dnsmasq-2.90-150400.16.6.2<>,gIp9| ʚR:O6yDTqr؈6SԨc7_Q׆ԣ.o@6,!kp~ (eԁ&I/dάyt$y[yjwHקf^JԲʗٶdi PSxh%5A E/ 4a NeuyN=;I tl[(:AKC FCNF/M$"*d9}$A}ShJ]gf[;8 $e>FH?8d   ; 5X^e= Q Tx\\ \ X\ \ &d\ &\(8\*\++\-d-!.8!1L!(1818928:6t8=>?@FG\Hh\I\XLYd\\]\^*bckdeflu \v|w\x\yxz4Cdnsmasq2.90150400.16.6.2DNS Forwarder and DHCP ServerDnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. The DNS subsystem supprots forwarding of all query types, and caching of common record types, DNSSEC included. The DHCP subsystem supports DHCPv4, DHCPv6, BOOTP and PXE. RA can be used stand-alone or in conjunction with DHCPv6.gIh04-ch1dESUSE Linux Enterprise 15SUSE LLC GPL-2.0-only OR GPL-3.0-onlyhttps://www.suse.com/Productivity/Networking/DNS/Servershttps://thekelleys.org.uk/dnsmasq/linuxx86_64 if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in dnsmasq.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi /usr/sbin/sysusers2shadow system-user-dnsmasq.conf <<"EOF" || [ -f /.buildenv ] u dnsmasq - "dnsmasq" /var/lib/empty - m dnsmasq tftp - - - EOF if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in dnsmasq.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi # reload dbus after install or upgrade to apply new policies if [ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemctl ]; then /usr/bin/systemctl reload dbus.service 2>/dev/null || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable dnsmasq.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop dnsmasq.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in dnsmasq.service ; do sysv_service="${service%.*}" rm -f "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart dnsmasq.service ) || : fi fi # reload dbus after uninstall, our policies are gone again if [ $1 -eq 0 -a -z "${TRANSACTIONAL_UPDATE}" \ -a -x /usr/bin/systemctl ]; then /usr/bin/systemctl reload dbus.service 2>/dev/null || : fin!-DЖks <-fEwlAlS"1Xe [=lh?^ P#  n!t.FK`r112aA큤A큤AA큤A큤A큤A큤A큤큤AA큤A큤AA큤A큤A큤A큤A큤A큤A큤A큤A큤A큤gIgIgIgIgIgIgIgIgIes[es[gIes[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[gIes[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[gIes[gIes[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[es[gIes[es[gIes[es[gIgIgIgIgIgIgIgIgIgIgIgIgI33d3d45450f1d89b8b50355b2cf0656dd5f2ad9fa37ca89e36d35338b9e50877972073229ed3c10179853e656a4c6c34b9cd477353a08687eac65fda03656207d439fdd491d1d850b359bf1d3874b086d2a811f65825672c9437eb5eaec6f94cb25f1317510ca07afd2dd6d72743fcdde9aa1da61818759dc415adaed0af31ea5a4c5b63c61cf51a3c879816717552feea5a8af766246b00549b780c3475885765b25dc51ba9fd414201ed8146f1d23af6c20c3feff364638f136759648d8a420f7ffd3ac280d05e9d5911ef9a276414d33dfc067feb02e2b43cf030ba4e3a811420061961c3a0fdba64576ad45749214ee836cd130cf04fdd33c4e4464bf404ca5b78c85afaf92bf423f74562311e87f3affc52fa07c42a593659d51db7b4c72c174d8ec4f11d8b168e308715b63e2f066fb8f3fa90f3a6c48bdcf285ae1a0c66d732a843e2ae4c8acb678d1fd3715362484eff6ab23877df608ac933bc9164e30dc229f359483f95f6af0a2d886a8f9870585380f7de906f462e1b46a76cf4a021a74cd3ba67985484c2e23381226820266ed6cc46ef657fc8a12f8333f4e02777e4eeb3440bd834286c258bba713905fcaf3eaf38f86a646be53f6f62e1df525ba862047b58c71c645ad3b9af10e54dbdbc2f75292c4dc08470b219a0a6b72f7c3bfb9c73d182acd7d8751c9c3fc1926db100f22dae0d0f71c98de090c78fed0ec432aeda33fbbab97b82b9d4eae3a1ded3710243beab2f344c6ca588949ba7fd5d2bd7858a440ca1a10e85c87c4af8d11aa02717ad4c823f17689112fc131e61ba13d73df9acbed61bf16c2590a39f2c8a681afc569851916f80df6c100497db11f354b4bd156d178f055e0e25e2cfcdd6ee95f1dd3bb10ff184f3ca90c8b4a2fdfc7a6dd0e11e02a5d4e45e36440250cdb1f77e3b592b470ad563d68e3d3f899c0c3fbaf6928dd0ecbab809e6f633382dbfbf33679feaa4fcdb121d3943c938e734286f2e0796c7eb67a135be6a5fede02fe749daaaebe3510d2b023f4ec1fd7ee969ba9f8340fbd8eb0bd0a829ca7f284f278facfe5988bec3a8b546a8656b204b48f0bd8c5df471d37cc08246023dcf813c189b17482a66b0df0b2535657218905ded9647c92a9dcb0efa632fb85a9bc01602838913cbc99398f8789ab3ede8429ad624596b6525a40248896790dbb549bf3a729bc9c086a253908808cd404f467ac923c398e89e29467519b740cff6bb1a842d56dd4a37bb4fc8384a8cbe71bf06395ac6bc6ff529e7238f89b08735eee3ff53b20552b23bfe8ac42dd20a519185c0ec606eac4e66e34020fd3703c8d4947cc73dfd13d473666f8f5c9fafe6be51614edf260539c9b47a46d955fc82d375eb30501eb17818a6ca5b21d0804b9a07ce1d0e0fbd58a736285a18713985817e2b408cb60e7f29ce0a115e0ea2a18d2b9609bffcf001131cebd7ef00827c33e91a94227387f55c2d1cbdb06060291ef0776544b35eb0817bfa1371302a691cba5d6a52ee3668b65984d08d6a28853b7e40fb0f71d741aaf87d0da18e688efd697c39eb884efb0807ff9ee1fc47e062f1077e108f1dc4eddf91d04a7db2ad23d07929e2c91e28e4997104dc4cf493104bdef53e05c105465f3314384deda5c8553c81088b789b350ac6f1fd52aee74521d39e8145a9d17c656c852c11cbe9069382b6f42ce3ec3f75cf060d9c98d4e1c4a33ec2d1325d57c47390cb46fd763aa1b30dd1c6b6ef813563cca1a1034e815282aa6265b2c9dc17d6b0df97874518db2515c073d16d845d13bcda98d196f00d6cacee33e78a2a8c56b2420902cf70c11bf3aeac54645c6bf093d85ad89524beeee4222c838354a43a29e747584b885a9f6288ee44747f80929c982e9fb863e933f682362933749abe46b6074226252dd68d09b3e86c26b1a77c0396fec5f060083f61900237d77f10604ea4d8e60ecff1bf4fae01f2d63d4a9865e94577c0c54e164dcb9324bfa2e6520a01b05f77899ac66105614b1582ff2445b8cb5eb2d16434e6c77fc760e98a8aaa3cc0df6695b91036505fe506b9b4f1891b01914b6ba8dc2696c1e6f75893d3337893124a44e2525018b4bfde9d858e11fed9db4f97eeb636244a5e1b5e93bd7423155ca3877211e916447a09843afccbd14385130a6d3e4101b049bf4f623c53e4a1ac9bfcc0471fe11d3f40478324732f9a89a5e2928dbd19ba1d8ba0a2535eb9b7ec047cad8002b955f27ff56a84df65b25dc51ba9fd414201ed8146f1d23af6c20c3feff364638f136759648d8a4233d3d45450f1d89b8b50355b2cf0656dd5f2ad9fa37ca89e36d35338b9e50877849369d66fe229ab2336ead75a3a4709d579241e7f568d3fbe33288d4426ee9ffd48fd3efe7741a470156a9b251d58145956dbefb61b638480b6cf04ce1885b18177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b8806438ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903fc68b5edbc182579ea8d617d6e9279f9a0075edd22225f79881976634f791fbea3fccc358f014b48f3507d603dc8604abfce56723bec5cb64c8dc1aa2192e38442c6e8cb473670be1934a8c1397c0ab969f122687f1088190082564eab9605b61d8c7597d5d758bb663c736755d6d9c5cbcd71b84f67ec47c18424ece96d68ddd37ee7123ec882d34497d330221af48de6688a358bce68a5783f3b81b71b08dda3684c6a4940e3219c505ad29794b849b3084d000c59561838985119edbefd2e808830a41204d27dc664ad5f13815e7eca266969e2c27f1361b525879bb7f670616434075fe28aa0366daeb84c15df2f89b140866981f8c3a40c315d30a18b8028cce53b2af67c53fee5b8615c94a1eadc63c88b2347d209ef2ed9490cc0d1ab5545373301f55dce38303be9045898fe78cb8d036044eb450a449babc0ec10187b869dbaf672f04cceeff53529339e32d0c3e6e889608c6541216a8ea39045963df6658d9fd68ec9799c946df1cb53b53cc2f91509d435eea0aefc2c68e0fb7fa7bde0c5095bb343a477a8b2cba04bb34e30e7947a55436a10fac57891dd1efbservicerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootdnsmasq-2.90-150400.16.6.2.src.rpmconfig(dnsmasq)dns_daemondnsmasqdnsmasq(x86-64)group(dnsmasq)user(dnsmasq) @@@@@@@@@@@@@@@@@@@@@@     /bin/sh/bin/sh/bin/sh/bin/shconfig(dnsmasq)libc.so.6()(64bit)libc.so.6(GLIBC_2.11)(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.28)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.7)(64bit)libc.so.6(GLIBC_2.9)(64bit)libdbus-1.so.3()(64bit)libdbus-1.so.3(LIBDBUS_1_3)(64bit)libgmp.so.10()(64bit)libhogweed.so.6()(64bit)libhogweed.so.6(HOGWEED_6)(64bit)libidn2.so.0()(64bit)libidn2.so.0(IDN2_0.0.0)(64bit)liblua5.3.so.5()(64bit)libnetfilter_conntrack.so.3()(64bit)libnettle.so.8()(64bit)libnettle.so.8(NETTLE_8)(64bit)libnftables.so.1()(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)sysuser-shadowuser(tftp)2.90-150400.16.6.23.0.4-14.6.0-14.0-15.2-13.24.14.3gQge̫@e)1@d_{dGcc@cY!@c*b@bL/@a@@apaLl@aD@a@`@`r`}p`!'`U`_ @^U@]Y]@]o@]6]%@\\o@\HW@[ͻ[j@[@[[LZ%8Z!D@Y*@Y@YXlWWbV@U@UUa@U4@T@TB@T@TT_W@max@suse.comlukasstraub2@web.demax@suse.comkukuk@suse.comgmbr3@opensuse.orgmax@suse.cominfo@paolostivanin.comdmueller@suse.comdmueller@suse.comgmbr3@opensuse.orggmbr3@opensuse.orgmax@suse.commax@suse.comgmbr3@opensuse.orgmax@suse.commax@suse.comjsegitz@suse.comgmbr3@opensuse.orggmbr3@opensuse.orgmax@suse.comdmueller@suse.comgmbr3@opensuse.orgmax@suse.commrey@suse.cominfo@paolostivanin.comdimstar@opensuse.orgmax@suse.comstefan.bruens@rwth-aachen.dematthias.gerstner@suse.comjslaby@suse.comdimstar@opensuse.orgfbui@suse.comcrrodriguez@opensuse.orgjengelh@inai.desean@suspend.netcgoll@suse.comdmueller@suse.comkukuk@suse.deidonmez@suse.comcbosdonnat@suse.commax@suse.comtchvatal@suse.comdmueller@suse.commartin.wilck@suse.commax@suse.commax@suse.commpluskal@suse.comstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.decrrodriguez@opensuse.orgabergmann@suse.comjslaby@suse.comdimstar@opensuse.orgnemysis@gmx.chnemysis@gmx.chseife+obs@b1-systems.com- bsc#1235834: Don't let compile time options change silently. - Use pkgconfig for libidn2. - Disable --nftset for SLE-15-SP3 and older. - bsc#1235517: Reintroduce nogroup for SLE-15-SP3 and older.- Enable --nftset support- update to 2.90: * CVE-2023-50387, CVE-2023-50868, bsc#1219823, bsc#1219826: Denial Of Service while trying to validate specially crafted DNSSEC responses * CVE-2023-49441, bsc#1226091: integer overflow via forward_query * Fix reversion in --rev-server introduced in 2.88 which caused breakage if the prefix length is not exactly divisible by 8 (IPv4) or 4 (IPv6). * Fix possible SEGV when there server(s) for a particular domain are configured, but no server which is not qualified for a particular domain. * Set the default maximum DNS UDP packet sice to 1232. Obsoletes: dnsmasq-CVE-2023-28450.patch * Add --no-dhcpv4-interface and --no-dhcpv6-interface for better control over which inetrfaces are providing DHCP service. * Fix issue with stale caching * Add configurable caching for arbitrary RR-types. * Add --filter-rr option, to filter arbitrary RR-types.- SLP got dropped, remove config (bsc#1214884)- Correct rundir from /var/run to /run for pid file- bsc#1209358, CVE-2023-28450, dnsmasq-CVE-2023-28450.patch: default maximum EDNS.0 UDP packet size should be 1232- update to 2.89: * Fix bug introduced in 2.88 (commit fe91134b) which can result in corruption of the DNS cache internal data structures and logging of "cache internal error". This has only been seen in one place in the wild, and it took considerable effort to even generate a test case to reproduce it, but there's no way to be sure it won't strike, and the effect is to break the cache badly. Installations with DNSSEC enabled are more likely to see the problem, but not running DNSSEC does not guarantee that it won't happen. Thanks to Timo van Roermund for reporting the bug and for his great efforts in chasing it down. (boo#1207174) - remove no longer needed rpmlintrc filters- update to 2.88: * Fix bug in --dynamic-host when an interface has /16 IPv4 * address. * Add --fast-dns-retry option. This gives dnsmasq the ability to originate retries for upstream DNS queries itself, rather than relying on the downstream client. This is most useful when doing DNSSEC over unreliable upstream networks. It comes with some cost in memory usage and network bandwidth. * Add --use-stale-cache option. When set, if a DNS name exists in the cache, but its time-to-live has expired, dnsmasq will return the data anyway. * handle removal of whole files or entries within files.- update to 2.87 (bsc#1197872, CVE-2022-0934): * Allow arbitrary prefix lengths in --rev-server and - -domain=....,local * Replace --address=/#/..... functionality which got missed in the 2.86 domain search rewrite. * Add --nftset option, like --ipset but for the newer nftables. * Add --filter-A and --filter-AAAA options, to remove IPv4 or IPv6 addresses from DNS answers. * Fix crash doing netbooting when --port is set to zero to disable the DNS server. Thanks to Drexl Johannes for the bug report. * Generalise --dhcp-relay. Sending via broadcast/multicast is now supported for both IPv4 and IPv6 and the configuration syntax made easier (but backwards compatible). * Add snooping of IPv6 prefix-delegations to the DHCP-relay system. * Finesse parsing of --dhcp-remoteid and --dhcp-subscrid. To be treated as hex, the pattern must consist of only hex digits AND contain at least one ':'. Thanks to Bengt-Erik Sandstrom who tripped over a pattern consisting of a decimal number which was interpreted surprisingly. * Include client address in TFTP file-not-found error reports. Thanks to Stefan Rink for the initial patch, which has been re-worked by me (srk). All bugs mine. * Note in manpage the change in behaviour of -address. This behaviour actually changed in v2.86, but was undocumented there. From 2.86 on, (eg) --address=/example.com/1.2.3.4 ONLY applies to A queries. All other types of query will be sent upstream. Pre 2.86, that would catch the whole example.com domain and queries for other types would get a local NODATA answer. The pre-2.86 behaviour is still available, by configuring --address=/example.com/1.2.3.4 --local=/example.com/ * Fix problem with binding DHCP sockets to an individual interface. Despite the fact that the system call tales the interface _name_ as a parameter, it actually, binds the socket to interface _index_. Deleting the interface and creating a new one with the same name leaves the socket bound to the old index. (Creating new sockets always allocates a fresh index, they are not reused). We now take this behaviour into account and keep up with changing indexes. * Add --conf-script configuration option. * Enhance --domain to accept, for instance, - -domain=net2.thekelleys.org.uk,eth2 so that hosts get a domain which relects the interface they are attached to in a way which doesn't require hard-coding addresses. Thanks to Sten Spans for the idea. * Fix write-after-free error in DHCPv6 server code. CVE-2022-0934 refers. * Add the ability to specify destination port in DHCP-relay mode. This change also removes a previous bug where --dhcp-alternate-port would affect the port used to relay _to_ as well as the port being listened on. The new feature allows configuration to provide bug-for-bug compatibility, if required. Thanks to Damian Kaczkowski for the feature suggestion. * Bound the value of UDP packet size in the EDNS0 header of forwarded queries to the configured or default value of edns-packet-max. There's no point letting a client set a larger value if we're unable to return the answer. Thanks to Bertie Taylor for pointing out the problem and supplying the patch. - drop dnsmasq-CVE-2022-0934.patch, dnsmasq-resolv-conf.patch (upstream)- Ensure the dnsmasq user's group is used - Remove nogroup requirement- Move the dbus-1 system.d file to /usr (bsc#1200344)- bsc#1197872, CVE-2022-0934, dnsmasq-CVE-2022-0934.patch: Heap use after free in dhcp6_no_relay- bsc#1192529, dnsmasq-resolv-conf.patch: Fix a segfault when re-reading an empty resolv.conf - Remove "nogroup" membership from the dnsmasq user.- Use systemd-sysusers from 15.3 onwards- jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1. - SLE bugs that got fixed upstream between 2.79 and 2.86, but for which we need to keep references when syncing: * bsc#1176076: dnsmasq-servfail.patch * bsc#1156543: dnsmasq-siocgstamp.patch * bsc#1138743: dnsmasq-cache-size.patch * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch * bsc#1180914: Open inotify socket only when used. * removed dnsmasq-dnspooq.patch - bsc#1173646, CVE-2020-14312: Set --local-service by default.- Update to 2.86: * Handle DHCPREBIND requests in the DHCPv6 server code. * Fix bug which caused dnsmasq to lose track of processes forked to handle TCP DNS connections under heavy load. * Major rewrite of the DNS server and domain handling code. This should be largely transparent, but it drastically improves performance and reduces memory foot-print when configuring large numbers of domains. * Revise resource handling for number of concurrent DNS queries. * Improve efficiency of DNSSEC. * Connection track mark based DNS query filtering. * Allow smaller than 64 prefix lengths in synth-domain, with caveats. - -synth-domain=1234:4567::/56,example.com is now valid. * Make domains generated by --synth-domain appear in replies when in authoritative mode. * Ensure CAP_NET_ADMIN capability is available when conntrack is configured. * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are given a directory as argument, define the order in which files within that directory are read (alphabetical order of filename).- Added hardening to systemd service(s) (bsc#1181400).- Add now working CONFIG parameter to sysusers generator- Change to using systemd-sysusers on TW- Update to 2.85: * Fix problem with DNS retries in 2.83/2.84. * Tweak sort order of tags in get-version. * Avoid treating a --dhcp-host which has an IPv6 address as eligible for use with DHCPv4 on the grounds that it has no address, and vice-versa. * Add --dynamic-host option: A and AAAA records which take their network part from the network of a local interface. Useful for routers with dynamically prefixes. * Teach --bogus-nxdomain and --ignore-address to take an IPv4 subnet. * CVE-2021-3448, bsc#1183709: Use random source ports where possible if source addresses/interfaces in use. * Change the method of allocation of random source ports for DNS. * Scale the size of the DNS random-port pool based on the value of the --dns-forward-max configuration. * Tweak TFTP code to check sender of all received packets, as specified in RFC 1350 para 4.- update to 2.84: * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH * Tidy initialisation in hash_questions.c * Optimise sort_rrset for the case where the RR type * Move fd into frec_src- Fix building with lua54- Update to 2.83: * bsc#1177077: Fixed DNSpooq vulnerabilities * Use the values of --min-port and --max-port in outgoing TCP connections to upstream DNS servers. * Fix a remote buffer overflow problem in the DNSSEC code. Any dnsmasq with DNSSEC compiled in and enabled is vulnerable to this, referenced by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683 CVE-2020-25687. * Be sure to only accept UDP DNS query replies at the address from which the query was originated. This keeps as much entropy in the {query-ID, random-port} tuple as possible, to help defeat cache poisoning attacks. Refer: CVE-2020-25684. * Use the SHA-256 hash function to verify that DNS answers received are for the questions originally asked. This replaces the slightly insecure SHA-1 (when compiled with DNSSEC) or the very insecure CRC32 (otherwise). Refer: CVE-2020-25685 * Handle multiple identical near simultaneous DNS queries better. Previously, such queries would all be forwarded independently. This is, in theory, inefficent but in practise not a problem, _except_ that is means that an answer for any of the forwarded queries will be accepted and cached. An attacker can send a query multiple times, and for each repeat, another {port, ID} becomes capable of accepting the answer he is sending in the blind, to random IDs and ports. The chance of a succesful attack is therefore multiplied by the number of repeats of the query. The new behaviour detects repeated queries and merely stores the clients sending repeats so that when the first query completes, the answer can be sent to all the clients who asked. Refer: CVE-2020-25686.- Update to 2.82: * Improve behaviour in the face of network interfaces which come and go and change index. * Convert hard startup failure on NETLINK_NO_ENOBUFS under qemu-user to a warning. * Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in - -dhcp-option. * Fix crash under heavy TCP connection load introduced in 2.81. * Change default lease time for DHCPv6 to one day. * Alter calculation of preferred and valid times in router advertisements, so that these do not have a floor applied of the lease time in the dhcp-range if this is not explicitly specified and is merely the default. - Reformat spec file with spec-cleaner- Update to 2.81: * Improve cache behaviour for TCP connections * Remove the NO_FORK compile-time option, and support for uclinux * Fix line-counting when reading /etc/hosts and friends * Fix bug in DNS non-terminal code, added in 2.80, which could sometimes cause a NODATA rather than an NXDOMAIN reply. * Support TCP-fastopen (RFC-7413) on both incoming and outgoing TCP connections, if supported and enabled in the OS. * Improve kernel-capability manipulation code under Linux * Add --shared-network config. This enables allocation of addresses by the DHCP server in subnets where the server (or relay) does not have an interface on the network in that subnet. Many thanks to kamp.de for sponsoring this feature. * Fix broken contrib/lease_tools/dhcp_lease_time.c. A packet validation check got borked in commit 2b38e382 and release 2.80. Thanks to Tomasz Szajner for spotting this. * Fix compilation against nettle version 3.5 and later. * Fix spurious DNSSEC validation failures when the auth section of a reply contains unsigned RRs from a signed zone, with the exception that NSEC and NSEC3 RRs must always be signed. Thanks to Tore Anderson for spotting and diagnosing the bug. * Add --dhcp-ignore-clid. This disables reading of DHCP client identifier option (option 61), so clients are only identified by MAC addresses. * Fix a bug which stopped --dhcp-name-match from working when a hostname is supplied in --dhcp-host. Thanks to James Feeney for spotting this. * Fix bug which caused very rarely caused zero-length DHCPv6 packets. Thanks to Dereck Higgins for spotting this. * Add --tftp-single-port option. * Enhance --conf-dir to load files in a deterministic order * Add filtering by tag of --dhcp-host directives * Remove DSA signature verification from DNSSEC, as specified in RFC 8624 * Add --script-on-renewal option. - Remove Fix-build-with-libnettle-3.5.patch - Remove 0001-fix-build-after-y2038-changes-in-glibc.patch - Remove dnsmasq-CVE-2019-14834.patch- Remove redundant %else without meaning (if/else/else/endif?)- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch: memory leak in the create_helper() function in /src/helper.c - bsc#1143454: Require user(tftp) instead of creating it ourselves. - Package contrib/lease-tools/dhcp_release6. - bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .- Add Fix-build-with-libnettle-3.5.patch- removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by firewalld, see [1]. [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html- add 0001-fix-build-after-y2038-changes-in-glibc.patch- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to shortcut the build queues by allowing usage of systemd-mini- Drop use of $FIRST_ARG in .spec The use of $FIRST_ARG was probably required because of the %service_* rpm macros were playing tricks with the shell positional parameters. This is bad practice and error prones so let's assume that no macros should do that anymore and hence it's safe to assume that positional parameters remains unchanged after any rpm macro call.- libidn should not be used anymore, switch to libidn2- Ensure neutrality of descriptions. / Replace description with new upstream description. - Do not hide failures from user/group additions. - Replace old $RPM_* shell vars by macros.- Updated to dnsmasq 2.80 * Add support for RFC 4039 DHCP rapid commit * Alter the default for dnssec-check-unsigned * Fix DHCP when --no-ping and --dhcp-sequential-ip are set * Allow zone transfer in authoritative mode if auth-peer is specified * FIx missing fatal errors with some malformed options * Fix crash on startup with a --synth-domain which has no prefix- enabled lua scripting interface (FATE#327143).- add missing prereq on the group to be created (bsc#1106446)- Don't require systemd explicit, fix spec file to handle both cases correct. In containers we don't have systemd. - Adjust pre/post install for transactional updates. - Use %license instead of %doc [bsc#1082318]- Update keyring- Get rid of python dependency due to examples. (fate#323526)- Security update to version 2.78: * bsc#1060354, CVE-2017-14491: 2 byte heap based overflow. * bsc#1060355, CVE-2017-14492: heap based overflow. * bsc#1060360, CVE-2017-14493: stack based overflow. * bsc#1060361, CVE-2017-14494: DHCP - info leak. * bsc#1060362, CVE-2017-14495: DNS - OOM DoS. * bsc#1060364, CVE-2017-14496: DNS - DoS Integer underflow. * Fix DHCP relaying, broken in 2.76 and 2.77. * For other changes, see http://www.thekelleys.org.uk/dnsmasq/CHANGELOG - Obsoleted patches: * Fix-crash-introduced-in-2675f2061525bc954be14988d643.patch * Handle-binding-upstream-servers-to-an-interface.patch- Fix /srv/tftpboot permissions wrt bsc#940608- reload system dbus to pick up policy change on install (bsc#1054429)- Handle binding upstream servers to an interface if interface is destroyed and recreated (boo#1018160) Added two patches from upstream: * added Handle-binding-upstream-servers-to-an-interface.patch * added Fix-crash-introduced-in-2675f2061525bc954be14988d643.patch- Update to 2.76: * Include 0.0.0.0/8 in DNS rebind checks. * Enhance --add-subnet to allow arbitrary subnet addresses. * Respect the --no-resolv flag in inotify code. Fixes bug which caused dnsmasq to fail to start if a resolv-file was a dangling symbolic link, even of --no-resolv set. * Fix crash when an A or AAAA record is defined locally, in a hosts file, and an upstream server sends a reply that the same name is empty (CVE-2015-8899, bsc#983273). * Fix failure to correctly calculate cache-size when reading a hosts-file fails. * Fix wrong answer to simple name query when --domain-needed set, but no upstream servers configured. * Return REFUSED when running out of forwarding table slots, not SERVFAIL. * Add --max-port configuration. * Add --script-arp and two new functions for the dhcp-script. * Extend --add-mac to allow a new encoding of the MAC address as base64, by configurting --add-mac=base64 * Add --add-cpe-id option. * Don't crash with divide-by-zero if an IPv6 dhcp-range is declared as a whole /64. (ie xx::0 to xx::ffff:ffff:ffff:ffff) * Add support for a TTL parameter in --host-record and --cname. * Add --dhcp-ttl option. * Add --tftp-mtu option. * Check return-code of inet_pton() when parsing dhcp-option. * Fix wrong value for EDNS UDP packet size when using - -servers-file to define upstream DNS servers. * Add dhcp_release6 to contrib/lease-tools.- dnsmasq-groups.patch: Initialize the supplementary groups of the dnsmasq user (bsc#859298).- Add gpg signature- spec file cleanup, get rid of redifinition warnings- Update to 2.75, announce message: Fix reversion on 2.74 which caused 100% CPU use when a dhcp-script is configured. Thanks to Adrian Davey for reporting the bug and testing the fix. - Update to 2.74, announce message: Fix reversion in 2.73 where --conf-file would attempt to read the default file, rather than no file. Fix inotify code to handle dangling symlinks better and not SEGV in some circumstances. DNSSEC fix. In the case of a signed CNAME generated by a wildcard which pointed to an unsigned domain, the wrong status would be logged, and some necessary checks omitted. - Update to 2.73, announce message: Fix crash at startup when an empty suffix is supplied to - -conf-dir, also trivial memory leak. Thanks to Tomas Hozza for spotting this. Remove floor of 4096 on advertised EDNS0 packet size when DNSSEC in use, the original rationale for this has long gone. Thanks to Anders Kaseorg for spotting this. Use inotify for checking on updates to /etc/resolv.conf and friends under Linux. This fixes race conditions when the files are updated rapidly and saves CPU by noy polling. To build a binary that runs on old Linux kernels without inotify, use make COPTS=-DNO_INOTIFY Fix breakage of --domain=,,local - only reverse queries were intercepted. THis appears to have been broken since 2.69. Thanks to Josh Stone for finding the bug. Eliminate IPv6 privacy addresses and deprecated addresses from the answers given by --interface-name. Note that reverse queries (ie looking for names, given addresses) are not affected. Thanks to Michael Gorbach for the suggestion. Fix crash in DNSSEC code with long RRs. Thanks to Marco Davids for the bug report. Add --ignore-address option. Ignore replies to A-record queries which include the specified address. No error is generated, dnsmasq simply continues to listen for another reply. This is useful to defeat blocking strategies which rely on quickly supplying a forged answer to a DNS request for certain domains, before the correct answer can arrive. Thanks to Glen Huang for the patch. Revisit the part of DNSSEC validation which determines if an unsigned answer is legit, or is in some part of the DNS tree which should be signed. Dnsmasq now works from the DNS root downward looking for the limit of signed delegations, rather than working bottom up. This is both more correct, and less likely to trip over broken nameservers in the unsigned parts of the DNS tree which don't respond well to DNSSEC queries. Add --log-queries=extra option, which makes logs easier to search automatically. Add --min-cache-ttl option. I've resisted this for a long time, on the grounds that disbelieving TTLs is never a good idea, but I've been persuaded that there are sometimes reasons to do it. (Step forward, GFW). To avoid misuse, there's a hard limit on the TTL floor of one hour. Thansk to RinSatsuki for the patch. Cope with multiple interfaces with the same link-local address. (IPv6 addresses are scoped, so this is allowed.) Thanks to Cory Benfield for help with this. Add --dhcp-hostsdir. This allows addition of new host configurations to a running dnsmasq instance much more cheaply than having dnsmasq re-read all its existing configuration each time. Don't reply to DHCPv6 SOLICIT messages if we're not configured to do stateful DHCPv6. Thanks to Win King Wan for the patch. Fix broken DNSSEC validation of ECDSA signatures. Add --dnssec-timestamp option, which provides an automatic way to detect when the system time becomes valid after boot on systems without an RTC, whilst allowing DNS queries before the clock is valid so that NTP can run. Thanks to Kevin Darbyshire-Bryant for developing this idea. Add --tftp-no-fail option. Thanks to Stefan Tomanek for the patch. Fix crash caused by looking up servers.bind, CHAOS text record, when more than about five --servers= lines are in the dnsmasq config. This causes memory corruption which causes a crash later. Thanks to Matt Coddington for sterling work chasing this down. Fix crash on receipt of certain malformed DNS requests. Thanks to Nick Sampanis for spotting the problem. Note that this is could allow the dnsmasq process's memory to be read by an attacker under certain circumstances, so it has a CVE, CVE-2015-3294 Fix crash in authoritative DNS code, if a .arpa zone is declared as authoritative, and then a PTR query which is not to be treated as authoritative arrived. Normally, directly declaring .arpa zone as authoritative is not done, so this crash wouldn't be seen. Instead the relevant .arpa zone should be specified as a subnet in the auth-zone declaration. Thanks to Johnny S. Lee for the bugreport and initial patch. Fix authoritative DNS code to correctly reply to NS and SOA queries for .arpa zones for which we are declared authoritative by means of a subnet in auth-zone. Previously we provided correct answers to PTR queries in such zones (including NS and SOA) but not direct NS and SOA queries. Thanks to Johnny S. Lee for pointing out the problem. Fix logging of DHCPREPLY which should be suppressed by quiet-dhcp6. Thanks to J. Pablo Abonia for spotting the problem. Try and handle net connections with broken fragmentation that lose large UDP packets. If a server times out, reduce the maximum UDP packet size field in the EDNS0 header to 1280 bytes. If it then answers, make that change permanent. Check IPv4-mapped IPv6 addresses when --stop-rebind is active. Thanks to Jordan Milne for spotting this. Allow DHCPv4 options T1 and T2 to be set using --dhcp-option. Thanks to Kevin Benton for patches and work on this. Fix code for DHCPCONFIRM DHCPv6 messages to confirm addresses in the correct subnet, even of not in dynamic address allocation range. Thanks to Steve Hirsch for spotting the problem. Add AddDhcpLease and DeleteDhcpLease DBus methods. Thanks to Nicolas Cavallari for the patch. Allow configuration of router advertisements without the "on-link" bit set. Thanks to Neil Jerram for the patch. Extend --bridge-interface to DHCPv6 and router advertisements. Thanks to Neil Jerram for the patch.- dnsmasq.service: Order Before=nss-lookup.target and Wants=nss-lookup.target as this service may provide name resolution even for the localhost.- Move trust-anchors.conf into /etc/dnsmasq.d to be AppArmor conform. (bnc#908137)- The change from Wed Dec 24 messed group w/ user IDs. Switch them back and be more careful w/ what is changed.- Fix symlink of rcFOO to /usr/sbin/service, resolving a dangling symlink lint warning (and remove the same from rpmlintrc).- Remove from spec group_and_isc.patch, forgotten in previous commit- Update to 2.72, announce message: Add ra-advrouter mode, for RFC-3775 mobile IPv6 support. Add support for "ipsets" in *BSD, using pf. Thanks to Sven Falempim for the patch. Fix race condition which could lock up dnsmasq when an interface goes down and up rapidly. Thanks to Conrad Kostecki for helping to chase this down. Add DBus methods SetFilterWin2KOption and SetBogusPrivOption Thanks to the Smoothwall project for the patch. Fix failure to build against Nettle-3.0. Thanks to Steven Barth for spotting this and finding the fix. When assigning existing DHCP leases to intefaces by comparing networks, handle the case that two or more interfaces have the same network part, but different prefix lengths (favour the longer prefix length.) Thanks to Lung-Pin Chang for the patch. Add a mode which detects and removes DNS forwarding loops, ie a query sent to an upstream server returns as a new query to dnsmasq, and would therefore be forwarded again, resulting in a query which loops many times before being dropped. Upstream servers which loop back are disabled and this event is logged. Thanks to Smoothwall for their sponsorship of this feature. Extend --conf-dir to allow filtering of files. So - -conf-dir=/etc/dnsmasq.d,\*.conf will load all the files in /etc/dnsmasq.d which end in .conf Fix bug when resulted in NXDOMAIN answers instead of NODATA in some circumstances. Fix bug which caused dnsmasq to become unresponsive if it failed to send packets due to a network interface disappearing. Thanks to Niels Peen for spotting this. Fix problem with --local-service option on big-endian platforms Thanks to Richard Genoud for the patch. - Add dnsmasq-rpmlintrc, for false positive scripts and symlink - Add BuildRequires for dos2unix - Use sed instead of simple patch group_and_isc.patch- fix logging, PrivateDevices=yes kills it (bnc#902511, bnc#904537)/bin/sh/bin/sh/bin/sh/bin/shh04-ch1d 1737640412  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\deesfifriditnbplptroesfr2.90-150400.16.6.22.90-150400.16.6.22.90-150400.16.6.2      !"#$%&'()dnsmasq.confdnsmasq.dtrust-anchors.confdnsmasq.servicesystem-user-dnsmasq.confdnsmasqrcdnsmasqdnsmasq.confdnsmasqCHANGELOGFAQcontribCPE-WANREADMEconntrackREADMEdbus-testdbus-test.pydns-locREADMEdnsmasq2-loc-rfc1876.patchdnslistdhcp.cssdnslist.pldnslist.tt2dynamic-dnsmasqdynamic-dnsmasq.pllease-accessREADMElease.access.patchlease-toolsMakefiledhcp_lease_time.1dhcp_lease_time.cdhcp_release.1dhcp_release.cdhcp_release6.1dhcp_release6.cmactablemacscriptopenvpnREADMEdhclient-enter-hooksdnsmasq.patchport-forwarddnsmasq-portforwardportforwardreverse-dnsREADMEreverse_replace.shstatic-arpstatic-arpsystemdREADMEdbus_activationdnsmasq.servicetry-all-nsREADMEREADME-2.47README-2.78dnsmasq-2.35-try-all-ns.patchdnsmasq-2.47_no_nxdomain_until_end.patchdnsmasq-2.68-try-all-nsdnsmasq-2.78xx-try-all-ns.patchwebminREADMEdnsmasq.wbmwrtREADMElease_update.shdbusDBus-interfacednsmasq.confdnsmasq.conf.exampledoc.htmlsetup.htmldnsmasqCOPYINGCOPYING-v3dnsmasq.modnsmasq.modnsmasq.modnsmasq.modnsmasq.modnsmasq.modnsmasq.modnsmasq.modnsmasq.modnsmasq.modnsmasq.8.gzdnsmasq.8.gzdnsmasq.8.gz/etc//etc/dnsmasq.d//usr/lib/systemd/system//usr/lib/sysusers.d//usr/sbin//usr/share/dbus-1/system.d//usr/share/doc/packages//usr/share/doc/packages/dnsmasq//usr/share/doc/packages/dnsmasq/contrib//usr/share/doc/packages/dnsmasq/contrib/CPE-WAN//usr/share/doc/packages/dnsmasq/contrib/conntrack//usr/share/doc/packages/dnsmasq/contrib/dbus-test//usr/share/doc/packages/dnsmasq/contrib/dns-loc//usr/share/doc/packages/dnsmasq/contrib/dnslist//usr/share/doc/packages/dnsmasq/contrib/dynamic-dnsmasq//usr/share/doc/packages/dnsmasq/contrib/lease-access//usr/share/doc/packages/dnsmasq/contrib/lease-tools//usr/share/doc/packages/dnsmasq/contrib/mactable//usr/share/doc/packages/dnsmasq/contrib/openvpn//usr/share/doc/packages/dnsmasq/contrib/port-forward//usr/share/doc/packages/dnsmasq/contrib/reverse-dns//usr/share/doc/packages/dnsmasq/contrib/static-arp//usr/share/doc/packages/dnsmasq/contrib/systemd//usr/share/doc/packages/dnsmasq/contrib/try-all-ns//usr/share/doc/packages/dnsmasq/contrib/webmin//usr/share/doc/packages/dnsmasq/contrib/wrt//usr/share/doc/packages/dnsmasq/dbus//usr/share/licenses//usr/share/licenses/dnsmasq//usr/share/locale/de/LC_MESSAGES//usr/share/locale/es/LC_MESSAGES//usr/share/locale/fi/LC_MESSAGES//usr/share/locale/fr/LC_MESSAGES//usr/share/locale/id/LC_MESSAGES//usr/share/locale/it/LC_MESSAGES//usr/share/locale/nb/LC_MESSAGES//usr/share/locale/pl/LC_MESSAGES//usr/share/locale/pt_BR/LC_MESSAGES//usr/share/locale/ro/LC_MESSAGES//usr/share/man/es/man8//usr/share/man/fr/man8//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:37161/SUSE_SLE-15-SP4_Update/da196edb312e24d64cf62d3a25f0424b-dnsmasq.SUSE_SLE-15-SP4_Updatedrpmxz5x86_64-suse-linux      ASCII textdirectoryELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=b06959b6153aa278ec9b0ec5d79aa238f29e63fa, strippedexported SGML document, ASCII textUTF-8 Unicode textPython script, ASCII text executableunified diff output, ASCII textPerl script text executableHTML document, ASCII textmakefile script, ASCII texttroff or preprocessor input, ASCII textC source, ASCII textBourne-Again shell script, ASCII text executableASCII text, with CRLF line terminatorsa /bin/dash script, ASCII text executablePOSIX shell script, ASCII text executablePOSIX tar archive (GNU)HTML document, UTF-8 Unicode texttroff or preprocessor input, ISO-8859 text, with very long lines (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)troff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)PPRRRRRR RR R R R RRRRRRRRRRRϷ=utf-80838ca1c3e1e6065597044a7b1af7051422f82b7f025a9da5fc9dd40fedf0b16?7zXZ !t/@j]"k%w uӿ8`Z(f:|-ƘAt` 1xb*kgfbn6䝿{ZzPR:P\Gn!;*Rѱ1[l͠$!bF>rn$EthzU7Ǒh^ͫAI<b|t;/0c;i*8hE>b?,4R{i%:>"dpmUK=t, ŵj.%/N"zhbom$;IГ* ).܌Czsc[4ْǞ ACn(nuMIR`?@of #_,5-}$1'2/f/K}\[蜼 P4~/)NL5pwzK5$ N5Tiq2}> wNlE3F-S;%PWo䶴ǏbLHWiBX@ k !,qݽ)::j+8FNZJn шrLa`™/7ڎ_?Fk3ǽ6I%dIvP1Aq61-&om'A6j[;F;rp~"XJ[\?09nw>8r>Ll\vYh|G9 ‡]?VL!Bq.<̘{7/-eXdN5PJ.濅f8d*LZ51C4T'ڡv33 v&%/(4XiG4 6zggq9ش&ϰF]zӈ68-Q!7K6W]VoYtUTQzT~ru2_bAT-$%|aeKFl8L7}Y"6Osd[8vUpgWH ˥]M{X*Su3fth фj-eiCP`LVEhZ3:D+'k_D9:W |V#C3YjMi$p=M6 T=ʖ)hxGi#OunNF;tՈ"b09AH5T_6ǃʮY$dwu=fWQ?Gy$,\-݄Ep*ߜS&I>hS2#'\Ng}hN= jqʘ=T8Yuʂ#DC QVUm˟p[VAǕn#6=OhDز-; Jƶ "Bm}kcSgךjk9B4adϢ=o[jRT]iP[Mӓ̿l7AkYyKu@'x8rBPVU/<@_QkXyunwΥ&\;$d5ͬL<^C"E@H\ȇa ,6ñQw9~jELB!Ɗ1${ER!?zfRLq?dz PI( V V} E][|~TȤx3pGPm |a6wpMlEN@x)+ Q#4ͽS ܟ ^7$= ݱ8>MTqTD,lisWI̗.䈍.A(VwO n2]g4K(!.k+QR+ԐaY|ˑ/jL6͓ Z9ÝON}YSx6c"&ڭ{V J-#Ų =z|%b`pTp݊!RL[heDf{|QV4"<4q+6=J;BLh,㠠\4tӭc M'#Њ5!\A$i?J< z>">tW]av\1e]*HD:\pptz" zZe0g+9oNaE;6-yPDB&DP}@LcĦs;[4ݴFLGncQj=-gIj Uk$3󛉱!/&b: ʻJ'쭽s*!O 9",*%VME\D(.2g128 1X̝DήhvO>MZZazŜ XZurcXŅ6K:FrF^o44RȻVa; 1 CHf8yT`s%ًjc4rQQ`!`+3JP]xZD~Y$x~/O<wKt6FskTC_ˣ"7qw& :6%HÜOǖ6^!װF/9iқ Ka&Edx̦-\M,߃o'亩(u/A9ɐu ȉF#I/L [|JK1MD{}%7;dA^ Τ\As f3$if]-'uA(Fd SsҊ{3P {0-+q.֝/CW%yii#\)`\AIk@`WY$`WڈgrXN>R+Er|Gʺ{xx+a1S- ޭB<<QwyIvJ6E0Sw\on<9dq@ 8#=ok" `P̩auZO kφ$WxHXv*Ho@a2BA 1NC}Enxʚ)>-D W#Ei)?bT\_Bs:כ1Gh% h)L[8( ˝B czZ6w?SRgV/ L)ZxD?ˆ}qh>Z T5j؁`@Q!+* m,Y+O^P$=S@hdk5`#+&}Ve3tժ$ nS(B݋#_/ɤ@x%]H>eEqsvIlf'劉 *٬+Qx0_ϝX}lGЅkKJ<Z#) 8.p r2?Pwl cXJvIJtM!h|~JR ̥n7;ao$#N5w}Je ^U-4Hn<&S mޏKƢHw9`~fǣ>k[{<)$ȼѠ!~Hz2 TB:ҍx&Dž! [rAH.@ [D_|AF%]_!_h?n68$fC916MD\SG{eoYMnMԤV|uw(v;$ ? SsC&1 O^NͨfzOݺux &H[ƴ.# K ``TуoneY*0A0{o*D֥V,9aB 4qSk%B͊?WADseAOhʗ {i >`$Qѭ-;Aaj/ǀ!e+3 hط`7X&d)=4 # ^&em *$aYWRc(iVF[ͤԵen#i|"'"+G<>>o EUlY ϬL6=5\xmﲁ̉5g(\F^ Jh\©(2[2`f9W7}wri Jpfˁ)LۋTZY;|wZř5޹+UMĬM*t <WUf\bEZc }.'11QV\8d@#m<zIIȐ( #x 3)'t]7gὝ]ITvw- w  wGTZ}9}OIszG4Y&wBw󶝖=/2of\gQ?݊ oN6' l ĤϘ@m+x. `T(TRi`1fnTExmnc|`[HpjEW?҈wI;FMD k;,)zՃǣ'HBD x-,@wmrKcGRFlnY;Gt|ʃ5@KƗ)Z,XkF?4*kZ2N_yӦIfu"z jl;g15;LʱR =l))iaR :vKQeT!zcRԤG|ÔK&qѻvF['LRViE4/ <]vcTamd +`EpE6&P$!QmWcJvIaAot7 'YGLv L/sO?Fm$ y}]hգQ$kD d|}bkxFu֎b ,V ݸ\eu(5 mg!7_Hq3hwg "e_eFk>{]f0 Ja]yTR}I0inaɇvjlUH.X#M uRi3/$HD\Mw6MT/; 2kU[pw^@b{#)?- 68н \]R]H}|~џe3Y9nt<0,W*B37,]Xz50΍P$=DKQqF毈10Ǐ/r9V1NmϞ^ni,@*q.5"̆D.:T53Ye1@@oȸx;g޲1-uBot+Ƅ\Od$ huƒ+HELW^(TIi/0nѶER{\B"/\6aJ&m 쇈9nxWf!<`g_G5lM^CwXň-#:{˘-&9N뿟F-bDka-xܪ\W ucM. +F ,Q-+*2(knϛ6vFC y툉s>kMj+{scR`WyttVRCqgQ*`1edi"`kbvQW#T+9߀T|)3κSW⁦K4_ONM4͸dToۣ T;.en ªN+U܄C^ |Z1GX䖴[L74^K<% sX7>kRC,cGYDC۳K1;rī4LcaSyPWbZTxeBg+nĕgU7OG_+tMߦ 1{|!#Ndj O1l(ÝG/rq@8U.>?C>O~sQꂜF*tj)TnBo)-3VѐdEt?ѿ5pG 7]L;L_o 8c4CW*2J/D0]4GXαȷ3@B{g+"0fkH+k=@jS-:+1ZsvUs)&ρ-4I 0Y~ (n Ж.^ity#:*ӿR^TQ\"&YEڨYa*TDwQjySCt}'gCupkR&jpRw6"4lO;"+n^ZaRG[I|zѷŵ++¯p҇)2$ɘ)/'sD@汅 1)gN"m*K훤@2%V \Y/3_.E@BUw$'&P.1A!}g;xv+h cR?+Q}yY>]EG yZwmޞΜoZsgNR:6hwGŐ1heL\D'@O3SG~x5L+>蚖D>_hܪ5! w.;# |sZNgte^f/Լ=`), (qX( 2`f¸i5 vl?Q@<|˳t<{)(G;EA|a^;F$꜃6@2PsL":d ߇0*6ȩn v*BxLE|:ت N,c 0=ؠ`,/ZlAP&ewgYG@_ f오lÑSI5U勵H@Ɛ+(YyK],)&]tfsFg'>[Bi d=FLW91cYf٦ ҉wL {v}otH"jLO}_Og75ZˊXÿI,S'[}k>"$2q `.\O8J8D{ۺ(;s &{NO B-J>W%zْ̤r"/9p6x70x+d^s Mn`t-Y>mtJMQm;gSd:E\㰺['9% X*ka$ZoȆ3?}t!g #tϤ)2Sk- L|WJq0)IpϝhDOɣ/5$dw.] <Nj*A2!xжG"5G̖alՉFz Q' 3&knu?#E[w? sM˰ 좈lP[ =tÎe<-@MVd8{9TVNb,uO{yDf%HdIIqRVcDUDSppہFhhf tr =g51[4[=&bQwՠ/}7 Zt 0 xt|=hj[YTs5ڂEm%_ v& {UҶrlt=לaLvL(epˢ5Fyհq!5 'F'msaV#mRօTHzU`d\2\PzE6" o rU2ǂύM ^}IvXͶEoȂM`hfˇ aބ3)ī!!ش& U@c./$.)t8C2G]s~G uJ4V1$C Qprоl0T}q!dLlF:*yd8|I'siKxk. duaibqJWȆ31?ئzU֤@%"GW u;,FpcD'H9;4|W\[6uD 6+lf^ՎZ1ѐeʅl;Av)o>LшurKK; Ufy8$cpsH2$T>C:\rVS~QcG8q3;" + &=bP).!V(NJW_ta<n~?0A VvX-;ǣ5E<8&ǯ_`甅k 4ƨIK $q/uͶ 35.pӦHs('˔|ЇM\RY9WbI> | VpGt-`d[JfL>F\LЗA&)𻷅9 aE mYוNwFͅ8QP+x}})a3hG$TIՍ)|V R'?8g:ЦBXµPiǽ ^[CJ^>`R^I -W:X|*?޼Kh94 &oŖ[kBW"y6NR7D.*!,^[_~\Ia,RȢ[ RfY\s9t0}v&M!o c0r1}_w阶lYG.F/<x߸nx֢5z]X᠃>8"0: aܑ\چ]` EΓ $lE/lBBx,cBb߱Ǔgq뾈PU1IڏƄ2lt|EuO&pCG2ZWw5eC+Lj|n4>B\rMIȑ&5ŵ)t4Lbbtd*u );L󭹂zd zb"5_~\ED)tu$xv.A;LZYP5ZI]bV ⹏Tv|`g<Q7Y?}yd"S1 jlmQwd y5L2{_Y=N=#e55Z\`uf)4^Mݧ4މnN/e|lDmE*z]1c[qK9Xe,$Eai 8{MŤo@O,i.JMHc߳nLfrUVydu[}]/tH'8`6VqF.#;Th*C\/@F`YX Řpb)GaB4l*4oĭ5 ;z/:MQhӋWiBI"LՖ=܋: } 7pDYkjLK3պ vGze̷$ur>?!.3s_b] 3gj.ߎ= V59/DwM#\_:"ضgmQ0Gz&: JAͦq/ a#h+ǜKv$?4JAPa2]5 }H3!_n\S`~H.ʭQ"Y5Rc2pѼ<:g)g6B/#ޜB]ٵ[LvҖ6*߬tDmƯĚ)(8HbDXd: :a/Btޗ_o-7Tq~"=J@Hת϶g[oƍ(֍f<-#:Ә QRM\KhP3絶Ѝ U떶qfq;6$ ОMBw;訰i%)t |_VAZ)D ?:y#A(}sM]-a97w.e/M<>PfHv k`(Ć4~S^.fq)C$ȶ NY|yg+Hn^т s"0+l,߼:7[lx5;wSYhJYrY7GaVC-6śN!9n/Zk[q,e]D{Ů+EҜ( 0ā8G9/Kbz"g0 Em/ؿs}S5S?*p*OtB9ϕosM6d߰';#:*yYXo _ P *,pj)4n揢~`UE]=Rꎶ%rįiPˆk}Tb)hKOgA_#9J_UG 8,=ce01v"o"eXAjg(Uc_B$+e1Yt|CqP? JH7x|=4}ri|jݜmhAAh㱆 \C!8&wf#+7-qqj7uk{U#J.1ED !);Ý!] d5=Uc}|X>6H?\mO[8}x^LB'> FtmꕘN2Q 'U߫4 ψ)ߚ'/8#bq0O.TQyY´?Nk%d -a."W9?_j9?󺡦J[HwXf?x|2cn곣h W.S+ESR3Ӛuֹ:䐈2JP[^˗p"KFCvmH"h? rH O5r8xdʾ@ut6-S 2^yT#BteLzRoiqNVxzcb|.E }1bza6d$whie B'rUS$} \%gWتJR ʾDac tDƩ3XZH_%ѭv/;vosqYuXE@ldyJW!(i-dhA *!7[I{Vjx9 Noܺjv1&jUh>7&$0 "sYp&`_;fC0-K! )jD9qsAkhJ*KivԆCHV\ EkݮVJ 8 #rtxR#ߏqA@0:*r@CSܬǏj4eK=IYB@;)n|RԼlZVz.lU+r2 I$JD _{zfDyK9@%k j[E5*bjRr쑓# wjK v_ ^EUߒX Orobɹ=oF iT;]FTr P>ؔO(2unf"(i)ZSu;A_oi2˽ ~FC-Y@Oxq*u̳4 |)voplkLAAމ̿+tWr4PHB%k=mBhKb,< ?$wvLG%΋QI3t",q59@L= UJױ1ok0{oEV"{$рߍdpķ{ ^#%@9uD30 q_KvX0LVNpG+jv@3%a莿!l'E*<R] -oS^HC@>C.G$L{oYO؅alf٤?ś#u SV'dQ-O@ȅ ipuǏhj[`],6/#vQ1"1Cy1=O_p`%D*s+?\gVZK%&H.ؾ)Ə Dr ~ q؝_J7bƝ0ɤ(!6 ڲ|%tCбn^TYڮm,o#&m}uA-|E$j_)*DHt{ݭ*f7}bRȟ`IbP#JѥAJ̶foP9m"iܰMuk dʱ`$7y,z_"=2P4Å9 ;Z|+"if nyiy2[ 8`.SA㋦̤jnZDp=ǙX-p~5iYӛ'r-nZkPr郏Cj4]:MIKmSXo r70m؜,VvsNW$%z2av`VB$w% ]3SV+HlTY?G.n;:Waفĥ,"/Q6r ]y2*x-^CɦS΃aX踪k-!n4&2Ar $]҆]fx- [,i1y?眷$\IcH(k !_YM|d.JsV)J nTr9MpU0ZfL41XOFZ0";!DϸLZ,2a>9~;24U knlt8𤼫r͋(`T?U3ONUgddzɜ =!61t@ jNM]Eg]ߜfppё`[t -Ph2 u./Y XpW=qu,'EN0AB<}).|ot _s58u0uo TJve |X~ )A/SyZ,;X5 Ni**(4REtYP;.v %A P"pIMÛ֖_$%{T1YҾڗ2CT(bqY|J sާ憵n1U#$ lZK/DKsf3i7I`.hLEYF[_Ry 6ݾV2I%Sf<\섮}iz,~~nÿxTAHZi[0GX[ uN:7d2K4|eF,Dp)SG" ՕvIJJXX M)Uۀa2_2km>z6>jcLMJ gϙ켡;YB>b5+qwt.5Ӧ+ gkqw x\+CJ՗*cXW1q {@ոhh*)ۑn 4؏*򛹜_j^p:N1yAv<|kz'ӎ~{}H >eiF%^ T.+it;#v|v)ߐ%`uZOQaR@+WYig]xt8@En-5fuGV{9bLԇDiW=y  vevJ$ύ3%@N_hOP _ g7wW>JP)j~bXȈH>YIdp}H@KHZ=%eL)[a&_7:N֑رzl'eI;\5cbo,G*IJ} gY-"D]Q"DQrR_]NLN*FLL2AЛkw1Q!lٸ_ܶwP42aS "v^wmw޴Ug ѐZ{B UpC ¦%@mC;Mr!q<5[Y-:_s5Ow=T~a̓n) ߲}g>gp V[aXc+"<:4^oߔVtuIЙr>qOVC=^0ֿ ܎t܀LPdi}ǬwuL´g z~= .ܮ&GUGF9C3u ,C4'Q؃{߶Ř{V'#I]3^azsZY۔(˫,̖ Ed DZoSqTn ~qsNl3 28 vFݽp^@MMcw\R>JI :VCIp"l0FRAnY.*ږ1AKcF)2LK dfY+Tn{F5J yX0-u ʴ] sCyK:[㟔HT=hL$ 8<'m'鵗I% +[21Mx kcbUٿTb?i2kq3 I6C)ݐy̡^\@]lg|k\LbW81ՓͿ t%n1_5 WKPCfn{&9?vI 7L 4# ՟T\=9]:1p@V JB͍2ŏ~?S.l}R9죈+~p\P4>a+˥/3/6V YWQPiZt{ۤqt^{5_-D7XZj9(xgKX[Q 3ɸ{ly60J飚jV``j>G@C0hbr|Mm ˾Z)]t5qpل$i4-iީhG 2!q?BQL46yzw`"3n R(epBSm`ZI 'mAD^rϲאEhbQ+pѴ +|}7ѥ.4^,IÕƄBAl16jbu J҉Sڀǒou,&W`˃7GmbqM*7q-OrӛI[O)/,~Ci SթސP %WDxJJ)8,ػSµCq^I_Ppy2ˆC]3GLpN^DK2mԠݾ5gP\3KX񃺯OlJxqI)qF;9kG\ xqV#8oy(V/⾵9*D퉈 ~XߐPjˁfrK|SfR w6onҁ"j[-=P-ZMX\K>ZCٕg460SS Hd%Ɖ[S^' Ҥ$z+z <ܫ[>LS TI oJ"N]FKsvv؊˶֜.7w4`3m IZqG`nZ+"Xߒ) B="1GN;\zmpc( qrс 2acՠ&vĮ2bu?#ӊ׼3^dž`7)q4%rqu99_nqͯ> /ոF^E gYXJ񗼢ة╷; 3C'О(,shefR1JnU9 h̷m.ؖy 6M?vӆ鼆p`yGz?U,Kʅ ݞ*@DkoE7|.jq0PSTݓO1I_/v\fe,K.ėC3y{nj>zQFOTϙa>g Kdm &ЛvK'1-(;+&lGs++7D[6Ha'J(9wJQ7}IZ.1}!(Z]"|'&X Hhzt PT;5\_mbBmhJ ]zcG0迥>@sRUldU=`e t"Jn'van?&b@{ {OInӦhc0~瞨曎I=?08; g}љV־ծHa,^^Esq&NtawZ;O)!XrSl_u_(`cy ({a "CѬ:|72*Zg a/eY|ܦl& r]X( Ăn)*l8?}7zYu!#5\p@1` e;ì"eNP-)MKɯ y3Ea:(ɘ{WI:~2KԈ 4JP,)2|vNtk4-l)f?\%_dI-2ODF5ܴxRVgI҇&_y^SrU< DsPQ`ߒWJ VfW$].t}=tz7lB1$ۃ|+lN^c4ᗁWfOzAɒ',ir/,bQ6jj 1` d)1qȻ@UxȲ٣ kO1\+~zSb_ͥP\FWeyo٤>*M8Hb? TQn#GU R*y&3> D'`zmXb[$yR`{|V2ӧ^\e*uU1<5d,6rRaO-:>ϖ m_-2ɤZb &SKarN<f;`d.J ֕Rx%@zkq&Vv_+>J*{{tFXz]&zP+N@і (@({&(#>p. MÒ? _64J5}&;bI4*y3, "KWRk[7sˍMm+ Jk- (}"[N&'`HsBL+[hR?*y,I O5O>IJ6B±w\0eSZmJJ)oҘӬfK^d屑2 5ힶ +΄]YkC\C!&:֗LZ)m0^HP 0);Vv&l'_H])ivT\-"ook:Zx/Ne$EZk* ϯ_VS}g>z Rb}Dw90Zn?YŐsA]>%EdLR'\B}og->HR\~HG _礳6jCzxܪh3pܭ_nl)QfN~)S`eX uԵ *wrJtknw>Ixv".)f%8 9EK>Y_p6D#WLFB+nwM ׿abQUCf  zCQH0ak0W:11K ФU0IW$ XD );7(7Yѭ?~ ۴ƕ8胤O#}oQQeq$вڦe.肈?/ݐƴPeVLP4+{ K>p,zy'hJh/CQ s )߂l·sm̡޶_sl@ZU#,ߵt pmsV C3?11/4C\oPJ-%.Ŋ"C4wi ؇JW\ !Gζ'Sy"۴ ixTMR|ATϏu߳`4N:*ZŝZeD~?[O*k\{tiS䢽(w6&@ywJF A#^h"0hLzGp;rMA]ˀ ĵӐ|{qY҇%cIx;T-KXV7$1A+F[Ccf"-^)*:rea'Cv{U%QX}TUDMSkvq%> Gr"5{xeY 50, uhT86*= i{_3b/7&GqTV8E`9B~0 %(GQఄ$_& 4eA9(wݑq /Nz&C;șmQ9z;y;ewh\xH̓Xr(Vz{ ڽjcqshy{m,.|_6!mu#8Fψo>T4.Fm@/.“KSio-u`GGVCy?e;cj(rYr8l|Gzt( F[Ӛi=دFZf޿nxޘ6v8MR.g'!U"f@:vWQۃc~UX yKwᾫ}@f4qp\TK{^j1~jTa?'TkΐNQ ]/Wbĵ_eQ#K {>u_>fk\%zKtO.KmFeM73Hdu @̼[ 3[GaB2=ºW/Ė 2G)+xԱ؀uԉAAϼv:m!Ev>hIǢf17SƧ<@X=֩ɉt>zv֍' LgxV!@Pet['2&_#uZ(aʐ['9}܉W_K\wƺR93GSxbja9+;nҖ$b$0DrYXV7'd=қ;5aQCI0^ YB$\ׁl/~ 8bnw oC@4?G=%ⴀM=5`#hH NKb%h+ a24HP_u ΈtNSPXy04~xcLO#╳7Qr55MH&Eˉ`$|DM+xpүm%όM_MeC-+B G+QU~s~e%G^+^ZpDX{*jFJF%w"QT'ۗs^kZxb-D\1@x_i-Sz_+7{4NОE% '׭FD r'."_~7 ('sxwW =/*\wiəʮ\;2S iOn,ʝ\,FEf ŽU;ֆ?FV %7shR{'STܐ&Lj\QU3Bޔ3{&Yڸ jǖZdvcNbr R!]BL*J,N~?[SKBҝƔRFID~B\xw( L g;ȱ{xD㌳})xO 5 $q2P3V]Q;ܢÿD}lYh:HfB] RyCl9tG+EڡU0ASsrVkCu~׊L*rns3RN/zWTo:3_e^Plm4oO18\*6}yED[_ZrqC kY\*Ⱥڔ+OQZ V[3q::IɎvK,j!2QCmU^Ad y3A* /TW=š r| m/Jj MQ }~;kUxf˨m/.꾌SN'E׊J)bNjk!Oݒ~SbT*%y=%]c 8Sb+J4! L{ُCYJo^V75[W17fvg.afRqyfqea'gƒDBO>j9YLUčAئT•05Nk>:04aj/O8jK]a6ʣz04[Ț( I9F@u6I|l:%j}'rFf|NfE(3mnv,S͢\I3pmDy(9ڍ:ޣgv[wIPCID~Q;.@DgHwA0֯&}iNjC&(myjY6('q%Eoy!]v5q8}_cj xen+qSr}k^ga&(6O43Mkrr/ '`Sˀᡲd&rXN/3`VĖw)c%R4E@ɘ:&\gA0\~BN*^{"++ A_َoNXn 2|*շ 4]پxCYpAQ*KڟD˃',[^cB%d_~.ltJgg؛dFcw2'F%v(8U+2]\/>CoM Kۣ݋sG˔UFZd@#ϚU7[k䐽F1[3P&G4IKظ&F}yAQH ZiF=3ی'ݏKP]\8SC(lAׯZK-q WNpǝ ֕:$l=Ke.rrJdA)}%/`h iCMvA:[I\*ܠ21ˎ[0*܋IlLVL%,zEM jHx&i D8_B !#s,w4rG/`bwyjeHI 'O=#Q6@_eR#osgkċzS18pJx3غ3XL7%KRcNkcM@^@_aADnD~1@uF`I,$w )EEV]1S􎻋$7:9[!, כﳃԤ>nob a+{V^J2egQk+1Oaz'ٟ/H=O=t֣{,3M|i1 v@6м"g&ӻT":9 +,zWyaTOZߟPƄF[aUh$:>KRRGoPw2!zlnPwE||4F|Ak&u/0&%R\¾qJM뇼-Xj)i|dȑ%UtP ۠2|Wӛ\Q+o脟T EF[*s ۈ8rN XM1ł/Mj,r& rD$Kj5Coz .jOϜ=4Yړ7mEË7CG4qomhV%M|~ ?>]yf^Y_r,ܟzBE2jH>=G8Izz$*Mp$ )VѾ$YM^{bowZ'Ŧpnђ#,_/eT5L:mʕ|NUG{SA]j}[ ~ۂ^t'MY5;t*HF6g_6$, IR"q`0 IB֏ӅNGX_"n#H,`vw}r~Cfr}x<4_<ѱWZo9yCabWj&͡^ns^tܱ[M KZ!^KIZA[Ao Hz}~ɘH 1ىm40`}CF}#v&gR7K dw\=˸)qOGT#IG`59#WQ|ǥaP~VNԉCшT8'6ZA^ * 0?6iisVY;uU!< ?^LLr2Ӳ9>cLf:'^^尵ܩ}>ffyb6wvMPyFG>Xr}&))Zcؐ?|Oj 7@]j`TMy6-,QQ:Bco˝e}ǘYdz:D x8Goc3Q#*Cc4V oY&6Vce!bKx <k(=Z/CWBe%mk̅U":\ڢi Bx)gm˛JTgHNF%] r+4TMp{9!m%n[Or Dd> _.,E!W O;Xф!>][CAjB.r/\W ^Hr:CB z U,SoUGv]/&1~eE'C ׸-cxJ1 91R^/@ } 'XѸ-B [CxI3S 'w>g>5Y+UpC FJU;BxɓȒ[usE=x-go@)E.wAѤ5Z<=""ĝ?9YI:xؐE4H0ZTU|I ^QM'z:Z~Izw3HxP&.ځX갛AH, _uwU5L]$Uo34Dxײ>XmpO-`Sg1;hN'^B= ދ{$,"ʰI!TwD,CrbphL%*TյxoM=׎ja;Ǧ"逊 X4,V{Jn"vF=V%nE恕C }áwtEt*5Q==Q`P>#V=Bh844EQC3é1I/'y8p y^nb.+GT9u>0e{|y{4C3D8L1N*\m||A臒cYR ~r=^ ֐Š|Bo9*G^jDe.pTƄ %a;E7UB aIu:\th:r`my%3}ЂMRdDh4F1o,k[ѷr7PYh6Dӧ5WI+,bt 61 55CǍY{_)G |0ܳzR3wPy+l72f%E̵* l.Byhheg@Zbt;_@cb0l ށශs0AYt&+x[-UTzdF{S+wTwtң5oP&Xd7I*J  S#&ڹo8h9RE>Tg- ww傢]kFSb)c)}6А|{ŝO@:9{lrRa+Ry}* &{} 1~;*-֑۱%phaBqPf%PZ QX~ j0;ًe;(np!^9K>4KjR_շ}[\ިZ7 v-e?I=z]eA!VǤ㭣}4@gva *D K$Ϝ piF^Ǚӭ@%3 8sDYSC>ٲ&3Jv*_31X@by9 Q){LlcpȺg)6)aOAmӕrL21|"I?ȩj-U?lX9YP>D2I35f{?k*jPHiqb& XJTbcDAAfPɒ)/JFԹ}Ay{0X@!JFl\$*h E]-,y/M4nt3+:;O "0g?%^U W w ەqӔ@S5fߟuj6(Sd0,AIĜՌ&'C~~ӫ"TA2dqz3ے)m+ g ?{ {GP{ig,%DAbwsr.ϰp$*,YKjӐ:M_t6(onE t!Xc,!^:ќM)"Ȏs62 'k;/e-"X9D2u=Xgs07GMK`Q-՜b3l)EҍD&B&1ѦXy<@/ľPH/M')"5(nJ:}+e9 95Fz4u/5}sZ󃿠-}qcyzgqJÔtFjYZU] L4˾,3^JLg{><ϵn%׊+=˙s&p-,k̬2af ܫL=ﮱuH==& %rxggvGX&5~ǻV.3fR1 fq7nK s+dTOxܘ̩1+SuLj_vw4.vml } n}YcFױ>14-WUfǫys:-ͣHX? w ŘA&_>y;Z x{SNѺ*qɂ(g pKAZy;Nނ#{'{ 0P0@5 TS uD/: C.Wp{4 ثbsxSdsZnJX bo_IMb7⊇(>pc_nI LQɢvZOe}wPAVrg=*W&ct?NMLa%#>r> .\pWW jxo:؆^ޖx'B7E67qOSz&Y$Nz^bPd7H†!M\=S@`HLꮫ n'PZvjN"|}Q*sE]Ƿ7&NZ(˂f%Lc΅Q-0&]O +YośnNfuC'./*qSF . {i ,5L>&ilhQ4^QoK {uWm\5U3R­72y^Pah!oʬN(K/gBu\}+"! ul=C`+苾ڂ;iidSQUT5W2'^D?cr6r++ppw fHQGo~P퓜s$Wyiv(ʧjHz.qlTc_7')Oזx%(&NlM]?\,}E5_yt1o9 %,ҩ@UtOwZ%YC+SXYЌeǧlMpXvUf5^!9=)FBl#WLBZVzSis[n净woJɸw) >SQ4i6S%^wPBI1i,RQ!5MѤf6A} Llݝ?XEdBؑX80O^ڎVqHIN,5ÏPV<Zxʟ9Bä0r7xmb{"s"=':brWGTjuaqOͺ×ٖ6# L+#/)i%Zϛmc;cpԇcQ,n[O_3k\g0y v#Ȯ|`1T ۻ3JY?<;20(B,wj)M?("V]x jKb!-Dۇ9IT!qgVbC7uFBzjNmd'W0p0soG;9ta8@>YT]޼{kᣮYVG'ez't8G<:t$ye r.jBwR% ܁5lb ѳ2nSE&rXz9jk%4 9sBf rmPpB_6R}_;'OT.]ToY P%C]Q=j#݌ Nv[-7i: эoI=VҔa\z#+<+L(qBl:>i8p]2\Z~BZUoc38waES/*3%"͵+`aj3;vc`Y('y e0tG 5[%exUДtK_6'6$I܍h/an:Ԅ =,{AoFyvƯ>(#D6vx&g Mp;x&.F7WA ʂL[ , C,@%4IaI~.A()Gk 'xlhZiRg*"i>"Kp4=8dLL(ijU#9^N\#9JCK8X1m6 >_U^o_kF#̡-pƞS Pן:fj\d):g(]onChT,8U&t#:;F/SZLm=jr%ieO@&*=%HiZIoٞiښ͞t"CЛB<>دݫ"?v\Ng?RY@joQw=˥r}h9,s {R9Fۘm^O[Cp@lsq!0G NPU1(E)'A>,R19ARzD5_L{Y{ut{j?EXI6 $'VTwlbo o|iD9g^WUb2b:HXX$~gU4W'AF48"w[ bLғ8xìTrӗÆT1]B%WRG*b%s>0g8=*m~O~<-8< ]0.}AO;BJ(v 924 tV_HQ*.zCKr'2(U*Qr#=״\~s_Kkջn'@[7/j!ob|kXa9+E,'0LK$w(+?ce Z'PK4)1W^B.7 WUsm(SaC<կ򹧼.V[vSFbOG)iLic KsꁂD`Dc4 }ɂ˹JyuT #j/~tQPfA uБ}w 1pR7O2gdZb" ^*Tu ^ DjJfVIy,h T\@/qscZ{ 'Kثh-QZ}RrCw.6T f;tV y`ھ.O+5uJ\7~VD\*\  Lb2wtg:)}a>RntZ;]1%?w9# dM:l S“X)-uUmLmCȁ @ze/Fդyp{v"A1r{A-kf~q@Z󐙨W]}ܻrW3nb)bQМM:FLFLU[Kb޹+)'d- Y@2'˓ l^1t"gT" ySzQ6nhF/E_\@CՑE~x*"^'1U8<\~ G=4Xŕ)r&]2DJ۫upt-:sz&T^xUցl+qUELGzӣ,)Tew"X nA,b"q6G}!%A!}̂Z{O]kb@dKuǣy"Oh}AWbpˀ5@:X!-,*!z(Z&ڋhC4KqQ - ȩ:5%2c?Ҫ@Fm~`U 9IatN^;a( V:!Xn^j/aeSA eP7Gdck$4Ô= ;Md5&pE{X4Ɠ߹ƕx%m%فϙ8_; < ˻>8H)&qJfw@նR NzPebYqOl!0$0?KQ@,!:#_ci 0NfY6AͶ©Kǽ2-1 ZvM4cG޹m{?e1# ]_1hgv wە36H p>VԘ+jut4;V\36Gf888ѫ}Åa#FDJS9J ]A@;BSSgYBbp#T^V-o0jqq' $ScoUx) ;B 95F"D|TIp`FҮ[q,nj֍ϤSrB@[.sj[0QM_QlY$29DVwX59͡ <]"þGbhr ^wc WۮgZ>yB{`4ٟ{uҺsKp Y5FFih217c02 '!orAky#>WLOo(=pX(+,fŵ\8 ͹>[qo25}gIϾNތINs"h-ҟmg=G$3A =qD bzWaD`hiAD a;ny80"to|JȖuAd hIDܮnZe"!*dXɛaC$7Kdulb0f9utT)sXkWDYnk?H;qtBUprx˵$Lw=-4p3)B? DLWQBڙE徐oK=&rxܯNqA4pq gƚ@x& LO+p³UB~elC¡ӏo7܅_z:[#zDa N#2ojt,XC@'5nB n"^:#!^81sDͣn^ uGt"$- K}:u>=U 烂g+8wYLL5B=;Cuno iY?rm1!,W OKU^@Y'&IN5ADf-90v!6'ymtOj8r:]IT3 M^溒.(1ax`"O ߤ *?Imh6j+%UuҟfGRho58XS̿(LN|y+G5 Z _tR\ ʑh4*w@Lĥ{NoĥG?#5&p$*O6ZuXr,,듫cp,W?T<\I OQJ,R曣rVGNbD IkR4ć@J네 Ǥim%P B1mM%@ wƓ*ӌ*ZMhcoqc>ѯvFL=ӃEb߹`'E).9 eT+8f:$=aH]u ͷWd?b~Q ~N 2Xsl 5R!1oXz65P ZT\wgq3ONb)1)x5kfyuΠVl2}=[9Y]ɳNfo2lmN>f?rB|&H^WG1J wyGWslp_إ7=e{@3/ cMsṥ ߉S*\z& X:y݆c$Ey; r8Ź3S&;700Q:;m^K"-APDE;6 T)X}vo+:o͓#*9t|Z $ZLتv;'P=C`BZX+DY:ntiڳ=)tZso{,GP.ZT`Q.y4`öD>>Mv^6xp[>=ѩ;9yk0+*k-e5Y 5'ۀhWErsjy,(bRH \-3Mj-;YANM`z emj(ͷΌiOUO}LF y =`?JH~{'6t}ki/?.ƕq##<'H˳C:HnϳMZH*p8a?\{'c>' E>D.F[9:q0* M6 $aR_ѭgT7KC/FsȆ?8/b]E P>G̊_7|'s2 B| J!=:l.[HT(W h>Ci̕)'N䧤jMZ]Lɕ90`'m c1lF'f/KLeeZ9X2\RYv=SEQ^Q<`0DԮA,q^(|tX,J*Ԝ${InO3D.g:MEyNQ%,7/0k..IPv,7(YP)ʽIA 7L-\|kǛ䳃 ?mp?@?yjTy lҦ!V4 ,R2I[gO͞%?~1^Y!H 4Fșب2Q U2R{2Yae'>x8t#<ӠXY4JͿok6g&ɪU(^LaWGO6qՋN♏Dw ?^TAzD)zU?s8CԻpy!ɦ)Y/XPz]XςZ7BhMv,;uTӕ }Hb)Ke*6-n]LB*饐{qqrO-iMܮ-dEo&SiJ$Qj[9<6y9O/38›5}1^a.j,՜d =i%k45@*M'8M>g`!`j\w,k=e2vtUM`i?hZv74_ (lJ߉+nzLy6 {\H/ԈaOF 64!Zhjpxr"(%“9puemBF'3 [~L8aGxHBRmJ!]-٤7p>zn81ղ^JI>e2#"-fyOVlɘpv: X 6v`EEGCRA ˿hM,`1F"ױWFOr15"V4YƼx7̰7hJ?[}k{<"C7`#wc!E5䟆@!#s~NA5"fߞC'Z hO j ݋XB~`%E,!WypLﵚ,m%N7u*z_vkAH h=.ތADwd,\=^@h=V -w+4?3 2bypl2W` On 3#dԮOeqWhr9Xme 5b>Җ=]6xmb` L1Ha5SdXڨ6g^Ջ?F 3T>Ax;@_m0r3K,A|4lgśIs lVo~E!"o ċ?LU@Hv>>~Q^%$upJn12]F[PGQm56\[&R]R0wY:jTĥyoTÅ鹕_/t޻coHV[>Ӝ7x7!@}t.uE4n ];u?ou$,NSj'рUh3/U+:Eh16=e'ʘsM)V[0 ,POpOsGGROsW,,/yO,)[EZnc!$4\/ BnLdKӪJQYgZ/ ށ y8Fs!3i{Adqȣ|]OCz:P90vc)] Ak9cpYK*OFddwMYf3KvI豩Kv\h55PƋQ\s#¸F)ybv\V93b8ޚ%$K5Vg_NP?gJk'׬ _Y] N-2K?ģL߂Y?BqHQK;$hY'4QCE82,)( t2l&+DYIr>|\z+!uȭ2Nzt@!S!%tZ;ȝrPrt]'{Z AA3HtINc!:Vj{Cb*?8.D:=us{re)pûeǹ Q(~L9Kfvm]#WycGS54MIj@]%]gy2E?QhPJU, t쒙hK輔1pJe ]^(8'n6LKbYUy 䥎+zZ+m{tw+W4W%hh%ij-3: lM_j6iBKT{thk^4%+|~==7 fvu,C' 0xJWQvtٙBYF2L!9$Wjf:<~ ዸEDDEUD~}?+pY[|i o@X3.qfi7L[GΏa^Y ZH5kBrcuؤJV<[{6K>B߬ج@0+;y-zXbŭ@Γ`#Q>y3c;ͽ1IT8w%6*2,?,%e +L*1dgC{'CC[ ދ+H=h ErGWxgX}B@X}΁`uD#;3m8 ivۜ>B*ƭ?::V%#V)BY VhoDz*Dž20^g$ Oa&'QFѷ-έ+`q$gD[d*Zjc&)1 :WxKw-X:w4{ [q' 9,=Jͥ>xoɢ%1%j{_XS%rqD o\; T+JM'C.v$TjHRKb3:%N:!;; vY#:x P!—ޯYE3PDŽb=M֨-V+OKa?r2۝`=rHג;J/ZVc6Lggn?eA3/A^@wzסȬcBpښUI絔 c7BEaRs(]&MiOL r ʴ1PTʋa0`b3yB h`DJM8qsOS袓ˇ?b>IZlqb%W5gզ,UZլ@V%#]^@-qxn O4FYP޷NC""vӁcEnL:b7YՋjpyvN?{3{!WS%}T kݰ屠oz4͝qB)%p|/~TwY+"YX&QHvUKS&]L#UA1cCZ*0^9f~"o1黵ެYƫSQ~O n,'3FoE?+Uj#I'U XVH.CȤ})9ۋ2g(He;]"Ne%t?-EeLD$OjB|UJx2՜2o)']B! 0{*5@:͎UvS3E]\XCCuY{R&fힶNNbu],+~*\JʕO=!/FEdž\V6a Z0A󭶾,ji"0@ )iwI*7b@N`|̐3_XL0 gWtO2R04. Rwo\ʏd%Æp.5H&qʈ`gV,F"Zt756FgQ b&x psG$^&nnT 1`.י\N|Dw^;GW Oam8L휙,sZWF:b9~2w8`'2tbԞUa8[o"#|z:^]~ފ WW|2\HBd;~ь51Dx:Wm4\r§Ns;j^Ĺe }<R8QOÛ$hjy"cGPoIE[ @GM8rFU\vWor{tlpr"%=-ӿh: I*9WW?ZwYO h^㐙JcGC"?ǺXA_YI(`6VY8Tarj(p_{ {ߙq_JbzV7@XU}p à{i 5F%?MY<~`dZVuSU[XS jnC#F2*Mn7_0١PHEo֛/xzpBm}[Zkģ&Ñ%'شon}lk I%Goλ? ev,OR ^IL'h1PƔ OQJ!϶&BޢC^g]3G[k$, w"wM<ajOe[j2CuEfFmUp;>HX ^,^kfApPd'=;ݝ@ے^(7]m(bP.I(6iPkؿN3ӽTyt(zA~XsYRi(-J%l pyoߥ#}z ޫ[GHCM9x :u7T䱒,XAJग़!}0:#`ћfԔZT0BV˭CWq 7jc^]\ref$;O3<_;Q 2_HДd0ɂdYi0eRl)ΐqEP`uicPE2:3@\L!舙1.9{ ]ۧV,``u4\_}5Z[4! SP/`;Ȫ30H$k-.xPnQCL+|UYhKr4dPwa}Ɲ&'vڞG@3b9to갠xS\q1(Lr-;\2Q47Lza/:9~8[N1~}H뾭cuͽLhoyɹ("t/O~1>F겷"1\ d74Fcbmy_"4<J@ǕZ:aU3!B*F/>@Hˇ'i &뫷Q8sNF^(l'>Hr+!v 9ʢ"ન΢;.<.y@١9Wj3I_ Cs0[fyQe=ܿEz6WncӪeCo@<53ռR9Rci;M-%hk氡(5a<j[ DMyK=oT\~M3%1Ut-[B\5-He` ~T2bR)Gw׶"omlϥ{$#j[V0կwkBG\cmpZPKAw޺1ks,=PОT345me=s5.`qC▆VDcA"PpI DMW2~axt99#]+xq䇅dCDE%7o̹~>[81 'QFX/ c97:Z+>QC t;Z˦0kai֠r6y[#&3vz)]z.@Cľ ߩNR{P留uJ 8I9 %,1fj}E -}(a݁qT?'bJ/*T3ьmlXHe(ު޸]٨vvwB*]u ,`( AP8^zU9QG{#Qȇ3"5aF2˜4AvYrv/'<֞OhyRg|=]w8t^r"p-p#-o:&$c<1@W~v"HhF[BokŦ?o'xT%x@@H{Ɓ&N5m2 X!Jcl¡w(RÁQxrU$rx{]|߹7j:ƃE!Gmܟ`T+TxArQWP_dHNF3]6흑a;k|AEt6~]siep p^8:2IZ¿yȊ꺒 c\ jهyt+ Aq18TOA2si, Gn@$>S)߰ff$kX`5~^y㾝gIw^01: j'h4s̯latV׺I " `i7(THJ%ĝ}S <2 힭q2p.!g)j7 m"dUdI|_>:{ áGЍI*b杩G԰V$5F<6"^F>7v ĸ doc}T>N)>߅kMmxH̙G&Al6nLY`H6raZ_MU8,"@+Ctl7EW! rLdS3eYR'`D$ o}>"=mI4u :M"TdkπGPo2JdB?HljVS8q ;Bf6CQ6$ I]^yviT q#kƅ}s#1]Jy9F;R׹t04CȊQc^wL Lw@Wa"O,#Vf呁L1qY7/ #o} sB@?IC%e{6PL >x^/C%$x@GVkZuw-r})CHBS/"~MUy˫e{ty@Y <>!ctf© ;Zg&*gm uUwro5O43'h572J. 0ALMM$"[c~xyTw, x*I+q3mJfi}3 [FNc]9v XRcL-9 XS8\N U/a҈@CY`xE{_?12,XܣŚDSm{2QҬ_0O x6*g1 1-cNcI-<~ }V.b*8K*JBVP2蠇ѹ`@vhg2=?2XKC FvKMG2hhSATN(aݜ}faAM].[ Vd]aA;,%B뛊HդKhCWЋ7M$ŰMdRTQN+\av?+ₑi(PoYF63h3j c Xq 5|cаX-C9ÅW<Ω(b:ܦaƆU4Y)uXr ڣVFNCo#): =WtK8%3F..a wrȣ&'Vsצ+g΂C%IzXJ3S˨9hRm 2eW.78N XGHtJm18PT2:# UmB;Q~nKSpj=`;ƨVӜf 1$@LQάI hݢ m- d~bΟ3w:q)wTR* ]ܔةBhYKkx8zVeP ?fWo~apﳌVtٯ2rLv|-%5,_-#jC() @iL[V۽1̦ryJFHѯà W!F&:ϊc&POw޻ԫhA WG FdgQRL69l)>eʵ)۵.33.쒦7+cqd7oxpUbByOadN-d8 7 GS碙lg^3)My8sAq [Bļ9"]uo{GbAb,jؿ,? M6|.䠺92|Oxv1Giޮ':uX]đs_8SuȭvNJ? 2oaǼF)Oj7& ]Z WR^t6i),b=Sō:=J^ z_@Җ9X̥EK5 ]7#~մe*Lǒ/r<8Go6+QT:wǵqH<{'}aS<Ֆ,IGM|-4(Z[=@h"@> =oNaEhSt_\@:'~Q.Է >8>tΦ@XNӶ'D($~&o3t/{YHQOˏȽj#'/~rb{J J._0\)p0$xn8ӽx5Q[kȺsHO٪]hUSN QZPw}+L@YR:uVhjN!s0es뿼VJv8` V:;#q2yw-6-8x"ZZ3 EHXoJﬖtv.$ 0gHdp }Yϱ8]vs[$bń4!i2G>;z^tKɠ+r;? bDݴVPe8&CY3A|'mnQXPʬ}ʹT|PhFJt>~1?B:QlE*]éLJM/r?GbvUQhـ=~_ H۝͇EfV'uD<0VZC=8.JGj(ߠf*|-sIB&+1FUl#lA\aVfr)ay<_.ho~ܕF!Ã~YO񏸬uWɏ5{r/h2OXllQ$kr].&B*{Q   f@z~~͡X4s+:F•߬^ux SP?EE #GHH{ 8QASWg7I|ooTmױ]uRI=pG~dޔDٜr&1g@Kk >/%cyF>B^@AT?Q3ˮ[VlKm4oS0=8[$C9WqJ7Ɍa) |`Fs ߱ciͮ~>[8(Qe/x3 670 yQV>3g̛vTkX'UYR33 >#nw?jcj*Kq/h}Y8fmZC=o+1Մ1HT֦./*EX~wr+ VCzimZs3`Ukogj U^uZfל.Kŕ+Tq~`0j;gZ([6^_?ZT $)V.7oPn(_azMf4I̢QO ~>k}fg=&IIjՁʼNLqM1=&c=Cqh-;;1@o*qXv8҆"O 5/h-a"WYXtM]sj[!ӵmPYq\,9 =t>P9_ s,h[]L[{jJڍABl| ڎݝz??T%X He!5 @yPd"wxKF)z]4 wg b=Q$kɅ4D!uR}֪O z*/yc鬞wJxOKq>5D\cb*K`*e% U0|~d?6ئDc@AVyT(&kW<uusaٕb @?XV=F vr=1q/JϾpf266l_T%YCYP) ^s(*ntTv3e [)aGMW0 \?INćFYvS$!q:q ~ L}Z#[,ĂT3 -9qM@_7'J,LxHI_];6yҫ&yG!&-{dq_Rnu Kw9R `b@CuiG2\QvrsLf)seXa/W^*ɍgg.:5ѻ'xW%rԕvؚ^=~կ6fRtewN|DJhr(*<+['9I)) (äϫj#G3rV/iMڿr@m'PƁp Z!J5X[NU141EU)yEFbMˍ-, _ûaaD>D=BMV~$n亳j Jw}195};aw &ȩPV}啈foOM`/o'*&QǭPrjr*f}>8'!!j^JZL}zFqLxx+UNLL.ד!]Pܚo9S0o'4/R   D,U)rRb#۶4O@`jT{=!2Aݳ' `7KɡdCy\Ϩsv^ͻ&..lf5+֗*κEAp* ,V {iqְ;!".7ڥ`ɦ}mwWB[_w@@\Ꝛ@z}{ϋگ5$;@Tu>Ono+tݣ!N0Tpou/޻dXQŜ6x@1eJBjnOm?!#}'5[QֈG,W8!{6 fۧ_Fói{!ɮÃe6gS9h]ֵneX+Q|Q9yh;5`qkM/s^sG ή@(ޛIV2~=|GK'Z hidz*lAkw-_dkA`x0QC^*VS_=Br%|IB^!uB( r0fXQk#Z@_DQ@c|(?[/.0t y̳ER \<>S j觾Jγ?4U4e54dPn^\ܸD)D:bȊ_s6m(#aBdDglx@tG'Q9嚲irÄ[<7$~1vac1m ղ1yx6t"O޹M ) ؼh!3 ?4M&UTcf29{$.\UܣSIg5A Ocפ ;#5{ֆ'䚞=MvWs~Ù(_.)I?Ԙi1R("L#b=i bҸ!?{>UEL]fp$yǦz/^Fs!,oFЃ`F /Ճcҁ<{sa Q.QR>O ␃ VDZ)WjjtPJFOx*5so\ǫ|Cze$r"Ѥ!,(FpNZ|*06} (tHFY}<.TUsym Iv=u,Z)_f]gf-3Ԛ,T~m1 x)? JJORW c,VF*dj d*UR&w8XI8͚ "8H ~U;O P'C.5I1d=̆G( !|-9x=egk`jD<92Kv?0-8Bg>$_]J/j%+lOf`֣ߗ,ێv)<:r`$ٖzH֙։׎.r~NZ17kĨCtx]HmL7tlJi(:Ɇf,=}Ts6lT쭤v߈ G5.^<7^!ٛ|x'Ӗ7w,:@8TvEe1%.lŀYxY~<# H ㊗QyַfZdfiE,ִ{ pΒ%i1䋡Z 0T?u;$*Q׷7m7M#=:_tY={ V?+9@MũZz`Ibh%gsӱk@82m/9p{&7֨ZOICΡPQ&-@sYdMw`Sq/rw "#t )ˉ,܁`_enOH<Ҙ>[Ec.;8HP%ߩY1==6*EȣʫpW1hM&yѬ:_P ZubFQ [o3kX\] if)pDvIY2@JDEE$ݷ|u!0֑8;(<-;5y)5"fi;7A8F~}y>t'"epp)cŠtVI-%t !wߎ Sz0]B|/:ڍ|SeS\;BsBb{b͚Sib? u*\caU“."_j]R>X ^DcLURWdË;e;>=#ϤxLALÒc˨**' zj?"b* EddɅplcV3Cvufk3I@H@7uXDm,DeO9T n*pi^ZTIOPW!5lKLlÝv=֓ksjzQ0$$Yqc—q[a.*lk7}7?FTDNYyÁ|&7J~|yY,x%79: ~F5IhI#K[p)Vt$Pm(ң)x\2,\+2l݇A'_ba6LD 6 }(FDڦ_yVJ.(K_hߟc,䊋!N1ڸC;Hs ZA??~L"9vGI\fh 1"YBt]iGk䃎e [D)^*Z򺱽Krسé1{GE`Xc:~zLSz6_^|=+%tz Ri)\7 ^O->h-Z7:)lXp9{EJ Ӊ+SJ_{.Jk4rhqr'L_8.}1TlXNӺf-A>CgډKYͿ}|Am%S>V4Kz0P0tMCjh?4ZG*|AG]2>I4R8*}9{X%Bvdb=[6uEMt >bޣRY#;A'q-3T 'zFY\ΘKKW&Dtt6!+gI؛E^zẔ6 ^O{ރ蹑ć4rC#0V6r{,R\ 3frl KpRE(eГLc o15C P~~s_o7^J+ N-ҎS8(j4Xи KŖ9VY)X> ܽ&M mt SJxc~W5]z9ahA#DŽg|Ïi48Ȕ, }=Q36F|y+u ꝏ֥9o.6*uOH˞cq7 tvrEW O^)~W9 ȥA=V@wzH. ^ ܙ@"a| K}OG6᾽Jv6V^md :jY9"t"!rw7` u#\ZSO{vߥKY@yo007l ~8 ,B"wXs*G, q$cHˣo)aB2o 27͑Zy2SN(^햏soUc ~1gKlu4Atr2$NNø! u0-q# ^6*g̑Rz~*~%ڐaU$UcOgyi?])WcXr gq#ۃT)7Bb LJqM-CKjqrK$-&W%54%|6wtK4ݩ71w/Sxrz;-O QѴV@Tu̷hc_?Iبy`>' 27|O%(ɓ&]DeU1ӢBqU䂬+){9N| Fq(]Py z;VVK!Q^#\a6ND!8apK+zh}p)!z@"J5lأ%-곔 luKxO|:sz,vnO]Zi. I%u?[gbG ,} e}|hMW%;q70|g#b /pr c j@9,qF/ے}𲵥3j?T<$,Ur&)<3Y--yK-KgnwϰU`܍RnN(wA#c|WmvbӖ&K,S6u[/I~]+K U !(:kyn߼hd#kz ܚaGx w uDߥ|5.+9!Dϱrwg?}T/@Wb@ D+EI^M٫G=߱ãGTSd/K"eBZ"`\ \xT%mBjE,؆˴zneK"xoYRJ_Ae'AWfc7r=ўJ9ڢ`u^{:ޠaIEHNh™M5v ; 8w9 &p Afx7&T%'!%,\9nyp{!{5+GB(Q*)[ ~H$݈^/6",.HCWW/%y]{4>$(}HLO&{.Fi_abaQfٗKhZh*JTӮc`"/څP7*UBE =H# %`7(HZ3BZ|)%lG?iLV | JT_3գ8vdU`Lȳ(B)`Η^3vPy45vV؄zA2WM_WGqe0q1fp.BR( [+Mğ4&JU0fSГR`aڢDmRO8+-w=A Q(寷6d9"=xzիl]?: % l؉t) Փ8VGl\aSX8qA-D0դ]Gq Md5BڡJ *w氞̨i<ߐ} h/d{#i^_H *2x?BMgqi,Ic@j -4BWHI!^"$zҋl>./:1%5A$@!TH }aLxP~w` Mk)8e5z#>iw4ﵒ>'S:Jb*،% MW 1 9l73osu>P-?7? t,+mp”척Jߨ1Ao})F%dӲiz)ں:÷‰]̺Y8n.71Poԉ% y Y!ƚ5}V.MVܖ瑦tp8 F1z?o/gI 63-ix\12j)t2\ @xÙTd~ $w_bUVU9vXc\?ҧ)njKEqwͫAJy`ԠH~quVA'JbJ$OqT?8"T#< kf88 Oe!T%Ɏ-0S8fHԼH`Ʈ![+bR-Ro+*y Y5f9cƖʚdb &;0,61O,?O$M_%pիX_Sʝ&Xcl2wצZ'hn֧2":WȾsQYPwe@ Qx Az˹ ʍ}=tc10G}*Jn`]evDqw {-~ lq}7BUהP*XG4J'bMu M9ew.*ӫ0AT@K<:^6]3 :4P)Sh@}w#/m\ax~"qA* g֜0B>.|$>x*UnB]ZdYdȪCwj<VO2۔g8A;GC;haׄVtgnOJMoLe_;y"/(dD]Oɇ[S޶<͟{68`d҄xUR<6*F$~U-h&vXq8N¸6C{d wf%zt>M Bw&DnGUAr5NW/ɧg}ʝ Th<c-xU8K^Y('vKMsedڔ_t7EoX jKǒن}5Am)@;ru 8])yR e>ۢJzwr )!W"B)K( &^ $1 ~U;9IzCS?>q>T 甼f{\x(֤^oSds]Nfd$bO P&3- {Ƽx3ov/?ypfRݦU+"֩(Dba0v׻GPe\׀> ZtH^V }xp:-i[0 ps a%`#zCF/&qy*Bz®Mp2/SXW쮰q=ᕽ%hP\"ReQK+KoW ^{6G-hܫ VQdP3bT%~Q=\W?N"gby? %lNcĖE,ziYNQ%v35V-59q6W3AlЗt٧:3AVW2+Ǵ_JbEiL^(yY \Ay$2+t1q6_@2EFƠU*?N B ^w86Qw8њ學FLX'Gq6dӂRsaW%t͸C(4ٿDa J2vW3}t|նb>zJXcN &]j!R("Ky0 4[( ?uo]'.mLMʥ%.2_V|?= NNq4iZ ɸ@;o]~@EEO27q&K+ ZilA:mڴռeoC[~ȫ:,\^pj>.u &nJd?LDKhyۄ3\Co^teɼE!.Zo}Aqsxj%"oHBLۈѵE²0R6T#  7Qx!~,CNa=(oӨGB fCԏ0<۞5 -ᅧ[%-F&ۿI-[5s_n]BGjl3y}@^51ˆ P>LްϦhdiPE!qKrQO:ѡ? >^X.»?d!LɻF;k I)C\^λ={7ÛevyL_MQǐB:]qU ON_OcSoY0G.U / > T|N+jKʟ nۮF9F.OS ʮi s7ΐ}/s*oA)Fq 7WP3!WOJOZ8Jau5%%*D_zfJOi:.?˒4PЃ5K@=Q[In.h>m93݇B,qU)]@5 uk,пc* cQp=#{H-z-s?-B~~-/1qebF (TPA[ƾ%ez4+: ٜ^% }bitN>gmb^Թo"zN.;sJ6b39 qSNœ+hzp+Dd^q$-{](~_ Lw2G8JO(G7mȚzfpjiW|vos*Aw37f]y>WavTYakYڨr=uUxdxdF30nPA 4Mpf hGkF671 8TG,-v{gӗ^O \N@l Nf}d%`͊Jy$e++t@蹳;-漲k#˪}NYyJnƨzem(ph˝1@avR=/Vbk罜!;=͖+ީ!;υ ^ 4(v8M/m Q8UsQX-x"PX'=VvP }PuZ|`CxW.V??(Q3(;F5Eyd@ETS\tPwTP5hmetM-!6e3:Uu-Ne@?e/HI=m5W]4Ŕx6wQ M=E2!At9,i:1'Kyϊ2j"iC4U2]/މK߽=٬ S)!cw˥_pr󲈼Ȋ2ynfpŻ&6nLj9XD1˜ S!;.jz4 596K#p1zͶRwDbB=SZB /Vqi/~̩v* 95IVCPb vm/|H c+]$f>Xwbr`BtpPJf,$/" atSCB-'zHjvpcѮtVgt)\2b#]Lgd@ )1' ( u-?L,ku"s4ߜsVA8@,,cImv5 mo4qew)bm9= `Gq yΚزDoQXz EB%b"9~^[JԌø%)DMԩڿM5^Ÿ*qf{7V-q "*zCM@ G fS 1ЭALiTf2STY=u0QP )vs^]'D߽-GU0!৽ h$G^s\][Ef+\5\vc3ajiеZ\#/PZB>KOEpr3nE *U˄+dU_ 2mg}aLr@O }UI3a~9*l!p>XpUoJ+PYNɰ_,QO7-q$qzmZspyj /UtJE?)g]RBmog#VrH K-?ꃍ.uN kJB_iv7J ]8b D󶈶H|džKZcP:[dsŐw\?ڟnU ϧ0q%WA1} >ӹYpAN~f觓hr R\4%n O #љ|r95%iR0Ýti+wɥ.0pkuG}u@c|- PU@r`JD5QlN"'dnv 3G3oex* 礿ijlOŢLzұ(F2U{J 18M_b`+UT?Hnx BHpbIw]hf hG9 V1 [- .(Df׭a2MTvAx fxث<^.nōaV ts G[FOo0g6#@QkQn,crEs[r8 `\MDn焖Cϝ)IP\5 ZJ(}A ł VA3$KN;wLvUĩddo5]Qu9c~`,Kj!*/"b)%~[CibD,[IB= zH:qYׯ1w$u T\R93J<&8-Qխ 32ąjp 9&,T6^;2p BCSOhx