pdns-backend-remote-4.1.8-bp151.3.9.2<>,4_l֜!M@eeejGXĥ[3&2 ߣOۻC=} i*)rCU"T1{kTgWTGk5 de=m<*Wn|3GLQFe* WX&,Q`2ԂFv:Ҿ}-V_{kXfY:6TjuEy|o9x1CGq*g/h:D.%OulX,ǎ#ozK9ϑN\gXD*w^hDɿh\I>>X?Xd ( @' @d~      `(N8X29 2: |2FUGUHUIUXUYU\U]U^UbVcVdWNeWSfWVlWXuWlvWpwXxX yXzXTXdXhXnXCpdns-backend-remote4.1.8bp151.3.9.2Remote backend for pdnsThe PowerDNS Nameserver is a authoritative-only nameserver. It conforms to contemporary DNS standards documents. This package holds the remote backend for pdns._lobs-arm-1(SUSE Linux Enterprise 15openSUSEGPL-2.0-onlyhttp://bugs.opensuse.orgProductivity/Networking/DNS/Servershttps://www.powerdns.com/linuxaarch64(_l833381b283ba52590f33c8decbe446eb04e580a14d9e591148e311b85be13352rootrootpdns-4.1.8-bp151.3.9.2.src.rpmlibremotebackend.so()(64bit)pdns-backend-remotepdns-backend-remote(aarch-64)@@@@@@@@@@@@@@@@    ld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)libstdc++.so.6(GLIBCXX_3.4.11)(64bit)libstdc++.so.6(GLIBCXX_3.4.15)(64bit)libstdc++.so.6(GLIBCXX_3.4.20)(64bit)libstdc++.so.6(GLIBCXX_3.4.21)(64bit)libstdc++.so.6(GLIBCXX_3.4.9)(64bit)libzmq.so.5()(64bit)pdnsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)4.1.83.0.4-14.6.0-14.0-15.2-14.14.1_k8^%@^`]A\@\@\@\[[[@ZZZЛZZZ@Z@YeYY5Y}@YMYMXDX@X~@Xx@Xx@XN@WW@WJVV8UUv@U>$U8TPTи@Tи@Tи@Tto@Ta@T_W@TR(@TO@TO@TO@Adam Majer Adam Majer Vítězslav Čížek Adam Majer Michael Ströder Michael Ströder Michael Ströder Dirk Mueller Michael Ströder amajer@suse.commichael@stroeder.comkbabioch@suse.commrueckert@suse.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.demrueckert@suse.deadam.majer@suse.dejengelh@inai.deadam.majer@suse.devcizek@suse.comwr@rosenauer.orgmichael@stroeder.commichael@stroeder.commrueckert@suse.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.deadam.majer@suse.dedimstar@opensuse.orgmichael@stroeder.commrueckert@suse.demichael@stroeder.commichael@stroeder.commichael@stroeder.commichael@stroeder.commichael@stroeder.commrueckert@suse.demichael@stroeder.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demichael@stroeder.comLed michael@stroeder.commrueckert@suse.demrueckert@suse.demrueckert@suse.de- CVE-2020-17482.patch: fixed an error that can result in leaking of uninitialised memory through crafted zone records (CVE-2020-17482, bsc#1176535)- pdns_maxmind.patch: backport support for MaxMindDB- Build with libmaxminddb instead of the obsolete GeoIP (bsc#1156196)- CVE-2019-10162.patch: fixes a denial of service but when authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. (bsc#1138582, CVE-2019-10162) - CVE-2019-10163.patch: fixes a denial of service of slave server when an authorized master server sends large number of NOTIFY messages (bsc#1138582, CVE-2019-10163) - CVE-2019-10203.patch: update postgresql schema to address a possible denial of service by an authorized user by inserting a crafted record in a MASTER type zone under their control. (bsc#1142810, CVE-2019-10203) To fix the issue, run the following command against your PostgreSQL pdns database: ALTER TABLE domains ALTER notified_serial TYPE bigint USING CASE WHEN notified_serial >= 0 THEN notified_serial::bigint END;- Update to 4.1.8 * #7604: Correctly interpret an empty AXFR response to an IXFR query, * #7610: Fix replying from ANY address for non-standard port, * #7609: Fix rectify for ENT records in narrow zones, * #7607: Do not compress the root, * #7608: Fix dot stripping in `setcontent()`, * #7605: Fix invalid SOA record in MySQL which prevented the authoritative server from starting, * #7603: Prevent leak of file descriptor if running out of ports for incoming AXFR, * #7602: Fix API search failed with “Commands out of sync; you can’t run this command now”, * #7509: Plug `mysql_thread_init` memory leak, * #7567: EL6: fix `CXXFLAGS` to build with compiler optimizations.- Update to 4.1.7 with a security fix: * Insufficient validation in the HTTP remote backend (bsc#1129734, CVE-2019-3871)- Update to 4.1.6 * Prevent more than one CNAME/SOA record in the same RRset- adjust buildrequires for mariadb 10.2.x on SLES- Update to 4.1.5 * Improvements - Apply alias scopemask after chasing - Release memory in case of error in the openssl ecdsa constructor - Switch to devtoolset 7 for el6 * Bug Fixes - Crafted zone record can cause a denial of service (bsc#1114157, CVE-2018-10851) - Packet cache pollution via crafted query (bsc#1114169, CVE-2018-14626) - Fix compilation with libressl 2.7.0+ - Actually truncate truncated responses- Update to 4.1.4 - Improvements * #6590: Fix warnings reported by gcc 8.1.0. * #6632, #6844, #6842, #6848: Make the gmysql backend future-proof * #6685, #6686: Initialize some missed qtypes. - Bug Fixes * #6780: Avoid concurrent records/comments iteration from running out of sync. * #6816: Fix a crash in the API when adding records. * #4457, #6691: pdns_control notify: handle slave without renotify properly. * #6736, #6738: Reset the TSIG state between queries. * #6857: Remove SOA-check backoff on incoming notify and fix lock handling. * #6858: Fix an issue where updating a record via DNS-UPDATE in a child zone that also exists in the parent zone, we would incorrectly apply the update to the parent zone. * #6676, #6677: Geoipbackend: check geoip_id_by_addr_gl and geoip_id_by_addr_v6_gl return value. (Aki Tuomi)- Use HTTPS links in .spec file like mentioned in PowerDNS announcements - removed obsolete 6370.patch - Update to 4.1.3 - Improvements * #6239, #6559: pdnsutil: use new domain in b2bmigrate (Aki Tuomi) * #6130: Update copyright years to 2018 (Matt Nordhoff) * #6312, #6545: Lower ‘packet too short’ loglevel - Bug Fixes * #6441, #6614: Restrict creation of OPT and TSIG RRsets * #6228, #6370: Fix handling of user-defined axfr filters return values * #6584, #6585, #6608: Prevent the GeoIP backend from copying NetMaskTrees around, fixes slow-downs in certain configurations (Aki Tuomi) * #6654, #6659: Ensure alias answers over TCP have correct name- Update to 4.1.2 - Improvements * API: increase serial after dnssec related updates * Auth: lower ‘packet too short’ loglevel * Make check-zone error on rows that have content but shouldn’t * Auth: avoid an isane amount of new backend connections during an axfr * Report unparseable data in stoul invalid_argument exception * Backport: recheck serial when axfr is done * Backport: add tcp support for alias - Bug Fixes * Auth: allocate new statements after reconnecting to postgresql * Auth-bindbackend: only compare ips in ismaster() (Kees Monshouwer) * Rather than crash, sheepishly report no file/linenum * Document undocumented config vars * Backport #6276 (auth 4.1.x): prevent cname + other data with dnsupdate - misc * Move includes around to avoid boost L conflict * Backport: update edns option code list * Auth: link dnspcap2protobuf against librt when needed * Fix a warning on botan >= 2.5.0 * Auth 4.1.x: unbreak build * Dnsreplay: bail out on a too small outgoing buffer (CVE-2018-1046 bsc#1092540)- add patch for upstream issue #6228 https://patch-diff.githubusercontent.com/raw/PowerDNS/pdns/pull/6370.patch- geoip not available on SLE15 but protobuf support is available.- Update to version 4.1.1: bug-fix only release, with fixes to the LDAP and MySQL backends, the pdnsutil tool, and PDNS internals- Update to version 4.1.0: + Recursor passthrough removal. Migration plans for users of recursor passthrough are in documentation and available at, https://doc.powerdns.com/authoritative/guides/recursion.html + Improved performance: 4x speedup in some scenarios + Crypto API: DNSSEC fully configurable via RESTful API + Database: enhanced reconnection logic solving problems associated with idle disonnection from database servers. + Documentation improvements + Support for TCP Fast Open + Removed deprecated SOA-EDIT values: INCEPTION and INCEPTION-WEEK - pkgconfig(krb5) is now always required for building LDAP backend - pdns-4.0.4_mysql-schema-mariadb.patch: removed, upstreamed- package schema files in ldap subpackage- Update to version 4.0.5: + fixes CVE-2017-15091: Missing check on API operations + Bindbackend: do not corrupt data supplied by other backends in getAllDomains + For create-slave-zone, actually add all slaves, and not only first n times + Check return value for all getTSIGKey calls. + Publish inactive KSK/CSK as CDNSKEY/CDS + Treat requestor’s payload size lower than 512 as equal to 512 + Correctly purge entries from the caches after a transfer + LuaWrapper: Allow embedded NULs in strings received from Lua + Stubresolver: Use only recursor setting if given + mydnsbackend: Add getAllDomains + LuaJIT 2.1: Lua fallback functionality no longer uses Lua namespace + gpgsql: make statement names actually unique + API: prevent sending nameservers list and zone-level NS in rrsets- Ensure descriptions are neutral. Remove ineffective --with-pic. - Do not ignore errors from useradd. - Trim idempotent %if..%endif around %package.- Added pdns.keyring linked from https://dnsdist.org/install.html- Don't BuildRequire Botan 1.x which will be dropped (bsc#1055322) * upstream support for Botan was dropped in favor of OpenSSL, see https://blog.powerdns.com/2016/07/11/powerdns-authoritative-server-4-0-0-released- This makes the schema fit storage requirements of various mysql/mariadb versions. pdns-4.0.4_mysql-schema-mariadb.patch - preset uid and gid in configuration- fixed use of pdns_protobuf- update to 4.0.4 - fixes ed25519 signer. This signer hashed the message before signing, resulting in unverifiable signatures. - send a notification to all slave servers after every dnsupdate for complete list of changes, see https://blog.powerdns.com/2017/06/23/powerdns-authoritative-server-4-0-4-released/- added pdns-4.0.3_allow_dacoverride_in_capset.patch: Adding CAP_DAC_OVERRIDE to fix startup problems with sqlite3 backend- use individual libboost-*-devel packages instead of boost-devel- update to 4.0.3 which obsoletes b854d9f.diff- b854d9f.diff: revert upstream change that caused a regression with multiple-backends- update to 4.0.2: The following security issues were fixed: - 2016-02: Crafted queries can cause abnormal CPU usage (CVE-2016-7068, boo#1018326) - 2016-03: Denial of service via the web server (CVE-2016-7072, boo#1018327) - 2016-04: Insufficient validation of TSIG signatures (CVE-2016-7073, CVE-2016-7074, boo#1018328) - 2016-05: Crafted zone record can cause a denial of service (CVE-2016-2120, boo#1018329) For complete changelog, see https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-402- BuildRequire pkgconfig(libsystemd) instead of pkgconfig(libsystemd-daemon): these libs were merged in systemd 209 times. The build system is capable of finding either one.- update to 4.0.1 Bug fixes - #4126 Wait for the connection to the carbon server to be established - #4206 Don't try to deallocate empty PG statements - #4245 Send the correct response when queried for an NSEC directly (Kees Monshouwer) - #4252 Don't include bind files if length <= 2 or > sizeof(filename) - #4255 Catch runtime_error when parsing a broken MNAME Improvements - #4044 Make DNSPacket return a ComboAddress for local and remote (Aki Tuomi) - #4056 OpenSSL 1.1.0 support (Christian Hofstaedtler) - #4169 Fix typos in a logmessage and exception (Christian Hofsteadtler) - #4183 pdnsutil: Remove checking of ctime and always diff the changes (Hannu Ylitalo) - #4192 dnsreplay: Only add Client Subnet stamp when asked - #4250 Use toLogString() for ringAccount (Kees Monshouwer) Additions - #4133 Add limits to the size of received {A,I}XFR (CVE-2016-6172) - #4142 Add used filedescriptor statistic (Kees Monshouwer)- update to 4.0.0 https://blog.powerdns.com/2016/07/11/powerdns-authoritative-server-4-0-0-released/ https://blog.powerdns.com/2016/07/11/welcome-to-powerdns-4-0-0/ - packaging changes: - remotebackend split out now - enabled experimental_gss_tsig support - enabled protobuf based stats support - no more xdb and lmdb backend - added odbc backend where supported - drop pdns-3.4.0-no_date_time.patch: replaced with - -enable-reproducible- update to 3.4.9 * use OpenSSL for ECDSA signing where available * allow common signing key * Add a disable-syslog setting * fix SOA caching with multiple backends * whitespace-related zone parsing fixes [ticket #3568] * bindbackend: fix, set domain in list()- update to 3.4.8 * Use AC_SEARCH_LIBS (Ruben Kerkhof) * Check for inet_aton in libresolv (Ruben Kerkhof) * Remove hardcoded -lresolv, -lnsl and -lsocket (Ruben Kerkhof) * pdnssec: don't check disabled records (Pieter Lexis) * pdnssec: check all records (including disabled ones) only in verbose mode (Kees Monshouwer) * traling dot in DNAME content (Kees Monshouwer) * Fix luabackend compilation on FreeBSD i386 (RvdE) * silence g++ 6.0 warnings and error (Kees Monshouwer) * add gcc 5.3 and 6.0 support to boost.m4 (Kees Monshouwer)- update to 3.4.7 Bug fixes: * Ignore invalid/empty TKEY and TSIG records (Christian Hofstaedtler) * Don't reply to truncated queries (Christian Hofstaedtler) * don't log out-of-zone ents during AXFR in (Kees Monshouwer) * Prevent XSS by escaping user input. Thanks to Pierre Jaury and Damien Cauquil at Sysdream for pointing this out. * Handle NULL and boolean properly in gPGSql (Aki Tuomi) * Improve negative caching (Kees Monshouwer) * Do not divide timeout twice (Aki Tuomi) * Correctly sort records with a priority. Improvements: * Direct query answers and correct zone-rectification in the GeoIP backend (Aki Tuomi) * Use token names to identify PKCS#11 keys (Aki Tuomi) * Fix typo in an error message (Arjen Zonneveld) * limit NSEC3 iterations in bindbackend (Kees Monshouwer) * Initialize minbody (Aki Tuomi) New features: * OPENPGPKEY record-type (James Cloos and Kees Monshouwer) * add global soa-edit settings (Kees Monshouwer)- update to 3.4.6 [boo#943078] CVE-2015-5230 Bug fixes: * Avoid superfluous backend recycling * Removal of dnsdist from the authoritative server distribution * Add EDNS unknown version handling and tests EDNS unknown version handling Improvements: * Update YaHTTP to v0.1.7 * Make trailing/leading spaces stand out in pdnssec check_zone * GCC 5.2 support and sync boost.m4 macro with upstream * Log answer packets only if log-dns-details is enabled- update to 3.4.5 Bug fixes: * be careful reading empty lines in our config parser and prevent integer overflow. * prevent crash after --list-modules (Ruben Kerkhof) * Limit the maximum length of a qname Improvements: * Support /etc/default for our debian/ubuntu packages (Aki Tuomi) * Our Boost check doesn't recognize gcc 5.1 yet (Ruben Kerkhof) * Various PKCS#11 fixes and improvements (Aki Tuomi) * Several fixes for building on OpenBSD (Florian Obser) * Fix several issues found by Coverity (Aki Tuomi) * Look for mbedtls before polarssl (Ruben Kerkhof) * Detect Lua on OpenBSD (Ruben Kerkhof) * Let pkg-config determine botan dependency libs (Ruben Kerkhof) * kill some further mallocs and add note to remind us not to add them back * Move remotebackend-unix test socket to testsdir (Aki Tuomi) * Defer launch of coprocess until first question (Aki Tuomi) * pdnssec: check for glue and delegations in parent zones (Kees Monshouwer)- no longer ship dnsdist here, we will ship a new package based on the snapshots from http://dnsdist.org/- update to 3.4.4 with a fix for CVE-2015-1868 (boo# 927569) Bug fixes: - commit ac3ae09: fix rectify-(all)-zones for mixed case domain names - commit 2dea55e, commit 032d565, commit 55f2dbf: fix CVE-2015-1868 - commit 21cdbe5: Blocking IO in busy-wait for remote backend (Wieger Opmeer) - commit cc7b2ac: fix double dot for root MX/SRV in bind slave zone files (Kees Monshouwer) - commit c40307b: Properly lock lmdb database, fixes ticket #1954 (Aki Tuomi) - commit 662e76d: Fix segfault in zone2lmdb (Ruben Kerkhof) New Features: - commit 5ae212e: pdnssec: warn for insecure wildcards in opt-out zones - commits cd3f21c, 8b582f6, 0b7e766, f743af9, dcde3c8 and f12fcf7: TKEY record type (Aki Tuomi) - commits 0fda1d9, 3dd139d, ba146ce, 25109e2, c011a01, 0600350, fc96b5e, 4414468, c163d41, f52c7f6, 8d56a31, 7821417, ea62bd9, c5ababd, 91c8351 and 073ac49: Many PKCS#11 improvements (Aki Tuomi) - commits 6f0d4f1 and 5eb33cb: Introduce xfrBlobNoSpaces and use them for TSIG (Aki Tuomi) Improvements: - commit e4f48ab: allow "pdnssec set-nsec3 ZONE" for insecure zones; this saves on one rectify when securing a NSEC3 zone - commits cce95b9, e2e9243 and e82da97: Improvements to the config-file parsing (Aki Tuomi) - commit 2180e21: postgresql check should not touch LDFLAGS (Ruben Kerkhof) - commit 0481021: Log error when remote cannot do AXFR (Aki Tuomi) - commit 1ecc3a5: Speed improvements when AXFR is disabled (Christian Hofstaedtler) - commits 1f7334e and b17799a: NSEC3 and related RRSIGS are not part of the dnstree (Kees Monshouwer) - commits dd943dd and 58c4834: Change ifdef to check for __GLIBC__ instead of __linux__ to prevent errors with other libc's (James Taylor) - commit c929d50: Try to raise open files before dropping privileges (Aki Tuomi) - commit 69fd3dc: Add newline to carbon error message on auth (Aki Tuomi) - commit 3064f80: Make sure we send servfail on error (Aki Tuomi) - commit b004529: Ship lmdb-example.pl in tarball (Ruben Kerkhof) - commit 9e6b24f: Allocate TCP buffer dynamically, decreasing stack usage - commit 267fdde: throw if getSOA gets non-SOA record- update to 3.4.3 Bug fixes: - [commit ceb49ce] pdns_control: exit 1 on unknown command (Ruben Kerkhof) - [commit 1406891]: evaluate KSK ZSK pairs per algorithm (Kees Monshouwer) - [commit 3ca050f]: always set di.notified_serial in getAllDomains (Kees Monshouwer) - [commit d9d09e1]: pdns_control: don't open socket in /tmp (Ruben Kerkhof) New features: - [commit 2f67952]: Limit who can send us AXFR notify queries (Ruben Kerkhof) Improvements: - [commit d7bec64]: respond REFUSED instead of NOERROR for "unknown zone" situations - [commit ebeb9d7]: Check for Lua 5.3 (Ruben Kerkhof) - [commit d09931d]: Check compiler for relro support instead of linker (Ruben Kerkhof) - [commit c4b0d0c]: Replace PacketHandler with UeberBackend where possible (Christian Hofstaedtler) - [commit 5a85152]: PacketHandler: Share UeberBackend with DNSSECKeeper (Christian Hofstaedtler) - [commit 97bd444]: fix building with GCC 5 Experimental API changes (Christian Hofstaedtler): - [commit ca44706]: API: move shared DomainInfo reader into it's own function - [commit 102602f]: API: allow writing to domains.account field - [commit d82f632]: API: read and expose domain account field - [commit 2b06977]: API: be more strict when parsing record contents - [commit 2f72b7c]: API: Reject unknown types (TYPE0) - [commit d82f632]: API: read and expose domain account field- set $LD for now. this fixes the configure check for relro,now.- remove custom PIE handling. upstream does it for us now.- update to 3.4.2 This is a performance and bugfix update to 3.4.1 and any earlier version. For high traffic setups, including those using DNSSEC, upgrading to 3.4.2 may show tremendous performance increases. A list of changes since 3.4.1 follows. Please see the full clickable changelog at https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-342 - move man pages to section 1 to follow upstream change- disable botan and geoip on SLE_12 because of missing dependencies.- Fixed broken _localstatedir- fix bashisms in pre script- update to version 3.4.1 Changes since 3.4.0: * commit dcd6524, commit a8750a5, commit 7dc86bf, commit 2fda71f: PowerDNS now polls the security status of a release at startup and periodically. More detail on this feature, and how to turn it off, can be found in Section 2, “Security polling”. * commit 5fe6dc0: API: Replace HTTP Basic auth with static key in custom header (X-API-Key) * commit 4a95ab4: Use transaction for pdnssec increase-serial * commit 6e82a23: Don't empty ordername during pdnssec increase-serial * commit 535f4e3: honor SOA-EDIT while considering "empty IXFR" fallback, fixes ticket 1835. This fixes slaving of signed zones to IXFR-aware slaves like NSD or BIND.- only enable geoip backend on distros newer than 12.3 before the package lacks the pkg-config file and there is no fallback to finding geoip without it.- fix permissions of the home directory- enable some backends that we had forgotten: - pipe (main package) - random (main package) - geoip (new subpackage) - new BR: yaml-cpp-devel and GeoIP-develobs-arm-1 16009535584.1.8-bp151.3.9.24.1.8-bp151.3.9.2libremotebackend.so/usr/lib64/pdns/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:13121/openSUSE_Backports_SLE-15-SP1_Update/800bb5e90984cb5e1dd903a4d61773d3-pdns.openSUSE_Backports_SLE-15-SP1_Updatedrpmxz5aarch64-suse-linuxELF 64-bit LSB shared object, ARM aarch64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=04e41b6303711d31179d14cf0960d547a94de3b8, strippedPRRRR R RRRR R R RRRRR Xh̤Iutf-81fa56d7b204a16047f6684f83df3834a8c74a452ab5982e1aa6340e6dc863a75? 7zXZ !t/m:Z']"k%4960E<$#]CY_2IJx;%=iJ4&e^!rI)hbG87DtQ ,׾Jfn)(yf뿭xږd.([iV򔖋F򿆅rH݋d ?ezZbxEDv-S!VѴK?˺9Θl.CocKr *$.kwXN\> 8tz/yRR+$9TWf ̩ӡ$P2>x)(Clj+ZT~Ү*vX%9Xadjg )Վ u c 2b^lU5||6'8O VUt(ѠHfP)y!YN<^'ϭ2g5/y~ے\η[45~_&HR؊si^:R_R6UҗӼE.xCE^ԉ ƎY &ʄajW 7ixzgZJ[<@8u:P٨Vt%\Ig}Mmi27ߏ\%͖(VH5A01=G{.B)y%CQ6z u7%7p?~2ics6r0"VvP3M¥!nO( HLw4@7f_ Dfi^Qu4WflOBIyA\gհ,-#;^'-@ 萑,q*n@/!iؔmK~|Ig=x %WrjcP(HjA1v k:%i$en<+mAG5@z@j\sa>DKCUׅi`̻]s甆g*ęz0SVՙNg}`kЇO s9܂DmVv)֦=v^ `خ DɸkFD+t[]n&ZdX c|hA7 usgvkʎΧYVgO{ ?z2 ,Z\9˗hP!dN:tЗJXq֌l𬏢N =ڲᛠAt-l!ȹO1scOpˑmSɽA;Y?V%`ŗɆcTl=foN*_s˝C:2 Ѻ񲉺Di)˃hqZ"=&4Nh6PmϚ,g ZʩXlL6a[H]{5,h 8~Y沽`Ŏޯ 8&GAߍ\ 6)OՆ?F_3)cyܳv40pѻ_]UZVf Ի _S|+/ts#y|l[v#4 sḞg\+aE͓5ϰf|ZOF4·0URr)h1) < rv#ؙI=P{;:O3 _ O~Q B$!dLkÌt&) <'n7}ZV6t.ZjQ%״`:)׭SEp)h͍@")WԏW~>}tNI&;ɊMD$+xSþU龉2EP49 -& Ȳ~]TIJgO>Ԇ[ٜKm0J [eEj-`-Փ Ev20~T5]CVP20'⭷J|%l^l0) cqXT\k}_-H88kvw279яrZ0$ sSI!I(C|S/,rtlQ3TX`Ei?OR U+[z!B*\'~p Vs>~bJ;jsn;e -fjәRWC8{(u )R!66Ӂ3N6[~rf&!EB[vj#BI/ߙicw~jcʍDAt MtA Qw=k(zlpM2㽣ɽr##'fM7Ĭ, il{$Az[2*nHM8醹?1tIb>ȩM=ϽYئSX.7[q+ԃs*sز@7dOλ:#ZoN^))Xſ@hDYqHR9<~t63!-B{n6= lfЮU-Uh1Lmd[!CZQ1α<[h5H-i7+Je] =Hk2|}0"KSK㈟T5`C+K<*tfQ$y94ЦA 2轚K^f6Ihqw izn"=jOUκ9Ac O|?_jw Shܻϱ>u{:T1\Ο,ӺԊB]*" ~|3D9ݕku,Ŝؖ/[? ά{7 ^>B 'oOd$ǤHsypwo٢۲΂,h#NDZyP3}cMNi+:]BEXrWQWJ8El(D\rH|aҺ8}9ۭu]jD":S>)FGB9?4')9y\*? 4p;lh{WpLVKw6/-۪ AdZ4ϜAmppO`-#Y0u-L=6Jªg4xJ&bdjW$bڳQpn/T"\JO#rZGdep5-PC1 b~˪lcXRi|]@#]OzNQH}_L눙] ^iϺV1cS1X/>9Kp;z!ϼ!CLM\>x"E5Hasʳ^#a1>N;S1Nd +X4` LZa ?jٟm=lx5ѽU*{mb /1}6G't9C N8SD0{jc[㬕O缢)x8W4͠J4m5%*MqlOP"h q- łLHG\FùKFv=~wi򙎳՚[PىELN٬7hc#费 $ `[}ˊÞs WD62X `9ưu6bD@Pޛ$*,so5 >X,'BF ^\w諥W;axf=dhHb  R *Sw|% Vf)Q(2XoflFH1^TUKؑfOZܴ{ekPV("2+Z,Z W|$ZFKrfw!4r#m)LV*P(@(T$c[3 @*kfӭS.jMG[qfea-z*vL9 v*9/)lJ'Uֻ| 8؝R@?Ae]߯./PW uH6bHX@]?e σphikvsjwzKJ߮4EGv-﹊{7`r U >?x-EV_9dVb7r߆9pe~%W~Oҫo1`׽M\BcWr]'$DPD44Y[?D℮s0dy]rP*Riw&O:iyoE*(NSTkogK}rV #WzRTۮh[!>NJEf Wq|!Q g0$+S}i*ިn)uiUh'iRwi+ Z$Ԙ%ZcUܠ|~б=t8jBNCfTދ'"Ir47/Q^jdW?'մ';Dq\;<$*9DT6>ry^/d 2VE<)4ڡqoi4([T,gAJ *'(Ya/EJk-J+_'Lr︃>D1(BuuCFbIYk| 5?Ca;$28&f9W HivO܋U޳f >i\qBy6 yݠ(9_+ 2rm2Vq~--Lnʀ&uGVmXgRdx?=* ,|`+.#ݥ PZSh8 1r82(GZmSzvx؋hzKEh;>,ߡd6蒶FnyztӧctI\W~ y_Wz~6ȼq"Ldf%dCH/b98Ģȗj&u\C8c0*bջ41%t݆L!a=^f^,ml5 r AVo\\\ynͅmf$8`=R3z؉6^{rH.54dw+> ^BxKIA7uhN7g9smCڅݻ$tgC'=ܾ{K") _3&i@r;Ԭ;ōчz z(y7Ʊ[;"bB h 'ݑb@ ^:@,t)tX܉(aCb.A0@莈|]JjA9ԝ~!6_ 2z]5} Y%Ngfv )}nJ.XEFJ#'83_GaGi{ UYKtK粅k14*q=2oCeG׷j(aI!Eɞ;|BjR+2лa;(.o1L"O)ATkT! hćoF$^*KkЭؽs}}CK׫$M _5tHP +7^)~\cYw3~:]lqB!}W' C$.&hyIC9ȜHTE|u<+RONڒJe;=%@jӷx~t}6{vT#& [{t}]j-C>:!b?$Ԁ[Шhj"nYa6v}5YPG/mLބ/0GI2o( 1I#BO' 좄i U=.!dw:eJ3IDvuAz6=! =YRHWzSUjN uwҺC@M|V(CCY&Z: *EG_p]VvqÖI8VYQHA^Ii`ga1r77U\d"RR7F> wt܂ȥրyCmD$9+#Z5itoTdM Nްqa<R>Ϧm>tV_%m0 YIW/'\Dic0Dqlt[;)՞Ey8ױ>M-"r⁛+%M7&ǂ\ipUYjfhsDž)qO..d4B$x2^N?8ӗ sÍ0G4sRY.<|0S 8pU@h  }2˝,rv0Fp1CYDwY+NɈ}h݌/rj> )aXs8oI7mJ#E@ ,X+kUPuAڧ] Kwxa-?x(bY+Bs *J!P& mc7TǶKq3K SWGZBjqQi/eTN  HiuVϓs@#k )W绁.57¿3ed>GAE,Zz]t A#]Lxd-@@jWI:czʆ~!I"6+F,c <otˤ07h_6m/+[ݯuF J?U"mfV7 R[kzTLOk!R3<)KI̅YV"(.Q@ŷOx`񤐺85Jy w)뿞Pψ|㿻O <';RiȼRSmU9?L`iDrSGDCvd*4;:\6-adͯ<|s2[R7 puі41W=x ]'m_d$-r]\Wqv4dS3I7?_UBҵ-U~)ʫM;``b =fO[8|Nʛ̧-MSvw>gƒ۱CV]zXyK%N~Et$)QYjosWuNs-?LJ;7X2￴gpH暄\'mU^Y#d "rG.f2*ω eѶ \YTp!d 3܍%m["cnөNw} H}DjW j.w: R4Z~e6nJD#^Lj 4[ .RwT@ '~`5P8.zif!B |Ý+H;wAHb67\ |I0<C} zcFzuox0F+9: Dׯ!=)H j_]Th`ufe|6oc:Lу̹y-S=G{dW鶜ऐ@f{r[ن 8yT{2fi&SZҩBu)0[y얱T>|3AB ެx@RUj!b:}(ę'UR>:?) x` 2e]`A?eLl] W>>zCW"|y 3ІL=nS xe:^D~F:G1os $O]r*j\CֈsĚu)!xmрK*FcΖ'[H.Yʸv ouD[?{Q\\+Ʋ2d"Pmrҭ:OU\$JKK|RԦן@|Xܠ?d")TJ%m\b MX}{/F P5w՗G}(г?1Qʺ~dDBxcW}$n]GqK|R)_>#]6IVGWD#uq[L@B XAYn&n(Gs(O9(#{d$ 6jjw}0XL\^kX^no)k dŹ2s(:Y zuTTR4}E64:B!kem0_&[ٶ.ɾ²LbRtc:1V]e1VƢn3a3:pڍS_ժC!,&_WKo2MlW͔uJؚWt:1[,1hҎ5hIU8 rȺ),uds 'BtOU#Ny_RÈ&OC]8%LH?/b>K/pKȦԭVSgSRyܴHnnx693O]b<7z4+$HKh?B/ay<|pi~JRZߖFH_/ꓲ ׷$ѳg%ɡ}d; Ԩ1BXRM+6ZmwA `aZZF fKb|Γ!qj'ElI>>]Є)Ű@hmtEͷ6»@5NYzߚo˖e;PTevqV[q~ E(P]yN>c&)n"+>s5'R\Ř`;ԩםecn/F,wg~ahW42 FI #z-A@'| ",wUV\ћa 9gy~y1'x线܄XTᓔ;Y7Gi ٽ~X}݊nfJ}.A)QVwK -U%"Ʋq@VË+; eMpO6}'i,y\aKiw47Xx~(Oj P$?={`h^푼0K&>}mŸ"IcL ~,0͗_U|26\MqJoiUnxXdkXei7N$ "?uUZhDc]]d(͆3 /&Al l[)!$#ݎ7ȫrAefPEʫ}'٢ʜGeD #jT?X.慯|H8%qw=/FHֽHó 2I0 U4r6v ?[1љ_##% -_yRj!g>m#W~\mӦm=b/&;rLfqTTƗUmJLu|8jB Orq_.$HUEunCV U^z7ϝJ.lUhwK0TPm!AlHj4 .Q;Lj rf4mlCB!#΂1*E9Oכ>96}2ޑj̥ᶏ8X&;aq:W/Ch35CjEe\Ea,vdadJ`ժCJ3wfW^3rjsSI:\%xpb7)B0(DS鵋}̼SY+43=XmYwsAУ Z0!S:)0nrPI)-=8}wK0!\dꊦ*?cVHA r·?4͑>Q4tf;~ a! /H1@&BRi ot ?mq$0Ji`5s9#l=/WyKrO't+94jWB̊JXof[Hif~GK ,`ԢgK%W#BnЍ `qCj=śp,"fg8$ JͰ"KzV .1(+-o4ds K 5Eq>^/=V(:h %{U~҇ >>Pޅ֐GUdq!κYTۛQLҔm j,@C= [o}^&l%OIU\A(L@ DTibQPVh>w!=Z* : T6< Si7JD3ͺb5A5*e 0j ڠvhݶ1>QTiauLqYlC_ i9b 6B0Fn UK D"VCwcVTK,*6b:d&\_ Ki:%{{+c.f1<'gXH^[h tLV{>\WPoo1dI{m#q}IC9~a'Ჳ2+eJ IABSW;NsOǎsR׸bZho:8F jU;J(mm3/R_զwf*;퉚(!ӷu2)'[JPD[^i%0 وnp&`!uQʭ,ݰYG$ٝ5+Z\Br}>rkU}֗9 fQ ^ˢh!*jFa3L)N47mlԤfys0V(xľi&txܟJqа{=5Q1r&0C", p8W- '2zکֳRkVv4:HC4ܤ+SC| m<&af[ũl2ӭUfym'lɢrN+UV81^ ~b@u*] Fj/UG&/P4,,%R,`1iA ~9v 8a :qR?ޙIư"2h%f!#]b݌HgJAqdz*MMdm$;bMv-:)M6DgK/0juֶϥl4{=s *2 5Nݽbd'yW®"Y-z\pMClMwȚL;@~MX:K -hKwlɍ)D+H 3cϥ9=eDB?p ߀;_D@ "p=+TbjO3a*Jh]@s.}1㛥%Q.:*0OKT}\iLZ0$q-| SQcvcu91ZJt%լql߂cz4 +ȒG msgAhV3re|@êpGk 1GE z:!ő+ߚKmB3 fnq?q%EM"mLD>8KLjd=R CG!uD}(a iw3NYt* 37yYSԯ.j,MX<~銲 S@&7 ]*19^gh6rb[U/bKItOl ]p'xgsuBd[4qnDQQ@Wt^|~FvhJg|x" 7_e,TLyq8]9zA y2qQ W=μn+)}Ca̹1ӌL4~~K*<_[>- c{GM9D28ae%GJ' YDp`cYZPy}D2<6]J5VkSs*5;L,ԷcW*$/zvxې4=.YhU#Gl+y"gx27/(S'ZiyM&p7#wo~;H$VwZth,*d ) y!+u"[,sPJ>'{mtp#`gugo/HL:(eH+=s%>I Y7Q;br<3SJ'6ʼfO _1Wzw#N.n5qT幻_afbXuP鞙8x뫬ճbKr'T#;.SH婥S %RlRm>.qg.D߻@u~"8 #)0{7V s YΛ~ۏb6NWקۢtFc\#s&ւr:%(nT6);N5Ì9jzv5S7uӝbfBm/@Vuвt!:{w  &R=B7_ Z ~㖅3(e؈$` &]5=/r"z~]ğO5#L HUkLxG5]DdG I )o%S`٨{PeF\m-x`;K+fw<<>1^f\kK-t#t5)01{ݢ,Tw2g]@wm9ѕb,hucW?X"mt(Ryk8%1@T(MdsO<+=[KVuJӐMҥc}ȷ3t($raV+^ă%tK%|ܻw J5 ^[kp|\8iyq@5 bXSN>daTВ8k]69c"=͌Rlu$⸵$If&E$z'{O Sz.=j{h#3.~Zf# Ant di3nje r5mNZ19 N7>#縢֬1Y U&dqG:g@QF+.x[H?D&@\ˋ]&PΛ]½xF\ O47yҥ;=G*C(ܿm t 4+O=4}ydlnaEV=.#G^L[ G'@Ff2צfRJI p&O\`[g[8Jf0ACd 1LJAE`#"zo<Ʌ |#v¦?J[ٔ2 e+Y0𫜏a@lc01n =(EYF ں)1#k:*YW%"7dQդms ey(q#0nt)C(.V@UWt>:$7 ɇô=WaUa&ӴֵUk z~}-ћpe@nr=/ l_ ݥ7T*^Ho;I$95lgu/~p t햮x[R 7W}J%i2پ_J6,b)utуP8ԝl D =Ml aM-&;(@ Cz$L,D ϯy(M%"f;s&^>x>:+<2˹_p!aEˍhőa @ҷrӈuR 9ȜXHJm+rB0՛y8-?8ΛoXq;0tDQ>;@S {/&UZ0tvvZ8M0\V5E\PB 1r7Sňc7OqŴfK :nC %F>S r1ߎLI OdܠV_<͑`t(9$yzKUG_u'yLqaߍ#gZ6(@i &53lvO_|\فsYaj(KVe~^ qN1F=d )AR}7PDk8?caBՈNA=RŘ7PR>is;Ɓq RWCby=*K+I1 (ǻB,C$1[aaܚiau'"e9:}(Y !.<P|pƥ6Y:i}c8VUkR:4{lGO@l<דXZd%s߷k<ueqq{ԑ,m ͍  ^xH F'fLWH23VS4 +&"8g먑hûRR%+%ǧN65F.CGa"kWڕś7j!<JU݌ 0]!)_FT*Ix5 1VivD N)=P+L*Sk*~<Qo@D FZJK3J@"0(RFuUD63bO"RMۘ!,&PB:/8aE+wt;(l +εڡnlLt Һ.Hܨa Qh/YܦRIg1>cX޶ ]圡 PǦ@rUIPB9fF_ @4&冀 5/iuthbtb7j+!h@1oxC@9Pp blC$Z)p&sje7[ :p'b)9uCµt-ߩx+@j[R!xa0mÝ卙ˏ<]K@4p(nY{pv}(C "TEPWz ٕrTVp.76/~J}C٨>a/ÿ#TA;zr,&`WOGh:/_@8(m~M#BUF\2^#5cūvO~ .jrR8&E>/)Bc8SPkS~ypYrw}0ׁɆSb$\:#m/[ >e7[uFS-1"&S@QJ&*Ih2Z1fau09.hU"^. )8e`yXUū΂kHF +\1 ܝQi %"g6Ҭrc=4JJv-&LΪGƫܰn3hnDhw>JLhviօLl5fvqp̺y$/9Pm`q,4vksg`w1⪯S q+9TmIm5ЖDx!UAT9?N  V:`fw>6`Brj8Jt,p \ގ*vA\d4paYi]wUTӆ,>E$7ՕTc| Уmezzc^/@}+Z5q;NWZv#68+5ʥ@ Ziw!@A[Yg<"+H`&uХH{&uha0vyݎbY&b3lkf'ar -:ن5F\؂qBև":5ct?ehl4sF^~ކjd5 R]rw?D nU={D*ĵTr=7eS&n+.x$[ T2јlD E)f3UrF{! YT/;"2XL-WJ諶ӣ-rO0rk + B첥M _F':V,v*-wAR~{ӎ9ogl].Ĵ2UH>7[rY؎e0ׄEFxD0rѕ`}cSqiӪ놱x/8~ξo;Qeۜ~}\(FjK=2+2U)HMv"E㾲f;HFҖݺ{Q7B@3.*n}ƣ}CQ9PY7RUwAR|Ӂ)@e]nYGkwg'KafQŻbپl7A?/,?m(f|W30K8BPrG+rP@<5_&/tn[!^)+7_ajgmWR=.FS7œҔ arGiGg+ƀ% HunlGmz7#{I `rIƒ/gIf$ | 鶬(ߨ;A:b0 XCC/<)Bn_!Q.]y`s(X3ZGYiMUJ`z /' ^N|$VmŊ:E.Pdv񇖳4!_=Ը 1j,ڨ߽x_ RXn[Fr= t}5]3A4g۔!N _OC/+-0}:L"1̸<Ɗ&<y+ ء4|MG8~T/Z8f*v=v;^ˀ'E欈<'ʆ(MMmvL>TvkUƙYqa|J?ɣ30z>4L֡#_sJQ/KBV?,Fx],gsaqQ^ 3}緐 jLU*pjKooΗ|Jse'Rl=(=W&JSsz.A,O"ŇĹf0W"P5J0\&ϩQw~޽-LkaHT<g2t.Y uk|d >kqmD 1=&JW!kJ$jIV6 +ٷX\;BUWJN9T0:~t WRQ -{<5.UY)wTó$,$Xk4P "i*=qaیϕ.BO1ssؖ{6>/%*1491g97D,6.^Rj"a'  W+`Kˬ_ikuB-N­tyo5pkBpbC2p{a,.k\FZ XE[}n\~XQ WPK)鑚塺J+]BВ <|y;B}),"8M#Z쯗69筰/jboawUg$E׫\P&b`r]?)SH6`%riH72/E4z|4qkMXU"'I5< |%F}]KgQ$d!8G&7Kh3UJӱ¡補_Zġe_R@=,󮍔;0l:%'bް/EYpv Z쨔j/J, r\.;[4|PtpcB_-) U-j q K9HmGkH۴r# YZ