wpa_supplicant-gui-2.10-150600.7.6.1<>,g!p9|MTlH?!%V 6wmv5F7Z*ZD8@ѩް(ܾKB+h'ҏٮ̺DiaQ&s!Juy梸쪶Z<_TA ><?,d ' J , BNkq|      *4`ht(8+9X+: +FZGtH|IXY\]^bcd#e(f+l-u@vHwtx|yz(Cwpa_supplicant-gui2.10150600.7.6.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.g!h04-armsrv1 SUSE Linux Enterprise 15SUSE LLC BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxaarch64 큤g!g!5d525fcb234d87c55ee3beaccb03bb4d2a179e783c962ac155e5c6a6d1782154d57783ead2cca37539bf8b5c4a81b8105c2970de177652fe1a027433593467aarootrootrootrootwpa_supplicant-2.10-150600.7.6.1.src.rpmwpa_supplicant-guiwpa_supplicant-gui(aarch-64)@@@@@@@@@@@@@@@@@@    ld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.3ge}@c@b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- CVE-2025-24912: hostapd fails to process crafted RADIUS packets properly (bsc#1239461) [+ CVE-2025-24912.patch]- Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run)- update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)h04-armsrv1 17418899802.10-150600.7.6.12.10-150600.7.6.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:37861/SUSE_SLE-15-SP6_Update/9b432eb1227ff88675139bcb07b9c311-wpa_supplicant.SUSE_SLE-15-SP6_Updatedrpmxz5aarch64-suse-linuxELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 3.7.0, BuildID[sha1]=d20254213079c98e89091bb17349b31acba57cec, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)RR RR R R RRRRRRRRRR RR˟QZsxkK>utf-85e7624714779628126ff371b420bc2837937a6f75d573055737a6d04cc29241d? 7zXZ !t/*s]"k%pRUJzx+P"\>*LAHdz(oJUUrUn&&/U2m'6:{dxdsH/~BnFT-tCy;:o02aQ,t5$Rz,0@4Yaϙn @zqc_sm`p@{{RA޳Ì} Ahhu.č/ͲL$/zbF~'@Ѽ(SK"Pz5)|T+%-6"v;$trȿԊTtb0 թHibߌ0A+/v/7L*rksqY^xjmPZ\N:c oTbH5`%f(pU ';Tf8 )d6"jw@Zvc c#G_I~t+%ǒx/]!9**g!Y$bV BK\94c1\j"LA+g1(zoٞ :1}8f,q; ZdB;j_`dfg,X 'QSҖ~4"q *M߅Tz}c5a2K6JvZ] R晦|O?G jLg .&7±Ȝu0r'<ucph5"d\Ry{JD7|/&|G#I Yߖ<Je?,os"LGcq&Uj̛VR)kv'pGrFm? ,.4Rt `[yƪ%>wW Nh׍.?H 1JqXNfjٕ;M}hr͂ţ^į:oȿNr v NuJBg?OFpm.##aoE- =\J _"~1DU%~˨w~ vCI8gh gG[QoL*ڽduCU<_SR/ *?>vlb ꮐ!',umd,R+fG~E8d< X>y.JwӛCh:KQ!Ĉið(<ʽ?jU5#P]*Q66˃@eo*?P.=R9C0'ԂgB.,f6}w P~h[tBW7KnC7dxVZ*kux{» D'*/xJk"w2 E VRy:Zq[FG`3>薙RcWw1p2)vI@ y}> 9}| P^br%#trV}U{#f;u&ZHxU_F5zo<׾Qw fi:=\ oMJeO]?N#asb+q&3ۭaiX_"#AX^@\|T  OFvnd9 u$I; w5D8Tx%W𖜾G5/\asվ+Re`wǯpwt *fX~3!v.Jn2T ܈z>bf$Fp Z-X7Q( )WqvxD(1U|t!l٣Z"P5^H^smݼIɳQҴ4C|Kq1(O= Q~d}wvrMh-~"a[D9DƊ aff3w)& J˥0NhwLT3oC"n2rr:5Y}˞pL)d="٣&;IqSp(',2YO*$)oz93_e<@M8gB,o.8 CkV_!e}HyΟkAu.\OB5>0ܛu2 _@BEx~*0m0Y]`UYȤb4\speb| 4\ns376x_[v 查3@ LumB#mOvJDœM6(F)46k]Ds K2CSCګ`;| }aow@^VVN~f:|޻؛Ihp" P嘷ab1DD^[FmwKs1~ /`mAFmɩ%ynR:$B:^us7Sb`nbo|Nz㻦hE+4 e3noq5rADfT:i6~< qle{"GZ?Bi@|nȱ3R˚CW5ًQ-,4(5Q[f!26\Lgzcv&ii_S% i no'92|f]`iS ].A@aF!kHD -̢PR?A IY[xrג,^{>ּhfmNR`!cBQPso >CgҴTU$} 7^yOFee1qG ?c9"%ЋB`!j^0r_/ C{^֯,|Yɽ͏W't /Qw.gFz8/{[`ԤP%Z =!V!p"JKf N/Զ@i ]ƴ-Z67R 9݉Fd.~)LDje.*!aӞq!򐺣 YAAU31=o;ޡbrlCUES QiL"V`؇!.Asbj6{@꒗"h؅b̙"{lڌF04;Iv变9F/mQ5?wߔ*uDyJN0 ^h?g (dmFHz72-m73F9ң'-Ft2&<24l!luJvw[6zq5؍0BQ3{LW>XۂKum8ܫPDvt|2?Ihl\8Lmp;3!_-q^ o-6H<1@'siyӧ@nM H) J6 )@2ւRzFT͹ݸmc kץ2_рVj2EO-N/0BI*h} ,>"]ƸYE)IKS|qv\Ěb46$k3(@`IHw5I)n "!a.93EL"dş_T.H畄K)6̯>y}0IeMTd:p)鹲ᴈ_)69!VT/*-r v4glc?˪{<9!9,:b?-8 [:u+D"?gQe>l@6pžᠿ&;C4I=9Z@6K)I鑦4iy G֣KҙP&64<ٹ3P^e(f߳"qDR y$ qjBK5;k>ssH3;n#pl7HpmMVe.KtǞ4nc_}yRR R?!췍+z\Yo29P5Z}uA0 x^P:NqM_ѧX\y,VbH`ϫ6&ZpEjmVʅX~"oC4:wsOŧK4 _`2u 纗,[ 7BJB߉Mwef6Z3hչRhILҶF呐5S޺a>ު b\Lhڸg_*wgMB/_ Hڶx!֪ I&+`* 4)Mj nO PB0=8XA FR#ѽ'd5]u#2sLSTPK0%`}$JAMA7:p*cݴԢ.":+ #KUS LـJ:^jSL2xR4 "(G&g*nqW S5?UA{c_ M5 ۝#;0\!gIqnrVRƸy28(@w]w.6C2uuRiɜw Dnxy/ezPf%$$ZJOIL+ *09;N9&pA,HN5-ǤϬZ?0RrT^uRsDztJOaM|ۤ8-+ &y$h9A]wq<=fFD}W?+$ G1 "I y/SM~)+%w冁(="x@B .#xOs"eh؈-xcv=JJhZ_`SּÓԺEAڅP`mt.sV?5ˤX\՗G4/-a]kTym\hj )f6 l +TC?}d9} d-2dQ p'Jé@5 L'S!S*-' ܊1QxNmfFMe}ɕ_/Zc>/;ƱR)4ʵz'*F_ł-n3w@֘ԕ >OC<[?"cgV .}bqL1#h>~L \) L=VODž?~Ŵ$`K U/z% =3:`ti[^K܈3,fh!ьDʅI&Pi<?6 _J/&x. ?](el8W6Jt l4r8!:GV7VAFG^/lHpeȓ~-颡jt_ i)> /6pz@fX` (ؓj$*5AU7.#0Ӄxг: }d&B^j|F3:lS[3֨,TLE)&/k/vvu3R$\#y:bL egJN'c&a<8ޕjD}:ڮJoOx:y7 b} ˚}ZqraBՈ#mB@qXYlyZAJ\nt0$pSpd9(3uV %USgGŗ7l̑Ky P,maa!ԡ2]Ęm?b+ p'OB ZC<։rKcɩ3Եi"@K끻~rl}KJ>/71>w*Vfy^!4[n-f>ϫ?u\?rJ5+UV`t1 ٚSma-گ|QҪ{hƣƖZSSYS1Ҁ v:4S%vHAʈvx&=j)[B qTVBe*"rፒBgacLC|&^$۵p}evx;d0Ϲ =⎫ k}?!^&Lʍ5`df5]Թ)&/,Kfs9X q^=p1q0E[e痑D]VD̥ʊJ\Rcȴ|if^0e42^Ew! "yĊIpF̴poj%nE!fw ^ټQwV1ےI}U O:$H~L|:rL lia,l 2C2w/DI{nT+Pim1܌*eAk?KGL%~aV(+/XeI؟szĽv]x*svK CWӻ!ě|>i W Ꮇv񱷏DAѦXVaEﱝo9t 0:z:i"vz-믘XhN‘U&q˶!ĹFȅA)8n+@+{;X'$ԍu7reޖGoc܈TimaE4 n.NՙjnJ\mJ0S\ P[ʪlEi| ma7N%ڕ @3c#OcC3Jz.N:QYL&[q=8;̺UϦ;Hb8[ݞ_b5QR7\m}.<:+Bz}'?-,mۨg)>|wS\S lr.rWrRD]ےV&gXݢCByʋ57Q>w( A? bô`,}wT86;myB] =PN>/XfS.(@D)̬+>y$XTl,4WUdkRzRT)|<\ $N16ҳLb! _߳owe{j 9UkzZK ,٧.DݔVkps~Oڄ,5x\v:R6C $q%/B&c٤W@L˱bT_jSڒ̍;=5 Z؋@֊8FIAn[6cc=ɯJweu-BGm8l<ٸ@8ua)j-)FdPC< ;YWһ'2e%xP<-Αw&C[7̧E{:(ҵ_ ߕ٦T.&s|{OW7)p`ՆlbSN:mnj,&$oǡ4 "ٽAÁb>E_mQ 3 H>.ePIEmM'FHTWu}8Bݝ :|,=?H.S\"ޟI>~ (vd3ʤąE+awjڛ>TN {lKb#%+n5J Ρqj"P=gTe$KmEN`Q&-T m/cJ=2~ةB!+М%(3Ůk6铎8m'6vփ ߌeZQ۞,fͨ}:Q4ư85ñ\WK,`B.h`zdo*J䜟.Ҝ2 DP^ tA!aͭwOZi6D;(n\ʧ H `̮2)-iM|B2LۙyE$b-[a0-/qvcc +cL}~aڏ0 c, rφZ8$d4Y.kBߪկ ?Žڿ&GF1ʚ:6h5Vi n>߭&ڏڂjemeFsVcO_G%]E[A v:!X-:nً ߽>TK.v]CU (ޣ0RA'@duLAϯt88 _^çq1O8ו"yEO=uWQKCC<ȑcPo OPֳc&Vp:1B(=v*̽ÍX" P9wI'p<}&4MKHiPL6>lt2sЦ*4&CYHP(n T9C:(_AVr포 -72NͣUACs; '+j#G$o'F {H'QЃw _K %aoIU uWp?"\[E:(IZQ ü5aňH Sd_ jR5[WSj^IހUSՖc2\A}7m&0; K^w x$|~7E$j;h.*ݮV:u:4.1X&#GB 'sF}Sة +Jyd٣-n97lR{ڣti,tP1R{[f+O`6A }D"ugZYz˞zu=\ێ:J5V"Ǎ(#KeYDԯNe="!DY#iX'c-b$Gi鯃"n?(A));*r:P,O co?M3q'6$js},6Cvrut% W߱4skPYF .>QKY2ybpwh3@p`?8.ބ|vŁ>DH+:M&h =+dGӖ; w"v lYc-I|js{,>uy"+_{4ҏ}kHX|k5_3'gݻ1bVE< ؉LZa,3fsZ3wh@x^bRy>so& >A]u_9tH)zиi}-C2x*q{=Q5 ]F_-yPg 恭Tj-BX644 vSGK<3LKi3~$^S+[ 9%Wr=N[~`! @/=dʩU˭B"oBܥU랛nR],ZR9$41;~\\]h9@R%0l~T|%ZW!R573 Ĵ#@߈YL@ ((mojF̠JD*u貨y&9`:sl휩M2$ Wy9Nr E޻m!zJGU1ʼn /C`6g47ldWf~ 7(!P wRS2ZsW0@D!]Rxsw)k̻YlD׌ů51lHHoc!1 Wdޝvlg|Rtmr<-=RyTRr5TF,Wn55{`Pt_]7goYHLd294E˗ФW= e%nA.'59|qlC0͗kJŻ8cv[%<nƌHUyeIJ 5awȊ<~xO}`\s7rWȅasy%1Oi4_86Ql9n.ڼY&֤sA>7 ^71M8#;wcjTf#f*{NvP@cPg`t˾F!nhCQb.n"dsv`Mb3&iĖ*tP1 HSPK'EE YssP/AeZbctk*?G<3U?ʇhA> r0UM7_}|S;r¨j$~%quP^)I5B$_%P͹x?II>q'1hmjMvcVo\Udqݶ)[)pgԔO'K TL<Tc,ueIʋFv*˲='p-Yq@_cYny !fv+2u}Oyd?9!C5A{g<:5JvT:(_a=qV}˴ޗ/ty4YAXH++@a6~^&Vƈ"r=L5-0M?0oe5ȥi)OiGf=չ 1n@v 34gi< dvO\1[xXuXrWo&(iMpq ȷӐ:2=sX/ny_(C`c#"O|9Q<<@mOd\U}YE/y6\׭Jn)lc8?M=ju`@`=R-vF#J8Lr'&|lzp?!ܯA$h[FLJrVa( ?A9}\<_tŘN[醁AR+7X!6<F7 V:˳s;4L2~lbz\y Lr U;@Ҷ0ȜLDu&a>xa=r#EoV9{JAV &츳E_b$2q/Ά>8>ۗ2X')``2VRKz-A1 zBʎIΠTyL)FʙYRE0_ m/J1}s-V(͛PCXO 5{^O~\.P{Km}c!J:<4c*>qoaDT@Nh+ B2HnJxzY M5`r K"㪁7]PWpV~ /Gbw6-0HG;JMɖ (tr^ul;bz =Irare>?OމdDy 2D^R(mhC=Lƾ_46T\g)wsJtKλ暞ƣ7:g=GT.ˑTӂk0?3!`BUQ]7Pp볺"g/w]cMAQމ+p 5W'[ȬS,RvtҁcȰ2ìwL<*iXi@RV=yD$ڌݨN<,F 2 77hIvqj {9Āp+ķBê^&/sN>E*l[v߅ppxC po5wtbi\0x $BP38Ecr|ym){ò`dd·u~+7+BaWsă(wP)OIV[t 2dl Zͦ0xbbwE+C:1Я͎C9YH7ѽC13aGH/2lKM$q.4EE,>ѳ۔no>S޳R`^_"Ƨ% JzzUWCt l C nELw: Q_rLr9~lub7~QL" feR@6ct8p* ZY"4۵TnLPtC q+#wd[>J?:h2лBMqv //Ҡ݁5sFUXW,7P x _-tZ Ufe:C*t?V^ed/ڹx0z\<]}Rk̛9Yy3hZR×TbLdGT9U, ]g7$qu3z2jK*K; 9lsG ZZo q۞vo9 $9Ozѹ]U ;[ \0Og{aʫfW^ܓb#]e&YBouq8"gJ\Ւ쵳#Bd|}w6oe)gPD҈:rP1woOAdъd{<āVsuFkK|?'Sr_ohRvud@ڧ)gK,5+௺n0MY@Fcg wkeXq j_aU?a-A^v>Z\h)#Nm$6E2S 2b+ 05 |f*} z R\:y2zd1oSIK~S#>ݧP8C%ʨiMRЙՑ"|Z;,|?P {v #:2ß9뜰պ.bSq"!8I8`38LƝ1^ ]"E>1~CKJey!P%@<! 6*8`.A1!.lH;{po7P⃖4R͞Kв^퉵Ⱥcs3&Ir7D;kQ1 #X?~ĮwE+2ݾ!!ˮ8tKx=%'d=-#S]ڲI"i@UÓp+qnxxwTd'}1\Q;*L⎰R@ǧ t]s]` LLĊ#Ff#qҬDWg J#'\g3.fkGc!~ьnHɉcQ"!ƠPrB9Qy@!]k2;1ز23~a/JA^m %7ۢi ՠԳnk5qȏnb\ޯy2 av$"4;Տ.ZlyD9dž@ ?)ݣd?j-{-|]S!ܲ 8mofcr^hk ]q͸ES]0LJ A}K_QSLI7W-$\oQ>#S^^#~kX;ՁNW` /iG m1I{bm axdaUq! HZC//W[\2R TG{yy n%9R*i%%Lq+{*le<;>w$D#[)% g *&EG0ϊQV1HVB-e:e;Zx zB 3m=DF /JN&N}Xܦ"]r%xK;:et3Y~hx[BwByP|B!lxnck瞀*unYIXҖ%c([+qKyX)3B#ƙ49DcqǭۊkLFJAھdfud~0jvEn܎YQF# L=lH> Mm5r8{P>߷!Lji `kD%o,{eFk6͋fÎ"&Cw"˰VtECZ L<|-+]A<͘ge(D'ex]ד} 0"{u R`[ynO>°^H|{;[/5~}O`F.Ywxgz4h v1IY5$J]-E[8;51fT"#fKe*)6İÒ>Bhc]9Zն`J "z<$?tٱiL2P14ZXuW)AU Ack]B}F6C~%t jgpg,=8O`%]m]B3g*'N`}*]v oQsFyZ3@ hrHa{)4iݿ\ʶ4CR8x#7"Y47>+߀Q120F q-dM D3An}-܎"AC 5Eqr)؝ bVYKJ (2 "vI>7#uD&9v_kh%>gRO*ESS|&"BcLkuqyv>c̐ hkXoLخ)WV  bK֭.lK.\[f[^HbÁp(rA/W@c .wʋɉ PG96q5bOrƍp.Ymh?S>H2Db*s[r${ +ڷS7$+?́m 4& M%("d [%ts`]uaHl{>:DSl !f,ܿ@oK1nZY<*C8kDYA)"kߢ9ˎጃU 98Ľ!h^5 M擟"D0]U_^.UaQyÈTvZk_# "8d.gN.{_Bay(E1m1ႁ"*=*>Vaaԙ| izqZULXJsakZ:s8hNQZLW)#{u+MXʯ|R׿Tcdw ΩEPb9c$@q)[{/ݾ.jO.|4?ЛbG]}w;Ae݈,фlT\-0!<vIb-IuVRIxQɄ}̿0-oK3|n&"Uۜv*%[̖3!Z-eͤwCįgs LH^b[`oy#bzMt @şf.ޘ1%c`vuX6߱^l"g6PcUWFD)WK:~dzWeZ)iN$`43iWDl5Ws|U)˘м`-$ 6֋}f!+px*'_bJZblO)ݱ<\H+>ܣihZmg*qE9w3o.cx _KƞVΘ00؎^;.}G;0q1b.:]NZ,}= :4Jʮg`ek!53pleiȵ==w0Z(*rA1bcCc 굖KCt582X@Bа6_hOX ";A#REq"G*1 lj#@v/蟂dZJĐ4:!Xd G_ GiDb }4# $PT3BD#H~/\ `?%1>7DHlkVAlkJ"D@6zh8ۖnz3U$FX ^]zւrԬ1?5`Jl>oVYX5WЮPokzb m_Y\P"jUw :q7xx8̬B|zR,' <8_t igwgLI4*NT5nL4_[$e3$4PrǤu6e?-IG/t+'3FNuF}b)T{Hgu e|?bd.ETl:@@I,lg?pMٕ> 'D3Ib-*uw/ USIjA)1ɷp&%vg=2KVN=XK)Q_JpIAwf70 AlWÀ"<{3Zغ9^3o&`g.;C.ޅ<ֵ@P7cpu縕?B9oGYnOTC@Zf&;J1cMP\X䯈˒/ZSB쪕N <Psb-x 6d&'x['J:5 Vo`^hݓZ{ /ETU(pۀ9~vfטgwZV?θ[F f%p<y=ҝB܏8EV!:xǺ1o讥"PyV"JGݤFDNégVB%k:K<b~6cM{EDp2x"k[sbT%;H'24ߖ4ov*ҥwِ+"ק9$֜50}jgXxȹRq4|u3=(̨l 5/8(@HWz.d4E[YsWCs@_Royj rB̯Hhqo Q0ł%B<^_eDpʤ%u(ȹo*Ll @c3N09wT?iaJMEXu0C/!wg ^*Aϖݨtz;.juT~(S&B/}Q96WeR|h.k")%:V^%ܾꯌ N!Ӏȏ}lR._7Y 1o!h*= ;uBr{q2$(.L |w|ս{fZlCYO:岓chWPjUAIYуc*Bh[_,֙3w19u[n}7zQ-vSN>P$b3~LTٟ1[Maͣ 2.k@)\n*̄hz=S;O+AU3W(`[ 7AC.@:xsюcGA]UCnPHI>PҤYd(x RW_>.W;]Ma~ =hӦgf od054Me#).0(y$CqnsNs0)(I(m`R-Mkޟκ֨Ws ?԰zCawu.rF|mbFεyXN 󼒡1QN4Uo%l9c`LԘS6xZaYbo)82̉wO`'ϢHS_)D*-$͌ZGD~!@L6+Z:Rp+GBg3$1=K)(v\)ZlYQo<.m<)X٩` ]:[bK$կ`we+HE6R|i{j^',0;fCrέKh`ҋߒqm\<VcMEWy^3kƶ^M^ӑ; +Y*"TPn6Fj!NoH^.d!sm/2Ҿp/Gvxs^˅¾N*QNDS2H*im יwsD/i 4B@_j%5֠ZT{2eR->WlaaFqF:B.H8$ we1*HU|5A *[)~]'fOǰ[LWn: ű_E*b5*b;2)9dZ`H;b97כT#mǢE;6󝣮Vny.s]2"ъ iyh1z@d^[eiC~Nh)T%$ s=F"veCѻP?67)=T+%D+\,*tLcUm:<8Iz79 + g^CRD>=51MpuziWWFHk#t&h7 |H?ʋĺ * & vb.hW9YSU9OjQ)=j)j`lf xHǁZxE*{Pv}R]SjB,p>2KG8tX.IowdeKE"#&(/ar^{cm{hy[P LGW^9`V5Q e`b@j{#ݳ>OWlA%|Ӏׄj" m^s@yWJ# +msN3 M gwV<laAn(BKOh^Mej6=|l-Ȗ@OM:"t?>k#g )mPY{J&#Z1FeH_@x #gyZʊ;"r9 [+H 5d/O $p7ʑ8 Q@hk(NY"߹S4(Fto:vieeaSMb@,B%(_pF E#%{g&l$ +D9\ v0Tñdcw*ZC/QCdT3I ,U #}gQ>)gN!IR[m]r( #YXy 3C(j'~1S%W3O㣭hv}N}jE\i Oo"Ad5Q;"4F*^*v'TR\'u!rNI*d>`,7jpj* Ĥ e \3A8p)JiuP)Dc(4ǨE%4ra;#/#JUҟiJ$^%z۞ >Mk3@w+)PF|*| ×?{'()%(#w?W^gpVS|fG{JzL#,`啘q ieX!@DL@.T\ﬧOv\ ai:'}9x}TB& $~ ?TYq?zȁv:5hҲ[,-[AY8}liU1J( G)^=Xe Ww Míxm ߸DPsZ F/^bb0ւLsa^k, 4Ԣ0b-7OS"T d[qۯ t ݤ.(Ք y;B$a[CthlumKm{= ̥>ypte힇 I kju# )1GAy)t ՚ }f }KƲW*@ {"UM :M>>PQr>; 7 *uC?w" VD?w+9-ܔ"  VE3d(zqyO'Y)n =}ýnM7aF!@m,xVOCy?-@!_!݊hYPm/S&l$ 0c 5G+&fUp~9~i)j輟e߸5X9amRdݢhuΧ@0=EÊ]J}9)nLF`;>a@9rFkBz Q2_䅶if4WyC :tJxb{QS*p‚PZS9[c=o)frUA6[Ͳ`|Tzf}=1%`RA8Qo1r"`82$ AV.K6qkȱ Ug+6lm/@*Ν& oJ:2 c ": q;I}G7P*޻x[F=!b!늋qn MyP}_ Kv<~ߗc'q{n(*ς:PPd{nrVvƼoZPg3WBhjz Hޣ{>mjܔ?"mc@ֆZWnGs54IFN bhbj?InCPރ*^ ЧT~țpc/ (|\}edŎTzV=>顃X)CsosEEkȚ*^J.5T<9=hCwJ{)܄$N"+9y k|0$'KNedʭ}?X7 2d&Ӟ.7B>vdnv?0Q_l1RK0`s @ACs\*l9UFvmҝ 4% yxګ~ɵG4o`ޝۋr] "嚭'dεڀ#>Y,#@wI ĬD1a8z$4|n;ޔ%-ce5d&ܩ8u 3H9)ku / s Tir]5h O07[Ap(ڨ5 WPd"+xX5d, quÓ 97{ ` VF"P*q"&bֹP"Y07wm EN6t|=5Z1 GbSO d2Ye88.fFx4^펍ވ%L(r7/\m d̟v N'cU#!gNE<辺b4ճ}EVSɯE4&U6pDTE'mF-S${)4jdU8IBTa$>w$kݶsJT@Jq7$PnN6RE<_RmqU0ac!KѧhVjC6u9GTWU N M%Ev:G4qy.=05m ]%V,b,{ ?`FE6ױC@C肎i\Sj9TQxF5b)..y]Vh#ok>gN1.0iHF-6Ay,r/U.q"7 F'61r =z #ON-5$8](E*y,hAcm1X~iwY)q U]ѕxfNptT>-{" R bd LZ/ݦs\f/[XçXi)jBߎOmH!YC ӑM)T~:֙!|pvQ*u۾" "c5ڇ;yX #cFU)ҏZ%A.x?;QSʵ7v\Ub-d< "b\̀P "ŪH8ǰnhB|!4T%onhj1*b20s&9ӰDnhkWl~xKH;oEI.EڛB}T&"9G9oiA:lZ4X]/PTbZ:z̊('>NVݑ>tw6Yh>,MzO*lMp -ħ Yg^"R|tYg`lқJr<  FȞ́:xB|Q[fa9>G|DxTip)x$p^'AmN|KZ,\a'KlD447a)ލ0R:m:́:_URz:lC-~4JBe1>;.xXp,IRT]{fԅ..W &S42%8I=> "AY+BNCuC"vVMHhjbUѻBof:I\T&:#}ȽSy?)a$4howg`g78 e,ca­cSYvp-}3ۥn{A(Z++_R\C8ڙ2>p!(nԶ23S bKr"8ņY2ACLGt*f Qv>*:_A|- ʇAޓ$M-MO w^Vq_}x Ú0tH .B(JTy8{/La *j53>5Ԑ%SੋQβl"ȖCZ(+&w zO+_^kk`0 k-Q7'I"UF&#gc=ᚽbD<+ٛHɐFAȯ׳AJmİFg ~b$p dny휽_쇠g1Z_8?VzyNL;uZC9Y pg!Hǐ˱!|~\`8ʌƻe 8p /T]& njl7ڭ4 E5'tz[5T˦{w: }"f$; `UUzTrLe32"1ڳ“pElsZBᕥ4QNhb~7fWSm9r*Ny8P1eC%p/CSk6) :SPV}+闡+iNn#jkZpY ک99C?&d/KUպFsW[| ?D#L@4 >|t} pyde?`Y%ZkKfߋBʼq%Yq $l"Xӎ$H-JNdH^?vG%ʏ䥗ާ B3!x@fDȡHӡT֥x~>5>uG,wU<Mo悳(WpmוN4;~!=֔3<.֞&EYD >$`ĖsmX{Ɨiݮ"%ckS+ɿs[Abl'1q:Z~K\;&:0J`U X@9XGyM(,m5?CK[h'1T UrxZegOwb}u<>>J n .!B%tnsI:Q]FrDzQ;{,GVs O\:Z38~#G &Mv9Rf +L\/o f*Lfћ}5St:cꩪ(x kSK{_H\ۙLz߻^wߓaJa .Zd Fz̊FtHS<%iB~}'6gn zXOi _}ﺎ.[ή';tb x NOFհM#-ǂa!AJ qG#t3'|qzE_ e̛ʰ&yŽ/'/Pf& N=<7YAt rہ:Ff0:5c5⩞Aw 0-~;9ܴNK8S6b*"f:,(#[3 SbT̺xH8R[caκ?G1T#OuV9Y!ݮ,ްp}"2ۛ-]b4tCu*īo)G A6oW|-D7LUݵ|wwu;u=-7 -G:.Ҳ! Ȱ?5}"wd +%C&HD6n-᪼lhp3E";RfιzO; ΛB퓆Yq.5 ΚOUH{GI\hֽCT;M&>ϻRDu o>( o..o1L曗ޝs/ScmÖc*^2&vబcV.qܑS3xNѾ N)vhRb_\Y noGsrmSC* .qI #[Ψ]zsʺT,]>[)]Jn>3c pjûj3d͆3s- l˟sюΛS-%1F5R)BWLh=~=~1_LeQL͹ݭ`i5ۙS+ ̟+$WWjqڕ_ejmNcUT뺵/?FV YĦŌynky{z:Kux1.?LlVC>ޤ{HL;mb,&Ck9.-qAXG9^#b?qpgvV "cgRfZXnj`ۍ8θ?"6iWevlIiX%;r]=DLLI:y9UWO{ o$o۲wO 7w-2s !xI.l*!OϠQ4V#0u~Ne>-KMH W^6g4+2%!Ge]fVJo^ծa2Va76|L=\jՈ0/ \#:Ne f6)Ru] ^*/8+.\~  ,d8 $0{vVpPIx'!}A#pʄ IwwTFQV0J#mhq2Sћ29I,$[zFFe0`KHc ` ]q^hE#\IH)$[LSP1 N 4aڅLGJ)ɤ ɠIys=/Ylm>}GEI~a%պݣ!!$xqsCA#%5ck(%uBa`7ӧ97ˆOfOh"U3SчzKLg0X~6Kw 9h$b)rֈ9mFG?]! 9(Ξ gdX sprM/ >&1. .p9LatĊL<95Dܝ ”D&8}ַH\~VD'Zi7n!Dy߂GeͬϾzTjm$[W1ޥQ& AǏή Lm>r#4q[BǕwn76cW=vhP%_))Ф6-sfz.>,к9x'ڣc>[Gs}on葦MYv^C\tH}lErˡ*C8;c:tō7O$ ^ 30C1F綾K%Z~ZۖlĽN B=3w"#oo[0ccg26NW##c0r js ߇F{bT.r(w߮bC8j'Y;y4V)lMbnK ?SM=MYG &B^n ` q@FրDj4ej2ݹqjHwb1}E"_8K_~촟iD5k?0yr?@-ȇ82=-xC^px7a2l6KO7u\ҲO\lZOwE  񛫤Zؘ|Lu' y>U [uwW8P`6 Yy $Zkʴ|:Wpj{+z'K6K@zmA~>1&(JTǻhO(k5oAPR:2Ȳqd5iRv9ryCjp\.ۃ.'gHP#MvH?w&ځ^:fiV6]I}?VF`_CMba2x[h'8`}ʻ l> }|N|_W$ Dbix <IQrlV"={0)wphvBLfH#3^ծvВ%V/&g9Ga-}`zG 2J_8æx$+A,bF2珗"MhOd6D ŝW욤j;)N{X)G=Ձs5TXU xI0n=7摥'_Um3+rnH&"߫bL@Xsdw /6 ܎`hx~32P):2O40Ly (^R(:{]Kw6X 9_+2O9ʷQ肍JTe?X}gŌBR9* 2%ʕձ%DO--8 ԏ7{s TE`i˜!7@ClzHz!rsn(J61etiL[u(Ѡ!"Ü{!}3`VoQN:uRSq4]l CD0' ql }_^ :u4Iְaׂu .oFX۸N~u?sRn/z <+r>I 5mh ~jgȫ'R,ZW'c5k+r0w*f9S`;B\o{zT2H#n7EKn)s4v  aXV<3D*JKW?ڻd +&3|N{ei٩ܛ=.mjfHƀ*r%,2{˺G,0bq)||牖!0jfdScV d{1CpbѺUS۱VSܐwϡ-f pAvT=pL#(|k-{b;h9;QQDCR m=ҖLAHw05VM=ؾOx@TZ[d+myvjYh]牆h}H2 mWI_;SVհ/Pg7CMip:KgjbKS0[nkZ,R}^@E7._Fxpɉ\BX:,إi ݰVscGǡBĖO?P $ϾTrPhˈ\ҳ ^&|=aN zh9M2Q/@mv>@DW=lC!1JTsz\"ͪYW(p)4k1*3.X~ueV-s , ;? M+F@8RWdN^!w[UFceUf7f $o:Y4H|& q8  SenzE~|l#ށ۪9>E=VJY% *5n0ձ^40F MAwT[۬v&Mý<'|#o 0/`F !^SU: gfn3vl=ӊbg#c(Y!A$L3$9̰=GERs_V,Tŗ˦~?JdC+ft;j&~ h*6 l_&(jBէ%e-bT+[" H'x,=rȾz *'Ѡժud) kSgm蟓 eٔsY"mj’r6 2O=5r2>8c4Zr[$Dg#X+ Uy#WqNYv,.GA9;<7amy֝8<\%m1eMMG:9\zrYe3'TDS+:ＵT:50<*{j1=JprwDMvK8!7+ôzU)!g`Bl0|_君r WvWƧ ?񱇧wSDVPMP5>RIGzB4ߌimD ~cclΎxi{Q#+r*RfexD[C]_ gY'n-'b˫!r;S t9mQSꮽ^G#$OPQ儽W0yFN2FMU IJM+ZuGE}V!Zڣr5.d% XXhשDQnA!V}Fr)u6;&msVD"ލ#p,^' n0k dyɡUAHh8>}j7s.yѹs)3F窿AR;eS-38SD+__#,馬TY2K`@gk8؄[Rַ9+͵r0kosa_#|)Bx1HM7rV9|Qɽ8X89'0ɷh]dI;,˜-?IC8Z0k4YY?74M@ = Xk@(ӛ;ý= Kn䈜[- TP6t@ut5ܽ*>{*3=kb/dC@Ȫ]CAyp24?Ҥ$F3|JӘ0g3U[;#+jCNgME9RT76-z4hr>BTT^ۙz~IҔGpT=?†,w锻aBtLtFf|Ml @Q`wl SXZP:kI=AwjbfWoz}f.`ۙY㱕}3pEk~sswru IRbEhO6W0Ռ]nq/QOB{b 5mпpNM#xRHan5xVD4cQŷz2^\ ]».jwW~',Z~ !ޯUhXA4>u}$~ ~ i2c2pW:<Ca9 N_+{R>W-{5Ĕ9 ;Xh/ k|VژA#nV6h.wD hH $Ba[ o[w0XW٧>t+TNcth%Zu,/2%'5LA[@/BqU廳߳^gBCV\U]#Aqƾ2. Y!m DdAAzƇJ7 jkPh~\$ :I:-M5墻"4͕ҋ8&[ȕdn\ДR"5@s(EXQJ.m#4{-:l~M.[>>Yǫ ~k.y .k,Rx]@E( gMh" EAwWI˟񖽘I,XdٕV -* E`ɟ@y V-r d VAO^;F3̘0r b1Y3PY _f)j""84oT#_ט*%]Y;&OArt!3g:32y-hRZi{E̯6ʒ;2f/~OsvT,4Ԩ%dX]xw:H_ V'5q-cS=>ʻW*@R~M,Fs 60>!to:Og44- C{21D)Gb$:֋vu? P֧L@kPn `{{KCq5M{Tn c2=˻BYx D*^sV"IGIFĴ-2&OBСΦ7wͣ)QU1/SQΨ2PG ]pܭk "y8o6Vp38veZ ہsԦ"o̠]jLJ'Q2Lf+Tџ^wOd\obϐLc".)"<>, \,hntr} Ԁ +$$gzin& ~#1mqp+ _Z儞  O8Eˡqdь'_G5LhWf_wT_*~JUi!!c\nohުu]Ⱦl2AټBTp!XjE.!G+%1GO4T~M 9?(2a{\i%&t4 a&T+ XdcoK&r˵;|ۈW&-Ԍ{yV.i.ҹ2'g~aca)g2R\ĸc~6-hS>UhG9B{XmZDC89mXeE@.B5nL4! ԢR{y`:$V`|\f0쐶[*RpdF؏Iz]tGxv9QF;*!hɍp@j|CJ7<X6qzWvK<\cwL6c6ɁGP!֛qB̧}v&5ͨ^3^(`bZ&F&-; 9Z[zz%C hnpmM;erY9M.βS>>FWN7p^7e"2fZo7/kkv\Jo Ѷ|_ 0<2r*^s2CBE,{EWz] Cfqhx+l\B10I->&*ER{2!nAtV ?{0:}*Ϡ& F!INpT^ }9xV:ʛ Kk =PϨ{`dp &wxPwBƿYRM17q@u#x%A垠 /CbY!|3Cz968 (h_Ym3sC9=P!\" NB}{&1ۭԾRߎMhEeZEiÑC1([9IºĉRfja<\(/K#GpwMt` ѐ1dY*+KB OPѢ &%Oqf_/YrM̓! h*r5]M̏Y\Fr#C%l̲B2,t07bb_rC `I[B #1Bĭط&cQ#bRl9D))dz*c̡X"+%>ݟ7{-9qi.*N-]w6D10WX():Oe*,CE..w_2з\n:}9Jz&&NsJɍAiz,B43 0=)ҿ ݏ*[AM%o_Z9b XY7Bcנ^`7/IqZw`j1Zg!0qG; А )_3;jj`oDOF~[X  Oc,$ͭi3f:x7NE$(MV5_: 曦ɂ=%_3Zf`J-giZD Sו7:!yݦexkn(l%2w `2oVU^JrjRȒnfn_ v10RTL(:~O$DbKZiB=;K'UF9=&[^eu :zQh7Q?"8FA#3zIP+wC2:lC0Mq򥂺LP>Q:`l|IcAlգzYXx!~/pdJ ( [U=d}h}ϭ=S_q*.T[`-!_VH5LYܿQfAHӺa渀 wz%L.ƻMə`g?&C1V!b{ av*Lވٻ:u!րOݷ\Wc@4J]S]՛Lw.LK&߹tv F{M>Қ-\A8FN7ڈ2Ppլ3c !,zW7X8W>h{_J/_6Y M3PS%^y2l*0. E#*$r=Gkw9LtPM)䤞R'tM%3߁{yя)CS2hls34ˢnvpN((jIx(Ktmr.^($1NQԺ\3!Pn|!mCY$Wj[3䯋I:o~-jқL|v9EIʉJ릱)#^_,В wޥֳfVV$ Bw],Ռroӹ'2ᝋz! ڙ}8`i*~\!P?߾qE 8bef(j8§{f.x`ڷB=h/#=aWI<+lưJ:ڻ*~T~_xIJ-s3ˤCep8U*yj"d7]]BQꪼ ~t2z$;j`.Bfj|=EW؆HfJpIpi)k-u!5 sޯH74΂M FHXa-Vo}^..Nfw@6=grFIDUhF,QG(HO f+:/NBnsYY++J~4i<0|wp 3f@˨2O!Gp#ʽ▕O=,!6WbO-[W]r9UB޲I hxպ*z" $X(5Ϋc MJ_f~\l'ZB|dm_m{Ң3YsǙz8UdCǜmiUl=cK=3_͚x)IvC5$0LLα\M炕\TQTBK#>ٰg"("LP\(\ծ3m031So5fXo _DK`D'x1O`A, _]~.hՎpQ:Aˑ:D׳uĭ1/=*v13l'eZs~J< tUӍ8ƶHL)e &I]Bc\8Sn!S/Z~w5olr(/,Ku7Sp LCK48QwSu%hΗc7˟8/ukZTB{&0 g?O_^sxFI.=I؏pLGxևbƎGڰgO4i !'E eܔPGi8P0e3+v1,SZ 1Ŷ0ݡA'&1hKK XIXƽt#[—m6u. R]UVr:ﱋίR ? MTQR6:8<Ȭ9D(R !P#v1.,%k=FcG6DwdܬG>34|#7mt %:w:c+cK̨-mkhf] v*&J h ddk1_Cݧ-GţԮ̩F `=\ܷN MI@H~Úr'x5 ԶW۩[}ǵ%s1ZW$?{'zPL5/'_q u`Q}@^pOtgIu6O$t旸Im-ZWb.:_p{;؈%AO\iHb^|8W0_;A$%TS$H}VHѢ+4'i'qCV`*>mjpJ$[= Fg8@/56(ƗX0cQr@t|o(GΑkPS8L&I3u+XzEG.7P _!oȤ5Bm>ȮjӐC%[3D娆%\Tbȗx 6f;Xp5civ}ao( kDW}"eWɈ%()˺FgZuLȵ=`D✇3N_ GT% m/VoFV期ezL],$f{4;rzU:: iޙ6 ؟/ ?T~(azj8D&퓞a$v1-0K'I4˃/aYA=v%lo dڳs?<2` "h4fIY*p ݨp`u zOota^Q-7||ZIW.c8 G +5lR  "gRhGf Qês$ω50͈48aS b%} Ai( jq^l>v4MT9UUdUFJdF$N[lcvl޹[Vmw8-%t1 Sx?ao̖pQ/dʗęouޘ|xC0LG`O1[-=6:Zp, J(+xJ`q]{U-=zY595O  5Lj]0zㆌ@q՛[ƍ5ֳúvO%絗]|l»>ז0E\Z"Yg ;9%GnHs#O!+×h@ڌ02&vxԩQ09}K\DIcc J$2J@nZA3G =JDUB;I4K6*\;2@yQ7ӌFkW㎓G"kEW})v8б|Ὕu~opK GJʆo)%u4kiaXSE}-o3R99XJM]Qd>C>bk:Sa'0ᰴ!] ,?D_e8jlW\i܅tG̀ ɨ9[k-d3֚vc%ms=`,$NB>{Y4}prSk)*F˥~ oMҦ M5!V kVgv7Ph'{_fc:M$JfgqLSٿ: ̀`G _-i%h,(1Zt .w!) KⱧj%E:6Cvp_F0Ow7ñ]%YwZژhN I^vőTʭ#/} GFf%/>`L IL9ı'J~)K1bfF+Iw@Ӛn8D0=Q5)>ԳdEd%} w+ d-T[Qv{>AL[Y?Lew2/lӘ ;CEctX^]V?YiSN(s\aMȟx_7ZɄ5"jrx.6ۨ* ;JmΉ-e 0ah5{0,;^DZ'dCCVbRQTWXocf؃ rDL`h3~&;l3+Pp}ϦzGtB6k51Me`WkL:o\1m~ͻ" Qh_dN}]/7i WОѿ9J.+ O˜Iq!Lx/ܰ&#;q;77a)v.D9p{Ӆ0%xӥoXB9[6N_4X~vIt#šDCԩvC0-7F7jSkS"2Q|2b0*eC,Oh;Ѿ~]chtWjovhI/Xo6? F@UZ7ɵ bɍ0v!0x!x%|nx5%'av:ZE>ݼCB2WG벃(-@4;ar|AX>b:8N;$V5T$Ԃ#i>ҐS`Dxow?e͠ 6Ɛ߄VLoZ.p՛q9_ק&11:Ip BpLLW&\@$B ^ Kgڧ)kvRKWɜWLq6hQu Z@oKhb 11eRo8r 39֏fu[M_‡:9I;ꅪvÿ/Lu\y)? 8ɿ@!#lC)52#svtqWYK89 ji͚ǟ[LXɸ[{Vi-zIma/ޛ7M` ؍b7 d-wTg, R2h`R_ZF߰ś)צ]-m֦@>[ZmkWXܱs_pMeh ( 6Arb݀܊b7n‹n FA<1o7,);J"hW꽳UO p BTVB~yFF 52.J,W2&XF=ۦy:C;1;gX V?ty:|˩noalq@DFڿW|QTM~ M؜,J ~ ){+o܂]%R0iZU >VnW0)o*{\|B˓{խŽ_ϔ>.7o`(@l-zF S$ D'D d-ip:P{P 4gp>3|z̈QtO3Y% NynaK|:eMzHw)umcͻBh]}=32P8]2Mj1T{^08)ˑXi!$|hm eة`-pX֢MrXb$)t8H-$l--E4lD%LK_x25jU<^$nzn`|h#氹+KBXtH#I2S1z/W9-ep`]/s0x˵̖Yg C6OHF@!nk} r9etU7u{lphfM 6V}SݳS.WRE4I9QaZMЙ)܍H@`jߒzFEney7)d  `r(%);m2~( LI͵W47*>rC|lATZje%!bՀ{k6#[6 3t1ݨ~nCGDf) -?!)Mj3!Ôd*}qw{1:{겔ȷ%v-?s%(y>q}q('d|ӂȎX#}Od Z`_ L76?KJ]Pv% x8rWg1M6,9-Wt8=}g l!} =mtŕVz3/)R߬7#U/CF>YIXדnt[2?<޾ߡJ$ՙYj2ۑyMl=v7ltW-Q+b+[_ʇ!4EHܕ7! X+nB=7.-P=Կ\xt6 '7NnW/{vPS^B(ptƻ3Gr{c|Vl.uǸErw97]^W WP:r2>hO׻OmWED#t=c 7è i_yC|k^( 2|:?=V.b)J `hY Ź}`xpw~nعށ;%نʰ:>V]`'?AQԫ rĒse^{'])Λsgz;yZ؎:r)1rZqn{ j4[E%)*p`e*tpgD{+X(ZؤCo&>Q;\Fh)u"MGxyo]9Ԕ)ҟo1XD ঱:X Sd"|hQ+:}Vg]{HyR^~6N-8!s ^dZKؗi~K/Yb ~gsiH\D>j,F`}_ ڦ8)Ь E:f\ja|}_ܽx|3<{R_陫7T2sawC# OR~mÐ|ǿ%DP0J-k"AOH/<"9U4*g4 jgaV֩@"S)2X} @su[@NRu3*z\.6ݦb3b!#dT;Sj PԆ&n\*eY>#9km~'}{nI|g֨(c!7J s sB ,0 /N..Q-S%B??wHHV|=Xqv *4\n*-|YD?%0b?/FXV_x'Bޓ$<.[emr "55:,/ ;˩S0"(u-nČFHx5}+4+'G|G3g)5Qm/ )*BMiz T }Ku_C46 !sj7pS|Oշ?4 fxp9W.7'?("Qh`LԮzՉ[g-?$킧ڲzDjoM[Ĕ[ã3 F Ӱfԋʱzϭ-ʐ.6;#?y f3_iPI۩H"}Y(]lW`(_>m?*>3;\[h\aA\sҘ!HE,ߍ0W5C/YAm5dߍp bHjiD]4hȐNMs2OWZ&#M.>ePk.9Ćۤx/] u`Lܚ^&R4  l"!^) 2d%m ]Ofi%Y={ԜFqL ']&ٔ6rjT1Cщ" 8SÞN~rˣ/i.ɚq2K=TitW@ X8@dGYƒwd)!{?(ڬ(I+w9R9Vp/D6ƄeȒlfo\ф9ӫ.^:Hv75F$LFOg*&,E/-[)G}SNLWfM (2 FVK &beOi=`__}i``[ZU?zR[g;(*,b+D"r>BƙT\f\y Sح- V2&u\d&a dE!,RQ)!CtFoEltDkN!3͎՟O^YTVUt h}_I_?*'cULc8^ymE>E2/,Z1㹸 ?^ !cB|/MBN8br}cJ;=la'bsL9U۽irHcE*y"mc8O={ʰTL a raTJsw`@R3u`39ףcLZ@oMcDuXqdq^dX=[祯>VAugtvF>crdh}`=J7^Kӗr V2 ̠͈G"0n{ޱOڊC/>o][&Z#Sެ6qkW86zX;z[6MhTn}o>8(%,n3OM'Q#6eP9?\.@WH/'ShږM9 G7qGOzYC\S0Yy;vp+ҝqa@Է'愵ICyG _',f,{ST!w!y`EuIFD)[*#yqkg^ؕ TZ*jYT^,oOJ˚ 4iToaI=~cJyfӡ7h_*ylѿ>LR%;f_fo>?$yKq/.sK[2, c`sIglNjˡrdg#n6Hai&Ymv"%;6[I؝/mC " ߻QrC82򛛐Qg"Tv;H `sC10a:xa"·s(8x'Lߝ0_GJEDD @eY+vܶc6y3l:_x{'S#0H6 `Z Жl,f E),u7 4D +G|tB|U+xaANZ̽<Ɍp˫Ă8 E-5X6-hG%$Fɭ;ۉ4?%, ށ thK%~j2RoqXj!r:mW+%8[nu=$3,͌ZO s8a=V/IЌ1JR}lBxϫY ǽE$]ӓOV/\_Fet.' 'PVL^cF>fQ׹8rӻ]9QiwxG56yҬ]Vw8AuXZW$tl{OXEZ$.)r4O;5o4@@Ebk6`]fFhgkl=䠦1(;$z?Xv44):܄v"*pt^P)W^M3oZHV&H`^qsa:X/lypϖM{XZ孁vE#Fu=ڼIH>e$8b̃9jW}0OR%mbҩSᜠhռ\M&(Gr(uRStMr,eUR25"#UzO{9GB*mU1KzSn!W"ϤFXG+H? #3]t*+-!M1l_ϸTgmV E!pN,@#P+9HK86vA{:Z [ab`=٘fS#O?I[}V̕j!sFtƏI,d槄3 ^l_9i p%V0WʂX!{bKft)Tl "a..}Vwf8:L;1#M *%V8ǻ*QtNj~koƤ掯d^& ϜZZ=Ơ~V?LMWht\=q?7\T*(?CN6prXݴ,`|?f]9k?Qb~==E*^l!nku[1S{O^hKylPe"KɿܿM1Lؔ{6J  Q>zz$)<|(P=T ,'vղXϳ1iRڭ(nV.+1̱IDULI<bNwZ߿ƐjD\}t_9l,)[L`Xr~[t>t~dkvPPN3~,A%sifF/~\KwcQƪy[πs\bbFsnL8~( S?Rb_NFmKW/NEn]|0lS)䟞Q#Ab)[[StwڔR\#57}hN\)`ѳ0k_:-b <4<<bǖ1ЙacW@bӻj[>JʞD1x;Yi8<Ou:yI:M%vsgvy e>,bN`1l?︼.] sŢe~*IJЙ&}{bVr)/J11x⽁2$KC{@83r?YisJK`1J֗cj_j]D{StxXQr0['㝋x%ȓ wݸPJpt+~ןm%6qL";TAjiæś̞:Il[ Csq.i cjS-Jh:ǖ-GvVjR44O?4M+yZ)?MO>Y%mŞ>ѹ^s6 U0|4cTzW_~߇HRE! eGמݠ`9AxB|䭝 ._m #$t%5;K@'q@ke7@Vk绣aP4Ȩ~ަQW8l$.m %hv?dw;5 wónIke9U4<$b!CHD9(PrF0v (q4ks5 }#W#ڀPjDV]9B>-z^{CxF;Dg-p9|rwW?<5@OdNI1|h&ی5jg>ƨ 4jٱ,)hFRdXf H,2n;f߻mA*9{QSzP-`6ߡY5+BMZ0,[!`;*Nf HE"Tt6k`U[,eeQ̮Y$5Q|54EwMc iR6:l 8}:Xn'尼*c9lT>LdOVc& "t/Y2GxĔozmu tڕ+{E+7ΐ^5[mrÔ68A4*e^Tr$ZH;ЃCʐJ"_)IV>~/ܕGPHu'-%g֋hbٌ5m炵zOəµ3EwdRYJK '>è,ړ:Se NnJ:Ci7]No; –Ky: T=_ 8w`TY!o55fwR_jyoWCzՒFܶ4 :t{YrƪlG kxR}O,6n Z"h(%tD$&9zI/~  '3+_=~Y,cNu"f{Մp x-%zDwGOyO~UI _# ./(B*~G0bo*r!1d%iErFن 9K׃"lCmh\m17}Vc ɧٖXhN#ƶw5y,Uf n$3KvmfZ.ܬ"bGpָ7WP"O={Q\.p`[B*? Пy2\$҇"y~"1!2^w^(ӰF; `ewT`e3L^ <Yz 媧OջgWώ)P5=3,} w4=lj5> !5zTE310ݗcA㜏Scu@Llop־QlzI:\Mll@Faplc_1TRݟ-ʩ{lO'$B}EhaNN3=-!QbKg6RD`ȱ} J6E0u 9S8ye`N[˾ͺ:TƝ>Zq#N5 T2Pl21>40׾đ8"rzUO`ntgD@? ^&אO~Y=7 ,(U͡-3(űj;>= #Y/s\%e: C*)a0EС՗fEт^:|Jb^ FF>ZqMIW3j2:0: BiY 'Ty96-M~01;{u{_s#'danJe׽QީMrOX}Ez@_> ~~cZ6F5Pi)WPVx5Ei[Cb9 FEbnR*Ȝ ۸0ysʭ?3 v= lDa~۴oCl00$rJ!m_w6=+2'$ˎs0PDAHqhq+ǁsIђUf yd& tˬ:cu@r52~ QZSf֛tdGh t $*Crc;#Bq($;KKaPe;✦QH Yzvi/e[gU804M{lvnip,n*Y6I|%(R0MPllPduIV}"UiRNI M\ٰ^b5  l4\8e݃3C#ŞZb Ĝi=TRQ bezE4cL.BOWh^1luP7Dfؚsac"c$_|gEm~ȫ:**~Y]Š hxؤjjsܴҴlF3;XzJd]jq׻%7[4W#uRgN]YE6ɦ'FMoԂC [{w3R%VCIʹ*s&u흠|#l80?Vp<|ś#T5ŁK*XqڸXF9ȻrA`=}W+WXu}4jp ʿ>p̉fuxg?M{xFƀcM)t"d@Nt]QKM4v+i5˺[YHbM8 ej־,$GIxm$X"MfM)h ,xm0<)ƛKs̀|X㱢`+Q=8*:-RthڒYLGSx7O7 f)=Dμ]󌦆कӕ~qxe}x1ʠ1PxUTNUJܺ?,++4o-6xRAar12qز Iy}^KuhPTWսff{P*`9trЙMw*Mitp >M~L'GKN//ٛJ( E^05<2cgo?BS01)tKI!*-(H0Z'̹,O\xg>n {.@!-N9f˶Udi$oʊwoš;!1 k%:la'XjjvxPPqa,yvM$h_|Es+JKB_ёP0˵V1Ѥ=hI~hd:iH;X9oqc-HR2(i&3Gl%CEѣzk#a|C`6q+Z:gjƸ5UT+Wknx>YK^Շ9 `ڷ "e)'Ml1ŽwIlGI5'b]Ew:g4I!X~9bNK0ҩj@'7`/Ja~YΖg ^* LJnp< p>kYfxd2M}:F }K"87P#D1[;ĘmNNmf-T0tQ>n]$zHU=K7b;O5 As0?@4E=;C0AzuS1=ǩ.vϽ:Zc "ixt"#yV/](2JQn hRy\䧶gh*B-nZmPU6Z:::ȧlMZy&D`Ǵ<@-sABhcTP^/mO@LR؞$vUkefMCcإx3UՂ46fʼnOJbD1PXڧr$hsy}۳k;A%yd˵}Y嗍YՂ҈ !0oƕ|1F4Dˬ"/vA)ؑ X-fJ,@\iqm)D"~T;qð")q mBC'΄K@Vz 5] AHr4دQ |q^[T0w8ehj}4`G*tCP T.q7z-x  SHJ#[8"dpC"HPNelv* ĞWR Bkf7rs8 K ^}E9izZxwT VY9 \^ @"[\4/k}B)`X+Δ$G[5-M̰G / V\kٚU"L.Bx')5#a`t*F,Jz`Vn?w:,)#7/{\p͋Ǭ\I+`贕h>*k{M +1.""P.4upܳ+0#_^bUJTp tկthd} #PN0{~3hX6Qq7pMY?T` _bqM5s@5RֿZć0XKk.8gP/ٙ[-r[Y]S"(xAZk*2 =3v9mˣ~)َ_% r[V b7N+NBaE&MyβTYg4gژZ`S @pʜF HrMAI".n„!$@?g_ĤT Cz#L*fi>x-\N?r)~,A;F'ϰ!-D)%>{á- SG \.G]qB]v|y6+hyLc26Ј|>Q%_l Wʾ! .cEC0Mv ̊u :xiU&rO^XqIß9u^EJ1SPuETmDٰ4xjvt%w80|f33C|?o䑩ۻםMl:~Izh.CG\yiʁVkiRx'.q=O}?a;|)sە{7 wyLKP6{hJ?#T_zr˔'VVK5GJ͍6<]jIMsc?5:/u[-c>:z$5Jl"nB;9.:|n%ډd'l胦L]"'~߀8$<G:=D5fVجo [|wZ_H?Gxru tY+%bU\/q&seWzk ة0xwV F|ql54N}g H3G}f6:v3WE1ngt\e8/ eJB[ 輋^{]qAj]&MٽׁNaߴtE7ޒO>;> dzN[: xn25iO{60S5}Y虽m@c㪿K '1۴myS1ocn=d$h`_e*'5/|<b[[Ub@ "M)0biAw磥f%M4$ZT{w_N UYgNEC2!3GI&AdC¦v+MD(|e )J(2ą`iAa5z.CJ;R;5T3c dh#TiPM?cA5|786Wg"f[<6٥(ʩbzVCq{pL4xd3Oh5pu=Zx|6>v:xTIE ibˉ0ҥU6RiKR- MpviCR%aW%47T$R"h2c5G0k>Bm [l[\p6ڵ(֍Y=oH 4pi=}nSρtl) ~ي$_G>Bb ^-^8}lwP;tSL*Q23HBE]{'JwW4?S}0sm<~ym*Ҵ%pgD>:qtM:>[>c[>bsؿe~@=ƥcRcEܗvViSʲmQaO- (R?>ش1b3ЏJt&,##`^TJ lzҬIYogb<̻plSE& a#&GQA4r8P:)4xJ7+ *rV#P)uݏPoR(h},b _yG?ڱ'6h;ЄJIQ7q(v~q{ÈUBEO-z)e&*Z&H>n_KIE KNxm|(m3*R;?[lp'-W̱;yEr5ڪ cgm+ pjJw6*-li92 '(GF?fwd!sCXëe#_DgV^iNBeWa=vfZsfj@L{#pIW#k^&ĥƾk;Ya&{Z3S`уԔ 5cRHINUЗ|0>!(8#1k冢c (i16%~R my a’4_^=olnlAdolS.JSWx5"rw[#"<شl 4`V^ttѡ>rZzn&Zr＂!~,uh?;U<#z4eH66])%vw8V|-k\xO)S h8yN*-'> Qi:BM8CG_t ":k_74ا??r㨕ot9d`z,茭IY@:h-KzY/miFZ+#eAV\/˽@k T]T 6{tUwvg>_C`>L29Ysr8\?Y&t`+%,aXϙWX 3'΃)ݞ6EbpvkF0u1@`H}pm%F6HL19ṬP)&US'b u0%GS$J)`ۆa%!j#!vfy:r_fG5H j iF0]3x Fd+1ۊڊ0_te]ve~sQ=c|dRw,T)}HpPc`Z#}~]Wv +A! | H`6f28 AtQ)3@͏kcuG-vKNN$*ZIF ޿Ľ_56s⺻ׂh`])"7M0ٵv/ab8^dD$ Pf`mW[]< Mޑ772i;;FW3eܞjdM–底 i/;eO>:9$ %h;{ wC<$ed"mیtNPf(V^E[jZhz[!%N.挒;3bjBZB6HzbG{rY\\~eƒ| yg]Paثvھ0=ITY;=Ufg?0m{j;$F^6I`H$Eqb[a\{|MɌbqo]/5hгm)=K燤٪q1g6Ih[ BL>) *\VŇhh9I"ʝR'RWB6inEiK`MJ=DHO`9Q+RDÛU]Ƥ%]fz0́TC/q~"B fFAN1SfZQl e>#^yPj/W~J: `#y.؏O(٘Y*~"k}q{cy`S<l eW4=G'8n e"MH3D YE OC@K.P.r V+-jc릣oG 1Ұ><$ϱ{MLEdW+9ĩԷڶ*jC0f ; Mx@tri@R\B6~}g!٘ C,7kd9zq=IPOžfgZ,|w~wWY͗7BnlgR'B5/0I6@::eukIHM5Zt?U$/)*[&`@!?-A M4\`kn'#2ݵ` /10~aCnIeiu]xr h,z"cC{ |"PKF+hUw~t+as3/Hkb}za'k9wէKZLA/,{pz} B%buub!'4M.o nҁp>-mXf1 < !1_w@a>Niϔ DOߵW '5r)X$ItabqhT쯢ivZ%߆{lꊾmHZN2H A]簈uv#SCbMΎj.S EέJA+AM6͂gwx(Y~`kI9!P nNF;V{WC_ڌb 99^a(ӊqLaݶ0)V9pW /A=G}m 2z}T kS/٬CHxA{yX$/ȵ5=!OJw(veS`^jY]b<[] loiJTKN?l6g#P 4Ó\}Y~̋c %R굼y/$$$yҹDk q!Am=yt GD W&Z#1q\CrsKѯyշb0knF 4` 8[B&Uk: )=NB},EibOeu,_@KƶѶ`xiǶٴ t-e1ŽokVem HpKhAGegG1zG{ ވ CM(z# 6Հeɧ+#wv'.WvDu"C Rs7\ MW hݰ8NaFJc%`7\CTU;J`YJiX!/[mP^HF-拪@fr;GtD(E(%xlp,;3`E.cUD(\g]c&FځZIܚVkcg1\Q<2T=ό0 yma"AzU sX3ߥ`;!9}>'|Bʾ+/;sfCq(hK MηE6諮GL,Ĭ3Saf'ռnŨvE2"*.OFQr9մk{ze](H1$T0s ;t#Ԗ٫A\eh+@&:pm]փiz |ҞCcGr:|?FeSaF-GV}f1v`A= #^H}߇ͅ2hՉH~J,ή* ~H_И5cgW~ CT8W\ H]EuOjV 9l{T]`ג'ʲ"&#\ DJAڲJQϽ V79E x۫_0F+*¦Ke@*k=!O|/& O6B|;sb:Ҹ;Ҭ \GZ6bGHaͷ>`3H1#Wٚ?&ESO6-B~02.z01p`?%-ZoJ>Iyb|A đ(!O-tiܹU l٨h|yD$ BJG#2o"QISVjd K5iQjIx5ӸrZN3)X`؛>jwJ[') (/n3r^Bi@Fc61?7/߱> zlZYj' !p^F<Ta!,:ipeJ ۍE}.pڷhh%D$ݔ;)ac{)?+hJԵ5vW!gtteAkӿ,.U !sN~vD'ܽ5E&FƋSoa2Y:2N+~sA +~3Q&/ =K4ǿB/)ڛab$0`j` ׅ*+>3pylg z` CK#sN&Mx.N rpmN7bn&7>hě r 7ܯ 6 N|~ѴƱ',)y݉(-ĿrIdVtX |2nb1_L뗪wޏ6 ɕI^J3 o sՙ` D8Ρek-Е# '䷥vp#7,J*:i9؜L! A*9]<8/KaL,!{I[7S}&4W5@t JoxG=Z>+EhSJ0.ɞ.V؄Zu{bG*V&m:VV{:-g2v x(|V0sIsTXNZO6A]<`G[PٽM?S Vy:P"=AEi0Z~1ЧO l4=#}p7zBֳ?] nt\"a}8nvB4㵐L ] 7 >; sh@zWhkGEm>JÃ1cG ȳㆲ>ĉq(9V`y{5ߙAcWvLV#Cjk-Y<#M]T1෍ˀ"*뛨r@`(>LRs/)m^(.GBܚ\kQ\-͑V :Jec?k%f ~^8G!y96!wy!#8)؝rioז+v@`œ٭~~hWIh i4ҍ+s!Yj T#3u3VOҩ`+v22zH L'6xe{eIHj>5G7MEfc?prh<B&nrbQyI] Qƣת>Ƣ%ED.>/ir7uYﱯ%s-tnEh IǠr\.֞`!~U(] s VVQԌ2AN`aXV Nк](2'4(ݷn=Q\hY-5m/dV(ā@› :ŕ YZ