wpa_supplicant-gui-2.10-150600.7.6.1<>,hg!p9|_N6 ?6ɓ ל#OɶON1Zh+`` 8q:j}+RJQ Na.X}.;/ 5|kHU8ԭ=wz)_Wr)cKl^L) H1w;;||oĢ9G;\ý 0!8P+{|7*>?d ' J , BNkqx     &0\d(8$+9+: H+FGHIXY\(]0^EbecdefluvwxyzL\`fCwpa_supplicant-gui2.10150600.7.6.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.g!h01-ch4c ~SUSE Linux Enterprise 15SUSE LLC BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxx86_64 큤g!g!4d91fc40b4e0d610ed40f8ae035850eefb2652f5e39777022c113f2aa0df1c19d57783ead2cca37539bf8b5c4a81b8105c2970de177652fe1a027433593467aarootrootrootrootwpa_supplicant-2.10-150600.7.6.1.src.rpmwpa_supplicant-guiwpa_supplicant-gui(x86-64)@@@@@@@@@@@@@@@@@@@@@@    libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Core.so.5(Qt_5.15)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.15)(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libc.so.6(GLIBC_2.4)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.3ge}@c@b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- CVE-2025-24912: hostapd fails to process crafted RADIUS packets properly (bsc#1239461) [+ CVE-2025-24912.patch]- Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run)- update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)h01-ch4c 17418899762.10-150600.7.6.12.10-150600.7.6.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:37861/SUSE_SLE-15-SP6_Update/9b432eb1227ff88675139bcb07b9c311-wpa_supplicant.SUSE_SLE-15-SP6_Updatedrpmxz5x86_64-suse-linuxELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=74afe6a705b5f627b7d9ae6f308cb0388f1a7808, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)RRRRRRRRR RR RR RR R RRRRRRe>1jRAcwutf-85cdfab85e186bc1cfb8b30df16a447982f66aed7f2e7244579635a48a7fc0d1a? 7zXZ !t/F]"k%{m{#rD~d tGJf͚F`=6鷎-u2uy1T3*ӪtܭŌѱ\Gh(;-^$"L-I(-ҬAnOH=tB@}Fѿ1&Wi$u!: 6fOpEf 1pW@^ghkuKrkjҵih>hZJ3@%gUwYz{UL[b`tn' R1/nX9F Ke$2(/7CC 4"ŝi1U_ NK=dRw|[mC4N9zRQB g,="xEyZm}A[wz%&SuSS~qm4 f| t:uXoc! ^66 GKQ@}|c2So$a9 A XzsĠ]̌ǭzzĨr 4A5"@D;qk/BQ+&-2ݮ.e&Kٌbc獡M{TgjpVU5q%=9^Fi˚e)8;7Mj"* 뇱Ja4"o]pgͿ!q8=-Z=KqZdR-[bsvr9,5?=2k7mh 4*K3^^LA妏|{DZ,,yޞOq[<*c6_Mcn쁛 # Qw]z>7%)w3GjFi_KG& RAR m6$ш5sK9N[+q $};r;5d~jS[ʕi!*L)U5`\n^ijUľi!aau6ȝ&'52I:yD`j^ <ߧf/.@2C@_+MkRH3rOq@Ast>a2$ҬIF/Euv(_. kC}c:koΪ{J{&^؈!7+GV(W[u9PjV WLYM#uae)&MwkW;t[Χ2HxR4MĬĔUwL_%>-4x;mJ7@>1@o1N z`r(񴅒}"Ӱ>CͪW0Q*UoMM)AM!jv\3+\3BWVtd$HieL2C~h:- jGU2a(usb܊ P_:2Y|X s]Tx@vA~󅆪n2:Ńy"NDBT?;O Rdy C3`T_OգɈ0gm m(؋Gqt5MJm,\wsMh:hR.#ר:Bw8v 62ur/@~=b`a'>V-gX!buuG:)ˬ!͞hsy;z:dXjDuO-Ih㡬(E a[_V,[() =OfoKX#KA@u|b<sYc#ȶ B&r1i5x}Њ5{ǯO \|ؒ/zǣ*`,ؒ.`rbR-U*)yc|vɄ , #9*f2{cfk"8)2 Ԅ^-n.;`;,`YȦ,d󙂸E4s٢D^FgI`%FL$Z1z) U7L >!*s t{l^ʗt GE~Јd&29jXM2.bF#_[N~7f'- 41DabRgqq07 ɻ ˺Vy³;Y-jŏ`\ދsw)kZ{B'11ij"D%ov!6:.[5~@:T+G'9(LE1;fR].?-?C{gEdHŹ0dۭ)c seEYo@[E,&oS: `l2e4]$=w`(*_  M-L.w7^$dKo3G\Poi`x7 饞sgct,_ QwI?I<.HsP$<'{훕yc<)~'OiG9Ec Kj9 1 Uھ$bM^ovPؘr pr/IW #i@iGM~|A;I]cHFiIMw'T" q鸬JÑ)ʗYgq0ԋ;r|[ [{elb8p E53)"򘎓|`uAl{qkq_5NPqH)DuJsoIvI0b K/WĊH>٧͗TmcrG?y _>ƺu+GRZs{H vgDKohytּ GʣTU+58 ."&$b9*ѭZA tI\i6%7[jAyF]T OwGӜZ[N:{v`c 8jf&o^Zϙ~Vg na h*֝ (='TL8@ëj"S8: Lĉ=;_*zJbԻ{YKvFd+HO"4 wF^>/ oGBf^ Nk:aH ٮUB;Xnߑ];1H.鼄!5~LNn)uZN OfTeF@^lPJM{-'4(nyPvF#6/LB$]YqnN`#tiFR?:PN 6߯nka JL`'qYa- f_=hl0IBZWlhvBu݇P-|%_8wqľ?2۝q_GwϛyyJVJV90g:mS! "@:oWWoa8܎}1CF2t m#: QoQܿa hUFu W[0Ƭ{|2! vF41h V rK)6h]}.}׬a!0+^8 TN`mQceui?a|MfJct1H7U1"Z1:e$26UUU[9i]&И;\ilc>-ECv ]~8 4}Mbw>n2]ͥt"G[MĵowBBSMZ圚l7Ea Pޤ=0p1e} C䬲yK&9𧻺?TJC_CTm+WFIT,6j هs (:)N+X_S@q_yFZgB /3|S 6qEnV6>4]`LT~t{Fxu, Xs<)k}wm|k_]{%frMDolGj(Jyh[_oǝ\˭FgO8keƌlҹ $h?@_*\`>`;̪(@{f<{w20߅XlArB0OAE7R[lC{Iw#ػ}C7/rb\!jŀSΉjѷM>M759^Q+5œl5YI~@[qb-W)6AGѭԱ1?vW~Vm&*(,"#!o= |%! /$ HОxKeF+3z*m,g_76jan BXoY0g9Ki[m̀eLh%Yєz\&=˰tm,F@^Rq.O}^ ,W8ke}¤1Ţg^캇YcɪsūaJDu>фտ- eC qPk4IVLh?XU؆nJN06Ej,}<#cP v%[D<@r\*{Gm44S.hknsj^nIXu+>ODlRQ+TsgVbΝ)GSh6lg*}##qNddM:N#JL;=Td}Xy0hf t㶪\)D*ZTs3NRq(gj,yN5N) x,/ %MSɔH^NY1 TC? 8yqToVhH~!pS+jT ވu^HڧDb~q?hLYJ#vA wҔݹKďƂ wWt;)QyfR"k%lǠ-+q^3/0|sd:M az~0qD#FjZQqүkȾ͏5^gP"L]4v@n\1%[B_.F Aq]{oh1ޖbukH@K!}?cp #w~M6c8QT8%uٻZ{s$p{P^r[E/gQ?g"$h lfp0c^+Cr "?w?u^Nl{3!ۿ٥D ĭp #=WdoQRP4{ZTL-*sư' ?j1%t׮;](8*GQ :!Ӎ(RH lRk֌wk.c<8_ /aiW#`GV=ܫ5~anqH A0UBM^[+~k D6Ik  +\ el/v3ܗ\h.=r`3,zW(NjwSPd AXFB@IMm^4Ǐwף̕)cޜ燈yrG"e i%ZP`kNa[Xl\3GۚUwX͵tRn${,)ceS].*O3ajUJ'T&طH_SCe:-=Rhư$mԘ)6/h87kåzFIL,SzZ_u<;"4KSt[Ŭv*O֗U5qЫ1 !ta T 2AX2HK5̳z{0Mi4㡖Cqa6RHR-H]O1yAUk\ǎp6{N,Wن نyy{p7Tf@JkP?MÎ_?J$ tM(7; s'cxJY1 V1t b膀"cEE1ƏZǸ:gpz}>2r^;RkIm6mW tyDVoV5^N!֛sO;z{(ɗ $`W_yz<[GK#@f*PxtT!q:>^jA&/"J0yZHXzr>?  &n'Qͱ[0[Y%b_Nphb&ZS#M%w"bS*ch)a>lz0i TJoIwji$]<݉`FYk| +U)4<@6z_lR͓E-XvXǭ'ܞ JP56=7~2d0V1\9KѪ42+alcq;s%{ 4x4Jh6ox0t,V3hbɫ4p@ KM>TDE>(BFxI_^#gk`ύꋿ8 \r`SByڦ(macHF:̦qН'1m{GȨIwhRsqalQ'f^~3L%|>mOjzTQ.˴m { ̕/QPP!~A5_B'^θ{B|^xp7bکe$|&U@>[ "Np]Hwx]1X쟸OX8ݤJD>Pqu^IHúwR=x+β&23*4\ 0!ҕ0c]`n1H@Y~`JIJ$ w8_$rqaߧo_Lp&/"`BM*v'BGٻwVM ƧSն^52SjZmˏJT*5Z;sAzcKn>]F?yy7$wG+ 7g 7T#IX UǯLƢ ~kY4AOMLؽЅ>$#쒧` /Vws%;mi&{%rt3ï/b!gd :>LoZ7e-dlv6SM!հ>D>RMM䯴~qp+nY"v;p2Ƽ Q# ).Iec('$KdxBfoa=n!=b*g2i2GϜ^ &nG.~")\>u7PS[{f¨3xg ʅޘVp"bk ~ͬڔē1ӥ}6yuN%b {qTzHsgsOĚf6!|xsBm'jt !w1(3{%|5]`޽`#>iб뀪:;.yHݾFtLXD7g. O+]Ϧ彼zp3/xBV9lS.:K.*Od w>k<^7|Дk` #iK6L!"#iTzh >{r28jwmPDfͰV='a^t{=q|tn ObHߘ[0_BJ-m¶|NPˤ P`SމF¨m-3;kYGǒiPs[{pUܥu'K?/\tʅꬖŶѶolg"\k S<ٟ/ hU<'Bkyݞ8Wm505d[gJSWշK+TZ@T"{2Zs =1ن;+t(p֥k6SV,X,i5y ѧ³ǛYB~?"$m>Σ-涞)utsӚ(B~9qrYĴc8 ߆2m6|v / hLP nHLN4D=HXeq:yF]gvg_̑QpIa_뀲#z1L>tyRVg ?h'Ge12 7$\3S57͡zw+ij(aX 3uYѶOO:df*ETR rŋڈp{JΦ ξDlF[hnm RCW>dIZPUOag{ Y"0_+'fP{}`#R s:.bstEA2Y| aJc8*ʉ^YzZ~r q*0/C\Xz?&vCNT%ك:]:Mo0 T?iș [iI:JVTҎMVn~yrx ;0M_rل&Ѱ\=JߏdMsb x71,:-;#@IAvה|4i+&S%寇bSb Prav]`xu{f5K;#| |mIm"+J8d1=p2sj7@ "4%\cmV:@.>^iK~)gLrMQtu,5CW0}ASD-мz<)Sox:v7ylx-qq_ǎQsC{bX%ȵ@`%P񱍚qg ֙޹% =/|K1*$JZ6P`7Mbٰ,mdk 4l"vOnYDf&iB H¦Ñ=ܢԑUjQgV4K/nz9?ejrJ5銔_DsP#s'.3cQH}]A!6fxOsN qTLP؛gٲcÄ߻ ؼ6Vy+XQ咷 _d!ڕ/ X$@Hu:r2+qĶ1]'wHb JaBg89,@eD!)@[r4'cU)XQԂBY\%AښHBfM]kl)$roaa&YpETw,|mkDAfe)Sйq4 N7O 2E7N%BW1QRLbVEA#6)<|kXN.7Ϯg>94x  HIkZL0v0^V%|76Yt52wA@H]JfˈZg4<.6qYEcη>O kgogB0d@Q8(Q/6N~S.#;Ů1DnUG3̳uwsEn}+`҃ޙ_'KX7V{#*xB舰A繠\Vaz!%݆u|h·@v v"}jfc;cZ|# RZ)W{\rХ?t^D5[e+>1>g_($̭ :gu0i_d2ěYT}󒩤ȇpgYމJ@-gVo%e'Ǔz!t&YT {0 Bљn3!u|GjI!ptF^&9֞D?,׼"t& "[ƍi &ޕpQSm?o~}vC R)0˹,b*gقzuʠ4;-nQ[.RRodcEe>H[OlK4C\`~@OM#cγm@^Ӎ;Иzw8-r.uƛL: rU n̛.ξ(O>#"P,Ԣ=5(1#GZ\n)UI <מ(s Td9N[oɦ*\)Vg8yl>Ȥp0|An%]fw;,k-CzV"v@wbè]#A\!AZz+_DrE^HlDHD/V,3 >x+'ER;+Coz*{3\#8{^q1b;)R0<9YeFHiTyyObl\ ƢnI8OD\dG󏑑Zd,Ւu݌$=MThiB7bCA}wñUJD'xM) \#Gé<%m_s2O Ou7̭!`$ߙWgƮ٤?(٩tm݀/E HLl&AsyM@̶ť:`XH ^LUd0a{|ahW&T}W=Zm*]d2]ШWđkFɠ 9 l֣ mZ|%'c3Qa.dp(Hxt/ڭ-ZWExs~f`}`tL4>rM+rж\:\J^K2`t2e4%Ԭn]0>;?&~/`xVVO|]-u}`Rj^Xl#H>aG9yl>Ћ?H /j=\~J/͉aLFR'S/Qi}@:*aW(k xßѡLᲜxȃpEge爄 Ÿ/Gzҙy/Sp%eX/(MoGp:#ޓ5QD<1AZat$0 b|ܰy1l}{A4I+$ފ]W݉&>#1??oyg ;!i4"e[ciL$6́t3JZ5I GęǏ7(g+_);csk&[Eb$A j2̸wT-;f;o[t,S]u.ȞZqe ؞TO;N̄5`vm2Jw#ʑ<>Ƕ7gTs|]Aw2)UGsdi$P=zJ׸k⽁-]sJo-61.I >6W^o^!1M}h A+~tPZ zqCQ QۋZwxz$]`X(#˼BU1xA 4uvp[>irKG,"/E FYDM>.]p@bf@ovKOz8#q)c*ՕlZA0Ce1]9.= Q !6L+bqjc_kmώ`1ި LL?bWAJǩ|Ad[i>fXSN5O[PYХ rZX+42YtGT~W@'+FK+({JiRsp* 0*TdGZjU1Litur`XVYCʁ13'%bc" e󹳻l4#\N5MO[45?ףPM@XZ{=WϽ)RudYzëCh/`E1 T ]I "7E=+ >^"T˪ _֧wnIu=MF$3~^xKD,x"hyNDKg|ޫRAj26c{K LMC,e<&/94G >,W"6z>UpeOvHԝG9d! _I0] j%-LXeo\jZoĨ<.j5@%7In~@6@+|Bw#$~;`xuytXDkbXQmL T),>eұTsUƷ==BJJ~ApAPu?=K @HfƳ7N$x`6ڥ+3n5qmr1X0u߆T]0mj!Xj hsBbw-bz8r.ur`+Ry4Th0<᳏N]}.aqcd ses_t"Ȃݽ;J2@6&t(٩Δ;0b8W-)D?)^oZ* ·O?/3LIC3qn4 lБ݂:I0H!FkrV|Z߾f'7wE/]ɂz}d* DS*f$}8DTč8wIQ^K~30&v׶Iđw*,85euL#g`/ߥ`{SɎX5so?8a=w+gF OZ`F%}L,P@cK=FҖ y;BؽfKu)E4/ "b+Rr_@J r# 'etlTVK=lj^dz 4{Ϛ$Ng ;?~Fq;6Y>$~`WWu=A1a}v6q;'(J_*/d\ 52ϠCa(i3W n^ʏ<Qpv3%Xb.VD K}] < Ѽ |i>Ja 3p"c!x8ڽ[ᬱ,ݤIzUQyCϿecD_ren.?b1SW|:eJGs[:nm 8(R|xXu[}2wZy@l ^/C5/%0/m@A,=Ef|}C5P~+ ;P^ҝ1sK5}XFIrAn+笥< ;S9l7*IY})} Dl7-'HW[<͉!\7 ^!d4[DD5B6 Ouo,c=\NQmW^鈞JL4{J"6RyPtt?C%hk%4KC9mMvv6 CYDi,4uǟ/nȣ [p7"L θFwgyInyG`bJg)5FD t٢^-p"2G)v/jos)E{fDƀ_; =zAWJQ`P߫KtuLmvt8HHX@~ovaVys,z|"U]>U.^ݬ/x fn(Za0)3éxg.(Eڍq&`M6g[|my! m/=\({oh  µZXxp#DZDu3{ E|Eq?P?VY8L~_yNmp.P>>ʲieUa;8F"íZB'=4F/2ʸUNbr…c\+Ҁ4ut"E[WMn@ m-'&;),u\I!z} ;p9ʄY=^A I/#ɽ( l9W=td,T6H'0OY[]uc&~[ք(͟P`nqa;8F򼻽^ڼ}X_S*ӌ%q%7(o2~F& 'E.t<Yq׼juӖI 9-FH,%XXTSv2 zAM_"ڡT%X(p4?BDv1@&VL<-W,n%3e|b:Z=bHj }o?*.;<.l't*M*O;ӗ(E/iH=]$=ʟMIf^Y}UO h1?(1f v+' A[#: h،'i2B8y1B̶l%̄Dbݦ+VShF6$т[N=p%Z$ڶ0 v=j|Oּ^زrHTo>ND:4H5,]<܉1Ύ0;+SZSC9q]'Y6ܦ?.1 nT>vwWJZ\io)_}Cv_ qɨ݇0B6Yݯ; s~z %1yX+,4!4ԏ%FB7hbo+|ќqC)326"d7PE}*zEק 3/a02 F}.G*(ƒΓl-QIc>hb}l]EQ4v a#btW&9+[*o Jsmܧey%izV贬bE3wGƀb*kfa,skOYT?MfӳOO1# ݾe]1;Ve4\Q9AKI]~O Skbn.+ѱz*]ԢRB諸ȵ16 R[ N]yÃVE? 5۷' 8)v3̶bL<{(t>l1ge`[%}d> .F=5w^)t=dC,Au9.d>70z!iuF[Vƕ@rbP R zFz jT8S$޿]1_e6y&B5bm%ͷsq}nf0H+!/l#Hu{1Z7.3ܡǮeuLXWTdVoq݃dlXhxW}w- 441K(ֱ@X526B/^ i]'僛O~0DB=B>\bܞq8Wu0 P⊔IOs4`BfڐB1g!i? k 9tB-Kt7r6. waMDg=D?<`߳$̜̀0ODh]2l*#v}Li?Egk)(ͤ}6Zl ڰO^j^j=4}ZlyVsC:й/ kaUіzcwޏ'2clQ@Zlu5$Y^[iU(ds7oV;>\Os6c8)F&OjY&3W kF)q >۫?1L0`J r%+ :GТL:f;|⧻!){9,vpdXh1Er+O\ VzK'Q _pW 6[HLW 4SY; I W#[+;XαW /d>WӦdL妨ڱR< DRDw\oV Jb)@?;ꖎ_k-K ξG`۽ -HDD[GTQ*Ť!rW+jy(Ƣ76;ݩtƏ\Kw.S??+ p/w}EyYs$10n صs1DWl@,ꧼ }_/'iDUA5Etfpb"H?H{|"D.` @UA X͂E[졽_zY N}fwtk?w|R{J*uWK`Odaـ;n:98lutex2An>?Wn]JOYxk%a5W 웲-Ɩb=oݏꗕ,{ԩK5@nL[P(eIsPmL $^H>ն@-{xDHH9K.Àf +{u•>/ ЀԢ :C=ˀt"=y[d.pLi 2q7(wgw.АGͤ_Y$PÒԅ=T%DLb~ .ޘ}a,ZMe3`uE3Sz ?y+&TGtt5k*0'3qc<;+ϻ/.÷bjqi–eDBo?fr[x|:ea|%zщdbVgR~z>nl"+FƓNf{OUݾӤ55LGfdp' -7b==Zdʡ'^=K-µcw gX.o<;BfF*  pAqDòPE:zDb17 eK#D$D}+5Cp)o뺳k(k68?;/Z# /2kSY &56L~H;?tP0ZA 5y! qON?MN]6̐_ +YUphW;R#ǚy[yC tP"߆Y৥Ob)k ^줏] >q [}!@y:*Dž7KjX$mE2a-߆3'%l<:l/ocER92(h.Q$ :o2 _T> ɂyk+lСXx!'?幉SawпрBtP Xȼ+e@XcX~.q`/Fù5J1J}@Nqh.RnHlkJj\-Ì*yy0m/ӃR Ko5X$3K +u=VAraw(8D-^m((6i׳^>xJW34e!N=Wc`eÛjitctе'^!~/n|_z }Dh(D둑 D4kȒwWqG诘 C9 03\Ҋvb%?T1$v 1B IZI':]"-Z0#3&ԺH?yɫЖ ` mJ 3獏N㛲6Hƪ(DM9Aw}BCK1 Ze#{r/[ ~|ۧhHuSPzsBSڳ̓}EY@6(8pv58mC*gF!>遞Ŝ./| GXs)3PPhFwEaj_t]ns$\(g QeV\9. $7 LUpAlM͝lT_k1~䠑eyʅ8/3)4A#< 9 ~1^$84 Y? @(k27J֐SnӉ ` @bo5=4youhLqA3P3^*I^ܕT}1dROyN{,ǯps3 ~=c9ۨJ*hn_d!-(PR!b,$=J͗6ݛWO=} Y54 V mhÕ>BXos9fvϮ,6y .Ғ&з~@t.;mph' }m]hU-JZ,f[$a:zS #X`1BDM^0_I\J&/WaEo+͹%wIΰLsO0F;g97ٽ+B;y+4&&N4Fo+e@a` p!fHK-Y̢#laԩHOڷw)'H >aU5oW yXw65 WG=$?$[=Q' 7^mW^1d1C7J1yR:B(\gfz%BvI2=*'2g@oR <䶠.r2]}-D-ՃcH):[c*a4(2Fb\>"UZ4f*נ0zH7!".4T5%p-Z:,W2"gӛC8~.OFrC!`p}sMR >SPJP̭Kprg3j;R,tc܏IPA3}vo!?[hQjŇrb zRIGb ߹uPBߎ,oPBe2ĥNUE*U8=fJs=Pm|ږb#nVa\uGXjkuTaKJ31c"XHǡ XgQkO=(Z$rLeBG-⩠8Qֽ4e,Mg>vЅFzF|"_FjsXJ ȉI*C >`0h5 ,ֽc*jya~;ë1 V 2+ěM _ ~TЈ(Vpr!AmdJ"IC:*ƛr :ַ[] S!]# B? ߸W/H@P?p WZ.fWyZ_f[?g;&}.&1"J%Grr=j=jO^*B4꾽$eƟ6&ǏĒ #@ rxe-f,l bݝ| xm\tɃ=Uk})E9Wu|b(>¯j5MOjȐZq6b|FEvGNިuptf8axskv>>FNbd.Փf GJO.!Iz42g֌PJ=}WÌEGAAߐ^v1س ֵʎ!^+a!H; SVð$Nbb{vF i]|5 M3߁`O (LMcD9ȉr}YvuuNt3#rjE4Dr^E*:q;DHB\a=CeܶP'I2 V_ /W3eXRUn|Rwv39/j(om[}T-3A`Oj|<}pC^aԘ:3PqR, '&yBI{|v=; =y*_[+vK}iUbZ~LjGv"ʚ{V#.pN4ɖuy^e Ć(yGͰ }qs,9HVW`_֔j栨̮I{p+.$$ u^ f!t [jȬ7U F'J'+_p Ds3E7op8y?ZhB;@ GWD|#a8Bx<]N,bp/A(l)kナ(PDulc܋FJ7Jd-^X$RJJbn;,&( YG!!K}ˏ} ئpX@Qu*pDIe(N!f U#$ a?h@+yX \۫9f7{\]X]9ힸ//_ڟ;b>Cʯ:sQ#*H^UP,t6_33N-ilb=¹9 a\\y̘HHAм5MK!y_^`Ol6;|iHqSXnC!o6J'7M3HNJ(ji qF%$V-*%h:YgNP3)GSy$* |_aE4zFQ6a)O I{&FdeƌwL2&IY3X~b@`Ry6'ȹ)v+%ISEG7hnr7y-K$kR~y 6F+?shpN-R躁[ i*#u4s yte16 Fތe ]~!NJ)Tq&Ҷ^L\1nM46 ܥ$9丌)dO;te:?yM|xJK)^"-1TJѰA]h;ь\( YS.ZRb6m+48O3-Sƻcg$q/ahhEUV f`s7[T:/ENDm4O< cJcؼ SͲBx!_,!Mbzdr ZGYXI@+:Eds5.>٩&%=}x giA/wY*{QrV@9-b>@8>.ⓅT]v!9Y~K+A[zgԊ7F{(M&5îBR5%Ir |(ϛDQ^@OO ,f0f=914~nhdá:oOA4M$Pa#:W }4@0Snݘ#XXrhYdB$uN_&Peviޅ|8k#;^ |"cEm[I@3lYBvn wlͽJ(#Ԣ&DƞR8_ԗ:IM Sc~L=n`Xmn6 w[=EǙs;N)j%d|a9ah(čX.RX'V4F_*_!Yz.b̫Zssx?dɔ2ν\7+h΀9kOoX⠻◹"%TLLGณ@yH5Ax0,<J 6~a yi\5J)S7\?qGϑvSWGsVSdB'(Ik6K}f"y5* &rzF ƙ]TH3Wj0_$(:f1KqUpIbхwIVlL9;ܝ ) ›.cmW:[`&ɣc@@'߼'KI,$͑_`KZNf+)9fÄcw=scj0FnLk`s Q@ĝ@JSzNCYP dG83dN>YqTTB{5EΖoJz~D̝<.e&qzӺ^uwڶ}i2ߦvI ok%s1(pP%URG'[nC- Dkz Ey횔 1ӑ (9msS*r vUV@00l{T8l6%RF> 7Jңt6^Ejj~^!,}_V;0kegnõ)tgNPxU)5 XZfuAO#(ni z;$Kva5H]2uO]O=`t̍k庀z@\)K py A*MY/L 1\:`3>)!q%=c7nZoe-㕳?R#kAJ]am'J(\Pk4}E"Q#q{㩯E썁ucV3=8M<d‡V348af"@}D3[:LzMZOD{U4 (~sF.>D#3sm_Iѵ{uٛ<W:Ko_2֋V@P9o:'V)kKO8m\rgz &LՅ˟;/7zݐYiFiA`@¯CT.5^|^uAy}&ĂLˉr(g $tg9}&|?&IRLekʮHkBy:qM#7W|$1 HpP)&f?yCe] }ېԾ=@<2sC!`~ffay@a$94X"YeT"@~3<LO`nݎvgƅnrO*9V]zIK ꃹdtUIP.>·@77 w_)UpKD۔'\H\9G"0JwFGn'"WY9ݳ\L *7A9sґ.g~ XS__!^%IRV8[/sʳ sg^\fEXPE(rHY޶sNjgIbng0iսdUF4 %*odeDQak8\ A$8\)|+sJPejr-a&=NKPgŠC>o0JAQS I$'v>ZH $)oB5߫:(6,L%7h\I&|=bhHKA,U}.B]\+!.nTk]ɩ#K*sR,J䣓-juJȀUSͱ<*& * #&+uC>iK_$Ig}aX1ʩN+˵p[7LAsz?^%I?&O$^- Vҿ9n]`9SW$ Eӧgl̐[ cZŃ~ԞrBJRM3{"ih3X~-XlZ\dGS齂{:T1. b8sl{/8й9WmXz ⅏QUD涇EGVIݨJE}Z3(pJ"4%yp!WW7A|&l̍Ze0ЋH|d9+3iX6x/f8A h9u'ՋpJ8> ߸rix]Ç(FA_;%CC074,lb@@0M&[©ŦeT|t4[.76JݶWz'=OAQ٫q~5B [qd^b#d)V @E:>)Ҡ˯cM2 =Tmԫc)cE^5t#Reξ$4],GO7}Hex1oe&XeZomC܎ EDMvX>ʜ&d&!z=[:)*L٠ll;%egM 1UBJk(r$Zg8h͐AΞ@}`=#ZB@Aϐ^VpÏ̡աqR1$ūq(ůMW G%=qdp=uZ7xh?I|oX {F@P˜nhfu9ъ "7>I=!gcm^2@ 1 |?6&S01 QkC BZR;Ygk}:7CFzA_# w^hܧm`en/7P8cD1yq [Rq>rn2 Fc7{P~yl:^(( (w޿.G^K')fp"d5oAdFt9RAUNj$RL“dWb'b8x:lY:9,#1x- q('BZ[(Pγl+^Dg2U.5è'+IUΘR3G~e9x[)/^ ӞGMU2gL,&)]nnE6n=\ H!{?y֜NIwĪ'uι/ݞހ*GqUm (DGZuGl߹%׹?4RJK59}9F䜛[+n Rm&,ws/юZp`=Ȉ8d/nH7Pϟ`\jonߊkV~ɻcg*.",b wNO3y$SUR+!XP"B6Oj XE"Vʴ?iӜSJkϼAy4/+ pU(X2ԩ\s^pR\ n)P>m7޻sf7M(ӎ[$")ؤDJw9?Mi!è :dG?HYx'my:&h ڤE ZURkW.Λnt.!VH%)zѧg_й鬛]U7>U 7KF>`z"gRZ">-[q@LN'M P#fI\⪖m"֪,C`lt%2eOnO}V UIޮ۶J+=ws>2HTeӶ.cJ[B?* 1z0q 417^Uq4帍(_#)NS(r@WEY:~LuW^[bnoqw0$a6=#>Xa "6==:fHZ z7L z@o:?Ɖ)Oe:OvEGس~(]mbN]ꭔVΥ2aMS&sKk Ԏz{YM2\9/ kŕHrf} |otS&Mp \,~6_Y$3 /jզ+@ZS4o2oJr˳]6i+p^I2tBLeŝbV.P}>"C/$'|RZ1A ! %9N+X@#!'Q"%٫ck4鿟jӈY =e Bf59RCfv E ]ĎKm<4`Mϡ͠; vj:H :ȢRlm@r^Ϡ9 2!jt+'x8 aRf}*Dz Ksϑ1]ZMaZK3Tج<ΪvtEۥ+ (X(F@s>Xw1e6nG&?W, p{#fE{~hoexkXUF:-;fʻȂ|bR;C{$dX_ڀX]qx . lRe/}?ܧ?"5vV ig^[%ߚ;k📲]'XZja8+CY&ܒ&TwΜGհ>7t3]K8O.ˏ@<慅|͝-JE N%X>f((YB%57G>%&S2hV8oԐ9GGHY&Xg/N<sS v$Q~'Mfݔy f-29ɦ.lj\Ҵ궛!l_!~sJQ'17k*&9qͮ{2]_b9 )[>eWm8ڶBP=~~sõLuxA^m. 'B!gj'#v+^*R(ӗ$fdFYqg&}dVy#ZjEjke&apMҲ':oT |H`ŠՋi<5 J`J n4$$Wӓk`f>3J͓:2K~$bߎiw/\Wmpx5PJ4(|?\מO S*9 dS*|APfv Z{!JcJ̇9ǕNT_n|YWԲB뜁9bQ YIdojdeVP'd1-PRx1ꢧ6quů6WW9G 棴C} b稡n_qEO(妞+:ۍv _`Ey,Z<"}hdAu c-xWLII#⍀ Jj+ǞG|Z:p:j3tkB}p,ϬeX}]{_Ɂe<":u)eZ ذi;eB=!<{POtߘ˘i塺 nX'&"?*/.\=:Ҁ![M/L,A^S 7H樬M{ͳVbG>S5AW5,,y?ʒHI AZhf-L|=~"y-'*6%Ҟ) kELpF`uv~,rv T(|"@.P7g9oKbX|7tW;µϢ^sKɟ-jh&崢FJ u[d Q=)<.Ş9zWvʇ{$t8 ` 52ՎqQƮߠjhOTu]A0Z JZ=Wqrkf"#8Q5yyc\m:U_f%RPkYے4éApZt)IEVΟ/"n-L!EY 'ه;(9faPlg(HsE3ҟ{04}7 pi^7gr^ qD۷tVO{# /B"&"?t9*7x%7#~X&ϭ $\ǾC^MGXpW/Zf 8J|cxDb,0F {:/qsܷR{ݒL2tIJ66艵MYrǐGH8YlZ\**4.!hF5 #a?yi(5Ͱ#ClF=՜ެ?/N.u] F* ,g} f񍧮Z-ł~'f3*?|T̀_|=Knu(6[E9xwMT6dg3;^vkX*>ۻ|ȴ\v{`A)ԠIygػlo-_7uXz0XdP( B`J5JN_5/5GY1K7`8KO YVZǗYgsؒ"\]gټ Fj q9Sp*ƃV![LrGs*6TAK} j-޽A~۝q#7 ߘ4>k($MZN7 `l>J;'܏O #[߀z:qp^rȋ\COBB^j??!Nʢg[M6#Je>w\o")߻QBKNFN޽d8P %(dz#ijD:lm%٫Zha,[pJaٮbY:TTL~G{4~͹I_O{e[RxPAfN\]Q7bsx l#$Ǹ{s߫CC}؀CeLԯqzm mDrfzʹ:3$I /"9-^{_63"eXMNr C;qm+FBc/ݙ=Nۣ[KxppڽFSroCLy@AރȗlL"M|./Ǣ1R-0e%؅EAlBgngO}X Ց[P T,@ 63tJ #H I quG\c`t \CCnL:Rh|.Tm;ˑ0R1M?KdbG3)?S)JMXRԣzh>-uBz &^,׎wlzdt j=D^ʼn4}SW5gQ$!2+w!h6P[b;EBC ʠ,) ?,M$3w0,ก辨)l_ž$'Շ?*v?hȩNU#F gM^cM@V 0`M{>}O=b'Eh+[axzoU0z8qL"xb$~4RDŽfBYh@ūp;+ [a뱍#|YGֶl(c9#Aؚ-!W! E#iL Vu$i*m\Fna>\~/udt8!Fp$km0z8}1âwbĘTKF,qN?9qMjKRbU7*cC,7FJkM<{T:JmH ڛtb+MҁJƁ:trzE . F'LoYV#V 19{އ8敆pz!@jy@鮈!+ QZ+q$'}dNzкwHI۫3߭Y/ `_3mʁA߆fމ&,vaAtk񺺞U&@+J}(*D`-=`(Ӎ ҿ1lfiK=َ#Y)Z)X팷p wOVE8pA&ROx/Y?2蒃PũZ0: >bt¼=yȗ*9 Ra8X2҈i+?%&bo鰼+ 9 ׿.NEmW`@t ˔O\Hxr%v@LIs,ޔm sj{E qM3%K>*&\r[5ͶD9c8 MN/q/Rsgf/"輣-dU Y> {nTav|VDu-d)brА 4->ѻRGmfw\pUy`: jz<}`|!drCbL j(6 /ˤ_nńW)gkLh?xW:dN;}^*ZVnc~>yR.!?21L}4B'wʤZxZ5bɘpӸȱrA\?lO 9y,vGsabjJ˚vu]ύT~ًǧ56JZU"&{S߮ۀX679 SrdVF7 ]6_izaHF!ݵ8'=W9Lo\957ZѪM|cԡ$c!MF%F,I_T5s߷UAHr*jN9aSw|ydQЭxFF=*\/uΈP"$c-FՆ7=ľ~%v_Vf߆ŁMn kϼ#5h9I.8 eR}ŢX= "\Ɓsi@H a+7jC [0iF*E +x&!O jQγ߲?Se4p ;RO4xE Ƅʲȑ*pbia.́/󷝢#pT}0t۰~S8=NmV22!_=0ӑ1 .dWE[~r`Vn'-,Xϯ;"1y$.' oX+p.*$f[yK0&d$ab`!xZ 2kb|‡ =V5=D C&8*A;u،{/'/U&kTL|#_r`1hsw8z-b WYRh$O;eSXWTF<-{ %7p绅av D%(j? * ?[^âΚh m۔U}l tI^fְx7[z+~+) MB7]'ZL($emX+BƔ^)y06e%_L̮T ;RTCT'W抽RG/ !kE:'dt0Gk8O`U*VNi>ZnTR(]n=U82t4WX>wyvtE ?t 3?A<2mv 1vX!s[8H#LEuI@+&vicb&"ho(ϿA ,J+ҳ7mJ$wNdbuKˎ>v//4/LTkj} va 0wǨFpG4Oax2٩؅8!YPx;Y:䐛ÃB,rQ~FĦ@DY(6'dq%ٖc탰mbSq l驋),$(Z;륭ym&4 0=0A - J/Ko.n.+n1tS|J2h!S_zJm D﬽-k43^:W.hdT ҍ xlq|@BsnA_,줤> 1XTzIB".7^88gb^4m|$ ΠKBSDl̒ )VgH>1`1*qt\ }pjNՎ :!l0Ifk$:-cQڐOM>Z1 /Je7Ix)_-Q[ #zTAg`4oZR'}nىPV-lRϢ@+%4l\UiRuD*{6LԠH=NN3>VMP=i.UEư^C5= -XSRf|jR+Sʃwtw0gGar E+Y@Iy= l6v@<^)GX}OHQO鐉ْU}O!2ınoahz`,+[7ߋ Mj).jSΔ5F`ɵǮ7Ȋ=R+rzkĨкآ~v6*#Q.RgF4;C|lIZ_|FgxN e? Sϼ'5,[KlvcdGUnFjR3qݠM~%((!=ۖefD ,Eٵ%,Q=M/&t jJN_B11|ʅ6I- &GưR«yA4/@SXwWjy#Cth^vJmeЖ"e=xb/:8ET 7^t)}lTww^o +u|#SgʢPJSO޵-/; Rf | ğ'N;*8 u)1Ye] \5#Q==L2Ԯ'%WUrkLMҪ Dl>05|&f`5 P`ivN֚L`~T|lSYN:9TϢr5LaX5e΀L֩k9M)?;I ^I|!`PF,K|~Q4:;]I:H_f%NX;^c ʙ%i3bq(:DIOK7j|ǩ3nsGUJ?Pj)R/~uҌA>EV\zVg?Op$ms1> "LW1 !MxFİ襹`1qG|a`Rd삌Rn(§Q}/$0Mtiīy6B̥I }_fCw6C?9U!ۚ;2K&\z|hEm")/5V鑈Vq⸼ϗۤu ͕pEaRz?S'6K  (f(Ʌ2өXy (ecId-NE?E>Ti!]ğd|drMYB笷ꫮ=XA϶%[q@_d<f?J (Fp6{G>aC{~?r'1&QלpeÊʭ!kQpc#5弖i$amHmh!GxI{ [ֵTz9n]tJ64+[-_OhU~vxt@p̒t&" !۩B#qf; Z$VX%h4o(&#J1*6dxtH3s?Y#4tgQjh$,[ Z̿-@1_o2'x`m- Km'0ȴ)m $өtbᐜVSUWM^25טlav9` $%gׯsB2nz6}~.N[>lf?W)˿2kPXI3Wᡃjg<<j)|އxfYSmT^(ЎDp?1*x Sς|=_I|RV'#0.tJ JЅ%_^^N}L$Д⣉I`jo3SД}Xt9~l]bNR>0&l@ᄏu3PlTlBh,vE(˅wQƼ7aU'/%H+}+/72Uw.(ڻu*;OzO?i=K[qBJI\F4=|@㰏o3 M'jKƇONCdQC7w,U ]oNptȁv]|fxTdHHڄzq:8j:TܣF9Q9` ;DCp9*Y|Dࡃn;kWjVAiEM蝭+jw9 Y+2eûKNֶ#9- 60 =yNqFj? t(Z}P]+{n!g s[m5g94dq6a掯pBXZso\ .A>w㞉\qnX5i3 onT6]c`b[1G*Y /EO99'79VY.PVgcQ!@Nt(]l@?~;/9$BwZ3U9?-Z_DiDO*`w $PUBRzPw?!ۙ 4#SeFB{Vue_׋I1Dݺqoe2|xǬԬFL *^gU椚(́u0#.& BZؖ9.," vQ_5_