knot-module-geoip-3.2.6-1.el7> 6 6`d63!}|J^>j/5,dd/ " j/5,dY7&G+}L֑ lwۓa&R;|Hq*8%5ubĐk(uW-9y*a>C>%h}vRN=?ɈovJ -.Cճ(ټyƋqq wi&84v}PFo5* ?*NaCr\XcZ;߿;8a.'JV`OV&f mlǙJ2@Ҍ6\J\~)WK҃yuC?sEZa [V?Qryŏ{+5fdڱ* *ۄ+g=m,{V6r1eT:MkJZ3ae ϰ/ {As:ü{m[ ms9CUb*{Ob"{M*í˻z@d!&PsO3Sd%ehaq.g~ûxBZ9K=Jg& 741e079c690dac9c50825bda531d8c379a488c73$3!}|J^>j/5,dd/ " j/5,d|N iYn'ar 8S i$UOݵ(U򯔏N$||)e|@TI.CEsV|1{U&ns&+YvGb\ߕ(ê=mvH\gs1k|0&}&ȑQ\7aK,Wx]Wnd|7XC.?|[P#P_69zץZ ̻ *b]kgw2m 8Ke>OfNފ=z`gt񜖩@{cy}|fO ,dvʌ^x}WDz.6"Y;2L6-Ϙ?E a=Ճ Ol$eh2*] Կ}4CJ!6_As<ZfEAE+gBRKF^rLYM,^g"$b͍Y& +#t)$"'͉>hdx[S r#g:Atۗp<3%j>:n?nd  : $( * , 0 q tx}((8D9D:DGllHlpIltXlxYl\l]l^lbldmemfmlmtmumvmwnDxnHynLnnCknot-module-geoip3.2.61.el7geoip module for Knot DNSThe package contains geoip Knot DNS module for geography-based responses.d/buildvm-x86-05.iad2.fedoraproject.orgiFedora ProjectFedora ProjectGPL-3.0-or-laterFedora ProjectUnspecifiedhttps://www.knot-dns.czlinuxx86_64id/u268b1b80774ac5176de677e5b786c3a62ae133f6084d887f99d93a9b526edab2rootrootknot-3.2.6-1.el7.src.rpmknot-module-geoipknot-module-geoip(x86-64)@@@@@@@@@@@@@@@@@   @ knotlibc.so.6()(64bit)libc.so.6(GLIBC_2.10)(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.3)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.8)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libgcc_s.so.1(GCC_3.3.1)(64bit)libmaxminddb.so.0()(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2.5)(64bit)libpthread.so.0(GLIBC_2.3.2)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rtld(GNU_HASH)rpmlib(PayloadIsXz)3.2.6-1.el73.0.4-14.6.0-14.0-15.2-14.11.3d.@cۥcc{h@ca @c*cobjbDF@b@aՈ@a@an@a9@aj@a @a@`t`9@`f@`c`@_H@_@_E@_m_Z@_O@^˳@^U@^^F]}@]ʞ]@]]2@]'$[ @[H@[E@ZnZZZZ}@Zz@Ze@ZNYYYXƉXX@XAXJX-W#WhWWV&@VUUUUa@UG_@T@T@Jakub Ružička - 3.2.6-1Jakub Ružička - 3.2.5-1Jakub Ružička - 3.2.4-1Jakub Ružička - 3.2.3-1Jakub Ružička - 3.2.2-1Jakub Ružička - 3.2.1-1Jakub Ružička - 3.2.0-1Jakub Ružička - 3.1.8-1Jakub Ružička - 3.1.7-1Jakub Ružička - 3.1.6-1Jakub Ružička - 3.1.5-1Jakub Ružička - 3.1.4-1Jakub Ružička - 3.1.3-1Jakub Ružička - 3.1.2-1Jakub Ružička - 3.1.1-1Jakub Ružička 3.1.0-2Jakub Ružička - 3.1.0-1Jakub Ružička - 3.0.8-1Jakub Ružička - 3.0.7-1Jakub Ružička - 3.0.6-1Jakub Ružička 3.0.5-1Jakub Ružička - 3.0.4-1Jakub Ružička - 3.0.3-1Jakub Ružička - 3.0.2-1Jakub Ružička - 3.0.1-1Jakub Ružička 3.0.0-2Jakub Ružička 3.0.0-1Jakub Ružička 2.9.6-1Tomas Krizek - 2.9.5-1Tomas Krizek - 2.9.4-1Tomas Krizek - 2.9.3-1Tomas Krizek - 2.9.2-1Tomas Krizek - 2.9.1-1Tomas Krizek - 2.8.4-1Tomas Krizek - 2.8.3-1Tomas Krizek - 2.8.2-1Tomas Krizek - 2.6.9-1Fedora Release Engineering - 2.6.8-2Tomas Krizek - 2.6.8-1Tomas Krizek - 2.6.7-1Tomas Krizek - 2.6.6-1Iryna Shcherbina - 2.6.5-2Tomas Krizek - 2.6.5-1Igor Gnatenko - 2.6.4-3Fedora Release Engineering - 2.6.4-2Tomas Krizek - 2.6.4-1Petr Špaček - 2.6.1-1Petr Spacek - 2.5.3-1Petr Spacek - 2.5.3-2Petr Spacek - 2.5.3-1Petr Spacek - 2.4.1-2Petr Spacek - 2.4.1-1Fedora Release Engineering - 2.4.0-2Petr Spacek - 2.4.0-1Jan Vcelak - 2.3.3-1Jan Vcelak - 2.3.2-1Jan Vcelak - 2.3.0-3Jan Vcelak - 2.3.0-2Jan Vcelak - 2.3.0-1Jan Vcelak - 1.6.8-1Jan Vcelak 1.6.7-1Jan Vcelak 1.6.6-1Jan Vcelak 1.6.5-1Jan Vcelak 1.6.4-1Fedora Release Engineering - 1.99.1-4Kalev Lember - 1.99.1-3Jan Vcelak 1.99.1-2Jan Vcelak 1.99.1-1- Update to 3.2.6- Update to 3.2.5- Update to 3.2.4 - Use devtoolset-12-gcc on EPEL 7- Update to 3.2.3- Update to 3.2.2- Update to 3.2.1 - Remove patches included upstream - Update Conflicts and move to knot-libs- Update to 3.2.0 - Patch: fix tests on 32-bit platforms - Patch: revert problematic hardening of service file - Patch: revert config improvement to support EL 7 - New knot-dnssecutils subpackage - Debian compat (knot-utils vs knot-dnsutils) - Remove bundled(jquery) version as it differes between distros- Update to 3.1.8- Update to 3.1.7- Update to 3.1.6 - Use _sharedstatedir for home- Update to 3.1.5- Update to 3.1.4- Update to 3.1.3- Update to 3.1.2- Update to 3.1.1 - Enable XDP on ARM and improve XDP config macros - Remove patch included upstream- Introduce a patch to fix tests on ppc64le - Use autosetup macro to apply patches- Update to 3.1.0 - Add missing BuildRequires including new libmnl for kxdpgun - Temporarily disable XDP on ARM until issues are resolved- Update to 3.0.8 - Print failed tests during check- Update to 3.0.7- Update to 3.0.6- Update to 3.0.5 - Properly escape BASE_VERSION macro - Include module dirs in main package- Update to 3.0.4 - Move dnstap module to subpackage - Move geoip module to subpackage - Remove redundant VERSION macro- Update to 3.0.3- Update to 3.0.2- Update to 3.0.1 - Sync packaging from upstream- Rebuild- New major upstream release 3.0.0 - Sync packaging from upstream- Update to 2.9.6- new upstream release 2.9.5- new upstream release 2.9.4- new upstream release 2.9.3- new upstream release 2.9.2- New upstream release 2.9.1 - add EPEL8 compatibility - fix unsafe PGP keyring permissions- new upstream release 2.8.4- new upstream release 2.8.3- rebase to latest upstream version 2.8.2Knot DNS 2.6.9 (2018-08-14) =========================== Improvements: ------------- - Added zone wire size to zone loading log message - Added debug log message for each unsuccessful remote address operation Bugfixes: --------- - Zone not flushed after re-signing during zone load #594 - Server crashes when committing empty zone transaction - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_RebuildKnot DNS 2.6.8 (2018-07-10) =========================== Features: --------- - New 'import-pkcs11' command in keymgr Improvements: ------------- - Unixtime serial policy mimics Bind – increment if lower #593 Bugfixes: --------- - Creeping memory consuption upon server reload #584 - Kdig incorrectly detects QNAME if 'notify' is a prefix - Server crashes when zone sign fails #587 - CSK->KZSK rollover retires CSK early #588 - Server crashes when zone expires during outgoing multi-message transfer - Kjournalprint doesn't convert zone name argument to lower-case - Cannot switch to a previously used ksk-shared dnssec policy #589Knot DNS 2.6.7 (2018-05-17) =========================== Features: --------- - Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung) Improvements: ------------- - Trailing data indication from the packet parser (libknot) - Better configuration check for a problematical option combination Bugfixes: --------- - Incomplete configuration option item name check - Possible buffer overflow in 'knot_dname_to_str' (libknot) - Module dnsproxy doesn't preserve letter case of QNAME - Module dnsproxy duplicates OPT and TSIG in the non-fallback modeKnot DNS 2.6.6 (2018-04-11) =========================== Features: --------- - New EDNS option counters in the statistics module - New '+orphan' filter for the 'zone-purge' operation Improvements: ------------- - Reduced memory consuption of disabled statistics metrics - Some spelling fixes (Thanks to Daniel Kahn Gillmor) - Server no longer fails to start if MODULE_DIR doesn't exist - Configuration include doesn't fail if empty wildcard match - Added a configuration check for a problematical option combination Bugfixes: --------- - NSEC3 chain not re-created when SOA minimum TTL changed - Failed to start server if no template is configured - Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing - Inaccurate outgoing zone transfer size in the log message - Invalid dname compression if empty question section - Missing EDNS in EMALF responses- Update Python 2 dependency declarations to new packaging standards (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)- New upstream release 2.6.5 Knot DNS 2.6.5 (2018-02-12) =========================== Features: --------- - New 'zone-notify' command in knotc - Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set Improvements: ------------- - Better heap memory trimming for zone operations - Added proper polling for TLS operations in kdig - Configuration export uses stdout as a default output - Simplified detection of atomic operations - Added '--disable-modules' configure option - Small documentation updates Bugfixes: --------- - Zone retransfer doesn't work well if more masters configured - Kdig can leak or double free memory in corner cases - Inconsistent error outputs from dynamic configuration operations - Failed to generate documentation on OpenBSD- Escape macros in %changelog- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild- Added PGP signature verification - Added integration test - New upstream release 2.6.4 Knot DNS 2.6.4 (2018-01-02) =========================== Features: --------- - Module synthrecord allows multiple 'network' specification - New CSK handling support in keymgr Improvements: ------------- - Allowed configuration for infinite zsk lifetime - Increased performance and security of the module synthrecord - Signing changeset is stored into journal even if 'zonefile-load' is whole Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Some minor DNSSEC-related issues Knot DNS 2.6.3 (2017-11-24) =========================== Bugfixes: --------- - Wrong detection of signing scheme rollover Knot DNS 2.6.2 (2017-11-23) =========================== Features: --------- - CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support Improvements: ------------- - Allowed explicit configuration for infinite ksk lifetime - Proper error messages instead of unclear error codes in server log - Better support for old compilers Bugfixes: --------- - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file- New upstream release 2.6.1 Knot DNS 2.6.1 (2017-11-02) =========================== Features: --------- - NSEC3 Opt-Out support in the DNSSEC signing - New CDS/CDNSKEY publish configuration option Improvements: ------------- - Simplified DNSSEC log message with DNSKEY details - +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given - New documentation sections for DNSSEC key rollovers and shared keys - Keymgr no longer prints useless algorithm number for generated key - Kdig prints unknown RCODE in a numeric format - Better support for LLVM libFuzzer Bugfixes: --------- - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used - Immediate zone flush not scheduled during the zone load event - Server crashes upon dynamic zone addition if a query module is loaded - Kdig fails to connect over TLS due to SNI is set to server IP address - Possible out-of-bounds memory access at the end of the input - TCP Fast Open enabled by default in kdig breaks TLS connection Knot DNS 2.6.0 (2017-09-29) =========================== Features: --------- - On-slave (inline) signing support - Automatic DNSSEC key algorithm rollover - Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0) - New 'journal-content' and 'zonefile-load' configuration options - keymgr tries to run as user/group set in the configuration - Public-only DNSSEC key import into KASP DB via keymgr - NSEC3 resalt and parent DS query events are persistent in timer DB - New processing state for a response suppression within a query module - Enabled server side TCP Fast Open if supported - TCP Fast Open support in kdig Improvements: ------------- - Better record owner compression if related to the previous rdata dname - NSEC(3) chain is no longer recomputed whole on every update - Remove inconsistent and unnecessary quoting in log files - Avoiding of overlapping key rollovers at a time - More DNSSSEC-related semantic checks - Extended timestamp format in keymgr Bugfixes: --------- - Incorrect journal free space computation causing inefficient space handling - Interface-automatic broken on Linux in the presence of asymmetric routing Knot DNS 2.5.5 (2017-09-29) =========================== Improvements: ------------- - Constant time memory comparison in the TSIG processing - Proper use of the ctype functions - Generated RRSIG records have inception time 90 minutes in the past Bugfixes: --------- - Incorrect online signature for NSEC in the case of a CNAME record - Incorrect timestamps in dnstap records - EDNS Subnet Client validation rejects valid payloads - Module configuration semantic checks are not executed - Kzonecheck segfaults with unusual inputs Knot DNS 2.5.4 (2017-08-31) =========================== Improvements: ------------- - New minimum and maximum refresh interval config options (Thanks to Manabu Sonoda) - New warning when unforced flush with disabled zone file synchronization - New 'dnskey' keymgr command - Linking with libatomic on architectures that require it (Thanks to Pierre-Olivier Mercier) - Removed 'OK' from listing keymgr command outputs - Extended journal and keymgr documentation and logging Bugfixes: --------- - Incorrect handling of specific corner-cases with zone-in-journal - The 'share' keymgr command doesn't work - Server crashes if configured with query-size and reply-size statistics options - Malformed big integer configuration values on some 32-bit platforms - Keymgr uses local time when parsing date inputs - Memory leak in kdig upon IXFR query- new upstream release WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble).- disable dnstap on RHEL (depedencies are missing)- new upstream release WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble). Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme Improvements: ------------- - Allowed binding to non-local adresses for TCP (Thanks to Julian Brost!) - New documentation section for manual DNSSEC key algorithm rollover - Initial KSK also generated in the submission state - The 'ds' keymgr command with no parameter uses all KSK keys - New debug mode in kjournalprint - Updated keymgr documentation Bugfixes: --------- - Sometimes missing RRSIG by KSK in submission state. - Minor DNSSEC-related issues Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Improvements: ------------- - Extended debug logging for TSIG errors - Better error message for unknown module section in the configuration - Module documentation compilation no longer depends on module configuration - Extended policy section configuration semantic checks - Improved python version compatibility in pykeymgr - Extended migration section in the documentation - Improved DNSSEC event timing on 32-bit systems - New KSK rollover start log info message - NULL qtype support in kdig Bugfixes: --------- - Failed to process included configuration - dnskey_ttl policy option in the configuration has no effect on DNSKEY TTL - Corner case journal fixes (huge changesets, OpenWRT operation) - Confusing event timestamps in knotc zone-status output - NSEC/NSEC3 bitmap not updated for CDS/CDNSKEY - CDS/CDNSKEY RRSIG not updated Knot DNS 2.5.1 (2017-06-07) =========================== Bugfixes: --------- - pykeymgr no longer crash on empty json files in the KASP DB directory - pykeymgr no longer imports keys in the "removed" state - Imported keys in the "removed" state no longer makes knotd to crash - Including an empty configuration directory no longer makes knotd to crash - pykeymgr is distributed and installed to the distribution tarball Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility Improvements: ------------- - Added libidn2 support to kdig (with libidn fallback) - Maximum timer database switched from configure to the server configuration Knot DNS 2.4.4 (2017-06-05) =========================== Improvements: ------------- - Improved error handling in kjournalprint Bugfixes: --------- - Zone flush not replanned upon unsuccessful flush - Journal inconsistency after deleting deleted zone - Zone events not rescheduled upon server reload (Thanks to Mark Warren) - Unreliable LMDB mapsize detection in kjournalprint - Some minor issues found by AddressSanitizer Knot DNS 2.4.3 (2017-04-11) =========================== Improvements: ------------- - New 'journal-db-mode' optimization configuration option - The default TSIG algorithm for utilities input is HMAC-SHA256 - Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor) - Added some more semantic checks on the knotc configuration operations Bugfixes: --------- - Missing 'zone' keyword in the YAML output - Missing trailing dot in the keymgr DS owner output - Journal logs 'invalid parameter' in several cases - Some minor journal-related problems Knot DNS 2.4.2 (2017-03-23) =========================== Features: --------- - Zscanner can store record comments placed on the same line - Knotc status extension with version, configure, and workers parameters Improvements: ------------- - Significant incoming XFR speed-up in the case of many zones Bugfixes: --------- - Double OPT RR insertion when a global module returns KNOT_STATE_FAIL - User-driven zscanner parsing logic inconsistency - Lower serial at master doesn't trigger any errors - Queries with too long DNAME substitution do not return YXDOMAIN response - Incorrect elapsed time in the DDNS log - Failed to process forwarded DDNS request with TSIG- configuration checking was fixed to be compatible with Knot 2.4.x- new upstream release 2.4.1 replaces old 1.6.x series which is not supported - configuration should be upgraded automatically using knot1to2 tool - make sure you reviewed the new configuration in /etc/knot directory!- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild- new upstream release: + fix: False positive semantic-check warning about invalid bitmap in NSEC + fix: Unnecessary SOA queries upon notify with up to date serial + fix: Timers for expired zones are reset on reload + fix: Zone doesn't expire when the server is down + fix: Failed to handle keys with duplicate keytags + fix: Per zone module and global module insconsistency + fix: Obsolete online signing module configuration + fix: Malformed output from kjournalprint + fix: Redundant SO_REUSEPORT activation on the TCP socket + fix: Failed to use higher number of background workers + improvement: Lower memory consumption with qp-trie + improvement: Zone events and zone timers improvements + improvement: Print all zone names in the FQDN format + improvement: Simplified query module interface + improvement: Shared TCP connection between SOA query and transfer + improvement: Response Rate Limiting as a module with statistics support + improvement: Key filters in keymgr + features: New unified LMDB-based zone journal + features: Server statistics support + features: New statistics module for traffic measuring + features: Automatic deletion of retired DNSSEC keys + features: New control logging category- new upstream release: + fix: double free when failed to apply zone journal + fix: zone bootstrap retry interval not preserved upon zone reload + fix: DNSSEC related records not flushed if not signed + fix: false semantic checks warning about incorrect type in NSEC bitmap + fix: memory leak in kzonecheck + improvement: all zone names are fully-qualified in log + features: new kjournalprint utility- new upstream release: + fix: missing glue in some responses + fix: knsupdate prompt printing on non-terminal + fix: configuration policy item names in documentation + fix: segfault on OS X Sierra + fix: incorrect %s expansion for the root zone + fix: refresh not existing slave zone after restart + fix: immediate zone refresh upon restart if refresh already scheduled + fix: early zone transfer after restart if transfer already scheduled + fix: not ignoring empty non-terminal parents during delegation lookup + fix: CD bit clearing in responses + fix: compilation error on GNU/kFreeBSD + fix: server crash after double zone-commit if journal error + improvement: significant speed-up of conf-commit and conf-diff operations + improvement: new EDNS Client Subnet API + improvement: better semantic-checks error messages + improvement: speed-up of knotc if control operation and known socket + improvement: zone purge operation purges also zone timers + feature: print TLS certificate hierarchy in kdig verbose mode + feature: new +subnet alias for +client + feature: new mod-whoami and mod-noudp modules + feature: new zone-purge control command + feature: new log-queries and log-responses options for mod-dnstap + feature: simple modules don't require empty configuration section + feature: new zone journal path configuration option + feature: new timeout configuration option for module dnsproxy- fix post-installation scriptlet (RHBZ #1370939)- endian independent DNS cookies (fixes build on ppc64 and s390x)- new upstream release: + fix: No wildcard expansion below empty non-terminal for NSEC signed zone + fix: Don't ignore non-existing records to be removed in IXFR + fix: Fix kdig IXFR response processing if the transfer content is empty + fix: Avoid multiple loads of the same PKCS #11 module + improvement: Refactored semantic checks and better error messages + improvement: Set TC flag in delegation only if mandatory glue doesn't fit the response + improvement: Separate EDNS(0) payload size configuration for IPv4 and IPv6 + feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)- new upstream release: + fix: Transfer of a huge rrset goes into an infinite loop + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL + fix: Failed to build utilities with disabled daemon + fix: Memory leaks during keys removal + fix: Rough TSIG packet reservation causes early truncation + fix: Minor out-of-bounds string termination write in rrset dump + fix: Server crash during stop if failed to open timers DB + fix: Failed to compile on OS X older than Sierra + fix: Poor minimum UDP-max-size configuration check + fix: Failed to receive one-record-per-message IXFR-style AXFR + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message + improvement: Speed-up of rdata addition into a huge rrset + improvement: Introduce check of minumum timeout for next refresh + improvement: Dnsproxy module can forward all queries without local resolving- new upstream release: + improvement: Log change of the zone serial number after IXFR transfer + improvement: Document operational impact of various RRL settings + improvement: Add support for rate-limit-slip zero + improvement: Add 'timer-db' configuration option- new upstream release: + security fix: out-of-bound read in packet parser for malformed NAPTR record + fix: systemd startup notifications- new upstream release: + fix: don't load expired zones on reload and startup + fix: remove race condition in scheduling causing delaying of events + fix: NSEC proof construction in zones with many delegations + fix: TC flag setting in RRL slipped answers + fix: disable domain name compression for root label + fix: check if executed under systemd before using journald log sink + feature: write persistent timers on server shutdown for better performance + feature: support time unit specification for 'max-conn-idle', 'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options + feature: add 'request-edns-config' config option- new upstream release: + fix: lost NOTIFY message if received during zone transfer + fix: kdig, record correct dnstap SocketProtocol when retrying over TCP + fix: kdig, hide TSIG section with +noall + fix: do not set AA flag for AXFR/IXFR queries + feature: new configuration format in YAML, binary store im LMDB + feature: DNSSEC, separate library, switch to GnuTLS, new utilities + feature: DNSSEC, basic KASP support (generate initial keys, ZSK rollover) + feature: zone parser, split long TXT/SPF strings into multiple strings + feature: kdig, add generic dump style option (+generic) + feature: try all master servers on failure in multi-master environment + feature: improved remotes and ACLs (multiple addresses, multiple keys) + feature: basic support for zone file patterns (%s to substitute zone name) + improvement: do not write class for SOA record (unified with other RR types) + improvement: do not write master server address into the zone file + documentation: manual pages also in HTML and PDF format- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild- Rebuilt for nettle soname bump- fix BuildRequires for systemd integration- new upstream pre-release version: + DNSSEC: switch from OpenSSL to GnuTLS + DNSSEC: initial support for KASP - split package into subpackages - add documentation building - restart daemon on updated3.2.6-1.el73.2.6-1.el7geoip.so/usr/lib64/knot/modules-3.2/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=genericcpioxz2x86_64-redhat-linux-gnuELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=0085603b9069bd3d23f3bfd0791b3e68b4030b3b, strippedR R RRR RRR RRRRRRRR RRhttps://bugz.fedoraproject.org/knot?`7zXZ !#,jM] b2u y-iSqkCQSnVt-?OCe>]UpC/ = p¹Q gzn]3)@ocb=2ZEW\BZ;/fP57eS6p} gI/60 6){6}3"|[EucVyjI ŃGJi`-Ah=<״qZ L~,VHh?thvWQEX*Zl `3:Ӎٲ0G1=f-nz(l_{(-/A aG#]xeNE[%SD!٨BD%j5$ĸL'8V`='՚p]B gi.KS#%N*i v}9U^á.&=o"`?^a~q"끐\J7!|N7jk>=!Ş,NYl3L_Y=rf3N((kSmiROMnyݼ80ڭOyJ-z )SqX2lnvʂM1j9@E3xFygyy|?jXyZ@A/70l w9`[S!@7ߦ0ȴ'7mɎJlҀ9GjfRkip2 > U4WчJ }H,|[u{/v,E?+U¡|UTڶ `>ZMGm7џ=4]>7j=攉>V68t|%9bFs! 3L3_ Q-c `VN[_O`#E(oFKF1m)^-DP{}Gڣ{}c{$8wf5Q;}hGr'yK+ P/1W~-ʵÇ~[^uEڸMۅ?T e]bd/Yxd[3 `qAx3BcGA@HքIm(G,U|1dѵ_zKLu@OPw)8Mhd}8|hbWŒ-P(zaRvWv6$E=f1UBƨqLUŘ8{A?5f2aWE/O]KFP}jZ|u[qeeޖZ}lކct%#9I~>v;I*Gd/Bq^/ܯM:fkLr?7x)aɹotyx djAbOyornV el$?qkWQ -lXóh 50G)KGXFva<>!Z vؾhLlO6}KBK'"עb>mߩ:Oc/,Fb{% ׺~aȋ:5&$W)Ra!Q+P,r.|NNY+HB6)TedfyǗSasXؼlT(:DRaaM.Œq/u8,$~$KZE9R2R8X DKVV}0|`~ .K"1_"e$O2S*Doa4ӯ2(Q^]q,ND)A1$Oa>p@t߱o8|gWt!nbbs^4-̲fے6Mu %?($|z1dn^Rp -hU"]Oya+̑I^#|2=J`"^(Tvt #K.=HB@f>NߪĨ`Ľf5,mD+j A*RFcoDNTi9Cƌ7,2@:t[jKs&e勇ی+!MwΨ<٣\GNGR6ҟRD%nzgb}[MzE`KXmbR@0?PZr˝NZvWj'-'~HZZeCT0p- H M( mJC LZr ]!Φvbv6SHqfP|1E_R1xsQaT&vYoPDh1M"!ik-ytUNhĶ5z™Il1A7uS¶vJyv4ܷUG!Iߝr߮wox0/0To"߯c`QI]5ڰ0Ȱ q##+Bh\˗:pYtHf_,RYab2(P:c-pSBy(Hy,0c 5ه 7bA=wٖմV[~5~C2 1}u;璱˒9Px)$1n6YZ̰ n@&mu ڛO% $!5(0N;"DHUTL!ȏo̤b \lt`TMOYcS2 fv)ٜ'͹3 4RvxNa#CCȲ>*l2X7dƨ59)jP!񳙏?ǓS.~Ǥ$ӜkGlwbaßFcZKU!-_--j@9kwDHFhUq*yXSBuW Ċ> vSr*eˠfCpl=AK̡!}䌀~{Dj6bOQS,`?c5mNov9dJqg|2u0)"1.5{ id Ԙ!@wExRFGtj$z Sb|7Nd9.AfۢXF]kܟUrCV(d i XV,HhKG=xzXEF: :a}RCXssSFB]"U&BpC^bJ5a-r~~dRE/Kmg)J[˧֌sxbB;SaFiEF|? Q2R&Rnj?jE @Le,6Ђ CħCTrwF"dBM~P-uHO\chs^J#}o0f.ktД2FDqw.9Z]Kd.t3ɱ> o:Mgh2#@`Լ-q|m&=hY"V4 gM޺+%US?PR.pJPpMXe>աVS3A UY P#%ˣ e$VږlqadLjF8uIV؏gӨիOg'޳-1tqÂ< ٪Q^u'rc;2UkE&cgz~΃3TB;:tcA{Vg ~gLv}Yx8YN^N`h|cP訏0|}Lʈ3+k% m査PǛY+mX;D5|?( {ǫW~<:@tI3g9]K+jUo%QT0[Fw⾽l4o+i1nT2OnR,M*ݺzjŽ 6HC߂n3@26(ZDE.1!4a2V1崁GuHaya0Q^[5*XP95-XX= k+}'qGp>mZ}]ziY0%.ȍ>> $~/馮H6pa !ϖ=G脴e{s}vu B6뽱>f9QNTl`-.$ +l/E $PbSHaquy+ywǟЌS*$DqݎW}e7roYՖgy :\YAt|f0*;J'kPSt'5éV*P1Le;TXr,Z>%2rd{ͬ>!Rk3L#yuǴ}w@-9,q6 Ng` ;¯P ~/'(CyT)40]f^vs39@w@} M\!}Sקŷ豱-"݆$)8=/hsrӻp$FmAQG^O9ltVIyd8S3 =Q.ąEq*; / DI]֣en=åZl^`DrмS׵ߩA g~6j4,[-"XLD|3u9g FP)'(x+1_*~g?&ɰ-J"|5'Tl?=2k~츙;R-5զ<󝈖ʮm;|hS\N7rvhЛg*<\w(UK[*}L+,C-T+ _ti7RW ؃XKjl_nDa}F[}bWUUk/nGo'㥛]buQZmy9Zw* @=jI-\߮pv> ѬB'I SsHKVDNK5sH]w-50ׯN{URR;!h?0/br(:r芄1JdzL f;ͷ4RⳔT553R3FljjCmPM* 4nLO4䪘)2X\D 6¦Qwt ͶebW){q #$"yj a,S[U؛Zc8ր]J|ILsr{˚%q*]S&A[^w(Q!&-HUjU64PJl`' wkUgex&￢^BA\[tC}(Zt=rw6ŭ9ؼX(;ܶX-$ۆ"M+?̄8On^wөIc~ p%ĶD_ ouC*YVm'plCHHVNcΡgk:^U 7+Af@gsx9Îe$el±p%4Kh,驙%1@BD﹆ERA/+$4"r0J7aݳC-Z9#[ =@&?9yE\<>5J eM!Q>ځG>̔lb=UkkWZCÀ_/<tC r,!܏;6v$ nOZ&n~'>x'rBG]]cn "9#.6c*Y70_ ;,dY@Ytc J`Aᱢ0y0l4jGhM|Z\ phb<ޒt hr qc'FDx{&@3j)>Œ5S"&۫LF/5b8&>p<ԯ'Y=e,/o;hNΓ&8#Ï.Y[N2Cecmӳ ,< D:u3~ߛ&\1* $sROGMaŰRC^Wx۟A2;?X:aڞ[k {{pƞXʩM&4'8t6]Lo)ZN;Ǎ(S%&M>+tʁJ](4< $ǿi>]RʊͶSL6b[u| 4{Gbze>ֱjw;]{vBmrU_L?>&)U~0Hi svֈɯm->3i9{}76 ZޣB'4fID o1\>g(T>2l.6ZU& )Ɯ0ҾLjri&fT+Ir\f]N ߦJ[{v}Ϻq=HpUAGy=5vaqGq@HTRwF"|sEghΉ9݌9~N?6) uP@p/.=T=+%rChai*ܰFz87xp21TS88] pr[>i˚l/nj'uǭF5 b[-tĺsu lmn0v9Ѱ`<뮠sX`/sG`Ð3؜4İ|Ք#O$ t_oCv *_LW`)AOuXCK̾?3jN#!3q5}=C]gW2"Ӻn`*1gOG I0͔BƵ ?!h!2& 1O /HLc/y:0d>3辊DJ7dz2&$Fk?0Q$L>i2ۑTLQ>3ׅ N;`O]kx.JfhBRltہ+H<9}LK,~Dvt) # ٍa[5W y~DKkңu:)E`BnnoogVO1ՍF3KZ6lYb;H Qc-ߙ@؋>/bԞ> *5oBÍnS23lul/&L7g}2+a|%VKg)^@l,bI[<_::]k6jz2DG|+X+ٍ|2bdAv{ -*60zXڍ;cÁq+Le %O^NƦKi;s"2h<0k1%[yHjmJW9\IRIm8NW ܔi(F1{̡pd| G X0*Dcnz.e ٱL(E =;fKlb2# 0|)G;iU^3]kV  I 6cUi\:!DcQy]sDL8pt16͟)q Ta\퉝cy :DoU!^ VN{$ӅިSkw׎ArDfFTqRTb)gLq^tJa6un$ҥެ3(J^if{MuxEvJnõ_JD!ϰ FI_3 ft}6JTz]4f@C ^܏fN>J t:\@"@g4*RAAZ4 =X4S؞"W&m͈<_gSU`+&Mׂ8*s%݇L1jؾspŸ蔻<ˋA.c|m*VR zXm59^*%v*Ԇw0s6-sd&C,',uA.e~MN8^0S)'nȉڴax"_v ݚ= 8Sɧhl7>A\ȞZR@wt,Rˋ U(wPf'-]775Y-cǦ F.zh~S~(%I:zn~Nٺ GAoDDYk+ܹ-eQo˲a- .H~P jc>J\5{44/^;@(1ߟ#3؈;m+ҍ~3ʿXKE,yoFT[x@YT 1}Ǖinj,I[^)GlLRy7en40wTdh]'q^Bs/,Ɲ ƫxkw1@'bC|D/2o-&xuV zEޠ=! m rim]![z [lzPa0#\D#=OAhd̰37LT).ACW'3QD7N6В!8J[E@K7x2)FpOe%+toütt;I8S#Gyo8nx|#hH>3j%k:91l7^{ydso}bЦJlZ<6!mYIĜ 6nɷaH6'ti#׉г"'=r0vʾߙ*Dz!ZV.h PT4dVc^{?LHc[q!yuj>HZ 'YsxZv]2ZR 'Ye&$Vm[JgцU%2@m(;fDWpS[ -h+⢳W C8ܠMd i{Ұ|'Ump _)frcTputCaaOPm,4`haeSDo-ndO@CN_-f Y ^MyLSJ;sj7jമo&digB0ڸ! m$ kެd̡^ x * DGr/:ᒦttٯЃŒޢEMWN-y|K%18'Nn T4d9>UO*OCI\@t9ZY3_7|ZiD?o^V;UsR/iQ}FT8J]?3/|qռ`I A!>">z(J_]xg0fZɊ}Gf쿙|/a !fN(S`Sި*?a^Hd:p;>>UM:# dEq( Zb{RԎ~:U=*Rn5\(|}]VZ1h OEh6LmqGU :w|(Xka]h sQ"{YAt Sy|X#g1w7f؟[}6K?5@u+[a MU"*߼9sLoDr$JڕʢXHx B;,`v4~W_IwmITe>[=I7xlzABA_J-%(w;zf7׷cK_g(*_qN1ϺuAI{$ÚO'L֡GF'dKC6td7 E©׬JW AݞaA -Ԝr@쓛53eHΆ?d=ȪPauH)&S#vW-{rh˷$l"HRbGh.7^ Q~ T<޲"sVȞ[ r1jh\|ɗъ8'υ(q gqB1uة͞VL|xO hNk_בL.kȲ1O< "ٚX6iyχ]6&?tCJw,B_<1 q_Hq0"$t=Le7ͳgQk=p3$ta0dgQiv`G=hS8A n1|+@_jo~[tD:7u.bIj0_hߩ=t'9_TrbKبȎ\};h/ ^a= Ť@i?1V%(r┙$z~^;r߃i\,5Y0w7w1Ohps?6H/UL28gx%m ) WmkM6Ufq#[ S;^Y) Ax' 7}$9B)/jo{^RJ66р-6,owt& ^bOF dKFI[ꍧd10`WxjwYa֊:AAv`~$d߾z0rO'H(k/& ~Oy=}Rhdc# ?Ӽ_JE&Pnq0c!k 1B:}fcv!f"`9c)6yp0x-GC-L`%=`Hx@⨞p[˿1K@)mx9jnN 7n{P=\_!dŅp$,a' F|2 o;YɃ^X4HX$lA~3UdN,-9U4rYOAT }@uj1bIe⚪[7[ZЗmCv5zG8 C1ถ_X )J7~M4o((\P$Tnk?fRGYKdtX/3,B0쪍ݹ | & GJ2J?\^(12 0lYGtӎnlk.yKI.δV8b#p& }NƳQk!eOis-i(ck&G'#E<0Ôe#ny+ʬd2F̬#59c.3·YTp  U!|̻q5N QU 5H[ /"ӹƫ=FՓGOQYW $6{UQ&lz*_y_[7HDܬ+_Q7 /!Q8o~TCgЮD,=cu+X :3r Gl[N! wb[ﰮ07vvhU_?mDZs o2abΟ3}ɭ M$"Q4ƣ5rDkN.2~.0HHX۶.V-S F՟LNkG)񄝛KK\d #D֧FRx Em4F5/&E}(0Cf= ?nQoGuu`D,Kt DXqL*ՠdӝe|N3&7 kxH*"N7{ Rg{`+GAe1Hwox@8 "JmD T G5"];=-Bb [BnO&sr;έI(Hg@!>d :. \ڴ|w 6l|\Dw[ 6k ){ql <^v~tx}ùಛWHn\K<# ]ᓹ%B%CB]~A$l~]bF w9+Iv 8vy  8r]RE'`i;3XTk3ק_TsXY>z,52 d(1٥f?yŘqX=LSkNJ-S pDP=eĎM 㜢wn]`}RXVu6}t{(S=A7-[vcdh`zb2a|L[))3{6 gIFZԠŁ$~o]WKܶl.NQ P_GjC,oXkPVLϷpHOtƘjXW`ӥ?2،W8̉6P#6)b x*Wlr"Ei\[/6ԁ7:-YD!09jp7Z~`1+cبGܕ&7 1-m@3Rrg I5TGY^AQAgk>C 4 g-_'9#b9Ր5AY3ڹ"0z6`ct!/V| y'ϷвdžBHSPu-G键d:^|&;Yl%،ZeEM;}" %HrXOe{tco: zTn`Z>>Q]+jBJyRLCj:^=^leio2ڸ͂+!Bi ܎I<V# kO٩,&7v{\>Ed LMb DRaĭwS#jp 4F*i[ɻR|U 66SY^ڳ3-")l;kzy .:AXUC4[f"ʝB;n|@D*6ЅBrL |Ǽ6bPͫ/Ep7c hЌ%@eUP MB1# ˝z>z+ɕŏ'hE%D;d95)޵n? eO9Ȥ|y'ܰ cnٗ c5U?>qOqK"% S-!b`jqϏiQ~HXR9 {|z9k !AEy4PZ̔%N;ϳ[7}ǭM4N @>O!2so<55iXN&K)e>+81ЫH)q>2^G'çJ4MIuA>V}s%/_N~ϓ'oP ~cbp lўeB'ë^z΍eeL!a?I엏;VNB 9m?)m'͞a`Q=[([ ;uo[3T5MbGrK@#C,(i30 q yDnH?䞑/闷B EMBoH ^^;tkuoA.^ K Ot1t'11|1)(tǯWz 5Uq%zｯ_ƥ@ &_`'\݋C?V#I?t,xW;/o~y;xYP_ڛFQ 7Tѧ@ -rBY i'a NSq"1Tpy0B^xIEdZΠY#UyK|X+5O )G+gK_#g{1$p| !X7dRkP냈ݼ@7RWl(ZF'ѣw ˚kV%{ndd1U0ʝeo|s*_=hXTpJ >2",=*ˑP/b7L=٨0iCR#l.LNG#@͡Π ĒY6$2xl!9R'BD7%*Lz_{I+JGXXV8C jHa3Zj|˙=Ef3ˌXdj]xV -fQ%ն9iSh %5:֟b1{帋6qaӺ[-X: ̞>t49P1T {&i@Ѡ`]h6E1m`V-Ҥ?\7\|: ^8ή ]h{(ĴQ񯭎Ij8"*Uw[1ИcfOc#"6ΪjTz SFM0 KSۆc?  kYtmxtiQ 78 Ga|Нc@d8.R8b#J:ekOK.)voVi=uikaE`)}!XT3z<M936JTSC,ͤ$;rt<;B B+I 0 }_ N]hN18[ TNk : t^BZ(HwlUٚͰ_%Vz05ff"NP $&J4"kwNGQ0q݊8*+kF΄a0X1e]0*ɋ ~0fΨc{#8b"FSMb|GbvÉ6\e5kf·4*A=xWc29|ZjEl Y0,^ @YX ԫ|wbOA$+ 叴׷)\%" ̄G/(Q~sY0>sgDxT5%^yKސĉrϿ.R'ZD%ui3_8:QW| ev<e$%<5; Ubw,5=&ch|3qlTlN!Zn~iIBz*-> "Ml~Njȵ9 $s 3%;!)V;@OIvFgVQ]Z's5aa\ 噐_ThH/WT?tbV[ t BfΏOxޣRnvHHc޽ SnQn+1 ?H--S6: A [>vM&'ɠ^truW: d0puVp?C+&"'-W˖pKH^qޯߖTpPeAM!:0fW3y(җ[5ӫN!X-j6%E@9|D-GgڌLw2жYJnt skn>rJʼP-MbҶ0 +L}k\ِNU5V&8j_Vo+Inv$.ќ(Z=?RN3ϓA_\YZ\}^<4 A^ iqc;?e}zS]e\/"D@n}64:&^娼ȲI 8ݓ:qB<%i & DGfMbMi5tD[,t *CQX /P."Oё%Lgq-_.MH{ƛ]1TGn9wLAO]ľcy.6Qtj`4ߥ hiBR{u57#v}>pOvf/A~gf B|b}VQNYLECu'h)JZ\mR*%FS?/׶tT V+?[[! haS AK o@̗|gY}xL>4HsE$xVpdp lt6}w6ˑdA!X/DaS}{%3awc̈́ql]3sHypN#̈́\0/XzÈ.Xְ}01F=s΋5m! 7=%?B3ovJ"¾P4tDz5rB6(qS[c` `aIӲG|o^W;\2.t8byA2=m?aSr'n6ii-5:)LkQGwݚʯfmu; ƾ=g q${E?@K(M;յs?-z55{l׃:^W#C9 RcMXq@WrJ F5i7Z&RzT9}w8AVQwEsAb;:^h4 `ľ`xdҥ|6f檈HaY9>׌lV:- # !{,$ֹ<˯[VJ!7 ~N *{WHSrު8ǙY?n^cXimD?1*O {GyMB!T8T9S!CQ+ŭ$oYϏ 奥=af-ְ @_TߒMݲ=[G@B }fc0T WBs@)ÑYOP{M&TbfWy[Te>ҳ{s#v"Ȫ%-=n##} 9- :Bϛ\?^^ Na8 ..Q9Mt-^Ph,~ሡy ^I 'c(wwC]*F"Dk8(*6Nb[ lS^S/>?/)ŽNV1V4֣vq_*&i0uay+eWfDc@>fQy!P 4v=)`1BXH32 ͤ:{iq0 qnvq;-8.YwfIc`k[3M1 6e0nUWnnn]`FW/}뜤U'f83Tu#qTJc>S%LRl,k=nZCBn7msVA[3dI+ٓŜR*Sֵ֠=ǂmL|RyV]k%:$/[ ؆۬?:XOh2g@7S'rj򍉘)eJ).k$iBx#fƉW .,eFDk"-D1٫iM&=0%Vd0ύ [(,=l')VU`룩}Ȳ :m)CI~1&@Qů$/ĝ|΅v+n'm),\|Hų|ME2!hk0U{}̉NvYfiO0h|n5HGڥ*αUtEPk t YH_Ra ~YM+icS@{8 /0e4:)4rY/\ ,hRj,j`]d[ua/XmiG1_Nj=3-Ct`U(^%y!hjIxWfq07yU|՚n8 N@1~LY|F -յCSO%ӣMlP0qUr?ӂs#ݸVpl3Xt6R׉B?8i0I,^GF5r3%(sUk9$sz#ڬ27֋g pP?<ݠx/P[8'Pҁ%Y/жJsF:N$<&mmd刌ie}RʱHZ"c3\nճk(NِZ=U`6WoFUj#Ďj.?0@OORvZ4S48rnFz Q\DVC9 [+ۅ/] W?,M#|0hFip?۞rYglc v_PS60_sϓPiшR8;8;ŢyuC/Ry1}F7@/[`:En *})n*<ם9~5jӞEʟnSh'~ i0g ~? V7c(,-W|v.rmYf|C wW.̀s D0|Y( ܠ )!GӜ?<ƕ3X4QgnUx'}g}4OLXc75755:_C'TϘq4Bqs웾O1`—Y _٭ɓMtp78)x?$h3;,I0<6R-ۻQE%u\k'럀hѾTkVݓA^(ЖGy D\M]؍^|0Zٝ`k{@x6LJE,F 5.h޵abxԂ5!B)̞̿S<DیNZ),}ɻ)׍bRcc$5Kd&C I=fqgXBH[˜q A6%M}wc[`j幜Axz~ 䙮.xU<̜؆{? _{-%xfsgú:[ؓ`oO>ORӄ:v/=2J9/9VZ#?S'LJ))I)aq#5~FV%ҧ^ٗrԲ38Jiv &R^l 5eS9P3)cyJ^SKXp1|D_-v@A%R8+?#q#֣ʺBQ~:ROdsUS0G'suK ~-Miy`\DpsL ηz!~RK_U7}/Ǜ ?t]??亐/,F+Ҍ)WYc/3(6E1ho ' p7 e}ރD4fWO.ӘUږ78{G?;,D*b{51(V~8>~saB}y*eJsB m3WdN@Slw웇jD݋}7jerXg&&Y|tF֝.NVv]y?xP1=9GOpۇlO7  7؋ lS9+Q?6)lm`4V1Ρ~A9v~3UYAv+ nHw+I|xC3oL}r*Fmrb-8Wjk @-!bXolTC3##2Ï*lxK;}1`Xh*@?8SApc;/t'u%-QnUNF3Mt@mJS6;lp0t2q gpd<$j8nť߽72YiuV.w`봣uvhat?x5 _IiWD_GoiͰ*RV-saq$LWz,AvHZJUf*­FV- S)Zk+xUr'Zx_$!˾~ emGo__ K O Z`Ȫ|XޒrJl^6 U承Mm8Dz5'Kny &knNcC^|:PklZ󉢘{j^ɼ na-Wr-SD&߀cH.<7wXcGy#r\A %0b=DytЎ$:4_dɒf,eW[y!ҁ|R%LjX$Da]}Z-r9I>4n۩&a3HEkx#7)_齒H dz]h}Y_+*SnqiœZ4gM8 5&p52J 1򜊸o@qyy,W2[Be감@x͏+֧yF"Cք)=J>ffQɌEZDwd͊{yg'/̀V+VdGZt([4yt фC\ Ap rt׶n LY->ԐQAemHR2 ̨̭CO0$>B5;hsÑΓzNÄC맩&T~)lI f%V~,TyAxL> ÂP\5@Hr5S[ڴْdɺh}Nb+ ?2$xCRZ_7 ݎԱ>=^b?LىZKڮ=o?&p 82X:kx/w=RLpӘ#,±`#+pFR,j(+-oj5]\ BFуXv \I%-N:;UZ J-&p +JUǫZ~>Ɂm* lJ$,Ȟ0⧳C;119 `є9R3I2ǔ&@ح/`QJ<46 AdH~jzܱ_jֱ]Y[rI&AlL;vxPre93xT;@<(s@WRw/Bzqzbjj0rEÚv {Vt^? –/br3=.'3&Pb>϶8ƾX$o}R6AhI!4WodOBW~iH-qIWVeM爺 F/M8wl"4LMqSA` ,EjEF6GG(lD:^Y~_`٘7aM_-|s 0ŏuo(Ƃ?+RE&G:Y˿G Gfq 6W4@ȕ$$ M՝MZYi 1 gv#:gIE/㲝E֥kUQ0p~9@q n:Þ܄8oH'w<'+n׍Fy)؜3pi侴 4(k [@(2 T1aeJ$(h4I{ܖmB#R}Xx eYB)qw%2al D c^}zۓ5leA4HKVqn-e=qdQe@~I2 Hсr UQgl# E ~iieϙ,_L/Ax3 {6=&Nm2[NNr(o:/T7K^z6Ń%dˏ\]:J/iݏɿD{(Vh؜gRC'Lfd3)0+=X\ \bk47~ |M_YddvnIEq]Ȟ%O;xz2ރ,߼!fLaɇ@>Fozi5F"B2FӉϭ__V]LU#lꔜŚIM@dIjD/[s\Xbr?8m=_ہWW1Ohׅll|aܰx,90WH9i. ?3F \H?rK*(:abej'Q_یzb{$s<7vJk t#e8>pL1+9 Wma}b=9 9Zb:} gڢb2nbk2'gXW T7(D!mxsX #/w`@ZK,Hn3$(;GY.^˲T2܃TEB~!j 2y i] upRk둾)T,D@.x}zaPl~\fTP>C|oL! OR!"MH$>g|]i%vToFFf꽤tip+c u]*!ЉÃi>i] Ǻb=_<Aȗ Tgj6xMHqa?7!p߲zG//z{ܬf{>K,zo`ހnE־bY 'jSDw+.{iˋsƳY0~ͲNcK"-(*Z!?h1q r~u*!K޷p1ME!Wc!jhj_-R,CP2"DcƂk#k.w(:{h ԐZ %:Lf? e,LԺI2) H׋;Uވ%!+QyvP{=!>__HkeRktig~nv*]a@&>Ωja]W)D3~sxQ?R*=/E7/3>5R@5-o`̿{rQUܬpNK0_z4ì/F鍕F[,a{~R"SiEL `?QwC4}BT\g|LC=AC?{mk|U- wBobt. 3sycm˫RIWrTXtgj:qIy؉zqC\h:yG[fbdfw<$h3ډ֒~G[eB]-6$ho+Yz bdp:>*uPVGǽJeJgLʌї,qHED!guġ~5٭}fcYwq%̼ӵhm"X,")d'Xo$ۅg)kG-T =5X$xW9!pj(t*f` ̩J+84Y8ْtY]86ׯY T\U؉8qkrK§ #'SFoġ߻ Ò(a1 pN .=t"h=$@ tHR`%ftg6ll'.]\{`ذ^5$Z-C`#uː1:h?f 0QQGתFϚS?vG7 7G9kOr;bjեpb*\2VS}2rGKtgiqAdQ1JgM ;N5^hZbAoosF5zN)0 ATJEh(Gqc')X&D`ցJ^sƱff dMUvXHB]~ G%+֢ԉiAcP:J8qq'GN"4W'`H[神vZH0'yRBH1Qu:{WF#+aWIgXu\1(Y[h'?L=B*>h}]XtK|Ȉ7r;%Fz-i }B+U;Gn?qot3%cboTH>9 bo ybvyWN_㲪9pG3OsF尫p;C?VCo#8t'X>GIWG ;$cM—TXŶ >?C.`V2d/t<<ˢ L Wp}[;kIr`ljZ<w>c- ?<+S4 g 1 ƄNZx׀:q}*2xBp]}Qy\wWiIB&{`v.Y1M¾l9-7&XaK0E& )exOYPgVgt`ݜWЅ¹z<O}71mSx PhF1j]}^J颡r"qruad&65/-j/ke[7wwN<=!WnCxš 3\L-6&@~BE)P_amJ9qE K?E +VDrWEܷ!+X(>RՊ&W2l42إNAlmF 4(@Cy Z98jTGUr +; >/<ѓ15Wnc9`N5U+]6呷P-Ql4q#=!}35mv+J x-+MG[ ex5]pEbE Ps̙b:R̬[Woo xz߉%WmU"^٫.@3skHmjxy3Nj̈;y[XwKP4oD[xeηRYxtfW{Ɯ r! )l9]\;-h=**\Ȃ[}4XKsJ$b!?:Y5|@5-zU$f%Kll>C>qQy,4R6px)2/\6$>6'j,OHLȇca\XE%^}{XkpP\;{rCB )Bθ.Bi' B,6`Hv*39=ᇁuaD:PAT W#Ȼh ]e,ߎWnjO@cFDTxJ$*t?Za^͍#GkKEztn뛤Hmd(&-SiIM|=[i䎔#L!BϪR9!FFHPI:S"B5[ 뉊(cJ[%7Q=hpu(4.*\KP2qBT@ -pz@ &ŀmxodV/uEt tSd@)(a)IҺ)۲VZ0B"CW?Mq78ʈxPy89od@CB~6I<4STʑ¬7  +\8x[Ѣgf擽(/ٶoITrJ^_Nirl f1l%赮{&Bus' sW=@*nz_aLwop|ȽtWWBىю*UXj5;Omi,΢+Μ(|1&w}OWip YIbmM{x`d¾eލ z:7U`>T#g;QgݍA-1 8jc"G{DI fOлJooڂc ʣ! R8Y4ER/>~?[BFpDkj1"~ O,Dφy;KAob2hKp0Nn bOݒ꽠gLPa>cCFeֲfvRGh_Egا]w U}H[1a>73!t!%- 2!F :#FK~9ep1M\:P{Rv?w-D7`8:?2L`e T(2*@?iwiQ3e-ɂ4`hSk#2ds)}0 Et3jBk[HHrO}@3\pd˼ dDz'SŞfz(5J>Jw+D[԰8JiO7aJdu /%l >AzpKfn0G}5!HU_$am+ǭ+]Hs[fb*b1$5nse_u'xt7 R٣3mK@q]Ñrk.Θ&'$sٸ3ĺ?k/&OH;:piir#b@ɺ@YޔhkPqmt71V.%RpYYnRtrks —G49`[ NQ>5M\Zt \i$_( og?<Џ3=Jer iX%@!h:}$RyuUw7, Ɛ/4Sr+Krrуm@9x1М>XOAߨH!(nX޹ ?.sF;|;a-I=/0kmc4sf}cAU078[T|ZJAXF>4ex(t39"W(+|NU]gDBi@a%v3%x}6 &iTlͅ  ӺMB, mj."@jO--S` 5YxcVM`d]%Djq.h,*b٪lXÖI 9Hy5HU qMwX;xERN[c]j@٩Q銄}u|(d 762+"D+/oKRK1 VIc/Gŵ.Gc ĆLQ;dn&}&,RRR #暮9 {t%I|u!dG7d3;?>#[=k+؆Z'wsu=G Cb+DI+$!!lxi_RL%[bD0%R2 3˿#(.]4,j+S3DjVJu]L$9 .A"]@}SbruoaL{ 2-eS.qkW5 =DT8-ҼK{]sޖa*0mLgt =|Z,X떥)6_ogiJڍ G>Mh!ͦ-Rr$%k@C(d#3,٭A91._B(Yԉytaݏ0^2(_܄dQI~|(X|)Ծi.V~ĭ,t"#^&hLN86.B|Ma<uJ"0.}vBssv עf<:ͰrG{8zo"C2،@涍`cBu%j,ƝT'gߑ,Y?LFYFXI39!Χ5涓bC 6DR,2{\Cr N}nџj[E G,O{&]G &n*`DtPu<U,(=Auuէfx{M'pl=y@ n ̊:'vː+cEr!ňw"@6+(5xBp֮R}vBJP{3 YZ