knot-devel-3.0.6-1.el7> 6 6`d63!}|J^>j/5,d` j/5,dkid's:GJPW{HU*y} |62.晦lM!}f4]cXT/~ӲHJ+:7p)-}#f9^vG^T*Rbr1Aey!ëN詹~ J}Jp ]gGJQ.nœ]h' &̜HitW_ԒVXxߨ&@:M)Hg*ƕ+M)`>'wfJ!z>ʩ7g*u뎀kKSΨŞ 26J@Sw^D7YlZC3`ylWhSP83JgTAgVet{LFUj/5,d` j/5,d,Y'm8`@W`jٳLz9^a6;Rd &YTx JW,=\Z(<6. ~)/_b2upwcm1^#Z&ӿj 9;[vpB4-YןKYe|Rlk)Mͪ2vMav*PxÅpӧ,ug`W.0ƺSI7wý](3:Tj3%` 8SExuX֦ݲJ$Yj\L*rQ4lkr-aia%y]5, .2(<ݜ|Dlhѷ+%(I soQ餶S#3GK 5" t'~i'ե-`715ZV[{/@oL"۷e㙂B>brla WD\dM>:?d   M &2JPXPP 8P P P (P PPP,Pl   (78@191:(@1G}PHPI@PXY\P]P^ bdefltPu@PvwPxPy< ptCknot-devel3.0.61.el7Development header files for the Knot DNS librariesThe package contains development header files for the Knot DNS libraries included in knot-libs package.`{buildhw-x86-10.iad2.fedoraproject.orgFedora ProjectFedora ProjectGPL-3.0-or-laterFedora ProjectUnspecifiedhttps://www.knot-dns.czlinuxx86_64G %~ QzR c ^4 J 0&d'KD , tgj# U  GJ& r L >""7 +:%A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{ea7323202e14690ec389d8659a58a08ae55fdf8203d47a93354a2772d1c2a60db4fbe48c632018c0e15b531c25797c3b380cb0ec35f0a597a1f1c94008220b58f676aed7ec38307f1d7282f86ec4f894dd4875c2429109cab92b9621525966dabc13139bb264cedbb87f2c05521f7485d1933527c92e8a7a212c6f8ef2464203364324e616dcffd84443431a4d05b8f69363665df33a0384e51bf51365adc424984d4b743dd141778bdfd3bf2d5fec12b0d5308299b64e0e505bbb47a5ee8e158e9c208cedc89ed277c48b97086e1455d2534705619218a1229e97234bfb0b9e85dc895d1c2610cef7f07c2ed8f7ff2636a55034385513452f53e85c2754a05492ea22cde12acc55b67f797071c03119cac1d0ecacb187646052b5ec9bf692e8f6cdd36b572a22aea68204f86f208c5f2a052cccfe73a5430b0dc4dbe6a9db0bb9fa74795774ffc71a964f8b7132997957fc0ff8ea37b1f21d1f49c112b28d7419ae51ecd71495a5c3010c371169857d9c66a7a6a6af98b030b6ea5be85ec1a5919f3837757036c1766ffddfe13b4756a180dd56c94acd798fed6d1d35454f28c3e7b2c6cc75abeb22f94d2eb7162ccfaefa2a224dfd135c8186472796d057e9b8274f9e020c60c3a3752a1ac435a57d93689bc626d645a88022426b8e8bbbc2068794bba3e89a38dda175a6952a812eace59e96b20203054f68ffaa6a860eb5599c23167095d105229e366197352e4d4b3ddc39745ce54e4b386fd69dbc9924ad79e3e1ea4a4dd6c3646eb57a5145cea6bddd6144c24ffbcde3ffcaafc8b4fd8f8df55d86daf9841241e346b2e6bc17f15091d367132c5456d64e2c3565a20767af608031639b271fecd0b35ab0054e67bace684a983d9c96599ea7ac28049709e7cc98c3de9f322e232b419b010057a85ae809040bfd1d4f7980d352ae3a6573aeabfe39a9aab4f6bcdbf0693805d8fbdd906c78ab0e955f39e7eea5977a041757fd765e25974c4b01ba40214d4cab0626fc506a1ad7a0e8577b3aef19a925a2e7e584a3b3fcb95e283786e674532f67549c00841bc95832f32904bd73abc971e99b1da5eec117e8a341735d9a97a37ab02ec9377bcfb81e1c5dd368d8b08a45c1a06bae79ef63c42672bc930378393ca1581c00d473c52452f2175a51ec449150c30393ed4243f3c8e6625dee31f6e3e97c9b3a40ea8219daea7c06a9c0c37191d36950be3a402aac76dcf9f532c6dfbb60228158cd280701096ce5420acb1f925aca139999ab1b075d4c653210b3b946d5dacf07626d0e407012584cc199a554f47b5e1b3c0d5a226d9720bb3cbf391fee27b1a70850972b4469ce0948db81b62373ec7b7f48dc28d3b26cacca029b46cfe7d4815c72d5253618e526d5f9a68f1993f6d90e0428b4585ca5be835eeceab21017198d81b3819c40046ea8ea9156c5acc89c8272ed367a5e39697095241155a9b48283f7e206fdc4345c99e734245ed008a00c55b022308f1e325cdd2ccd6476828068ee18c484d9aa5d85a9d55ee1bcd8a6c512fbaab8e00b5a31d025c978aecbda25a32caccf45d637996cf54daa2a4a34ce921185f4689126d406597a1aa7917a1f4cb09f8d7fdc26b48c819eaf771ec0e6d899266644885dd3b825b7137307935b3ba7f3af24b8b3536fff1cded7df7fe32ed047aabdbfbc878e4a090daddf8cbcf961b104eef29eee38761e4d542ee9df287a6e20403a08a75476d01eb55697b3903695fc4e8ff5dfb39fe9b4c0f6fcac6f57d1fabd5792d97708c868ffa8985c98f69b4b0062de6517423284635714ee1a820a82bc17197d1334667b6b06ef1258a93c21649c8a8b4b91b4063489f544e810bc10ffcf7834cef2549c53a9b6b81cdb937c0bd08f121aba302841a71120e7dd3194c3f3e51dd2b2db50acaa6e0adf5a10b15d83dfcc30161dcdbfe3e0ec3bcd4ecd1b35415214c84ec3728b93cde1d58ef253337548c27d48246cdfa95df787ca6e01968b1165e23e9f213a3e8092e3d55141db8a229a257e33b5b78d6e416ca902cf8a68b2a28e1e3e89a775b91a6df6110fd6a82ec30fecd5f27716fb25bd2f32491a381a61b4864685d60c8d14c3ee0e1e6b27e0aa682f1baaa4bbc757a22ea6ca342b8ec2455f2d53aeb14ddd3827ec6e5fcd47c2d5fda756c4efca40cd701630d5b70efa38e8858ddc6237adf9676eb48ef1be78d484dc095525cf47421ac58917ea5c09e68bacb516577967c3a2ffd12022371430ab2a2e74d275401c78b36c467a06a1e2ced136266ed33508ea1410b3054429eabfee04ff1f14beb1df7ee29fd647dbd56960a62b25caf376211b0be3034b5504b6fafbaf42aafeda061486f3a0cd57ee6661cbb3472354758d8f194182e0e372d1c5b0c964f5b0e272006722d7b9cea85bc01a4a7b2691463264f07587df640ff3a6cc0f2e5d5b0e2dbeeeec8af6380c4999e2525c03db66ffa62112fa2ed32631003298e74a56c98121799d00246d344841cb4a4e1cb60499185a8bf7068cfad12e59fe2b5c332c6e971c6ee71a317a56253e05e712dd37186e9d1fbf2460d537ac1bc5636d5fdb8a6cc17007197f83ca431b327084bca54022011cb92d30b44fc417912d2af87f0a8a0027d7b857395c8566c5c6773fb43be48a6b25855cd7495e9907dc46930b276cf7b2ec1c5c2b3032312fc404f217416a54005443f8bd7821040a1280a52fa02ce842b4007a1c81da28000d3c840eb4477853b2d336a7cc14a8cab9041b5f72a00026fbb7b6f97fd93aff54b07847560732279f9d23425a1f7e7a3fdfd89ee939250d553c0e409b4d52afa4ef0680649fc2558a8c9affdbdf66a276d69c05b7140b07c2284c56b7f61e232f07394a408d0cdf6aa4113b903307b7bcf5657a0ba38ae165c4ae2d46704cfa49308e637877e428e82a3f71394c771c8836317e0955ba763514b8d4e2d68be5bf6f7d5756ff04d0d7d14d4fbd652e2b162b9f17c326173543e597af6c16d971b16252a41b50c89e301ba3libdnssec.so.8.0.0libknot.so.11.0.0libzscanner.so.3.0.0rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootknot-3.0.6-1.el7.src.rpmknot-develknot-devel(x86-64)pkgconfig(knotd)pkgconfig(libdnssec)pkgconfig(libknot)pkgconfig(libzscanner)@@@@@ @    /usr/bin/pkg-configknot-libs(x86-64)libdnssec.so.8()(64bit)libknot.so.11()(64bit)libzscanner.so.3()(64bit)pkgconfig(gnutls)pkgconfig(libdnssec)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.6-1.el73.33.0.63.0.4-14.6.0-14.0-15.2-14.11.3`f@`c`@_H@_@_E@_m_Z@_O@^˳@^U@^^F]}@]ʞ]@]]2@]'$[ @[H@[E@ZnZZZZ}@Zz@Ze@ZNYYYXƉXX@XAXJX-W#WhWWV&@VUUUUa@UG_@T@T@Jakub Ružička - 3.0.6-1Jakub Ružička 3.0.5-1Jakub Ružička - 3.0.4-1Jakub Ružička - 3.0.3-1Jakub Ružička - 3.0.2-1Jakub Ružička - 3.0.1-1Jakub Ružička 3.0.0-2Jakub Ružička 3.0.0-1Jakub Ružička 2.9.6-1Tomas Krizek - 2.9.5-1Tomas Krizek - 2.9.4-1Tomas Krizek - 2.9.3-1Tomas Krizek - 2.9.2-1Tomas Krizek - 2.9.1-1Tomas Krizek - 2.8.4-1Tomas Krizek - 2.8.3-1Tomas Krizek - 2.8.2-1Tomas Krizek - 2.6.9-1Fedora Release Engineering - 2.6.8-2Tomas Krizek - 2.6.8-1Tomas Krizek - 2.6.7-1Tomas Krizek - 2.6.6-1Iryna Shcherbina - 2.6.5-2Tomas Krizek - 2.6.5-1Igor Gnatenko - 2.6.4-3Fedora Release Engineering - 2.6.4-2Tomas Krizek - 2.6.4-1Petr Špaček - 2.6.1-1Petr Spacek - 2.5.3-1Petr Spacek - 2.5.3-2Petr Spacek - 2.5.3-1Petr Spacek - 2.4.1-2Petr Spacek - 2.4.1-1Fedora Release Engineering - 2.4.0-2Petr Spacek - 2.4.0-1Jan Vcelak - 2.3.3-1Jan Vcelak - 2.3.2-1Jan Vcelak - 2.3.0-3Jan Vcelak - 2.3.0-2Jan Vcelak - 2.3.0-1Jan Vcelak - 1.6.8-1Jan Vcelak 1.6.7-1Jan Vcelak 1.6.6-1Jan Vcelak 1.6.5-1Jan Vcelak 1.6.4-1Fedora Release Engineering - 1.99.1-4Kalev Lember - 1.99.1-3Jan Vcelak 1.99.1-2Jan Vcelak 1.99.1-1- Update to 3.0.6- Update to 3.0.5 - Properly escape BASE_VERSION macro - Include module dirs in main package- Update to 3.0.4 - Move dnstap module to subpackage - Move geoip module to subpackage - Remove redundant VERSION macro- Update to 3.0.3- Update to 3.0.2- Update to 3.0.1 - Sync packaging from upstream- Rebuild- New major upstream release 3.0.0 - Sync packaging from upstream- Update to 2.9.6- new upstream release 2.9.5- new upstream release 2.9.4- new upstream release 2.9.3- new upstream release 2.9.2- New upstream release 2.9.1 - add EPEL8 compatibility - fix unsafe PGP keyring permissions- new upstream release 2.8.4- new upstream release 2.8.3- rebase to latest upstream version 2.8.2Knot DNS 2.6.9 (2018-08-14) =========================== Improvements: ------------- - Added zone wire size to zone loading log message - Added debug log message for each unsuccessful remote address operation Bugfixes: --------- - Zone not flushed after re-signing during zone load #594 - Server crashes when committing empty zone transaction - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_RebuildKnot DNS 2.6.8 (2018-07-10) =========================== Features: --------- - New 'import-pkcs11' command in keymgr Improvements: ------------- - Unixtime serial policy mimics Bind – increment if lower #593 Bugfixes: --------- - Creeping memory consuption upon server reload #584 - Kdig incorrectly detects QNAME if 'notify' is a prefix - Server crashes when zone sign fails #587 - CSK->KZSK rollover retires CSK early #588 - Server crashes when zone expires during outgoing multi-message transfer - Kjournalprint doesn't convert zone name argument to lower-case - Cannot switch to a previously used ksk-shared dnssec policy #589Knot DNS 2.6.7 (2018-05-17) =========================== Features: --------- - Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung) Improvements: ------------- - Trailing data indication from the packet parser (libknot) - Better configuration check for a problematical option combination Bugfixes: --------- - Incomplete configuration option item name check - Possible buffer overflow in 'knot_dname_to_str' (libknot) - Module dnsproxy doesn't preserve letter case of QNAME - Module dnsproxy duplicates OPT and TSIG in the non-fallback modeKnot DNS 2.6.6 (2018-04-11) =========================== Features: --------- - New EDNS option counters in the statistics module - New '+orphan' filter for the 'zone-purge' operation Improvements: ------------- - Reduced memory consuption of disabled statistics metrics - Some spelling fixes (Thanks to Daniel Kahn Gillmor) - Server no longer fails to start if MODULE_DIR doesn't exist - Configuration include doesn't fail if empty wildcard match - Added a configuration check for a problematical option combination Bugfixes: --------- - NSEC3 chain not re-created when SOA minimum TTL changed - Failed to start server if no template is configured - Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing - Inaccurate outgoing zone transfer size in the log message - Invalid dname compression if empty question section - Missing EDNS in EMALF responses- Update Python 2 dependency declarations to new packaging standards (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)- New upstream release 2.6.5 Knot DNS 2.6.5 (2018-02-12) =========================== Features: --------- - New 'zone-notify' command in knotc - Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set Improvements: ------------- - Better heap memory trimming for zone operations - Added proper polling for TLS operations in kdig - Configuration export uses stdout as a default output - Simplified detection of atomic operations - Added '--disable-modules' configure option - Small documentation updates Bugfixes: --------- - Zone retransfer doesn't work well if more masters configured - Kdig can leak or double free memory in corner cases - Inconsistent error outputs from dynamic configuration operations - Failed to generate documentation on OpenBSD- Escape macros in %changelog- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild- Added PGP signature verification - Added integration test - New upstream release 2.6.4 Knot DNS 2.6.4 (2018-01-02) =========================== Features: --------- - Module synthrecord allows multiple 'network' specification - New CSK handling support in keymgr Improvements: ------------- - Allowed configuration for infinite zsk lifetime - Increased performance and security of the module synthrecord - Signing changeset is stored into journal even if 'zonefile-load' is whole Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Some minor DNSSEC-related issues Knot DNS 2.6.3 (2017-11-24) =========================== Bugfixes: --------- - Wrong detection of signing scheme rollover Knot DNS 2.6.2 (2017-11-23) =========================== Features: --------- - CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support Improvements: ------------- - Allowed explicit configuration for infinite ksk lifetime - Proper error messages instead of unclear error codes in server log - Better support for old compilers Bugfixes: --------- - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file- New upstream release 2.6.1 Knot DNS 2.6.1 (2017-11-02) =========================== Features: --------- - NSEC3 Opt-Out support in the DNSSEC signing - New CDS/CDNSKEY publish configuration option Improvements: ------------- - Simplified DNSSEC log message with DNSKEY details - +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given - New documentation sections for DNSSEC key rollovers and shared keys - Keymgr no longer prints useless algorithm number for generated key - Kdig prints unknown RCODE in a numeric format - Better support for LLVM libFuzzer Bugfixes: --------- - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used - Immediate zone flush not scheduled during the zone load event - Server crashes upon dynamic zone addition if a query module is loaded - Kdig fails to connect over TLS due to SNI is set to server IP address - Possible out-of-bounds memory access at the end of the input - TCP Fast Open enabled by default in kdig breaks TLS connection Knot DNS 2.6.0 (2017-09-29) =========================== Features: --------- - On-slave (inline) signing support - Automatic DNSSEC key algorithm rollover - Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0) - New 'journal-content' and 'zonefile-load' configuration options - keymgr tries to run as user/group set in the configuration - Public-only DNSSEC key import into KASP DB via keymgr - NSEC3 resalt and parent DS query events are persistent in timer DB - New processing state for a response suppression within a query module - Enabled server side TCP Fast Open if supported - TCP Fast Open support in kdig Improvements: ------------- - Better record owner compression if related to the previous rdata dname - NSEC(3) chain is no longer recomputed whole on every update - Remove inconsistent and unnecessary quoting in log files - Avoiding of overlapping key rollovers at a time - More DNSSSEC-related semantic checks - Extended timestamp format in keymgr Bugfixes: --------- - Incorrect journal free space computation causing inefficient space handling - Interface-automatic broken on Linux in the presence of asymmetric routing Knot DNS 2.5.5 (2017-09-29) =========================== Improvements: ------------- - Constant time memory comparison in the TSIG processing - Proper use of the ctype functions - Generated RRSIG records have inception time 90 minutes in the past Bugfixes: --------- - Incorrect online signature for NSEC in the case of a CNAME record - Incorrect timestamps in dnstap records - EDNS Subnet Client validation rejects valid payloads - Module configuration semantic checks are not executed - Kzonecheck segfaults with unusual inputs Knot DNS 2.5.4 (2017-08-31) =========================== Improvements: ------------- - New minimum and maximum refresh interval config options (Thanks to Manabu Sonoda) - New warning when unforced flush with disabled zone file synchronization - New 'dnskey' keymgr command - Linking with libatomic on architectures that require it (Thanks to Pierre-Olivier Mercier) - Removed 'OK' from listing keymgr command outputs - Extended journal and keymgr documentation and logging Bugfixes: --------- - Incorrect handling of specific corner-cases with zone-in-journal - The 'share' keymgr command doesn't work - Server crashes if configured with query-size and reply-size statistics options - Malformed big integer configuration values on some 32-bit platforms - Keymgr uses local time when parsing date inputs - Memory leak in kdig upon IXFR query- new upstream release WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble).- disable dnstap on RHEL (depedencies are missing)- new upstream release WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble). Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme Improvements: ------------- - Allowed binding to non-local adresses for TCP (Thanks to Julian Brost!) - New documentation section for manual DNSSEC key algorithm rollover - Initial KSK also generated in the submission state - The 'ds' keymgr command with no parameter uses all KSK keys - New debug mode in kjournalprint - Updated keymgr documentation Bugfixes: --------- - Sometimes missing RRSIG by KSK in submission state. - Minor DNSSEC-related issues Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Improvements: ------------- - Extended debug logging for TSIG errors - Better error message for unknown module section in the configuration - Module documentation compilation no longer depends on module configuration - Extended policy section configuration semantic checks - Improved python version compatibility in pykeymgr - Extended migration section in the documentation - Improved DNSSEC event timing on 32-bit systems - New KSK rollover start log info message - NULL qtype support in kdig Bugfixes: --------- - Failed to process included configuration - dnskey_ttl policy option in the configuration has no effect on DNSKEY TTL - Corner case journal fixes (huge changesets, OpenWRT operation) - Confusing event timestamps in knotc zone-status output - NSEC/NSEC3 bitmap not updated for CDS/CDNSKEY - CDS/CDNSKEY RRSIG not updated Knot DNS 2.5.1 (2017-06-07) =========================== Bugfixes: --------- - pykeymgr no longer crash on empty json files in the KASP DB directory - pykeymgr no longer imports keys in the "removed" state - Imported keys in the "removed" state no longer makes knotd to crash - Including an empty configuration directory no longer makes knotd to crash - pykeymgr is distributed and installed to the distribution tarball Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility Improvements: ------------- - Added libidn2 support to kdig (with libidn fallback) - Maximum timer database switched from configure to the server configuration Knot DNS 2.4.4 (2017-06-05) =========================== Improvements: ------------- - Improved error handling in kjournalprint Bugfixes: --------- - Zone flush not replanned upon unsuccessful flush - Journal inconsistency after deleting deleted zone - Zone events not rescheduled upon server reload (Thanks to Mark Warren) - Unreliable LMDB mapsize detection in kjournalprint - Some minor issues found by AddressSanitizer Knot DNS 2.4.3 (2017-04-11) =========================== Improvements: ------------- - New 'journal-db-mode' optimization configuration option - The default TSIG algorithm for utilities input is HMAC-SHA256 - Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor) - Added some more semantic checks on the knotc configuration operations Bugfixes: --------- - Missing 'zone' keyword in the YAML output - Missing trailing dot in the keymgr DS owner output - Journal logs 'invalid parameter' in several cases - Some minor journal-related problems Knot DNS 2.4.2 (2017-03-23) =========================== Features: --------- - Zscanner can store record comments placed on the same line - Knotc status extension with version, configure, and workers parameters Improvements: ------------- - Significant incoming XFR speed-up in the case of many zones Bugfixes: --------- - Double OPT RR insertion when a global module returns KNOT_STATE_FAIL - User-driven zscanner parsing logic inconsistency - Lower serial at master doesn't trigger any errors - Queries with too long DNAME substitution do not return YXDOMAIN response - Incorrect elapsed time in the DDNS log - Failed to process forwarded DDNS request with TSIG- configuration checking was fixed to be compatible with Knot 2.4.x- new upstream release 2.4.1 replaces old 1.6.x series which is not supported - configuration should be upgraded automatically using knot1to2 tool - make sure you reviewed the new configuration in /etc/knot directory!- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild- new upstream release: + fix: False positive semantic-check warning about invalid bitmap in NSEC + fix: Unnecessary SOA queries upon notify with up to date serial + fix: Timers for expired zones are reset on reload + fix: Zone doesn't expire when the server is down + fix: Failed to handle keys with duplicate keytags + fix: Per zone module and global module insconsistency + fix: Obsolete online signing module configuration + fix: Malformed output from kjournalprint + fix: Redundant SO_REUSEPORT activation on the TCP socket + fix: Failed to use higher number of background workers + improvement: Lower memory consumption with qp-trie + improvement: Zone events and zone timers improvements + improvement: Print all zone names in the FQDN format + improvement: Simplified query module interface + improvement: Shared TCP connection between SOA query and transfer + improvement: Response Rate Limiting as a module with statistics support + improvement: Key filters in keymgr + features: New unified LMDB-based zone journal + features: Server statistics support + features: New statistics module for traffic measuring + features: Automatic deletion of retired DNSSEC keys + features: New control logging category- new upstream release: + fix: double free when failed to apply zone journal + fix: zone bootstrap retry interval not preserved upon zone reload + fix: DNSSEC related records not flushed if not signed + fix: false semantic checks warning about incorrect type in NSEC bitmap + fix: memory leak in kzonecheck + improvement: all zone names are fully-qualified in log + features: new kjournalprint utility- new upstream release: + fix: missing glue in some responses + fix: knsupdate prompt printing on non-terminal + fix: configuration policy item names in documentation + fix: segfault on OS X Sierra + fix: incorrect %s expansion for the root zone + fix: refresh not existing slave zone after restart + fix: immediate zone refresh upon restart if refresh already scheduled + fix: early zone transfer after restart if transfer already scheduled + fix: not ignoring empty non-terminal parents during delegation lookup + fix: CD bit clearing in responses + fix: compilation error on GNU/kFreeBSD + fix: server crash after double zone-commit if journal error + improvement: significant speed-up of conf-commit and conf-diff operations + improvement: new EDNS Client Subnet API + improvement: better semantic-checks error messages + improvement: speed-up of knotc if control operation and known socket + improvement: zone purge operation purges also zone timers + feature: print TLS certificate hierarchy in kdig verbose mode + feature: new +subnet alias for +client + feature: new mod-whoami and mod-noudp modules + feature: new zone-purge control command + feature: new log-queries and log-responses options for mod-dnstap + feature: simple modules don't require empty configuration section + feature: new zone journal path configuration option + feature: new timeout configuration option for module dnsproxy- fix post-installation scriptlet (RHBZ #1370939)- endian independent DNS cookies (fixes build on ppc64 and s390x)- new upstream release: + fix: No wildcard expansion below empty non-terminal for NSEC signed zone + fix: Don't ignore non-existing records to be removed in IXFR + fix: Fix kdig IXFR response processing if the transfer content is empty + fix: Avoid multiple loads of the same PKCS #11 module + improvement: Refactored semantic checks and better error messages + improvement: Set TC flag in delegation only if mandatory glue doesn't fit the response + improvement: Separate EDNS(0) payload size configuration for IPv4 and IPv6 + feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)- new upstream release: + fix: Transfer of a huge rrset goes into an infinite loop + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL + fix: Failed to build utilities with disabled daemon + fix: Memory leaks during keys removal + fix: Rough TSIG packet reservation causes early truncation + fix: Minor out-of-bounds string termination write in rrset dump + fix: Server crash during stop if failed to open timers DB + fix: Failed to compile on OS X older than Sierra + fix: Poor minimum UDP-max-size configuration check + fix: Failed to receive one-record-per-message IXFR-style AXFR + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message + improvement: Speed-up of rdata addition into a huge rrset + improvement: Introduce check of minumum timeout for next refresh + improvement: Dnsproxy module can forward all queries without local resolving- new upstream release: + improvement: Log change of the zone serial number after IXFR transfer + improvement: Document operational impact of various RRL settings + improvement: Add support for rate-limit-slip zero + improvement: Add 'timer-db' configuration option- new upstream release: + security fix: out-of-bound read in packet parser for malformed NAPTR record + fix: systemd startup notifications- new upstream release: + fix: don't load expired zones on reload and startup + fix: remove race condition in scheduling causing delaying of events + fix: NSEC proof construction in zones with many delegations + fix: TC flag setting in RRL slipped answers + fix: disable domain name compression for root label + fix: check if executed under systemd before using journald log sink + feature: write persistent timers on server shutdown for better performance + feature: support time unit specification for 'max-conn-idle', 'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options + feature: add 'request-edns-config' config option- new upstream release: + fix: lost NOTIFY message if received during zone transfer + fix: kdig, record correct dnstap SocketProtocol when retrying over TCP + fix: kdig, hide TSIG section with +noall + fix: do not set AA flag for AXFR/IXFR queries + feature: new configuration format in YAML, binary store im LMDB + feature: DNSSEC, separate library, switch to GnuTLS, new utilities + feature: DNSSEC, basic KASP support (generate initial keys, ZSK rollover) + feature: zone parser, split long TXT/SPF strings into multiple strings + feature: kdig, add generic dump style option (+generic) + feature: try all master servers on failure in multi-master environment + feature: improved remotes and ACLs (multiple addresses, multiple keys) + feature: basic support for zone file patterns (%s to substitute zone name) + improvement: do not write class for SOA record (unified with other RR types) + improvement: do not write master server address into the zone file + documentation: manual pages also in HTML and PDF format- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild- Rebuilt for nettle soname bump- fix BuildRequires for systemd integration- new upstream pre-release version: + DNSSEC: switch from OpenSSL to GnuTLS + DNSSEC: initial support for KASP - split package into subpackages - add documentation building - restart daemon on updated  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOP3.0.6-1.el73.0.6-1.el73.0.63.0.63.0.63.0.6 knotmodule.hlibdnssecbinary.hcrypto.hdnssec.herror.hkey.hkeyid.hkeystore.hkeytag.hnsec.hpem.hrandom.hsign.htsig.hversion.hlibknotattribute.hcodes.hconsts.hcontrolcontrol.hcookies.hdbdb.hdb_lmdb.hdb_trie.hdescriptor.hdname.hendian.herrcode.herror.hlibknot.hlookup.hmm_ctx.hpacketcompr.hpkt.hrrset-wire.hwire.hprobedata.hprobe.hrdata.hrdataset.hrrset-dump.hrrset.hrrtypednskey.hds.hnaptr.hnsec.hnsec3.hnsec3param.hopt.hrdname.hrrsig.hsoa.htsig.htsig-op.htsig.hversion.hwire.hyparseryparser.hypformat.hypschema.hyptrafo.hlibzscannererror.hscanner.hversion.hlibdnssec.solibknot.solibzscanner.soknotd.pclibdnssec.pclibknot.pclibzscanner.pc/usr/include//usr/include/knot//usr/include/libdnssec//usr/include/libknot//usr/include/libknot/control//usr/include/libknot/db//usr/include/libknot/packet//usr/include/libknot/probe//usr/include/libknot/rrtype//usr/include/libknot/yparser//usr/include/libzscanner//usr/lib64//usr/lib64/pkgconfig/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=genericcpioxz2x86_64-redhat-linux-gnudirectoryC source, ASCII textASCII textpkgconfig file RRRPRPRRPRRPRhttps://bugz.fedoraproject.org/knot?`7zXZ !#,M] b2u jӫ`(0g3b# _9U$$<"$?oa3Qaή$]ncYL8Ś/ZBšu`iũebA[x GSm6w7=4B%;Э"Fbഺx 8Ђ, $SnS_h'z7KΒ*3d:܇MJߖ"(]?5z\@.[#;61&kCwgؙyrL_ LJ9ВzXqpPaU$|Kž < N%8=V.:` <%rXCd(A'iM~`pJcͿTS@,?[@P)uuiJb}G+^)-NBy0jdnx? )~6u*]Ӧ*BIAr`i"h9G >` q?AbG[YEFYGF ˸5x&yLTWoc8 DH8YkGNHk"Cg9&.FJBנjd))CDE*jV.B>ݐ39/J+Ywt}OS{4*υєc-rMIl<,D0Mω Uk]$6ftlĎ~o_x).H]NeN{~HZ?f4:LD:GڼK/0]\HMEBrq[9+og}i-X 9ެ2,N_9VqS;71% ESB:KwO)- ' ~ (Z\ HW-Vlc#zQ5}Ȁ۪|,#2@3lmrPdf T3&iBHn P܇@OfB?-M mݠGI%fS!H A,k~Ƣ7m4G cNxL$Snusr]sR=bb/%T2N3΄/R 0dIb FvƵG)D ~!+3"cYQX?d6sJH*p8`9aޒg|G?<3ERG؀^c;fT7?hH\MRD0pԧ0kБԺ[X*AFx!肀(dޫj1g!$xϝv @:*Z,CaëYI;f If`J/cHIhн{OU|Qf0ZB05..#,0! v՛ .M0e~)]w\Cg>\K&\E'N()`X'8>IsBxuxKſ9E/A(&":6>[n\ H6MX7i ّ>v(Ҫ[X]2$-kʰnJݳT unN^M# f|ȑ֓?uF C>$`X)1^%G6KXH$Ͻ D=֮l Rb|!x:YUؑh+]*Tm)ZDXc?)E$"ߏ zq[$MJj Pt~>Y cw.G6s Qަ eQR,]=˂d탉U?c$@^ :g1L7 du =Z:kkBmP(%GgzͥZ .(8,1nfv$BD2 Y=Y]sR9O  _`4 V{L `Fvqy5r }G3F}cmȜStK䄁ԻlY~;G;*0VXHgvɯZgc:0?ِDrm\x$А>ݺv WdߘiM?λCϚ:rd1_0Eajv͈ o]Ԭ~CͧK`-3,)4x]4`"yGHUP=+ P 'p@J բugdAHfH9X((aΎg q z=[ B<ݣZWԗ)zwZ_meK׺؎ucGx;{$IQ\a beLB5IO*ie131SūtE5%=VT[MV:H%ύA@gJ\hrmIK1|:lER|oD2x=bݶ ~XÝ2{K2P4OZp#MʒkG!ȗ!Qdd;HzHʹM+€ˠ6Xx`qm%P 6xU.pps!-_\nDĹjf@;3W['sس "5ތ2 m faBUN4nn-S4mj7WYgD3r雬 yXRbs[?ֵ zLK6Ihf'0ȹYpg2終\vINK!^!=Y%i"'LjxmBl|SacePZ62&!o̧6ԄOv@ hsO7p}iIŞ*,Kg}ʒ];He)aLuR֚l$Zgƞ-ZQB WⰗ?eQ[Va7 ;)s!$u &I8p}Tao yDL'L `dFPm )@rk/*QLZ j/NM [qsHm Jh>NdlB!>[ON(/i?Ҟ" df7RĈ7vtm1SoI\*Zv `AdGwD!ݫIH64iZ|%diP_vzh<œe$=띐qtéqpJ3&)䪚}oyՈQ٧+xfNO7Z5A/) *-})1XB?㯸Z^7! \ZtYkgO @ػj7T޵^4dʛZK['A{h?>N-U B%A*BLu֗a42)yEP$30p s!kqv{.hīpeZ~S[ܣpl@4@4%ɤD>pƤ (؜xpqU{7oe?}kwT"ZS(Ms}?l,Kn~Q?ȭ-*K Sfiod7x|lK[[U & }^w|{p B EZ{k%,ung}꘏kcpF~*)AF;EƞQt1N'"ATy.!~1 Ԏp"$`yS s$_C3I-z~v4?c1EdJ; [ MO|P#406mR`6E& oP&sp ہ]d^d׀Fo myȿd|q*5V@Mt8iļR񚪅7}aohwtDJ!f;zU_OSl|ϳ`5 6 &<'/ߘ<2ӈL+g^cC^|nyY], L9GTn J'}8ܳ^X%a:qpoJX[Mfxw:! q6MsL@Ǥ01G\3'fQ^u8]U|(KA k/wqo笈bGb͙Qeqʳ}]eo0xqPiT}VSL2t8װ?>9K&\U`rkmbC̴ ٝ`qatd0칠c>|Z1▤w:c~4I嶄f_"]>rw*32 l}H~u (9_̻*Xi>vTY-^`ǎC!Fp$$ C>0ʵ2GpmjeRe񝟵yyUFrC *-L𫆤H8^gђmvV~DLn'ù5CuyN 9skqc^tȧ78c ޾Cu zpq#C O"l$/kWF ϕ.~XƩ %s}6WU N+1'z$af(vbZ}*->xZ ,Ҋ7_~JIW,C>iҳ 1Ù5koY 5U PiEPAo[ϝ0rAu S?dCRf86'}ˋ-rYd6n]c1TRE`6x+9aO햴 U"vuTdVEe<tW Rd![pry[ ^EyBR cEZoէ0 ''3A!. +V`޸wѧ+|ݜ3QbOq˥:Si;46aE, *`j!>yrdT?hm :hW$ %Z],q{Yx?&󛍮ougg #+6돑Wm GU_x"  sGЗn (fq]9CŘO33CpmWd^kҨa&r.A42֫M"BuMB.(+cM8.ky"i4S$i3 Z! 5rk$u'RIߚnQaERNdbDv25gSˆZ4HԻF&CC4v60f fK&p(QAS#{:4p|#suAWlܮ򲣬GE79 cɣ@ 't28Ad`@FopҪ8YH眃É*{B˘J VzJI;yHvs\P6|SL:A@+koCi$+!.*{|DH~_Ng=<9Ymch@B. 0 XGD>k+7KՒEUmuF ir+k9OޅWKŭ IiBl܎\9-5H0uGՠuWHK#5o k=:b-T:JO@gͶ[D c&,*%4,$cIMqƯRE^e)i2nLv{(H^(\-}'jV(2#$xYF~1/kMT63|4"H^.`W;GdE-Or7[giIl|~%)(ىC@s$p#Ls۬;Y/gގ#!7f=\2cwp#4?&G폂De~ӉMw)e|L_ ofNF"(]޻Jk\)ߚ3ߢg#ȂZa-5T%!B=$7]NykO/K`nZeКaȖ; :CtC Upwг}% gkT#Va(3G,+\o%x#m(bD߽vjkϩ 2y,F WV4 HK˩=M۲ X޶T 1e2X7E΍m/2z'U#Be$bC)D\tosc 9ƐBMt'BqYW !2X"AaRYV\[DбjcHz 1g 52yuؒI7tݦ!{b-*N2R:$ÈV\o-ItOEGog_,$t5K##ƶYd]syI+Qj poM&]U WrW#GxQBpJUn"D:S`5E.HaA%WXOOcf9yD7Xo}Sv3Px7ͱ6>K 3_?&ۣgHLoQ($pRvvŖ{ߜHTӏn)ł?"Bvwc  !<[f)OYh<qUEK7ʁQgw&[ˢk8=Gdt>ǡ]JqjW&ǯCw$Nyp7 B]K;‰Y&< g4{fm'D+[*/yL#9гwm*g7Y>, f/8*e,ZՄ g ySӐRN`ȭaW= IӔBJG/.+4J(2,T[1Cp>=wg?~1GIj |_  5 b^MQX o@4FX[Rx7,2zw+1P^Wәӵ;&s,-!@ICBOh7kI;UkD-OG|m PKamc HkcUK<66[#t,|-&٭ӝLZR0ݗirx?'>s?R-~C\j!["rso-鎱}nm^ӆ 1 Y/p~ڽ2 R?D! ћal9UU-Cٌ8;,ȏș9[a~6~|[f?8>I89W: n](V0<_0-j'Mtdf_rʝ,Zɻ4OVAm[xBé6t/Vթoin6LsHL {ء>OyCn>&қPl +OOvSd8H-*:{ zZ'XF_$Nu?27C %M\KWQ_4F8Z#U'޼\@||? 2! d[bk_l)} , țNк41Kq b~eoڇƣkPmPw\<ߏ5*pMqTo̱GPg3-i $cN ,x5/N$#W1dpbu ]fT֗FnOAe,w> omrb|OK-;Z٬\.2J{+^Gぬb=iH sU,?_ J$5L@˲ˉJdb}Oz~̗2 E{Dz uO{:qb̕ؼp_H&oHҹ3lieH?{Jd-[SAǩ SD. UldC3KTmb  y(`Ô* w"Kg:[>#a2y<\(l:E 8޸%NJ0{]=lsG(_+^q,P59t`}z>`s~hb#aޖP^XήbF?cجOaxg%;8"a9`1Y6D ~yClȾ9 h}ga9PfsRs[qȿ$:.\lfu`t*ky˯nY5gw,xZ &TͮE&³kz}ouY~CWNIơ(`*F[lmlÏ-Xah^pmh*{o*SYS>Yg۹b԰.]#+ޣ 'ϹOZ! HdKKGj'HEj9(u5G+_YI4O_!G~ "Hw(@dk.TM J5QZ_Ikc{*3Uh!ULIAۯaQ@cuԴaiAYJ0tO+CI0aF W3)޳g*yЅ*%h|apa#HgZ%[qo}(ִjӴO5MhR %baSL4y \܋gPC3P< [TTm6ݟi>yi4yxJLI@ @L`zpB&].)bA[`zÿmٍjhg+Ӭ>6?ٜw%'lmBHg*b]\f %Q͂Ay.Ѕ~iVJܵi "3dWJhPH}/(owRH@$W-=0|H]gO tIZ|@$=n`Z竌ǿsvGe`ԥ~}{_$ϋXTzkhWqti&eޘ66)}k8H, ȻcAWH ;nVQrō۩k5 A^#WU^G]Z+7Tr41ujdA- X^]uCqr@s[S L;X 9~k#o~lsEч2hLtz>p:FvդoR)AhxZ(SP? XEkC,ŷf9'y-:ܪ Ƙ &B7朷l<5)[GعX>{ ױQWu,0; eg @#Mɗ1ZZJqI@W02L?Y Ix6-w.{~:\+_y?h=xnw\YѶ0sիkG }-$\Iz"yNFja㯱=؊a",TJ>-x7i`.Whw!no?ÂE8Mb|",J ӕOi۟dʦYJ!v0p'mzkL%F 5-uѝ*'$GSVsUԖ@XMn]p_Ubd{׊ `]#ԗeK( /Qi)3&YЌܩA&#nT1@ [o7әa}ϒh?zy'&hl@$d8VBRs'w˼h"״@LƊixJETp=89*dQrԏ[pI铽Uƞ2zm}8Z94G-LH}EK0A:kQV [2jNlֹ un1)QKr[1>ߑ)˻͊._т7Dw"￸sa39Ƣ<M** }N#FtMw\O[ j#9[|'EAXڢח(M6fC\رp 䫤zxxșzHg$1\EJR-8߾qpN x. cy !`[D sBЙHfqy8ʍGf$U2 Z#]q^&FP&:wY=!XS/ͧtJJA"u:SzvJD`|, O:<ڇMziBC܊LL<4V"\-[vP!9Q#Ce58 ĺrh.^feRTy hba7k 9R/U ~-j%aq8*X`E葵`̣+#qm2_W =(f0 'Sׂî)SYmGLؽ} ڎn1[m%Y-Eˤ+GcVྟWwROP3hbu(x(v)i~ +,WUuvh%骍 6K#PsQ89iS3oN8i c(\D]E\@#Trr/8,iρ(d.L?2#pBO\bʺ {߰i}yȂ`-W2SpɘG.0c+qS3 ;`d^"&j&ȔE%Chۏh֒I?WX,g$2Rɲ۹ؤ&y)1զ_;5炞+Zf&08L@?k5qK %da審X%$:)yՐ7>."U gw<3;둅ʮ?9 .;*|}_6nÅ/ z?_.[˯:|)̓Cnd>؀y(qq>+$琏e\+ie.Qxo[H܆Kq2*l-5q|߂@c1=Xq:gEvx(hpmP: 0 8y3ix3 vU?ylQzn 6-1#-:"[=g p~FUv ?Ɋ5&#Lfo%9ܗiI\Pj(qg o ]ی7oVw:eHCv40FSb~[TIm4W :tYuj޷b*OB!9 b-@c{ &z 3 bI ųOiC,OޤŇgh(z;Pr+wCsЙ52|K8tDƨyMFnnPb@ Tl@SΎh̬QaON QFŧxlGi y=dኑO'53}w CF}楹PL#Y :=eOkz;sֹ2Q'|'!Iwb)VJ_/Z[ `cydq5 I_OO 1!tCqw=3լ ]M{i13WLm|.s)!j~zm0_NRAޤ:U !:G{mA~xUœd? s~5/&4StGόmפ8ǮفKl{Wڛ.Ϯ)M7(_E`aH~f(7ꩻXX"WRwFQ ($ GE %Ӝ)J3^6\sqUH5=#8{oT9ͶDyFbX.Pse7t%y?Jf}+澝[4GޒI{ U Pd!0ADVKz"ɱOpφs?gKȴd5'@Λx^K)KG𾓅')u߃6݃G.Ϸ!ĈOuU1%r@(0&erG= rouz~UYƑ4taQZseM.}e)I}$!ǟO, ȁ~vq&C)5%s#Fͯpk3*ma܆l 7Z?'U!@ۣ!]C A {fL 9g o^Q%B=$ИZߧb2^%O\C2jW'p5ƛe=u, ؇ACQ я6IQyGZ= ۋc´<3q[ 3-J*jNlq1@=XH@E~X{f"m ݭAl*p= )|Q!4T6AH P24ʸiN=25On; [}xއ-y0Z۷T>׿WFGAD [^5r ×N󑙘BޚU{-#jbaKkGX%C> 2[k5 gTF$]瀃 =$%A"D lʤ)wLP}a- p} rzVYyE&rnx<r¾#R:Wŧl -tT͠>FJaafht.uy hȒ@QG%gBi: Tp}gIQIo&qߎ9$GBb]DŽ֖9R{0YLT[ B qA=LlVA\ɫxb}KMb018j mNNAbgqyp.ϝN3Β{ $zt^DzՈ" |?D4@JoGAs$<~jI(@l%;.xK~PË/|UDt!Jɥ?GtӟƘ +HQ>*Cl*)_4aJ}`]tsw^ϓ!o,1=q +{7tC"8wU4չ;~JÆsCOhhWC9Mne:&dLS"Sf݂Qg^Aw:K2!>fv a֧Fs\];:>{<@<_Rnkg4GIN@kGNLDw #-K&p*;{ &F>p@V0 2k"oQ^>'m3B@N TWֵf n4~t-3[ڟ: MuѝWN F5b%p޲eZrJVY( ^*rjv7"8=.nފCW +Xvenqm8H5M3^ DUUɨ~D9.D\O-n)n<$g5UyZ e+4<_o?ኬ9z0=Az&,1N磡'& eV"xƠlP$P;q4Sw5^5[6ꧪYP0YZG|eʨTzsz}(h<Ll70~8{BrZa Ѱ:ET'VG"ִ'KO@= c9mho1${"kC 5:TѮ۸:jry­h vWQFRFx8|",58xqe*)MPu2X\ 1Z٠!HtkFڃ.?.晠9@Y.z `ٲwP pљlPVO:•5l,R<ࣰ{|ZcL1B q33LX+D9q{Fm禰VUkpΩL HrE֒{yZ><0 \ޡcӛƥk0v {Ru1z4yW&mӲ3a3;\FDDݍ=_bma5E KgJ*&hÙf=UpP+Sv (~.}xEF93'"[ ӡަ1zJ. }֕K`):71oqa}uax;yv;o zڴ:Cw.oJ cHsln=<ϋ㝄`XkS~u.WXEDQ䇝kg?wts z\CQ_{립x8FuvCAjN4 P/ sc"`$;xoY] v;XxK-Ui<HQ{/~Npj4D#%`V)cR%u"Hxw =#$6j`8~kyֱf=4'p}i(g^6LDbǟobT,,CaavlaWu$Lw,JS,J}*[zHM0_wDzm"8v::N+i9tY_9ۦ f 9 S"Jq5LD_rۆNHiV]4ٵg}ѺLWxJfS{-oI%%R*@Ƚ4j0Ң5IZ5k8lcSj(HgP#%,/\Ox %mm=ԣ.txƃ8&p| g P!̏Iko(6{4fڐo)/k}` _#Z> sW*`QA&(*^m2?P/Dc4  ֳͥ.ZB`"ڙbo6_Bɐ uz;W(=2ud"+>IB5*iר G )l*A-@vcʑV6<I@儌Q:1KW|+MoZZ}6-P, $oz܋ZSP8NTu`̝seAEeѓހYz&TxRz@,\_z Z3Î7eڵæ{hzuh&C䬢ErMvN۲:!DҲ0b NgMOgxS_puWא5v6+~9ѣ_z d,mqC߷Bsš>BD PYrwMYQ~'l̾An?+*ў 20. G5j]{r~{*B@tCour1W/ɠ]by\׌St5/3/{EGj`ȮoGAyZKr!K_n4Xhu&cǑ:I(8bNa8^dK0mrLq$p6hHzs$D:"ܶqTgH9N8KIP*٧dԂMr8.C8YVf`f" ,u`M鿡Hg|+eHut#|Exgo:a7`TY5^ڢZ)\NeDM 5곽Q}H"dmpOh66ܺhtMNY+ B8B#%hP2T L.קGU*eX7.a?BQ%4`laHxVw,kzTБpwَ 1**L (w^vB1U`'5mQZa[oV47MEr)x,W*z!NEI"&kU[]-}ʹ-m|C^h_ok'ڡm8}b֚[5=(r2caʉ"6񎏺zku:RVrx>c>C7B#@vz?g;KFeঙXr VfJ>;v6'&PAr麻vUo78=̓d- <U?ntxO(CRS#~,oc=g'ꟍgH]Nҹ2;F ȻCGv!xb;pX21Ul*H+W w'Õ*n=ŧq/X!IwYZ7j?5> uɣ4#eԬh63s/PhLkbdVBs0{<ZX #f)+K͈ EW vqwT:хi\;0jnm<"Y=A|y{J+~<g3HSf^ALjGo@ۺ"@y * AOyI-kC6!.J6$XyVP<ل2:(,+DC"M+ӒuJ07B T\d\8;C"}ZFK%T`x=byp}#uYApHj9K8[;:9u~GX#u]Ʃ"ρ29Y lVSgKMG]G~_E¤6n霰L˛V"$ u5$9j6IvAZ|MuRwW=fOTi-m7;*B+_KP/=ݯ/)Xұ\͔#r{'vX1LFc=\8B \ZEMbcZ< dXJt/ѥ/$ D#E)H*L3"ZgwkJQ |:_OݗV$ttCnbN-0q !YK:{۫_2lOa\KLa?֬9GC#)3})ODF{ЫE>JsD"uL뢆ET8~Cr +mbŁkvY0l@i;UfqS(V*zdJs4H,I`90ߘ=Hk&bw#d1&\!Wե˶3d *]ӏ`C6I c sGK 4/W?;Z}iĶǒpؠٻpZRޱ;2 =Kgkz)x#g$-q. uzq˰'cv,hafa|/"Z9w4Oeazupp"h6¼b,@9e;BiY:0CKytnL+E"`. Xdٴz"5kюN-B1}6S"zԃp GZؒJsVOCanNhPwgUe[lmᾠA@:6 s;m"&`u: 1K*h~)CIj?6*pcw2lBӠԏn΋42i~P֩[j]x'NhK-E,8as<)Cc_ e,Owl#-${ 73Bn}]z_?qa+y6Np-,d308## /%2%<w#* [OۖRwY79*+*A\Mp ;y="-RjSMahggS@]v%: \h8lg JD ؆,-`RUX |PYDX .yy\Aԋ*,0 Nwq*ٷI oPHBӹ7sH/?4QL)B7`D`]n P)NјP鷐X9?&GTZ t.Et6dzץX jh11/9++ڶŪ,B/̍ ?!y*28}n'_R9ekFsW`Ҷ?s r^K[r =E{O߬hR>^o+XjJa92 nl }s#ce7^t(u5'.D׻/Ql8@kfC@-;b-6Q aC/p< /мs.+aQmE`+*'aْsnPp]j09ۜEg;8\= 0 B{o*ބ_hv0Th/83/ >L׌<'8C;ru_}몯rHn6.q2{ xR'mq9'B9 N'fj384 JR5HI]]iڇ .=X)Ti )LA5wDBcAށ. }%`]OǠ +AǴyVMS:-Ȃ6RY\F׫ϡan#{@?=kg\ajrݕiԜ$ 2]sMC< &kUnK͙U;?~"Z/*{v`hU 1M,U~[%h(!Tۛۡ3# @X/bϿw ZM74ʸ9 NI6QCBbTzŀq%yX*qYeK\;~(pj'Fd)k>'X-AV^k?/U}BnB9&e1}π"uNT\A_V_LUQɔy0O@ڶe; >px%QjA9$e[YTd%PMCMFʺb`biIx U'(}Yg]l@v`b8$!X|nNй3qz;]"Ks;ZHXBde8 1XaV!dEIdxoUٖ$`HI5F4Tf6INp2Wa" 0km#1Mȳ[Z(yqƾtg\| mrpcoڑKvep/ y1a' t~v~w'6,uY5Hګ[>Ps| @0[zkxm@0="KϾi&*[S(Yɐ1djX VmGv .`k.e^*k0?Ș'/ȉ/@pM5.B2LۺoGtt԰"##:qpMu-}GT͆`nx\1eU)ElM%\,1P9^2%%Z@.f,[K*tSRoFRreva^A }v9BunC$0Wq~}DwPh  5*ol&V+/V1JGƕ QKFCkS ]rVW{~X.UYm}3 U|} vHjy>_Nʜip*AvK;UBj͡Zvtˊ6EV]Qjr{{2Xq66?lm:`Kks^Tb6yFM+7ڋz\$܂&- D?eUpc-Vn.z:U8/K-48oܳn^ (A>΁w\ۣ`U(;Hd(e(O݀sg PXiT^AlD*j϶n>)W"vdь@m%=R?I }K$yci6qicrذ0B[N#o!❅)ӝkIU> L?o{gcެHojb-BcH IOLA,FYgA?p" qL6? N8SP`7!Tyīש^ ؤ*x*n]LV28 X?O-?[owX: ̶7 1,ı#Fqg+![Ш3xSAא%p *^.>AL娎ۖ. óM&I-,`T~ڦet/y5yU*a[xit"zC~ً5\2#וz~ä&Yqs`vκɒi17o5^u;|ҩp<6|fzIq-w>؋MEE`?'B)*]@Ws131muzb{MN+lװi$; CNW˴K:8;zq=koYUr#+57?D{O v!nK6hyB{d/"~Gz>8t3z8HBҽv Ƀ 6G2_Qqt4[5yGRteۇ*ݼn*mVM1Z? ˋs)w'AFRA1ׄRUVD3o>7M1HZҨ;&2r#mndC>k}L{}m'5k3|郧+:%2iBiO#Ź^/s7^iܪZ~]cte4 DX֐ %ΰ4QZ6s[<v)s_.C\{e/Md2(U *E>w]yBL+.GaZnuEu79Ginٺh qP`DL5 +T(tf׎nl7nD4(F/2 7MT+ b킷@)cd01ZP % KoMф $[%. uԬ?F !XǩsbA,Tc>h \YFKrZq7hpqim#^ V?3}-dJİh@N֤31DE4CZ 2t-;A}FlqA*Y[$jALԉ+Ò^-]}" {֯콋j=՟Ʋwk/V×;}ր0"{?7Ih87ԱM|d+=ȾrђS OA.h 1@*gm+JݧE7'EG9E%n# -Sr'lmSH%zY"\TЂQn{tjM,]{GmUCO3jO3 ɵ˓ʿ{Ї̩pcҴOX "1)B~&1'7^W"~~oSexQ+̨\uV)b?y4fM !e$~hATBX{KrxofI;4OpKMVlP4ܭ` XfD4L̙qody2ҷH+(->I;XtTKF.A_0(A$ׄa`!9 xaGx 2aܦ^TBe:B"S>z?g5iKMW{BS_-"z  LBYvx* YكR=Ds3㑐h⽫$SPN5`Z7m*l,:E_hsA)̺/Jxx+_t7\=,r:oL):ܲ/5'.A :n=vjK#4.Z#R13Ĵh࿒( mƪ}%M#{;oq jЋdV׍wiz6Ęlp6Uʼnb@CY|AE}/iC4ΆSWV\_9LkB_ѸYbvHu&G'ݸt۾"e50r`=R8`4ڧL,,6TK zt3 ʐjoqu5L3xM{(`ߦk(44c DW4=dMZQX7:/;NZrdO$ikU w7%T3%|fł'_͉$0ŵo>PcMl]ם ,%.*f6iմ^ؿKGMtR$Pҋq:(. ⪂rOn f ueɝԦA\LG>E{[-Mwazw8FuW9v puy&+iO0C1TɞG .CAsfw[~[Θeꀄ?G@6|irYw#DF#EE5xcl3IMKF%x\BV`ej C-(=_)@ߟB[8<8'cSew.JKNdY'zUPi">{yv@DፎI OXZ~ثcA6T#L)y ]+W 3hf&rd[-Ze1겋[OrM ĹPF;2notCyau*մR?DC? (R} /8½3cWF=Ԃ_2;T{QަazGzA)Zn#佸OyY{'䉔M2o6xW0J (SѱOtLWO'ˁm[4\̪g 8VêݴU bSmHSx! C(ݤ~I+{Zi<&MGT>*ΌZf 2.~ETj?s dX|^F`K>Ц+$+KZ?`Ni3Qb>wV9 Pl ^U8XϓjPcwY^)PV#dI&SY缝w˳Q%3:'G5l+z=#ҡ~\ש';6= a&zrz۸1$)g HGP:q+t4{Dj8`$k ;n8 R$7{2vU+>:]S`3{(3 ̳+|y2mOyŖ{G M w+Bo<1\ 0U:3J>b iCbLgodF̓d,Wƣ9+W6>  "%_6*1deN Fm<=Qc⣍f_, ߲,_|QPݮ$1Cy8c^%ĶbH༯x&lJte~iiך"VVŕps=#ݜS}ֹʢO+-̱~8! b;zS1M8$©>˭0K_i'q-o t{XhkW jcpf"D }նl[1*Iz>Z-ag_@֊"1򏧨yCOn|E4 Bj̋^}?X_t̰(T)O$WvN;_(( bW#RI. .Go]CA\iR`87`5 V\0DjN]bص{kpW )ʐ~Ƿ2t%kT¿rXAH*\tƠ'3jw?D285vra5A,95`rnu_MD+W ;}J4Ɉ3ՍȤ|sI:QN {6H.!TV&Dz]7)\\ϋe=*X#l0z+23i2Ɍhh6!W_aP֧m尚vZS1sM8xrR'xYoy/I*PJQXp8P/䣂ԐVYJdлcFҞ7h5׌1OvQ//̀ݟLSݶ`I'mte+fX;لib:MCāi_k!)2bcĜ݉iZ!/5GUCi^|gZH,AmL0XBe aXT,@2k[aP2 w}_b? `_8 ?!&2;x⎀7ˠVݰF8`Q=d #ʛ%Z >TTu [Dɧ1K譺Ou?q^ZImvcϝ`*-anSScN&h%;5 F>seQS]O5PWf\!J#:ɘs{( Z+OP>K8i.Sn([f9 ψ[\F`,3>x?Ҥ}l<$r,_MWG{. LTsM*ㇰ`12/a!Z1|},Q] NЍѾ:g+BߩD,NM~ )8ѬrABN|G:rcO;L D948u/!B@qOn?_ dTsə^gn㎨y?fqM>Q\IR؅r0ָz]77t>rxDw^ s/r8L%V02׀EaV/ 9`BX&wg* fVʂO4oIdrfKSKN6]mut3.fљKX՗qL lM:6C\@|'iO~B(5C*ceb IƽsǶL14Fx% ͞3'A]uc2^lI (*W- G [QKRzLUf̶?o܉J"VveBx'LXJ%HuxALY#Ԗ-& h)gTg/@,V%uzGGmmvYSHO*ST[hu/yF PT4b>2c!mxa& /Ր3wcNa#kť+ [7o%"[HeyZzrD7|_>-:`5NyPM4$:7~mqg B⊟F2_ #uc2ӜR/P-$A|elGʬc Eb_GgNrM;~RtsCwEu+.P05ߦA+\]c7ь!9GD%nI@V5oh|k/AN]nJ;4e*1ćTUV!6Qo: =Jg$EfR)z3ltRZǙ8so{<\\  Έ6e j$#v[}n4TU6Jn[‰KyENfD~\EPkmk$qeN.7wOnؔa$׊_>PJ_tQ~X_ x2k[b|!H9SƆY 5޹ХuX qmiἛ=N7eg+Ќ",tl:mh2{Ae "k0C RQF=oAgpJ_M4Ǡ@@dd-(@ b%*N~gb3 7?SmZDoCmM{5||Zt7;am? Z1T?S-]lz4,]129FTLw>箋V)\M1CCBrB#/WpM̍M<8)Ap(LweAJK-;H˔$0L|m A(/njKSJ˧ji(:SBC6y ՐrY0Xa7R%"|V9Vms}sQ票Ke~uӪ|pn环_3XV7mV=tBc9ɘC 6m,(bB/g RYUތFIѥ%\G`Vզ+];Ϡp"ubS2Yk4C-kS[e$`DO<5o߰@Rn[ ,| l'?W-L{8Nxd*;+Uɨ@~֠Dɜѩ<;th֦U K򉝪1J͇X.Vϒy-9A_@;?=>sN'mx)۶0+T(O<%k :/?.%~ {,]K*ٳ.V)vSCnoS>("tOCCnv/S;J\0q" yz-ʷ!&;֬8GU:$u$lIywug;-鿼\]J덩1CGDZk5v6Dߕb/3#D_s4BЇlt#1dU8w*`JV1hoE2˜ȖpW|!0_M2ܡ:w [1k)= 36ͪѓmЪr 81;<2 1u y6lNA=!<2ג0{ز}_T|CDؑZ;n<^ DS;:K?#g& 7@Sqא;ssh3qJֶmn,a{1` qdӃ x5Q=Yoyb<*%[d"E!HEFbS^dX<%+tRjX_Th }V yzS4Iʨy6@:EG_yIHqYج3IQ Ṭ/~ Y/h>~R\?9J+;  `{qGztٳ1Sf{"D顨 niA6@1vKhe ,BDVMWe"::| !*XGX~HcLs]1 f *<}p_3#O_2,aaW׫ y'>կs*dR< z-`幂ҥV+1& 6>TJwUy#:YmÌ*LD5[T[NM5ڇȻːj{.0^͘`~!% R0_4dɕ)4[Ш =dHi//=k˻y[j&"/Sk!P.7? D2#yʮKaS࠺o m`=R?bIԝ`2=R^:"<,](cW;?KV,d0XTSEpR "eTyWm.rM.(LxɣTMk7ؿ>d/?V.ںXVOJa>n8냬͊'}s7ˈ >Ɵ9Qu{Oz6Fq1H'X٪[P:iմ#_0Q6KݤcRSiu.i@ rJa%pl^tB:#+}4$%Z8ug+YBBBkڷ94fW[r5 AC"'opeטYB_&៊V ?A QudYuoQ847b,5n!fB̢+^SDqf 7O={lQc 8<͝Yy3XZ*%NA+#sFGt ފI3Yk5"_>,""]HIyz)?5μ9iD{~[@$簌KR{5"fî>GA$bND3nKѨZ1/S~Œs;TH4(ڶ\7CƜ;${;t^*YLdXˣE1Y:VW73 $u(HJiXh}Z }Ge#N %5!pk,>(PqytQuZc"b_bhأH=16c$P fZzSǡ os/ʹs #+Yrw ;o[a>x*y";4JHyTz88}i?%"$s8\F-{.P >sU֬Yw.>v ok`m=Q̔ћLg;}c.OL tljwA)X\ը! J$bSpA(gsG0cĔTL2߆#XuSn!J)pymAđƁ+ SҷXI7dR;M3.ȯvVl=(F~P\~hh4~FTZ$̞9Rut~Ƨ/Tj*ĤG@DAbHkBZBǯlbD)|1ŞhJT+j.X6;9 ;G Ba2Ê?rCg^{ÎNd)k-ѱ;W\<8akɸ\ - )s0Rb>3 KKX78;IlT6uTHtO90^)KVYE'uc[ D|ĉOqڡ릛L^gCs\d` G$xHGw$BPw0xc2ښ~h/(:Mݏ g\ԭɬ(?/+Z=13bs-k h4sT1b:q-f/jaWW om5k$E!2bQ5>ݘi'Vr+`!)F&f M_YAsm0'\Zy5cIr4zԄkS0יYQh1g_O:B`#j0Fy`uxS<#üw+D&4 `+r*%3h(yD>=hKh)nꓛIyh1$S #sg,:.dm:?6츸ibLTuD7‰ٸ ռ܌ bQjz5ƼmTzxMJ[ nBG?ѯ_`Tg vtT!v*dzIr# 0uN7Қn&joERcM6`@ZRfg:}#Z!Rlg6RF-?]rY"a7:9bwX)9^ѫ \Uz8[Rcj3P:F|!7 //d`E|:YL#(ʃ~:%3o% E jgʸxKAjAc\:DGG{ M<fip SXtz\=`̛R^MeeĮ(ךIX! RQΓlcΝ U#XEGQs $wyۻV(FGy,+Gw=/G( ʀ6)4V) RFZĦ<#ӕD̩?Tw=budmO!R;-O 5='Xo8̳_4 VKyd 9o A%nKbfʟ3%9.qZD<3`xlK^ո_kb|$飳`U+MbfVH =X՟eox+ :ĴdTԞR'Vz>RE,ɇ (-s30yLTd˟1$-w ~ o[<]橆Mvh Cx_f{$佒˿ܫ+>D5m7 sq8fhJEݶ+u;+V0CYxvkrȼ4,r<{c7i12H~H!h"Z0ٟQTls=bm\1Vc&9S,j+@Z0w> { 6r$2}Zy;,mw4մ7%853ۦaM $>ΌXs CLbOx/3$:1#0ķ{1lukvd-%Q\߂l3!.IR!.**䣣dX`f[U<XFuyr>a.K+mWNciK`+|=xxtI@6M#D(/ظ؟I\/@,<1*{p@4^& ̾KgYXVx+|V}~3Kȵe|39mf RT:c 埢==Kl/Q郕1tln{$J*ȳPUǪ W=Gl*,E6v)AeSP^{!ox@6r14$z&PX`2yvy9Lɍq^lsι|PZWcp8r_|qǗIQNGS9{h %DP`i`t*4@'L&0]r*FZ z{-MwD gdՐn|L}35cm|hR39.nvVSi*ѨyWei?ӈ(jZpZ5~dqβ3t3"tj?6S8Ԙo60PfI"ND( J⯕-NN( lS*l^ 㿿:T&g1lZp햒C _8TE󝁝LKR%ud]ݑ9\:yA$6n,{>']ryJCFꖙNTk^-ISb[P+4;Ƴ8Za/^j7z_h[K (&lPO5n=O@RHQ[,?ld6aNSoYjzBe`_`wzYHz/m2+;>q:)ƚ a@h &`.^1Һ-XA M>ϭbz=3;y~JG6FkEQ^K^b:>SeQ4q6j2 }N1E}l5Sc^˃3k%2ؤ BN ]#z.g?tQo}N)%z]k/@ 7[zSh)`$: =mN)Ä>^ "w$[2aYϘ.]* E*TLkuf[˿XӰ[S.w@cb#|rlGP](70xZ^*#Z5pك$s[W3+D&a2հW_-c_^7?B5z-r=~*Geb;,!)C-T5|kAvR~Nɮ7'0PQ,oK =䞯,yDh;1Cr3/ mo9%9u̾5չTzqO-@3;|լM:0\z^;juRs[aLǑ(_3p:/J0BrDfTe(~X,. ]\W\얻Az?WiqSpLۼJrU-Adk>y@Qdp|&s-oLrYo9jx0q0\'Mcޱb8_"Fpj+{Lڙ::QC{U]sΌ(>"#}"iBAϚs^"aIU|9op\s]Z{*QrdȱN3=T U1ӧe@0s$eWr)0ҕd]T>/r& /-"SM3+;lƺ,˄;XOޔFx0C+v7_Û~]^LЬ50֍ʂW@~*$ ~^5u'7:av ;&UoNb M+)ưd7iK aZtaiW6!ʘ޸E3>lo@\B^w1. $yB^w<H <Ш9!Ep mdhk7 ď:o2]~XZ?ϝdVY4%a!&H2.c.i4A7k;|,=o3@CAGzN2tղx:f?O,w mMz ԚUib~4- fg;=H)ܧȚOf`HIvobR$e2*$#wDFR7Sm_FNt9C7)LE6iGc/%Z9 dYK@>HC*[A YZ