wpa_supplicant-gui-2.10-150600.7.6.1<>,ig!p9|X~w-xmb5?RI8 ;;z胞GPAQn&xYH8 H#6mB]suIUk;>?d ' J0 FRou     $.8dl((U8\+9+: +F G$H,I4X8Y@\d]l^bcJdefluvw,x4y<z|Cwpa_supplicant-gui2.10150600.7.6.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.g!ibs-power9-21 SUSE Linux Enterprise 15SUSE LLC BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxppc64le 큤g!g!c6b05322c1743ca76fbe0369f900942834b3dc4d1c476b13bb0a73ac8b403289d57783ead2cca37539bf8b5c4a81b8105c2970de177652fe1a027433593467aarootrootrootrootwpa_supplicant-2.10-150600.7.6.1.src.rpmwpa_supplicant-guiwpa_supplicant-gui(ppc-64)@@@@@@@@@@@@@@@@    libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.3ge}@c@b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- CVE-2025-24912: hostapd fails to process crafted RADIUS packets properly (bsc#1239461) [+ CVE-2025-24912.patch]- Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run)- update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)ibs-power9-21 17418899902.10-150600.7.6.12.10-150600.7.6.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:37861/SUSE_SLE-15-SP6_Update/9b432eb1227ff88675139bcb07b9c311-wpa_supplicant.SUSE_SLE-15-SP6_Updatedrpmxz5ppc64le-suse-linuxELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, interpreter /lib64/ld64.so.2, BuildID[sha1]=d782f112cf1ba0c3841aa0e0950874f22e0c84e1, for GNU/Linux 3.10.0, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)R RRR RRRRR RRRRR R RH~ qQ9o1$utf-8e51c8b3bd4d2a0f16ed07044610cf7384122846ee974bb3c0c8ce8f85780bcf0? 7zXZ !t/0]"k%}RUJzx+P]8\mH 1}%s+ހG:f^"MJZo+[ރT !q urpkDI(:éom PMvv&*VxP`5 , z,)V7A.<033 1_N LT;=c$.$w./:2:go,AW#nVvMT>K-_AYM"x ]1gxb _rIx&{1 )mՕ?WAW:{p ?39PW>&Es#i*t+Jr%ia?u{:.sQfzfIu>T ˫AyᵡNٜR\edU ¨`2Q}9SN 8gJk`^ٍ\\='ʶ|$M\G'`W"oiBn:P7ݢsVvs}w }e#DSwfWvNhgsq>AS4gS -@zwewYy1M8%Kn <Lo73U$kc|[UcБ 8,FcDc6Z.L85vL}TyόYzuۢ ԠߝyQjXWD:Eg辟$@)縇VGgD(MJy'W-nXs(Wb9fp`X8dn {I-e;h3$%C:CoyY"_u84 O {䓡)xZێJd@;aiҴ\\AlԠ-- 9}u'\-^uN >):Uzl_*M[Aj\}Ǎ0FGu%^Cq9MZ$g̍ -o4lD--QBW?ي}+((WH۴UZIT 9ྊ.f6R͡Јd}-l5{kЊ1>NƶM'V):쀈}Yc!y}<Ŗ.>Wݜfp75 Za" >V;**{3ǀk|P0pTOE 0ٷl=z(bS1SeJGlnjvdOHˁmӪݬ 6p|mY XF gj Bk.yܹ6TrB 5$g7웑y<Uo?c<[[ߊsTO5B{#i5%ͦ &_:/(cf ~UStp|LDO e hN^'&sD\.PR2(EguYָp3!C }do2BqHN]QP| 9-w16 Aqf\IAPo19J}DRՇF%mFSS@7uݶ5MAAJ8UA=wg r^> ׈[؇P4ȠEUJI/FxTKt2y]Man汽kmëSJcU)Pw9l Fӈ;s+ 1*gg]kaeם"tM-;Vx#!tl eMcN6F@+zL疽ߘN5M(~ȴN%1ץ+ m%]K]9lU*s4.ZL}l#.4BJu΃ю\ܚQj*8}sNzؖ0R5.kTuhO!q&C1]0ω3dorK(\,^wu_Ƀkca Μ$0_'x:],u#;F:IsP)kN6 ( ,@'SP{(=w{pGЍr1$P68PT %d ŭtv10G+Y >.& mEjHb9wd9wgŊv i}3i+mԳіy"#~ <:{_ C t/D_VRxG9{< ~ cicj r3N gB)J<b *A@f=`ok'?"պ:H=CQ9`_dz%u\s4*ƋsV虙&[xXU AJ)[0A>]DߧF3λ݄1J`CMh#w|nurf :+G[T='g90WY G =0Mp~DXqp{SE#A.~i1`iuɅb~6'[\M. )( 2.4HأDuG.nՍoG/dܞ j  :`D2"tRC1V;(jyR6Ne]Y2$x Hf>ˣo\SEԠ>o%y `/F ޯkȓZ 1 tϨ}(?b4Rw}>䩇0Hw?DS7 JZI6nS3.7nb$w]nR 1=|a%7-ߘN/ e;T4c0a^ CʪW9N_>=޼7X,k kx >~ hx +VVS)EcC(cdw`>:~"i$5{ ~um ~tC-;)#Vڠ`]]-DBHzX&-j{_ F'6RXĽVa\M՟ Vu ;]#"DG!?)Vx m|[& EN{[RcAB:$ѷLrzP#{P3O ~xA7B2c!jlw0A`~S]/stA9dMfr})c -5X̧W <VԎ;"P=/ƥ*o4F?L?*@TsI`/- V=G[؁NP)7Gl*&lU BynmA9Ll}QKLG1@za p ᄳ+zm҈&dފ8+¢]F9H?Ni?Ȟ(ބ-1nѢ2&s[/)$42MRVv GneɦU+6,KYeh`t$Gϼ[CvK)C3M`|0&ݗJj'WXLjX|qb㛸@v\`B G X0l#*~5(=ʙmvz?PjؽT*Z!aZ9?49WKƨݐ2kπ̬(FRM= Y ?*&+B(Fp׾kޘV>^tc?1NLC2/TcI 0z^҇ii^D֤?ˤiBn v`hM6JnXYW˜څ7iUfr\S>"s E \!.A=sxe7\''oՓ^U{YpU^gizLt8ɽ} ia} @̻i}~WeiBwN"JO.YBɓ0A`{\Ə4GgM[iVA0aHmud l(XRrUv~9 ̓VIP݊ 4ӣ )-' ,4JϡxUAx-͕QCb{]/59#kš usRgT 4fJUi}V )a_. O{W0R\v` "վXAa|8<?Q;QNAoHT/gYT4#r{-1\5HO@ZWl8NøuK݃gfL0m]8W*xSfBߠ|[u0o-1G ǬOZqAgC!+ L 9O#E0 ?Z< ;vX!9f2?jZ *j̽BoNo\h)$-`S_WD9c]oRBCwv,}pQ?-DL~yO`aJ`~`"rt~b[pzu'# k."7B6JvS+a/BB'uYOҋX Y>ˠطbIos|Va`Ʈ86el r4 G9c&}"0yq`o~n?Ogo9OI|Ͳju8aiڻhBUݏEXL= S/a$Giƨ;ȩ.xW]!>p}1xQ6 l?;kZd|QWFRb_JS1÷FXsеe”K}!qnGra D{n qܖ'BA~@ ,lgx ʗvS^s58[05Lrp*&I)8rw|.IMl!æ9Qr3oUviQ*[@#~u=`wX^쭐{Q9? 5kmE P"ͅ0_tͥvI/f$[Wgk3wX!}Y jfTrP* ]&el/x"Lk좺p;d`TԄԼ3:Q`+47WȚK*)mP3rd>u#r:"-1a4+ j7RUN#ՌwȝҡK򟋜/$P#Zh.PQ uK’1!lEB3`aA.Di2?bN|ZXoN.DZE﯄6zhCoV 4WeMK%yVtºn}Kc0[frL SND5R &PL E8'<+0 5;l]Yt>Km9:qiB;JSg./ C]je WZP lqfZO8$ޓT-h+wdl;B/BF^TWW=-`)P\9frkӾcpU_}֑ٵ\T|ت1]%D#N3Ѩng -h4q loz Qu[NJ1%ŠE\H(Sc(pN7S! shop.ܕ|B 2\PW~OD+2lY( \~k.)3{-X! _C*0ZW jFÔnbsd?tޡ\%,b^'n"ܼ ]Pˈ# ێ IT %\J/ӲA)@יrQE?ƨSo %|t6*Z %ab[d]T yBRKSpR.hͻFg~$"@ *嚨+|ҀA t5<1@Is~[KY$pQXC|f^>]fy_ҌgKa*F-g0rڒJ-"z~hO#=a ::J]p/aYTw_{4{ '?]tcvv]C" $\lGJ 8F{@΍Mw+<<7ĦVU!W^ݺ"5Xwgv o]2@ؐ!pQ+uTf6U=rjy95pl}`8' sP| #g5L[QRzXِ (` 0+UmeN,g7XYpt"b-V)>?ib䬶֚q%R\WDsY^)(Ix~fYԔT;Ș6{jS`1ُkPNJui',6>ɏn%ݬ@X{t?=J;4΃ô)gdv\I0 Wg1+=ͱՕO-kRlߐf|o&5e$E!{ə!\9h3 j9j f^ ~.kj΃HZi6$|2?6,s)-njW-$(H1w<4x^zH\78DV[߯i,>np8VT#pb/fRU g>d9l''mn0NB"OC9uP^Bf3ɣ_z7F&|[u=52f;nzcfg5i(ތ UjaXn)Bk?E~jY#ơo1YӶ-eo/O<"w-bl:i=cnJ¶7g Ot<b1?? ۅ7y_u$T%S}Q#WoHnOqCiQhtl)yiyi2]0Lf\6!r:\`H9ҪZUU֖k.S8(W"8gD]ҘNØ)[Rc}4޺7sF~DoXn8O_/W?](XQ'We;-jӬ Inf{եWODߖ16-zǦ9(ԙos3)Zxű.%i-8]?^1Q݂kom3g!ReΡVǦ֨Eǻo^~g3 7&6!|DF/Ʀ}bWnL hG54+59M9NH<.ąFbC ')J+1Ԙ3 bǤ zj/Ņ{)cj)_#K0)O9[Km]3N-ѱZYs/adQ\-2 /wIƛ‰rƪ_JLN4g)[Gwfy' Ho= p%iP&E˭]JŸ8G8bX`)n1f:0:AF+8FaٻAm膝u? _J-I]b!S7r{k#H!l>Ǥr&ٳPJ*]7LN5=W$&&P?k`̗R7-9!!*=LH6Lz CGҭ:qhh[.$0 G[L| io20qȑ$d:{*KMYƋ~"k:ϩH=L:Ym&Y:iO9|ndDV| m:3(VF?$wQP"DdS=]Ls AJ[CrVKqB ZlTlQ5V6}J'-^S~ÿ\^[ݺ}A'4fޔlLJ7v48 덣B|,Q`WWy:ɒxk~6Eelq. (#"DZ&+9&D&>8[ھ6ZUX1~BtnQm"iaZ(&d(ދ?{ĭhlĵ 8%r]Ĥ" 7-ߎH𑠩Diz7 2+跔x0S/REq|*R…vUtUnUS@G|\ Jߚ?30VMnbhaCq>Y庅 ``1F˦7#&e^Ym^'2ӞteL H:@Ol,іsz+rea‹[b *B(ՒhØLo1N!v>kyUA5VRL]VBz8="w4tURxnƬq$mCJ6hɌxɈ<_U8Nw1So6@R(@l_d_֟7?߃հ _,O.X1wQXx<33tw%R>vĝy1i߰C2sT;Iʆ`?lMf=mkZ1~EHӕHw%|Z] W^,I'ܳx-N~,7?3i+Ýxlz&Nm3/fY-)CĚ7u d D?ik+#~1yq@%|d:>jfE{fDQ lD/Bz==|7~or"T,VضiIED<9 G7QA g?lT ;@~I[2QTχ5깣U#W.mP\0~zp#vR[Reg)8 Z}wM(,VV;A|I tvr-JWFIJ&.U>%U57]v4*0ӊۏ'xR7iwNS@$@-?%c_ mtd=#PJQȢef$. }0{teR΍VX4d= & 5!E]B|5[`5F/d4W媰/? G /m>oT^AMT浅H'DϨ+2UFGUd5m]V~б!:HwLK6Ϣ_g\R̦*5] UzUkK5~vg@!K G B/EYZ) -j3U@wy}H_v}VҜထ~lB=3C"E*<hTs@D8Q'H!@OXUr{wә+:ӒHb*ptǚTE|A5(%j`Ⲃx:zQ^_ W2'Gl1jU]ytP\W7%B!zVUNKBi",r9,s60O0v )+9W1z7Yt&K i9zb%ЯRnŃC!TfqP&}rΕF6pT :#2bBH;gX] ^չT;Y8Wgr{E57_|#$Ț& sz[ύ\8w ? -hH*Y66|KLth_x8 o@zruft Ջ8M2az򲫗LI׺ľĂ\6%EaSd:2_xJhԼ|3Sh-:8pQ5lESޚ1_5xޫUTȽ-U C Eb.O}?i %J*6V@@1V볉QK52gVlE? K̼Nj*<&wZ2U6l/#W96i~# hB5*zoű8btWC!;ƍiizhj%:Xĥ*#{ "l<)4(ϛFyRrjOe<7zUuE9Bc&`\mUgX`&ÿ=#uy[RSDRp ٫ j5l9oa6Cހi#u\O壥"><r7rQ ūoٹ7jjܫjݾ/|6[@ڀ- -ƾ?I (ˑ `pѲ;h;nv0q -=Z(la%`9 mO5aNw [d$(4_fqbAz/-x/uBQ?m߃j3_u{@hFrxسhW^dx]u)E V䀠&Hd}4!E^7PEcbx=Hj V0SE4IPCIg*>^E(rg^1Tմ3P&1MB sQD62=C5 ~z5(|}*PaWz=*gi "$Eӝl$ ky 4ܯR$o* .n`:fhs6iSp}eetsכ,k|MZpb|yro Wŵ+cwwq&^-8 /\Ar/Hh6 o<_}Z1&E}et!?%g~؎:F`8kLe!mpkBY ulx=AU]Fdž]Q5.`}RO8`-?|k]Kh\%IӃ쀠rw\/fPPV_=Vy%l~m!A6~vB#$,4CGwՕ6D˾yiCrv0o  sʌe-jx7 o$do聞\0N߇Ó wu2eO,[ ]MjI$pS- K<\`KRxR?6 ahhXw[tU<\۲.th͛\"R.PӨ;ۀ6TMpĚOL$ wG2P@$jZO2bFZǤMy/D 'G9,߿v6o 8ANq1z`7K^FT5hS3 {@@hm+ݽ /HO4|s8X$|H -yǵKUP2^F9i*'E@^ @<тE|o^c 3b6|hV:u_gtԜBV%pt;t> Y[kG2sR(!!o12cb\BmU<1;fld ץ 5%xN5#ڸp*hBW)RX$!AMz3IrbT=xqC<,G]BT,\! WqA1} '^2b`6ZP3&phJ;0XosoͮYl` 75H3Zc{s3L.&1ߦ+YL-3{Y iP9b.|[Mu1k gx:i2'ot EZOHi.cqH!8 !z\@ ^8 Y3l/1KnO3x^ԎL r$\%QMf(XR dbװp9GXy D˃(\TÔz,E9g,wyX,sXrm%"2z \l>Єv%_bf)G>rleVdelY~kDn|f;MfBsI:;8mO2}CD<73)B<4>"'qr9IX(N:FSʭ0h6i dс :w'&FhI+na>摌s>kKv0%'x7s%xhQ_aB214Bm@IZ zQB>!囯 =]'%;G,mR 6hX8@q)ƥ@ERv/UW|M?($wlqb߿in x4T9:jIPpDX+|8 ^S,I{˪\cں4$&4P  ˍw#RO@| @-|hu;&uYL.rZ5@>MrՄcOQ|d=~eSeEwJD6|+Q[{oCj, O5ґ^յ9Nz[J戬 QrB*V$̬)3*dZ K8/]Dm5hZcu{4{ OӉ|x>åC#T3YP d҈rVֶ/}0eԬr<} UãkHPSͣ+Z/'"pyyS#24W?X[){BFi'ҁ6В͊UM]d AFȐ>XJ0dם\]W&"<7XX/a9344 4|xdղ?c]TYWuPk^`jHA4Tʳf'Oe:J~&}Eu$~ǭ|hXA8k-mUƵC$ONRa-XGOCC,ewuY"9;S! ^D\A;c<['H6iwj MT P1OVkDI+Pőj crDO| ^qubK} @ʡq\SsE\DƞsR\!~d`W@(-i,4?޸MWhE|@(q/)I606 שg2!*b'E  1|̗ncE(c:5WzkF=>GT--4y&ax ;KJ٥Mv! Chz[h>4(‹W?98i;%[/u69Cj_L|癰>]}gL\B* l@NL{Fƣn`SSabܠJP(hDLD9-}!Y SODd>cgX:@ku'~`*.&D^|m<*`Du/b洇{l7XU QI}UKȧnUpGP*L~&k 3A: Fb!2':5 ]aXr97ҪwcwP>Cwy+ S9Oj5Ns'ت#y|}_lm}~FԳFRMsԥvP{gӲDhJ\F@=q3FSo܏Sylbɚ_-9\lU.*6QOZtՆbi-։HxS`+ L)5d\FN#N7~MA<"0t41t8/νbqhFՆ swi&6wKzjt!,z2M'4|6JBHrU@ ԴՑ̩G BlarJBv)Vf/6'Ai n^01* N &OU?}h NKծ6Pl;sJ&+`IAx|^XU/m0*P"!πo£ˤ&q1j;/sdUEd?O YŹvse!2L8U%%E&6dl)teV#}NŒ lO;łQ?+TTls"sSN~ҢK-av/h&SK bTrYf0ZHҖF= 0x&[akLU$xtn#؞.:3_ذ"#-ZHל #Gm?#XI-T J!ȍnft[׍*8=A}*zMk S`ڏG.(ĒgZ*KztʡejKIUV[ DW Je Md=}.?4fVZz dT^L UwB+j^_fjOY2\Ө*dxEt)q6HODo҅&gIBu AXep@t65zXG B q@J`?QBjHi^ΰbn!@CU+' v^4ZnEcLp}hި6u3{DH J712@{q˦.~yZ9V&Ɉqe ksb|En;w4yl>T?L"큔\ޞiTsi dOe[܄jPzppmoCOjh90X9>,JI[%u܅ˊD qyx_?UY`WARrXwi: Uۣ )3vV£!S=t"s@'՝ 5YD.U\sϔ%,E [zCn9c#Z'OgQ@ݘج7LO^0́ jmz*6hI< DjU|-NH/gc[LOt+x+g/1,Qȿhɩ /:T.k/Ki5F>[ڎ/tWR uiՄyT8tBNHO2.`/ŧ M'b7^tS-ȮsY)qA6=m"jPsq9Zz5BqCFP:اEF`ݳ؁8A(FYuPduN7@|G7rUkw_űLq]slD [~+Kr8CұQU (BgFiA}x$;|S$J%ՇH$r6 q.^`Y3|jnŅofYJd D7+mp8OXкu(I|psm cbQݕzDoxʷ~fiYQ^z =Lu]NrS'6! 8R}ArL]r-";V = ;62$݋jq{`6~EEH4R2sݱ>5F48oAco6n^U+/(7Uiם;8<m+ٓ!0!*rPɯ$W.^T ]Lbb9 KYXK$!at[i G!ʼn\_4Ëqk㻜Eք>6ms1 4k7߬PFEŬ< LzY mi( 'w!{VjbO8`r{=‘ gPf_>3>2ʼ"Ө- /~kzgw 2˷C!Rc-_&^ddFcMs2t>ѵ,ujP̗Y;Uxԩґ VœiKj{o^8HsKk!.P.{h")]JWLk[=L]E>sM|Ѭ#F󃹫Рl%dZ.܋-M" m5LA163!{b4":)[!-XCj݊D3] &d$(J!R,t< <<. v>~$1U0ap9,blRR N[JX]I~=`.t(c gbHB7+H >ee CaS Ƌog׌t&'a#x^"3fHqfK\(I3BZITryc hqF< C1v [ȝeJ#n ~z~3~H ]2/\dd2V6RmIuG٣Gy^lr67,0cTA(A9n:AR9TE)2CH8n/:f;'7rj}hb;{ϓuѼ/">c&, ?ԞcP xˈP@G3;*! 5a6fc Z> }n!?0U<əl ,j…A%v8W ;aNx5)'^neu*Q-JF blJA%j~g#=.=Et;kMoKDi+uFcmvV"9'+!j|.(+۝a.1% kRKr45':ԝi}C,Ze}$~*ĔöĦ1 yZ[:E-QYzUMNN Ō ˗ڊ0|l(R+&ȑ.ڣzWR8|tGb--Zf|V9{E-U3\1\TxR* RW@(ykԗ8qp(I ϘKJ{hbqޖ3#{au &]@r;"DV A`&w|ڛ%{(hH"vcuQ&(Wrr/qOVS?*w8ފQ,7i7,OvtPXz͚wDuGZP;a@]cJ7D:jhzx=K@-/{R .1$P;X#%s$x߽HΙ"N7nfZAʼhT&;IԩVMLP!kмQ#4 WiɄ3qM 2|Ra@" 'rֶH]U;C"wnMm#TP- %ߧ'I`Ȩ]8@#YF6fT"gegmShPi3N+wt$L?R֧:wQf.j4S@c 4T; vCg_0 \ʗBR&0QO!z &]OJ7p`G@xUS+gzp % kNU3^fٻ*|6yvQqaMnH0'.&cX/s؄i˼clbsy 7,CqT}=OYKf fB@ۮ2G= 6ɚȴ}ݬsE3V8Bf<hy2Nm_pn"N ɾ6#IlgZ](yNGz?PetM'nĦIXlF?{qPKJTc&rRL0u׋ow q.,+KօPU>;I;12=$T24| K_fu"/bFb8}{CBTvGRM-HݜosW:lȫS6slE΂09J:Q׽Zjת{q 3DBPY`~SѩI6'xA0H!xd -UnGAlF6|}I<Ӱ w C/I~1s;1Tl:Gq~jD kt?]rܼc-O\ vHGԆC0lܓ[7D4cL9VH@f*P~;XguF2uP$,;!o C(,w^f_Hid[`qD<%N=jٙȝg e~-,aGUۡ42ɂ7Q_$q ~:(M0-GsWtތNu= 5 ֣3РEֈ^ .*9~ Hh9qHBeWtw3ƐNvrN.klo9%4vJFC%1+)**0-If'o|-ۢ@6aT(Ɗ8cؚ|Lڇ>h' I {_ֶ"ޟ2tonOɌŶ m焺,';_"1v} .wIP7L9x(5 j^ SOR='($r##f6k^k pgmFAe[X.V(TN VqMRqjW+);p(~YfMюFL#-ڔ2!oC&AF&(vuvD#UAa<յXb JՍM6̙]=cW$BL6kiZGivb`p(_hoIԎ8#) Ɏ8}e ipOGaR;8 Qde =u)33#)*㬼7,I:ϿOiIy/{KE3mIzDZx%6 rJ`V#Ō|–MGg\ӺkMkq_)TN:%Up15߸ 1gnbTc`nmɰߝlDe{:afKrHtOMYGskO!1e.f1Cz)gQ1-}8wǣ;B>ʥ$z :t؛b~;_ tIWAV&xhN^Ɗn>lKӸ:oM"!fa[2ɿ֢8& Yr bHH,r/zw)Ϯ[mlsQ}٤Jq%`nKs+N;1/W漦GP=V) )A2 * M0"o' q3oy_-)N x{% V4lX H&s2ݢY`?wdkhp8_|)0=A:;689ng[RV{C\gPo7G[{ߑU0q8HKf$0`%HMHQT๢3TZlнv1ώDzB/ .VDK|(fLMv #v^B\o4sd5{:AX$ĩLH/Q!Whj86ҖZnr۪ *XHIeX"jdK }豼gCq(l;f#7EGQlsE&JX;Ȭیi> Oԭ@.m!L)$jE/K'A߸fs壀w'kL}6>ḍSP ٜq&VMs3PjiNUvmB:W%wJԎk>6;GQBҤìo :5 [b~H7JT#@hᄊ>#3&2jx|8 {ff@a5vi= xςJS.`V7I}7 ˠ*ǎ`p\;~%.us\$鍓Ϊw~N$P[dϘ)F.C։fG R-̗o@ϰ&|x>Ѹ'8s^#KUɝ s2wgBofgr:Gf%>|792LFZ<۪cphH(2e+" s8`l\"jq@9{qo{=;d ~g%8Vo:I?:G픾YhGnu]~wAr=u=}93_#jB|ּB# zWxƒ!!2jFca햚蒖_> Oӗ;My$]5xߐsﰟϐkA$6yF!s8:DU:3Rx?CSQň%7 ;/`ƽ<ԻR{3w#t-? NӪ[n\o-qh)fId܃2FjbN'v5;( \.#Ȧ|5ؓPOwswl&8*WewZTꏮ Y h1;KºTц3r[ǏOAG) q#‰hyCQڀڈj /RWM"Ǭ2Ȫ!XzpfX8."-U;2of5MuY.06/* w"EQ8eW궟ܮ:opkoS : HˆI?B2!Ǹ=/_|U*';軞9Xyą4Fn|.y4MHTZtK2*ѭvn[%+P9}q|bB-B36$>fV8(p$iB=`6BU!qLS.t2rC뚠ࡣU[|k!BG)*d8k䉰I|װ->ʮpg{yzd`v@ )b^ZlN/#P pѦ9Bt7&n6UEm*d\-tl?K'َh鲌ɠ*@:`:33n/hAy!~O wVi^ &~m;[?uÍ"G.љ;De&$=w orGrJ 1 -ū06[ܪxk$^P.+jU+ `02Flޒls')ͼ|/9ȫ+.e"4߹v`υ⦭Gpondơ#MY1RIyVRէAa,v~[΃[~<)DBh;}@LɤH#kFQ+-*!V,\XCdIw)h!]|U R y\PR*6.A_**Je0 JZ1leiN j[P˄fpU n1_gF1Ȫ:†T(h?0W7UOETl>澰D2vȻ%N,f EdmRWبx/6$:ha '[Z*hȞƾNu`&mz( oCNIv 5~P=M5RB* ΃\֌K1]}~ƈ=$< UܯOGLeQŖ<چ5̀mGX~Ogko%  I.r$K}E#R}\]A`hhfvu 'aB>do_UM\"R=*yB>ճ@LmY3-ܳQ٩E~*#Ve':l0e`L'yaU fqEF/;~C:` >ڕCtϼ=MpwI?5a` |9}4icDQ7&ceP%´qb< g3jYحy/תqjTkq}zN^geo->@;Ig}ЍqstpCU2i-?7Iy "RN^O=nj u95:n 8/etask`php˫$V, O&<יsOS2y͠'S~<<;GAoy `; 7~tM+8@M5$}rRMr6)Tt 5uYɩ"7ɦy]vG$YIJ 휱FRfډqB ,"Ɂt"IR#ՋƥF)q!N Ep&ZtgYsAؐ6-~sos#(Vrv%iT-Q2́`j$`,/oHv&)% AǃkD\6mȌlX]=Șo;%Xh/XO~x`0m8ɘTM_ۘzgbzR ~?/O*&00L](r\w~"<A/)Qػbf-$>Me)&nIb= ȚS.L臻\|C.- }Fo xCx;̢`_ wiq:-Sh;BC8-9Y!&o_5cNq<b]r',y)J P<0K0Wa:9~*wqܹ+0 WqEe86~M4EŖW,/΢u1 EIь"H0r|i\ǪfpV1(~(jbh^2(,@Kܜ>oln.&9o\j I/4]IyUp36ô)+ܴWA6!?%]>pϭTQia}D⮎/'LŻXp:C:Øj4HSH@Q'+y3ޑ҂tRTn<ôyO$s.=f(@@J R<|uϸMg6r}7QuĢWOyw"M*G+x=eldI1 A4kQ&S+tu  66NVⲖSƢt7!\::Û|\ƣyC`p9uƒâCn"vwp )d+#j:pi"_&UX,5 ~Y4qիs5 w "ML2r<42{huHU-?evl54|aFjy HFdq8$H>MJp:t i$"s

lOv=!O‡HP8!TtfRԫ|Tˈl`M7ng8n(.%f:ͦE\A?\~d0㻝>ɝepJ׺2=/KLW̆~&nT0LRipDj B~XZEr2 r͕M0/]ڨ`Kj1Fׂsi0VL7%}wM@& i}6[*X+XCu-dЙqTOB2'ڏ:QAtOkѐ8- Sp tŅ"PM?(*'75_4+qz 3q@2h"X`MG)O {gZTc%jɵaJX330@zZ7톞 Zp؛6UH俾ܚ9UmVل^͸a|(;{@05]I@pi-YTYӭAgJ 3p"22t2 UK3k5= kP&/D(k$UCq(,1k5sSC$Ϝ"CnNax-GjʄK9x*{5zy.++<p]޶}G d-PBPFW "]PG?FW_qDVD %oNH@(H۝H˾.Q~d$$bQqMt3a:\U5xVEz &Aϯ EC 8gh4vm*blV:ˉ UdC%gR8Qr}UV X (ΨgZUA]%ύt^DSul@ ۰#+ sq19Egn h\06 Z/He0YL𥏙%Xei/H/%,5: !To9< 꾼>^!@Mx,(j hTV^D-0S-ӻ wJQ]ZWBSA|е}p$FjҨOGYV]zVGf5F WDRtR})DU%ޯ iXLx'}-(ҿI!jF9}ihM5*%Jw-3pfzآ"ɑFqrxʼnbsRNw#AtW[ч0@Rk5_͞4xrW2/ڪL7k/GC#*0M_x-¬ d^Ĵ6tXɻz xaU'i3ۭKrH7䫳-# רwU9"\)7'1g q7cΫ !yyzM[xTy @xu7,$gYxG;;Aa*>q]'uη%?D|g0Iq4zP]dU\w?E* - DbQbJX_VG5Oz/z#^Y+:ld5V@^\Hs(_. *q6@l,4GRe-jAߩn#|Mx!Չ[ Gp r~v9_;BJSRƣ`.U)3rv(nFf}َW/n0 cYvuxUae`PNT)Ty(|@|r4`3r! ХWp˄}FEZ_A0'̀-A!v Sw;eqLz21m8*sF Mybq8!/gI9jq-!X%CtBlTgٸ/":DR|C\%gɾR R Iѱ^l#2⃫UQ">Ŋ%E. *+LmJoiܔC=ߙZkhcXƎ8qH8ogvshξ+)/s*z q8oɟnG!](HP5j'1#V=q NVv۫-*dM?>2ydZwܝb!Hؗ1 %X7殻^yqCuyVQɱd`vp {@n<|:Ձw:6hK.(l j /M뻨LI3Wû`Bˆg69gsN (8^wM-_ZW6zs}=*mQsT:1[x60c:g|dzɌw,fVmzzN+c^FF_d-zpe~e\=:ܨ_uMq❺o%F&.(@oUP#IzX'ڠxW?y-Ct,-O~G%@'{7D1u^ ) nlMnJT\ m &s TIZUe$&?R˴ 7:sڞ)#wJ?:yŒs4t[ OXRsPD\<A/G$mB qxXۣq{?/x@;6j (%<.4 9o ]AMksyqc@d+lSA>N禂(,Q?T-/_sAlZ'kZ?&{*\Np ڤ"`6ƛa7I屔S_j5=q!ӵSB g0Z"#W@M掮*ȡX`ېD)ᦩxi;ákL9AVs&VmR3N[t涔6؆8|S&e:qTj= -`*Hg?(LS"~ƌ/TO~KdؽUռR!9:)o4'd2۪O i):A"ml%DLpOKN ePhpufTLQ k\)93ҟN\Y Ƨ|Ƃewt9fuϮvlUjA Tku(cJΓ÷gTWܜ1=Iv-ő._Fb (9Þs1 "{zv5ah䉵4~"}upIO3ҦWo8Y潳1Et0Ʉ2X\>ڦx> h_>Y 麎:{PjI7^'=҉zG=s)'fbōYNڋ_+]0gyɶ-LY1(I\T@uJu D\z$ɫW9K6ᮁk٢sɧFhXC۔;Wb Nr;w01xBq5.ig:{m|å>wK؞YIa*}o29 kaˈqx^eXm\g}ݘQKXRJQpfG)4uA"DM~L)̓# ]@#Rɓ?\,۸kGgPp xS-pԯ.֔lXPܙ1Gy8.Ih_I)7u\7;I| c\oP|5f:[⎶DAsr؈N7wUoIL1}nٖ ^@黫z1iCG;3HXS|6/+mj_y>sYTѦ7E+_9+G:d晗bŌPA>GaiQPe`^<9u=Pb'%t'X.Tb7Fs?Fbr 5wHGǖt{d˓eѰ 9yit,'m;Uԅ($Zf.bU=(HEp-}u?UfTᲱ6c(OAf Qy`i1ގ ܦa5.o.p`UrK0@SCOm `zI7Cr:6tQ뒢2wcH8RqM7ayn{W[ RE[TRy]v~7[&h2C"&|ֱC?=O;Hd6͹4eXGbV0"/A]ab"r.b}`PLdz4Í9c_Xa-~V W;MbLqNdA EcvQ n- QVWԀKЖP;?1f3ZBFH*iPnaLd{$tF\ /;Cq$ ڼpNډ`{''5 V%NҗzA36N gc,21b/:] G`&4[ԶkJS)o}ZlpU)"r.L U+!3'{7U.3;`\ylUU-%@+D8Cg\2Vq"gh`nJ^B.hݹ0%(1qvhTLx7as"7L/DhgqlĄ˨\EнbѾ + CJ5nX Lv٩V{"Q~801 b\Y|w1jwOuJ#Rk:LP*YD`_N|t74/6 N[ GOJ+HB0;nM`ds`X|TlU/c]-̆_yPkh 錰^bv[T6Y<&yK?aGZ[c"xύ64En&KѝYC\?7ҝ /P_W\x5GNͪ߼ rE's?ȞvNwT]1JAVeEJ|s~] :jVmeqp%N.?x8eOR|&E]K 5.<ߗ05IpЉ,x0y-Yi'dx unĖ)Ei(q!ul30'Mzr:MN Z˟ 2fTܦuڡkͫ5Py (BzB}̵d5NiIc^Iő݀Y*N'+,D14WN\GAp⡊e%>j[b ns*e+糥)hPo{jOK9yC(qT O Z{z#-";~,A὚l5:f8ͫ fnr[.{9_;υ+GRZȃD: ]DgP(.~lо,|,49Ԝ- ը<{N h2|qMM@^hrgph=̀O$~T,&ԇjlǕLe O@) B 8NBaEణ%fM oi.Q)"R04smX4Ŵt4qr;`ےW,[8qN 遲Ľ@0 7)GW``1y>6$n򏄟9[Aƶ-v]PLFEf ĜC䆁 q7!+V%b>*3,Smn۶_XD֍ LB<3_2x> h%b*B}R8;ϝxD ǟɰ ,(ރ kuu6x[ׅpq{͈ R%N Yu ;\-ҒQʼbT{<^tr;t#vC!oaNRG Z9}}6q3Я8VRv[@&Yh㾚)?yy^OF*JX6Cd5͸wmi8<=0] ȶܠƔUkpYXɾⷋ l^k>m@x<P ϷEEYza?a]bŅSî0W|e)# 6uRIhF /Mx7`t16d(֢3F=&6t|GJ.ݫrk#bQF 3:q_6mR(jnNZ*{b@J;W "W7%RToNSXf_+mșw⫛i? pR^2 :ry[ v<2J̯7W0 q֔0FqgWFV(oLsH1/(ӷ>lm#9Yʎ0}1 C]T}V=D$5YT3\uÈVg_tҹc\b["NesXLjiM=:'H%́uX \/MߚWKksee00dT/НN8 ZJ]Ch6=o1Seq4^5\_h/q(աsS/U]5M2P~475>{e5sDBLooEQAWyu3K 9J3|!X}iye1uZR{kS^"dm FZhnS@Q * Я73c70R_=-%}'riJ\ 9=ԭ+͊r.xzU횈HgVzI֝SC^}V8'rEC&Z6dz%ƴo0tgDHL IIKYc0d4C|U8P 0XO{gu&EI0ဆ{pPų`/^ˏg, ^kRt?aۗ5jV XӴY)<7 ^Ҭ/A^Eyvt]8F"ݎh%BH+ hJu^mK_O>W=>IkZ2N΍̑cIho8r+-0%Ɖg:Z}*;xkI1XJ z] svgY6y忘wvWi ,dNJ.,ȅyiRyW(o\#Ew?@Dy1pezR-*5E5^&ĐbiXm*SDoj>Y"~r+ִ>4t||KӄWj;e*̏ߦ  ~Nu&؟&}npӊ2lk9KBG {URkiOLì0qAA"n!0g@Z`r3mRdoZ0w9t'.:ϿW=fB9NɒmG^:bF%=7k'Dd!"wWHam<3I sn>U\GnB&8o(_A隣X=upm0`3D} /s*P&|]t!^A%,?mKPgS|OŤe eIuj ӧl#Gf9waajw.wlO7otȃ))lC"tl,ޢ/tT|#H^=~O=C;rl̓%1uY.{ #Z|nUHHB /t$Ar璪dL\pL0 s"پ4#4`x*~NRxGM/!ӓMDo:IQ=\jUG:c! .;~?!0>f~"0BUU2Ω/tή,brbA4QNVi,jpF<)l eT~7'B4!GKmZ;Xz[H$Y'|DDMFy4澐;bZQsCR ibUB`j%qDA 1 DC&F0"XdD_[ώuRNZ D)rЈ8Ӆl_Sڼ8+6“3w, .J!}Wy)@vo cGwWβ5K7@+6If@'. :I+I aGT(RK?,l#`*;/Ԣ+Zm<#m}>o2qOށ Jl>) ,Y < koM7^Ph*-*ST>!b?k$QQ]F#ҹ3z+&h}Ђ9ٶ t@1[_~٘45BU p5 Lۣ @(n$358d?$͘te X-{_­ iJQ3f6jVL};O}VYӤ{1[N؊h)0epY:cAw #c]uZz Z3fV򶗺d0` hd'`'__=֩Jf $jYl:8!}20 H[@H g!pӺ8:ޭ _]4轶 YZ