ipa-hcc-selinux-0.17-2.el8 > 6 6_6 3!y덏%!E/֡f? !E/֡Ǯ[9fPDy,f{C;,-a[=?U,;u&N Gi,˓\Ӗ`gb}3iTt!1z;.izI.Ќ)0 ^1]>HqQq%K`-"a{@r B5_3h0[׿4O䐘??T]5&w~nU8-l)R,J(GW*Ve&`~5q& ͅ5e~ڪ~p ]A7S:7T 6ͭWuR\HEbEDPh拌CY:#οmf &Gv4'ѳ>Wu;5 %FZ!@Gs$;p!+bO׾%+\hn6[yIܜF3]0p/f1/m^-Ah)il8. ,vܮX-@j"ך3$Ɏ2Z}v 3Ã5KV>33W9aM\3R7TCDZ˴i.~UѦ|ڐmNF{EZxW^V9aQ<<3J}I>vmd>pB9 ?8d  ?pt "w,D P \ t z  @  ()809|: =3>3@3G3H3I3X3Y3\4]4 ^4rb5d6Ie6Nf6Ql6St6lu6v668z88888Cipa-hcc-selinux0.172.el8SELinux policy for ipa-hcc-serverCustom SELinux policy module for ipa-hcc-serverf7buildvm-s390x-03.s390.fedoraproject.orgIFedora ProjectFedora ProjectGPL-3.0-or-laterFedora ProjectUnspecifiedhttps://github.com/podengo-project/ipa-hcclinuxnoarch . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then [ -f /var/lib/rpm-state/file_contexts.pre ] || cp -f /etc/selinux/${SELINUXTYPE}/contexts/files/file_contexts /var/lib/rpm-state/file_contexts.pre fi . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if [ "${SELINUXTYPE}" = "${_policytype}" ]; then /usr/sbin/semodule -n -s ${_policytype} -X 200 -i /usr/share/selinux/packages/targeted/ipa-hcc.pp.bz2 /usr/sbin/selinuxenabled && /usr/sbin/load_policy || : fiif [ $1 -eq 0 ]; then . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if [ $1 -eq 0 ]; then if [ "${SELINUXTYPE}" = "${_policytype}" ]; then /usr/sbin/semodule -n -X 200 -s ${_policytype} -r ipa-hcc &> /dev/null || : /usr/sbin/selinuxenabled && /usr/sbin/load_policy || : fi fi fi'_K&A큤A큤f7fff7ff794fc60c37a254bedf2a580831e8e8f11a9a3558f533c3fbbdfa7a415f4031fda1ccd7df80136f26c5df5a81921dfbcb597d4ad4ae8792a8421cdb0b8e9d3272e8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903306270af1374aa1a6c8b2c143399a65627669074bcea8d2910802d446e299607rootrootrootrootrootrootrootrootrootrootrootrootipa-hcc-0.17-2.el8.src.rpmipa-hcc-selinux      /bin/sh/bin/sh/bin/sh/bin/shrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)selinux-policy-targetedselinux-policy-targeted3.0.4-14.6.0-14.0-15.2-13.14.3-1073.14.3-1074.14.3ff9@f[f @ee~@eod@d@ddd?d$(@d@c@ccۥcccChristian Heimes 0.17-2Christian Heimes 0.17-1Christian Heimes - 0.16-2Christian Heimes 0.16-1Christian Heimes 0.15-1Christian Heimes 0.14-1Christian Heimes 0.13-1Christian Heimes 0.12-1Christian Heimes 0.11-1Christian Heimes 0.10-1Christian Heimes 0.9-1Christian Heimes 0.8-1Christian Heimes 0.7-1Christian Heimes 0.6-1Christian Heimes 0.5-1Christian Heimes 0.4-1Christian Heimes 0.3-1Christian Heimes 0.2-1Christian Heimes 0.1-1- ipa-hcc-client depends on ipa-client again- Don't install /etc/ipa/hcc.conf by default - Refactor: Client scripts now use hccplatform - refactor: Move all server code to ipahcc.server - Feat: Server features detect Console from rhsm.conf - feat: SELinux policy for ipa-hcc-server - Fix EPEL 8 build- Allow build without idm:DL1 module- HMS-3840 feat: Detect configuration from rhsm.conf - ipahcc-stage-console now configures proxy - HMS-3821 feat: auto enrollment can set DNS resolver - More Fedora packaging fixes - Implement testing with Stage Console APIs - Implement console proxy settings- add CONTRIBUTING.md guidelines - Fedora packaging fixes- Prepare ipa-hcc for Fedora packaging - infra: Add helper for stage console testing - Fix: pylint warning R1737 - Fix: Typo in ipa-hcc-auto-enrollment sysconfig - Fix various infra issues - fix HMS-2066: Add timeout to confirmation prompt - test: Test on RHEL 9.3 / 8.9- feat: Enhance reporting and logging - feat: Check remote status with HCC - refactor: Use context="hcc" in IPA API - infra: Log JSON error information - infra: Refresh cache and config file - fix: Use LDAP for public JWKs - refactor: Run ipa-client-automount - fix: Replace legacy with modern Insights API - fix: Limit hostname to 63 characters - fix: Use UEP CA to access prod cert-api - fix: Don't create global DNSResolver - feat: Add ipahcc-client-prepare - fix: Fake headers can use org_id/cn from RHSM cert - refactor: Change to --idmsvc-api-url - HMS-2348 feat: Add ephemeral fake header to auto-enrollment - test: Run CI on Fedora 39, drop 37 - fix: Better error reporting for missing RHSM cert - fix: Fix typo fdqn -> fqdn - Fix: Keycloak SSO provider requires openid scope - doc: Add test instructions and hcc.conf info - HMS-2814 feat: IPA client installer and automount - test: idm-ci now requires local cloud auth - feat: Add sso.rh.c IdP provider definitions - HMS-2694 fix: Update JWST issuer and docs - HMS-2595 feat: Extend ipa-hcc to retrieve+store JWKs - test: Fix and improve coverage - fix: Update spec file URL - fix: Update git repo URL - HMS-2594: IPA plugin for HCC JWKs - test: Do not install KRA - HMS-2532 fix: attach to api commit - HMS-2491 test: Enable backend tests again - HMS-2491 test: Allow backend test to fail - HMS-2491 refactor: Separate GET signing keys - HMS-2491 test: Update test infra for DRT - HMS-2491 feat: Remove old domain registration - HMS-2491 feat: Update for domain token workflow - refactor: Remove env patching - HMS-2446 feat: New domain reg token - fix: Use gssproxy client keytab - HMS-2446 refactor: Move IPA API to WSGI framework - tests: Add test for deserialize() - tests: Check that serializing compact form gives a ValueError - feat: Add additional check json deserialization and update docs - feat: Rename deserialize_json to deserialize - feat: Do not allow compact serialization for MultiJWST - test: Enable mypy checker for tests - feat: Add domain token to mockapi - test: Run CI with Fedora 37 and 38 - HMS-2070 feat: Remove D-Bus service- fix: use new Quay org for CI images - HMS-1789 tests: use @podengo/ipa-hcc COPR - fix: Support latest tox on Fedora 38 - fix: Allow non-compact JWT serialization - fix: use OpenAPI from public GitHub repo - test: Build SRPM and RPMs on GHA - test: update packages in containers - fix: Don't hard-code inventory url - doc: Add documentation for developers - HMS-2195: fix: Use idmsvc as API slug - feat: update locations - fix: Fix typo in automember rule - HMS-2147 fix: use HostConfIpa schema in HostConfResponse - refactor: Use setuptools to install Python code - fix: store public JWK in separate file - HMS-1857 feat: signed assertion for host registration - HMS-1857 feat: Add multi-sig and host token - HMS-1289 fix: Remove inventory_id from HostConfResponse - HMS-1857 feat: Add JWK abstraction and helpers - feat: Update JSON schema from latest OpenAPI - HMS-2038 test: Smoke tests with idm-domains-backend - HMS-2068: Drop support for RHEL without PKINIT- HMS-2052 build: Use OpenAPI schema from idm-domains-api - HMS-2038 test: catch metadata misconfiguration early - fix: Move rpkg output out of .tox directory - HMS-2041 fix: Represent org id as string, not int - HMS-2038 test: Improve testing with backend compose - HMS-1991 fix: Tighten OpenAPI schema - HMS-2008 feat: Adopt JSON API error objects - Add definitions for missing JSON schemas - HMS-1991 feat: Generate schema JSON files from OpenAPI - HMS-1991: Refactor JSON schema - Add project and build definitions to pyproject.toml - HMS-1898: Fix and validate error response - HMS-1975: Remove check-host API endpoint - Improve CI and test with Python 3.9 (RHEL 9) - register: prompt for confirmation - HMS-1926: Friendly D-Bus error message - ipa-hcc CLI: print human-readable messages - Document how to configure for ephemeral - logging: pretty print API response - Reconcile JSON schema with idm-domains-backend OpenAPI - Add verbose logging to ipa-hcc - Prepare release 0.11 - Ephemeral env support with fake headers - Improve Makefile and tox runner - yamllint: don't apply truthy test to map keys - Rename field 'cacerts' to 'ca_certs' - Reconcile domain response schema - Reconcile register/update domain schema - Document how to install build and test deps - HMS-1898 Reconcile error result schema - Ruff: silence F811 redefined-while-unused- [HMS-1788] Add simple GH CI workflow - [HMS-1779] Move secrets and settings to CI/CD variables - [HMS-1645] Replace bandit/flake8 with ruff linter - Add infrastructure for mypy type checks - [HMS-1645] Drop IPA 4.6 compatibility workarounds - [HMS-1645] Drop Python 2 compatibility - Run integration tests in FIPS mode - [HMS-1645] Drop support for RHEL 7- Last version with RHEL 7 / Python 2.7 support - [HMS-1607] Use inventory_id in API routes - [HMS-1607] Move common WSGI code into module - Include os-release id and version in HTTP header - [HMS-1479] Implement status check - Drop bundle file, add more ipaserver tests - Detect and block auto-enrollment with FQDN localhost - [HMS-1472] Switch from admintool to D-Bus CLI - Add tests for dbus service, fix hccapi - Move cert parsing into common function - Validate insights registration state- Fold common and registration-service into ipa-hcc-server - Default to stage - Add title and description to JSON schema - Use D-Bus service and simplify config - Download PKINIT chain from registration service - Add mock tests for mockapi service, refactor code - [HMS-1485] Add --location to auto-enrollment script - Verify with pylint and fix violations - Use server role to indicate presence of ipa-hcc plugin - [HMS-1485] Add IPA location information to domain - Add D-Bus service for checking host in HBI - [HMS-1475] Add tests for registration WSGI server - [HMS-1475] Refactor and test auto enrollment client - Test with RHEL 7.9 server - Remove dependency on requests - Rename smid -> rhsm_id, drop redundant rhsm_id from body - Move API handler in separate module, add JSON schema- Fix config_mod(hcc_update_server_server) API call - Improve idm-ci - Refactor project structure - Add timeout option - Remove unused cert info and detect_environment - Split ipa_hcc_cli into CLI interface and logic - Add systemd timer service - Add global hccDomainId, use domain_id in PUT request - Add HCC update role and register/update subcommands - Add ipa-hcc to register/update domain with HCC - Update rhsm_id in server's host entry - - Add server role for HCC enrollment service - Fix deployment and rhc connect in stage environment - Test on RHEL 9.2, 8.8 - Add mockapi with test API endpoints- Add metadata to deploy with local builds - build and deploy RPMs from current checkout - Add QEW test and metadata file - Add idm-ci playbook and metadata - Add tox CI with custom image - Fix stage env support - Add 1minutetip and virt-builder scripts - More validation of PKINIT options - Write custom krb5.conf, handle missing domain better, more arg checks - Drop 'not krbprincipalkey' check for testing - Mention SHA-1 PKINIT issue on old RHEL 7 and 8.6 servers- Fallback to kinit with PKINIT + ipa-getkeytab on systems without PKINIT support ipa-client-install - Add support for IPA 4.6 on RHEL 7 with Python 2.7 and mod_nss - Handle platform-python on RHEL 8 - Sleep longer - Relax dependency on SELinux - Move keytab installation into auto enrollment - Basic tests for WSGI - Move /etc/ipa/hcc dir to registration-service RPM - Move scripts into ipaclient.hcc package- Detect stage/prod from rhsm.conf - Move refresh_token to /etc/ipa/hcc/refresh_token - Move more configuration into hccplatform - Remove keytab file on error - Add service with force=True option - Update permissions before adding privileges - Use ipa-ldap-updater instead of slow ipa-server-upgrade - Split server plugin and registration service updates- Rename package to ipa-hcc - Replace term 'consoleDot' with 'Hybrid Cloud Console'- Update CA chain to official RH certs with new SHA-256 Candlepin cert - Wait until host appears in ConsoleDot inventory - Always disconnect to get a fresh Kerberos ticket and connection - Add ipa-consoledot-consoledot.service - Remove old test data- Handle outdated keytab, autoconfig org id - Remove pkinit_anchors line on uninstall - Workaround for missing IdM features - Fix spec file dependencies - Automate ipa-getkeytab with update plugin - Move some files around, automate service and keytab - Update spec, add KRB5 snippet with anchors - Use more persistent connections - Add caching and logging to WSGI app - Add link from search facet to consoleDot inventory - Lookup host in consoleDot inventory - Regenerate certs with C=US instead of CN=US - Return shell script with certs - Add cross-signed certs - Add script to generate cross-signed Candlepin CA - Update README with more instructions - Require known CA issuer - Add WSGI service, roles, and cert mapping - Add test scripts - Add notes about cache and certmap-match - Add test data and instructions - Fix error reporting when global org id is missing - Use lower number for updates/schema so we can use 89 for test data - explain unique index - Add write permission - Add enrolled hosts to a hostgroup/bin/sh/bin/sh/bin/sh0.17-2.el8ipa-hcc-selinuxCONTRIBUTORS.txtREADME.mdipa-hcc-selinuxCOPYINGipa-hcc.pp.bz2/usr/share/doc//usr/share/doc/ipa-hcc-selinux//usr/share/licenses//usr/share/licenses/ipa-hcc-selinux//usr/share/selinux/packages/targeted/-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protectioncpioxz2noarch-redhat-linux-gnudirectoryASCII text . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then if [ -f /var/lib/rpm-state/file_contexts.pre ]; then /usr/sbin/fixfiles -C /var/lib/rpm-state/file_contexts.pre restore &> /dev/null rm -f /var/lib/rpm-state/file_contexts.pre fi fi /usr/sbin/restorecon -R /var/cache/ipa-hcc || : # with selinux/bin/shhttps://bugz.fedoraproject.org/ipa-hccutf-8832ae682e4355181464ebeedd8ba1b4b585bd53993fcce90624eddc18ff47047?7zXZ !#,c`t] b2u jӫ`(y0 ~ {.H>8b>%`1"/)P)/L$уƁ1TzT& ΢~n *QXT PswK|q/;p|/av4l|1y vFlңu*ןᜫa+@Js#$mA"8pnFVBhms({pAHNC1^Fw82.Tҭ $SLXqq~2u',gl7X ӧ>poD_'޲侗qG_T6Cs?M$F[G̛/?}>҃CBS:۸ȕH*g@5[ErӓGɅK۬e }Ƶ!4 ^#ϤqPZ3UrdPk4C`M~k$>'.3A26ķ21 ??_'hZ2 $?|s5| $S> z܍=ox[+q ,* W?=SV$&4 3sP+,޿4*ֆ2Mpg dQ l &ŦI=΢AT esr$F2{H8Mv} ? 0$\ktEjf\~>! :0D9ۃlG l6ՍzYRc?E1.V޳oE "=a! v 1$^hm:#׳h2@/̴oQyw-K F(W!w֒w=/q;C.N ~ޠJDt,lfXKQW3~#y *WإąӾіm*{NwL Nl0щTrA" qp=.Mwу c= \gIoa}*diLe rc@Y18GjSP-p v'}n:li|_Aᄫ+0;_n7y~Y[Pu O\RQn\B-D_g6S;t` ܫ5,}F|ɽ㺉M~QFOP cV6(׳=\%O1.3@^ zegɶ?6<>5M.C c"sR N"hZеJ{[(6GDFAяKF,G7yɠX=yaŸn X0fyTW'=b1^%' #i/77W}c$-IY1 gplפdQglGl_Kb"VhA{? gc2f.*#KTYZ`.Ľ7.wcVGDFQO(52'fK nra;ͤ$2؀*h/$Eӻz+0X',̨ ntX{rHgrٟ>bUkq~!"!Sgollܝ `Rx\CO "'pEW"`1HjXu\v\7oIg1:ĢfenHG9ȑ9d=eS^bu;#`pdUAJc o}Jgibi^du2lJP G :5S c/$hFVY E~ +oՏսAۧvwO>%UF`Wa!XK)GO%駮#3&dZf3:=jv9Z_ KU|zHzXcoO%-O  ] zڠI,8=褄8 .GP[t v号LǍŠ4d^.!#/$4o`F1+{S V0YBΤu!tUsABt`o2-Wg0dZ͂k1h\32#xNKtUOd#WLH ]Km)Q&.&5& ѯ4vM71Lqѕ3:BA2HAmrpIC njPn!>Ş¥󂛕GhO'^~겴;pVk;DWCOi9PFNJN\Gqg;-[:--TUղץFt3(18X gLZimL: =L$SN\45^-p`ZY47w<^a+oY1F1ngLxR7s$+8з !MN#Ou& \iܜXO-&z9x4wbl)0+.'>V+#m~[sWjUmI"]ZI`I.X 1UTO>^Foy9UdX`sB8*[N'Ǵ4h5k+cH(ݠ81k6Nd( MEo&Xxڛ/l'Eͫ-=tSG[YY ,wڔT2DлvZ&?<$&" IYAL=|>zJOtǬ6,l Yj[c4lܤ4y `@WrȰC_lXBm\Hom!5%ʸH6% K"T8cNܽwl㬫MK +8-Ŧb` TXόl/ֳ5N_^fh J(YTTyX vf1 8eT; ]JN^aWͯ䓐ᆨPP%Q@4b0kefcJV6ѧ };̐ QJ` 孰JfUrvڝǪGHdSdmQ[?_GL=j7_ntɖjp7יdzۭ b~J :~d ,N-#,2ig [<(YQ UYdā?GXʼnFT[`K^X.EWT4!Ш'tDziA.z655Vȼ5Rp<j,\PvGt(^|B'04{g`bBL 1mfW!m@n}al ;H)1Ñ>ȅCQ7P 20ϫ2M(m^ziU+$E=}39 wooRM&z8=QVʯ;7D&tP5נA|,BD5iHem[0סl:WE+ɤœp R)\ni_ʵ L&=8owCy2?^]Nci9Ur vДH1Gs}1zXT@~6:_n6Q_ }RIh+gxd$[ 8f/5bQwVY^.~[Y=,dZ% ) f}_yC &~+W;]O%OD xKZE6c&р:14P~Nv':Yu*P}=?B8\"Qu#4;dOwZ!`SoV]{.2+5[Aw2_@&n (L5(.y@XjU屽GQrׯ |l״ܾ-`j'D>{ҕ~\M3U_!\p[i?)M^hŴ  1;c KY`/5բ_M)fMȩzk+2EI_;H} 0w&ʡ8o D DhΨɟЦrqu+;fDtۡJiyd RO|տaw}O%.bOj?F(%U@81XTuvyțNj^4bA1z*`J+Ѽ OM: \(8AI+`QR)zg`C5wwTI_(PL缓EJ{%d fsџv$Or5~H5j3(i -]?gYO(dDgStRK2_e?87fN4 /lSzyΆu?iE #gV[,+|`TԂ3=i`{ GF&P6hOtM^=<^w1 @[k#r=V̱`l]cޒ\xQV!]7դ̽|>$uN2 wWXlLLԧ1v>9~]+7AaQ%BrE]cX1S'gLߗir(~ay%_]i}@"C f8֮`TDKBwd,SrrՅsU 6DYm;AO#UgD l6ڢp| o@.>49 y rR CGq r֬hav-t jڰyrҝ d8|'C+8-zOFEi]Mś}82絘h"Nɗ:.Q"i v\#$XI9{ a=א?mB7-<0P~}1KqK&hvOJB,W+5T.uyQ{$58Q-3{ksShB)=aQDXOwb`ͣ!̕ſ|YKf=-aQf!^k5jHΧ IlM@\,R;?5j"ۯ9ٸbUNjӰkٔ?Z;=GaOd h˂T:2s{z+SA5f8Yϊ߬3"'AZ?Wz1NÜ}} Tl[D欑1\)S(浾Q[9ӥ"cq)%zpO,9g pA&$~fHnT^'ɞF#K-bDX\ wʭ }p=C}Xz5Nn ܹr[B}q eGakX\V1ZXBv\CmmyuQ]m]y8aIkOtD^936{T6c!F)Sѽt!t(QΠo|'(I Q}L 8n&1ϓ)י5QPF;+i~Fl،n򦚺RKk{ !a֓=AW0">]-xPgq쓑dY W7~/BNc'E[J [t'g#@QrKtwm*MҟъM3{l0 [N\mۻy'9/ʀƓ 4񠓆ޮ *:W[`Yr&@m[OܑSM`5l :9+˸m1'UsFB&CB`KڨrnzN Ϊ/Y&!?a—e]6-IRDf,oeqP͑O; k=F1~p=|2 {MVZƚ~64^EQ0b 9mGw/+KiZvgVu"K#݊*ӋkY#qiluעxBf]MIt$H%t1O[N,՘*+%Equ]^=Õr||v,lg#j'?}|AD[z͠J_ΈO-_oQjN)Ŕb;ktX*Z r$, B5+%JR+ߙ<8ClmX(9Rcec!cǖg$(Y˽Rr}}7&m](jTME޴B-P8 avll 0wH {D 0L6ze_Z\L@vX`sq\ŋʝ=6Xycuiq&fΜD%XJ ^SjNE\Q=)I ՏCr¼6"RD;O'uV܎YZZTޫUu9"Y 8A۲PKh ҳ +[ZHhacs wթu6\۳ްƘl1A7\>{HDN[+O~kHjR< "@oCy `ȣSk8MBi-fPk#L{eag-"pMJ M]X(:@wQ_ősM zGMjo6f J_Qh]!78GDudh($\HEh/,0v߯ 0.p>Varl`50<J Վ9JYsOLZqjë}P#L<엕ݬN"/Uz!/vʍt>~oX9ԗρѺ#!.:Z Cj`?^qX(X(w{zϯ{s;#Ѽm[P|?/޳ ̉}f b֜~lNCں3>bTϢc4-lXh9يd=ASԅurY(/t ^Oxv@kբl<(A2eh$$h*="5RP(:~B!Qx|m1[ư8?B A8kRi;&;I"%@`^.35*-ёBi5^wc.v# c`Ɩ"xZ:U.Υ?)k"*Ӈ)t ,iH"|LҰ0/@˘*bFlvZ{CGWɬ)"agO VPc(O @*~lԭ izt#WBs' Eҏ1 LBn %$,J{R>:=kҧ+HogjrXqmx '43!;*G ɗ7|͇8!J|ڋA[(fps7љ"]nL mp vs)HbMJ6Mߘ7Q55W,*H*u1x<{zC] |pYHeZ Rὶa̦!Ln l8d`|Ks@ ߩ* *5GE6F$6=eŝ8BH&"N|MtpSp:w$. {w,Rꬱ4" jrr.:FOØAʌ \"ȜBolddnƿ[d3eBۯ,OpGf[F w7jnh,v  r*?|:JCmRs1B*Ș{ . 1iY-82z~7ƟYۧpJ1-V`:|{ ^(KWt?u]|Y9dTtc)/ÈSrG !T1a|R|F?yȲ"^iA(4Ϋ<@E,ϖ֓HN?WKtZ}>X~>ԫEFVmwP2 *22UGev۷ w?bwb [zAF%9Z[Sm٬ (gWBٙ3*'<Gם!^&A:x_u]ۆt#\eUyp%dDHA-($H[WMJ <_it]"{5YEy%Vi&xo+>=LC't0 ǟV4wyP69ۓS>(cAFjM-M!~Tvij}iBײFl4qgĭё24=p' \ pI`?0TkAJUX%nYP 2oO\VJCICevEJn|߃D~BPBגG~{uk`^T6935tq娛FF u]ܶ8Bi !ZP:jNy`bd6w:MaK5IoJ kž<A mm9[^1r?v&+v]|jv@pgon`~e&V[X;#A= gJjfIK&C;x>|G͈yuiV "LJqZcXI*qx̱6 Q!7J]+ū%^}xW(jXb`_e؅`wg*1a>~r" UѢ-0n~4}Fv'2Hy ~5-YqAXo5xb !4fdxߡɓ5b 㾷Pw!9j#[mPņ씾iJ,xNOR}%GSod("퐕ܪq߆<'O\=(|[*E,VϠ՟6Gu(0qMm4mNjOVD{i8=1D6dU?lZ y0!OE[9@Gw#nbc2n鲍$MKDUtS^w!wt2GOezdq+"nϞ]HhIlv)@A+xtvU_NVM#}!](9Pozh_h"bDf$1l,%$ΐVE.6dibn `z+&C 7nI\ҜNowpYmibuk5_<:V-p? ' oM.Ou$eQYDz)zjvS)&w[ؗqjntF+]n> x;ʛݑwe~i. 4N:R[O?+;K'Eo9Dpӷk{(xd? @o|⿎m΂qY% g9K)H&Ԭ1LۢB?~3[ύhkźi($O2ͷ׋4R6׳NK{6JCvٵ_ ~K#pM}q<3MFՐ[ @6 DaA}^Yi_ {Y@2VdҪ\085\rL\͛2J~hmswOvvf诠0>?My jwr^~yR<-Ae3HgՂ J婍 $j?ut5 aDXݕI0ԅr#cRz ?#qd3ZSÄ͎YzGǂ2V) RP%}U&xuY ;?UQ}e񔉡;vFPH.HVZ NDecTv`_I/76L9wys J]PI=A"tVUᲄ? ׹Ů iUmip|F%+6d%ùzDBDZ NDZ(1xsD$OmFFCr<8א;C1:C$d>jg xCˬ4) $.SQxMQgt}®R-PbcAW39^YHy5՛`6c#&: bO܅f3Js}3Y5܄+<8"x+Ajы%dpE˅'㠲9Pgp&Ms֚FKZ[᪁Œ2EE|tsy4tȺ8hf31b H dGQ#ĸ }~xۓ]pQTseP~|aeeA`O"c 4vgn3C羧?6GP~tExNlpIOWɵ~KΗz{h]FW5P^#-\]ypZw.54 Tq(m짯mڰl@NwB# #S#:Qy^CO;Ɠ fwk+'8ua[3)+ D]@!XgtӱOpiD?.U?ivp\,jk[`5[HT"BФV#+-E 3Z^jB-Ѱm 5k E|!"Ww}Hs ul_:PQiׯ?&%WM]~ S9b-2aHɝط޺Xd1%06u~nV,w0iIX_p m:2`JJ;`- j2ɾ7xIֹ|m. OPHbaB ;yZ7';h.ۀ[몟ahĸ #SkZ׽JM-#8J#;eD[k 0 ./GJF O0fۙϾ૨Iꡳ\uچrkcA**hD)7%6Q/P89\2_tvk~LuϾ~m!9&h ZWfTfg=f]. U߆9kRQ]"ܱ썽V({U$ ҂VBtd9)ec&oz:>k]5;CW,AL.z Dwq}5*ebc]|1K9^V%xƯ$p iG>*M$ 8zz2f g+(gܿq]FJ:@:DWɏ0bC+Ȧ?N/F'T(K#n4oM:2ZoQeASE h~cr]? [2TB&9| ]`D#)=e`DaLD$6XiSRGU ^,iPRZV#FQt+גvX!2'>9YyFOx\cv{9[jBKJj&H.ð?wmKa&TFU9u6L$ גlr`w7_Ek/"ag0[v?bi'Ymp;@`j}izSwM0am9!O^YBq.vA roLR"1: ܭp.;C+P!ՎR Y/o1|p!Q.޶ DL!Em/= .$3ڬG=q9a%Wԏgdeߺ۳rBfBA2F&uU6A`+`G{ 9F?| `1!Ւpjw' F^F㮁 xa=lI!!/Y[_Fcq-t0uvζZB/y"BFk"&#]{@ =fٙ~1:nWc}PGT )>7FKg+t%¾{b[:@j'D ~A,DC*PkLIj$F@ZOmZ?Գ;p_?; /_5v :3p1Z O`}nFljvO<&w3,? >m\3*QW|]arm7%++r/I;q=9)Zc+4wfk.1-~Y+e2ͺAK4>4po(HEd)bV!%d']ʋo8Z Cp˜<{N6]1/`֩E:{Nw玊qID3OU< pO wŠx"2 @S^S0W J*[YJrJr17 V8=E GI-N\f>ӰS`a;*Jه耜iJu >]=U^clp-7m $0Xs4 k\}V2 b蝗̂z@ex+nSw+Fx5tUauG,i@$s04Fz}pNFgOkQ"-jɺӋ`K_ܡ:O ]  A~n{0EoLFkYuX\ |e>Y.&9SWp @1|Uk}*)IF-=A$L8(Ί_260HGw ^a]-PT @T6_6)$La+>^4R^qm\ cmǟSf <`p!6B!J-*Zq:ޮfKuU٩r'U򐀹ɒ\Ve\aW%p0e"_aG7}/$~Rg##YM:8d4BPAa XMd/4#s4XɼjYp?ڲ-~y=ɩp!K`wR'BMˮ ZlC026*3+( )v(H9o7qmͧr@:ZV!&p esND1G1TT$7Պ>! ?"M1M _C+O^!N@]zm89nYPl 5Or0yGYaŇ}7=;xEVF3N>˓eR8ge"_a_6׏nb\6CpX$v,Q?mr9O<^{ct jgr\vS? \yIk(s]ӛ{^ 5ML@u!_ %eG_+M,篁l=Y\%$}.eԶM,.lQ<p=BhQRH>&Sϸ&+oz4ba/!t۵p67 \+2B4!M٭ 7pɊu…yig#^SQ9'VQKI-( 󿘩tSUv=.}HlqCZ":gxj<?#;=U(QKiҕC j,>ջ*g n3c|3A`!lH`cR2We SP   gkA~5H7%eG5sd3jƗ:֣71C!ЂٜFK1LVR=eHk-Ip9 dgImIy^"M<ʧH 呱hk:ʗsɭ}."TpDV$ ӪeɮG%0MA!0a0i_⽿Hk ԩD N.{i6sh5 PږJSsy߽7<^-@hWB~TXPĨu6Z-癦P^sy0WSw$4T+/l6'\۶G'xi_tOJE ʀDg{@B s|IĠ( }fû£M 6HwعXA6'l}O5bpՋ~"PmۉskBK o?nP0&}>'i+D24+ CP.zրzJ i?X!R(kD ϰ"k zd-S*(yWkJ>R챞]˒*puITKڤIǒ3&Q׌2A ώ 6>C=_"Md39MG_.$$KnjϦ7j7GTeɆyYKsevn-s]bɬ/+c<ǽ}rOmI TKͼ=o |*n: q .dy}M/ TC.vE֑~mlO46~*ws1g"6k4 e"‚ -CyijP8*{C]+IБhhjڞuH6AƂ5G*ѽ MO{CW(L!j'7cUWFR;s<-skŚSg:s܂:m W1|tMwpZ3Ć.Jؙ8/u'On\4%Z, OFeoH[dq!ٌkK@j:Rn.CKR.еԖAMG `+-K&:5,HߍHFhX)pR9Z%{m2gϷl&ʿztg&3QFMbhO((ݸ0~CɁSJOmmz6 (,ɚk2M-䟱zj6=⨂$inWLB~XS/}AS!# /Uˍzj_IKRVnʫi\ߟa#A]oˢG{Hf*mt@ _d5F#wg"Bbjqߖ^Ȝ( #²;lWR7ٵ߅!E}[D:/\#"z a|#;s=R<3gOPUXf[ȳNc%W Tc* (Iׇf|P#!su @7Yx"_ϯށXj22 l\cPor-.B a@7Z|BoQӘtn؆9a*gT΢c%5d$~AxjtCnW u%K8[5w6 u xL`(Ϝ|)kH]EqVYWWO=U> xk@6v<`lNJ~IJie?L@pkRٲUW43PFaSS(Vajނn_6/GgPs^[,rfJ|Yp B><ոSL4e"*V#.CpYkG!E̗qK gzv~.GJo˒ ޻hgm9^ Zpq=M-b ~T0{SHHv61a~ }: +;_ 0DiQ-h%SU$cL ũĮ\-xƳY OrWWⷝPYA<*= yΪQu##fiׄi`ak **>bdsMK쪺a ?Yˌ."G艿᜝%e@kh@A1⟎>q8Dd]Nws"YV<"@I|Aܖ6\pewrcf;.t%)N`U:9嵩fO͗u&-A YZ