wpa_supplicant-gui-2.10-150600.7.3.1<>,n\fp9|ՙN?aIk֩"6!@6C'sG6B:Fy9XC?R9HA>@xR{-GUun\0*>Dܰc-k>o'l||ۘU7^,P +Pm cٮkZf\ QT)I%k!&)hh3v}f=e'>?d ' J , BNkq|      *4`ht(8*9T*: *FGHIXY\ ](^=b]cdefluvwxyz8HLRCwpa_supplicant-gui2.10150600.7.3.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.fh02-armsrv1 SUSE Linux Enterprise 15SUSE LLC BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxaarch64 큤ffd0bc3642a63d3175bdc57c59ed292ac370916851027116f486085f19fdeabf59d57783ead2cca37539bf8b5c4a81b8105c2970de177652fe1a027433593467aarootrootrootrootwpa_supplicant-2.10-150600.7.3.1.src.rpmwpa_supplicant-guiwpa_supplicant-gui(aarch-64)@@@@@@@@@@@@@@@@@@    ld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.3e}@c@b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run)- update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)h02-armsrv1 17267463352.10-150600.7.3.12.10-150600.7.3.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:35766/SUSE_SLE-15-SP6_Update/1481ab215a0b1830ea80ceb6538f4766-wpa_supplicant.SUSE_SLE-15-SP6_Updatedrpmxz5aarch64-suse-linuxELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=16b099ec7acbe82d8d20ab702f005903908fd91c, for GNU/Linux 3.7.0, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)RR RR R R RRRRRRRRRR RRe rutf-81d05bd42a3d7022360e39a920c38f107273d85758274f55dd9cd0c88b6ebe5c6? 7zXZ !t/@i]"k%}RUJzx+P]8\R>~v)z!&~u~H0/:;nVbJ)Ku[l9㟶|_'z %,H)4mķo ^* o$ e\Ѱ eJd`|45&/bmM,:U)#]n!?BXdhܬC ;4:Իq*4ρ#3+`l{7hUcQ+ܷFdbV1"~O_dӿ\ $D: ~$w_Bh&,v"ca%dztbFr"WC.Qv@p1Q}XQ΋Ȩ:DVR 7mfrSٷBn#l7st.d #ˀFm+֟+_z),>&@R~Te'_Ju:2Py0qz^(kLH-Bƙ#:Eb3JXWs~sF yޖϛGem|QY|ngDF++,\ȳ\4*Y6bĦ}`{r_~;gVB@/2z[g'B94+|viʹ:*I0S,?0@,1r"EJ{xbΧfH +Ej3jgBMєR,NLƖheMI-չ?/(FM량$!5韰bQ n(QeY1qkB1p-3?#?fΙ`ݍ]4WqQY]bS",za鱸k8 T욚S@Q,tp;.пΥ3lH,3+!y1}9G<+$&n9W:-[ȱAJ|nV›WsZ†C߽N%N3sD5I3` kеc9"=p'!C9C")梷y6gm\YbFJW4UTA¸R1^" kPPPkV'N'd>l>1s'ck*lkF%M&4qMr6S"w `z' u8](Kͳ]=)EƓ4 5gTGv5tĈ@_kT?qVMpozu)OlyP2J\M'sRc$7s.djW\ v*퐿 Db1=BQ5[[9O * a_֒|7qiȴ۾VPgztl aʩ<{k@9H\3ِNl+d''uFLڹ)Ӥ7] ӧg4;:Z^g)< Ha9:2ҎXC_ !َȯ'7Kv5pCc_(:j!Y5G9֫XǶ$S^Om:V*;9wd`Yy#._~F M$%Dޅͤf4]j,f4BtyhXϧQ sL{&Z:lƧ` uI-uaIj~_a{s)Z;ЇȍPK6dΚkmwhvŦ'noӫAaə%#-Ue=$:jR'Z|KB͗y͊H- 7Bk!Id:_Sw7]=V)_XJ4LӺRc̤ 8Ns';c( lH?kBteA>Ƹ]= :\OudELBaP%o$/Q3STdڌbqQ0'N[ oLb+!6{N Mcu*U6-N@*Oa]D혋!skOHȣ_Ȑ^!"POoԒ]uֽϣS:n aPs"@i &l}'Tl"F_*rz;^[N h)0Փn m#r|Ffq8FγEh"*dFKwxGasÇgo(eSے|c,aT2Bg{OKO2>yQKBVaqe|A q@^HH;w&FfedwKԥ&I8YNGgh dLHҴ)TtTe] PG~dV|X-AK]NU}s`TAU7z`(pYG縞%J:3|:B@8Jv脍]/rnLwdJ#0N-kᅪSOR?$.;*+F ~\@̳v̼ZpFz?LHR|@齔m_1X];tb?Se'aEoI_%ؐ{4^-)̎ )E@f,qAmSS'yEF޿ ,(|}e%m|Xԉ*8ؓ9sOJ1l< 5\m۟U5h a# )XN/wARS5g,HX+M*\2yc0W` }N*͈.!",JܭKf8&贷`; ¿/V7G!#MW9˒m.~84׋~)\ZPreEe<׳Ϯ:^T)V5.hkAqɽ`wSHO'CǑ7Mc g13eFz;j~hQ{ < ]2A>~g| / v!6O{0}ӢvhPNU?VAʒ:@ zBBeJmQ7V>T` u`Ůֹu d 4}2jE(^vt) "hfkfcW?lP9]E%B`A9kVӣѧPͩz[o|˟ʎh\0@5x`B8cj0*f=Pmڲ謁<7`T[j8~M.FιK<rep-PxݑnOlZ.sY%p޾ w HMpY3X-+UEaZX-`̣򣎘?;K%ύ`!~> r_T zWѭmsj dmη<8A&]~g϶Pp0u%wY]ܺ;6f&Ol aPА+scNm`zrSar^EuN 9LDm_ԙB"]U7EцTL:N.D#3kGcUxOM4, 5^g/VvT۪}DI tPAV 7p mLTBAjK]@@\0 +hYV6u/rqQQz%)bQI#$㾴OmvhV&x--)h8OW OnWD9N]6V0&׾%6݂pyJ;AESw~m& uY?:P'rkdv,<[ĴGZk t0+1t&˞ Ju H#qc(Zߋs>1}MEpAy< <aE?O49<ϤANE {"ܭ$ bĜ % b]VGɘoa}ת^k#wy~[RMنdoPr;vSpCJE5\V f0h o!1EDOE*B wx=lr$.I8b S1P([A7MC^Uyœ:Ӝ1^5іI$0%taOɰ['۳UD@x1DPV%y_1}ebF {ybޱH]/{טR@ CbZs <5ֺߐxxб v9_^;?~J;.6cNNt䥕k mA^6̋-&ڗtW\aĎso@ѿ>`2[f|g:7)¬z.hwrn|O-hI?mcx4XyW8ݒv#AҬYչ%~bÕv9G%T`u\ᛘjCiUʿP5PS\lbt[8@QF8SNEYU!n\/ K2[Ad+RoTuB~Ȁd[PM+{S&L &.jRaxZf}2iػ+/F'shm'w4NӅܲ}i,ytA"Aˢ]mx¯ewy;wKx acD|,8cebW-h);v{幪5@k9[e^kj^}"&11eڱIQKDs#yBV_ B|{KsJ.Iz}\ rÿ4@ ;(yya@.ZDWɻ{]I37r[~dF4"8dn9^y#*ׁ#8\L\aB c :w&W q 6ЉaR^g;le"ba;UQ@@_FH?|>9]wZ` U#bx$5XL.@nQS*JATY~QxL9fuuT>G=xň{)qjkԩ=7ӧJ Ů>豫7>*d'9vE;9_F3R0l&cc7P̭WVSK|s 0OоQ~W^q V醎vPu7iR!IgKlg* IU'4_DK{-&XM;tӡ&O4dh̵`׀} h!vz3-Ժ$J"< CJU؁D)HF=:~K^o7X9 _Io"UCSKG{Ծx>3o %tvٜ,Br87`>ːlɢ>l.a>)d-xzhX؜=鮢M ɈB1R}bolȇXF$уo1WHHM~#a{Y= C3dD̎Nlq< Hf,};z[Π]֗tGH3v wM@8#Sӛh2[NB{TA\25" n xj> 5뢤d4?t}s |P8Tw>3_p1@@xd=D4R&):)ʭ{eNA$6CX6QCZم{ ˕6,c@RqL_5`T`| g8}z,s߲+C,T@G6 i[5-em/˩=YHjou9OӺntq՝KnQx?Ӟ$RRU#Zֳt5t _M$h-T=4A }[Xg8NJ<3nncAO{`٭fcp-?yNť1n"f, GmvwCnUߎYpz?aԦ[5ܣkuKSc- _KLR8G$BЍnavU,tz+^)BW nA3 !$E\PL 1ൡJebOӨsX@..At o3\v3hymͳ0P_8@C,~;á`oJB_ױAX ԙO2i- BQqn\>H Gnez-.Sh{υbihg@t I漏;PKPxnDC>PBx%b ˫:"ҫ6enwόjtM6 r{I{I~P=*N& 6HCf,q=*$;V69/i:KmBRI݌_o̗N ʎ<|F_yrڧ | 8>1/HOI%&>>U Hc3~,_gSs͑"lA=ƒ~2!dHz(#-9O/ ),r+G)@參!V"TԾS넀tkw!GdTiK ÆJpMjzmj)@ ,)MĈU-jSh",$Jfz~]"&ͼn~9:n|4ҷrlHf)i69)4AUOm: I^Qo} P+ mGG饵%3єz +)S*e[lQEhZ:Dx jil;׿n#Hj{\c!wqSU`N˝FVSbaޜhtipFF%Uke&~=8'|͠4.You=Sދd P QkCT6x`_1S7qrMzyхjYq;Sp!#kq֯i%#iЈe[ +QW:S;Xb_NƙdC/ B/8D h1_,I.7F;ϝx y/.+*((:NOj>WĞJdTDqLNVKbEKO? /6 gX t8 r*^D`ͧT. k汃j%r?L݉C}d.CA.]dLVn=]_ 0G,+֓?%f27CT⇦`!ޣ?#;Cvk8fPu;r@Shi=a2rGQoBRZy׍qHvñQ_:s|⪽i̶"ݷ$\.^[̾H.c =Dǔ!VWvZ]g5ٕ֢z!΁=ʈ0 25*V0/g?Sbrq\τi6(/eb> ޸Ѣb4SKgh$ƥ&^ۀG,Zo".+@PX'uЌ^|:XFlq"*:D)uCt?{j!t!ۜoxq~V(4_|ȷ,>>v*A5l𝘯TB:auLs{P=!xDP:b.Pv%íx3ineb/)T!KO6kTȒC'/6ʒda#b!xds0,Gx"?W{`1 "(#'x=q (" u,s V1N')U:G'KL}37&39fv:Q T_x3H7~)FND\W#JFIB2K>8"Z3w̜ƭid ; l|.iK?U$i<Њu>"44mƶze!-nVȐ00Fs $[IZa41 ZAEI$[< ٍ.ڄŰ9Zɯ3%}^wLQ s fAND_ (TA{m I>@AM0 4mp6eQ#*BXװ[aʭ_[Nb_QꆍsL|{iz`N5 M? >ŐWzX`=JLbR뎤K)uA܊G@PAS'4Cc%:5D"Qmk iY^MيItf)" $vxoXK5&~x(^hk3fGL7+FULA?t*#b8# }ZePٲ0&G)9exqxOk(+ڝ^?j\҆ r7N'͓yl)N`OY]y;VEذfjj'tsղ:b;p/x@dLi'-Ϊ/2wD 2 tMn@ FxU5' RZؑ%%2>fU6C93 QLh2 @;dn1J-O8ν/v;wu-Śn Dus,=ta0,ʬ"}!t*?>K2CA4HC1y@Q53K\*焠IMW Z6[5<$VV-IׇVIIѤg37FHa#St\? ]WxjJU<;YPU<1B'\_ 0/`<|o1 5c+@)("bw *TL zs"fh?[~J ?^J}׶o4iz( 8J)܇֕i,&Rw c=}\K+ \E:1BKx:8ixѨ= sĺ@S٘ކ(݈.s@%$0X2ERlA5qm-7_$1=D}l l{TX=p'1xd`8*NY0ߡZ1ȰWѓXaVR9.fm%ΰZ 7cE[1H ?C lDAtmC~8d@2)b^&-%[j07g$)[m4eŸylQ7@ "Mo}غQXd CզF&SPdAZ\GK&=hqxshVԞT[ ADl02!0˘ dl#^'DuyC0/*+ƱIN2yz`!әy^=.S8K둎㹥2BE=tUxG9Ef$s<IdMO j$ZS~hX&Ew}1-W9%EYV$C/cmSK?鑽zr6o_kV%F]&vp@C0 ٫|mfu'[g9^ ~;D ab)*TəD7, )sNńAo/sCOu?ƛXٯmz0ef?Z&Bj. #b6EAY?rc=krls`іZS|%ў[̵qѬsK3tw0Em :sEPA#|A/\ⶥ$V"MBm&VN*vc3PА4tàh&3[* 0jUƣUk7W}V$ Ǔ aNc T9nMqҰ/l+ELC|}vK|:3 G*'Fqr-W~,\׹j;F=SP~W$}03V`w$l1*J#3JÏ^iɬ,a|㰕?Y~=d@ozX -+htf%faDОqU̡KƎ5@A+p_$҈gF=[+6u/ۡs=8msD/&p_vw 򊳺/:OҚdxIK% 4nI8irbXCΠ~ͥd FSun&ޣQ]H'=%h2Ur\fN!-"r*CCP L5ik_/EKk-/(/y+&tk& 3]v?:k@%*F(+h9G.ƅ~ 9.O t*5Tvw֮A׆UOqgX__/4&$S)N=_ zTΕ*?TU%y'[JZP+t-\Ld[_K-sQdh+.xddQY-.u|ƿ]88$VȐF5OƹGNeXT(doK+gC"fn{MJzBR\#޼wz ˇsnT)`ɛ˟_݅{-}MȺ'F7{=DIqp}}HJNEWZxX:.b]ʇ!Qv9PamL|$""%lHU<nė'HGU.CrxW1,Ė(NkX/j$,N3$#sfNyֳĶ OT֣@˻k'93XGx8k(%8#T Ca3R?.L1ZeU!'%iayJlNIfmBoqi[JDSZx)t` `_*[BO +9BbàèDA~X b cGǜ ! n( w7E[קc1O|S"%MPƔP 8}C9:bSJ,-I ֭Ky^qupz\KDAҼFd B֢mݸ;Pԟu)L)[Gg×8'`GIuGt2l2)m'/ ~5AS$ z,k#:a8oЃ@96$  D.`o6Zi0Ϡ*ADߠI"h9Tp#C6E^-h|c[{V+g1m\v!L_U3=|?tՄ!.UvN4P1e%pjNh .Ye; q9eV͟9Wg'4PjhOXu^sLk( a+ PJ0MTXҺXpWڇ>DK PzGh?4(HSp..ib{FI랼 kȶ,n&C]x/O6= a.a$T E }L'BP^ b Lm RI>3]p]﷤ 3jMBt}Bǧ#rg-@V˂tNҜacwYI鬈*ցfƎPd[a0x[#D:u]epWKjM7guφ8X/eDQN|h}tܛA:?@` D6H~"(g3 gq !D+j1¬#5\tP mP]Ukf)m@x=>,klrN_&p,SQRQ^촺5;nfZJ?0?7CSb.XҊ]?*q >h˓'Wo+eqbCV\9Uޭɐ2Qr5H(T##@yݮp9CfETc=Nm%MYSI"G-9{o܌]'9Ɇ7K R}[}{ZxpR"+i#?|H0sp]g˦ H`- 6s]7#@gg+2c: O!M|mhEO,a\)s`:nWpb5_*_8JQ:C{B-A Tn\enT :!Bhi _˙濤QU$B3y݊}>]lAlLS4P=8H|"E`!R;iG趍.õEk5ZsR} T$_R Oq#lB/c )"v$qf& ̟q̓ )'@v9qNPfocv<Ќ5]_:mL!Pl3C?k%ЬO;&.V,kR'- Qm<'G& O9hYuOzQ%ӌ[h–Gbv⧝K旘9:^;C ӁO? %o||짜ͧtwڳ ҥo%؄paD?3 AKM wei }Vݯ; k mgS"[᩼]$(J/<%O_]ߌx#Wx<.e{ cr|ʬ/^ݟ'jP15/jN E_\:lJzu5³I3g2$ZHIJE#sWp#i&c 68JnyG;Y!mLM {L @c#.W`a֋8HNz\ukR~Z,ļi1P=|!e_Xh5uCGUSxPCB]+n QmHf/`2%uM\R$4Ub(>Uh RVƚvL4l4'Yd)עy6üSwl:o^%oy+)rjѶ)6>2]}3z[ d}tHtiDQ?bw8;OXu@S~,ֿCβ~a DZ`wE-]UY%CSZq||\&yI8nTzDNnv)O+_+0 ຃RA*w[HS{̼f{ \oJqi 馭KDmټ,Y Ƥ“3^T/63k=PRK.Bp%B+8ZIұшQn ,.+ѹU.:M_;9'۱rQ,d2+0+:bR1[8a[XS? ;|DXĶ>V/ q2/sW(5#ɜ XƠ'm'7|/"jo')y' YpEZK0$#hk]ǡnYiQm0Q8"$W)9봒uL5iMPX4qwpK9EhDY:KT:-rtޡ=4D- qy#W/@79^7iS8Qڞφ.5DP[DM&q3A'waz>'!7ZߕF )M `čץv wQ,i,uږ 9P*.bp ff5Ѝ0s;FEM ABvnH1X~촁׋ôk)6[g`l ֻ]+.:eM([5{[O!Z!v|4*[167;3p3E6s=n];67JPph"[T 6B곥vYISd+,b.PוUyL5zJ:ԓ<~OgE&Ͳ~ 4H@/MLt'Ql0Q6,IPڐ\$U[:rF -’8AH U5q>LVow˸j~J.ç‡h%9d-/ux)mԺ~d/%(yŠ.DFEM)PTPϧ9PfZ|l>!Bgt YFb#-+ymD+gJB,ڶZO]}Ȕ??}6[|))}b:kC] ~K !}&[=etLkJ?wġVJ;.1\MFÖ!{޳+ڕ B+;./5GHcQ=C5V-UP.ksuJ=(#B#V?9%"ظl+%?yo8 k n$66 mؗ!Pk&`"~M|sz\-ט̔XVCּ@_W/EVBr/qj#@wAQ85}{w16(x7̤ =y.*@G*/C0 9ƤS+$YQtN݋mdniv i P ٚE@Vi-T| Np$t仸l5B_!䮝gr3M+ +x>xUS/1f`a2 1O8!eDR?pfናWUZ?'AJ V .o ,Foص-j.N6,?-W~ԅ- VEa֗K2OjLM5n(h CZ[%l<{F#~R{P޲*U @ i"?ca pYrg]"={\zҊ>S߈2Hل=5nV1a>Ih2)6>H \ex_r网wHz5iOcN9R՘ۃg|~tX#wbO-^f*#C{h~MĤJL$*i Yla]*Yp~{ _adS /Z^wUf*Br]*i^ ^31.5$]0z5pJ(KEw}.5߀1 OVg}1"$|]E%~IXx -*?Ï1/+:WR ؤ$Og›C[㿁$W2O;d/7u)/x) ӣ"9!Ej/N}?"-#킦B()Eꃿ"߳6PI''Q -!TJ 驗5#@$r9ar?ShҢ4g .V6vņ6 BY3y*ɪbނhMfjb6 Aa->C_[,cu?o=KizW8$EIs$>'qV"E1}5 Dd8ߞfozz q_YIt!Att˯R6ۯM*700x8ڊ0Tg؍69KҚκm=#{|]cMc~zWdKW' g/Kug}s)Vn]W [DQe"׳+KsHS:fu5Od0D>.3hSLgD֓b͆ Зۉޓ8NĐߍmM ^0~O_Ǵ-'_eR}4YEa#eX Nvԫ~sbԢp8/zd|elrk3 (4o(auJ1Asȝ!8 Nm; C?i/|[kULCŪ7MS~nR fbKތN\_ Mh'|UMM5>c:7% Cde&7k9h<>2bt/0pC$ cz* ̌L(-;*Gߎ184-xp)k0&UO߂R_ැrLM,f1_΢u9ԪC nnzq8aQaQ$&REEhgz>@bk>gNGf: JOQ<č0. 6 Fo_ p *oB*|;ٖG)ਹ,)vW #t ^sp݌?+$\5 A#\A*NچV{eo.Sʬ訚pj`]4^J r.g"uBCQҿٮ-bn :yC]faBP(2Os .vpx h4;n#GA(5sqB%yI g!Yj Af>"J;f5BњhQsxufݳ}'1=@Er."EQcK3;'>䝛EoCpy Zn@ [߿kɅR8K,nxq@T`,X}*>KeE RceSD2t)a)P@魰[h[}t:H՚Y΄"weiFe&kv*VLDh;"J[[>Ō.ӊ|VD}Dk<|m`!1=%ע|ٱ%Id2 K 8l^ِ"oxηaWk2%T-Et z(χ#A>Eʮ+F<]syziHMټG'g #SUaf4Xt8( 䳛#<ɻn<3DjnE]xZs K+y ٥-QF+/zѼq ѦJ[d|a0]רAhg~o.fnK yzl-iD DyY+`{[8&l(-P&Fպa,\Q*'n6;V^o+8\shA2Ubٵ"˲5aTLAIe%2D# 2hQpb%S13Xi[)r ]q&y2S2>|[-QyYds<[n릦s!)@b&LڐҏY:Sq 'h gZ"ƄfZ)Y""ߖ$Nv{ǯL DBsXժhK9tp+5׉]Ӹ<IBy@ӕwÆ)hfsgG8Bÿ ia,S'W"uw{A[5GSZ~L>5159]8IGrXpɱөw݈n1oeg'+X 쭦^e7AOMao}@RI!و;'#ZKXrv1͇[\T7Fqz|(ۂ2tޘTM == .>>e,C#ܔ#\SfH83 >H ͬFxG+}MI0o"gzm? )haxW*+巐=1FDe$W~m yzS,n.`qui| h#]Uv#f6Gzw7=m4v'Ӣō< >{#Gni0@|A@T@319dU?}:#*]:od=xYL D\RGQVo`X~ NILיi˨C\^cLHq!}I2{8BZ3eÖGKv29-- il F@\AݫdxQu%{yevKUZ[ئtMl } 6 v+F ^} 6M!VFHz(U ɭ#op(Fm݅ =aAk&y9rN1+ƢrO$"*-J8wk~R{ĉ/)mti Dݟ;rYOQμj3}22@)'w%Nt-zI7!5P^"uKOA}RFId 8Z8z;!~DީOdJ S]< ^7?FV \BPI{1†gI:WӮ`GϾnaD'ZF5GRқA2],"PfϬs0)E<>ҺAIVY0kbBC&觘Gue877|{)?pd!|O,k]\ QVxRHGl.Q^緛Khg2a"y:3^=4J?mU |qإ}V' GolQwt% 4:>}2AUDcY̋I* cOMRh1ۉ>{_y֪rvH|(af d&֐aOѻ8;C`ܵ8~`n19;p ,'2kw!u7w9,.j䧓ʆANrs d5S*`⼳!׺lda,B"M7߈b ^a=n'h[Ug7ѱsռ*l;,/Y!ʴ|R傕)\(GGErP9(3U^6<}tg vy~^[G' ]5yur$_~U%TmaޖUlD[0zvL׎kY{[Tf>x(82`P=V%db:Ա8`167Pm^c(4Mj܁6 " #.vgtn{."ઘ0Kp0R~tє*/& ̧H/~c5o=o kEF"@H/Lf!ڝ_yEH7@ߓv9*|=蒨kݩFޡyc-/k왭/v=R}29ٓ0aD -UU;'iB)=Ӊt#{sn%6\̽;:fզL oD] gm{ ;&a_JcNv$Vrցb}I#ڶR'J,IPG/QZtd9|[[)6w&w %O?2J2mMPv8¨/]ٟ?> uEW6!-Bp/'tWnTS ^ݣ(m{.usDM2bp;< >Mgh>3#+bo:IB$r~)BeĠY#UPyI;yZߎy b?n`FA<.`j~m n빺h  S&$@]  ͒,B3መP_Z~!R{`d0aUq'NQXO6I⺏q.(۵[ۗS жD4h#[k «jZ$䞤E ?ઁ2@ʚ6t76&T1+7Cyi+NS{q] :/f uvg# +8DS I8/Oj(?Er5%O;}'v,}8p'|=$n,=ΉPO8fz]xζs h /"ɰtz%JLv.uon 7 ZG9AYmH<ӦW_o)@A\.5K;v봕Z͑?l( /@ G9xhI" PWȜY~rSgO\(e~"bfs yKX6gH6MolTb{J`@,3u}Ċlīz#)*-qӞ1j+fV & 7OE!HwD`TjV$ 1vqv{MYA^;:ȿlt|Hm3Qh^N`fFW`6և`k pxdZ_3H4-)cHcm̩KłEųf`@׺\51'9SgC HK7cQVa'  9%.׌y)׋g B|Q(g.,)\1^0)tLoǝYT/He _Ls 1}yǾܸesoHk!JU*H ,cyTzݻwJ  !IΕcs[/ Kߛn<ی2€ń"axG) A*r-zܽ[eo 2}XZL ?&xb:I + (2VXN%B'a+l ~:5PM׋z!Gٔ?41φM|qjeEMרkU}-Yk`W ðFQ9}pS,|~H7H :!ȋ^Qݙ)O\g@J+$ #c4 y#[Rrg<Sʔ6K2;J%L ,.&瞒gEŒH*g+=IZZOY}ى1}̆8$׫#qwFnE+#Ղt'8D9Kb=A%c~2c1{Ļ;XuuXA/Ep}X+޲cV>tttuy D'e>0lgFÑ%gpX:$c7Y`Ӗ\`ْ7Kwܕ8L)#) r`E2KjzMU'"  פz ݖ)[6৓VP º59M~8UYRD& ɽ%*zQgha\(OGKBA٪~P }s}t@5@I ȧ}7%~+zaW]>l*ɪ-)~hmlp|ٳ߁r)"qPoeMzz}e] ., yPzHoWhj=!z>۬ݱ&?Qb+6p D7eS׻_{އ7SlC1UͶcz.l2fUӀ[9' !JCg]BMUF&, 0JC(ssfX&^IhVT㭘cXW:jTm\$a wr}EYh~vO6wBw(`cCn /y: Ԗ^NEK3xx̑yvܵ9B*Xv7;m8(cYH;Smat{`B3 6R- ć͝o\aԲR`Ou X]=?|m 2MUiv.KdaIom#*Q4 Ocó~H_y%]EJc8D,z{‹ug50Q*'}֨!Vxk@نXE6Aχ aǣT鹦*Zy~4LI%^4eӓbT.I)_%^3mUwcS8ԯ6 A/g)#G"FKS ^[vsK֜2wv8br>D:X$_ZcH 8'P⻁8 3)NP NPnK d *Fׄ*?- ږy+\_[S4:#6DRw<~85]I[n\ijƈ9.\ y&[9?ngC'7Lb./id@YJڤ}DF8eZC%\dϑŅMxL|!6~ }Fh4m}ZAE?Q;pg71[k檻 TZCtf>GE{DnI0_A(j,E[CS=-.lg`4bfGx+,TUnEk$Sqgxv<@` VԿ+}I*O5J `O}۲[zaՓ.n& +ױkK[v`zFA<"h)/o<(^3 ,a":݀Z1Z=֥X<%]F!Rb cϧ H9BtQR.-5(7,ꉗt &#h|f/o\|E z?8,Ftx8"̋8B# X'.)=T5~b#:V̀{5%.-J?DP" 9; ڷ@qի`Bot%@v"䈀Wq2 `1ױfhD?3ajZY!Rҧ E]NIIt>_fi$U01e>N l[},˴2Ũ GQ74ImAζD`Vw0IJ Y&D9ZVrXZZ81Gnb_C3U0fkr{tmU4\@szڃpu|WM1FVaݓXGʊt c,]orFHEր#z?pS;յO1b9XUCwLTabWMY"8㷥v_>Cɰމ?*pu3>NDן鿵)Q嗸(F:v`]$PV:Tc*[+k:H1+s׎0S[셤˜{x~sߑ}6NZCm|u'b$OSz/e^"QGHXc#7ob)\֏ؿt]=,ʭV讏XKqV;"@NI&7}FNE[]I~t7ճE$7/Attg@ҍb* T繦wVk̸`g؋)ŏv\ID폙,ĦcrW?O1ǧЅP;zjv \. @uzm;/jՖcyx ]fw0 SMl̑O vz(`b'--ͅs厑ĸQUшT}CIBeGx.$RBb LC4DӍm7Fwd5QsrY1L\h=rNϾrYx`djOWʙneH_AVOuIU7`UfQ6D0*d#_!*RlA6\OAnf#2q 7(CXz˞Nʀi3Y~5~ mg܀iB`AZcIWu/q_*i}]°U(\̋{ ɆwϨ))ΫRd i[=8xA1QOzdCsš+.9NXw؇alUgS`!H iFl1sAQ0βH&SV/6&Lo B01vC:LC#1 5;(^kCWϛ#lz3?1P=>eohlOT?Aai»Se־F|o.Q\IɄ3Iv4Xd?i W]fw3_8 QqGIw㘶sk.xƲN {+qhNȸ5n<⌶P&>SϺ-тQ^]>Bx3[!c|V)]>&>9ZV;^gW'n 'i i!% ݻߧEbr?l>],0FU*ب?Y!zQ{?.+oi)yV% !⡡Qj >\ZcYDLcTÄ7҄]Riݘ-/_a9+sr]C{H*\/ r+X^9ahIuR"Fx8y}O}t?`}E4? 9y;D^4 ^)Ҩ_d=@]&\T۩cҖAٮ`1kHΛA^')l8m?>Ca%{$Z,!ZVh T rTIޘ).O_}̌Ν-zalSr"g^uv:EgR\"26 Bǩ0<"וV_OUښu=<1@Ez?ϣ?Gi"&;A8V/B?*r\M%I/_IT#>,5a[ "̆v_CG\5뛯v骎Q[pҔjSgh,C`4v*XVP+b)/T%E0OOOKz;}g3,j%N38^ZuH!qʇٙRreDe1醈B9_eNWf~ĵɘp䔾<S).DO{MX 09cq$t5޶%'ϡ㞔smO:S.V@5c!pࣤ^p\:Xc9t#9XbKE*j&)u=́8J+%ybg78;i$g3e7fM'1ecu$rي d4׿C1[Pv8SS^`~N~ }y2AO]րtYyFAob, )IfSB6s͢z#!%|(;|O vJ {Fd#]RzDf>=^|hm*f:ٯv=l ىx‰Oe?ySRbpfh½ĚqLcչ} 1 C6z9Jn2fH($ħmnt$v~ 6\E d6)KerrT_4"OO,x)zb+ԙ-IR"7*{'}}nQ FP5Os(Ax@ԡ\lދ*Eoq~0"2LP,iY~JKwLhXp "h=[#Ρ$}p4J&Hw6St.Q?lumÙfvso6eu?_ae y3c(N_6i(ҵ$3B%z$jCC[uމ,R-p~ Lyæw6Qt/> ^%m?(c2wZv/WIk\\Ls|+S-H[I#SItua'#U k;FhI{" b> fFm?G%b~7jUlK=ccܕFW-by.CCvTTy&Y /,fW+z)j'=z:mM[n S7tr栐xMbi=sR\ &?HͬE *1}S8@ئcD(Z*ń(XyiIbf0-7}x8$"*+:MQ]${E4w Ä;Wjm ht`ge[\!V_9e?ۦ݉wA0a8 QEϗ`5皇y Q F9Z&яdoHCH,H]-5ѭz8ĮIl$H=sY޶YmEyDMC޶MUzeqt>8+N*mu7Y0.-@1RP+l)G[Bnz~x*9]fmHQD8Xw?SLkJa$}цKHZlQש^^$VˍdxwhD'wO e-;Z4g摙q蕘hm1@<56OƸ2b^S3S )vX),rC1fm^e<#JIׅ1O ]354^ca#}ULO8sBؚjV$ 0 QnҢغbkfA4NO| GvW*?2g)F#k }9~gx&qzu9~K>f/Min];wD;gg`7o:NO}(\ΩKU#%I%[;44-W^jbIYV2GfzSq!× Dّ-R'0޸=y/@Iݾ‹psp8$L\٨1/ ˘6T9xZHNl{  V%36ZHl}R0q,7SYHʌFF#ڈi҇P4SڋG>vCٛ|7O$ Uo'<7d! 2`FB \E{ux^y8\cr*bwWxLlwءhMo:_v0/B]ۆÈ(W *h߸TSd8IQYE&͟cƐ2#)f`soF3( R9dyC?Id:5иAl&m^}kU~ËZF]c`~iޫ7)դC|Cb%e:rnAL=3/c"DZzP; h0p97?1T%R`+;,π$>?1ur<|+#YJY }@>"@3횳7/>ϲ]U|_-ftews.ù<SΜh*.07GV\Dl)g*s~zE4]@w"6j{~sߣ|ԡ_JR}Lű(;;sȼpqDY%,ЍVxuGrN Fve [p4LQtr{Б~SeRJ"J)_N.KONFL+F-SeHnate{o 2@ڠ/89_"_ۣS"Ϡu9fV1kk5OeY3[~ +!$߱Q^GD*iDnȻO"ŵ{A kƻaaC1_gD P?߫y+V1"L'Sj2*twȣ;:6r5^~Z($s@gɅvvbx7|H{?{]z5hdlm8gSFiݷ >p<=_!~+5v%GnCοV|/iS 3A:)a<'U?嶬\Qc#-bIkq㘀 yY8Bv \Ľ۶|O30-" ?+L5(E>;_@eZ`ESRBu3X@ LnҤϫq/F@:}yWd~J{ڷ+%&?/_kɅgw gx 껔K) ?th[Wz4^6Za dPb]lT.pӍPyHX#jN=jϽCܘ(~0)oM*#Dj5mt> jNa!^ȃQfo:{s`H<½{DɅdl[13dsLD$ثčfGz.&㖕/*rT1 ,4EHgbϬ}D& I4&>=Ps,rBCux<(LŻ%lJQ:Us`<²dEI^V*$PG#"!Hy;:fH Y$0P{ݏgy8T}O zh x 1\T]>֯Qw^!RVn>ׇ2&Ht.9 1 "Ak:P|z#.^x YZlqy~>_zJ+x7қ!t{Bm2E@Daxӱ[^E%zK ZccCvԑJfBO:AH-f̑3)hB)ZWYhEHtei2i|0l0=sڛ.dYwxw|,k+_t;f6sOzL{mi>OOMD4ݔ/9y$ޑ-{Q(B*J=1W# > cN "Wbr!TdyVSa}׆1f.GQ!,bEn .tp6k# 0UʗZNӟbuY? VcAT5al*<ˋ} _\w ,TW(7T-Jøw-ً/Q+ObwKu%PKE\Qҭ``=]ѯql,b, 0:ٸ2-T籆vݝܤ6_Mث/IUXnh-VVx~La5qa;TǩbbƵ{k8.cO *@Am{?tsml<-(Vi?{10OLJ tjTf4)9wW)iFDQXܞN|Ds",IV_:#)D/{T߼ffSov5I.0cU0Wz$%*%,C; a8ZkUƠQSaҼoɜ~? uJ+i-ӾVʾlnue`D7ɨ eQG$r Lqq8`_(M Mjyi,D>$63H!mYpZ92p#1Lxvjʛ1z*#_q[k(:/3`va [$l1%von- &1g QRʩ߄Kq=%LXs:2 ?xs +8jo3iU^EDҖU> }(7>?y3xx:QđcE?49 ̉#єfg?@}ܻ_G|^ݜ2DyL^ZFixmL~hu^+:Xߞ=66cĘҧ>32fBRMjuv %֤7OZ@퇈 D_ ;`DB]B.a0֥80auѽ6 7 o@v(_Q*"πܞKP\)}]W66=q a * Ksy&~Ѓ↎^t nBȓs"j5ĪLo³L\ީ3%Lmt&zJ0T(䓡mԉXB% NӤjL?+'&[8/f+ I>1 ' M ̘ͧ mDL*GXL*D|>Ĺ;(wW τu L𧫧~4)~da :vdFVJܼWŴq<>̪y\]J~2R%7ll_pϢ8_y[t,긩u͕7L7q:u'I!a{7_i`dCNc-d̴)sEIoH0Uv`6_/M;J5 ߜriʅN'rm,Nľ>gcB=|7Һ.`c[_^ޯ fhW{1-<} (KRM]Q}fkꔥ"bmB4Z)4=0#(hӎE"Ro%hYde9g3*}`> qW.ݠž2GM-uKeCh(6 ` l޲xovC&=z˲>D0UrB/VnY!*܏bmsZ%q =MSh8X7i*ir Qi㗑B6, }KF)ƥM\*&*-g CeQ\!L;:DieD5տϢ:EH0VVݺR@rS sټdUhd1S豹1Ak?K\DeRyqaە*9Ͷ$}ϪS@) ) e0$afہv@)mggSc>&BeV8PwJlt1b(xQt(2jt]cM\/%dcVa 1PQͤqSsbܵ1 G+93"+|Bʯ@a[rƜk]@kA}&~~˚qieOKTrc7Y1 +>-WzrZTۧ4QDE `v!}x]?bQrXg[X }Vqp}zk&Xutaօn{0N^e1 K~*><\2z^I %M,9kYEeĜD;VnT9Gܠ^?.]~,YK\0ܖ,gdG <+Qt7w~!ܣD]2[_'P B0&'3S,l>ơ,ېn'lN%-:.WFոR(dl Cz&aUAU@+>tߤېx\d;7xV!o"^jV)u<%k2 zꉿ7l L(q~b~5\~k qOqj!;B4'F+JR-dv@}*C DAMj[21KiD_֏|V;v:"yg)o猭i^+q7);uɭAxΉwc/k<47] KpLێg2MD}|'Ȍ kS؜vޘaQ pCy=)]s^PxdQav5:o^wC0* Cˤ^Sa ~H ޻жp eyB{^HS`ZE Y3xvjȹ{g4^{3]PixB ,]QV㹧#5l-z<`}cÈNc&^Nr9`}]y5ҁ% lM"S6}i 0UE_5#wna,RSc}ٹn]KNM-4֕]l Q6`k.%ӝ *3O&В9q.>='\ŠCPdn{Vȭ4 `F(Y"ܠ@BSZܖ&] kA@Dt #5Y6Sʎnj8Ar\%FoxIyXa̕*uPL"DQ`.Z`LO,~l^` OWb>)u<҆tj'Йk.qɮ(rv8p8HCx69fv56qH(/]'-Ev^yK!Ըb&mlÿR#ZzL\yl<^-Z !apE7[KaWԀƨN lmPGKR'G#™l^@AtחUFXmMYyAIq|>(LX[p UVbWqn(5WXHFBւH{6UoG_g!:!jSzbNpStjgCc3.Ʉgt`0D+Zi8,C`jXUQ͗A:D *r Mm6[>ss=3]_OjHMNB1X-KB^Io{xΔוaYC@%+JQB#!yPIfEvs9G·^5-[D{adv`Zp*.J!.˘ ̕8, '7b(MD : Iw ӭ \ i@MumAO|barq'Lr mLHӦ+ yA;4SقυR YuH Za:Adݨ˟R-DcTVL݀ZHK{kתIYTgi={tlJO\20rߵg7]-pruqkAb%Ͱ6F¹MauY^cnո" ӮG=Oa c#nI/cΘUqR̚Bz,۫ՎY?؛*˚u/sK*7J"󍸎VצXwjSXjwʐ}4شc (1vAxacO].?yCZl2ڥz½ _"+J!o9x'-V$+F +,(n|nh%52/;I"[ETT :8mfA[!_\fQf5`дq( ߖKyXzf{U{3ќiր7+>Ln0*t*53-Rѱ%3Uχ6c~C)ѹut{Wb9ICmiMzidFE&Xq[U #QHt[."UM˥B"]}a")2vmh|Z7'_J^"(4تPl/Ͽ+^ t@mESvPST?)Xb4u0&0SXfپF^Jɾ \f6س;ZHʹI󥔒6lK _!>Ch„#lrNf"_/f o*Hg"#k "ɥeU_"?`Ȇ]Uy2@7[lE |`ST9w\d0`Fjg ^r6Xg tEÑ#0Llь"fԛ?<Մfhǿ!)d4. 1yd(qs yؤ6/! YZ