ipa-hcc-server-0.17-2.el8$>k91M,b?Ws*>GX?Xd  SPT|  ; 66 P6 6 6  6 66660(89:$=E>F?F @FGF 6HF6IG6XHYH\H(6]I6^M$bP:dQeQfQlQtQ6uR|6vST wT\6xU46yV VdX`XhXlXXXCipa-hcc-server0.172.el8IPA server plugin for Hybrid Cloud Console integrationThis package contains IPA server plugins, LDAP schema extension, WebUI extension, and registration agent for Hybrid Cloud Console integration. The extensions require an account on https://console.redhat.com/ and registration with subscription manager.f7buildvm-s390x-03.s390.fedoraproject.orgFFedora ProjectFedora ProjectGPL-3.0-or-laterFedora ProjectUnspecifiedhttps://github.com/podengo-project/ipa-hcclinuxnoarch# create user account for service getent passwd ipahcc >/dev/null || useradd -r -g ipaapi -s /sbin/nologin -d / -c "IPA Hybrid Cloud Console enrollment service" ipahcc# ipa-hcc-update.timer is started by ipactl if [ $1 -eq 1 ] ; then # Initial installation systemctl --no-reload preset ipa-hcc-update.service &>/dev/null || : fi if [ $1 -eq 1 ] ; then # Initial installation systemctl --no-reload preset ipa-hcc-update.timer &>/dev/null || : fi /bin/systemctl daemon-reload if [ $1 -eq 0 ] ; then # Package removal, not upgrade systemctl --no-reload disable --now ipa-hcc-update.service &>/dev/null || : fi if [ $1 -eq 0 ] ; then # Package removal, not upgrade systemctl --no-reload disable --now ipa-hcc-update.timer &>/dev/null || : fi# remove pkinit_anchors line from KRB5 KDC config sed --in-place=.bak '/\/usr\/share\/ipa-hcc\/cacerts/d' /var/kerberos/krb5kdc/kdc.conf || : /bin/systemctl try-restart krb5kdc.service || : # with server .[dd $($R / ,>P~'_ w >(!# & `KA큤AA큤A큤A큤A큤A큤A큤fff7f7f7f7f7fff7f7f7f7f7f7f7f7f7f7ffffffff7f7fff7f7ffffffffff7ff7ff7ffff7fff7f7b31d02b89e6caa05c48aa4ea8f66304678c96b1b41261509cd149c79642a6cd8963f8f984b73b30f0c7a77ed85f200ff3408833143412479fa7842901e81b421c7b7869943f15692dd4b717db35aa4a7b12d35d245a076d77d42ca51c4eb2dd5c7b7869943f15692dd4b717db35aa4a7b12d35d245a076d77d42ca51c4eb2dd58dc31df9be393b5a7b32bed3bab69fe49a81a4127f6770f74942bacd3f1af63e8dc31df9be393b5a7b32bed3bab69fe49a81a4127f6770f74942bacd3f1af63eaf7e789271b3072dce71237bf5ff12c4c602cc4bcaeb3e8010a3b506a6e2de56c7afeb845ac18596c0a7e7a9cd7d18ad1fabc67ef15345590a5fff3ebc3e7259fd22bc9f04531dd2c421478f98d8dba1075f35f6a4c9860efeeca2f7d689e036fd22bc9f04531dd2c421478f98d8dba1075f35f6a4c9860efeeca2f7d689e036e6710ac47890d62bae143c0271829957fc9fdc94f7f1fd5cf5d87276e3a5ffdce6710ac47890d62bae143c0271829957fc9fdc94f7f1fd5cf5d87276e3a5ffdc9aa814846ff1c5c3e09870cf5dc9c9d72450b38ed2a893816459da0d40f0dde19aa814846ff1c5c3e09870cf5dc9c9d72450b38ed2a893816459da0d40f0dde182dfedb40d265556fa3f923caf60337a278a16a40aa25f178550b66b9b5458a0a9d1ff80ca40f8bcfe0dfedb1ce491a861cbc4f39ba488811dd5f7a6ca358ba711775bef5fdc8b0e9934abd1c520f2cce009c006f9e2c37792f0eb52d7f80f2f11775bef5fdc8b0e9934abd1c520f2cce009c006f9e2c37792f0eb52d7f80f2fa2512eebbc1d44ca5b14f0c751a803458444d6b62798591d25ba87e7eb3920a33904f7ee2d7f49133a68a1004610ac0aa987b472efa63aa4ee6890b33f3c23dad7794e192ab019ee244335bcb9d0d48d22d616d034936135beda85f848767af955b522a84594344d97178747a397bbcbb688ccd665f706f9170a250ad0aa83cb5f2789ade62d840038b2aa74f873b42301f0e87b1bc1b4140af48ae7e4dc39e88a9197a4dd793e1a006e67d4ea61691fa4fefc1a0707aaf5050d1ac022af2f79a128adfbea5ba529243ceaa67348fd8c998243dbab8081534045094619feae8fd6194ee5dee43f604d4d45332f211316db90a30691446ded5957110008f14d7a94fc60c37a254bedf2a580831e8e8f11a9a3558f533c3fbbdfa7a415f4031fda1ccd7df80136f26c5df5a81921dfbcb597d4ad4ae8792a8421cdb0b8e9d3272e1b9271c78e9532be6444a11d9bc08a6f416b298488ac53e9086791fcfa68be37344c07e0d6e46c03926dd9c0605889524ae9b877e40eb489893e9c943b49ea36e929bc7209cdfa3729514e6a716e3368753ecf1dc4d72551dc318dd15537870c032b441fb49e06fd89c00e2eeb3b2f3d1f1aa639536b096b8d4ffc2d1d3b68af0ba22260e39627a852234c5cf39ad7d43b97202c9c200744a955fbbb4073e11617bd01be55b74fc85378a70cf382ddcb45fe9c2c4551c962ea83d58847e8fde281434890455b15e52dfffc5795f5cf617d88537112db40cafcaaa8d7fa460e60b99f6de22e356b6c6b55128965ca0b43eb2eaa1a5cecbef07e59d0a9ad0171ea9b630f30666b235aecf1395d04f62fbc72e594b084fde9a9fe3ad9543b0905846b84c509faceb93ae150a80d10ee2588cdb6afb886c57adb8d4d06ba197d04c0966f7af0cc2ff02fb54c074b620c6bc532ce419b81e35bb4f5693d0b97a572f28ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b90307dade5a068cfda0becccb52f26fae6002a4b5c3572f161f6a5dd2cef5f2a12501-redhat-entitlement-authority-2022.pem00-candlepin-redhat-ca-sha256.pem02-redhat-entitlement-master-ca.pemQ@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootipahccrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootipaapirootipa-hcc-0.17-2.el8.src.rpmconfig(ipa-hcc-server)ipa-hcc-server  @  @       (ipa-hcc-selinux = 0.17-2.el8 if selinux-policy-targeted)/bin/sh/bin/sh/bin/sh/bin/sh/bin/sh/usr/bin/python3.6config(ipa-hcc-server)httpdipa-serveripa-servermod_sslpython(abi)python3-cryptographypython3-ipahccpython3-jsonschemapython3-jwcryptorpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PartialHardlinkSets)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)rpmlib(RichDependencies)selinux-policyselinux-policy-basesystemdsystemdsystemd0.17-2.el84.9.114.9.113.60.17-2.el83.0.4-14.6.0-14.0.4-14.0-15.2-14.12.0-13.14.3-1073.14.3-1074.14.3ff9@f[f @ee~@eod@d@ddd?d$(@d@c@ccۥcccChristian Heimes 0.17-2Christian Heimes 0.17-1Christian Heimes - 0.16-2Christian Heimes 0.16-1Christian Heimes 0.15-1Christian Heimes 0.14-1Christian Heimes 0.13-1Christian Heimes 0.12-1Christian Heimes 0.11-1Christian Heimes 0.10-1Christian Heimes 0.9-1Christian Heimes 0.8-1Christian Heimes 0.7-1Christian Heimes 0.6-1Christian Heimes 0.5-1Christian Heimes 0.4-1Christian Heimes 0.3-1Christian Heimes 0.2-1Christian Heimes 0.1-1- ipa-hcc-client depends on ipa-client again- Don't install /etc/ipa/hcc.conf by default - Refactor: Client scripts now use hccplatform - refactor: Move all server code to ipahcc.server - Feat: Server features detect Console from rhsm.conf - feat: SELinux policy for ipa-hcc-server - Fix EPEL 8 build- Allow build without idm:DL1 module- HMS-3840 feat: Detect configuration from rhsm.conf - ipahcc-stage-console now configures proxy - HMS-3821 feat: auto enrollment can set DNS resolver - More Fedora packaging fixes - Implement testing with Stage Console APIs - Implement console proxy settings- add CONTRIBUTING.md guidelines - Fedora packaging fixes- Prepare ipa-hcc for Fedora packaging - infra: Add helper for stage console testing - Fix: pylint warning R1737 - Fix: Typo in ipa-hcc-auto-enrollment sysconfig - Fix various infra issues - fix HMS-2066: Add timeout to confirmation prompt - test: Test on RHEL 9.3 / 8.9- feat: Enhance reporting and logging - feat: Check remote status with HCC - refactor: Use context="hcc" in IPA API - infra: Log JSON error information - infra: Refresh cache and config file - fix: Use LDAP for public JWKs - refactor: Run ipa-client-automount - fix: Replace legacy with modern Insights API - fix: Limit hostname to 63 characters - fix: Use UEP CA to access prod cert-api - fix: Don't create global DNSResolver - feat: Add ipahcc-client-prepare - fix: Fake headers can use org_id/cn from RHSM cert - refactor: Change to --idmsvc-api-url - HMS-2348 feat: Add ephemeral fake header to auto-enrollment - test: Run CI on Fedora 39, drop 37 - fix: Better error reporting for missing RHSM cert - fix: Fix typo fdqn -> fqdn - Fix: Keycloak SSO provider requires openid scope - doc: Add test instructions and hcc.conf info - HMS-2814 feat: IPA client installer and automount - test: idm-ci now requires local cloud auth - feat: Add sso.rh.c IdP provider definitions - HMS-2694 fix: Update JWST issuer and docs - HMS-2595 feat: Extend ipa-hcc to retrieve+store JWKs - test: Fix and improve coverage - fix: Update spec file URL - fix: Update git repo URL - HMS-2594: IPA plugin for HCC JWKs - test: Do not install KRA - HMS-2532 fix: attach to api commit - HMS-2491 test: Enable backend tests again - HMS-2491 test: Allow backend test to fail - HMS-2491 refactor: Separate GET signing keys - HMS-2491 test: Update test infra for DRT - HMS-2491 feat: Remove old domain registration - HMS-2491 feat: Update for domain token workflow - refactor: Remove env patching - HMS-2446 feat: New domain reg token - fix: Use gssproxy client keytab - HMS-2446 refactor: Move IPA API to WSGI framework - tests: Add test for deserialize() - tests: Check that serializing compact form gives a ValueError - feat: Add additional check json deserialization and update docs - feat: Rename deserialize_json to deserialize - feat: Do not allow compact serialization for MultiJWST - test: Enable mypy checker for tests - feat: Add domain token to mockapi - test: Run CI with Fedora 37 and 38 - HMS-2070 feat: Remove D-Bus service- fix: use new Quay org for CI images - HMS-1789 tests: use @podengo/ipa-hcc COPR - fix: Support latest tox on Fedora 38 - fix: Allow non-compact JWT serialization - fix: use OpenAPI from public GitHub repo - test: Build SRPM and RPMs on GHA - test: update packages in containers - fix: Don't hard-code inventory url - doc: Add documentation for developers - HMS-2195: fix: Use idmsvc as API slug - feat: update locations - fix: Fix typo in automember rule - HMS-2147 fix: use HostConfIpa schema in HostConfResponse - refactor: Use setuptools to install Python code - fix: store public JWK in separate file - HMS-1857 feat: signed assertion for host registration - HMS-1857 feat: Add multi-sig and host token - HMS-1289 fix: Remove inventory_id from HostConfResponse - HMS-1857 feat: Add JWK abstraction and helpers - feat: Update JSON schema from latest OpenAPI - HMS-2038 test: Smoke tests with idm-domains-backend - HMS-2068: Drop support for RHEL without PKINIT- HMS-2052 build: Use OpenAPI schema from idm-domains-api - HMS-2038 test: catch metadata misconfiguration early - fix: Move rpkg output out of .tox directory - HMS-2041 fix: Represent org id as string, not int - HMS-2038 test: Improve testing with backend compose - HMS-1991 fix: Tighten OpenAPI schema - HMS-2008 feat: Adopt JSON API error objects - Add definitions for missing JSON schemas - HMS-1991 feat: Generate schema JSON files from OpenAPI - HMS-1991: Refactor JSON schema - Add project and build definitions to pyproject.toml - HMS-1898: Fix and validate error response - HMS-1975: Remove check-host API endpoint - Improve CI and test with Python 3.9 (RHEL 9) - register: prompt for confirmation - HMS-1926: Friendly D-Bus error message - ipa-hcc CLI: print human-readable messages - Document how to configure for ephemeral - logging: pretty print API response - Reconcile JSON schema with idm-domains-backend OpenAPI - Add verbose logging to ipa-hcc - Prepare release 0.11 - Ephemeral env support with fake headers - Improve Makefile and tox runner - yamllint: don't apply truthy test to map keys - Rename field 'cacerts' to 'ca_certs' - Reconcile domain response schema - Reconcile register/update domain schema - Document how to install build and test deps - HMS-1898 Reconcile error result schema - Ruff: silence F811 redefined-while-unused- [HMS-1788] Add simple GH CI workflow - [HMS-1779] Move secrets and settings to CI/CD variables - [HMS-1645] Replace bandit/flake8 with ruff linter - Add infrastructure for mypy type checks - [HMS-1645] Drop IPA 4.6 compatibility workarounds - [HMS-1645] Drop Python 2 compatibility - Run integration tests in FIPS mode - [HMS-1645] Drop support for RHEL 7- Last version with RHEL 7 / Python 2.7 support - [HMS-1607] Use inventory_id in API routes - [HMS-1607] Move common WSGI code into module - Include os-release id and version in HTTP header - [HMS-1479] Implement status check - Drop bundle file, add more ipaserver tests - Detect and block auto-enrollment with FQDN localhost - [HMS-1472] Switch from admintool to D-Bus CLI - Add tests for dbus service, fix hccapi - Move cert parsing into common function - Validate insights registration state- Fold common and registration-service into ipa-hcc-server - Default to stage - Add title and description to JSON schema - Use D-Bus service and simplify config - Download PKINIT chain from registration service - Add mock tests for mockapi service, refactor code - [HMS-1485] Add --location to auto-enrollment script - Verify with pylint and fix violations - Use server role to indicate presence of ipa-hcc plugin - [HMS-1485] Add IPA location information to domain - Add D-Bus service for checking host in HBI - [HMS-1475] Add tests for registration WSGI server - [HMS-1475] Refactor and test auto enrollment client - Test with RHEL 7.9 server - Remove dependency on requests - Rename smid -> rhsm_id, drop redundant rhsm_id from body - Move API handler in separate module, add JSON schema- Fix config_mod(hcc_update_server_server) API call - Improve idm-ci - Refactor project structure - Add timeout option - Remove unused cert info and detect_environment - Split ipa_hcc_cli into CLI interface and logic - Add systemd timer service - Add global hccDomainId, use domain_id in PUT request - Add HCC update role and register/update subcommands - Add ipa-hcc to register/update domain with HCC - Update rhsm_id in server's host entry - - Add server role for HCC enrollment service - Fix deployment and rhc connect in stage environment - Test on RHEL 9.2, 8.8 - Add mockapi with test API endpoints- Add metadata to deploy with local builds - build and deploy RPMs from current checkout - Add QEW test and metadata file - Add idm-ci playbook and metadata - Add tox CI with custom image - Fix stage env support - Add 1minutetip and virt-builder scripts - More validation of PKINIT options - Write custom krb5.conf, handle missing domain better, more arg checks - Drop 'not krbprincipalkey' check for testing - Mention SHA-1 PKINIT issue on old RHEL 7 and 8.6 servers- Fallback to kinit with PKINIT + ipa-getkeytab on systems without PKINIT support ipa-client-install - Add support for IPA 4.6 on RHEL 7 with Python 2.7 and mod_nss - Handle platform-python on RHEL 8 - Sleep longer - Relax dependency on SELinux - Move keytab installation into auto enrollment - Basic tests for WSGI - Move /etc/ipa/hcc dir to registration-service RPM - Move scripts into ipaclient.hcc package- Detect stage/prod from rhsm.conf - Move refresh_token to /etc/ipa/hcc/refresh_token - Move more configuration into hccplatform - Remove keytab file on error - Add service with force=True option - Update permissions before adding privileges - Use ipa-ldap-updater instead of slow ipa-server-upgrade - Split server plugin and registration service updates- Rename package to ipa-hcc - Replace term 'consoleDot' with 'Hybrid Cloud Console'- Update CA chain to official RH certs with new SHA-256 Candlepin cert - Wait until host appears in ConsoleDot inventory - Always disconnect to get a fresh Kerberos ticket and connection - Add ipa-consoledot-consoledot.service - Remove old test data- Handle outdated keytab, autoconfig org id - Remove pkinit_anchors line on uninstall - Workaround for missing IdM features - Fix spec file dependencies - Automate ipa-getkeytab with update plugin - Move some files around, automate service and keytab - Update spec, add KRB5 snippet with anchors - Use more persistent connections - Add caching and logging to WSGI app - Add link from search facet to consoleDot inventory - Lookup host in consoleDot inventory - Regenerate certs with C=US instead of CN=US - Return shell script with certs - Add cross-signed certs - Add script to generate cross-signed Candlepin CA - Update README with more instructions - Require known CA issuer - Add WSGI service, roles, and cert mapping - Add test scripts - Add notes about cache and certmap-match - Add test data and instructions - Fix error reporting when global org id is missing - Use lower number for updates/schema so we can use 89 for test data - explain unique index - Add write permission - Add enrolled hosts to a hostgroup/bin/sh/bin/sh/bin/sh/bin/sh  !"#$%&'()*+,-./01234560.17-2.el80.17-2.el8  85-ipa-hcc.confipa-hcc.confhcc.confupdate_hcc.cpython-36.opt-1.pycupdate_hcc.cpython-36.pycupdate_hcc_enrollment_service.cpython-36.opt-1.pycupdate_hcc_enrollment_service.cpython-36.pycupdate_hcc.pyupdate_hcc_enrollment_service.pyhccconfig.cpython-36.opt-1.pychccconfig.cpython-36.pychcchost.cpython-36.opt-1.pychcchost.cpython-36.pychccidp.cpython-36.opt-1.pychccidp.cpython-36.pychccjwk.cpython-36.opt-1.pychccjwk.cpython-36.pychccserverroles.cpython-36.opt-1.pychccserverroles.cpython-36.pychccconfig.pyhcchost.pyhccidp.pyhccjwk.pyhccserverroles.pyipa-hcc-update.serviceipa-hcc-update.timeripa-hccipa-hcc-serverCONTRIBUTORS.txtREADME.mdipa-hcccacerts00-candlepin-redhat-ca-sha256.pem01-redhat-entitlement-authority-2022.pem02-redhat-entitlement-master-ca.pem3bba0b9d.049f9274f.0fa9a18d6.0hcc.conf.examplehcc_registration_service.py85-hcc.ldifhccconfighccconfig.jshcchosthcchost.jshccidphccidp.js85-hcc.update86-hcc-registration-service.updateipa-hcc-serverCOPYINGipa-hcc.1.gzipa-hcchcc-enrollment.keytab/etc/gssproxy//etc/httpd/conf.d//etc/ipa//usr/lib/python3.6/site-packages/ipaserver/install/plugins/__pycache__//usr/lib/python3.6/site-packages/ipaserver/install/plugins//usr/lib/python3.6/site-packages/ipaserver/plugins/__pycache__//usr/lib/python3.6/site-packages/ipaserver/plugins//usr/lib/python3.6/site-packages/ipaserver/plugins//usr/lib/systemd/system//usr/sbin//usr/share/doc//usr/share/doc/ipa-hcc-server//usr/share//usr/share/ipa-hcc//usr/share/ipa-hcc/cacerts//usr/share/ipa/schema.d//usr/share/ipa/ui/js/plugins//usr/share/ipa/ui/js/plugins/hccconfig//usr/share/ipa/ui/js/plugins/hcchost//usr/share/ipa/ui/js/plugins/hccidp//usr/share/ipa/updates//usr/share/licenses//usr/share/licenses/ipa-hcc-server//usr/share/man/man1//var/cache//var/lib/gssproxy/-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protectiondrpmxz2noarch-redhat-linux-gnuASCII textemptypython 3.6 byte-compiledPython script, ASCII text executablea /usr/bin/python3.6 -s script, ASCII text executabledirectoryHTML document, ASCII texttroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix) R R R R R R R R R R R R R R R R R R R R R R/usr/bin/python3.6 -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1 if [ $? -eq 0 ]; then /usr/sbin/ipa-ldap-updater --quiet \ --schema-file=/usr/share/ipa/schema.d/85-hcc.ldif \ /usr/share/ipa/updates/85-hcc.update \ /usr/share/ipa/updates/86-hcc-registration-service.update # restart httpd if running /bin/systemctl try-restart gssproxy.service httpd.service >/dev/null 2>&1 || : fi/bin/shhttps://bugz.fedoraproject.org/ipa-hccutf-85f3b5c13c4381bc3eab7fc4c2ad1d5254063cba0353e7181c30df655e88f5e95?7zXZ !#,  ]"k%rٻrCEo4ENv~5Ƞ-F~$Dp:aC~ච '׵$v=1evnn kL(W7e-g{.[d~ +q6cx{C|?'CAT `IoF9)Gja.t.:b<2u֞zX[*Z㰱x~m h+~7gN* h2K&ˇ*#:Ÿa(T]zrCϞx.a6=8Β3~_gV"%dj!M FV vBTJ0';\v{7|%lHBhSD6xk>D·g/J+e% ߆Q_,/?4?Ŏˣ]{^wqSlM. /wL86IS: &\2JUv;=y !C;:d `cg_pү";Y?aЪ2q賮,؋f,eYo6{r#Q>d_d_L"fz;ab$pʽ Y] 薒!ipNn FɈzFX @0ifmok8>ۋ(x䪕@5Fd K}U;=K+!8׉/_>j7^gy8aW[*c-dzbQƁap y@Z*Vz|uC%%n_btuX~7mM `K &"/!%!BDF`gUZ/C^VAO-$FTE..zowU~ŁvS'\2}p^~*g`r'4SWԱ[^!:v,Η$?K %a@VJm6qPRF4Zwۘ> bqJΏ 8)ˀ+U2Τ1v|) 5/F\c '{ĕ|s߼L)^%Kv0 Na~HR%vDM$m~Km')ާ-yF@~֪r!껃l t+{p|G|V0Nž@5 [Yʼnhl6OEY{K- F I"WA!œ99BjԼH#B`;,@yǺK'<tg=Y߇$nE9}K)V<.iTt\tSnNss 2(Ƽgړ<LbKfB٠qШjDp+sJ $DiL0JҬ~<(0Vrc av|ξ_x7LWtпOy]~'4C)R?=d+G!%t_. FAîƤTvTlHSw(rILXPXxvF>S~牢|_1ewn{)66s5w{jNAB1bDo 73䠘Ӈʬ{Z;dΨ:%~rõW9YC9%(Nl`9LčJA1m-,.e7+s30ּ5[X+PKYCU({R<ăOŌ@pE$f4Jjfc%]Tz1uiVځysIG=}?Lh6c|Z\H.ƍNA7>=ɷCFVFBe}M/KbB0}߽'!lYucs$bUUaFJݩ&h"U)c8 S\H#7avk9T<$ɃM aN fZ(Ԁ!)^gqr!<xgNNs$įF t ߇~@Չ0}Q49 q~%FЇt9&EB<P<U:| GEdhƕ[d/A 2,AQ8d'D`qr-KWFSn9C\G[ 1& ȭ  ?/w @ct_XX *he^\y$x& =i5\r^KI@evjO*:k;Y1!aqƶj>&MF3+iŵ.bA]BI>`SD^BbJ<,m̠t .9iCȠ{(^ՉXyͻy7B1;4I>hX_&DmӸ;cYxG.F{ %Why+E' |xWf;{!4v }/T0͋lPsCdj^Bys4o)[ejUt3r8b%kR76مz !DSnI7DVyf++|w+\)?8DN/4`%*&

tX{ gl1LYX$*2WtW->M9B-{9 0VPT~Y]\$8OEjsZcVĵi-PSG|^@߱{ 1w=T쳈=ddf1l(=T[FQqTC3E\0Ips4L<ٛ{^%$[J Mc/j+"d #{[.ڔyȖ?i LQ1K \ ' "+(w/dVN]rf\ZPNq{-4ٚU$z}(}WQ0n\vYv .&bM yÌ'1H*9梔F٥._Nf0}"gKDc1"T1B+G}f;1mS Qz?7p:J`j?_.RF?׉~F%/Lb;ႆ-k^ h^"t0{ PF<M 62(*0r<-+vK#D/m~e&,Jd:GI˂