pdns-backend-remote-4.1.8-lp151.2.9.1<>,_kS?/=„h27z䵓ٺ]_j; F('1NJW`o}8{QB@]̖;QB)/L\2S*okLR7&ʹb%n@L\%~>o$K\[c4hH? K8( ╪My~cHeuH[+ѻxd #g*)#0j*rN׆ڨ e>>X?Xd ( @ ! :^x~      \(J8T292: x2FU~GUHUIUXUYU\U]U^UbUcVdW:eW?fWBlWDuWXvW\wWxWyWzX@XPXTXZXCpdns-backend-remote4.1.8lp151.2.9.1Remote backend for pdnsThe PowerDNS Nameserver is a authoritative-only nameserver. It conforms to contemporary DNS standards documents. This package holds the remote backend for pdns._kS?obs-arm-9(openSUSE Leap 15.1openSUSEGPL-2.0-onlyhttp://bugs.opensuse.orgProductivity/Networking/DNS/Servershttps://www.powerdns.com/linuxaarch64(_kS7f467e090246719f3166ab9f6f8d91b7dff118db0c7001ab2c3041450a67ef64frootrootpdns-4.1.8-lp151.2.9.1.src.rpmlibremotebackend.so()(64bit)pdns-backend-remotepdns-backend-remote(aarch-64)@@@@@@@@@@@@@@@@    ld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)libstdc++.so.6(GLIBCXX_3.4.11)(64bit)libstdc++.so.6(GLIBCXX_3.4.15)(64bit)libstdc++.so.6(GLIBCXX_3.4.20)(64bit)libstdc++.so.6(GLIBCXX_3.4.21)(64bit)libstdc++.so.6(GLIBCXX_3.4.9)(64bit)libzmq.so.5()(64bit)pdnsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)4.1.83.0.4-14.6.0-14.0-15.2-14.14.1_k8^%@^`]A\@\@\@\[[[@ZZZЛZZZ@Z@YeYY5Y}@YMYMXDX@X~@Xx@Xx@XN@WW@WJVV8UUv@U>$U8TPTи@Tи@Tи@Tto@Ta@T_W@TR(@TO@TO@TO@Adam Majer Adam Majer Vítězslav Čížek Adam Majer Michael Ströder Michael Ströder Michael Ströder Dirk Mueller Michael Ströder amajer@suse.commichael@stroeder.comkbabioch@suse.commrueckert@suse.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.demrueckert@suse.deadam.majer@suse.dejengelh@inai.deadam.majer@suse.devcizek@suse.comwr@rosenauer.orgmichael@stroeder.commichael@stroeder.commrueckert@suse.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.deadam.majer@suse.dedimstar@opensuse.orgmichael@stroeder.commrueckert@suse.demichael@stroeder.commichael@stroeder.commichael@stroeder.commichael@stroeder.commichael@stroeder.commrueckert@suse.demichael@stroeder.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demichael@stroeder.comLed michael@stroeder.commrueckert@suse.demrueckert@suse.demrueckert@suse.de- CVE-2020-17482.patch: fixed an error that can result in leaking of uninitialised memory through crafted zone records (CVE-2020-17482, bsc#1176535)- pdns_maxmind.patch: backport support for MaxMindDB- Build with libmaxminddb instead of the obsolete GeoIP (bsc#1156196)- CVE-2019-10162.patch: fixes a denial of service but when authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. (bsc#1138582, CVE-2019-10162) - CVE-2019-10163.patch: fixes a denial of service of slave server when an authorized master server sends large number of NOTIFY messages (bsc#1138582, CVE-2019-10163) - CVE-2019-10203.patch: update postgresql schema to address a possible denial of service by an authorized user by inserting a crafted record in a MASTER type zone under their control. (bsc#1142810, CVE-2019-10203) To fix the issue, run the following command against your PostgreSQL pdns database: ALTER TABLE domains ALTER notified_serial TYPE bigint USING CASE WHEN notified_serial >= 0 THEN notified_serial::bigint END;- Update to 4.1.8 * #7604: Correctly interpret an empty AXFR response to an IXFR query, * #7610: Fix replying from ANY address for non-standard port, * #7609: Fix rectify for ENT records in narrow zones, * #7607: Do not compress the root, * #7608: Fix dot stripping in `setcontent()`, * #7605: Fix invalid SOA record in MySQL which prevented the authoritative server from starting, * #7603: Prevent leak of file descriptor if running out of ports for incoming AXFR, * #7602: Fix API search failed with “Commands out of sync; you can’t run this command now”, * #7509: Plug `mysql_thread_init` memory leak, * #7567: EL6: fix `CXXFLAGS` to build with compiler optimizations.- Update to 4.1.7 with a security fix: * Insufficient validation in the HTTP remote backend (bsc#1129734, CVE-2019-3871)- Update to 4.1.6 * Prevent more than one CNAME/SOA record in the same RRset- adjust buildrequires for mariadb 10.2.x on SLES- Update to 4.1.5 * Improvements - Apply alias scopemask after chasing - Release memory in case of error in the openssl ecdsa constructor - Switch to devtoolset 7 for el6 * Bug Fixes - Crafted zone record can cause a denial of service (bsc#1114157, CVE-2018-10851) - Packet cache pollution via crafted query (bsc#1114169, CVE-2018-14626) - Fix compilation with libressl 2.7.0+ - Actually truncate truncated responses- Update to 4.1.4 - Improvements * #6590: Fix warnings reported by gcc 8.1.0. * #6632, #6844, #6842, #6848: Make the gmysql backend future-proof * #6685, #6686: Initialize some missed qtypes. - Bug Fixes * #6780: Avoid concurrent records/comments iteration from running out of sync. * #6816: Fix a crash in the API when adding records. * #4457, #6691: pdns_control notify: handle slave without renotify properly. * #6736, #6738: Reset the TSIG state between queries. * #6857: Remove SOA-check backoff on incoming notify and fix lock handling. * #6858: Fix an issue where updating a record via DNS-UPDATE in a child zone that also exists in the parent zone, we would incorrectly apply the update to the parent zone. * #6676, #6677: Geoipbackend: check geoip_id_by_addr_gl and geoip_id_by_addr_v6_gl return value. (Aki Tuomi)- Use HTTPS links in .spec file like mentioned in PowerDNS announcements - removed obsolete 6370.patch - Update to 4.1.3 - Improvements * #6239, #6559: pdnsutil: use new domain in b2bmigrate (Aki Tuomi) * #6130: Update copyright years to 2018 (Matt Nordhoff) * #6312, #6545: Lower ‘packet too short’ loglevel - Bug Fixes * #6441, #6614: Restrict creation of OPT and TSIG RRsets * #6228, #6370: Fix handling of user-defined axfr filters return values * #6584, #6585, #6608: Prevent the GeoIP backend from copying NetMaskTrees around, fixes slow-downs in certain configurations (Aki Tuomi) * #6654, #6659: Ensure alias answers over TCP have correct name- Update to 4.1.2 - Improvements * API: increase serial after dnssec related updates * Auth: lower ‘packet too short’ loglevel * Make check-zone error on rows that have content but shouldn’t * Auth: avoid an isane amount of new backend connections during an axfr * Report unparseable data in stoul invalid_argument exception * Backport: recheck serial when axfr is done * Backport: add tcp support for alias - Bug Fixes * Auth: allocate new statements after reconnecting to postgresql * Auth-bindbackend: only compare ips in ismaster() (Kees Monshouwer) * Rather than crash, sheepishly report no file/linenum * Document undocumented config vars * Backport #6276 (auth 4.1.x): prevent cname + other data with dnsupdate - misc * Move includes around to avoid boost L conflict * Backport: update edns option code list * Auth: link dnspcap2protobuf against librt when needed * Fix a warning on botan >= 2.5.0 * Auth 4.1.x: unbreak build * Dnsreplay: bail out on a too small outgoing buffer (CVE-2018-1046 bsc#1092540)- add patch for upstream issue #6228 https://patch-diff.githubusercontent.com/raw/PowerDNS/pdns/pull/6370.patch- geoip not available on SLE15 but protobuf support is available.- Update to version 4.1.1: bug-fix only release, with fixes to the LDAP and MySQL backends, the pdnsutil tool, and PDNS internals- Update to version 4.1.0: + Recursor passthrough removal. Migration plans for users of recursor passthrough are in documentation and available at, https://doc.powerdns.com/authoritative/guides/recursion.html + Improved performance: 4x speedup in some scenarios + Crypto API: DNSSEC fully configurable via RESTful API + Database: enhanced reconnection logic solving problems associated with idle disonnection from database servers. + Documentation improvements + Support for TCP Fast Open + Removed deprecated SOA-EDIT values: INCEPTION and INCEPTION-WEEK - pkgconfig(krb5) is now always required for building LDAP backend - pdns-4.0.4_mysql-schema-mariadb.patch: removed, upstreamed- package schema files in ldap subpackage- Update to version 4.0.5: + fixes CVE-2017-15091: Missing check on API operations + Bindbackend: do not corrupt data supplied by other backends in getAllDomains + For create-slave-zone, actually add all slaves, and not only first n times + Check return value for all getTSIGKey calls. + Publish inactive KSK/CSK as CDNSKEY/CDS + Treat requestor’s payload size lower than 512 as equal to 512 + Correctly purge entries from the caches after a transfer + LuaWrapper: Allow embedded NULs in strings received from Lua + Stubresolver: Use only recursor setting if given + mydnsbackend: Add getAllDomains + LuaJIT 2.1: Lua fallback functionality no longer uses Lua namespace + gpgsql: make statement names actually unique + API: prevent sending nameservers list and zone-level NS in rrsets- Ensure descriptions are neutral. Remove ineffective --with-pic. - Do not ignore errors from useradd. - Trim idempotent %if..%endif around %package.- Added pdns.keyring linked from https://dnsdist.org/install.html- Don't BuildRequire Botan 1.x which will be dropped (bsc#1055322) * upstream support for Botan was dropped in favor of OpenSSL, see https://blog.powerdns.com/2016/07/11/powerdns-authoritative-server-4-0-0-released- This makes the schema fit storage requirements of various mysql/mariadb versions. pdns-4.0.4_mysql-schema-mariadb.patch - preset uid and gid in configuration- fixed use of pdns_protobuf- update to 4.0.4 - fixes ed25519 signer. This signer hashed the message before signing, resulting in unverifiable signatures. - send a notification to all slave servers after every dnsupdate for complete list of changes, see https://blog.powerdns.com/2017/06/23/powerdns-authoritative-server-4-0-4-released/- added pdns-4.0.3_allow_dacoverride_in_capset.patch: Adding CAP_DAC_OVERRIDE to fix startup problems with sqlite3 backend- use individual libboost-*-devel packages instead of boost-devel- update to 4.0.3 which obsoletes b854d9f.diff- b854d9f.diff: revert upstream change that caused a regression with multiple-backends- update to 4.0.2: The following security issues were fixed: - 2016-02: Crafted queries can cause abnormal CPU usage (CVE-2016-7068, boo#1018326) - 2016-03: Denial of service via the web server (CVE-2016-7072, boo#1018327) - 2016-04: Insufficient validation of TSIG signatures (CVE-2016-7073, CVE-2016-7074, boo#1018328) - 2016-05: Crafted zone record can cause a denial of service (CVE-2016-2120, boo#1018329) For complete changelog, see https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-402- BuildRequire pkgconfig(libsystemd) instead of pkgconfig(libsystemd-daemon): these libs were merged in systemd 209 times. The build system is capable of finding either one.- update to 4.0.1 Bug fixes - #4126 Wait for the connection to the carbon server to be established - #4206 Don't try to deallocate empty PG statements - #4245 Send the correct response when queried for an NSEC directly (Kees Monshouwer) - #4252 Don't include bind files if length <= 2 or > sizeof(filename) - #4255 Catch runtime_error when parsing a broken MNAME Improvements - #4044 Make DNSPacket return a ComboAddress for local and remote (Aki Tuomi) - #4056 OpenSSL 1.1.0 support (Christian Hofstaedtler) - #4169 Fix typos in a logmessage and exception (Christian Hofsteadtler) - #4183 pdnsutil: Remove checking of ctime and always diff the changes (Hannu Ylitalo) - #4192 dnsreplay: Only add Client Subnet stamp when asked - #4250 Use toLogString() for ringAccount (Kees Monshouwer) Additions - #4133 Add limits to the size of received {A,I}XFR (CVE-2016-6172) - #4142 Add used filedescriptor statistic (Kees Monshouwer)- update to 4.0.0 https://blog.powerdns.com/2016/07/11/powerdns-authoritative-server-4-0-0-released/ https://blog.powerdns.com/2016/07/11/welcome-to-powerdns-4-0-0/ - packaging changes: - remotebackend split out now - enabled experimental_gss_tsig support - enabled protobuf based stats support - no more xdb and lmdb backend - added odbc backend where supported - drop pdns-3.4.0-no_date_time.patch: replaced with - -enable-reproducible- update to 3.4.9 * use OpenSSL for ECDSA signing where available * allow common signing key * Add a disable-syslog setting * fix SOA caching with multiple backends * whitespace-related zone parsing fixes [ticket #3568] * bindbackend: fix, set domain in list()- update to 3.4.8 * Use AC_SEARCH_LIBS (Ruben Kerkhof) * Check for inet_aton in libresolv (Ruben Kerkhof) * Remove hardcoded -lresolv, -lnsl and -lsocket (Ruben Kerkhof) * pdnssec: don't check disabled records (Pieter Lexis) * pdnssec: check all records (including disabled ones) only in verbose mode (Kees Monshouwer) * traling dot in DNAME content (Kees Monshouwer) * Fix luabackend compilation on FreeBSD i386 (RvdE) * silence g++ 6.0 warnings and error (Kees Monshouwer) * add gcc 5.3 and 6.0 support to boost.m4 (Kees Monshouwer)- update to 3.4.7 Bug fixes: * Ignore invalid/empty TKEY and TSIG records (Christian Hofstaedtler) * Don't reply to truncated queries (Christian Hofstaedtler) * don't log out-of-zone ents during AXFR in (Kees Monshouwer) * Prevent XSS by escaping user input. Thanks to Pierre Jaury and Damien Cauquil at Sysdream for pointing this out. * Handle NULL and boolean properly in gPGSql (Aki Tuomi) * Improve negative caching (Kees Monshouwer) * Do not divide timeout twice (Aki Tuomi) * Correctly sort records with a priority. Improvements: * Direct query answers and correct zone-rectification in the GeoIP backend (Aki Tuomi) * Use token names to identify PKCS#11 keys (Aki Tuomi) * Fix typo in an error message (Arjen Zonneveld) * limit NSEC3 iterations in bindbackend (Kees Monshouwer) * Initialize minbody (Aki Tuomi) New features: * OPENPGPKEY record-type (James Cloos and Kees Monshouwer) * add global soa-edit settings (Kees Monshouwer)- update to 3.4.6 [boo#943078] CVE-2015-5230 Bug fixes: * Avoid superfluous backend recycling * Removal of dnsdist from the authoritative server distribution * Add EDNS unknown version handling and tests EDNS unknown version handling Improvements: * Update YaHTTP to v0.1.7 * Make trailing/leading spaces stand out in pdnssec check_zone * GCC 5.2 support and sync boost.m4 macro with upstream * Log answer packets only if log-dns-details is enabled- update to 3.4.5 Bug fixes: * be careful reading empty lines in our config parser and prevent integer overflow. * prevent crash after --list-modules (Ruben Kerkhof) * Limit the maximum length of a qname Improvements: * Support /etc/default for our debian/ubuntu packages (Aki Tuomi) * Our Boost check doesn't recognize gcc 5.1 yet (Ruben Kerkhof) * Various PKCS#11 fixes and improvements (Aki Tuomi) * Several fixes for building on OpenBSD (Florian Obser) * Fix several issues found by Coverity (Aki Tuomi) * Look for mbedtls before polarssl (Ruben Kerkhof) * Detect Lua on OpenBSD (Ruben Kerkhof) * Let pkg-config determine botan dependency libs (Ruben Kerkhof) * kill some further mallocs and add note to remind us not to add them back * Move remotebackend-unix test socket to testsdir (Aki Tuomi) * Defer launch of coprocess until first question (Aki Tuomi) * pdnssec: check for glue and delegations in parent zones (Kees Monshouwer)- no longer ship dnsdist here, we will ship a new package based on the snapshots from http://dnsdist.org/- update to 3.4.4 with a fix for CVE-2015-1868 (boo# 927569) Bug fixes: - commit ac3ae09: fix rectify-(all)-zones for mixed case domain names - commit 2dea55e, commit 032d565, commit 55f2dbf: fix CVE-2015-1868 - commit 21cdbe5: Blocking IO in busy-wait for remote backend (Wieger Opmeer) - commit cc7b2ac: fix double dot for root MX/SRV in bind slave zone files (Kees Monshouwer) - commit c40307b: Properly lock lmdb database, fixes ticket #1954 (Aki Tuomi) - commit 662e76d: Fix segfault in zone2lmdb (Ruben Kerkhof) New Features: - commit 5ae212e: pdnssec: warn for insecure wildcards in opt-out zones - commits cd3f21c, 8b582f6, 0b7e766, f743af9, dcde3c8 and f12fcf7: TKEY record type (Aki Tuomi) - commits 0fda1d9, 3dd139d, ba146ce, 25109e2, c011a01, 0600350, fc96b5e, 4414468, c163d41, f52c7f6, 8d56a31, 7821417, ea62bd9, c5ababd, 91c8351 and 073ac49: Many PKCS#11 improvements (Aki Tuomi) - commits 6f0d4f1 and 5eb33cb: Introduce xfrBlobNoSpaces and use them for TSIG (Aki Tuomi) Improvements: - commit e4f48ab: allow "pdnssec set-nsec3 ZONE" for insecure zones; this saves on one rectify when securing a NSEC3 zone - commits cce95b9, e2e9243 and e82da97: Improvements to the config-file parsing (Aki Tuomi) - commit 2180e21: postgresql check should not touch LDFLAGS (Ruben Kerkhof) - commit 0481021: Log error when remote cannot do AXFR (Aki Tuomi) - commit 1ecc3a5: Speed improvements when AXFR is disabled (Christian Hofstaedtler) - commits 1f7334e and b17799a: NSEC3 and related RRSIGS are not part of the dnstree (Kees Monshouwer) - commits dd943dd and 58c4834: Change ifdef to check for __GLIBC__ instead of __linux__ to prevent errors with other libc's (James Taylor) - commit c929d50: Try to raise open files before dropping privileges (Aki Tuomi) - commit 69fd3dc: Add newline to carbon error message on auth (Aki Tuomi) - commit 3064f80: Make sure we send servfail on error (Aki Tuomi) - commit b004529: Ship lmdb-example.pl in tarball (Ruben Kerkhof) - commit 9e6b24f: Allocate TCP buffer dynamically, decreasing stack usage - commit 267fdde: throw if getSOA gets non-SOA record- update to 3.4.3 Bug fixes: - [commit ceb49ce] pdns_control: exit 1 on unknown command (Ruben Kerkhof) - [commit 1406891]: evaluate KSK ZSK pairs per algorithm (Kees Monshouwer) - [commit 3ca050f]: always set di.notified_serial in getAllDomains (Kees Monshouwer) - [commit d9d09e1]: pdns_control: don't open socket in /tmp (Ruben Kerkhof) New features: - [commit 2f67952]: Limit who can send us AXFR notify queries (Ruben Kerkhof) Improvements: - [commit d7bec64]: respond REFUSED instead of NOERROR for "unknown zone" situations - [commit ebeb9d7]: Check for Lua 5.3 (Ruben Kerkhof) - [commit d09931d]: Check compiler for relro support instead of linker (Ruben Kerkhof) - [commit c4b0d0c]: Replace PacketHandler with UeberBackend where possible (Christian Hofstaedtler) - [commit 5a85152]: PacketHandler: Share UeberBackend with DNSSECKeeper (Christian Hofstaedtler) - [commit 97bd444]: fix building with GCC 5 Experimental API changes (Christian Hofstaedtler): - [commit ca44706]: API: move shared DomainInfo reader into it's own function - [commit 102602f]: API: allow writing to domains.account field - [commit d82f632]: API: read and expose domain account field - [commit 2b06977]: API: be more strict when parsing record contents - [commit 2f72b7c]: API: Reject unknown types (TYPE0) - [commit d82f632]: API: read and expose domain account field- set $LD for now. this fixes the configure check for relro,now.- remove custom PIE handling. upstream does it for us now.- update to 3.4.2 This is a performance and bugfix update to 3.4.1 and any earlier version. For high traffic setups, including those using DNSSEC, upgrading to 3.4.2 may show tremendous performance increases. A list of changes since 3.4.1 follows. Please see the full clickable changelog at https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-342 - move man pages to section 1 to follow upstream change- disable botan and geoip on SLE_12 because of missing dependencies.- Fixed broken _localstatedir- fix bashisms in pre script- update to version 3.4.1 Changes since 3.4.0: * commit dcd6524, commit a8750a5, commit 7dc86bf, commit 2fda71f: PowerDNS now polls the security status of a release at startup and periodically. More detail on this feature, and how to turn it off, can be found in Section 2, “Security polling”. * commit 5fe6dc0: API: Replace HTTP Basic auth with static key in custom header (X-API-Key) * commit 4a95ab4: Use transaction for pdnssec increase-serial * commit 6e82a23: Don't empty ordername during pdnssec increase-serial * commit 535f4e3: honor SOA-EDIT while considering "empty IXFR" fallback, fixes ticket 1835. This fixes slaving of signed zones to IXFR-aware slaves like NSD or BIND.- only enable geoip backend on distros newer than 12.3 before the package lacks the pkg-config file and there is no fallback to finding geoip without it.- fix permissions of the home directory- enable some backends that we had forgotten: - pipe (main package) - random (main package) - geoip (new subpackage) - new BR: yaml-cpp-devel and GeoIP-develobs-arm-9 16008691834.1.8-lp151.2.9.14.1.8-lp151.2.9.1libremotebackend.so/usr/lib64/pdns/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:13121/openSUSE_Leap_15.1_Update_ports/09357eebd4b440097887cd3db35b8206-pdns.openSUSE_Leap_15.1_Updatedrpmxz5aarch64-suse-linuxELF 64-bit LSB shared object, ARM aarch64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=3110c2677a5d91cabda9433c74e7e12e6d98cdda, strippedPRRRR R RRRR R R RRRRRs ]C%Zutf-8b99a547b923027876db4804206796fff2c785a5783a929d2194c420487f560ce? 7zXZ !t/_L]"k%y60E<$#]CY_2IJGrX]0N'QPdO^z 謊hHbx9'93اqiƼ\A A[[<)gtk(ir fTƨ!U6+D!efH hǹꙴb4Ժ}7? ہ_Y,ު;nO;#L[z)nWBt/Hbi[" Zp]Oo"n^91,ر4Z[G'wq2'zGxѣQ:n=DhӎR~ 3+Y" |̷Ά!eAC&b344wЁGe%y1Zem앗HAќM+c4^l͔y>1)۟jiMJ0jV"E[cNWqȷ <*_QM2&=:^]kDý`gPлo1-7&Qڀĺ&l$"NnW +mV礤A 'Êc`EJ;co$ݮM70,b[OX7PK*!R 7IFhÝ^BR-Iv;p69탐 .x UE}g. B(D > _ChN?DL~ KRK .g֋nmCh~{2l<}O}/8؊0Okr+U3ms*w3[wwruaWƈquѼ~?Tt ˓˛~ߛ_ T7E2јw\PPC+*NYqǽx %w5NBC'͛r$ȁ M <4xJߐrĊj[vH:nRJUb24`PH1oNÏO!Mx۬q }Q72440p"WFQ㹖P}܆eWW8Ø&u'{ .\YSdhNt)iV-ZGjtJ*r!BTZ? JA(X3.V;[D\gP*[2J0O-І-K+}z>I|w"]vu}E` ݝJG,qVoo=laq,BĐp LGy %xfT*y^}8qԼ?SȻ_+ARےPmq'`$3]|_U޷>)gbMqz e][RVumLF)C8\(ŁEQHF`6- *~xkZwO3 ͊aKTKj- QΈ}5r\}y>nي+נÎc4i*O X2Tugzjd%fN$IaAN$ʸ#mnLԤk$ubˇ:T_Lq$5_:f]Y>J 􌹦}"I}r` |1Kಠ:3(80FҦ/; ܅ 1[+r&?UH!J0K_D/yx^bUrɟ? ɲ@l4~ZhXt`rbNA%ҝ316..բLAMw/Oڥm(dK HcAz/8SM,_m!"3pQ^B0"ϵ]9bHD02 %t v¨T{JzDY{tU%zeאi܉16q10iӭj>{E}7[p6k5MS֖<{Y\e D^ M|99\?x p(@14c55Hᫌ0Mۯjw\[ =JɕGŌkYLі<yf /xaqfW.6Ľ.X$ [JŢO1X)ɸ71h`a|_}H_Qc둅TxV嶃2tr.Û H瀻 6 F8 =wgX~fixRKFVsAAcۀ9ymw"_'(%Z*y_T˹u2ԘƤt7r1[xur}hN$_h*μCk2EڛwJK#{-χ.uψLX1O"W}C_}z0P;t_>q28p#3\qn "X_AoIc76F'Lᣧq9Tf==Oi5ϓGNgߤHBP*V=&ų͍=PʫIS ^3 UhUPE? YGÅ*s|!03=8[lк݁nQ*\O5g,;@D99^\%hZN["Aо~f|wgipTS-_S#( `6uIg.k e_ZȐFH\U҂G%{^^RCYr`ׅa)63 f`C ppw<Goܣ6 uee"nAn[ Ud=`O4U)nRբ?|d S+.6=&onG,/746$nӤ7܀թ@DK8G*uס}͌np݋,I] r׽4 G [ne}G?Kp_Oto}ڗ$ϧ U v5)3rl=Og`̈kPq"wnJqT x1_#2vNL -SƪZˎPח*]IIA30cbȝ@b= \w$Rr1$v7eֻiߡ;IH+vZG&cqI4=Eγefb%q7dKFQ> Us+w{`Dpfc*>k j<C :Ԃ}^6.Vg&ڞyJ|DK @-UE.˻SL*N-E_>1VD RV " q !&A+ [RZog Ĉ х{I^[rd` K B\F^rlp=Xx-hm.:+ \/=VGbIƉУ{јQgu2l-O payܯ.UwX4oLn[x Gv@!lHz2 gvnMo\'nBG%!P6)Հ4Aꍳ_zL' Z0i:жlAls]y_c [$I ɒ-h6@ؠ5/d鉍gP_yŗ~P3D,x\IѰõ󮤅rL_}̫˱!.bvEZhƘswM/8p'{+pa踗zQ7x{ua7:yJ6\($; g`h+``JW6uc@!F [`3LjˑQ|b ɾjnL0N:LP#8}\WG{ɒ<"{ %WakM=o(W ]rQQfˈOhey[2 Uc*e^aO &Q-B0 Qْ~(oX:XMB7|BJaLa(=J[0j삔28l)+Yw@ =d\eȘ0Z>d:z?|6' Ät("z!u,>NH,4A'DVxA<_@4"U:}y3z\|s[c@} r9CV@T=HL"?k#@]E*dO&ʞ"W}.tʹ*gPйL>F! Fe1VɝCܕn$ `x]ӤˍL C^*gWFQu Q4 ~,PǨ]3ǕZEQaCp^cɾTJl~~"N^ _ꩴvJniy  Yj(&)nw[hJe~O/sK p A )~9 LBCҹm;yyuK;ɆViV4noRܦB0љ(9s@Վd @Ҧ;\R<TBSZ:;*9Uos}QQh! )*WT,B_핫K"< +&=Q{gL* Qd^#a3hLuJ0Z봫|9S(͚<<\f}V$oF!]Hyٻ?e%lWPx3rȿJN:1bYuwZ;/PɨF+=E#u?Z 餎WýdUo"1BӨ.?ZF- WdrZ}xpv|?GQWb:ٵaM[cFa%e\8󒦋m*%VVk blA,lJykeNin\0zQ2yχbW45NJ)_*ɤnhƦjQ#t1pTD|Dj!7pLă^eW٘g,\>~"r1/+l`!K o v+M3tEbxh!KUndl%ME7cXW2r }IQX]!d?ٶf.4Bե×62Ah[qZt+t~$*(Z玛/gK vmK0?'ۙc"Wf/'@L)o^c7>:36M!0DL}TU ){W.d;jx% صwE~mS{ZX_@gvxDG|,dvSo1T%JGDuJ+D b31g<) K*DDno a ze\ WX/^ 'fc4>Oj![e]V>R"\D>sM0.bEOU ٞ#'V1i_ % ³a4y g R+a2޽]wSSXz9jZi=$O6?aGR'‘:Mu &*EW&Ī6ZSҩbҕA:}/ഄ8[*FR$-^bdh޿r ;N*߮63:9bXV J>U)Az|qM9^0Y_8%K+%jju_mBBo@řF Lo%5iv$7az6Rr.P;=ߋqK;)"Hmں^WKw$\$Zij1~= E_9h5ۊheNi*'u(thk& BΫ[y5ӊ{SNRJbO=NPOU_#(Tq _nh;sS(&7ظf"jeAHh,NHݪ^LKYM"j#p}Jt9:ɡΏ[q;b ėZ `w@_n"}zhpQ`#q OS3+],-Edf˱u0 Rq-M9RaZ(%n[g%4@2Cb-K1B8;N7*D [2?P Db)gfn¸ԉ!4b@YvUѨۋɞ{L6Mhxd .}54k]E%c_n$"xN9I%)=I i4n G ] ڝxC4OY!k ˖Kƻk?!am Y1\+P-|_㨊v>qD>.lBGIC| +4"uFRqE 4N. .4+uA> ۄ,hYp%:`ZvjWq!thh:ѻJf6_@ b9_'3[6Dޝj]G.n!ZㆿTn۵{٢x\hta  ;@vYf1=w3LQK@93A!b?{6lkC[mwSBآksFIi z0l` bgФ<]P B(Xly31RQy+TR纫.X`aÄ~?[)+༨ffNfɩ ?+U˅_"[GFkwsLuqAߌ ,Q)bNg*oM8q8QH^Q0Z@>SY-vv5:>c^1{2+sXwIJ_Dӊh±7^cj1>JW݌$3mwNUj݋ᒛW $!dhkˌKPt)4]:y>{g[ρԑNpi2!Q\S3+ھgv|;+YsRe+h&tc-03wkwBwok,˲l6T5#|p׉[,02IIyF|ٌ2ik<4Tp*¢p c0yByWCL[p,L/uhCeSZY}n>|$#4*|cJ/Lpx>i;s^I{ˁhGKEr9ZL3М(2ѥH !jwċZ|\ʡ|lo(.,4s3^py\b?}U/{L.cq8]A]\e4xqsJ,Օ#$9~n"I .)MP-Ϛ]Yf߂uVqrPҬ&ߓ/$,Ed"OߋhzBowRZZqL4Vs Uix0I4oԒpbI>蘒&&v火1-*>?jL9s4,R>Ctl\'pC]f{}- /dw: rn$ ޗ34 ry0)ڽZZYů.(/`TE|W$~HY'Ék\#. R)_#/s{pv7aPZ%.C7gotq:K ޓZ9 s|zε9u[E$ls^ɺ|KGd[|mRPnY orO J`isG3ޥ `6G]PyngvERX24=y kT|9q jrx} r?,X&cJhQW)3 Wn$wu$fK_zg|8'[ ̼ي0~Q;9-WG4.s{ 6 mW+yn^S6K5^K͌24WmeLaQ3A9bBKY_4{x~@M̢s&e¾a.!s>՜5 d-IFKژH>J)@{pRf^#O֖Nk6"Pq4L2˜LYapb2Mj(H&gw2T,Q3!F>N6tQNW2Ŭw䣂~_f|_+MBf!莇}yƾ{k\3ؓ3?(*Wn5KS9ဳI9 R\A@c[y]Ouz'> q0&'~n\ݣJ⍡fꠠg LmO1ƴq2M`g#FY)j~"0bS2ĀH4 Y5ǧzِ[໶L]gfKX)Bb& _u#s Bޘb^ 䪿Q}̌x*riV)lV9iA}͡#%o ԛ^D)+ 1|9ypYي_$r,2absrh;C*Lz :{@HMI`#3瘑E "Lٷ]De4~VIgςL~yi9͇NN# !U;R' L;e zx.PMONGW!à2v9%Er!Ä%A=as262] ~lJ'ѷg\ t  Ӆ2 pP`O8.#Kqç\LgwP*gk/vexpG\(@ݶmoKúK0$9%[1y0qSG3$^5ChlI2[+ V7 j h]!@^dePc3S^^vMeT8nhL5\8|D#+&ʍۻ蚴'`cKEeΤ ZlZ 2[#r.թW\%iK6z_;F0Sx>`ǘ;?1u̲v9OҺM|EQaq6@AJx񄠥a03i@3ayI?v#e1}ocl|6 *2۩ju(?"/tϣr?)~Y!3uGS( %ݽ B/=wpxټe˲LyANAy~A /0qQ-7˛*sTE%δW="~O iF?4cERL_ Y u4"inH}JNrxS5ZqD|#W轲UiAf0m7*Y`:Η؎AsjZT+% 7ƽO>*"vzŰSl'yDIOn^ Ġ dbRMx9\n!5*naٺBŬk&E,Flsd]vT= 2 9u$[Asn/p;:H+;7~4+iYL8_,o<*"KɇHK)nѵj:5}ް%+|\F)Tg!CXpݷP6{|R{o`l>yG`}M(ؕ@ຉ>xe]&C^Χ $KgvP аί1ICle~ZL}XVר`+ *~*Lf%GJ4| DsdY. Ӭ~]x &x~XY#2\g̿͝t,EDp{QR~.Ta9-"G|hEY4Y]asOU v3JD ӤrF:uv%9qM+P8DwZp13*'ǍͨmF8~)wl|Qы[=79@|vy<=x #}#s6roEryd*~ #M{iؒ_8]~ VT?>p$~l$}}_l:9W.!KsaEGAev؎|VX2Ëx Hq†ɉ6IAh0"gxMU% <߇m_X{?J\W  E&pPBp 5b}ŕ#B,ڏ7#0迢ھx3eb[IU X>qf(7In(TXO=Vu<ܺL2 ߆/y{ q56Ļ+> e.;B8z? ,e}o;g{e}|*׻He'N1Lfo=U'PgN9{)pl}ׂt6r&])YLbQ )sB{Xt"q)7$+ڶ`d(%=B)5uH Buic|,8ɫ|r7ESs(Yx[I$nȸZTe@eA(\p ƼP|KªS[8Т*IxXCXbs4mOq0"O~ԶTG=;>!J$ǚ`N(T$ra&͜#T.isH bS,p93 _s.t))@$мQ(}-70#k-TؙAe| A&5`8ECEd".`핱t7{UhMDRyiz?= 5we""`W9P$R30j8$#n'R A٤MCV;$)@4iAm f?jG+j`^G:ïB Fj]1=-{ AB#Me#˙̤GQ fdEYAo0ĔӦ_S 3xYqQyJq"{V.Ɇ=}!XF+T6"Ώ^fq' Y崊2pxs"W=ꅅ>#9/-N-e&(iļd99:Z6IJ‹':r,:7阠##(J@@DVfW縏 * r8SNaig (.2`D_t҈s~Kv(8KT9xtrPL% !ޞd~ 1sbܴ؏j -1KC]Eǘ`U!I3A'%vҨhNQz~>ehY ¨\A*u|Hcm fMf%x]5~u* 3j%uA|-KӪ1<{.OiuA87€)"訵J}CZ &xg{)tsK.h]nI#>ZC|Z!_|&RGyK8|6vSWT{h8L*2mE}[=!]h䣞ut{YE2$i2q޳v8;ߴ!t+!8 't24A{T%da_cC1clT+} FpHH\|ˀt]/JBlԾo8jm>#Pg[֠``͈">A9h!2VshI}ƓE#UռשQ:n[s1 7䕲~< F+EYx:}|H7>>(_?r' g{2EҢ]ֲ~=?[% vq!* )i-™d_:njn{W09(Ǡp %atC^-`vU*stKݏ6h@||?I4q-m4X]fy mA~xHQ1ir$b~꬟>vbUp^ ߡJ/U\F_iߦ~EQ-8Wv82Gkt \>T(OUPIp]p*oyUGµx*!b" ]Z8u[Ah uv14j Iv!.8rͧВݓwjilݔoάwihR Cnj u^OLx'`t@D8-Q A. <ڴjdT9p  tKe܇j6cAB)6Bk! %A2]4MKpՙ<6 RFڒ}4Jq"dY[Zީ S5ax8]m Ntbd3)XlD3gLT|%e38YVFzwxv_Avݻ.& *b+ްm+;"O>)HN2mQZq\Ͻ!ɰ #&)i N 8@!xTY&x;}}::鉌NR!mo :Imj÷)V3[;MB^;߶BOiZ.5GdM QZiuX=y'Nz4U׻- rK`0é`x {{hL~vQ|6]`i'D)0\YiG}"SP L_7u y o*d6Xo!A} T3O SJ"Vo,z/7;M(Rh&kyk,-MaYa^X˕5EBKt$|b/W`<$BVk+vбǕ+ce(վQ_ &¡.*[JdGV7r'pJH}߫C $xifngH@ ֐^f|8> Z8a?03|7H[T})/لvLl?7IJ*}KV$&ꭆ pRJoh+*.֔ə/R5БM~HgAh>Hܬbl|oơ~E:o u`ҩvNjpJRW+TGFqiaj& 5z3O@A#[bDZeJEB G>K]i/: z>HzX_͏(/S*LCB-4e^`B /F c$7-rt"*eT9oiVh:s="cF .[ ó(;VxW  ߢ:clvo#J JX*RuC̫8, uv Iח;F- Ѭa