kubernetes1.23-apiserver-1.23.17-150500.3.18.1 < > , $Ƥ fap9|: }nF~*mVȒqd|IW\\p$g+A?d|'_5t+hIcmh7.ǍBJ49 *HHV;N)\C!ye|YS37? 8(?xrA;1P8u .?J@O eYLǻn5oxBCfZ+O ,cpA$SW1KAOz@L !+ > > N ? N d # 1 Z ! 8 > H d r
+ N | g ( 8 9 : F J0 G JH H Jd I J X J Y J \ J ] J ^ K[ b L c L d M: e M? f MB l MD u MX v Mt z N| N N N N C kubernetes1.23-apiserver 1.23.17 150500.3.18.1 Kubernetes apiserver for container image This subpackage contains the kube-apiserver binary for Kubic images fah01-armsrv3 piSUSE Linux Enterprise 15 SUSE LLC Apache-2.0 https://www.suse.com/ System/Management https://kubernetes.io/ linux aarch64
; ,^ 4ÁA큤A큤 f`faccfacfacdb73303c37276c769beb0330bdfe5be30bbfaba0ffee847c63a91f38205cda0 639af1c94c39ded3a781d1f82c7075b6af898b7bb6d284ea0313278568c54231 8b6974720f4fb31199e971a20a4a21cf3987708b6dfa6a0a1f4775e381b970ee cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30 518b22c45aa44868a823299ec6454a3fed2806300dc803046faf3ef95062a9cd root root root root root root root root root root root root root root kubernetes1.23-1.23.17-150500.3.18.1.src.rpm kubernetes-apiserver-provider kubernetes1.23-apiserver kubernetes1.23-apiserver(aarch-64)
rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 3.0.4-1 4.6.0-1 4.0-1 5.2-1 kubernetes-apiserver-provider 4.14.3 ff@f@e}@e7@edd@d6@d!@d!@d d b֜b֜b֜b֜b֜b1@b a@a*@a@priyanka.saggu@suse.com priyanka.saggu@suse.com priyanka.saggu@suse.com priyanka.saggu@suse.com dimstar@opensuse.org bwiedemann@suse.com priyanka.saggu@suse.com priyanka.saggu@suse.com priyanka.saggu@suse.com rombert@apache.org rombert@apache.org priyanka.saggu@suse.com priyanka.saggu@suse.com jkowalczyk@suse.com jkowalczyk@suse.com jkowalczyk@suse.com jkowalczyk@suse.com jkowalczyk@suse.com rbrown@suse.com dmueller@suse.com rbrown@suse.com rbrown@suse.com rbrown@suse.com - Fix for bsc#1229008 (installing kubernetes1.23-client also installs kubernetes1.28-client and kubernetes1.28-client-common)
* update `Requires` in the "kubernetes1.23-client" pkg to:
- `Requires: kubernetes%{baseversion}-client-common`
* Remove following `Obsoletes` from the "kubernetes1.23-client-common" pkg:
- `Obsoletes: kubernetes%{baseversionminus1}-client-common` - add new security patch to escape terminal special characters in kubectl output, bsc#1194400, CVE-2021-25743
* patch file - escape-terminal-special-characters-in-kubectl-112553.patch - add new security patch for bypassing mountable secrets policy imposed by the ServiceAccount admission plugin,
bsc#1222539, CVE-2024-3177
* patch file – bypass-mountable-secrets-policy-imposed-by-SA-admission-plugin.patch - add new patch to advance autoscaling v2 as the preferred API version, to fix bsc#1219964, CVE-2024-0793
* autoscaling-advance-v2-as-the-preferred-API-version.patch - Use %patch -P N instead of deprecated %patchN. - Add kubernetes-sort-custom-column-print-flags.patch for reproducible builds - Security Patch Fix for CVE-2023-2431 (bsc#1212493)
* added patch: fix-seccomp-localhost-error-handling.patch
* this new kubelet component patch returns an error when a Pod or Container's SecurityContext has a localhost seccomp type but an empty localhostProfile field. - Security Patch Fix for CVE-2023-2727 (bsc#1211630) and CVE-2023-2728 (bsc#1211631)
* added patch: kube-apiserver-admission-plugin-policy.patch
* this new kube-apiserver component patch prevents ephemeral containers:
* * from using an image that is restricted by ImagePolicyWebhook (CVE-2023-2727)
* * from bypassing the mountable secrets policy enforced by the ServiceAccount admission plugin (CVE-2023-2728) - add kubernetes1.18-client-common as conflicts with kubernetes-client-bash-completion - Stronger conflicts for completion packages - Split individual completions into separate packages - update patch files to reflect upstream registry changes from k8s.gcr.io to registry.k8s.io
* kubeadm-opensuse-registry.patch
* revert-coredns-image-renaming.patch - Update to version 1.23.17:
* Release commit for Kubernetes v1.23.17
* releng: Update images, dependencies and version to Go 1.19.6
* Update golang.org/x/net to v0.7.0
* Pin golang.org/x/net to v0.4.0
* add scale test for probes
* use custom dialer for http probes
* use custom dialer for tcp probes
* add custom dialer optimized for probes
* egress_selector: prevent goroutines leak on connect() step.
* tls.Dial() validates hostname, no need to do that manually
* Fix issue that Audit Server could not correctly encode DeleteOption
* Do not include scheduler name in the preemption event message
* Do not leak cross namespace pod metadata in preemption events
* pkg/controller/job: re-honor exponential backoff
* releng: Update images, dependencies and version to Go 1.19.5
* Bump Konnectivity to v0.0.35
* Improve vendor verification works for each staging repo
* Update to go1.19
* Adjust for os/exec changes in 1.19
* Update golangci-lint to 1.46.2 and fix errors
* Match go1.17 defaults for SHA-1 and GC
* update golangci-lint to 1.45.0
* kubelet: make the image pull time more accurate in event
* change k8s.gcr.io/pause to registry.k8s.io/pause
* use etcd 3.5.6-0 after promotion
* changelog: CVE-2022-3294 and CVE-2022-3162 were fixed in v1.23.14
* Add CVE-2021-25749 to CHANGELOG-1.23.md
* Add CVE-2022-3294 to CHANGELOG-1.23.md
* kubeadm: use registry.k8s.io instead of k8s.gcr.io
* etcd: Updated to v3.5.5
* Bump konnectivity network proxy to v0.0.33. Includes a couple bug fixes for better handling of dial failures. [Agent & Server](https://github.com/kubernetes-sigs/apiserver-network-proxy/commits/v0.0.33) include numerous other fixes.
* kubeadm: allow RSA and ECDSA format keys in preflight check
* Fixes kubelet log compression on Windows
* Reduce default gzip compression level from 4 to 1 in apiserver
* exec auth: support TLS config caching
* Marshal MicroTime to json and proto at the same precision
* Windows: ensure runAsNonRoot does case-insensitive comparison on user name
* update structured-merge-diff to 4.2.3
* Add rate limiting when calling STS assume role API
* Fixing issue in generatePodSandboxWindowsConfig for hostProcess containers by where pod sandbox won't have HostProcess bit set if pod does not have a security context but containers specify HostProcess. - Update to version 1.23.9:
* Do not skip job requeue in conflict error
* kubeadm: fix the bug that configurable KubernetesVersion not respected during kubeadm join
* Bump cAdvisor to v0.43.1
* Fix: filter out unsatisfied nodes when calling AddPod in PodTopologySpread
* kubeadm: fix the bug that configurable KubernetesVersion not respected during kubeadm join
* GIT-110239: fix activeDeadlineSeconds enforcement bug
* fix: --chunk-size with selector returns missing result
* Fixed winkernel proxy failing to query v1 endpoints created by dockershim CNIs
* Winkernel proxier cache HNS data to improve syncProxyRules performance
* Update CHANGELOG/CHANGELOG-1.23.md for v1.23.8
* apiserver: printers should use int64
* add missing error handling steps
* add missing error handling steps
* fix image pulling failure when IMDS is unavailalbe in kubelet startup
* fix: exclude non-ready nodes and deleted nodes from azure load balancers
* Avoid updating Services with stale specs Fix the bug that service specs in servicesToUpdate may have been updated by clients.
- Require only BuildRequires: golang(API) = 1.17 pinned Go major version.
Remove potentially conflicting BuildRequires: go >= x.y.z.
The plan for future updates is BuildRequires: golang(API) >= 1.17
minimum Go major version. - Update to version 1.23.8:
* Revert "Automated cherry pick of #109124: Winkernel proxier cache HNS data to improve syncProxyRules"
* test: update graceful node shutdown e2e with watch
* move the ignore logic higher up to the reconciler
* Ignore EndpointSlices that are already marked for deletion
* kubelet: Mark ready condition as false explicitly for terminal pods
* agnhost: bump version 2.39
* Update Go to 1.17.11
* add service e2e tests
* kubelet: add e2e test to verify probe readiness
* kubelet: only shutdown probes for pods that are terminated
* kubelet: Pod probes should be handled by pod worker
* Enable resize feature
* Reject proxy requests to 0.0.0.0 as well
* ipvs: fix prevent concurrent map read and map write for 1.23
* cpu manager policy set to none, no one remove container id from container map, lead memory leak
* fix audit union loop variables in closures
* Updating e2e test to check EndpointSlices and Endpoints as well
* e2e: services with evicted pods doesn't have endpoints
* e2e test for evicted pods
* endpoints controller: don't consider terminal endpoints
* endpointslices: terminal pods doesn't receive enpoints
* add pod util to verify pod is terminal
* Update CHANGELOG/CHANGELOG-1.23.md for v1.23.7
* Add test for checking ephemeral volume expansion
* Fix resizing of ephemeral volumes
* untangle fix with healthCheck feature
* Winkernel proxier cache HNS data to improve syncProxyRules performance
* Skip updating Endpoints and EndpointSlice if no relevant fields change - Update to version 1.23.7:
* Fix requests scope classification
* Update Go to 1.17.10
* authn: fix cache mutation by AuthenticatedGroupAdder
* GCE: skip updating and deleting external loadbalancers if service is managed outside of service controller
* Wait for cache to sync in job's TestWatchOrphanPods
* Fix OpenAPI loading error caused by empty APIService
* Test Foreground deletion in job integration
* Fix removing finalizer from finished jobs
* Don't mark job as failed until expectations are satisfied
* Integration test for backoff limit and finalizers
* component-base: replace url in rest client metrics
* fix broken find command
* Allow KUBE_TEST_REPO_LIST to be a remote url as well
* Disable JobTrackingWithFinalizers due to unresolved bug
* Update CHANGELOG/CHANGELOG-1.23.md for v1.23.6
* Correct event registration for multiple scheduler plugins.
* kubelet: rename closeAllConns to onHeartbeatFailure
* kubelet apiserver: be gentle closing connections on heartbeat failures
* fix: race detected in TestErrConnKilled
* Replace hardcoded kubectl with kubectl.Name()
* kubectl: fix hard-coded value in zsh completion
* kubeadm: add etcd flag for member data consistency
* Fix a bug that out-of-tree plugin is misplaced when using scheduler v1beta3 config
* ipvs: remove port opener
* iptables: remove port opener
* azure_file: try to get secret namespace from ClaimRef
* azure_file: add namespace tests for InTree to CSI conversion - Update to version 1.23.6:
* Update Go to 1.17.9
* Fix: abort nominating a pod that was already scheduled to a node
* Fix the overestimated cost of deletaged API requests in P&F
* omit enums from static openapi snapshots used to generate clients
* Drop enum tag from certificate request condition
* Addresses the issue which caused #109115
* Add test for indexer with multiple values
* Reduce number of pods in Job+GC tests
* Adjust validation checks to pass for both client-side and server-side validation
* Remove finalizer when orphaned
* Fix: Clean job tracking finalizer from orphan pods
* Add test for Background delete propagation
* Add integration test for orphan pods when there is GC
* Copy request in timeout handler
* kube-up: use registry.k8s.io for containerd-related jobs
* kubelet: If the container status is created, we are waiting
* e2e: Wait only for the service account
* e2e: Wait for kube-root-ca.crt to be created
* client-go: update generated
* default kubernetes agent for generated clients
* Include pod UID in secret/configmap cache key
* Move kubelet secret and configmap manager calls to sync_Pod functions
* test: Verify that nodes do not transition to Failed while ready
* test: Add E2E for job completions with cpu reservation
* test: Add E2E for init container pod deletion
* kubelet: Delay writing a terminal phase until the pod is terminated
* Update CHANGELOG/CHANGELOG-1.23.md for v1.23.5
* generated: make update
* polish comments of non-enum values.
* unmark non-validated types as enums. - Update to version 1.23.5:
* Remove apf_fd from httplog
* Update Go to 1.17.8
* cluster/gce: update konnectivity image tags to v0.0.30
* bump sigs.k8s.io/apiserver-network-proxy/konnectivity-client@v0.0.30
* fix dryrun when ca file exists
* fix regression introduced by PR 100320
* Add unit tests
* Fix nodes volumesAttached status not updated
* Fix default config flags
* test/e2e/framework: include the new control plane taint
* kubelet: Clean up a static pod that has been terminated before starting
* Add an e2e test for updating a static pod while it restarts
* cronjob_controllerv2: do not filter jobs to be reconciled by labels
* kube-proxy: fix duplicate port opening
* increase Azure ACR credential provider timeout
* Updating EndpointSlice strategy to retain node name in topology until field is set
* fix: do not return early in the node informer when there is no change of the topology label.
* /test/e2e_kubeadm: adjust label checks for 1.23
* Ignore container notfound error while getPodstatuses
* Update CHANGELOG/CHANGELOG-1.23.md for v1.23.4
* Add PDB selector patch integration test
* Revert v1beta1 PodDisruptionBudget select patchStrategy
* test/e2e_kubeadm: fix matching UnversionedKubeletConfigMap defaults
* kubeadm: fix the bug that 'kubeadm init --dry-run --upload-certs' command failed with 'secret not found' error
* wrap error from RunCordonOrUncordon - Update to version 1.23.4:
* Update Go to 1.17.7
* Use serializable struct for x-kubernetes-validations in openapi
* Make JSON schema round tripping test more strict
* ignore CRI PodSandboxNetworkStatus for host network pods
* set secondary address on host-network pods
* Deeply copy JSONSchemaProps.XValidations.
* Ensure the execHostnameTest() compares hostnames
* Revert "Fix comparison between FQDN and hostname"
* service REST: Call Decorator(old) on update path
* add namespace in azurefile volumeid
* fix: azurefile volumeid conflict in csi migration
* Mark device as uncertain if unmount device succeeds
* Update CHANGELOG/CHANGELOG-1.23.md for v1.23.3
* kubelet: fix podstatus not containing pod full name
* Fix bug with node restriction blocking pvc.status.resizestatus change
* Fix regression pruning array fields with x-kubernetes-preserve-unknown-fields: true
* Set max results if its not set
* Update CHANGELOG/CHANGELOG-1.23.md for v1.23.2
* Update k/utils to v0.0.0-20211116205334-6203023598ed
* [go] update to Go 1.17.6
* fix: remove outdated ipv4 route when the corresponding node is deleted
* fix: delete non existing disk issue
* Revert "Automated cherry pick of #107554: Correct the feature gate string for RBD migration."
* fix containers order after applying
* generated: ./hack/update-vendor.sh
* upgrade sigs.k8s.io/structured-merge-diff/v4 to v4.2.1
* Execute sync before taking the snapshot
* Correct the feature gate string for RBD migration.
* fix: azuredisk parameter lowercase translation issue
* removed unnecessary log line
* kubectl: add integration test for result reporting
* cli: let kubectl handle error printing
* cli: avoid logging command line errors in more cases
* Fix header mutation race in timeout filter
* clear pod's .status.nominatedNodeName when necessary
* use node informer to check volumes attachment status before backoff
* When volume is not marked in-use, do not backoff
* kubeadm: remove the restriction that the ca.crt can only contain one certificate
* flake fix: remove the error handler for cronjob integration test
* Fix the leak of vSphere client sessions
* fix nil pointer in create secret commands
* Fix order of commands in the snapshot tests for persistent volumes
* client-go: Clear the ResourceVersionMatch on paged list calls
* Improving performance of EndpointSlice controller metrics cache
* fix the error when cleaning up jobs for cronjob
* Update CHANGELOG to add missing release notes.
* apf: ensure exempt request notes the classification
* Enabling kube-proxy metrics on windows kernel mode
* Update CHANGELOG/CHANGELOG-1.23.md for v1.23.1
* add gce loadbalancer no-op finalizer and existingFwdRule tests
* disable gce service handling if has rbs forwarding rule
* add ELBRbsFinalizer
* add gce elb rbs opt-in annotation
* cherry pick of knp 0.0.27
* Remove JSON logging performance regression
* Re-introduce removed kubectl --dry-run values.
* Point flowcontrol users at v1beta2
* [go1.17] Update to go1.17.5
* dependencies: Update golang.org/x/net to v0.0.0-20211209124913-491a49abca63
* mount-utils: Detect potential stale file handle
* Skip creating HNS loadbalancer with empty endpoints
* Add regression test for CPUManager distribute NUMA algorithm
* Add unit test for CPUManager distribute NUMA algorithm verifying fixes
* Fix accounting bug in CPUManager distribute NUMA policy
* Fix error handling in CPUManager distribute NUMA tests
* Add a sum() helper to the CPUManager cpuassignment logic
* Allow the map.Values() function in the CPUManager to take a set of keys
* Fix CPUManager algo to calculate min NUMA nodes needed for distribution
* Fix unit tests following bug fix in CPUManager for map functions (2/2)
* Fix unit tests following bug fix in CPUManager for map functions (1/2)
* Fix bug in CPUManager map.Keys() and map.Values() implementations
* Ensure we balance across *all* NUMA nodes in NUMA distribution algo
* Short-circuit CPUManager distribute NUMA algo for unusable cpuGroupSize
* Round the CPUManager mean and stddev calculations to the nearest 1000th
* updated deprecation messages from 1.23 to 1.24
* kubelet: set failed phase during graceful shutdown
* kubeadm: avoid requiring a CA key during kubeconfig expiration checks
* kubeadm: print the CA of kubeconfig files in "check expiration"
* kubeadm: validate local etcd certficates during expiration checks
* publishing-bot/doc: add component-helpers to the readme
* publishing-bot/rules: remove non existing component-helpers branch 1.19 from the rules
* Changelog: mention kube-scheduler bits deprication
* rbd: initialize ceph monitors slice with an empty value.
* Direct v2betaX users to migrate to HPA v2
* DelegateFSGroupToCSIDriver e2e: skip tests with chgrp
* Update CHANGELOG/CHANGELOG-1.23.md for v1.23.0
* [go1.17] Update to go1.17.4 - avoid bashism in client-common postinstall script (bsc#1195391) - Increase _constraints to 13GB - Restore & rebase revert-coredns-image-renaming.patch from
kubernetes1.22. Looks like it's still needed until all supported
k8s versions allow us to change how we publish coredns containers - Initial Package h01-armsrv3 1724146069 1.23.17 1.23.17-150500.3.18.1 1.23.17-150500.3.18.1 kube-apiserver kubernetes1.23-apiserver CONTRIBUTING.md README.md kubernetes1.23-apiserver LICENSE kube-apiserver.1.gz /usr/bin/ /usr/share/doc/packages/ /usr/share/doc/packages/kubernetes1.23-apiserver/ /usr/share/licenses/ /usr/share/licenses/kubernetes1.23-apiserver/ /usr/share/man/man1/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:35296/SUSE_SLE-15-SP5_Update/d46d6d7920f61cfa98dec478e009a2c8-kubernetes1.23.SUSE_SLE-15-SP5_Update drpm xz 5 aarch64-suse-linux ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, stripped directory ASCII text troff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix) i&(fY utf-8 1527c8f56189f34326fb247c797879fbfc6889a50a456eed6097aa48463a030a ? 7zXZ
! t/] "k%]{~mpDh_g 8VOû^3k*LgiA{?;+~9`܋LpIri ;
<$2\{>-X:H
<7>{N8kMmA७u&U[&NͳX i]* LG͞R.%^: BlPךmL< Tw=+4gl}?F _0J3 i[x}jujL&'3N|5ϲn-k) n)N5[Ũ"c }Xsn6wFO%k$fd yfw8Zᐷ'f{_ a@oakPS# o#F s>4Qb.}sNe]
0CO>Y$TZ͊2sO6yt6ms-a6x6*t{x䮺|˚Y% ,-R+<( yU =
ZQ #9$ 4^ q,W0 h}q 'M ~>wZ =2^)DSj#gn:wDxc
vN`tw_%ަ@ 1_M2W-q; Yl{=5:|l{dV̽Tˁwj@A ̴Vrn,-?ɹ$)Dv'}:>;P 7@XnG!trD jp>ZIrWQ(aln%j#|Os@\&
1wQ䬳x}w
b16Д !#p]! 6V/h Y.9+K Αr>,֩ %˝㺶 IuPSIc ϫ"Q8x[TDUg^Dr3%j\@ d8 $-/'Z;9>pѰ, /@ e}RqBG#'A͛y
6 rPKY mV,L Iьg $槜E;K#K8i!35LVr+SC*E ^Hms8i\\ſ\ `㨆Ff;q=%&ȉ뗢
BSmFAY߃`\H.6qAxX^ 3ADwo浆n1WEamD ]鱊yqA>c-ՙh:zL5?
]
u'ProS5=6(G!!qdN-@^2p
F>1m
7N&6[of
0F~F3 ;# y]v~yiN3]P~M@`M'}]TEP<ϯX~Tա,7LJlJLG\8?Oԡ'K|mMU7H!7yEߥt,>v\T(D+ "(s\X/>w X_*LC]@Y@,}! 8z(-M\dߏ& vuj(Q)l!}vYQ:/^z ]+ڠCcQ AAd=|EnF)ܠ%L_aʉmJJQ^&pVF'Z}7< 5q<_dx@&Y6iN{q".x`~Adw-&RZlKMMY G cHHxsik |w
&NIC+µ|I 033l
^#Z QX
W Gm;`s93!K{ ~]ө>(k˳~. 2|ᅮn^a҄
k/Br躆{%&ٶ^V%N[i0< 8(Im1J}d
k^ zJ' țýQXnw9Q+MQũ3= Jl
Hsm)l>
pP-W?ٸ**M ~Rdn!Xp9zR/[b~e|V~eyt g:).t%Gʨ6@ս l\,i Ȃtw+ӣgYԣhM?(c \ƲuE
;Ԡksh2 鱻 ݣ:35!"Է&/ xs?C/V
;я04S+K|Ս$R'
o[)Ҥ* @ <e& Z:XLz%WU3v?Skb0¨f/
:p CKf7)dP A#U!I8H"N@6P#0$ ]J~~m0
ص ̦_zLO8"kʼξz 9w{e;Vh~4۪B'Na6Ea}@8Ͼ6Ԃ9Pcߘƒ@tZ]5 3'3V hpG j;[C Emޟ:] C3j%: &ڻwM7GzT
z6\u
x OQ= ĜvDbHd8d(3xh 3Sb/2%((,]C [G?2e`𱤸y ="yÑSk=K&/W^聝O (H>5벀j[ߛP 8P T3ڌ&4& /P g:2Ym
ҩK%]1i\\iq 3\_#g(!|At*Q:K=:펓X؟T:!'9
+SUhVO[ `sd3tPv43Xr ?x1``q|Fw +εFa ocH[y 3`GO.f']KuXCo6@B Or c:JuD '֯ȓ d?y+ܽB{}HD1ud;pԼZ" 4i yBW
}),<֏w٤ig|@Ȃ c JeDd_6 /Ak0:o% Ħͻ0g]D
T +nU\ -mlC>?ˊZ߭K$ &s>K)#I/%%IW2; bfT\6*\ԹcvAᦆdV
JNaE3#^(C:9jc>,a!1p]]
],MٷzJcω/]P\$؆=](73> L j8{:K?>#KRg= WqQ=s%>PkݻΚ/u:9Y O!A&/Jhl2
lr雨z5X#% ^_,?F#:{ őyz?:Q}4l'fҪ,TK /yE7uZ4YvL*( ^W=E"b٭彁+k2$k9Y߿X䂚э _ͪA=Thڭ/u 8@V(_x"fA0NԩK
(AܦH*ǷȤÝrIS ߗL
ՔI&¸]a}GS5g*mtLţvw8[W Һ % F
<
-CG+&P l^@~xZjDy_%1Ac/֊Q͞@֤Y <υ!Js GwE H8AU&YJ~;;iNqwpdl+pV ۱ ʁ Ǝ;/֛H 79:eNW "e[HuHB l n~7 WP81ƅri}^ 䫩mSCh2=JwFҸ r C.z8shk+$kM`S,)@%J qWl 73K 'ёk.zA)l0 t
j6֩y5Hpu z//FVHj>v>uZOb^ o T^Kئ=^hf0Y%g}I+o@EJĉ֔#=T8RS/l0D?Ξ |ΨS%gO(4TK g;e";q3e*r69(ȹYw $= kH)D( f`֠;aTjǩ$z
N2 _ESzs(ĭ"Qx qFwp߬u}6N E5;:
/aw
HY7)\ 2]?*җ`jU[;˳j
GSy
J|WD`q7RTR bE%Baoݷe?K[,3I߮L3ur{Œ \{EiTIrvMn@vHBL8D'1!:$`C-4OtpvӐX2maM .$~PaT(/%Rcx#QsB93q*^g8MR4yE"ᚾآ{2YFeATlգ~}SyWiѭFYsHz&ŶWfyugߠW2 s&FZ.oF&zx
1,ҲCk+uUrPĔ)qG(_ZT}a
*[F"%5Ĩ`>8a\. t>vl 賰4T(qbj9Lc&F喼/HnVp# &j(Cvgwf 1B1"UցY,EF$7=ftWu>v['TjD=MX0ƍ='J]nV{)lm9:qD|L3
HeVvj=N ,@x345`86\I Z-^Dw(\[ĽïTm}6#ۗ؉e4`s8.JeȡڦP1, +w:초fi;ߩuT#?nfDLL?3<ܱY<|!Yoc8bl~4ű H\y&̈́Ηs笅.ũk #z s3#S~Z '
죗' \rk ({4Ik`GC`U\Pc6q.$Lr) !q+JQQIxïƧ+yHfC]- T r>_zK8U'l|4S>Z͵ ט`
!|@')nEiqib zYРBP`8,bLԯ®0漓;GAN,fJ
,r}D'bznn5v]!IyⷢɌ.,z:1Tx2 ?ژ8 {1P.T, G6pAz\r+ʘO=0ESu#2[Tңs=GBA$|ݾ lzd-Lvk=!qD}QkYc0hHxtbF2f,Qn%`]MxkgOveBt;Ss%ߏF{QD5f.Ǵ(L}ø-M&^(|J a%h=("jxy=F?ڈ:_ZPm~Kw$kd뜯X0?x/9o %Kɥp.~nc
wC>
<4J;z4i3B3k/ihU/فHcή xSȢ+ 0pR2muhh[b?pۉ.zTv^M t>?\'2\I
a|"n6Qm$r-v *9z"V'!(lQ]y=Tp#w mlGNOPv1 `f L}ݦ.%>|^_/sni/GL{>6z 0ւ*H6,qrI:<B%~ǜ\F }Ax`YI5 'sTzؗXnnײd
=E ,2$yWT%):B/U *ηRّ^L=h]ÔR>2JwmxiJQ r}:ga* `Ma?y.y}GK0h=WY5~\)Q*vyB?"\IhqJߑl1%Yw;1 hzAsPwAnю W#a0=}O Ј߷ Ns3.?i8,)8s%*w9}i"fFI + Q{l(L ~9 4"M^5H;-ThLrHfv Ic}5Z=sW \3_CsR8Z2Vxj~ 9E
Z[Y`; G4QIwȯF
_SAbьdA<6%`Fg{^U|r . :u1-q&gPVbc"-FRnV}PI U0WVIc|}EJ AV \ nTg~5x; ,K;T3eکՂA]NJ tfU#Vs;?zu! VXA~l a+5Ii. 1bߌg""Kpy`RI`$6Pցѱp b
-K|::8S$P)LQX'nOF/[q7υ<錄YEۥr}]0 RMy"˙c) xP>"x#D6QU?&R 2SZhsZ2lbɃnP2i 2E:;_x oaZm7\~F
*I{n`mdϋefJvU
rVY3M:GNd̑6ށ
pqDޢ.0F}s.oZj0}!
tI}6/}K]]-n L籪ml> {زt;gFeu{xѥ%\O%tHz_H*& hWgB .7H${ ~;C %k`FMU:²\ |TeN7
G3@Q &Höw 7 J<(KT1fq#%eC 3DnU ϔ%~ DA_πyS-z̺-yq$Q4YجnR!>¦*:r}j!)R|HuҍȽL2fda9971I2e 舆L š=/{ yj9қl؟K#d`3LG#l"pY)|,>5?[s>sYL7J3O5 pIQfp< Tvc3zkOHB `ʷկÆ&ڱ V^6i=M5,"wջ$"~ UXtڙ@m*1=0'T ki[4JTyB !^ei_1v hHY'kj[| 4dCKJr9`r#b(^8s"J7iC~]0<3Q[Am[+&xa7M{ȶcovp) kn2eyZ&o
q3 ی,2WF&]j^Pu'o q[Ϛ"/^bBy0_#LLFGMFe|EZ5ǀDOc̥B5f6 %lGooY=Tf<=z;^H98BV:80NE/WK-,T7%qKMf*bI\:2Q9L=pum|tR il02, a1Lrn*qmwn
(:$qR9&YN8!a5I=O#o)R3OAB"ȫ.1<tJDsJ7xR j4^y\*Rvq \YY*4yv:RMiV-{^2h^=yTzi@ M+)wTl
?8
qVm,
hܜP}reEh
r a
gnLL: } IlBY|Vf~ChoGW8@P[.o*N*=$I*:ujhs6*ܦ2 -Ǥ &|z7ևc*^SPCBe-G~djC4(~IXޒLC$RfEs1e=?G:
M.ldryohϯؐ,Sי A0F]yK_k-:wIaXAxֆɕ(a? @:hVf6URUh*"aAr'hW 8<3yWj,)ƒgSolNuoay2,/gR
&@/x~ ;tK+߷?fwZqs!XBm&ӊO
?NQ:s%w4vV;H8\PH[SgC tN %>wA+A*~~Weww|3Lk
\='(lhK"Q.z(UZ |gtC[wmFUiέfc9i(A;aI4O*0; QsٱF#kTNYy_Unei"$E/d|"Th|~Y7-5y%,Sd(N 1 3s8L~DZ[a;ڃ}z fs%}6YG:Quba ,E\E;ߨ3F#N l ks
"]Mv10Ns|Mwҋn6G&}?dH& -D̽j#e [|"Mx5.So*J 1ySi}@ M
V&^ٗo
ۉJ^/Hm uu@ԏCit@կ{_? r]& DmlE AM,1XMչɒCc=-ۙ= \i;mX˚Pۅ%bLeP/Py8 hR%l;n>eE`|y3G/ܼEًI c@
껒On
xI;U2 '[x@e/W(%4Yml˅
%@ kpTpw`WP'fY?rĖ)_%|
.Մ "Us7l%]{wTwKI o3O'ƉQְa k:J eRƄxQr{б Jl?V v>6f]FMpL_
x9'N ULxKs0g Cq+7yV!~D8q0 SzN~00h![k AEeӔ 4& ̐6l
mFFG_l
OޑRб0]V
-3&[uX? E mTy&x덄{<셙ЪS}𐿩-l0igs 9MiSz>@dGMYEFw6<o
K56l_5+'aa *[ *g~X7?Kl*P Ӫe*wF!%HGcÕe(eIM_-8T>
< _ J,Z mzB_VtMEH">xd,k
hzmw)-ܷb0.,>GO+D%| `lտhG*f/B{>v+v|t;@AGWvH60n F:嚭f\SR\;^}UHŚkWI9nƷ3oG bڻf (4Dpft-I_ciutԆ>) S\l $9~{Sغ#H"l | $J5 R(iKռɺ]f|v[
ڴzT:ML 3.UBx"eo#@^6`3C x NN;g;- nQZj/$rG| @6 ևߐXKz. aq Mo,6ŧ"tD >N0}6" _7nYC6ǚgr$S#RnRbzw;6VɲcvΜj3" [&%"f_q
(IK \Гht3c&9+
yy Qnc T:G[.(abj\Y]5W*Y HQ XP ZH{ J˭w TP!$'@[ nPƅH[\i}mIM ouJ< ˺M`g2)*=t /:*Gz
K0O[%r} w
} xȝpR|Qc[ WfZ [Bu 5,;n/ьY9-X}wMnuRMSɀ*kKq7N"X`D fW"BNoӳdBĈplDz,G =#x&tJJxk?|buU DŪeTG e) |qBNȻ 5H#~NmvA' 7^-@2ۈq?P
>>>Af&{K"S _
7ܢx7N W z}r՝`Vؤ{F6x
?F]qv$ bE9Ļ4axD S:Da}Dɮ X/bmpB|&M8R!ӽ(H }=gW15Q5HA?uF -A:RaݷK
ssG~8jD*-xoK
tle^x68 XƓj:}imt^HRWi|@6F(N Ԕ.yu5)y XA}"\j3JvM9?eI 58J!z[96c 5ǿ߄>UNրX^W U`! aQ;H1CĶ>ѯ,y1 ݨ2M=k
O Yo%ZHM,lv[seej z31%EG#pkJSP%S|ŴQg~O@^S61D,!M־CuӬXqҦ\ܥ@_-%wA#} H+» O.ٙ)g̦4$d/})/hx=
ruvC{a0@`A`
o0M{L!l-j?_Qj^Q +TF8Zo<9M8yC4jXl
mE>9[٬UvՋZ#p9UOw L!
Ipܨ0 .c3\7 d?wd^a<.ʴuy-*t(r>q'SxCDE, Eɗ'3> "̀.ٮ9y TEFrl+=,͇(I ?maI JO)JEyv R
$lI 5%kfpwp
K* 2pTb8#dCW sr)$f8 wY˶I:dFvtMm0LܾOP185턒9LgEbʔ9&6H)6
!@o0s R?_ 6D#z+9K /X>7 ̧7Cn7ݦ@!O
ÕA{k\Z `Ck;)Mk% !\$ͧ-~R TmXt ݧ
ں4*ARUa|A$^y?t3ĴE m MNLa! CG%6
ş_㟼ͯAD4G b|X:QiB\B =uq h3j7: cSzks [ 螨4E?81 N߲kO( eZ|u#nSߔ$
4W`Yj= q[nRpټPt<4])"=lIY+Km=`/fV:98-wlYFcMK^8Y9 Q}[_y ;OAiE
@'c :dYZN
g҃#/ 7OH{R3ɽ˒\s! h 'R Tkc|vUz*o+`?9~y4G_`!I!EwzرbfVG
8'&;rْEp7::Ai?in*A y [
7\s M+R mn1H[=BƉoG-Mӯ!2RWj!
$ )^fl?sp瑂P!̻dv#O2>@K3I|pK%YG~̈́:urۯk ]z5R)i¦r()5HƻX/J >!̝ǐhiRQAr#? CO!Iq|BEsEі=ˏ|a %'W2ihz '/՞Ł/+N=$'!(zr[lGBs7<6˔aK],}qxKx.
t?v\vg/ATա.wwni<F"f }wKK$nƋ&W EK@ 1Y1D~RXU֓ 3 a(
k,ewmkٛN do4o .@fn¬h Q)@ MYn8m6 %%D Š_c y\[vS\0J:]vWѸ G
EHIށ'3}C1$.rPΦi5 ~ s꧳\)8n\t9
.*ӑwPAZ$
,u%Ut8ݯD\D21R SGutwXGfDEszȀT{ PŎ% 'E# >٩% t~Ǎu ]7M#E;?ӿS3N _P#~eS#jf~eֺ37 5 Q߳ L:C , ۯoT IG\Rc D*bU Ϛ2hqQd;C\^BID=%d#P s ed4qM%3~:Cn_"84c3x3#БSl55.LQ6W-,K+BA ¥:M3=28N!Ⓥ]P/{ ste᫉bh6 b瞆gO] (B*`8:qiI0|{v79 8iS!
4}- 'ýגH@f*uǨ`l~Z9Gb< {ztǜ9ڒE;)% ?mƷX{x)1d]S" >S
gK,4Uw&wO@Zdhs?{ ;>],0ojs\- EYJ·l[m:x!65ӹp?
S Ǧ8mEPTQlyDtJ6Ԇ$m:VIʔZoTu]]
3]2Q:BH'~) @X{IBspfA=fE:'v.eGYR d7% O 2o+!U
4A,vdiSߌIrr}L {Q%),=s
>CuIT;{ $| { ]X p˹;C`D3v?왰 $ G&+gC:`_H}` &tR @*kώ`!(څOA`m{G>i~LT`> ( mt5$Lz5e,Jnʎ.%ۺUyv`FtA CGAJ#U:~cx> rg(g呒Y[Ky>ei x+4'W}n `hR`T1G `':b]Yw?SZ "cV-~
l+
&7fI<[N>DZ7?:=Bf *1JeLxߡd9X t
=uӔ褎V-<@SS60YDJIh gFWVxt>=(YfR4@]ƌXUr i05R~<8=4l&W'7¿:!}]UJM7h۾ ļǟLKL CI^JU=DkK @Rf dKOz|ZKv#G^\,AVP|ģP 'J5&YX&-o$xe>*a:%]-z S ņ5 PfƗr/bҲّdr9 ã-< (`.v!M*WĠs+u+ 9jJ:* Ϧql! !"v3,̣xfco2b#B`R%`}
~M#`Ie^ ZadIoimYpQS nb,zdd+KnHOU,p
*9賔Bovz^&!3;Zv 8"g7ERZ7UCR^!UM:(zh|ϧnBH&SZVN .$,o^"8Z +צ?{sռoZjN}aLU~I/G'.US\9BPAdvrWyT~j
p] Z]pe p
ԷygHet n,nTLr p48 wk OL^#E S\Щn]&|FȔm_@Ù%ȽgިW U/
-- co Q
!Q<̓
څU|o.Ǯ)"=M.o(KN6
M+*Sc5t'kU&B\@?c' V?;Lz ^Ji)0|HYCc0T'a\Bm-yT, ފn9jt6Ŀ=cY%*?+!)^ uZf,zK`,8{57D ؾw 8g#T7 B֓kOՈšw`AY]E,j@Glu4q.bwgΤz w$vmr5{5bm#
xT0h7+oinX[7N5>ee%P';m ߧ Xtd|x'v..|ՐYVZ 80n(R k F`w)@_02%:f]将&g(A0iK~szjOͼ#+csIjaf0>&F] nDw6֢_YۈMPS A> Klo
oSQwqRX`
v -C_H}.}.@6AnUR}ϟdN{;l~)U)=r436O٭8
t& G(jB}Yo^ GeU
"ʼn3f8ԝுCMe]kj X 55U3@^5"`NiR I>>`w È 2[L" ##6}ս)3"-lT3 MH]&l\
>$v,] ŭ.6XL \
Ԯ;xVSҝh$[j !"]+ܳ 8{
>2%5O3 "CEbq f#!%>iT M] ]ںe}bpRX
Q |÷Q& ۔6Ӵ~' [uO#FVb~Pvۗ@'
)6c vByډ[)\}e7sm&-LT2D
ʃoNC8ȨyDHiKQ 9$7X65BAR4}m7kh)?BDէ@d|u,^7IQ,W|y8^ާ<}%qsGpn-lM/,$bpcamQݰX1h/ɮkI2=|Vp"B3A)MQ!` m_[M\K":} yϺ Hi;
.lvM*ӓ PMlPcn}'KۃyrVYܩ] R xp\όq
j*1CV<\a
ӎV%$xJeH 3:6.RquXV#HPNm} bƋz+ "B! _ <'ME@?#,FH<0pYl{
PZ cC
gRPOs/g)m h--90M O5Ղ5Rl6Y%Ez,\&ۆ0 ^߸)G>|Fst#ľPdDHӋM ڞՈWݨ{/'f
gtO\m {[Ɓ?]Y
KsM ;P[ׂ٘DWj~zE &^/gnkIfѴ Yk!.G+cX _w6c,egϼ(O8 (+EO(c?v ''a.c^ϒ҆ 0"|J̈́vΈ1stpYEѽ탮!Y(WoBYDd(.Rij7A04XL)zةؗ(Fz+fn# z?Ur,XvL&J $5irOF28?җE!oO ;'e
StIg^?(J'!˕
~`JkéPlo-ƪI.pUƕmWW {up]3j#9R1Tш!Q HJ2 Kr,kY+!k'^sٮ==,9ޫt,YR@\ksfϙ8 fHbÉ.Π +]D1 mvqd?Jd˔Aqlњ^W j3a]X ل+[WAe1yt4zDyhv4Tմ'mC PCf`7`4.},J:[h Kbf{lf;ݻO:](hPR0W5 n *lۥv:[tA#rls< p9;S 2T( @M]eB#,8-FY6(A4mҌjm^HU.+G%lG %i9rGHeJf :~], ǗȂJh'j]SԑM9,ZL)M|OK B ST:dM S
: 9_ o"Y(I-t̖OpU=T*Y;_:
[Xx \8<N!ӇHpH\ڙ,ot~
)k4=~` 6kp~}M^ ۴b eeԿq
~a2$tj7AEgQ'Kbsdhm0RMo iJ^]b }_+z;}%v۽~dNchJgZ!m =dh Bw
]p:c\"= UG\)]K#pT0@!n7 g\3]j! g2')'N)Fwk ؆(y{yj魌6Ő%Y] M1ν]sK{um$hrN+w`U.{?l#%ψftjZ6x7<إ A s;"YhdbrRuq f,pX@} J6oؕ6= PRyYzLVf1[G{@
Z0"ۘ :BmGO %0_y
^EnZm=6jųw4V% fȸtE\wm.>evֿ.tje)̓e+7O
k\ =2t銖cg ѿgHx_5PL<{6[RJ/c.nu5s)с@$Ƽqi,\ŭ`fzcxw@:_ck#َʹ@Z|SZ N\!>=C)/9T;RP#+"& )}| df!Fp "~W9 n jC Lާ݄]ƁkG vM2Vq$} 5WcUФ8/TZ%tP(DB61(4QJ>y_pً炢r=i[/z{"HW'g~j^*S6vRN$.س9;yLme qlaJ8q {!lC~[=G6o0CUB~`ڰ 0 ~P@Ĭ_]p/!
XES"Ojq~lyh*,*RkGd|kՇ zBļbڧBŅ5FTQܬn.`~S ^lÒK>doMZg ,Qt)0 S#?5 gkՁ:#fx 2dld~t "ԒDRޓlSl 9e_gYb;WP3Pn"MP-04lYCvХЍRd4ݍ/qP8'?&f5X} S#ta]z,cu$`H%dd՜ D>ГŒJ*ㅈ\h6xxꙉ)~XC¢nI:_r** +(S\s(x4sD|',uawvDqDy!:F;[35˰
7ǂ4#HDDJҘ9F~)$7^"Rm:A7V閐GlCo#=^y}%/ h?@{?:ta=,$%PI[/ :*s 슢 [
LnZ9dbR)!9g
x-잘kWY!i pP;U54D9t(_32= U\o$v_AnS w<d%@9wŶO'q4/p|ht%9+V#m} !WMS~/.lxQӣO~C(^f=j}ըSСHfPS&OZcAF Ū`m- FZq]LJ?
Dl3Y qzt4eO $ T:x gVnuf@%$D` 훺#A :Br a3U H'sJhƂhuڄHE>sLJKh[
'+[+S s\[n>`9h4 5 !{,Y#bNۇZ`~xx7.|d( HT sF84`/H⸐gnW=2<ӡv $SWV-[IqCkhP2FL"GܤZA}lc.Y&b}Rj,qRS$vsi4|,Фco"+d[Z 5#*~-oC)ٖe_gNf
L`Yg;NB1u=Lx)P~S'Ә' 3.c~oX%
ૻLڑyCq@Ѧ>]&.{֛4}0ar9 *h hxEr͔K )nr* >6b!/]l iTW%bgvpB
u i\ܳȓ`W!+ 7!k觧ܢUkcÔnHuLM7H([h> C9 `!' ;&Q䤪گ$ɵCz`UAizZ;O7'?K;pZ5В#nXNQ,@95bI¨es23@pơ̄) 'S,p$5^T°B'Qߎdfrh8p|AN)ɢNz2pOkVInyN ܜ.Ơ>J+ [ y'F/D# UT{
ǁܽ8$@04h(ǂjڋ7YY*~68M0aGsi]'L?{1SWv $ еY!Ggb- tM
\{Gѩg^/ݘ^ΛuKv/)ǜnSN#Mըj䅴5,}'Z9i%tA,]9SÙxPj&|㖚xH>Llr=ԭai<~wUւ ZN JF
Ԫ B]8o
d4|vO VsZ]TҦ
ޭ0sTHtB~*6%ag`6Xr HjA*t.[ ,wud?5pJy9m'uۺaMx1!>j p^ 72F'`]o-f?P̖wԁ)_YQ^bF94,To=4JMa{&OB9{6>C;M#~}#q. `ϐKWEVszpKc[SK:P@d
Lj*VlRRmXL6a^JysiċyV E:mu.8G[!L :t~id57\ۄsGd;/=y^y&(ӧ?1eOn<[ܨˑ=^п9c8`r [+H
39N2#( E
`̘ ] j%#7&)r%6kbTU l:;/WG/TG.OPھymWһtQH_(d:xHq `Q;՞x8 T^:TDd<&3\wi?kLE&XI7
_[Er}@EB{\0wc$qZVŴًNQ
u臎v B$wKҁ B;R[;BT6XafnB1ߋf}J,cu6 6֙ Rl~O̒aFa?v浐ؼw&A!@|'7ti-UA5QR?bOPcZwxSeb#E@V.4.1M{LOV7b f6C;J✰ G!q}#2n