knot-devel-3.2.4-1.el7> 6 6`d63!}|J^>j/5,dc6 j/5,d2ކѷJZ5[ /PB"^KRu9HeA~QT*b厺+VkOW^0V;h 5 .e;"WAS}QGfC s7"wx8:dFAh %-Ǎ|>Ƌ2ǼCps w*&A]h\ln6} @ۿ{g$že_#kAmTcq L}eXkYj6JqRnqAJӀ7֘7('tŚ|޻5#&1*{׾Bhl&25J0Y򍵩Ez ^!d$Ґ9xloY"y\bA !_U/%a_:ztmD1,rxvo\eP/{V|HlD!n0DpŕAdZۈpm8j/H{M_&ΊjCod801b31fbf34e28687f318fb8fc5bed62f5c6cf9^h3!}|J^>j/5,dc6 j/5,d#C{D) IΨj)dqTј޳QRP XdNx˶p}?X/ 1DY2vhy;hɔl6Ztc>bqD*2Ѿ8SX!O ) _W1Bxᑢ1:kRJY6t8!ГŊҬq\V R`4 |.;vBYIJƶӋ-,4 fr\H̑1YnHb!~RfO#8d }jLn~04p>:?d   M &2JPXWW bW W lW W WWWVpW< h  a ( 8 B9!B:.#BGWH WIhWXY\W]dW^hbd}efltWuWvXwWxWyL Cknot-devel3.2.41.el7Development header files for the Knot DNS librariesThe package contains development header files for the Knot DNS libraries included in knot-libs package.c4Ybuildvm-x86-11.iad2.fedoraproject.orgoIFedora ProjectFedora ProjectGPL-3.0-or-laterFedora ProjectUnspecifiedhttps://www.knot-dns.czlinuxx86_64I %~ B#R . ^, J 0'(9K< - tgj U }FX kr  L >#"2 9,%A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c42e4254af54c053f35290cb46ed8acd81e9057446b2d71ef8b911103c6999cd42b4fbe48c632018c0e15b531c25797c3b380cb0ec35f0a597a1f1c94008220b58f676aed7ec38307f1d7282f86ec4f894dd4875c2429109cab92b9621525966da759f07a1c22a4825047d93059c1b52328484334b7f8594b3511234325224fbd8bc13139bb264cedbb87f2c05521f7485d1933527c92e8a7a212c6f8ef2464203dbf9aaff8cea91313f84aa0debeb5dec8320826f796327da580a004cc05b2a3bfc9daa3a1ec734614ff5b96508ce9194e3138c6cf36df83f5a44a57504ee0e498e9c208cedc89ed277c48b97086e1455d2534705619218a1229e97234bfb0b9ec9669c39509cf8f5605eed37c08124192b60ed878e4f8707fb7689e1c1c1eba292ea22cde12acc55b67f797071c03119cac1d0ecacb187646052b5ec9bf692e8f6cdd36b572a22aea68204f86f208c5f2a052cccfe73a5430b0dc4dbe6a9db0bb9fa74795774ffc71a964f8b7132997957fc0ff8ea37b1f21d1f49c112b28d74dbc4c85e9a17c5712cfb676499f0ce467e72b96b61e969048ec42cd43bca7e79919f3837757036c1766ffddfe13b4756a180dd56c94acd798fed6d1d35454f28c3e7b2c6cc75abeb22f94d2eb7162ccfaefa2a224dfd135c8186472796d057e9f36a6ff3574329624bd8101860f5c8aab9120e213e310827bebe0c5404f185087d3c4103bfb975bb72df32b83b0f1454b68af76d0a322e6012bdfe33e314ea56ff55880afcd6f267f2ac36d63e7d21c4c05a94671242c2b98265dc033f97ea792fdcb60c04de1480f588d132d0bcc6571978b64f74ee1e0b05b68472b088f1eab3895ae700bc36c8bf8e84cc135c7e61013c262a8588c495818ff6beb95cedd867af608031639b271fecd0b35ab0054e67bace684a983d9c96599ea7ac28049709e7cc98c3de9f322e232b419b010057a85ae809040bfd1d4f7980d352ae3a6573aeabfe39a9aab4f6bcdbf0693805d8fbdd906c78ab0e955f39e7eea5977a041757fd765e25974c4b01ba40214d4cab0626fc506a1ad7a0e8577b3aef19a92568794f2687228985fef92941424d5d68998b941d1cc640079e10ddf99a12bfc29094502ae508d76d35c66c49a3bbbfab63062a405223724bc545d67b41de48e28debc18f8ece4ba5df6c8fb7ba9c9a01c6388227a98d272a9ff77ed4ecb84c0b45c1a06bae79ef63c42672bc930378393ca1581c00d473c52452f2175a51ec44ea1ee38730477013bbf9c8983c5985e5e14aed6b22854ec16f781184aa6b3d097191d36950be3a402aac76dcf9f532c6dfbb60228158cd280701096ce5420acbbf966173cb85aa9ea97c10e7674a09c0c7ee88988c66f4f9b30c01100333d484a554f47b5e1b3c0d5a226d9720bb3cbf391fee27b1a70850972b4469ce0948db81b62373ec7b7f48dc28d3b26cacca029b46cfe7d4815c72d5253618e526d5f9a68f1993f6d90e0428b4585ca5be835eeceab21017198d81b3819c40046ea8ea5eb2ac45cb096b58ff9108a2fe6a99fe698f42c2a22c0b896a9cbb9cdf4b70b434245ed008a00c55b022308f1e325cdd2ccd6476828068ee18c484d9aa5d85a9d55ee1bcd8a6c512fbaab8e00b5a31d025c978aecbda25a32caccf45d637996c0f486d76c5da8c5c6407e14415a2cf13573fa7c7b42f7249d1ac676295832fa4819eaf771ec0e6d899266644885dd3b825b7137307935b3ba7f3af24b8b3536fff1cded7df7fe32ed047aabdbfbc878e4a090daddf8cbcf961b104eef29eee38fe1e919f28aaf436f2016c2dde4533a78e136e9ea526fb1e246c51feb8cc8cf570e77e888ab0bc525b95a0e058411ab8f82c16ed18021427d2107c4a2a3b1e82423284635714ee1a820a82bc17197d1334667b6b06ef1258a93c21649c8a8b4b91b4063489f544e810bc10ffcf7834cef2549c53a9b6b81cdb937c0bd08f121aba302841a71120e7dd3194c3f3e51dd2b2db50acaa6e0adf5a10b15d83dfcc30161dcdbfe3e0ec3bcd4ecd1b35415214c84ec3728b93cde1d58ef253337548c27d48246cdfa95df787ca6e01968b1165e23e9f213a3e8092e3d55141db8a229a257e33b5b78d6e416ca902cf8a68b2a28e1e3e89a775b91a6df6110fd6a82ec30fecd5f27716fb25bd2f32491a381a61b4864685d60c8d14c3ee0e1e6b27e0aa14448e342f11453b42f4e81202318e81f820e8fce142fff6b646119148bf78d1f8f228c157bc2fb5908df7065f9a59f5618906612165603a3e48f02b05fbcd16d484dc095525cf47421ac58917ea5c09e68bacb516577967c3a2ffd12022371430ab2a2e74d275401c78b36c467a06a1e2ced136266ed33508ea1410b305442980bd50a6e6bfd1a35417aa5c74316e52f1ba5304d8a799a054e935110765fc0e926c5496ab912b4c7e7406a3aef76fd0faa559bfe6f95482d423e0777793c329621af1ff50cf8ab6545706c7d872a2f5dec3ec487482c97d53ef647c45ac407c04b6fafbaf42aafeda061486f3a0cd57ee6661cbb3472354758d8f194182e0e372d1c5b0c964f5b0e272006722d7b9cea85bc01a4a7b2691463264f07587df6456f71cc9f352d6c8f5cfd5f0ae2d7468b0d0c14382ab9457d6059bbec986a8c42631003298e74a56c98121799d00246d344841cb4a4e1cb60499185a8bf7068c0421e33dab3a30ae46a8ccd14e3e4e3438f3167de92fb6d2f04ee6418c41366edbec6cb1a64da831dd7dcf418ec4a546820b816a6dd26d37658b52c1c856604b27f9bcc05a01059d5fda2147bdaf3264bc8355a3e6b0490b7070a727c033d439d537ac1bc5636d5fdb8a6cc17007197f83ca431b327084bca54022011cb92d30053268cbe50c1a671b6dbcaa63b0b4fddb4ddd9c9d0e25a25bd07a36147c4055d7495e9907dc46930b276cf7b2ec1c5c2b3032312fc404f217416a54005443f8b198f4650054f59842a247de965fd8883792388e3a6cc74c05dcdda579d46b8dcbf76c7f5cb1ac8982be3a2d0c294d411b0f13f4fda39ec1c710b1f62c1554b1204f981bdad8ca615f9953081368ab9a9bfdbfa2b754588e0651a5438bb96dd6be5b6b27c8e6c17c09588fb734f1ea445fcaedf5f73b63837b6312592dffea3be366eac7eeaf6570d01e3813fb88e55b40df8613227c7b4b3b2be15c148bfd834cb91e8d23075ec6700225e33662340bf1b8a923c08448fb254f7dcdd64f818aeaa61566dc59db1d5a33f3ce250deded35999608ae24c77b06293c55a6f844dclibdnssec.so.9.0.0libknot.so.13.0.0libzscanner.so.4.0.0rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootknot-3.2.4-1.el7.src.rpmknot-develknot-devel(x86-64)pkgconfig(knotd)pkgconfig(libdnssec)pkgconfig(libknot)pkgconfig(libzscanner)@@@@@ @    /usr/bin/pkg-configknot-libs(x86-64)libdnssec.so.9()(64bit)libknot.so.13()(64bit)libzscanner.so.4()(64bit)pkgconfig(gnutls)pkgconfig(libdnssec)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.2.4-1.el73.33.2.43.0.4-14.6.0-14.0-15.2-14.11.3cc{h@ca @c*cobjbDF@b@aՈ@a@an@a9@aj@a @a@`t`9@`f@`c`@_H@_@_E@_m_Z@_O@^˳@^U@^^F]}@]ʞ]@]]2@]'$[ @[H@[E@ZnZZZZ}@Zz@Ze@ZNYYYXƉXX@XAXJX-W#WhWWV&@VUUUUa@UG_@T@T@Jakub Ružička - 3.2.4-1Jakub Ružička - 3.2.3-1Jakub Ružička - 3.2.2-1Jakub Ružička - 3.2.1-1Jakub Ružička - 3.2.0-1Jakub Ružička - 3.1.8-1Jakub Ružička - 3.1.7-1Jakub Ružička - 3.1.6-1Jakub Ružička - 3.1.5-1Jakub Ružička - 3.1.4-1Jakub Ružička - 3.1.3-1Jakub Ružička - 3.1.2-1Jakub Ružička - 3.1.1-1Jakub Ružička 3.1.0-2Jakub Ružička - 3.1.0-1Jakub Ružička - 3.0.8-1Jakub Ružička - 3.0.7-1Jakub Ružička - 3.0.6-1Jakub Ružička 3.0.5-1Jakub Ružička - 3.0.4-1Jakub Ružička - 3.0.3-1Jakub Ružička - 3.0.2-1Jakub Ružička - 3.0.1-1Jakub Ružička 3.0.0-2Jakub Ružička 3.0.0-1Jakub Ružička 2.9.6-1Tomas Krizek - 2.9.5-1Tomas Krizek - 2.9.4-1Tomas Krizek - 2.9.3-1Tomas Krizek - 2.9.2-1Tomas Krizek - 2.9.1-1Tomas Krizek - 2.8.4-1Tomas Krizek - 2.8.3-1Tomas Krizek - 2.8.2-1Tomas Krizek - 2.6.9-1Fedora Release Engineering - 2.6.8-2Tomas Krizek - 2.6.8-1Tomas Krizek - 2.6.7-1Tomas Krizek - 2.6.6-1Iryna Shcherbina - 2.6.5-2Tomas Krizek - 2.6.5-1Igor Gnatenko - 2.6.4-3Fedora Release Engineering - 2.6.4-2Tomas Krizek - 2.6.4-1Petr Špaček - 2.6.1-1Petr Spacek - 2.5.3-1Petr Spacek - 2.5.3-2Petr Spacek - 2.5.3-1Petr Spacek - 2.4.1-2Petr Spacek - 2.4.1-1Fedora Release Engineering - 2.4.0-2Petr Spacek - 2.4.0-1Jan Vcelak - 2.3.3-1Jan Vcelak - 2.3.2-1Jan Vcelak - 2.3.0-3Jan Vcelak - 2.3.0-2Jan Vcelak - 2.3.0-1Jan Vcelak - 1.6.8-1Jan Vcelak 1.6.7-1Jan Vcelak 1.6.6-1Jan Vcelak 1.6.5-1Jan Vcelak 1.6.4-1Fedora Release Engineering - 1.99.1-4Kalev Lember - 1.99.1-3Jan Vcelak 1.99.1-2Jan Vcelak 1.99.1-1- Update to 3.2.4 - Use devtoolset-12-gcc on EPEL 7- Update to 3.2.3- Update to 3.2.2- Update to 3.2.1 - Remove patches included upstream - Update Conflicts and move to knot-libs- Update to 3.2.0 - Patch: fix tests on 32-bit platforms - Patch: revert problematic hardening of service file - Patch: revert config improvement to support EL 7 - New knot-dnssecutils subpackage - Debian compat (knot-utils vs knot-dnsutils) - Remove bundled(jquery) version as it differes between distros- Update to 3.1.8- Update to 3.1.7- Update to 3.1.6 - Use _sharedstatedir for home- Update to 3.1.5- Update to 3.1.4- Update to 3.1.3- Update to 3.1.2- Update to 3.1.1 - Enable XDP on ARM and improve XDP config macros - Remove patch included upstream- Introduce a patch to fix tests on ppc64le - Use autosetup macro to apply patches- Update to 3.1.0 - Add missing BuildRequires including new libmnl for kxdpgun - Temporarily disable XDP on ARM until issues are resolved- Update to 3.0.8 - Print failed tests during check- Update to 3.0.7- Update to 3.0.6- Update to 3.0.5 - Properly escape BASE_VERSION macro - Include module dirs in main package- Update to 3.0.4 - Move dnstap module to subpackage - Move geoip module to subpackage - Remove redundant VERSION macro- Update to 3.0.3- Update to 3.0.2- Update to 3.0.1 - Sync packaging from upstream- Rebuild- New major upstream release 3.0.0 - Sync packaging from upstream- Update to 2.9.6- new upstream release 2.9.5- new upstream release 2.9.4- new upstream release 2.9.3- new upstream release 2.9.2- New upstream release 2.9.1 - add EPEL8 compatibility - fix unsafe PGP keyring permissions- new upstream release 2.8.4- new upstream release 2.8.3- rebase to latest upstream version 2.8.2Knot DNS 2.6.9 (2018-08-14) =========================== Improvements: ------------- - Added zone wire size to zone loading log message - Added debug log message for each unsuccessful remote address operation Bugfixes: --------- - Zone not flushed after re-signing during zone load #594 - Server crashes when committing empty zone transaction - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_RebuildKnot DNS 2.6.8 (2018-07-10) =========================== Features: --------- - New 'import-pkcs11' command in keymgr Improvements: ------------- - Unixtime serial policy mimics Bind – increment if lower #593 Bugfixes: --------- - Creeping memory consuption upon server reload #584 - Kdig incorrectly detects QNAME if 'notify' is a prefix - Server crashes when zone sign fails #587 - CSK->KZSK rollover retires CSK early #588 - Server crashes when zone expires during outgoing multi-message transfer - Kjournalprint doesn't convert zone name argument to lower-case - Cannot switch to a previously used ksk-shared dnssec policy #589Knot DNS 2.6.7 (2018-05-17) =========================== Features: --------- - Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung) Improvements: ------------- - Trailing data indication from the packet parser (libknot) - Better configuration check for a problematical option combination Bugfixes: --------- - Incomplete configuration option item name check - Possible buffer overflow in 'knot_dname_to_str' (libknot) - Module dnsproxy doesn't preserve letter case of QNAME - Module dnsproxy duplicates OPT and TSIG in the non-fallback modeKnot DNS 2.6.6 (2018-04-11) =========================== Features: --------- - New EDNS option counters in the statistics module - New '+orphan' filter for the 'zone-purge' operation Improvements: ------------- - Reduced memory consuption of disabled statistics metrics - Some spelling fixes (Thanks to Daniel Kahn Gillmor) - Server no longer fails to start if MODULE_DIR doesn't exist - Configuration include doesn't fail if empty wildcard match - Added a configuration check for a problematical option combination Bugfixes: --------- - NSEC3 chain not re-created when SOA minimum TTL changed - Failed to start server if no template is configured - Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing - Inaccurate outgoing zone transfer size in the log message - Invalid dname compression if empty question section - Missing EDNS in EMALF responses- Update Python 2 dependency declarations to new packaging standards (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)- New upstream release 2.6.5 Knot DNS 2.6.5 (2018-02-12) =========================== Features: --------- - New 'zone-notify' command in knotc - Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set Improvements: ------------- - Better heap memory trimming for zone operations - Added proper polling for TLS operations in kdig - Configuration export uses stdout as a default output - Simplified detection of atomic operations - Added '--disable-modules' configure option - Small documentation updates Bugfixes: --------- - Zone retransfer doesn't work well if more masters configured - Kdig can leak or double free memory in corner cases - Inconsistent error outputs from dynamic configuration operations - Failed to generate documentation on OpenBSD- Escape macros in %changelog- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild- Added PGP signature verification - Added integration test - New upstream release 2.6.4 Knot DNS 2.6.4 (2018-01-02) =========================== Features: --------- - Module synthrecord allows multiple 'network' specification - New CSK handling support in keymgr Improvements: ------------- - Allowed configuration for infinite zsk lifetime - Increased performance and security of the module synthrecord - Signing changeset is stored into journal even if 'zonefile-load' is whole Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Some minor DNSSEC-related issues Knot DNS 2.6.3 (2017-11-24) =========================== Bugfixes: --------- - Wrong detection of signing scheme rollover Knot DNS 2.6.2 (2017-11-23) =========================== Features: --------- - CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support Improvements: ------------- - Allowed explicit configuration for infinite ksk lifetime - Proper error messages instead of unclear error codes in server log - Better support for old compilers Bugfixes: --------- - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file- New upstream release 2.6.1 Knot DNS 2.6.1 (2017-11-02) =========================== Features: --------- - NSEC3 Opt-Out support in the DNSSEC signing - New CDS/CDNSKEY publish configuration option Improvements: ------------- - Simplified DNSSEC log message with DNSKEY details - +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given - New documentation sections for DNSSEC key rollovers and shared keys - Keymgr no longer prints useless algorithm number for generated key - Kdig prints unknown RCODE in a numeric format - Better support for LLVM libFuzzer Bugfixes: --------- - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used - Immediate zone flush not scheduled during the zone load event - Server crashes upon dynamic zone addition if a query module is loaded - Kdig fails to connect over TLS due to SNI is set to server IP address - Possible out-of-bounds memory access at the end of the input - TCP Fast Open enabled by default in kdig breaks TLS connection Knot DNS 2.6.0 (2017-09-29) =========================== Features: --------- - On-slave (inline) signing support - Automatic DNSSEC key algorithm rollover - Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0) - New 'journal-content' and 'zonefile-load' configuration options - keymgr tries to run as user/group set in the configuration - Public-only DNSSEC key import into KASP DB via keymgr - NSEC3 resalt and parent DS query events are persistent in timer DB - New processing state for a response suppression within a query module - Enabled server side TCP Fast Open if supported - TCP Fast Open support in kdig Improvements: ------------- - Better record owner compression if related to the previous rdata dname - NSEC(3) chain is no longer recomputed whole on every update - Remove inconsistent and unnecessary quoting in log files - Avoiding of overlapping key rollovers at a time - More DNSSSEC-related semantic checks - Extended timestamp format in keymgr Bugfixes: --------- - Incorrect journal free space computation causing inefficient space handling - Interface-automatic broken on Linux in the presence of asymmetric routing Knot DNS 2.5.5 (2017-09-29) =========================== Improvements: ------------- - Constant time memory comparison in the TSIG processing - Proper use of the ctype functions - Generated RRSIG records have inception time 90 minutes in the past Bugfixes: --------- - Incorrect online signature for NSEC in the case of a CNAME record - Incorrect timestamps in dnstap records - EDNS Subnet Client validation rejects valid payloads - Module configuration semantic checks are not executed - Kzonecheck segfaults with unusual inputs Knot DNS 2.5.4 (2017-08-31) =========================== Improvements: ------------- - New minimum and maximum refresh interval config options (Thanks to Manabu Sonoda) - New warning when unforced flush with disabled zone file synchronization - New 'dnskey' keymgr command - Linking with libatomic on architectures that require it (Thanks to Pierre-Olivier Mercier) - Removed 'OK' from listing keymgr command outputs - Extended journal and keymgr documentation and logging Bugfixes: --------- - Incorrect handling of specific corner-cases with zone-in-journal - The 'share' keymgr command doesn't work - Server crashes if configured with query-size and reply-size statistics options - Malformed big integer configuration values on some 32-bit platforms - Keymgr uses local time when parsing date inputs - Memory leak in kdig upon IXFR query- new upstream release WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble).- disable dnstap on RHEL (depedencies are missing)- new upstream release WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble). Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme Improvements: ------------- - Allowed binding to non-local adresses for TCP (Thanks to Julian Brost!) - New documentation section for manual DNSSEC key algorithm rollover - Initial KSK also generated in the submission state - The 'ds' keymgr command with no parameter uses all KSK keys - New debug mode in kjournalprint - Updated keymgr documentation Bugfixes: --------- - Sometimes missing RRSIG by KSK in submission state. - Minor DNSSEC-related issues Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Improvements: ------------- - Extended debug logging for TSIG errors - Better error message for unknown module section in the configuration - Module documentation compilation no longer depends on module configuration - Extended policy section configuration semantic checks - Improved python version compatibility in pykeymgr - Extended migration section in the documentation - Improved DNSSEC event timing on 32-bit systems - New KSK rollover start log info message - NULL qtype support in kdig Bugfixes: --------- - Failed to process included configuration - dnskey_ttl policy option in the configuration has no effect on DNSKEY TTL - Corner case journal fixes (huge changesets, OpenWRT operation) - Confusing event timestamps in knotc zone-status output - NSEC/NSEC3 bitmap not updated for CDS/CDNSKEY - CDS/CDNSKEY RRSIG not updated Knot DNS 2.5.1 (2017-06-07) =========================== Bugfixes: --------- - pykeymgr no longer crash on empty json files in the KASP DB directory - pykeymgr no longer imports keys in the "removed" state - Imported keys in the "removed" state no longer makes knotd to crash - Including an empty configuration directory no longer makes knotd to crash - pykeymgr is distributed and installed to the distribution tarball Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility Improvements: ------------- - Added libidn2 support to kdig (with libidn fallback) - Maximum timer database switched from configure to the server configuration Knot DNS 2.4.4 (2017-06-05) =========================== Improvements: ------------- - Improved error handling in kjournalprint Bugfixes: --------- - Zone flush not replanned upon unsuccessful flush - Journal inconsistency after deleting deleted zone - Zone events not rescheduled upon server reload (Thanks to Mark Warren) - Unreliable LMDB mapsize detection in kjournalprint - Some minor issues found by AddressSanitizer Knot DNS 2.4.3 (2017-04-11) =========================== Improvements: ------------- - New 'journal-db-mode' optimization configuration option - The default TSIG algorithm for utilities input is HMAC-SHA256 - Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor) - Added some more semantic checks on the knotc configuration operations Bugfixes: --------- - Missing 'zone' keyword in the YAML output - Missing trailing dot in the keymgr DS owner output - Journal logs 'invalid parameter' in several cases - Some minor journal-related problems Knot DNS 2.4.2 (2017-03-23) =========================== Features: --------- - Zscanner can store record comments placed on the same line - Knotc status extension with version, configure, and workers parameters Improvements: ------------- - Significant incoming XFR speed-up in the case of many zones Bugfixes: --------- - Double OPT RR insertion when a global module returns KNOT_STATE_FAIL - User-driven zscanner parsing logic inconsistency - Lower serial at master doesn't trigger any errors - Queries with too long DNAME substitution do not return YXDOMAIN response - Incorrect elapsed time in the DDNS log - Failed to process forwarded DDNS request with TSIG- configuration checking was fixed to be compatible with Knot 2.4.x- new upstream release 2.4.1 replaces old 1.6.x series which is not supported - configuration should be upgraded automatically using knot1to2 tool - make sure you reviewed the new configuration in /etc/knot directory!- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild- new upstream release: + fix: False positive semantic-check warning about invalid bitmap in NSEC + fix: Unnecessary SOA queries upon notify with up to date serial + fix: Timers for expired zones are reset on reload + fix: Zone doesn't expire when the server is down + fix: Failed to handle keys with duplicate keytags + fix: Per zone module and global module insconsistency + fix: Obsolete online signing module configuration + fix: Malformed output from kjournalprint + fix: Redundant SO_REUSEPORT activation on the TCP socket + fix: Failed to use higher number of background workers + improvement: Lower memory consumption with qp-trie + improvement: Zone events and zone timers improvements + improvement: Print all zone names in the FQDN format + improvement: Simplified query module interface + improvement: Shared TCP connection between SOA query and transfer + improvement: Response Rate Limiting as a module with statistics support + improvement: Key filters in keymgr + features: New unified LMDB-based zone journal + features: Server statistics support + features: New statistics module for traffic measuring + features: Automatic deletion of retired DNSSEC keys + features: New control logging category- new upstream release: + fix: double free when failed to apply zone journal + fix: zone bootstrap retry interval not preserved upon zone reload + fix: DNSSEC related records not flushed if not signed + fix: false semantic checks warning about incorrect type in NSEC bitmap + fix: memory leak in kzonecheck + improvement: all zone names are fully-qualified in log + features: new kjournalprint utility- new upstream release: + fix: missing glue in some responses + fix: knsupdate prompt printing on non-terminal + fix: configuration policy item names in documentation + fix: segfault on OS X Sierra + fix: incorrect %s expansion for the root zone + fix: refresh not existing slave zone after restart + fix: immediate zone refresh upon restart if refresh already scheduled + fix: early zone transfer after restart if transfer already scheduled + fix: not ignoring empty non-terminal parents during delegation lookup + fix: CD bit clearing in responses + fix: compilation error on GNU/kFreeBSD + fix: server crash after double zone-commit if journal error + improvement: significant speed-up of conf-commit and conf-diff operations + improvement: new EDNS Client Subnet API + improvement: better semantic-checks error messages + improvement: speed-up of knotc if control operation and known socket + improvement: zone purge operation purges also zone timers + feature: print TLS certificate hierarchy in kdig verbose mode + feature: new +subnet alias for +client + feature: new mod-whoami and mod-noudp modules + feature: new zone-purge control command + feature: new log-queries and log-responses options for mod-dnstap + feature: simple modules don't require empty configuration section + feature: new zone journal path configuration option + feature: new timeout configuration option for module dnsproxy- fix post-installation scriptlet (RHBZ #1370939)- endian independent DNS cookies (fixes build on ppc64 and s390x)- new upstream release: + fix: No wildcard expansion below empty non-terminal for NSEC signed zone + fix: Don't ignore non-existing records to be removed in IXFR + fix: Fix kdig IXFR response processing if the transfer content is empty + fix: Avoid multiple loads of the same PKCS #11 module + improvement: Refactored semantic checks and better error messages + improvement: Set TC flag in delegation only if mandatory glue doesn't fit the response + improvement: Separate EDNS(0) payload size configuration for IPv4 and IPv6 + feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)- new upstream release: + fix: Transfer of a huge rrset goes into an infinite loop + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL + fix: Failed to build utilities with disabled daemon + fix: Memory leaks during keys removal + fix: Rough TSIG packet reservation causes early truncation + fix: Minor out-of-bounds string termination write in rrset dump + fix: Server crash during stop if failed to open timers DB + fix: Failed to compile on OS X older than Sierra + fix: Poor minimum UDP-max-size configuration check + fix: Failed to receive one-record-per-message IXFR-style AXFR + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message + improvement: Speed-up of rdata addition into a huge rrset + improvement: Introduce check of minumum timeout for next refresh + improvement: Dnsproxy module can forward all queries without local resolving- new upstream release: + improvement: Log change of the zone serial number after IXFR transfer + improvement: Document operational impact of various RRL settings + improvement: Add support for rate-limit-slip zero + improvement: Add 'timer-db' configuration option- new upstream release: + security fix: out-of-bound read in packet parser for malformed NAPTR record + fix: systemd startup notifications- new upstream release: + fix: don't load expired zones on reload and startup + fix: remove race condition in scheduling causing delaying of events + fix: NSEC proof construction in zones with many delegations + fix: TC flag setting in RRL slipped answers + fix: disable domain name compression for root label + fix: check if executed under systemd before using journald log sink + feature: write persistent timers on server shutdown for better performance + feature: support time unit specification for 'max-conn-idle', 'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options + feature: add 'request-edns-config' config option- new upstream release: + fix: lost NOTIFY message if received during zone transfer + fix: kdig, record correct dnstap SocketProtocol when retrying over TCP + fix: kdig, hide TSIG section with +noall + fix: do not set AA flag for AXFR/IXFR queries + feature: new configuration format in YAML, binary store im LMDB + feature: DNSSEC, separate library, switch to GnuTLS, new utilities + feature: DNSSEC, basic KASP support (generate initial keys, ZSK rollover) + feature: zone parser, split long TXT/SPF strings into multiple strings + feature: kdig, add generic dump style option (+generic) + feature: try all master servers on failure in multi-master environment + feature: improved remotes and ACLs (multiple addresses, multiple keys) + feature: basic support for zone file patterns (%s to substitute zone name) + improvement: do not write class for SOA record (unified with other RR types) + improvement: do not write master server address into the zone file + documentation: manual pages also in HTML and PDF format- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild- Rebuilt for nettle soname bump- fix BuildRequires for systemd integration- new upstream pre-release version: + DNSSEC: switch from OpenSSL to GnuTLS + DNSSEC: initial support for KASP - split package into subpackages - add documentation building - restart daemon on updated  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVW3.2.4-1.el73.2.4-1.el73.2.43.2.43.2.43.2.4  knotmodule.hlibdnssecbinary.hcrypto.hdigest.hdnssec.herror.hkey.hkeyid.hkeystore.hkeytag.hnsec.hpem.hrandom.hsign.htsig.hversion.hlibknotattribute.hcodes.hconsts.hcontrolcontrol.hcookies.hdbdb.hdb_lmdb.hdb_trie.hdescriptor.hdname.hdynarray.hendian.herrcode.herror.hlibknot.hlookup.hmm_ctx.hpacketcompr.hpkt.hrrset-wire.hwire.hprobedata.hprobe.hrdata.hrdataset.hrrset-dump.hrrset.hrrtypednskey.hds.hnaptr.hnsec.hnsec3.hnsec3param.hopt.hrdname.hrrsig.hsoa.hsvcb.htsig.hzonemd.htsig-op.htsig.hversion.hwire.hxdpxdp.htcp_iobuf.hyparseryparser.hypformat.hypschema.hyptrafo.hlibzscannererror.hscanner.hversion.hlibdnssec.solibknot.solibzscanner.soknotd.pclibdnssec.pclibknot.pclibzscanner.pc/usr/include//usr/include/knot//usr/include/libdnssec//usr/include/libknot//usr/include/libknot/control//usr/include/libknot/db//usr/include/libknot/packet//usr/include/libknot/probe//usr/include/libknot/rrtype//usr/include/libknot/xdp//usr/include/libknot/yparser//usr/include/libzscanner//usr/lib64//usr/lib64/pkgconfig/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=genericcpioxz2x86_64-redhat-linux-gnudirectoryC source, ASCII textASCII textpkgconfig file RRRPRPRRPRRPRhttps://bugz.fedoraproject.org/knot?`7zXZ !#,o§] b2u jӫ`(y.ѻqb'ŽI>B~*D]u6HFN~LͲ W|2kkDkVAAaI/̮a$BlL0Xca3،b.|#i\.*[=~ïimaW'k,hJ4OV{xb]'|nSEFŽ/?a@g59l ;3 g'NzԷݭmn9tGkPX]u1'Sq,j[h8>~H3>EFͮ8̅Fac/fl&⦮D m$|q]mCOy:k}x>A 5 mԢH<'cga6hI㫤Z1+8Q%]ϦBs*%/1652se]x>2\f8''\S3F`40RxOD:`:>35WҒru  J 2U03D)`_DJ;D>u?16G"5LZbruSXT3ͶH06sNQ\k$0+X q@dBi;k"rxvf}YJXF֦‡ϻvdI_&MvŎ?lQ5\ (wҌOyޡa/ K`HSu#J iqڇf82yC@r.|ϝJP֔`{# 84570BlkYJi'(BA] [/$3'RY dFi6)X'1Zjt;dJ0INz{At_yCS<p;+&!L׹>j018z3tM%]Hz<ㄮ&YwګTTK:p<%'(JBŵ<U G r Oza7ײݭ䢆 C*Ak)D++wiρ`Dp$ejvZ'od `ffznw\Dy! !ʢT0:A֕HVz<2IKOӮrЖs4^z֛LhEZfgz('Z8Ƥ j{Ҽ xCcuH;I9qKg^Ӝus]KIkLk|9 <-񬧆7Qs] TLT|H ujǠ LI{Ov3:0k#k 2iU󼍡bK4WHvEEHS}Ufv)W:f^Y 3\5̰s Y>eĵ+#֫ݺ2'.QEJ|Ed4|!fGF& ;]-1; ]n-9GϨIDf;_q<>=]O'C|qҠ\I@K8֖~R=A*N!ܽC")vOc~2_mΛ /m7j+C4M45)O*"kL؂ݰ\:YTӹp,>hӌp**8i6|кH Ԗ>DED ͟vg337uWQ \#߲̀b~!6N)M?l.#d4_2Nt|]X| MJcИ>D6%?:f{p "^_T˫yG!pī$#0)m4M]IumWdOd]Ǧף>{ѡȰ]Ո݅Jg)KDZ#\d_Spß+UD*1$r[q:/r)z4O' et2A5g5M(Ke @R>c.*G ]8c<3Lb%2\XQX"},=YIW t+8hjAA=Bi<ܐz'ƢY(O\͚1=BCa麸6tl Ycq=:7,'PjQR۪t8nRa@_OGR<FL|3 lnwBOO J#,b9&r+V$нQ3}$8F՜  7DU*T^*σyWŬaMt[lgxkId8X u?ɡkFYWL9Rx1i#UrWOXXiS|Iz.Uj kdL1W}jxOU-&ozTo(fEk>,#`7;{9T- {`uJ{F=eeLoڼC6c8V~>W@Vx_>,}躃ɞz:\t:CJ1?"…*ɳ"Ah_j^j:bRɦ> J4ӴiGɷq KDpu )u<]4zLU1Gj,(#ءgTv];Zɽ/ UF`+M6s]6TFi[b[ ]\(Bn& 0Ґ W y'c۝!P"q4& {BfIV}W0æjك&[:yn8e/1J+((`X^VK`ipWIHs%\ė|G|U̐gߡ #rHBߍm@N4tg~[[ܥ`dv@FqC:

7 S%_Qmq >hHe:Rh}9'{9jG1_| \;>y&;MfYuco|qWpdN臸j4⎈x郩}Y?-j`f^ C2-W9?#C[ժwN}*.s#>@׈+,=e [qK)ծ+kLC q: \w6bXx҂63krx+I7UaHs?ӼEb|Yt'C@mݢ["G`\OA:j$=  ^puH"Z{\˲}0=-$=PGFΪAQ++Bl_)eݩ`Ide.ƲhpC!iU#5?s5\.°YVw##t%Qgz<]L4Oo,c)hMͳd1 *KG9Qq}lٸiXCDTأq9f釰*b$_4ݸy B`ghpՋ<0 +RKkGb$@*J9~wVԸ} !T+"=FAbfHd~JŲQ5:,(HAG- VQ#DY#<f4#n c*+^VjPl" ǿ4ݞ,.m0T.48=yF0_b,\w-R`vh/Nwn ;OC @V/C Bڦ!ns+B7y4nxa,ե5BIM:)7՟ZymY@vx==ֆ'dB49XR赇tK[IOf)^|n|(k(h>')ٰLBOFr$8&5GTEhvġ #7,F= 8$π|"#i$n1EGI8P0ijI&=4V=_ xK_F0jq5* z+`pW-"ݧ,|$=JʣtMudahMyn1PBU,R u7 GnoQN;A?l"=KxR鰬4Kgنؗħ!{C bMP/,3᧌c%Hkw5j#a9+n0>-,*KLC\fC )CMjW] Id ͓~`7~E!Džn͆{u9#N ҖL@!bgJ𽱫[ y6%)z|\RJ+[S7iDha艜pO ]XbU ~֟\_)(_w!=- sX3D @'#RsOm`8KP"ۓ&^%zѝ.W`۽!`Sqd^:QJWE"&}e? eo[خv=7ͪ[A[\qa˷JKE[n[Q~ }V5(Dž J{`~d?jq3|Dܭ_tKU& VX9()$&5ӟN0sU?U\rtQ&5ZY̆9M0R('A5PIp7elܯB2[Rst知jXx:$H&!I,\7 n.Xa²Vf3?9쏞7nȤFxz^-ⵑ O4Y6Fh1)~Y28/ _1o"qW&{L`JeLw,FrfT YS+#f9?ZH076KCXdё&Z/{ԺMKMT]̻9Nrn"q6{xԵ4kS{I,O|'v@QKNnD&$Q3/*\*G4G|J `$Feǃ全pL&"~Qj2KZ0AR<˕(,fI7;e;zA p˯*0VEL &%wEnRߢh_pyɴ<Q-^Yit4W}oT Sj]Ah'o7 jPKn"$?zrfSZVDH<)] 'jM50i jIu!1٩lj]?J*Ȏ s%8`NbT 57Z&+MhyץkR޹L&Tﱾ| ^t6?>l6|]FcuqxQ1{♯ '~fqaT+ƕg*zھS݆Z []uȉaskCt]UZ+9UG=o3' ?o}xSgɈFQ=hMѮYlBylӢ NNe+3Z1TU; N5]¤8RHk@yeX,E{f߳tXI1e,`\Hn 4I?h*nF֑*a&ׂ/ozf#$պ,,5ۇGLF2 bYiia`Ti8T X<]5^T tzhbLRwcszOh [Fdv|-d ī=dMDLGfH,EVDHO$)c u yŻky:3gl%6Z+hXuXIUys]^~Ȑ{5qh ͗ŖctO;K4n[-o(7c'vg2Ͽh+vQ6{+gpQ#% cH$&ȚUUۄOrdioNI+ N=ܲL:N(\ݟ dⴅ{5Z^Jp/sOͭp*=%)pLl*)!n/ڨ험SA>´S_ &28;u]:5PY fᕚ Kzб%X H|cxbϱbRiBX]Y6:[ܨᖄ,q)jym$bd ' NI4*Ԕ3ԇ!M:j?;djZ{ޙ]AIBC.dkK]1it} #m4A xSr[7!0bd 'R&U(>^\%>%4 /f y$(넇4.Lyɿ}G ?;b~lQB[uQ>s_xdsɾI3B5β=S˸}'@(mU>+`邼=NUW馜?W0]ަ4CRzU7v Ǹib6=#EƪY]PY+Tbm ,GgaZ['U F1 FمJ:ܻ|`qX摀׀#<;Dg*  }sz*G{jtpE$Bz21 G":' #{Ei)N׍~"RZЋ;g>In>pT)u:2bf{ÿ'nVNq"$1{]{/XmIM6#AăfLaw ή6=yZl9CrLIGBn̾(߸O,f9X_|8h0HP eeЧK)tbgPo4Wv}}HnR;;'ND^CK7=?> o^u}PI_A\ ~ꛟ݆AޝM|Hu99FUKo.~DbLPcٌVICtJYMLe%e~e<(jt= j\PкۻCd™!yPQ-Ӧ-}u j`XWa` M$qxp={M@idj\dl ĶO葂2%a)| lfHNJ~9 hU!Ȅ:Y!˛?9"4: uĝ&%x{ﵣ >P& MXU&ߞ< ʨqM)[Tb(EW3Iaq]ՖEқұ cӓGinPV3(^f'-򳨻_搤 x{$^ V6iO!G~PlSG,_vqq{10G\1m,eon9=0PՎ,50|ec8Sڔx5Տ.QCSAӿV!x쉠䚚̀^3ηJ>6[`P' TWSgV-e {q}Y]vohtSc a jfQ*cHE K*l#l4#9*q^@UQ֭y#EVS4k,el.3 F lTZ EdPj6"Šh(%22EJc3դأo\-3+&F%&`P]GQ@!q*&:L/ Jye&=lC"$ljUYVxفU>"{9<,aS`Q9$D9ij`leI"Qd;%bU.a|XWV5~G Qzҷ0\v GZ9J-̬7V J-):b<'   aTEx}"ߓj)9GzvKS]g3}<-5NsmZ`;k90쨤fYJ2y*[S>hɪ +z7A'BTL%nF1ewfeAU)A*nž@X͢$i x=ſ50ә2K&ڹs>P~A8U Oסzup5 =y V+_꼘lwz,HԦ<"p "1BŰڝJ|J,FaCҞ y|hlD X=D84hʌ!$-=7ߢC@ s.TZ-Pbև#VMSmH̶̭2OSCj5a'ien}SI8N`ږ*o7*g0rz$2xu;/s;.Faǝpl)EZ]<ƮD# ʋG y%klْzڿ= 10bhKj*^26nJVAvGP+zMzkazs R =ҿ``EgX1nJ(H7kdk#M& #|Q6p͌0XAJ @HUvӫj^5&|hy?L6] S X(ۧZWVR(l$^ݮ5gt,:.ztZb1Uujil rWYN'h w6=R*/44 '真U*k$R S+QB>U篦s1oG o݇܍U#08vlcaA<Tk{a+\.\Ը:~q sRPܐ6`E SFMJ6-4njc;V% ܒk RJph*<|sy fGӆw]; mAQV,oQء@;9ɅC:\u_̨dŊ̭'p{҇3qQ&xj~Pnʫ qDloh;c  (n{x0߯*E$5  ʬ ]%г3*ҡ l-a_YdVGY(ȹKA.έ#*pjCWQ+,MOх]ihl+5A& D 53.YBPZ캴S($hF9d@>?W.*DY]YgW(i9I𗞗!#BKY8c]3@T UumcHω.9h?@=h'A҄Hr8FHNJx0im = Fw7[<"f(^(,ė~#E܅/جxYUC:~@hۉ90x{Ei#r";F-ϺC|8U<]G# /7jE& n330;nLAyrq ?=գMnYpڈ5edM;8ƤEЫن?byMxxc3\c#tf:>ˆ:q΃بOX8IQۍ٩:)@H-"H,cZjѼ38]!KX,")be9-iGtRī6+tP'4~:]8p?NkZN/|GS?g3W7(S+X$Cj |tcKIa)UXpD WCfcP%eFI6zaf]QΥlb(1WnEUcz?/ǀﾻIvj(fJsyTvE )ƴ͆tjp pNxz/M%"tjmaN?CNR[KHn{,(IșTcw=Q(6(Yߞׂr[U*Dc@uyCj|=9Wg TZQ y[Y^jtcTMƃ]4}x 2Y6}`a&ݞr}B=k}P@&jd?#>sR*z;gzDu0çMbˉ0 'q[Ѥ˱4;_:ۉ: zCr^M5*I~MqcZ`AZR'Ss1*FtzB[SRx?*[%~'s U ;^d۹am~E^ڰ%5$MY^Db]tbߛy6sdwNgIj4-6|r="Kx2p'pt/?Fs=M~dlb%Jlt~

slXa ':uȜ}od˅6BQ,2ѥjxr(TYD$'3no lENguFI@3M;tZHQg) /<1ҙh z+y'ID(;%!%!<(8GF#l TN/?Kٳ.dX T"@lWvF-ȹWgYnYs7rbǛ+,/6[h0v`TtД5$oǷTH0۱-/)"r Q˖ &XfQ9eLgJ=T m .cZwx FS3Вx,V33EUgzc2/#Q=#9A^H\፾WWNXX((S *솢r q8 ҚRCɓuvM"(S.Ϻ׺ICκt#{e8}_H Zto0c&_aJɾT죞`~C}?Wxr_`vZj&7*͋AO{wVTϝ+\_/iމèÕGշefjnN7KO  I 9ގ/GWꊾ<aJ]Edpaw0QfO?QZh<}2LI9Kb?1b n y'qD{' VfN k̛c[ѯ;̓k#0`ElbޣVI)D0Y=C[vSYgܒ# VwژNi䃀-(:g#EwQ_ H3 ZP|)z{ 9җuƱ']699znq )khINl,·Ƞ~P_ ƨ `D Pӝ}.)H5,#O;uHK@oxtn԰ܔχO]ݾ'&dh4*8 v 3H6-JMvrghBXS{oF"f,zPpˁ`{>@8Jl{ pXP8ֿkL!ZٍN C+0ny"#zy% :Ndً>]lNw〚=SPz#]bh#:3"5r Wδ`/*1DHZT/KRΗ(z:fZxY37_MnP:5EajI?eu++/jLϿھꈾ{Oj%>Ԅ.s2+IʅK|0J9YƵ'/TB Y>)T/n!{tlÇcb+^z~Di(`gMs/[dIcA߰" 5jd VwKw|o9<7_K ]엌m2XNl[W6g~>חSǶ /eA^lm4*“m#_F"q=~srokPؚũf&5g$' ?⚮ڳoM.M#М(FmD8_h۪ ~~׋=e5.tLN+NҴq;=cW6*B"!3sCyB9ӧ.Mya о UY[ʓb=آ9h8O,$暏9S0Q<o>n#-ExJHXv6ԑH9L͹"qZb⦸>SencKU2i7v7̮([ٳU*'D>pp ibprYQFTE3ۨ^q>+|'j~BW~;zݵJBֵYb/6ppyFy[?oRT?v-koŘesc_層B.POh"0Y6M_Ef{` d][_mS+JPQa5,2AGec`XK+t,ޜ7㎺ pk:%nTb<ڏshs)AEBGkVabe`vB>Q$}i10m}"CF' XqKg|Eӹ@أp] I lV32H8 v34^yA'AׯA¾{\.ˆǂԉdUےtOq[] RK#B4QVJ"㯳b, Ex=YRLYCg@ ]g_11D&qA_fGķfn}*c@ȷ&] 8q"یJeݱK%BR }%n襝siҖ<}`?O(}"/bCN1jjƟRS9k$P8yi{k jRg:!g/B Q_|@^Ҡ?IfUx0ѥFnE4XĠ=yфZ.mG'pJ`b dW%#e92K7UB+~kNx?V::/]jvzn&sS UILU~usˋ+~js '.,(ߚ60L=;#kŢQ a@xmjuZ $2px[Mfy=y}^FL漕eEX 8 f'j,lQ/ւO8tRahn-}B. Oi̪L_Ae"GFյ!L=fg\MAeVm²hnbdeޣN. 9>\_^{wgJb3jBӉӝk藽--Tmix͂nApAb@]#w5/_<uJOm9V3'"`Xl!!zjlj5>Pv!ȪZFǭк?!rGcfF-o;gKLwBI/t/9/9] tSiCd9ncq l(7x1|9vɽ9BHR|?;/Dܴ}݀l"(l#޻IDUH>! "J0JϨv]DsfP+ƒ@n( pvi;Vo֬=vp? qޱ "-:769%ĎZBqtQQ%σ=gy5pWaĜtuJe ϟbY+YG%8UTر[)C* '^z̦%r-Zէ E,H b|hcG\4 `R $ #S`do(֙3_KWiJ|MAB>"C?8v+ݖ 9(GeN3L(\PHmtSxJoLJ5щ~bob,hCȤ=_M K5QANR!\#ǀv[*b`:@SlțoA՘:`ʾi䑀rtOp |; 9>dP &6@ngCpK[ruhil7̹V]ϔ/jCGզ`I=fPA%2JZn9+õN񁰧~wlbpʎќrSX9v]?SU0TrejP猖;DO;>/UX۩k7>LT6ϠXs0)ВЏ ̼E;.=S-PU 1ςDӨ!+sW +f͗4xMYɊ^ Cr {=c%9{?B 3u7Y;k⳨'bSܬ%!IX:ls5 ]%zŰWXugN(1MSa ng%N6ѾLޭc9ݢھ~vwm\`D3lnգk:"lrϜ~tmB({&RГDB䯎'o9+V'Xg ܭ.X1Uk~A#+[[ "}J$J mCwnsfPyN Z GsBIʖߤ_qL4+$C{xqIr-MG'yEy ǻLY1Pi2.SLQNퟻ=Wωo/(3hWzP`+TĪb-YC$ ts:m bH J9Puiښ"iLu)Y :WU#W)ќF0Mc0y2AٌX8]+OM O"S&''iO ?g5%6y..KzT`IEdT񨣵7@</gf4ef(uA836*: Jia$4CjeBbSHY<f|5mCݢ5 sJ8/W,ꑪr'uUc{L Ycax^XmߝI[[ z4L) u G$ّF{@aγK`~wEϣ-,^bkZ3ԔH+ϝMz?ermCi\i7V,ON m7쉂à.ƴ(l(!q@@B̃ X&.ero/ΑsubG%DM6s=L6o;1c:V-Nu&+γ&Tѓ g~)" bga$Оi }7d++v1bS{"~ַ; 7u.29t *CU1wF֊ kZѨ˭C▍⦲7"^" N5$N#+-}-CYS'(!3^9?vT<)\qUPbW}0{Ka\\(2{4#*!s#*V S `#>O;H|B4B Z2rIP,,9HV /\ ٥GbCK AR(LQ&{Jc bJZ0K&x18~@lO=UUZqe8&^6븃(^wX[j`@VA#L=\O 谀݌ҥf>Fl|F yOb'VNrTS^!NSSpB2av*.*Y)";n֊ mxx ; /=C Kbk|&[4Xz%k;'),1:KUwPiji5t܊eVV+EJnД-y~.V4-мLApYow 9UXSVF3Pc/MV*Eȏ^āħ~Mg|+ͱOu9|bW*,NY"H {'N[5@Xy`Ʉ̹jpR`Dk|ί9ڡc+VaԥN].39]/N[?%J'l]Ph6G%u}IL4434^>$%]kٵgo~6)Dgi7+DAh/z;]N#'Q 3?oLP't,tQl*;yhD&0 OINc,SjN:Z|d), f_M1s U*NrJy2$%1c)3Y!F}^tzH-|pϥV)7ίS9yw\JP_KOb*YzQsU >G!rq%; 1j4ٔ醾W=t#i[oXԔv?*h/k'68I2='~,' Eeh\f! A$ AWVĠZoimtE%uL}f[dr8ij73XH<~Dixp@g>0 kVޭі,"Ⱦ1SFg97F=wg!:Ee4=To@g0mΌ;Sf,W;dt) 6=#T}v`g>|C0qnsD0F$]m=0 LԲP:c}Z &W َ4*D|9> MG畐愪+AȲʘu3kzᾟରZbeF_+:ҡuWe?"*9dPPxI#mp+na1<-lejAP?wPq`4~^[yKaYLACPŘ9gbg1^/oI(Bm~ޱl#gӸs.'ϚeWODfbVy:$8Esᦢ A)jP~5w:Lu?vNHx|euj~@~˯ /dbS9yt ڏsf{Zqݑ̴ү:?~T)iQ:X/A<ey}:hl-|Do9iP)ȍbQ(ZdHgDxCi&lքʙ \t !-럵 wPq7s *Y1c<>U[Ln7&H r(H6 ~K )d ud-FW̦3{%fw@7M%fuy'r0 Ԩ%#B)+WQe͑8MW.N6\KjjANü|钆t :~Ώh^@LXh ju,!L飽Z4վrt./Kؑ)SA2ݕ4$l9vT6>/PS[Z"Qj_W苭7hjk%B9` jMo(meuXdz1E?w>B/75l d_PK|?6GA3mGu:;$KW?ڻ@V-bX:Ad(>4Ws>8򎯂I~ڿ-l.轮}pe^}|E #3>L9@y$[@#*]5BU y')  !Ǧ\dHÛB2pZ)xjJoPf(W-l#NOGka)%B0jCWu:ł#3Բŀ̯:r~c $!א>dL!`xԛJ Cgl881RD{2PU z~2zѶ;5Хtȗx8tA["JE2sgfVt(:Erdt6{2~Ai4/"8/?Jï=j0})h "3ij[JrZ]GV4[yIC8!n q9ơd^)'J:mOZOЬa֛Xogݎ>(Kr }@bEuެ-paY FfEqhY~zs:U?n7KnkU\?СL\/sO-oNZJlr{ _'zw}ZS]L[EYQ? QL[В=Zߩ.C]l̙͸3vpB4Ѕ^?1o<} ޫBjwx*աk˜rXK=< U1\ġx2c@\Yn!^o>!EzƙO_NɡZYW6:=Ⱥp jEr^NSt!=g]Ԣ'HSӔ am;n{,I*h%^u~QC5g\(9J!L\J~? /}jE'$g%Ԉ t(, |k)1xJi_z0)-uG#DJ6WJ5weuG۲e*ǘ]M_7q(9;xj6iĺYo"dqOۉs3\LO0b1lxڀm ,j 88T2y~Z4m1-J= ݛ]vA"5U P8VZn'4\+X Knw5!+tk1 C?r%4UX̅J[̐yD찼aH8!82 T'xt?ۙұ#%dK0)Y:d25qMgc9P pdysv]cy%yd9N)eM(+r'[ \;TIUm( ({%$#"$M,Ban Q|/>vVW`)CП)-PEl}CܵW á@a!*"[]! S7piEX`.1QosvXh /{g-<12](]Cb#KZ}-O8mslpLmWkpWt/,QV M-xW_PJat_/$Szqjb_l>AA 1x,Y-tWO\R"uN09LMi Z/nkY_TUAYa+.6z$4in]^yX*ȱԋ;Gv(a5tRb,zB%X0Fw,73sV(ҷV ģW:PR#AyL-D5Hmq@3cY!~]%uَ7^RoYc4xܓ/_UpRm OSbM_Ɂ)8k_ ˴V,JG+@uIQIHc Bߏ:k$FI  P/%-W` EARLj9 'GIբ\(a^luH0 m"*΀-(R Hq/iX_yF+9Yʥ5_wWvvSG?NX$9\ؾ2 S@ 104-7lg=aA"5ΖFmC4pPi Tl ]]-{BzdtcV.;:uP;\"D(\䂾e)imNN`0N2sf_n%bX89{׈c<1DJyRH.y 6G*/)o[`:}']Y\`K }[61وC=1'*7VG0`@!%0:R\ȉMo.֝!*']wpCqATI"'/D7 dOB ^v)(K>#Bs&FQLU]C%F=p*ώq3˧}*sPTu:s= 0ADMpI"PlMT`?}<>7 _ ľ>Jf利UZ('4j@⸼ۊ_$[,4,_V)ա : N OfGn}ea5`'ԇQx)"7rwxxǰNeYjM S)VsQLڢVunb0g")AnwMZ=_sςeY!*U-EƲZ0X U[Yre2ʄ%Zѐ@6Q 8y~+^4!N4bs.9jpp!vׯXu n"cKDAHG/ T -!&MOD"ƩP]X?퉶A/ LyIZٶEkξ4wVKŁ*a~d|T19x.o$1A͆/%ZEU`X[e\c9+i`2p#b[Z"rY8 e a53d֖i $'tp$@hӪvgBA"j r6.re7]^ k1{g TB8G{L7λ?8aK6os 0]+Sx->*XX7R%$kUq: 蝤A񤗰 \5Vp0]F6]K](h%pMKKqjONpBŽ?pꤲh{1U+ K' [{@AOp*>Z9`@uXhTb_CDIg)ULC R$E-"yeDR-o+IҮ$;W105FG{qW_(hg_Xɦ噠T5I$R%hx4n8ӮT8H^Kbg9?£$ R a nc*8>8]o?Bmv!3(o_&&h L!Kۘ|qt7R3y#2;UK]6'[h_ b. D陸׎|; {z%(G^xqtV-9eM;BKBM^Q<7۹W#шrT5 S!J*19VlN[i7~mitf Cnc hule# ,T.Wb "N ¢w1dy܀<:nԭu y:Boh_i9}:SPf2x.BKa -Ey[ψ1@ဂm,/_ЕA1H6٩Ggi3HYNH>q5MzIp :9BQ1]Ljr7`RadZ[#퍞VݶHlͼ` f8/]&P>ҜA=0ied"cUzPxX'ey:e#S%f@19ݮ:E:BU'Xm u[T4E;:##⥀/X0=JhILӋ5J7ံU]A%ߡZ[QH;_\Ly^%V#vX NeǥZ2&'6KDs$r9Zx!){Ë-&¦ZߠvaЈE%lա^t"̴p{oR[<Ν+Ti/} N+(*݌y>h`S2]HN@eHmMH)FyZ2>ڋ{R۬UyEt` hoQHle4 (ܹd7(J:BCDL$Vg^IDzL/(+0ݵK]ӕW\o,# _T bp 30䘍,B_ܱ9 4Ze"U"y"WC^6CsµB2箜3o0ƹJ1QH=Zd(:h"ݵw2+ƚmPIv`D9.匔OQ$L-tDf(9FULJ G0vd^އK.#Y?rʾ xy\!fO+Exbkjcp] '򋔪`&?z=k2s QZɧM @_#(A.Φ)!#= ,g(= TH 1?bkC~By24lpbu t Ya4j0LZJ_7De6~8K/TRTC8.z fYl=<3cCo)ݛVwTsíqf:ËZj|xh.!l=&\ eHTfXTaK2ur?{HhOֈd).a_/"'ƬnZN1ݍ_(/N|k޴Re{rzCo? =xWQQ.e=̫)א4Jo9& ZDL3@7ksY]a`}g%In-z)fQvUSF!EAS@`!􁜐hTvXqlr]C؆ȗŸm oq<9 n>1Cl+gU55IY< !QzBÐ(PAJV/RA1Ji\u8J=IڛSvfryPiћ݅f3 Pr hyLIXz&8*\}hբ߭/ L7f|P¥;>4p\d3،HX{Fkgv8^eT(o/Փuvk^>4V`x/4}&4ȔpAf~wi Z_`<&giE\GXPe$PDAq@j\ ")-U? anc!rͫ5+i#@6< qOq,@FZ#&!Mp2eXщHPQ yn'3K2f/NՆ+p ,* Rp4GO\_ۤ/:0e( #_4SLنޝnc9YXIAW^ Љw.L!vOa`%w%N['Ƣ& ߄T9QHjb hgfdVulu\MM'i\sz7k߈yf8fOaLABr8vixXo u$T?uCF5S!kv;:;ILu?&?BM+aF9{Ν] ɘn`o 5D}/ǒ0wwh} dKe0~8זS qƒh0EK~N$_gmr^%Sq B1:{2ï;;8BlZD2"V]: ^>u,C'ʇbD;ue%Ǣ2{-K_Ej+l#:,̪ +4h ,QK:| }"H]ܓv%hT~eI}S(hR˚-fEP7q5 O[.c,(kw: E13cOHVdk,9$*k~.wEц8 2s@-@wRmi?ᇾ jC4R5˦_!7bl Y?7Pk>%;'UU /7s:[6j^" ( @%]\ewuZy5G } qU>ұv!zϣOݻLo8)NY-?=r,'sGv3,؜u llpC39̨ <Ǻ;Nxeo'EZ1z_Ɲw_*KJDʼnT*j~_{~F`#]{I2 ->1-u6D !)1yS.~:Fld-ɡA[(oѨ-#k jP+i +2G:F ђ4zP$R\@ʋ@aTC`D:ju-c\y spF"_`@C7;ʐ }'"q\Ab #;мP >ˈ/L IXDKEv5W]&SV)4c&vcSN~l0 [xؙH^G&.jJ@<4Nl%xJ,st#sOwy=܁_E>9.~aqyCdAKõJ{km*Wir*o[ {ҕ6t+8`ZεKH xRkwog̝BRQl8hT+S|ozsO}/0IO! i3fS8I@[ do%$PAG>~7eokN]3mOKBj}f3zmFZhы2 ڎSd=@MPwzQUltP~_Rh6򼣏B~UG㱺XSſ/]  ?::XjtDYZMt:yhw_Rv V\q|$!j,(GUq:ioôT|*wqHɓ Njq(o1p<HW5_ Ӿ/ p'J/:,!4nbܓn3"N"Sctމ㗡_G4n3RJfN2﷗N|j$L>޽F5;2001(bĂ2nG y ~)#Wb{R d  ElyJ+ O F)F6|nxWs$V}>(0fv77"S%X hb K-2c@=|-(ǭgɯѺ3j;DQ+;TגD9 f2v0Y [\.Ӕ(IpZL@ WGZpSg=@}h jFPM-n9gho s I#N(@Fn<ަm+gBPYmɩ+r,onl]:Ho HXed*_Cs;6yJEio$,Fbn&?;ٴ(4Vn',tjCgvrv"-Bt.?vgri578QAzU8@0,:c8XI"%:ŁlXTz^PBUS"M:~3JCYFnն3譾ΊB4(%)ƍŽϲ}0BPIJ\xoH.rvs$lwJAO PO8/gIOyu [Y \P9vBnF<GWOfp@[ԖXPǛEjqVfj?W&ܽY#. 4mK)YOL8 &N /mIzDC)Iw]ZȂ`0ǙK[EΤQ.fCpdQ)m  bsw|~g C4&* 9m WDF4)Cj?/…hew谂c+>+5~ 񾚲r+aZ0v_ȑ@qR M˹{׻Lus4?.Iֽ.20)jR.Zt+!ifϏT!\IRk|Tچ;`׈_>#\,-OEPRꥅFZ>¹b MD2Ϡ`4"ê}"a(in>׋%"*1jNRw*j9N($R?x)`r=@Df}@k[XVV 9/ <ޠV( 8i!>yOve #?>#"ZʤL/ 9B!]OL9y_rgSJ¡iTb0e;}PgQ&R+5s S Z' Wd?|R4K1\|=?9$@S$J<5#12 Yb 1c ^_"/K0gMDn:P߀?q\jXӌ;eqw/At۹B"q㏬qub%o#gY~L3~ʧFA,X ( z@s%g .b@ׅ:g=]?x/UX,)Y{ 鸧-?1B{RwרiΜv wW^Pwƒ(Ӥ ТpsG5ϐNASCs9ږ!tvpQٮZlcssz P㰠p̒겞b{6hu̖8{%Xs"\rM(!Q9N@1^7IR4PoQ"<7y| (632W>ww:e84ɻv?y՜c ^=K鄲G; Ee{hT >0^Dh "Oc* 0"\FNv ]ipDQc"兄3+K,=q;b %\_C˖;Nqg ?L8y@yef >(71RYb81n毳S$|;ABH5)C~ pbqCfY*fwP:?6Ql$}?$$iSokYc&J8L1mWgAZeEgag?ln>MNK#Ys[i=> `k"dpsj)u Q_Xƃ/Ɲ'jB}B+ ;WƘHQvK[:\y%PY<|`]`/eā T@8´J5#q =PzZ=iX f4G.P8$3+ͨˇpѱvЊd-)ejF z͔aFV=$*gx&$9TFX;L9 v*Tq/ )?hw LC٧@.xN#Q \fum%t\NlLK/Ҷn Ni~eR?dȁmӳlOc-_AR#{_yB[QeY|ܞ%T!6fnuh[OLjZK[j'z+/f˶i^m;W+IDoQkiu-" piL** A =\P+Sj>t @FVh@b1JLk] Yd "4ɎW^L,zBS>ŗSKٓ,{stp)~>&37]KS81ܲy"#϶jT&ڿ *جi. &XlR2~A ^'سw)ɴ(h#dCD=GNmE%+M R2QGX>OwEƺ'!Ӽ%qeh\GjZQpU/YNr;MidJMd89 ѡJjRn8yM+)%^m+E0%j{`!(#u m* ?%XE(yQfnׄNC(E-^!t\[$6j ׼7LP gDHm@2#%esmHAޏɿDvqQ5|9Y7tKXz2"!JBߢHUKUJO·#K4\E =TFvٲ@fe䀓98NLq Gran%+' @ʒD A䀁-aU5ZkhuW2FZKDxOWqe:{Dvp7gLv:\PbRAbI%eq? jI& }VAּڧ=c+]؁3-uę>abhcx7|\~ ܁Z@dsHцnwP::iE!&T^;jTm }W7|kzcS"gX/a8&ڵVݢO2t C|]I##*O) 5f U7dr…?٢N"xG2&8S7-EbDDYH9Ęb)ЂGƘ8V}s ,Xq>Ktm4K[7a ì2w.I| 1QH-#Xu8Uh{Q 0ٱ2p.;/4 bmuV\\K֒;9&bgoծip?_d%L+K{0_@}Oc[tkC&xA-1 ׏kxh@1 D+B:Qk`LbQ#Mmu<($ѡ: p%T=iq*gN/ fJyޖw֋R"[d7%A*銛,+uCTN/g~g(IJlL5t8=lO+޷'kɘvf,umIU>|XR#j/P-!sC0 *8Pʁg.!_Q$2DH9U\R(L,}yf ,(`7InmZ?z5 HZ*htXYP̴:0J:khdacђu sstn'O C"B"q+!H2 Q s cd&qrdoFsbqXùXH~0yf~PR4st`Y :#&o!qeC6h̒ Ufxc7zΐtNUQٙ<5V' (%ܓŸ)$ӛ ,;37s.[K))]VExվ_S"b`(vj/pA5~3xzा>W󦨷>WY[a}LE2XV|?pۭȉzH՗ =zra 8g7&}F*`E9 }5mG1]qӂH b(otSWx=$ع3FPCpfk>x~M_p+Q~O}~`0s8hGD swٻPF=OnL7҂N<,fD:)ЙDQ0@_Ri7_Yq=PTz֧4E;çW+Dr &~vt WEJ? B6wlIXjva+ϯ2ܻ,Ua-InVTMΚO(]کZ۝N&G;1jag$W5GwT+LWʫ4ޘz.e~{3uF/FY6yZ|w_uhdY-BI]ڌr"+eR9Ýb[PqO%oE;W%W kPkyUh=zHG(hjgH5/ #ԫ>:kk3tFx h;G)'ŋskHnvKOBɣʳ${ Tѝ(% t⾸ qEY53u&/iLi)$5 1Ω~Gf:f|bv'd*=#pMJ]}:t*8ڷ)ʥOyrہԩ#gf iښjcStxVV<=G%H<ئsHDɾe[lc.D#q |H@ǀy|FtQw":&-oy;L:O?0F5 \K}LChOOܺ0;>id9m9JMs#$\#s/P_ O>ٓm۶YQ:\3h](Ir &fύ}\h`uH@Y~Br}B*EXWy.Ȍ y}ښYSHTwEAs05 @`P2w;  H qGIɃմVK; snQ" oz>tjF+ț/m+]{0B%<#3 Σjޚ &ƧL,pgV"< [U RN)睹' Mz,#qsup&R 19/ȶxb0)KR=bB-`\2ExG '^*TRaXgRHܩjJd/1e]p\AX( :zD)f,%P~CYhquqrmIwT\2$xai!WkjJO,z)5*5rLO324p zSMASlJkt938e,J=KBKؾ4yhpǐsFnln;gP˽Zo &~-q_'(="w6OE4MUc6e!ve϶*@!NhpܣB@4;(&&w.E7Mw,U& Òʇ `18zyu,?*ю]AJlP|ȁ#'g}oB1[6O0w0j !Mh6JFڭ|DN10SUM WWf Wп Ţبqaca-8<\0m2#QJV i1쫃Ju\TZD;Al nЅ={tLJE=<'T=`P `MEGbzƘnӤ;H>ępqp:e՝Ê,W&х`sP]UFAg#o\:l=,=]䓈4p Vo R6ʀsjqVz37(l3_!6R::` ESDJi nuS-c?(ړNPL 5V|Uɻ^DþiBXH\OGYIL.|Xص8ޱRюb1y;ޏuX0@pL|27]]c38̪81X];ıx $ Px$xUK+O[3Q:n19A';Fҹ#CX\f^_yy7q| hOɻ"Rڼ$'wsޞ#w8R<\t>y3,ŴrHҳ* J%2kPr<A ֜+ '錋Ǻx7AbG?t (j^+2AnPRM.(j.F{~ T[S"sξrgj >ox{g+3xD,,:;jğ 龜O!QIir"޺us3\I=-\OF{"A1һQjs'KPOSu9Q]g;<dO!p& ^@LΡwTB iLsҸ4*(ҮUSkn5rxeoϾU|LMRN=”+$MWca&OKq1Iw8h`Gr'6QlԝseʒlQ: UƻfNB3 WÊ~BwX8H`ǠPW9&ĠB1O{5uB,DSVE,s^~vSo2V .$dFzhL`IXOcx~5^3Wc$o_2-_Új|کY(t펡k h b3YGU"ݟnau<ɯAdFSWbKQ  Ilh6a>Pդ,6nx)2"up*Uayi 6LwQc[nQ3t{]+lxůq<^䡂>3&fm910n3L.~6 mjj4eѰOw [uyf~uش7mzW<[/a^eCk?<H;5|+* ̘гQ!8kCæ\dMyI;C9m*ѓ`T1ŠVk`V asoL!T%D.:}HuG %|uǟ['νo0y,&:hg`[52BfdA Q,~9N*#_<|Όދ̨̀“1'SO";P]op*c#&=, w7z=LjHn_)[ JdJ6AV VFs'bloܶy0/2RmYDm ͘N.{'A_n96 Y:Hz /p5XV{ôm@c%%}z7jj89IZyM-r9[ ]7ی7d[ou?5\ f͝M'z{ K.Nd7yF+-&٤[9/-rm,p='KK.ը GDrytr+|5럊JxdC5;P;>Q'{H܇d}dk-"6}}~XƷfys Zmrr$30h)R-o19Q:${ |=AoZE]Vh>㜓7j}(z\, тBgjԖ4bpMv01vR,jI]'$22x?#IJ[n 4};wu|>ldM]9ʽbjXMV2ˇ5ĮW-tɎF:UsK*WCy܀ @c1-6E#OEʆY!: L^mTi0CV'vya)[H35*-tQH3 (D.XT #n+J^zO[X#%쳝]ov\a;El}9;G؍vEVHtExS m| #%A RR4{ErArN|.Xv'޳x@)wwNy[=^mGz_ljF#`mבj9pϷ[՞Fm!j^ʚE2JTY)Ҫ 'v3:Ka΢ y<ҹC41X?5A6U}S w&Xj_D% ,Rc5>?]k֎Hi%RJ[MwWVmsczP۽/f]@3M ~e@KÂ6;( p/OM3 |E ⣏ѹwU} fH=:jS9>JU)j`͒rh U&D9Q#]4 ؃Vė(b(摮϶dҩúzw3A*5˄.?B+У\@:/tWE` tb3 +,rŅUCzXֺ@Òs2b &8jRT)٦?޳QP7󴰍Њ\dO; N9}#n%|ra \wU mSJ)n]t.!PN0Q7И =dj pt< i$197`(,?,r|$w.`ZKoV>&p\cwF/V#50&=x:u&8fBsi=|x+gTˤV:>n3Pjc\B(vXP]l/Tqr O C~|E^XrzLTEjSTBg:%˅x5q .\ZohW$;Wb"<\9D';%ϐ)?Kﰠt(_k*R|($U5R3d ))v<;0OϚq{_Sz.gb9!`aV< ;{kii nνRIHVB5KƐm4}W-wT9yv4x~" >yU#p hURۿX(./Ҕ[&UU{F(ăt83XjRtMxCKAMY >$~齇(̀ GJ 90c=ۈLPCf73#.1]{To 5AVw e9v@֝!ۢe 9{{OL6v\\weRqѵJWnw1:Ob$ jZd`ZK'~V*s=RS€"忴Cf[~}CǢNF~1|ys cv61_[L_y5֖! ӮsZ]T=TokCb~tTGձ*{dȕءw:J"I!:hBKV V{L烆vP*}x#gomFˮbzZ 1Ԩg9=T. QF#Oe7;h> iUAPD9--&AIɮV DҦߟdcFz*G%ޓ#+/uOBeBbn *- y~"_1^#{7Q_\W Vjm{Z"ۅio YZ