knot-devel-3.2.0-1.el7> 6 6`d63!}|J^>j/5,dc7 j/5,d{~B"&,O]<EuRjz3:{RE^}pI_nOêcJiI:yJ^li3> ὎|N) A uljnWJe+tfd1&Ȗ|\VA1U+YN2(@ ^Ad>S[z UR)]B`pypW_.,?FRkA'N>FIi}Q٧ Ka|[6m$DTΘΒi'E©`F>0|uR>:POx\_i.k72_@iȦw-D<sj/5,dc7 j/5,d FVH'rC^&_d.wLojI+PG++r{l?&cX {\BPH6Ac,2i b!1KE S(NJEӵ`g5X. [|3|ߖ^M~]%8GaF:Ý+QW(UԬa$Q.S!;`*=p> i݅f I4M=5alBB2{O"z|?;w꩖/E vk:0? d   M &2JPXWW bW W lW W WWWVpW< h  a ( 8 >9!>:-O>G(WHWIWX8YP\W]W^b0defltWutWvw WxhWy Cknot-devel3.2.01.el7Development header files for the Knot DNS librariesThe package contains development header files for the Knot DNS libraries included in knot-libs package.cbuildvm-x86-26.iad2.fedoraproject.orgoIFedora ProjectFedora ProjectGPL-3.0-or-laterFedora ProjectUnspecifiedhttps://www.knot-dns.czlinuxx86_64I %~ B#R . ^, J 0'(9K< - tgj U }FX kr  L >#"2 9,%A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc2e4254af54c053f35290cb46ed8acd81e9057446b2d71ef8b911103c6999cd42b4fbe48c632018c0e15b531c25797c3b380cb0ec35f0a597a1f1c94008220b58f676aed7ec38307f1d7282f86ec4f894dd4875c2429109cab92b9621525966da759f07a1c22a4825047d93059c1b52328484334b7f8594b3511234325224fbd8bc13139bb264cedbb87f2c05521f7485d1933527c92e8a7a212c6f8ef2464203dbf9aaff8cea91313f84aa0debeb5dec8320826f796327da580a004cc05b2a3bfc9daa3a1ec734614ff5b96508ce9194e3138c6cf36df83f5a44a57504ee0e498e9c208cedc89ed277c48b97086e1455d2534705619218a1229e97234bfb0b9ec9669c39509cf8f5605eed37c08124192b60ed878e4f8707fb7689e1c1c1eba292ea22cde12acc55b67f797071c03119cac1d0ecacb187646052b5ec9bf692e8f6cdd36b572a22aea68204f86f208c5f2a052cccfe73a5430b0dc4dbe6a9db0bb9fa74795774ffc71a964f8b7132997957fc0ff8ea37b1f21d1f49c112b28d74dbc4c85e9a17c5712cfb676499f0ce467e72b96b61e969048ec42cd43bca7e79919f3837757036c1766ffddfe13b4756a180dd56c94acd798fed6d1d35454f28c3e7b2c6cc75abeb22f94d2eb7162ccfaefa2a224dfd135c8186472796d057e9730175087fa57df5d888dd1b20235be606ad93f0b7120474263fd5bd04706fd57d3c4103bfb975bb72df32b83b0f1454b68af76d0a322e6012bdfe33e314ea56ff55880afcd6f267f2ac36d63e7d21c4c05a94671242c2b98265dc033f97ea792fdcb60c04de1480f588d132d0bcc6571978b64f74ee1e0b05b68472b088f1eab3895ae700bc36c8bf8e84cc135c7e61013c262a8588c495818ff6beb95cedd867af608031639b271fecd0b35ab0054e67bace684a983d9c96599ea7ac28049709e7cc98c3de9f322e232b419b010057a85ae809040bfd1d4f7980d352ae3a6573aeabfe39a9aab4f6bcdbf0693805d8fbdd906c78ab0e955f39e7eea5977a041757fd765e25974c4b01ba40214d4cab0626fc506a1ad7a0e8577b3aef19a92568794f2687228985fef92941424d5d68998b941d1cc640079e10ddf99a12bfc29094502ae508d76d35c66c49a3bbbfab63062a405223724bc545d67b41de48e28debc18f8ece4ba5df6c8fb7ba9c9a01c6388227a98d272a9ff77ed4ecb84c0b45c1a06bae79ef63c42672bc930378393ca1581c00d473c52452f2175a51ec44ea1ee38730477013bbf9c8983c5985e5e14aed6b22854ec16f781184aa6b3d097191d36950be3a402aac76dcf9f532c6dfbb60228158cd280701096ce5420acbbf966173cb85aa9ea97c10e7674a09c0c7ee88988c66f4f9b30c01100333d484a554f47b5e1b3c0d5a226d9720bb3cbf391fee27b1a70850972b4469ce0948db81b62373ec7b7f48dc28d3b26cacca029b46cfe7d4815c72d5253618e526d5f9a68f1993f6d90e0428b4585ca5be835eeceab21017198d81b3819c40046ea8ea5eb2ac45cb096b58ff9108a2fe6a99fe698f42c2a22c0b896a9cbb9cdf4b70b434245ed008a00c55b022308f1e325cdd2ccd6476828068ee18c484d9aa5d85a9d55ee1bcd8a6c512fbaab8e00b5a31d025c978aecbda25a32caccf45d637996c0f486d76c5da8c5c6407e14415a2cf13573fa7c7b42f7249d1ac676295832fa4819eaf771ec0e6d899266644885dd3b825b7137307935b3ba7f3af24b8b3536fff1cded7df7fe32ed047aabdbfbc878e4a090daddf8cbcf961b104eef29eee38fe1e919f28aaf436f2016c2dde4533a78e136e9ea526fb1e246c51feb8cc8cf570e77e888ab0bc525b95a0e058411ab8f82c16ed18021427d2107c4a2a3b1e82423284635714ee1a820a82bc17197d1334667b6b06ef1258a93c21649c8a8b4b91b4063489f544e810bc10ffcf7834cef2549c53a9b6b81cdb937c0bd08f121aba302841a71120e7dd3194c3f3e51dd2b2db50acaa6e0adf5a10b15d83dfcc30161dcdbfe3e0ec3bcd4ecd1b35415214c84ec3728b93cde1d58ef253337548c27d48246cdfa95df787ca6e01968b1165e23e9f213a3e8092e3d55141db8a229a257e33b5b78d6e416ca902cf8a68b2a28e1e3e89a775b91a6df6110fd6a82ec30fecd5f27716fb25bd2f32491a381a61b4864685d60c8d14c3ee0e1e6b27e0aa14448e342f11453b42f4e81202318e81f820e8fce142fff6b646119148bf78d1f8f228c157bc2fb5908df7065f9a59f5618906612165603a3e48f02b05fbcd16d484dc095525cf47421ac58917ea5c09e68bacb516577967c3a2ffd12022371430ab2a2e74d275401c78b36c467a06a1e2ced136266ed33508ea1410b305442980bd50a6e6bfd1a35417aa5c74316e52f1ba5304d8a799a054e935110765fc0e926c5496ab912b4c7e7406a3aef76fd0faa559bfe6f95482d423e0777793c329621af1ff50cf8ab6545706c7d872a2f5dec3ec487482c97d53ef647c45ac407c04b6fafbaf42aafeda061486f3a0cd57ee6661cbb3472354758d8f194182e0e372d1c5b0c964f5b0e272006722d7b9cea85bc01a4a7b2691463264f07587df645e8a2fb7804f736060a60688330aff4c178b53550537ec8d55c26d688b28aaeb2631003298e74a56c98121799d00246d344841cb4a4e1cb60499185a8bf7068c0421e33dab3a30ae46a8ccd14e3e4e3438f3167de92fb6d2f04ee6418c41366edbec6cb1a64da831dd7dcf418ec4a546820b816a6dd26d37658b52c1c856604b27f9bcc05a01059d5fda2147bdaf3264bc8355a3e6b0490b7070a727c033d439d537ac1bc5636d5fdb8a6cc17007197f83ca431b327084bca54022011cb92d30053268cbe50c1a671b6dbcaa63b0b4fddb4ddd9c9d0e25a25bd07a36147c4055d7495e9907dc46930b276cf7b2ec1c5c2b3032312fc404f217416a54005443f8b198f4650054f59842a247de965fd8883792388e3a6cc74c05dcdda579d46b8dcbf76c7f5cb1ac8982be3a2d0c294d411b0f13f4fda39ec1c710b1f62c1554b164e0a2497e7ee7b32ff0095affd13c476f200ea14ae331d793f49f21cff8b3f581bed1401f149a0b1658637cc6ca6573fd66be9daab69fb5ea8be00843f89818736d0394d5f4848136e664474643c7b068a83328298ff42e0d0725289da95d482005dd11698d41c4a89d2ceb1169c6772c33565ba939200f470a3b6a8535aaf0679b0d49fb8136971f4dd38aca6fc4505581b3b95e2e2c367fe80a3347acde97libdnssec.so.9.0.0libknot.so.13.0.0libzscanner.so.4.0.0rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootknot-3.2.0-1.el7.src.rpmknot-develknot-devel(x86-64)pkgconfig(knotd)pkgconfig(libdnssec)pkgconfig(libknot)pkgconfig(libzscanner)@@@@@ @    /usr/bin/pkg-configknot-libs(x86-64)libdnssec.so.9()(64bit)libknot.so.13()(64bit)libzscanner.so.4()(64bit)pkgconfig(gnutls)pkgconfig(libdnssec)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.2.0-1.el73.33.2.03.0.4-14.6.0-14.0-15.2-14.11.3cobjbDF@b@aՈ@a@an@a9@aj@a @a@`t`9@`f@`c`@_H@_@_E@_m_Z@_O@^˳@^U@^^F]}@]ʞ]@]]2@]'$[ @[H@[E@ZnZZZZ}@Zz@Ze@ZNYYYXƉXX@XAXJX-W#WhWWV&@VUUUUa@UG_@T@T@Jakub Ružička - 3.2.0-1Jakub Ružička - 3.1.8-1Jakub Ružička - 3.1.7-1Jakub Ružička - 3.1.6-1Jakub Ružička - 3.1.5-1Jakub Ružička - 3.1.4-1Jakub Ružička - 3.1.3-1Jakub Ružička - 3.1.2-1Jakub Ružička - 3.1.1-1Jakub Ružička 3.1.0-2Jakub Ružička - 3.1.0-1Jakub Ružička - 3.0.8-1Jakub Ružička - 3.0.7-1Jakub Ružička - 3.0.6-1Jakub Ružička 3.0.5-1Jakub Ružička - 3.0.4-1Jakub Ružička - 3.0.3-1Jakub Ružička - 3.0.2-1Jakub Ružička - 3.0.1-1Jakub Ružička 3.0.0-2Jakub Ružička 3.0.0-1Jakub Ružička 2.9.6-1Tomas Krizek - 2.9.5-1Tomas Krizek - 2.9.4-1Tomas Krizek - 2.9.3-1Tomas Krizek - 2.9.2-1Tomas Krizek - 2.9.1-1Tomas Krizek - 2.8.4-1Tomas Krizek - 2.8.3-1Tomas Krizek - 2.8.2-1Tomas Krizek - 2.6.9-1Fedora Release Engineering - 2.6.8-2Tomas Krizek - 2.6.8-1Tomas Krizek - 2.6.7-1Tomas Krizek - 2.6.6-1Iryna Shcherbina - 2.6.5-2Tomas Krizek - 2.6.5-1Igor Gnatenko - 2.6.4-3Fedora Release Engineering - 2.6.4-2Tomas Krizek - 2.6.4-1Petr Špaček - 2.6.1-1Petr Spacek - 2.5.3-1Petr Spacek - 2.5.3-2Petr Spacek - 2.5.3-1Petr Spacek - 2.4.1-2Petr Spacek - 2.4.1-1Fedora Release Engineering - 2.4.0-2Petr Spacek - 2.4.0-1Jan Vcelak - 2.3.3-1Jan Vcelak - 2.3.2-1Jan Vcelak - 2.3.0-3Jan Vcelak - 2.3.0-2Jan Vcelak - 2.3.0-1Jan Vcelak - 1.6.8-1Jan Vcelak 1.6.7-1Jan Vcelak 1.6.6-1Jan Vcelak 1.6.5-1Jan Vcelak 1.6.4-1Fedora Release Engineering - 1.99.1-4Kalev Lember - 1.99.1-3Jan Vcelak 1.99.1-2Jan Vcelak 1.99.1-1- Update to 3.2.0 - Patch: fix tests on 32-bit platforms - Patch: revert problematic hardening of service file - Patch: revert config improvement to support EL 7 - New knot-dnssecutils subpackage - Debian compat (knot-utils vs knot-dnsutils) - Remove bundled(jquery) version as it differes between distros- Update to 3.1.8- Update to 3.1.7- Update to 3.1.6 - Use _sharedstatedir for home- Update to 3.1.5- Update to 3.1.4- Update to 3.1.3- Update to 3.1.2- Update to 3.1.1 - Enable XDP on ARM and improve XDP config macros - Remove patch included upstream- Introduce a patch to fix tests on ppc64le - Use autosetup macro to apply patches- Update to 3.1.0 - Add missing BuildRequires including new libmnl for kxdpgun - Temporarily disable XDP on ARM until issues are resolved- Update to 3.0.8 - Print failed tests during check- Update to 3.0.7- Update to 3.0.6- Update to 3.0.5 - Properly escape BASE_VERSION macro - Include module dirs in main package- Update to 3.0.4 - Move dnstap module to subpackage - Move geoip module to subpackage - Remove redundant VERSION macro- Update to 3.0.3- Update to 3.0.2- Update to 3.0.1 - Sync packaging from upstream- Rebuild- New major upstream release 3.0.0 - Sync packaging from upstream- Update to 2.9.6- new upstream release 2.9.5- new upstream release 2.9.4- new upstream release 2.9.3- new upstream release 2.9.2- New upstream release 2.9.1 - add EPEL8 compatibility - fix unsafe PGP keyring permissions- new upstream release 2.8.4- new upstream release 2.8.3- rebase to latest upstream version 2.8.2Knot DNS 2.6.9 (2018-08-14) =========================== Improvements: ------------- - Added zone wire size to zone loading log message - Added debug log message for each unsuccessful remote address operation Bugfixes: --------- - Zone not flushed after re-signing during zone load #594 - Server crashes when committing empty zone transaction - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_RebuildKnot DNS 2.6.8 (2018-07-10) =========================== Features: --------- - New 'import-pkcs11' command in keymgr Improvements: ------------- - Unixtime serial policy mimics Bind – increment if lower #593 Bugfixes: --------- - Creeping memory consuption upon server reload #584 - Kdig incorrectly detects QNAME if 'notify' is a prefix - Server crashes when zone sign fails #587 - CSK->KZSK rollover retires CSK early #588 - Server crashes when zone expires during outgoing multi-message transfer - Kjournalprint doesn't convert zone name argument to lower-case - Cannot switch to a previously used ksk-shared dnssec policy #589Knot DNS 2.6.7 (2018-05-17) =========================== Features: --------- - Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung) Improvements: ------------- - Trailing data indication from the packet parser (libknot) - Better configuration check for a problematical option combination Bugfixes: --------- - Incomplete configuration option item name check - Possible buffer overflow in 'knot_dname_to_str' (libknot) - Module dnsproxy doesn't preserve letter case of QNAME - Module dnsproxy duplicates OPT and TSIG in the non-fallback modeKnot DNS 2.6.6 (2018-04-11) =========================== Features: --------- - New EDNS option counters in the statistics module - New '+orphan' filter for the 'zone-purge' operation Improvements: ------------- - Reduced memory consuption of disabled statistics metrics - Some spelling fixes (Thanks to Daniel Kahn Gillmor) - Server no longer fails to start if MODULE_DIR doesn't exist - Configuration include doesn't fail if empty wildcard match - Added a configuration check for a problematical option combination Bugfixes: --------- - NSEC3 chain not re-created when SOA minimum TTL changed - Failed to start server if no template is configured - Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing - Inaccurate outgoing zone transfer size in the log message - Invalid dname compression if empty question section - Missing EDNS in EMALF responses- Update Python 2 dependency declarations to new packaging standards (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)- New upstream release 2.6.5 Knot DNS 2.6.5 (2018-02-12) =========================== Features: --------- - New 'zone-notify' command in knotc - Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set Improvements: ------------- - Better heap memory trimming for zone operations - Added proper polling for TLS operations in kdig - Configuration export uses stdout as a default output - Simplified detection of atomic operations - Added '--disable-modules' configure option - Small documentation updates Bugfixes: --------- - Zone retransfer doesn't work well if more masters configured - Kdig can leak or double free memory in corner cases - Inconsistent error outputs from dynamic configuration operations - Failed to generate documentation on OpenBSD- Escape macros in %changelog- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild- Added PGP signature verification - Added integration test - New upstream release 2.6.4 Knot DNS 2.6.4 (2018-01-02) =========================== Features: --------- - Module synthrecord allows multiple 'network' specification - New CSK handling support in keymgr Improvements: ------------- - Allowed configuration for infinite zsk lifetime - Increased performance and security of the module synthrecord - Signing changeset is stored into journal even if 'zonefile-load' is whole Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Some minor DNSSEC-related issues Knot DNS 2.6.3 (2017-11-24) =========================== Bugfixes: --------- - Wrong detection of signing scheme rollover Knot DNS 2.6.2 (2017-11-23) =========================== Features: --------- - CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support Improvements: ------------- - Allowed explicit configuration for infinite ksk lifetime - Proper error messages instead of unclear error codes in server log - Better support for old compilers Bugfixes: --------- - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file- New upstream release 2.6.1 Knot DNS 2.6.1 (2017-11-02) =========================== Features: --------- - NSEC3 Opt-Out support in the DNSSEC signing - New CDS/CDNSKEY publish configuration option Improvements: ------------- - Simplified DNSSEC log message with DNSKEY details - +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given - New documentation sections for DNSSEC key rollovers and shared keys - Keymgr no longer prints useless algorithm number for generated key - Kdig prints unknown RCODE in a numeric format - Better support for LLVM libFuzzer Bugfixes: --------- - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used - Immediate zone flush not scheduled during the zone load event - Server crashes upon dynamic zone addition if a query module is loaded - Kdig fails to connect over TLS due to SNI is set to server IP address - Possible out-of-bounds memory access at the end of the input - TCP Fast Open enabled by default in kdig breaks TLS connection Knot DNS 2.6.0 (2017-09-29) =========================== Features: --------- - On-slave (inline) signing support - Automatic DNSSEC key algorithm rollover - Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0) - New 'journal-content' and 'zonefile-load' configuration options - keymgr tries to run as user/group set in the configuration - Public-only DNSSEC key import into KASP DB via keymgr - NSEC3 resalt and parent DS query events are persistent in timer DB - New processing state for a response suppression within a query module - Enabled server side TCP Fast Open if supported - TCP Fast Open support in kdig Improvements: ------------- - Better record owner compression if related to the previous rdata dname - NSEC(3) chain is no longer recomputed whole on every update - Remove inconsistent and unnecessary quoting in log files - Avoiding of overlapping key rollovers at a time - More DNSSSEC-related semantic checks - Extended timestamp format in keymgr Bugfixes: --------- - Incorrect journal free space computation causing inefficient space handling - Interface-automatic broken on Linux in the presence of asymmetric routing Knot DNS 2.5.5 (2017-09-29) =========================== Improvements: ------------- - Constant time memory comparison in the TSIG processing - Proper use of the ctype functions - Generated RRSIG records have inception time 90 minutes in the past Bugfixes: --------- - Incorrect online signature for NSEC in the case of a CNAME record - Incorrect timestamps in dnstap records - EDNS Subnet Client validation rejects valid payloads - Module configuration semantic checks are not executed - Kzonecheck segfaults with unusual inputs Knot DNS 2.5.4 (2017-08-31) =========================== Improvements: ------------- - New minimum and maximum refresh interval config options (Thanks to Manabu Sonoda) - New warning when unforced flush with disabled zone file synchronization - New 'dnskey' keymgr command - Linking with libatomic on architectures that require it (Thanks to Pierre-Olivier Mercier) - Removed 'OK' from listing keymgr command outputs - Extended journal and keymgr documentation and logging Bugfixes: --------- - Incorrect handling of specific corner-cases with zone-in-journal - The 'share' keymgr command doesn't work - Server crashes if configured with query-size and reply-size statistics options - Malformed big integer configuration values on some 32-bit platforms - Keymgr uses local time when parsing date inputs - Memory leak in kdig upon IXFR query- new upstream release WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble).- disable dnstap on RHEL (depedencies are missing)- new upstream release WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble). Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme Improvements: ------------- - Allowed binding to non-local adresses for TCP (Thanks to Julian Brost!) - New documentation section for manual DNSSEC key algorithm rollover - Initial KSK also generated in the submission state - The 'ds' keymgr command with no parameter uses all KSK keys - New debug mode in kjournalprint - Updated keymgr documentation Bugfixes: --------- - Sometimes missing RRSIG by KSK in submission state. - Minor DNSSEC-related issues Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Improvements: ------------- - Extended debug logging for TSIG errors - Better error message for unknown module section in the configuration - Module documentation compilation no longer depends on module configuration - Extended policy section configuration semantic checks - Improved python version compatibility in pykeymgr - Extended migration section in the documentation - Improved DNSSEC event timing on 32-bit systems - New KSK rollover start log info message - NULL qtype support in kdig Bugfixes: --------- - Failed to process included configuration - dnskey_ttl policy option in the configuration has no effect on DNSKEY TTL - Corner case journal fixes (huge changesets, OpenWRT operation) - Confusing event timestamps in knotc zone-status output - NSEC/NSEC3 bitmap not updated for CDS/CDNSKEY - CDS/CDNSKEY RRSIG not updated Knot DNS 2.5.1 (2017-06-07) =========================== Bugfixes: --------- - pykeymgr no longer crash on empty json files in the KASP DB directory - pykeymgr no longer imports keys in the "removed" state - Imported keys in the "removed" state no longer makes knotd to crash - Including an empty configuration directory no longer makes knotd to crash - pykeymgr is distributed and installed to the distribution tarball Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility Improvements: ------------- - Added libidn2 support to kdig (with libidn fallback) - Maximum timer database switched from configure to the server configuration Knot DNS 2.4.4 (2017-06-05) =========================== Improvements: ------------- - Improved error handling in kjournalprint Bugfixes: --------- - Zone flush not replanned upon unsuccessful flush - Journal inconsistency after deleting deleted zone - Zone events not rescheduled upon server reload (Thanks to Mark Warren) - Unreliable LMDB mapsize detection in kjournalprint - Some minor issues found by AddressSanitizer Knot DNS 2.4.3 (2017-04-11) =========================== Improvements: ------------- - New 'journal-db-mode' optimization configuration option - The default TSIG algorithm for utilities input is HMAC-SHA256 - Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor) - Added some more semantic checks on the knotc configuration operations Bugfixes: --------- - Missing 'zone' keyword in the YAML output - Missing trailing dot in the keymgr DS owner output - Journal logs 'invalid parameter' in several cases - Some minor journal-related problems Knot DNS 2.4.2 (2017-03-23) =========================== Features: --------- - Zscanner can store record comments placed on the same line - Knotc status extension with version, configure, and workers parameters Improvements: ------------- - Significant incoming XFR speed-up in the case of many zones Bugfixes: --------- - Double OPT RR insertion when a global module returns KNOT_STATE_FAIL - User-driven zscanner parsing logic inconsistency - Lower serial at master doesn't trigger any errors - Queries with too long DNAME substitution do not return YXDOMAIN response - Incorrect elapsed time in the DDNS log - Failed to process forwarded DDNS request with TSIG- configuration checking was fixed to be compatible with Knot 2.4.x- new upstream release 2.4.1 replaces old 1.6.x series which is not supported - configuration should be upgraded automatically using knot1to2 tool - make sure you reviewed the new configuration in /etc/knot directory!- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild- new upstream release: + fix: False positive semantic-check warning about invalid bitmap in NSEC + fix: Unnecessary SOA queries upon notify with up to date serial + fix: Timers for expired zones are reset on reload + fix: Zone doesn't expire when the server is down + fix: Failed to handle keys with duplicate keytags + fix: Per zone module and global module insconsistency + fix: Obsolete online signing module configuration + fix: Malformed output from kjournalprint + fix: Redundant SO_REUSEPORT activation on the TCP socket + fix: Failed to use higher number of background workers + improvement: Lower memory consumption with qp-trie + improvement: Zone events and zone timers improvements + improvement: Print all zone names in the FQDN format + improvement: Simplified query module interface + improvement: Shared TCP connection between SOA query and transfer + improvement: Response Rate Limiting as a module with statistics support + improvement: Key filters in keymgr + features: New unified LMDB-based zone journal + features: Server statistics support + features: New statistics module for traffic measuring + features: Automatic deletion of retired DNSSEC keys + features: New control logging category- new upstream release: + fix: double free when failed to apply zone journal + fix: zone bootstrap retry interval not preserved upon zone reload + fix: DNSSEC related records not flushed if not signed + fix: false semantic checks warning about incorrect type in NSEC bitmap + fix: memory leak in kzonecheck + improvement: all zone names are fully-qualified in log + features: new kjournalprint utility- new upstream release: + fix: missing glue in some responses + fix: knsupdate prompt printing on non-terminal + fix: configuration policy item names in documentation + fix: segfault on OS X Sierra + fix: incorrect %s expansion for the root zone + fix: refresh not existing slave zone after restart + fix: immediate zone refresh upon restart if refresh already scheduled + fix: early zone transfer after restart if transfer already scheduled + fix: not ignoring empty non-terminal parents during delegation lookup + fix: CD bit clearing in responses + fix: compilation error on GNU/kFreeBSD + fix: server crash after double zone-commit if journal error + improvement: significant speed-up of conf-commit and conf-diff operations + improvement: new EDNS Client Subnet API + improvement: better semantic-checks error messages + improvement: speed-up of knotc if control operation and known socket + improvement: zone purge operation purges also zone timers + feature: print TLS certificate hierarchy in kdig verbose mode + feature: new +subnet alias for +client + feature: new mod-whoami and mod-noudp modules + feature: new zone-purge control command + feature: new log-queries and log-responses options for mod-dnstap + feature: simple modules don't require empty configuration section + feature: new zone journal path configuration option + feature: new timeout configuration option for module dnsproxy- fix post-installation scriptlet (RHBZ #1370939)- endian independent DNS cookies (fixes build on ppc64 and s390x)- new upstream release: + fix: No wildcard expansion below empty non-terminal for NSEC signed zone + fix: Don't ignore non-existing records to be removed in IXFR + fix: Fix kdig IXFR response processing if the transfer content is empty + fix: Avoid multiple loads of the same PKCS #11 module + improvement: Refactored semantic checks and better error messages + improvement: Set TC flag in delegation only if mandatory glue doesn't fit the response + improvement: Separate EDNS(0) payload size configuration for IPv4 and IPv6 + feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)- new upstream release: + fix: Transfer of a huge rrset goes into an infinite loop + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL + fix: Failed to build utilities with disabled daemon + fix: Memory leaks during keys removal + fix: Rough TSIG packet reservation causes early truncation + fix: Minor out-of-bounds string termination write in rrset dump + fix: Server crash during stop if failed to open timers DB + fix: Failed to compile on OS X older than Sierra + fix: Poor minimum UDP-max-size configuration check + fix: Failed to receive one-record-per-message IXFR-style AXFR + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message + improvement: Speed-up of rdata addition into a huge rrset + improvement: Introduce check of minumum timeout for next refresh + improvement: Dnsproxy module can forward all queries without local resolving- new upstream release: + improvement: Log change of the zone serial number after IXFR transfer + improvement: Document operational impact of various RRL settings + improvement: Add support for rate-limit-slip zero + improvement: Add 'timer-db' configuration option- new upstream release: + security fix: out-of-bound read in packet parser for malformed NAPTR record + fix: systemd startup notifications- new upstream release: + fix: don't load expired zones on reload and startup + fix: remove race condition in scheduling causing delaying of events + fix: NSEC proof construction in zones with many delegations + fix: TC flag setting in RRL slipped answers + fix: disable domain name compression for root label + fix: check if executed under systemd before using journald log sink + feature: write persistent timers on server shutdown for better performance + feature: support time unit specification for 'max-conn-idle', 'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options + feature: add 'request-edns-config' config option- new upstream release: + fix: lost NOTIFY message if received during zone transfer + fix: kdig, record correct dnstap SocketProtocol when retrying over TCP + fix: kdig, hide TSIG section with +noall + fix: do not set AA flag for AXFR/IXFR queries + feature: new configuration format in YAML, binary store im LMDB + feature: DNSSEC, separate library, switch to GnuTLS, new utilities + feature: DNSSEC, basic KASP support (generate initial keys, ZSK rollover) + feature: zone parser, split long TXT/SPF strings into multiple strings + feature: kdig, add generic dump style option (+generic) + feature: try all master servers on failure in multi-master environment + feature: improved remotes and ACLs (multiple addresses, multiple keys) + feature: basic support for zone file patterns (%s to substitute zone name) + improvement: do not write class for SOA record (unified with other RR types) + improvement: do not write master server address into the zone file + documentation: manual pages also in HTML and PDF format- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild- Rebuilt for nettle soname bump- fix BuildRequires for systemd integration- new upstream pre-release version: + DNSSEC: switch from OpenSSL to GnuTLS + DNSSEC: initial support for KASP - split package into subpackages - add documentation building - restart daemon on updated  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVW3.2.0-1.el73.2.0-1.el73.2.03.2.03.2.03.2.0  knotmodule.hlibdnssecbinary.hcrypto.hdigest.hdnssec.herror.hkey.hkeyid.hkeystore.hkeytag.hnsec.hpem.hrandom.hsign.htsig.hversion.hlibknotattribute.hcodes.hconsts.hcontrolcontrol.hcookies.hdbdb.hdb_lmdb.hdb_trie.hdescriptor.hdname.hdynarray.hendian.herrcode.herror.hlibknot.hlookup.hmm_ctx.hpacketcompr.hpkt.hrrset-wire.hwire.hprobedata.hprobe.hrdata.hrdataset.hrrset-dump.hrrset.hrrtypednskey.hds.hnaptr.hnsec.hnsec3.hnsec3param.hopt.hrdname.hrrsig.hsoa.hsvcb.htsig.hzonemd.htsig-op.htsig.hversion.hwire.hxdpxdp.htcp_iobuf.hyparseryparser.hypformat.hypschema.hyptrafo.hlibzscannererror.hscanner.hversion.hlibdnssec.solibknot.solibzscanner.soknotd.pclibdnssec.pclibknot.pclibzscanner.pc/usr/include//usr/include/knot//usr/include/libdnssec//usr/include/libknot//usr/include/libknot/control//usr/include/libknot/db//usr/include/libknot/packet//usr/include/libknot/probe//usr/include/libknot/rrtype//usr/include/libknot/xdp//usr/include/libknot/yparser//usr/include/libzscanner//usr/lib64//usr/lib64/pkgconfig/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=genericcpioxz2x86_64-redhat-linux-gnudirectoryC source, ASCII textASCII textpkgconfig file RRRPRPRRPRRPRhttps://bugz.fedoraproject.org/knot?`7zXZ !#,o¿] b2u jӫ`(y.ħ&xb vf ѻ٩J w>+H@Ϫa"bŊOqU[ܹ|:rκnoeWCRiQOػ3Lod!T.^1̕'mĚy,V#V5 h6t糵̈.OOTrCu!zsYKkOc >8!֒',F Ж*k}b&Zk4F+vuJpVV8ʆ4 A}+PvIGOX5TO1t|hGt_uڟ!'T*>EO{GBZ h 9tZ4%'@@j yƂ-R nPQS9Au-g E3mLVt3Cf_t~A#΄Xj$&P` M%I" 鎞I! y9O^2Ņr8(_3ɋ>NΠ"L<A%T[tRnjDy}[T~x-D"4!z@uyz/!e ^j%P_Qu cQD|C4ِsߌTaXb"ßX+ȜOlu2oIw27| l=GnEʛDhŶQү{ QupmM&Q X R-nF5r)6fFM.2چ_m{oT|ns+/ mW&#|ȚԞ@JUw2"Goﭯ8-dgĊi^0{f3 F$q^/8kQaV}t6๝%G9]k``EBŝAiA@;C׈^KKhߞ/781˝Ӽ?[dˠDBT̓m4;U1TM8DH[yVJPt^)t0& YB6L%CQHPV{$5 %VP|8ydN'k!Cs */<1I"γ` eS'F,SNQZQA=y32^$bkdec}OoݴrcЋ둲֬;.ʾJN^i:CUL&h/ c4C~|z-񋔎|Twi;;[`:_ E4g鏄=Ez#XpkP/ҙ[Y:W!"\!"#RD>Plh f$ gǢp$4'c6%Uz)z|AT73Ȉ e§q7i /Yap '(lPm ByRl 1F=twUiIEa`:됝9F ٴdk&RB0CtB;,([I脆'i[;xL#Y5)4Uпm$Pẩֵe1HA6l&`U-1&rCB Ě F9v§1 2bi^ذ͊()~n}w-(~8T+ww` %̆&%8Ч\ r~c<ӡ*Ӣ[Px -*̴|zEfB'=z#Qze' Q!ۤe- I0KG½p Mlg LCc.B 4`nl؍/Bp#3Ȋ=X5ܹmd@cJ`bp: ̉&h~{ kuy߸"ed?F`鏸L^ 1oCFm֯ N|Y<OG% BG"IjDL$B 0q@#F镭p UP~WaamԕSQ\Zz r|!#u3 ~gjAڨ5aL_\tgvo9V*Q/*+ˮ?ŠV ]qJK[y{Մ\xӑ=[K~IF#\05^ʟ3htoQ஼6RDk t3_+M#P>jo[=N^L{uX7k.8-eoI )x! Nlu/аލC'Wl]3iL!6=&7ﯠbt98\&79ΕR7"]O8ّ -F!KQ'=Gm1pBAy.z!~qJ3'HqJb@8Ccc6޹fK$Zu5ձ"z}<ױe}q>+;\쵡g:X"uB8Gf KK>"MHQJ;\q+59V|lҲj&lfU_ñC~RwHa%zY\#2 Ipӱ:>*)|CVxwD&^LI-m2< Cϛ;ןoI4 '\,/y&9 .pa_? rLYzeW|Y~TqW%Z,d웟+a/ SZN@TZrQ{So8DoVg,HC,]ih(RHn6rږ`} t׊osFe</iW9tj;ϯ)ÖAEz=̎^O*µEx+D6ѹҡ$ ZC~q~7#Gb*ʗۣ^ڟx1L%69)`HYNy>pV;' H \n_&pV wSCf ZMc"kAF͓B`Q ԭc*hY$TϰGQ#Ȟ*6EmXּRcȰC{qޕ,B?+Z%K;e{WV+^ΪzP?G `aOl/+fi &1|]B1$*Þ}ϫm vt jrA7L}y`ysR*ks(WPUye LX1"m}{aM| _O-%WH\;ت$[0?[[qvqZ8oK(Yq|ή'>"H;9.1(/u}0\(^+[)UN0@B }d!.雹}0uye?,DȬ!zD9T輻HLhڇk1Xe*U">5&=/][\ 8] PufErF9գoMaAN+Jéa$[IʶCAER5bx%pYW|~*)qmH4n3r!οYGע㺑ŰI?rf{N:U^6Lϼ{0/u|uml(05IqdD졀8OP^\t.v3#$ rt΄A#IE;}w%6!"Lo8w0yE㖠Y&xÔN, 4R'}J u0MRI 䪖O$+NQb݂F|CFّ$tfO|Z:zzKkSco|Yl b0=GPbM,)x49nUF]\M*8=?dR ݫQhŤX 0SFel{|Hᄚ]b3qu=[Ԝd܇')`=M?ց8OK͑_ƜN?3@HA?Dd/_ TT1Q˯5xy/\sȷMMavsnPêuÂB#Gbrs5o[۰]"nCʔ?ƿ.WO>:ӭm/I-E2U.?mn JC)RT~cՎueT7plUi_`I!ZoOR[fKl:Q~t$M>L tk5܊c!K{ go=d,6|bN-butTs#(DbPyuk+qn i,,`.a|['QE5˳b->D] VxքK z#$P_۠Hxby,{*?B QD.~-I\$o z蓺FdKL/tjPLu2B&B3p5 +[BZii)̪۬)Lz d ;({M乕\NWvlO CDz~gUao|cǨ12/βDce^nV,wPtq&]X\0viLѤў_['K92EV=Z. Gj;J8(nrXlߎԍ3,jM}^+2_ɰ}t&Cإqkps'`URvp3=C1e$(?CXQ{Jl.! ̐!:Xk8TNaw#(q8HG}y">dİF(l d52shs Q^PX0_?\ZxFJWS88s$ỶRQc3eϠ\M1e 6j.T;pKj hv!'D[ szA yj\|"t# `lM 0MݏZt릴/hlj#LGޙ-Rw )ytNPJ+;8w+9YEq1u %׫/Zy"̑\DE`^IP-8!WBXX7wQ7 ]YG1to&u׼#[9_ ׃f:Tˏ}c;}'-F*A}]dXZMXm ޾oY,0.zv < <N،NuOKov].AoU*2S⺃64Zv)SV ?_/0;N  `xs PpD|qb cI͈][,iMI:YA5}/?31*7ƥ~µ+N*7kmOhm=DMQ v5J7]馀 9(mNʪe,T҃ݻdy$$ dz ?3g Lȓ.ܾ|$v$>SS>407E@KWNqk95;N̈l--~ )BpC<%[P h z#|Dsj7ݶb Mt1I^ʼxL?('8f@H M|ِSnaX< p&Ft4!/MP=̯J*N1~=>fq&:eXS.ΠN/I<TKrlhlaaS`O zEl%‘w*z?tFC~}`Nwng6,-X7NB츻_.ٔtT&вB# #anNiTyгfK om#"+O@k݄F6~abȞKd\ 3F\#M*^YS~LxN+?W⼍D@7x}'Ok{(]T3*YgRmUG&Up 8j u6kfVs;-ޑ'''L%5XC4FJ܄o[1vO6dXB7;j&E-O'=f FHRުװ>^*dnx̤ AȪOg?KIfclFycBu]8ui0wݜGch%)Iv6}uU]< rK[!]垪X3 =h/ߕ Qa8H?S]4yF`zbʁ;~g~=;[ ,1*B]ޭ)Me`&"nt3lg`Lb.@uKn͞NuҧǯNwDM+x2%-N[2gMX(cwxP YXE78g)m^v;pq] =xq1+æ wH8,mE\kV>[1Nc/P.( JP3'7jׂ{7Jr7ZuZZ93o8X.!dhf;48$74Ibw?|ds4P':p_ S6ztPl]h= )kmm=([4 PӭP| 4_ =@ĕ] )%*l ߲*m={VԔ22MqEfYA۶f jc_p07#lX}EqxwK/GdQN@\! ?J ~_v2 Sb:`A.zU@R^ 0tHeb8۪/@%z^"K|%粯mR؉?48E\F8ZxD JQkT5,o6}{uqK<ư-`x]v#zu= 3}KE,c ױ%rlw&DfLӗ:oKЮ0GXg])ws&~zk).emӭ=\/uqMn¡ע#K{H +J`\H-oyys1q^dCE8oB0(o7ϳtXFOtt= <H1]w_Y>ڞLCX?țZTjt%JoW񪝦UGBҟqR?//Ի!J 3 zv(sSWԂVip)vrN=#l$LQ'9K:$B}vd1J=J /3^H\ü,1Ie&ԷzAf=nl~(b_[>~xi(&kBWPNډ%eE OQ#x8 ۬@Wpj 43ӜޒɖȞ{n^g*/T,,*- o!w@Kgg$FXK"+41ΠzQ^(MU!p JޓJ{7 !@݌j7 素YDzH+`,<ނ HMp$gZrr=6a; * \t* S>RM50"ivn] oWI6YyqP›Q[@ƾmTu^;@RJAfeWb$2=cX#@c4qW z*cPEK8=>@JZ.V4QM= 63+?\[l*HnZtG7S#S [.U^7Uio]Sؤ9Hc*?a)XP 4 q9wx@rvUKx?o&M&r ^ 1ӌ)DjZP uW9(|#-x%f j |09N )mXSr9G5p9w5\z%WnAY 3V&ͯl<n 8NmOr0~ԁBy&:< eFP.9IS<=a˟/ &~^y4b68!z+9VقDR;vDzorNfp2]2am +$EG@i3's]cxvn&6$|TY#GɭxqzqAq#iNH~2PGQE`$Gc/ Ht~j9wJQsgrN䢣i9^J(S›omu) b1 lobzb]WT7Oy\h>bS +0'$VBZi2_[@pKMQigoʲ¹wSbU5Ys7 4 GG[L'Qq'8p*- ѳP؁vb?3viFۅ&׼^5=&r+j V҇!nX#] M^^en 祓O;HXq=CoC MR aЉmйTٸqWḕ6{Yn"{\d1[3oO+ߊAprnz^O_-Bj<֬VhHG)ŐR2zRE[̵ۥ14ƶ7u=|9RiW@ K|h4O)aQ>O¾ȩQO|}ӳ /|0^5ɛbQu}dR +ͤE ٽDL@-EVz O+L&j[Rǝ%5ΌשdAUX( zJ^z$hOS֫ԓ1VEԠm)sl'L|Wt3 ~QB+뼅Skz2}#\f̌!|d+ @gAqH<Ey*{F՜{ hڿRuTpY0k@BNe. ^Aaܰ)Ky_2vHKjUS>{,q1 i`|d"L7g: RuiL4eh:Poּ`d0o.r!OX^ w+]E@}8LX1}vp̘9ԌBtLmA74ǥpB6M)1B!Tkÿ ͨIgB /eB_FXSbK@v˔\-{iJEaaM_.N"}1B)2^[hUz5#a6TE:N<~#E}Kttx)+Qɻ x`錩Y|m|w!NLKyyi{e'j~,2& 0+ :I鰰gk ")cW:Z0YȦKދ*"p:{5UWiټ;U1Mmy9 enF%µCLp~nǬ*moF(Q(@.?6@H]YXm{5-Փ5*S6ӛZ CWX]nGWIšz*Q QRkZ`P*wmSȝO#eQ\T)j6?ċ{i']f%I$\fLkQO(,Q:g1s`WWucAMX_CAFHjAl0ɘ2LU6;,b]K,!z&=t8O~\gEfΛaΠl 45m|s~=} L^l.\uGzT6d˯a:~M-zff5GK/#c?4p"Z6riΙGpꏆh4Lk(RK'HaλމxLw-k/#|1~  \qpEW_tlVg$E ""?"A[-=0tqyb3k5:{;;L9앁pAf!fr+! 8.j>wXP$a7< @1WG}X["E`=|&j#vo45/rZ:po'<rW# 25꾵Gj?S6 YwtXF_L4.یNlrE/܂~S'X K`Iy%Κp,BX]<nǦRG&qM`Xw|dn! Y =mUFO+ Ύ$'DL3jŪ49JCu<~YȸR+|`('{\Ɠe_b~vn \*j"\Y>;Z6Le)G`#َacs=ͽySa^{8ƣA]5'Įٸo+tp@? j 8}]ծHMɰ+AF!@2׶$42 ~` +豑Z,G|GfJj8u͚lF[P;ƈ[l3)7*jgG:E> :mT jc]IsդM s=2*f7>,ڏJ|H_j),ev+ [9(KGsg;3"-t٬+W캃bM`k8mbx '9vΞҀv8j#[:ch9#nIZRR0r3=9ۉ`;rL{ k@/p V!)}`A+zAʐ"90'ڒf?=cFӵD[@HMxLr(j;a8iY(J{.q efw`EQq׭Јb[c{W!a&-RyqGQ㰿2s 8~iXJלJwR#MHE4/JC dT/^ΗlkFsYMWnق XƩ1dZIG3%14tFjUePH5/q[&۲ː#bW/# us[~VLq=y$Eh@|jPfGHth KQ6W,ahqBX8}LӆwUP3!Δ:.eʀdYƧ'`첗rL%3:In37?& &_up>NҞ9!|g\o|kΥ? hO$| 4(IIS6zY+ߤ93zA#V0kv2#B*Cm+3P6zK%6T18> _Z5'n 9AltvU>vA6rZZҁb8_vEU' H0y;dk=PT7H-B/Ưe @N=?Zos e6K[48r%)L:8|MGwq_a}$ ReJugy A-Tu’iQr9i/8NkyO> 9cC6>5gNRe W"翃S~7Cc&. Pѵ%*6/XoTPt~ƴ$jɕ62 Ito yU🞲ʁ"TLFn;F5]y]t?}$AJ;mFluQ0%,pdɂ1q bHdI$Ɔ4gʒG@6rsaӯPUf]NdGo`1!E]tvƉd24ߓJ:gVmQ3xQ# 2giI=`nmҚdޤHcGYNy˲}AN S@~c5*jzvIi;OPLVmkfl?Rܮt~֥]7p ݲ%נm˖9|0LSuE8Q^MthS<딎$ 1[Ll!;.cj$rk9؆NXSa76JFSձ,p)1e6'$MSwRaAP:qQ=7 c+O`d/a:U%l t@: u+*pC̠-iۭ. Vzs/ooȞ P |^ r(ګ0{fǕ#[J S*i_nug%q|6Ț&b8vs ]..+#P{MkpMs뷁cS` VDk=F,s%Ch!{)Rִ Frf+}/(u)aVd+nc z^  Owu2WO {1M [;!'6yua鼷Nz8C0+_{L }$!,O=](afܖX>/6Wwۓ{Z :<6tm0]C$s#cO GÞ5EQ]9y3hokﻘ`(nոRɎs[9ցnethDmQ8!DYJHqv$IJ0r@ #׽&澤(74qÛt}5Hr{ ,n5n}c29e/YozL6(LU.b3*S\o7o%{Ks 3UpoC=l-?r~iuBohe@;`"mj-2OU[4gƲz ͎` LD8&942m7XC}sNDw~$?{Yï_ 簿Y=eH/ )mv*/v. <0u@Kvl䱅YvgQk5bGk> W$K#;ptakCy-gtE=O\ruV:X ~5M j{<VcKs fJep0ЖMP!K\Ԝi85121sRYu1p3T2KAƔl0Y μ0޼,. =:B[tqV#?h#:nNE,B2W€2Iy;J!k~8ߔØO%OR7io(De!"P3%yxu ekq0-2`#&')u=ýܚ*]b sahˮK:I+ë,0B ^٭yNNU7L Odl:>Q;UE0@`3Ul&0eQ,wtԮ.;X];Byح7@职{Bzˤ1 G 12HѓK4ԍX"CAs`Diqp5,u{EiLbiuAO`ٺǂy;%47XF\$qsxAib??g ?ioU{sdӼn8Ecٻv~HU j%88o3@0!.e/OGO3DYad@nt%vwdAljGjޝdwBٯl_4 ԓˆϗfqWI 8#pnl=/x* Go#@{)`UrYJ*C[(rp]aI9Dց*P^ֳ[=n H714V#q)ۀ`@< h&)RbD*-3Sa2_^|W׳!J_HwHm@m~a%W9Me 5 l{p7=u;+T tp W-LUEl1K'ISWeZ[lYмxSG\+jT[F{ S385:~ŝ`v`Bƍ-W,Q|AB9FЌQZD` ɻg1dya,09d`MYWg061f"q.;oT^0i9 "G5v~TFuk#wI{s@t9ۘ5U^ph@8LVA.v\SaR%J pn8]?uvN'tK'ij3^H~$Acmͯ>TMNq/nڸUWjp:OZr?O*Ϭ/K퐩w+`A}Z.OsޢF.*}eC&z4ɒfдxF7FW=5rl[$5DggCLnq# FbVE_:Id+@80[ci y!W A泑 ݣhEYPUq5T=b6}5Vl[Qy)d"KH)=BDM졝{{k%x.e t@BZeݣA :#iOzZdbPFL*s Qq߷3tj=ƟS7)9 8X{?TOˌ*4bi=RMI{.O^C)^ae&aOl1obqPg`IĀ m gǀQYW. YdBq5[̄nq]~O9)_Xgt.TȾ\ %ih!2kV5 >1g4uA+s:n|h7xV-+UÚh鿷%I&K e 0_fcUţPҍK+8־{g]|ߍo[ȟ"1|XE@"13z_X7I;YJ,'r`tq{ꗜHQp׹['fla\ Lnq'@^sކjľ!I}o)5z@DR? 5}XB@U(ϝlR{K׳ٔKNrg۩f'&_GL`cbRR#пJb `i,ϱr;4jozyo5F,F{9_wBD˦g%a3_"⧁M d, Vg07ȦWGAR1pKY}+o"Sդ+#[;.%3[]d.c'rq`~'KX7M*&QFT_牯*%ns/%wNj:.)4-j4VҤlM6$gAwɇ8Yw Y9G"/iԆjMb?{' CcVFvٟ"t.5_V(WF4Jmv=dk *T%ootٻ6=4l[h kߑ4v՗ 늶{72^8QS{'SVʄX@ "wn۱ujJeW%UNJK?ԻPI5PlH1*3}5` ܊DLfd9gVKf$jwFJdVۘSdĭ >M;ĤˤnC%TPdD%zQҏF0Ʈp:Q, 0qIĢu G"GijPmp4׎MsQjSR/@^25ybo@N\j\j>Dkk iᘿ4DA=BM4b%i)ƷVuhuO2_Me,MAXw(3kZFhM?cvlX?&*XKOZҭl6 ˃w'7:0B-fD ʗV3YM\jجJkJ| }j\v"hsxY3ţWضvp ۭ/d)] o'|/(ld i>y/&+.`쾋 L|/tzRD݋X [q\/:B{|'E]_OxIf. h|t w-[%&P|J!]]EWe\VTĒBQ/IYlܭxg{cL'j59A"}&VA3JĬ?E=vjM/0mMg{ؔ̉mOg Yaxyc FQ&%b9ixc2vS7Ofo~I S{q8ٌ0iyZ<֦ͱhTVSQ )b4\} MHi/Ҷ,Q64*Im$c0,(PޮG÷Ȫ %aX۟#I=?4ܦ<*󦭯UC=919@3dUo -=9 ώx^ Ʈ5X-w]ip:W CX.pFp}j!hoh;jr pIuRhτ+l,}Fv0!do.A.w%𓚂ifjfDg܆uʃ6ӡΪo'\p%MzwN6yܛKC(=#&B V9>.}MP%db](Ll;BObD:}%1R0g#jp4Ǟ+{X)OX߽]|֠E i܋gd{P|{θԡyJR88˲^mn f?B乇K>S_r #`.¾VH8/gH:_I xmO(etzL ݴY`@1~mOP"On䪆okOq䰩Evya93E{ JN_ӾA3m~SQ9 Z!ݸހќ+=*͙Ő(Q䎻0Ati hmrQ>=H>L/laoܧ v?TC(?PC-t䂁eK56ǟ@$cJ#M)ջM#GTW:#ܴ1G3>*_ J`ReJ*n1Q8xy^oM0M94̍'0" 1!JȮfݗԍ9O0?O#al[<)n@(>l8K3smcD.?}Joa47uVP788 oȷGp p*A \~ݶY21SݜY^BGVx$+ p~aL%b3l˟+UȜ$}_䇃#XF< 6TJ[>F8XF8_keAyx5@ˉ|jۨj^7:jJ !ψYg7ak5n2Q9L;;pGH)U_htkjw}" r\=*U+S]K70KDgE:ySyoF krPSajx ^\oɈA~GgNKsʚU T*;nX029/|n| R<`20|%cMy-l`K""AP5=Rq.s1XIJnV AqC&6/@];=RT:0ĈLѾw E̞lffGLTb3I{fC?EBK%JI}[^YKH0&0QD|4I@\} qo!IL\A>zM*]-J'󮞆V[*6M`]T=2u{ѝd+FG# )Ke?o[1PY8PD0ɞ[tw(sp1-}==袍/kNJvRIX|ϿeOE%߄&*-mN <BSmV,$tFF &Pn)}Ƙh`6K`[xEͻsaq#1ﶮ|*nhC?bUvHGOT ƆreQqC x!o4թfeN#- 6k?KgxF8j'JO;riC4۲vD{䦍AQD4R A2E~ MrVa b^#Xyo"JjgV#(>> 4to̳9K%%m)Iȷ'@ #8MO J>gd. ;Fa}[ڇoӷ@@E88_Fms/5*͞ ZaB 5ekh?3⾿tX/xM H1B.Lca[}oT2&B~ dH7ܔ.Etqg8t $8Rmx Ir9,4>_:z`o[[z?~o(&ƉйbG| CRgtzL|*86}lsajX悊1A_IوJ%7R  Y')m6Bܕ9s7U[eN lZw/YSZo6kiV0&M?$IK78Q΍($fR,3=,rdNHW݉qcZo7jtW,SCa(d6ïofjޒ[ 6RrhPGpܚ:]“ . ( ۰(i mMjknr {SkjGNY/6!`D "KOu(f :\h4qC嗖׹}W 8#*'!]#odA1 ՟]R5nDGR:ɦíN4GҢ/8(h*rG;<Q^3/A>,c`H8,ىӐSEUN+#fEUuNm!̷tE;J(k_Xi|b*Y (t3}.cـVJTawaq|).9`D)^Ҫ6gu)uԸ+OV0f_vK>'NWk!kzLzd*.n"7/KGXTiVF* F֜s2kSs%\JHyTa*UI\.+ڞːϭn.Cv°dxMi12F'$-@*  &VàK+CP7-|ꋉcowMAd%ȑ_@'1p=ܮ=Q+N}.vtf3JGzpCWtHgͳхx }!Q. CVkh +x"ocJ#D !2e V$*X 6iF"# K#EzF̆:RtǛOt< 5Í5Л4Ѓbh T/hQ 6yW33K$ʘX8= M,ZW]&V`zUEڛ1m<~i ݱ 3 DNnI=i`rj)Іp ?sd]ڽȢ|پ5a^#06s횘u}R9Q#Y?jvEםs\N j,>1^D8"#y6{6E{O#n~qy4t*1"+ A|~bxpSZJIE2gqer U#D+#JEV`}D Uv`B?Saʪ"r޳(/+^x[ښ+kK-gmSaZpʭS5kn%J+T('uQ<0OY!*5S,)w ֭b&U!5 ȇ׳eA}*VYG?LwM6 5NkaIuG2.*)$?y`:Gݬr4G-dQ_?V S*!iSJqց;"Єdj;fP* ~bDW!IYn?pi|TU/ﶟ ByuV"*"Iz5i=KJ7V{r/iVEZė({40Sf,ZD%<7w ~X}MnJ\6Z]{oR!,Ue*dP.u3J 7!٤rd|bgh{VM#<w~wuՋFaz" yDd5wQvEkO~MRga fUvx<SFmRDY=g.>Nt#eSvf V%=%YFa_4Il{)S'0Ljdx ٬"%Qj5룣AךqBzrIyN(+&xE^|c;GղNˊ3۝tr@.QW-bWp(;@vcPZ.:ot"AS6d_HDF$yl&c+ wsE?"N+agZ:'#3?3*&b6n(pr|^ ?L1/5ͺQ OW0mӫXMÌRl]7UH%S`j+ǎC;٘bss1߀M،(K~lfo3@O"ܭ- q>(hidH ) Ϛ$d ʃm{UKǑs<"*%]bի*Mمkyq=wW_)9:0VbSg#]RBZlߍЅ´=H`˷sS,{Nrɾoq`$-rEF^ه~XT3(]hGnwl~2<21tCm , g>n+PD2;:2(x#i+4|7*y'#dK^yR$3U&:GG?(\5hmX4H-g[.1 r:^ۺcvݒ^9SD&H`L Œ M.b)O.p0UfiQbe|b+(Da!@6Cӭԙ IcN$=7ol,1$ڭ=QoF<۱QH@ٳn|\x+k ΒWQOθ-MBv5a8t'X>vB.+`˜SppE{2kq稰AcFWV 9}^w8if޵W)o@[-Crlfkd,鑣u>>m}>tMq#OC'=#Ț@,D(RB.h~˟ Y$g N1aZ}k5 5 =_ZS3+v-.AEp$@M:_i m Y}k社*\i?NFr(a:g`Ճ=#e|Lr&Ӧz"} }ݴ2Gd2J-?g{?.jmCt#袽@C^vž9X#nj&!t̑l+x59//D_ AD\",ktlM~lVinBVx%D [.$'3j=B\A&xyۍC-|y鄍:iYPN!Xa nW-Gm?#Ex[p HYMwMv2l8Md\~? ,},lB#S5~&mnqK^ê ۡWYx+:[Xgt|4_'»APȟt:D+) Vjj-7*jUP/*ת&)NM _= g:M!T5QR UG.J՟_r>z`رfO52g? ŃCcҲFS8˾dVYxcY[]SmcA:j^(0̌3lw:\(ÊWB1X`=A.*ܽM33I|PQjݡSl|1mڮ<xPPג q GنT~8MULh;&rG3^y[ŅNǞ,6v9,wFAmF'sgd诎$:Vlf 9*\ɵ dr4%NUO+k!p.˖o[Rb2+l`xwL߇`$H ^QHkt S ށ91ͧxuLq+{n'__cX?1˯D 9j;+vX3>` ӵoۤ^JibɝDM*˜;*-$ֶS ͫ5ϣ2쪗#k<0YPm+:ơnPÞRh=:s7{jjlR/K}{C-Hmtߩ O^e ,~(_W7!Xl _D,!=~= V̟GXާwٸ>/#B,=gG4Odx?@/c!AGr6 ^w}B9*|(syk!sU}3勓N}gƩj#.@<~jd`'h'T)]XPKɳj}Fw)"7pY, ʆ"G.̗-;g͘5Vt&xx=+_]"=~CX)p6a .^ˊӶHqy5b޷;V3u9}ywvGSAyC^8T1)*ƪ Q<>;*$Pkj%udp0M)3pGfӪ fTDC/ҤZ"vC՛![O08Ы}&d(aH$图؇E3]6Q@+YQKՑ|>y|ِK0^B`#]ZyS3Z%M+]iF"H%猚j<M |%ykpe6+pyVFs=30KpU)3Dkd /N *-.mizV!C.{9X5!z0U !*iB.gi;[#k^'%Yf|K@aӷ\a(SՃhFu͒W^š xD`:窄=tTȾov!B!ŽG[A6Y&;P)rd1H2o|(q V3;_y;Ej8w$C.eXh#RDГl"7>衻м/.AȜkДkMØ{n)JYN`n0 ⎟D -_gº}?ٲD/2HVeE%l 9>H?I>Ot`0';" kT[l@J*?cb^Qr+IMlνj]ֈ$ e]t% nWKL0gԲ|hcho:]= 3}[G/ 6@ &Odw98xN;yi |H撚0Xb5 @\}c)AQ\ob h|/BO+Xz xX Y GijvW KH }?ujS`LԧU}k))#C"ev,:PVD D@3UlW3kFTjώﰛ'.U{O-U\ 햼'"i8mكj9*UR]yc1lyka$Q K=UDNA鐭teQR7bH;Ȣߟ)p;BctTOrv}ĦDUf׏ȃMG55AIN;]g杻:B2.[Lo;BG⽲M 9Sb QfT+hk²Co'Bt}ofˁa@a)vM4"ۭPUO_U> @/n_rꨅ{ֆյ pd uے3%VP&wOQ¢f8U<{E h;@p6ҸOSK85 (hH "5BhL1Iqƶiԍq3,N ({a"+KF6Um!Q@5ؔلat[VUL&etp~BWh3P AJF1JϿjrGFrX+t Q!80blGyQ 9Z)qۿ(=A\=*WCT9=TQ߳>>zX Vc2D^ɇ-D Ig"tVMo{c Zi %$LzF'iB(|6 OxdJӧ(8k6ȰN-¯O&/CrΣ@`f喹@acߴa]7 u)* .Xv'<"XbL lv=L'P *Zħp߼>MZ;(4i%i(,rb.x؃XKa)?F@IQ\sLLq'5(fIGg+Y\+$4U2!g#nFlDdBZ(SSg *4}wJ^" l߄eXN&#U weJ*3JI"7C$;0$ a*Tτ_5N.yW?|ꙻ>T:}EV-ŚErF3C̐0cXv|]̗IDbڔd7iit $]ԎyxΛb&DcgLoumZ1l9jflH?:ԑ[_4Oζp։TTW*z4@Ѣ82}1,$Q/l&J4iWP2KE;N yw(!goviWj12]r?3,s]s 7s@$ xӰ\X gz (n]1wnN?VI2/I$:̀i+ݨdEj=+v.DU>2=fp&2}/- 瞃j-&7H'tZ%lA#3nqX[HuJ0j## Cvjv}[C)mJ.s鬝ZJ;Sq*{϶XŷSNVhmMN2sfI WY/ >><=V[6_R(L-."-JbNP>Qym{ Y}UTFfx 4'(բFHAdl O@1]Fvvy菒- Wb#s 6doC8G{߄<@՘ o"ELf-_aI<9EXfݑ *j6iD3}k D-Na(cW37-uWn%}s;bZ80FP0_6͓D橓 T T*8.(`|{;欌?U6 7Kmp7Rܰt#,!"i9?Q sO0̈́j+}n=x1Orm3WJ0`ivuçPgc2t֞:@B?ԧyH5 U9_YEŒwi]) ($SR|o6 7~է-!{ -5 k2*=M ".AJlK ϕQDѝN=Fqo <}so*8FSJ\M^jo}vaG9 v'O } 8mR׿)E~4:LnP9=i d7QU"0CJaG(4Mi: F1{DJ+?M~{ٮ·ڛ59b$6\C+q| }AUՂs>s `|ieeX eIЂ~,Uצ:? ;ٮ] g%U('6\#@/ ߰" v[;]$P`+u:U= Vέ{N4r35c w'\DŰG>oY[!MIH2>7Qo4 @Eh(^{2S!"vfaۥ6f;aФO[gr@]m m]GzgFݞ1%gyr$ 50ÐMUjxkߌq,L& &I6 sL5u,cėrmQڭSO -wr%S_YBFΑYBWx8!Kw$r@rIY%-oƸŞ/7Ql$ 66 hQ$1uiͳ;Mh}9_鑈tyk=.I\J'$Tn\b;xEcyMye\|7cR;c"cE$oPAۢme93^z0T}bSRbB2"zaUԦB.Ʉ͔B. '8/'4Y+kt/qP_J YN(sVrfL:V7؊]TƉB@2ҞH6B@Fס,$ӡm5 H3? xe>X:H-҉pֵ"6jiR~{ /|7x!J !P"#C2ЭRטgw%5l 3k -r9!_ VGǤ>( j6N 9h7̗0)|s]r5QEOU9`.#Ft8{/fgxm͉|K0 ԅ|~jޞc?j G"*?b6:!()e5Ƭ'{CUDeB.5e[ʧ؄I?AC$^]0D̗wIY_<؂ 2g.̃DzvIM!_ HnT6o"I@UYfanC{ *Iq\iL4ܩ \_R )rpb(eY%d؏пj ]= ͦLn_622 eo֟A jF{f;ޣ<@/L'ߵK[hwXl0ڈrdk'iB5K&\{1i+8<в6Qzu{A]ƄS,V?72q髞i WзyA"&iΝPv󿳂r7͌99.{e1!;((|ȝpbpVhVf6Kbf;S$OcellђSKw̛NuW9i졛F\H`5Ӡ}]@:;~!̲ۙ)iI~e x_^*!gxb>|r)UGQNu sz ]@aWmoDi1ve&y,@kcV z$vJPUuՎ̍V7Rހ؂/ kU3,(^7:aImlk䌌~ 3^ m)kC}}Z}lͺ. P_YZq@dD +`nEU5 S\L_xՊJz5BEqvfM8F>Icmw~IThvzplb!ӂĔu48 JY2E :$ 2րչϋd*)*M3$]j8r?IS7٠"[6}g5Q4$BJ+r,7==wXIje#4u,$.%R쓯 Sh k1?t&M/3rGCGgKۅ'&77pwkRcx3о b S Cn]B!u J%&*c֡I $riD@_A/Ps4Cld6e; T#"Y渷+c,3)oA3VsX7{w10cdfZu m)$Ծ3!h0吗9lvw@;KX\ jzx %(QK U[/a (8L z*}~ؕlr gԾE'J[㷏&Ha,k^U6(qP9>5X!Nv#AWf9%אr LCR9u@K \uH\wIHB&5]i0D&DrpU AcD,ٸ iyxl Jaxl""O# א,51=I2kȑN_ ߁*6گpDd}xO.Z 58, wK@]A SΊVA6-) l#?N.:yv(OU{kO2\%?n ($_uA4۹ hM,e4ԨFb@KdB-O{Ӹ >&,acˀ[vEšI`=RͨM寲mhmVC6 ` J7r+aeDRbnl x#C•GU yni\Y9H%IgBd-tz4g(Ik&NMT.wDMr[M})b*66s;yQNPu`68[ qR+ SH+|9:sg| ATmc;W:e&q|,QjTsnKuL|N CIe.D#TAFowZkR?Ѱђ3*I*pHlۛ_:4#*KRWtǫ`E#冽Dji>@wdGѯ=^F ?ֿ?G m 3+iP9јB7Viܻ( slId<6) AguU,dL1ݑl3x}DktK |O5ϸߧP8u+[5Hk+2@lHl@.$ZmWRE0&?כSn2BvKJ+d9nhed2JR,P"s!&o?`e,<W3Kji8{5Hr>BeRu[a]MѺ—V+fekÿ#)%kWYH貥'C"rϬXN1^A <<` 5~;qᬢ@莢~5pՂ4_#E*[b2X]e%R.EC!mu{Am߰J|Cv:g}#Vӽ o360URcG($%QQAC/KH.jcz="ZUZ`zW1hK hF8C|+׷cJ-M5oR{W/*>%[$vqh+0(~{;C)>m8īg|EPHvZmp}acJťd#Ͼ(V7|^l):~釹<0 T 4Nc]tHV0OTXU`>"~7yT|%Œ#9ke\ׂ/oSb-w6XlaIŕMfvYD9l<+WޠNomtFcbk}*{~eD3G5dTݓa (=)X] Gr KDsz5!\}7tAnU߽__mH4Ua:Qke j2V#T}#9tY'agJUŹK.\HѤav }&{+6ʐP.ɱSȘq EX"_4 `bykIrϳ,oq$eqJ$LLnu4S65^]lv_qxw%Bknu.1j/tg2=:L{e2 LB ܄]Uygx&FU0rK&" 3H?q:Yh?`LoPP$F0~>ݫ$sAS<ס7=v+ ;!A@H 8B ̑h6iqΣi~O&M~WLz1Rcm+טt1`-=w~ߖDUA& uJkWcs34侊 N*>S)pxZ @Y>T|+K| յ,胻5dKuf%\ƜodX\N@k3^3/He+& p5kST堅k<,!6qlI[ N!F*rĝ1p6sд 1A/@q-5g2(S/ܤD.gJ mm2 L}bNF'O{_-9$:+$ C-4E2Ad`t5{v;rbAǘNcKᗒm zUîώ+ V)|kn&ىu%BJ'w@ݚEs]9(=,q ro::xt|RD/DaNר+ =vZfn -#q7Qvٰd*lF-!>-4w=@{.)RmSSw>U* >=f9ؐ7?}f Ւy$cQ$u:7㩢,DC?`N 1gbUa` &"Qv*hx9gJG1hg:?|pƓdWJusAf=`/߲BQ4p8KX[9CWHI=` I9CTU8Kɔd=܀UU8r`5בrΞx%כ YXD&\2φ Y&z* g-hͧe|4b/?%9+]e\#x_Ӄ+)BM*ifִē)#V{yUMI32D_wa$@oj.#&΍KDi4< N4M*]Kɸ!E': Tr!=Lw"H1d墜I=|^rŀ4Wl a9cH? A; iA,v )BL19dwkʽe-};8Ƥ3tgۗƑYT=L(wLnd4qQ+ BEDi䬰7fsTw '$M 2-CM7y֮ ZDgXoVYԶ}س'{*?WځA'utژ GWYv#psQ `.sD&;E[YG&g^5 .Ka|7[Gtq0 TZ.4awOk#;rtP.O4lL.OTձt <ޙ1Ĉ1 d ZˎVNޠˮk~1q@7&Nh\ؐ{3~&Ҳze߃'$hE x11=xS`u0;X6MJ>,N>Jzy!y-D5Q"f߁Oلb鬷5L>ɸٌi1Ÿ{uM,ՄL1j4t_0,$oy sWPz&`p{ lm[ckz}9. {J@EjItSw[}Jgרl|ǘnP|󀂦Zo` ˴# 8lc'Ӕ eeXB4/!:+/f[*_{OԻٸ)M-D`'"LXNA\L.$㊵K lxw ׯHG >KT5N2Q YZ