pdns-backend-remote-4.1.8-lp151.2.9.1<>,_kQt/=„-K7Eޑ himAr fƔĵ}o9xϟQ6l&}\.GiF;KDF ήT!5k j]0DxU[w䌀|x?A BHb>h]+cB+>Th : S*Tckf4o6y9ɧ`HTeZ@F˂9$p򴤜2 EgCY)8S, H 7V 9dʨ.&H'R"[?g\I.ԱKD>>X?Xd ( @ 6Ztz     XI(}829L2: 2FUGUHUIUXUYU\V]V^VbV)cVdW`eWefWhlWjuW|vWwXxXyXzXhXxX|XXCpdns-backend-remote4.1.8lp151.2.9.1Remote backend for pdnsThe PowerDNS Nameserver is a authoritative-only nameserver. It conforms to contemporary DNS standards documents. This package holds the remote backend for pdns._kQtlamb58hopenSUSE Leap 15.1openSUSEGPL-2.0-onlyhttp://bugs.opensuse.orgProductivity/Networking/DNS/Servershttps://www.powerdns.com/linuxx86_64h_kQm9bb41f542b3339da85e38bd91f8af2ed8c62f70f1f2081f0544836b9781e27bfrootrootpdns-4.1.8-lp151.2.9.1.src.rpmlibremotebackend.so()(64bit)pdns-backend-remotepdns-backend-remote(x86-64)@@@@@@@@@@@@@@@@@@    libc.so.6()(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.15)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)libstdc++.so.6(GLIBCXX_3.4.11)(64bit)libstdc++.so.6(GLIBCXX_3.4.15)(64bit)libstdc++.so.6(GLIBCXX_3.4.20)(64bit)libstdc++.so.6(GLIBCXX_3.4.21)(64bit)libstdc++.so.6(GLIBCXX_3.4.9)(64bit)libzmq.so.5()(64bit)pdnsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)4.1.83.0.4-14.6.0-14.0-15.2-14.14.1_k8^%@^`]A\@\@\@\[[[@ZZZЛZZZ@Z@YeYY5Y}@YMYMXDX@X~@Xx@Xx@XN@WW@WJVV8UUv@U>$U8TPTи@Tи@Tи@Tto@Ta@T_W@TR(@TO@TO@TO@Adam Majer Adam Majer Vítězslav Čížek Adam Majer Michael Ströder Michael Ströder Michael Ströder Dirk Mueller Michael Ströder amajer@suse.commichael@stroeder.comkbabioch@suse.commrueckert@suse.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.demrueckert@suse.deadam.majer@suse.dejengelh@inai.deadam.majer@suse.devcizek@suse.comwr@rosenauer.orgmichael@stroeder.commichael@stroeder.commrueckert@suse.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.deadam.majer@suse.dedimstar@opensuse.orgmichael@stroeder.commrueckert@suse.demichael@stroeder.commichael@stroeder.commichael@stroeder.commichael@stroeder.commichael@stroeder.commrueckert@suse.demichael@stroeder.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demichael@stroeder.comLed michael@stroeder.commrueckert@suse.demrueckert@suse.demrueckert@suse.de- CVE-2020-17482.patch: fixed an error that can result in leaking of uninitialised memory through crafted zone records (CVE-2020-17482, bsc#1176535)- pdns_maxmind.patch: backport support for MaxMindDB- Build with libmaxminddb instead of the obsolete GeoIP (bsc#1156196)- CVE-2019-10162.patch: fixes a denial of service but when authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. (bsc#1138582, CVE-2019-10162) - CVE-2019-10163.patch: fixes a denial of service of slave server when an authorized master server sends large number of NOTIFY messages (bsc#1138582, CVE-2019-10163) - CVE-2019-10203.patch: update postgresql schema to address a possible denial of service by an authorized user by inserting a crafted record in a MASTER type zone under their control. (bsc#1142810, CVE-2019-10203) To fix the issue, run the following command against your PostgreSQL pdns database: ALTER TABLE domains ALTER notified_serial TYPE bigint USING CASE WHEN notified_serial >= 0 THEN notified_serial::bigint END;- Update to 4.1.8 * #7604: Correctly interpret an empty AXFR response to an IXFR query, * #7610: Fix replying from ANY address for non-standard port, * #7609: Fix rectify for ENT records in narrow zones, * #7607: Do not compress the root, * #7608: Fix dot stripping in `setcontent()`, * #7605: Fix invalid SOA record in MySQL which prevented the authoritative server from starting, * #7603: Prevent leak of file descriptor if running out of ports for incoming AXFR, * #7602: Fix API search failed with “Commands out of sync; you can’t run this command now”, * #7509: Plug `mysql_thread_init` memory leak, * #7567: EL6: fix `CXXFLAGS` to build with compiler optimizations.- Update to 4.1.7 with a security fix: * Insufficient validation in the HTTP remote backend (bsc#1129734, CVE-2019-3871)- Update to 4.1.6 * Prevent more than one CNAME/SOA record in the same RRset- adjust buildrequires for mariadb 10.2.x on SLES- Update to 4.1.5 * Improvements - Apply alias scopemask after chasing - Release memory in case of error in the openssl ecdsa constructor - Switch to devtoolset 7 for el6 * Bug Fixes - Crafted zone record can cause a denial of service (bsc#1114157, CVE-2018-10851) - Packet cache pollution via crafted query (bsc#1114169, CVE-2018-14626) - Fix compilation with libressl 2.7.0+ - Actually truncate truncated responses- Update to 4.1.4 - Improvements * #6590: Fix warnings reported by gcc 8.1.0. * #6632, #6844, #6842, #6848: Make the gmysql backend future-proof * #6685, #6686: Initialize some missed qtypes. - Bug Fixes * #6780: Avoid concurrent records/comments iteration from running out of sync. * #6816: Fix a crash in the API when adding records. * #4457, #6691: pdns_control notify: handle slave without renotify properly. * #6736, #6738: Reset the TSIG state between queries. * #6857: Remove SOA-check backoff on incoming notify and fix lock handling. * #6858: Fix an issue where updating a record via DNS-UPDATE in a child zone that also exists in the parent zone, we would incorrectly apply the update to the parent zone. * #6676, #6677: Geoipbackend: check geoip_id_by_addr_gl and geoip_id_by_addr_v6_gl return value. (Aki Tuomi)- Use HTTPS links in .spec file like mentioned in PowerDNS announcements - removed obsolete 6370.patch - Update to 4.1.3 - Improvements * #6239, #6559: pdnsutil: use new domain in b2bmigrate (Aki Tuomi) * #6130: Update copyright years to 2018 (Matt Nordhoff) * #6312, #6545: Lower ‘packet too short’ loglevel - Bug Fixes * #6441, #6614: Restrict creation of OPT and TSIG RRsets * #6228, #6370: Fix handling of user-defined axfr filters return values * #6584, #6585, #6608: Prevent the GeoIP backend from copying NetMaskTrees around, fixes slow-downs in certain configurations (Aki Tuomi) * #6654, #6659: Ensure alias answers over TCP have correct name- Update to 4.1.2 - Improvements * API: increase serial after dnssec related updates * Auth: lower ‘packet too short’ loglevel * Make check-zone error on rows that have content but shouldn’t * Auth: avoid an isane amount of new backend connections during an axfr * Report unparseable data in stoul invalid_argument exception * Backport: recheck serial when axfr is done * Backport: add tcp support for alias - Bug Fixes * Auth: allocate new statements after reconnecting to postgresql * Auth-bindbackend: only compare ips in ismaster() (Kees Monshouwer) * Rather than crash, sheepishly report no file/linenum * Document undocumented config vars * Backport #6276 (auth 4.1.x): prevent cname + other data with dnsupdate - misc * Move includes around to avoid boost L conflict * Backport: update edns option code list * Auth: link dnspcap2protobuf against librt when needed * Fix a warning on botan >= 2.5.0 * Auth 4.1.x: unbreak build * Dnsreplay: bail out on a too small outgoing buffer (CVE-2018-1046 bsc#1092540)- add patch for upstream issue #6228 https://patch-diff.githubusercontent.com/raw/PowerDNS/pdns/pull/6370.patch- geoip not available on SLE15 but protobuf support is available.- Update to version 4.1.1: bug-fix only release, with fixes to the LDAP and MySQL backends, the pdnsutil tool, and PDNS internals- Update to version 4.1.0: + Recursor passthrough removal. Migration plans for users of recursor passthrough are in documentation and available at, https://doc.powerdns.com/authoritative/guides/recursion.html + Improved performance: 4x speedup in some scenarios + Crypto API: DNSSEC fully configurable via RESTful API + Database: enhanced reconnection logic solving problems associated with idle disonnection from database servers. + Documentation improvements + Support for TCP Fast Open + Removed deprecated SOA-EDIT values: INCEPTION and INCEPTION-WEEK - pkgconfig(krb5) is now always required for building LDAP backend - pdns-4.0.4_mysql-schema-mariadb.patch: removed, upstreamed- package schema files in ldap subpackage- Update to version 4.0.5: + fixes CVE-2017-15091: Missing check on API operations + Bindbackend: do not corrupt data supplied by other backends in getAllDomains + For create-slave-zone, actually add all slaves, and not only first n times + Check return value for all getTSIGKey calls. + Publish inactive KSK/CSK as CDNSKEY/CDS + Treat requestor’s payload size lower than 512 as equal to 512 + Correctly purge entries from the caches after a transfer + LuaWrapper: Allow embedded NULs in strings received from Lua + Stubresolver: Use only recursor setting if given + mydnsbackend: Add getAllDomains + LuaJIT 2.1: Lua fallback functionality no longer uses Lua namespace + gpgsql: make statement names actually unique + API: prevent sending nameservers list and zone-level NS in rrsets- Ensure descriptions are neutral. Remove ineffective --with-pic. - Do not ignore errors from useradd. - Trim idempotent %if..%endif around %package.- Added pdns.keyring linked from https://dnsdist.org/install.html- Don't BuildRequire Botan 1.x which will be dropped (bsc#1055322) * upstream support for Botan was dropped in favor of OpenSSL, see https://blog.powerdns.com/2016/07/11/powerdns-authoritative-server-4-0-0-released- This makes the schema fit storage requirements of various mysql/mariadb versions. pdns-4.0.4_mysql-schema-mariadb.patch - preset uid and gid in configuration- fixed use of pdns_protobuf- update to 4.0.4 - fixes ed25519 signer. This signer hashed the message before signing, resulting in unverifiable signatures. - send a notification to all slave servers after every dnsupdate for complete list of changes, see https://blog.powerdns.com/2017/06/23/powerdns-authoritative-server-4-0-4-released/- added pdns-4.0.3_allow_dacoverride_in_capset.patch: Adding CAP_DAC_OVERRIDE to fix startup problems with sqlite3 backend- use individual libboost-*-devel packages instead of boost-devel- update to 4.0.3 which obsoletes b854d9f.diff- b854d9f.diff: revert upstream change that caused a regression with multiple-backends- update to 4.0.2: The following security issues were fixed: - 2016-02: Crafted queries can cause abnormal CPU usage (CVE-2016-7068, boo#1018326) - 2016-03: Denial of service via the web server (CVE-2016-7072, boo#1018327) - 2016-04: Insufficient validation of TSIG signatures (CVE-2016-7073, CVE-2016-7074, boo#1018328) - 2016-05: Crafted zone record can cause a denial of service (CVE-2016-2120, boo#1018329) For complete changelog, see https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-402- BuildRequire pkgconfig(libsystemd) instead of pkgconfig(libsystemd-daemon): these libs were merged in systemd 209 times. The build system is capable of finding either one.- update to 4.0.1 Bug fixes - #4126 Wait for the connection to the carbon server to be established - #4206 Don't try to deallocate empty PG statements - #4245 Send the correct response when queried for an NSEC directly (Kees Monshouwer) - #4252 Don't include bind files if length <= 2 or > sizeof(filename) - #4255 Catch runtime_error when parsing a broken MNAME Improvements - #4044 Make DNSPacket return a ComboAddress for local and remote (Aki Tuomi) - #4056 OpenSSL 1.1.0 support (Christian Hofstaedtler) - #4169 Fix typos in a logmessage and exception (Christian Hofsteadtler) - #4183 pdnsutil: Remove checking of ctime and always diff the changes (Hannu Ylitalo) - #4192 dnsreplay: Only add Client Subnet stamp when asked - #4250 Use toLogString() for ringAccount (Kees Monshouwer) Additions - #4133 Add limits to the size of received {A,I}XFR (CVE-2016-6172) - #4142 Add used filedescriptor statistic (Kees Monshouwer)- update to 4.0.0 https://blog.powerdns.com/2016/07/11/powerdns-authoritative-server-4-0-0-released/ https://blog.powerdns.com/2016/07/11/welcome-to-powerdns-4-0-0/ - packaging changes: - remotebackend split out now - enabled experimental_gss_tsig support - enabled protobuf based stats support - no more xdb and lmdb backend - added odbc backend where supported - drop pdns-3.4.0-no_date_time.patch: replaced with - -enable-reproducible- update to 3.4.9 * use OpenSSL for ECDSA signing where available * allow common signing key * Add a disable-syslog setting * fix SOA caching with multiple backends * whitespace-related zone parsing fixes [ticket #3568] * bindbackend: fix, set domain in list()- update to 3.4.8 * Use AC_SEARCH_LIBS (Ruben Kerkhof) * Check for inet_aton in libresolv (Ruben Kerkhof) * Remove hardcoded -lresolv, -lnsl and -lsocket (Ruben Kerkhof) * pdnssec: don't check disabled records (Pieter Lexis) * pdnssec: check all records (including disabled ones) only in verbose mode (Kees Monshouwer) * traling dot in DNAME content (Kees Monshouwer) * Fix luabackend compilation on FreeBSD i386 (RvdE) * silence g++ 6.0 warnings and error (Kees Monshouwer) * add gcc 5.3 and 6.0 support to boost.m4 (Kees Monshouwer)- update to 3.4.7 Bug fixes: * Ignore invalid/empty TKEY and TSIG records (Christian Hofstaedtler) * Don't reply to truncated queries (Christian Hofstaedtler) * don't log out-of-zone ents during AXFR in (Kees Monshouwer) * Prevent XSS by escaping user input. Thanks to Pierre Jaury and Damien Cauquil at Sysdream for pointing this out. * Handle NULL and boolean properly in gPGSql (Aki Tuomi) * Improve negative caching (Kees Monshouwer) * Do not divide timeout twice (Aki Tuomi) * Correctly sort records with a priority. Improvements: * Direct query answers and correct zone-rectification in the GeoIP backend (Aki Tuomi) * Use token names to identify PKCS#11 keys (Aki Tuomi) * Fix typo in an error message (Arjen Zonneveld) * limit NSEC3 iterations in bindbackend (Kees Monshouwer) * Initialize minbody (Aki Tuomi) New features: * OPENPGPKEY record-type (James Cloos and Kees Monshouwer) * add global soa-edit settings (Kees Monshouwer)- update to 3.4.6 [boo#943078] CVE-2015-5230 Bug fixes: * Avoid superfluous backend recycling * Removal of dnsdist from the authoritative server distribution * Add EDNS unknown version handling and tests EDNS unknown version handling Improvements: * Update YaHTTP to v0.1.7 * Make trailing/leading spaces stand out in pdnssec check_zone * GCC 5.2 support and sync boost.m4 macro with upstream * Log answer packets only if log-dns-details is enabled- update to 3.4.5 Bug fixes: * be careful reading empty lines in our config parser and prevent integer overflow. * prevent crash after --list-modules (Ruben Kerkhof) * Limit the maximum length of a qname Improvements: * Support /etc/default for our debian/ubuntu packages (Aki Tuomi) * Our Boost check doesn't recognize gcc 5.1 yet (Ruben Kerkhof) * Various PKCS#11 fixes and improvements (Aki Tuomi) * Several fixes for building on OpenBSD (Florian Obser) * Fix several issues found by Coverity (Aki Tuomi) * Look for mbedtls before polarssl (Ruben Kerkhof) * Detect Lua on OpenBSD (Ruben Kerkhof) * Let pkg-config determine botan dependency libs (Ruben Kerkhof) * kill some further mallocs and add note to remind us not to add them back * Move remotebackend-unix test socket to testsdir (Aki Tuomi) * Defer launch of coprocess until first question (Aki Tuomi) * pdnssec: check for glue and delegations in parent zones (Kees Monshouwer)- no longer ship dnsdist here, we will ship a new package based on the snapshots from http://dnsdist.org/- update to 3.4.4 with a fix for CVE-2015-1868 (boo# 927569) Bug fixes: - commit ac3ae09: fix rectify-(all)-zones for mixed case domain names - commit 2dea55e, commit 032d565, commit 55f2dbf: fix CVE-2015-1868 - commit 21cdbe5: Blocking IO in busy-wait for remote backend (Wieger Opmeer) - commit cc7b2ac: fix double dot for root MX/SRV in bind slave zone files (Kees Monshouwer) - commit c40307b: Properly lock lmdb database, fixes ticket #1954 (Aki Tuomi) - commit 662e76d: Fix segfault in zone2lmdb (Ruben Kerkhof) New Features: - commit 5ae212e: pdnssec: warn for insecure wildcards in opt-out zones - commits cd3f21c, 8b582f6, 0b7e766, f743af9, dcde3c8 and f12fcf7: TKEY record type (Aki Tuomi) - commits 0fda1d9, 3dd139d, ba146ce, 25109e2, c011a01, 0600350, fc96b5e, 4414468, c163d41, f52c7f6, 8d56a31, 7821417, ea62bd9, c5ababd, 91c8351 and 073ac49: Many PKCS#11 improvements (Aki Tuomi) - commits 6f0d4f1 and 5eb33cb: Introduce xfrBlobNoSpaces and use them for TSIG (Aki Tuomi) Improvements: - commit e4f48ab: allow "pdnssec set-nsec3 ZONE" for insecure zones; this saves on one rectify when securing a NSEC3 zone - commits cce95b9, e2e9243 and e82da97: Improvements to the config-file parsing (Aki Tuomi) - commit 2180e21: postgresql check should not touch LDFLAGS (Ruben Kerkhof) - commit 0481021: Log error when remote cannot do AXFR (Aki Tuomi) - commit 1ecc3a5: Speed improvements when AXFR is disabled (Christian Hofstaedtler) - commits 1f7334e and b17799a: NSEC3 and related RRSIGS are not part of the dnstree (Kees Monshouwer) - commits dd943dd and 58c4834: Change ifdef to check for __GLIBC__ instead of __linux__ to prevent errors with other libc's (James Taylor) - commit c929d50: Try to raise open files before dropping privileges (Aki Tuomi) - commit 69fd3dc: Add newline to carbon error message on auth (Aki Tuomi) - commit 3064f80: Make sure we send servfail on error (Aki Tuomi) - commit b004529: Ship lmdb-example.pl in tarball (Ruben Kerkhof) - commit 9e6b24f: Allocate TCP buffer dynamically, decreasing stack usage - commit 267fdde: throw if getSOA gets non-SOA record- update to 3.4.3 Bug fixes: - [commit ceb49ce] pdns_control: exit 1 on unknown command (Ruben Kerkhof) - [commit 1406891]: evaluate KSK ZSK pairs per algorithm (Kees Monshouwer) - [commit 3ca050f]: always set di.notified_serial in getAllDomains (Kees Monshouwer) - [commit d9d09e1]: pdns_control: don't open socket in /tmp (Ruben Kerkhof) New features: - [commit 2f67952]: Limit who can send us AXFR notify queries (Ruben Kerkhof) Improvements: - [commit d7bec64]: respond REFUSED instead of NOERROR for "unknown zone" situations - [commit ebeb9d7]: Check for Lua 5.3 (Ruben Kerkhof) - [commit d09931d]: Check compiler for relro support instead of linker (Ruben Kerkhof) - [commit c4b0d0c]: Replace PacketHandler with UeberBackend where possible (Christian Hofstaedtler) - [commit 5a85152]: PacketHandler: Share UeberBackend with DNSSECKeeper (Christian Hofstaedtler) - [commit 97bd444]: fix building with GCC 5 Experimental API changes (Christian Hofstaedtler): - [commit ca44706]: API: move shared DomainInfo reader into it's own function - [commit 102602f]: API: allow writing to domains.account field - [commit d82f632]: API: read and expose domain account field - [commit 2b06977]: API: be more strict when parsing record contents - [commit 2f72b7c]: API: Reject unknown types (TYPE0) - [commit d82f632]: API: read and expose domain account field- set $LD for now. this fixes the configure check for relro,now.- remove custom PIE handling. upstream does it for us now.- update to 3.4.2 This is a performance and bugfix update to 3.4.1 and any earlier version. For high traffic setups, including those using DNSSEC, upgrading to 3.4.2 may show tremendous performance increases. A list of changes since 3.4.1 follows. Please see the full clickable changelog at https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-342 - move man pages to section 1 to follow upstream change- disable botan and geoip on SLE_12 because of missing dependencies.- Fixed broken _localstatedir- fix bashisms in pre script- update to version 3.4.1 Changes since 3.4.0: * commit dcd6524, commit a8750a5, commit 7dc86bf, commit 2fda71f: PowerDNS now polls the security status of a release at startup and periodically. More detail on this feature, and how to turn it off, can be found in Section 2, “Security polling”. * commit 5fe6dc0: API: Replace HTTP Basic auth with static key in custom header (X-API-Key) * commit 4a95ab4: Use transaction for pdnssec increase-serial * commit 6e82a23: Don't empty ordername during pdnssec increase-serial * commit 535f4e3: honor SOA-EDIT while considering "empty IXFR" fallback, fixes ticket 1835. This fixes slaving of signed zones to IXFR-aware slaves like NSD or BIND.- only enable geoip backend on distros newer than 12.3 before the package lacks the pkg-config file and there is no fallback to finding geoip without it.- fix permissions of the home directory- enable some backends that we had forgotten: - pipe (main package) - random (main package) - geoip (new subpackage) - new BR: yaml-cpp-devel and GeoIP-devellamb58 16008687244.1.8-lp151.2.9.14.1.8-lp151.2.9.1libremotebackend.so/usr/lib64/pdns/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:13121/openSUSE_Leap_15.1_Update/09357eebd4b440097887cd3db35b8206-pdns.openSUSE_Leap_15.1_Updatedrpmxz5x86_64-suse-linuxELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=3d3bf874c865074fc958dff337b9be51d5f3b02e, strippedPRRRRRRRR R RR R RR RRRRMBEJQdt0utf-80800fbfe28cbb83edf80f6d7d0b6e7de866000257cb488e617307bddda73b933? 7zXZ !t/e'R]"k%4960E<$#]CY_2IJGrZ#H@uA|rSlZXKM mȫ.b4iXLʟFSw>6c_8,GJ qE}zFuQ?ݭ}u98?c{n,*f̙S'⣫&N$j#D@)ƾQ>NN uh|g% ƌ& q̸UOA(O9 dboOMҌ5<2y[uo~N`62!s-r3G]eYw "ѳLN_.!P#R)V!jݨ)]'pZE>)@S,zydj ^whSH8?ٖ[m|oۻWSӿ3hT>9g#ĩ2[#<]z|`_1D?Y=IIމpTP5~>6TLnȾRWL,? |Cqy% < = H[H;mc_^ <:o"m.dmjuVKrA('go3qyD(  ] ܁aZ^h@%gZ_gn:5ޞπ}a24m `-Y6B/$e1-Z wL',n@P4-I{2~3z1v/P70#wp3`סƯE.3cx $"톯3$}[Mn}s1O>p3mEaghjbdK[8Vǖ}^dd[2qhAIѬ6_J}r#Fr(\C8 FHW;Aҝ6d6+= _"O^尭H+A',̆j|B2ҔV3ǢsBxJoG[R?IL팃OREFNsׁ`N3V) !z gkCFa6'z% 」+- 2oD(D@Ȣa0Sֆ ۠H֐I+XU{R8RuАx!i^x6%ΥVЁ/f/}7bV0Cc甝DPNY sU|euvBK Be@h=%qt xWL"@jAIMxk*/n?m,A+zӚkQ4 XQpPqہ&*Bj F pnY| 1j$.dut󾒥Pdq9q5X-_Aaf_5Lhýd8WzQHW}Uu)xc@%l0]:q)emhCb0z3Ac<)[pl &$Հno)<=8 r\2y->:k=Ь/mGt⛈dgOUt]lm fI?<&8S=4EOn Pj:kEyq E]Y9u axO%69br39#&"w~=޹PMN21ק{Y$nMdKdDN6_ c: *LB&~Og:&Ѻ}4\h[Ɂϣ`1*K7p Bڗ!{YoǷ)פ./*"={o9/VŖU;JHk13Bx_ԤE1vҵMc 'g^;_ZZoF]m$fx%W۾!2ƴ'(4u$SFQ PiU S3Bnz u"+vt^HBV~}۵h/ Ήzj8 Z 8C@ rGa(74 T[ﳦ@iWr9(#LVQPXK xTfO@_="-üCEJCrX&΁#T ɒZ H쏄&n2-̦7Y9G`]n^ m{g!}c>C_D6rnZb28-WO &GMgyu=K{JuYg/@*gH=l;gz(AƳ*Z@CP$B <5t+{KzlC{,gUt'\>=ho;aUXmk"^$O&} D½eJÌ V*2YZOﭦ8 C ƈBX0ޭAbp@0w l1>i)4ueLR:JLU)vFoyam&W73o @3Բh8@;M`(:QeW ԉ)#ǶWI<-),Sr#>+@"p8: =!v풏RV%pk=#R\XGXZ׮%{a=S'[ O( St YAswĝ_/ XIP q.ܠ"=G>pYݵ".7`AboQ3 ]Ln̷ӽ2ߕ8ҷU5q\2yY.޸(Eo%N/e_L^#.2ƟV6+=\Y 66L[U8(0;?GDUodJg OM_?%Zgn8mȣ'10Qw)󫆳(ڵ:A{als͗_Y@Q؜LM&IMUrJU9֢¥͘qC0JOϟdZdf:dŷٰTWtڸ8I~p"ee#2!N'Ι~vB OCdG1Dyۯ &HϤWsDŽ|z Eѿ_%5CtzNdPlׯq(pa T#l dӶމSNj@ЧGߪL j\t#ܮ#*Ou5 P4uj.euD4֬H>ЁC"71%+r\^ZҭS[| Vt8N\zCG%E߮YvګuX1 ĉA[_Z CPj-!q.jbzHH7SxȽ`ss r5 !eKh3FH +H 2:T8"pψ[X,N* r{q0Wt]|쎱y ?ǀ ]xwP5cXK8B|2P$3' J E7W՛.m~Қ-BeB6#m{HRu1ѭzN* Xx&V_k-BmE$RY/* E|q-Yi۸cjb[D*=%zLT8T&O{YAo)6@tC [y{֥{Չ~3 W&[WzwBdL, $eХ" ~w&q/%%0!4l_ڼS8qT=Tr N}`fR؟3 t*ƈS\7@ T W8xchl^ޜݑ29%Qȟ( z^T7k$òMt~#\#.Po`oP:eӲ ;Dǎm跸ITsin4U|gqYa}FJ  <6΀[2\2Ebwm@=O%JY?в*9F~4z7Qh?)%*ÕsgHUJ0WǨ ok][R%R$Fa^0K_o}:8+ c/aw%?7Ab `}O M EPԲ U <”JzxۘUH`V 2'Ly\qf&g_,N&T]v%k&BFV/xGh!AxB8fV }Q#1F)g,@qi@$!mn)k.K:y@MTV4r +*`s`uN3Ջ\űDjYݾx3 鿞5jRMgYۊR$qE$ σ4)'wm_xpUry6'^zgOcz\I"Uu ӭ;m?sKQg>15k^Օh޳uTPtBj-jipH:mZ!ꙫUg}`L$]__d)5\/P*@8ٌ*xC>9r0ͷv74={-^QQEj-'/S~n**g#cg. -UHC VU&-pWFWnC,,njC.j},ߛ,HAĤ]2!fVk<3${p- vW!.J.Y -\5'be}Q 5KVE_t6_ډ Y6z~U=Cɂ>q]AO,01 .FSt(bdY5ctd+өnKaLn7~6)t|[K+HE7gOV#v^eݳiIrn\(T+I7v n9Xkf?{Yi..!ɇ)LSᖀi.F5Y* #}#V̗2?@yFx4/b&󵴴Aqv`fQjQk?@3gσr H!-v ]\:ia74ˆÆ6*9tkp(ߢ?$Vſpp'}i#Z0C Y@loۚ"D daqyؕ0JK~ڥVϽF7\,Ύ7aak^vqbY͈"ڜE{2}b|ZDl֭`Vl1shRr/UF>vnkk0TO%6Ǜ,.ŽDh #vŲ]Z&a(JƃM%mr: +v #|[!~7=_Ik=t Y,p?sz%bsH%`$4% o s3 ws ~=ppN*!9wt)o5?Iw>[PY@Xv_՚ȯw-:R҇I4WVZ[l GLV>g_#MDtF2JX_W uMO:*\W@0@89`aGG ?daˆ%)#3e.0;&Z,XǞH|D2OBvB2d CFn\nm%ZAIѺRo%1ӏ:1h2HK:}$sKKReO򆖈VCH>` vXʚlzv^YirmXxI|]rĀxˑL]WJ ܍6=%2~s*' M-Mp Z7+[^>ᤎTnpӜ0 hZPPD+AafASXmm MāgAV(`Hb\ˣ@W"'3[U1]։)M J. p=hc %8*N|y8FقUSb5з?N!uZ_`Q'L~ j1[z;9rhDdi3j%|ߎ9FU.ژ!xsjesbI&˧|n5Mc< CJ"KT, C݅˩׫d>@O=]!KÉf9 OrOex%6xk}8t5>h? k R *ݗ8?y˅.s@9p8 } _ %g YP=R[ jk &eipp2@[ "T|ʟTg$~'≝0-T{l";dHR~}7a 'KlXD* kH]BDp @xjK1MO7Aܽh, {"b%&+C`t {sε[@93S-2xou,<˫& EWt1w[|&& ^8xAzR΄3E+Zvœܲz^Bݷaiۚ Rc~.@5,-Ů<]pN%M~>l u,,yTG.OJ98.S35 ^=i^z$熮enB+﹄{k;ChK5vѓc68o+uOn,3X/Myh8iۄd x?a `?;ַE!>u+l3U`gSh9ph.;\&Ffn Ɗ-pF{>ˆr5&}rށo\H Fł؂v>ZEwܚ 0s+Xbnй@»Xƽܺt{jy}(-dhv`Uq\!\d(wWLzFRL2c b*_q4E%2IIZ}l08cEXL Ǝr=xnXk] ǥ͗;*눦*CBHЎ-|:xPpЂp)XKnK8JU剛ɛeEbF'rڦ%4;?˫5rc -~? x_뛙'1g*wKZo\-섋 g{\0_iy(xF?KO& "JXLv=+ݞD$UL[?z>+1s43H 郑Wz3uuMa*5_G'7$$C%Me4DdR,M`P> ,^U*-_TRlMuW{]);_.ߴջΠ!ˌL[P(`sJTƞĔr-eL=gABMAr؜Ԩrƾ#7kCpͨ֬Uy[x~G2h @{¤pjݴ) IhlY Ⱦ63<ߐFӕεi$$qZ3=mQh2%\0ŧ/!Wukm򪹱L{΀K։GwLͬ=W3mp 8~P6fF.fc_;'7K$ dő]̉ٸK-%xkyAD%a"׋1^6a? O*Ca<&(8t z$gh ^yҿYh2.Љ^o$C$L]tw膤I.ݎQ%VY8&ב&[y>*}7v4{~kYC  )\i,-Y"s9 ^eqR6U%׏eL'B`G?>%B*u<[b7ۡtYAx'{+ )PJ˵\sJm2e[obaZGvƥ5d/uބ5i}(-FovJy ' JM幢:jߝןsR0y@ׂX4ZFNbmmǏwkMCze/<ɿn&8D͔Jj0 +ޣ6gTq$9Y#Dv[mv(z C6::Yl~Յe z"R:s8`,1`ߣlx/DSuGTMS _Aw4#S%n=3`)g:q&ar:إ镴,R?ǹ3(B@3P{S\ο'%kpq/:{]N56*Їj>k=,%6J -7Dv7R6lsŦTT':2 _wFi+u`Õg FǖICUVA$k^h$H48@SUg2Mx [ ԷqEtj^Ak;Uhym8L[Ib7;NRW4 󇸮WfgÑ槊]y!TPj SPd}rCS.ʵ. `s8@#R}ҥ9*kٵ_~z=AZO'kc=ac1%PkklMqAibZ@-M/KD]+:\S[Ȋ(' %j&KŸ0E= b||hw3I54/POu:r;y/xݦߐ ?S%0jx|3xU# ,o(XRE2_AzMF^P.fQ@kV#cLļQǴtf/]}WM(gڤӑPrrתj(Ѭ᫃-HaX).I4y*e(/I(='e]x?֑_̦$ _LD;+!Jl֓հ Ԛ0(B{avI&!g-0`aX:A(ϴ>]X&݇x5~~5ipcxu>lȪ<'ſlQy0q{(nZqic9' 1 Rt\3jErf]+,Fv6tDOBx\o-}=O7Y H^K#~8Ez*JñALT(/!|"@8w*9|NMjHNWϱ_FPv(V%w`1a 'm !Rs`[, ⱝ.L,f}p]~dhy@uȹDŽH)(,;:ȇ%)DMw"N؞â<ч! 4BR-SK4;YXǓ6,idsWerG; %qkT*0[TZ7Tm чH6Ql'ASٌB^*]JUPѢܠQG±-{aatΝ?3pRK}ʱZȍacD%(MDyheg"{Oq ]FҋChAnrY(p nAA8F(&?y*7:$D {UUj [@H*;g@g'|bFpH`I'G*D5끃ĀzkL}ik&Dl K#ފބhۯ7)ip Md[Qſ ʂ8~a9GWt#7[Yh Te%h{[: &<ĩ|O6Ganm `(; *e7[iǣV7ͭ:"#|C=7ēQSF3ok]OLB$rVe]e7e;ĆZ',/翘D!Q[t# GE,u 'Ѯ%VXڒz{U':Z!J'%q^ITȻᰪ^K6?،`:8ņ@nF-ͪ[sEEY5ti,]`9FV:E ћ 0uCahoދ3 zuc0RF>.$OʱN Z\ˢjwFCeyesn0tE @RzN?r*'R9bX!~NN|;]i'4<S%ox~PO!Ri["nxyk1 ymzj M~ɜ!3Y0숏/ꎥQ'_RZ|Š1v D˃ULOY3h;\qC1ߌEm]~0~J=~p@(i<2HSh\F5ݞN$m2Fk[0q.0BYþ+.&CfԴ)lR;{ $fVCYC7XT9ً-xu]+^a4 w};~u1<$A;.BwvF|sw!XK X` @ħsB1$Z-*֔I =w.79y߬CGC fFĦ"C ŻA J'jRukD LMpqVɵ:hὪC nǁhe8giҹ\CYf gsηLbJ0ýV{E H >;nE7Q^ܺDr3Ȁj~Iƒ<lSc !J_u+\^f?&٤Y_ Ֆ@6!}w9:v1<-.+^|s{Uj0)qwV%Iy<5XbU]V c_Mͭ[es=OyPg1{GdYVu6S^J?HӍksbFֻN Ã{8WQ4# ` 5ˇU(8_Ez*+Nu JOɋS|LoB|-Ep*OhoE d#[;^j XX4+Goo'Ec"azY\ F R gcMVBJ;ٳo.IȅS1827lcr܏rbc]LD1lda=.V pm907% !~^YV{~ܙ!aJ`LKD38׺L|9)JH^O8~_}Ҡ6ڒw=EEYQ+f|Dï*͜9|8dvS:͙JvĚm7{@uW5~ܾҐлQ++OBT:EMςTҰyK=k aV9LiI[qcчqڵz]ё]c ?R:n*48V5ȣ7lN N{KypWA,S,T\@h};#tc~xP5){Z93(~>WI@҉31dx10?kgC~}Ե)!؎(z\"̂kʟ`<몏mQe&]ܰq+&_S{].鿇 \!}~%=%E/"2c;N MX/jghJ0"?T~8dT22nny J,wAI d &?6`_ɧ֫W-ifDt@@^PcInUa5U&9^*.p{CWFlNJ$^'+se~4 ?n 0,]p+XTz%}@=I)df:/RN<~L}l8u\zZ)"{/un/s䗴fC`ʰHHϸ58G"p'G9DQ;SR4:rؼhH ޴:s H$Zt LALuGn w@՚NY^WX'QG1;s_01dY`t&0n)V !`+ry/ 8KJ\/ycp%I2tq Xs+5|fjJñҟ·r-WkM9iʣ~LpFKMd}@:پSBLK`3L[g/ Hk&+ׅPw1 |TqQckhcHm{%k1^fb>)7օݳ/,WL9xgb/ rE=+=Xt*zlA^먾"ϻ$DsThGGIpɑᖉoYކska{%,Q' ۿ[yYF5}nx/{•ĊN򪑞Ii#d 1:ړZ=٩*&!w-S Q$oF2KFdISW&nLB QINw4/#%<kMȄ>3 # ʮ ;,8W,4 n 9?r'KiThLݽm;Ug8d[##_k1MV룵#;M̯et@=W߃],-<51lGfPv[Dw>G&~[x!^˟%|e`0^% `Êvk2WKq_#&X/,sOz-0Ro8'ah/NȰ7𝪬<t + ;p,Zȟ\N̪;RX&6#H87fI N+,o{/ w K}źwO_Alu#DR-J* eh;[o; )L=/{$ t}0p{6d{2푷UG΂9 y- v%b )}&x HjI>SԚ/@umIL3m-9T8Oos&tq' Ob5<0J$y}JW`g>H*Tu][.5Brʧw@ 9mWLїCy \DnGS{g(G9!zfҾV0V߹sh3Xo*@ațks[S"P$ۢ$ -ըGk1!u 6xiQM&dcmkA Me7t?s`jDrsxi[~$OtkL9xPZQLTV/ء͚(J]hMc/2 1Kj:wSϘB?3$D.cy,AַL)fq{#.n1YF~FM_:nE&_R|%5vX qNyl!PLR T f.@Vlv T8JsYTJiD`X샤U:JL6 z,M3OAX%;<;4E&Gc ży(mI3,H[{nUn0Ubq49T(LPX־hXobKC]y/7*p2a9VN/ſ}^`u=vhA~}\IQd|5~g!%Qf$Fi\ΓVh5GHC L)CωW3W1ʝZ"A3qsu3p^*]h*B 㫢Z)A ,muYwA'C_)l+86ZoW(H2X)U*e"mD{w!e)%NM"sX͝*Ξt j޼Ê$5^a2x#Ձ7Rߖ>dK4y@TLXN`BÃ?a"⃔hōpm:0G;& ijL2pm59pهq^1Yf'|cnd缺!Qb%`{toO(*#bV764kh Mu8Z)KɶxlB( yh}Jѷ_&eX,bMރ-)ˑsFQoFvsY02)щ1O^X_rCK`*i;J =yXji/H:j6w7!G[Ѝߑ;jGSMơ'pOewrYu7Śqr^ U{JR2@tt umn~uschğF\Y.w 8EB,mpPz| k0Z%fإcǟѩjGn/& UJB`㏇\:lЭ`Jіe7xZ&5|MLHj%aiz4uOO=$~}FEVlQ}Ljk[J,/?T! ms/U=0% cEFss)ef3Ow@%qV_o#4!ח[5&,.SwEu92Z)9 6aXWc ?lQXn}ظra-z;#g%iF%5ͦ4]9rg-&}Fy%- % H4g=ĩqaw䯀^OVDWv5Jj̗ːP[l8;-T}6!SCL]TLY15n- b 鶺WMLkԙ\/ Ashc U&O$ > 7_*g_(PXrIJA[>*nu&E%]"aI5qfSoZ&|',J:ߠu]5խKmƱ'W2ɗP@K@9"tS"5Z@tNl]XbZG쏴 = 14"5b`ٛ[aB:ׂo)^PuO<[腤 @+pֱ R.l._2%`wh%x*ÁX~1k2SyjhuK*d?TMORzsOE0`JY) U 1~$2 'gO!IU3u5vRhN[ӊ6vu7GLB2}3*?ϢV7}LOJCk Xdv UP[\<[r8JJc/V}M)~ՀW (Cr-qqeB8L9 ߏ H,;͊"wa& &$ v3<;Ka>0J/s{ @G P% Ԅ}-`T! :#>7S̟!rwӐnѐ'z0U>=-g=7G(}DH߽7Ԙ DDm @( /.AW>ϔ@R'$ūCU*Xɦz.~V=k`Y_T/:rl5QuR#۷{+eqQ >?#WDҺc*UdwϠ8J&KC3z _r:kt{>,]}7I_f0Yph'?3=ۥW6RlzkeiF(tJAx&䰪 ;F_WeЇXl` X .R}.ȼ\K>h 6k%dv/*}-j`T""B:! QQ4'FwO!V1|t .py~m~.F GvPhxǓ2vuf(zdZV9J]3 }qJm Q)WVi@ C6*ֈÊ6cԩ^n6/R+Ά{T[В4 bС5GުҔ/&{GUOWh$i{8XTjv1Uξ?K5/(35I~!UBy m{͘R@BUwHɡ 0(+_`ϡ;'P3ٟm(b-9631u?"[JvD?g@"NM\`E"biGp1]ti 7UX%KsT 3' _{3@$b~q?9qdsY&Cp0SOl y R\W2eQd"!1j8*gA<{%c_Ȭ$.&0ȢSmJ}ifoj3C/\f̝Z{&>=&?g,8aQcҳk~ $>|&ʇpLCA_,b)a08Z}`q65F d9!E]o\0?Ȍ"/G?UW Ȃ߬^6sm05a..1u7;ͫ+gЙ%Y2Cf\֬juBKsdq\O;%8ܥwG4UYc0 Λkޫ