knot-devel-3.2.9-1.el7> 6 6`d63!}|J^>j/5,ddk j/5,dr"/'uΓPhV?aR{+[3e9.Kq!ˮaP7k"]kY7C# )(M5<j`nwV,ч`8Mj/5,ddk j/5,dx6|( rgM dx%YǞh2k?,SN jr+uզŞ۞!ho[5 ԤI1zb^ǚe砮֒mceX3Ish& ?8XqhjgIO>GGvHJm&>&ȹ%~OJK;PoᤕR9b@ۼ>QwzN>y>>g!Ln6/ullfzdBdn5eGc T]jUIS`ɳNta%:n/[m?ZXC95Ds84|<2袙ey]KK xiks 껺&> xJ:ĦY5M^7zBPhA!E@28;< <-X/U[XUڽS#Jޣw@deKwy=7Kʓ>:? d   M &2JPXWW bW W lW W WWWVpW< h  a ( 8 G9!G:/,GGWHpWIWX$Y<\lW]W^bdefltWu`WvwWxTWy Cknot-devel3.2.91.el7Development header files for the Knot DNS librariesThe package contains development header files for the Knot DNS libraries included in knot-libs package.desbuildvm-x86-18.iad2.fedoraproject.orgoFedora ProjectFedora ProjectGPL-3.0-or-laterFedora ProjectUnspecifiedhttps://www.knot-dns.czlinuxx86_64I %~ B#R +. ^, J 0'(69K< - tgj M }FX kr  L >#"2 9,%A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de+de*de*de*de+de+de+de+2e4254af54c053f35290cb46ed8acd81e9057446b2d71ef8b911103c6999cd42b4fbe48c632018c0e15b531c25797c3b380cb0ec35f0a597a1f1c94008220b58f676aed7ec38307f1d7282f86ec4f894dd4875c2429109cab92b9621525966da759f07a1c22a4825047d93059c1b52328484334b7f8594b3511234325224fbd8bc13139bb264cedbb87f2c05521f7485d1933527c92e8a7a212c6f8ef2464203dbf9aaff8cea91313f84aa0debeb5dec8320826f796327da580a004cc05b2a3bfc9daa3a1ec734614ff5b96508ce9194e3138c6cf36df83f5a44a57504ee0e498e9c208cedc89ed277c48b97086e1455d2534705619218a1229e97234bfb0b9ec9669c39509cf8f5605eed37c08124192b60ed878e4f8707fb7689e1c1c1eba292ea22cde12acc55b67f797071c03119cac1d0ecacb187646052b5ec9bf692e8f6cdd36b572a22aea68204f86f208c5f2a052cccfe73a5430b0dc4dbe6a9db0bb9fa74795774ffc71a964f8b7132997957fc0ff8ea37b1f21d1f49c112b28d74dbc4c85e9a17c5712cfb676499f0ce467e72b96b61e969048ec42cd43bca7e79919f3837757036c1766ffddfe13b4756a180dd56c94acd798fed6d1d35454f28c3e7b2c6cc75abeb22f94d2eb7162ccfaefa2a224dfd135c8186472796d057e9c01d0ab049245e1575653bc48c3fbe2707d397c7d776fa01c87c04b88be18aa27d3c4103bfb975bb72df32b83b0f1454b68af76d0a322e6012bdfe33e314ea56ff55880afcd6f267f2ac36d63e7d21c4c05a94671242c2b98265dc033f97ea795b7921a44e2b33ac2ef7bae994da7c194bd6fd08ccfc1226ab933a457721679ab3895ae700bc36c8bf8e84cc135c7e61013c262a8588c495818ff6beb95cedd867af608031639b271fecd0b35ab0054e67bace684a983d9c96599ea7ac28049709e7cc98c3de9f322e232b419b010057a85ae809040bfd1d4f7980d352ae3a6573aeabfe39a9aab4f6bcdbf0693805d8fbdd906c78ab0e955f39e7eea5977a041757fd765e25974c4b01ba40214d4cab0626fc506a1ad7a0e8577b3aef19a92568794f2687228985fef92941424d5d68998b941d1cc640079e10ddf99a12bfc29094502ae508d76d35c66c49a3bbbfab63062a405223724bc545d67b41de48e28debc18f8ece4ba5df6c8fb7ba9c9a01c6388227a98d272a9ff77ed4ecb84c0b0735f3bcfa495922d93011ba453068adef1477636bb5e4cb2ceafe13fb046615ea1ee38730477013bbf9c8983c5985e5e14aed6b22854ec16f781184aa6b3d097191d36950be3a402aac76dcf9f532c6dfbb60228158cd280701096ce5420acbbf966173cb85aa9ea97c10e7674a09c0c7ee88988c66f4f9b30c01100333d484a554f47b5e1b3c0d5a226d9720bb3cbf391fee27b1a70850972b4469ce0948db81b62373ec7b7f48dc28d3b26cacca029b46cfe7d4815c72d5253618e526d5f9a68f1993f6d90e0428b4585ca5be835eeceab21017198d81b3819c40046ea8ea5eb2ac45cb096b58ff9108a2fe6a99fe698f42c2a22c0b896a9cbb9cdf4b70b434245ed008a00c55b022308f1e325cdd2ccd6476828068ee18c484d9aa5d85a9d55ee1bcd8a6c512fbaab8e00b5a31d025c978aecbda25a32caccf45d637996c0f486d76c5da8c5c6407e14415a2cf13573fa7c7b42f7249d1ac676295832fa4390f7d47cb792987b55dd1101f734ff7b706063f29dedeb43e96643e1bfc9537ff1cded7df7fe32ed047aabdbfbc878e4a090daddf8cbcf961b104eef29eee38fe1e919f28aaf436f2016c2dde4533a78e136e9ea526fb1e246c51feb8cc8cf570e77e888ab0bc525b95a0e058411ab8f82c16ed18021427d2107c4a2a3b1e82423284635714ee1a820a82bc17197d1334667b6b06ef1258a93c21649c8a8b4b91b4063489f544e810bc10ffcf7834cef2549c53a9b6b81cdb937c0bd08f121aba302841a71120e7dd3194c3f3e51dd2b2db50acaa6e0adf5a10b15d83dfcc30161dcdbfe3e0ec3bcd4ecd1b35415214c84ec3728b93cde1d58ef253337548c27d48246cdfa95df787ca6e01968b1165e23e9f213a3e8092e3d55141db8a229a257e33b5b78d6e416ca902cf8a68b2a28e1e3e89a775b91a6df6110fd6a82ec30fecd5f27716fb25bd2f32491a381a61b4864685d60c8d14c3ee0e1e6b27e0aa14448e342f11453b42f4e81202318e81f820e8fce142fff6b646119148bf78d1f8f228c157bc2fb5908df7065f9a59f5618906612165603a3e48f02b05fbcd16d484dc095525cf47421ac58917ea5c09e68bacb516577967c3a2ffd12022371430ab2a2e74d275401c78b36c467a06a1e2ced136266ed33508ea1410b305442980bd50a6e6bfd1a35417aa5c74316e52f1ba5304d8a799a054e935110765fc0e926c5496ab912b4c7e7406a3aef76fd0faa559bfe6f95482d423e0777793c329621af1ff50cf8ab6545706c7d872a2f5dec3ec487482c97d53ef647c45ac407c04b6fafbaf42aafeda061486f3a0cd57ee6661cbb3472354758d8f194182e0e372d1c5b0c964f5b0e272006722d7b9cea85bc01a4a7b2691463264f07587df64915c1dd41c73bba6502a4722e4315e3f3816930225fe98b5d837976442be15a12631003298e74a56c98121799d00246d344841cb4a4e1cb60499185a8bf7068c0421e33dab3a30ae46a8ccd14e3e4e3438f3167de92fb6d2f04ee6418c41366edbec6cb1a64da831dd7dcf418ec4a546820b816a6dd26d37658b52c1c856604b27f9bcc05a01059d5fda2147bdaf3264bc8355a3e6b0490b7070a727c033d439d537ac1bc5636d5fdb8a6cc17007197f83ca431b327084bca54022011cb92d30053268cbe50c1a671b6dbcaa63b0b4fddb4ddd9c9d0e25a25bd07a36147c4055d7495e9907dc46930b276cf7b2ec1c5c2b3032312fc404f217416a54005443f8b198f4650054f59842a247de965fd8883792388e3a6cc74c05dcdda579d46b8dcbf76c7f5cb1ac8982be3a2d0c294d411b0f13f4fda39ec1c710b1f62c1554b14e4179dca6fbbd5d623c46bbd60131cf09b24b0ceb8a68465b22cbf6053e2d587fa895fcdd2f20919a87f3e33d7a0a282f81d669e5c04bb0251c659dfcc8bf660f567216b1d60ea0d5e81c219f8e52228600d1fa8df3266ed0b494eede6d6b9698dd0429f2ed1acfaa162ef898b5ae502545fac3f9ee9985c30e313502299e2262bfc7aebc8fa29869e8b06e34c89fd18ca88feedb15a87da861f8ec3516a79flibdnssec.so.9.0.0libknot.so.13.0.0libzscanner.so.4.0.0rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootknot-3.2.9-1.el7.src.rpmknot-develknot-devel(x86-64)pkgconfig(knotd)pkgconfig(libdnssec)pkgconfig(libknot)pkgconfig(libzscanner)@@@@@ @    /usr/bin/pkg-configknot-libs(x86-64)libdnssec.so.9()(64bit)libknot.so.13()(64bit)libzscanner.so.4()(64bit)pkgconfig(gnutls)pkgconfig(libdnssec)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.2.9-1.el73.33.2.93.0.4-14.6.0-14.0-15.2-14.11.3d\@d}dd.@cۥcc{h@ca @c*cobjbDF@b@aՈ@a@an@a9@aj@a @a@`t`9@`f@`c`@_H@_@_E@_m_Z@_O@^˳@^U@^^F]}@]ʞ]@]]2@]'$[ @[H@[E@ZnZZZZ}@Zz@Ze@ZNYYYXƉXX@XAXJX-W#WhWWV&@VUUUUa@UG_@T@T@Jakub Ružička - 3.2.9-1Jakub Ružička - 3.2.8-1Jakub Ružička - 3.2.7-1Jakub Ružička - 3.2.6-1Jakub Ružička - 3.2.5-1Jakub Ružička - 3.2.4-1Jakub Ružička - 3.2.3-1Jakub Ružička - 3.2.2-1Jakub Ružička - 3.2.1-1Jakub Ružička - 3.2.0-1Jakub Ružička - 3.1.8-1Jakub Ružička - 3.1.7-1Jakub Ružička - 3.1.6-1Jakub Ružička - 3.1.5-1Jakub Ružička - 3.1.4-1Jakub Ružička - 3.1.3-1Jakub Ružička - 3.1.2-1Jakub Ružička - 3.1.1-1Jakub Ružička 3.1.0-2Jakub Ružička - 3.1.0-1Jakub Ružička - 3.0.8-1Jakub Ružička - 3.0.7-1Jakub Ružička - 3.0.6-1Jakub Ružička 3.0.5-1Jakub Ružička - 3.0.4-1Jakub Ružička - 3.0.3-1Jakub Ružička - 3.0.2-1Jakub Ružička - 3.0.1-1Jakub Ružička 3.0.0-2Jakub Ružička 3.0.0-1Jakub Ružička 2.9.6-1Tomas Krizek - 2.9.5-1Tomas Krizek - 2.9.4-1Tomas Krizek - 2.9.3-1Tomas Krizek - 2.9.2-1Tomas Krizek - 2.9.1-1Tomas Krizek - 2.8.4-1Tomas Krizek - 2.8.3-1Tomas Krizek - 2.8.2-1Tomas Krizek - 2.6.9-1Fedora Release Engineering - 2.6.8-2Tomas Krizek - 2.6.8-1Tomas Krizek - 2.6.7-1Tomas Krizek - 2.6.6-1Iryna Shcherbina - 2.6.5-2Tomas Krizek - 2.6.5-1Igor Gnatenko - 2.6.4-3Fedora Release Engineering - 2.6.4-2Tomas Krizek - 2.6.4-1Petr Špaček - 2.6.1-1Petr Spacek - 2.5.3-1Petr Spacek - 2.5.3-2Petr Spacek - 2.5.3-1Petr Spacek - 2.4.1-2Petr Spacek - 2.4.1-1Fedora Release Engineering - 2.4.0-2Petr Spacek - 2.4.0-1Jan Vcelak - 2.3.3-1Jan Vcelak - 2.3.2-1Jan Vcelak - 2.3.0-3Jan Vcelak - 2.3.0-2Jan Vcelak - 2.3.0-1Jan Vcelak - 1.6.8-1Jan Vcelak 1.6.7-1Jan Vcelak 1.6.6-1Jan Vcelak 1.6.5-1Jan Vcelak 1.6.4-1Fedora Release Engineering - 1.99.1-4Kalev Lember - 1.99.1-3Jan Vcelak 1.99.1-2Jan Vcelak 1.99.1-1- Update to 3.2.9- Update to 3.2.8- Update to 3.2.7- Update to 3.2.6- Update to 3.2.5- Update to 3.2.4 - Use devtoolset-12-gcc on EPEL 7- Update to 3.2.3- Update to 3.2.2- Update to 3.2.1 - Remove patches included upstream - Update Conflicts and move to knot-libs- Update to 3.2.0 - Patch: fix tests on 32-bit platforms - Patch: revert problematic hardening of service file - Patch: revert config improvement to support EL 7 - New knot-dnssecutils subpackage - Debian compat (knot-utils vs knot-dnsutils) - Remove bundled(jquery) version as it differes between distros- Update to 3.1.8- Update to 3.1.7- Update to 3.1.6 - Use _sharedstatedir for home- Update to 3.1.5- Update to 3.1.4- Update to 3.1.3- Update to 3.1.2- Update to 3.1.1 - Enable XDP on ARM and improve XDP config macros - Remove patch included upstream- Introduce a patch to fix tests on ppc64le - Use autosetup macro to apply patches- Update to 3.1.0 - Add missing BuildRequires including new libmnl for kxdpgun - Temporarily disable XDP on ARM until issues are resolved- Update to 3.0.8 - Print failed tests during check- Update to 3.0.7- Update to 3.0.6- Update to 3.0.5 - Properly escape BASE_VERSION macro - Include module dirs in main package- Update to 3.0.4 - Move dnstap module to subpackage - Move geoip module to subpackage - Remove redundant VERSION macro- Update to 3.0.3- Update to 3.0.2- Update to 3.0.1 - Sync packaging from upstream- Rebuild- New major upstream release 3.0.0 - Sync packaging from upstream- Update to 2.9.6- new upstream release 2.9.5- new upstream release 2.9.4- new upstream release 2.9.3- new upstream release 2.9.2- New upstream release 2.9.1 - add EPEL8 compatibility - fix unsafe PGP keyring permissions- new upstream release 2.8.4- new upstream release 2.8.3- rebase to latest upstream version 2.8.2Knot DNS 2.6.9 (2018-08-14) =========================== Improvements: ------------- - Added zone wire size to zone loading log message - Added debug log message for each unsuccessful remote address operation Bugfixes: --------- - Zone not flushed after re-signing during zone load #594 - Server crashes when committing empty zone transaction - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_RebuildKnot DNS 2.6.8 (2018-07-10) =========================== Features: --------- - New 'import-pkcs11' command in keymgr Improvements: ------------- - Unixtime serial policy mimics Bind – increment if lower #593 Bugfixes: --------- - Creeping memory consuption upon server reload #584 - Kdig incorrectly detects QNAME if 'notify' is a prefix - Server crashes when zone sign fails #587 - CSK->KZSK rollover retires CSK early #588 - Server crashes when zone expires during outgoing multi-message transfer - Kjournalprint doesn't convert zone name argument to lower-case - Cannot switch to a previously used ksk-shared dnssec policy #589Knot DNS 2.6.7 (2018-05-17) =========================== Features: --------- - Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung) Improvements: ------------- - Trailing data indication from the packet parser (libknot) - Better configuration check for a problematical option combination Bugfixes: --------- - Incomplete configuration option item name check - Possible buffer overflow in 'knot_dname_to_str' (libknot) - Module dnsproxy doesn't preserve letter case of QNAME - Module dnsproxy duplicates OPT and TSIG in the non-fallback modeKnot DNS 2.6.6 (2018-04-11) =========================== Features: --------- - New EDNS option counters in the statistics module - New '+orphan' filter for the 'zone-purge' operation Improvements: ------------- - Reduced memory consuption of disabled statistics metrics - Some spelling fixes (Thanks to Daniel Kahn Gillmor) - Server no longer fails to start if MODULE_DIR doesn't exist - Configuration include doesn't fail if empty wildcard match - Added a configuration check for a problematical option combination Bugfixes: --------- - NSEC3 chain not re-created when SOA minimum TTL changed - Failed to start server if no template is configured - Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing - Inaccurate outgoing zone transfer size in the log message - Invalid dname compression if empty question section - Missing EDNS in EMALF responses- Update Python 2 dependency declarations to new packaging standards (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)- New upstream release 2.6.5 Knot DNS 2.6.5 (2018-02-12) =========================== Features: --------- - New 'zone-notify' command in knotc - Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set Improvements: ------------- - Better heap memory trimming for zone operations - Added proper polling for TLS operations in kdig - Configuration export uses stdout as a default output - Simplified detection of atomic operations - Added '--disable-modules' configure option - Small documentation updates Bugfixes: --------- - Zone retransfer doesn't work well if more masters configured - Kdig can leak or double free memory in corner cases - Inconsistent error outputs from dynamic configuration operations - Failed to generate documentation on OpenBSD- Escape macros in %changelog- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild- Added PGP signature verification - Added integration test - New upstream release 2.6.4 Knot DNS 2.6.4 (2018-01-02) =========================== Features: --------- - Module synthrecord allows multiple 'network' specification - New CSK handling support in keymgr Improvements: ------------- - Allowed configuration for infinite zsk lifetime - Increased performance and security of the module synthrecord - Signing changeset is stored into journal even if 'zonefile-load' is whole Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Some minor DNSSEC-related issues Knot DNS 2.6.3 (2017-11-24) =========================== Bugfixes: --------- - Wrong detection of signing scheme rollover Knot DNS 2.6.2 (2017-11-23) =========================== Features: --------- - CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support Improvements: ------------- - Allowed explicit configuration for infinite ksk lifetime - Proper error messages instead of unclear error codes in server log - Better support for old compilers Bugfixes: --------- - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file- New upstream release 2.6.1 Knot DNS 2.6.1 (2017-11-02) =========================== Features: --------- - NSEC3 Opt-Out support in the DNSSEC signing - New CDS/CDNSKEY publish configuration option Improvements: ------------- - Simplified DNSSEC log message with DNSKEY details - +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given - New documentation sections for DNSSEC key rollovers and shared keys - Keymgr no longer prints useless algorithm number for generated key - Kdig prints unknown RCODE in a numeric format - Better support for LLVM libFuzzer Bugfixes: --------- - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used - Immediate zone flush not scheduled during the zone load event - Server crashes upon dynamic zone addition if a query module is loaded - Kdig fails to connect over TLS due to SNI is set to server IP address - Possible out-of-bounds memory access at the end of the input - TCP Fast Open enabled by default in kdig breaks TLS connection Knot DNS 2.6.0 (2017-09-29) =========================== Features: --------- - On-slave (inline) signing support - Automatic DNSSEC key algorithm rollover - Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0) - New 'journal-content' and 'zonefile-load' configuration options - keymgr tries to run as user/group set in the configuration - Public-only DNSSEC key import into KASP DB via keymgr - NSEC3 resalt and parent DS query events are persistent in timer DB - New processing state for a response suppression within a query module - Enabled server side TCP Fast Open if supported - TCP Fast Open support in kdig Improvements: ------------- - Better record owner compression if related to the previous rdata dname - NSEC(3) chain is no longer recomputed whole on every update - Remove inconsistent and unnecessary quoting in log files - Avoiding of overlapping key rollovers at a time - More DNSSSEC-related semantic checks - Extended timestamp format in keymgr Bugfixes: --------- - Incorrect journal free space computation causing inefficient space handling - Interface-automatic broken on Linux in the presence of asymmetric routing Knot DNS 2.5.5 (2017-09-29) =========================== Improvements: ------------- - Constant time memory comparison in the TSIG processing - Proper use of the ctype functions - Generated RRSIG records have inception time 90 minutes in the past Bugfixes: --------- - Incorrect online signature for NSEC in the case of a CNAME record - Incorrect timestamps in dnstap records - EDNS Subnet Client validation rejects valid payloads - Module configuration semantic checks are not executed - Kzonecheck segfaults with unusual inputs Knot DNS 2.5.4 (2017-08-31) =========================== Improvements: ------------- - New minimum and maximum refresh interval config options (Thanks to Manabu Sonoda) - New warning when unforced flush with disabled zone file synchronization - New 'dnskey' keymgr command - Linking with libatomic on architectures that require it (Thanks to Pierre-Olivier Mercier) - Removed 'OK' from listing keymgr command outputs - Extended journal and keymgr documentation and logging Bugfixes: --------- - Incorrect handling of specific corner-cases with zone-in-journal - The 'share' keymgr command doesn't work - Server crashes if configured with query-size and reply-size statistics options - Malformed big integer configuration values on some 32-bit platforms - Keymgr uses local time when parsing date inputs - Memory leak in kdig upon IXFR query- new upstream release WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble).- disable dnstap on RHEL (depedencies are missing)- new upstream release WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble). Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme Improvements: ------------- - Allowed binding to non-local adresses for TCP (Thanks to Julian Brost!) - New documentation section for manual DNSSEC key algorithm rollover - Initial KSK also generated in the submission state - The 'ds' keymgr command with no parameter uses all KSK keys - New debug mode in kjournalprint - Updated keymgr documentation Bugfixes: --------- - Sometimes missing RRSIG by KSK in submission state. - Minor DNSSEC-related issues Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Improvements: ------------- - Extended debug logging for TSIG errors - Better error message for unknown module section in the configuration - Module documentation compilation no longer depends on module configuration - Extended policy section configuration semantic checks - Improved python version compatibility in pykeymgr - Extended migration section in the documentation - Improved DNSSEC event timing on 32-bit systems - New KSK rollover start log info message - NULL qtype support in kdig Bugfixes: --------- - Failed to process included configuration - dnskey_ttl policy option in the configuration has no effect on DNSKEY TTL - Corner case journal fixes (huge changesets, OpenWRT operation) - Confusing event timestamps in knotc zone-status output - NSEC/NSEC3 bitmap not updated for CDS/CDNSKEY - CDS/CDNSKEY RRSIG not updated Knot DNS 2.5.1 (2017-06-07) =========================== Bugfixes: --------- - pykeymgr no longer crash on empty json files in the KASP DB directory - pykeymgr no longer imports keys in the "removed" state - Imported keys in the "removed" state no longer makes knotd to crash - Including an empty configuration directory no longer makes knotd to crash - pykeymgr is distributed and installed to the distribution tarball Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility Improvements: ------------- - Added libidn2 support to kdig (with libidn fallback) - Maximum timer database switched from configure to the server configuration Knot DNS 2.4.4 (2017-06-05) =========================== Improvements: ------------- - Improved error handling in kjournalprint Bugfixes: --------- - Zone flush not replanned upon unsuccessful flush - Journal inconsistency after deleting deleted zone - Zone events not rescheduled upon server reload (Thanks to Mark Warren) - Unreliable LMDB mapsize detection in kjournalprint - Some minor issues found by AddressSanitizer Knot DNS 2.4.3 (2017-04-11) =========================== Improvements: ------------- - New 'journal-db-mode' optimization configuration option - The default TSIG algorithm for utilities input is HMAC-SHA256 - Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor) - Added some more semantic checks on the knotc configuration operations Bugfixes: --------- - Missing 'zone' keyword in the YAML output - Missing trailing dot in the keymgr DS owner output - Journal logs 'invalid parameter' in several cases - Some minor journal-related problems Knot DNS 2.4.2 (2017-03-23) =========================== Features: --------- - Zscanner can store record comments placed on the same line - Knotc status extension with version, configure, and workers parameters Improvements: ------------- - Significant incoming XFR speed-up in the case of many zones Bugfixes: --------- - Double OPT RR insertion when a global module returns KNOT_STATE_FAIL - User-driven zscanner parsing logic inconsistency - Lower serial at master doesn't trigger any errors - Queries with too long DNAME substitution do not return YXDOMAIN response - Incorrect elapsed time in the DDNS log - Failed to process forwarded DDNS request with TSIG- configuration checking was fixed to be compatible with Knot 2.4.x- new upstream release 2.4.1 replaces old 1.6.x series which is not supported - configuration should be upgraded automatically using knot1to2 tool - make sure you reviewed the new configuration in /etc/knot directory!- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild- new upstream release: + fix: False positive semantic-check warning about invalid bitmap in NSEC + fix: Unnecessary SOA queries upon notify with up to date serial + fix: Timers for expired zones are reset on reload + fix: Zone doesn't expire when the server is down + fix: Failed to handle keys with duplicate keytags + fix: Per zone module and global module insconsistency + fix: Obsolete online signing module configuration + fix: Malformed output from kjournalprint + fix: Redundant SO_REUSEPORT activation on the TCP socket + fix: Failed to use higher number of background workers + improvement: Lower memory consumption with qp-trie + improvement: Zone events and zone timers improvements + improvement: Print all zone names in the FQDN format + improvement: Simplified query module interface + improvement: Shared TCP connection between SOA query and transfer + improvement: Response Rate Limiting as a module with statistics support + improvement: Key filters in keymgr + features: New unified LMDB-based zone journal + features: Server statistics support + features: New statistics module for traffic measuring + features: Automatic deletion of retired DNSSEC keys + features: New control logging category- new upstream release: + fix: double free when failed to apply zone journal + fix: zone bootstrap retry interval not preserved upon zone reload + fix: DNSSEC related records not flushed if not signed + fix: false semantic checks warning about incorrect type in NSEC bitmap + fix: memory leak in kzonecheck + improvement: all zone names are fully-qualified in log + features: new kjournalprint utility- new upstream release: + fix: missing glue in some responses + fix: knsupdate prompt printing on non-terminal + fix: configuration policy item names in documentation + fix: segfault on OS X Sierra + fix: incorrect %s expansion for the root zone + fix: refresh not existing slave zone after restart + fix: immediate zone refresh upon restart if refresh already scheduled + fix: early zone transfer after restart if transfer already scheduled + fix: not ignoring empty non-terminal parents during delegation lookup + fix: CD bit clearing in responses + fix: compilation error on GNU/kFreeBSD + fix: server crash after double zone-commit if journal error + improvement: significant speed-up of conf-commit and conf-diff operations + improvement: new EDNS Client Subnet API + improvement: better semantic-checks error messages + improvement: speed-up of knotc if control operation and known socket + improvement: zone purge operation purges also zone timers + feature: print TLS certificate hierarchy in kdig verbose mode + feature: new +subnet alias for +client + feature: new mod-whoami and mod-noudp modules + feature: new zone-purge control command + feature: new log-queries and log-responses options for mod-dnstap + feature: simple modules don't require empty configuration section + feature: new zone journal path configuration option + feature: new timeout configuration option for module dnsproxy- fix post-installation scriptlet (RHBZ #1370939)- endian independent DNS cookies (fixes build on ppc64 and s390x)- new upstream release: + fix: No wildcard expansion below empty non-terminal for NSEC signed zone + fix: Don't ignore non-existing records to be removed in IXFR + fix: Fix kdig IXFR response processing if the transfer content is empty + fix: Avoid multiple loads of the same PKCS #11 module + improvement: Refactored semantic checks and better error messages + improvement: Set TC flag in delegation only if mandatory glue doesn't fit the response + improvement: Separate EDNS(0) payload size configuration for IPv4 and IPv6 + feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)- new upstream release: + fix: Transfer of a huge rrset goes into an infinite loop + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL + fix: Failed to build utilities with disabled daemon + fix: Memory leaks during keys removal + fix: Rough TSIG packet reservation causes early truncation + fix: Minor out-of-bounds string termination write in rrset dump + fix: Server crash during stop if failed to open timers DB + fix: Failed to compile on OS X older than Sierra + fix: Poor minimum UDP-max-size configuration check + fix: Failed to receive one-record-per-message IXFR-style AXFR + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message + improvement: Speed-up of rdata addition into a huge rrset + improvement: Introduce check of minumum timeout for next refresh + improvement: Dnsproxy module can forward all queries without local resolving- new upstream release: + improvement: Log change of the zone serial number after IXFR transfer + improvement: Document operational impact of various RRL settings + improvement: Add support for rate-limit-slip zero + improvement: Add 'timer-db' configuration option- new upstream release: + security fix: out-of-bound read in packet parser for malformed NAPTR record + fix: systemd startup notifications- new upstream release: + fix: don't load expired zones on reload and startup + fix: remove race condition in scheduling causing delaying of events + fix: NSEC proof construction in zones with many delegations + fix: TC flag setting in RRL slipped answers + fix: disable domain name compression for root label + fix: check if executed under systemd before using journald log sink + feature: write persistent timers on server shutdown for better performance + feature: support time unit specification for 'max-conn-idle', 'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options + feature: add 'request-edns-config' config option- new upstream release: + fix: lost NOTIFY message if received during zone transfer + fix: kdig, record correct dnstap SocketProtocol when retrying over TCP + fix: kdig, hide TSIG section with +noall + fix: do not set AA flag for AXFR/IXFR queries + feature: new configuration format in YAML, binary store im LMDB + feature: DNSSEC, separate library, switch to GnuTLS, new utilities + feature: DNSSEC, basic KASP support (generate initial keys, ZSK rollover) + feature: zone parser, split long TXT/SPF strings into multiple strings + feature: kdig, add generic dump style option (+generic) + feature: try all master servers on failure in multi-master environment + feature: improved remotes and ACLs (multiple addresses, multiple keys) + feature: basic support for zone file patterns (%s to substitute zone name) + improvement: do not write class for SOA record (unified with other RR types) + improvement: do not write master server address into the zone file + documentation: manual pages also in HTML and PDF format- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild- Rebuilt for nettle soname bump- fix BuildRequires for systemd integration- new upstream pre-release version: + DNSSEC: switch from OpenSSL to GnuTLS + DNSSEC: initial support for KASP - split package into subpackages - add documentation building - restart daemon on updated  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVW3.2.9-1.el73.2.9-1.el73.2.93.2.93.2.93.2.9  knotmodule.hlibdnssecbinary.hcrypto.hdigest.hdnssec.herror.hkey.hkeyid.hkeystore.hkeytag.hnsec.hpem.hrandom.hsign.htsig.hversion.hlibknotattribute.hcodes.hconsts.hcontrolcontrol.hcookies.hdbdb.hdb_lmdb.hdb_trie.hdescriptor.hdname.hdynarray.hendian.herrcode.herror.hlibknot.hlookup.hmm_ctx.hpacketcompr.hpkt.hrrset-wire.hwire.hprobedata.hprobe.hrdata.hrdataset.hrrset-dump.hrrset.hrrtypednskey.hds.hnaptr.hnsec.hnsec3.hnsec3param.hopt.hrdname.hrrsig.hsoa.hsvcb.htsig.hzonemd.htsig-op.htsig.hversion.hwire.hxdpxdp.htcp_iobuf.hyparseryparser.hypformat.hypschema.hyptrafo.hlibzscannererror.hscanner.hversion.hlibdnssec.solibknot.solibzscanner.soknotd.pclibdnssec.pclibknot.pclibzscanner.pc/usr/include//usr/include/knot//usr/include/libdnssec//usr/include/libknot//usr/include/libknot/control//usr/include/libknot/db//usr/include/libknot/packet//usr/include/libknot/probe//usr/include/libknot/rrtype//usr/include/libknot/xdp//usr/include/libknot/yparser//usr/include/libzscanner//usr/lib64//usr/lib64/pkgconfig/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=genericcpioxz2x86_64-redhat-linux-gnudirectoryC source, ASCII textASCII textpkgconfig file RRRPRPRRPRRPRhttps://bugz.fedoraproject.org/knot?`7zXZ !#,] b2u jӫ`(y/=Z ygԬƿ c@S*R^4 mGO'IZt@+ NF>~#ޒ脾DkSǒڼSaQ6~= ׭ UP2&66, ~9"$UWƸ9Ĭ MMN, hWr+- ~YzCJ㣜HkL}8Cbre)N/)=|fszXCRmī쿬9}\3 f\?_]4QL>"AK, #A %-(J j Jg~|9[1_PyTNS`fD{G.~.{M^n1 X%Jzv/ 9IQR2G~E#-Y\Z`I19!MZuҵD Hy[W$(nۛ' wxeaX /<0p~RQ#G<&>xE< m2}R{:4mWv%S?c"cbY,r}'qm[IoFhPpv~ƻ/հ;i֟Gӥۗ7_b<3g[1@"FVM&ŤH/Q(8 5 ǝA\*:/wu/ `kbA!i NcWL&4SE!,iwpno7uVET:HnXKZcn4AƸ/vV 6rb9q3$:DB)fPh k]s$cB5="e5Մ%XtLUd?Ā,oY c43cAFymSx :TYn|;/,憵 @U~(_)4^WSS0J^ IW|՗ =\8C/?j-'݈}Ad 2NU)MUǓv|s!dU㷢ɳEĉ8-7%]rџmBBu<'B8ube^#U(.J|:={-2ځ4ZeAe%3~X6Cfb٠PNhI\T/dNp/8"/j=m^F"ضJJ0#6n7:)Jj}ww:~%ay&-(˸qe"ML*Q)*Aa"*F-1tAF~vC7Y`nhQm=SctdYWsDi}_vLZ*܈)(Ȓ ITin >}Ca^Ě4my+D$:@QiUXLٓ w Lf0P~ir h&\0,%]بy_.\4ODk}D: ZiƜCN"Ss#A{s;ˡ"HF#dYf_-ptJ9OފN+K(Fȹ5=4\Q8N/ {5)"kϧ5b#V5L"=% oWü--G;5f~r4phUm9t'3`?f`^ݔ qQEh4jCW ;&Rb[ S(+qN|nFj,|(xlI{x{3ru13dsUJ {CE9O5>"Wl˫ *0sӾr~Bo{U:hbB)Ap[=7|*6wvƞq?LqU`p+F wWے`7cF-)2Y J ̸̾_<5PzD!=d#iz2c;--+K(fj\鬙ޱ )ugl1,]lXqtoKx!`~d_Ki@=מk{s̏V48 иvOs7,NKd`@ߺ7n ?HL8|6.ͫ-.BR~{%_\:GG,C㞒艛gG#q}nxJ iJyU{;AqPtI*  R#x7D% Z0=OYa.}:z<ZJ3ɒnip<bax.J `X>g֭?5F,OUPs~um+{fDM?@43Uߐ$6vYqΏ7-ogC%$95sq1'6T*6u[cU_ &ZtSHU︱swBP1b|"i vNK3{\ͷJk8hC}9Ek;ۗJ~q1K$ө@rS|A*z_OġD}psC\6!%o?&jiibc!70ObDz [Nzavɤ#qǭi8E,0lSk6"%ғ({3}"m]]~lfz ٶJܦijϱ~g|WD$)bmhes;BwŢ!ԀC9^7 pLm#0}W6F"7%QqiDf欬pUA42o /aU֛Mtћ$YsLzO2(DBȋbcצ~NTE/~Lik^CʲOu(^m&L e o]!Z\{Qu?iz/ρՓZw_Be)I<P'\`oZ@í-nIoxh ll#g?oVX-df7~mMM _fVmYrdhӧo/'mBjyG~7 sI0Wg ^lGwR }NSp%Cʲ o=I`Jl[l |t?;lKT*]g$aRكg 2Kpj)\sf6,̥B;N651z(60 浗2m!c(ml%,"^HbOY~B7$$5!9km1WY= Ǭ=Tta1>M&`,:?k! I'h?8JpLJf*w> ]Rx?~{?OUoO>1;/$Oe7gpa[`蹮.VZtμ>GWӼE%`fP_''.[ϣF́' 獌0 / /(|kwt;']F ~2 0_"K*y8هZ\[aq]qBײݬ/orssٲa>K~;!"3WDqtA tMF*nBP %BEb4-/ś]nN^-7s[8+Dd61sQ`<ށDdG?WP*eYf8,`5Ц˝Z "es ZVg2^ =I30Tdy!.4sc%ӧu4p oW-_մO>D8Țh 79F?c,?90۔}w˙s3vG,cx,8{4R Oz2 3ѭp,t(`:PQnhH*< ˛>|Ħ.G 7z(\Sٟ 6tIa d#)эAo%6#]4@aԗ"@ƆTh#],8Z~X%H.4$-9fknRXx#kRo@{_9],£PԐ~1 B(|KȖUjhIOn1%U-7c,nۓXi0ĻXEP0#MMgy;^ry9BmGT տp,C,0ܐjz>;bVTut޸:pvd%`IbO\'O-s%HleJG'XNQg? N8`qoKq#-.6 a@>[NgڃCbxȊWmkWP=xg9c}"W :JQFc@?=TvS*PrUNUZ&KS)UgC''-vagV[˝ M0.&7stYmSAw}Jkv u j;b[/38ڤE|YʰW,?Rbu5"x羁Շ̢y{86n;rl~yR 1lPA۞RIx0,BХ(u@%6IoOF1a ($z E KqhM0wâ{5aYɕBL?YnFcM."s͑c=DjO$-URP-ͅe$z\kո:Gq4plitΕ.9U_bX6Ԧժ̊{9H{'Mb?,,HϑáptޤYGMHP6ƼsSÖw%j|<<+ MmRyv'U>R[֣Ո{\ȤW4(!ݽr\lQX1Nb[Lc\̌w!<|s̏**+0 9nJŨ&+k QL]=R:_ѧ;v,\ӫK l \Ae).<ܮ/ I؛iUXQlM q[WH GwȞ`-3/ k=={-D[;HYx*87Ѯ+ΑJO%zY'C)HE1^+ѯQA[[kPqsۓpOjOL8JHh\\b9;! I*?nY/7?޵` p4ik\[xlT=|! Y&lM}w0=&B.58˄8SX͙8ܧlnVġNPvJ|C4V7qRA$M|GBBǯۛ#G6az;b$qN( <%8/߼іgh!Xz[BEҳ8.+<Fdmj6:wn!AkYϙq[G>Z} ; x{MJvYXH*\-z%POee7gy_+ vXh[u'ʁ"=3'>\NJZ>r*0*AmO3XE 8:ʮQkDNgYuӼC08šYX {QW~@7тݮpF 2"sY7Ujn}~rըsl| MYz0t?@!fe`$UZʵloCc[yJ[Fۑi`jbFpRFR1X9IfʒƯqy{!]-jQ嫁>e.\q* 1DW{=ѮctaO|2>ŒZjNgH `2R-~Y894~gmARNه|[ djGJ nKZ J^R; vx[z[\(B]g0YfXG.zSI Fkp<lG6o@@ J_j땛S?]~$b9+KGP`tBY4@[HB[gȓ RFa~|J]^K:m31ܤ,P6T$Qd 8Ժ~.T={ƨu9$#a"6a!y%12zw.rp{Bޣӯw?mNo]Q2ay& ׆GeJob LM F7Pǰ~oGl@S<IbBLuλ%kp]x0H?.L%*wIt(^y!І5LP|sм_qHaw eKUuIףJC\.(St<ĈתbU¾۲>GG2By[ {oK@`< i=`lBQ+kH[F=3a{άX M9ͷ&Rmɂ:!xi hdM?L r"`g?d-?eXX%z~;;;?KF2e x~<F6G~1 eޕYuo X]|~h-ը8K _M݁N?Ǭޘx(3L9o _|H3LJ 3m)uwڋH*m`s?O\D cx?*r< H~_,ggTiнFGqg,$[q\bJFzm?kaP&P /& za jP~ 3y!(ԝT)gJFmV:N7j͖]_XġBqRԦSͭc=HQwCe(ܯ@WĘ:fK~?tnOIHL3&m&!NR0t@dJ>03d &O pcOz,m\|L_6jsD8|> 㱛 kh "aKf_'z-|SgV"|6_쫓BCi\z 1"tSxD}LUXCRX?wV%Bd>qOdؽ6`IG@ Ѩ"IkAF7NccۢD0q-޸ŋuKjH?ޖФs^k+.,Y001Q[q+a\7*޸+ZT|-rl~fr[TWYN0d2FwFVAGY\u" DbYUBR A2RC8>rŧ:?'&+\9umd,w}GxwFqU/lyۈ̷PY7"P$ !ƀ"2z1K-.yew{r@˺-x^hrwV[YI/tS#N]Ojߪ>CK)j<[e۫<湔%36>pO, \~FHa/[ze:Fr@0BcO\"ns.רt0ㇾKuJ 2aVTyQᲴj'cY3\/Jh0}pDq7E:fj \<-d@v3ddPSaU5glÀolU҂ rFL"5ӳe]!phz(d M8 acu=={T~  w;V'ҥjv:鸃N07v"b[4T2Lx$  Na+Ǒ<"*8·%[V^,V= M|ؐe3q|o 缞p༦!R-_޷c5=͔-o$LP\M>9Hntr#ZHCH~z@:|奜Ctڝ˿SBMwǀG7x.fr.qר8<3a-9aDzԤ[Xpgtkqlj2K/P x|VT%{P##&U r\9)?řG=!t^lēS•%A"+;!q!FmG}wt+\TdL swm$ب &AN"m9\Q8X*M7NXvqfBa).ZrT)8 ~=99uϩ# 鮦;eـuG1 Ҟ9ιS-<.l?sau;ɂzEӯTsiߗ &WTxpޡt%wڒEeUU|8Q?L賒~@1^f+K=3P> r]49ٕ_O Bx/%[-u.IA ے@QDK/*GyT?#mr}~P|3$!qNG`Gre~*0 D^sʌjT%gSĂ uK2XmHI>j;*|ƕC3_lKY]ݶz!ƞf(6NOwe8lx(g(F'JqR5<:v5W\޾JXyaEW 7:X&Y]A4yp=`ؘtMN@t9ט# u7{Vz4ۡ^%m\% 2i˜pd)m]bcZ~sXz~).؁x0x.+wݾIV[}CEP5/VfT̛ՇC9U`Ntȏrd-d'RH07Yy;UAda`_J#VK`6j)ᑕ,y2޻]O+ij P^4qjz% ;k9EFQį ٴ#Zu=Up񓶞VחÂbkeh>h",-D &`$_C3A%@=`C Z]^ Fî9u_{z<29fm}4TͧHC$U gUl3cj|_w  [Z?ʓFaJDUb#bxl]kN2b/\8Q[X^D aeJy ]N;JqG/sܣIsjmc2鄃bEcPS&w?<3[^ZT?bfeګD(?Y8<d\ 3AT2mn 94bGK =r‡4XM/ er^Y.NhyBV}yGEHըVqΔ]m9tdnqNWTOhF/)rԨk# z$+|8 D4G記)MOb:0/#_H׺hXy8㳁ȁTOY֨ZWl#A*Z͏g][=S[q|f{V+dYH%BOhVzCX;\ht,O؋&ʅ-@^xibT;z^/h`~QHp)$(2Ymn .+;uxtϮ59O@)YCYm**+|k7ZT__7,A$m6&*FkҀ׮J 1X \aI<"ܕS,UiAPqA @*/ӛS@C3 .Ğ:pԫ)QZgtp%Ϊt}}{'ۉ1f{CCE*27\ߴ%*+xO{t9,shL}5L 5KCvRoͺ?/<&.5źMt=02t"i&MԈ3;|ۅ L\9vxp/t&° iSdeQv }zƠh7 }̭WzHۅ:n<ǸwBMF("$ -{Bf+6q ZO =Wc&i+^REg\Arhj!_Κ8#DMR-1>sEmS7GD|?y?79jPYMhiK%)Afnj]{=D.C!>f~E&47o%A{zu$y!Kٿ6=Cvq\YODSC(TY2 6Xe9¥@O֣w*-_<0 904݅6MF<Ԟ(is~"0 HfG)au168O/Tbe?zU=*)zu0P!'VR4CiǻvQ)&狟\K*##-h}m3TUoihUJF-e}==;G6FMd}q̴K8OCaBK$ }fKB?ΆrkU@/+)JbfFZ/N۩yssDF qrsAFn P/v=G*BÙ{)U3DO 4})߶at%IoY Z dhFd)\|lq?t\^9ؿb54%oD/ReT#xoOoZ.w1flnDoҧ?@(gÏm=FFqB!;,{D}?vwfϧu ZOxHr!(D@Rg.]"{a0Hg(c9E&,Q۱2YHI1rP TB"?ΞiM[R]Šp#-(OC*4ԞN^8{Г)嚩fWKEF*^=$>'̇ >թ8o<qE\r3Ө5n05-xƠzlEqѶD~޾$`,$\dhp@|E _)HB28t-4)_ lD6Usu&>]Pd@w1pu, &WmשIC*A!Gdz0leç\ا_bpeZ213?f!XyCqgnЭ;Ţ-LJ s~x[jU&g_Dc- C V̳A3,'rA% "OgqACK(qTس>,1șs굙J#wpNͯpIBeM>uN0c&e1SK1Cuh: @0 y>˿PD̥$:[UqD.U)5,!nX 捍=r~X+%g|f,$ Xf"pW7ČU?| n쓬n%=N}o봱q e9I&Q:_饪$aO du_A.3QyLZ< ՞ft 9qA'dN^? XFy),!y=1ws .8Q`!^\p"“45..J7TLQjh:?3Ppr(U9<" p{hBlA^CKDu`5nh;YM/E Pa0M%P;iʖqk!;(3gtM:F&euo:n(HޑOWtcRa֣9ܠ\D:P &,PBZW@7|!:݀qsh]9 !a9F g\a?#ht2lV$j̢2zQO0$,%N P3Hfn\ DЂ!y3t[ ycØ7o5 ;?Lo-1I0@YuQPu.@q^s.ItNjscČGpoq+s+>wHS%1H8ӛܖܛ(,;$N`-D 5^kTriLNOzixM3՜15xX|Edظ8pQ(^-_bn&c n5)Y.[oZe0]]l<,+Y42•FBuĄBG g k 0ZQqdEֵzI*7$",@%'z!3GUlVu~.RGE34ZKN(`Scew͗o> 6BkvK~\ᄨ9$DLd'RWH<&%M]F소90޾A%y VKHMD ]+B(l)6f㽃ѥB^G#%';Pn3yθۢG3rELr28;Y+(cKCڱ[ލy0v6:w\wąɡKwATGE,路 9U{vZu8m%-VZԵ[㙴xˈ^0g 2h;)V҈@isSj~q엔͢N)մpB>"~Al~#m=}+ |蘳ѣbu*VjDhH&.C!/wWC=ZӮ֎@ tH'I4kMi1YL[jd(JF\&o'U5w'v1@1i V׹_3OXpfKhM9;ҨoSvr{px Qlǥf8eL#/qhoT#G݋fkJfaˡ$WO.q1,G%b3* CCbi/JZ:`˯w鉯$^p١AHIaDie _&=?PJG` · l5yLfzr#3Xt&D o1}~h>%жs1r_ rR?PV;G1FTqvjzF KEݵ\a lYFqQ4f<^_^⎜lwV3 *P#Tcm{?BAeq,` JBhk 昜-)$b6T»I6]wZRzOf$gH)ppv^5Z_+Mk ⼋i[h(Nx[խ 8=J {HY@,~#"1݋t¢k,Pz5g#O`$AZ*/>|"y!!a[b(Om،<;RX-57{\>{3?6L3xL`3 cjͭ(dTek6 c(s(>G﹇#h!yQ~uS~2=kUyRK_0D΂՘5p23*S*DM 1<G9%km&4B;(yl[GU['4fGc\R d]2>Yi]xsr@nTcQP#1%p""Cx+SxN }t \L3?8m`Ii`jnW3$Hr F~ccc+#, AUF:`3ZCߵ1gBI6wĮ|Gclw ln'\rۯMvtxng߼ݾep^?TLXJKHUJH 9 W` Af=ҿ MP}ksnjjEUz֢֬Gcv llA}!LW&dnՆqH@(*!~Xq`4Sz }st 2/IN Rk$CiQ!zCJ)H xXL1M^4!U+d{v KUkHbITw5=e[< {WCQ?Ț]OSX$sxܶEȤ!J߳V"MN%>˜<#$irf1tz.= oGSkSMJ#X>=zľwl`)f̂-A,Q MfP_\A_V:լRAb"{Mͺ'ƳH} \2hh& 6X?]CSC~Ibi_ͲsE3;{|\30j7E֮<Ҏ|F@7'+.R+/Q =u.ѿ[`0r.@O9eA$G{֨t"j ᕜjT꟟bDQra~YPv١Vy8PhY#pw'<gJAV.dWc7zs_+MVt3' Jgdp&ߞ $fcѫ-j#ʄ W,ܳ yd50y9kd'Ԯ D29Ca_f껷BO#UKoy}Q f@[uPK5%]f-T(^ IvI0}O;˴֦ꓔpd-UBCp;+_V$ܝ|7LcGKJ>[sea{NOQM,^7*u;OCu5{.UTN&sY~ܷ:3J_tc@kaeHQ09F D^ ,|Tyi$V3(KFl< vEG,8L}V–tFC_yqAĽ&`KyPR ٩eP:è YEբOuM@oY2m*<]dh،a63#ƾߠ)h2Q޾3"/7K&l%#S=L$WBNz aKl#F=kbC1\q6v 1jrS1(Ԗ: q 4]8@C)]l PT8ϔ7ć_]{D7^& Qre$TJgfY&-^6YƏMzj!DEm;lnNT|qu/"rGGJw8. ʸA]QToa)eҮ79V^Z9 d>Pȇ;r /v֩lzπm$on48ZՑ>qwb*&KKlɐ;9eX2yx ݦzjg++l+u kS;gQbwBx--+ ßW@.YL*BStPù9<䈞.F?L9>l407J.ǰyP)6+AcJȷcL\ ڞeN6/;2A¶j/)6wc_'@K;/}ѺP= ;F}@rc M"q>Uz42$T#L~NdZ{d{XKĞDw[ket6Aa '?B,k9y(QxwCY٨0vDX VY xF>~*.u${Ukr}Nbg՚%Xɭ\OS֑(1\XU֧c)e8.%Ii`46R\r5)j7oIgNIP5`O[_}1ZGÕRAKvR<#3ej}rM^h' m?RGy 8E}Վbgz cĢg{y 43*T,EB4ba%btU$S*^Z\ؖq쓃MCh3._QWe“1o?{Sos:DIz!b9{[_{^W[fyLFAV?-ٳ )^Z5۩azGdZTQz3W">vv`Sq\qtpDs f"2%6r}S'ڨvm{q&*$ßähHN{@6k3 n(߲TKA0ǴegBv%>\hףNgvϖnrWж#G׫jVП0#`cπOZ=NiY;] d_OPB{  jSG\Z'Digt{wO"T;}nQ;UKUb4n:v=!59zZydAJS41r\8(q15,G[hk34UFѾWoTxiNɍb6L fYiӦ6J lA> šNT*1YUFG]lӤb<{l '&=ȯOu>XPC cyf2꓂{%+pZڹ/b7`wZ,L`.aIdы&V:~4D$/Q|XbҢ#}Q'ސO\`W{V$b)6FsI=@55wN/CZ &f/Ogyne(;9 mGr]4D Bnw{h־$=pƮlxGo~~hj$0n(W;(|e\H,qwo}#Dh*Z.-wFk(R obf2U^K,{Dް+Swv Hfk̗2b|&ͪU /(iصo8!ȜQA`L>X-9*<^#'mfi1t Rr(|?,(Qz> ) Ѭ\zYi>>{%kd( 5vK>tZMN\A$ #<Xӗ\)Fy:*dX1LhC=zh[F),9tVDFrP*XQ:NV,mԨvB7ӞHo?&bTn,i&m ț?^mwz9^7iМwwt_1[e\Ûd I>9Rj9F]6inG2s,^[3iC^ܙ8uc͎+MI&g&kC{h@+[/G5@0H|H dzOigJPvgef *Mȅ1J:u`Ed)/+=C{khx8¸-D`ˢs5NJ9F;9cBeJ"WTs>&G>I'Mۭ&ƒ̋|<|@˿ǯAypHgB|aFR߲RH_Rm őO &TM P5 lo^K}.lwn}d.G1DѰ%lR w"iY+(qe@a9^R&  Mm(88ڱ:oNW9wԤЧ=zyiܹɽtBcE蘭/1D[2&o8ZDaO~o=Eů\ӆgwٺa%D+R *{&[wTTw.97<W"7% 2&P䧵 Aİ'Li $0*@}nbeo9f( &;@ .?rWL AF^JyFك!.T5pJeGxD.w,Ձ/dŪQ 4h;]3Q Jgys=_^W C lq%&<߸޾>|*ĵuWcE C?Fj&}{*(y}}R 5c^WDSF >^g]o0)ޒ)jE"k%}؛x`q\)!w'oL +T8ǯ]5/]5mV.V3ڱv'9"cRiXlMOtX𗮃׈8)E7=qp\PϊaoMu}N̈Ӯ5 wFn=FDmiUdCVOd /BObLՏG\7lm"Vi+w1Z zT1 ^~~R o+^ꁉTkYXnҌ0 'c#Ke=7_iuO +Z}:ID¬MӢLHxkƇչ3)䛹Tj JZ -pE)+zfk0ܚ.ay;V%7,PRqb-m)>n<1Bv."PnJgJ oJW$YDv7V1 %C 28^>Zsrʔ+5鏢5S<`.UaVEˮgH:)j-|`l1Vo'[ Q(ó_WzuNLğ`rTy@ EecQYae(ݼ{EpAYj ڌ蒵XINa(ddQj@3$8¶/Ţa>n€Ii(!ͳG|e >]¨N-󔯰ܠlILUpe3;KKRveEVhk{u[# K,Y|2j8y<+{Laq%hSE{Ei 06S"7^r\岘J"rwe:zr%* {XFצk`9T@Q?J&F$)yƂ_XPʽO's .0gJD4@6ey-i)F']9nb%3H?Ic!5oA8JʟmJ"zTBj@¤7w`DOH> z.^biu_ DMH8}& 0KWع̀u:I6h]!0a4|} 1|_ZMFkģ_??}Tq>8^fKx]5 S%Aܽ=DKYuoy}Ǥ]ƭJS&p{`jUG׮QC6Mcd-C·-%c}TpX|denf#GSkz[8@@]{;?Kgor̊9K*} \ߓ4Dজ3kr; P8(x.F lk&%7N- y?UПy B_۵ cev)~L%!C&5YhSdÿ7`]P4y$0j*ms"E?8#)fd?g1dpi͈i׼]xzS\Wb9rdӥXBŀpAjR2e8pg?KNftfI,8KU l /dqD O1ݶY:`lرH"*&?hQ&|qܿ_\>?*w{#)*CY[Rxm&B@f?fbfh4Kߪ8ϵM;6P%?Qͱ}ằ|?k8`#5Њ^_`n;GgN ޲1r_|g):G*oA)~ ЌJ6*.$IiEWu!= ~guC15 Ċ7JI-9{1x}PO)U^9#$Q<|;, 뉐O)w 7O2mķ `m;!]W߮UQ '_?c(\I}S&VBS[zMĄ)|[{B@ͷęucV3͞).b;:|/(]xAp=~΄qȘ\|V=5=lQFr-.aBM:-"01h-"o5d f@z~}YXf,a_o擄8l EصǃF}Z|zLABO9Kڵ*燩_|DQvB!MTop\b' U 51MX3T׫VG]Ɗ^d R?O[ wI:-C|edȻF{h`%\ vdM:-,θx$E~U+gR^ӌ ie@.Z]g7h@6ʦ*c-u%B~hRr/avwaƍֺ݊7wK'͕bs:c.XVGFg7%ZxӲD# :vSvk=@~aV۳˫R?)4 N^ƜL{7B/`'5#se)Wf7י, #䔭Wx\WrؚHʔ ûrn!i< q)VvP'<@Х_ ڛ)e^d^qg8>@|d}TO#ZV#nYZ}yۚ|P+茬CB"ЪYnbxNLQFf-R^pP'' 0e]aiGB艎9^dQʘQVDuȺ1 (:z;˵g2-~JF:c B4ets|zz rv;oJ~T-DCiX&~0cդj!j9o"ʠH8Dvp8IXA/jUր3w֧ь*̩Ēа C.jV-GUslcLpDzHl7ΠdFG+){Q{]Zcb漏\Q],T]˾(v!Mt'D:0Pgu`g#?^>޵Fc7nv .KӲ;~ځB d\6SqݱIa԰d~xUx(t4:7 r#vy f`zIHj1EyQt?#KI9I Po}w3O!f 5z)wbE.~bޖBѦa`+[yC^鞔{<j;i֙ '͉c2i~> I-bdv;"w#څ2 '(3:()ɔUL8I3 ]QVF<r"q&ILK,RA4 [YϮ፛i@Ien 4IX%^N ^}Hd* WkH?ns/GaffY@;R݆-z:58]6l:kk4]~ aU I9B#>s5Mڨ*H nؤ6{yYVl"@VZP]+hOuVl=y':&y{ṡldzSW\6Ĉ!9Lhf\!{6{%X7+XI.끢k&0D[dfRd wʭq}$@1.An P#YgEBt/=Wt&Ow/f̱N.m5/L՜,!1lBB#H ó]' > mJ1 J(*W|1pT("X=yQFW#LZpr5_iiVt{tɉ&?;`S=Ju[TQ!M社lf['sl?/D*A ݆EBnB=sNJlZjɯ@HR !؄cO6ݳG+]m mAo .G""fd\ҪPzt/|=S&& 7jeq'Wx!,Q*]aZ>w?öo+cz穛6j:YfҲi*ͼ">"#Jfnwnnے6[fbv> /je+{jm9{YYe]ViuAxTNh?頦:"?̹xh[ -xWX~HLlq@W]nN܅J@k.f qSTy&v ^@0fxvit }B`GEwGsaWorE)\qNjQzv+l)` :DK"nj9l6s ;ZذK.OP(xbE40e7 nYhh񖳡;:M3,q5|P*9{X ? v~% V>x<4&[]R]xM8qQΎ7Mw(jeZVq)Ͳ3<Ǩs>LJ W#'҇|.o0Xh93_{FGبFg=~aJwS`©Mb8s+TQv!/F8T',ވ`Z P)Y"6l0|o>Ci 8 M}HIm1"n}6yPύ2h>,MtwǞ5L^߲uU ׼'ھ9$7M:e_P8>/?"y$IL=92Y%~vwزr?yRkm]^cweZyZ;lBzhb_6 /ab[NT'~ q bYE[s}< zK̍+ eM&,ҤƏ\&8EKԸE3*o(4㳐Ni#>hXtBY7;Ym%%ے8r7# F\ <ߣo5~5~nR ރgE.R17xw) D-gڭqQ3 PdZuH^}U 3ic72D#}i]|5(~j8QC1X}*Ѭ>K}͞KLD P$ꏭ{{a.*mJЀ;}RE &⥣jw69c22ҧsK C0/p-6Е@D}L7`&RK}JX9ǩ _}Aד<ŒF46Fv'~I[ j@VVR^*󜩶h`p99;R>̋/y,}eWɮڕE?r0JpĀo8ν&^=CIۄ8=<  Xw6tQllV`n_syݳS:ՔhKt9Ӟ}آh]~wyU$5]г-n0~6:գ?jmL_%pDxƒ_]gQ\ޞWr>'5*AU*ut؈4>@ P"4e_42'%ifCDog@Mf4c뵘2!'D/7(y(ǦT|ٴ=+ լczܹVᑳm=JEʦ>%ɰqXJ;ڥ&S? }bX߻z ?Іnţe ' lbv k6 $л*mԯ{eA).먜~_Us ϮZSvyI\7'*q r|ΫC6s0-s -μq觻TnV?Hxή &u9!d@Qy3tI0a\22v172ԊUY.ÈTvA0.49_x?B;L&aHzqrMϯ&͟vk!T>8zG9gf"J9࢘:Վ4 }qD+ylgt*CLy# SO7K@E{S36j6ўu gBiPteHQ{C!NXBnvlkM&1tZ: SMPMCSXZ,P)uY֎-#N\n=s쉸vv Y(1tKi2 GSaqa1ԘSd:ΐz /ÞƏpN#4 Ddx ڻtgtے+\HR7ȗgb s٦rdRHx얧uʎal5~w4 .t[( 3i%!ngůATl Ok Jw3 zSv6%5L"kUO4gJo}9<@϶yiQ+<鶼]eY.㊲t>Ic0{_U<۷oa3ls۳p<.h퇡+W:8W{I[ߛ{vmF3t dkA6[Җj>Kwrh%\3͡NHsF(Е> D:b0 sY+ͺ8edBbzĕ k[Ъ/ .Łޮ cŦK~ЁAz"׬~9l:7DȌף:Oġ|)QUg`Xȭ1"i^PsqfkC~:!@DÀEee4^+%|ӾxxQ a-:CRY.e[Q #lJUJ󞕴._zj΄&[phi[#Y 8ިmSzWg(/i=ѹ+o7Kv(:+VB1FZ4V dӯd!^.uvF^iAo4H3Hsp9HR,.oR,a\#=W&p-׊lpprEuQ(|we>OW}dԳ fL=E[׾lO(m#eHk-) оFXj﫜37Jky7h/7A!h)F !uQoA!n?ccV6]"|({߁`~QpD3"`y{t vYsW@n>[O&Sx&6KhdWXZT&rݧmϺA+ $mEUULTpQLDsMQi:~!D׀IZFZuHJ?_(#9IL}ޕoLWMgOlRMN8y+K՝Dzܠi_ =%LDE- I?s8Ud>k:13 %g 9mGl/9 ;=@ tkR{.$H,.yS=L蠮ysV q#v]D3\g@{I-!^TYr k |qgi4[K +0wDrrYx-`iV 'aoVeeZy/OY] SSLg#喎Y\$IO)"غ !D&0iID([gs{e/j6+Wr]MFsտX7F:&7OW!y{MlYQC)|'ˈtO |%\ٷ\+DˆK23 1%)@0!'cOaΓ]K1^2ϖKq;Ğ=賰9'~}A8ԗG,lNSJe /3+GwѲNiw!=8bk{nCjx{c8.ɵU/R EQTap k.!lDP`lp}{tie@;^_՜D} ؑ!,"HehyZ".GU]sA_[}`\,]7/m?O_;J\!16b#O8^0%r Lm}Pg0:'u)' _9bvyժATLf S=qx3B>gO_$xǧVA^$r^FNu)eu>uQؠ#9/1BWS ڈ6l/o[xrYf v.9<'aiK2ndžˆu~eS hB-*b<_`Hqb u_!$)!gjvONP Shg#ړ`{ֺ4PX \9=&_mzfᔨ3*]MCr }.K h3<ۜD4K7yE(0w-:s|.<~G|\yt+33H*oddM>9Lay$|/R i٧"W p|!1'=+8gkۀL,-8Rv+wբo᪍Lgo}F/V?4clۦ}\Wy̴ouOMNVNaf&J|YLjt"*_b:KF{.vMܤZ\D˅9 LFXcd x%Ey-8Ia]`2>Xu15-h>!9#[w w䔄/'莌,T+! h$Skʅ+7yT9N؄, #V;QeT; nK߉ud>8fS1|W$)u8`d809F)=n8sd8LKH`vYo*A'=m@MňuP頻 }FFA;84x{/mĹn`xNBas}j_n.ޫA~ y8X }(!);t!=t̘ʔ{\/MVJ7ĵwi4}jvX5D  7M͛ }INS7E6B<՚ إUKR~A1$ֵ<7KQ\,='ň I^l ּ>{W劯gl=wq#{$Dl4ceކ|Këa5 gK2I`C-mK_}B4W$]Fnyx j0`zI= 웞<se֭1]ڵW/Q>E)[aue17CcHNq"$5'O/Z ~N R9S/UHG0Whg}V?Kcu1&)x'$mG),ֳ1I-b9tZ}hk¨&nC$ :08Z.ZͫtP՘/ {j0tx|X9N|o_.ZN{2.4Z!_?HjrX}rd }bA其4eb8p*7i[_FHz. yhtE0)L蒂2,*M84cm//m.ʝG5͠Wt`qwp$dXo5ΡlS8OXy{=hGJ0c)24ٹ:ME ch}xtk@[n5\*%^p̨z\nj,4fwhpgSFg$/~!+=T:F6grfKiu$ x[*b\uv:1#Ȳڶ/۴Qɹ-T{NUqޙEF (eDzZ[ąD1'x4mU0^wQH9cꮭYhȈyjD.Psx7ĶWmJy&gP1Ps6+Ikl?ݳ䓈1җ0tH]6|Qu>!D&_Z,Uؼa Z﶐e'PeOM ?mܞқGRP+9e/{}2kIM);[?*c1FEcl@"96w>A>=?Y έAa039G;X%6;+?1Ƕ*Z*%ܶ(p'4[AO|=K3CR>[(uvR!N}/Ym Lz)jXf:iCAt||ʽKZ3elID,<2u1nP~{YuMMbWT*L(d֪}5i^v|KRꞼi'Vk l(^c5*”\F!=w]GQ %55K3$ iekB?o %.>)%*=IS/F{ OԸ]/m>j0//=QE 3keջg*RzE! qFHzBʼn? NPUUw{*7IJcړLL};Jp'F vBeϱRc١@ά'ʳ\lKazT+508c#?ՁZ!ɋ) 뚉M?l7{=~R!C#50PS,DzS uz1藡2ԋ f8)QnV`%}צ{|07+bDplIL8|4E }Fn=!}Eܒ(9' wPLpgҁ HqA.]  :5)#]`NX|v;QSpA/L l/8>KMWj㩬.0Z* ܲ0C庞R6]9j1WCwݖB4SKu²wxpaU輸{msn8aFHl.OaۅGHJ(_闬er*z1OY rIih l9h4 D"4wa;5#F~Eb o\DZsxYQgB^+ݝWƫu--Ir[Ut )(U갃<SM[6،"aF@T쓺b pyy 2㊝f3or ʧ/A+`% p O!i^U6vTȨ;bB7uJg?nfxOh4,n\|}׃JUP% uǺFy+&[4,S|I% ^3h "jF'tUfΆrԕ]f6ΨokM/aETMG/W6ɜnQ 0յڄ*xlĂ`{+-u"ZٻR; ʐV c`I!2J/ 9+,ܰ&6$Qz`5`\QI&O7j|@HT?>pP&"l*^cRy:/۝NzvjW̞ ~1\V"-S<9<`<=s2tV_0r2OKG1JFIIT/?#@ iwn >:bJpC.O%E-8hool9S4T'n x r.|gZYKTRCFcZN-l}9q. ^MM#z{km.`Z^^bK)"q޵gH^b&wF[9$dd'8A֝iM9f*O"%$ ;I"R[|=ǸqnyXKL=[VOJ {p0>i b66iÒp[!J-3e0!Jun^smt́?63W˘tB=Ex'ޫ}+屜;6XT8@:E0C}<4D99v9R$>%Vg >uxh&;Cc/Y`MOj'y7pEKvj|4f]IGjnnfAN4gԸ q06Y:C@ՇK?ڙR1nY1˹mpz E2ʩTXπ0s2\>#Flⶼ#0unb,[1s(FsNRNi 0Rkߴ] V cs;ᘂu#,Ż-YNq'E"~NFqK|hr(iSjϰ|O5b+,o+0!Dae՘U5f[!>PPŏˏi>@P>nH2 Rgcchg9.xYmȄtT7ԏ o4~#LVj`Oʨ$$O|Y{křY`[ʇ(F{vE G3H&0_e#B[<\XsՎرNkBcKjoZ̼wOpgECUifGS]A!eI_Emdr"^FNׯG83g|?|r j>DgPTM(I7Ɇlbdher b[ r&q+#Gv櫺9,ITLz?a y_xI˝4\;n!ȫ+ѶXYm B 7^dၒ\ ī!bq#l+fpì5gmx9WrC"i[݄W]k}]l$~) 9'•40Ơ$6TCԑȿ^:*ȏ|b@bhDb8j~ Q3_vh8ކ=Pc:ǂjH18Xh=/jOaA|Pk;px=WnPŽ k _!CrN)SzqdNG4SvrϪx*F;hX.sq5kG{_$ڮlVM]G&Z=n]tìK҄|z>"^Be֝Klxq"BlmI>IٽasN] &P߬`l t]9UR5#6 Ц:Tӡzd!4f}#%xHCR' @Hŷs(pA\Ycp|%IpSS_s VtNz?P̍{ c:]A0F>H5qh3]biMXz/ݧq޵JJooCr* *=JjYۮq96HmWЬ#&x{%+g}d:u==x̻ϡ?,/Q]Ŕ'H+ Ac<>¡ {߲_5ls%|?_ԮV.W3Ye9-#W%r,q/sVjC,#aL>XE"% $e.d FX'U 6%iՒkV؜6ܧ*MD(pW|Pⷉ?yK=+ 1eEnN^^?T[>Ƿ9f܃\!v\clu9xo͐Dk 3WW}*=o f˂w';ٺ:/QjĜ8 dƳhD^ΠN8<1#"Tl RcƉG)!ɘo R>->'BWe \نZ@ܿ[:M$J{kϡoz*92CE̩[.IXl6璑~)P爕-u] ,%^^4tO?_ro8|1An2$&o%!"+^^Z[(qa/4@7_'y/J@M^^clCH[ٿAXfc/V:|j,\wѲ7Kܝ`xLv?~W[ ?(]W3@b|4&2ߺ+d;}uQ'dIH[O9}'$.LjH_/(%`}Ic Р$؆=+ŠWg׈TӤ]5۫v{[dv4V e5w5Ia=DF%k)d֧$^ݫ;?+A,|pEbm0Uy!&!egYi3.co9a"!{뱖/d(gC_8f[^T3>>!xiNM'y<# 1jPI\JXnxFR$2k 0 kLfޯ~1`?fJ3l0]N:YХNd |{[RMMEt&ٓ7UtͳyN'r/Ģq!̪M !@@2_D˖gjнr|)٪#N#%VZ@Xu*sƿ_"?2OY YQI7>R4wq5ɂ˴]O^o0qZXV.#{9lϾ8DcO*P{ZzU.Y뢝 ʾ0\I>5I4Qc 9]W&Sի;v75@ųS{5Ot?==ohm8GɊ[O5z,y+Vt;}ܹu&IDN PNjlOK\l$Ek<6۸ZEPp$/PhPN5sVqO ": .j&S- ]2. KN鄎n؅A2 {{H+%R( 7Y~s'ui70nV%)j'j>Vz \sZ 9$\fI5㠍Q|B9` U I)*r]x[YsNAOS1®IrE OyM(9A-=&o.3!B*=Aj8ghN'+5 n!W\UpWUwk;") R I.j~0 *NgjzqMgm=uQj.'xQa(6Ϙv[4H{6ywnr+^Scj*F%D'AT2e$Գl"H5o?wRݔCo/tm}, kPSeXZ7ئI48F̑V-##SlAȮyʩ@PSG\|:F/zeWR$7 Z3Z{엎p_{p9"g.H0 4@&{!ϴP;|=AUZ֚dqKzƽjUUG ;C|/Hi~^"sqogTE3OQ}TK}tI?eOoă1I'uXI{s3M2֌8a}цC(b ~r8OfT NƍX>3#,<`OQO֏PC=hvܓAyWgͩrbZxp)y`3b~q(&+3%k.8P/hãRtQGY?, NݎNsz׺ʕ!r[V#}VeؾcIZ#/B =T $g#܈tL+)%j^ḿK槫$/!:URMJe|MvhmŚ.*8jѼ}1KjT N{F.-$R\R/55,OFu>=RbR48::0 L Ό[!5'ܪ~ls8Q sHN7{<|9 v %hi <#W$_([r`ؗ'($ yc-A&lfQ2~A C~߼tj0 RψS©?d=[x/seWG|dV18 _}CB$)Zf9;QO'tHq(> +q6!ky9?7քWQtNɥPd6fLxDl,](14k4QND軺]ݔv|.Z?Ȑv5b٠nR6>;Z7l5 -^` Y ze t6[9TV~3ʋstpx5#^Empŗ ɔ'{)ݟVɈ q>vY7Ќ fL}^qd[P [vS`%heQjr_#%u=TfM9HbޠIU<3lC|L`rVV?ѥnቝyw\jjӟ#0ql>b>`&?:<빹OYA^89l:U@IN՚wQυN[9Dk o.8Q}6YՂ>gE ĭ舥צizO'I,5UpL9c=:mY!n*TϨ׷2QQGLg+fǑbV=|ZPAx$l4fT)2CpHxR[apg< 0N<gn.w!o8Է^&_' hZhj>D6#qǴ3L?"Lo˛~I6,C+42RΌn_( X f5 0zVYq1b%!RKJa(NtUGx//Xb !iU؜\5Wo}duha#r%ݨ<k@"|,$G%/ ZNMPtѾ8~ n;_^߸?X w4# IX'*;{EOeAzr2frˣTcД[2rw^!SA2( m Yxu<ΘB,؏C^~7jfx?]ک;l@ٵK78bOc5x ]xTԗLJbNk esH"ZQ9^M!R -YZ)$PmDө#e˕7IAҰW $CFL8rx`BZ'D}^\]İ fZ|z.:}'V:L}p]˷9*%4C*Xa>.3[RWk)feY'. ɘG`lЗJҫ:f͟G<-YJLB=`BdFB*V{,R0 cK0!r{D;QsNH鿿ΘҘ:fyJ>r,/G>@x@̸z4]nC1 &;1X8W^ |ʦYė QD<~SM g'y$Í$&41_C"ϣ 3i@-)ُVOWɔ+l?gKt.V;e3AVJG##W,jN\C!;Z./}XA4ua'^$, H37 YZ