haproxy-2.4.22+git0.f8e3218e2-150400.3.19.1<>, pehŽp9| ųОOZ6~`Xgj7H[7̮~Ok !bV`x~qTqy[q3*[B/zK~d8 (fqFf3ɸ?4N]vs֭՜s#?oV]"b7\ORx"`rnl"(u t^|c=h,dt:W8:g&h@v7򰰱qO%yQS>RO?Od   . d6M c: N Q   0 | 8O 8;<>AA8CC.D.IS.(I8I9LP:W=-F>-N?-V@-^B-fF-~G-H/I2,X2Y2Z3x[3\3]5^>YbAcAdB?eBDfBGlBIuB\vDwIxLyN\+zOOOO$O(O,OBODOHOPOTOXO^OChaproxy2.4.22+git0.f8e3218e2150400.3.19.1The Reliable, High Performance TCP/HTTP Load BalancerHAProxy implements an event-driven, mono-process model which enables support for very high number of simultaneous connections at very high speeds. Multi-process or multi-threaded models can rarely cope with thousands of connections because of memory limits, system scheduler limits, and lock contention everywhere. Event-driven models do not have these problems because implementing all the tasks in user-space allows a finer resource and time management. The down side is that those programs generally don't scale well on multi-processor systems. That's the reason why they must be optimized to get the most work done from every CPU cycle.ehŽh01-ch4ciSUSE Linux Enterprise 15SUSE LLC GPL-3.0+ and LGPL-2.1+https://www.suse.com/Productivity/Networking/Web/Proxyhttp://www.haproxy.org/linuxx86_64 if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in haproxy.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi /usr/sbin/sysusers2shadow %3 <<"EOF" || [ -f /.buildenv ] u haproxy - "User for haproxy" /var/lib/haproxy EOF if [ "$YAST_IS_RUNNING" != "instsys" ]; then if /usr/bin/systemctl is-active --quiet apparmor.service; then /sbin/apparmor_parser -r -T -W /etc/apparmor.d/usr.sbin.haproxy &> /dev/null || : fi fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in haproxy.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable haproxy.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop haproxy.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in haproxy.service ; do sysv_service="${service%.*}" rm -f "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart haproxy.service ) || : fi fiFFM,xP (  |E B !X*hu$;_ % $ e 5%?Rj -M FF #!L 6y='5ql3{1hJxPfR.T:y=0WBF_bKzHSHcagD Hbf{.seqvv10 ",TH}yuw9 A聠A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤AAA큤AehŹehŹehŹehŹehŹehŹehŹehźehźehŹehŻcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYehŹehŤcYehŤcYcYcYcYcYcYcYcYcYehŤcYcYehŤcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYcYehŻcYehŹehŹehŹehŹehŹehŹ084a3b5332563f6ce8433037a473ad263c6438493da6f13223329cdadd84f152603f2db99b558f41fca9744e9bcbe8c4a93eb5c039df6159407df6d992ce82717f5110a65d8568673546776881abd3e8d3eeda0c5d1239f0a6cbb5d33b83471c215c8b930a6f9b422cc69154ed87ac6741f4f65dc35ce9ceb6e4b7924ba25b83b0a9be5257c97649cc9e46428dae8112dd7290795074f4d9e14352463cb4dfde544e5615feca06b24fcfe30f13fc74d986bd4d1a77f374a2e1fb8fb899b2f74e0645f3fc655c6d94cdffe20ab2fef760bff92b2e638d80ddac3cf1782525fbd7c5b70d25c4fc8bdb1e56040746fb2009a99b603d32e288ed2213916bb1838321c05ef16f5dd2edc28f865f1946287420b14b838937fbd82a75954d0888e5f87e4739782b06489350a37a8d3753d97f4d34021a3ef3b595ee43b74d762d35c3bce5120fc7e8f576ad299158bbde68e8cd56425b1dda1427e43a2292ecb2cc583da1682cb28a8690cb90edeaa61f3d0207e8f282b7a50be46e5aa37606339f9c273f4798caf1f53b68a920f811d9ad79537188b9ad518679243848ea81bda4289f53bd6d594893cef3b2f2c9448dd0a50d5fe1ab5863732f41ce63eed5e2c9cc8cc4fce4f65e4df4b3154b05e8e7b99e54c8122438898b831768bca002f00c352ed2cf7dd73555848d569b8e298ee251e45e6eecd57759e9b745224b9a0c3193fce8ac8a342e7ac6f97f864fde1ccadd0f194443ac722e159be552514d8e4990b95f66ea643546bd70230485446685ed27e34f0bd573d5afabd2611b50ce59339e48b4ebadeaa6b28b67fc310cf66d0885964ce6b94356fbef62fc752332c07e071c2371e2effd1ceb80d1087f6b36194312860f79c135ded8c129490078beac53daec4e7e15c5a9dd9590395722f38df3faae087f02f388ae1dd4594a0d4a1fb5a2286746a00d5986be9390f3c532811a97f884a8d99e970515e9c7ec2e05824e6307a254873823854929a072c6ea5f18c7b58348eb53a77314d4db606c737461f9dedcd550de481fcf0a25b3dde843e082dc377e21604024710f8cc662b0de60beeab05b3c2918107f640cce6fcdfcc2287974bc840b28d5f20d8f0d79f2c1238ffa2e010c4fb6c2672074a0ee92816189cd71df18d515ca85e08b53e91501378065efcbc5006ad6b13ccb8655a586332d43723469435d1be34ba0caf0d5f40a2f8b1a15ed36f0fdeab5d27c6d77c5e8a5efa5c4473589bae29ab49409abda031e077f8088259af3a5bf90e62058101480e922d31e8d17241437ea9a44354dab41d854071ef50acf6f6a955d8b31c8c3f72aa00572964ece1cbcdd589cddcf0e0d412d8a01f320acec1eeeb9f5d54c6c0f296584b590c36193f632d83d50677726c4180905a63b6db5b242a9b0c66159f10755eecb2b07d4baba5dbfd471d0e4d028ff74221702450647838cef1bc7e5b1bfda273e17c98d2f0aa8c9bf186b70f99bc04c0a6818e513c09cf7e0f59ec748d2b78d3d169e33d52452fa4abe24327087af4a1625bc4da102f9e9d8c07f8372e31caf7420df9755f2b43af7056fa1fb8dbc7d20fde3c9a8e7531b92ec058fbe3d45902a648432beacd69e77f3fc131101dfe12cc7ab96535e642a76d86d66bbc983d82700aafbbb30dd5392d6ccad52646d932f52e68df43417ff910f45aa52157702f4d2a4a5b875545e047f434c9fa69cf584383c71c67cfea0349f9c236b4bffac3da6f9bd7b320d35b59dc05bac1e1a0791101f4e4db2772fcf852353e921a38ede1d0705d1be9983ad4c7bff1a15755124dd229112203f34fffe1ed8951a4a1fe0832af9aaf02f0bd8b0591e59efe86cf5e2d6767ab90bdb1446d49393862fba2f761dd5a23c43373e17336c799602bc1ef35d2208c0519c1288516147a703f16c2837eb8802deb27f83beaa0ac0c626a1ac4d322f40710ace0faa6a234f7225c8f9704de47de79cdd537eca68c228b43fd0815a63c0c25edfdb2973e1e35f80f11e96b54c1ba6ebd99acb147cfd530085d317dcfa3a574346dd436ea7655ee1d7f6a7ffda00c8f82489af9df31bd11eceedd77e158084634322ff655946b4885553ddbc23e9d3bec3cf281316d2add72376d97d081e70f90eaa106d8bc3db6d06f8b03f45537630643d37c3e4ae97b754536c126971f465036a1466e29bab7690d4a7a243ee02defb4aa0a584161be3e29e6d5f6f060316c8cc7fc9e674d51e4e5db1546d3eef226b1f60cfddb9db7630752f8fdc6898f7c99a99eaeeac5213627ecb093df9c82f56175dc754bd975b46612e6262f568b24d42cb250c9bed35a5d61ae94903b867764efaaab660a60da56eeaf9c0f39438256adf79682080b0da66cbe9d20b8d880da50554315b631e8bd8597b846c53ebd6cb979681b9e77e5e1380b22d4fb367d57ec06917cf40ba6775c9265ae4452b7afc995c89795e0c511eb7bfdbf84e79b46399ef3f28821753af9ec235dbbedff69ad9ff24a2c3902377ea1f1c596959b8fb7d912dc5b54429fd37ab30e43b21ff0664c6d44ae47c51a9f47a739cf08dceff350d26fc8fb3d1e2c5c87fc6c7effb84e7f3f675a653b1b9801e232c9ca6ac66afdad454a90e7a7476c2e870506e24bc8a43f1a6376c0235f6f19ccb29bc2ef027206e1d407d7f7d220aa0d09e820f069280bc5f8d51ffac6b28fc85e73eb2e859285526d6a176a9d4d631354266f84d7e943a30cfb3d6a5e9e58d7292331ae7a3d767cba8d40707250a7b2c96a9d3666184e5457c91710d04510ec2ff397a49c0f5d4884cb81ebb5196e0971e3e21fa479213ec7e33efa17c2d2519e9f76a3e01f9ffce8698a6dca01674441b1eab6c307f2babba18e36b9bb2ad15fd4700cdb28941ad63598d2fbe3a8d31f611ac978f67ad23e2ea7842ea1d5ac94dcc603921678b1379cc9d122272b848f14f864248f495dc083a48a721af561036e1f4a9b193be03aef9969a56a496e6bbd2f27d2ab365fa43020a375a523ae493ced3779dc72819c4ab859b6799fb9abfa6dbd3774c5a724d2004b0c36ddd7620ce70bbecd320bfecd8dd15384410c0af22ff1a43078c84dcb81b2d5f77c2e7f1835e232e7519fc70a9d5ae57995e069afc89379f17a2ee209afeaf58a62fe426d0b09bec61c8ddc3ebad4e250cbcc3e86dc9317e03223b905db8b3fe3704d478c4cb56b9cff2d11a1379ab1acc0b26f8816715d9d676094b49fc904e684eb1729dba365c87fbfeded2989e940ec4704adb89860b18ae9a5e606dcba2b46470acfd46963d72bddabaf7ab7f7e8a7862b8324710eceea9d6b6fdd347449d4c2dc4bb4324afe8df196b53de42c6bd96acd12a37968edee08f60c397640d96da38216b769a9a5e61ff6890e638b6348a43aea82e48b1bbe37814d7cb263cd0b9df240a31a880fbaeb231526e1ccc3f38239ca9805384c61171c5abfcc0fdbb7951cfcb8a8ff93050056678bcca805f5f35c85eb9df481317f1fedaa293244d54fc1bc0527ef867316eda08e96d1708307243a4268d575e352e8f15c9f53015f7e66b4f614087fe7672281d8d441231f1a00322f86eaeab1060ffd5d057f2aa37c6dd97935fd6a69452fce3e3074f6249c19f3197120879ae13a9b29e6d405027607e351d473ac77995f9e626f255484b39cc239d270db1703d1f19b43837994a04068afe5d6b3c84a7b5dfcb0c34fdf4626ae19be1ed79c339fc033640ae26a625025f8cdcde2f73c2d61c0b8491f194c4dfd665a46251c54f89c8d904726f6bb790c5c1ec009b0f6598c61e77d5aa075baacadd009caa28a7583c988dc6dca2e9ef805e90ad0f1ddd5fa373c6b0956ebb50eb0af8066dd3628579c61638e42b066be5437788e3769da6372403ef5b062d13520dd34598a6d75db6958c831f6061c6ee57f6088f32f1da978fa64e8e71227da9a73bf960bc804cef476023b7d2d4296bf7870b824522de1204b84871e2886848361e2258a2827c46ed9580fb8805a8f08997c5858fe8a61f4f485e7bcf0ce41ae9f2edaf663b335e025eb4e388378d7800ccc4ffbdd155d2c5d40cf8757831a9ee1870732eab60f904b4a3ad5dda30c808783f69d29bdc9497f4c6a21a76ca645c80715c374995a48cbd2e97c7aeea1cb00cc441a90ecd2916741f6a3db2aee1defe3862c731ccc6237050859f8509ad07d88b0151992bf3076ecd574b8da972232cc571070ee027e8f1b598f9c5a0702637335108b5d7953cb28d8ad3880437f696d3c6f5e60400f5eeb03d558c400a8bae39a6a67c8c18e38c83f59f5de06e05a8d8008438b8e468383381bcbc57c5fc9cc1904c10f3752f22d451fde8d389d36e194e1edffead5e5ebe7967736f691ea94b34ff514d5087b81be1b547848f90f0259e55ea346e99c54f8b9cf2a504227dd1a95df07007198989c622f5d41de8d703e7bef3d0e79d62e24332ee739a452af62aa20dcc3994852776b8552b9820c1a562196da33b81b224d4441c9fcdec3ca01476bf9cf3d942c6bd5ae671bb085c16b62b1610a6f4e3c278bbd0624b5127164ae7ea3f2d38da55e9226339e79c7e8dccd9449fd2d46d6f959c898c0157da420649e853756c3bbc50bd78c1e86484ab1e10ad8306b47a02b8022874c5927485055ef30b40bee05aee79617246a9758b90f5cb8937ad211f013b0de4d223a4b63e772d8e729046cdcb1b92bac78f98b034aebf88129575a37d2c945480cd60135292e4b0e43a7c65565cd93bfe2f19f65b78a2e1366802d896a0449fdc61fad7905d11c7cf32dd30be3c44eb7ee189e2e6d13872a859cd4d1a6b72e30616a571ad418b96e4805efc0cfa7ec523796f745d8f44cc62e814cdbdb9d8b60943f3f54eec0ded52ec03d1e500ca9f0acdb33653875f12e4348540c4d6d69aeefb269a35ab2c913d39946958301ca81ee6a408457997a2885cc2eedd6f3ea92b842d8fd2b230ec2c76f27f96ab3b009902d3d68db46e30de879c53970dc6dee6db65d2aa42a6b68d251cce7b0339205c9518fa674b81bd6fac82b24ae80875245bb83ecdbf962c786c9d6c216899ca3dc196213c9e0661722ba546bd467dc43a8f8e4cfd1433303adfd6aedef5fec8fb0b07f531de18fe74dc70811813ebeabeae30475e30dd24c803f6ca1824328fbc160690f9dcb99a4235531898d73827e6e3a9bd7700648f72f159454c31029bdaad74b68532a76681d217a23e254f43201430108bfc047fef5d6360f7cba560c850a1ebfbcb361894bd08b1952e665101a2217df18176071905064c6cf9cba8b2eddcc7981186c696c518fad489b2d7f1a966eaf95d0678c912fab844d54a83ba50029769afcbcc044bcfce311819281db60c3790257628aa1f6e175570127e3e2716b6b5529c780a92198755fff6973ef4ab3846aabc2373c3f6e0f5f6991bef967e90b44a9493b44b9aa1a688a0f2769232ec671d01891ba5d10cd6fbcd162a52776a36514ca09dad6966db41ecb0b627362076e160b7814ec9b1406c78e89e16281331eb69a6f5ac21492414fea1d18b34195cec3ecefa11afc1ecc0b705f82e1365fcdc1f896d3c4978110913366d23c19f36a768a4f245953fc1fefe14bcadbf739cb3ea0c2e22cc93b70ff9c305e031bb4f50eaa35d72cff4e2ee4f74c6eb349a5b717516e2d97fbfa1fcb602777f67643e0717ca51fceaa25ac9e5ccc62e0c727dcf27796057201fb5fded56a25ff6ca282da5e249ffb1ec4c8b05e3764af14207278514f17f02beaa52d6ff87adc14a96f4a36b2bff1af35af218edc056dd395c994c2b9aaba6dc802011c3997d099857/sbin/serviceQQrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootroothaproxyhaproxyrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootroothaproxyhaproxy-2.4.22+git0.f8e3218e2-150400.3.19.1.src.rpmconfig(haproxy)group(haproxy)haproxyhaproxy(x86-64)haproxy-1.5haproxy-docuser(haproxy) @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@     /bin/sh/bin/sh/bin/sh/bin/shconfig(haproxy)libc.so.6()(64bit)libc.so.6(GLIBC_2.10)(64bit)libc.so.6(GLIBC_2.11)(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.15)(64bit)libc.so.6(GLIBC_2.16)(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.2)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.5)(64bit)libc.so.6(GLIBC_2.6)(64bit)libcrypt.so.1()(64bit)libcrypt.so.1(XCRYPT_2.0)(64bit)libcrypto.so.1.1()(64bit)libcrypto.so.1.1(OPENSSL_1_1_0)(64bit)libcrypto.so.1.1(OPENSSL_1_1_1)(64bit)libdl.so.2()(64bit)libdl.so.2(GLIBC_2.2.5)(64bit)libdl.so.2(GLIBC_2.3.3)(64bit)liblua5.3.so.5()(64bit)libpcre.so.1()(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2.5)(64bit)libpthread.so.0(GLIBC_2.3.2)(64bit)libpthread.so.0(GLIBC_2.3.4)(64bit)librt.so.1()(64bit)librt.so.1(GLIBC_2.3.3)(64bit)libssl.so.1.1()(64bit)libssl.so.1.1(OPENSSL_1_1_0)(64bit)libssl.so.1.1(OPENSSL_1_1_1)(64bit)libsystemd.so.0()(64bit)libsystemd.so.0(LIBSYSTEMD_209)(64bit)libz.so.1()(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)sysuser-shadow2.4.22+git0.f8e3218e2-150400.3.19.13.0.4-14.6.0-14.0-15.2-13.24.14.3ehy@d@d5Kc1c@b'E@ayaZaZaV@a7T@a`@`9@`f@``c`\{@`P`?z@``U__I@__u@_:_:_@_@_@__@_w@_w@_Wr@_$_{_c^y^(@^(@^@^@^^F^C^=Q@^=Q@^)]@]]B]@]@]@]@]߶]e@]@]@]@]@]@](]]^][][][]@1@]$]@]@]@]\-@\ac\73\[[[[[[v[ug@[3|@[3|@[0@[ @Z?ZȲZZ%ZZU@UcUPUG_@UD@U4@U/@UTE@TD@TԬT@T@T@TdTxcTuTuTmT_W@TSyTPTBV@TAvarkoly@suse.comvarkoly@suse.comvarkoly@suse.comvarkoly@suse.comvarkoly@suse.comvarkoly@suse.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.degmbr3@opensuse.orgmrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.dekukuk@suse.commrueckert@suse.demrueckert@suse.demrueckert@suse.dedimstar@opensuse.orgmrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.dekgronlund@suse.comkgronlund@suse.comkukuk@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.dekgronlund@suse.comkgronlund@suse.comjengelh@inai.demrueckert@suse.demrueckert@suse.dekgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.dekgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.commrueckert@suse.dekgronlund@suse.commrueckert@suse.dejengelh@inai.dekgronlund@suse.comkgronlund@suse.comkgronlund@suse.commrueckert@suse.demrueckert@suse.dekgronlund@suse.comkgronlund@suse.commrueckert@suse.demrueckert@suse.demrueckert@suse.dekgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.commrueckert@suse.dekgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.dee.istomin@edss.eemrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.dedmueller@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.comkgronlund@suse.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.dekgronlund@suse.commrueckert@suse.deaspiers@suse.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.deledest@gmail.commrueckert@suse.dekgronlund@suse.comledest@gmail.commrueckert@suse.dekgronlund@suse.commrueckert@suse.dekgronlund@suse.com- VUL-0: CVE-2023-45539: haproxy: misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653) Apply upstream patch. Add patch: 0001-BUG-MINOR-h1-do-not-accept-as-part-of-the-URI-compon.patch- VUL-0: CVE-2023-40225: haproxy: reject any empty content-length header value (bsc#1214102) Apply upstream patch adapted for 2.4.22 (patch h2_parse_cont_len_header() instead of http_parse_cont_len_header()) Add patch: 0001-BUG-MAJOR-http-reject-any-empty-content-length-heade.patch- ECO: Maint: Update haproxy to latest maintenance release for all SLE15 (jsc#PED-3821) - rebase and rename haproxy-1.6.0-sec-options.patch -> haproxy-2.4.22-sec-options.patch - remove patches covered by new release: lua54.patch 0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch 0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch 0001-output-buffer-is-not-zero-initialized.path 2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch - Update to version 2.4.22+git0.f8e3218e2: * [RELEASE] Released version 2.4.22 * BUG/CRITICAL: http: properly reject empty http header field names * CI: github: don't warn on deprecated openssl functions on windows * BUG/MEDIUM: stconn: Schedule a shutw on shutr if data must be sent first * DOC: proxy-protocol: fix wrong byte in provided example * DOC: config: 'http-send-name-header' option may be used in default section * DOC: config: fix option spop-check proxy compatibility * BUG/MEDIUM: cache: use the correct time reference when comparing dates * BUG/MEDIUM: stick-table: do not leave entries in end of window during purge * BUG/MINOR: ssl/crt-list: warn when a line is malformated * BUG/MEDIUM: ssl: wrong eviction from the session cache tree * BUG/MINOR: fcgi-app: prevent 'use-fcgi-app' in default section * [RELEASE] Released version 2.4.21 * BUG/MINOR: sink: free the forwarding task on exit * BUILD: hpack: include global.h for the trash that is needed in debug mode * BUG/MINOR: mux-h2: add missing traces on failed headers decoding * BUG/MINOR: listener: close tiny race between resume_listener() and stopping * DOC: config: fix "Address formats" chapter syntax * BUG/MINOR: mux-fcgi: Correctly set pathinfo * DOC: config: fix aliases for protocol prefixes "udp4@" and "udp6@" * DOC: config: fix wrong section number for "protocol prefixes" * BUG/MINOR: listeners: fix suspend/resume of inherited FDs * BUG/MINOR: http-ana: make set-status also update txn->status * BUG/MINOR: http-fetch: Don't block HTTP sample fetch eval in HTTP_MSG_ERROR state * BUG/MINOR: http-ana: Report SF_FINST_R flag on error waiting the request body * BUG/MINOR: promex: Don't forget to consume the request on error * BUG/MINOR: resolvers: Wait the resolution execution for a do_resolv action * BUG/MINOR: h1-htx: Remove flags about protocol upgrade on non-101 responses * CLEANUP: htx: fix a typo in an error message of http_str_to_htx * BUG/MINOR: http: Memory leak of http redirect rules' format string * REGTEST: fix the race conditions in hmac.vtc * REGTEST: fix the race conditions in digest.vtc * REGTEST: fix the race conditions in json_query.vtc * BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned * BUG/MINOR: http-fetch: Only fill txn status during prefetch if not already set * BUILD: makefile: sort the features list * BUILD: makefile: build the features list dynamically * BUG/MINOR: pool/stats: Use ullong to report total pool usage in bytes in stats * BUG/MEDIUM: mux-h2: Refuse interim responses with end-stream flag set * BUG/MINOR: ssl: Fix memory leak of find_chain in ssl_sock_load_cert_chain * LICENSE: wurfl: clarify the dummy library license. * BUG/MEDIUM: resolvers: Use tick_first() to update the resolvers task timeout * REGTESTS: startup: check maxconn computation * REGTESTS: fix the race conditions in iff.vtc * BUG/MAJOR: fcgi: Fix uninitialized reserved bytes * DOC: promex: Add missing backend metrics * MINOR: promex: introduce haproxy_backend_agg_check_status * BUG/MINOR: promex: create haproxy_backend_agg_server_status * BUG/MEDIUM: mworker: fix segv in early failure of mworker mode with peers * BUG/MINOR: ssl: Fix potential overflow * BUG/MEDIUM: ssl: Verify error codes can exceed 63 * BUG/MINOR: resolvers: Don't wait periodic resolution on healthcheck failure * BUILD: peers: peers-t.h depends on stick-table-t.h * CI: github: change "ubuntu-latest" to "ubuntu-20.04" * BUG/MEDIIM: stconn: Flush output data before forwarding close to write side * BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action * [RELEASE] Released version 2.4.20 * Revert "CI: determine actual OpenSSL version dynamically" * Revert "CI: switch to the "latest" LibreSSL" * SCRIPTS: announce-release: add a link to the data plane API * DOC: config: clarify the -m dir and -m dom pattern matching methods * DOC: config: clarify the fact that "retries" is not just for connections * DOC: config: explain how default matching method for ACL works * DOC: config: mention that a single monitor-uri rule is supported * DOC: config: clarify the fact that SNI should not be used in HTTP scenarios * DOC: config: provide some configuration hints for "http-reuse" * Revert "BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action" * BUG/MINOR: mux-h1: Fix handling of 408-Request-Time-Out * BUILD: http-htx: Silent build error about a possible NULL start-line * BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action * BUG/MINOR: log: fix parse_log_message rfc5424 size check * BUG/MINOR: cfgparse-listen: fix ebpt_next_dup pointer dereference on proxy "from" inheritance * BUILD: listener: fix build warning on global_listener_rwlock without threads * BUG/MINOR: server/idle: at least use atomic stores when updating max_used_conns * BUILD: peers: Remove unused variables * BUG/MEDIUM: peers: messages about unkown tables not correctly ignored * BUG/MINOR: ssl: don't initialize the keylog callback when not required * BUG/MINOR: http_ana/txn: don't re-initialize txn and req var lists * BUG/MEDIUM: listener: Fix race condition when updating the global mngmt task * BUG/MINOR: pool/cli: use ullong to report total pool usage in bytes * BUG/MEDIUM: ring: fix creation of server in uninitialized ring * DOC: config: fix alphabetical ordering of global section * REG-TESTS: cache: Remove T-E header for 304-Not-Modified responses * BUG/MINOR: mux-h1: Do not send a last null chunk on body-less answers * BUG/MEDIUM: mux-fcgi: Avoid value length overflow when it doesn't fit at once * BUG/MINOR: mux-fcgi: Be sure to send empty STDING record in case of zero-copy * BUG/MINOR: resolvers: Set port before IP address when processing SRV records * BUG/MINOR: http-htx: Fix error handling during parsing http replies * BUG/MEDIUM: wdt/clock: properly handle early task hangs * CI: emit the compiler's version in the build reports * CI: switch to the "latest" LibreSSL * BUG/MINOR: ssl: ocsp structure not freed properly in case of error * BUG/MINOR: ssl: Memory leak of AUTHORITY_KEYID struct when loading issuer * CI: add monthly gcc cross compile jobs * BUG/MINOR: log: fixing bug in tcp syslog_io_handler Octet-Counting * BUG/MEDIUM: stick-table: fix a race condition when updating the expiration task * BUG/MAJOR: stick-table: don't process store-response rules for applets * DOC: management: add forgotten "show startup-logs" * BUG/MINOR: stick-table: Use server_id instead of std_t_sint in process_store_rules() * CI: SSL: temporarily stick to LibreSSL=3.5.3 * CI: SSL: use proper version generating when "latest" semantic is used * BUG/MINOR: sink: Set default connect/server timeout for implicit ring buffers * BUG/MINOR: sink: Only use backend capability for the sink proxies * BUG/MEDIUM: compression: handle rewrite errors when updating response headers * BUG/MINOR: ring: Properly parse connect timeout * BUG/MINOR: log: Preserve message facility when the log target is a ring buffer * CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in workflow definition * CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in matrix.py * BUG/MINOR: server: make sure "show servers state" hides private bits * BUG/MAJOR: stick-tables: do not try to index a server name for applets * DOC: configuration: missing 'if' in tcp-request content example * BUG/MINOR: backend: only enforce turn-around state when not redispatching * BUG/MINOR: smtpchk: SMTP Service check should gracefully close SMTP transaction * MINOR: smtpchk: Update expect rule to fully match replies to EHLO commands * BUG/MINOR: mux-h1: Account consumed output data on synchronous connection error * BUILD: http_fetch: silence an uninitiialized warning with gcc-4/5/6 at -Os * BUG/MINOR: http-fetch: Update method after a prefetch in smp_fetch_meth() * BUILD: h1: silence an initiialized warning with gcc-4.7 and -Os * BUG/MEDIUM: lua: handle stick table implicit arguments right. * BUG/MEDIUM: lua: Don't crash in hlua_lua2arg_check on failure * DOC: config: Fix pgsql-check documentation to make user param mandatory * BUG/MINOR: checks: update pgsql regex on auth packet * [RELEASE] Released version 2.4.19 * BUG/MEDIUM: resolvers: Remove aborted resolutions from query_ids tree * REGTESTS: 4be_1srv_smtpchk_httpchk_layer47errors: Return valid SMTP replies * BUG/MINOR: log: improper behavior when escaping log data * SCRIPTS: announce-release: update some URLs to https * BUILD: fd: fix a build warning on the DWCAS * BUG/MEDIUM: captures: free() an error capture out of the proxy lock * DOC: fix TOC in starter guide for subsection 3.3.8. Statistics * REGTESTS: ssl/log: test the log-forward with SSL * BUG/MEDIUM: sink: bad init sequence on tcp sink from a ring. * REGTESTS: log: test the log-forward feature * REGTESTS: healthcheckmail: Relax matching on the healthcheck log message * BUG/MINOR: stats: fixing stat shows disabled frontend status as 'OPEN' * MINOR: listener: small API change * BUG/MEDIUM: proxy: ensure pause_proxy() and resume_proxy() own PROXY_LOCK * CI: cirrus-ci: bump FreeBSD image to 13-1 * BUG/MINOR: signals/poller: ensure wakeup from signals * BUG/MINOR: signals/poller: set the poller timeout to 0 when there are signals * BUG/MINOR: task: always reset a new tasklet's call date * BUG/MINOR: h1: Support headers case adjustment for TCP proxies * BUILD: makefile: enable crypt(3) for NetBSD * BUG/MINOR: regex: Properly handle PCRE2 lib compiled without JIT support * BUG/MINOR: mux-fcgi: fix the "show fd" dest buffer for the subscriber * BUG/MINOR: mux-h1: fix the "show fd" dest buffer for the subscriber * BUG/MINOR: mux-h2: fix the "show fd" dest buffer for the subscriber * BUG/MEDIUM: mux-h1: always use RST to kill idle connections in pools * REGTESTS: http_request_buffer: Add a barrier to not mix up log messages * BUG/MEDIUM: mux-h1: do not refrain from signaling errors after end of input * BUG/MINOR: tcpcheck: Disable QUICKACK for default tcp-check (with no rule) * BUG/MINOR: hlua: Rely on CF_EOI to detect end of message in HTTP applets * BUG/MEDIUM: peers: Don't start resync on reload if local peer is not up-to-date * BUG/MEDIUM: peers: Don't use resync timer when local resync is in progress * BUG/MEDIUM: peers: Add connect and server timeut to peers proxy * BUG/MEDIUM: spoe: Properly update streams waiting for a ACK in async mode * DOC: configuration: do-resolve doesn't work with a port in the string * REGTESTS: Fix prometheus script to perform HTTP health-checks * BUG/MINOR: tcpcheck: Disable QUICKACK only if data should be sent after connect * BUG/MINOR: resolvers: return the correct value in resolvers_finalize_config() * BUG/MAJOR: mworker: fix infinite loop on master with no proxies. * BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized * BUG/MEDIUM: mux-h2: do not fiddle with ->dsi to indicate demux is idle * BUG/MEDIUM: http-ana: fix crash or wrong header deletion by http-restrict-req-hdr-names * BUILD: http: silence an uninitialized warning affecting gcc-5 * BUG/MEDIUM: ring: fix too lax 'size' parser * BUILD: debug: silence warning on gcc-5 * BUG/MEDIUM: task: relax one thread consistency check in task_unlink_wq() * BUG/MEDIUM: poller: use fd_delete() to release the poller pipes * BUILD: cfgparse: always defined _GNU_SOURCE for sched.h and crypt.h * BUG/MINOR: sink: fix a race condition between the writer and the reader * BUG/MINOR: ring/cli: fix a race condition between the writer and the reader * BUG/MEDIUM: proxy: Perform a custom copy for default server settings * REORG: server: Export srv_settings_cpy() function * MINOR: server: Constify source server to copy its settings * BUG/MEDIUM: dns: Properly initialize new DNS session * BUG/MINOR: peers: Use right channel flag to consider the peer as connected * BUG/MEDIUM: peers: limit reconnect attempts of the old process on reload * MINOR: peers: Use a dedicated reconnect timeout when stopping the local peer * BUG/MEDIUM: pattern: only visit equivalent nodes when skipping versions * MINOR: ebtree: add ebmb_lookup_shorter() to pursue lookups * MINOR: http-htx: Use new HTTP functions for the scheme based normalization * BUG/MEDIUM: h1: Improve authority validation for CONNCET request * MINOR: http: Add function to detect default port * MINOR: http: Add function to get port part of a host * BUG/MEDIUM: mworker: use default maxconn in wait mode * [RELEASE] Released version 2.4.18 * BUG/MINOR: sockpair: wrong return value for fd_send_uxst() * BUG/MINOR: backend: Fallback on RR algo if balance on source is impossible * BUILD: add detection for unsupported compiler models * BUG/MEDIUM: mworker: proc_self incorrectly set crashes upon reload * REGTESTS: Fix some scripts to be compatible with 2.4 and prior * BUG/MINOR: tools: fix statistical_prng_range()'s output range * BUG/MEDIUM: tools: avoid calling dlsym() in static builds (try 2) * BUILD: makefile: Fix install(1) handling for OpenBSD/NetBSD/Solaris/AIX * BUG/MEDIUM: tools: avoid calling dlsym() in static builds * MEDIUM: mworker: set the iocb of the socketpair without using fd_insert() * BUG/MEDIUM: mux-h1: Handle connection error after a synchronous send * BUG/MEDIUM: http-ana: Don't wait to have an empty buf to switch in TUNNEL state * BUG/MINOR: mux-h1: Be sure to commit htx changes in the demux buffer * REGTEESTS: filters: Fix CONNECT request in random-forwarding script * BUG/MEDIUM: http-fetch: Don't fetch the method if there is no stream * BUG/MINOR: http-htx: Fix scheme based normalization for URIs wih userinfo * BUG/MINOR: peers: fix possible NULL dereferences at config parsing * BUG/MINOR: http-act: Properly generate 103 responses when several rules are used * BUG/MINOR: http-check: Preserve headers if not redefined by an implicit rule * BUG/MINOR: peers/config: always fill the bind_conf's argument * MINOR: fd: Add BUG_ON checks on fd_insert() * CI: re-enable gcc asan builds * BUILD: Makefile: Add Lua 5.4 autodetect * BUG/MEDIUM: ssl/fd: unexpected fd close using async engine * MINOR: fd: add a new FD_DISOWN flag to prevent from closing a deleted FD * BUG/MINOR: http-fetch: Use integer value when possible in "method" sample fetch * BUG/MINOR: http-ana: Set method to HTTP_METH_OTHER when an HTTP txn is created * BUG/MINOR: ssl: Do not look for key in extra files if already in pem * MEDIUM: mux-h2: try to coalesce outgoing WINDOW_UPDATE frames * BUG/MEDIUM: ssl/cli: crash when crt inserted into a crt-list * BUG/MINOR: tcp-rules: Make action call final on read error and delay expiration * BUG/MINOR: cli/stats: add missing trailing LF after "show info json" * BUG/MINOR: server: do not enable DNS resolution on disabled proxies * BUG/MINOR: cli/stats: add missing trailing LF after JSON outputs * REGTESTS: healthcheckmail: Relax health-check failure condition * REGTESTS: healthcheckmail: Update the test to be functionnal again * BUG/MINOR: checks: Properly handle email alerts in trace messages * BUG/MINOR: trace: Test server existence for health-checks to get proxy * BUG/MEDIUM: mailers: Set the object type for check attached to an email alert * BUILD: compiler: implement unreachable for older compilers too * REGTESTS: restrict_req_hdr_names: Extend supported versions * REGTESTS: http_abortonclose: Extend supported versions * BUG/MINOR: ssl_ckch: Fix possible uninitialized value in show_cert I/O handler * BUG/MINOR: ssl_ckch: Dump cert transaction only once if show command yield * REGTESTS: http_request_buffer: Increase client timeout to wait "slow" clients * REGTESTS: abortonclose: Add a barrier to not mix up log messages * MEDIUM: http-ana: Always report rewrite failures as PRXCOND in logs * BUG/MEDIUM: ssl/crt-list: Rework 'add ssl crt-list' to handle full buffer cases * BUG/MEDIUM: ssl_ckch: Rework 'commit ssl cert' to handle full buffer cases * BUG/MINOR: ssl_ckch: Don't duplicate path when replacing a cert entry * BUG/MEDIUM: ssl_ckch: Don't delete a cert entry if it is being modified * BUG/MINOR: ssl_ckch: Free error msg if commit changes on a cert entry fails * DOC: intro: adjust the numbering of paragrams to keep the output ordered * DOC: peers: fix port number and addresses on new peers section format * DOC: peers: clarify when entry expiration date is renewed. * DOC: peers: indicate that some server settings are not usable * SCRIPTS: make publish-release try to launch make-releases-json * SCRIPTS: add make-releases-json to recreate a releases.json file in download dirs * REGTESTS: Do not use REQUIRE_VERSION for HAProxy 2.5+ (2) * BUG/MEDIUM: sample: Fix adjusting size in word converter * BUG/MEDIUM: peers: prevent unitialized multiple listeners on peers section * BUG/MEDIUM: peers: fix segfault using multiple bind on peers sections * BUG/MEDIUM: resolvers: Don't defer resolutions release in deinit function * BUG/MEDIUM: http: Properly reject non-HTTP/1.x protocols * BUG/MEDIUM: tools: Fix `inet_ntop` usage in sa2str * CI: determine actual OpenSSL version dynamically * BUILD/MINOR: cpuset fix build for FreeBSD 13.1 * BUG/MINOR: peers: fix error reporting of "bind" lines * BUG/MINOR: cfgparse: abort earlier in case of allocation error * BUG/MINOR: check: Reinit the buffer wait list at the end of a check * BUG/MEDIUM: config: Reset outline buffer size on realloc error in readcfgfile() * REGTESTS: abortonclose: Fix some race conditions * BUG/MINOR: ssl: Fix crash when no private key is found in pem * MINOR: tools: add get_exec_path implementation for solaris based systems. * BUILD: fix build warning on solaris based systems with __maybe_unused. * MEDIUM: http-ana: Add a proxy option to restrict chars in request header names * CI: determine actual LibreSSL version dynamically * [RELEASE] Released version 2.4.17 * CLEANUP: mux-h1: Fix comments and error messages for global options * BUG/MEDIUM: wdt: don't trigger the watchdog when p is unitialized * BUG/MINOR: conn_stream: do not confirm a connection from the frontend path * BUG/MINOR: server: Make SRV_STATE_LINE_MAXLEN value from 512 to 2kB (2000 bytes). * DOC: install: update gcc version requirements * BUG/MEDIUM: ssl: fix the gcc-12 broken fix :-( * BUILD: listener: shut report of possible null-deref in listener_accept() * BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings * BUILD: ssl: work around bogus warning in gcc 12's -Wformat-truncation * CI: dynamically determine actual version of h2spec * DOC: fix typo "ant" for "and" in INSTALL * BUG/MINOR: map/cli: make sure patterns don't vanish under "show map"'s init * BUG/MINOR: map/cli: protect the backref list during "show map" errors * BUG/MEDIUM: cli: make "show cli sockets" really yield * BUG/MEDIUM: resolvers: make "show resolvers" properly yield * BUG/MINOR: tcp/http: release the expr of set-{src,dst}[-port] * DOC: config: Update doc for PR/PH session states to warn about rewrite failures * MINOR: mux-h2: report a trace event when failing to create a new stream * BUG/MINOR: mux-h2: mark the stream as open before processing it not after * BUG/MAJOR: dns: multi-thread concurrency issue on UDP socket * BUG/MEDIUM: mux-h1: Be able to handle trailers when C-L header was specified * BUG/MEDIUM: mux-fcgi: Be sure to never set EOM flag on an empty HTX message * SCRIPTS: announce-release: add URL of dev packages * CI: github actions: update LibreSSL to 3.5.2 * [RELEASE] Released version 2.4.16 * BUILD: opentracing: Fix OT build due to misuse of var_clear() * BUILD: proto_uxst: do not set unused flag * BUILD: sockpair: do not set unused flag * BUILD: fd: remove unused variable totlen in fd_write_frag_line() * CLEANUP: acl: Remove unused variable when releasing an acl expression * BUG/MINOR: pools: make sure to also destroy shared pools in pool_destroy_all() * BUG/MINOR: resolvers: Fix memory leak in resolvers_deinit() * BUILD: compiler: properly distinguish weak and global symbols * REGTESTS: fix the race conditions in be2dec.vtc ad field.vtc * MEDIUM: queue: use tasklet_instant_wakeup() to wake tasks * MINOR: task: add a new task_instant_wakeup() function * BUG/MINOR: rules: Fix check_capture() function to use the right rule arguments * DOC: remove my name from the config doc * BUG/MAJOR: connection: Never remove connection from idle lists outside the lock * BUG/MINOR: cache: Disable cache if applet creation fails * SCRIPTS: announce-release: add shortened links to pending issues * DOC: lua: update a few doc URLs * SCRIPTS: announce-release: update the doc's URL * BUG/MEDIUM: compression: Don't forget to update htx_sl and http_msg flags * BUG/MEDIUM: fcgi-app: Use http_msg flags to know if C-L header can be added * BUG/MEDIUM: stream: do not abort connection setup too early * BUILD: compiler: use a more portable set of asm(".weak") statements * BUILD: sched: workaround crazy and dangerous warning in Clang 14 * BUG/MEDIUM: mux-h1: Don't request more room on partial trailers * BUG/MINOR: mux-h2: use timeout http-request as a fallback for http-keep-alive * BUG/MINOR: mux-h2: do not use timeout http-keep-alive on backend side * BUILD: debug: mark the __start_mem_stats/__stop_mem_stats symbols as weak * BUG/MINOR: cache: do not display expired entries in "show cache" * BUG/MINOR: mux-h2: do not send GOAWAY if SETTINGS were not sent * CI: cirrus: switch to FreeBSD-13.0 * CI: Update to actions/cache@v3 * CI: Update to actions/checkout@v3 * DEBUG: opentracing: show return values of all functions in the debug output * CLEANUP: opentracing: added variable to store variable length * CLEANUP: opentracing: added flt_ot_smp_init() function * CLEANUP: opentracing: removed unused function flt_ot_var_get() * CLEANUP: opentracing: removed unused function flt_ot_var_unset() * DOC: opentracing: corrected comments in function descriptions * EXAMPLES: opentracing: refined shell scripts for testing filter performance * BUG/MINOR: opentracing: setting the return value in function flt_ot_var_set() * BUG/MEDIUM: http-act: Don't replace URI if path is not found or invalid * BUG/MEDIUM: http-conv: Fix url_enc() to not crush const samples * BUG/MEDIUM: mux-h1: Set outgoing message to DONE when payload length is reached * BUG/MEDIUM: promex: Be sure to never set EOM flag on an empty HTX message * BUG/MEDIUM: hlua: Don't set EOM flag on an empty HTX message in HTTP applet * BUG/MEDIUM: stats: Be sure to never set EOM flag on an empty HTX message * BUG/MINOR: fcgi-app: Don't add C-L header on response to HEAD requests * CI: github actions: update OpenSSL to 3.0.2 * BUG/MAJOR: mux_pt: always report the connection error to the conn_stream * BUG/MINOR: cli/stream: fix "shutdown session" to iterate over all threads * BUG/MINOR: samples: add missing context names for sample fetch functions * DOC: reflect H2 timeout changes * BUG/MEDIUM: mux-h2: make use of http-request and keep-alive timeouts * MEDIUM: mux-h2: slightly relax timeout management rules * BUG/MEDIUM: stream-int: do not rely on the connection error once established * BUG/MEDIUM: mux-h1: Properly detect full buffer cases during message parsing * BUG/MEDIUM: mux-fcgi: Properly handle return value of headers/trailers parsing * BUG/MINOR: tools: url2sa reads too far when no port nor path * DOC: config: Explictly add supported MQTT versions * MEDIUM: mqtt: support mqtt_is_valid and mqtt_field_value converters for MQTTv3.1 * BUG/MEDIUM: trace: avoid race condition when retrieving session from conn->owner * BUG/MEDIUM: mux-h1: only turn CO_FL_ERROR to CS_FL_ERROR with empty ibuf * CI: github actions: switch to LibreSSL-3.5.1 * BUG/MINOR: server/ssl: free the SNI sample expression * BUG/MINOR: tools: fix url2sa return value with IPv4 * [RELEASE] Released version 2.4.15 * BUILD: tree-wide: mark a few numeric constants as explicitly long long * DOC: Fix usage/examples of deprecated ACLs * BUG/MINOR: stream: make the call_rate only count the no-progress calls * BUG/MINOR: session: fix theoretical risk of memleak in session_accept_fd() * BUG/MAJOR: mux-pt: Always destroy the backend connection on detach * DEBUG: stream: Fix stream trace message to print response buffer state * DEBUG: stream: Add the missing descriptions for stream trace events * BUG/MEDIUM: mcli: Properly handle errors and timeouts during reponse processing * DEBUG: cache: Update underlying buffer when loading HTX message in cache applet * BUG/MINOR: promex: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: cache: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: stats: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: hlua: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: cli: shows correct mode in "show sess" * BUG/MINOR: add missing modes in proxy_mode_str() * BUILD: pools: fix backport of no-memory-trimming on non-linux OS * MINOR: pools: add a new global option "no-memory-trimming" * BUG/MEDIUM: pools: fix ha_free() on area in the process of being freed * BUG/MINOR: pool: always align pool_heads to 64 bytes * REGTESTS: fix the race conditions in secure_memcmp.vtc * REGTESTS: fix the race conditions in normalize_uri.vtc * BUG/MEDIUM: htx: Fix a possible null derefs in htx_xfer_blks() * CI: github actions: use cache for SSL libs * CI: github actions: use cache for OpenTracing * CI: github actions: add OpenTracing builds * CI: github actions: add the output of $CC -dM -E- * [RELEASE] Released version 2.4.14 * BUG/MEDIUM: stream: Abort processing if response buffer allocation fails * CI: github: enable pool debugging by default * REGTESTS: fix the race conditions in 40be_2srv_odd_health_checks * BUG/MINOR: proxy: preset the error message pointer to NULL in parse_new_proxy() * BUG/MAJOR: mux-h2: Be sure to always report HTX parsing error to the app layer * BUG/MEDIUM: mux-h1: Don't wake h1s if mux is blocked on lack of output buffer * BUG/MEDIUM: htx: Be sure to have a buffer to perform a raw copy of a message * BUG/MINOR: tools: url2sa reads ipv4 too far * BUG/MINOR: mailers: negotiate SMTP, not ESMTP * CI: github actions: update OpenSSL to 3.0.1 * CI: github: switch to OpenSSL 3.0.0 * CI: github actions: relax OpenSSL-3.0.0 version comparision * CI: github actions: -Wno-deprecated-declarations with OpenSSL 3.0.0 * CI: github actions: add OpenSSL-3.0.0 builds * BUILD: adopt script/build-ssl.sh for OpenSSL-3.0.0beta2 * BUILD: fix compilation for OpenSSL-3.0.0-alpha17 * CI: ssl: keep the old method for ancient OpenSSL versions * CI: ssl: do not needlessly build the OpenSSL docs * CI: ssl: enable parallel builds for OpenSSL on Linux * BUG/MAJOR: compiler: relax alignment constraints on certain structures * BUG/MEDIUM: fd: always align fdtab[] to 64 bytes * BUG/MEDIUM: resolvers: Really ignore trailing dot in domain names * BUG/MINOR: sink: Use the right field in appctx context in release callback * BUG/MINOR: mworker: fix a FD leak of a sockpair upon a failed reload * BUG/MEDIUM: mworker: close unused transferred FDs on load failure * MINOR: sock: move the unused socket cleaning code into its own function * [RELEASE] Released version 2.4.13 * BUG/MINOR: mux-h2: update the session's idle delay before creating the stream * BUG/MEDIUM: h2/hpack: fix emission of HPACK DTSU after settings change * REGTESTS: peers: leave a bit more time to peers to synchronize * BUG/MAJOR: spoe: properly detach all agents when releasing the applet * BUG/MAJOR: http/htx: prevent unbounded loop in http_manage_server_side_cookies * BUG/MEDIUM: listener: read-lock the listener during accept() * MINOR: listener: replace the listener's spinlock with an rwlock * BUG/MINOR: mworker: does not erase the pidfile upon reload * BUG/MAJOR: sched: prevent rare concurrent wakeup of multi-threaded tasks * DEBUG: pools: replace the link pointer with the caller's address on pool_free() * DEBUG: pools: let's add reverse mapping from cache heads to thread and pool * DEBUG: pools: add extra sanity checks when picking objects from a local cache * BUG/MINOR: pools: always flush pools about to be destroyed * BUG/MEDIUM: mworker: don't lose the stats socket on failed reload * DEBUG: pools: add new build option DEBUG_POOL_INTEGRITY * BUILD: debug/cli: condition test of O_ASYNC to its existence * DEBUG: cli: add a new "debug dev fd" expert command * MEDIUM: h2/hpack: emit a Dynamic Table Size Update after settings change * BUG/MEDIUM: mcli: always realign wrapping buffers before parsing them * BUG/MEDIUM: mcli: do not try to parse empty buffers * BUG/MEDIUM: cli: Never wait for more data on client shutdown * BUG/MINOR: cli: avoid O(bufsize) parsing cost on pipelined commands * MINOR: channel: add new function co_getdelim() to support multiple delimiters * MEDIUM: cli: yield between each pipelined command * BUG/MEDIUM: server: avoid changing healthcheck ctx with set server ssl * BUILD/MINOR: fix solaris build with clang. * BUG/MEDIUM: htx: Adjust length to add DATA block in an empty HTX buffer * BUG/MEDIUM: connection: properly leave stopping list on error * [RELEASE] Released version 2.4.12 * BUG/MAJOR: mux-h1: Don't decrement .curr_len for unsent data * BUG/MEDIUM: mworker: don't use _getsocks in wait mode * [RELEASE] Released version 2.4.11 * BUG/MEDIUM: http-ana: Preserve response's FLT_END analyser on L7 retry * BUG/MINOR: cli: fix _getsocks with musl libc * BUILD/MINOR: tools: solaris build fix on dladdr. * BUILD/MINOR: cpuset FreeBSD 14 build fix. * BUG/MEDIUM: ssl: free the ckch instance linked to a server * BUG/MINOR: ssl: free the fields in srv->ssl_ctx * MINOR: debug: add support for -dL to dump library names at boot * MINOR: debug: add ability to dump loaded shared libraries * MINOR: compat: detect support for dl_iterate_phdr() * BUG/MINOR: mux-h1: Fix splicing for messages with unknown length * BUG/MEDIUM: mux-h1: Fix splicing by properly detecting end of message * BUILD: makefile: add -Wno-atomic-alignment to work around clang abusive warning * MINOR: proxy: add option idle-close-on-response * REGTESTS: ssl: fix ssl_default_server.vtc * BUG/MEDIUM: ssl: initialize correctly ssl w/ default-server * DOC: fix misspelled keyword "resolve_retries" in resolvers * BUILD: ssl: unbreak the build with newer libressl * BUILD: cli: clear a maybe-unused warning on some older compilers * BUG/MINOR: pools: don't mark ourselves as harmless in DEBUG_UAF mode * BUG/MEDIUM: backend: fix possible sockaddr leak on redispatch * [RELEASE] Released version 2.4.10 * BUG/MINOR: backend: restore the SF_SRV_REUSED flag original purpose * BUG/MINOR: backend: do not set sni on connection reuse * MINOR: pools: work around possibly slow malloc_trim() during gc * BUG/MEDIUM: mworker/cli: crash when trying to access an old PID in prompt mode * DOC: config: retry-on list is space-delimited * DOC: config: Specify %Ta is only available in HTTP mode * DOC: spoe: Clarify use of the event directive in spoe-message section * BUG/MINOR: cli/server: Don't crash when a server is added with a custom id * IMPORT: slz: use the correct CRC32 instruction when running in 32-bit mode * BUILD: tree-wide: avoid warnings caused by redundant checks of obj_types * MINOR: cli: "show version" displays the current process version * CI: Github Actions: temporarily disable BoringSSL builds * BUILD: bug: Fix error when compiling with -DDEBUG_STRICT_NOCRASH * MINOR: mux-h1: Improve H1 traces by adding info about http parsers * BUG/MAJOR: segfault using multiple log forward sections. * BUG/MEDIUM: resolvers: Detach query item on response error * BUG/MINOR: server: Don't rely on last default-server to init server SSL context * BUG/MEDIUM: cli: Properly set stream analyzers to process one command at a time * BUILD/MINOR: server: fix compilation without SSL * [RELEASE] Released version 2.4.9 * BUG/MINOR: cache: Fix loop on cache entries in "show cache" * MINOR: promex: backend aggregated server check status * MINOR: server: add ws keyword * MEDIUM: server/backend: implement websocket protocol selection * MINOR: connection: add alternative mux_ops param for conn_install_mux_be * MINOR: connection: implement function to update ALPN * MINOR: stream/mux: implement websocket stream flag * BUG/MINOR: ssl: make SSL counters atomic * MINOR: shctx: add a few BUG_ON() for consistency checks * BUG/MINOR: shctx: do not look for available blocks when the first one is enough * BUG/MEDIUM: shctx: leave the block allocator when enough blocks are found * BUG/MEDIUM: cache/cli: make "show cache" thread-safe * BUG/MEDIUM: mux-h2: always process a pending shut read * BUG/MEDIUM: ssl: abort with the correct SSL error when SNI not found * CLEANUP: ssl: fix wrong #else commentary * BUG/MINOR: ssl: free correctly the sni in the backend SSL cache * BUG/MEDIUM: ssl: backend TLS resumption with sni and TLSv1.3 * BUILD: makefile: simplify detection of libatomic * BUG/MEDIUM: mux-h1: Handle delayed silent shut in h1_process() to release H1C * BUG/MINOR: stick-table/cli: Check for invalid ipv6 key * BUG/MEDIUM: connection: make cs_shutr/cs_shutw//cs_close() idempotent * BUG/MINOR: mux-h2: Fix H2_CF_DEM_SHORT_READ value * BUG/MINOR: mworker: doesn't launch the program postparser * BUG/MEDIUM: conn-stream: Don't reset CS flags on close * MINOR: mux-h1: Slightly Improve H1 traces * DOC: lua: Be explicit with the Reply object limits * Revert "BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back" * BUG/MINOR: http-ana: Apply stop to the current section for http-response rules * DOC: config: Fix typo in ssl_fc_unique_id description * BUG/MINOR: cache: properly ignore unparsable max-age in quotes * BUG/MINOR: resolvers: throw log message if trash not large enough for query * BUG/MINOR: resolvers: fix sent messages were counted twice * BUG/MEDIUM: mux-h2: reject upgrade if no RFC8441 support * MINOR: mux-h2: add trace on extended connect usage * MINOR: mux-h2: perform a full cycle shutdown+drain on close * MINOR: connection: add a new CO_FL_WANT_DRAIN flag to force drain on close- VUL-0: serious vulnerability in the HTTP/1 parser (bsc#1208132) o Apply upstream patch: 2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch - The output buffer is not zero-initialized. If we don't clear reserved bytes, fcgi requests sent to backend will leak sensitive data. o Apply proposed patch: 0001-output-buffer-is-not-zero-initialized.path- VUL-0: CVE-2023-0056: haproxy: segfault DoS (bsc#1207181) o Apply upstream patch: 0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch- (bsc#1196408) VUL-0: CVE-2022-0711: haproxy: Denial of service via set-cookie2 header o Apply upstream patch: 0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch- Update to version 2.4.8+git0.d1f8d41e0: * [RELEASE] Released version 2.4.8 * SCRIPTS: git-show-backports: re-enable file-based filtering * DOC/peers: some grammar fixes for peers 2.1 spec * MINOR: stream: Improve dump of bogus streams * BUILD/MINOR: cpuset freebsd build fix * DOC: config: Fix alphabetical order of fc_* samples * BUG/MINOR: sample: fix backend direction flags consecutive to last fix * BUG/MEDIUM: sample: Cumulate frontend and backend sample validity flags * BUG/MEDIUM: stream-int: Block reads if channel cannot receive more data * BUG/MINOR: http: Authorization value can have multiple spaces after the scheme * BUG/MEDIUM: http-ana: Drain request data waiting the tarpit timeout expiration * MINOR: halog: Add support for extracting captures using -hdr * BUG/MINOR: halog: Add missing newlines in die() messages * CLEANUP: halog: Use consistent indentation in help() * MINOR: halog: Rename -qry to -query * DOC: halog: Move the `-qry` parameter into the correct section in help text * MINOR: halog: Add -qry parameter allowing to preserve the query string in -uX * BUG/MEDIUM: resolvers: Track api calls with a counter to free resolutions * BUG/MEDIUM: resolvers: Don't recursively perform requester unlink * MEDIUM: resolvers: remove the last occurrences of the "safe" argument * MEDIUM: resolvers: use a kill list to preserve the list consistency * CLEANUP: resolvers: replace all LIST_DELETE with LIST_DEL_INIT * CLEANUP: resolvers: simplify resolv_link_resolution() regarding requesters * CLEANUP: always initialize the answer_list * CLEANUP: resolvers: do not export resolv_purge_resolution_answer_records() * BUG/MEDIUM: mux-h1: Perform a connection shutdown when the h1c is released * BUG/MINOR: mux-h1: Save shutdown mode if the shutdown is delayed * BUILD: atomic: fix build on mac/arm64 * BUG/MINOR: backend: fix improper insert in avail tree for always reuse * BUILD: fix compilation on NetBSD * MINOR: memprof: add one pointer size to the size of allocations * MINOR: memprof: report the delta between alloc and free on realloc() * BUG/MEDIUM: lua: fix memory leaks with realloc() on non-glibc systems * BUG/MINOR: mux-h2: do not prevent from sending a final GOAWAY frame * BUG/MINOR: task: do not set TASK_F_USR1 for no reason * BUG/MAJOR: buf: fix varint API post- vs pre- increment * BUG/MEDIUM: resolvers: always check a valid item in query_list * BUILD: resolvers: avoid a possible warning on null-deref * BUG/MAJOR: resolvers: add other missing references during resolution removal * MINOR: resolvers: merge address and target into a union "data" * BUG/MEDIUM: resolvers: use correct storage for the target address * BUG/MEDIUM: resolvers: fix truncated TLD consecutive to the API fix * MINOR: resolvers: fix the resolv_dn_label_to_str() API about trailing zero * BUG/MINOR: resolvers: do not reject host names of length 255 in SRV records * BUG/MEDIUM: resolver: make sure to always use the correct hostname length * MINOR: resolvers: fix the resolv_str_to_dn_label() API about trailing zero * BUG/MAJOR: dns: attempt to lock globaly for msg waiter list instead of use barrier * BUG/MAJOR: dns: tcp session can remain attached to a list after a free * BUG/MEDIUM: tcpcheck: Properly catch early HTTP parsing errors * Revert "CLEANUP: server: always include the storage for SSL settings" * BUG/MEDIUM: stream: Keep FLT_END analyzers if a stream detects a channel error * BUG/MEDIUM: cpuset: fix cpuset size for FreeBSD * BUG/MINOR: sample: Fix 'fix_tag_value' sample when waiting for more data * BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back * MINOR: initcall: Rename __GLOBL and __GLOBL1. * DOC: configuration: add clarification on escaping in keyword arguments * BUG/MEDIUM: mux_h2: Handle others remaining read0 cases on partial frames * BUG/MEDIUM: sample: properly verify that variables cast to sample * MINOR: sample: provide a generic var-to-sample conversion function * CLEANUP: sample: uninline sample_conv_var2smp_str() * CLEANUP: sample: rename sample_conv_var2smp() to *_sint * CLEANUP: server: always include the storage for SSL settings- Update to version 2.4.7+git0.b5e51a5e2: * [RELEASE] Released version 2.4.7 * BUG/MEDIUM: http-ana: Clear request analyzers when applying redirect rule- Update to version 2.4.6+git0.d83fd76a1: * [RELEASE] Released version 2.4.6 * BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release- Update to version 2.4.5+git0.e74a1b34b: * [RELEASE] Released version 2.4.5 * MINOR: tasks: catch TICK_ETERNITY with BUG_ON() in __task_queue() * BUG/MINOR: tcp-rules: Stop content rules eval on read error and end-of-input * BUG/MINOR: tcpcheck: Don't use arg list for default proxies during parsing * MINOR: arg: Be able to forbid unresolved args when building an argument list * BUG/MAJOR: lua: use task_wakeup() to properly run a task once * BUG/MEDIUM: lua: fix wakeup condition from sleep() * MINOR: Makefile: add MEMORY_POOLS to the list of DEBUG_xxx options * DOC: peers: fix doc "enable" statement on "peers" sections * BUG/MINOR: mux-h1/mux-fcgi: Sanitize TE header to only send "trailers" * MINOR: stream-int: Notify mux when the buffer is not stuck when calling rcv_buf * BUG/MEDIUM: stream-int: Defrag HTX message in si_cs_recv() if necessary * MINOR: htx: Add a function to know if the free space wraps * MINOR: htx: Add an HTX flag to know when a message is fragmented * MINOR: stream-int: Set CO_RFL transient/persistent flags apart in si_cs_rcv() * BUG/MEDIUM: stream: Stop waiting for more data if SI is blocked on RXBLK_ROOM * BUG/MEDIUM: stream-int: Notify stream that the mux wants more room to xfer data * BUG/MEDIUM: mux-h1: Adjust conditions to ask more space in the channel buffer * BUG/MINOR: stats: use refcount to protect dynamic server on dump * MINOR: server: return the next srv instance on free_server * BUG/MINOR: server: do not use refcount in free_server in stopping mode * MINOR: global: define MODE_STOPPING * MINOR: server: implement a refcount for dynamic servers * BUG/MINOR: http-ana: increment internal_errors counter on response error * BUG/MINOR: h1-htx: Fix a typo when request parser is reset * BUG/MEDIUM: leastconn: fix rare possibility of divide by zero * BUG/MINOR: server: allow 'enable health' only if check configured * BUILD: threads: fix -Wundef for _POSIX_PRIORITY_SCHEDULING on libmusl * BUILD: halog: fix a -Wundef warning on non-glibc systems * BUILD: compiler: fixed a missing test on defined(__GNUC__) * BUILD: fix dragonfly build again on __read_mostly * BUG/MINOR: vars: do not talk about global section in CLI errors for set-var * BUG/MINOR: vars: truncate the variable name in error reports about scope. * BUG/MINOR: vars: properly set the argument parsing context in the expression * MINOR: sample: add missing ARGC_ entries * BUG/MINOR: vars: improve accuracy of the rules used to check expression validity * BUILD: tools: properly guard __GLIBC__ with defined() * BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSL * BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBER * BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef * IMPORT: slz: silence a build warning with -Wundef * BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef * BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef * BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING * MINOR: proc: setting the process to produce a core dump on FreeBSD. * MINOR: tools: add FreeBSD support to get_exec_path() * BUILD: tools: get the absolute path of the current binary on NetBSD. * BUG/MINOR: flt-trace: fix an infinite loop when random-parsing is set * BUG/MINOR: cli/payload: do not search for args inside payload * BUILD: ist: prevent gcc11 maybe-uninitialized warning on istalloc * BUG/MINOR: connection: prevent null deref on mux cleanup task allocation * DOC: management: certificate files must be sanitized before injection * BUG/MINOR: tcpcheck: Improve LDAP response parsing to fix LDAP check * BUG/MAJOR: mux-h1: Don't eval input data if an error was reported * MINOR: pools: use mallinfo2() when available instead of mallinfo() * MINOR: pools: automatically disable malloc_trim() with external allocators * CLEANUP: pools: factor all malloc_trim() calls into trim_all_pools() * BUG/MINOR: compat: make sure __WORDSIZE is always defined * BUG/MEDIUM: stream-int: Don't block SI on a channel policy if EOI is reached * CLEANUP: mux-h1: Remove condition rejecting upgrade requests with payload * MINOR: htx: Skip headers with no value when adding a header list to a message * BUG/MEDIUM: mux-h1: Remove "Upgrade:" header for requests with payload * BUG/MINOR: systemd: ExecStartPre must use -Ws * BUG/MINOR: filters: Set right FLT_END analyser depending on channel * BUG/MINOR: filters: Always set FLT_END analyser when CF_FLT_ANALYZE flag is set * BUG/MEDIUM: http-ana: Reset channels analysers when returning an error * BUG/MINOR: stream: Don't release a stream if FLT_END is still registered * BUG/MINOR: lua: Don't yield in channel.append() and channel.set() * BUG/MINOR: lua: Yield in channel functions only if lua context can yield * MINOR: lua: Add a flag on lua context to know the yield capability at run time- Update to version 2.4.4+git0.acb1d0bea: CVE-2021-40346 (boo#1189877) * [RELEASE] Released version 2.4.4 * Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive" * BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer * CLEANUP: htx: remove comments about "must be < 256 MB" * BUG/MINOR: config: reject configs using HTTP with bufsize >= 256 MB * DOC: configuration: remove wrong tcp-request examples in tcp-response * BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser * CLEANUP: Add missing include guard to signal.h * BUG/MINOR: tools: Fix loop condition in dump_text() * BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time * BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long * MINOR: time: add report_idle() to report process-wide idle time * BUG/MINOR: time: fix idle time computation for long sleeps * BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords * MINOR: compiler: implement an ONLY_ONCE() macro * BUG/MINOR: base64: base64urldec() ignores padding in output size check * BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec} * BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions * MINOR: hlua: take the global Lua lock inside a global function * REGTESTS: abortonclose: after retries, 503 is expected, not close * REGTESTS: http_upgrade: fix incorrect expectation on TCP->H1->H2 * BUG/MEDIUM: h2: match absolute-path not path-absolute for :path- Update to version 2.4.3+git0.4dd5a5a6c: CVE-2021-39240 CVE-2021-39241 CVE-2021-39242 (boo#1189366 boo#1189548 boo#1189549) * [RELEASE] Released version 2.4.3 * REGTESTS: add a test to prevent h2 desync attacks * BUG/MEDIUM: h2: give :authority precedence over Host * BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header * BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it * BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax * MINOR: http: add a new function http_validate_scheme() to validate a scheme * DOC/MINOR: fix typo in management document * CLEANUP: assorted typo fixes in the code and comments * BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during config check * BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued * DOC: config: Fix 'http-response send-spoe-group' documentation * DOC: Improve the lua documentation * BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer * BUG/MINOR: buffer: fix buffer_dump() formatting * BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one is released * MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure * ADMIN: dyncookie: implement a simple dynamic cookie calculator * MINOR: server: unmark deprecated on enable health/agent cli * BUG/MINOR: server: update last_change on maint->ready transitions too * BUG/MINOR: server: remove srv from px list on CLI 'add server' error * BUILD: opentracing: fixed build when using pkg-config utility * DOC: internals: document the FD takeover process * BUG/MINOR: fd: protect fd state harder against a concurrent takeover * BUG/MINOR: pollers: always program an update for migrated FDs * BUG/MINOR: poll: fix abnormally high skip_fd counter * BUG/MINOR: select: fix excess number of dead/skip reported * BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before * BUG/MEDIUM: connection: close a rare race between idle conn close and takeover * BUG/MINOR: connection: Add missing error labels to conn_err_code_str * BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames * BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe() is called * BUG/MINOR: mux-h2: Obey dontlognull option during the preface * BUG/MINOR: mux-h1: Obey dontlognull option for empty requests * BUG/MINOR: systemd: must check the configuration using -Ws * BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree * BUG/MINOR: check: fix the condition to validate a port-less server * BUG/MINOR: stats: Add missing agent stats on servers * BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request * BUILD/MINOR: memprof fix macOs build. * BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs * BUG/MEDIUM: mworker: do not register an exit handler if exit is expected * BUILD: lua: silence a build warning with TCC * BUILD: add detection of missing important CFLAGS * BUG/MINOR: ssl: Default-server configuration ignored by server * MINOR: mux_h2: define config to disable h2 websocket support * BUILD: http_htx: fix ci compilation error with isdigit for Windows- Update to version 2.4.2+git0.553dee326: * [RELEASE] Released version 2.4.2 * REGTESTS: add http scheme-based normalization test * MEDIUM: h2: apply scheme-based normalization on h2 requests * MEDIUM: h1-htx: apply scheme-based normalization on h1 requests * MEDIUM: http: implement scheme-based normalization * MINOR: http: implement http_get_scheme * Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules" * BUG/MINOR: cli: fix server name output in "show fd" * BUG/MEDIUM: sock: make sure to never miss early connection failures * DOC: stick-table: add missing documentation about gpt0 stored type * BUG/MINOR: peers: fix data_type bit computation more than 32 data_types * BUG/MINOR: stick-table: fix several printf sign errors dumping tables * DOC: config: use CREATE USER for mysql-check * BUG/MEDIUM: resolvers: Make 1st server of a template take part to SRV resolution * BUG/MINOR: mqtt: Support empty client ID in CONNECT message * BUG/MINOR: mqtt: Fix parser for string with more than 127 characters * BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules * BUILD: Makefile: fix linkage for Haiku. * BUG/MINOR: checks: return correct error code for srv_parse_agent_check * MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response() * BUG/MINOR: resolvers: Reset server IP when no ip is found in the response * BUG/MINOR: resolvers: Always attach server on matching record on resolution * CLEANUP: dns: Remove a forgotten debug message * DOC: config: Add missing actions in "tcp-request session" documentation * MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules * REGTESTS: fix maxconn update with agent-check * BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check * BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header * BUG/MINOR: server/cli: Fix locking in function processing "set server" command * BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task() * BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status * MINOR: resolvers: Remove server from named_servers tree when removing a SRV item * MINOR: resolvers: Clean server in a dedicated function when removing a SRV item * BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI * BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled * BUG/MINOR: server-state: load SRV resolution only if params match the config- Update to version 2.4.1+git0.1ce7d4925: * [RELEASE] Released version 2.4.1 * BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces * BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace * MINOR: mux-h2: obey http-ignore-probes during the preface * BUG/MINOR: stats: make "show stat typed desc" work again * CLEANUP: mux-h2/traces: better align user messages * MINOR: mux-h2/trace: report a few connection-level info during h2_init() * MINOR: connection: add helper conn_append_debug_info() * BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers * BUG/MINOR: mux-h1: do not skip the error response on bad requests * MINOR: backend: only skip LB when there are actual connections * BUG/MAJOR: queue: set SF_ASSIGNED when setting strm->target on dequeue * CLEANUP: global: remove unused definition of stopping_task[] * BUG/MINOR: mworker: fix typo in chroot error message * BUG/MINOR: ssl: use atomic ops to update global shctx stats * BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE * BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node * BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree * BUG/MEDIUM: server: do not forget to generate the dynamic servers ids * BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees * BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server' * BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id * DOC: lua: Add a warning about buffers modification in HTTP * BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs * MEDIUM: resolvers: add a ref between servers and srv request or used SRV record * MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item * BUG/MINOR: resolvers: answser item list was randomly purged or errors * CLEANUP: l7-retries: do not test the buffer before calling b_alloc() * BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default * BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded * CLEANUP: pools: remove now unused seq and pool_free_list * BUG/MAJOR: pools: fix possible race with free() in the lockless variant * MEDIUM: pools: use a single pool_gc() function for locked and lockless * MINOR: pools: call malloc_trim() under thread isolation * MINOR: pools: do not maintain the lock during pool_flush() * BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location * BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush() * BUG/MEDIUM: compression: Add a flag to know the filter is still processing data * BUG/MEDIUM: compression: Properly get the next block to iterate on payload * BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block * BUG/MEDIUM: opentracing: initialization before establishing daemon and/or chroot mode * Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode" * BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future * BUILD: make tune.ssl.keylog available again * DOC: use the req.ssl_sni in examples * MINOR: errors: allow empty va_args for diag variadic macro * BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry * DOC/MINOR: move uuid in the configuration to the right alphabetical order * BUG/MINOR: vars: Be sure to have a session to get checks variables * CLEANUP: http-ana: Remove useless if statement about L7 retries * BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree * BUG/MINOR: http: Missing calloc return value check in make_arg_list * BUG/MINOR: http: Missing calloc return value check while parsing redirect rule * BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list * BUG/MINOR: compression: Missing calloc return value check in comp_append_type/algo * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request rule * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request/tcp-response * BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy * BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare * BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture * BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine * BUG/MINOR: peers: Missing calloc return value check in peers_register_table * BUG/MINOR: server: Missing calloc return value check in srv_parse_source * DOC: intro: Fix typo in starter guide * MINOR: cfgparse: Fail when encountering extra arguments in macro * MINOR: http-ana: Perform L7 retries because of status codes in response analyser * BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts * BUG/MINOR: http-ana: Send the right error if max retries is reached on L7 retry * Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers" * BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response * BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter * BUILD/MINOR: opentracing: fixed build when using clang * BUG/MAJOR: server: prevent deadlock when using 'set maxconn server' * BUG/MEDIUM: ebtree: Invalid read when looking for dup entry- Update to version 2.4.0+git0.6cbbecf09: https://www.haproxy.com/blog/announcing-haproxy-2-4/ for all the details see /usr/share/doc/packages/haproxy/CHANGELOG - refreshed patches to apply cleanly again haproxy-1.6.0-makefile_lib.patch haproxy-1.6.0-sec-options.patch lua54.patch- Update to version 2.3.10+git0.4764f0e4e: * [RELEASE] Released version 2.3.10 * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush * BUG/MEDIUM: peers: re-work connection to new process during reload. * BUG/MINOR: peers: remove useless table check if initial resync is finished * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data * BUG/MINOR: mworker: don't use oldpids[] anymore for reload * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases * BUG/MEDIUM: config: fix cpu-map notation with both process and threads * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers * BUG/MINOR: server: free srv.lb_nodes in free_server * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received * BUG/MINOR: logs: Report the true number of retries if there was no connection * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check * MINOR: connection: Make bc_http_major compatible with tcp-checks * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections * MINOR: logs: Add support of checks as session origin to format lf strings * BUG/MINOR: checks: Set missing id to the dummy checks frontend * BUG/MEDIUM: threads: Ignore current thread to end its harmless period * DOC: ssl: Certificate hot update only works on fronted certificates * BUG/MEDIUM: sample: Fix adjusting size in field converter * MINOR: No longer rely on deprecated sample fetches for predefined ACLs * DOC: clarify that compression works for HTTP/2 * BUG/MINOR: tools: fix parsing "us" unit for timers * CONTRIB: halog: fix issue with array of type char * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one * BUG/MINOR: ssl: Fix update of default certificate * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS * BUG/MINOR: tcp: fix silent-drop workaround for IPv6- Update to version 2.3.9+git1.afb63bc04: * BUILD: backend: fix build breakage in idle conn locking fix * [RELEASE] Released version 2.3.9 * BUG/MEDIUM: time: make sure to always initialize the global tick * BUG/MINOR: stats: Apply proper styles in HTML status page. * BUG/MINOR: payload: Wait for more data if buffer is empty in payload/payload_lv * MEDIUM: backend: use a trylock to grab a connection on high FD counts as well * BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent- Update to version 2.3.8+git0.e572195c7: * [RELEASE] Released version 2.3.8 * BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters * MINOR: tools: make url2ipv4 return the exact number of bytes parsed * BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless * BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available. * CLEANUP: fd: remove unused fd_set_running_excl() * BUG/MEDIUM: fd: do not wait on FD removal in fd_delete() * MINOR: fd: remove the unneeded running bit from fd_insert() * MINOR: fd: make fd_clr_running() return the remaining running mask * BUG/MEDIUM: lua: Always init the lua stack before referencing the context * BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback * MINOR: lua: Slightly improve function dumping the lua traceback * BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro * BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list" * BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable * MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua * MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master CLI socket * BUG/MINOR: protocol: add missing support of dgram unix socket. * BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable * MINOR: time: also provide a global, monotonic global_now_ms timer * BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback * BUG/MINOR: freq_ctr/threads: make use of the last updated global time * MINOR: time: export the global_now variable- Update to version 2.3.7+git0.2d39ce334: * [RELEASE] Released version 2.3.7 * BUG/MINOR: resolvers: Add missing case-insensitive comparisons of DNS hostnames * MINOR: resolvers: Don't try to match immediatly renewed ADD items * MINOR: resolvers: Use milliseconds for cached items in resolver responses * BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set * BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks * MINOR: resolvers: Directly call srvrq_update_srv_state() when possible * MINOR: resolvers: Add function to change the srv status based on SRV resolution * MINOR: resolvers: Purge answer items when a SRV resolution triggers an error * MINOR: resolvers: Use a function to remove answers attached to a resolution * BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete * BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item * MINOR: resolvers: new function find_srvrq_answer_record() * BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item * BUG/MEDIUM: resolvers: Don't set an address-less server as UP * BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution * BUG/MINOR: resolvers: Reset server address on DNS error only on status change * BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error * Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record" * CLEANUP: tcp-rules: add missing actions in the tcp-request error message * BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check * BUG/MINOR: session: Add some forgotten tests on session's listener * BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters * BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check * BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached * BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw() * BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple http tracksc. * OPTIM: task: automatically adjust the default runqueue-depth to the threads * MINOR: task: give the scheduler a bit more flexibility in the runqueue size * MEDIUM: task: remove the tasks_run_queue counter and have one per thread * MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks * MINOR: xprt: add new xprt_set_idle and xprt_set_used methods * MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1 * MINOR: task: add an application specific flag to the state: TASK_F_USR1 * BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake * MINOR: ssl: mark the SSL handshake tasklet as heavy * MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY * MEDIUM: backend: use a trylock when trying to grab an idle connection * MINOR: pools: double the local pool cache size to 1 MB * MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS * MEDIUM: streams: do not use the streams lock anymore * MINOR: streams: use one list per stream instead of a global one * MINOR: cli/streams: make "show sess" dump all streams till the new epoch * MINOR: stream: add an "epoch" to figure which streams appeared when * MINOR: dynbuf: pass offer_buffers() the number of buffers instead of a threshold * MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait * MINOR: dynbuf: make the buffer wait queue per thread * OPTIM: lb-leastconn: do not unlink the server if it did not change * OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn * OPTIM: lb-first: do not take the server lock on take_conn/drop_conn * MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock * MINOR: server: move actconns to the per-thread structure * OPTIM: server: switch the actconn list to an mt-list * MINOR: listener: refine the default MAX_ACCEPT from 64 to 4 * MINOR: tasks: refine the default run queue depth * BUG/MEDIUM: session: NULL dereference possible when accessing the listener * MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs * MINOR: atomic: add armv8.1-a atomics variant for cas-dw * BUG/MINOR: mt-list: always perform a cpu_relax call on failure * REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h * BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode * BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring() * BUG/MINOR: backend: fix condition for reuse on mode HTTP- Update to version 2.3.6+git0.7851701ed: * [RELEASE] Released version 2.3.6 * BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout * BUG/MINOR: mux-h2: Fix typo in scheme adjustment * DOC: spoe: Add a note about fragmentation support in HAProxy * BUG/MEDIUM: spoe: Kill applets if there are pending connections and nbthread > 1 * BUG/MINOR: connection: Use the client's dst family for adressless servers * BUG/MINOR: tcp-act: Don't forget to set the original port for IPv4 set-dst rule * BUG/MINOR: http-ana: Only consider dst address to process originalto option * BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf() * BUG/MINOR: stats: fix compare of no-maint url suffix * CLEANUP: muxes: Remove useless if condition in show_fd function * BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup() * BUG/MEDIUM: resolvers: Reset address for unresolved servers * BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records * BUG/MINOR: resolvers: new callback to properly handle SRV record errors * BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record * BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned * BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl() * BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal * BUG/MEDIUM: cli/shutdown sessions: make it thread-safe * BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop * BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe * BUG/MINOR: sample: secure convs that accept base64 string and var name as args * MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes * BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert" * BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok * BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line * BUG/MINOR: server: Init params before parsing a new server-state line * BUG/MINOR: http-rules: Always replace the response status on a return action * BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer * BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ(). * DOC: explain the relation between pool-low-conn and tune.idle-pool.shared * BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions * BUG/MINOR: sample: Always consider zero size string samples as unsafe * BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust() * BUG/MINOR: checks: properly handle wrapping time in __health_adjust() * BUG/MINOR: session: atomically increment the tracked sessions counter * BUG/MINOR: server: Remove RMAINT from admin state when loading server state * CLEANUP: channel: fix comment in ci_putblk. * DOC: tune: explain the origin of block size for ssl.cachesize * BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL * BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines * BUG/MINOR: stats: revert the change on ST_CONVDONE * BUG/MEDIUM: config: don't pick unset values from last defaults section * CLEANUP: deinit: release global and per-proxy server-state variables on deinit * BUG/MINOR: server: Fix server-state-file-name directive * BUG/MINOR: backend: hold correctly lock when killing idle conn * BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints() * BUG/MINOR: server: re-align state file fields number * BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state * BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors * BUG/MINOR: intops: fix mul32hi()'s off-by-one * BUILD: ssl: guard SSL_CTX_set_msg_callback with SSL_CTRL_SET_MSG_CALLBACK macro * BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro * BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro * MINOR: check: do not ignore a connection header for http-check send- Update to version 2.3.5+git0.5902ad99b: * [RELEASE] Released version 2.3.5 * MINOR: config: Deprecate and ignore tune.chksize global option * BUG/MINOR: sock: Unclosed fd in case of connection allocation failure * BUG/MEDIUM: mux-h2: do not quit the demux loop before setting END_REACHED * BUG/MEDIUM: mux-h2: handle remaining read0 cases * BUILD: Makefile: move REGTESTST_TYPE default setting * MINOR: cli/show_fd: report local and report ports when known * BUILD: ssl: fix build breakage with last commit * BUG/MINOR: ssl: do not try to use early data if not configured * BUG/MINOR: xxhash: make sure armv6 uses memcpy() * BUG/MINOR: mux_h2: fix incorrect stat titles * BUG/MEDIUM: ssl: check a connection's status before computing a handshake * BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store * BUG/MINOR: stick-table: Always call smp_fetch_src() with a valid arg list * DOC: management: fix "show resolvers" alphabetical ordering * MINOR: h1: Raise the chunk size limit up to (2^52 - 1) * MINOR: mux-h1/show_fd: report as suspicious an entry with too many calls * MINOR: mux-h2/show_fd: report as suspicious an entry with too many calls * MINOR: ssl/show_fd: report some FDs as suspicious when possible * MINOR: cli/show_fd: report some easily detectable suspicious states * MINOR: cli: give the show_fd helpers the ability to report a suspicious entry * MINOR: mux-fcgi: make the "show fd" helper also decode the fstrm subscriber when known * MINOR: mux-h1: make the "show fd" helper also decode the h1s subscriber when known * MINOR: mux-h2: make the "show fd" helper also decode the h2s subscriber when known * MINOR: xprt/mux: export all *_io_cb functions so that "show fd" resolves them * MINOR: ssl: provide a "show fd" helper to report important SSL information * MINOR: xprt: add a new show_fd() helper to complete some "show fd" dumps. * MINOR: cli: make "show fd" also report the xprt and xprt_ctx * CLEANUP: cli: make "show fd" use a const connection to access other fields * CLEANUP: tools: make resolve_sym_name() take a const pointer * MINOR: contrib: Make the wireshark peers dissector compile for more distribs. * BUG/MINOR: backend: check available list allocation for reuse * BUG/MEDIUM: backend: never reuse a connection for tcp mode * REORG: backend: simplify conn_backend_get * BUG/MEDIUM: session: only retrieve ready idle conn from session * BUG/MINOR: ssl: init tmp chunk correctly in ssl_sock_load_sctl_from_file() * BUG/MINOR: config: fix leak on proxy.conn_src.bind_hdr_name * BUG/MEDIUM: filters/htx: Fix data forwarding when payload length is unknown * DOC: Improve documentation of the various hdr() fetches * BUILD/MINOR: lua: define _GNU_SOURCE for LLONG_MAX * BUG/MEDIUM: mux-h2: fix read0 handling on partial frames * BUG/MEDIUM: tcpcheck: Don't destroy connection in the wake callback context * BUG/MINOR: mworker: define _GNU_SOURCE for strsignal() * BUG/MINOR: mux_h2: missing space between "st" and ".flg" in the "show fd" helper * BUG/MINOR: peers: Wrong "new_conn" value for "show peers" CLI command. * MINOR: build: discard echoing in help target * BUG/MINOR: peers: Possible appctx pointer dereference. * BUG/MEDIUM: stats: add missing INF_BUILD_INFO definition * BUILD: peers: fix build warning about unused variable * BUG/MINOR: dns: SRV records ignores duplicated AR records (v2) * MINOR: peers: Add traces for peer control messages. * BUG/MINOR: threads: Fixes the number of possible cpus report for Mac. * MINOR: server: Forbid server definitions in frontend sections * MINOR: config: Add failifnotcap() to emit an alert on proxy capabilities * BUG/MINOR: init: Use a dynamic buffer to set HAPROXY_CFGFILES env variable- Add lua54.patch to fix building with lua 5.4- Update to version 2.3.4+git0.10189c965: * [RELEASE] Released version 2.3.4 * MINOR: contrib/prometheus-exporter: use fill_info for process dump * MINOR: contrib/prometheus-exporter: avoid connection close header * BUG/MINOR: init: enforce strict-limits when using master-worker * BUG/MINOR: check: Don't perform any check on servers defined in a frontend * BUG/MINOR: sample: Memory leak of sample_expr structure in case of error * Revert "BUG/MINOR: dns: SRV records ignores duplicated AR records" * MINOR: reg-tests: add base prometheus test * BUG/MINOR: reg-tests: fix service dependency script * BUG/MINOR: sample: check alloc_trash_chunk return value in concat() * MINOR: reg-tests: add a way to add service dependency- Update to version 2.3.3+git0.9233c2143: * [RELEASE] Released version 2.3.3 * BUG/MINOR: sample: fix concat() converter's corruption with non-string variables * DOC: Add maintainers for the Prometheus exporter * SCRIPTS: announce-release: fix typo in help message * DOC: fix some spelling issues over multiple files * MINOR: contrib/prometheus-exporter: export build_info * CLEANUP: cfgparse: replace "realloc" with "my_realloc2" to fix to memory leak on error * BUILD: Makefile: exclude broken tests by default * MINOR: converter: adding support for url_enc * BUG/MINOR: srv: do not cleanup idle conns if pool max is null * BUG/MINOR: srv: do not init address if backend is disabled * SCRIPTS: make announce release support preparing announces before tag exists * SCRIPTS: improve announce-release to support different tag and versions * BUG/MINOR: stats: Make stat_l variable used to dump a stat line thread local * DOC: Improve the message printed when running `make` w/o `TARGET` * BUG/MINOR: tcpcheck: Report a L7OK if the last evaluated rule is a send rule * BUG/MINOR: cfgparse: Fail if the strdup() for `rule->be.name` for `use_backend` fails * BUG/MINOR: sink: Return an allocation failure in __sink_new if strdup() fails * MINOR: atomic: don't use ; to separate instruction on aarch64. * BUILD: hpack: hpack-tbl-t.h uses VAR_ARRAY but does not include compiler.h * BUG/MEDIUM: mux_h2: Add missing braces in h2_snd_buf()around trace+wakeup * DOC: fix "smp_size" vs "sample_size" in "log" directive arguments * BUG/MINOR: dns: SRV records ignores duplicated AR records * BUILD: ssl: fine guard for SSL_CTX_get0_privatekey call * BUILD: plock: remove dead code that causes a warning in gcc 11 * CONTRIB: debug: address "poll" utility build on non-linux platforms * CONTRIB: halog: fix signed/unsigned build warnings on counts and timestamps * CONTRIB: halog: mark the has_zero* functions unused * CONTRIB: halog: fix build issue caused by %L printf format * BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request * BUG/MEDIUM: http-ana: Never for sending data in TUNNEL mode * BUG/MINOR: mux-h1: Don't set CS_FL_EOI too early for protocol upgrade requests * BUILD: Makefile: have "make clean" destroy .o/.a/.s in contrib subdirs as well * BUILD: SSL: fine guard for SSL_CTX_add_server_custom_ext call * REGTESTS: make use of HAPROXY_ARGS and pass -dM by default * BUG/MEDIUM: ssl/crt-list: bad behavior with "commit ssl cert" * BUG/MEDIUM: lb-leastconn: Reposition a server using the right eweight * BUG/MINOR: tools: Reject size format not starting by a digit * BUG/MINOR: tools: make parse_time_err() more strict on the timer validity * MINOR: tcpcheck: Only wait for more payload data on HTTP expect rules * BUG/MINOR: tcpcheck: Don't rearm the check timeout on each read * BUG/MINOR: http-check: Use right condition to consider HTX message as full * DOC: email change of the DeviceAtlas maintainer * BUG/MEDIUM: spoa/python: Fixing references to None * BUG/MEDIUM: spoa/python: Fixing PyObject_Call positional arguments * BUG/MINOR: spoa/python: Cleanup ipaddress objects if initialization fails * BUG/MINOR: spoa/python: Cleanup references for failed Module Addobject operations * DOC: spoa/python: Fixing typos in comments * DOC: spoa/python: Rephrasing memory related error messages * DOC: spoa/python: Fixing typo in IP related error messages * BUG/MAJOR: spoa/python: Fixing return None * MEDIUM: ssl: fatal error with bundle + openssl < 1.1.1 * MINOR: listener: now use a generic add_listener() function * MINOR: listener: automatically set the port when creating listeners * MINOR: protocol: add a ->set_port() helper to address families * BUG/MINOR: mux-h1: Handle keep-alive timeout for idle frontend connections * BUG/MINOR: listener: use sockaddr_in6 for IPv6 * DOC/MINOR: Fix formatting in Management Guide * BUILD/MINOR: haproxy DragonFlyBSD affinity build update. * BUG/MAJOR: ring: tcp forward on ring can break the reader counter. * BUG/MINOR: lua: warn when registering action, conv, sf, cli or applet multiple times * MINOR: cli: add a function to look up a CLI service description * MINOR: actions: add a function returning a service pointer from its name * MINOR: actions: Export actions lookup functions * BUG/MINOR: lua: Some lua init operation are processed unsafe * BUG/MINOR: lua: Post init register function are not executed beyond the first one * BUG/MINOR: lua: lua-load doesn't check its parameters * BUG/MINOR: lua: missing "\n" in error message * BUG/MINOR: mux-h2/stats: not all GOAWAY frames are errors * BUG/MINOR: mux-h2/stats: make stream/connection proto errors more accurate * BUG/MEDIUM: local log format regression. * BUG/MEDIUM: task: close a possible data race condition on a tasklet's list link * MINOR: task: remove __tasklet_remove_from_tasklet_list() * BUG/MEDIUM: lists: Lock the element while we check if it is in a list. * MINOR: plock: use an ARMv8 instruction barrier for the pause instruction- Update to version 2.3.2+git0.d522db763: * [RELEASE] Released version 2.3.2 * BUG/MINOR: http-fetch: Fix smp_fetch_body() when called from a health-check * DOC: config: Move req.hdrs and req.hdrs_bin in L7 samples fetches section * BUG/MAJOR: tcpcheck: Allocate input and output buffers from the buffer pool * MINOR: tcpcheck: Don't handle anymore in-progress send rules in tcpcheck_main * BUG/MINOR: tcpcheck: Don't forget to reset tcp-check flags on new kind of check * DOC: Clarify %HP description in log-format * DOC: better document the config file format and escaping/quoting rules * BUG/MAJOR: peers: fix partial message decoding * BUG/MEDIUM: http_act: Restore init of log-format list * BUILD: Show the value of DEBUG= in haproxy -vv * BUILD: Make DEBUG part of .build_opts * MINOR: http_act: Add -m flag for del-header name matching method * REGTESTS: converter: add url_dec test * REGTESTS: Add sample_fetches/cook.vtc * DOC: cache: Add new caching limitation information * MEDIUM: cache: Change caching conditions * BUG/MAJOR: filters: Always keep all offsets up to date during data filtering * DOC: better describes how to configure a fallback crt * BUG/MINOR: http_htx: Fix searching headers by substring * BUG/MAJOR: connection: reset conn->owner when detaching from session list * CLEANUP: connection: do not use conn->owner when the session is known * DOC: clarify how to create a fallback crt * BUILD: makefile: enable crypt(3) for OpenBSD * BUG/MEDIUM: ssl/crt-list: fix error when no file found * BUG/MINOR: ssl/crt-list: load bundle in crt-list only if activated * BUG/MEDIUM: ssl: error when no certificate are found * BUG/MEDIUM: ssl/crt-list: bundle support broken in crt-list * BUG/MEDIUM: http-ana: Don't eval http-after-response ruleset on empty messages * BUG/MINOR: ssl: segv on startup when AKID but no keyid * DOC: add missing 3.10 in the summary * BUG/MINOR: http-ana: Don't wait for the body of CONNECT requests * BUG/MEDIUM: filters: Forward all filtered data at the end of http filtering * CLEANUP: cfgparse: remove duplicate registration for transparent build options * BUILD: http-htx: fix build warning regarding long type in printf- Update to version 2.3.1+git0.bdd7178b8: * [RELEASE] Released version 2.3.1 * REGTEST: make ssl_client_samples and ssl_server_samples require to 2.2 * MINOR: peers: Add traces to peer_treat_updatemsg(). * REGTEST: ssl: mark reg-tests/ssl/ssl_crt-list_filters.vtc as broken * REGTEST: ssl: test wildcard and multi-type + exclusions * MINOR: cfgparse: tighten the scope of newnameserver variable, free it on error. * MINOR: config/mux-h2: Return ERR_ flags from init_h2() instead of a status * MINOR: init: Fix the prototype for per-thread free callbacks * BUG/MINOR: tcpcheck: Don't warn on unused rules if check option is after * MINOR: spoe: Don't close connection in sync mode on processing timeout * BUG/MAJOR: spoe: Be sure to remove all references on a released spoe applet * BUG/MINOR: http-htx: Handle warnings when parsing http-error and http-errors * MINOR: check: report error on incompatible connect proto * MINOR: check: report error on incompatible proto * BUG/MEDIUM: check: reuse srv proto only if using same mode * BUG/MINOR: http-fetch: Fix calls w/o parentheses of the cookie sample fetches * BUG/MINOR: http-fetch: Extract cookie value even when no cookie name * BUG/MEDIUM: peers: fix decoding of multi-byte length in stick-table messages * BUG/MINOR: peers: Missing TX cache entries reset. * BUG/MINOR: peers: Do not ignore a protocol error for dictionary entries. * BUG/MINOR: stats: free dynamically stats fields/lines on shutdown * BUG/MINOR: lua: set buffer size during map lookups * BUG/MINOR: pattern: a sample marked as const could be written- Update to version 2.3.0+git4.689d98154: * BUG/MEDIUM: ssl/crt-list: correctly insert crt-list line if crt already loaded- Update to version 2.3.0+git3.7a50763d1: * DOC: config: Fix a typo on ssl_c_chain_der * MINOR: http-htx: Add understandable errors for the errorfiles parsing * BUG/MINOR: ssl: don't report 1024 bits DH param load error when it's higher- apparmor: do not limit to tcp sockets. haproxy can do udp as well.- Update to version 2.3.0+git0.1c0a722a8: https://www.haproxy.com/blog/announcing-haproxy-2-3/ for all the details see /usr/share/doc/packages/haproxy/CHANGELOG- Update to version 2.2.5+git0.34b2b1066: * [RELEASE] Released version 2.2.5 * BUG/MEDIUM: server: make it possible to kill last idle connections * CLEANUP: mux-h2: Remove the h1 parser state from the h2 stream * BUG/MEDIUM: stick-table: limit the time spent purging old entries * BUG/MINOR: filters: Skip disabled proxies during startup only * BUG/MEDIUM: mux-pt: Release the tasklet during an HTTP upgrade * MINOR: server: Copy configuration file and line for server templates * BUG/MINOR: server: Set server without addr but with dns in RMAINT on startup * BUG/MINOR: checks: Report a socket error before any connection attempt * BUG/MINOR: proxy/server: Skip per-proxy/server post-check for disabled proxies * BUG/MEDIUM: filters: Don't try to init filters for disabled proxies * BUG/MINOR: cache: Inverted variables in http_calc_maxage function * BUG/MINOR: cache: Manage multiple values in cache-control header value * MINOR: ist: Add a case insensitive istmatch function * BUG/MINOR: lua: initialize sample before using it * BUG/MINOR: server: fix down_time report for stats * BUG/MINOR: server: fix srv downtime calcul on starting * BUG/MINOR: log: fix risk of null deref on error path * BUG/MINOR: log: fix memory leak on logsrv parse error * BUG/MINOR: extcheck: add missing checks on extchk_setenv() * BUG/MEDIUM: ssl: OCSP must work with BoringSSL * Revert "MINOR: ssl: 'ssl-load-extra-del-ext' removes the certificate extension" * BUG/MAJOR: mux-h2: Don't try to send data if we know it is no longer possible * BUG/MINOR: http-ana: Don't send payload for internal responses to HEAD requests * BUG/MEDIUM: server: support changing the slowstart value from state-file * BUG/MINOR: queue: properly report redistributed connections * MINOR: ssl: 'ssl-load-extra-del-ext' removes the certificate extension * BUILD: ssl: make BoringSSL use its own version numbers * BUG/MINOR: disable dynamic OCSP load with BoringSSL * BUG/MINOR: peers: Possible unexpected peer seesion reset after collisions. * DOC: fix typo in MAX_SESS_STKCTR * BUG/MEDIUM: lb: Always lock the server when calling server_{take,drop}_conn * BUG/MEDIUM: mux-h1: Get the session from the H1S when capturing bad messages * BUG/MEDIUM: spoe: Unset variable instead of set it if no data provided * BUG/MEDIUM: task: bound the number of tasks picked from the wait queue at once * BUG/MINOR: connection: fix loop iter on connection takeover * MINOR: fd: report an error message when failing initial allocations * BUG/MINOR: mux-h2: do not stop outgoing connections on stopping * BUG/MINOR: init: only keep rlim_fd_cur if max is unlimited * BUILD: connection: fix build on clang after the VAR_ARRAY cleanup * CLEANUP: tree-wide: use VAR_ARRAY instead of [0] in various definitions * BUG/MINOR: http-htx: Expect no body for 204/304 internal HTTP responses * BUG/MINOR: http: Fix content-length of the default 500 error * DOC: Fix typos in configuration.txt * BUG/MEDIUM: mux-h2: Don't handle pending read0 too early on streams * BUG/MEDIUM: mux-fcgi: Don't handle pending read0 too early on streams * DOC: Add missing stats fields in the management doc * DOC: fix a confusing typo on a regsub example * BUG/MINOR: mux-h1: Always set the session on frontend h1 stream * BUG/MINOR: mux-h1: Be sure to only set CO_RFL_READ_ONCE for the first read * BUG/MINOR: peers: Inconsistency when dumping peer status codes. * MINOR: hlua: Display debug messages on stderr only in debug mode * BUG/MINOR: stats: fix validity of the json schema * MINOR: counters: fix a typo in comment * MINOR: ssl: Add warning if a crt-list might be truncated * BUG/MEDIUM: queue: make pendconn_cond_unlink() really thread-safe * BUG/MINOR: tcpcheck: Set socks4 and send-proxy flags before the connect call * DOC: tcp-rules: Refresh details about L7 matching for tcp-request content rules * BUG/MINOR: Fix several leaks of 'log_tag' in init(). * MINOR: ssl: Add error if a crt-list might be truncated * BUILD: makefile: Fix building with closefrom() support enabled * BUILD: ssl_crtlist: work around another bogus gcc-9.3 warning- apparmor profile: - we need net_admin capability for non local bind and setting "source" for server entries.- apparmor profile fixes: - include abstractions that give access to the openssl config, ssl certs and ssl keys - include local configs only with "if exists" so they do not have to exist. - move local files to %ghost- use parallel build- Update to version 2.2.4+git0.de456726d: * [RELEASE] Released version 2.2.4 * REGTEST: make map_regm_with_backref require 1.7 * REGTEST: make abns_socket.vtc require 1.8 * REGTEST: make agent-check.vtc require 1.8 * REGTEST: fix host part in balance-uri-path-only.vtc * BUG/MINOR: ssl/crt-list: exit on warning out of crtlist_parse_line() * DOC: agent-check: fix typo in "fail" word expected reply * REGTESTS: use "command" instead of "which" for better POSIX compatibility * BUILD: trace: include tools.h * BUG/MEDIUM: listeners: do not pause foreign listeners * REGTESTS: add a few load balancing tests * MINOR: backend: add a new "path-only" option to "balance uri" * MINOR: backend: make the "whole" option of balance uri take only one bit * MINOR: h2/trace: also display the remaining frame length in traces * BUG/MINOR: Fix memory leaks cfg_parse_peers * BUG/MEDIUM: h2: report frame bits only for handled types * BUG/MINOR: config: Fix memory leak on config parse listen * BUG/MINOR: http-fetch: Don't set the sample type during the htx prefetch * BUG/MINOR: h2/trace: do not display "stream error" after a frame ACK * BUG/MINOR: ssl/crt-list: crt-list could end without a \n * BUG/MEDIUM: ssl: Don't call ssl_sock_io_cb() directly. * BUG/MINOR: server: report correct error message for invalid port on "socks4" * BUG/MINOR: ssl: verifyhost is case sensitive * BUG/MINOR: Fix type passed of sizeof() for calloc() * BUG/MEDIUM: pattern: Renew the pattern expression revision when it is pruned * BUILD: threads: better workaround for late loading of libgcc_s- Update to version 2.2.3+git0.0e58a340d: * [RELEASE] Released version 2.2.3 * BUG/MEDIUM: mux-h1: always apply the timeout on half-closed connections * BUG/MINOR: auth: report valid crypto(3) support depending on build options * DOC: ssl-load-extra-files only applies to certificates on bind lines * MINOR: server: Improve log message sent when server address is updated * BUG/MEDIUM: dns: Be sure to renew IP address for already known servers * BUG/MEDIUM: dns: Don't store additional records in a linked-list * CLEANUP: dns: remove 45 "return" statements from dns_validate_dns_response() * CLEANUP: Update .gitignore * MINOR: Commit .gitattributes * BUILD: thread: limit the libgcc_s workaround to glibc only * BUG/MINOR: threads: work around a libgcc_s issue with chrooting * BUG/MEDIUM: ssl: does not look for all SNIs before chosing a certificate * MINOR: arg: Use chunk_destroy() to release string arguments * BUG/MEDIUM: ssl: check OCSP calloc in ssl_sock_load_ocsp() * REGTEST: Add a test for request path manipulations, with and without the QS * MINOR: http-fetch: Add pathq sample fetch * MINOR: http-rules: Add set-pathq and replace-pathq actions * BUG/MEDIUM: doc: Fix replace-path action description * Revert "BUG/MINOR: http-rules: Replace path and query-string in "replace-path" action" * BUG/MINOR: startup: haproxy -s cause 100% cpu * BUG/MEDIUM: contrib/spoa-server: Fix ipv4_address used instead of ipv6_address * BUG/MINOR: contrib/spoa-server: Updating references to free in case of failure * BUG/MINOR: contrib/spoa-server: Do not free reference to NULL * BUG/MINOR: contrib/spoa-server: Ensure ip address references are freed * BUG/MAJOR: contrib/spoa-server: Fix unhandled python call leading to memory leak * BUILD: task: work around a bogus warning in gcc 4.7/4.8 at -O1 * BUILD: tools: include auxv a bit later * MINOR: cache: Reject duplicate cache names * DOC: cache: Use '' instead of '' in error message * BUG/MEDIUM: ssl: crt-list negative filters don't work * BUG/MINOR: http-rules: Replace path and query-string in "replace-path" action * MINOR: http-htx: Add an option to eval query-string when the path is replaced * BUG/MEDIUM: http-ana: Don't wait to send 1xx responses received from servers * BUG/MINOR: reload: do not fail when no socket is sent * BUG/MEDIUM: ssl: fix ssl_bind_conf double free w/ wildcards * BUG/MEDIUM: ssl: never generates the chain from the verify store * BUG/MEDIUM: htx: smp_prefetch_htx() must always validate the direction * BUG/MINOR: stats: use strncmp() instead of memcmp() on health states * BUG/MINOR: ssl: ssl-skip-self-issued-ca requires >= 1.0.2 * BUG/MEDIUM: ssl: fix the ssl-skip-self-issued-ca option * BUG/MINOR: snapshots: leak of snapshots on deinit() * MEDIUM: lua: Don't filter exported fetches and converters * BUG/MINOR: lua: Duplicate lua strings in sample fetches/converters arg array * MINOR: hlua: Don't needlessly copy lua strings in trash during args validation * BUG/MINOR: lua: Check argument type to convert it to IP mask in arg validation * BUG/MINOR: lua: Check argument type to convert it to IPv4/IPv6 arg validation * BUG/MINOR: arg: Fix leaks during arguments validation for fetches/converters * BUG/MINOR: lua: Duplicate map name to load it when a new Map object is created * BUG/MINOR: converters: Store the sink in an arg pointer for debug() converter * MINOR: arg: Add an argument type to keep a reference on opaque data * BUG/MEDIUM: map/lua: Return an error if a map is loaded during runtime * BUG/MEDIUM: ssl: memory leak of ocsp data at SSL_CTX_free() * BUG/MINOR: ssl: fix memory leak at OCSP loading * DOC: spoa-server: fix false friends `actually` * BUG/MINOR: spoa-server: fix size_t format printing * BUG/MAJOR: dns: disabled servers through SRV records never recover * CLEANUP: dns: typo in reported error message * BUG/MEDIUM: mux-h1: Refresh H1 connection timeout after a synchronous send * SCRIPTS: git-show-backports: emit the shell command to backport a commit * SCRIPTS: git-show-backports: make -m most only show the left branch- Update to version 2.2.2+git0.b8a2763d5: * [RELEASE] Released version 2.2.2 * BUG/MEDIUM: tcp-checks: always attach the transport before installing the mux * BUG/MEDIUM: backend: always attach the transport before installing the mux * SCRIPTS: announce-release: add the link to the wiki in the announce messages * MINOR: stream-int: Be sure to have a mux to do sends and receives * MINOR: connection: Preinstall the mux for non-ssl connect * BUG/MEDIUM: connection: Be sure to always install a mux for sync connect * BUG/MINOR: tcp-rules: Set the inspect-delay when a tcp-response action yields * BUG/MINOR: tcp-rules: Preserve the right filter analyser on content eval abort * BUG/MINOR: lua: Abort execution of actions that yield on a final evaluation * BUG/MEDIUM: dns: Don't yield in do-resolve action on a final evaluation * MEDIUM: lua: Add support for the Lua 5.4 * BUG/MAJOR: dns: don't treat Authority records as an error * BUG/MAJOR: dns: fix null pointer dereference in snr_update_srv_status * BUG/MINOR: debug: Don't dump the lua stack if it is not initialized * BUILD: tools: fix build with static only toolchains * BUG/MINOR: mux-fcgi: Don't url-decode the QUERY_STRING parameter anymore- Update to version 2.2.1+git0.0ef71a557: * [RELEASE] Released version 2.2.1 * BUG/MEDIUM: http-ana: Only set CF_EXPECT_MORE flag on data filtering * BUG/MEDIUM: stream-int: Don't set MSG_MORE flag if no more data are expected * BUG/MINOR: htx: add two missing HTX_FL_EOI and remove an unexpected one * MEDIUM: htx: Add a flag on a HTX message when no more data are expected * BUG/MEDIUM: dns: Release answer items when a DNS resolution is freed * BUG/MAJOR: dns: Make the do-resolve action thread-safe * BUG/MAJOR: tasks: don't requeue global tasks into the local queue * BUG/MEDIUM: resolve: fix init resolving for ring and peers section. * BUG/MEDIUM: arg: empty args list must be dropped * DOC: ssl: req_ssl_sni needs implicit TLS * BUILD: config: fix again bugs gcc warnings on calloc * BUG/MAJOR: tasks: make sure to always lock the shared wait queue if needed * BUILD: config: address build warning on raspbian+rpi4 * BUG/MEDIUM: channel: Be aware of SHUTW_NOW flag when output data are peeked * BUG/MEDIUM: server: fix possibly uninitialized state file on close * BUG/MEDIUM: server: resolve state file handle leak on reload * BUG/MEDIUM: fcgi-app: fix memory leak in fcgi_flt_http_headers * BUG/MEDIUM: log: issue mixing sampled to not sampled log servers. * BUG/MINOR: mux-fcgi: Set flags on the right stream field for empty FCGI_STDOUT * BUG/MINOR: mux-fcgi: Set conn state to RECORD_P when skipping the record padding * BUG/MINOR: mux-fcgi: Handle empty STDERR record * BUG/MEDIUM: mux-h1: Continue to process request when switching in tunnel mode * BUG/MEDIUM: mux-fcgi: Don't add private connections in available connection list * BUG/MEDIUM: mux-h2: Don't add private connections in available connection list * CONTRIB: da: fix memory leak in dummy function da_atlas_open() * BUG/MEDIUM: lists: add missing store barrier in MT_LIST_ADD/MT_LIST_ADDQ * BUG/MEDIUM: lists: add missing store barrier on MT_LIST_BEHEAD() * BUG/MINOR: sample: Free str.area in smp_check_const_meth * BUG/MINOR: sample: Free str.area in smp_check_const_bool- Update to version 2.2.0+git0.3a00c915f: https://www.haproxy.com/blog/announcing-haproxy-2-2/ * [RELEASE] Released version 2.2.0 * MINOR: version: mention that it's an LTS release now * DOC: minor update to coding style file * DOC: update INSTALL with new compiler versions * CLEANUP: ssl: remove unrelevant comment in smp_fetch_ssl_x_keylog() * DOC: configuration: remove obsolete mentions of H2 being converted to HTTP/1.x * BUG/MINOR: connection: See new connection as available only on reuse always * BUG/MEDIUM: connection: Don't consider new private connections as available * BUG/MINOR: backend: Remove CO_FL_SESS_IDLE if a client remains on the last server * MINOR: mux-h1: Improve traces about the splicing - refreshed patches to apply cleanly again: haproxy-1.6.0-makefile_lib.patch haproxy-1.6.0-sec-options.patch - track series file in source rpm- Update to version 2.1.7+git0.8bebf80fb: * [RELEASE] Released version 2.1.7- Update to version 2.1.6+git1.661c88907: * BUG/MAJOR: http-htx: Don't forget to copy error messages from defaults sections- Update to version 2.1.6+git0.34db76106: * [RELEASE] Released version 2.1.6 * BUG/MINOR: mworker: fix a memleak when execvp() failed * BUG/MINOR: ssl: fix a trash buffer leak in some error cases * BUG/MEDIUM: mworker: fix the reload with an -- option * BUG/MINOR: init: -S can have a parameter starting with a dash * BUG/MINOR: init: -x can have a parameter starting with a dash * BUG/MEDIUM: mworker: fix the copy of options in copy_argv() * BUG/MEDIUM: contrib/prometheus-exporter: Properly set flags to dump metrics * BUG/MEDIUM: hlua: Lock pattern references to perform set/add/del operations * BUG/MEDIUM: http-htx: Duplicate error messages as raw data instead of string * BUG/MEDIUM: lua: Reset analyse expiration timeout before executing a lua action * BUG/MINOR: peers: fix internal/network key type mapping. * SCRIPTS: publish-release: pass -n to gzip to remove timestamp * Revert "BUG/MEDIUM: connections: force connections cleanup on server changes"- Update to version 2.1.5+git0.36e14bd31: * [RELEASE] Released version 2.1.5 * BUG/MINOR: nameservers: fix error handling in parsing of resolv.conf * BUG/MINOR: lua: Add missing string length for lua sticktable lookup * BUG/MEDIUM: logs: fix trailing zeros on log message. * REGTESTS: checks: Fix tls_health_checks when IPv6 addresses are used * BUG/MINOR: logs: prevent double line returns in some events. * DOC: SPOE is no longer experimental * DOC/MINOR: halog: Add long help info for ic flag * DOC: retry-on can only be used with mode http * BUG/MINOR: server: Fix server_finalize_init() to avoid unused variable * BUG/MINOR: checks: Respect check-ssl param when a port or an addr is specified * BUG/MEDIUM: ring: write-lock the ring while attaching/detaching * BUG/MAJOR: mux-fcgi: Stop sending loop if FCGI stream is blocked for any reason * BUG/MINOR: cache: Don't needlessly test "cache" keyword in parse_cache_flt() * BUG/MEDIUM: stream: Only allow L7 retries when using HTTP. * BUG/MEDIUM: streams: Remove SF_ADDR_SET if we're retrying due to L7 retry. * BUILD: select: only declare existing local labels to appease clang * BUG/MINOR: soft-stop: always wake up waiting threads on stopping * BUG/MINOR: pollers: remove uneeded free in global init * BUG/MINOR: pools: use %u not %d to report pool stats in "show pools" * BUG/MINOR: cfgparse: Abort parsing the current line if an invalid \x sequence is encountered * BUG/MEDIUM: http_ana: make the detection of NTLM variants safer * BUG/MINOR: http-ana: fix NTLM response parsing again * BUG/MINOR: config: Make use_backend and use-server post-parsing less obscur * BUG/MEDIUM: lua: Fix dumping of stick table entries for STD_T_DICT * BUG/MINOR: threads: fix multiple use of argument inside HA_ATOMIC_UPDATE_{MIN,MAX}() * BUG/MINOR: threads: fix multiple use of argument inside HA_ATOMIC_CAS() * BUG/MINOR: sample: Set the correct type when a binary is converted to a string * CLEANUP: connections: align function declaration * BUG/MEDIUM: ssl: fix the id length check within smp_fetch_ssl_fc_session_id() * BUG/MEDIUM: h1: Don't compare host and authority if only h1 headers are parsed * BUG/MEDIUM: connections: force connections cleanup on server changes * BUG/MEDIUM: mux-fcgi: Fix wrong test on FCGI_CF_KEEP_CONN in fcgi_detach() * BUG/MEDIUM: mux_fcgi: Free the FCGI connection at the end of fcgi_release() * BUG/MINOR: checks: Remove a warning about http health checks * BUG/MINOR: checks: Compute the right HTTP request length for HTTP health checks * BUG/MINOR: checks/server: use_ssl member must be signed * Revert "BUG/MINOR: connection: make sure to correctly tag local PROXY connections" * Revert "BUG/MINOR: connection: always send address-less LOCAL PROXY connections" * REGTEST: http-rules: Require PCRE or PCRE2 option to run map_redirect script * REGTEST: ssl: test the client certificate authentication * BUILD: Makefile: add linux-musl to TARGET * BUILD: tools: rely on __ELF__ not USE_DL to enable use of dladdr() * BUILD: tools: unbreak resolve_sym_name() on non-GNU platforms * MINOR: debug: dump the whole trace if we can't spot the starting point * MINOR: debug: use our own backtrace function on clang+x86_64 * MINOR: debug: improve backtrace() on aarch64 and possibly other systems * MINOR: debug: report the number of entries in the backtrace * MINOR: wdt: do not depend on USE_THREAD * BUILD: Makefile: include librt before libpthread * MINOR: debug: call backtrace() once upon startup * MEDIUM: debug: add support for dumping backtraces of stuck threads * MINOR: cli: make "show fd" rely on resolve_sym_name() * MINOR: debug: use resolve_sym_name() to dump task handlers * MINOR: tools: add resolve_sym_name() to resolve function pointers * MINOR: tools: add new function dump_addr_and_bytes() * MINOR: haproxy: export run_poll_loop * MINOR: stream: report the list of active filters on stream crashes * BUG/MEDIUM: shctx: bound the number of loops that can happen around the lock * BUG/MEDIUM: shctx: really check the lock's value while waiting * BUG/MINOR: debug: properly use long long instead of long for the thread ID * MINOR: threads: export the POSIX thread ID in panic dumps * BUG/MEDIUM: listener: mark the thread as not stuck inside the loop * BUG/MEDIUM: sample: make the CPU and latency sample fetches check for a stream * BUG/MEDIUM: http: the "unique-id" sample fetch could crash without a steeam * BUG/MEDIUM: http: the "http_first_req" sample fetch could crash without a steeam * BUG/MEDIUM: capture: capture.{req,res}.* crash without a stream * BUG/MEDIUM: capture: capture-req/capture-res converters crash without a stream * BUG/MINOR: mux-fcgi: Be sure to have a connection as session's origin to use it * BUG/MINOR: obj_type: Handle stream object in obj_base_ptr() function * BUG/MINOR: checks: chained expect will not properly wait for enough data * BUG/MEDIUM: server/checks: Init server check during config validity check * BUG/MINOR: checks: Respect the no-check-ssl option * MINOR: checks: Add a way to send custom headers and payload during http chekcs * BUG/MINOR: check: Update server address and port to execute an external check * MINOR: contrib: make the peers wireshark dissector a plugin * MEDIUM: memory: make pool_gc() run under thread isolation * DOC: option logasap does not depend on mode * BUG/MINOR: http: make url_decode() optionally convert '+' to SP * BUG/MINOR: tools: fix the i386 version of the div64_32 function * BUG/MEDIUM: http-ana: Handle NTLM messages correctly. * BUG/MINOR: ssl: default settings for ssl server options are not used * DOC: Improve documentation on http-request set-src * MINOR: version: Show uname output in display_version() * DOC: hashing: update link to hashing functions * BUG/MINOR: peers: Incomplete peers sections should be validated. * BUG/MINOR: connection: always send address-less LOCAL PROXY connections * BUG/MINOR: ssl: memleak of the struct cert_key_and_chain * BUG/MINOR: ssl/cli: memory leak in 'set ssl cert' * MINOR: ssl: improve the errors when a crt can't be open * BUG/MINOR: protocol_buffer: Wrong maximum shifting.- use the "profile profilename /path/to/binary" syntax to make "ps aufxZ" more readable- Update to version 2.1.4+git0.3cfc2f1d9: (boo#1168023) CVE-2020-11100 - SCRIPTS: make announce-release executable again - BUG/MINOR: namespace: avoid closing fd when socket failed in my_socketat - BUG/MEDIUM: muxes: Use the right argument when calling the destroy method. - BUG/MINOR: mux-fcgi: Forbid special characters when matching PATH_INFO param - MINOR: mux-fcgi: Make the capture of the path-info optional in pathinfo regex - SCRIPTS: announce-release: use mutt -H instead of -i to include the draft - MINOR: http-htx: Add a function to retrieve the headers size of an HTX message - MINOR: filters: Forward data only if the last filter forwards something - BUG/MINOR: filters: Count HTTP headers as filtered data but don't forward them - BUG/MINOR: http-htx: Don't return error if authority is updated without changes - BUG/MINOR: http-ana: Matching on monitor-uri should be case-sensitive - MINOR: http-ana: Match on the path if the monitor-uri starts by a / - BUG/MAJOR: http-ana: Always abort the request when a tarpit is triggered - MINOR: ist: add an iststop() function - BUG/MINOR: http: http-request replace-path duplicates the query string - BUG/MEDIUM: shctx: make sure to keep all blocks aligned - MINOR: compiler: move CPU capabilities definition from config.h and complete them - BUG/MEDIUM: ebtree: don't set attribute packed without unaligned access support - BUILD: fix recent build failure on unaligned archs - CLEANUP: cfgparse: Fix type of second calloc() parameter - BUG/MINOR: sample: fix the json converter's endian-sensitivity - BUG/MEDIUM: ssl: fix several bad pointer aliases in a few sample fetch functions - BUG/MINOR: connection: make sure to correctly tag local PROXY connections - MINOR: compiler: add new alignment macros - BUILD: ebtree: improve architecture-specific alignment - BUG/MINOR: h2: reject again empty :path pseudo-headers - BUG/MINOR: sample: Make sure to return stable IDs in the unique-id fetch - BUG/MINOR: dns: ignore trailing dot - BUG/MINOR: http-htx: Do case-insensive comparisons on Host header name - MINOR: contrib/prometheus-exporter: Add heathcheck status/code in server metrics - MINOR: contrib/prometheus-exporter: Add the last heathcheck duration metric - BUG/MEDIUM: random: initialize the random pool a bit better - MINOR: tools: add 64-bit rotate operators - BUG/MEDIUM: random: implement a thread-safe and process-safe PRNG - MINOR: backend: use a single call to ha_random32() for the random LB algo - BUG/MINOR: checks/threads: use ha_random() and not rand() - BUG/MAJOR: list: fix invalid element address calculation - MINOR: debug: report the task handler's pointer relative to main - BUG/MEDIUM: debug: make the debug_handler check for the thread in threads_to_dump - MINOR: haproxy: export main to ease access from debugger - BUILD: tools: remove obsolete and conflicting trace() from standard.c - BUG/MINOR: wdt: do not return an error when the watchdog couldn't be enabled - DOC: fix incorrect indentation of http_auth_* - OPTIM: startup: fast unique_id allocation for acl. - BUG/MINOR: pattern: Do not pass len = 0 to calloc() - DOC: configuration.txt: fix various typos - DOC: assorted typo fixes in the documentation and Makefile - BUG/MINOR: init: make the automatic maxconn consider the max of soft/hard limits - BUG/MAJOR: proxy_protocol: Properly validate TLV lengths - REGTEST: make the PROXY TLV validation depend on version 2.2 - BUG/MINOR: filters: Use filter offset to decude the amount of forwarded data - BUG/MINOR: filters: Forward everything if no data filters are called - MINOR: htx: Add a function to return a block at a specific offset - BUG/MEDIUM: cache/filters: Fix loop on HTX blocks caching the response payload - BUG/MEDIUM: compression/filters: Fix loop on HTX blocks compressing the payload - BUG/MINOR: http-ana: Reset request analysers on a response side error - BUG/MINOR: lua: Ignore the reserve to know if a channel is full or not - BUG/MINOR: http-rules: Preserve FLT_END analyzers on reject action - BUG/MINOR: http-rules: Fix a typo in the reject action function - BUG/MINOR: rules: Preserve FLT_END analyzers on silent-drop action - BUG/MINOR: rules: Increment be_counters if backend is assigned for a silent-drop - DOC: fix typo about no-tls-tickets - DOC: improve description of no-tls-tickets - DOC: assorted typo fixes in the documentation - DOC: ssl: clarify security implications of TLS tickets - BUILD: wdt: only test for SI_TKILL when compiled with thread support - BUG/MEDIUM: mt_lists: Make sure we set the deleted element to NULL; - MINOR: mt_lists: Appease gcc. - BUG/MEDIUM: random: align the state on 2*64 bits for ARM64 - BUG/MEDIUM: pools: Always update free_list in pool_gc(). - BUG/MINOR: haproxy: always initialize sleeping_thread_mask - BUG/MINOR: listener/mq: do not dispatch connections to remote threads when stopping - BUG/MINOR: haproxy/threads: try to make all threads leave together - DOC: proxy_protocol: Reserve TLV type 0x05 as PP2_TYPE_UNIQUE_ID - DOC: correct typo in alert message about rspirep - BUILD: on ARM, must be linked to libatomic. - BUILD: makefile: fix regex syntax in ARM platform detection - BUILD: makefile: fix expression again to detect ARM platform - BUG/MEDIUM: peers: resync ended with RESYNC_PARTIAL in wrong cases. - DOC: assorted typo fixes in the documentation - MINOR: wdt: Move the definitions of WDTSIG and DEBUGSIG into types/signal.h. - BUG/MEDIUM: wdt: Don't ignore WDTSIG and DEBUGSIG in __signal_process_queue(). - MINOR: memory: Change the flush_lock to a spinlock, and don't get it in alloc. - BUG/MINOR: connections: Make sure we free the connection on failure. - REGTESTS: use "command -v" instead of "which" - REGTEST: increase timeouts on the seamless-reload test - BUG/MINOR: haproxy/threads: close a possible race in soft-stop detection - BUG/MINOR: peers: init bind_proc to 1 if it wasn't initialized - BUG/MINOR: peers: avoid an infinite loop with peers_fe is NULL - BUG/MINOR: peers: Use after free of "peers" section. - MINOR: listener: add so_name sample fetch - BUILD: ssl: only pass unsigned chars to isspace() - BUG/MINOR: stats: Fix color of draining servers on stats page - DOC: internals: Fix spelling errors in filters.txt - MINOR: http-rules: Add a flag on redirect rules to know the rule direction - BUG/MINOR: http_ana: make sure redirect flags don't have overlapping bits - MINOR: http-rules: Handle the rule direction when a redirect is evaluated - BUG/MINOR: http-ana: Reset request analysers on error when waiting for response - BUG/CRITICAL: hpack: never index a header into the headroom after wrapping- Remove unsupported options from example haproxy.cfg - Make haproxy useable for containers - Use sysusers.d to create users. - Use systemd_ordering instead of requiring systemd. - Own vim syntax directory instead of requiring vim. This also solves the problem the directory got never removed if vim is updated before haproxy.- Update to version 2.1.3+git0.5c020bbdd: * [RELEASE] Released version 2.1.3 * BUG/MINOR: tcp: don't try to set defaultmss when value is negative * BUG/MINOR: http-ana: Set HTX_FL_PROXY_RESP flag if a server perform a redirect * BUG/MINOR: http-ana: Don't overwrite outgoing data when an error is reported * MINOR: htx/channel: Add a function to copy an HTX message in a channel's buffer * MINOR: htx: Add a function to append an HTX message to another one * DOC: word converter ignores delimiters at the start or end of input string * MINOR: build: add aix72-gcc build TARGET and power{8,9} CPUs * BUG/MINOR: tcp: avoid closing fd when socket failed in tcp_bind_listener * BUG/MINOR: listener: enforce all_threads_mask on bind_thread on init * BUG/MEDIUM: listener: only consider running threads when resuming listeners * BUG/MINOR: dns: allow 63 char in hostname * BUG/MINOR: unix: better catch situations where the unix socket path length is close to the limit * DOC: schematic of the SSL certificates architecture * BUG/MEDIUM: ssl/cli: 'commit ssl cert' wrong SSL_CTX init * SCRIPTS: announce-release: allow the user to force to overwrite old files * SCRIPTS: announce-release: place the send command in the mail's header * CONTRIB: debug: also support reading values from stdin * MINOR: acl: Warn when an ACL is named 'or' * CONTRIB: debug: support reporting multiple values at once * CONTRIB: debug: add the possibility to decode the value as certain types only * CONTRIB: debug: add missing flags SF_HTX and SF_MUX * BUG/MINOR: ssl: clear the SSL errors on DH loading failure * BUG/MINOR: ssl: we may only ignore the first 64 errors * BUG/MAJOR: memory: Don't forget to unlock the rwlock if the pool is empty. * BUG/MEDIUM: memory: Add a rwlock before freeing memory. * MINOR: memory: Only init the pool spinlock once. * BUG/MEDIUM: memory_pool: Update the seq number in pool_flush(). * BUG/MEDIUM: connections: Don't forget to unlock when killing a connection. * BUG/MINOR: connection: fix ip6 dst_port copy in make_proxy_line_v2 * BUG/MINOR: ssl: Possible memleak when allowing the 0RTT data buffer. * BUG/MEDIUM: pipe: fix a use-after-free in case of pipe creation error * BUG/MINOR: tcpchecks: fix the connect() flags regarding delayed ack * BUG/MEDIUM: ssl: Don't forget to free ctx->ssl on failure. * MINOR: lua: Add HLUA_PREPEND_C?PATH build option * MINOR: lua: Add lua-prepend-path configuration option * MINOR: lua: Add hlua_prepend_path function * BUILD: cfgparse: silence a bogus gcc warning on 32-bit machines * BUG/MEDIUM: mux-h2: make sure we don't emit TE headers with anything but "trailers" * BUG/MINOR: stktable: report the current proxy name in error messages * BUG/MEDIUM: 0rtt: Only consider the SSL handshake. * BUG/MINOR: ssl/cli: ocsp_issuer must be set w/ "set ssl cert" * BUG/MINOR: ssl: typo in previous patch * BUG/MINOR: ssl: memory leak w/ the ocsp_issuer * BUG/MINOR: ssl: increment issuer refcount if in chain * CLEANUP: stats: shut up a wrong null-deref warning from gcc 9.2 * BUG/MINOR: ssl/cli: free the previous ckch content once a PEM is loaded * BUG/MINOR: ssl: ssl_sock_load_pem_into_ckch is not consistent * BUG/MEDIUM: netscaler: Don't forget to allocate storage for conn->src/dst. * BUG/MINOR: http_act: don't check capture id in backend * MINOR: proxy/http-ana: Add support of extra attributes for the cookie directive * BUG/MINOR: ssl: ssl_sock_load_sctl_from_file memory leak * BUG/MINOR: ssl: ssl_sock_load_issuer_file_into_ckch memory leak * BUG/MINOR: ssl: ssl_sock_load_ocsp_response_from_file memory leak * BUG/MINOR: tcp-rules: Fix memory releases on error path during action parsing * BUG/MINOR: stick-table: Use MAX_SESS_STKCTR as the max track ID during parsing * BUG/MINOR: http-rules: Remove buggy deinit functions for HTTP rules * BUG/MINOR: http-ana/filters: Wait end of the http_end callback for all filters * BUILD: pattern: include errno.h * BUG/MINOR: 51d: Fix bug when HTX is enabled * BUG/MINOR: dns: Make dns_query_id_seed unsigned * BUG/MINOR: cache: Fix leak of cache name in error path * BUG/MINOR: pattern: handle errors from fgets when trying to load patterns * BUG/MEDIUM: connection: add a mux flag to indicate splice usability * BUG/MINOR: stream: don't mistake match rules for store-request rules * BUG/MEDIUM: cli: _getsocks must send the peers sockets * REGTEST: add sample_fetches/hashes.vtc to validate hashes * BUG/MAJOR: hashes: fix the signedness of the hash inputs * BUG/MEDIUM: mux_h1: Don't call h1_send if we subscribed(). * BUG/MEDIUM: mworker: remain in mworker mode during reload * REGTEST: mcli/mcli_start_progs: start 2 programs * BUG/MINOR: cli/mworker: can't start haproxy with 2 programs * BUG/MEDIUM: mux-h2: don't stop sending when crossing a buffer boundary * BUG/MEDIUM: mux-h2: fix missing test on sending_list in previous patch * BUG/MINOR: mux-h2: use a safe list_for_each_entry in h2_send() * BUG/MEDIUM: tasks: Use the MT macros in tasklet_free(). * BUG/MINOR: stream-int: Don't trigger L7 retry if max retries is already reached * BUG/MEDIUM: session: do not report a failure when rejecting a session * BUG/MINOR: channel: inject output data at the end of output * BUG/MEDIUM: http-ana: Truncate the response when a redirect rule is applied * BUG/MINOR: proxy: Fix input data copy when an error is captured * BUG/MINOR: h1: Report the right error position when a header value is invalid * MINOR: ssl: Remove unused variable "need_out". * MINOR: config: disable busy polling on old processes * BUG/MEDIUM: connections: Hold the lock when wanting to kill a connection. * BUG/MEDIUM: checks: Only attempt to do handshakes if the connection is ready. * BUG/MINOR: checks: refine which errno values are really errors.- Update to version 2.1.2+git0.d5b6759b5: * [RELEASE] Released version 2.1.2 * BUILD: ssl: improve SSL_CTX_set_ecdh_auto compatibility * BUG/MEDIUM: stream: Be sure to never assign a TCP backend to an HTX stream * BUG/MINOR: state-file: do not leak memory on parse errors * BUG/MINOR: state-file: do not store duplicates in the global tree * BUG/MEDIUM: state-file: do not allocate a full buffer for each server entry * BUG/MINOR: ssl: openssl-compat: Fix getm_ defines * BUG/MEDIUM: fd/threads: fix a concurrency issue between add and rm on the same fd * MINOR: fd/threads: make _GET_NEXT()/_GET_PREV() use the volatile attribute * BUG/MEDIUM: ssl: Revamp the way early data are handled. * BUG/MAJOR: task: add a new TASK_SHARED_WQ flag to fix foreing requeuing * MINOR: task: only check TASK_WOKEN_ANY to decide to requeue a task * MINOR: http: add a new "replace-path" action * MINOR: debug: support logging to various sinks * BUG/MEDIUM: ssl: Don't set the max early data we can receive too early. * MINOR: sample: Validate the number of bits for the sha2 converter * BUG/MINOR: sample: always check converters' arguments * BUG/MINOR: sample: fix the closing bracket and LF in the debug converter * DOC: clarify the fact that replace-uri works on a full URI- drop the udev buildrequires completely- BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors.- Update to version 2.1.1+git0.4ae521379: * [RELEASE] Released version 2.1.1 * BUILD/MINOR: unix sockets: silence an absurd gcc warning about strncpy() * BUG/MINOR: listener: fix off-by-one in state name check * BUG/MINOR: server: make "agent-addr" work on default-server line * BUG/MINOR: listener: do not immediately resume on transient error * BUG/MINOR: mworker: properly pass SIGTTOU/SIGTTIN to workers * BUG/MINOR: log: fix minor resource leaks on logformat error path * DOC: remove references to the outdated architecture.txt * DOC: proxies: HAProxy only supports 3 connection modes * BUG/MINOR: tasks: only requeue a task if it was already in the queue * DOC: listeners: add a few missing transitions- Update to version 2.1.0+git33.8e4a62508: * BUG/MEDIUM: proto_udp/threads: recv() and send() must not be exclusive. * BUG/MAJOR: dns: add minimalist error processing on the Rx path * BUG/MEDIUM: kqueue: Make sure we report read events even when no data. * DOC: document the listener state transitions * BUG/MEDIUM: listener/threads: fix a remaining race in the listener's accept() * BUG/MINOR: listener: also clear the error flag on a paused listener * BUG/MINOR: listener/threads: always use atomic ops to clear the FD events * BUG/MINOR: proxy: make soft_stop() also close FDs in LI_PAUSED state * BUG/MEDIUM: mux-fcgi: Handle cases where the HTX EOM block cannot be inserted * BUG/MINOR: mux-h1: Be sure to set CS_FL_WANT_ROOM when EOM can't be added- Update to version 2.1.0+git23.e77b108cd: * BUG/MEDIUM: checks: Make sure we set the task affinity just before connecting. * BUG/MEDIUM: tasks: Make sure we switch wait queues in task_set_affinity().- Update to version 2.1.0+git21.67ff2112b: * BUG/MINOR: mux-h1: Fix conditions to know whether or not we may receive data * BUG/MINOR: mux-h1: Don't rely on CO_FL_SOCK_RD_SH to set H1C_F_CS_SHUTDOWN * BUG/MEDIUM: mux-h1: Never reuse H1 connection if a shutw is pending * BUG/MINOR: ssl: certificate choice can be unexpected with openssl >= 1.1.1 * BUG/MEDIUM: listener/thread: fix a race when pausing a listener * BUG/MINOR: ssl/cli: don't overwrite the filters variable * BUG/MINOR: stream-int: avoid calling rcv_buf() when splicing is still possible * BUG/MEDIUM: stream-int: don't subscribed for recv when we're trying to flush data * DOC: move the "group" keyword at the right place * DOC: Fix ordered list in summary- switch to the 2.1 branch https://www.haproxy.com/blog/haproxy-2-1/ https://www.mail-archive.com/haproxy@formilux.org/msg35491.html- Update to version 2.0.10+git14.7caf150a: * BUG/MINOR: mux-h1: Fix conditions to know whether or not we may receive data * BUG/MINOR: mux-h1: Don't rely on CO_FL_SOCK_RD_SH to set H1C_F_CS_SHUTDOWN * BUG/MEDIUM: mux-h1: Never reuse H1 connection if a shutw is pending * BUG/MINOR: ssl: certificate choice can be unexpected with openssl >= 1.1.1 * BUG/MEDIUM: listener/thread: fix a race when pausing a listener * BUG/MINOR: stream-int: avoid calling rcv_buf() when splicing is still possible * BUG/MEDIUM: stream-int: don't subscribed for recv when we're trying to flush data * DOC: move the "group" keyword at the right place * DOC: clarify matching strings on binary fetches * DOC: Clarify behavior of server maxconn in HTTP mode- Update to version 2.0.10+git4.6d9a455d: * BUG/MINOR: http-htx: Don't make http_find_header() fail if the value is empty- Update to version 2.0.10+git3.200c6215: * BUG/MINOR: contrib/prometheus-exporter: decode parameter and value only- Update to version 2.0.10+git2.3a00e5fc: * BUG/MINOR: contrib/prometheus-exporter: Use HTX errors and not legacy ones * BUG/MINOR: stream: init variables when the list is empty- Update to version 2.0.10+git0.ac198b92: (bsc#1157712) (bsc#1157714) * [RELEASE] Released version 2.0.10 * SCRIPTS: git-show-backports: add "-s" to proposed cherry-pick commands * SCRIPTS: create-release: show the correct origin name in suggested commands * BUG/MAJOR: mux-h2: don't try to decode a response HEADERS frame in idle state * BUG/MAJOR: h2: make header field name filtering stronger * BUG/MAJOR: h2: reject header values containing invalid chars * MINOR: ist: add ist_find_ctl() * BUG/MINOR: ssl: fix curve setup with LibreSSL * BUG/MINOR: cli: fix out of bounds in -S parser * DOC: Add documentation about the use-service action * DOC: Add missing stats fields in the management manual * BUG/MINOR: mux-h1: Adjust header case when chunked encoding is add to a message * BUG/MINOR: mux-h1: Fix a UAF in cfg_h1_headers_case_adjust_postparser() * MEDIUM: mux-h1: Add the support of headers adjustment for bogus HTTP/1 apps * REGTEST: vtest can now enable mcli with its own flag * MINOR: stats: Report max times in addition of the averages for sessions * BUG/MINOR: stream-int: Fix si_cs_recv() return value * MINOR: contrib/prometheus-exporter: Add a param to ignore servers in maintenance * MINOR: contrib/prometheus-exporter: filter exported metrics by scope * MINOR: contrib/prometheus-exporter: report the number of idle conns per server * BUG/MINOR: contrib/prometheus-exporter: Rename some metrics * MINOR: contrib/prometheus-exporter: Report metrics about max times for sessions * MINOR: counters: Add fields to store the max observed for {q,c,d,t}_time * MINOR: stream: Remove the lock on the proxy to update time stats * MINOR: freq_ctr: Make the sliding window sums thread-safe * BUG/MINOR: http-ana: Properly catch aborts during the payload forwarding * BUG/MINOR: mux-h1: Fix tunnel mode detection on the response path * BUILD: debug: Avoid warnings in dev mode with -02 because of some BUG_ON tests * BUG/MEDIUM: stream-int: Don't loose events on the CS when an EOS is reported * BUILD/MINOR: ssl: fix compiler warning about useless statement * BUG/MINOR: peers: "peer alive" flag not reset when deconnecting. * BUG/MEDIUM: mworker: don't fill the -sf argument with -1 during the reexec- Update to version 2.0.9+git6.26b7b800: * BUG/MINOR: ssl: fix crt-list neg filter for openssl < 1.1.1 * BUG/MINOR: peers: Wrong null "server_name" data field handling. * MINOR: peers: Add debugging information to "show peers". * MINOR: peers: Add TX/RX heartbeat counters. * MINOR: peers: Alway show the table info for disconnected peers.- Update to version 2.0.9+git1.caf02113: * BUG/MINOR: init: fix set-dumpable when using uid/gid- Update to version 2.0.9+git0.efac87ee (bsc#1154980) (CVE-2019-18277): * [RELEASE] Released version 2.0.9 * BUG/MINOR: mux-h1: Don't set CS_FL_EOS on a read0 when receiving data to pipe * BUG/MEDIUM: filters: Don't call TCP callbacks for HTX streams * BUG/MINOR: log: limit the size of the startup-logs * BUILD: contrib/da: remove an "unused" warning * MINOR: memory: also poison the area on freeing * CLEANUP: session: slightly simplify idle connection cleanup logic * BUG/MEDIUM: Make sure we leave the session list in session_free(). * BUG/MEDIUM: listeners: always pause a listener on out-of-resource condition * BUG/MINOR: queue/threads: make the queue unlinking atomic * DOC: management: fix typo on "cache_lookups" stats output * DOC: management: document cache_hits and cache_lookups in the CSV format * DOC: management: document reuse and connect counters in the CSV format * BUG: dns: timeout resolve not applied for valid resolutions * BUG/MINOR: action: do-resolve now use cached response * BUG/MEDIUM: stream: Be sure to release allocated captures for TCP streams * MINOR: doc: http-reuse connection pool fix * BUG/MEDIUM: stream: Be sure to support splicing at the mux level to enable it * BUG/MEDIUM: mux-h1: Disable splicing for chunked messages * BUG/MEDIUM: mux-h2: immediately report connection errors on streams * BUG/MEDIUM: mux-h2: immediately remove a failed connection from the idle list * BUG/MEDIUM: mux-h2: report no available stream on a connection having errors * BUG/MINOR: config: Update cookie domain warn to RFC6265 * BUG/MEDIUM: servers: Only set SF_SRV_REUSED if the connection if fully ready. * BUG/MEDIUM: stream_interface: Only use SI_ST_RDY when the mux is ready. * MINOR: mux: Add a new method to get informations about a mux. * BUG/MINOR: spoe: fix off-by-one length in UUID format string * BUG/MAJOR: stream-int: Don't receive data from mux until SI_ST_EST is reached * BUG/MINOR: mux-h2: Don't pretend mux buffers aren't full anymore if nothing sent * BUG/MINOR: cli: don't call the kw->io_release if kw->parse failed * MINOR: tcp: avoid confusion in time parsing init * BUG/MINOR: mux-h2: do not emit logs on backend connections * MINOR: config: warn on presence of "\n" in header values/replacements- Update to version 2.0.8+git0.60e6020c: * [RELEASE] Released version 2.0.8 * BUG/MEDIUM: pattern: make the pattern LRU cache thread-local and lockless * BUG/MINOR: stick-table: fix an incorrect 32 to 64 bit key conversion * BUG/MINOR: ssl: fix memcpy overlap without consequences. * BUG/MEDIUM: http: unbreak redirects in legacy mode * BUG/MINOR: mux-h2: also make sure blocked legacy connections may expire * BUG/MINOR: sample: Make the `field` converter compatible with `-m found` * BUG/MINOR: cache: alloc shctx after check config * BUG/MINOR: stick-table: Never exceed (MAX_SESS_STKCTR-1) when fetching a stkctr * BUG/MINOR: ssl: Fix fd leak on error path when a TLS ticket keys file is parsed * BUG/MINOR: mworker/cli: reload fail with inherited FD * BUG/MEDIUM: ssl: 'tune.ssl.default-dh-param' value ignored with openssl > 1.1.1 * CLEANUP: bind: handle warning label on bind keywords parsing. * CLEANUP: ssl: make ssl_sock_load_dh_params handle errcode/warn * CLEANUP: ssl: make ssl_sock_put_ckch_into_ctx handle errcode/warn * CLEANUP: ssl: make ssl_sock_load_cert*() return real error codes * REGTEST: mcli/mcli_show_info: launch a 'show info' on the master CLI * BUG/MEDIUM: mux_pt: Only call the wake emthod if nobody subscribed to receive. * BUG/MEDIUM: mux_pt: Don't destroy the connection if we have a stream attached. * Revert e8826ded5fea3593d89da2be5c2d81c522070995. * BUG/MAJOR: idle conns: schedule the cleanup task on the correct threads * BUG/MEDIUM: mux_pt: Make sure we don't have a conn_stream before freeing. * BUG/MINOR: tcp: Don't alter counters returned by tcp info fetchers * BUG/MINOR: mworker/ssl: close openssl FDs unconditionally * BUG/MINOR: http-htx: Properly set htx flags on error files to support keep-alive * MINOR: version: make the version strings variables, not constants * BUG/MINOR: WURFL: fix send_log() function arguments * BUG/MINOR: mux-h1: Capture ignored parsing errors * BUG/MINOR: mux-h1: Mark the output buffer as full when the xfer is interrupted * BUG/MINOR: chunk: Fix tests on the chunk size in functions copying data * BUG/MEDIUM: htx: Catch chunk_memcat() failures when HTX data are formatted to h1 * BUILD: ssl: wrong #ifdef for SSL engines code * BUG/MINOR: ssl: abort on sni_keytypes allocation failure * BUG/MINOR: ssl: free the sni_keytype nodes * BUG/MINOR: ssl: abort on sni allocation failure * BUG/MEDIUM: applet: always check a fast running applet's activity before killing * MINOR: stats: mention in the help message support for "json" and "typed" * DOC: fix typo in Prometheus exporter doc * DOC: clarify some points around http-send-name-header's behavior * BUG/MEDIUM: cache: make sure not to cache requests with absolute-uri * BUG/MINOR: peers: crash on reload without local peer. * BUG/MEDIUM: mux-h2: do not enforce timeout on long connections * BUILD: ebtree: make eb_is_empty() and eb_is_dup() take a const * MINOR: mux-h2: add a per-connection list of blocked streams * BUG/MINOR: action: do-resolve does not yield on requests with body * BUG/MEDIUM: lua: Store stick tables into the sample's `t` field * BUG/MINOR: lua: Properly initialize the buffer's fields for string samples in hlua_lua2(smp|arg) * BUG/MINOR: stats: Add a missing break in a switch statement- Update to version 2.0.7+git0.1909aa1e: * [RELEASE] Released version 2.0.7 * BUG/MEDIUM: namespace: fix fd leak in master-worker mode * DOC: Fix documentation about the cli command to get resolver stats * BUG/MINOR: contrib/prometheus-exporter: Return the time averages in seconds * MINOR: stats: Add the support of float fields in stats * MINOR: spoe: Support the async mode with several threads * MINOR: spoe: Improve generation of the engine-id * BUG/MEDIUM: spoe: Use a different engine-id per process * BUG/MINOR: mux-h1: Do h2 upgrade only on the first request * BUG/MAJOR: mux_h2: Don't consume more payload than received for skipped frames * BUG/MINOR: mux-h2: Use the dummy error when decoding headers for a closed stream * BUG/MEDIUM: mux-h2: don't reject valid frames on closed streams * BUG/MEDIUM: namespace: close open namespaces during soft shutdown * BUG/MINOR: mux-h2: do not wake up blocked streams before the mux is ready * BUG/MEDIUM: checks: make sure the connection is ready before trying to recv * BUG/MEDIUM: stream-int: Process connection/CS errors during synchronous sends * BUG/MINOR: stream-int: Process connection/CS errors first in si_cs_send() * BUG/MEDIUM: check/threads: make external checks run exclusively on thread 1 * BUG/MAJOR: mux-h2: Handle HEADERS frames received after a RST_STREAM frame * BUG/MINOR: mux-h2: Be sure to have a connection to unsubcribe * BUG/MEDIUM: stick-table: Properly handle "show table" with a data type argument- Update to version 2.0.6+git0.58706ab4: * [RELEASE] Released version 2.0.6 * MINOR: sample: Add UUID-fetch * BUG/MINOR: Missing stat_field_names (since f21d17bb) * BUG/MINOR: backend: Fix a possible null pointer dereference * BUG/MINOR: acl: Fix memory leaks when an ACL expression is parsed * BUG/MINOR: filters: Properly set the HTTP status code on analysis error * BUG/MEDIUM: http: also reject messages where "chunked" is missing from transfer-enoding * BUG/MINOR: ssl: always check for ssl connection before getting its XPRT context * BUG/MINOR: listener: Fix a possible null pointer dereference * MINOR: stats: report the number of idle connections for each server * BUG/MEDIUM: connection: don't keep more idle connections than ever needed * BUG/MAJOR: ssl: ssl_sock was not fully initialized. * BUG/MINOR: lb/leastconn: ignore the server weights for empty servers * MINOR: contrib/prometheus-exporter: Report DRAIN/MAINT/NOLB status for servers * BUG/MINOR: checks: do not uselessly poll for reads before the connection is up * BUG/MINOR: checks: make __event_chk_srv_r() report success before closing * BUG/MINOR: checks: start sending the request right after connect() * BUG/MINOR: checks: stop polling for write when we have nothing left to send * BUG/MEDIUM: cache: Don't cache objects if the size of headers is too big * BUG/MEDIUM: cache: Properly copy headers splitted on several shctx blocks * BUG/MINOR: mux-h1: Be sure to update the count before adding EOM after trailers * BUG/MINOR: mux-h1: Don't stop anymore input processing when the max is reached * BUG/MINOR: mux-h1: Fix size evaluation of HTX messages after headers parsing * BUG/MINOR: h1: Properly reset h1m when parsing is restarted * BUG/MINOR: http-ana: Reset response flags when 1xx messages are handled * BUG/MEDIUM: peers: local peer socket not bound. * BUG/MEDIUM: proto-http: Always start the parsing if there is no outgoing data * BUG/MEDIUM: url32 does not take the path part into account in the returned hash. * BUG/MEDIUM: listener/threads: fix an AB/BA locking issue in delete_listener() * BUG/MINOR: mworker: disable SIGPROF on re-exec * DOC: fixed typo in management.txt * BUG/MEDIUM: mux-h1: do not report errors on transfers ending on buffer full * BUG/MEDIUM: mux-h1: do not truncate trailing 0CRLF on buffer boundary * MEDIUM: debug: make the thread dump code show Lua backtraces * MINOR: lua: export applet and task handlers * MINOR: tools: add append_prefixed_str() * MINOR: debug: indicate the applet name when the task is task_run_applet()- Use %license instead of %doc [bsc#1082318] - Recommend apparmor, it's not required to work (make haproxy useable in a container)- enable prometheus exporter- enable verbose make output- Update to version 2.0.5+git0.d905f49a: * [RELEASE] Released version 2.0.5 * BUG/MEDIUM: mux_pt: Don't call unsubscribe if we did not subscribe. * MINOR: fd: make sure to mark the thread as not stuck in fd_update_events() * BUG/MINOR: stats: Wait the body before processing POST requests * BUG/MEDIUM: lua: Fix test on the direction to set the channel exp timeout * BUG/MEDIUM: mux_h1: Don't bother subscribing in recv if we're not connected. * BUG/MINOR: Fix prometheus '# TYPE' and '# HELP' headers * BUG/MINOR: lua: fix setting netfilter mark * BUG/MEDIUM: proxy: Don't use cs_destroy() when freeing the conn_stream. * BUG/MEDIUM: proxy: Don't forget the SF_HTX flag when upgrading TCP=>H1+HTX. * BUG/MINOR: buffers/threads: always clear a buffer's head before releasing it * MINOR: ssl: ssl_fc_has_early should work for BoringSSL * BUG/MINOR: ssl: fix 0-RTT for BoringSSL * BUG/MEDIUM: stick-table: Wrong stick-table backends parsing. * [RELEASE] Released version 2.0.4 * BUG/MEDIUM: checks: make sure to close nicely when we're the last to speak * BUG/MINOR: mux-h2: always reset rcvd_s when switching to a new frame * BUG/MINOR: mux-h2: always send stream window update before connection's * BUG/MEDIUM: mux-h2: do not recheck a frame type after a state transition * BUG/MINOR: mux-h2: do not send REFUSED_STREAM on aborted uploads * BUG/MINOR: mux-h2: use CANCEL, not STREAM_CLOSED in h2c_frt_handle_data() * BUG/MINOR: mux-h2: don't refrain from sending an RST_STREAM after another one * BUG/MEDIUM: fd: Always reset the polled_mask bits in fd_dodelete(). * BUG/MEDIUM: proxy: Make sure to destroy the stream on upgrade from TCP to H2 * BUG/MEDIUM: mux-h2: split the stream's and connection's window sizes * BUG/MEDIUM: mux-h2: unbreak receipt of large DATA frames * BUG/MINOR: stream-int: also update analysers timeouts on activity * BUG/MAJOR: http/sample: use a static buffer for raw -> htx conversion * BUG/MEDIUM: lb-chash: Ensure the tree integrity when server weight is increased * MINOR: wdt: also consider that waiting in the thread dumper is normal * BUG/MINOR: debug: fix a small race in the thread dumping code- Update to version 2.0.3+git14.0ff395c1 (bsc#1142529) (CVE-2019-14241): * BUG/MAJOR: queue/threads: avoid an AB/BA locking issue in process_srv_queue() * BUG/MINOR: htx: Fix free space addresses calculation during a block expansion * BUG/MINOR: hlua: Only execute functions of HTTP class if the txn is HTTP ready * MINOR: hlua: Add a flag on the lua txn to know in which context it can be used * MINOR: hlua: Don't set request analyzers on response channel for lua actions * BUG/MEDIUM: hlua: Check the calling direction in lua functions of the HTTP class * BUG/MINOR: hlua/htx: Reset channels analyzers when txn:done() is called * DOC: improve the wording in CONTRIBUTING about how to document a bug fix * BUG/MINOR: log: make sure writev() is not interrupted on a file output * BUG/MEDIUM: streams: Don't switch the SI to SI_ST_DIS if we have data to send. * BUG/MEDIUM: lb-chash: Fix the realloc() when the number of nodes is increased * BUILD: threads: add the definition of PROTO_LOCK * BUG/MINOR: proxy: always lock stop_proxy() * BUG/MEDIUM: protocols: add a global lock for the init/deinit stuff * [RELEASE] Released version 2.0.3 * BUG/CRITICAL: http_ana: Fix parsing of malformed cookies which start by a delimiter * BUG/MINOR: http_htx: Support empty errorfiles * BUG/MINOR: http_ana: Be sure to have an allocated buffer to generate an error * BUG/MEDIUM: tcp-checks: do not dereference inexisting conn_stream * BUG/MINOR: mux-h1: Close server connection if input data remains in h1_detach() * BUG/MEDIUM: mux-h1: Trim excess server data at the end of a transaction * BUG/MINOR: checks: do not exit tcp-checks from the middle of the loop * BUG/MINOR: session: Send a default HTTP error if accept fails for a H1 socket * BUG/MINOR: session: Emit an HTTP error if accept fails only for H1 connection * BUG/MINOR: debug: Remove flags CO_FL_SOCK_WR_ENA/CO_FL_SOCK_RD_ENA * DOC: htx: Update comments in HTX files * BUG/MINOR: hlua: Make the function txn:done() HTX aware * BUG/MINOR: cache/htx: Make maxage calculation HTX aware * BUG/MINOR: http_htx: Initialize HTX error messages for TCP proxies * BUG/MINOR: http_fetch: Fix http_auth/http_auth_group when called from TCP rules * BUG/MINOR: backend: do not try to install a mux when the connection failed * BUG/MEDIUM: http/htx: unbreak option http_proxy * BUG/MEDIUM: checks: Don't attempt to receive data if we already subscribed. * BUG/MINOR: dns: remove irrelevant dependency on a client connection * [RELEASE] Released version 2.0.2 * BUG/MEDIUM: threads: cpu-map designating a single thread/process are ignored * BUG/MEDIUM: tcp-check: unbreak multiple connect rules again * BUG/MINOR: mux-pt: do not pretend there's more data after a read0 * BUG/MEDIUM: streams: Don't redispatch with L7 retries if redispatch isn't set. * BUG/MEDIUM: streams: Don't give up if we couldn't send the request. * BUG/MINOR: mux-h1: Correctly report Ti timer when HTX and keepalives are used * BUG/MEDIUM: mux-h1: Don't release h1 connection if there is still data to send * BUG/MAJOR: listener: fix thread safety in resume_listener() * MINOR: task: introduce work lists * BUG/MEDIUM: servers: Fix a race condition with idle connections. * DOC: Fix typos and grammer in configuration.txt * BUG/MEDIUM: da: cast the chunk to string. * BUG/MEDIUM: checks: Don't attempt to read if we destroyed the connection. * BUG/MINOR: server: Be really able to keep "pool-max-conn" idle connections * BUG/MEDIUM: fd/threads: fix excessive CPU usage on multi-thread accept- Update to version 2.0.1+git27.5db881ff: * BUG/MINOR: ssl: revert empty handshake detection in OpenSSL <= 1.0.2 * BUG/MEDIUM: servers: Don't forget to set srv_cs to NULL if we can't reuse it. * BUG/MEDIUM: stream-int: Don't rely on CF_WRITE_PARTIAL to unblock opposite si * MINOR: stream-int: Factorize processing done after sending data in si_cs_send() * BUG/MINOR: mux-h1: Don't process input or ouput if an error occurred * BUG/MEDIUM: mux-h1: Handle TUNNEL state when outgoing messages are formatted * BUG/MEDIUM: lb_fas: Don't test the server's lb_tree from outside the lock * BUG/MEDIUM: http/applet: Finish request processing when a service is registered * MINOR: action: Add the return code ACT_RET_DONE for actions * BUG/MINOR: contrib/prometheus-exporter: Don't try to add empty data blocks * MINOR: server: Add "no-tfo" option. * BUG/MEDIUM: sessions: Don't keep an extra idle connection in sessions. * BUG/MEDIUM: servers: Authorize tfo in default-server. * BUG/MEDIUM: connections: Make sure we're unsubscribe before upgrading the mux. * BUG/MINOR: contrib/prometheus-exporter: Respect the reserve when data are sent * BUG/MINOR: hlua/htx: Respect the reserve when HTX data are sent * BUG/MEDIUM: channel/htx: Use the total HTX size in channel_htx_recv_limit() * BUG/MINOR: hlua: Don't use channel_htx_recv_max() * BUG/MINOR: contrib/prometheus-exporter: Don't use channel_htx_recv_max() * BUG/MEDIUM: checks: Make sure the tasklet won't run if the connection is closed. * BUG/MEDIUM: connections: Always call shutdown, with no linger. * BUG/MINOR: mux-h1: Don't return the empty chunk on HEAD responses * BUG/MINOR: mux-h1: Skip trailers for non-chunked outgoing messages * BUG/MEDIUM: checks: unblock signals in external checks * BUG/MEDIUM: mux-h1: Always release H1C if a shutdown for writes was reported * BUG/MEDIUM: ssl: Don't attempt to set alpn if we're not using SSL. * BUG/MINOR: mworker/cli: don't output a \n before the response * BUG/MINOR: mux-h1: Make format errors during output formatting fatal * BUG/MEDIUM: mux-h1: Use buf_room_for_htx_data() to detect too large messages * BUG/MEDIUM: proto_htx: Don't add EOM on 1xx informational messages * BUG/MINOR: log: Detect missing sampling ranges in config * BUG/MINOR: memory: Set objects size for pools in the per-thread cache * BUG/MAJOR: mux-h1: Don't crush trash chunk area when outgoing message is formatted * BUG/MINOR: htx: Save hdrs_bytes when the HTX start-line is replaced * BUG/MEDIUM: ssl: Don't do anything in ssl_subscribe if we have no ctx. * BUG/MEDIUM: connections: Always add the xprt handshake if needed. * BUG/MEDIUM: stream_interface: Don't add SI_FL_ERR the state is < SI_ST_CON. * BUG/MINOR: spoe: Fix memory leak if failing to allocate memory * BUG/MEDIUM: mworker/cli: command pipelining doesn't work anymore * BUG/MEDIUM: mworker: don't call the thread and fdtab deinit * BUG/MINOR: mworker-prog: Fix segmentation fault during cfgparse * BUG/MAJOR: sample: Wrong stick-table name parsing in "if/unless" ACL condition. * BUG/MEDIUM: lb_fwlc: Don't test the server's lb_tree from outside the lock * BUG/MEDIUM: mux-h2: Remove the padding length when a DATA frame size is checked * BUG/MEDIUM: mux-h2: Reset padlen when several frames are demux- Correct version line, which should be 2.0.0+git6.- allow the new master socket path in the apparmor profile- Update to version 2.0.0~git6.41dc8432: * BUG/MEDIUM: htx: Fully update HTX message when the block value is changed * MINOR: htx: Add the function htx_change_blk_value_len() * BUG/MEDIUM: compression: Set Vary: Accept-Encoding for compressed responses * BUG/MINOR: mux-h1: Add the header connection in lower case in outgoing messages * BUG/MINOR: lua/htx: Make txn.req_req_* and txn.res_rep_* HTX aware * BUG/MEDIUM: h2/htx: Update data length of the HTX when the cookie list is built- Update to version 2.0.0~git0.ba23630a: - new internal native HTTP representation called HTX, was already in 1.9 and is now enabled by default in 2.0 ; - end-to-end HTTP/2 support including trailers and continuation frames, as needed for gRPC ; HTTP/2 may also be upgraded from HTTP/1.1 using the H2 preface; - server connection pooling and more advanced reuse, with ALPN protocol negotiation (already in 1.9) ; - layer 7 retries, allowing to use 0-RTT and TCP Fast Open to the servers as well as on the frontend ; - much more scalable multi-threading, which is even enabled by default on platforms where it was successfully tested ; by default, as many threads are started as the number of CPUs haproxy is allowed to run on. This removes a lot of configuration burden in VMs and containers ; - automatic maxconn setting for the process and the frontends, directly based on the number of available FDs (easier configuration in containers and with systemd) ; - logging to stdout for use in containers and systemd (already in 1.9). Logs can now provide micro-second resolution for some events ; - peers now support SSL, declaration of multiple stick-tables directly in the peers section, and synchronization of server names, not just IDs ; - In master-worker mode, the master process now exposes its own CLI and can communicate with all other processes (including the stopping ones), even allowing to connect to their CLI and check their state. It is also possible to start some sidecar programs and monitor them from the master, and the master can automatically kill old processes that survived too many reloads ; - the incoming connections are load-balanced between all threads depending on their load to minimize the processing time and maximize the capacity (already in 1.9) ; - the SPOE connection load-balancing was significantly improved in order to reduce high percentiles of SPOA response time (already in 1.9) ; - the "random" load balancing algorithm and a power-of-two-choices variant were introduced ; - statistics improvements with per-thread counters for certain things, and a prometheus exporter for all our statistics; - lots of debugging help, it's easier to produce a core dump, there are new commands on the CLI to control various things, there is a watchdog to fail cleanly when a thread deadlock or a spinning task are detected, so overall it should provide a better experience in field and less round trips between users and developers (hence less stress during an incident). - all 3 device detection engines are now compatible with multi-threading and can be build-tested without any external dependencies ; - "do-resolve" http-request action to perform a DNS resolution on any, sample, and resolvers now support relying on /etc/resolv.conf to match the local resolver ; - log sampling and balancing : it's now possible to send 1 log every 10 to a server, or to spread the logging load over multiple log servers; - a new SPOA agent (spoa_server) allows to interface haproxy with Python and Lua programs ; - support for Solaris' event ports (equivalent of kqueue or epoll) which will significantly improve the performance there when dealing with numerous connections ; - some warnings are now reported for some deprecated options that will be removed in 2.1. Since 2.0 is long term supported, there's no emergency to convert them, however if you see these warnings, you need to understand that you're among their extremely rare users and just because of this you may be taking risks by keeping them ; - A new SOCKS4 server-side layer was provided ; it allows outgoing connections to be forwarded through a SOCKS4 proxy (such as ssh -D). - priority- and latency- aware server queues : it is possible now to assign priorities to certain requests and/or to give them a time bonus or penalty to refine control of the traffic and be able to engage on SLAs. - internally the architecture was significantly redesigned to allow to further improve performance and make it easier to implement protocols that span over multiple layers (such as QUIC). This work started in 1.9 and will continue with 2.1. - the I/O, applets and tasks now share the same multi-threaded scheduler, giving a much better responsiveness and fairness between all tasks as is visible with the CLI which always responds instantly even under extreme loads (started in 1.9) ; - the internal buffers were redesigned to ease zero-copy operations, so that it is possible to sustain a high bandwidth even when forwarding HTTP/1 to/from HTTP/2 (already in 1.9) ;- Update to version 1.8.20~git0.6fb9fadc: * [RELEASE] Released version 1.8.20 * BUG/MINOR: spoe: Don't systematically wakeup SPOE stream in the applet handler * BUG/MINOR: da: Get the request channel to call CHECK_HTTP_MESSAGE_FIRST() * BUG/MINOR: 51d: Get the request channel to call CHECK_HTTP_MESSAGE_FIRST() * BUG/MEDIUM: thread/http: Add missing locks in set-map and add-acl HTTP rules * BUG/MINOR: acl: properly detect pattern type SMP_T_ADDR * BUG/MEDIUM: maps: only try to parse the default value when it's present * BUG/MAJOR: http_fetch: Get the channel depending on the keyword used * MINOR: skip get_gmtime where tm is unused * BUILD/MINOR: listener: Silent a few signedness warnings. * BUG/MEDIUM: listener: make sure the listener never accepts too many conns * BUG/MEDIUM: listener: use a self-locked list for the dequeue lists * MAJOR: listener: do not hold the listener lock in listener_accept() * BUG/MEDIUM: list: fix incorrect pointer unlocking in LIST_DEL_LOCKED() * BUG/MEDIUM: list: fix again LIST_ADDQ_LOCKED * BUG/MEDIUM: list: correct fix for LIST_POP_LOCKED's removal of last element * MINOR: list: make the delete and pop operations idempotent * BUG/MEDIUM: list: add missing store barriers when updating elements and head * BUG/MEDIUM: list: fix LIST_POP_LOCKED's removal of the last pointer * BUG/MEDIUM: list: fix the rollback on addq in the locked liss * BUG/MEDIUM: lists: Properly handle the case we're removing the first elt. * MINOR: lists: Implement locked variations. * BUG/MINOR: threads: fix the process range of thread masks * BUG/MEDIUM: spoe: Return an error if nothing is encoded for fragmented messages * BUG/MEDIUM: spoe: Queue message only if no SPOE applet is attached to the stream * BUG/MEDIUM: pattern: assign pattern IDs after checking the config validity * BUILD: connection: fix naming of ip_v field * BUILD: use inttypes.h instead of stdint.h * BUG/MEDIUM: peers: fix a case where peer session is not cleanly reset on release. * MINOR: cli: start addresses by a prefix in 'show cli sockets' * BUG/MINOR: cli: correctly handle abns in 'show cli sockets' * BUILD: Makefile: disable shared cache on AIX 5.1 * BUILD: makefile: add _LINUX_SOURCE_COMPAT to build on AIX-51 * BUILD: makefile: fix build of IPv6 header on aix51 * MINOR: tools: make memvprintf() never pass a NULL target to vsnprintf() * BUILD: makefile: work around an old bug in GNU make-3.80 * BUG/MAJOR: checks: segfault during tcpcheck_main * DOC: The option httplog is no longer valid in a backend. * BUG/MEDIUM: ssl: ability to set TLS 1.3 ciphers using ssl-default-server-ciphersuites * BUG/MINOR: http/counters: fix missing increment of fe->srv_aborts * BUG/MAJOR: stats: Fix how huge POST data are read from the channel * BUG/MAJOR: spoe: Fix initialization of thread-dependent fields * BUG/MEDIUM: threads/fd: do not forget to take into account epoll_fd/pipes * MEDIUM: threads: Use __ATOMIC_SEQ_CST when using the newer atomic API. * BUG/MINOR: ssl: fix warning about ssl-min/max-ver support * BUG/MEDIUM: 51d: fix possible segfault on deinit_51degrees() * BUG/MEDIUM: logs: Only attempt to free startup_logs once. * BUG/MINOR: listener: keep accept rate counters accurate under saturation * BUG/MAJOR: listener: Make sure the listener exist before using it.- Update to version 1.8.19~git0.ebf033b4: * [RELEASE] Released version 1.8.19 * BUG/MINOR: config: Reinforce validity check when a process number is parsed * BUG/MAJOR: stream: avoid double free on unique_id * BUG/MAJOR: spoe: Don't try to get agent config during SPOP healthcheck * BUG/MEDIUM: server: initialize the idle conns list after parsing the config * BUG/MEDIUM: spoe: initialization depending on nbthread must be done last * BUG/MINOR: lua: initialize the correct idle conn lists for the SSL sockets * BUG/MINOR: spoe: do not assume agent->rt is valid on exit * DOC: ssl: Stop documenting ciphers example to use * DOC: ssl: Clarify when pre TLSv1.3 cipher can be used * [RELEASE] Released version 1.8.18 * BUG/MINOR: config: make sure to count the error on incorrect track-sc/stick rules * BUG/MAJOR: spoe: verify that backends used by SPOE cover all their callers' processes * BUG/MAJOR: config: verify that targets of track-sc and stick rules are present * BUG/MINOR: config: fix bind line thread mask validation * BUG/MEDIUM: stream: Don't forget to free s->unique_id in stream_free(). * BUG/MEDIUM: mux-h2: do not close the connection on aborted streams * MINOR: connstream: have a new flag CS_FL_KILL_CONN to kill a connection * MINOR: stream-int: add a new flag to mention that we want the connection to be killed * MINOR: stream-int: expand the flags to 32-bit * BUG/MEDIUM: mux-h2: wait for the mux buffer to be empty before closing the connection * BUG/MEDIUM: mux-h2: make sure never to send GOAWAY on too old streams * BUG/MEDIUM: mux-h2: fix two half-closed to closed transitions * BUG/MEDIUM: mux-h2: wake up flow-controlled streams on initial window update * MINOR: xref: Add missing barriers. * BUG/MINOR: stream: don't close the front connection when facing a backend error * SCRIPTS: add the issue tracker URL to the announce script * SCRIPTS: add the slack channel URL to the announce script * BUG/MINOR: deinit: tcp_rep.inspect_rules not deinit, add to deinit * BUG/MINOR: spoe: corrected fragmentation string size * DOC: nbthread is no longer experimental. * BUG/MINOR: hpack: return a compression error on invalid table size updates * BUG/MINOR: mux-h2: make it possible to set the error code on an already closed stream * BUG/MINOR: mux-h2: headers-type frames in HREM are always a connection error * BUG/MINOR: mux-h2: CONTINUATION in closed state must always return GOAWAY * MINOR: h2: declare new sets of frame types * MINOR: h2: add a bit-based frame type representation * DOC: mention the effect of nf_conntrack_tcp_loose on src/dst * BUG/MEDIUM: ssl: Fix handling of TLS 1.3 KeyUpdate messages * BUG/MINOR: check: Wake the check task if the check is finished in wake_srv_chk() * BUG/MINOR: server: don't always trust srv_check_health when loading a server state * BUG/MINOR: stick_table: Prevent conn_cur from underflowing * BUG/MINOR: backend: BE_LB_LKUP_CHTREE is a value, not a bit * BUG/MINOR: backend: balance uri specific options were lost across defaults * BUG/MINOR: backend: don't use url_param_name as a hint for BE_LB_ALGO_PH * BUG/MEDIUM: ssl: missing allocation failure checks loading tls key file * DOC: Be a bit more explicit about allow-0rtt security implications. * BUG/MEDIUM: ssl: Disable anti-replay protection and set max data with 0RTT. * BUG/MAJOR: cache: fix confusion between zero and uninitialized cache key * DOC: http-request cache-use / http-response cache-store expects cache name- Update to version 1.8.17~git0.e89d25b2 (bsc#1121283) (CVE-2018-20615): * BUG/CRITICAL: mux-h2: re-check the frame length when PRIORITY is used * BUG/MEDIUM: lua: dead lock when Lua tasks are trigerred * BUG/MINOR: lua: bad args are returned for Lua actions * BUG/MINOR: lua: Return an error if a legacy HTTP applet doesn't send anything * BUG/MEDIUM: cli: make "show sess" really thread-safe * MINOR: stream/cli: report more info about the HTTP messages on "show sess all" * MINOR: stream/cli: fix the location of the waiting flag in "show sess all" * MINOR: lb: allow redispatch when using consistent hash * BUG/MEDIUM: server: Also copy "check-sni" for server templates. * BUG/MEDIUM: mux-h2: mark that we have too many CS once we have more than the max * MINOR: mux-h2: only increase the connection window with the first update * BUG/MAJOR: stream-int: Update the stream expiration date in stream_int_notify() * BUG/MEDIUM: dns: overflowed dns name start position causing invalid dns error * BUG/MEDIUM: dns: Don't prevent reading the last byte of the payload in dns_validate_response() * BUG/MINOR: logs: leave startup-logs global and not per-thread- Update to version 1.8.15~git0.6b6a350a: (bsc#1119419) (CVE-2018-20103) (VUL-0) (bsc#1119368) (CVE-2018-20102) * DOC: Update configuration doc about the maximum number of stick counters. * BUG: dns: Fix off-by-one write in dns_validate_dns_response() * BUG: dns: Fix out-of-bounds read via signedness error in dns_validate_dns_response() * BUG: dns: Prevent out-of-bounds read in dns_validate_dns_response() * BUG: dns: Prevent out-of-bounds read in dns_read_name() * BUG: dns: Prevent stack-exhaustion via recursion loop in dns_read_name * DOC: refer to check-sni in the documentation of sni * DOC: clarify that check-sni needs an argument. * MINOR: servers: Free [idle|safe|priv]_conns on exit. * MINOR: stats: report the number of active jobs and listeners in "show info" * BUG/MINOR: mux-h2: advertise a larger connection window size * BUG/MINOR: mux-h2: refrain from muxing during the preface * BUG/MINOR: hpack: fix off-by-one in header name encoding length calculation * BUG/MEDIUM: sample: Don't treat SMP_T_METH as SMP_T_STR. * BUG/MINOR: lb-map: fix unprotected update to server's score * BUG/MINOR: cfgparse: Fix the call to post parser of the last sections parsed * BUG/MINOR: cfgparse: Fix transition between 2 sections with the same name * BUG/MINOR: ssl: ssl_sock_parse_clienthello ignores session id * BUG/MEDIUM: hpack: fix encoding of "accept-ranges" field * BUG/MINOR: config: Copy default error messages when parsing of a backend starts * BUG/MEDIUM: Make sure stksess is properly aligned. * BUG/MINOR: config: better detect the presence of the h2 pattern in npn/alpn * BUG/MEDIUM: auth/threads: use of crypt() is not thread-safe * BUG/MAJOR: http: http_txn_get_path() may deference an inexisting buffer * BUG/MINOR: only auto-prefer last server if lb-alg is non-deterministic * BUG/MINOR: only mark connections private if NTLM is detected * DOC: cache: Missing information about "total-max-size" * BUG/MINOR: ssl: Wrong usage of shctx_init(). * BUG/MINOR: cache: Wrong usage of shctx_init(). * BUG/MINOR: cache: Crashes with "total-max-size" > 2047(MB). * BUG/MEDIUM: h2: Close connection if no stream is left an GOAWAY was sent. * BUG/MEDIUM: pools: Fix the usage of mmap()) with DEBUG_UAF. * DOC: fix reference to map files in MAINTAINERS * MINOR: peers: use defines instead of enums to appease clang. * MINOR: cfgparse: Write 130 as 128 as 0x82 and 0x80. * MINOR: server: Use memcpy() instead of strncpy(). * CLEANUP: stick-tables: Remove unneeded double (()) around conditional clause * MINOR: lua: all functions calling lua_yieldk() may return * BUG/MEDIUM: threads: make sure threads_want_sync is marked volatile * BUG/MEDIUM: threads: fix thread_release() at the end of the rendez-vous point * BUG/MEDIUM: stream: don't crash on out-of-memory * BUG/MEDIUM: mworker: segfault receiving SIGUSR1 followed by SIGTERM. * BUG/MINOR: checks: queues null-deref * BUG/MEDIUM: Cur/CumSslConns counters not threadsafe. * MEDIUM: ssl: add support for ciphersuites option for TLSv1.3 * BUG/MEDIUM: buffers: Make sure we don't wrap in buffer_insert_line2/replace2. * BUG/MINOR: backend: check that the mux installed properly * BUG/MINOR: connection: avoid null pointer dereference in send-proxy-v2 * DOC: clarify force-private-cache is an option * MINOR: threads: Make sure threads_sync_pipe is initialized before using it.- also fix the systemd case for the apparmor_reload change- only reload the apparmor profile on newer distros, seems older distros do not have apparmor-rpm-macros yet- only use network namespaces on 12.x and newer, failed to build on sle11- guard all parts referring to systemd to fix build on sle 11- Update to version 1.8.14~git0.52e4d43b: (bsc#1108683) (CVE-2018-14645) * [RELEASE] Released version 1.8.14 * BUG/CRITICAL: hpack: fix improper sign check on the header index value * BUG/MINOR: cli: make sure the "getsock" command is only called on connections * BUG/MINOR: tools: fix set_net_port() / set_host_port() on IPv4 * BUG/MEDIUM: patterns: fix possible double free when reloading a pattern list * DOC: Fix typos in lua documentation * BUG/MINOR: server: Crash when setting FQDN via CLI. * BUG/MAJOR: kqueue: Don't reset the changes number by accident. * BUG/MEDIUM: snapshot: take the proxy's lock while dumping errors * BUG/MINOR: http/threads: atomically increment the error snapshot ID * BUG/MINOR: dns: check and link servers' resolvers right after config parsing * BUG/MEDIUM: h2: fix risk of memory leak on malformated wrapped frames * BUG/MEDIUM: session: fix reporting of handshake processing time in the logs * BUG/MINOR: stream: use atomic increments for the request counter * MINOR: thread: implement HA_ATOMIC_XADD() * BUG/MEDIUM: ECC cert should work with TLS < v1.2 and openssl >= 1.1.1 * BUG/MEDIUM: dns/server: fix incomatibility between SRV resolution and server state file * BUG/MEDIUM: hlua: Don't call RESET_SAFE_LJMP if SET_SAFE_LJMP returns 0. * BUG/MAJOR: thread: lua: Wrong SSL context initialization. * BUG/MEDIUM: hlua: Make sure we drain the output buffer when done. * BUG/MEDIUM: lua: reset lua transaction between http requests * BUG/MEDIUM: mux_pt: dereference the connection with care in mux_pt_wake() * BUG/MINOR: lua: Bad HTTP client request duration. * BUG/MEDIUM: unix: provide a ->drain() function * DOC: Fix spelling error in configuration doc * BUG/MEDIUM: cli/threads: protect some server commands against concurrent operations * BUG/MEDIUM: cli/threads: protect all "proxy" commands against concurrent updates * BUG/MEDIUM: lua: socket timeouts are not applied * DOC: ssl: Use consistent naming for TLS protocols * DOC: dns: explain set server ... fqdn requires resolver * BUG/MINOR: map: fix map_regm with backref * BUG/MEDIUM: ssl: loading dh param from certifile causes unpredictable error. * BUG/MEDIUM: ssl: fix missing error loading a keytype cert from a bundle. * BUG/MINOR: ssl: empty connections reported as errors. * BUG/MEDIUM: cli: make "show fd" thread-safe * MEDIUM: hathreads: implement a more flexible rendez-vous point * BUG/MEDIUM: threads: fix the no-thread case after the change to the sync point * MINOR: threads: add more consistency between certain variables in no-thread case * BUG/MEDIUM: threads: fix the double CAS implementation for ARMv7 * MINOR: threads: Introduce double-width CAS on x86_64 and arm. * BUG/MEDIUM: lua: possible CLOSE-WAIT state with '\n' headers- Require apparmor-abstractions to reduce dependencies (bsc#1100787)- Update to version 1.8.13~git4.c1bfcd00: * MINOR: dns: new DNS options to allow/prevent IP address duplication * MINOR: dns: fix wrong score computation in dns_get_ip_from_response * BUG/MEDIUM: queue: prevent a backup server from draining the proxy's connections * BUG/MEDIUM: servers: check the queues once enabling a server * MEDIUM: proxy_protocol: Convert IPs to v6 when protocols are mixed * BUG/MEDIUM: threads: unbreak "bind" referencing an incorrect thread number * MINOR: threads: move "nbthread" parsing to hathreads.c * BUG/MEDIUM: threads: properly fix nbthreads == MAX_THREADS * BUG/MINOR: threads: Handle nbthread == MAX_THREADS. * BUG/MINOR: config: stick-table is not supported in defaults section * BUG/MEDIUM: h2: prevent orphaned streams from blocking a connection forever * BUG/MEDIUM: threads/sync: use sched_yield when available * BUG/MINOR: servers: Don't make "server" in a frontend fatal. * BUG/MEDIUM: stats: don't ask for more data as long as we're responding * BUG/MEDIUM: stream-int: don't immediately enable reading when the buffer was reportedly full * MINOR: h2: add the error code and the max/last stream IDs to "show fd" * BUG/MEDIUM: threads: Fix the exit condition of the thread barrier * MINOR: debug: Add checks for conn_stream flags * MINOR: debug: Add check for CO_FL_WILL_UPDATE * BUG/MINOR: http: Set brackets for the unlikely macro at the right place * BUG/MEDIUM: h2: make sure the last stream closes the connection after a timeout * BUG/MEDIUM: h2: never leave pending data in the output buffer on close * BUG/MEDIUM: h2: don't accept new streams if conn_streams are still in excess * MINOR: h2: add the mux and demux buffer lengths on "show fd" * MINOR: h2: keep a count of the number of conn_streams attached to the mux * BUG/MINOR: h2: remove accidental debug code introduced with show_fd function * MINOR: h2: implement a basic "show_fd" function * MINOR: mux: add a "show_fd" function to dump debugging information for "show fd" * BUG/MINOR: ssl: properly ref-count the tls_keys entries * MINOR: systemd: consider exit status 143 as successful- Update to version 1.8.12~git0.8a200c71: * MINOR: stick-tables: make stktable_release() do nothing on NULL * BUG/MAJOR: stick_table: Complete incomplete SEGV fix- Update to version 1.8.11~git0.1d6ef58d: * BUG/BUILD: threads: unbreak build without threads * BUG/MAJOR: Stick-tables crash with segfault when the key is not in the stick-table- Update to version 1.8.10~git0.ec17d7a9: * MINOR: threads: Be sure to remove threads from all_threads_mask on exit * BUG/MEDIUM: threads: Use the sync point to check active jobs and exit * BUG/MEDIUM: fd: Don't modify the update_mask in fd_dodelete(). * BUG/MAJOR: ssl: OpenSSL context is stored in non-reserved memory slot * BUG/MAJOR: ssl: Random crash with cipherlist capture * BUG/MINOR: lua: Segfaults with wrong usage of types. * BUG/MAJOR: map: fix a segfault when using http-request set-map * MINOR: lua: Increase debug information * BUG/MINOR: signals: ha_sigmask macro for multithreading * BUG/MINOR: don't ignore SIG{BUS,FPE,ILL,SEGV} during signal processing * BUG/MEDIUM: threads: handle signal queue only in thread 0 * BUG/MINOR: unix: Make sure we can transfer abns sockets on seamless reload. * BUG/MINOR: contrib/modsecurity: update pointer on the end of the frame * BUG/MINOR: contrib/mod_defender: update pointer on the end of the frame * BUG/MINOR: contrib/modsecurity: Don't reset the status code during disconnect * BUG/MINOR: contrib/mod_defender: Don't reset the status code during disconnect * BUG/MINOR: contrib/spoa_example: Don't reset the status code during disconnect * MAJOR: spoe: upgrade the SPOP version to 2.0 and remove the support for 1.0 * BUG/MEDIUM: lua/socket: Buffer error, may segfault * BUG/MEDIUM: lua/socket: Sheduling error on write: may dead-lock * BUG/MEDIUM: lua/socket: Notification error * BUG/MAJOR: lua: Dead lock with sockets * BUG/MEDIUM: lua/socket: wrong scheduling for sockets * MINOR: task/notification: Is notifications registered ? * BUG/MEDIUM: spoe: Return an error when the wrong ACK is received in sync mode * BUG/MEDIUM: stick-tables: Decrement ref_cnt in table_* converters * BUG/MEDIUM: lua/socket: Length required read doesn't work * BUG/MEDIUM: servers: Add srv_addr default placeholder to the state file * BUG/MEDIUM: fd: Only check update_mask against all_threads_mask.- Update to version 1.8.9~git9.6d82e611: * BUG/MEDIUM: cache: don't cache when an Authorization header is present (VUL-1) (bsc#1094846) (CVE-2018-11469) * BUG/MEDIUM: dns: Delay the attempt to run a DNS resolution on check failure. * BUG/MINOR: ssl/lua: prevent lua from affecting automatic maxconn computation * BUG/MEDIUM: contrib/modsecurity: Use network order to encode/decode flags * BUG/MEDIUM: contrib/mod_defender: Use network order to encode/decode flags * BUG/MEDIUM: spoe: Flags are not encoded in network order * BUG/MINOR: lua: Socket.send threw runtime error: 'close' needs 1 arguments. * BUG/MINOR: spoe: Mistake in error message about SPOE configuration * BUG/MEDIUM: ssl: properly protect SSL cert generation * BUG/MEDIUM: pollers: Use a global list for fd shared between threads. * BUG/MEDIUM: http: don't always abort transfers on CF_SHUTR * BUG/MINOR: lua: ensure large proxy IDs can be represented * BUG/MINOR: lua: schedule socket task upon lua connect() * BUG/MEDIUM: task: Don't free a task that is about to be run. * BUG/MINOR: map: correctly track reference to the last ref_elt being dumped * DOC/MINOR: clean up LUA documentation re: servers & array/table. * BUG/MINOR: lua: Put tasks to sleep when waiting for data * BUG/MEDIUM: threads: Fix the sync point for more than 32 threads * BUG/MINOR: checks: Fix check->health computation for flapping servers * BUG/MINOR: config: disable http-reuse on TCP proxies * BUG/MINOR: lua/threads: Make lua's tasks sticky to the current thread * BUG/MEDIUM: h2: implement missing support for chunked encoded uploads * MINOR: h2: detect presence of CONNECT and/or content-length * BUG/MEDIUM: lua: Fix segmentation fault if a Lua task exits * BUG/MINOR: log: t_idle (%Ti) is not set for some requests * BUG/MAJOR: channel: Fix crash when trying to read from a closed socket * BUG/MINOR: pattern: Add a missing HA_SPIN_INIT() in pat_ref_newid()- Update to version 1.8.8: * BUG/CRITICAL: h2: fix incorrect frame length check (VUL-0) (bsc#1089837) * MINOR: cli: Ensure the CLI always outputs an error when it should * BUG/MINOR: cli: Guard against NULL messages when using CLI_ST_PRINT_FREE * BUG/MEDIUM: kqueue: When adding new events, provide an output to get errors. * BUG/MINOR: http: Return an error in proxy mode when url2sa fails * BUG/MEDIUM: connection: Make sure we have a mux before calling detach(). * BUG/MEDIUM: threads: Fix the max/min calculation because of name clashes- Update to version 1.8.7: * [RELEASE] Released version 1.8.7 * MINOR: servers: Support alphanumeric characters for the server templates names * BUG/MAJOR: cache: always initialize newly created objects * [RELEASE] Released version 1.8.6 * BUG/MINOR: spoe: Don't release the context buffer in .check_timeouts callbaclk * BUG/MINOR: spoe: Initialize variables used during conf parsing before any check * BUG/MAJOR: cache: fix random crashes caused by incorrect delete() on non-first blocks * BUG/MINOR: fd: Don't clear the update_mask in fd_insert. * BUG/MINOR: cache: fix "show cache" output * BUG/MINOR: email-alert: Set the mailer port during alert initialization * BUG/MINOR: checks: check the conn_stream's readiness and not the connection * BUG/MEDIUM: h2: always add a stream to the send or fctl list when blocked * BUILD/MINOR: threads: always export thread_sync_io_handler() * BUG/MEDIUM: h2: don't consider pending data on detach if connection is in error * BUG/MEDIUM: h2/threads: never release the task outside of the task handler * MINOR: h2: fuse h2s_detach() and h2s_free() into h2s_destroy() * MINOR: h2: always call h2s_detach() in h2_detach() * BUG/MAJOR: h2: remove orphaned streams from the send list before closing * MINOR: h2: provide and use h2s_detach() and h2s_free() * CLEANUP: h2: rename misleading h2c_stream_close() to h2s_close() * BUG/MINOR: hpack: fix harmless use of uninitialized value in hpack_dht_insert * BUILD/MINOR: cli: fix a build warning introduced by last commit * MINOR: cli: make "show fd" report the mux and mux_ctx pointers when available * MINOR: cli/threads: make "show fd" report thread_sync_io_handler instead of "unknown" * BUILD/MINOR: fix build when USE_THREAD is not defined * BUG/MINOR: lua funtion hlua_socket_settimeout don't check negative values * BUG/MINOR: lua: the function returns anything- Update to version 1.8.5: * BUG/MINOR: listener: Don't decrease actconn twice when a new session is rejected * BUG/MINOR: h2: ensure we can never send an RST_STREAM in response to an RST_STREAM * BUG/MEDIUM: h2: properly account for DATA padding in flow control * DOC: don't suggest using http-server-close * DOC: log: more than 2 log servers are allowed * BUILD/BUG: enable -fno-strict-overflow by default * MINOR: log: stop emitting alerts when it's not possible to write on the socket * BUG/MEDIUM: threads/queue: wake up other threads upon dequeue * BUG/MINOR: tcp-check: use the server's service port as a fallback * BUG/MEDIUM: tcp-check: single connect rule can't detect DOWN servers * BUG/MINOR: lua: return bad error messages * BUG/MINOR: spoa-example: unexpected behavior for more than 127 args * BUG/MINOR: cli: Fix a crash when sending a command with too many arguments * BUG/MINOR: seemless reload: Fix crash when an interface is specified. * BUG/MINOR: dns: don't downgrade DNS accepted payload size automatically * BUG/MAJOR: threads/queue: Fix thread-safety issues on the queues management * BUG/MEDIUM: threads/unix: Fix a deadlock when a listener is temporarily disabled * BUG/MEDIUM: spoe: Remove idle applets from idle list when HAProxy is stopping * BUG/MINOR: force-persist and ignore-persist only apply to backends * BUG/MEDIUM: fix a 100% cpu usage with cpu-map and nbthread/nbproc * BUG/MINOR: cli: Fix a typo in the 'set rate-limit' usage * BUG/MINOR: cli: Fix a crash when passing a negative or too large value to "show fd" * BUG/MEDIUM: h2: also arm the h2 timeout when sending * BUG/MINOR: unix: Don't mess up when removing the socket from the xfer_sock_list. * BUG/MINOR: session: Fix tcp-request session failure if handshake. * MINOR: systemd: Add SystemD's SystemCallFilter option to the unit file * MINOR: systemd: Add SystemD's Protect*= options to the unit file * MINOR: systemd: Add section for SystemD sandboxing to unit file * BUG/MEDIUM: buffer: Fix the wrapping case in bi_putblk * BUG/MEDIUM: buffer: Fix the wrapping case in bo_putblk * BUG/MEDIUM: h2: always consume any trailing data after end of output buffers * MINOR: stats: display the number of threads in the statistics. * BUG/MINOR: h2: Set the target of dbuf_wait to h2c * MINOR: debug/pools: make DEBUG_UAF also detect underflows * BUG/MINOR: debug/pools: properly handle out-of-memory when building with DEBUG_UAF * DOC: cfgparse: Warn on option (tcp|http)log in backend * DOC: lua: new prototype for function "register_action()" * BUG/MEDIUM: ssl/sample: ssl_bc_* fetch keywords are broken. * BUG/MEDIUM: http: Switch the HTTP response in tunnel mode as earlier as possible * BUG/MINOR: ssl/threads: Make management of the TLS ticket keys files thread-safe * BUG/MINOR: init: Add missing brackets in the code parsing -sf/-st * BUG/MEDIUM: ssl: Shutdown the connection for reading on SSL_ERROR_SYSCALL * BUG/MEDIUM: ssl: Don't always treat SSL_ERROR_SYSCALL as unrecovarable. * BUG/MINOR: threads: fix missing thread lock labels for 1.8- if we lock down the permissions the home directory has to be owned by haproxy (bsc#1077716)- Avoid %__-type macro indirections. Remove redundant %clean section. Do not ignore errors from useradd.- Ensure haproxy home directory is not world readable (bsc#1077716)- Update to version 1.8.4 (bsc#1080069): * BUG/MINOR: config: don't emit a warning when global stats is incompletely configured * DOC: Mention -Ws in the list of available options * DOC: Describe routing impact of using interface keyword on bind lines * MINOR: init: emit warning when -sf/-sd cannot parse argument * BUG/MEDIUM: standard: Fix memory leak in str2ip2() * BUG/MINOR: time/threads: ensure the adjusted time is always correct * BUG/MEDIUM: spoe: Allow producer to read and to forward shutdown on request side * BUG/MEDIUM: spoe: Always try to receive or send the frame to detect shutdowns * BUG/MINOR: epoll/threads: only call epoll_ctl(DEL) on polled FDs * BUG/MINOR: threads: Update labels array because of changes in lock_label enum * BUG/MINOR: cli: use global.maxsock and not maxfd to list all FDs * CLEANUP: Fix typo in ARGT_MSK6 comment * BUG/MINOR: sample: Fix output type of c_ipv62ip * CLEANUP: sample: Fix outdated comment about sample casts functions * CLEANUP: sample: Fix comment encoding of sample.c * BUILD: kqueue/threads: Add test on MAX_THREADS to avoid warnings when complied without threads * BUILD: epoll/threads: Add test on MAX_THREADS to avoid warnings when complied without threads * MINOR: threads: Use __decl_hathreads instead of #ifdef/#endif * BUG/MINOR: kqueue/threads: Don't forget to close kqueue_fd[tid] on each thread * BUG/MEDIUM: checks: Don't try to release undefined conn_stream when a check is freed * BUG/MEDIUM: threads/server: Fix deadlock in srv_set_stopping/srv_set_admin_flag * BUG/MINOR: threads: always set an owner to the thread_sync pipe * MINOR: threads: Fix build when we're not compiling with threads. * BUG/MINOR: mworker: only write to pidfile if it exists * BUG/MEDIUM: threads/mworker: fix a race on startup * BUG/MEDIUM: kqueue/threads: use one kqueue_fd per thread * BUG/MEDIUM: epoll/threads: use one epoll_fd per thread * MINOR: fd: add a bitmask to indicate that an FD is known by the poller * BUG/MEDIUM: fd: maintain a per-thread update mask * BUG/MEDIUM: threads/polling: Use fd_cache_mask instead of fd_cache_num * MINOR: threads/fd: Use a bitfield to know if there are FDs for a thread in the FD cache * MINOR: global: add some global activity counters to help debugging * MINOR: threads: add a MAX_THREADS define instead of LONGBITS * MINOR: global/threads: move cpu_map at the end of the global struct * MINOR: servers: Don't report duplicate dyncookies for disabled servers. * BUG/MEDIUM: peers: fix expire date wasn't updated if entry is modified remotely. * BUG/MINOR: poll: too large size allocation for FD events * CONTRIB: debug: fix a few flags definitions * DOC: clarify the scope of ssl_fc_is_resumed * BUG/MEDIUM: stream: properly handle client aborts during redispatch * BUILD/MINOR: ancient gcc versions atomic fix * BUG/MEDIUM: mworker: execvp failure depending on argv[0] * MINOR: dns: Handle SRV record weight correctly. * BUG/MINOR: lua: Fix return value of Socket.settimeout * BUG/MEDIUM: lua: Fix IPv6 with separate port support for Socket.connect * DOC: lua: Fix typos in comments of hlua_socket_receive * BUG/MINOR: lua: Fix default value for pattern in Socket.receive * BUG/MEDIUM: ssl: cache doesn't release shctx blocks * BUG/MEDIUM: h2: properly handle the END_STREAM flag on empty DATA frames- Add dependency on apparmor-profiles (bsc#1079985)- Update to version 1.8.3: * [RELEASE] Released version 1.8.3 * MEDIUM: h2: prepare a graceful shutdown when the frontend is stopped * BUG/MAJOR: hpack: don't return direct references to the dynamic headers table * BUG/MEDIUM: http: don't automatically forward request close * MINOR: don't close stdio anymore * BUG/MEDIUM: mworker: don't close stdio several time * BUG/MEDIUM: h2: ensure we always know the stream before sending a reset * DOC/MINOR: configuration: typo, formatting fixes * BUG/MEDIUM: h2: improve handling of frames received on closed streams * BUG/MEDIUM: h2: properly handle and report some stream errors- Update to version 1.8.2: * [RELEASE] Released version 1.8.2 * BUG/MEDIUM: checks: properly set servers to stopping state on 404 * BUG/MAJOR: connection: refine the situations where we don't send shutw() * BUG/MEDIUM: cache: don't cache the response on no-cache="set-cookie" * BUG/MEDIUM: cache: respect the request cache-control header * BUG/MEDIUM: cache: replace old object on store * BUG/MEDIUM: cache: do not try to retrieve host-less requests from the cache * MINOR: http: add a function to check request's cache-control header field * BUG/MINOR: cache: do not force the TX_CACHEABLE flag before checking cacheability * BUG/MINOR: http: properly detect max-age=0 and s-maxage=0 in responses * BUG/MINOR: http: do not ignore cache-control: public * MINOR: http: start to compute the transaction's cacheability from the request * MINOR: http: update the list of cacheable status codes as per RFC7231 * MINOR: http: adjust the list of supposedly cacheable methods * BUG/MEDIUM: lua: fix crash when using bogus mode in register_service() * BUG/MEDIUM: checks: a server passed in maint state was not forced down. * MEDIUM: netscaler: add support for standard NetScaler CIP protocol * MEDIUM: netscaler: do not analyze original IP packet size * MINOR: netscaler: check in one-shot if buffer is large enough for IP and TCP header * BUG/MEDIUM: stream: don't consider abortonclose on muxes which close cleanly * MINOR: stream-int: set flag SI_FL_CLEAN_ABRT when mux supports clean aborts * MINOR: mux: add flags to describe a mux's capabilities * BUG/MINOR: h2: properly report a stream error on RST_STREAM * CONTRIB: halog: Fix compiler warnings in halog.c * CONTRIB: iprange: Fix compiler warning in iprange.c * BUG/MAJOR: netscaler: address truncated CIP header detection * BUG/MEDIUM: netscaler: use the appropriate IPv6 header size * MINOR: netscaler: rename cip_len to clarify its uage * MINOR: netscaler: remove the use of cip_magic only used once * MINOR: netscaler: respect syntax * DOC/MINOR: intro: typo, wording, formatting fixes * BUG/MEDIUM: mworker: Set FD_CLOEXEC flag on log fd * BUILD/MINOR: Makefile : enabling USE_CPU_AFFINITY * BUG: MINOR: http: don't check http-request capture id when len is provided * BUG: MAJOR: lb_map: server map calculation broken * BUG/MINOR: stream-int: don't try to receive again after receiving an EOS * BUG/MEDIUM: h2: fix stream limit enforcement * BUG/MEDIUM: http: don't disable lingering on requests with tunnelled responses * BUG/MEDIUM: h2: don't close after the first DATA frame on tunnelled responses * BUG/MEDIUM: h2: don't switch the state to HREM before end of DATA frame * MINOR: h2: don't demand that a DATA frame is complete before processing it * BUG/MEDIUM: h2: support uploading partial DATA frames * MINOR: h2: store the demux padding length in the h2c struct * BUG/MEDIUM: h2: debug incoming traffic in h2_wake() * BUG/MEDIUM: h2: work around a connection API limitation * BUG/MEDIUM: h2: enable recv polling whenever demuxing is possible * BUG/MEDIUM: h2: automatically set CS_FL_RCV_MORE when the output buffer is full * BUG/MEDIUM: stream-int: always set SI_FL_WAIT_ROOM on CS_FL_RCV_MORE * MINOR: conn_stream: add new flag CS_FL_RCV_MORE to indicate pending data * BUG/MEDIUM: lua/notification: memory leak * DOC: notifications: add precisions about thread usage * MINOR: systemd: remove comment about HAPROXY_STATS_SOCKET * BUG/MEDIUM: threads/vars: Fix deadlock in register_name * BUG/MEDIUM: email-alert: don't set server check status from a email-alert task * CONTRIB: halog: Add help text for -s switch in halog program * MINOR: mworker: Improve wording in `void mworker_wait()` * MINOR: mworker: Update messages referencing exit-on-failure * BUG/MEDIUM: h2: fix handling of end of stream again * BUG/MEDIUM: peers: set NOLINGER on the outgoing stream interface * BUG/MEDIUM: checks: a down server going to maint remains definitely stucked on down state. * BUG/MEDIUM: ssl engines: Fix async engines fds were not considered to fix fd limit automatically. * BUG/MEDIUM: mworker: also close peers sockets in the master * BUG/MINOR: ssl: support tune.ssl.cachesize 0 again * BUG/MAJOR: hpack: don't pretend large headers fit in empty table * BUG/MINOR: action: Don't check http capture rules when no id is defined- Update to version 1.8.1 (bsc#1069954): * BUG/MAJOR: h2: correctly check the request length when building an H1 request * BUG/MAJOR: thread: Be sure to request a sync between threads only once at a time * BUG/MAJOR: thread/peers: fix deadlock on peers sync. * BUG/MEDIUM: h2: do not accept upper case letters in request header names * BUG/MEDIUM: h2: remove connection-specific headers from request * BUG/MEDIUM: h2: enforce the per-connection stream limit * BUG/MEDIUM: checks: Be sure we have a mux if we created a cs. * BUG/MEDIUM: peers: fix some track counter rules dont register entries for sync. * BUG/MEDIUM: h2: don't report an error after parsing a 100-continue response * BUG/MEDIUM: threads/peers: decrement, not increment jobs on quitting * BUG/MEDIUM: stream: fix session leak on applet-initiated connections * BUG/MEDIUM: cache: bad computation of the remaining size * BUG/MEDIUM: ssl: don't allocate shctx several time * BUG/MEDIUM: tcp-check: Don't lock the server in tcpcheck_main * BUG/MEDIUM: kqueue: Don't bother closing the kqueue after fork. * BUG/MINOR: h2: use the H2_F_DATA_* macros for DATA frames * BUG/MINOR: h2: reject response pseudo-headers from requests * BUG/MINOR: h2: properly check PRIORITY frames * BUG/MINOR: h2: reject incorrect stream dependencies on HEADERS frame * BUG/MINOR: h2: do not accept SETTINGS_ENABLE_PUSH other than 0 or 1 * BUG/MINOR: h2: the TE header if present may only contain trailers * BUG/MINOR: h2: fix a typo causing PING/ACK to be responded to * BUG/MINOR: h2: ":path" must not be empty * BUG/MINOR: h2: try to abort closed streams as soon as possible * BUG/MINOR: h2: immediately close if receiving GOAWAY after the last stream * BUG/MINOR: hpack: dynamic table size updates are only allowed before headers * BUG/MINOR: hpack: reject invalid header index * BUG/MINOR: hpack: must reject huffman literals padded with more than 7 bits * BUG/MINOR: hpack: fix debugging output of pseudo header names * BUG/MINOR: mworker: detach from tty when in daemon mode * BUG/MINOR: mworker: fix validity check for the pipe FDs * BUG/MINOR: ssl: CO_FL_EARLY_DATA removal is managed by stream- License is now GPL-3.0+ and LGPL-2.1+- [apparmor]: allow haproxy to restart itself. needed for seamless restart. also reload the apparmor profile on update.- enable network namespaces on 42.3 - Enabled systemd notify mode: new BR: pkgconfig(libsystemd) This fixes problems with starting 1.8 on 42.3. - apply build option changes as adviced by upstream- Update to version 1.8.0 (bsc#1069954): https://www.mail-archive.com/haproxy@formilux.org/msg28004.html- Update to version 1.7.9: * BUG/MINOR: peers: peer synchronization issue (with several peers sections). * BUG/MINOR: lua: In error case, the safe mode is not removed * BUG/MINOR: lua: executes the function destroying the Lua session in safe mode * BUG/MAJOR: lua/socket: resources not detroyed when the socket is aborted * BUG/MEDIUM: lua: bad memory access * DOC: update the list of OpenSSL versions in the README * DOC: Updated 51Degrees git URL to point to a stable version. * BUG/MINOR: http: Set the response error state in http_sync_res_state * MINOR: http: Reorder/rewrite checks in http_resync_states * MINOR: http: Switch requests/responses in TUNNEL mode only by checking txn flags * BUG/MEDIUM: http: Switch HTTP responses in TUNNEL mode when body length is undefined * BUG/MAJOR: http: Fix possible infinity loop in http_sync_(req|res)_state * BUG/MINOR: lua: Fix Server.get_addr() port values * BUG/MINOR: lua: Correctly use INET6_ADDRSTRLEN in Server.get_addr() * BUG/MINOR: lua: always detach the tcp/http tasks before freeing them * BUG/MINOR: lua: Fix bitwise logic for hlua_server_check_* functions.- Update to version 1.7.8: * BUG/MINOR: stream: flag TASK_WOKEN_RES not set if task in runqueue * BUG/MAJOR: cli: fix custom io_release was crushed by NULL. * BUG/MAJOR: map: fix segfault during 'show map/acl' on cli. * BUG/MAJOR: compression: Be sure to release the compression state in all cases * DOC: fix references to the section about time format. * BUG/MEDIUM: map/acl: fix unwanted flags inheritance. * BUG/MINOR: stream: Don't forget to remove CF_WAKE_ONCE flag on response channel * BUG/MINOR: http: Don't reset the transaction if there are still data to send * BUG/MEDIUM: filters: Be sure to call flt_end_analyze for both channels * BUG/MINOR: http: properly handle all 1xx informational responses- Update to version 1.7.7: * BUG/MINOR: Wrong peer task expiration handling during synchronization processing. * BUG/MEDIUM: http: Drop the connection establishment when a redirect is performed * BUG/MEDIUM: cfgparse: Check if tune.http.maxhdr is in the range 1..32767 * DOC: fix references to the section about the unix socket * BUG/MINOR: log: pin the front connection when front ip/ports are logged- Update to version 1.7.6: * DOC: changed "block"(deprecated) examples to http-request deny * DOC: add few comments to examples. * DOC: update sample code for PROXY protocol * DOC: mention lighttpd 1.4.46 implements PROXY * DOC: stick-table is available in frontend sections * BUG/MINOR: dns: Wrong address family used when creating IPv6 sockets. * BUG/MINOR: config: missing goto out after parsing an incorrect ACL character * BUG/MINOR: arg: don't try to add an argument on failed memory allocation * BUG/MEDIUM: arg: ensure that we properly unlink unresolved arguments on error * BUG/MEDIUM: acl: don't free unresolved args in prune_acl_expr() * MINOR: lua: ensure the memory allocator is used all the time * CLEANUP: logs: typo: simgle => single * BUG/MEDIUM: acl: proprely release unused args in prune_acl_expr() * BUG/MAJOR: Use -fwrapv. * BUG/MINOR: server: don't use "proxy" when px is really meant. * BUG/MINOR: server: missing default server 'resolvers' setting duplication. * DOC: add layer 4 links/cross reference to "block" keyword. * DOC: errloc/errorloc302/errorloc303 missing status codes. * BUG/MEDIUM: lua: memory leak * MEDIUM: config: don't check config validity when there are fatal errors * BUG/MINOR: hash-balance-factor isn't effective in certain circumstances * MINOR/DOC: lua: just precise one thing * BUG/MINOR: http: Fix conditions to clean up a txn and to handle the next request * DOC: update RFC references * BUG/MINOR: checks: don't send proxy protocol with agent checks * BUG/MEDIUM: lua: segfault if a converter or a sample doesn't return anything * BUG/MAJOR: http: call manage_client_side_cookies() before erasing the buffer * BUG/MINOR: buffers: Fix bi/bo_contig_space to handle full buffers * BUG/MINOR: acls: Set the right refflag when patterns are loaded from a map * BUG/MINOR: http/filters: Be sure to wait if a filter loops in HTTP_MSG_ENDING * BUG/MEDIUM: peers: Peers CLOSE_WAIT issue. * BUG/MAJOR: server: Segfault after parsing server state file. * BUG/MEDIUM: unix: never unlink a unix socket from the file system- Update to version 1.7.5: * BUG/MEDIUM: peers: fix buffer overflow control in intdecode. * BUG/MEDIUM: buffers: Fix how input/output data are injected into buffers * BUG/MEDIUM: http: Fix blocked HTTP/1.0 responses when compression is enabled * BUG/MINOR: filters: Don't force the stream's wakeup when we wait in flt_end_analyze * MINOR: config parsing: add warning when log-format/tcplog/httplog is overriden in "defaults" sections- Update to version 1.7.4: * MINOR: config: warn when some HTTP rules are used in a TCP proxy * BUG/MINOR: spoe: Fix soft stop handler using a specific id for spoe filters * BUG/MINOR: spoe: Fix parsing of arguments in spoe-message section * BUG/MEDIUM: ssl: Clear OpenSSL error stack after trying to parse OCSP file * BUG/MEDIUM: cli: Prevent double free in CLI ACL lookup * BUG/MINOR: Fix "get map " CLI command * BUG/MAJOR: connection: update CO_FL_CONNECTED before calling the data layer * BUG/MEDIUM: ssl: switchctx should not return SSL_TLSEXT_ERR_ALERT_WARNING * BUG/MINOR: checks: attempt clean shutw for SSL check * BUG/MEDIUM: listener: do not try to rebind another process' socket * BUG/MEDIUM: filters: Fix channels synchronization in flt_end_analyze * BUG/MAJOR: stream-int: do not depend on connection flags to detect connection * BUG/MEDIUM: connection: ensure to always report the end of handshakes * BUG: payload: fix payload not retrieving arbitrary lengths * BUG/MAJOR: http: fix typo in http_apply_redirect_rule * BUG/MEDIUM: stream: fix client-fin/server-fin handling * MINOR: fd: add a new flag HAP_POLL_F_RDHUP to struct poller * BUG/MINOR: raw_sock: always perfom the last recv if RDHUP is not available * DOC/MINOR: Fix typos in proxy protocol doc * DOC: Protocol doc: add checksum, TLV type ranges * DOC: Protocol doc: add SSL TLVs, rename CHECKSUM * DOC: Protocol doc: add noop TLV * MEDIUM: global: add a 'hard-stop-after' option to cap the soft-stop time * BUG/MINOR: cfgparse: loop in tracked servers lists not detected by check_config_validity(). * MINOR: server: irrelevant error message with 'default-server' config file keyword. * MINOR: doc: fix use-server example (imap vs mail) * BUG/MEDIUM: tcp: don't require privileges to bind to device- Update to version 1.7.3: * BUG/MINOR: stream: Fix how backend-specific analyzers are set on a stream * BUG/MEDIUM: tcp: don't poll for write when connect() succeeds * BUG/MINOR: unix: fix connect's polling in case no data are scheduled * BUG/MINOR: lua: Map.end are not reliable because "end" is a reserved keyword * MINOR: dns: give ability to dns_init_resolvers() to close a socket when requested * BUG/MAJOR: dns: restart sockets after fork() * MINOR: chunks: implement a simple dynamic allocator for trash buffers * BUG/MEDIUM: http: prevent redirect from overwriting a buffer * BUG/MEDIUM: filters: Do not truncate HTTP response when body length is undefined * BUG/MEDIUM: http: Prevent replace-header from overwriting a buffer * BUG/MINOR: http: Return an error when a replace-header rule failed on the response * BUG/MINOR: sendmail: The return of vsnprintf is not cleanly tested * BUG/MAJOR: lua segmentation fault when the request is like 'GET ?arg=val HTTP/1.1' * BUG/MEDIUM: config: reject anything but "if" or "unless" after a use-backend rule * MINOR: http: don't close when redirect location doesn't start with "/"- Update to version 1.7.2 (bsc#1023141): * BUG/MEDIUM: lua: In some case, the return of sample-fetches is ignored (2) * BUG/MINOR: stream-int: automatically release SI_FL_WAIT_DATA on SHUTW_NOW * DOC: lua: documentation about time parser functions * DOC: lua: section declared twice * BUG/MINOR: lua/cli: bad error message * DOC: fix small typo in fe_id (backend instead of frontend) * BUG/MINOR: Fix the sending function in Lua's cosocket * BUG/MINOR: lua: memory leak executing tasks * BUG/MINOR: lua: bad return code * BUG/MEDIUM: ssl: properly reset the reused_sess during a forced handshake * BUG/MEDIUM: ssl: avoid double free when releasing bind_confs * BUG/MINOR: stats: fix be/sessions/current out in typed stats * BUG/MINOR: backend: nbsrv() should return 0 if backend is disabled * BUG/MEDIUM: ssl: for a handshake when server-side SNI changes * BUG/MINOR: systemd: potential zombie processes * DOC: Add timings events schemas * BUG/MINOR: option prefer-last-server must be ignored in some case * MINOR: stats: Support "select all" for backend actions * BUG/MINOR: sample-fetches/stick-tables: bad type for the sample fetches sc*_get_gpt0 * BUG/MAJOR: channel: Fix the definition order of channel analyzers * BUG/MINOR: http: report real parser state in error captures * BUG/MAJOR: http: fix risk of getting invalid reports of bad requests * MINOR: http: custom status reason. * MINOR: connection: add sample fetch "fc_rcvd_proxy" * BUG/MINOR: config: emit a warning if http-reuse is enabled with incompatible options * BUG/MINOR: tools: fix off-by-one in port size check * BUG/MEDIUM: server: consider AF_UNSPEC as a valid address family * MEDIUM: server: split the address and the port into two different fields * MINOR: tools: make str2sa_range() return the port in a separate argument * MINOR: server: take the destination port from the port field, not the addr * MEDIUM: server: disable protocol validations when the server doesn't resolve * BUG/MEDIUM: tools: do not force an unresolved address to AF_INET:0.0.0.0 * BUG/MINOR: ssl: EVP_PKEY must be freed after X509_get_pubkey usage * MINOR: proto_http.c 502 error txt typo. * DOC: add deprecation notice to "block" * BUG/MINOR: Reset errno variable before calling strtol(3)- Update to version 1.7.1: * BUG/MAJOR: stream: fix session abort on resource shortage * BUG/MINOR: cli: allow the backslash to be escaped on the CLI * BUG/MEDIUM: cli: fix "show stat resolvers" and "show tls-keys" * DOC: Fix map table's format * DOC: Added 51Degrees conv and fetch functions to documentation. * BUG/MINOR: http: don't send an extra CRLF after a Set-Cookie in a redirect * DOC: mention that req_tot is for both frontends and backends * BUG/MEDIUM: variables: some variable name can hide another ones * BUG/MINOR: stats: fix be/sessions/max output in html stats * MINOR: proxy: Add fe_name/be_name fetchers next to existing fe_id/be_id * DOC: lua: Documentation about some entry missing * MINOR: Do not forward the header "Expect: 100-continue" when the option http-buffer-request is set * DOC: Add undocumented argument of the trace filter * DOC: Fix some typo in SPOE documentation * BUG/MINOR: cli: be sure to always warn the cli applet when input buffer is full * MINOR: applet: Count number of (active) applets * MINOR: task: Rename run_queue and run_queue_cur counters * BUG/MEDIUM: stream: Save unprocessed events for a stream * BUG/MAJOR: Fix how the list of entities waiting for a buffer is handled * BUILD/MEDIUM: Fixing the build using LibreSSL * [RELEASE] Released version 1.7.1- Update to version 1.7.0: * BUG/MEDIUM: proxy: return "none" and "unknown" for unknown LB algos * BUG/MINOR: stats: make field_str() return an empty string on NULL * BUG/MEDIUM: http: Fix tunnel mode when the CONNECT method is used * BUG/MINOR: http: Keep the same behavior between 1.6 and 1.7 for tunneled txn * BUG/MINOR: filters: Protect args in macros HAS_DATA_FILTERS and IS_DATA_FILTER * BUG/MINOR: filters: Invert evaluation order of HTTP_XFER_BODY and XFER_DATA analyzers * BUG/MINOR: http: Call XFER_DATA analyzer when HTTP txn is switched in tunnel mode- Update to version 1.6.10: * BUG/MEDIUM: systemd-wrapper: return correct exit codes * BUG/MEDIUM: srv-state: properly restore the DRAIN state * BUG/MINOR: srv-state: allow to have both CMAINT and FDRAIN flags * BUG/MEDIUM: servers: properly propagate the maintenance states during startup * BUG: vars: Fix 'set-var' converter because of a typo * BUG/MEDIUM: channel: bad unlikely macro * CLEANUP: lua: move comment * CLEANUP: lua: control executed twice * CLEANUP: ssl: Fix bind keywords name in comments * DOC: ssl: Use correct wording for ca-sign-pass * BUG/MINOR: stick-table: handle out-of-memory condition gracefully * BUG/MEDIUM: connection: check the control layer before stopping polling * BUG/MEDIUM: stick-table: fix regression caused by recent fix for out-of-memory * CONTRIB: initiate a debugging suite to make debugging easier * BUG/MINOR: cli: properly decrement ref count on tables during failed dumps * BUG/MEDIUM: lua: In some case, the return of sample-fetche is ignored- Update to version 1.6.9+git.1477940904.ab45181 (fate#321723) * BUILD: poll: remove unused hap_fd_isset() which causes a warning with clang * MINOR: cfgparse: few memory leaks fixes. * MINOR: build: Allow linking to device-atlas library file * DOC: Fix typo in description of `-st` parameter in man page * BUG/MEDIUM: peers: on shutdown, wake up the appctx, not the stream * BUG/MEDIUM: peers: fix use after free in peer_session_create() * BUG/MEDIUM: systemd: let the wrapper know that haproxy has completed or failed * MINOR: systemd: report it when execve() fails * BUG/MINOR: systemd: check return value of calloc() * BUG/MINOR: systemd: always restore signals before execve() * BUG/MINOR: systemd: make the wrapper return a non-null status code on error * BUG/MINOR: ssl: prevent multiple entries for the same certificate * BUG/MINOR: ssl: Check malloc return code * BUG/MINOR: vars: smp_fetch_var() doesn't depend on HTTP but on the session * BUG/MINOR: vars: make smp_fetch_var() more robust against misuses * BUG/MINOR: vars: use sess and not s->sess in action_store() * MEDIUM: make SO_REUSEPORT configurable * MINOR: Add fe_req_rate sample fetch * MINOR: show Running on zlib version * MINOR: show Built with PCRE version * BUG/MINOR: displayed PCRE version is running release- Update to 1.6.9 (bsc#1003264) - MINOR: cli: allow the semi-colon to be escaped on the CLI - BUG/MINOR: payload: fix SSLv2 version parser - BUG/MAJOR: stream: properly mark the server address as unset on connect retry - DOC: Updated 51Degrees readme. - BUG/MAJOR: stick-counters: possible crash when using sc_trackers with wrong table - BUG/MINOR: peers: empty chunks after a resync. - BUG/MINOR: peers: some updates are pushed twice after a resync. - MINOR: sample: use smp_make_rw() in upper/lower converters - BUG/MEDIUM: stick-table: properly convert binary samples to keys - BUG/MEDIUM: stick-tables: do not fail on string keys with no allocated size - BUG/MAJOR: server: the "sni" directive could randomly cause trouble - MINOR: sample: provide smp_is_rw() and smp_make_rw() - MINOR: sample: implement smp_is_safe() and smp_make_safe() - BUG/MEDIUM: samples: make smp_dup() always duplicate the sample - BUG/MAJOR: compression: initialize avail_in/next_in even during flush - BUILD: make proto_tcp.c compatible with musl library - DOC: minor typo fixes to improve HTML parsing by haproxy-dconv - BUG/MEDIUM: stream-int: completely detach connection on connect error - BUG/MEDIUM: lua: somme HTTP manipulation functions are called without valid requests - DOC: lua: remove old functions - BUG/MINOR: peers: Fix peers data decoding issue - BUG/MEDIUM: lua: the function txn_done() from action wrapper can crash - BUG/MEDIUM: lua: the function txn_done() from sample fetches can crash- update to 1.6.7 - MINOR: new function my_realloc2 = realloc + free upon failure - CLEANUP: fixed some usages of realloc leading to memory leak - Revert "BUG/MINOR: ssl: fix potential memory leak in ssl_sock_load_dh_params()" - BUG/MEDIUM: dns: fix alignment issues in the DNS response parser - BUG/MINOR: Fix endiness issue in DNS header creation code - changes from 1.6.6 - BUG/MAJOR: fix listening IP address storage for frontends - BUG/MINOR: fix listening IP address storage for frontends (cont) - DOC: Fix typo so fetch is properly parsed by Cyril's converter - BUG/MAJOR: http: fix breakage of "reqdeny" causing random crashes - BUG/MEDIUM: stick-tables: fix breakage in table converters - BUG/MEDIUM: dns: unbreak DNS resolver after header fix - BUILD: fix build on Solaris 11 - CLEANUP: connection: fix double negation on memcmp() - BUG/MEDIUM: stats: show servers state may show an servers from another backend - BUG/MEDIUM: fix risk of segfault with "show tls-keys" - BUG/MEDIUM: sticktables: segfault in some configuration error cases - BUG/MEDIUM: lua: converters doesn't work - BUG/MINOR: http: add-header: header name copied twice - BUG/MEDIUM: http: add-header: buffer overwritten - BUG/MINOR: ssl: fix potential memory leak in ssl_sock_load_dh_params() - BUG/MINOR: http: url32+src should use the big endian version of url32 - BUG/MINOR: http: url32+src should check cli_conn before using it - DOC: http: add documentation for url32 and url32+src - BUG/MINOR: fix http-response set-log-level parsing error - MINOR: systemd: Use variable for config and pidfile paths - MINOR: systemd: Perform sanity check on config before reload (cherry picked from commit 68535bddf305fdd22f1449a039939b57245212e7) - BUG/MINOR: init: always ensure that global.rlimit_nofile matches actual limits - BUG/MINOR: init: ensure that FD limit is raised to the max allowed - BUG/MEDIUM: external-checks: close all FDs right after the fork() - BUG/MAJOR: external-checks: use asynchronous signal delivery - BUG/MINOR: external-checks: do not unblock undesired signals - BUILD/MEDIUM: rebuild everything when an include file is changed - BUILD/MEDIUM: force a full rebuild if some build options change - BUG/MINOR: srv-state: fix incorrect output of state file - BUG/MINOR: ssl: close ssl key file on error - BUG/MINOR: http: fix misleading error message for response captures - BUG/BUILD: don't automatically run "make" on "make install" - DOC: add missing doc for http-request deny [deny_status ] - drop patches which were pulled from git before 0001-BUG-MAJOR-fix-listening-IP-address-storage-for-front.patch 0002-BUG-MINOR-fix-listening-IP-address-storage-for-front.patch 0003-DOC-Fix-typo-so-fetch-is-properly-parsed-by-Cyril-s-.patch 0004-BUG-MAJOR-http-fix-breakage-of-reqdeny-causing-rando.patch 0005-BUG-MEDIUM-stick-tables-fix-breakage-in-table-conver.patch 0006-BUG-MEDIUM-dns-unbreak-DNS-resolver-after-header-fix.patch 0007-BUILD-fix-build-on-Solaris-11.patch 0008-CLEANUP-connection-fix-double-negation-on-memcmp.patch 0009-BUG-MEDIUM-stats-show-servers-state-may-show-an-serv.patch 0010-BUG-MEDIUM-fix-risk-of-segfault-with-show-tls-keys.patch 0011-BUG-MEDIUM-sticktables-segfault-in-some-configuratio.patch 0012-BUG-MEDIUM-lua-converters-doesn-t-work.patch 0013-BUG-MINOR-http-add-header-header-name-copied-twice.patch 0014-BUG-MEDIUM-http-add-header-buffer-overwritten.patch- pull patches from git to fix some important issues (bsc#983972) (bsc#983974): 0001-BUG-MAJOR-fix-listening-IP-address-storage-for-front.patch 0002-BUG-MINOR-fix-listening-IP-address-storage-for-front.patch 0003-DOC-Fix-typo-so-fetch-is-properly-parsed-by-Cyril-s-.patch 0004-BUG-MAJOR-http-fix-breakage-of-reqdeny-causing-rando.patch 0005-BUG-MEDIUM-stick-tables-fix-breakage-in-table-conver.patch 0006-BUG-MEDIUM-dns-unbreak-DNS-resolver-after-header-fix.patch 0007-BUILD-fix-build-on-Solaris-11.patch 0008-CLEANUP-connection-fix-double-negation-on-memcmp.patch 0009-BUG-MEDIUM-stats-show-servers-state-may-show-an-serv.patch 0010-BUG-MEDIUM-fix-risk-of-segfault-with-show-tls-keys.patch 0011-BUG-MEDIUM-sticktables-segfault-in-some-configuratio.patch 0012-BUG-MEDIUM-lua-converters-doesn-t-work.patch 0013-BUG-MINOR-http-add-header-header-name-copied-twice.patch 0014-BUG-MEDIUM-http-add-header-buffer-overwritten.patch- update to 1.6.5 - BUG/MINOR: log: Don't use strftime() which can clobber timezone if chrooted - BUILD: namespaces: fix a potential build warning in namespaces.c - DOC: add encoding to json converter example - BUG/MINOR: conf: "listener id" expects integer, but its not checked - DOC: Clarify tunes.vars.xxx-max-size settings - BUG/MEDIUM: peers: fix incorrect age in frequency counters - BUG/MEDIUM: Fix RFC5077 resumption when more than TLS_TICKETS_NO are present - BUG/MAJOR: Fix crash in http_get_fhdr with exactly MAX_HDR_HISTORY headers - BUG/MINOR: lua: can't load external libraries - DOC: "addr" parameter applies to both health and agent checks - DOC: timeout client: pointers to timeout http-request - DOC: typo on stick-store response - DOC: stick-table: amend paragraph blaming the loss of table upon reload - DOC: typo: ACL subdir match - DOC: typo: maxconn paragraph is wrong due to a wrong buffer size - DOC: regsub: parser limitation about the inability to use closing square brackets - DOC: typo: req.uri is now replaced by capture.req.uri - DOC: name set-gpt0 mismatch with the expected keyword - BUG/MEDIUM: stick-tables: some sample-fetch doesn't work in the connection state. - DOC: fix "needed" typo - BUG/MINOR: dns: inapropriate way out after a resolution timeout - BUG/MINOR: dns: trigger a DNS query type change on resolution timeout - BUG/MINOR : allow to log cookie for tarpit and denied request - OPTIM/MINOR: session: abort if possible before connecting to the backend - BUG/MEDIUM: trace.c: rdtsc() is defined in two files - BUG/MEDIUM: channel: fix miscalculation of available buffer space (2nd try) - BUG/MINOR: cfgparse: couple of small memory leaks. - BUG/MEDIUM: sample: initialize the pointer before parse_binary call. - DOC: fix discrepancy in the example for http-request redirect - DOC: Clarify IPv4 address / mask notation rules - CLEANUP: fix inconsistency between fd->iocb, proto->accept and accept() - BUG/MEDIUM: fix maxaccept computation on per-process listeners - BUG/MINOR: listener: stop unbound listeners on startup - BUG/MINOR: fix maxaccept computation according to the frontend process range - MEDIUM: unblock signals on startup. - BUG/MEDIUM: channel: don't allow to overwrite the reserve until connected - BUG/MEDIUM: channel: incorrect polling condition may delay event delivery - BUG/MEDIUM: channel: fix miscalculation of available buffer space (3rd try) - BUG/MEDIUM: log: fix risk of segfault when logging HTTP fields in TCP mode - BUG/MEDIUM: lua: protects the upper boundary of the argument list for converters/fetches. - BUG/MINOR: log: fix a typo that would cause %HP to log - MINOR: channel: add new function channel_congested() - BUG/MEDIUM: http: fix risk of CPU spikes with pipelined requests from dead client - BUG/MAJOR: channel: fix miscalculation of available buffer space (4th try) - BUG/MEDIUM: stream: ensure the SI_FL_DONT_WAKE flag is properly cleared - BUG/MEDIUM: channel: fix inconsistent handling of 4GB-1 transfers - BUG/MEDIUM: stats: show servers state may show an empty or incomplete result - BUG/MEDIUM: stats: show backend may show an empty or incomplete result - MINOR: stats: fix typo in help messages - MINOR: stats: show stat resolvers missing in the help message - BUG/MINOR: dns: fix DNS header definition - BUG/MEDIUM: dns: fix alignment issue when building DNS queries - CLEANUP/MINOR: stats: fix accidental addition of member "env" in the applet ctx - refreshed patches to apply cleanly again - haproxy-1.6.0-makefile_lib.patch - haproxy-1.6.0-sec-options.patch- update to 1.6.4 (fate#320607) (bsc#937202) - BUG/MINOR: http: fix several off-by-one errors in the url_param parser - BUG/MINOR: http: Be sure to process all the data received from a server - BUG/MINOR: chunk: make chunk_dup() always check and set dst->size - MINOR: chunks: ensure that chunk_strcpy() adds a trailing zero - MINOR: chunks: add chunk_strcat() and chunk_newstr() - MINOR: chunk: make chunk_initstr() take a const string - MINOR: lru: new function to delete least recently used keys - DOC: add Ben Shillito as the maintainer of 51d - BUG/MINOR: 51d: Ensures a unique domain for each configuration - BUG/MINOR: 51d: Aligns Pattern cache implementation with HAProxy best practices. - BUG/MINOR: 51d: Releases workset back to pool. - BUG/MINOR: 51d: Aligned const pointers to changes in 51Degrees. - CLEANUP: 51d: Aligned if statements with HAProxy best practices and removed casts from malloc. - DOC: fix a few spelling mistakes (cherry picked from commit cc123c66c2075add8524a6a9925382927daa6ab0) - DOC: fix "workaround" spelling - BUG/MINOR: examples: Fixing haproxy.spec to remove references to .cfg files - MINOR: fix the return type for dns_response_get_query_id() function - MINOR: server state: missing LF (\n) on error message printed when parsing server state file - BUG/MEDIUM: dns: no DNS resolution happens if no ports provided to the nameserver - BUG/MAJOR: servers state: server port is erased when dns resolution is enabled on a server - BUG/MEDIUM: servers state: server port is used uninitialized - BUG/MEDIUM: config: Adding validation to stick-table expire value. - BUG/MEDIUM: sample: http_date() doesn't provide the right day of the week - BUG/MEDIUM: channel: fix miscalculation of available buffer space. - MEDIUM: pools: add a new flag to avoid rounding pool size up - BUG/MEDIUM: buffers: do not round up buffer size during allocation - BUG/MINOR: stream: don't force retries if the server is DOWN - BUG/MINOR: counters: make the sc-inc-gpc0 and sc-set-gpt0 touch the table - MINOR: unix: don't mention free ports on EAGAIN - BUG/CLEANUP: CLI: report the proper field states in "show sess" - MINOR: stats: send content-length with the redirect to allow keep-alive - BUG: stream_interface: Reuse connection even if the output channel is empty - DOC: remove old tunnel mode assumptions - BUG/MAJOR: http-reuse: fix risk of orphaned connections - BUG/MEDIUM: http-reuse: do not share private connections across backends - BUG/MINOR: ssl: Be sure to use unique serial for regenerated certificates - BUG/MINOR: stats: fix missing comma in stats on agent drain - BUG/MINOR: lua: unsafe initialization - DOC: lua: fix somme errors - DOC: add server name at rate-limit sessions example - BUG/MEDIUM: ssl: fix off-by-one in ALPN list allocation - BUG/MEDIUM: ssl: fix off-by-one in NPN list allocation - DOC: LUA: fix some typos and syntax errors - MINOR: cfgparse: warn for incorrect 'timeout retry' keyword spelling in resolvers - MINOR: mailers: increase default timeout to 10 seconds - MINOR: mailers: use for all line endings - BUG/MAJOR: lua: applets can't sleep. - BUG/MINOR: server: some prototypes are renamed - BUG/MINOR: lua: Useless copy - BUG/MEDIUM: stats: stats bind-process doesn't propagate the process mask correctly - BUG/MINOR: server: fix the format of the warning on address change - BUG/MEDIUM: chunks: always reject negative-length chunks - BUG/MINOR: systemd: ensure we don't miss signals - BUG/MINOR: systemd: report the correct signal in debug message output - BUG/MINOR: systemd: propagate the correct signal to haproxy - MINOR: systemd: ensure a reload doesn't mask a stop - BUG/MEDIUM: cfgparse: wrong argument offset after parsing server "sni" keyword - CLEANUP: stats: Avoid computation with uninitialized bits. - CLEANUP: pattern: Ignore unknown samples in pat_match_ip(). - CLEANUP: map: Avoid memory leak in out-of-memory condition. - BUG/MINOR: tcpcheck: fix incorrect list usage resulting in failure to load certain configs - BUG/MAJOR: samples: check smp->strm before using it - MINOR: sample: add a new helper to initialize the owner of a sample - MINOR: sample: always set a new sample's owner before evaluating it - BUG/MAJOR: vars: always retrieve the stream and session from the sample - CLEANUP: payload: remove useless and confusing nullity checks for channel buffer - BUG/MINOR: ssl: fix usage of the various sample fetch functions - MINOR: cfgparse: warn when uid parameter is not a number - MINOR: cfgparse: warn when gid parameter is not a number - BUG/MINOR: standard: Avoid free of non-allocated pointer - BUG/MINOR: pattern: Avoid memory leak on out-of-memory condition - CLEANUP: http: fix a build warning introduced by a recent fix - BUG/MINOR: log: GMT offset not updated when entering/leaving DST- update to 1.6.3 (fate#320607) - BUG/MEDIUM: lua: clean output buffer - BUG/MEDIUM: http: switch the request channel to no-delay once done. - BUG/MEDIUM: http: don't enable auto-close on the response side - BUG/MEDIUM: stream: fix half-closed timeout handling - BUG/MEDIUM: cli: changing compression rate-limiting must require admin level - BUG/MEDIUM: sample: urlp can't match an empty value - BUG/MEDIUM: da: stop DeviceAtlas processing in the convertor if there is no input. - BUG/MEDIUM: checks: email-alert not working when declared in defaults - BUG/MEDIUM: http: fix http-reuse when frontend and backend differ - BUG/MEDIUM: config: properly adjust maxconn with nbproc when memmax is forced - BUG/MEDIUM: peers: table entries learned from a remote are pushed to others after a random delay. - BUG/MEDIUM: peers: old stick table updates could be repushed - BUG/MEDIUM: lua: Lua applets must not fetch samples using http_txn - BUG/MEDIUM: lua: Forbid HTTP applets from being called from tcp rulesets - BUG/MAJOR: lua: Do not force the HTTP analysers in use-services for all the details see /usr/share/doc/packages/haproxy/CHANGELOG or http://www.haproxy.org/download/1.6/src/CHANGELOG- on sle11 we still need to own /etc/apparmor.d/local- instead of owning the apparmor directories, BR apparmor-profiles.- fix link to tarball- update to 1.6.2 - BUILD: ssl: fix build error introduced in commit 7969a3 with OpenSSL < 1.0.0 - DOC: fix a typo for a "deviceatlas" keyword - FIX: small typo in an example using the "Referer" header - BUG/MEDIUM: config: count memory limits on 64 bits, not 32 - BUG/MAJOR: dns: first DNS response packet not matching queried hostname may lead to a loop - BUG/MINOR: dns: unable to parse CNAMEs response - BUG/MINOR: examples/haproxy.init: missing brace in quiet_check() - DOC: deviceatlas: more example use cases. - BUG/BUILD: replace haproxy-systemd-wrapper with $(EXTRA) in install-bin. - BUG/MAJOR: http: don't requeue an idle connection that is already queued - DOC: typo on capture.res.hdr and capture.req.hdr - BUG/MINOR: dns: check for duplicate nameserver id in a resolvers section was missing - CLEANUP: use direction names in place of numeric values - BUG/MEDIUM: lua: sample fetches based on response doesn't work - drop haproxy-1.6.0-ssl-098.patch: included upstream- update to 1.6.1 - DOC: specify that stats socket doc (section 9.2) is in management - BUILD: install only relevant and existing documentation - CLEANUP: don't ignore debian/ directory if present - BUG/MINOR: dns: parsing error of some DNS response - BUG/MEDIUM: namespaces: don't fail if no namespace is used - BUG/MAJOR: ssl: free the generated SSL_CTX if the LRU cache is disabled - MEDIUM: dns: Don't use the ANY query type - drop haproxy-1.6.0-ssl.crash.patch included in update- add haproxy-1.6.0-ssl-098.patch: fix building on openssl 0.9.8- added haproxy-1.6.0-ssl.crash.patch: fix SNI related crash- only use network namespace support on distros newer than 13.2- update to 1.6.0 The most user-visible changes, we can cite the simpler handling of multiple configuration files, the support for quotes and environment variables in the configuration, a significant reduction of the memory usage thanks to a new dynamic buffer allocator, notifications over e-mail, server state keeping across reloads, dynamic DNS-based server address resolution, new scripting capabilities thanks to the embedded Lua interpreter, use of variables in the configuration to manipulate samples, request body buffering and analysis, support for two third-party device identification products (DeviceAtlas and 51Degrees), a lot of new sample converters including arithmetic operators and table lookups, TLS ticket secret sharing between nodes, TLS SNI to the server, full tables replication between peers, ability to instruct the kernel to quickly kill dead connections, support for Linux namespaces, and a number of other less visible goodies. The performance has also been improved a lot with support for server connection multiplexing, much faster and cheaper HTTP compression via libslz, and the addition of a pattern cache to speed up certain expensive ACLs. The great flexibility offered by this version will allow many users to significantly simplify their configurations. Some users will notice a huge performance boost after they enable the features designed for them. for all the details see /usr/share/doc/packages/haproxy/CHANGELOG - drop patches we pulled from upstream git: 0001-BUG-MINOR-log-missing-some-ARGC_-entries-in-fmt_dire.patch 0002-DOC-usesrc-root-privileges-requirements.patch 0003-BUILD-ssl-Allow-building-against-libssl-without-SSLv.patch 0004-DOC-MINOR-fix-OpenBSD-versions-where-haproxy-works.patch 0005-BUG-MINOR-http-sample-gmtime-localtime-can-fail.patch 0006-DOC-typo-in-redirect-302-code-meaning.patch 0007-DOC-mention-that-ms-is-left-padded-with-zeroes.patch 0008-CLEANUP-.gitignore-ignore-more-test-files.patch 0009-CLEANUP-.gitignore-finally-ignore-everything-but-wha.patch 0010-MEDIUM-config-emit-a-warning-on-a-frontend-without-l.patch 0011-BUG-MEDIUM-counters-ensure-that-src_-inc-clr-_gpc0-c.patch 0012-DOC-ssl-missing-LF.patch 0013-DOC-fix-example-of-http-request-using-ssl_fc_session.patch 0014-BUG-MINOR-http-remove-stupid-HTTP_METH_NONE-entry.patch 0015-BUG-MAJOR-http-don-t-call-http_send_name_header-afte.patch - refresh/redo patches to apply cleanly again: old: haproxy-1.2.16_config_haproxy_user.patch new: haproxy-1.6.0_config_haproxy_user.patch old: haproxy-makefile_lib.patch new: haproxy-1.6.0-makefile_lib.patch old: sec-options.patch new: haproxy-1.6.0-sec-options.patch - added new haproxy.cfg to have a minimal config we can actually launch! - drop patch haproxy-1.5.8-fix-bashisms.patch: patched files no longer exist - drop haproxy.vim: we will use the copy which ships with the upstream tarball now.- fix haproxy status checks (bsc#947204)- Backport patches from upstream: - BUG/MINOR: http: remove stupid HTTP_METH_NONE entry - BUG/MAJOR: http: don't call http_send_name_header() after an error - Add 0014-BUG-MINOR-http-remove-stupid-HTTP_METH_NONE-entry.patch - Add 0015-BUG-MAJOR-http-don-t-call-http_send_name_header-afte.patch- Backport patches from upstream: - BUG/MINOR: log: missing some ARGC_* entries in fmt_directives() - DOC: usesrc root privileges requirements - BUILD: ssl: Allow building against libssl without SSLv3. - DOC/MINOR: fix OpenBSD versions where haproxy works - BUG/MINOR: http/sample: gmtime/localtime can fail - DOC: typo in 'redirect', 302 code meaning - DOC: mention that %ms is left-padded with zeroes. - CLEANUP: .gitignore: ignore more test files - CLEANUP: .gitignore: finally ignore everything but what is known. - MEDIUM: config: emit a warning on a frontend without listener - BUG/MEDIUM: counters: ensure that src_{inc,clr}_gpc0 creates a missing entry - DOC: ssl: missing LF - DOC: fix example of http-request using ssl_fc_session_id - Add 0001-BUG-MINOR-log-missing-some-ARGC_-entries-in-fmt_dire.patch - Add 0002-DOC-usesrc-root-privileges-requirements.patch - Add 0003-BUILD-ssl-Allow-building-against-libssl-without-SSLv.patch - Add 0004-DOC-MINOR-fix-OpenBSD-versions-where-haproxy-works.patch - Add 0005-BUG-MINOR-http-sample-gmtime-localtime-can-fail.patch - Add 0006-DOC-typo-in-redirect-302-code-meaning.patch - Add 0007-DOC-mention-that-ms-is-left-padded-with-zeroes.patch - Add 0008-CLEANUP-.gitignore-ignore-more-test-files.patch - Add 0009-CLEANUP-.gitignore-finally-ignore-everything-but-wha.patch - Add 0010-MEDIUM-config-emit-a-warning-on-a-frontend-without-l.patch - Add 0011-BUG-MEDIUM-counters-ensure-that-src_-inc-clr-_gpc0-c.patch - Add 0012-DOC-ssl-missing-LF.patch - Add 0013-DOC-fix-example-of-http-request-using-ssl_fc_session.patch- Update to 1.5.14 (CVE-2015-3281) (bsc#937042) + BUILD/MINOR: tools: rename popcount to my_popcountl + BUG/MAJOR: buffers: make the buffer_slow_realign() function respect output data- Update to 1.5.13 - Dropped all patches backported from git, no further changes than those patches provided. - Removed patches: + Remove 0001-BUG-MEDIUM-stats-properly-initialize-the-scope-befor.patch + Remove 0002-BUG-MEDIUM-http-don-t-forward-client-shutdown-withou.patch + Remove 0003-BUG-MINOR-check-fix-tcpcheck-error-message.patch + Remove 0004-CLEANUP-checks-fix-double-usage-of-cur-current_step-.patch + Remove 0005-BUG-MEDIUM-checks-do-not-dereference-head-of-a-tcp-c.patch + Remove 0006-CLEANUP-checks-simplify-the-loop-processing-of-tcp-c.patch + Remove 0007-BUG-MAJOR-checks-always-check-for-end-of-list-before.patch + Remove 0008-BUG-MEDIUM-checks-do-not-dereference-a-list-as-a-tcp.patch + Remove 0009-BUG-MEDIUM-peers-apply-a-random-reconnection-timeout.patch + Remove 0010-DOC-Update-doc-about-weight-act-and-bck-fields-in-th.patch + Remove 0011-MINOR-ssl-add-a-destructor-to-free-allocated-SSL-res.patch + Remove 0012-BUG-MEDIUM-ssl-fix-tune.ssl.default-dh-param-value-b.patch + Remove 0013-BUG-MINOR-cfgparse-fix-typo-in-option-httplog-error-.patch + Remove 0014-BUG-MEDIUM-cfgparse-segfault-when-userlist-is-misuse.patch + Remove 0015-MEDIUM-ssl-replace-standards-DH-groups-with-custom-o.patch + Remove 0016-BUG-MINOR-debug-display-null-in-place-of-meth.patch + Remove 0017-CLEANUP-deinit-remove-codes-for-cleaning-p-block_rul.patch + Remove 0018-BUG-MINOR-ssl-fix-smp_fetch_ssl_fc_session_id.patch + Remove 0019-MEDIUM-init-don-t-stop-proxies-in-parent-process-whe.patch + Remove 0020-MINOR-peers-store-the-pointer-to-the-signal-handler.patch + Remove 0021-MEDIUM-peers-unregister-peers-that-were-never-starte.patch + Remove 0022-MEDIUM-config-propagate-the-table-s-process-list-to-.patch + Remove 0023-MEDIUM-init-stop-any-peers-section-not-bound-to-the-.patch + Remove 0024-MEDIUM-config-validate-that-peers-sections-are-bound.patch + Remove 0025-MAJOR-peers-allow-peers-section-to-be-used-with-nbpr.patch + Remove 0026-DOC-relax-the-peers-restriction-to-single-process.patch + Remove 0027-CLEANUP-config-fix-misleading-information-in-error-m.patch + Remove 0028-MINOR-config-report-the-number-of-processes-using-a-.patch + Remove 0029-BUG-MEDIUM-config-properly-compute-the-default-numbe.patch- Backport upstream patches: + DOC: Update doc about weight, act and bck fields in the statistics + MINOR: ssl: add a destructor to free allocated SSL ressources + BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value being overwritten + BUG/MINOR: cfgparse: fix typo in 'option httplog' error message + BUG/MEDIUM: cfgparse: segfault when userlist is misused + MEDIUM: ssl: replace standards DH groups with custom ones + BUG/MINOR: debug: display (null) in place of "meth" + CLEANUP: deinit: remove codes for cleaning p->block_rules + BUG/MINOR: ssl: fix smp_fetch_ssl_fc_session_id + MEDIUM: init: don't stop proxies in parent process when exiting + MINOR: peers: store the pointer to the signal handler + MEDIUM: peers: unregister peers that were never started + MEDIUM: config: propagate the table's process list to the peers sections + MEDIUM: init: stop any peers section not bound to the correct process + MEDIUM: config: validate that peers sections are bound to exactly one process + MAJOR: peers: allow peers section to be used with nbproc > 1 + DOC: relax the peers restriction to single-process + CLEANUP: config: fix misleading information in error message. + MINOR: config: report the number of processes using a peers section in the error case + BUG/MEDIUM: config: properly compute the default number of processes for a proxy - Added patches: + Add 0010-DOC-Update-doc-about-weight-act-and-bck-fields-in-th.patch + Add 0011-MINOR-ssl-add-a-destructor-to-free-allocated-SSL-res.patch + Add 0012-BUG-MEDIUM-ssl-fix-tune.ssl.default-dh-param-value-b.patch + Add 0013-BUG-MINOR-cfgparse-fix-typo-in-option-httplog-error-.patch + Add 0014-BUG-MEDIUM-cfgparse-segfault-when-userlist-is-misuse.patch + Add 0015-MEDIUM-ssl-replace-standards-DH-groups-with-custom-o.patch + Add 0016-BUG-MINOR-debug-display-null-in-place-of-meth.patch + Add 0017-CLEANUP-deinit-remove-codes-for-cleaning-p-block_rul.patch + Add 0018-BUG-MINOR-ssl-fix-smp_fetch_ssl_fc_session_id.patch + Add 0019-MEDIUM-init-don-t-stop-proxies-in-parent-process-whe.patch + Add 0020-MINOR-peers-store-the-pointer-to-the-signal-handler.patch + Add 0021-MEDIUM-peers-unregister-peers-that-were-never-starte.patch + Add 0022-MEDIUM-config-propagate-the-table-s-process-list-to-.patch + Add 0023-MEDIUM-init-stop-any-peers-section-not-bound-to-the-.patch + Add 0024-MEDIUM-config-validate-that-peers-sections-are-bound.patch + Add 0025-MAJOR-peers-allow-peers-section-to-be-used-with-nbpr.patch + Add 0026-DOC-relax-the-peers-restriction-to-single-process.patch + Add 0027-CLEANUP-config-fix-misleading-information-in-error-m.patch + Add 0028-MINOR-config-report-the-number-of-processes-using-a-.patch + Add 0029-BUG-MEDIUM-config-properly-compute-the-default-numbe.patch- BUG/MINOR: check: fix tcpcheck error message - CLEANUP: checks: fix double usage of cur / current_step in tcp-checks - BUG/MEDIUM: checks: do not dereference head of a tcp-check at the end - CLEANUP: checks: simplify the loop processing of tcp-checks - BUG/MAJOR: checks: always check for end of list before proceeding - BUG/MEDIUM: checks: do not dereference a list as a tcpcheck struct - BUG/MEDIUM: peers: apply a random reconnection timeout - Add 0003-BUG-MINOR-check-fix-tcpcheck-error-message.patch - Add 0004-CLEANUP-checks-fix-double-usage-of-cur-current_step-.patch - Add 0005-BUG-MEDIUM-checks-do-not-dereference-head-of-a-tcp-c.patch - Add 0006-CLEANUP-checks-simplify-the-loop-processing-of-tcp-c.patch - Add 0007-BUG-MAJOR-checks-always-check-for-end-of-list-before.patch - Add 0008-BUG-MEDIUM-checks-do-not-dereference-a-list-as-a-tcp.patch - Add 0009-BUG-MEDIUM-peers-apply-a-random-reconnection-timeout.patch- added 0002-BUG-MEDIUM-http-don-t-forward-client-shutdown-withou.patch BUG/MEDIUM: http: don't forward client shutdown without NOLINGER except for tunnels- added first patch from the 1.5 branch after the update: 0001-BUG-MEDIUM-stats-properly-initialize-the-scope-befor.patch- update to 1.5.12 - BUG/MINOR: ssl: Display correct filename in error message - DOC: Fix L4TOUT typo in documentation - BUG/MEDIUM: Do not consider an agent check as failed on L7 error - BUG/MINOR: pattern: error message missing - BUG/MEDIUM: pattern: some entries are not deleted with case insensitive match - BUG/MEDIUM: buffer: one byte miss in buffer free space check - BUG/MAJOR: http: don't read past buffer's end in http_replace_value - BUG/MEDIUM: http: the function "(req|res)-replace-value" doesn't respect the HTTP syntax - BUG/MEDIUM: peers: correctly configure the client timeout - BUG/MINOR: compression: consider the expansion factor in init - BUG/MEDIUM: http: hdr_cnt would not count any header when called without name - BUG/MEDIUM: listener: don't report an error when resuming unbound listeners - BUG/MEDIUM: init: don't limit cpu-map to the first 32 processes only - BUG/MEDIUM: stream-int: always reset si->ops when si->end is nullified - BUG/MEDIUM: http: remove content-length from chunked messages - DOC: http: update the comments about the rules for determining transfer-length - BUG/MEDIUM: http: do not restrict parsing of transfer-encoding to HTTP/1.1 - BUG/MEDIUM: http: incorrect transfer-coding in the request is a bad request - BUG/MEDIUM: http: remove content-length form responses with bad transfer-encoding - MEDIUM: http: restrict the HTTP version token to 1 digit as per RFC7230 - MEDIUM: http: add option-ignore-probes to get rid of the floods of 408 - BUG/MINOR: config: clear proxy->table.peers.p for disabled proxies - MINOR: stick-table: don't attach to peers in stopped state - MEDIUM: config: initialize stick-tables after peers, not before - MEDIUM: peers: add the ability to disable a peers section - DOC: document option http-ignore-probes - DOC: fix the comments about the meaning of msg->sol in HTTP - BUG/MEDIUM: http: wait for the exact amount of body bytes in wait_for_request_body - BUG/MAJOR: http: prevent risk of reading past end with balance url_param - DOC: update the doc on the proxy protocol - remove patches that we pulled from the 1.5 tree 0001-BUG-MINOR-pattern-error-message-missing.patch 0002-BUG-MEDIUM-pattern-some-entries-are-not-deleted-with.patch 0003-BUG-MEDIUM-Do-not-consider-an-agent-check-as-failed-.patch 0004-BUG-MEDIUM-peers-correctly-configure-the-client-time.patch 0005-BUG-MEDIUM-buffer-one-byte-miss-in-buffer-free-space.patch 0006-BUG-MAJOR-http-don-t-read-past-buffer-s-end-in-http_.patch 0007-BUG-MEDIUM-http-the-function-req-res-replace-value-d.patch 0008-BUG-MINOR-compression-consider-the-expansion-factor-.patch 0009-BUG-MEDIUM-http-hdr_cnt-would-not-count-any-header-w.patch 0010-BUG-MINOR-ssl-Display-correct-filename-in-error-mess.patch 0011-BUG-MEDIUM-listener-don-t-report-an-error-when-resum.patch 0012-BUG-MEDIUM-init-don-t-limit-cpu-map-to-the-first-32-.patch- pull 3 patches from upstream: 0010-BUG-MINOR-ssl-Display-correct-filename-in-error-mess.patch 0011-BUG-MEDIUM-listener-don-t-report-an-error-when-resum.patch 0012-BUG-MEDIUM-init-don-t-limit-cpu-map-to-the-first-32-.patch- pull 3 patches from upstream: 0007-BUG-MEDIUM-http-the-function-req-res-replace-value-d.patch 0008-BUG-MINOR-compression-consider-the-expansion-factor-.patch 0009-BUG-MEDIUM-http-hdr_cnt-would-not-count-any-header-w.patch- pull 3 patches from upstream: - BUG/MEDIUM: peers: correctly configure the client timeout - BUG/MEDIUM: buffer: one byte miss in buffer free space check - BUG/MAJOR: http: don't read past buffer's end in http_replace_value - Add 0004-BUG-MEDIUM-peers-correctly-configure-the-client-time.patch - Add 0005-BUG-MEDIUM-buffer-one-byte-miss-in-buffer-free-space.patch - Add 0006-BUG-MAJOR-http-don-t-read-past-buffer-s-end-in-http_.patch- added another fix from upstream: 0003-BUG-MEDIUM-Do-not-consider-an-agent-check-as-failed-.patch- haproxy.init: fix reload and force-reload not to start a stopped service- pulled 2 patches from upstream: 0001-BUG-MINOR-pattern-error-message-missing.patch 0002-BUG-MEDIUM-pattern-some-entries-are-not-deleted-with.patch- update to 1.5.11 - BUG/MEDIUM: backend: correctly detect the domain when use_domain_only is used - MINOR: ssl: load certificates in alphabetical order - BUG/MINOR: checks: prevent http keep-alive with http-check expect - BUG/MEDIUM: Do not set agent health to zero if server is disabled in config - MEDIUM/BUG: Only explicitly report "DOWN (agent)" if the agent health is zero - BUG/MINOR: stats:Fix incorrect printf type. - DOC: add missing entry for log-format and clarify the text - BUG/MEDIUM: http: fix header removal when previous header ends with pure LF - BUG/MEDIUM: channel: fix possible integer overflow on reserved size computation - BUG/MINOR: channel: compare to_forward with buf->i, not buf->size - MINOR: channel: add channel_in_transit() - MEDIUM: channel: make buffer_reserved() use channel_in_transit() - MEDIUM: channel: make bi_avail() use channel_in_transit() - BUG/MEDIUM: channel: don't schedule data in transit for leaving until connected - BUG/MAJOR: log: don't try to emit a log if no logger is set - BUG/MINOR: args: add missing entry for ARGT_MAP in arg_type_names - BUG/MEDIUM: http: make http-request set-header compute the string before removal - BUG/MINOR: http: fix incorrect header value offset in replace-hdr/replace-value - BUG/MINOR: http: abort request processing on filter failure - drop patch included in update: 0001-BUG-MEDIUM-backend-correctly-detect-the-domain-when-.patch- pull fix from usptream: 0001-BUG-MEDIUM-backend-correctly-detect-the-domain-when-.patch BUG/MEDIUM: backend: correctly detect the domain when use_domain_only is used- update to 1.5.10 - DOC: fix a few typos - BUG/MINOR: http: fix typo: "401 Unauthorized" => "407 Unauthorized" - BUG/MINOR: parse: refer curproxy instead of proxy - DOC: httplog does not support 'no' - MINOR: map/acl/dumpstats: remove the "Done." message - BUG/MEDIUM: sample: fix random number upper-bound - BUG/MEDIUM: patterns: previous fix was incomplete - BUG/MEDIUM: payload: ensure that a request channel is available - BUG/MINOR: tcp-check: don't condition data polling on check type - BUG/MEDIUM: tcp-check: don't rely on random memory contents - BUG/MEDIUM: tcp-checks: disable quick-ack unless next rule is an expect - BUG/MINOR: config: fix typo in condition when propagating process binding - BUG/MEDIUM: config: do not propagate processes between stopped processes - BUG/MAJOR: stream-int: properly check the memory allocation return - BUG/MEDIUM: memory: fix freeing logic in pool_gc2() - BUG/MEDIUM: compression: correctly report zlib_mem - drop patches that we pulled from git before: 0001-BUG-MEDIUM-patterns-previous-fix-was-incomplete.patch 0002-BUG-MEDIUM-payload-ensure-that-a-request-channel-is-.patch 0003-BUG-MINOR-tcp-check-don-t-condition-data-polling-on-.patch 0004-BUG-MEDIUM-tcp-check-don-t-rely-on-random-memory-con.patch 0005-BUG-MEDIUM-tcp-checks-disable-quick-ack-unless-next-.patch 0006-DOC-fix-a-few-typos.patch 0007-BUG-MEDIUM-sample-fix-random-number-upper-bound.patch 0008-DOC-httplog-does-not-support-no.patch 0009-BUG-MINOR-http-fix-typo-401-Unauthorized-407-Unautho.patch 0010-BUG-MINOR-parse-refer-curproxy-instead-of-proxy.patch 0011-BUG-MINOR-config-fix-typo-in-condition-when-propagat.patch 0012-BUG-MEDIUM-config-do-not-propagate-processes-between.patch- pulled some more fixes from git: 0003-BUG-MINOR-tcp-check-don-t-condition-data-polling-on-.patch 0004-BUG-MEDIUM-tcp-check-don-t-rely-on-random-memory-con.patch 0005-BUG-MEDIUM-tcp-checks-disable-quick-ack-unless-next-.patch 0006-DOC-fix-a-few-typos.patch 0007-BUG-MEDIUM-sample-fix-random-number-upper-bound.patch 0008-DOC-httplog-does-not-support-no.patch 0009-BUG-MINOR-http-fix-typo-401-Unauthorized-407-Unautho.patch 0010-BUG-MINOR-parse-refer-curproxy-instead-of-proxy.patch 0011-BUG-MINOR-config-fix-typo-in-condition-when-propagat.patch 0012-BUG-MEDIUM-config-do-not-propagate-processes-between.patch see patch headers for details.- pulled 2 fixes from git: - 0001-BUG-MEDIUM-patterns-previous-fix-was-incomplete.patch Dmitry Sivachenko reported that commit 315ec42 ("BUG/MEDIUM: pattern: don't load more than once a pattern list.") relies on an uninitialised variable in the stack. While it used to work fine during the tests, if the uninitialized variable is non-null, some patterns may be aggregated if loaded multiple times, resulting in slower processing, which was the original issue it tried to address. - 0002-BUG-MEDIUM-payload-ensure-that-a-request-channel-is-.patch Denys Fedoryshchenko reported a segfault when using certain sample fetch functions in the "tcp-request connection" rulesets despite the warnings. This is because some tests for the existence of the channel were missing.- fix bashisms in example scripts - add patches: * haproxy-1.5.8-fix-bashisms.patch- update to 1.5.9 - BUILD: fix "make install" to support spaces in the install dirs - BUG/MEDIUM: checks: fix conflicts between agent checks and ssl healthchecks - BUG/MEDIUM: ssl: fix bad ssl context init can cause segfault in case of OOM. - BUG/MINOR: samples: fix unnecessary memcopy converting binary to string. - BUG/MEDIUM: connection: sanitize PPv2 header length before parsing address information - BUG/MEDIUM: pattern: don't load more than once a pattern list. - BUG/MEDIUM: ssl: force a full GC in case of memory shortage - BUG/MINOR: config: don't inherit the default balance algorithm in frontends - BUG/MAJOR: frontend: initialize capture pointers earlier - BUG/MINOR: stats: correctly set the request/response analysers - DOC: fix typo in the body parser documentation for msg.sov - BUG/MINOR: peers: the buffer size is global.tune.bufsize, not trash.size - MINOR: sample: add a few basic internal fetches (nbproc, proc, stopping) - BUG/MAJOR: sessions: unlink session from list on out of memory - Drop patches pulled from git - 0001-BUILD-fix-make-install-to-support-spaces-in-the-inst.patch - 0002-BUG-MEDIUM-ssl-fix-bad-ssl-context-init-can-cause-se.patch - 0003-BUG-MEDIUM-ssl-force-a-full-GC-in-case-of-memory-sho.patch - 0004-BUG-MEDIUM-checks-fix-conflicts-between-agent-checks.patch - 0005-BUG-MINOR-config-don-t-inherit-the-default-balance-a.patch - 0006-BUG-MAJOR-frontend-initialize-capture-pointers-earli.patch- BUILD: fix "make install" to support spaces in the install dirs - BUG/MEDIUM: ssl: fix bad ssl context init can cause segfault in case of OOM. - BUG/MEDIUM: ssl: force a full GC in case of memory shortage - BUG/MEDIUM: checks: fix conflicts between agent checks and ssl healthchecks - BUG/MINOR: config: don't inherit the default balance algorithm in frontends - BUG/MAJOR: frontend: initialize capture pointers earlier - Add patches: - 0001-BUILD-fix-make-install-to-support-spaces-in-the-inst.patch - 0002-BUG-MEDIUM-ssl-fix-bad-ssl-context-init-can-cause-se.patch - 0003-BUG-MEDIUM-ssl-force-a-full-GC-in-case-of-memory-sho.patch - 0004-BUG-MEDIUM-checks-fix-conflicts-between-agent-checks.patch - 0005-BUG-MINOR-config-don-t-inherit-the-default-balance-a.patch - 0006-BUG-MAJOR-frontend-initialize-capture-pointers-earli.patch- fix bashisms in pre script- update to 1.5.8 - BUG/MAJOR: buffer: check the space left is enough or not when input data in a buffer is wrapped - BUG/BUILD: revert accidental change in the makefile from latest SSL fix - changes in 1.5.7 - BUG/MEDIUM: regex: fix pcre_study error handling - BUG/MINOR: log: fix request flags when keep-alive is enabled - MINOR: ssl: add fetchs 'ssl_c_der' and 'ssl_f_der' to return DER formatted certs - MINOR: ssl: add statement to force some ssl options in global. - BUG/MINOR: ssl: correctly initialize ssl ctx for invalid certificates - BUG/MEDIUM: http: don't dump debug headers on MSG_ERROR - BUG/MAJOR: cli: explicitly call cli_release_handler() upon error - BUG/MEDIUM: tcp: fix outgoing polling based on proxy protocol - BUG/MEDIUM: tcp: don't use SO_ORIGINAL_DST on non-AF_INET sockets - Dropped patches: - 0001-BUG-MEDIUM-http-don-t-dump-debug-headers-on-MSG_ERRO.patch - 0002-BUG-MAJOR-cli-explicitly-call-cli_release_handler-up.patch - 0003-BUG-MINOR-log-fix-request-flags-when-keep-alive-is-e.patch - 0004-BUG-MEDIUM-tcp-fix-outgoing-polling-based-on-proxy-p.patch- BUG/MEDIUM: http: don't dump debug headers on MSG_ERROR - BUG/MAJOR: cli: explicitly call cli_release_handler() upon error - BUG/MINOR: log: fix request flags when keep-alive is enabled - BUG/MEDIUM: tcp: fix outgoing polling based on proxy protocol - Added patches: - 0001-BUG-MEDIUM-http-don-t-dump-debug-headers-on-MSG_ERRO.patch - 0002-BUG-MAJOR-cli-explicitly-call-cli_release_handler-up.patch - 0003-BUG-MINOR-log-fix-request-flags-when-keep-alive-is-e.patch - 0004-BUG-MEDIUM-tcp-fix-outgoing-polling-based-on-proxy-p.patch- update to 1.5.6 - BUG/MEDIUM: systemd: set KillMode to 'mixed' - MINOR: systemd: Check configuration before start - BUG/MEDIUM: config: avoid skipping disabled proxies - BUG/MINOR: config: do not accept more track-sc than configured - BUG/MEDIUM: backend: fix URI hash when a query string is present - dropped patches that were pulled from upstream 0001-BUG-MEDIUM-config-avoid-skipping-disabled-proxies.patch 0001-BUG-MEDIUM-systemd-set-KillMode-to-mixed.patch 0004-BUG-MINOR-config-do-not-accept-more-track-sc-than-co.patch 0005-BUG-MEDIUM-backend-fix-URI-hash-when-a-query-string-.patch - dropped patch we sent upstream haproxy-1.5_check_config_before_start.patch- BUG/MINOR: config: do not accept more track-sc than configured - BUG/MEDIUM: backend: fix URI hash when a query string is present - Add patch: 0004-BUG-MINOR-config-do-not-accept-more-track-sc-than-co.patch - Add patch: 0005-BUG-MEDIUM-backend-fix-URI-hash-when-a-query-string-.patch/bin/sh/bin/sh/bin/sh/bin/shhaproxy-1.5haproxy-doch01-ch4c 1701365181  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~2.4.22+git0.f8e3218e2-150400.3.19.12.4.22+git0.f8e3218e2-150400.3.19.12.4.22+git0.f8e3218e2-150400.3.19.12.4.22+git0.f8e3218e22.4.22+git0.f8e3218e22.4.22+git0.f8e3218e22.4.22+git0.f8e3218e2     haproxyusr.sbin.haproxyusr.sbin.haproxyhaproxyhaproxy.cfghaproxy.servicehaproxy-user.confhaproxyhaproxy-halogrchaproxyhaproxy51Degrees-device-detection.txtCHANGELOGDeviceAtlas-device-detection.txtREADMEROADMAPSOCKS4.protocol.txtSPOE.txtWURFL-device-detection.txtacl.figarchitecture.txtclose-options.txtcoding-style.txtconfiguration.txtcookie-options.txtdesign-thoughtsbackends-v0.txtbackends.txtbe-fe-changes.txtbinding-possibilities.txtconfig-language.txtconnection-reuse.txtconnection-sharing.txtdynamic-buffers.txtentities-v2.txthow-it-works.txthttp2.txthttp_load_time.urlrate-shaping.txtsess_par_sec.txtexamplesacl-content-sw.cfgbasic-config-edge.cfgcontent-sw-sample.cfgerrorfiles400.http403.http408.http500.http502.http503.http504.httpREADMEoption-http_proxy.cfgquick-test.cfgsocks4.cfgtransparent_proxy.cfgwurfl-example.cfggpl.txthaproxy.1internalsacl.txtbody-parsing.txtbuffer-api.txtconnect-status.txtconnection-header.txtconnection-scale.txtentities-v2.txtentities.figentities.pdfentities.svgentities.txtfd-migration.txtfilters.txthashing.txtheader-parser-speed.txtheader-tree.txthttp-cookies.txthttp-docs.txthttp-parsing.txthtx-api.txtinitcalls.txtlist.figlist.pnglistener-states.figlistener-states.pnglua_socket.figlua_socket.pdfmuxes.figmuxes.pdfmuxes.pngmuxes.svgnaming.txtnotes-layers.txtpattern.diapattern.pdfpolling-states.figrepartition-be-fe-fi.txtsched.figsched.pdfsched.pngsched.svgsequence.figssl_cert.diastats-v2.txtstream-sock-states.figintro.txtlgpl.txtlinux-syn-cookies.txtlua-apiMakefile_staticchannel.figchannel.pngconf.pyindex.rstlua.txtmanagement.txtnetscaler-client-ip-insertion-protocol.txtnetsnmp-perlREADMEcacti_data_query_haproxy_backends.xmlcacti_data_query_haproxy_frontends.xmlhaproxy.plhaproxy_backend.xmlhaproxy_frontend.xmlhaproxy_socket.xmlnetwork-namespaces.txtpeers-v2.0.txtpeers.txtproxy-protocol.txtqueuing.figregression-testing.txtseamless_reload.txtselinuxREADMEhaproxy.fchaproxy.ifhaproxy.tehaproxyLICENSEhaproxy.1.gzvimvim90syntaxhaproxy.vimhaproxy/etc/apparmor.d/local//etc/apparmor.d//etc//etc/haproxy//usr/lib/systemd/system//usr/lib/sysusers.d//usr/sbin//usr/share/doc/packages//usr/share/doc/packages/haproxy//usr/share/doc/packages/haproxy/design-thoughts//usr/share/doc/packages/haproxy/examples//usr/share/doc/packages/haproxy/examples/errorfiles//usr/share/doc/packages/haproxy/internals//usr/share/doc/packages/haproxy/lua-api//usr/share/doc/packages/haproxy/lua-api/_static//usr/share/doc/packages/haproxy/netsnmp-perl//usr/share/doc/packages/haproxy/selinux//usr/share/licenses//usr/share/licenses/haproxy//usr/share/man/man1//usr/share//usr/share/vim//usr/share/vim/vim90//usr/share/vim/vim90/syntax//var/lib/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:31674/SUSE_SLE-15-SP4_Update/ade29fa46ae9ead693907aa45584e031-haproxy.SUSE_SLE-15-SP4_Updatedrpmxz5x86_64-suse-linux        ASCII textC source, ASCII textdirectoryELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=44e64deeab5e9ea2b16a6500e64a8e5c87106403, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=f63cbe93d215fd004a31ece7afcf57deb27fdc8f, for GNU/Linux 3.2.0, strippedASCII text, with no line terminatorsFIG image text, version 3.2, ASCII textISO-8859 textHTML document, ASCII textHTML document, ASCII text, with CRLF, LF line terminatorstroff or preprocessor input, ASCII textSVG Scalable Vector Graphics imageUTF-8 Unicode textPNG image data, 1024 x 552, 8-bit colormap, non-interlacedPNG image data, 1082 x 853, 8-bit colormap, non-interlacedPNG image data, 1197 x 959, 8-bit colormap, non-interlacedXML 1.0 document, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)PNG image data, 1280 x 982, 8-bit/color RGB, non-interlacedXML 1.0 document, ASCII text (gzip compressed data, max compression, from Unix)PNG image data, 596 x 180, 8-bit/color RGB, non-interlacedSE Linux policy interface sourcetroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)&$PPRR"R'RRR RRR%R$RRR R RR RRRRRRR R RRR(RR!RR#RRR&RRRRRR RS":hP7systemdapparmor-abstractionssystemdutf-87ab410d79270b59b795520fcb54d983febd0344cbdae131fa83022d92fabb059?7zXZ !t/#&Yu8vcx67s=Y5 h֩Ub4*m7:\k=ָ"Hԏ.;>C\;N *>َ֦r$Ƥ jZ͐Q~kE,e2a 2 i?KO] ow2kiLSj} g%EAʍFgzQY]ĉO4&/ ߃W/u0 4t.'U; /N5#-?փx*^en+kJ"9^ReBMV Db>3ǫy}c! ;91N{)Q%O|%J /ᬬΠl2_^/-|ۇBvi15"@`yF5.4ݓ'>G_[a~M`oCAvxQ)>0:,^l훷u)AfӀ0['Z q)VW߀m>R<4:s3άrUb4 A!GB_S9h4tƶ;l͇־aD"y0C+|]rgHt3%=Gg^~j #$E*$ٚ'6BPd+q6,4oُP1Jk0di^+OXdn m%Wؑ޷WT Bi)5Vb)mkW/eUw4Rc9~/7.S{8 &`8M^~47DxLz7TPb#Р(wFKk|Rc*|,ȺO_n6Dh},]eW!Fﲱ6j#fs8l1\u-DHNu(40].=)n>"{yA?izJu>iR EzY֌$*,׸MmHG[ F:-l"+'@t>ے>#yVzs#bu[Q){ȶYsizAqh ,ZEB|/2Ɏ[2 p 2={`:zngt"EEcFQ1wfbYSu]Bq6!k@{Sન~RjC`zOȤv^Y@WklIuVXP*̓jh&fZhAwGOJK(73ko閈,0~}x4Ʈ@0ƶ8)o9Ao~|W[KX50PtrKL3%\bܺx)a] YU}D7{:llq8Tܱn:MY;+\$)09OKuQ,dhQ[31+/7P2MqKA&nu4 GنshL{|裡gdosQOt ]TE'z_("ONѨh{"#-PV Ljݠ?Ҟxv+I~䉖E4I%WT۶\t.6| NJ+ԭt,.b5W1 <,!Sc $yET533|`2J_*z~X5 w b{m q bNr(>PK?+_G3N2p6R?3VV Bsml <$~Qi>Kt,w,ٴh-%i$H^YقԣK"^F Ү*j`3bl`I!+ $u$4-RUYxi26lb]o`'LjZm>:ձr 9Kpܠ[o!3r%$ >uΑ|*-`;0.ꀷi_; +Ձ *rUs^g;:0qV5 IjK:M? 0D#BN"RbD 1D`nߺ.]@٬@;RDpjb$@C.jk2&ϬP&}!Lu(`֘2,iDPG AHضST"X(5#f]1v|nU4cPxM W~Cܶbgklq2!N$x2&l԰E{<UT 4f/1pHfxiqzoAwu. "0Dߓ<d"5i;^:'=Dc~B )`?gޜM)2ӱ Q t`o,I2DZ/05$=ab歞Cn\]4:E\`]wia{PK PP@QY̿8)>4ӷkG]N%6C94LKiH"i З$f+Hh[] .˛m#pV<[4 Wسazm`JTZpz`=A/@{Ws Kë oJ)L^EгSו_4 u2DSS~6G_v0 G]Hֱ1ʑ {sX-^6*MuvPGUn<ňd9%uP=1'jY^~t%XamezVc wLU<c W1vju25|/kK?r<TgS/;W p`uFrѡ"FqutzAo'8[BU |9r*8>{q̜)dbV dC8q>#cq.@n"q u{ -3,PF:7:<OhQx]֬׆w(U<>_ƃȞT7oe2M""lɳ.4 Ut<!`FsB\hj-wW;u~`4* iyJpH,뛳ņCQsM(7:(ĕ?VdU@T ^5~#IyPӲ2&Nuʬ4NE4A/x+6=R"[ߧ-&?ty vzZMY6K=,g\ٯG|^KڞQ+5<]j+͙$OXE=y5.f5[,B*4ߎ{:3wXVEL\ Hx(,No<II_+d]dz!QdD9ѷdq/]פcuqAz:ykOA 0l &_5a9R .s_u)*{dzƓaxLE+p˾j{ Q:}9HV9Y5-ףƑbXs^ԉZG`|j)N2rx_C+lpc\ ,P[pP kI֩@wDw.4DP\Q(4k<N< Ĉ|HS@P 0)JVJDuȳH!242+7Zםs`7.s * -ΑH܆؅XUkT4DזvtQʼnVO׸aՕ!#,fqKbY VXY Y(ι͘[h ?ͷ xmY}>F:4`h7ٜrz:zBQ^[; 9%pKzbR쁇V ݖGFGa71{7~ wrN3>b 쬪:0~]1/@Ѽb^4pL /df9BfUU4T wyvkFdΝIQ%Q~&vUtbN78+ٞ]>5g`a%ߑD[x JgU ^\7?xy6uKQx% Ҏf=ոХ1.zfSJfV&DQ^)9#ň gAlN5uP0p|6$M}BUH<*$m)\Z$d~x~'u u|ӗ򩇕ًӷƴ:-jXJ ubxSsN3\oզzǜ4QIrԳ@`泦#ίCLC>Fť\ 2)Cב3]Pʗy t ,SPH2J'kzW0&h; J5:; U@=/nm]f{ ϯ7@:]3矽MH=a5sC+LM/sQ]/.! wۓTվwĕFS&|Vjyd2+v+&WWš1MC]t n%4ET45kf-3vc=xC vk%4 uRGϿ>&eOXB/{ߪ3_^.VC'ۚ)8;1㻪nmY m&ÿrN3N 2,b* )0Qϰpk"bHnຈ zrZCE Ѓ9bIQM.?c4s\6O?o?.ksʟ>xb ۛbR&P WImVoDqՃϥy\saFt]MT(1JifQLb }qo^g׏ΰbÂ!re٥6cLϻfݼ6U\/ȾrTA: SC.k/uw3 %;O`MVF&aj25OMB,FT1-Y#gdʯy+U)Č i:ˢz0OZ8=XU"9ڻ=7RđҡFw;✵nh;Ր)쬫'2.X"FW z{cۏavBֺ} Qp}2sƄ܄0u-do?`reöeɄ1C$Ok; _D2U+-@V}6o724kf{4 !uJJtvoHf8gR|*ɝKٍ\pըp,I|m‰2ncR<:0V|F^GBb:k˞nW灈@)m-8hǘY(ӓ pS$ %aƊ+BU\{]ќ҂eSsL7bX\ry1"z|b?ww: ՏGOhVxoYQt[Ix'.~,>Ҥ ?lx±8-zf'ӺM]&9iwLD VL2uC5YS@B ZJ_<0N]@-:{6Cl-jm.{MȖicOxXVUffQkΝX"AʼXϐ} Si%5Վ!1>kNV!T 3Ax`/~`>mЯb)MOkHE{%,v+9JLu4gSa {zF3du>gOuMsݤf5OM>R*>== :2kj@u Bηm[%}ʎ`GVn"$>5RvbOL5ܼs :UTrD3v7cooRt6>MchϨClx , 屢?>`t샾l0IJ_B"Mi:Q;~`k L5 X hV%͕&3'c&0Mu1 ̟0œ\͕էʨӢM>2_dpfxpxȗη&4HGE;ŠoL\":ClS,V]ERk?W&Ww؊LR: bkF(7aI `#D"FwE?fYՕGqtO[W?%G:Ub{DODʳ|2SdžzHjDלH[Z@a`ca9D􍩣D?'o {BMksu|+-<%#{s&RlJ#@Gб zzU1Z`VJ᣶6N`T9Z7ANZS$"SA"7Mg?!{pMt:Za:ӍXnDQ<44qvT(CXc&N:dO^z}VyP? VW/7}+BB'{[εۨ:HG)IqJ׾L~#V+/7NdÕr5N7E :ӝi/[X/Mc'Ƕm;S0mIς@m\̶j7y+Z!a-?u~s_m6e*}FHs:ٱȂ4BTnx #3YWJ>_{xn3%wc;8PbX($:GU<)/ޟMO}o0f3J4/oqT-c~ f"o4o ~1%Z1ſ 'p5RNbvJ=鱈i v3LݟF,_<}Y}U͂%M7uՓ_gN@Zg[F EyB|ZU U:6$ч4w0gi0Ni`7%"7KKOYh#Н+㧛 8`9<]ĸra~2 .5#HN8A1T.U 끸*٘V6P"ZsCH4&bDTşZX`&䰸Lz&Ypx$K4W1r-j .EzESDU5uTʚQulZ50ϒ]J*?&ɛ+@5]M Q]$ª\ $Cb=GX;l5%Rs?? IBq2O$5s׆(#螜._R3ծ 8$зحU7)|w>V>Y˻C6M!KV Jxx׽fKvC@bEP=ez)H#l*ꏶԿ2$9D\~HE62w8tz+p)GV^}xtn(xQJ<=&pyz/eΚ r(Aρ$\5vE_Ɓ aPeߡ^ ;r[/|ZT joxm6ƫ"J'YՉfƻ$􉞞? {:ɉa[ fA&BD%W֞3~]Dg ̵B5I8"bjjiO H:xfak/L8Km^A!vr +x {c^*V;*xs,&`wJ l޿Zy ؉c?S%YUS@157IIrt<"H(Y'@'xk%|iɡC2ZI`FS2\74'l{_ۍcu;pC^g `9.XGP6rQ]i7!h|؞*e~5:ZR(; B7k5)ũLl 8m9Û 'ւȆI^$Zٓē:[f}I u2E)̈́xgDap2\ YLp vлAtO FCmyзŠ|_d_AhP VI v˪H`&66 mVR:P.@0!O kvDK+{KJ1/QܮkEA) (LBd*N',r+@a&XG2SBUM׿>> e|QJL&h#X2'd2xsFC{$᱆: Qk4`yZ4gX=P_x CƽGtF7D~ o5RmazzÙLJp*֘A4Qwz8>}n<'^x4QC/F6)64 KJ\s֒kec+'MMёmRy,`3tXPLaY87V9 u*j2rdWbNVUݧ eH}A[*˵ÁWs ZZB0j`G&(MgFRLjw}gb! < e`Zmj~<>+iG2`OxcTYOj[餅Kw= eΠ (YǾ#R\K2[ i>nItK>Ͷ>n㏑[59;{8)glos rl,?w1v@P˸e_a7:d2~7a57k z?L5>ԉ8M^ >rb q,iz?eo۠^ʎ1.Q\ex}OẌI_Lo"69ij)6A֕ܳm\S]r.} 6CZylKxҤ5nR%J<'*=qE^_UxzRu2e?2>w#%c!N8|⵰'Cfwi#QzCZ?QG!4T&Gxo*0/J_ܚjv3C>kW){=:u T:6iXNr~Cy' ŕ YՐס\}p)=8FD_k]۽u?i>KO0U%zCț*>g Pߊm&++ǨB=K ,NhUy;`v@Z6"C!@ Uŧ:ճ7a/Vlla#)zm= ܺ5K=OB<|sE=rPkj4KHZz&ujY cG = >7j|r@%}j=U)a%@xKF ˳?Jyh;S=l!@nOikv~[vhd~|*bO2kz[UiU%Uq>@?, jdx+S57G{G&W mH 3* dZco _j2U;F㇗%bX#=z2y0& `zodVr/y8j:_bo,d+y2A71,$ڹ!NYsIA28iLL|v |oθ`E-4As5Iወ*+[u涐!adȃÙkF1ЦٸTg9_ѸI3z :!'0K-791Ba}۩z:yr`cȘluä ^R6nv=P6yIqysީm@с@(\F ):pZDi,4uOcL$DNTac#;yg1nU;.q*޾QYAKTo݉EyODtL RnӇME7I3}!ę jw5K5&j+7vaGk; 8ξ5вz[[njF6ۮ YGaҹhs"cym*g|qC@ U(Ș9#ղiאxk٣轖1oTPF] s0[vMt܌1@Hm Opp< _&8aH8Š ꨿:_9hnrvp귩9ְ]'|$7QVsLNeM'F\n*KǑ 4~ R6q2v %'3e8"JEC4n9m)oC PbCN ۚ t̅}AV?@@ř3QyqN=˳b _y7v_I%gSyg6NI "\%Jr•R;`J\/cjX $zܕ?"|N25 V7:5[=2Sɴݽ^`զB@+bpEA c@Qi#ז34WHMjPQ0R(Y/U>b=ǀ/A426A|$lK8'oynǏ%LI1˵$৶R‡O(ȐNg_952tdVu39ՎAg0.‡,Bk2~i"oLԥfti3kBglZl)7h\_ l1%62ѥa; pK JG+>2) lZ`~k#>K:$X, 0C"c/s8\w5kсYf9hr^8HEȝm&DҦrz/6ߚ%o j%&|Lz[E&"?* LI~?F\(]d =| Gb[pů#Dci{ 7 "+hnU{XxuшEh17iEW IJ85ZM{s6 Qyqטd~p7sf Z=_IN%lnFqBE[WqQ8҃0t9f4} H*ժqa7M#XW-2_O9f(< {KUPkI$)؁8 1Ml%V'YND3B5J܋`/[]<74[Xjc GW5yKRL@麩0z0$9 %*fg$,!mBrml/08^d~\e0lUl3Nab]2~.&I'.`g^Yّo$j5xt`N% n~Y[{:P3}G m;|ٔSlg&bƓ9"4i(#%xa` Z^A+KV 7/ॢwTGqnxBSY891qi1|}rU5Ead4!:H^XߛvNgHmJX;/V 0V$0 CR`4ĪSwg@WbaUy>?ʱk]뻹[n6zkt=ߔ f|s%xdĴjy)_8BJTLq7mn=wFH=h pzJうo-1tnMBڝ{=3SH[BHVPvyF, 6ӟX}C@ֈU?OH_],zUNY}m,cF_&~$3]Ѝ$YhGpKbvHfuC{joܐ׳ytA\>܋[9]LfW㸅qgzdIJM֟PAu\]߮s^Mz˟F@8pT;3#%M{]uֽ -2˾ lG#K)vv{²QNq6bk>,!SK: 82"4E~o?!t ~ޘ"1D7Ěσq>jt!5f'h 9|K_I?qCrMLIG}ްԁVHfsS9B

רn5Vbd+z3_eI5i@Nb/ӿ![}Avd@a?WRZ@ls@ri-ĤË H9炙{1jGJ."`qe9Gp6 {g8.?!J0 n3( aRm8kuHLr\JTꗂ.cYA\$e`0eS=hQ9{_[Jn1@-ĭ롆Y ֈ꫐l7j "ϋԥLE9ft20:_`9kX๴Ш`fl|j-[kJkmpUMmRl;*l$wE +k$T:W0u+C!iHK5G@K@nkѸ{+CA9{vOoeei tʧE ^n8Oئ`ؠd5d{A>:*8MP%S)ρ؀D(HdӅ,RQ}MݞwpXZ.zQn8n1z(\,SdE&r1sTխr܏q̯)QBg#ϫ`q:0s˧^=6`u8KH9Y3\ -Md=-j1CFcFʴ\{"2-z+?^B2 ohrtF8|e!${t%Biz8Oa)62/54 >sz.i%KێȽu|0 gLXJ(mv+p n-x =RGh 86-F$=4HaS LlQu@q-݃ Ԓ%VCpyF2w'x Rټ1JΉw}gk Z~5W-PcucKd $әg3 pug:&}ne4ɛ-`3O33)/!K po-.L`-|֓qx!Jj9m҃yʆR"ؼaYW7w8% 7{xtxwjDϒzm']x@ ?("m)>0v(ù2kUtzRONOR ,L3NozQB~A,bBk7c}>y  5x[f+B;Ж <xSRNˮ?ܪD2Ga >"Z8NQЉ%nf̏fIb[`G<|_N~)MnvBXٙDv +C 8=XXZ mݖa'GL@gҟ(M|$ LK@?:0,jT^;Dur~~`n87izp`_y%e5F`Զm/HՄ 6J]( |}fmݷ_mП|VZr_h@!zAmLjÁAfiw_.}VBYn-DE Y!9|mbS@U|eż0'G{U׾.U϶'y#uP8 'TE @xW`bƑ^xg i|l8^ؐ;VohJ|k𬉨<g7׃t+ZQM=7v0.I4/ [MB3ak;G#z]A1)*+oFiY {\Hō\O'۷+74 xmDZ5pj+aW'|SϽ'5SA53"f4\bi^3VG8R?m/:mMܽ@cvä4s\ ]nca4afbe7b ruJ?ߞm TW`,@ r YoVǮbM3`(Hi9e#RjE_w%U)_`N^wV/^_]f-y}e BO,Ùp Q$FrGh`Nb (Rĸq~]8Ө|9,kz 0+Q̻Pht֭?D[]};$NF#TBq&O;AsEfhhCB _Кpy,AuGJ"\ԁ+Dh:"a>90tI KL](zޏ0Y &;RF?MT}p?UzHh ()V4 r\VAƞS!w9Vu;)#C/Z/VܡE.MSm+?Ju $-X/WA2G<&p :s"9],?Fщ<ܚlDh(%s^nu0|ı6ly$mmଛf `^r6 W6YpR ږy.#WVAOQi5=0 )T`NR,qJÚ#۩DsVlRtj2_ĭWqqw(P% Z\9^kjSˎ;UlPL2|xR- `kjI5ʒ1xokSKZhGɱ`$vk\*|KkQ6ͯ/ 1j=vZ<(]zBs%$Ke0b$smq58\1 MFt2 rf)8 6u\++(I]Ś(YiW]6DSkY!$ yŪF  %YbGu^o\U ݖ$z@pƥ xvOoՖg &:oM3Q4 ɻ=] 1-qz$/2rB~ZwFr[Sne)fd4oox*YzCQte R7) t a(1М#xE_ۣ5 &r5Ww/Dp/A TraK?ۢZ7u|ouN&F ظx<$SK[f |yWP+ a v=+*: O/ l:yOÉp"L1mʖ_Dc9;ȸ$6F@89jf:/::0 K~*{$"8>3$`wQ^WOU~Tx`fiVL;I:.QMKb0 DїG $Sf J|l]FpHvct&O2"YZ4A!czU<}s&JTÙ{J~>^oM)u~lx4Q;,~m ui!Y\2qGhሟ䫶c;NO3x‡%{v%fo)qh0Mptzb{UsK&#7=sDѣ©a8!0ǒ*CHr7hTڿj o%*kiozvd@Ը?\6vd.RCp~b@4'1j`>|9ƈ-'ig2qүx1r3mW&im++h d2KYe/Ug[-BEjov6XGv^1b=Է[ /ӀF)boEupZ!}'|L6vb; $-prnO+bd| "Idq{ FXm[4(~ȪWOxm?`(DC xSXk21d2Lߓq%~v^3\EƥBeKQkh$0o3 zDU5԰ <]' gu@x;eVJ!;Ī/FA#ҎQD!XlhyuhZ317nrܛ!)3QF4сIznI<{^ꗣK=Zv>])q3Q.l\bM?xCז`BR*>b߭+J`ܔrzxD+βЭ+uyD G!'QIlhNX29<"ǂ=rd7׌LR51EiM򦡁~/-}E: 0GduJ )+JmOb|cw- @\F>u/q4*.QCaV5~'N%gh4_LBDIUbs֮ Zrw_τ0e[]F&w ̐Aj}z_z)s"omʃdA},b-F-Z=#h%y1j^f25u2HѶ&\:A(9WʸB K%bkm {džJaq3;u?|m_G 6DE%>W\+@KרL6~1ؙ%6 4q&_1IeїӁ\>J)vcY#R(>FFݗoq~k*6P[SCƶ0$vnV% abyl#hJ 69I3eJPX*|M#֟dڻ#n3nA T"fxv1n#S2C=Ԏ9ʂHnNqpFz3GMqxP 帑vE@ eCDF{^>I|t,zeQҗ3 7Ŭ0zp7jD~#Rhk~7WHqFseJpC +S!!6@jX H9YqߐJE١NZp AQ؈-`StPEB^?W\"Xt'.=Y >'M0/5W$u0έ6+0К*p0]4ȯ>nxeT3<a,nebpmP8`2,?} (9ޟ׿YN8}wF)Z} Pϒ); :5}KG39W!݉YHZjz+"Yu\YH:_ }q LӾ KitP4RцrM*[ > dh 9%~)FܰPfF`'ξmj"yWx2˷Sc',LKp6%_&>4R@w {}IY!::\:zl}g'qm$`Bv6CH-7yBud_,@ْ_𹊵3-\k%bHMa_s h ()L]g^O#NbD)Ff?G:g<>|-'qQg ܕ=ƙ X_P\Dqy48kVD&[,yAy  Q_ˢV}6Z0WJ|h)Qcywe;cIf.@@,DwJre]ciYZf Y-:׳ͭKDLd:xǂ Jv$PP jJpr7X)*ߏƭN oi.<)HpZ$ O%Nڢ(za K){0jJL%ބ eeWZ#}$cg,K2)w |@z=n d5\$,*:z6hWFfԆ*$ZV6nɜi`䩵c ><:kJEfH 4 HJtφ69/X>N@lNg|ފ臭g{&|O.9T'GM":FwڳF(}kE~4&SdYZj2R1nK *-'rLCTR*kZ*īNpaC&`gnTxZj'ʯk 3]٩6N8F9q;7p v+!D'%6JzF in ďE~o֌Pzѿ9eBajimsV'k}Nɫ[}*]7iؤh` 4׭_^2qe<uۙj}0:7cU}*Mf/!cW%^B [ՌEU>X9< 3pQML/=^C3ΎA:XO똰.3VjQNۣReTQI}@"!c>K+g'gQ'vGvS#LLU s>Y~_Ȱբ6ڇrX"qq=>߄b.IAw^=v&ib0 }UXtr|[\ \}A-b%(q\L6Sm&qUc uTj!0%r0oqh`4EtR3`wlH hإyǸ $dvG#9^3@ം>ZrF3kT IF 6{C{a`PCW :.~2 P5 rY9U;BO(2ZɢG9@̀Gk/@*%.>QDY;>cfs sԢHq5Q7_yib~# <: $m|׊%{^[v[udyIօuѧʤ3v8r*cSJ0*uL>$#a"e\ GⓇ{fe{ -`-$hN/TZj##j%Z 6pzRɜW6*]]QtΘ[[Sm \QuS̰4 /0 n\7F^As}317/r#-sBĔꝬT=|@GcFDD`ox͒G ").՜n60bg <)B#JW_`EX<8Zl">b~"ߖ@׿r1wH"6oOqk =4ы{]ѱX @u'nEY xޑ󣹪E-Wkq-o?Əms*xSʡw ҂Q1Wy m`Z,8C9%ݜژ(Ycē#LЦ&Rx䕏J:H-9tM#z6#x l9 |mkhp+?NP|IJ_Vi~rˊ{}SF͐ Nꕠ5K5XKoe;PZ 3gߡ^PE` p0:x c֘( RZA4Zڎ#p\R ߝg%i,7J&>N#(>- g*8 !'ͻ/Н$Fж0VѡBP$co( C-L@~xRF kiM*[6G6Zl([rۨ1]OY^&GryT!RqqV0uһ&Vk`%o=U;/ jp0a<;ߵAiWoM(B@2+Qb.Yd|S#SGqHM!B(T=4S"bvsSG5etNCp+vwR;>*5XGXe"^ճnjiѤ"z@+Éރ^P f$Nv<,䣏,Px< pOO@NȒ j6i_5K88P nZ K&2(7ޤ9jQz<|¬BΉٲ)׸TnW~u-ɩv%!{"lXTzі+,J(VA|HftJSI;T !qVثbeIKn ]-T:{X-Gk{/V@_}YRG2~z_]MN1vmSFi L 4CiTqKCl(/rn>]jxeKYF:>0'Wns}Q X@4\0;N@aGshm7ʑSҠKN闇PW$@g&mL}LF%>(.|8z9@߻&uErvX}w:* CY_}.䣾y <>mkا.N? 9Z %ѡ[t$pB ͔HPU vJqk&+br% qIpg-݈ϗ mCr?/:<8JM4af9/}+ScO@\R H/,Tz8j6 */km}G'9׭EݪEڟ`a< M X<1(q;^᠐B&],$wr?#ЫˤD~U8 0gSfUc41KgƿX-·eOE9Y8HD >1![ 3לPe)0EIqmnyy)MaVىɫsE1X[GGi4 P .`l,Dy2/,lF' * woh"*N&tk8IPdA_h{}3C $wݾj@ziŊJz<bP|~aܷ-}oW2bR4sh,xU-LF79z~&""ѥ@EwwKcyf̎Ċ?4d!Y\m"t?y)w/tů2>n'tVsBTcOz#T:]e;9Lm]n.Z";.v \fNDm[`ֲ.3Zyȕ+}E jϙkɚé_c@]Y9jHc.3/oY}ɅyDQ˗(SCm|mT4?)g!G_e2{{8H%eȇ!s-*ֶjoɋPE}o.4pf,N3]RnS`Im5XuC0_sVϼS^cj!Cx1TP0#J)]PxDuTX+ rLLl%M)@ | @yaQQ#?ڔX^wz[c6]k'OP9'M? NMFV;-:vSzd3Z\\ivV7&=ׅ9U Կy9z<` Y5adEvŴ"ϧc^Kt8@b]ms[&i%2[&R/ !"zJضIMTd2<⇽A?A;P0fP[H4A,^4Uܣ~#aԬox6Q01sscma +^ئoiȇ0_IM^G691y3o[J*9ZPƶ'@5J-c׆Sj'xΏ6^6-J% Mf&CZ(ѰU֔LClu~h;IJ*u'I@^D6qK,ߛ{BFtuEiop8Ȇe8f$7iKmp!lfy "|p"Tx{k'<YG:ҜeR~#;vPzۤD"oVDjTEX*[W&vUhnmO̳ѭR>BƀCB=O߼]lrw!J=͇L}͋8Ǩ\l{oW#6 Et(m6ss5 #:Bp2] ! \F q.̓$%%"^Pڌ|錨Sg/|W$n|RNΨs3 %Z_)%+8O]ž>_Mhb%Tn6A>j3w[OI F!| !S5rug.*h)=y_ mT aP +v5@'/ k7RGJxA6v~28plh;rL诉 ng'6nda@wnȫ^^Q^p:* /qd_8=MW@ 2-aE?#c sZOo)+ %Wqޘ܋#j*su{wi.-tM$-%a#%]䛭e坬 M_@O0גŽ8Hx.y=VL7srMzϹ<ʥp4mrZ_~A+6үj' "X'hD1qI &iᆉRPjF{YSr:!RB*&TL)AhYJ92US511IR( Ȑ_0W@71+}%djFbDWZ~$ebQF?mz픽3RaȵڌtU&nr+x;1nϠs8OWfhQBvۀ̙9AB!&E 북 )B-w">.f %s*y\07q@V,);磻YRof.XB4:Φ[~7\,ٵx-PU'ĂDl GavSaǀdfbXK Z?}_:dZ><ۓrt|-±PjAal_9MA) dVr{GM}r!?W6Ût| ~aEnluCj[KޗV fZȥ H]$1>~)ou8q}"䩪\ Ty ^R]l[e'4}lӄ-yYI@g)ڧzП AЬ,sBYE+/Ӂ8kWAKia^Ҟ`Hf&n@7=T8(AR1?"Nk: ;gKS &PsPm?(OQHAY_0~iԴhpOC@nj=XF޺-\j D#SФ&UVhOKf/]Qjh#|Ok vxŬKYԚveȺM3rnu3ֿ}]ĝx!jw >ӏ?!.q _C;M+yT+^Y=ә7as^q,eފт܍jy8Ӈǩ6杶`R8>r/ّv߁aU6K@’[kׁxC-M$^r;N~?ozngSch h:N/2 ֤嬲|MqSKPJcf݃%oL 45;'gi1n@oֱ^>%nMIlG4Ũm:AyT:nڀQ,5y !7m b߹4w=%/9.`gR)T+4JF.jKΐa!StkLk?OLOqME~0V$*pU$&Dl٘ЄQ¶+ރڭ ևּVd@g%M{1iRt4({On-@I%@~ iݎF*2#lSϋB._܀SKΘ8]u5˙~w惰Fp-;\? cH`tOSae [``Arw,mF+'Uhn,`ZT=}HLoK&L{fؑtj뇯 aqŵ& IܙN#˿h!Td H= ü0bVmdBa*lj4˵^B $׊D MPhH=+PU(؇6>]';{җ=IBV`78afM,H-DZ-hhapƠbK91cR=Mk1yvF_.HxcEKjz+CѠŹi6]d\;`/^%?\0Mn~-bw /\å?IN{98}EqFp!$$/?ޜLvi`2)1"9ϸ&AJ"F3lʏt0*mslnr6LNgI'vCCS K=jwٗ$c2UD+SM颼0ABOz"5< W BTG:Om`EoGGcոrx9qyx;/wD񢿉YJ1K*N.I^_s&i _/= M;{&].qzW B.+< GIlAUE?1v[qHq5?UKDL)`aD+N0JޓV&'} 'ji(}?91}NwRԟP=]ٱ~?CW>C)觛?i7)XQLXO.V<(E@(P`T2O}6ۇ\yvD{ P77z9P[p2cGpL;yQ7)sݩ^idyPV1j9OY;ZnlPx+&Sc$G-GKsa1sWvW; Ңyy 2&c3t h"zI ! @"/}B˃w:u#h,hj67[skY!ÕRdњ7%ZtAe?cy%IzG7©Als@q.ψu̝eH>(> A!M\؉DZV2@#P:$W@pE5qt% WI>D\殗RpqiP ysojb< b_uه$,i0]rr?"Vbqáh O{I8}]KmdV_r.17ҍYVb6IP9r$8S8 `rʽP}jzDɑB0EkC^hc:}}F^%r+2A. E05 PnMF(bq pC*XCr s%.nf};y7 P[E-Ӈu3Wg:9LIIs}A=*V~fKqv@ew K0+pRVKSV3?ޚ.RPo ˸_\z`' 1ƨWgɛ'9d$$S}&xJk&ւj(|At0$0+`LtP%m-H?49I30/ n@BO^^ˀmk(0#h5C]^*u79hzRB9Z\[wH(dj.b rFw1#L^hF|v2nHd;˳HqYlV%q𽮓ך<0䌿^_S<}>82 3NZxuVɄvz"#> ݿEW%.asZ?ؙ[\o-trA2>@kbo [ ALJTd𸵒F]XQx[;hOYڷū΃GݯbV5_KX+J:_LdGDy>r{'iѳ>Q,c]O$wT#X+oU (|.e384]ǐ͛maH9\ 5|[t0_ ۑ*ȱSSYZ/^ЪM<A]o ػ x3<a(j{z[gݍ _VpX6#Q/р"ƿhL%+fDDx$j}S=f4JF?UyRbM>ւ}af=܊ޞÆ=2}>$x@ka%`'g#30,t5fF,wg߫)բ bP.~oμ  d{hx@ gb쑺H c[qO*[yNBaeYdX0)hjTwK=tڅ]U wFM>$$qc@{iT|,H9hS6hTq&{$\fҎi~՞ڂE$<,2o 7eVW!i @ 0=?["X)D6v;q,jbr.mr}^|m7ݗugn6sS͍˕tڇ)^з>wA^ݭcf@8qzfL,`J ~l@v+*D1dx#zYT#ȱK,<Tv&w@7i&5=tsբ;FEWCUFRKY[~xNeӣw:@E`c E:ٜm!3X&b߫@45ۤA(P՟Iֲ k~/wFXD0Z2vy]o1^Q5Iw%P , uL֕*:(O_~CCTjr_k=G $L }<ӅU:qR' bޖ]*),uS"_ϟ!PsО=웘αsCM Rak&}ޔO"i.g2"ǟMQ4>^:#P ȏKd"Ƹba0,RI;"T:Ӛ=C#۷S>sP3(ɋI1z2 o҂_P;YrЄ'7iAF_ruo]zҁabmg HJ5_i$22>8x Ԅި_Ք>C K ' fa I I)Td;*QpVx6?EL6nlD< S$%\M^*,71z}UH'E xI`MȌꏭJ&oOI̸} t743QO> 6+] :Hu Ƨ/vW 03?#NJ.T-C Dm\]/Xh WMZ`l&\#L[Cϑ67)B a2jV=wUo#:^'O<_+~Y U=w?şy$rՖLIT]1zңHabtx.i;z;EuV:Ӹ | sWIb NQS W~RBP4<]&rQXu+/{*eJjw0Fix1yɜ4ŝ"E8!^P_/P|sdgDZxҟGfeXg+X 4U5Gљ)qjҠ -!uȷ-⁝3XTRTI{)E" hC(Y;Ae1P%*Q0ezuw(| Ǿ>F-<WQԂ% E<!5ڕؕ+g1n-Z|KPK D-te@>35,d cò &Do$K|qO,v{Ő;h|j\vtsKS_0;ja>^OÖGDuSǺ֭R4%X_ >g2ρE\~K:L"$?V/qNVC忊rÔU04,Z }^jwjeoJcO]ҥUDg JƀB 7ꁺٸbP9JW27*Di"r:-3!V bV3]N2BԱٻ?ׯ%O'M3gҺ' ];гZ>Lj>)i͓IQ '&1|Ǽ h)&y2n1&=93ghx12x?)pKye=XM+b[N#ו~VbzE8xCb0.˾q ׺M/>.ʢgFc"IW17@ Uc)l+5Y[wJe[7A.XNw!alҙRYo;R#ЏrޞsfqMDeuaEq_U-Fɰ>W HA@6p7e UIf%8,G>_>WMsԕ;AW 'aTb_8>׽[gHc[4e\yߒ%cJ4h>WpT[,pd|*GmDqM`[sG e\?BͩaIܬ dCIУslp{!Wf0=t[V0!=ztroȘ$ȆnFjH[gI+0䷲ϲ,!'(5avOY)N5SZKP66="jQ}MϵK)PpM7Pnecn^a ̚ڠk<WA݁9Qu&䟬` jĭ|/_DŽ+_ `_||ѕ3ğع5SEaL"D75).EuhuQق1\G(->!;\C  U MC>i5`pJaWQ=!&6b 1w"wQoAKk1'iq*ݕ^Áqּ-gWrSJ<L<^c}+-r,]lz8`6 _50J#;5N|dԉ"3JmCr5#ѵm\j~"8~J5î=oDzZ7/Δi$Zi%4 75qsU둼P]i7I@p-u["\O}oC4)?C*2ۈuFZ:Oad8P9|FL *bw~s> ๓ɱJ@XD5tOJ;4}KB$&۔s,(,Lx}{T >6`r:  lh?ǡVk|j:p"~ǮޟxY'q (}aia9YuPKVi@RR(LѪ| 3Y^J{U>E|DLD_(@Qe/$1N*PZxC"aN*&i7Kq;]mցMȔ>zi7"pA~:f5]8v!{eoWkÿ y&vVOƲR+|\$&XG-SN#j[y|TX( wJ+Tt~1!UB(04 C')Hyu o+&B,&k*"#7@a](9RBdxƯ&C%}P獍G!B޴RiuId||Gҋ@eəJ<1C_ABP}(hJF>W+f*ߗTCT9\+ Y*2mz lUk%OiK~lzG.C>y9ZCZSE?TBUYlT%7GG |1>1'k3yZnK=q={[zgL#2en{%D5K ҝuhǬM37x#s+l^.mmbSNd&JrX{E GAi'kp8IDؘPu')[E_!C6]J a~.,)Dt@ӖRON.DyF%ߖW@LHD,JҗM`&ShߛU@8S< (zTl <3gcﱰU t}omUoa {h)dr' ;#z)1 Y-az}wnBW-\\IG2#n 7'^`CxbE:K n4 8oJkҡyh̙==e7>512Ώ6h/Ff|sQBXgYnm Zm>Իsūp],]!w:%[JTh?S.Q}bzQf$)xb|n;"ا %Z~pP*`:rog Y;m H$< 6[iQs$S|f<Ȫ/̰Oj.b,a#p 4٧l$\'p_?pM~+upeU@#'OM,MyV3|{b$VbmZШd??z`-`ByKY,*{Q4Hٰ $t,^ķsjieS?kxgٲ.:1b. 1b"MCf<9Rt|V1xw0}Xa&gN%Ā?gUS>B19Zm6)L0+_6k|\Ud?dru:|yO.TYɐ#Mq,X r)8zB&UPEL!Bz()$@Zaڼr*iOq0]ڡN)2VѾr!|I&o*d`o6oa*9%6"oU 7QJO4bZj&|m au^BKlpK|m8[V1%(\ INJ A= P!O꟞-':-?p#T oɂq& xP@b.9:m0}43$tZ>]!z}mA=V?& 2;3YT{z>w2 LA_7v8b{c8!rC>]U!?5Uhd^nkbh!WQa'v@.Nö‰*nX9ԍJ sim1Ql$[p0s!P»s}z˒j"'!nTKK'o06-e;8Ɵ uk9>22e(xŕ"RC^Ut kwF/)|Ϋ>_xeQ32n/ 60 v~2ٜ\mʷ=+kcZ\ɻK?ʑS;S9n@#e>vE<͔Nj Nv5 VސtycFUpaBZ^,jq\Z>#_0T ;#ybb%-jYMPyOAg"$HZ@y]:8=bƝ0vPȧWN?gkck./lUjANdֺ֦g R.1UfQedeHh?cF6Y xŔnI/ڽS"Η\`z4>"6oB:xxA1A9Vv!lz%r=[[7gh_o/?5IJƬ?gǼ6?葩&mdz n4x)-2HUxL`T6"J0gJ,hM0wwo|Nyxlc˺.e?20Sb_9{vTvjktNykrom/YBpxS)K}p"_e ςdj`!%3[A~kxg-,V2*-blڔѱ݁Gnhb>&_!,,#wߏN"*hlaY`%y,q/A?[X%(XyeR&Lr:*V瘊#?W (,aMW~ɑmHQTrv$`XEci'}/O=k-j>[L۠׀ ~x8/PMa{E"U6Ao˭Z2%LH1fݯrghH;:Bm)R~M lّYa=)x)\u Oaߜ̣=P1c9rSvaR&Kp@ˏlB/p/U [CnD*TC=ɟ †5*d ɇb>"It{@*/qy7^7NPY+xCʐD( WcO M'vj寉`Rj:$zHː:2SP3yHGZ@NEίXtO`LK8&h--˓ʐTQǑ!u5b# 1 ICt3" atH %[;ڢzN% j:y--5!'lU @~s=57֗Kz${i9*VͲ࡯ѱ/88h LQ;dx:+*TܴZ=w _uAQ2]hYl[S%:T4VxJ!5θ 볬:L{XP쁫am-iVw ً/1J.,(DEz*}.{Y5r>+4~G/K9e*yD +}aWkQ~r:vU57HQHJcJӥsw%x71!XdXE]VO}|1t?%[w#2(t7:78-Q",2N-h&bsA|s G 5csA$.h`*btOLWvH^(4W?mO~-JÝမpɌ!wQ]%aCQY ?7Ų|z=B.ʱV0ۡ@S@-ծl1ǥ:M}CR@dP oG1}Q |ՇP 1爔~r~۪Ġ#Rv pȮRhnӾ3)~kd]ǬL4[Cx$i֣Pr0͕e vq6Mh!ff|EI 89 0dOL4U4@_=;>5ȒSkpܿCުnxy]E"Av r?Yhn5LD\ H!+(3~;?WfC9 nS:V]DyUzn?Y3ͲhP2rWylT3_+^y49Iw+WXԟ CopEv #"ډɂ`'鈂G5_{XUOOogz7g$b0 ycUFt5|F ˁLL/2@hz@f &gJUm>qDg$ g4G}&V#JV3:G{\%oLJY-b 3HPm,JQ3$뷴PERj fj:=kȘfse|jqF[|M,ס?^gnD>u$I'T^C07h:D1Ƈ#!R}Ffg-ͬTqX$ۦqо!' QRXKBn:T;v[r]-e =O̶TI7IA+ҡ=̧`ZuZ̠|zP9ڇJPS9$ԉۈ̮kc.7Hbt4冹h!2F3( +g,( '`eD|Ԙ$t3 VğcnȖ&|fbz|0#LiA0~QX}<8!́5joIx|?O4mls}Qa\<*}eP{BB_3$ـ*B35P&%iӊ^bp9ݴG[=,ͤ`இ 7sQ6,V˰LF``!:cf ;8wRܛvNȈϪ G0hpº8-:!,ћ6)Ksn' h C9mHlXFA 땕~ꕙg=ɚI}j<7S;U: gжf[OugFJӇWRznҙ R9{+B fcP,Z5li_1d\ϡ# KB4sfв=Czm j}̊^9;lgT|,m噾f1`C|!h렬7.A,pxA|-%~%V+䟫$׵Kú:!F*@OeđFM v1!=\ ,lcz3B]_r:I+v!{ǒe#,뾬rP׽()}.n%Y+-KX/446y?K43tSŋZ˄4tc $`LVw$bh{fV5? I)C\ ~Fz~dvJI4>Qs&/VI'P8Y9Zߟ_j;k6TqͥbRtM3xeKYn޲ALi\^]1M?¨8GMٚI4a? .y3V"v;,6I xSzOf[.ƈ)[UYC!#0O;B/(DF~vѯγhu)<5zLi?_\uCcE)(eL1q f+0zF$63]YADM5顃#^!J` m8҃7-n-ӁTz@HI}rVtrjEmr>i2/n{"2) [t;LY~]Pd~ǔ`fz:hq^oRoYS~E է+hʂ+I}^Ves5{Wb I|"RQvܣ)-7p̫eg*CF5)Ru˴ē4 "iG=H$ F nǑ[;V96xVd-\՗fhy:!0pf_/Y'{u+"~{Aӑ+(3Yy_T0]޸e*VREO}Yߦw,0=!.bIbkۧt愘i㿃kHE  8 $ ]q7ugWLn]I6X<Esaj b_M%$V "W̤#w]TCXRQݯ2ffy%b(Kcg)}02葟eUwJ2 h+\p'mBQWr4IA28iɫ&!oB̈́q1s̥w*@zöڔg6 lC <Ȥ;kdJM”In\T]})%>_=LBE"`U䛈a:/ݽ=+ m->cS%sˉv]wSJ R0s (ww|Ç%2x$%)n( - M])`>Ar^!@o@\GfyA8`St^s1 #&ϒ OVsBآ_u.aٲ)%p\W:aYPo}ô(:M#c:׍DTL*`'!sXTW| gc;+Z@iڈ`A|_^ DblN r1Ӯ&)yE~v\ tk Wk䬥^ K{izb3$ΰ3FAWxvD~fWM̚=6T\F@ši NQ&9ͰNjf4T,!s;vogEZP@ 7E0RTNjQeZtϱ_Ulq+ j$)7QW>>"^-a ŽLDIAHZ?1NX8C"8yEQnǫϒwRHnJrc͐0tZCjQn~H8]ܼۙ&y_,VKrmb\NQwYuRo7"I5<|DadP6Z=E@P?Z2m V5 AV-I w^6}s "Q&F h;:_N!;WUEoFJ׽܎gAM\ߨ2[ǃ2i{[}bNMk\jEry҉}~+ T_$ZBB-foC/]N_P%q%A F6J0Ӻcbu>]4TTVE  \3C0@ azq &,8 z 2"]Ϣ]іxO$j+4 [&e\4 /r޺vQ) eG6S6nzAH VGPX+${7jG_HuRͻZXbJFju4Z!/ a9 ڑk7 kXIBP& s %ũq1X"]gQq)Oo} j(]Mu6"XGe3VQE%qMzKk2hm5,],O:'~CjkrXQ'`TP)9MGsTm, tI6μvn!H]r)&qiM9n||DtM;Sj=UD$z֬HN^?IY?C{N<ykf5[GpFwk 2ff &rwgv|X1I]r浑^% v.~:lFI s!+9P̝w K,:Md6_\I$$EQ_UA41|<'Iwd) r}VTf/1LvWLAn|Ko>d/$ ӏ>M/noo~,<cY4nF*SQ_0kxiDgǀv:K+Pa) B?Ã`Ճ$&WGt!zkI#>I˖`Aw H$ro㾷t JQ.$^ZOoKa͆6} g^XCiY(LsiHH>˶6%mNVÔ(Fzn/kXXp*JzohK `.Eo"߹9#mW? 7+z b+J`v3 YJfDPΏy׹q6 DX`m7$ԒJ%X#9P+5w|Zq٧Sk2`ot r+s7\%BIcC\.i\c(.F~lPxLbm[Zd3 wDoY_8 ?-<I?b:r!Rxp+-V}%/sE7w4P*dwH*k˛Bu*@hFX杒KYF-F*thK]a:l 0'bu=Qz&K"2w/ϧt,S]V3~!'G6Cz^肦&]#5=M#|"K@% ^Yy>yP s\]jc 6\ݦ: %m:%H2,-ɑ-£%}*Zk>$'$WPde@pן8+|!JN@U \\VKJRk U ɓ! y>j #k)rJN8,y:arNCzB$Sf|cA~cgGc,%9@T eK M*42ºyz.cI@& b3M<#OבsӶ Q=lXv(k o)&a>z댫KOa=igh[ 43sk[ҟb7-˶[fh ^܈`:A ̆ 7 ۊ64D,  *nw+͗XH B_Y)R߆ ]`ᕘOc! "C.‚b$Y 9U+&=/Fӯ/Qi5Fn 9(SNdEPUEp'Ga!N%h#m_)xKٯ={U$Ɍ0EU6H7~"$*H7jXur'lhzq,`z f56P|ii*hSM$Z3'^v^FHw7c;ݩ5BE58@}SQ >HH5z qLrЭ}Mӳt1s^VOI YWpJ])YNi4 wn'7VREڋR@aʸڙ`v 2)\fĶ/2[U ;}_E2Obu7v5cI.H;dy+l}{1]k0Mۈr]̠E1@ձWV>06!?h6w۶KJFnXI7~y?ȼ~o98qc3Z`W<=c>|!7-XK>Dgw6u'@w \j3|ws,Rhy=%8!=26.",шK]5L\<wӈG-(B~ǵl[s`0l-ζM_*y=yMn:RD/I9Ģ7 ~i;X/TnfBLξ({-H y{yÛ#=fG˦&"סֲIjq2>.VFģU9>>>3P9be>l{3%B' wIsoB*lSނіcԶ2@EɾbwfyO-JɄiW9AeH"Ty8]SX͠KR÷HIΆ0<"Lf<[34Њ8Soc_T4ѷ׳)ѥ``Lə^ܐB 0JJvZT[=S̵Ñn& ʽBoڨvum/y^]JYDPA]!.#q7@HI9hz yA\鐔5wwOw,. 6SKGHQ05c~D{ɇ:k2R,}:ΏPo {x4ǹu~}MZ𯘸w9Uກv\lk咢z֩JXnNl^|TFP*%&?߿1)SeYᙌ+ib Yu_NѰEδ %|ޑbߋqhM:.P;RE`V+~X5r4?륻۶T bxgE|1@QpƣLJK"߳sMδlrc_&{PTS9|geTH:J0&&?=0Od2P@ uO:c,`I!>a )$9p uigBa3 90A's*i&fXꕲ:?',z$9_Ȋ.fJ1Əi-Cs}GrpХ81qF)Dc4C`KZ?nKĢ4\,ϻWƄRc<[2IS.{Vf#٬h9 tf"IDߎfNuMW9 h4IJGhy'yٟ *m15#*5__` u}zw$j W<sWmz PW} ֤r@Y 㜥lOwyu'vYYcJm$ۗ&|Se ;5n MTB\* \jN4?}SK"DB*560, yF}4}@3 `N*wBS9wؙĢ#&8]nZ<m!Pv1R2ӃPɑJ`)LO^,xwڦSdR)ڼ3wVP W@p%ֈRo-WU?;=r\e +B0gC`&zG %܌7# 406I#fJ+rvc3+i8&@,uԩH59b^hSm#]kȠRPws˻@QP#1XW'3K rʼƏ<"JN'{K\xci]a4dc!lKr(͕#ϣIq)4ȑEfI|ͿHY 1=`}@%ɌI#oHvx&SDMl=殶pâyhāM,Gz1_Ű>E}ql+fmQok_GEnxp%w5Awg}C͇2nP% rś@^av;ڥمs])#WޚJ7R)Ll:FũXӢpy3`J 'cҽkkToR`)NT~pLcldXÍW`3ɓ&{ ~dmȷ/ 3]/f̮ Kz^xD~"ӯp?Ǭ)z/O{=[hdvHXd `:[]qO0h2RS¢omj)|(xƲXcM?+bLLNqQƝZ8 xF/O*WpO [wv$ 6IsF*5 pYC|}V{(퓐MѸbע)`UƊ[= )<9W&]wÜ(9b3DnUJ$v /+< xPdqg$bަo 3F0XIϰAU}3]+~rVJ.cris`07LNˬLkS %nֳTkqybqǁX vw"\?:Iyp ^Q[,ɩ6"m|YvzG@3JusK@g_1tMw `s28^Rib%P,f_RȥV:YTӰj<^>+ZI?R(s[n->5&<_d9+7ޣ/J@ FeLqtMf7ʡӞL?g.0.*y` pSSB%jQTpEH~R|^hg%xڱB3ȱD{lHbi^J/,26 gY8꾿b徒)P}*ӫJQJ6ҡ"gv>4h#>P.i$W:e28+Dvq- ծaPwŸΕ>i[^ 1i @`*GZ._${D4_*|m hy FIPcNrغg2;>Dxӥ##3'Ѿnes>^(Cf=\?H-B'Wݰzw"xG^lņH>`YWjHx]\.z2---ɯmjstFe~BV4Fm7A;s],mFcsNv*TU(\% EBG jwBO4S<7`\O_1jc|"?NʅI4} M?(o`'D O͍7M ՝?)YCMMpNe &G>\P 1Gۈ em7D^O+vWl @oTd?L^AiO)C;1k o& -U쵃+pfICԁ&Y^jl |Nd'`5򁝰t91l;1#3TZ4iHhl.ab'pB8СZI x͔2䘉w4:/Oe% +еP|;uxw=xRjDZJYlR.$c$.7^M tD)u#f2wbl#@'Ͱ[CQc;Z=$`.i7pW/UGXuvr -D"zlg=MF< tM4:+:XwNc@BS(@wV:^! J 96$4t&a;"b_5&oI:0#"1(,XPs}m0;m"NN H)TB:+P`kY|h ^n xs_ӫ${ϿvnOP7Bˁ|>xv (uU[4l1#6> <09#ڈ4?@ͣA=|5`^%ww)w3VYOl=9e`=N&Im0_/nMr]Zq ^xML4~ Lq"V5Oa=;PwK^&85ׇs׽[p'/#$ 1=멀H_ʼ1ֶD^D{_m׫]ZAYJp֗?_kh_^7poR>b s^tp%X,UASbH&k*r/LS{Q/eB}#=k6|S Qr?VbьXb A=c⶗U"D:6 x>4ā[Vi݈˅PhFbN+nj}\#d"OSYSʪыTr'kn]^|eM'&C>'v\NG+Nwͷ5.ڮ8cG7Ǖ(?# ]/'kFsy >KCq]}c4l^IMe[xt Mbxg.)Q/$O#(J[M/`]jYaZHJfoU i+CsН1'f_0:#.E»2Ʉ\}X6+XoB9Gʵa# =r^jzZr[)h -2[M eCjˇtv8 aFλ`}y#@U:uq %Fy5T1o.NXGv&|ى\^* P : q%A(Rxter L Rm73X'X⾍]"f 1,U־rܜ׸i}Gz ~]:A޺jr0@o2YWww47*Uc:ⴖ  T\+jjjlBtv+DЖJ95 t됡RKHEA5 ?cec%X@}{?nZި(V3ͪ b6j{ࣹV @ L}{YăDjz<չz hs >NIC7{}u 8#5|i#m݉u[7]j$ڊ"+hlU)Skl`kE@]{@PU@.!PFY7ܻsHoف5Uh),q,8Q\ՕW< UFB2&Fw!eN|t %9Sj0r&b1ۡՁ!H7g,4ό2ڛf ;oߣ}H; $ 4Y)0}ΣaVh޹pQDVonB~ˇ kƚY@¦V峲ͿOFqUn]5^H"I2Ab^ӣ]!X7W[h-t;!KIK>5^qxOXM0k57;М,Mk Ҽׇ)gwynTxqpåEnkҩp)h뽋LI ~`<$zSCFGghM Zp/ʻHqpv+Vz%f}Pg@>capq 'WL7$-ds,rSSUv# Rp?]lR Vd3y8[1E=z @(Kêଗnt,i9w %'CR"$5ت`Rv{B!5VUxoܝEQuv\;t1&: W\8=fT3nX5NbjmVuUm8P`# HQ,a@2O ey SG%t//nn/۾.awY+{1Ń2WO`7yÅpȔ딏}z9%-Oڽ=mkz[Y7;l)wxt8qU=X]N>,p(ǟyonn,Rj =3Nk#W`DeI:7Tu kIlj!+eadқ&eWQRBYmN8zϿ7b8X3N>3%3in٬[ݗQ͏h;iO$RJOy##)Kx߉y8`^NCmfEK?% 57 Q0mM]DҳQm;OLJ;}C{Wd| 1qLE#PpG`5[rp\kR e|ZRP7\Ѣ}r|&Pj[8vyQ"bk􋭹vq>=:=GX}\ &i U_`5kebuS=@yz7U;B$G//VW18DavpPb2uspGi,<|lՙFJ9K[ɏ6fZMesGPD4C`yDq9Y۳Pk# p.nBJ3BLga_sɀDipO WGԠQk-NҬ qXR7_W5r|MC,Lm%| h:gv"LMXFKkLv׿ۡgf{{U!!AAZGQz}3CdRQwevͅفw-8G& ;Z;qQP}ϗEǫeC1,Xu1/ 6+ 'I0oXމYmϩyN2˅\΢ CS"ɨmyn!8|B jNAc#nRRë3(UڿI3NQ/bBA]OnF%~Ga|8ڞqzQ}dAUl<.Xn uz}؃:sQ<4U^i @v=9G5lِ@@4(oޫxcӷhwJIW̭R:C4: }Us4Yd7-֪@>̀laߔsI7;]2iZwiyV,KoUU8N.)}uv6fkAMh@{'%K=^S018|UgiGPV9[g63zYvMBHS ,v<ͼhH Hⴗ[dHhs['80.QNsZe^T\ A; ^wR."sG[RseQmڬ/s0)?NSFl_m:b{.H{ĪZc6Ej|!>}4l_O]7T/9ǏFӌ}$d<V8m'D㝭нg?sھ|Fq`բZGQmF-m/*k[,^L42J2Ztn& ~{X1k"lɸVMD3skEϻS@=_B#mLwٌ*P=j^[hY /Ć!#.+MWb4ȰP҆8jg q&wH:fIVEH0]IQ|`l׬V^ OwkVۭx;U.4S2ja]Ig2:g:D/Xܺ~]a'R޿y׉ ?]0e2vU6ib|ikc}J 2z5K!tq{~gxzN/ĽN*jW42YNcQ[%,fya׫ eƛPnxz';Q*/?TZlS]v9').G$7 U{98y'3w: N'> U-4[DPCU| ߶=6JV[2I:<ͺf! GʹkO Zt;V91[~=G$UFV] :ʮ[*0+u,(b)j5U䌒U2FM{թz]AP޼+9mV6/c2sAẀxQ˷f=ZbH_ 岠!wTg\ sTdSbiܞe5STsR\/k[uҎ CUH00L#|} G ;Rfo>w]{1:nBFWdBH=_ Y4vk1t&rȕ Ҟh}{xUfhn"hc2{ qMsʁ&b2._`Q\fr[| W`k"re.vT;Iӥ 9ܞ{Ubgnuqe e٠f$(ý~#ř%T7"2"3i57Yq,haɴu͡IYDÊ2HdpI/]TSoQU^ojM+c){^D:CLWkǗد|1݁TYl?Bu3gL#jk2 VOSfD+~n z6D%Ft`Rϵ4%O[u6G'"b弮cCZꡬN:S[o.{`mI.B$FPBypض^Ҍ;aoRV%{ 3%m`rv ءx(:ܣ[MhF!s k|AS#(fޱ-64x{Bz;JjFWUW8GOm. ^+jh8*f,nfc&Z,UdI2v*Z@TC$0҆w4R~G>5`q\ F㘃F1t}gKEe 6Ac_k(t5=GHQhBİ+׎h_N-Wfiot%bJ]4mZ{n)5TmfC2"dE~#~AonGb-tKNJD+K f=8+sV_q,>[|F Z`f&+\gd*?DFFbkdTkP0^"bĪrn;V!_CoF]bbw% ٳgaQ N!˳z=[ *0E!XԻ:VI5ۤ !p"D]|0\ !2sE@UE~i0gy@@ ] *A\0!9^ȃ."MƜ=<=%._pr u{A+= 6nvrno\hѳsTYva`Xe)L)=Nn{0fZ BLN. ީO;ɡxACo sR b}H7*DZ78CA{}>(`p]Sa-4r240<8/G1϶ r" AǺhZ0J)ަ`5''$faXߣ2qT;j̙W36 ,u bđɳc\;(ԊV]V+A/p5LHN,/oZYU9sz(i⯊wo;$G>g%) ŚKst6>}{H+kr#n-vCDzYLxvt+hl4k֯& yӞ[Ufk Jr^`xJϱ?ѵy!bn [9B|j;Ѕ@L[vQXj%bNہ![X K4j@ٴ*eMړ Yƨ@o/JPM'w`dV2R&]`տ'oU?MeTzR,;bP;=!k)ئjξ)D*?TGs"9˯' H֕9u%ff{WF=\ڳQ:𶖜>LL8JH#l-3Bc#p`8rG!H[p3u ߔ@P8E@ql/hee"{P4N2==Yyڃ)TuEJOjc|A5_z攺' 5t*@PC%p1{ܴHBl[Y~c+/\ Cwx>Ϛ́dvi rdoW4VyT[xk:uGG%`q}d a%P%a̰۹1l-^9,)P?jȣ(Q5gCWZ}UOHJ׻w#]gH ȵ ZW9f $2ƧV6 h- W>|L#eu|J i c6"J]<hڲ II񓖎Z!tc{.NX9ņ66 B2 h "4CYNZKhV'W[ $)Ruܱsvެoη荠O%+9w5[Ґllp oAlQ[̶&,._* :m`qF̒FBi!bYTF庿M%erK:$IP/"XnՋÉYB Bh晜u*CE:\{PeZ_o[JSFr.hƾ@u%G:Ar)ۼmXSG)+AYsϦ$up<~QIo#wZۤñw.*bZ6!FʿF~qL.rJ="秶m 67]'y?֋XJe}hC^ŗ;PB cU \)b2-J\%)#5W| ml!L&Q0| {c%l:ypа 5[M|j4f|xd5iئ@癨&n5 <%Rt*A)-dJ_D衂K&Y}&V&ƌA8m4M{y6#6u<]B'\m*e%W #&N,EsEȂRcQ~.sM_:1 _!x^1>7v3 :D]`^?tn) oAZc ޵W^Qw4 !KNЎ)5 1iw{+(w- e:^)e[“EigϱD#sOELnœC Az!ٟ)X0cAO6Fi l{aaFdF;SnV$Ь D">uRAQYk!F562p A*Bϓm/= t]qZu G5,ѫo]Ql7f6#{w'z EٝLxK5 bqX(Ly"vIl 8KI2ANV%1;cKEfmHzHe H36( ~v-]HuX8fWOе 1AHH!Ft ^ nDo|S湱nSv}11P]V]:vϭ:]/%c3DMq5E|qLH|Ց8KU[[ywmh02{MTgEV6~ G 3Xdh3S 0N8dX*6;CB^I \Dj\ ,bZgeI,\ _9VRhl*4"}<"iޥjhGRʭp 4l^We5I`1Sg rH`c"vI޴#๘ g0%4"tK%ebUXЉBV"vA}rШbBġl\c`%&GС;eD,2fXi"Mf &YBFW ($*v 0U&&{/`̰C3T6qLM $CL@6$h:8T0B*HIB/I&@_1I 6i$I"i!C@ Bma !" ENeB sf$66 'h$Ѐm ! IbE@V`,f$Yh-&!EfAKB3plI"LvD4 ! 4 iBD1 `m\0H $fm$ !  0Ć$x$Є6@h ! VZJ퀡1H]S@%`" 6!+Nv$ l0&i S wHтH"ݤA z`w- $,B/$W`6!"$.R!!I4%|57>їA4 ֤Iav Y9 'q|014H£V(DZ髖> 1gcj.k0 %44 qB-1Qz]nVyEzgPնMy%vѫbND @HoM|t+D(J(&ZfU ʈqoiM` !Pwj*i;M I$ZN'' PcqО PN'E*I5 IT7NÁ#Ly!"HJh b살$ID"Y "Y*KȼVJx `[JVuU)DNefd[Sjk#ͤWoWnt yUX+!&1 ݵ{\Cۯ=HzWjVh=H/ iiI`~EE>G~ )!lUIՉ Yffhn7:EdQgk64ZZ2R&v'(3.jU][;ZR`$"oQMz-PBfکMĥ^IV&@HRy͙tEV-q棍#l&I sBHy!$-! ^BBZ_&B : @q.I|fAbBH/h p2=CHf+v"IѱR,I$Z$ͣZǔM`[1i{I[' \@#RđO5hy4 Y%wEH@a4Hj]GH<$-HIL_Kb^2(ofqCII:ZlܱK8%(0֐ 4/${kHIF@ GK65[j{2`F+a Gi KhMN@$\ $Uh.1L:!"bV1!$$ˈk4A'@^f3f͵+m1Uci i&*+?%5/ uh$@(PJ^' yD!.ى i m :$ AK%&6@? _ )i$hp4È{24Ф 2 SE$-WiLXQ_d2O7S"Fi I$7fM$T`:g۲Mr #e/{Xh4[4 I 3l:Y/#҈b7@3@97!"$Cm@(1*XD4慮 /e&]S:NKQѥ[VIa4εX  @z81 \1VR01Azv)mٴo&4,VCC5M-y}eЁ =$mHIuH) I͓]n Jp `!?!&N ԘS.e~5| '`uUx7}SMhA b dعƁg؀8ƒPBC,f!C3 ]6ھm0C.[ l6(dۮMzs=lԳo-1gԄ?B'a#H"s@RȨfBЉP$w- h, 2X>~9{?6vtiuMXodZʰn{b.FAo->[|BABJLyl!P1A m51>#߱%uIԅ&cs0C"XU3iت&!X*M!yLJnM@6 }gi$E#r|_[$*H-&eA&b6S1 FEFɆe ܰS !nQ }8&4*Z |!4v, Mᖡ~~SKMc_ilV-slF'l9H0eܽSBD_<񜄓,v#Ȅs%edژ<CG:@nUX@+ 4cb?Ѝm0x7 ?KP[BLauݏtEvdi&MzI#шo`2*PquL83-[a La&,LZ8ͣ q;ug~9K1gZw $)qKqyd-T$ :VBcI(*ߣ;KEQVt6\뙭LJ'~MvƱc)1#&Cllmi gm((ghGb-EZSgEBnQ)z&#nF꺟0v~ ezNإwFh3n&r qަH ϵ! jeSGY*K t6\в;DrE=_|"n^\oȒ b; &F &L.* 0L6('38hǮz~[i/$ #ow%T0" qm&6bm14D NRG Jh@$i@ cpyt"bΔD(6$gI75sד:F HW  R4u__n;_@ DF|˥"p+R.xK`y!d"KK^Y$KZs AD[PWMٚ@L;6SM:*XcrZ&@_[ e:𔏗BD@o 0{s?8Mknb:T4RʂRm6Nfp0|'jiVw S@ BBmؑ"9/DDDǃ1/|*|;޻: JEO=`zgH$QO |bLj3y)9ǏwSM, ^8—G {Ilf8'0(0)vkXAU {d '|[ BUdHή*S1JzأP5Haa˷6įd64L 97.%9O/7(Eh^ $)#*ӵͿ0,y k FRz JPJZKek/:/}ޏw{N/m7L߯c}?zNo!u_Qlu?{~ٺnt?#w{}?Mn>w=_'{|>}>/|?{>_z_ǯ{?}>5X)P3{*`VK0m$T,1 Tvi ZEbb}&0~ z&:䌟~ N_9?;s!cl]ȿ/ڝknZҾEF bhHYH BH=3Lblm.Ť2(h3F&K(3!Ћ  x0@z[*HZ\4#2o]HO_ ,4%i*H!vV-chAC@BD͌)0i @xxCb[)tv> wx[3>^4艮' "7ђiT`>ВhĐUchND &1. d&jN6p@ ˶CCmcD26MwXЄLsfL]@Wihy6M$IRб/S0C!$_i ١ ! $Ve"y`bAlĒ`Ub!$ @[6\V.4hAH4,V$tZѤ EIzcbhVRi ` cH4^W^0Ȟ9<)B (y,HF;AQ}VQWyvZt 1XpbIN$$ᜬD@ԺY>sQFxRjfKOf`#O#eꚹ 3O4^9yI9HS& 7H R5,HS0m1-Y lYꘑam +cN а"BH @Zx8pi\ +S`F@ , .;. uZG[!YJB+JӮamfp7#z&oK4'h  +4,H$bMD0A )Aƈ!!!c@1 6M Đ-DA  cD chcD@B#((@@@' !(ފ$S B؂@IuY `/I!o/w`Χ!$f@  i -4 B*BA1!*׵ąͳHj١$$c1w9n.sh7Eke d]Meg&E U,@aYCI4д !JAħCm!H`aXhlbi m61cmV441  ҩ#) 2J41X!ɞ40ā -uHi@  4D ڴI!=^T"يIkF3 \lђI+MnpT~ӛм]" `jI X+Ia 6pf1Š 4T @"PCi!!%bJ.+A- IKThԳd-An8=['xP(قܱ!/İL@1E 6 # {Fi Vn؄\r$hoE,'½ !ۆ eJو m$# 1Ypb D! a-FBLDAi7b"3 Qo[KLpf C0ѵZb [Uopxջ3fi aw. $y4m/Jpv 2b_ 9K,Q k!,щ&6ؠicS6;bhk H/aP_ašԱ^^WӟN`fNջ $`#,Wt0,A>W@_#0LF2u  ;iF#hH1b`WH̐ZC Mȇ `D5UZ`CEF6F ;HeXBFS@:˼(Ն `"f`ydĀ98s UhH/،LeeF l  o| \Vģ,҄DB;&C/b$n̅%¨,&8H&t[ZM Z@IS2"SKB9 +uɒ"2/X`w~ v̖I$I iBlHM,fJ&WXi:HBWxVauu\'*qR &UHA0M@قhlM KZJ Ż%}sfIMdBM8~02XFȶ@ZbcII] X-:* TD%`@HB@$ŕA  bm68W靋'"3v*&\FY+i03z*a`mm8a5 &%{7̹*lWy˦`S>y![Rh+) xL-)IlLdD46C+Bc0fb@^,UyL ?kU틩$3 JDdBMb&U~,_K]0įbKib  >si%GDDZ C(hmވEp$m6@5@h+0EuBڵtI*Hbm BLB@!$% M @sJ sg.7]Lc47PQfH2C%ڱmo$|):8cͥTsWV9pNdU,[Faj}Vb5ўvDˋXhKFH3S401;b/Z]kbj4:TD-|Z=A4p4IƄ[WK me*Fbdij- .֠Pu_Tlae'"ً0ō ^<Դ;!P˦cڈbe!S|X]]v'^an–P'q^1 w1d Ym!X-Я 9 c;mzD w DF qEX.U"6{) ^/fur I;-,euRꬢp̴uiY[K' PD! 0Ą-)lhZЙF٨!5ޒ(I@B!q @$O* µn)?h@mmmmmmmmmmmmmmmmmHe"@JVbKJ褐6,+w2X jUhHŴb!Z`&cv..7COc|KǤ> jJ @2#'rLfH[wO}ٽ|DG=ߓB:bqTf!0B|NnKf2#^9A`S!ڨj'튆 "ej3\sD*"%DPԊF$٨w *rtĪ ZKtj' -G|``MܴqVvsLT7?|7~v}uF`J< V/8*.ߕ$+?&{Aaž5{veW}fCo5֍g|Qœfgb:WqkkܯwZ您C`џhFy2dD;$Ē;f AC̻1 ZV؛H`! %B -]-b l"hh-Oh23A&YvN.Em lLhHMJG`$HH K6㽤 J_)V,b@ BBHb@T1 h@Fı$$"{d#0"-fmCI.jLSH&a HI}0HڴJ[B hI6o!a1"DŽJفx)BX%Km @;i! fhZ۝m D$B,BHIە>`4!%Q؂`BDP$C g݂U7 Yg^;AQ6T`R 0&)HV"(vw(4EMˈVd"AUUREB *jhА0˰S@f #Ev)4H˰@ S4o8a-P$jn CA;HmIVb@JM!u2M 6HiCBHa$)R @I$i@hI5 Q" «Ԛ߰Ri&H&hI!^$ề%C@CP/4bBi][1OAP6!{̀؁!LED@n܆@ i/kZ@R];UFCX E $V(hF^T4rm(؊a Ui$!4ki+v#b$ϴm- мhىIBm  03 Uz(@Ui!]0* CX m߷a&D4 @1C([M;D@B$i$ZrEq7 Lm K0ЀRhn Nx8RbBJf-C]2kQL6BPfBX㘔Z2UY 2*b"|&DPF, f\6ām%p\j[HPԭ@@`Cm 1@ BRhj܋7V- 4 4WMsdar 1Mјg~Xt)ƑgĤ1a0F+؛m Pȁ( BI wYE,H6PДKؔ4LŅDdV@`n>, C Zbi+,EKH6 aֳLc`xl5E$- ijV[x{o{mvעı;yqBxH߰_=0CIp |c&ݻLAihZ T^I-&|B˰,.ƃbP@mJmKN4+d6ĵM;1Ko$ vݢ fApѐZܘ p-IQok y J`i"itmڻm$66"÷c 6!.~+!6 ٞimٴ{7h;G,=;XZV$IqdB!mSHi%ĊlHc0״qEB˺m[YO*6Ľ AfՍfЊX$ BjLB%u Wcri$bGĒ ݰP\sȷWchlb +  vs4؄gzQ[`A.]+vC`H! )1p c,"4<(rMPJ/ZbX+f"L% ʵ"fh@ jfeJ AaX}/Zܵrɟ=‡Cm&6 0[v"M6+JXPCRƄa) Nd } JvWAbEF! `v 7 XpCFM+;miUh9I!FI9V*[>fU/Feا`ؕVBhbP ܼ)0hS^gI=L"NM3*]յeAҧCHW ,<4m6+,JRZ!1rg4dJiN 'Hŷd!`L L=ΰ)4"ֺP)khM;hDb:Ά(Ƨln fbM&@Z`Jژ@^/`d(D8Ĵҁ̙꘤!4\MJ!"W[LR&)'af6Fl#*ƖA34Yb3l hW@Zi+4 c$ (i/]Df*%cE3D Lm0XJE6l 3Q"kr'iLƪ @@h؄a4  )aiX bE--Kb?I׹@ccC Z2ޛPѴ@Id2ו&0ِyETT 1>C ]Ԋcc,cLT.joeY.fo"7q;[vcKjcxA ,DNs"H3ĂyEbp^ig/4 88)36+t\5&VhІ$4ưXK7^HDdelAs$ NDk5B6$9>!*5HĄCP{-016-$WaL֓[*jdgc5B)IUĽhǨpJ0bE;Qy HOPɸRcU~y[9Kz]olie! ̴;ST<&hk?Tܜ]JR+zf ﬤL90%t{Xɵr?RFbX}?ŸI@XZƣsc~{}ѵ{,GkBCĘhw9~?d7 lchy,-oS 3x%3N7Xncr1F$J?F춺8{38#0(zÚC C(0V%_^5pGZTFhv7Nlc$[eFuF#ޮ~,7  `S.:/}>7Q؀iDi8{;rN4u.JPDLza>jP&PiuKne[ Ҕ `鋻ܳl Դnv>c0#o-'G5ddua`1\r|^SF|Q1-ڜa\xfծ& Oq{NgΝ?cַZq~}vaۆt\۞7ZbQL[n#a;0/[,xnddgN:TVm]vB((^cR[wU`rnd4>ps2 D.>wvlli,5/EKn/_C^kh 3bC5$E )7mڴ`23}m 9(VR;ϏI|QX]FZT&~"e*,9ImyS#Hv8hJCTIItKr<$@n +&W-oRMabS&RFȼ`1v#u`/xnfe^0|GwgXPXV?{n9km)nN؝IS+R3'o5_=^_>줾ǁ-d$Mo*.YEO}U݅-]]7E=J"y)A. L~*lFJo^QZ'DF/[w;^uo1'4&y}ys?&?y|IO2ewCSWOt%oIRgAԺy @8AO\܏DPWekp޻)^煒$pC!E%O͉ҩHj 唩ٗ;DVx) CT!+20_bO*O )Ns0~gs:;U2v[[wuϛ#kŴL4DZ/P~CovyPSI患!}MBUgwITGc7xSd2Sb+𙩅re؉|0zk a)Me&(&f*o% x$22K{ni_oNY: ҺsϣW n5%º%&SVbbZMy"GmC#F߁q_ s::83.HyX x>[FǑ[oB8!l E%G*PFljqPM^޹MB&ck`2$r# nʾoǴ%'g9(ji7{[ WS@+3kX8Tq ԮOV7tx.*y]sza'cgeN;_=2MO\#IV]v֡aW:㑾J ,8/O<\3/|ٕ(U1lADFlC.x&"5CQXqtoin!u#'炗< #aN!${|!:>Vf*ҷ`08ߓ3n[-Yxp-C<ƆDaX&ʙ*R[Q$$HؒĻ*v幧q&+HVN NLERCG1 P@ES/[y=CscgV~7|d-qsJ'GFr` [5d)E60TTvR]ґ5"u-shRkHJ=7&eO"MơQk"#}u {%2 ĄLr SgF"SB_Un:sS#Mw:]9ٺ}Q}t ]"jB\mm8=n$Q܉56ԁOeP[}Q_4.僾IGCz;}KT˖ʿq}ȼ#)~*|Ռ2֕zC@Ԟ=*l6b@Pn;3=ZsFvM2(M&2"#s: N@sv ,<-WJvY#$LSG\ t~tPqv&Z*ٔF5#*a Sn<: $?(ߌPߓ=P&cptc[r3:#7fw8$Su;̉a,R/Uǧ"-NK(.4x(F.Zҽʖ-5o^*ɣ0=cc l~S(4:Ss<Jr벇p6_xȞ*ATt1Ȍ7ְN֬N ⡲]iS87Zܩ1!/cF̀e2?)@s>67sU'fa# -sm?H0޶+'u tl d n Q+NiZBX9ly<KRuP8JGZeO*= D}bH,~d*b:k[H (o>˩r,S{#4vH ,u^36JC=w @R: vz߿YV:͏`5N n21CvCԖ?څ<=ro5l54[T#Fg5a!h'k+YYG RE"5i`ޝo=86U 6bauPu߾od鯝{<b Tʼn/U;r 'v6&ޱa8f,,]] %?I~+Nᤈp'ڢ;V:z9niLI_j*euo6c,U=gE2Oń,:k.SI[1"U(p9,(ops˷xgA}@أ6\ʊ`8#B:{5{gm/"!Qwkqzm,!JA#j@q߁noYE̮~-7:y7ZMgubO?e\04*DLnC[ޗ B}>b=u]Tw<>림|A!6}"ӆN#Ũ+Rف"EPP>T /FӸiT_ WM`VOˆ֦%2][L%a?͋΁߀l&cz ƁA5x}ӭBqkp47@aq`=n7<$ 36&W r)JLu^9a_B#K3 R+4ؿEUePh!@0q~^/9/y[X^31+r3]Yx?u7kh{Sן7 ^m4u/||zi|||o!j6b{6 39_pxڏ\~35hvnFǩ9?7}Ygm7ϟz<^{_{?_{}^y|~g>ߟ~?8$wB:ڥ*"^WÃѓC$<+24" ;a aPYgD*Y"r!-R:M%!ri99PqHXeLm"I"׈,G-:EH ~o)O ni^O3ȤFʌ K_Am*C/6/>oStMptllS'ec;; 9|yW)(;mͩι,Q{ m*2)pMs"(Վ2eZEϻ(1bE9@D˴%.9f {F|51 `H}nKXS?"$'ĴAiS(@صQHBvƐDsfH阖HHh-0I~>@Ni$Pb4ioI$@V B\4 gm$0a$ i̹'7,H^@dmwa i$v$ G>^KYM$& i Yh1ڼilq Irش1 1gbGi/Q$vQM `# I -h@ " ;֒^EfBm Bـ0Bh7 Y hF$GD!CChB\PЅɱ ^{H1#hAX@C/z .$$XВHHbGh/pBHlK1@Q@]AI $7B!i H&6^4%!ـ HK4$*~{ov-cU߲ꨁ$#$ BB/jy,wʰBڍ` ߊA&[);h+FB?(#SM$! y-$e0z@r$-H>#a. zք4@"WIjZ4o B@ V,1yI #bF6- +X- 8&D!/-Aԧ:8N^J]xq <ז)&^m!g&ѐXH} zSKb)&AhAEf z"h d7d1() G!f-ԑ< "мzO(Vw7'^o,@{&Eт!Λ.?"|k^PM`+r ųV~/Xԛh5>{[G7^f\}Tʄ܅2MhG`7X s8*Ty%%ih$¹#HN3y'B<`_Īa1ɛ3g;'b(Ug9Rc1Z.4랔M6>Y"KNoWbH?a qC(լ3}oLzgw;V(wSi'KahW?Fҹp M"H0bw3"7M3ZmXD}Wuj>bL~?aVE52CanRiv'iC~8}pߪE]4@  2Wp2% *!*2K\jPxSXDD x0 B% aI<զ1:oK[a_/-S|Uf]cdr|%mK ~g6* 8yk H  M̉ BRc9{ ujM]BYzHw P>ϺyL>{K]XvƮS݉17,+j@sL]29jQ%V$,<4DHH%2FL,Z dd!}*^ʝB^+~y~˰zZ rH6L hb]H8f0ImȰkN46sTO Ъ4+$E0 ]#Bn4>jϠ@hHE /˞C>cg{Ywv]ҰEsI,Ism$|ϴ/5A .}[ $=2&`a!y {&uLzC!plѩZ fL)0Ny(hnr4gI&H5FJT2dV0_]UCjCi.{3~b:mYAG3ŭ7qN"TeC20mhv(hy}I; 0liO%:0x^{gi:b%6zmy}C҆ ddے!OmjRuLVO58r%˲{C]*AF*W'tΎr;-?_0N/l5毮fl]ߕG5x<JwpB9o3uz?ek|ln4w/7~$CAa/:L֪cF=B"vR1OJKmr?Hd]wۼm}MW/nnִW{77/WެCF1 LjhRA"~.؍n*<|^~mO/x2 >\݅Ybձu!$n؀ f`{6 ue2B>H+ζAix86hn8WaM54eHi%=b1 4 !t1ծ3aR.u9IՆ hS4$-I XZi-?C@}iao&hM7%Ē,hj]I 0ZXPB`зLhWٍcoz. iy;2bmlR#{0o!\>młؐ#),@h)1#~,M.z|i0HHH`oQΆa"  sdH 1δLm!Q1,ʹ+Ip(:oތm1.׽{ThU}F3 FHرIN\#ݍ1 ,)K`ory5Jq=6mgm0i35%oo@C ·D:?#W-<ؗHPMfĬܨP_QgrI;5Ǒ°oOXZc6& L@! Z`&0GvHDi6V57Wۧ}U {=lMS( }9F3>TOt~T|V+5_+\k-^A^UWh~Xc܆7Up7^m<}(WwQKCmثkSns5\c8&;BG^n}+enT!_HuOft [ezPTitdTKJ,T .Eu\H;z2A.WƎ mm'薗#ҫ pOdIQ&EiU~毽ET,k 0Q^tTKX#DO{0b6W߃sm&Gz'l} *tbkє~F"vcPGЅ똳<5ho"s۴/P'_0иz׉~7MXHԚ_+3M 5 Yo\9 Hm$.m%;CfBI-$(N4h!M $I2R?7y4\Ϥ\@9f]ӟ )A1bHsBGg $j+':ڻSﮕ&yK#$m]f˗`n.avZf#%!P_Mi҂o5- C uL7 Q1 9\?1d`o~WnM %33]J%,7f!fwl/m㔞 3G{sS-ͷ2Ç*uh1qxGB,G1U~jzcdrղd*h Ca/IUx NW& _3z__,ǓR uo||o*${ [m?E!$w_ۖN>*8x(8 Qw;x#:'3{p2^i{ZCtS⦥Ұ{ii~)U*> ~y \6 ׶ݤ;o*;[f:}om~iw 7|Kz/ΖDEHTv*?ST~'f#%8TN}>m/$;_nvH, 4t^}˅WRtp/'ן eD @_ _ˊ2\&ćNgm装+1.z U܊?jXOYunRy^ tYX0wEh^xT4xoS6Bc|'W}ӢTPʙfJɸ/kUp<>ђ,["iiT(]e{PJSRa9(_}RP-_ƈ)aLMho٭ivj_jF={oЂ]Z9ξwOR|H<h]RBcpb\sIWkwp yE3&+BE?6GofF~7i_BGg kqB;zQR[t\}.eVfm.>#p._ go9NڋaY"+iI. ;g$%/K"\hH*H6ourZǾi/4%rB'kNk0Q<`[ ŃafH]$¯33B;߁&J?@#`/%g`H}[ LOqc&5Z ;jP$93$iwc[8c9hAjtI{xHW,Ur~gl܄ _7|:YS8eG@# BQ^s6g׻|yߴXesQ˷oz[y,'h+`Ա-1It9╪˵֎ MR3R 8=i0Z8X>w}UW:bDI) ߮9܈nȝoo&wOq4+ux 1NaAAmee]By 7:nT[j3]6Fu>oēh Z= iȏ5U LGZ񍩃|w0>EPEK~)X؞=OOyŎEnsC3 E,$"yZ 6{G}6M x{ņEK#[z'6, j\ƾ̆1'[U]>9?QmǪ]wf6C,SDQ,??)sVc7Ku1,?7JG|/Hľotu =8::ji2/Ȇk^fvү\q7Z^7_]t?F -theM[%=\x^;[h0Bs167oQЫMgw˥pz}f, ZӚ}tJd"pnsq dcͧ_'zDV<@wE 5JhdeL TѡA'jBoC*p[QPjPtoWM3L)q %nH0AgooFėg~/\1Wm%dV;Zg+31;NRTssITa;J *bQ%1:]PQ_UMΙ1[JXFibD/~ai r"fCHm / *k6D-_E\#6A2D= .ծj߃b;Y;#/‘H.C/V@O8b^6gjp_E#UCN%^(Ĥcj ,Y>ju!/q{g y(_zrE?b1F̋} y$rϒ#bCb`ؐƑ6u3% C*}?_2evM 1d! G0YF&HAiߙh!uhƄ*dH_@H!GH?񓀨u"fo )v Lč鈆!C@ֺ{`$#T)W^@uA@RG:bܱ!/4/{f ,BZ%X`K߲ @;IH-*i⺰L@B_AEp a?CBH'i.݂A}8 H0l>KN 849W"`fRZT0(!6g}ۓ ;]l%93Bv ƈ_7q>fCUTW#=l_EWh9380/Mݛ~k:hϴj$W0;hF %*՛_l[4qjBRq!=Ӧ}pae$RY38 KV͖!s.?./an\"RY8; V<vវ'"h^^^^:w/߽{._> Us#Gk)PQvjl>7uX.?q+X7A:\7n3pAuOk[]rf6ຠ4 Ueۤ}ebLfю/ԲU/^-j =B+,TVƉ{Zk7jڵWA{Cip.--|&8Tf?Y["ކ#?wLJae Z'`}^W)bE%%%%%% ~fo:!Y1I;n:9,4Vs,0IˉP2[2Z[u?@93 mwٮKք%e?b6EĔUݭ9pa?uv^p<#R{z,OK_w\G̙iUl!0ebU|KW9̺ rw",k\ve0F;v8,6=o%t0[!vM@ b9i|U' ֽ෌"Ip;F94ztǮjQPI2ײRDC6@/k=:ި)5&1jł  H#(9:DK3G`nZ>STGs%3/^*k LbJCoN %z$pH&"`CaĂi !8M4B@$ "aFȀb؊HH!LC!HlbCMi6 1DMB$[HSrRN1=Z+OwZ0#{&/ Eڌ6=1wXBXSӟ0M x=|q#'LIK,R8%e@ޥZH5 {v9濳 i䘿gԀ.3Mv_F-o-qI.גGЍ~L.Ev _i|f oBS0Hwo| s//g-&b:L=񓶌f"{I F?nLau4x $I۰|3IL4 3m !LYB"! 7 WE0؄AfΣO[[lUjףq޻kvZ]& 41A`2"II=vqQ>cHB{cA5K4ll߲D i `!;j>bHdζVEE5:m19~RĚ;gsچj2tЫsfFŃǸ?|[mw99͞;ە #됥bdr9.3[y6s#;sg:/2ojGv}}}sp:5_hggtwq8up[|Yzc.]~g]6lɓ.ddd[~,lg؜ ]ch>4~ oɋ fK?"g3&dӡrp00+tlzQnι9Y׹@F1`4sy,G5<'uOf+^b}OWVQRVW%X]E˻[K[Uպ0L:WMɴr$*TRR/p7qسuu2r/ѯ ^Xov7#Ԯy{2z3Vev2LIdJw&NΥ}i1{z4mC6p*]…ww~= FQ"9s*N+ -,gnlo%^^K.\zzv`U5\ՎBBhXdi8қIwevKFYK GgWS||czu诓4LLgyyz^D"}..b`W+3$W{u#1X,,#oU59, AcyjzZ}.t>uqo#glcpf6j!%+̕,ΰ~ P4ߤ LuڌGV92Y՝Cc0rP j)Q__עeOgBʖs*)5TS^5Cz o_[MMooE1 |lΆ J/J7R#W}W-yӚgUb+D)XJxu x6b_ӱ]*\gR `/g}`bxc:[QdjlS{O%~U~^/sVFBhp HA.hg/0m6$T"96ҨæF7~~%ܦ+Ti~{o}sFqYNn~z4!Hqbx )זLC9ԵW,*SkRg^չ2 .iv=r; bb,B Ԝ>-sʍmµٜJnI260/!1ⴭ~E@iSk2T:Kf}E݇m["'X̫ԁbz QCE[C/ 5,;F32-GƎ6˷ja3eULr[Uj &LjM VG6~I 2B`D P:i 4%1S*=(zVuΟi 4![PC^մܣWKOJ;ߺ[mn%Kߜ_o 򣳞<ߝo`"ykmV0o[+C2 ä>9Q36 c^+UVjO*2'#ÀⷛO tm2]m,0[?Kl}¼Ϻ} !";RVA3i mm.se'}Gj ]ȗ\]J£^ hc[ͽ%X93;Dw>/CWT?!fIu>Y$#|8AAg6Q BG LB_zt8,Ai$ 8:D|L̝Hl0lGLf=LE8D Kc6 çsw9=WʮMhMH_=g'{] L?Qux;8 nnVۧaˡa(CoD2mUm7R #c0Ygڇ "L+3 IBD"2LJlS@ 2F@$?;Q3Fs|a|+ Z$]Cjm N64x PfX4m}g̲M:9Ek{G^/aCN2irw2kuQov +k7iJ@?1LC#'RH A &1!&6p 1!6vǐA6VpHi6؄؆!M4HA|׭q7_>É#R(  P0@${(bhkص<㦓Lb4$CHcH=L~Y(CaBWBLˆ%ܶ@"" ֒OЙfl4h&<4C LMtyx 114L` `4#K5zXS'`n4i봱!pXVȒ: Fvi݂5nCTxena /dN g&G> P&֓nY83u C5#]y6n ˱edeqefsiD2EԛZp/U\(/0ݻn>?c y$(=APgYffKq!->l.<VwkJÖhOnq,tGx#jz c-<8mU|3_/Pҳnɵu`fF >7ȫ ,tМ|V0́"Ihf=J'Syſ(%յq32~ MP{rSwQgSiYE$"  F#0H:ُaUvcByfIB_K9]vݸZʽv*t ʴ@ж(`AFb\J5N`CkxВ zH! Z6~Q WFLMCi!@Ѐmf79l>#X1*X$UoLi,@`{b-Z!Tr?HKg f@w=A}IoMqcYt [<\G^:0~G?9GP{AOKu4'Y8&g?4sͶ,5zf.Bh+[9~V$8 ŀh l ;7rsEmT{Y5${ptAӜUU >9OӍ"N 8sWiA+&5G;)Pj8]rq.(*Ѐ[Lc<~gڵz yZzQsg}4eĿ^G##mC<6{tS奼75VEƉgNmS~y$ffBb=uQ߶8[[2(ǺPp;,@ݕY.$"ׯBᅿZю:Sj:lt,, shX%>ssBfZ֥Eރ4|mޗ&i-`ƫUHYE<2/Lygf (FKzRO+V$mK3ppױe0 9ۃ;2$t^QכH#8ZC0ƋW/kC]?+޵ŖNLWD$jUf$v-?;fqb_-ݣVZzNf4H5 k˨)nH3HD ~z}¦z?J P_铃oHAsCK萜3_f3j%H$,^v1$$- Bd0D(LZj$W" `M6wKBE,y\1V3~̐~>E!وGp@ X xe(Pă?9Fw^-G`iP$ʴNo0|`%3B$ ɂt]9}! 4p@TA=[HIX4X6yWNFhHXCl4m#QKkWErRV/3iH: j Ivof506X^S!ҒAKHy@;I,ʹqҴVB[{Vk̬G{[5|\Őo.~'ߢX[:dt0.Ȉ-<ۊ|򋙤,2JZ}nz;. j aփwRoJ7Ze`rQ{K/O:B\z@ h} 4b38I5gizjvB9&`_�H#BBա̸օ䩷eP¦jǯ@D@f)kFR?S<K|E .}s.&Ou*q0Zccz>J:^ki^O|Dy͊E3܆khU/76n{̞Ȑ~mܜå{CKeWR uPgE?Ǻ?7> a ;:|?.wV0rj%BmmItjG|i ̪ͬ3IݭZPZLΆ"Z10𘘜>8ݙ%y;Qē-嬻=vʃ0B\%vӡ~Ψ#活;th;)#d]Z,Cɢ "$C)-A0qJE@zR&3-Ok`F Sgt>C)fؐ)b\wL$^|Iu @|VyU!NĂ@qo4Ļg\y{hWL4]!H뤔"">RHHPq5]B\Sy$]DZBw8 $f{m [ hulBxݖ 쳘IM )1tFH6 2]#g%W'@k-LE:/+6ʮ M^^}zO³ko$) Blh}!?G hnZ j_LJM=WU#xdD 4֘t׶2=ZZ&v5-Nb7BfhowSdfxs7*;"ccP9\>S0ix']l`ȟޜ~d#=c}p|ݵq}lH? u$јᣯ!&R}޾W{z,>CyLF.*#i^h55p_R$2?CTH1ÞSwxi& *kSAeV?]>nBl6|+rK4yKA L *(`cI)Z!#U< ^'x"vؕЗjxƕz|_{:{g`|'1 h"poM꒢r9Z Os8{7AɋhF1 )41c EalX"L^m3'i#/l`سՁ[XMIG 鄘_1+䟂fKg.%JI[;-(hbv4$xlGQ |O7hx_B}Cٸ_ ꛕq]Gsuz ; AA=QօrC6PnDߨImF1 `g>>m3BOxҏx_]_z^c*͝IL7fݎ+|`hf~C"i-AjuƱZҗy݆-%Hx sXF4+y H/T|h;M$TI^B=-v{ڴ&187(꯶MlWe‡lt]40Bbg}-Vcϝ?oͮ<^R uȳI`prڽiʖ8ܶWĞ5vDc7.?yG1PTl2``f,SLn6qN{t !B68X1x|1N ByqİG0/^޶&7UizP lRz 2qT<4OIVwBwd ?R{߇u]']7'8 qbq70ʼ^oѦƌ\/,3{&wLH -S RTb voz~}'ڳz~?kuz@#/srHт!~m=B?,Li La}A.2f_S)7D a!#i4e0˱Y|_i>ǣH=T`\i d٭.dR E /l9{}Y_bV1[E<Wul%K A 4z].%BlI F+_BhԫNm%WI*gkn/s|6ܳsu_s| 9ފ~"ÛI#g|$ƲvQb/7Yvn4z 8G?4zEt4L(FV脇~z@P{yܷ]-jkf\weش?3 yR{۫sr~-Oo6vjVVowϾffH '<)yU6Tee?%E1{{4害Ÿ>8p+2c]mSJr/*U/C?3>ﺇɗ{-JAc tfD/_b$_}bgU`ﰽ%_n5gNMTLcۋ͌=6l0JjEB5Bza~~d{j /8_eǶ%}{n~==Oz%|穳ྙS)XWy| x)Fa#8\V Ze0bWrSgwAӪFU8m_N!=ws6j_㫾r'Wغ{tHԅ*B]oh㝓$%QTϲ3A-GBSio۽{f@!\b")ٯE SL7* L= +m*|J(uV1DBH1`EqeBSΓYubHL H3~ 6ԊٵmbXaK-J)Ŏ":!41{mV?vNhba Er9gmƂK'ni6e{-02j^r n^dHe&WKM4KM3.j8]ubsWhg`klD)UׄC7¬qyۼWCB'[كfKz;";*'GuExо_Cr`S?T@h&kLa,UkfiL/aq3q@7U׷/ /jwQ# #ݦ^Ń%2 +H B>>/>\ZU7\HΔ][`tGSLXmt rqZޟ澜Pٯ#v Zq*RX^Ԁ#,g oyÙBy;2[n d+exH-zśvuRL0%ri Et/h L82=P hπjx؆ESuW6Ds M5>|k(B(Ÿ3Ԡ7/lUdI$Ԛ,9K 9F/QqO^>8̶,lIN]_?޽qzgۇrܤ KC#"we%G#Gv?_<>fTQT/)WkZ=Ü(ިw `%C+sL 1DP/ m-2{>l=qQv=L[OVUĎΡ~yA s|t"QxmWr/V=]U^DqUѤn-堤~(TETZ~q є ρsݱZ S#@ͻb" #C)%Y!M4*8qըiYKv]oLzo "nz7>zģ|~/GEW4.b& ' 0i'!sqB^Մ4~6mU(^wI>Kww|\q:X}k\>i~ڔ0.zx"}SAh6 b.ALx >8Do1 :Vyqw}8ƙVlS ?ss:6Vu-Oygbk4(?O`{y og mQ>g?*8}[I瓑+\"4X\%BdUkMGΑX1F^U}"UJAa*a*xqh%[a먕_^;6xl,Ȇ[=SV0cJf~v.=Ee=ln9Fs͙d5"M"JjЈCh&Iއ@5 :12dT 1%G'yKp3>KG8h ̾6nr=+9 ;a{Sfx yLоC Zr}[rpb-ԵgUXdnWhX.%T 7jsޞ湁K7OϤ42*\zL'sumM68 "ԂgG:G5ӹ<pUiJ3R6uZK@-O^jבSHR I'N3Z4tVA0q.]tWSQ I "RJjdCHD*&.nt_Jٸ!+.vXkuWeAUyW0DLH „  F}%05]t$QRsIS|c FU9˷X ""r%DozsU[QOZfZ]Q#cS3233Y4nZzi bB{lz-󰲈3q$./s"QYeҚ0 | w:'X/j{wN=he+vL3֖h浽x}K2,عbsHS͜瞣usuyS`9=1R&EC}~nvdA+newݎ;L3raGD&D@@ yVXj"%C6)p @Bi&D  YTCᷜ$CgE }f߽.ǶuCTΏKKn3koխ.i"܄n ".ąFaU#M.'&b'NRj,C]A cu1];\idof`lUإqn=Uҳ ^P}jfQn N=^g_u{vtV?l-[`wT kZ5bnhǴ(x`$Lst0!fZGE[?Ǟlb-d勇}L($|ca "y.i;izK˺bzIJ?xrKؽLFG`q i21 aW{|}8"f'CJpLMO߈4@J FL~p:\1t3,>p 15bp7G!e^qTEC){HB8nRVi Q%/$sϾ{[_X+=2yW,U3?=0BpҴNuZ\ir-.k2g6ivH+c;q84dr w?u$;~cM߷P-7zw [6Ζ/I,걎ZJw3OEw) ׬S[4OHaß%y?; Tמ '}h$T ]ȁ>aA%3wO'Yṗ|obcGec%\7器giu0~vVreb WY|yu<72\Cؿ/+F~KuY֑`P0x𐖱1&CI.* :61i1||{BX/*]+VB#$k~I/zQV%^3?N.t\a92E筅bJ!N$mt{f< ir8.?6zo V(A td έM0`cc׳NLĀR$}F5jghBLmYrxe!a8e\0l_i>3Zh_1ϣ  N`(M5[r b)k`r9Rp+L92o3 m㸟lVDHSZ>_1GuV,5-\{j+?zX+Ft`,+R8+-'.q oΝ晿-Flu\wY^Ur>Zufjg͗**̈́ ĭȸv? TiYyABJW59>-ͮ;r-:)^`9Zx+~ejs7KM|ڜ)`=@F竟=H{ݞ@nOAN.?#dAiDVּcG.xlbLMpqwE(yk2 ^qbV͎w]U(m?_\ IfN^EzyjGLۨKu__;U^i$"l^]I% QDٓU4^`4Oh4 ɂPjMC`&bG4, oqAELF~5/"2X1g5tɛmw :yC@2ėi ˼аS0e~``H)ɄH"-9Ϝ'LPyT$VK?g-#Rĸbl_h9toIl9'w-/wr;_L~ZXir=m0qMlH攢Hcg_h'5 {*K6N\[1HAX^h_ăj4>o,YҫӵEȓ8>=D9>QQm[nJh+HLӊ6:k9/[v JǻI}JmcKx\ fQvד[j<%B_L5:,c+icWG:kٞ_7X5r}s՟RگN#_O'RR`Ϩm|l%ev(Yɣ! 1I x DRfP5%y4|T,k[JƒM#ЦhJ^@z[9[0F6M#jӼZ賈``IhW[!sw~hy1YD1N/ʻc8Y ڶq;Gd &q_6)b =W%#`M[S1@U%"lGh+^L)}F>t< WM1vt>B 6ia0Ӈ*zyuj>4#ٕ“N5aT(Y0Ufj'irfK+QrMI1/ġCv~md=5M`{x%0R0JwTf8Uo -w5s&fV8AcV/Sڌlbu;u/0R*9SU}.QFI;f8+ $hB X= > ?Dמo`8j Е 3$"I| ̾Mp&#+`P zOom7!7Hd5k42rZ0d\}{J<@%et!t LF 1fPuׇ[mzrIH*:r狎h64LFXz2qhH)E&(壠QWA1\/F# )06%! )|+z` 0 <$ԟ=׼ѣVq2Rk4.N&OFXj4^<8ۜۻinڨx{;yMĿ^[{9wzȠgdz~1AmY8T6[ (1u'my6[{`ӱ?\%;xV'?d1#w8=__q}ql-MV"|?4&*՞p,)<< TKDY^?2zkmvJ(-u@a3b%3)+{ߗ~bK%HNėjO`Pzxi1 j=|%ɆGwKM I0dm ]0P߳$ k(m%1 B'b7@p&( @HA " MML[(vW IS# AL[I=33UkdϦI4Il& Q?gyBNߕ9$v{<%/K(2~I摘Am?6n+=vWl`9U-}fJ83ly8{Oht[{/rWphL u1Xv;S슃WS*=A׬q"ti  z91hN SFa Jc6_;taD(+8``C.`+W9>')C|w:VE\kYDf!H\+QA/fgL>l<_ 0B=1 P&@^g.4]窃@ o m2)u,X9 ιڣ!HMrzX&6 b̜BPcQ4+^l4 "@2ҍg`PbL`1GYv94/"6"Rym!BmbMwL4i&0i0lLm&0\5 cJN /`B;Λy_ubwn_rh]^.Fb6LPsBF<ғc+2bilLLiIh@4'E564ݘHWDJi5iL X0l}:Vm|a[i(  ܬ$lEA4XmciG̸`f4?됄i1gyM!!E*=~٥srl_)dfBq3Ks5#>&$١czm}BT6) %Ҽ D/wzAU,4+{+~CPZ/^.CGE!ӽ:7X?Z1Il$~$&bu)nȵx{3Pn4N^kR* bTeg:ˣtFhũmw_ [>ycO];~>]Q{GQ )lr)H }S^#U%4zQ}i*K4D6J 6 Z g_ *DNҁa@JMT9IDBҳ KgQG1ʖlN[؍:_\v H@^7p4Rޤ.Yľ.u ?K^I.A3mٓ,:aǨ 3O/ ~+JʠŞq8?6.uW*]k0A3 c)ŋ {꙱Z$s}@D{$}V~R蕠q̿%5:V=T qH5"#˩_fdGhsvPr$sgEM/SQgfuٜ_? ͬvx|z7^&4$=IQb}&F:8jEfʖ<ͳ̰zBGJO(x,XrrLi+ԃ#'>N=_/$LqƇ >~>;oG g0hGbRQ'9Ώjne.r_OnJˆ?6f$ȓj#h=bP( j!W޲|EwO̪9br Oh=}i/ߧhtbZeKrŨ#KEF%3NNɟb/v;kiAޏȲ}F5>nb(ѩ a ~|Bc[G!ғI"X!!ۭ$tIanRQ^/ȣY&uɂqɜF05 1}Wyom7ޛ;c%ϗ_0azf1P*)XU@dL s)Ƃ{ [5}e VsoD4%e$SOOWlFk ! dH(d:y4"#aZ|=WsbbgT.OR %k>ArawRY7I<m2h)l0\gW'h5zs͟5jr<[%too/|Ncp7N q!Fd*Oõ>_WuvQU`agp,by1|F_n#iDh:6x8\,t6٘>T4((ݕJzT)Xjr=k0*v{LeyNyl⦶?{Mn b$:2jjl 0yO3%uM]Qyʚv m-y>ƁK ]ru-k&UJ=  [J> `>Jv\rwy),9"c W8 Rz1!FRb< fJ3W&{:4\3IGbp2m[XRUd;PXmj\ď\ecܪC%WbinO) ISlO_*2 y-|~t~ۢ!h3[yLZݵ:~|Րgg{y=DbrP[ϯN'iW7_ޫI_2nPl @!knUjb%$m2<&kJeJ{5[;ןGl2HRׄ̽F"''eǤt_&TvZ5Ѵ/~љk9q$95V>WA$MFH7x 7VϤ+nDm`8$̦cmCQKb-t7ɧ?S?3IM4"= u.`vtyTj6+wL7!3EА*_(@AM3P5{c& 24cIaC.,\ C4xm$Q7D[OV]& TǙIy@|/Dﭣb`9W9{_=Iqro|{(څR`m.= N=!OlmtlűA #AI7QHnM5gpLl&)Hpm0/] A'!|qSLSsEwZId5)wn]Cg:@uvsZ+^1W{#;͔uCms9J5(+&tRN#k9JM&V4 t]1}SD_M) >^fuAM?襘1<_9Qgp_!Yˊ {OnȬһ-TO hUl+eclO+%61]Tz}8t{j\bVB>M mѡSa ?bٰnU6una۴UHvo?0=Kyt|"6 uegR!qLh[H6jR=cRĒ d~d)p[`y̤H,mfӠ0 5s ?Z^pec ~Mw3RZӰRݼdYb骭 *D{)lڭL"ͭ[gs1l*V] (xyֆ|YSnqo+')l]sf/Лa,΃s#:MN` ֹOX}<'^5ݛ®"j_b9:\*u`v3ALg}k% gJoճBUфt  輇|lVy?GgZeEZ>kriO<^w{cboCFjTLeC$fCGkk%/-?[-86p2:AXH((J *ś島F~[܄ddlmT7鮑j[O€f*eʡA#WԘSћ)AhfF,;EpĢ2Qi}ӡp|/Dud5)cºLDBɨvJGݩP(q6cr6 qx¼[Hƍ2U7h*=IcM=7ǃH -;@˷%7y(5/#s @V}׼V#LB\l !PU(K6-UGJqo4o *Cj8Ʉ@k>'נ/4}ڗ?Ah1 '4NMԦͰ } Au<Yu[nT;]cN+~&8ؗ(R kSc4H rkvLt虦ZĆ)bPƒކ 1߱i}҅4I76 2E#0/4ÿhT@LKoLvs*癀R*!JS/s-4Dkcއ<l f|÷B(oG;HqLDaLfj'9Zo.0[Îg(XЁ%H%06oױo?f`w]JF"0 ƑHs5Q~[tyN IK.oߧVFIH]ao[Cf[ӵ;YcFcRxdX4*mB$Wsg#6ږ!x ͧ_hn[NK%jd666ˬ~bu60:Mֻ#(staSMH>\bZYt;!-ĚlBXf$MiLJמ.= ʥqdP`D 2S͡&q>?,^s⅍]bKk|. xEi)H 2"kw6!Q59a L`j90/ݩ !&var[Yjh'>{jb#OnM1Lq/2|I4mSbCi./1ˍ%-WlK߁7s!HϬ̲b,SO߶ouM^wq] Ġ Q1DYF%)wLJ4g㽡!Isw`较)=u@fT)0%itSUn#9q;7 mt@D @O&J2^š_]wm@hȌ|Ci-,g+[ }Fy9JP`*H1`kH.3h)Ft.R% !ܱWk^D^3u664ƚ6Q0ϋ)Qr%Y͆k4%bA cq֞_; **UpX/]@-"d 6,Rʢ~U3M{;Ʋ&xG@3U8a[`t J:2WIIa(=PZ\"67`vhy_J2q2.R۹GAG{;dzx9KZϥhȴҏp,3S }!Y›$6NYmnupG"v-}z̞oS@V(\7s r"<aۜ<.Yz:k3$d3_hc#Ԥ$K)HS*2Zu!‰?eDಗXAdn3j/}%6cc8ӳ@N F<۔&k'wlI9%iv<! v6w扯Xzݺ;ّ.]6NClɱIPU?S5sgAtP[^ICʓ"|-6U[▞ nJ0oe!`Y:ny2 <|~̣ ĕxV?>/T)po׋о^v m3;U.fvϊ;U6:*;ol\˼RB:mhדek4!K2i'K]*l6cƌwGi.ʋnP^0j3Y$#XM\<&KיzXe<";Q+itnx,(^? !) ?e7_@K",*F=%~-}{M W1Ӱ{>%oBͣ%w&W["=@E90+1:{7:|mvf$1tt[{zvvn} vQbIJ-%XFeǸ)2dq]q71"8|#[gFr+?3+=fle5:ck# e8>-t`Gͤ_fN=zW֚Gs(mH%RlT+qW薉l1,LAMUoe sX pw$o{R3?",{"- t$mYyF0UO#STDpoz3F]q&-"stQU- *]ֵGLԶ0oǠ vr]]{Ա3Ƿuɓvz6 *Tj&&[usy+xuݖqٲ]K;:3;6iBk Rݭj(o'* Ѓ=\џsN] >hԺL܌>=̦P,ձ9˿qRP9/kW8.i/ݶE7{}-IߴMػ˹ך%s)EΗLgNR8Ҹ0g.[2q$v%=qFq鄰lDs4u5k(Q*.jŏzy`U\Mz!Gnͣ׸W䚥6j8tw8Gt*TfgFb݊=AZrÔw:M\M=#8ʍv0ƵǹT>|5yVG3QeY5e |:|'˳ġ X&U,a!+F;:DfCǟ} 661l:O";쓷pZg Ţ~z:3NST٭77v޽pY͟?t}{NX&p4PkoRz9H;3UǿJ)H)Lӧo٩kzToر}m_ߦ7V3[B9yv$BBP1B^F_Kj1kieWUgΛ'+.'qd*\2\ad]nm}ZGXDް&o[]^ܪ̀f$Vv( irz]ap?Y{7.6RQʉ/=l>)Þ8挖 ľ9oF2lQYs1qb 룼v4z0t1 m9|hSMYYežIqrnR p>6Np}AzQÙb_@u}EdHE@߯Nuz̕mC۸PiFr#,,:AƗ:Vat0Afuk%GmCXjcZ3[/=EޢC^ba247LVb4dh`ƚo36qaϸR~t:_ǁ_Oeo ׊e!NN^FSˇ*-<=hۀ9>ґqdoKN+D0 (&`~ds7Ul $gdH i?p=OUBH@$q똁 R w7<VVs6}65սM%ٹ@/^5x8,/.#8Ӿiv)j$4 b^Zuc:f Lŗ\np[W A|Ԭ"tRsJ񆥂H ͨEC(872;3A Xl;ft欃K TLwbw6ɓ3\Z+XEa0F&4[ӱ԰bBX*BW?{꘳z_ͤݢ2[ZOy*Zo<ƗH_9~:B^{.~gnοT0߆kQj^?rb G)߰D~贷`}X~-0꨸tMu2#A0UЈr[sC~}BRW<lϧz >76:Faq%?mzp\1?6B+HSsRi>em!`zx %"D7 QED71:n<ʔ]BKeڄL6xv t6o&G5 '6 r5wNVۯ&1MB:?1j$7y.9NNl.֥FldƑf]eHhmuL]p$I66bMX6В$m$_\#43(] eLZn3iiݼQܩ`rENix1usǁ5R ?vf3k#N׺*7eC>* hXP.!fu|B&gh%$GJ {a{\C t%n5z ~?Jv:7ϝ oUogP'9TlNpKWTtw %]!"fka I3m$cQmWf=I_Da saVo3-Vob-okӢ2J3Rmm++Uos:E~xùna0%xd oYpx}Z7.T]vvK")u_[7ecr"O_,½^jU`O2[5/_h]*N:np*jPj/)j`7+g32ݗbH[ߏ331eM~/@Ӊ54L%bsgˢ"Ct0~x~j"@bR7I-~T=]˾]I&v\5Gȷ*.~$A(3.FrBhk'D& AB@kJG#:h`9ZD8'RxtŸ᫻YI g&P҈5I&3z-gf%ʹ2G5ѣB@eby1a/)(DY&U/P'dlFf=|JLKˍ anaQ/{tgx~/a2>03nn!^ S!0 Bmc`JNPA#4nw;|鍀ٚT<\{~ ͒BG*  X!N6,ZE@oRmƹz˭EiFc0oߋe2H=Np\|CF$m&C<^);y>n VQgHD!Hhst;׬dtzIÃɓVF +L AC๿T[@.xLtVx?jEO'qn.2Qi_V;i)lS.S}3yRM%fL(nÃ(l 0#60sbpILX)z@LGU؄H>EAB23X@URKO&f=uxmKv4t [(rD4t p I?{]@m.BgmcrvL^S-^1+96wL[/ (A|yF+K>#J>Wk?sC0 K}t0VYbcFx?s|ʁm 1D@' ;rvM@%z%31 9`;K Yokp|j4X Bw  lѦBA!DK1%ƒ B ?,kq=r])|(ڗ*3 @?P%1#h3g}qI̼#D.Q)Ws&fpX"]hݿ6ҽhiywMt}y0l9(K8 Q~?19 HS[ZM|`~n?8I XuST E;g':{]Igk 5fk'8[MY\Ɯ䴲ҭd[L I-VD3.;6G_Ʌ) ]Ш#$ieT f LbYFa7М{AKqk?nO s.*.^"g.aX%J{/zC&Jwef*I%(U}MMjqMz&7۽i)8$̳kf%Ln ^$9{DNh昤tɀia,tB -ta vb1$$!N`:U$CŢEdY,⮮~74%7 .rv [K946&ΦJmeHgG-搳}=Hr.dis=ʵq!1]M=SB@#g4T7.P[*Ibp!mmyDp/\m$ *RRcQtmMa/n(2B#vp BI B! ! 4&4~ vC#lY/T1 *D6$H'LcJb̆ql I /Ӂ4QjP)BjK&bMгYϩ| oRE)>Q"JMCzlѣe 94*]ϙdddwRyEԠjBuǶ>>$\ {MMg [Ea=avp?r͗ i} ~r.`dbgy>aFܳ0P|R>)c`${!5$Ģf44ʓHf-?Bhrx0Ga;y;8>d y59+ӁhpLLLLLLLLLLLLLLLL\etofݱTRJ*TRJ*^?o~E?իVZjիVZjӣǏÇ8pÇ8pX+?Ǐ}jzׯ^zׯ^z~?iR<<<<fxQEQEQEQE}.'''W%|ow^zׯ^zׯ^g~^FCeM4M4M4M4Ӌަyyyw8q7©?u!C6qy$H"D$H"D$\lRQEQEQE;Ee //~NiiiiiK+ 5uv^zׯ^zׯ^&6gyB>Ǐg]jWUm.O^/#1eQ,=] 3Aww?3Cp^FACd%͘{YoW$]ڊ?}--֕(kx'у3d?~x`B**;qN!J M?%7Ml<sX>xx;^OYC?OfzUOzSV ro&n}ZA1|v.Roq\,/G=)}h틮R$^ǵo{I⧕RıV =egJz*fg2cF|',5xݧgr3vw$#yC[XYhuM1+3D}{' 2ȃSĊ@#W.$JHl]^:MZXy/\fXAμU}߱Sj\0 KAdNgkhW~ESI08MÆn{ a)$Jqt#Chŝ7#yHN q@0H'7 ?\J0}w 9͂Ru(@Bӥ%xv+RFV\ T~8:D2w&#j, Q!CI6ol9z#sQ0DdǜB|M.[z  c3V?/҄Di,oys}eQ5}+jp𿳌𬹇8⑪uΎ&ƣu"u?Fc6':Odj̍z' H0ZРKJ)QC2$"Z6GEyL&Bu]7!({P4[(b~AO7GA:V3ZEl1BҰ! 퓮W~N,۽_b O`yb5`v=co:  Uoa1pdbn6j4,9˔l0,-?oB-!!X'k S^ε =zZsLc`Ř!"FiK(Q%_i~)1Z.sjmi>ﰚ1O6Ƃ[+5-P%%onr A 0)r<؅KS g~glod'v%D䮢:l9/eK?C[3?3DzRVeKI߿g@7"thGn~LOY1D8Jg+" ˙g}A_<ԚF,61 ڱE rfYr 5[ ~*g_N0(,0m"xOBUm:+-m~ٵ;'qk-2[UC$A0G%+"gj:HFK[1B$1D0ozLl G|҉e ӅHP$OJ@aRJE= + ܀4^@pc|9,]F3A{v>`@s9[1WLyks#/ fۿzΕCFaD]I-09 BWW<;y?~W[ba[ކ)IV"$s16cAj[|[dQ O`M:)H!r~Mk_[uPDd1oox8.>@hK Ŧ_zpr?>3N_+KoFۃ-]~ڡl6>S,vs֒Ks|)/-CE_sڐ-l b _#66m_Ư N,^ &8ƑҴo_/9/uÉ(oLLRJw*viڭ:iBDž-e8yRÜ]#P۫j$^cH.'㥃8.e1&Ag~A#tx`Sx?!|E}9(a %~>({E{w} (=|uER4sSG@B05%צ 0D"@+]yoS?v|Y>u.i]cc;>%BP"k p)ǥll9n WFc"r`R]=h]:kYdR!왲p"y }5e"µhX⫳h]|-)N]RkPmk>E+~_:sM'O>x@&Jd~6T E^I-<{|oi,b`'LkT"\x- n^mQ曧sF{Wn}DCw)#[yvR5sP4]֕Y2 'ar^* ڒGN*g% Q{nUF,C1OSHZDvܣ )iP>YD޸͟vǘƱ>jĺv6k3ȉG;Pnԯ^IMazԕiظP13ջU{lBn]U8.#赿eh/';;R @ ATOanc"73'S`]{ƛ X-;UC7͗2@!=K=KH5 vIP8اɈ}"#7X1qŎ؆1`^Ar*:Rk-!)" FOOb ,ԽiR+q QU)YcEK1q%!/Ysu؍n_:0Z%QV#Ph&: R͵ $:>؀QVzүɋn`S+AE/lk$*vȑ`H⁄B\kguHu-NҮJA[SbYTtV|md&2a*iЩZeEuc릺zGEѡ+J&Y.:~M}q&si.2rz:6d@% &&lbk˵sMFǰi5a)3RPyR"Y{QB&wj$a.&A/ae(u ]__TLSmn6+e ّ ӝ)(uR[L"R0BX8J2J=W}Soi㤤G)qԦƽQQdi Ęs[5/^':;uIyNE[nXxnyW\(e_ŕF_fN^J;W|NTzW[I:3$|I1[dSʢA]c?ddr7Ts;w4ҝ#Nk83gmw]+Ftċjn{U}[A''ۡ +w9"?ckhv:OSLu_091B.. 7Ng.]--&wY\Hҁ|? yNGŃu8'%wBμVj42,"}}Lt:}75cOnK`P)AI ;gS9GG$1ԡ5?d+nJPg8idlE!TNؙC"YHB7<β@h<,[.2713縖,:\U)K֪CYטrJ\mzPP2᪣gTʂ+Zđkۖ]&X ]+PQԅo; x"5@Gwl U]g  8 yҀF4*4`2)e>m\{83/eV,׳XX{:F,|1J ެWOaS)d2iF"!dHzI}{5E(#[H1Cr>܉ Pm!!4911娪\@4 dDV}mPc$l) 644:nf5S13qv^ҷr㕤[iW2Kqͤ+U<2%$7*ɯܷ~fX95؟$|s@1P_3[?@wLꍢu㍍D 滋#@d]mqWT}_\S NZ;G&@BMGXp_Gwq?uWBg4~H6:^ڵCt$ƹ.{[ns<sfvԡn(*rv:N(3ή`5Օ RƏu{_Pp;1!"d5іwK_5jEq[QTab&P$Яjy"JB[;*GVԮ `}nەvK<VKĆʚvthl1D9d6u|<Ǝje 9"VolCkAUcgR0AudCUeh(:,ĶLskۋ: v:DsV8SgbgQli\ T]r$(IlXK{! vN+FaljM:w(dcƿL o18;㫿WEiޞJJ Vž.M7.-T06~J82_'o&֐j,~#K~Q Ý|..H|oL=q%U.B`EJp\;} 8, 0̬2uX刓kI&8D:d!{ L!@>~rm:V CaܴXzfp`[8k˚b٥ 110K3cXor-\(ST j! ?Q{7tb{$|=^UMwHXcIQh*@0Y'&+_Nخ]k }F$g'R+4#D$GtTnjH6\,V6+#œ4DBS%D4RtJwm5,:?Vv4/xIeegDHl4![դ4sN`*k,d䈌f6)g^qsKfׇk*+HU'SyH @aQ6y\0fMb/`- ! 0YnFd8Ȥ!%Sؘ@f IB=+&8 !!wŧyĤ =tReܴ"Օkvd)D$`Sֆa !DP8/4w!mqn­ll6&^DWpLc`9ܛƏkt@$=IpŸS,P켯 f: BaI΁hKP.[Pakz߯z-K}]`L Sm;Oَ&V*lz> yq! OzK9 k`/ 33v`lDhZzNBi5_ڷ&2 .FM@6o,\A.sIr <gJ%k7gJ]DB/I8yҾ+PurC2UQ [Td0Uogߚ!9'=pi}udJ13ȌXD@ l`(&1RXEz?]b>]WYc΅vԅ8NB& &`NWaWxaK5/׿{_-]E7bMmR>j O}Vꥡo#)e VAWVVa6^??s< u-yL%SF BLlzĀ>+ {gjT Ӊ9?%ّleahISʣYE+>bYJ[x҉\Roc7?%*5Fn.AtMMgM?FBp>wꦯVWHYe!zM^uMgAQҀ|#Ựy|A/ ۓĎ7 %%0KK0ץh$I1= I5¼շ:'񼯸ni2]cJŷƼ\_5&W>`0GlKl|Yʪ?lxԓVYO1,9>3"YN&)Ě !h2iHQ\icid6֦ 5SB^IOt l,&.5o"]giN\x Ae 3d81كSD2%}"&%aH@l6D|Ayro(GܵᐿxW$: H۲m ?W}n!Xr8|]4 Jʰ>=UaQ0~P\j@H]QNa 3f̱Nﳱ{* [lkk߮b%Tx~Q Rq챯4XGq埋LL[xnpe$;w>y2+!7f$d p9D2lM\bͳMxRr;adKKȏqsɖoo0Ngϴhqٜ֘ DLi2!Вo54XD̦ zپ*H z-uE`i&?wcO;FfGPZUK]z`z_e a(gCDqGɩLTfW< ]ˡ6bP^qXb vF;:k22M(iagKU9]eB-)kdx&6Y)e:&d+o&՞ "_0aTUYȇ  CEign۱|76~[4l Se}aaQf\`>dG{MϝLߩ}_ϭ$ F~L %C)6@k8cq—ܚEB_K_)AM~hfv&:^O9[`Xv<@u\s hCq[ S('XY+IU2 0]Nr^I`zA7o<@ y?8>X)P"nyw38WV@r3QQ͈/`~NYs%w y!>4KaϏgyvU(4h(ݴZ H~EzONnv&OuOP4--t'_Zj>} **Wk.$k<cMY8+t?B_U̓,BiϑBD솓?4(8#P'r4[)mA7'R_Os%hW;M=?5R_Q]?x {q[5so$y?Vi>Y=E+E=Hu]Wۙo%\R<ޤC4j#K(< V9N >Jhzզ]!h9 _g1LݛJ[s^t٣%:nY$ p.)sog?:Be;8VaͦaKN˧o ;>'n獴)4jqEf;3m*ML[/#ys 1sjH6Ue4>'[| wexHAtil.:E1 bEacEs6"0:Z34Y@H5|$P'BgjP _^Ҁ-d_] с5nZ8 6Ҟ,_7`2.X\?qv}FIk"YӁun*5T;ֈ` c?[H@]cIGsaaoN񦮴bА=Zy][u~V~}K*, &si 5ԜHDIDD&(pƀ mi}o&:sy{y0ABd 8&?B^2rD|q\1|*grL%grmgNRC>Nk6*b))Ryg#ڠ4cT,p3.L`\I̎RHA!ro"783kۈc.۸nsg}%sbTe mԍ7E9$:?@)I 5fl NsNbC# %[5Q[":ӎsED :L❅`f8>IlS!p/b/3>]gLqيsC oD=ASW6x 8봡I<!$JrdE,þd| &3y?`jKT8cV0~g&%F^1$;׎CĵMA !5fD fOi>$eԢvNWGЏ[[YV*I"5}D% KyvJ@yԍڜ(Wp{T-^CCؕ25OyQ1gzPش|E.1ϕj_.ǓCMglj5;*(Jdzҗ 2`F_t+RL/ѝ Bv"gE R{hl)y0 |Xջ?f@lW9Qo t 7V9Mb숚un^> =ޯ]kzhp}q+b&XɻD8y_֨kߗo jpF Nܪe@?'5"=A)}IuiSf;$rVUHx:7F XMDN*I " #,۟jȴ^oP:صrv&inFVV]3Tҝ& R< K'"c[Tg&>ceC rcSz1m|<^b*ya^ )&ccS&0? whFd.Eq_ZX.N=-J$#?L .֋^G@5.W_0B E_@ +kW>^xbr%Jk?Jʴf,ǮUC͢ne-6ڳflq0@ D-a"eo ;-3#5fdkJt؎C(P왆 L޶O`PBT\e0ʫ!܆'ݔC*fZs|W:w^uGsG/cb1,1DP7:s4W)aI%]M\mYm]9;_3?iɿyt>j1Z^.LDEBCP9v(|leis Jl6-]vNk:ק+|w_'mbW@)FMWr75 ,N/oYG~U ).ILXnD5M%5MH&XI6ZmS~Mb Vӎ&F AxҪr?`LGJo 7zWƦYXmؔUۤ@f |dr&JǮPĻ71YP b _:Fԍ?MeY33Ao19H,8q LAYsϒxñ AXL8֯VKLbU6dbdp"V$<\,gtͤ/۴dlhA-Y( J ӡ?cKk!Z''K;?_q!<')mo 'z=\\O߄fgXQgbe! `ͣQMj.?{~PBϽMc$+;yad kMR= q]V9ʬxv?vb %]:3ΫG۾p!zY4}'m2bV7[&K~.x;AKc#>bS])&N1hPJgI2'Z|?kXgXN! Um^еD@ vpZ.W" m!i`ƒc@y{0 $hv Zuk ed˼7 hqu9׏AU_@p0β#8S4a4:?{8U䵚/N^p@)5(2p wk-s>v|>Il9^,)qs|_/Rhr| G:#M[A=@E1e+4†c{ې&$Mb=MA.ך{ck6R2݇ {Yfy<݉i=xP:|G$@[ -O@ƮMd{D0&C&Zmk6Áx(P8 fK4~(Ift1ޑ?Xe*V LQEF##sQHgvp/>w:+FmFi`D6 3਒js^RxɘVv*4@q J<߃ ;e{TmVAts%~7o}AUYXD\W>XTZ]?WO]ΈFW19s퓿I6O ?vx]Cّ`lQ1hF%c*Jlk6,3mtlݝXܵ7>Z N [Ƒ}Rx*L;k ':.^1ʍfaT! }D`51:vA;S_/+b`5zH-&Ƀ?eүpPv,|v4$1(3_[€csr2lA-&4SYO8)w|Mշ ~C0[fB=^\ *dK<m 16&& i#gY [`Kw'|ǻwx%!#<ԛWO6v%"TD|LXM^5̝tM MBt[HXY\6_zQV /4ש5}4y S[FW+7dBI @/e8Hh9vյ͈HCu 9Y˰M$Y.;,xdS9L@@ :F.GmwtvUgtk3j9qqBE%b׭ p–> ]i :W-T'HvZF~Vҕ{I[pB!(Chq n='9ʧX~&"'@`}4V4zbNZZiTZQ%FAv*/|,őu2>_/`fثS@#VRfƾ,<}o'sŤyVk1hg، L_7>sGr㜨U{ͷC^acXhw$ leJ%l5kYiŗB*WPo]:Uv+Y01oĢ_VsF53ys,rZɓnSѡk{+k޹ZR9SyQ{FLw;F{[F#0?S,=oqJ"EE(1 ^+ݍ~PFw` wp1f}?=l$8oJ:H&1E8; zo@US;(?}"Y0p}?ѼRƮ1d)"&lƿGNsk8)Cbּ`[M]Iv ;>=bOn~&/Z#. }oη Jl>;[L }M+7GCE^6]Z%ËMM4^u\/} 7nkEWʞuL7X}faKhZ$9 ,_rcLCą05^cհ bG4oq@GuݞI!^'P W8LuFG!坒d٬MKqZP_ԏV۸۴xrGFZ/D"W<]hWtd{"+f@!'b|Z' umHD޷\GhCi ECѤ^̑N2J8Zxrbf|hXׂsqv41TÁ zmjwBt&$K3)j^&j6mRҩ"Mh1f7P .XS;$ MXyDYuɴƄ@nD!@ň#Nڣ6.@x G嬰\9q•%:cSwRKm*C SՔS^1SH 1Z~F68'FDNES Eh ȧhD^q7kcK8/:-+;vR (RxoNDt0~MNd YX :[p>7ϯ!eQ{jgsZɲ٧w"li38ՈKk_RuЙ˪6C,kZVHfjL>Bd|2?;S|]h;%|Z3!6B FƉQ?uWWM,щගq7{9顒ާsKZL!4{s-J4n_ӱ蹁AomQ&6ƑcqM9$aH_5ll mnGz7\)7{VsZuub'C9N]6F?pN!:!83 [ɦfH/RF_5GPM`] Z-01˹ҋm!\m$p꣚ȁ !227eܳAzOHg@]S08\sDl"izӶ-A>䙆b8mdQ4а}(s;7B0V 1=Hvyx515ݛ˺ b|džs=HŽ걟-t\HW4#af&=qpw:nvL@TDU\,f lRӽ+ [܍5ii1LicZ6$Vp4d8;?Ϙ/?7tTӞ oZ])?u˘ F^;LRi!usd8V-4D)tɚFۜ!ȹbbSSq>F͏x>W+Ֆ#N[+ 9|y)gv*&V )Mھ@~NaC wdoP8'GVllΙ|^XVa: x_\N -ܳ HH2[r' ɜlL(bsEaZi+V2 &Gx۰  V,JhP 1-J{+V۴*[{vuƲP-Z %uNxL4wJ\_5Omrx 2{wq€w!1?Fn^T~a7}Jg3.x^s io 4I$qGFl2c|M3 +<:  x2!`w+,̑R97{عy=Ew*^BLouS&c)oB m485cQX+L^ մ^P8Q;3 LսbJS *) tZ($+j R*ҽUK]1 l&U |֙cAU/DPc 5@WRQ@D$#N ]QCk! Fd},uS~AXX/(P(NsW&'t DsTd~ߨy|`|k]/nV^qa Rvlpl+p=nz 2 G4у5=1ga^X :΂ ,f`"*<8S}ɺva"C~_V P;>G4kQ&4HQ:<230 *W?5:@,h@IYJbv-5%`':h&bvʓ\Q ѿK䃇xBJ`hp@Q7t5Ec2Ԫ1`ؽ_{u(m=094ċ|&#?U{][> c@`W+D~^ɤ:j)sp*rޗ fX5y=jRNG*gt< @JfP0!﷟. *jeq533V*g7Uή. `gSJ `\Ipo ZlR[km9eemS7jwS!^8y3(Bb9QgݢVBP ؜(y= #ĸ{J:m*2hCǘ 0( 1)9ok,[,:|ٖtL ´4 BЖ-L m L+da6PP4އ7ٔCb$k! C Ԅ)/lPYL! $j'՝[1LXDȟW R"ŒQ^Wl3+ɮ*{I %\Za2V -ap-r]l9gQCOmn8\Ո8(5Q8yxvQg*BǑ";qD=ֶھCxp^p9wv<$cxpZ i2Ez}z!Xؘ&I +uaK _n0PPZSZTUlS<#ԯEA* ǫ~c;nM̜ä . :"+j⵴u{[v [y*|V $ĕt[^F=!5-!ѡ_n,vsǣk^J굧Ax3c1/"LfB<˜ HS#D`!) jU_9^>D i§]z\,f^@N#[mxaB app{Pݹq)C0TqC)˂'WlY 㣪>vO='w K"\E^ڟ>jn `1xJyM?sEO R1 ژ%-M|2ܷƲf*Qҫ}i^2FlL8::ٿS ^G279>BzOH x~j\=~P- g2xueq [!]m 2u_g}VG2!AL;p}f'mՎ887 0L/ x~I*Š'J/=9H$l(V;gkB߉z1U ,G//" YUcU 8g^'|?&U[& y($\m5{ H,tTLF;n_mHkᕻ.H: IIL0PRu 4QTbRP I.ӒW,4lħqO3%;SҥfS(1SJ[ 8rKӂ4?BC{]s6Z'‘E~`0Mur2bݽ0h G["%֏).7Y,%N߯ܲe3i3{N>O ahӪ 5(o^(sqRk"*d{JL}.5$n҄.DIǼ-IstɃocOehuD!0- @bl`i4N)ќCqdMc>5^@ZI@1V27x$ r ֏1kѷo]?fMfVjp||5_-"ֱqu$̩SZYIƺhtS^Y&7(_/2!/|srpdTΑ6fDc}Nr?fsxxlulj+qZG}"^#J6hx886ૅHgs#o}fU+.?Jq[[&dT%;>O Ȅ/oN砅]v~w'Ze$`v<kω/sSY_Jn)ֽ*($ 4iR4(H(c޼n Mz/MxZB )ޛ7" AH["SBOS6#Ɍl^5 HP( 7d?/ٯ9عw ؓ? nzN]}CXʦ@QM*!/? S,@ x",{୤$Eg|a@'Ecnx.6*OH :=epSo7ھ5'uuIgD >xm:h-Ƿd{bD6:d($sox QПPh^ "?v:a[VJV缞kB}_mޏ ۻm0OivڻP&׾=h;0Mu"k,r $FQYEv4MX ɝ/+_29&U$}Lz/Ds!6o&QGXz-*RL]QI AbU 8 -ɔ%c7r7XqL3wQ!#@c{[ Aje ONNU8} h!E,Md~= Ey [I?Mp|ѮQ6ZhIi1] V4JsBp MEIp`q/> W# m-H`բ  An2Q`q#Gu0Qrw y5VK3ɄhSxDτnj2y~rӻ\3b`d"̼qNh {۬.̶89~ |;=FRu^)0&!]y? ]oƍ]PmTD 2hE |Q (& : SGG>]!y4tLOhꕯjRpjݗiWY@P\AO/@acY|T/f?1YVXQӝN<>݊LPrG9pB!'YsͼDϨYJ7O=19~9ܤ`DNE/z?tFgýͦ3Lq|ym{.<Ə98z|T$K\dc.M˿EGZI$ >jJfB=w:f>Ԁ5pc \t4[jBYrH9+$(bVRUo M 7=lff!>&YJIO4}#i+It$M6jF4C$ o %\U=L'{ڿ<6W^Y('3}1V'?ocǮhxW^?Mn.UWs]`aOV3[,}ًͯ.9e GN-}7<|>v_:Of>_xNb;mƀ"FQe(6W8M-}RG,yɽc{NЍ: +X9t%!$eL{;xgvd~T q̗yC _͂h˓IG%?40~(m\ϏpNNDoPM:â9N_lЖMeiu {ͱ14]$yED$E UR S٘@ VR׿IC==Ck8l~z17~{d޶rB;IhPBu|6/$&QaGhbkl/.Ivn:ֲ۝ %H/-BbPPK^_sUKg3N!!эYc9VB/9!Lm*x?]iN*=_"fK!cpƕ*2|4/Ɂ+M/mGGIPB"?:BEɗ-4>w~_T@X6 {.lb`0a~94$R9*)atHaRJo8ͥ7iv^?(y`("F2 zbWUZw'`x?u^79ő Nj{0Z6.t g}SS#_:,ޙ߃LA)f[yqsFGqv=%^1! ׁ# H` (r;R9BSm +ԠY8gzwh'ߦf\ q˳d;VV`3&C$63:I&η~2sVu  ܈] oY//i(h(JGhmqΏF"A Gds m`(xaw"~-"Цafoւ>ast]U&6mcEZ9nnEgIdz6#JF=? ʫ63s5-M@[k*0_}(8JA?e9'̀lR 0QEᄋ#`~\}gBuk?2KfZYeMO] jxi5Rؑ`N-9S0P)$1FdGi~ MtN!/&NzV1#>W! ^xszN< ÊHj|$ٱd|L7?e$ <KFTm,T4?gݰ8a6%aR@EYgѨ!b9l ]k}Ml%ǽ?NBi5@48d&d^d׽ |u1K%7U!3mJ$!:Ub L^O\,]Yqi]B *H"lCh5qKBtNk_VHbd =G_};}eM7뺽tjghiHiؓaIpP)a}fg*V Ea:J.@e6;;s~DTHFlɐ\[m~¶VS}nm}FxLp8 Au1tc:Y '^S-5jt/Q \w/W i-W$6scH,kBb{a;ZhчP`U*gE$E] )kB1)]Oŀ!h #)ZfbCi6If*DGe+]SE Vm̷RBP\!~OIplgTwfaN18 38g\2D Wbt7~ꤗkwZYCnnF_U^uv23cWD{aBH=!@ٗa@/tU/L:5]־$OUy]&.}3fZKdtDrTs$8t5 ";YB۷uXOTubb[_0٧=`Wlq M!j ?Uf/~6NJmV^s f=6VS@fnnl幔nɪ\,&oRx۴k%9HCMB?<_wœUq-qCB s="(ֶ]t (=NZbuqF)q8}K:dY(VQun3@J(laMU.R{r!"5. .oL{cZ Z>6qQjyBh, ^Xh[ ER R>q) #(hlac½nu'C^NP;yhҀ1 <@y _~a2iB z9IBWґ}N`HM% j@qBORw‰7Aț*j'yGܣ;C~Ih:Dߓ6͆ca]W[1م5z$VC@2HN@ )xZ8;Ea.y`ŏ!yWPDXRJ ɺ'f;cv.+Ǚ*KbDUeHb~PtCwׯR?$e$G =U xҔ,(Ȫ5a=ffaTr l`zsno_y]wZbXp(BN_xJow-Vufeץ~}k|)Lw^[Vo{22E#\sIpUYq56~x>h]Q4Ý4?BVnsaDf-;P!n N`p% "/-Sty G*3{yZD9:QZ.wz}x<#xzta>V㦷(KwU{[8T]ZX; x*ٽv ٖ69^{PC?W2l H81 γ~0˹+}yo]Ij$5)Kio*j^[L V뚑QIIPL ٍoYR5spdz,F!b'5?bg,|X S\[ʜ @||ƒ$f]@5AC/%PX.h"tM~vP}MQ_8kr{9Q723BCfKUbǮ~.{ ϫSC[=\dm:, ۯcP}6,E v^E%E6|"\j}iJޏ;O!7hy&!$HьA×,O%dITq4Ya@H%S~u-@@QT1@zS0t>&rewq" +?Po݃ͽ7ߨ21&Ѫ2&יN"W(yFiH~)x9D@XGa{j;y;a4[#0ʈ8P+Jbe@3+.4?:ΫqCK pV_vޕ*eh.n%UNq#+$'Uj 3g VH :@ %`Sɳe^vV8̺z}S*ܤ_LX=?ԆWL*X{DWq4՝H(^);O#>AEx{ܞ j)2_0_P p25OKSѲ'7'8?"7Ǭ75&s|/y֜!2.^׽/R/7*×Q}z<55@S )MCw~E~7?g04b4m} @\RAD>٪vciUYͭeÃ.aefoW+ijv}ql=D1lsxZ>Ҍ[#U= 8V7=kj/=sŚ k6/ى~ٔYEci)f`iF29f0jJ=td1fSB&bnyغm _E,kYVV> UwYGB;F1.XM:9A'ge .DwU'{a㟣<‚\G.hAvZ6{׎vX%bۜ9DGCd}mߩ.g+@t5(w.~\K@bs(T5k:ɹg^CSAQoc9swD;d`̄Ү#w#!h?oVo6;ŚEt-魢;uH8K*_ AC1LĐ˅zɃlk M/ T_ӕ6>G d0S5yn~"N+~fW 䤁@昺GEJ!2恏E{dju F}{6`4fG-NGaN5vyb}? `t%vm?P:"|50 _Bϡ\3D+m %`Fx:pJI=NVЩ".>xrzUURã50RxІcгk<G9u'dtZmRRï`~ ~^ɫJ_5q8j#յb'W15uTv˒qҁ)Y:҄l.֮||Q.w7l~(:Ӧ 殬u T_ӹ>Y5R|+J'qVxourY^NLHSg({QMXHֶ&d;Lm[W7[Q4Z;G_:)8McȠpHl kEZ&o6s7h:# 5\;K.QbKktɫEJ4̧ ܺX JJ9BNbp+Q!J_?3%6L#^ކ|&]}<~+V/lmxsIE6"Rx:* :yr Pnp@06P1d8 <˜P\2p{& >S 0°`u<4;u$v+ogB59^Oe2]B\ B=uFH:~Vi%, 5$'[qEOl]Rk@)'@ cfx?`e<2qt[BFsg1]Ig-ʃfFœ MUjIZ4o;OṄb䱓j0K\&Nz:UgvۍUJX@6ʮY1vZGmS^28N!)-\aϷ@֭J"*g?{Ld<ϷXC,0媡 1FsSw㾧F)IHV7٥k) r2s&4t+Ҫ;J=N?D׉)-ׯj!ga还V $*;[NcUf]Տm+sܫٱuIf >;W՗Ġ7d̤w|"1^9U$i;&z#D"!:=7;8t*̮i5<) -szhM\d R_BohK1|}[^M?T9mn,G-bMbG.CPpObuJnty,[LzGc YzV3[T?ze/cZ+f=*|N]X+2yMwSQ}YmhUKZU]&.Ҷs"Zw u0[—e?^ѹSwO[b]$}uA" ^ߙv>*]bKZyau^x͢*wżmӗõk3fkeVEØW&aMMYG{|M*WMk ГrYzNfx;L,;lTQجz XObYE1$9pM(T=I0]Msg6:SbMBa1GK0 J%MiM?ﭫV6.*DQZTX <HXD *=M(*r#,M{9V܆PczWZ;}k(/״ZS,GIPL(?cBM1tӟ˜EޖQשgkMU3Hwc\I1mD^h05g m7,ܻeJyzFc̴+0hj~>\AGZ`K<_+I/bf!p.9T'nȺaRQt!Xۧ>7kɧv'̣W s,ha&qiC{w)H?zz?[-~=#`>jLј(k[BF;r) v!z~"tpFl-kǮ0;KJmur1ĖY5iytB Bmb0~b81;ӽ6D&_-M-:+Eis]} *xn6 2Nܗй (?asjس<'򨚃 (fy(7U5vjmYb`Wv.7ׅ?CejАƳt_BҧAI~>VKojJWyΡ hhiL}̆%FЛKGfGngD7ηW~?:x~R`QwË9N >VI['~Wu`WZ/+1@`ňKZI12d/#e5VqJ !IJvLv=L xSU x-er`htjةb%W4 P("d @P~&o,W4yXɖ$C;-3^mN7chE`\3q< ӫWs}[Ҙ\o5zޅ8D)q6SEMX8B&Az8呍tF9}Wt*꘾e;FIqe/Pi"(rR)~}X%ĝ^O=oJi I;ߔǴq[| g%?Si6mjKF j_jc7tэ2~1:&CuEU&\-]!RShQ@#<̒+ =B mޫcnM7;9OXw#(HkMlv% J{opT23DIH]+{w>=$5|\rEwC} K.\ KEN"Lg2HvS#FPW=L!ZΑ@ebjTEI,jBZC$j隍x )#[^ws g֮F~$@m3KXWډ#1 !- jDDy@ dI9I/ps?+]}[˾dyvwÌ1>B=N[0Uks\,M(@YNKS};1fҞK >сԟJ&0(ӈH]Q=V>],D}3@1Jg﬩i iߣ~NW@G5|AtRs+"!Q:#^t3y6/(>rã/$l  )@8@'9MHFy~&b2ydLGy"Y#lwGR+qGR ~[HUxѨkV4fDA^\ӇAD 5톛7~Rf>:إkx.\1R<{/l&a:blͺK-xh]|G^gT³Grt>4CV:_Gx%XJ# [;}m6;JīW hK=edZ }=`\A>~bAwuz5:3?8n$Gi,U3"߀RdY_dOSxo,H8T.Hd4U>W?,⿳>sVteo(gͷ W`oO)[ln^yd _fVdG{&#CP"H;3͢z 4OQZoPl<>r9ތ7ΤH<XIJoZ; x(I1ޑ$O',Txqvg)է~@@^aJIHL3Mh kuRru7syJFBP^lm_MoOIJ5^ e@nHՓ=yHg{4|s,ժ1YacCpeS&hn<)b|JB^?k90ĩ U[<I`iҪ=~t(56 q5})!]wQk=SfD 8==[i$<+cM?'}iRtOe6PIv`/;YD 1 y:,SV>0eO`륨.ZΨ [\Ӳx7]V=K8yd(޽j#Nܕz87(3G7 &r;Vi!pivtTL. ,Xpd -e5QSc}sir޽XG/v>*ӭ =' qtΏ`8V?\Vؒpž꿟N2,Gu X&?zwbC+#W{"W2~0SS(·nA={Ck7q8Kj>l.0GoXG`3YEÜbgqc~Ƈ oC}9ZgQ0 fu1XFW5{3rV6Mn6u- yNڣPnxw᳆K)U" u1WNtU'ZlsF?ݳGzC@HjAMzFlOh#8e;^:FxI\l_0SY8%%%c土oWwC~gpx/ȷ~u&~;J(`(5sOm/TvuGpaA20uƇjGmUv&^HYǵ:ڥ~j]b-Sp:!v#! ZM?͋M]vf}i[Ig0&|:PoPFHH`Hrd A$r9乀Gk{V|BG`YP8ENP7rT 0}{SgUuجFɫGXS;`6s-ݥ#gh+>ۯ/u'Ywy~R+F{G>p/5]J?mD.S֋!)(sn^#50X|[2yf>ފYQ?Q8/Pf朽 OTWp?S_Vي2gUOw}H$&@ 2HFg}S? )3mKkZ}M֮*\&?x=Ǜ<;kOP#\f/ӵ%^,Z.C-Lzm9Co%!d D@jIA+hi]S2D_V/j.]\`/{?ר:+El|^xknj.xϮG+ڦNX"+/8PN8!r}:U/^A~Y7'0k?D}o@q޾gMɟGXI <צ #øx G#\hAEh ]=p8z.(&ol;<$>t=R_^}C' <3=OԌ%ˉ Z/ ty-nZPs@@DY{9pVmi ajd s_-ˆ<$ɉ8u/@L%j>o3ClK!LY<4J8H!·qJ -ERtsW=}ɛo_說 (0a[sx^<hD{A!sm$tG2w~=.%~-Q^, ).S?YDSh8t؉o;u3/Tŧ?V[zfl]howójgl~r `L,Xsx.b;zދQG $ύ,⁻ٔ=Kh (WB "g '3.M7҆`~B3$Ͷ_TxzYe#d~/}d㴘1_~ip&67DD53>l&5?Z6*%|_ 8 h qhDdAFQ^m6lEbS\@P>t<י6+@.KF(uzd,( f3_@b(Iש* {{[9wk J!B5ZVJ0b y?yjq= Oqi:6-]jel c EMq /#4R[dyJ(S)6y=p#%TbI1JDSwfݔ3us%y$[fx%F^ߺfK'ե{p2}tG09_5`k'9]"[1# PWA@b #s#k^6"aOlmGYǹzf(ßp*D(XD$D. 5G=E-1珼F_yX?;E;M r6=-[ tτTvV*z Qv&Ifw0 ]n29P$& _@vТ_Yph^7q9cs``UstrsHX1UN#,KN=κg7ΑW1`Sд.k?9CwroK?ܳ"rfT9\@530vF^ *jG~9n[`֎t>-ފyV\NݟwEL@#+>N匸nvἺ̷e4y7C(^{ů_::0u!ً,XTq9Q!DNl]-I>V5:HO/}% )8vIpM] ۏ5o>66!4Oȝ<00é2_2ˉ׉̙G(A" :_O #l0JuG8h$"~i< )*Q;}dd\19q[-&v@l28[\Ƌ`NƉI(v"1 :_Pre#g5.W<#B /U5/2xr0:֑ٯC!wǁCF1/R՞iCN)aKyBӳ3ZM7udtUdMuB|#Ųۚ<ɫ[Ew>SGq-u?ODœ ,k o ;YaS0c/%-x> 19Gnpq!帍at7'|r7 .%?*G] a2{L4W9CcG1{{ktd500u<뙬Q0U\Ǝ[[moׁ8Ϡ}{G}[Gҗ1{MutZo}n@hFr0!HS3|5"RB7( oV ɜL@ sztʸvydڿ3g^0P(:,(]B>8%c)uh:>C )*'\)פ{gSM?3% nМ<40TJTآcMw0!p%j `#F-+~MiLS׈71Ս& EKZfR0] At8>&2+*n4h6_-iLj-bjD_TK Ɛ">X̔1Z0T 'W~bt+OI}OV`PK}n=.w)aIj-uQ5` Bdm Υ9WbS:bҲIf )Xt ,I|z'*T !OZ--85E'5Gm4vg#ysxOtT\WViF1[oI;@)ZS tLKni0(J@4@@J◈NLdsR/IjJ Wk}blDsX:Sϕhfl%} K= נ.<#s yǏ$hyC"g)e 4:#c.@F*Ѕ32=RH77}zsvTt,lm#-/^ƭ\70ݳ+χVa?}nFyJ?ypBsRѳiG`upOGח3F0;Gkt7&{~d輩ruGrW(1T"|b@AKV[m&< La)L2ykxt#%j:5*͎ll F3҈NU'&C Hc&?s-o.!>~SCM-[פF!Q5u1O'C/UD0̥.rfӼIA_4L͟B^zL s2ra|2Ҫ wLO`W3+ MrC(' {m H`FB]T{G`UFIװ:]//?N95E>͈Ys$ AhAXcyj]}q>}tYYߝ0?==< 3 1F>?}uߓ* vtBS̥`+Xbc5G3&RjNrSˬfC?0[s1e0!F[1(hD6hls- iZ/#ytfEm]1]03| LsoU9^1M?筨EZ=MQMxϫV#l@$$B>#QHljﱄ40J0 /G>[Q6[zWŌ[I6- [05b`H rd7 n[_ſ36t{nUvR.9UGffw)&{# Q(M(pٔwYOP g w,w~WEޭQes]^̍E|K~<p1Oj0?jO۷|x b1Gٜ}^9bAwH9Pc$R#8ol ۇ0N߳Ƨϱ@X% +To_ SNLm~gw%z}ֶ7!UG B8*"NdqAӧU}FMr_-L]չ?:d<[N;q0S_cr׿KQAsp4g3=@74auP7H V" C$<]@kPdIcm6P[jLdZR``}@\PT`p`bK8Bv TN za˳"$A FʞD֐wYFH2ܛ-5W.Oͩ0yr3+2B HGEUdB 5gEFEޱh&_c~3W E)bПBT olrVqqub225MKba#rozt ؖ |9ď?ZBRėU;}xHD_8ˉh|$p6K99lsW[?m5 .\&T|B U)s;>dʤyk@3nc9O0@aYzIX[>g6y60՗!Zva 21=z0N9UWyݢv8s= Y<(|]'=(8ylܸC_rZF< >=mG%tζ>d˲p R/*G:4a:%~_+$\./-$d "DyҮ7y;:FvU )~+j$:p\]/ iVm(ٮo`kah51;_6FL_a?AzLLP[_t_&f.QoO8mO ֆsE`1](F^W)jl Teq!i16Ke=+MhF^+lp59F@8qhrՆfvʮquppsFԺq1 p0? Ci1hR 1S7RRC% -5Q/UdWgb;qb(?%k>^)8 bZm^oa.Is$^xPaHQdʲK՝M )&@` 9{ 5T+v[MZm B G_+QZcn'Ʀ\'b$6iJǑWO*+e5vb =uK9tXeR3QAr@p@9+0.0Ɖ)uzgMVqѬo/cP5~ r8dn@hewzuLD\VQVx[v%RhU='m1S__wWiPնR>sZccqA5@VIH_{-qF?roi 6u^;甧̅FzJ;h#D'ȸ$pxrK: CH(2vvnEp*' F>?;DI \<_{yVԢ BGגrRK{wz+Cȓ?Blu:N p܂<}klm#[K-~8}Q;e-Dԅlĝ 3DwZk-mmSbp<>Ir55Rq?EX6NMxXR ڿV#DTb~nͯYޚ7pcBR+%EzALCqTimBWWvSGוCF!FA~3m7-/C!NrDwPo)^fǻh*BSD7y3}98TϽm0-ZSA)UD쯭F#@ -ko0&awyS2=Kh:K;Ίc촔50p%*oڵ,9#OyQ/}ǵǻnS'hH#N$F&X2s4=~Cαa;99j2~  0c zo4Z?00D!}-|?0M{h^Sh:]LD}]5/ EeA{?f)KuI$}IK1iU瑝8 ,WQ%chVŤ`|;W|5Ǵfw.U^`x˽˜i.kC(ƢqjNp $2 kԯ e*-w[f~44Cb젣eYT&y & An.gݖWy&Dj\EӺP٪%Ji7Gzfl`1Sw> +yy.o9x}ď_\~O]n(rȊw,o$Q y~,G^熰}.6ƛ{DSGJ؋XKՅHtqXGpG9sX-7fSJ~JX'1~4,Kq QW1H"޿"]vXFBDd5)aC3I06Q|˸*o`-P!MO` g~ӈj}{<61Kk?4fH!4a(x— =@ׄ;=-5kM?>% KƨdkŴ}1=kS0_}ƏeDdnޣh?'snޭ椷B8PQ3q4\89Qĺs[:)QR)gfKHO9Ilwmę%2p&nUWZvqM/1am_go QNys|mcAR.;8 OX7]`ٔ03݋q #Ţ:&wNZOᴶբ~|Vw$';U zO-f5#|d2\QBO=H=3d|kcWm uwaB.'bQ;ZL_~eþO6wQ1ַoD !@gI|eK_˛NpiM~"#UH.bhbbd:gIFPw08z7 lہeysv-@#ea ']x8# Ox h{ɗ ={gs^rA_}ھ/gL/rgG>4xN˃=*\LĪ:[mcO.`ڎɋ0Cz—&4 P tw2uGND"~2H! lhIࡺtKyN %icq3]柒$_\˪l?-*dZ`(LO14ܺp_}J]e-:*Ch[FAolfV!Ż3D oa#X-.@SȫO{h:D\G{f['oV8g)_k+(s bI[.n\}kzQ}j,Kb qSn41[j` Chbo?ۛDM4 ,5餪YY!+کkxXiXW'z*{K7 ^aR vʗÔD|R ELSbDLgZ[fdhg)IױXh-;e࿥}ӶZCyc-Y93e4&3Aq@N9.:!\O RSs(9{j]pؼm3#W:5Q ~sL2|*V nGG’*·_v SnE9_[Bi . CV%Y>A1.?c*^g< ܚ~U<]7RgY{z-ᕗسwB$v9x16+GGܜLhM 0Y b-k oap$dtԔidio|GpQls9!tK؍~ذbD({>h3#2 }\E3.=#!a |#T8\h; mWu)Y'D^ ؃U=c,0+W@4& h!G;vskAR.ASXqSޱ)-DD4Őv-m1FW,5C/bi"$H jZlUMk;ȼ? a5q>.u;Ұ4q`#8f@P;oG٠o[ot\H$3](^ 95ȗV˶l]xn/]%֜XCVjA2,T$Db O ٓ>ߞ:)6bMJ}t_OEe<бN @e]A,.0TqNPsHzKnM}-P+`(S s~8VV ]Nl:;IrͱoT]t_Su_s\@{itdP[sPL#bh2?]'C)[s -1kqⷝ `'=ݘg!w)_ٶq 5aJ@Z+/*, jzH ,swdæ[fЗċzG~\vRR Lʔ5` \qtTp;07Mnb5CB(LӚpN&aUBeQ~̧O'Dx5AUT[@mj'H#`-1Ŕ}W{ҁ'ֶ߫un7C2GU˙y@- *C"=ҹDypm>cjlݫ?ԠE,_#%iJHtc>6_Jv+P6RD pGFk .S1Q9QPЕVYB\c5~f{pA.`}̣sa9IRA$2==SthCpfOħCH]ټzRc(Hf/V/W:I`!T.ْ9/e5F& >[!a8 `kh<[p˾PỊn+CIG ưi͹AC_ ^=w>qvbmgn 1z3 203I&@B"$!@cXˢK]pC-Y.I&Hxl^9nk9Բ<ɊY}͚S<20(lג! wtpH=gZJwʻeoo)fHvHhL a`|c۔W)߰8pE(\ +h J#jO'X\§ϼ{lab97kwȮ?Ù;1€GHsێ+=n coW2T"`10]Hgw: a/xP_ tc=4.IbRxj: X=k \;F$xAX_=U.aYR/.nwH:¿[YIoD5p_#Jq6a:=jn83%(" >57P>zz$T o8 x"$Ax;O,i-q0,âS= \:tb[&# U HI@yyQq.~S G;%sExs#(v2›*8 ݠT~U| ͺV^ȿȦCJbYqUgc$Eꆞ*76enJHv,dZrt5wdTejի^S{RśS? WvU=e#C|)No/zT6<H[H92 4ɽ#{M ^PCeO."YØ͍V7 ~J(Efjn0)ye zôW?Ԝۅ0E2}FD=yW/VgbswnrO:10%jB$z>rSkbFpsvDX{B=GdyH/&'KI鯯9/M}y ,~{"/g,@%#/(v<ؕ%N(=z?Fa)Ay  tcG|I UޘmȂU($ 0{F:vg AH "EjYwbYfp#qʍ,r |͋OqܠFw'p  vfw' ]lΝ3=$" o*ŒSr{ƩG'$QUS=^Vֶ12|#Y7*&[Ix/'J1zi="+BڐN _޴oCGmD0Yz3FԃH^Y 5MO]Eޠ!,h@.ZUd|]5uݽ% ;u&?>FxDT]mpˆ|Lua60.ŋBsn.$^z jr`SgfD9x%h`X]^Wg66AaS`Ъ#yw]Q Y?lVwgƸ+++++++&++++++++++ڳ/y8t]s+⟁a9 4&#`0;e1I7E]S,ϫ>1!)ۄt)Vn<^&?ځP_!#ࠑh*fWp*N 'M |Áÿn/O2j{t]$sxvpɆ.p膼B[3t5 E',.uE@{H@ r$&hQ.A.:C$詂BN:rNqipSyނ~$WTΖAbB7Xwbb/Dn"G@p N61[6])']?@[%بhZWⴋiEtl1 2H1c ABV$}o[};>.~lkɩ2;7bf[*_mu*H&FK,l?q`ŏFS{*ԥ@ZAOvpSTC?qpM sLRv^6aacz5iTQOkE1r`$Kwm `6ΩT4Q^n*=vCC׸ڂ^H@g}ﭫЧj#ʧ**60Vthf*^ t\(X{F~8lj*K^Fk !hڥCIHBKefI灲J4I$ CA-Obթ2*> u% [U{.X0 - H@}L+.k`/]uY{G: 3xAT6o 3_MUm֚yjΜN!>ı;XgRjlWf* UuGSxmצR(+DPĊx&9aFl9nqj[ήꑹ|[7\U%*?1 Ȕ[@Y0m: L"+-ۼԧZb@@LfP2vmOΙи;۔*{9RL/Y zåC ?$t#ؑL @F4iM7{^ z2LŨR``>Fy23qSyG2j1IoKkfBe6 JcqڲwOň{V w'> 3> ^Fr 4zǰ">B1뢩L<򫩰kF&*~VJ8@BXh Mdmbv +BL2b 8睩@~}}d!C""$%Q;".2`ad~_~_~_/z=GK`0H(A -p=sCbg,%{#O"3Bbkk4ǂC K=̍ x]Dp B֐~tL@طr0Bv~dkQUqӞ489Zѹ`;5mE0h&q/MKJ 䢡9T i/$B"F FKیEEv;:G,g:yn,It>?SDav6@m@<JN< kYc Yhm 00sW +PkzAl_S¨{CwrjYigCWCd4 aq&CB [-lqX15 Fo1ȀE4QG|dl;_S?>80L]ǟp/[TOK4=k}#!b!MsPWZ)Ȩ0D"A,Гq C7kOcJ7ttK~Ct: Ct5>&q8>'淾"i5Z OF J""IU7yυLA<)$q=osTV.4uӕcd ^Iu^bPF![YE~m0p&J 2"QSu;O uD~{?;_) }%dm#%KwesseFuF|ȑ׿t:Ca: =N7*$(Mf>DP _DD͏l|dT*Dā`}D7s&qi/@ .ѐjxc5ҧ&૦Ӥ WH _kt<'EdGД@Gun;a|&5os$)< lwq9ef<ڜ%hY" p=6=61Hi Iyq+~)8Pp\, Ipl. ap,&uTNƗSǼ{mM>SJKhzD7Biv`!D&o^X <Jy5." Vƒnk3#(H ZzcЯl $iDgK(?ˋ/XdcWj5}{>sǕ{ǠJxs,ZA&IiB]ov\x^ lfqn7qn7aan7sARW}q=aiWFɠHыA"$ _Tx7sgr5$ղWgMͤm+o;;(y y=34{!dс=BMnʙZevvvٍz~= bZj _hRanχ0ܑ]/{\Yܜaڕ~jpߢ*@ZE3Ra)6msUmfD'iU}Fi5m0Q A{-bfp]~j{I5SY&QcNZd֭u.Ozx=~Gy91Mr0>\rc*^3OA= 1RץH۟|KE}sH!@)5@?7ا6<1# |ة 'KaRx~k0]K_=ap4p_d=>~WlxU&J~mK_-$em0g.#.mo8ޖ[ 0!|z^ȇ|ֽY &CquA9n R؈5Ft1P>֝ ae_swܾW+"Иc -a&(_Iu^QM7Isa@W8CJzrvV:zRye.ß߼0|~CҠ|8eLڣ(lj?~/۾} -!MF Dʛ&[9rh!~jg|}(6j!2A02fJh/ Oa|iaf ^(!,R{pZs$X?h+=s~`Oٓp*Uΰ!Zq%O')VrXNe8w/n; O]o&ёDq<ҝɮ5Wa&qAcuhb `Ӓk_ G?:9خ'X9e6JnЕcU9'W!^w+'߫;i(!( TCH4 $-HR!$$P`  $Շ~$Cp\, h퐄 oCk)61SC4?յ7ۍ1iV4n  % l7)kTjm$YP2)キIԶq쏱Qp,Xgl:rK]#{;l9uB/ŋWPn>n!IU2uɍIW nJ+|}c\^1ߊ Y;|ŷt}̽w-)"$H%opTGmY.fܚ'pACc [T36hr1ko do~J75f5k"eE)^n%n4CB6jqр$+|ECd r`\Kt;S&u= u`je3|Y;ukxTB؉hGKg^crqIpN L!Q. poXzۏ?oUذi0ᢓ0#h$1I߇ ;7}v?;>GH®n镱\g洙C(&{RcRg8>U$9{H,[X ֏7#J{`5&N<_7c{'Z,Oocj5z'xzkI͓gw7ܥ89OIt7rV!HvM 4ʎY>us׼aDۯudv:7+1x4k?m"[&?Zs֫a_=}g!fe=yojcl瘸z=%NVk{!26JPvKuQ܄zQ8 9OUQgz)VGXDS DF0an>C jUiz1^%0הrGlb} %b8׺3$ϵ.|ڴb`U?P$dKJjBmO) +5 ۢޯu[㋫[[ӻӅi1Fm6W;LiP2M38LCG7eld ĸlUXP}R!Н&3qSFO?os9?>~LM2EvyI<@_- e'p?9 %pU~J`1ޛDUha6>S6oqL{*h$WCI xE4}K1N4T <1 +FFf&9Ft*z$`{sȚ٢B*ٛQ>Empm9O^oXk̖_)gE]{@1.x^K.jL/SPGUVUQg0N1f/*_oW?x} к}^+9c(YtP@2dB*#qJ%i![#P`Ql )Jj7bCO p! :h[w?zLoE-Q0̰ax> ~rC컦lds F&_VowrK'͡ 1_MÌy5m|э'M2?7BkM$!Z erŎ -F& NcvrŒ<Kp {oC RvCx 'WL*0۾kPm||wrr՗o+ !wcA:Fh,fkƌJW1}#ً Lp)CTr$YzAd>wP(Ohoo>^w87ǥ7 e g9~ 8Rp_ G|>^;-)0 Dr4V"k|l{Z` 8!k08r( 3#:D2ptSF2+3$暼/ʂ3 Y ["۔GcyE qW󜪪kZ֪N8(k輷BIs+#E"]aj|e _ږac+uɀSdqKS/ی-.ˏ1ڏ'+ ?* Ig >4v'ֹl}h ^HH0Yhxr][w»qLϹQOx9?>. \l$q#~ X!Np0 &)0e-oZ&U⇐:~4-.JtogA폻gGaCc.Vy qVٓY41BW 0}yK:n"Y~(mkYt WDR6Q0YhBZV|G[\=łWoX1:<36hr, FSM=Lܡe؈Xa|@s/ֽ_b1B~A50A7%@\I)8CKu+f *vbo7<+gSgfjpj8~qt]7rx8mVw ۥG  gS7ܹ,Z-P .]^^{r ;C^|ZD1zHKr*/{P!r&yc<I[gIhŒSAsS6ƆΈs"cBJK @Fz\k\>vU-|& Di gbۍM7&w~j7>LB nv"k.(Lack?35(So_⦂\; ;͜Cʯ oYGڪ_bE_[~]=K|V#vri4bbg52쌯X8M|hlSRK$M(#? ȥnzթ-ӂO麍&64`^7nEq\g =)@郥6C3l;/ep~*6RnTҸ~nʾ޽wꝃdiʟ{ qڜۦ]C|w./E1LpF*XrsNH^V#_wG |^o^oecOSI)am0\UznCP2,߼ ͌@}XTN_|4\/YT5S/tܟ/wѝ>.brwp!?~iT 7m_zz-?KYlD216Rz{5o-czfn;SLB*k簿sÄD;4n/w2/%[GN:F`'e5VZ@tr][Qéߴ6?[KK?;Pgw{&ZjQe=ʥe7( w[ze]/mڴ^+8Wk-󬚦״id}nu߃tDb8eZtCGitn™CJ:\Rac_?{?g_{ඡ8}5^*piJ0Zk>EX񑦼YVa3u5oU3l]?<΁J1[98~+Hm671=z"wg];I0*fh_Xv{̞'<% :/ak|Arput'KZf\">Iγ85&?pR>kwwxp9}OsIbg7Wf|FTM樿]A`* n?`1cN{߻kZֹ#N<단:043on,ah>nanZw8|="uͦy`[ٝ!oLaƵv2#5 {m t@^kk/i:KHI/[׶<:q59t\|*T?GVB8{\wX>C:x\k*-*=+ sq nҶ%g4rVav)ʞ,|#%l{;؆g+k)GLh⧚m9JYrV'I<:|Hjؘ P : )lutE孡[J~,6#?⏔ilItOxْ^֮qR\eY .@]n:#FJJ&J0K{ܛYkkL{UY3 ]S8luF`r)2YM 4,!$emۼGI xP#==B@KY;tI/w_lMWYv{Z, EV @ĭuYYyj3<*eiIİP;TzYBk>G47#9 1M+HىE4<[vtˍ;:]O5ttN:i9 s|_YaËkvZ {}$%oG/hç]D: zPǤz{ƟGi=ka0+n.5 #8֔If] xW#=P[-n +`K \bRb6dRv,J'nCeFobwJz>7χ_ Aeތ4,,W:=ke `Qaثj˗hۜHZ\S?ȶ<)ښm7\bxI}vk?y:vr/zџϽt{'7~DI^mtG>?)ke2y|ʳ)mf{?SLi6e;'rxs>]i)x/dMhmu:\I{:ohwBCNu kegvU;li =*hos\dnh![444?dbݬ-jCQtS7GҖ Y\R`1;)Ւ#h폏dA2c V Hϝ5w:r6cM;Aw~wXq 䀟guu4Q7RFDZªLSÇ+/A&Iea1@{%fL(#-+cN7շ_Յe;~ӂ'N ݯ;0oc k{T^kJ%G0UOZ7]:6Õ>&<_~5:;nbTJ+4 r-яnsÝK OW .F0bf@4UY8.YOv8wR.ȧ1췑dQoBd7N|'èlG6jض̀qj_\ VO_  7p1 ӱ(eedG> _ `cϕbsI.SV̌kMXqr0U,O5(sA,Nb4]wVfէV: 0`(Dg<ɐ{!JҌ,Sqa\(gs˝[ oٻP+`VQTZqjCw>=Z*Hr=j?E8,߉ լ*B5Vaʼnba{I$^5ʳJQÈXV,O #{ (ٺ݌K89)QUFέNdZ`*kVG.Hdǁ3>5p eډتCK681eTr5Uc)G0fIJ-TZkz EGXE-U}u`\VM^L$̛Tgl(8#-JUdՃ%ǜ_}G VëUܱ" cQRwTm!u&VUouo!WXīU,}GW# C6I!o;Qۙ SUY,,{ Q],D\ VX@! [~?Wt#E\]2wg#v}T%mmj W-""b18G~'BRGKݕUb"abP#jW6hR5)ӧsvmq ]-X.iyL^8WEFK!  < ަ 0/yz:)Yl3-G/w0d+0@WOML@}f'} |!ӓ%S}/%, G#ajmw%vʎJDgʤyD#|(BP1Tnk&H+IڪHB+! eDUzOq8NâJx3< ̕]IMNz|*Dܩu|HA_ꖰBhQ͆,,.V6 D%)HqI#zn-:t.#QWU+Wn^X- |h7C릘BGbװ832]v]%^3 cwgx/ˆX,D^WNQO* -poV2679]]xkh3wv6q [vXqDIMs 距Jse~J;65Q+Xci#BWabLNǿʊ:>p\!)9gl1St{-#qIrD;Kdݙp-\9BŻ/w;]ջ>m|aING.W9(i+V?џO"YuNjg`^HQ~՛UtsZYCP&8ƎS6"d 20m7{?ӰU-ROw(TIlPֺ&eHwE[syuÀ>!Օ#.[?V2ʉ,O! loNLMo qZFwuŏm.Ú:~; D a'ʧ%^́hR D 9֗7'LHڱ'~f Cc,<E BH΃~ a?;ֽ[~+5%l$cM~*,k˱_mhR 8 aĕtkۨW7Wҹ&L2_o\ Tt{Q>smƣG͔GRǽWHHۖ L s(~&-;wpI*bC4DABǝ!D|F`ZWC~,W?h? Ϡ F@$ v7Nf ]"\n6`xZƮs 5_W<o}ASz]cs}GldrP!14nqH֙PϺJ_ϩWSOl{b}Syf22R+CVG@L@=" 9G95$#}l}ca7mDd>}䜱̏zCRD2XڰCqS $a;, ls'Mu>|Ǐx 2oA?c^D16En%8ټ}v qh?>#=)(d mbۿhX})]]9U5 Q@ln>f,LH@+tp/1c-ȇcP&5S*^[;̒'ve: EO%Oi kO%5SUeT[q,8vjI7~M ω\ o[1$4ρ]{->JKuuϕzMԣڳu8oǑԏ+B$}sUTtH،7ooq "lkL%owNk}wx'{p~:h?vz\MuZ>\%)hfZDЈ2idЛ&S3I#}Ib~:mVzYsuPh!Dh =By!P7UZ*-YT֕TI$ 5-_få穉e˷bSk&]d E@I_H!* TTyɺ|FIv2CB殱9s 1Agޛ=luyu2Y{*Cz C51.3qOV,_\o2ZD ^&:( ?DP:@i 25͚1hkp}H)5&r"Q)I@T& h=uO4ǻ jw獗' >ݔPRH Qr3hJ^;(sm!jn6o[ZK`k?[éZ=== mP/wg3mt_#f 9۱y _[)T"y*/BY%)n:=0LRy%O[c$#bYV}Cc]sO%vOkO2+Fs2J´&(2 w覥jDq.Q ϫ\B;!TEz¥X"YVSrT-j>OX:~W*۲|9 bH.K?T7~&~eIc* ^O9Y1HS׺E.UPqS: o)=*-wDz0d jQyFlv߫0I f3J8[8\"']]O^ S&b!O+d^@Cc3Ms(~{~?5&}@ð>c۫:iaiȺ_!hЏ83 ErmeGpƓ^^qnܬ2m3wU5{:uGahgoIk{}LXDAiEC*ͭX4`@|+;/+VJNg9>}|EW0o8]F" xtfA SeAUS$`IБE3]b[&uG+#_0K =w1H?ds|#@UqsD";c 8XLƬ)*F>뒴[4ݴc#Ch庉=ugp8>:>ԽYR3f4O3tt*nwWom9HW+jG=Ev3vNLbPRJ(mp4!}S;-a9c}:zvoz)4Nru^=Itmeu{po1CeK̏ɢӴ<0$aVL-Wov~:8JCi,y˶'E3I1r HFۖ3!60=BCVȽ*({d]lXUkMxOtߜv -6E]Hm';Vpg{84Ȫg<[fC5Q']&S:P;&iQgl8JCGKh4λ\8]J,MCnF<ʚ@%11DfVb6yLٗLo3)p fj@BA/u\eZ?A:G_s߭Yh4\SLZRq`Dž>H91R5jcI#om;ӯrq\wͪA|0j$3$bʣf,1)gUΛ3RPS4%.R"v6j&"s@N Fڧep7g[B{]W9fdch ` Fun/Z-oM)dHjrKZ20qH%Mk ۟{_Lj$d15#d7 6֔%ǭ3t8om{hrnZ`w\C/ VlY[\G .'H]m#]#,X"ͦ?\YMS Eؚ=_%Z슨4L!zk53%YW[c*R63bOo Hcp_ǐ4~ySuOkqړG>.#m@4.͌Dn0| hV8}Rw`otm~Vz؁H#uI`~CVPfU没]"KSqY;sa]ڷqKV,e2#wzř*( &/lm>D5T^TpV&%-ZDI.e-=A';VkO"5 L˜Ţ&҉ 7_\L6oFޒhB)ÎahB  !4'&ckyv|;19H)sW;o?RȬ]e;k~jv*WhzyJ8K }6Wxv,uP߸^_)2lδ#RȄ%k!zZ}~\P6{"Їg"ip{"iJMO\)䣳'VJ@A'DԊLleޮ-:'ȗn1d7 T*]#NQG (=pP ab͝j!&!T[8:5 krY"Q3ҜUj0d)EdXqjpji;&n3_z-)灊7:[JC6 ZC -c2s8rϽ14ï?sNޥ?agWDP0/ kI-]*4 Mou}2Z;v{?HF@{*$:mJ@6c|Љٵ}@`3jjrj6eTNssP R "B) -"`bb5:uL83zKd&4ZLl'z 88}7ѥES79LO0z! Qg>XLJ <2FB,5r"-e\z Q;T}Ʉ$Z!|GHb2Kv_-+le1n_:18AeXJaNi[F׀ZVrԇͦx)[\Rad 9M[6QpߌX>VsRE%_rޮGyZ\=C ,ؐ A܁;n.AqX&ޝu %;\!?} v^vfnY Pt(TL5*:uA4B*PŜLOYLaZ8ZP&\ Fcn9uVNҝJ"~:ffk5 `CA2׬i#(~;y)_M&/[L$2d \H>K#c[&F(Fy ˄ V\@$}C3B?f!4&/=֛jÁw졆\V/v*DňE!IgWNDgLP@@`qa8Vh\/At\'X[s}C<^]`} NgP=5Mi\$_ݼ(HQ1ͳ6z=?ĭ x6zB ,&2qBP_z|ŋd籠 E(ařn0G cDK1t=l|9q#\d\VF?YF..2=9'Hoܹl$ ^kqbI`?Tsb9\I0IeC{&'yuoگ:cR wC_?d2\g4q͈4M|lX{}>ɟwZx71.V'2ƜUJU ^x&^y>+~c{Iݝϯ`v{aEIQ)9>?@Ϊgx rI>VsA4K_fS7q`}fwR2/9bޡ  mbv8%;~[rFeig7˩(Hȅ&n[wJ헄nz405KaSp-lAEKXSD# " l~…[1G 1\g@)f@kхF]_+>S)?~GiLjLQ[Fpc وj1F y[RпwFXL]а˔zŇSn`ő^/Sm]]bJ̖T/e! 0<1MwFNRn=9+%1i|CKcfMEi&xy{.__eGkvZk]}v!;SXv4Lz[r lɮդu6wEbo;N\4-LdYR=ڰc[zh$)~s ~R|gpFSǺ7ʵ(?Դ(Y,J䍉 Tm_ }("z?GzIHk>eI5D2VuNnS%Z#kU,ƞK'N:1>mm~{~ .-0X<+Sdm49c&yd+xbey)8=^0X7f=[KS/1I0A1 1`i\sD *4c+|FhߞS2U tNQ$02B5$(xK2xס.b_(P聀>wl?SzOΩjMQCD}$ AvvQ(oঐ: 6JT "1 ^cȲ.BSX\ws5mTfڥgknXN5;`f(DZJ IQ%f/FE2Ev;w3!TgbpfbWݹ%q Ԁ(i^B|40|D<ҠqGs-o}sr9tsaCZ}c6Z([s6(PITx+(\ :+dH5" A%nPlZ+Ǡ>P o%t'_aShV~Kky6^hZf-} ?'{<V:nBpjX͆m6ln HpQܽm_Sp6@!Rn&3*3F}룰 z)8.XOӻC T8zP?7@7_ &pYA0..t{Kd ePjw9=izV2.&;Jg|qPJ.Aᘳ>d^4>-8ַ# zk"MQom?U:2o&c!ecOVM~.ZjÌ{MȜc(d }gh^CK W<0*olP{\DL5u-2Qɯoxy8xMI~<_99%]>/YFڦ}Imuq'bfnZEx}(5W_~8Qtc)$>ClN$uRi=l]9JlsqP謧C=gMzo/}bkEf!u9*`CGnȼy@{G?ݻ, l.)V&g#1FLQ"KaլT\*_I#G/;yn6gipn`u 3D ~T _g]&:rdtZ:Kl4QT>cgWW~*=\v:9`'S~L o*F!Cl͌36kAk ׈ `mpp*RC};zֿmoܕͥfwn,gT ieG{XB8'kX]9Ά;L s] Sߣt_Kʍr΢M6ձ5@;nD@5 9zGifF. 5bͦf Ƙ7fs; f1bSp ״GVlaQCىq7oٵU9AAlf!H9r09+E|"M mT+2ʷ+:Q9}y'wMOE +(E*x+@0Aե ӧ?+wv5Yf-3(7v_ cNb3JGD 'EDv' i (. xB(y\<0R΂`$)nOqUi(յi`H HfB & A<} r6orENXC~6i8Y8adGcTw]{Y·%&XV^84**k13&)ENJ@֙=}Z)#6CK 1dMTAa \q+ HZY k~ 4ۈVZ~Vʣ>~{׺5JMf <Ȥw;i$WCU}VvAcpJ4W򢎩O6z߇ l]2F٨.1HS8R:'^Għ ૱A$[۴R~8+q2ּJMY*J ruj4Ua 2/ۖR WTHlr$2''m7[xH`2w[Ŗ4]fLu&'ζHC78co]t$EPxV+}k8ʼnx`ED/36ѲS9%*#*|#6=\}Ϟ΁s&;ڙ齕#|3;/87W S>+@@$(z*~lcfm]dTɭ1iH/^FS]zq'Svyv4RmTvLam6"230c4@8X߻(!s ۨgf߀bJWpCy^F00w hwrI| P|3X>ýn(8&wail$`Z0|xyHBI'«u&~h*m6/kB9}RAT[#'Qz$aU;:0TrT Cy ?/d%۹T]Ds$fdBC^_l&b"QqH($267. ʉ*"Q}*2_Ig*B#1}8;ˌ|nY]&Z }o!^v Q# os-E#@iIoJ DԵ;M?g?y{F{Giy=}LfOs0pRS7`WB+c&zSAaE!`aÐaM9G@<ū(@9gtt Kf ^eȄ(3VRݡd:-8Iϴ.D 0Z,lF!ճc(2j2[}z4ꐥixjjalp,Tu\u}n`o[uّdKR pi߇>ípH^nΦaZƓ5'-tP\oL"Cg>=qQ g79IڐB:l/͇33i'<{t8 l^Zk^ENZm&p.n65ո0Չڷd,HPHas`A rX0yg4Bf|om >v|֢rJ6Zϸ~sKNz-+ҽN¾0 P?yV2ie, r]zHdI*2}DI -Y~="ԮM=^ lJP)j8C@c !#c^۞B6#ZšSiI2vw/zP1@;hF ~)&/ȵo]ANa܍Sk]pc4*C_EDV(=5qh dmMb*;5~%r@D٘,ԣ?XkΣ 4xDџ**uQ5ST1u3 y3O/.2ִ$:r/pm5z--)+[eg&mܹ(+ɊsDҜ 1snStL}})s` >?gy!9jUqj/ SX~2? ƶT]Q=5gـ} Ni uNJnC9X ̇H!4 A&f"i ٌ sЎE49Ww,;^1Ib<>#i裌3]{o*UQb af:#tu'}(jqSaa L7c-?MKoKv:t. 336SSQUcBP!p7ob-]N&~-]X'SDؤWűckpQIM$Vn;>Ǎ.xǾ"F'l?bm7gid/=,g`k#{}0´TVR0`1_0:Z]]ff1ԅ =XB.@ h߅kxw/?qs*¸?''NeI-jS;9XoJsI+@ y|S42:Ex'5DwWnהO`E{: q@,8 +H6i%$oc@ {+8;Vuj˒GAcIB7YEi@"9j1{(p D1UtJcxe$ \  6RiFL̂Wz=W!ѱ 'IB5'tT?Wl~]_G8%e4c4ٸ{ڑ~g;{:^_|-zbV]A1J"q?_9*o3a2B*b<|*9Xb 9*=6L<ݿ xTloQyu h,G1ND T^Mm-%ꍾ+t?Ǐ N.rB!6ѨAt8h{<[1kKQV X %v!7?[SDm2f.D  AH-.7 g !q7|[~5 {My*aȶh#JtP4S4Ąĝ.Q:1.1EېH BNj`jPU'ᢻҢ2!;iMhCIiNJIVuc!1SU èbP|bUsďd?>7x&h2wqD+V[hD|1e<6Sqim$}o=xyi ٫FS lT#RӤeh-%۹e&Gk7i~cGfTG }cPMzQhixG & +XQ{\ga[v+\nM?m 1_MI}t }}k7|ZvCdc)oċ{Z?K;HW&w1͢wmbNZmG ƲTԥuʍ d%`CCߙZD^:$שt~[F3]C 20eI n= Qو33Twd"u3]F⥐픮5 &JDJXErk1I!kڮ;6pNe?(sp"@üRܣ |x%b$ 3V\ 9}?k)LK`@9Kc 9+6ΆEǢ C5|[lQǁTf,xmp\uD bYy, iL"0?';avAuHi~mKXa{k=&I| 9x)&rχɆIdriq ޡJ6¡X#OI觠̫u)!A}P'3ZN鬪[zQ13He#[kR/xT7 H#@d;V0*?.@-TsD/ܡ}?Rz_d&7;lkѢ0>H03W3?BM:}kUuV/m3}Gz_w_ Xr}gt~A?rZh?0[׶x{$$gʦ8M,s..ʹ[Tr\*sf!clBۉr\uEX^+ܗ۲@{H;AP7fSA R\1xf8X7e_c S5FdUԴ{K濹o.Rk^#F s1I/$VۨVq`A36Q\{[RB sQc;\sny(A!1*3Rai  T[u#1CqNk; (MB/Qچ3B_q9H fE-)&̇q0y=X.3kN$$!Xb.nvհۏ!^ѧognAe+Z{P;+N̓Gyb#z.0 EQȓ3+]V\VYS#yh|PSb |NGڋxj!wd?68񿰺&*tΊ#Zf~^ŭYE,ßfp*r>}g˯엑W 拡]9{¹PY*YPA(V\%D00#]3$CىJ0e 6VNT$ ̪PmEv2-sADF!y @5(a戋vt;77(\Zy0V]xoP>VZ3tuw:&2h}4H!-"^u%?˾ ftAMXL]"g$6sbH(@K򖞱˼{QWӜc]qW4dRVD  v1ɰ ;3=؍#T<=ʜ$|L c # r>?mPormGv9nR%2$@E$#)dcDHfPN).{޿[Rj4ek5h:mrx'S.L ƕѡLz퇏AӷnJ7|3|2`"'o* lDIn/UagH z9ޓe55I=Cp[c{b6^݄宾VҔoW78/Vd TqwYfř*qN2Z1!] @bx")V 净>)ZpO Aw2ULZ`p aʹ ~(h&Ps*X/[`rmTQq]y-XLwM+*DJ6PhKm4b!lr=ܫHd FU [IL!e$%?}ݵu灟˰_<$p %-PJӊ-8k[M\C%+ضpf^;-c=b &}5nN3Go`wف-Q e@2#uu45V<"*2TPS`w2dpDWUѷŊw  -OgiF,,6D~:߇ZGޜ_b65S<.cɓ kUo706)P*qpE# xW:FsEΙ;U/H63ی0J5ae MZ#VF D W?I79-Mک*B$pZaw"4r0H4Sc*wAIkig4B"F]cˠx]YE&$,UM.eE9@g alZ> W aep[Pb.h=׹&j7Fkn<\Qղt7LS}#\[>`"U6~}™P"8?:dWRSD+ `C۴*m!~8>q`j<-͚Ǯ&Jzs^!a3ܦh;B2z ('3n^-L.(̽#; ٜ `UU abc8iVae]'KaUjjV3^d k:EnҺd»|p=&֮VzR d&RḵH.uJ/]c>)6*!~ H@i՞9#jW<m)j~#v"3m5#`YA:0a``@UCF`gN56ѥmVC.eeUn78`7qk !od(\1 zͻ@8(%,Be)Y$ydnaqʠ+z-$[늛)/َB;j2)lD|p67CT,7J@ݛ04m8 _%EJ_jź #zr6OFo/ r^HGYN42b-[33qwWeWw#R :; х_!MrZe,:]t`{A6ِsry+'bseQ{6LT+mb.pPo~B ׌A)Kll֦RV>5a8m@ܻ&^߶v}z틗58Ϋlb ὧHR (6 d:NlYZykl+iQL +ŔF$@|cFm@x>kP%[Կ6zmO|iMQ*mCi93VjiYRޣQ6U_Թ BSF$mS TU옶b0-ynE Z͋u.g]&i`Z!T3]n^Z&[S,ge6~".DLy(/!pʃ)Æ,Fjh4P:|=R 1jMJ.ZrՉGe*`a71Esk609{à+Tj$qtdqYs'&zV8vVG]ͬLsۢˌAuq\\)e Y]:-hv#khaic5d'=_W wX07je<GeI[Ƹu>uaiu8S\1j8c.f *iܮpw0!P=mXз֩mDȞ~&@/lÂa]|v/!&2;T,3VUm}%x.7Ѩ2߬ Ɗk/)D9]O*.RF)h|G:VuEpM?3)o =H%ΦafÏ_ 穥oNwY"ޖ)ax(׿q&e dˍ$mȶy:fjBMkkGVî+;cmb :F,w#;vkn%՗}iҸHY5kFE%VxDY\˭}5+DTE.t.(&(QxzoώD]xΊJMUő`Nalg#{@ [2/i&sT]],2"0QP݂o!b.\u.囉AfVc pN`k'{wgbxYzfe|,'Hɣ\eP!7v}OM,B\#&U)ec͉aT f_~AW1RTw)yNmMuM&xhȚBmP%6!ZlVͅin.3RIZNO=-]*Yd_κKWca5Ù;h[ "j\{3XmF]9v+_ 㠜bhKu[P+]ē8y_~TF5gZs5wiSiНGDIpźIW/YkYLSs!P/itL]#tlQty+2L[̦ff=ѝUx!'Xc2m@–e_1ītvd!`}m9m'Wٜ+[}eD2qxƴv2M AetKQԍwckIjSY[uei$ljﴢrU=ZmZ˅*,ĂaSf:1vx^6;xpl3ǹ) ?@\1y^5хpY цt[82P&N.Zil)Bbe1I1}XDHY6\D-^Zn[`լ-e$f@&tm^~$ = 2K[&Y DC@FX!ĉo `86oxCx-g"Њ2&[ZD^4P"eҳh׆脄b_(l]qvR}'4nwh, }P=Z [Is4Dx $;TcD '^5JqJHt8uDUG#%E9p/81Ccj) /PRܦxZ5?hbUWP5Z;["dyYׯ4PpMkR1FesP"Fݶȃ̅QfJz#p'oӳѝz׾ecC )@!6 BNqRAbcÝʌQIOSegg5zb J73lqЬ)"!35g R:]~;E;MN-(l k|hPz+/Lh?Ԓ@a4H6#JPQDY3HY{nˋb< +'㷽?n4w$\n:ט`ohty_@]t[Is?w\Mb)͟ 9'#7:LV@ʖyqVfDe7]vim~n^0"Ϲue3Eo?AG~VOEa yf6h)/}JΦ=$_*-ȽY(14$绱Ub#ZjѧV0-P\/mcyb|u+e2y YʝW\BwF_?W L*A|'1^3 NރAEINuԺLl<\jTR.4` 監 kN⭧j Űvib;Owr!_zDjϤ5;q%L i%[sJ*?<~U tm u{ 7 D DDS,Go5DhaWHViYȑt2BgSjac_X_qQ_giUFЭ儣w"HRRQTЫ$D4LKJ𞣇pUQ7r1 ږ,4k#()ySݛe  6ӗ<˧~â=n]|o ;mmˌÀճ}5T{O`^ɋr63NgN0w.+gK+ B;]kQ`{nZmEFty ,v-0~+R:fg+hFN<~G^l7W?PbWJ1e A4$-,.eM3}z@{Oe7knHil6q+or +VqRՠ[V?`r{ssxv½S#܁& Ss<5ε7Q/G Y^7Rp1ϐ!%eNq$iF㝲ǀp)'€+9P9itXie;^1I lSf=r[u>q4߸6d'\NW)1(LC0pP-697]ddv3Z3f6 "mV{^.x~ VX<ҍy`Ъ&E\kIt0*F8k#Ul2btF܇휬hv>1W )O[I[N<J%$IJ(=E  )XI 53 FJSidFbFUYT:+}cfmnt =-oܵYaങў‡/}Uh5,1K1\`<E:pu5lBaiÑ[³AAUAa uZ0:U](Czٖ gv^ҁ_5!Vȑy//k:kOp͜+Z7ucL}N%/52%NTf@ Z{ċ$sHc=`!ΞR!\ 'Zv4hp>{QFb6Hіvc!-+$-xoFPdLw5b T3rNcJF?.ٍ0AY+%"Az.R)vVxzߢpjڇC,D}W躯Zy"{J7Xh+qO*itQݤ$BmA!#ehDMģp$ك6>K>ȞބCA &/fl+ZaK""&OU~.SW+қxgKo,B72?o`ؚk(9c詻_.Qp2DmέZs"w6qtVί L]UDD`4 @ *NӫhTX G؄]daP s/lSn  KB%% PUAb![p؃RI( LH,T5ߙ;>sVTu~Gry_iv?U9\o# )$JQzɭ/ z=z$;."aHDIF4TSAuX D/AdkIQ r}vֻD*?eFC@cngf#5eݝ8eͲ[<@i2}SOjS$Nfgܤ*oL`^|Rb؍$**gP-R NL”_K96.e(Qؖ0.BT>RE:񒢏";9M]}NN &YL ~2ƔhW͒\+@hI -; !KzTo-2(:˗6_I)h|[c%Uw f7vt>} JϦ%U3伦XDam6KX\:tVz bjIT,;hoo.[lk^ý' ẆP(zvmSS̬q㓯DDK9"-{k 0st5^޵iwpEqX?Z,^V(+I7 k8栘" T_W_3ےGԬ,.GQ-M];׳ דbFktUGTjس<2QkO=OuH"rGp2$v$[ []Xl.ԔU;B"#U]IYQ E됌R̩gcdvt7EX84/»rqlGvS KSWYta-LFp=~2 ?HCZ)VdirC&k H/-԰<-NOU'y"-bg6G~,6Ad.]E1ψ+,G&8!Tء#c;2f 2 ֆv uK&AYzCL"W%-@䱅%7(|S:UyR-.Z pa ->e䕸rPZ!=5|~GYe^i0;qi1<.kqs^)5zMrñ w&:Eձ*[&;Td0Xђ*6E]n baV5 txp%V^EJ5[˚fs~%͌(k'[ W 5MUw4)U79KksHd$b鶩F^<8\8@!F ~Yj /Jym=Es3a%&z tҡkN2ecW3U#U 5p*7X]D U*oa&m2-mz%$_iïX\?;gK+Ea42~Rtyȍ"Lkcʑ5lٖW$xL.Ko!tmi"TڧN<|WGd ,FNq`$vC89DNo{~rG~3_Z~1׽v i=tsY={_Nj,UG7gS馜%{XB؍JRs1`vg#`vs!Ba FP! 0m<2 +!,! >\Bڄ083io)JY9^5&-cJ9ߚv^]M6U3;Vzߞ.7: ٛO}yҨgsSğt=_` =&߭'W=)mGCs|=rbj(@XE;JZk f; rlmquwQD|yzII140Lh4ҁ#@|bv2ܑ QCrhSyEw4  &\a.=~s$%utOVŕ2}mU$EֻvwOcg=a7Wݼ&K,Jcō{Ex cAJ{6>v{_s9 |tnG?I~]j}o~3Zo&iwP&`x;}.{6afO ޯzBcGə^?sOy&ؚ';"HyN Stl*S1ƆzD=ơ}oRN|~I)Np%O`H=!eџbEuTu]ӭ.4׺DԁjxX1\zmPS"cn$ AtPxrr$Zhapqn :IAS/g̩?Yֲ-1 N΂a r!Zp©qj#xM6̝!x#,( xm#?P0:DRw] KևF$R&+f,qgi?stk;_S2{%T ĀGTsvA,Ȑh4-4EMQi=\hBq+_=h.룉f?Y<Óq@"tnꬵsFSG߰[[%wLvc9=Yxba10QEwߋ'l:m T"1 PC AR!qէv"N}M( m?ֱ4VpDx;=x~8=a/wף7W= vLwjLZczNA?ǥw΋ 5Ppm{{G p!g`c*t3'ut> }ix p"Դޔ64S4D̝mƔ3lHa C1% 9 &dg:Um=C[bc 1E]I*0CWT v@/؁ \}̕|!b%>q_'{cRGeDp[Of} ̚i=06A3vlXUc>@e2q!߸?蹫x_KXݽlhHfw@P^"C@DaM|N~awM[] hXfH*\6*f-mHy,"]& Yƿ7觯eXzϔWڏ SD:~l@HBVbJ" NN" b44ݯv9Ԗ{gY֣ KAI¡Qx߯Ή^,l.?zي8ƵAvq}Ȇc._յ3I>f )2ܼj}||ЅkJ_ZAX"ox s;:=ܫ$Zuԧ̩գ\M\V͖^߽go"_\lXn*4J-]ҮiT?\ΤXu5 '"#qkgs'_q]fAPkzCl@^o`*ae3.7|kqIu5KwYp AM3cI7H_`:]Ƣ2\< tJ,wg)/|ksE X#a&uoIU7eL'p 7}yĉDxmes *3X\р3fw](rQCs˞@{Jx,23m!WAn$ϧ[+hd\6d&=nȬuĦnV@h<Q}LLo#ӊw}ՍӍ8C8͉tIw[8ϫI{D0@zl0 gO>b}@Q]\ GS݈,~F))Ӑ¸©I=AFmR|6 6aCo09+䊳XK@0٣ _ef%n.ұ+(`ޙjþQ;l_Oz1hnM ܈w"M{ߟyz{}ACc&vIRKLKڏ5E!J7_+'m*N}>@#$͟VYa`xAFjCa\fEXM'i}7KjJ"jfK7ሐûWA3+~`{l*} E/F%_I, LJ`DFdү3XjT'zc4zJ7Η ,tR4>MsfL~Zˬ{+ $?F9J UIFwg(c2(~m}#s2y> ?(@uUsOMv6}mRJQ*?*"EX +@ ϛ.9Ly.)v!$EHQp$Wn8m5OomN7jpGWlPnixdXp;Z&(a) mCl\@h5}0lKkt *dnJHS\5pN g6Gs/ӓ7F~iVM=I{Jڞxㇳ,p=ۉ'6HҪ/t h߂ X' 8T]&'q AҬ 떣BXa @Cܗx-3e'u)XЍ"P¬`Q' c7JfuŽO?u@+=$  X5te"ۻ@ev[…P;5o>=KFIsn2@) }pb[|3U(;(Qia3H"T3{:zZ2mD}uA³{Qك'͵ᙚ:/Dq]FbJ(Հty^)nт-h&"x *yŀkKkCieFF܂r]Ĭ6؄; Py6iCx{ βCߠLU) mnOgr!Xl>-$ߵhsi|Mz ry,"6 jV7|76jz9~KOaLRI,o3/X)o NhQ#Oq'Ҟٮ"-'EݛhyOJPVܸ{ɻK0[%λAJaIW&B]-ah22xHƙr۷!X=G0 d]o1 W9qܜY%<#3?CFI#|^2| Hzvyj޾~о);+IMBujbj:3ϤnuͺEL+Eax#|jٽڴ)Gh]@ܝ}A  ?dt nmպP;о[J@ 6ZbU١$$?6&,Q-/X7I%*B 1bD\C5X%ph I"4!쯛(ȣzA雲ZZ鈅M}+[$" qhgoC]0?ۺMlW?**{^E&. k@q-##0:?ᚌXrނ̇'EB(ɛֻ^I\;z譴 H)Ffcj "3`&<AmAqraqs];#^~%}iYsQ냑~`dro-FKn^-u*x}`Pqb-[NZul.2iCXBĜu,<|Bt?Fdo]'8#60]ةu[ۼ#Jmu NLrts'\ís8QsY!s794QxjSp3f-Mo<)21nz7" 4XwKoʼpNAXxI'(6l+FӒFqP3g"Ny紥 ; d#i\Pd#eUj"fbTIHD 1!K 23~a$W8 TU_FjoM@h0pϳJqb݌Rue62 !3C٨m_Ζ JvPE!kz1KCAҳ!9AfU?5­BL>+H˶ $͜72z ϐ Qti-M[*6g6΋`3qA9s\j61ßӛ;廧'/,g:fq{4 \O"wB>[Ź7Zi]b{.* o OIV(HWrHJ;`N3It4 .ΦVхe7{iB`X%pqi3#^"Z`2>MTS c\Ϋ*\C!..7a?$8o]gmo? "ܔ<zS\&UXjBK݆vpl4KԀ~Gbn+cC\P#ر2GC,t5Ț_'VXv]K H{3&]c^l1CX+ H]oC+8_me*Y",Ɨ MNGVmN=>,)MZ.j+N1T-jb)v=m!S &Az;՟d!j2>Ss < 2S''GEu"ǧ)}6mQ1\i;OtV叅].8Um?,wn&Ż(aRǴS2tDCϏPhXOwar^%QVn' ETf"ԃaqj&JAI516HɼCS [?5Ku64k;=avxJ1 y\[ 3Ch6fmGb)w).%)icgd%XzFWI^och3k8f5ٗ΄" L!hkxH^*[o m{g H)rQ`u7:qDhWuOHCōjp {ykj"/<#Hr1Y#5+t 3Y8uۀpRe)m]XMCۖ6Ϝh+‚`)l)S.[>ē_C>& 6#=됕CN{0m6؆LA꛳Abn$znx38圎~V_r1sƒ53J%p$kQ!4|D@v8/mRi ^q7bҺp&V^ICSwB L C  *[. ~U lL`CY@nn^GKe=X#ٙ4^⟵شiAc4uG8_uf.0KYU'{: fL/1Y,ANiis#n܈~1갘*u~ %ޯv _>-؂a5^WLi!_KWsƶB%՝D2 q6LCSR~݉Nk}ww?EzгOyIaL܁\:(;y5L KS R\1-;',\Z79ITKhPW Gf>z!ͩ۷lU#Z|*`17*u{ϕ=Q& ʅnZcVnPmI' EbD̜'dGVgnEF\,ClP^< iԃHBǷQY?ovϺiŌ~N ?dڪ#O&Ga-x`|Nh@!/Ŗj(k;ꛒ>h{h*$m0}{ \ )*&_V5P/d^ZRTqyqxeEBfh͊ ΑZHA .Fn(FtSJ{&Tip]wa9Ƌ*x nkPHcυE3jl܉?}O8śY3YV _#p8 N;iaXyYm!bOQ\8%G QœGBGǨaqp-: **6V7{QLm4Sx" 2ƹ7լ)K ׳hgB}~n "bq+*p@!< @啅13* .]m,p0hB*H}f@Mm*kEX:58!_mR;+*e_pQ#Q| ݷ#sOyBw#9 l2*5]AfUJ/,ɅX X@kg~sdm/p>Kʾ-jhxb,\UɜthJCmk̀'ABr\X ^7AO)ˠ^ [.&yY$kSX5䗠`&sѕ5ۖG0c9M&sTLW=p`רV$髇ɟ N0?81mU: Jo&] #zdnhĜ?L%nhdb1a5̗ks3 Vd["}hj/8f #)R*8;/1&?}֊ Ca%iwwz)cJTWf %!= #㣍eO^q3 Xb9t&YBsM?)m!xBνcª50 hF~YԸ8/C"2;qI7Cu̩?yza΅Wd)T!^>%U>:Q8h-3]*"@!›x0pmvMp˅ PDMsZ]© f̀[GՂN#\=+: Ỉ+/25?u4q-S JiCU͚#Ɩ (p`3gdVkAMvdC<۫.xn?wk^0 Fk ΕiEw_V.U{g'@Xcp_-:B6V.[RƉw@bx *(V/(.jaܤ[J쬀.β1 6GF1ey7 qZ:.ضә?HnUEC=yH?sdIRGFl2pl>QikǁA&Yp:4yj6o K|ݻ-.; xQݒKOH#n)5zD }CU}йX;U~C+)yG:s6<(;uܺWOҮ-WҺ:. L*]ˀ:e?u˴mڙHp*ԛ@y^g+09Ap_^rδPK/SP"<9$m>@.nv^ 8c>Sl<(i`+ ҹ `B'Қwg#wiȃV/E 2Vw!Fw ,[8N bֆY1, FV6gzGq}Y|m標 *w[65ۆpbYþB ?+.R_n@X?D(RiKZ%Ie0 E6rzf7yUULsX@5tE׃ɬyK1`~Aj}0B9lw#?_~e*p~^2x[ h]Lp^kKoiS[ )f=-3q3(Z#̂MXh5C[j6UxQ7M$+)c(N+N]);{ǡnt $ q?3] }ͤm })Ư8J5܎4P浻Y!n>0U:x'\ P_DLWt7 I$e:!zs+qe nUq[SZ>cޡ_ey7T&b~YSa1̇ͤN-șY{xuIHd@+}j1-"ɢ27$Q^ay"dl>ݿ@V҄=Eȷ,0Mr~m#6~2QV)(L_׾B_PG vŽ-]l !@*bKUج7q^7CCA͜7wR=L(@KҜw.a`ŽRۮLJ@t|d=/?vHh՞ͱUtWlc^E9_6q-bKT7c?p (+brF8Ƚaȧ2yMU([A3FQrӹ5 60$ NgEi i><ڳQ?d oR[117R21~f:DobCq cWl?XjJfu rsSao!Fs'zi%'00{=YW}}rZf9\;iOޫ?KEju(%.1z`lh__. ="]в\9;b`po2]BVBji"SSl1oHpڽԜ/{m$8>&ϓgG5Kxkb ݩt.֘eR0C2ʛ}9.FMoOm^;zCS=my/fd_ "l]F^{A}ZdFB"݌vs^w,Jšnj5g$gd]Bõ:BS+n{gޔbp$ᢍŨ*~k7_N|")JٝHQ"b$f! O=S6 Y"Dq+$\}u0r*kP=nWuawjd0gt}b Q+g ͬCOڷMGP!Rr<"p>˝[K0 U%{n9 Bn­>C=3 (X]~5?`[z9j+s ݉Js:SykMYyZ֓3g$ڎSύ\C*& 飴Ґ^p?v֋SE06<ʇܗnck:t6a)^`;s84,F@(VHZ`fCg>>[ybEdDIlܙ {P@EBw^l7_R KS0:PΩϐ*ޛi(M_|Υ3f\ɃZ=t.XSڇS/k zБ9M,$7h{7T`;Pqqp3g)K7z;|ϥ{*C$^N܍PjX4y2UYqTٿ%]~c terd%P?D(f ‚^ ~BP"V 70Dr錍+% &{A0*!)!x= Oj[Q·?bw> cI!M7fH2VXܥ˦rk2 1eQ"l2w 9"KxߥOA~Uo0[-iX-k$47wN U;>mqvEY!?P[M X!͔*.=HbfnP#Psk߰h;b7)ƱbmP ^?ߐUf<#[*MeVE+F1ǏMQڐPXpr;QR/,Xg^? oXr8xlξHA?s ݞp/<",5W&FS`pJ /X@א~)1*LN,O>mnwBe==$ģzdnYڠPýYa69S"|8(6<* |5$Ud 0dwvDpz̎򷽻x%&ا` /Jxxuϙ7 ۞eЉbX-]!WK1͸QYߠxp%tF?ӑfIosg.%%li$K@\KļΡ0TNaܫ!ST -NSh\*\V 3:s6А; CT-}ȳAqWZ(:N r)ĨZ!]7FlC=˝Lk:@v)]4uc\`6C!l+bأ9No[nC6l@QY3&]RLxb8J5/ע-vATf !;`7 HcqͶsc5d/@)'t *63hDSu,9{a}ClHd赞F3ZT y5mA Řg 0c>\GǶd +ą:'Hw 3S$SpvgSYljF2܄p-QugP)#QJSϐG9LW&v|?+ \~ c!V7da0ZlÀpYעs5(r [wNTA5 ?sre7q>0#d^(k WSM@T8ByZԘ nvq!ގnv**D!YrI*`M-m5SRlн ;g9 > fZ|)lbX'5y#~xTKuQ~<jYoE)>= B 1<ڧ$96ӤJ_Ct\ C>4=}L86&:y_*pP0z~Hfo0ۿ!:! %#-A&}ȓї~T.;.ȧLa$"v]N%Tv~p{rVYfBOo8-u+fcے>) 1% ab~פVl1+)4 Ʌb`f8NUWcGW&&`VtfM:xEHF^LdAYy3o[Efwb_ jOtgxZͣ 1Xf(^EY#FDБ̕!:`['YՊZ{[guB=#s56et<1 <Y[o8П^GxGnA-?uw> b'8KXfPv](LTBtʇgk]Fe.=Bɶ/!VgC

Z~D=qy6K%F\a/WzJ €iP2PbOvôJ9C d=̧n\Ǭr^Xo-)rR87!c|xg(f_Z~QApoe:#}n"9leg2y`v iܙfǘq=uA5-fGϛƵ,|FX[8-uLH>{ԩ̨y?{rI_ҩe8R Vu]UTU'SDn!a2MilӁߊT \7n$82s`GiWЛo1}Rᷪmދ=; dZT "*Y TZ ͓Akb5Ac U~$Q\]V@>˱b́ yn 4fgJ'/g'S}ݵ8Q!O­vynNV H+b k3=7QbMt۝Un C2G^+򁑁FAhd5ԎsۗSx;7npZdo^(w,]7g+:.hOپSc"iIenv gE~ՉUa^btydq (".Wk}k?:9@XcO j _l̂2w&[ḨaVO:Րi^x(ι̰@ڎɏ +I@^?rArQwlIt"[p+QUXR€>ߪH @@ KF疡0o٭H??(PvUC[k-ex"D d`iKp^C@G#f,DhpU7xK9Zr4~hi{g 0J|0DE!YVz;,]_do20W-1%; G(StA_{%K=cu1I*8YoT%p"Ad_*}0-9nхޤ 4 3x W`;#[O<pUP<ΆԈiهaF崳ۜ1c=C*GIc:kZgt s ez :9SinmND94dK>f6 ,E͓2w=p>Q]0mX# ȷOWuwN}0.PLP0̚ŵqZsy/9/"-J%#t [PHcU#4hb%j6o5W6##?=1r1?qj58 0V^c A%w|OQx\K[9zh9k+@U{tn0_FS|uC?ȩ@DU0A7kuO] YY \}͑#Jm LF^Oko+:_f5/P 72$b 7 ˼LSPmV5m0Auvfܩoz_}Grv$yGteԑi %pUؿSa `CuvvXg&~"~\ٰt!: vlX} Q=joP!y" ǩwFeep j5UN~ [o,RcYsGi lZs|ԡ /xQ\k9ֆ.!(ƉϘ!6}6ک* eh>Y[$ &QVhݫI 9#Ű#=2aνfRopc #F(x7YiXgV Hk%h6|>,FJ#y!bv=q.uhk|ϩ+A~&'^ 1,ujf)7l85wNK'&$[1_RK,c1%v&X}] pVQ)K, pxyɢQ0@i* OkSGD=ii׾Mj#Dݒō'vL5==u)U ;Gظ'Sï_C j?AK,p-"0vG~o=D=^[Q'=k↋X}Kٗ&yM]5"Fj kՏvIuE{@jrm;=9{+stbF"/f9i"R>W^g@KzLdhώ3lvtb͖>f. gڔceƂrRux;7 Ά[Ay6g!X\ɇ8 Fr`t]2`1{ᚅWLMnY_{^P%}jy w>}kc\N.XL*/2.1f i˵!]B)CO T Ïۜy8} M3΋Cb$ d9{V;hn~N-cƜL3I\4!}ƾ4ǔ۬/a=D I]zX7w'ho1 {_+G5ɃnYDaT'J!wY YrpgwuwF)( o vAu[+Y`̲ƪ׺wC_Vah?]7p+:@\ŅM&r¤* a\<5&P?yUطWWd?)g}7x^غb[@lom "$\m"Ds;3w?R#ՑdspNCr/c%FGUAI)ˈ?Hx*/ìK~Zyx^ 8WLZ`witSfdBP>6gTB&E{ltϡ.&_s&pd̀Ti*ImT83HЄ@>#3bn;2"tEEyqXbEVThj"#axgk3pšFKT4Qێ7lm%~ 锆-zk093 Q/:;'paʹB@&IϘ4}gUFb0Xi%v 5f`ts%tujo4в)Ϥ KAӎ=$09*p]TX@Pڮaƾ@z\J #3/:!NtH?DzVnh pyWdȞ%@(p^h]n.M<7#H(N DTLv5뷫4m%8մޗs{*u>Khz{G}]Qw@.ݝ{oӪgb&LiG%Y>tZ`U3]T\bpU!>|/]нmԳI6"~X~Kb>#r, p־6-;OAS33|[{o :@}Ώ7ٶx]N J?bd٭I]ME!}|yzH/g#!fa6焚::0v Rn8"Q=Xh-8'fteR>DeT8"{y6b*__UT!am~s\uSl4ڑ6 P:pںF}_h1VXU։XئCbyhΊ^n$5v^0h;7Zd$H*i@K{7h2'逯u4 gLյCṃw_w- (ʍȶ$Ad`OA k/ 7x=_ypi&,hdkbd#}RO쇏X;ibRJ=ulx+g\(KdUڟ,*l4[ . JwX/@ZoqLܯ[%RCHi}XI{S&M<EnbuRT-Dž<#"40k{a(] ɒq{$J̭vzB>cp Զp?[l2~ARL&;)IT@+Mb-4v{fRn$ׇcmFJfcMEuba8&؇/y_c"+n>ߠmf )DÝEԠ{'6:mS<4*W!4UPRt`"IՐ86kL|g;jg"Ngj+qN8ڋ |A:&YR,=Ԣ{<ƝT\Wn|jrJUYo1@(+?ltnC§0Z?dyBI5dEMgT:<ҘZ!dihZ0Z_YY'6Q;V}]6g!^,N:J#FwTEg}؋8Fp{W ΔxP[2~WJscP;oL7 +u0Hտ(pj5|(E~˓Eսس>CBʁnAaX Q8ppXͳѻw> <{\x\d#2hz!G~/da [} YPݛ6\fSbA_S Y*@Cʆms#6@Q1||G6@L[Ximgg07?ko!q_څdU.7DgIBS#u$#ªe G^? q,,bnq_WOO޹\2k#%9ar!nmjr<ď\X ~_2Y\[Rr $0u2358"P]xddST$ZDcAӹKvX1@ll,W~Bk* 1yn=;}0Cy/!j*wE9@zkz(9 zB¼jm~8G^"fˋRS"v6o$Y{bL3tqI"6z%g0%'ЍdF": pւn*NN7e߶A>p^-ec nP=S!SO|n$_Av|.qW'wa9 nWu LK>pZ륿W9I/6 yu55XMi^v;2>ŞRVչ4^tO?AH3Ъѩ+7J;:q1Q7_㍈W_&tozjiH;5"!;k4w0|]ym/ M=?J홰1.ʥT:M 37r<Q;:Z/PDy-䷪#Ϝ{bљ)P8bC0)CN= w9jY (?I߱OD_`Q߃ .8)/_s_8A` -|J#NP}|H^MŌb}`C -)]m;pvC 'H&"^-ˣ|'"9y?ף\TzHr%di-MJ?T9l;NS$EL`BI=j)Ĵ7l΁8jeKSS+ĮP'8$8%pS7 0K<W {n&d~3 "<[*?!Xެ,o&Hj$ŐioGmJ\igaNDziw.1H6)1y;!uU6dxjzwuG]2mcᡏWo{1p5|S7't||n*M9l•r(#@ *U{o Q9@huRCmӑb`2%J#@eȉbNK;&j(Qej fo(]e٢7jk#ة#.)٥^h94s P۲Put+(}yo~zvӪL.3Em0_WFX oۛWvқ25AهfY8^g^e[2Uu%'7@ڪ$mY+R6p]W %/QzC({5!N9Qe_*tekaIrA K ZK/sC Ԧ`"IYLp'(ԟ%"d5/, 2YrVODܕO8@?"d)t.l[^{_cѠ[e rJeA]ƖkWr/(9 =|ݐq ?꒬ksmN$~ioP Ň_D3p$o@,~vÊ߀!-hdvv$sJ;^82Cuaf?vF\,$Z9rú6NR.g I O&FP#n=^Tf$/~C0I@>nv֦b7ST |uEθePP]y36)nnB NYmc)MV/TP`%z@=ou$NJ{./%Հ q@O/2]$Zg%=/*uz+&JKj瑣`6=!uc J5^Fq~1bR!ukWO"K,Pk7DL5:3ŲR2e8׉`&YR>z]`/i6=ďYY_9XؤÕZ @P Ķejfw$^Ϥat$gwTXvv$|u5Wyi-}dBS%6x WM2N{cA΂\yB?ǻAՌ)o A:kcDa$S Hi t熶K?zA8pHDŽu7tw`}E~8`-*'[Bk%֓J H JY|Ju8hDǎ)|~ב7EIeU)(I<{J~ >9+UN!ВP7uB•|Wljp(ryVM|UٹS:+s. |H+t*bh˰'",7lM?r %ŶjÍf-Z\AwJ z=6~ lWcDARD"b*X6̶G*Q䲃Z!v:T, ;=] Qx~XX<@  [2v:\ 25Xwڮό L.זp;,v }.2k]/TMW+͢HSa4mqKϧ%9bKq͔fB)qYϣE: I7RRZ| T2{,}Zw^TSc,ix'ҽNm&𳟯;>k]2l-ȅ5sQ}aZI`WScD>Щ].^uTGKu`5Y5xᰜqoGlN[hX4< ?Cn8M8t(O'8L5p, Z+Kݾ_xL &О|Bg۞ wYH5AAP9>GQ0% ÚWNP+Ŭ܀qA-#]o:"۞C&M6d-CA fo]֨͋?1¹X2,H {#jCk aTn|۩tjݡʡKh758*BD;,ϳI|+RE?j;X0RJZzg’Bv5`GAqcӵ+dL|va7U6-J0U&,/3媗Ǧϩ솔G"nŒlHn:* hcv\&q]&RgX^LoCƤ k>xcu%"܍^HGS*䒑UFZ 縅"ƕ&V~ #|sP@s@+s]2% .2#D{cyw|CW& oJ:Ijk9wbN` :u=k<<%O O,BCmLؾLE2v"nғTtlH9 +4աS ֚)$I@A]}Yzޓ"FYVn@>E|Ff[ ?T9DUrР18( nB=ע}!cu4}$Ȓ Elp_9ʲRl HH |Plv-Z~ag\nUB~Eӫ|328Biǣqn}(TR_$LffWP: !Z,#7s5'sж %^z{N%D`ٻոwB+J=.@|/4v?6)>sD1lm|`A;=b{1f]d eix@@5=*@_n|&2&U< P ; jݥÓ.nkmbs?@\¾bb+dwkD5;_1 x!Ǟ&죣`Տ̵#ZBCOSHuNΝmdY}|&E(!-r{1;ɷHgEب[rȸݎ]@_&.~CEo*`.n@cx-}+Fqx0tmn&G_D9&uL!t*[ct&ʉ  1 J7'k:Æ}/j}:}\xlWo:^0#{$ulrkE=TIjjae@+QP#ff?Q?TS>FYvum )S^9-/h ^uU&~AeWҙm] {ɔoָzm :B=dkw^IpH8녜̰aYwծ1"A8=ʶUWS 3ԄGIn{+ GkP\8}-ll0us-A)Pj1GbɇtN7;(ßyPeN-؅hɄW=.W;a)<96p{Qj `yc_tUH0cu9ӑҡnN؄A7G;4;d((+XnB2O]iqTX3ӌ8#$._O1}peWv >d WGٛ fC/$u>jr+3cuv_C-D+Q sP݄'(0WgZCRldcV343C-\n|d|ԇ[dnD.ZR`H':kZLIO vr/9?Ν1Y,Vnbdk-iT6x/).p9ֿD5HosS. Ȋ$,V 8t9f'1mw {2D#1{_~Ş*,ifO˴XGRuǗnnocMܯ-v^ EZȄYݖ5;(^ m%^&u{7m42'_[v`E>FhGA|̓3x4;p4Νi}MFF+X+L:W[²GJ-,ܚ]c%85xzM4N|$Y7؍:"Nܛ}]]nK#5hCKʳGԱLjF@^AU{E)?"KR?T6;n2~9Ѣ5U^vT-{h _|N3qP|63iJ ~vi|V?HcE@*cc/ JOotA@TdwO ?G ζgo$<"twܙ_H$v1$Y}v0}ķ<613/ `NE_=?j2#r2uxW&}KR[o4ё@IyXY_ח_ 5p-qqʊ'{-bS=N7P&##_D>2ԝt?V2+JQ*V !Z턪Ui=[cʯdӏj!I#2fKW\J*<% ~xT}4gGNZjkGe\rW?CsSo=,M<U`䉫U &Q}ÎJ@Jù$+C^91%UgHV1GC2|a>S=Ҷ$%'+vUG]92jB˿6od%wa NքX'4[:3zǬrsV20?&0-3$%Y~/zUx൹}Xl27`$=m +7KW?ħhqg/axcvSH ܢ_-ɇ4? B@x\ĪpҔ-_MFA;sNm#lC] kQF$cE I q0/ѓk(M`fd(NNZ`iT Q9``@Š d9ݞz<`:ʓdN}ceXP'q}ģ`(UbiK\ mb={7 y7$W/k_x)vPU,sH#0;[%aod[6հ\ƽ Pli砙SB}ɩ%OTqC@w8? kW$,CD{fMȏ?:H $˜t梻6wUJF/ЖB/Y8#5'TkK|aA{$LiVX79cLyqtPtxO[z(L2Y}qU}|XC'iH:qTg5֌@v@vrfa5ca>$[shb&GZjl3 H~~ Nu7 dƚXfֈ5\rWdQni.u"wuNjā.^{Ltһfȝ8 y{4mWp{sw n\\+!_E޺Y`-/}چ?9uA!mvy)Y8:R_V`vN#p"2LJ>vvF hp2DX DGW{Ր? ed bNm}Ba.P9a0= qXB8ԉ3Ym= NV|MJ7HERN9) N#EdlYWxcMt.Oiy+9JѶD'-۠71wOu8{Q9_~rBs)ϒ.U0?XnKuVHL|U8w pD,ޕMwU푗*ב gPnfQ{3n^h70OΧ\}tͷzu2N< k%L6Eo,oh޸ L}4#بJbEc+&4TZΫWS\ov~TQ3$wm@&3 >zohbݫʫ!ΣQdGhC5OTH;&ABFa{BI=H)^0Pq]g -9v VqH_l,ue` ǒQ M XwlW7;ۜ7f_%# z^/%Z¹ ̜O > + VWINg@?5,'1iDrZVmt$Ö_8RDYPaGtc.f>o\I.{RR|X3gW Oy!NhΉÿ9w23*Uyylㆁ+Ì 7Z'YMwِz9B db"kW&㚺CU^% *k 1_M|) :GOGo>M캤)cD W_u!c:S%HN) > i x Q Nr ~h"˺VVpb ?DB=0щKm}i-70Ȱd Җm4PQs )<!G`&q'J5Q*1cFAM n)tvH~|2^Ž꦳w#:x@xqOWSx읍YӃFbk$P8`ɵ^L5(.s i6Y:YtZ2"ND­33J͊ڹ?LvSՊM̳ZdyV[)iB0~ bܖɍ<7bE?X苻5Ld`*^n">l, jO<9٤sU:VpC_?Tu:k+n;ӺL%ՊZ##| wb<[SvlWZqs-66 P2՞E߱dzJHθE ~xW(++(7:$*-EOǮMBZq Ȕ]FbR9U, h 5!O1jxߦ Yp6)NX您ikdn~Mt,||:~` gXq33AuLp Pw;;Cd(J Ѫsnd׉%H$8쒰Hv +䶵Џ%ּy C;eБ<^Ȯǭ1xpA=1 8J:}ܻnW8ҤN6T0f/npЊJ3(. * 91*SnT mTWCUzjGVԫ團έҬT꯱ 3;SڬX[Uy5!V/K̲cDOPk&[}͐ n`!_i95Pi-sSjr@aD,b]3HyTdn;(?R fSGqJ^́PT@&=Tʷym hZUÔgP`H€($;u,=CM4T" غf^?ǖŒNXnģ- 4l Kx3ۛ{4gÞS `x3wi.evZ'q}$R{WK` F8!x4>~3۝/7G_~17n N\)^41A3l:&}حSN(mвJȑah57+F6(6)^2p](A,fp*=2_[)ȣl{df"3 ٝ`\ ;*k`R9Mv2ұ(7868ՐI=U3] +Y=1_Y"bZOL#Z!FMgc'RQ=MH([f;ǣWNF"e"ru-rىD_Py^xod/nJ7Ptk"Kbj+5`>H<-9?`j#M=cYtwp?M<1fh*=U&*kBϘ|9Er%/;Q?lA ƈjFrܰ;&V:7 cQq,0٘gClq%Ըs]>g9G\ 7b hsd9Dzm^-ܺixT6i=lgH{'26K==S]R?Rq;Rܩ]<3"7S7މo2b i WqԐ=SnxVW1T ~=Lp{ۍ粋א:m])vx"9MVz3/~V02ིK^>Njr A Tn<^sNhl%-*8b4 3,0,h9ZDE%g|B6'ؔC&3ݫ7"y>E~>_㮪.WE Nco^ʫF.ⷄ+CY(URK] ?*_CИu#kJv2*~Ò.e@d`{mґ0] /%_ r۾L[_:V;1mcY:|qr'HE_q>EIZ ɬԘVمcct^FsﳵQ'ŊSwL#Sw F*۽R={3GG"uxBdKҨs'-dpza~{-)0dͲBUn%:15TCWs7v; 8ʻTR4[-Eq=ZsbVrE[k+{~mou&"ynlsۦ]X5',_VTs"cx؉KR%T(@s!rׅxjg?WD m) x_¡.@3(UӤ× O(;jBj#1[R[fpa_/eedk3-TJSHbRn~/afˁ J;xJID_F?P4Ɂ2Ck;|U} B`)Sk 5UďiOyf6v.KwdTA}Z=>z{Zge(tS )*Px B,^mۄ"Zn/vÈjm _ct My6%H Ui|E=X&rv|o֠+YM%=.F[KpO׳ֲ<9cJ>qB[ .Sc7;H_D&?K }[mz5<W%>ďuNbDC4qVc$.>V܎g I([ G4#Es&KۣfU,:*(Agl0\%-BCV/,.ZԔSSxQr T!^B%`X.5/~;m .N%#d~2҅O*AB߰R\GbDh>fGdx8Uh)ecׯrN[D#:A6Ȩ6讁,(kD컶"е$#W` h8sJ5 b&*EPn9J7sŊJ䁂4E:.ePH -DLS.To(-@"E*L@5Cͩ4 @uaYz.\ŵ%Emh@GH@IfXi=T'?$gפ5fi{B_ؖ/KA -'Ǩ T{3:Ѣ:=: 5垁ïX=((@( ěE"^,_ubL o*Yq7.h%%3 PRjXC1\ٚqI/=EԍΩ8%EIEmު%nlPEbH%qI'; Vwذ<?ݦ ~$p[=mнa W`I%- xy2l10ȹd !d?sPJnDFc GM$aB3lYO{[S/i$]~^Rpd_7|F%Ex="WLxYm+Pz'9пIA^n燧\<F#R-"~ j{ P5W§Z6*}?;h[K07=1m΀bFV @gkSTkal=0^B!}XX+ik8NB1Ec޵KW-:2o=iƇ//!iK[<}!0|"ˊ1H+i·0=tBDL5HF:^Eu?zZU0ν?u78VQ\Ci33tCS)vC|P \[ (,-GFTAj=`Sd: n9W{ڟW]tL,g y`:I[ VۊNp}f2I-_XL'?sѰb/)eKJM1 oV;u[Mr 4Z{$%\."i]Ko2܌Mshzm#m~,ikJ"*)򀩕{m([Z.":kN¢yr6k=ĩ] KkO>-:,Ew;_ V ׻cttV d"ze-6LxɜWDrKxiY׸3V]Ϗat}Н;);WY!NfH";P|~c mv 'ML{V? &t.V-xκFנhV#cv9qqnٗkKLiIQ/&&ΐ'r낎&& u]u؈l7q}x'T)o\"gef:6_ PҜ[Q} Fߦh~- l Q!&,Iǵ}(U"uvr5xWbbtU pz(|AR*:46A! Ǹ! st __M[ $}\G jP:$fw_?jO$F˘#uo8hƢ?i :b+H6u8p(XuBK]b c0va'rc9}1lsϗR򡴂[#-@q8s ~E2VU;oJHl"2VBUGm4/G}60R8S06fc!l ]#=*rZqॠqF;!g%<*S<0Ak,Nb.q9 .7?c *P!`-NkΏ5g4 jG |@v6/.`| )1uh*;ţZbCV8'dMg*K{T;PH1*e\_UiC.@*bo:Nex)eߟ9GQu[}<[``d$5^#.\7M_#d@e&Cdvf ys;c=UPlL^QgB)̌vT?k).- q.;yzGPsѐ%؊ ?x3RzM7eLZ)yax".n=ǂZ(,7ˆN6O,gsUJ O'}a|4y8fzH%c9U+ >uФ*"jI:`Yщ;ؕvfJ9#}hhՈK$C3UW"ưEcOitA5A3/~K-54Jפ߭&viZfʎV(!:Nv~kJeCXTzL W8vSa1rmt(;)˚e !h0Y f#B wS ]J)_^TF!#ћe 9f* R*iC[$pƺm@t71L^Sj+_?*$(pECd$}RNʜXi䥞g2M`0-ͪgK6#T>\_uՉf06 8cZ={#Wm;Na`uC>~{dYp )j| rV胞\y["a=-a # M/Tg1LKooGk0y?;7O^ED*aqXo > [Êrl/NrE$(47~d?1-VBX\@v]Sq;IgK2L8;C[67rq frYD.^v@xwemM[}\4:_-QRA/4JUkmq)&ɳO ަ y; 7X=fu,b8'9 fO_]h7Zֻ7 !9:{˃C[}'.>ևG=2=]=w]鐞.=\t(S Ysaӡ9-3l}۠CcϜ8i]j>f50rl6PN>.l$wA0|COpcNz~s-3qX}%_Ejvvm D-.FPT=w;!Lm}9G}E>Z+{S9d>FIsZGpX/t9Uq'ިݦCB_75knjژeֆDz["=ByBtMT. By+Fȑ (fޔ-RSшHS6AOFU#!ۤǪOSw"~Zbr73x1 `P"JKhnY6bi74ir1,vӼ Ugt+u Xؿ6J'V&;pa[zx?c)År}I}&>-wQktҾ2nuy:Ef kS4 zkՋK|6ofUW'w ۛx[ycg> FR$4ZA}dH),tT%w~ٹC:HJ/j]/q1`fP9ǞPEq7?7l8(SWdq[}>݊KMDbVO=gƟ1cy0T.|a XIu\o<9zTXs-Vd;FH즖OBmM4qշU5Zқt%TDmk߆ WA4ܥьgE/R ɶrh#,m6HO-;592TeR3zi+z44l6y|[].ZZOsj27oΗ) ihiToڸ_P^#-ÆhFbhryKd[OӦw=Eܟޠ_RH)/]TQt=(R5#.XYy)au1𮡒%$d:6/46۠z߀{2i hF['B ‚oA0(Sأ\meeIx$j0z{+!،x k@]e0UQU~FPCǥt~wOlՌ֜e!lwW]Y.MC(XhSsp)-qb9hmhqT]זқ>5ZXE1ÂU7utE|* VMuF"x3pRr'M-'"fO0(<<׋D0mC˼F㌳d9[7V^õP3i132=Em(m@p1qk^k%Zq\0 &_l"t7e1$©|QCY]S>u8cu`wC!BUNY IV(<;H{Ky պQk/r=Q#g1-XY^;V&Bja`{ dӫrWnG__ Ⓡ-;^¯߭ĪxXGiM7*rcs^q&aрuZNX+X1y 7'~ﲥz͒lϣ&1tib?ZTQ gqt!(cpOD6C^*S>w/pJɤO amd9LۙtI'BO[HrRzzI<؁j?\RrS1gOl4z ;zwҗU5>SБOK.xvav]`,,5#rS[bL /iYŨ}!)f+EH+mU7g/O?h5f 9;/t;N.M35.ln\ y"[G UOo9ifRGL+##y #~H,"$}a&]59}+nCm1ZT )*@+^D`"qrN~W+D92\ED$Aݔr8{!/su;`h}XwxU) ,Vx?qĢ=wZ4TNHvZ `涋qt@r;e}`{aNNnDŽtr wZ!/D7pj)o2y$`\~7>V 7LzQ$}c)Ёp/aވ^[|6=2y\1&z2o33E߾kBxkQΜeYh>/)V摯#c)QQTG[EkPhL;BC]5@8@c[gٺUKAݨH 7V᲼A 0%,İ߲=M{},0܄\*0aAEpI8 €@k #OH w/ ]5HȜ3@wDi5l!bQ96*0OBHg^ JgQ@?xvR Kځ~\N)Vz%? XJjdyPmD\Y+@o,d^jU)lbc"X:SJ.}JÅXH5%tUu~\ 朳#DSX־ˠNxHʠ>쐓̓%Iu@g- +z,©5n _A'buVh&zBgHJz !*Yd ك`=H ⶏKW5}'AL|Xܤ)*+8\R!x>I+Q_Ne!ݏGlg#pr{ 6' )uKE{:(W |*`5v|&#V6c8Q eYEoc,n҅D{1.B~#\(YU 3b[g_BO rhmeay$6;_oF /$kYky쏘g_P"evhUNuD.FfŜ^Á3\ՔI+%e:sjtܻL%0-;JJYrPU8!'G;qZ'aR^Ut#xAI쉍 /H‚LQ_ٯz> N03S.hɱ(/.k1>ڧ-iy܍x;D$翎P,}MNgNvg<#7KMUs àePr\zvi)݄1ea}W+,ō&jV}< ՝lbg+Vx?6^!:v}C}įQ!?:@`;bg:TXe@2U6ۙ[27d-܂+\yyvft G=dZBSgz^ @$MBImAO9uCERK/F9 2t"V<:HqSي4wܛ1[]l2xTQEDQL?"$Udܑض12lW3ٿgX9jZ/s# ȘIj" Tf)à5J:]f4:9V4"[MR^J-1!:ZklCxM/gN1>xň[8u=uGaɧE 8f&b;HSݢ^hA? dxzO^Dp!/UqMה5 fMf<p$*/~Jkh~)q&ORDmpɑX.p|,_6,p7`o MQdDQ$_XݰWB5*=yY ~Aa2<)>CZz |<>?^;?Oe01H㵖+:8{+Hn\O/ %j_P gp MDi,!jhՀ|{C'XaYVZ _ Bq`lVQV9sq UuVj>P\9[q ?ړX#?& `" q2c@Jl@Yp[v АWzdȻ߻^<{|쩵 কr;5 om5IbVÞq҇U`ms-Z4ٶeojuŗa '}aXd5.c͗g~E h}pIz|NSl8%$PK 6r; u?LfV@dEw=&vIU꼹qHxQU:^./IBg@Mm0p6UIgk_ hGހV8d`u#O>nY4߰v>.1_ޯ/H@ō5(&u)ڈ&rD{Jc 7ZV""ǰ{P9"{Mo?4 x92z$X1s,hRNJ~^0u+Z~i Yi75vs/ט6޷nxf^ŽOlOoU 1:wFϤr |WyACg727۟W A7吡 v[Rfo,4cN q:\$%K9Ox}aaw”̱CPLX-?>1wV.nܝNtYoL/32aIXzl]jץ<<[VyiM5zONLI3E&s0 z#(HckAh%rC1z^FǾ7% R a&#wV#"=ח~qGߺByTnt8]̧yހRwI.b,#q5 ~&Ug2WtS=됲NF3iMVZ ?NMh϶V;`zG'ge&$`Y _Q9 (kB0"s($|Giw:i>y-<Koq)e2ZOn$>.عXK!S괫}|S4O<$ERI2T3W*7z9.]>Ҽ4.`Gt6\ Vh&8tiC rq`C,W }qLɳ%o#I]ժcLUhZPZb"!H4pUPõxdT"Vz.DNuM}8+y<7)*́lSCu-8mП9YH(hvY-+`cY'T=d M4.@+Ur 95+ vf3M>3/~o=nʹЃVBlZ ՀQ# H!Fv2// o9_YGySk8Ȃ%F  [\f kbEQOR97ܡ!@+3<#Nf/=?S~LTi{R`v$Uh<3PO`W %s`U)TɋEpag6ML2V}z%(u Q9|l-^cilNWΧ蓜!yYv{qbEW(E+oce]_S{hQ=r'Gʧ4BS]aoc*?"A!_kZ([iQ{J2, V;ѿlm׸c_t3fߚibN=gX|ÒempCH]r;aml?ܸ`z[]% }?P=Gd)΃9" p.po,O`y[![7p_Zdx=ҏV|7WBW<|Iߴƒ6^$-wpTbAW%77n-("{]p]> %7^mSċX~=.= c9Rmm@͞=ċ*:慰Wz޶Wӓ#tq@A& ׉jdsdeMYh }wh`|^3l[*B-+l|)k=jvAgC0s5$>3w}q/!-áDm# BB7?)"t=l ޴kn Q! T{HIV3 TzW5-Jdtj"'% EBaۀfL&zz@M.Q LSE4&D6WeF*l#ݭ܈ےX+SrO)XIΆ:vi͆(2b\ǡ^#ה:F?uZ4z/H*٦F7%K t:߼Xzsл xR:|)^wx]U3<"&3b3_&+ åxV}+-A={7ݘyȦE5tnT)8.1F^U{U:7]3PL4wI[g(]Ĭ ¾uARw'tH0}l)]ݑ M$ KO[xȦ{:VŚ`, wmKa16~o jO}RXT}!ИFxpoѻDOFē%'Ģ0hh:q% e@`(ThQ@imRDZ\1vlĻ=ś9f%NPOg:c~r(m9xG +s15S4Xњ+Lj?f94驀":H@QX67Ey\Nz4kƌ̼(%9Gun@I&_>8?91qjb}}AZnEKG?AwԽƫQO5桓X> ,‚ 6F>IȧH@/mz^K6#Qǫ,R^htE{ɇEFhu ŴtL"xxc\9Pp.Y-ܑ]@Q/;7L4aMf/uUŶVG8Pi&#UZo݃G'|2ά4+k^?=d쬎S~鑳3KeqfXQA~M:>L^uv`1yYi0B:e\RєֵC6^h<DҿkH K׳=.9b UG14yG{*CMryf'p e-4Rs)x+t7Du8φ=|a/a U+ BL'\:'+gydHQq/F/#<=FW=Ce .rz'Ulcp{?FwGN,~ZA2Yl̘9?| (NbДk!;8Yf3[d1ٖ{&=1YxXc#MvIm X5G1]n4Ű+1Y,Y$Yacwӫآ\);؂1X a2 LUX~[Y} FdyƇچh.\Οiۚc/kj"ޝcCV?_t.y gn:dMR+ьLHhA]AoEgcK`8F9cjr`~zeޚN!P:K cɎybbWT1xaO*cI 4wxS]Ny `w+U+wPTTRW:mrܤ F@"իyEOఢPڰoV+E0Ѵbn]Ka9΃#Zo6Ӷ7u <{"Cs m) Yq<#oᬽ?yvr~yD/󿟢KZ=@nΗ)}!޷E SXۗoæ[gcF¢WL ]!e9 ,8umi72' y=^p >:~SAL<^']i%ig}[eފfz/ (]dH^q9n)AHx V݆T K)c~›-|z)e Ea[mY a{Pe-Ʉ?GŐtdb٠Es#|LW/A)03}K|<&1U7Q$G3ʋg ҨRi<0p(N=|"LQ,jwmən& SM{jmaKY0UK~]X^ ]HRaP鍭8$r a iE%NsNH9tm懝⎕bt+m~x [Nf"}y,zfbBbso#i9*xLeYB;f. odJZVĚI`[F6A `)M.RE=T~FǷRg |Eԩ"8o욳Dd;T7&Ka(4!} Trxif?_x,.tFXCZ~* D|*Srs4?ox&㖼~'K/|f~ZzFHۢ0 :3$չzG{9k,rR-e^ҥ]Aʙ3o&'J)q*Lxm;p% ¤iX zL҉Vϗ\_=on97jWeM} n;L S򐁒HjLv2-E{J-Lh/5; p)g{.UE9kugK/2@g xl(܊1F{Je_7>++~r'|V,MBcthܨP; JS/K ~W1Qٰ^Ϙ@3J}8M_̼Nd4K=9̺w~Ilu`D ~K|!#D^(OX|7ay/t41Llg5itʛgy@ {@\`[:dp)o`6~F\_EtZ~7N`aE| 4@zF R2NfR'<(qaP?_r?kKzʒQE( "<ں!ҚXA8"d@:d C#4|ΛKJ@ҍi‹_KEDUaz#NRj@$G&v 3.!4tێ$KgR?q~F~702s #qFq-VB[timH{bͲGύpcQL#; VKwoHHQd>(Rd*4eѬt,EOm@kF_9i5J2'E>s[ll҃C&ƥG R3T6%!tRKe) M `}2!h;ο!e9*5`TŴ:j hgmW61%ߍIkwStw;'pg^4R%DF+L !J(ʐ?,mZӐ {W堃?!igr x uQ׺O~q3W#K&H(#lM SS|гJ, f0 =JS;ϙYҨ \ b'||*OL`H VN@`c2Bj{Dgqgq(o&ýΧr^"%ʹa@UbW/ 7֏7ٺYH ' L@ӑfHcʸ`alm(X媃_HPj<`,rT3.P6W@@q/?x}Ah)3玤P/znkиڂn mJ}MX@Gj2ncwu$× :wn󭪟U3'n慠5 xޱ*R>o8Q+^>꿢_r8Yl%`,T`^X|d=?/aS21EqsBU85Mo ϓ@{ȬθI⍞JU(h,r+Nk38=gǨda^N2)]3K@ܱv1` cI Ϣ/nb@6DmyJ9A1TMEwX!\ա#lɊꜲW*K^7/Z´ F  qҞx eնϴ]H:UK8@ڬbdB+ЀvP-[fGtX#h' ̇w{U4]9ۇ: a+b$7wy-c027Mm$%(mȋmh}/МN+XR&< D+.J  w FQBMO@iwgVK0[l_ȡB f|>&(3r\<"\KsDD`X W51$Uug/Bi6ɻ$^IV]3 >rXϬjH/ ׌ [WG|sp]B>B_l yqtZ}e!+nCА[jN #Qo!nqÓc_.W˕wJnܝ"y 7Q_k'] mE L۬s; w\hb81*[͈9N`/@+?EJh/%UPQff]W1#Bk#$X# F=_dE훍f58 ,*]iwËuxbN+}6H&lD$NRͰ9Eb#˜h@) $}UU[tO(qsӒK%>f;j7A O{|Ņ:˭2sAz'1j!Ikv/-Icg;.kM'ӡOa#]iw qPW% 1jN?F`j|XFUr@?x26*`6ҡb@l,KVSD'ӈaMV]Vm~ "SxvV܇#";e%.1ݴO.P=SM^9Pw6L"P+۝ ,e_r ]1/%"Β9R,xvn*ֵE3H+z9 i- ]Ju %oeu}/~4UbnϾi̭l[S*8_zTSϞ%D\8x= Qn3p0$,a[bN."zJ(K{igX PnƟ+9n/@/Y9:(3F c ˓|tU>W| cwq_2pJR MG!p?Wgը6s;Dj9<7K>i|LR[KḠ.~ȓEm-r3Bƶb g㻀 XS-cS.*ȟbS\4 sYv] C24o3y欍N}><~gZ62P}eبXUHyZ{]RDvn1JZ7G+"͟]c*F#LLʳ!h2 {zPԣnҫV58gmOBC+gO&:Pd~!/JQw2QZ14kHVwWY d }MбV* 1蠡Oz9pS'^6~/"=9?l<ǛQt"וiG}9_N"h3}:KEbu!c] {k&i R`t<.j<ט m{=҇IAI@VG0]$AavgOG}W]@7k"D{(!5ct'EyLb?Hwġ.B,Ra@O{2kIFϣ 5f]f⎳ `2dc=rvl1ZŽ^MW|!^:#]A`aXYek4S3{u)WJ.{1&'SxΥG 6_$3|nh4‘և] `8)A=6lfUBR5{!Ets2jJY?wҊ@n>8w cNN8$ ϵe'3ieNB5hRQ.-tJ#XJA~nQQQa.?RvtRW)$p30'4߬fI` k(@P6g͋VPϐvB5ݺTer&gT)l6p_Lz X]y.A{tDPOQ>#6p[(=Jvx~ZCQ10݃tqDp: RBv{2Lm.e2O& ED M1Km~~= 7K›_N|8(骐 mgnlD6l0;z)@B֘?aeNhxW؄pc6F>f@6MZ cT.JaL+y  fTǜ%>E^^Ya[vXD+nPA`]byq VT,׳J>RsN Ȝ uʕrp;JϺi'eUrߜm2e GD+%ܱP-Co*I)v +-.wa`idMfuiD՘|+.8=qV$'7m9B 5`J#ଐkuCߕepGNpIZa=!AIYDHYUS@OLIH2D`;@?!g2~T/ċ~Z*w&KN9`GaZ*m i0rs@g 9"[&FU:bd6%䃬z<Ҹ;|nhZ>Ur [Hcz'-o_rr[:ĒaƞI78/Hz:3Z\ tKʝfl0"ī?| /G$udS,.<1" 20ust*nO\øZA߱goΐ9mY:o]uHOKD l@TԸq0EfgoOx^M2UM{5X5A+vؑl>l }s86/5=oS XgdSO_ mQ*`HAM8b_V9nJFϺ"31_Y##8)$zMnKvn[~$5%@L#PPTK_VJU=b--S!~'͌zz't콝#CqCp#>Ʈ\K Pp%r @DCJ`gVͣ.f(.^S6#`~$Dm+=)cue]*qNJ_^wn;?Vy33k1F9eRᘶ |Qa{3[f)rHn?!" z4ξ82$z;U{>+FOOhjE} u!"Ux ~aB8Rf h cQV/(*\}ˀop E;Տ:s-L+CL )bR3B:FPu\N>)gVqCu2<KΔ^J$-3)p_֜} znZrK]E ml ǁ0 !g VN>_LsGrI7zx jW*n^M_^T20<绹mIrt;TC2wA ]&-k_j b)[HfnM_KJq5F {"3n)A! T:݊YJv+`H5ՒH>}>~X8X2mIiVCrP@15CH#+0ΚVy<4~yV.1TY+hF}H1ּT7FC*c7aT:'+~w ӷ\SyOiܑ*+Bf@PP(~i&M P-OnM kOfz䡯324%[T/uyKyxaF0h蔒ē륩y`=º^;9f%^ D>.M> T jw-9;DhMώNRu|83-:p(9ӫ YNΣɕ}&\Yvx є#gR"$uy jH-/*F #1.bXDi4C歷;U@&baG[nSU9ӵ'HO?ㆦV7M zn؄VhY!R_Ym炱=/ ^hU 0"]~'w\Nnjg[r='=7 rHWXiXe&N~K[%lxhbzD`1HO'IƒC+A"Sw8b褓eEe6}"j ROnκ :xnc.—(X 8)mz{2=1BɌ![dpzZzG :UgIdaQYh K8XJ!2yB?F:I D6Obbp,|yP7j7k',q϶(}3ڗ_aRnw qUFݮ"e` g3M GyliGpS+F[vl\,1_=4LCE=†ӧt$}UG8"1 ӻD5E6~ ;j;!;gHHFX>j1[TKN+I~+:>#ݗ!ȁx=b'Dškb`dHco/aQhb֏giLjM6 xl8-wJ?pҰM0Q5ffH[B_ܯ%0Y%USntoTcy|SM*#ɦhkT~% Sm8te#ڽ}eF3;ەI!F\ b9hP܂ht3h*D4,B|P~ [YE X;ǷR-giuEnVH@i\e-ImqR-6|[3 *) P41s<6~,İ#;*4]aGQ*:&&e䅺&cYbk\źaZPP}.+VpǖD_u'dF|9:4V. l3a{.75H!5K3D0A:V ~nlYxq s^y\\fw$j`ho7Plכ<120N8"B]@)$H=eҞͷ|>/ѼE +Wr(e1gSb!C㶭ٗvAR% Bk[56m0QJ  N%4 +L 9fJV_X}Δ WdwEyX ;.|p>'Ll+sO5IgUHG"l9jvAtאRX1HJDX)f_P;VO+LjZӑPz~f:R!7>İiZS.GJM'YI*u @-`Mz}HtMU) 91íZj1&yt6'\le L3fIVG&+t;C3LPx3j!㰬'rӭuޕ͑5 CY@["UMKjİA+6%XCs <{a $m )ICAb i0::Uk0[DN(T~Vo3o5YRF`:I=v"EBKрvʾ `ճ. v.c=?a HXyagd$t: Q6lՀ+Zl]P/r6?Y'gU&*cuk> 2;Xc>D]v_YsIbDMIwCQYTæog׭$ѝY6@т: j>Yõ5ΫV/eBi?}*9=&6I^{,kqӨ qVKvuf;,{k2];zKL=W_0 Q/JonRuR'aܪ&ύ2"eKTKJ->L J8DԷ_G =swQ_鎊!,9z=+aYh_%1x^v+:/ѥt96b$8=?g/Jn$d4l>[㟞6c (}C&m\[\"*~A1(uS|eDỡOlk|71LވLWE;e;{?aƽPoh">G{qJؤx{Hɏ_InBx=Ecà9&eBc Jb <(u,L_HȊV 6Z,\߃,('VspCYuM >;$a;F߾2r6ɌFȅ&>ă[Ǐ^Q"QWɄǔ]s|s{ ThyzKVl=A];6}h|,%6M_pHvRdLE~"ljRIwڌn]4쏙!p gYfxB'u#|WTPN Lq8 kz305ǬhIUAR".z|*ԠjQ|p:Q,|x"?msGT,i$x|ki{ӻۡ՗Ao;.lX j3 XOŃI s^ܸ:΀0\΂-p[ܿ2 T1'Z0qom0cD<,Ly/|uF"7ʈm# '=[$#ik_6-.b{=dzukC 78)*?e^$/nn5(8бD$BR?=Ā Z4*oEd5shⲯ-=C&ΠnTZNV6!WJȸŊRj)teld$$EDt{`CSiU#4\*Ln&aPB3ɇ9}$Q͘lD:<]qLajB!w-J;h^$ܻe˫KC@37 !\gSQ50 p.L,zWy}bKfiAI+<%c͙] I%ajhA+Rt|Ht6/d>j_|_ex--W9ڠAoV~W168q]䗼,O'AkEz|/^1>E%%Sí)| >raѼʲt<D˷#xoLM6LiacTQ:ϰP{gÓȘ/L țeJmJ< Uq>+]itur!PdZ Ydz ܊]i/]0-}i;(+<,- %7ST %6v)zU1 +NvF@z?DvGJp*T`̢^yH//z!eF2hy1Go|[`{_tV3oߢ:@ h"w3. 8 x*3(0_[yR.#V Gwyϗ~v,tzr@2{c^aJlfg+&R&,@\g2w-u /Lޥ:=IjX5J%q8#6iu"E|^7CC5,b_4׳s'/}z9b[{jPj.e62j߉B{  ,uq&f䄇XΩݲlqr!e*N47VwfZѪ40뾚9S0Et! #^2W~9iAn"9]q @ɹ]TMq `SvLfl-V&HuV3hGP\JY;1H$Ga4K2~CT-PQqu{뎖Ψx3-bV HZTU{`ߙ!j[mnaC<S5}U$VRg?$tu١ BQ|ZDtc* 1cgQCQS}$$+C5y _bJrGX|Ӡ\cَh4T!nX.l%'RjռS)h[ʡ;}['ϧ- mVզ)}oo"zeDDs-NN|XGAi^C>9~DFQ;=P6@؊Skrp/[T'cu> aWq'$ٵ=\M Հ~XS"툧W 1H| 5k;̭k%P%Qᠩtfa2U堭_9ǁDĎlH+^-Yl̛WASHCj{&FSç,ECB}3+QLTa!ua=!6cY MIN-I@FUkѰ5pj]xtB`yp; Yj,&'oÛֵТL %2+K\ fgp+gq&H3\|d%Y2  iBrk~3J@MK./UIcQ7oo y3~:`GrB\~eru"4R$]˗G. :E!a ?x3?%9z1Uy #b;^1;Lʂ#:pdNc4?e󹌿]" ?vW#@=px^cuyEazBujb>! w@Bhi]9&du$5BwkhUBh:/3!X&ٹ7 bHF!<0i$$# }3xP^גoU2DuH_`Pho 3 N5ه%xzNt[kp*2.¦Ώ-iW]x.f >un窨 g PO684W I\ s {VML-jTJ><%9Nֱu͍i5pTq tk^pT#ϧUm) },XtΨ*姗?j,0(vq?c@&7Jܫ#S O&svP3 K|[r6"W&i/ àobH$t{D0#Nj<=:"z##z!zJ!aXUo|z*[F%5,ÜkdI{3DJD\\;BRuLOݟSf̅%ҼHS5Eda{Hn?ou8ClXt 0YQ@ӮuzǢ5=2vǝ͕]*A&kU7ORX WguX2wj>:o-Y2$7֊ zԐt\{Y§x`F|}'P k^Sd#}Lt3O=Ҁ \>(kz|t,ZG&ŕF+Cæ\NcJE xyR;oHuT戝|5zWts,@z'-_z'UcFacg:@ϩU`|YI/g~kPWRO-L,1 oceQF38p[+ 7f&}Ȋ,g)5nE9tY$9,E@% lyX`\+dݧa7{, ݰ.9tjJ3{?o~xPj!|.e0Z;0^Z_ P8$dNPGլ &HѿFhDp~w(dV6[}WtMo\2~ŬFs.tod6dX TǙ}t EVZ֒pBm:c@le#3Prҷ91<C9^_Ja%SF Uow R Rcf16y01ȦCʁ8SJ\dnU߬=ۖF} c3PmLAu+╳k"{oY9o0Fz['v]nxaE"X(kW6^3p^pLӵȽ /vY <.]l0?^o.#Z SGV^ Y*l^"bdmF]oѫ#U.= `b`T[j ŠWI硻ϺBO;y`TB[vńb(eh_'+9:.o/XO"N4T]J ps%O_Է*"#=!̛/(E!+ڦ)iMMǙ=-8&C;-.B#ix>؃Ӓ #%@*6M2Vy֣E}\ɳ7b_1 ke򖞾f5ʢ{?`` aDXT͚Za.@8{έ|CWV`;l~h*aPxCOY9уd9f-ˆx 8#]qv n\W:F 6փ[tTTqM"B_F2s }uT" -.!AzʧdEl)m5ﳊ.=q̧]RBH4eJ֗a }38~U?R^G/iu ?_L@y@A)kv Hq:U6 *~\,+L*r}jE`rf3x_nK ob12V'զNH;qe|D۱X]/L=x4 w 6;6*͐w`LD F٤FK% 9}kB;J:JeCǠ.4#Ri߬\YKB%3 /@Z6&~HiBMݏiv @ކԮwR{UT6}(Șt" 1}vVGC_z5\ƍ"y,օ۲hN#i*c>rFAOJ3*lbXN쬶,ldY*svHlUʳn[rb?H=Qfӧ4{="62tJWu./E a4F KaI^[)vbc>y^'& $_6yZKd-&<^*XӳͰ zSW+l&+&+RXY}cX601r|væ`aHZ<6B"߸wYN ؛>h)Fv_s-X2B0l gIvb"w#?=yr7u f]}vǷ6:F^p-fL uo2h&e\m]bV V;ft+4e8Ed85jhV]⬆t聬ʛx$zf6T-Lq]򤢐t;`"ъ0”m3;!nESe  +'ybſN/fȗ;mdUG_{?7 oGu7Xa )$W5n_ң|pzt5<zLq&9HԉU?\P'؊98T|Ⱥr,i6[pf}hf?}P%OI(Rǀ9 }譑U&d^I}'mUG  ,*T] ^*5`+zaۋon0G5~ٵ_[v'Lٖ6UoҩKbm;as˜',`>H6Z et'S ~x W(]m=m !Jzaq݃uj!)YC*LC/ -%R*<ukN "0F\{Y6V8&SfދlPFxmV޷IDwT/HdHu)zEgL~7SDe IF˜l_ CK<~iҡ(>Vbflٟ靛+ht}Dn0[UY~iqu.u3iʞӟS</sl /ā/=LVeu^, (؏Р|t4"gX !>ge[pU/M{FK@ ]&"fZ*_(x\'b@}?uXVVSt_@SʐPv*]|J)J8 ,Ӟj-U;F-"cwL`,1RNlЉMTfNܲ{A.j516i #Z!)_P;$1nA 9vrfl%MyJ=dMI@`b [ܿK:TҚ9j=@ O!j$O;%u6tfYBpc?Vwun%އ VgyR|ztȢ&(3)* ݃U@ΰzy4?/rl9&Q`]ayh|bXvg##7@/:&}siazK".PB~e(I~U㌊o&WQi^4cGO@#\cJ6W +v-ݹXHb?{ÁmOȇpl-ĥ%+\!nbs|l8R݃+ YALj`g=._9=mV׮R^GbUiF97pp\|k*OC6U$\ۛ`6wT؋:U.9Јbn8?< /O- pЀfPfE 1- :bYujo3⤜Y}[W\vN_g~hP(I,\1j~++ʄ2D؋*3V'1f)V;"D: \ !b59|fz5tg6P#swwNf-ۀnQw[ːMǢQ;YzGany.St0 }шwx2`12,zLC;i[C$!09,JynbInX;nbIցu; CIJ,욣]0Ho|M3;do;R`( vܜ#0 3ˇow?tnȬzY%_Փr~=ZbNGCO9-ZL!Gp.K8pΛ3(S6 ?M % F '<IaVg!pluL޻@_ERGG?9Xp!o.) 7}xKNt-j6[̀/Cb!H9 +a'b۱auR1r$T^Frj$ N-c:U1$p1pcSXv׾[#|(+6剭?]ք=yg~BR(S3dn+b6(xozeiR.o.)!K&URo|ؔ};I_\!0Oo{~҄i&mC9zߦb$)޼H_o&6@!,:k[qèklYk%R²#ӠTOqs=\l-4s cqh` =SnJB=#ۯOIT9kfEӛw_r0?%Y?B5 ѧkm3aLI|E0.ݠn)!789F|ZV^XϞe7[ǎ! r^9ȠaI_,Y1N|9v}U61)nY {倎TjgrN<% jx'[JU OB4{#ƨY5s`h5Ka"]T|W5p*vܚVq7O#\w]Tu9*ѹ1c^-LMFMa**O~WFA4jJ_w卽_-4J)L.ѥ^:]pAQ4WqفnfOZ<6]Oؓ.l!Vdஏ&4+(7.]"\Y/d}cu3ik1gŝu:<5rkI^WN6)X \/|${7AX  #Y*/繤>]]~ w02Z2Bfѐrw9N *k_t% |Dy# }P\Ro3Z\S 版U(~l]@'vVVC6{U{ ^DҨUC] 7|짫j&ZV60Ix%jsW=U 3K﹧O[i ]сl()4(ϙ #SeוKoL*7#?*"j؟_ɵGKpNR[nx}IEG4r0fW@8 (04+)h@C_⎵R6ʻpn/L[4h{G_C}9l(fB [G,KS.?93]|?+ѵA\ DOk%jb-[)W@ƇwVImKy-]kvP^ Ud5&~?{aYJs;?)EL䕱"o“"O&j=xmf,^'UeNwv,7TRfiIm쓆@o%&kہ d8gw]Y1UU"M$axbjPy:*iA*XhP{qUc{Mix$HÜj1A :ފt\Ln}Iag~XI؀c12"u Z |y`({ctYm*;Qݵ9Sf63dmE|| FU%&I.$F3Sޕ:L[!D '-fhbd>of'n+ ԱQ0!yGTygfKIQ ysdpV}W㶄ٔrX17){VLpPK;N\| "88J^t׺w^7;fUhLg[^snuym56vj'\ . 0<- ~,'vG7w[meTPHWmX|y9$śE)nwnUy4Mbڐ& 08+Fi?= ;9yj(迅75t: rI.Tu #Q!R:r#nDa9pGwDjf8vuj#LAQGӕzgLs 1EbRcaG\2ݧjZfr"#-q-֥I\` '}wu~Pi+4XpB`G56ab-ȷUEB>!C+` w"D϶Z i6H0Ŗ}4k#aa;Pv:%, Y˚ia?2’+pZD =qSV߫Dn阁 %gĶYFpT :xpb%8?(HآK:8N нp+~$0FIrH6`a}w(}$BC; Dr 3c3V<;[H/] 4DWz[[@bR}Z7oEi)炝Ge6:Ax" A[| )yyhA%vFzTpps3ΩZ9BxY9l!PSU;M߼8N׷piKS0lN/S:LINz*;3tj0#nJT@dT Db!1︺s^LZcr\H8qˊ[5_3(Eu1_>#tdC]()Q(k2 iXl(RMWZ)A҈91&^߀)/]ҁd(KN+lsȹ9ļ?҃ uB,vq1J.8ЁEs##Co Ϣ1 CϬ]pP;ĝg4j-n0BiRN^Cw\m(S_0O缥Qzc`} 8`!AS5v>﵊[p@v\\q8@D,m]brhBVOKcԳ XA9+~eĿ|)jc`\1F4BLyr81"Ga>s@*bY!V?I hH.iYK2F~JhLUUcVIY}蜋bW$ ɦ۪C%uos\Y5(Viؓ"_$gr5iBh'(Dav"7?m_)iն^~r9("W~kAY_Sb^NQL3bTuc[IMWjl Ӈ$>YƊɎѽ > Z[ & \|a2ujN )'q w@^%w@l!Ck'o ^GCs̈Ǧ$A9.^ʕf3^5J.dmx k7#x4 5w/.Bix07kY)R&p8û3$ @(}& бKt;aU&]( :s^~1J,ܖޢa.W /+:b5lEoIq \{h婒 / 9J|?>PaUR nw$L{g8/SSjE[!Q`}N.bbEljI\dalvFVw|߹%sWGkXU-ՐäUC~N͘|nRG,H& Ïd>7 wF;B1t"բhwsaqU|cԉw6n:vArFk* [o"G>Ec??΅6 dąGڹ IN}g_q?k5 Mk^#D>& :ʄ82)PAVirEΊ֊htp)FPz411川Cbt''wlIV(qھ:S/+ևOk">G'SAXvl'5u? i?T40ؾnׁr('-L_tp`|RDq+hD:iQ{>c+a-+nj/)BFkLNbDG2g8/PlW\Y]/>Jgx>J%oy\GNs9^0I hNh+'y>`܁*٭ș!)",R\K#hI\̐fЍ/Ox\`ǯ\{F~:t;bC=J,di=3~- IȞ742mn HIPܒh1Va'K܋N 6?YxS;)R.CU.qLonkT3-n͠3aG 6cFA~.Gyjr/߾?`H1k@d+9+źɄcuU;Pjj pH_2{ $ԇGJT&h^d.Nj0 nLpCQ\towchq˔J{ֿ d؀GN`XW4Nspmw|v\n>}rAmGR:*b&cيg*ADZ7(<""y"aA眣 RluQh)ũE%V#569(1Zq3qg}]+X, 6NHT'Tyou\U]kD,b6`As3n9q?KWpqU qACx"1W䃪#;ݵ+w_E oD?z+3SCRϹk(yֈW͡,B_u?(T._!h3t`` , ԅmpʅ?q `C!99iUD8,$Nռ|69uLj5 Y{wfUoX8rc1EDd sc7ة eq:q|atTS+$33 @rM:cli#m/IlkzW{8۳/zIG (P+]f$t~& 12F 6}<=Kʭ ej .'Ʌ ,֭`>1ښ`6Sβy\&=LBRk\m;Z|oRylt<*Ju]j^/"EH;g6>Ib)bΏ y?mYڀKyףh_&;5po7E_vbR?xz9)gʔγ&\B;}fn?:lpSr3JاhCp|#2leU y !QlyH(Vxin*?Q%.t*/|[ ǣߣW`%$(~"CW}(89ia(fMi(К9dEƥ6EWj@*UNķ <{"|V8q AbBᛐ7AFn܂>&M>-lj_4D>)rhz78փ^Gs)~+m^7r6T P<6i[%^/ 9V2J9Wsq !>pfW*C1k% NF4kvվ'tX26rT!ąWr$Q;J%;%>Qq>03rtXz@bhVucƇ;bpVb%I}_y<7{Nqqs ("3d.'Zo G|7W+-DŽdP2U xӁh@Mv $ewPWL^ΓN-JtP)iRtI * z"+\ͬF$4I w޸%umi*:1/JfɕP]1O.fj!4rCJc(.oyGgKTlG=:_mU{2#6)eW QAH̝7O!O2L|Q,~2vՈ77Hm䥶vV'UPrz e 2rhc[ѷކΔsu>y6^ ꊧYS-b:FiQ2d۬ypnE%߲(0.身NV.d@sj` 4%pogd yA\sx&s,.:݋ð봉tI EbfO6߬RΛ&0Tm1)?Y ء/W hfX5}lz[Q~a $wKIq^֩TU) frYU\ Oy!7gؙ5堲pk,DeB~'$ \xU,)ƍOk(Ϋ`D@gL< p:{҃'u BZq+WHm>FC)t h:Ku=mS9m}'QQi[v{Jb-dFYh YY2PvRS?yjҫ|ݡ ߭\o;>s~qbZG$Uh$$_G 6h:_-!|:xJ(}aV޼Wi&A|ɘ7% ,9? Uq]l8AQHOhA'@^vn)Xj2 y揜>y~oP?Vag籶M|#V4w|LƁ"5ߘn.*i(06Jeޟ-њDWف[;.z0S1 O O4uK8o:ݿzŠn9gT,$Fo~l3No*=Hlʳ K|bY䃭)f"]?NȒ鋌Ak 6Y/JMx-<{?ESsE(?ǦBiA3/3$s2@ZB^<9v 2;хU UMtQt#^-,D;7:*:VͲ/m'ƂPQ4OJi56Ip),8tIJsƬL<{> Q ;GrkVأo%?5 &f1eWdOljByߣAS$kn3f߲~WLl%---h$Dō p$nnQqg+ ;8~`^mmVfXqIVW8@~,{gՂ^l.UR9NUz.{S)}q 㱊I;)Xv= Ƭ";h15cv2}>hjLMbx~9!%{sN"Y8ώ&uxAEWč}ޚ f8 ccȚ`83EبKska0-`k*mP_X1ZɓW0б IaE`*H( \ZKYA!# tMމfV恢YT<&~z&-x;dK ;n͐f2whէ#v30LJ[-/ke(!ꯦ:M$3<:5zV9+t3k%:u)HWD,gVVw8H]egvʁbZjT.tOWiݥ9'O j6-\ijOLK|ۉ'k^.o<ۮ?FJ1l,T! { [k>^~"88p*Ζ@i ]&Ύ0Ne;NjUk=go{aJK#iɐJ/-\5jMw*B$,hAR[M퉭w+wk]jV@Z wfZg,172pz]<@ƚ=OTqJڌoܥB_ i+2U|ߔiiX&k5qu3 d>q`~P'ʆ%CdpXo-+!^wej4Kdf[߂gc8-V6Y)SAy̆E%mՕt(&)xghXSssȭ#B^b|ˆA_ L 0h 5k^Q]D{jD@ 2f@BʤIfIc.Bʲ>mHI0nOvi]6iφP<}uwmaYHpn].;t)?wyyI[' 5y} •U<?=&R0~L,9'מT^B<5΂j3Hntf9H5vw^ L {sxRoTwߛKoFzYuQ_6edeRpNbSv,J+˷nՉ0$ީ` [Ҡ3Cu\G{6uz'_;j}3k5Fe_C1a VyJs_E!G0p|܄aOݴm"+ḌRui6eVnpleJq쥽@*!tAB&T9v2䈮h~!M#T gnuawj%$ ZKX٪b<ZesFDMQM> s9,h4T wzg s֗=>DLJ#|o +#fjlw'RE]9;|xQ.+(ͳ1H#dnQ/!.A|f:8,@*xܖe&zZ֡F*Ӵ-:_vVxC3,@='?}MY㘞MpO|CgtArc2֢ N֦궭þii.sLF=$d.|l$.ۖh\JY-ٵwJYv #CA8IBTp!&oõ?X,Ovߙk20juz zzi llJ?{CL5UPx(mq 07Wٵ՞Д2hҮ.f4jJ+C.vͽ L'qr`Q2:.e3\,rE,Jztasg.k3q]4)]^wQ' a9 S`PTo8mZ!%t-HUƚDe 98OT73OiR]LTP2Tp 9" }iOhdkpFP_+W! GAJA8')4Y,fSh\VP% Մޣb"ѪAΊ 33~Bb(DV7_LT,7ˌORu>ׄ9sJDU2n He',0Z\ŕ qfV$o\BHHDέvOQO=nCruS/dwʑ7?L,fOq[V?T4<{@~RH] ɬ:(G&LYQlqK1#JRKIW|k ]C ~hg5s{nsT Wxi_.Zxoh.]d=2T@mv]`{_䲸BH\F  Md cPFV%jMA K%y`eP"0"C{)]:?xج=[C-րr]p^FE!%gx m=j v>lFMei٠Pu$(xSD3-A~ 45UА GdU]^7ڿg;+qa)_Wj@JP!:57T=~| 8A$Ŋ$i3~  @u()0-0JXÄV_Tآ'i ?|[N')o]za);ָ,PPhYVDpKMZG(N5L"uQZg7̋\=FMeW}1TTLvAzS?W 0OG?"y.|`+;˕.]gLg%$WgBIT{,"GgԼ-!Z6E~x2XRjrE-zZٚ3G j'1+$P݉2L)x u^ DÀ4!6h|;JY*AFl7^'t8glt6?Ĺy) :r>EۿE R+<$7ut2󌄍BVZʧiGcƧPZ ^RE%Eܥڢx"? W3 ,RS>DɁۡn™kI~ui8vW5,Mo*n^[Uڅ 0?ߜ307LywmE~תz[m.O_bg +2s 6, "nh=|_s{•:A?T E">dATA<^ Bw|mmctE HYSgcՆzX-Z%ripONi mI>hUQ--E }.`e{Xev9WoAT;Y!'B^V7Zɩ%(B]_Z;LߠLi)l [֥>P]P.!E'oG "P4Vp˭5,tC"SCDIoKGŧl:=ȔxARf>;2ڍV3[^tJqpIz5VÀ'{jP3eT}TC >+#NPQkx$R.PK9b 9A\|aMl܍b{<"τL[26Nlkus0  +yuIW|A9k&bH; o/Jv΀m7݀b;|'KBcƇ;'Pz>pprlr恂ĤNa~s| pZ=y_is)mT)ѡ=-XrWoB ['9-Tc~}[ =,2x9`Ǟ^s6-B\GB}`eU[ v1j"cztf9q`UFw*#VlT)dj_:8fd4P6r%65+$s _".bLvfqTqe\ٓ'i66? Ϩ߭9H!bv_TjD@P7w胥iZ ``}V7KC)Ѓ[P,6IE؆A1I-Ѓ'ZAzB '`E4g}Q;yrÊ̯W0"jRa@apm 4{aZ]"~_mWmaTYhd{yh<:1ط!}_%wy}7<4]N;^ }ֆ(@뢈":| |;3~vId6>`2ᲆEaW1SK$pQfڢ"aPՉF2/6$xz=<{0(Pb0Y?!|(q.stz[S8Vr[7&ν:1u_֕YWBMG&zmޕX27yW!./i/ϼ](fI>a^xuVc@9!YE߿d`/:_vfKf~[zN ׍{~ꖿ4z9U\‘ztٽ) %؊up+ab|wZߨ1^ `RPB"}&1"=spk_# ͒lZ5Vک]~4׈Є!*ey| J ]#|G8PEv}j؛+O&[_~h^:?A]>Ϛa'@AԼH&R/G>%D?9OxeՉ!MY9 [m5z'ikIW= k[$1UπeRVv ƇM K]0-wlJZ[Z6#Pꠚ\ڻz~$Hoڣ+9M;9t;-|'0d"%=km{<8U;OBgxIxw0"V[ =Ku!mPAȤWf(Ӳ^ mh{^+e +< )Rj7Rr@""hXvYrjRZ)z77) rhsJw tšðtbzA@)S:_lPO& vӡ Ecưウ߰sf% .(7+TL;b#P6%}npyF \4Okkne`J[ u ħD(Wm{Ĩ\A˅qg $S"||Y^\u(n%1+#țq6hfXO'ܥTlW20)CZ>K5T&~mHp;;eg*?]\xb3ˡuOiD'~,t+15c.Hȕ .O L&Ql;$/  jw9uIֺvc\ d;sB Yåefs`'V܍80siD'{aT4`,Y>jΎfvkWե7ljCZRi Q`X̰6BNE 盈 f e 1[E^c&Q*e 諽] B-.ELX_&~q>О\[P\ BzK~A^]$('Gi( {Ѯžt;L{Ͽ4v/uhMoOc$T3 _ 3>Fs8+v8ER\1۰ QWj4O1 TVҧ{ŁvBB2$~*); {*>dr6rbe:Uq Un$K;xK'Qk2iu߿_WK1Iݛ\z@,d!uGh«7$y2/lu~RI (~XޝLe;W@3m+9}/$||T\?{eu\ltJ1Bd~~t#$\11oNFE$E#}! @>gwѳ8%Bwo&&G~"5D{9t<$;ϊ(?&w.)n'Wo?B2䋴Tpkmrn:☓D _U8"6~/ d]xD#WR *CpROljfI|ѱ嗅'"𕅁j`![PY~<=*bb14 u"NǼH<B2~`BPY؀7&FB:5#Ȟi+L3.0.ݭNW!9"]كhxDɥw7!,$4Ư1߄F/.)|OuvO1Q;~ th7e7Z8=*sCN&Ʋ:5!:EPI@la<*>KRiYVRȷmG<,/c8~3@"=|t;ia, F!k2Ǖu3 !v 7HRxvIBBwA0Z)kZ$CLVkJ%ɓZ{{=꺜< '.,1Uo^Ektٗ!;AM6h6vqnbW V[03ZQ`:T/F$h-\9Q}H-W\Rj3j9_iEUZH $\^Z >3͏zld 0$o5ΧTۊ8x t:Q3Nn;Uk0! ,hSx}#K]f+ UGPԄ=e1>4aCw~r&F7`]s,z}L[ѕ<,Z^GW/1\gn7tEw7t"fU-ѳ\V. Xlb4`荸Vv[FҊ2GnކC֯5nۋ4jN1~vIdJ*D7xg aƾkM Ԅ2)cǃICS9@p݉x*db 2l7^k ^*Ǔ҂mNMKH%DʔbTG ʱ+Y_OLd)fҠ%fzbzAшJ0RZX/<^ig.'uVFr{GוQv"zWHH󷐁};3tN 9!Kp㸶>s\oU19e\y'3KN/#K+niPm&V_;ee*{.7iTIPwg Mb,cRb 4_ ͼШ7|q~ yo Ϳ5lk%aDT$7u_҃slkAh&k%bbRbh!r^CC]wu>F tܺ^P^?Ѓ^^zR@ BЍkW+m%ʍ` Gba< 74MHyF1o,v4)f :O3|˜db ܵQ {_ wvY AұR Em1$(: g/Z/ *)d<{N)7}ƪ^*ӐVY %nm^e{>`B+e=`*?J?aşP_x(>vV~^Dj딤ũ'~'餾% (-Dπx@j0to(K+ODx2jY\+2Bn#ѹ $Y!DÍ5ݼ6sV8s uZ"Z\~E^+5%9;-0CT Md$B,W=Qmֻ4=ǂE\l>p@!l i`jvʴ'Ώ&Ya&ˍ*Y=wV{ Cޕm%? [z,h܍ml)l'SLUy,|Fr)] S X: (4@&&(suDT?<&_Gy1h &-Lf( Խt'H)-[5LCUK} /\~ d"VIiugӃtQBZm\T.'g7^@[VyҠ[\[_I$᱑CP@yh"Ӈ20%Ƥ[Bop;XV(4< 9$GgPOuni b9imMU7,}ڇP# ۜyUG^[ =c~KFG8⑴ԤS>.o/pZ,`?L1$(Z㗈%alM;P 䕣MҲ*p1̙(B -B,lOsBHQ}VWmgΤ&0c>:}Y[{s<{$ rel(6C? W+ߋjh} ȫ|c-!$@' ϼV7.D r(pAkM-sG";ӯYstV-[Y8H{g䷦M*KaؐswNe>~7nD٠ˌ=OC捖[ V\SS=G>@0_tB oEGbEA\T\7U"q%aj3d굟r0ԸzI. 7}rlЎe"ԶXhEs*E ]A׾) FK^NѯarUM/Б,h8>D8/OB6NOR3)XGΘQARJpAvAqNAz!jZӕAO. Q[mɝ˚irD^]$Lf&]wї!{D OԭlulD8`p`=[.#І.\jy͟i$CGK.X+8쿣QE2cmАAj5˱}Hav؇{=sO$_Z!w{%cW@M+tWc*-#t;Hi%8ДppHl>/3Ԋ ˁB9yz8u,XG`aL@*9bOުL%Q}tA9+ݔ?¬rEHXR+9'r٪+,5t(BF"h"@ݠBQ+^f\#dPN`Mlm]AxC?q~4y5):Q~!Irn&L:Jo>DC"m9U>jl eGcVX\(1wpv"b >*S5leJ:$KTdȊ${D-V5 K›7Z]U[$5qoCs= e9esjB~Iװq+}GݓgTXض,SMeV(O9a0Aի[#QG|7QP[\ki}_JcԌ (Kb_cЎT Ұ)J3)7ե`<=mSpIU濬 #{Nz'}nF ֛q>縹@rG54lRP ESzZ{&XGgH#EA~hU G.W%,m2O<2/yߣŻx9nM֧b;As>N0:׵͕EVn1_^R-=1Wr{>؞gf`8tqv LR\$6&[!ö'8dz2GN3+wS.`#fCe˧m>Rj3M7ƅIcN ׺x7 q閽{xC0Il2(̙YԾ}0clj_?z9vVԫj%xIy#,4o>{Y0UɐՋɣwE֭DŽNÛi? +vWԌL#u*8|1xLT N iJ& ^~^׮:g%C3!@L95yLg^}% Cc֪SZulmmWJtqoX tl[.]a8*'ad\o:n|e˿=7&[ ϩtX22VD#w-:`ok;:OB_yP(+}$Iߘ37n> A41nz [3 V)2J (^\AG4t{1u+Q 9?*AsF8пq_ q STb5λ];P?aMy&f;𠢹ROjf[T%ޯ}sp"'e&_Sť)[a+`g>}Ul <[_.  "ia$?o$n/ ]w{@RK9 xt49pMPN(S72|v{3f) ϨH&ĮMѦ Ўɚ=?UfTWq,_vUyU"ۺq3\*ےBs C8ܶ3 "Ci+gdݟF= _?[lMQd 8h`pخHmޗlrI #;X0ox^'}xK1>#e5T /}t>LqSc`Xq{ǮÀ]/r!?F *͛?6~@s /.1S;%ZBv۟Cu0? ,idp}m~LL5-BqKI±Ax#z%9GwfW;ZvU5 m$wvSQ!+^Z!ϧ5٬C(?CԔ W)c<_ nĖGC~Gd֧`R~P! zo'4R_瞨}e׃%Y&{_R44Bk2t2y$Z%%J&cإ٧5kw_j*dBc9V=_iEԎז{a-tigpYh/mHl~Rq4e<8^ Mrx%]BH>[Ρ]6Gy ̗,@i:!LEbA"ϓxIЭϹqC֠[1wRw ߋ]篴kOjq3C [I~eav*9ӹ(1*3lhhg+ǘrlu t);y6UPA[vo1*mQrė6}hN7Kf_l1E,R\t}@x @O.&=QUpxńn'P@mt>0p[sYa޵ƫ@2p b`(8rw۟wҐ4^8eky,TzT@:T`tr*2uT BNvL?gi2^;`S(qy8֠AsQQy"+Lܬv\ EB-B"aJ?@j/Ϲu[1́o (8 )mFT&!iBU]]mB!X]Cd!닲(J҇cA}l VUepFsއa")/-+y@Ǎ=K%A~}al= O3x/vuWB"$u&CdkϱL1!t?UR]E.{ 4wnm13MYr8CD4oc% SDc3Qe"Ҍ/1@?JmkO.dj$ՒG0;kRYdn&3R3%+: D,z̤3DJ0#͞nӊ@gyr93bDkUS=q7e$rXf1 /S7m;d4*™r{X#&\ (q|`r1-?YX1 U17Cjm R4 wѶ .kQjL% ^v%xwgn}{K*:,gTvn%; ;j0yĈl &[ѰVB^kיP;m@\d%]4&x-Y"&HJhEOn/rt;Pc1Y6Vt.xMb2c9[687>b0 \ڊ#2&T^D9x`'"P"w8*D n5 n\j7|jg+qêz_e^hםꭥ Q'ɢglMS~R;dv -qg18{4kh4hYw'5ֺ>%G*_dѹrNoBj#j 2DRrt^u,г%^vyZ"q'/Yy: gnbgl΍,|oMƇb  d\GɌ{J:Z^.(H<3/\ô$*Y!5p5E5g` ޯ|3 ՋNpΠ/[W\'#ͱ GWqZ:)j>ۑ/i8 @ qmLI!P gMh݂' JO4%X*!ү$nq͋J6ʢnUȀ) z`E!o.QP̤1&v`4G4 5;~x9%-e !:HЏ"ge|_@t `uJ~9 0z%MJ0h|wے4ϋ|.C&k5G}*0^Y{(Aj֯%iWHŏQ-̧mj]w.JݪS?\9nQFR15^O+ >32;!%cjeh5iW%ڃƁ ^ho y~o n;uvHtBO8|B<[OUYTY3{[0P+Z<$ ,[M/2.7ەC {=2R1vnh?v`u#g#`Rk"v%Cق $uđ~|䚒|#D#( ١{o6CxS$KmYnHؽ*Lp?7>͵q@EH_@>jC6}1]`eIfUiɂ"~#vB>XLY Z2[x]3J-/S ,zDe=bK/lLh[&~D`%I?Ӂ8#/KM13=A-\z1^\ud=_KMڑGq,\W 0^;e)ʼn d&mqOfmѳ۴t = Dlϣ+#,A3tdN'q J Ђ1ow0%wn[z7.S11(AN9}-PFzX**kX=/zvܣ6J: 'it>lT,EKHX 6i ;) 0Miz. IK^dfB/sIAu&P ЫsSa8IU\EmMYHdи ]악d:/p`%}p0:k<Q*+CUAZ DzSZx뫕K AW&ylƐ  wW:h}Ì K.9jsF2 uqxڅhVL+*P6/mj+ۧ~Л?T !T6$jOr:Du%ebkp/p WC'({E u1LA# FDO5k ^Pb6b(9PAX p #ǭ h|w 7C<+MCQAIvљWSS2?Hw94׉;+题׉N`&{E٦?1;4Lz-R3fAlN: ܻL1M#^s4KoV**ӡ!\ "_sQ'ȅI?nT#+Z#N~mUCK\|vI<'ļwln}kB| ڽ\܎XE-uIP*>e[P3uJ2J!2t/ gckwh]Bb,Hy&{&"ug+o*E `lGDx:f-a $<'-*f@*#A.Iۏڛ탾%gj bۇ07$:'0:fKNÓn&T!at| fxF%rHXkh aYHDgnL68'-,pҕt7NY-FpvN-!D+n(>Xͫ(yϥʗvځ$ʗ[Jy%ǘ#up4ZG(HG`e+Ll^{^д8P-oGP8^)|"4Ych,MU@C4lA>r|h#ZnbNSM>2 U-"gܖC}%= ǜkn2?CvC(/qHU7qݴn\d *i-D++c"_.[h1]irslYR@m^'+%|x~쫓߄{λ~h^/N8$ʒ8ddfg3F`=vz׫Ud'!Θ deJOp8\;)IC>YCc^ ac7٧v;M~-jI9pݱ6Uz[54?ThXǁLt?@aX+hR{7GPӔ8_]N%~d| >pCZ8kh|>л7ę*}6!̟q,wHl" ڠK:3e|[O2ӚչsY 4]^7VKIvv׭PQAg e$9:0gvHMggf'$#o&1hb\ ;'՜ ag2[X8 7++Ab1Fʋ3y{QQp,ūUQk8܂Y587VS.pb Vs[HS$5 /}f^K/]Qw'6^lB>vcNhJd[ w셶 TG3 L¬ھlT),iR[Ap%gSxF򟣈ׯ2:)[]vl! dYչ'n¼:5,NXq6>7~w:E<"t)8]#"/{=Hhח*gR틈k?V{,\}IhkTZ*k[Oބ? oW)s>ha}#˧e|9N0Â<\d+'5$爿ӻ|%lfga9}^9U!Xr+BX5#P)݆!A@v\\ | /zOyΏ='nd`3L$[MIY6@BhRT"Rs&؟_pSPu }/F$ZN'c\vEQji[[2I!c 1ÀP+j tR[ q9m q6 3>GaTnǶCqv|rnhGOmbbts?Cɻ']֓P +Ƈ{yw 电zS3޵3 X:qCFJ(<r"MoV*f|aU(L$,md7| $6X3k^A]?e,sy26k#O@-&+p۵^#:lx Ʃ4ɡKsӴ?yΤB0eR@=4mj2k SS`xVhl4I|aۭ d: xO ̤՝ɤ%TvJAX%Jj(;k7cȜV C29tb|]qkvy{3JKsbty$V~GZL9T߄l67F1j>ҙYMlNR |v)HFB$; 2vsPxlQ%!6L 'xZ&@--ڐ۬#EŽ ي>4dƪr#vV*ʼnM&XݠRuYnaTNG!Xp']Q>Pc!9׮+5([thI0WݭHy$ =h}9L ~\Nj([%fִ톀0kS7ߟy#X7jA$;dыK*N2 !Xiˋ]GLXog=UmqncS8ѠSaA|] FJ(5,uHXqnAd"1iFPaE7~L^&j@sX8: EoamZ^O`X]-᝛gE3R.*wtW `3pYޏU/Q\_r.+"-2 rssژz"Nvq:Wi>}q`BHcoAe;?͎Q.cMT<Uj>S%TO;2@fc㊨fD-LyP wI DTtyHI"态]Y*8Ӵ7tH~KzDx;ЙǙ~e:)ҵ$%8 8Wo "jhi'Ti=geϑ*7s}_U80 W+__nrL~&uWb\lYV+i*~2— y(g " S%22PxA08}?75a|o؊U $7@>dbz΂6E#bNϫ]-5_Gjj) u`Ÿ#ʘ j|*fO%ˡ3z(e3x$ץH*)ͦRF&e.YI^,lj<Ƒ!?/u=&[gR lR}UK:6N_4.L) pus 6a$_L-ܽdb,XO#&]6{:y #N\V:t0B#h1V}ʎ{'χ͐+eՇUƴ9$Iq=>b;g*8MRcl8nC;a(ե)lf^*^c6l@h-vN9PCXS9l Ir{5aKhD;e8Mi]x[?yF\EqG+f-;= Z𓯦MFȧN0T%`#I.<3X#Qfg11WN6MqXE^llM¢v[{ӟԌ0lLӨ04iE[b8{  8_`6Hv߫QGz (~S :+9 "Jx+$R^m?.A_Ⱦ+-dk:;wm5P}XzD)Vtk2Npt!Ҫwu 4S?LZjoQ飶I^#a/ x(r%-~yR< oHgRL[ӕc/4jIXF{G;"H/UMVAO| FNu(2K-}gjR7 Ҟ*zʃ`[)_ŝկA#uu!9[N_^Vdb ԔkL}5UgbME"*`gh_a|~+< $Ԁ>EφtY#e Xu ]t''>cuz_)JzږEm> ~Tv뇣ԧsh}sߡzM Oc`pS-:G0VJ`_`ǿ[D1yc>$$-ѿ:wǥgsoO@8|4o"Hݳ ^yшKW`+35jx^-b_bU<jz.LLTo\r"(W: D/IaH%:nyA]=YQ7Z >qK.2GNr_<(Y d@&~gX7ʎQ7^.R푬rŇ_'Kmj0K%#dG*M#× 2|0s 1LbN|rv'Z oW]k=Z3[# _wk'vwDJsfΑ%/G]~Y Q*mRLT:PL2,蠕{ʀP$Û7w bm]dz&3Fn׿p^s}3D r"]4 ??Y}i D@W̵-'?dڗ )jEW2 k,||.MrPRRr`N=yxʕ/bt}lGu,t:ZZ|١PZSq'?hS@L,d il6$NM"Ly CHYUM]ybN{#4QY%!o ķ gBqBoI'r "1P$ ' x*oӊ@|更,0˦ yџv@S^aKh'϶q 3Wa0) (N 9PoK^А[c*w9!tQjJ)9v_b{V 5C'õ'ݣ<1PfT>O"Sl̖~UnZTư'u@JVT/8!Ͻ~S-C01ݱ,e "ܥfE|NP~\ZKac]c5Qdy|0N3m0{Y}c pVMtsoQ9@Dz9W,G1OV!deT%:K}Xg4_^y)^/}jMf46fb@3ULxs"N: #n+hcӥ26F01Jas\# :g˿]~ a[lh3?/C).t/53>Yu+y.5H&?#ePWQUvoAI2ZF:JhCJi.Hl_U:<ȉD}Ec`CO-E){O7%>l:b`e+IA?][yu6TtE znL$=~ LoDO_/`KvyK WC^yQ<hEz׿OwM &i \X"Z`ǔq,ql1 z?y\=`ڔ!^ٝ- zկe氀S9Y@JWjsBg"5sW>BfC*hrWщG-Hji:`K8;O k%ChfR>ƼtQىW*8"$yfO6~C%FBZs9hjqoϳ,WPkAxBQ5cW:ߺ_hjS| 30 MW 5c_.,4R > UμGg!j|WR|i&6xh?ؚn0ar'}ېv0YAh =ա"p5Cë0!!!?L2gRy%WPiّpp Q2ĺx&#/Z\tuAwt73 xb#l <|DHv]QSg?8Dvtɽ޾ޣ)A 1C'iMc&*7:+DYScaLYޜ\]<^{Ai-$R ӗ%,c1h tM/m^x~sQibs늡c^ؚ[ $-[:4'ޤ!9]""4(Vj hxYiW/tn: mʱS^ASXT{Ѓ~Er PyÔS-F:=溏gsކf6DJ=E~Yꄦ->LxWk9+B@^?]qP%%#I(.eϳЅ #@Ȯ6A  i.,W>4.KQQ=Ŭ@Qx):ZF@ey 5Z ca]_rP: _fFIM>緈EpVZT%,s'N0_јߠVz^蚙n*jV܍;LJsU/fU2c>P;qv(Nٷp{/"|< F Li^j鋜x qs\ht|p`T>!SnYp{ڿ?s#i[Dߔu>ȘCGMRl 0nC#Z"Ɉ !h0Ɏ?N4Hig}bJq $8/;г]ј#x,\Vd |^h6Ru٨ޡ3Yk K_,T?: qDL)ɥf>wuVK@<^mdFYlbv^֖3W'%SL 9@ T@KZEzc趆39Se%1n%dXzA~h0濢(4r1jx]"yT cTnr]=]|!;(|eӻӬzע!Ho k3+9Y46 ]e\;B!y>ox~* &1P@fq(jԇh *n_i*kLz৕vkJ| c)+W1bU_W6VYbT;]qX ~^Sa'-VH ܺ$kHOL|&i|00&(|xU`eM&Ihx3faK.BvcJB~MSceŶ<BJ2<)AÆ6>n;'`D5d|XϪm+0j=v(ic  U6D}bW/O$bonR%jv:r+(kaZY.t Ix[࿽Q%0qv@'TUb{ $ސLίIq{tͦ|X 4 )*,޾hQѹhM»ү ȎNqz[k|-(0) vgTh8b ]nvDBJ/.nG=}p# I}lԄ&0/Q-|9-zFy\HZIK6,h%2*>*lUtpQUD5ĭɅ)KZ>gcAZ'?P1VH*C^W9uC@yeAw"(çFMSq?/fjBD_蔱f=;=cyK7gҮ30Eiod1 ]'Է~"2mnMd>R1vUO~cdOr)0?9q G +s87be(ґvsA܌Ly2]v)vV]%ތ ?wRimX(P{gf͐*ڌ }/8G *c[Wi3({pmG]9 &ٗ tW  4aL> ʨ${y[JT.O:{6f"dd~-;4 f_Uu*H{fwaV܄6A| @MS.WTM,~9,DZtjsڦ.#xgB./וSW0U#\e[Е?OziT\PtxG螴S)S^7h{ǀ. hҘBKV8GrOmdo~΄DW. M(ZT +C#A8h"Zz68 X7k^z48P [EAD-' İ3[$ jkm5ynob|7>OҖ~xZ(U|- ~W7YHJT#Cӵ]Xʑs#i.A 5%E=ؒN͜~.6oZVչgӑ9]}% "$^ -`#U oF(4XAyLxv:9B(.[EPdн\CviEwه"ؾ}VP=Jd[yi6|8ŋlQu2<{VjABO9%pfT6+ `U|L#bMψŲGxӳF*M~pR{( пGmR[(/YT#^ջB%.ӱVMzAqw÷F((iNR%]PIM6jovθ>-@tŀ~ ˴]À⭜HecugIk}Ȅc$4̃ z[V#Y̝!)tX6*,Dw]}$$]mG[x4Oš243nW9b59u +Cֻ\qA-ɔiKiEa4P]tZ`Fm6;ϯK?5LIb0 &3Zd!$> ~bpEI{T_tqvָ"݁W$uЊR1F ~xX񙺈&9]uP_O ,煢 GO+o;i8BB[Q^V Jbl $^R"*moi7Ej .h]v=yϫ-|ie+dY9a4)rm%vlՔ|f4 3;6Z{u9BKc.)݂^9 ~A \> L:d[榻8AhP3+ouP+CQ=S?#藁%Bmc7M$>fcN~O5FW *=Y&C\lEg >Wnń@Y*,SDE ,_L';tnG'Ak^,Q+=>gHU*|ѧo}˘Ɩ£^Nбgz?0W|"OAdH7*{> Po+ظʆ? X ru!F &B* 9Ely t?Je&\[3n!ąp@ҧ?l(Xod=d8a`";̔+3+973 P^N qn{|pNtpa$n Y, V薦1 Yﰘ<5lmɟHIٮwevRPMVO,CCy@`оGP7ABW4+.V@+ІgO ~ G%9(DU$E|]wFB ؟3T;B":'K] ZPayJL.=6dgN!o'UebPݶ6|ܥEiwy3g4PX/$P߯,G&}K7} hcnf7.G#E9g@oْ 0"b6GӼR+L7rx41͸>(ms7cw+,8t՛>?eӵM wPNxlӘVM4C.vw:J3 >c[vS9NAh^Z ?8zwkpti(8HǢ]?_Zߎ/|Om!‘M1r5| H9Q]~EbΜ?0"lP M|6=L(@34 erݼG z3eٰiF!_E^.ss-J4(PY:|q',oymz.=6߰lB3]G[9Bq+9<$*ZZ2|/0mg  < EJΧ mj/T&*9onݔ)%9${)Pה#76_g&ômkdK}NX<`\m&z̭6vgB0GszwpDr^S4Q]M:2bm%T"ʧ,z5OS]w;aԛC: 1AFHl`-\ӖqQ | ~W zĒ8Г]oulre8jV(^/öWacX-#ԟ>Gva:k骖 /_g#&!4@>k>.bV AͱIQ=Dy+GT [n4ĠƤV8|ew<:C4SpmClp`%d u%Ps#lɸk6{.2щp/6OƞXlin9\l 7y:>gxɑ=gܘ'hA/KQIPe7)n5\5WZ44@lkAĄ7\KRp"!Sx,aB IGۏnT"W[ DSyo~e OBy (3Ԁ 믣E$2@0(~q#P.(_D(b=QRgq ߧv`*atUYÒG=H۸*ꉑ5 +oۀȝjܛ"fD]=ۑ$pB#}L{VažnjdIHBͩzþIL I>ycz&=2w<,ܔAgM{ʏ܁>Ӕ;u*k `ZՅG6_VZWMpm9=8A{{Egp]Y8{[Zx)u[ٍvQff5r'y&7 ߑ b5%BigFRtbvDA#exnZt5j!Gz#|gì,SjޫcWfP=wq?򖡿dAu8H!8 Y4;Q^K{*PiL3[&EYHNx hlT{׳;K/ >> &qʼn)Hlh% qaϜr2'ZzNȀX7HVhs,(YZ>ޙz8sMdw;ǫ v)Q*1U)>q;՜2tiFRҘ^ґ;H@%J?YJ9#j,+k?X{kSokҡuJ@UK1p}#]'UĜt6MgmGMcvQp RR_)QC[d3<\'Rk yxaՁ ?/e!H#ngD7|k%m}7ķjNI}ՕtNj09lncuT<,тk߷wt0yǵ&Χ4ꆮ Zlƶ\QNu`VqW@˗) عlyTYa>H8.xE4_1+Cf6vِNKA8,H{J: ބE\G2bqQka;}&amu"FUMiq;tV-@XAaQNW/v`Ubۋ~ dEvU ;ñ2B*Br7.w)~U#G@RbY܏^Xt9/J%.K/a5!B87_>ӓLLH9G]/qq42m .v,dq܁BzCYk6ma4f/}H++cc[SzLD|n yѦDׯXLR޲Y'*P!6<c N]!pLx鹦52FYF<nIPT^ 2ŋ^+В[ tƲqdzofӍlIyC^dX}y?Mġ _욨q\Kkzk5j"}}JH/㮡>ž<ØBrͺbM|vT/j} ۿ<%r`'Aj@Iqfֱ1X6ݛ` zܾMbO,]9:xT TZV s_ʔ6ϵJ [7|3W̶yId%;U4 !ĺc[-oqmSkiJ!KLF,2:j,`^>PwX͹* hoԷ>,\ao3龶~rX -V]ZIhw9>(x*x`0J梉YuFq"~zMѼ /ɞHL{d )I&r XS9ڱ=.S~j_뺴[awſsNI$jyHd 1vyٰ,DJ]A#sZIԴ6|-Ќ 󖋧)GkGlZ/y(1δKhK[PʅЄlr/fD'$lدL6=3X&/,Y\Pwen#t'ouSX7\ng[2*>-t&JI FMLZ]X3%}) zZF}hhs&sz%T1..uBYGs&?Ŧ\٧ĥuI'0$:_w8?DԿ7\7-OSw S)C텽ȕUnc)o(Z@bU2(泰qX3fmdU)EQ7E:Zp dz\6U]WmSt}Wiu1mF6jht:ҦYh f]_hOyHݲ(/\(WOhLYżȟG3Q7ڭ-9%'8mW H#4\@"u2Oމh#.(IUVy8zb+B(=o^}V^LW51*@S|mqFSW&@$v_N'p EJn!>]^t8HF&+r( CDcBpg"W+aQvg!"Qɾ;*T^ʃTt*׌j I:`3&s+yLv u:cmf]8Do96^;UͮJư"(5L:cXA_A@TiV#sG;Wp,Otxrv  ٘L/u GeBnaQ9>j_MR?CfxJus6wEh?gQl]U.BO3*%mPMÝNJe h#EI>Q3l4[7P3vgO-)<| U 4 wn1"}Ѯ`ϏZ,`T6T_39@x#ۻ'igFtzvB=W0C, V1xUaqIJbMCl |%鄳zx3~YIt];񡣐4~:LIGpY*A?xez|EiJlwf@uxr!XG ʈ1qFɚk?iItPH%b26m`e$}$Ai{'xH:[)B4D,k31*3}AsTLwO?MnX~ݶUSS#6s}aK3n! C!R$4@rWXG΍$**%HE"X'iI5EC,!@G@!.jwb\]Jy8-=Bpd:6 i+L_FZ>j O:F' H=&U>$!4?k;1[l0ۯ&/05sO B(,'1gS(8g_6*r }P jtN$U1a.<@t[O5 jˉx+uS#ז"41b6#Ps֤F3M6Q%wͧ,Vq|O~Po-K]طj^c. C+cG(,#77x,ǀ ;&dbRfsc0*7躌@L餄y/+\_svQ"w8e2峙`TnW(, Kp9龅Oj4#Z|a%xC*o-+Fy~n̍N URVX5jjK+0DG1=@VbG߯Pwϓf2щ=(A_]Ցa:ӝSY#'O>jDP {5Ǭ¤L-Ҕ\&ju ֓i^Faٖ瑩4cJb:5WyGzs5B0,hlPzFnwgKl|<Vmūǵ:ds[&)0i> KM-mjd`)1YGn-g%N/EŖy&X|ooK!)ƈlBMN3 tpX@ UG Oι%"eo,g:Zg"(ڢVХR܀Ą9: S_s(*hͿTL(s|ΡL Re+5e\>=MoeYy1Nu2rd~>Ph~uKf5&)jAmb5 FbI4s<0ANvgI\ ͶHv29L.u[EI$;so(Olx$T*ROY}hT.eQ [qpnU#cy*'F ȨXb;ycJߧ1a31m$pTXWw]X#^LW5f3 ( _{I$a$Q~I@x~J;QQpK\5}oq %:paZJԵwk 5|iZy@q=^W_B 6q=U*,}: PNB|-EEd X !w$Bu-f[UC ; a·p8  -I$=oOA-Q{}ؠNUwٰc~obH螓/T<]ǵ [!W)=0 AL]pb\QbX d*]R/*q=0Q}ǿ9ַi~;@0K"dqdNì^ExbEIhl,'͍c Rؚt?@D4/D $.UI i+͙Z7$$:̮g""O845]aG#)MY0@L狈(gn ^GѢcEzEΐ ~.ʷdJN/Ym23Kܦ#DI)3Qv-x~-nR:ێk,~ 5G3aVSmF,(N1+P'KLkt΃t^(ctNք=FN}h#-:|ck:&-.[0f#+hКx;ao2З)"$ȹ^U-ILen<؋n(A8=F9ֲ4U6B7칥VmoOLr1 Qwˈ\pQh,)?.B|HU.G}`WZֆTܗCsǿ9JU?y xx& d>@xRn5` ]`BBogO^?$9oN+uzo-@R˳ b@mnoHXnmvBI QlS~v(d}^k3/?3 K}dMٛL>YݳUXǾt-|Q[Ԋ|D0 -㷬= a6xN>`WVbR_Nj\GP/m@j[4%~Qv&8 s\*#8O&/w,@| Xؓ "7Y|K-wmaA8nW bKu,~G'JZzYf fC}Q9&VT(uN-蔫ޫ){ĺJ_)l3dfWܓ6rlŸmW-6PImUmMlO-x+"*+ڹz{d v>em>>]EHiTQrE)1len> DY.*4RZpYE !Neܓ.=@BɌX4Yk-Eb^LoIb`ll'+GtO榧}a{ BWA_SrU?р/[&~n:!3GoO[I<Φ0)V̌uaLS > X-dH TeCJg̀JsJ^@\GPPzP N]Z+LQ` ӛ>Ա) rz+7sNHYPpng-vjڡI9u? Y$ ^|[DuF ( q'J/0"O6"bѨmȑEO_Fl^il*efB<䊗N] xITcIf&IX+o)-HgWii'9I~.1Ϛyv7B KDsS āi Nh't:{,TmV Bh+U+Z?]TٛMAzǟ$t).Q‡/D!˥JE:[ >|!ϻEasHU-,J^+kEMͰ}īijj"@46xi-֘9wlB[RTkZ_IlEL)nY-`ƌuN*${H*xiX80*WG+=l³&ֆB6vڐEA{y<nTb!?~'<eF7pg=E RbzĀxTX!PV¬} #7 ([گC;gRXU4PNu'Q.<=SZCDX7d;NJ)w;:@4 vAJc#Vysf; j' {vwlyybP*ӓnJ{FhKgڰJ^^[0YR q u?Tܽr p?J"k>FP0$hԍ#~UfZ#FTDϋqP ٠Q7)~([]ڒpt?͟}#{d>Qf3-M#x?iCY B[S>sJ3n'I,u邀چ߰lk$9[XQ8n0ȡ8ŝ -C_^JH!bLѢTG9tϲ/0>ӿnA,nCޞ-{92h-AȄ; 52%Gį.[/C,mf|!P/Ijl U+| @8:0/Rj1'E'1{9@ n NW!/8;f-#qAڞ@{=362!Ǫb&m4-f >rBDfqb'2ݳΛshfE iIӁYC3h>!OFįn`HP>㛽^py= C5Rz6)Oƴ*۟ FT8β;q:&*@hO6.NE3|:Z8+? r8b ڞ`GOhN%{[J%oHO~wyqa?6^oE=b8 [iź9$ac9!Yad(,MʷL`T/Y.ecTX$01 2W+__Cͥ@R8`ANpe"%mP mk3cUѸLL9 ^gFb3;+vdMff z<+θKgBi{w]s0B]#N.Ʈ, Gw̩IQt·<"H^_=7#fJELc!1$ø^r{$$oT}"h:pKՊ< m@nk7HGՎ 2d&dT=Q ]]GuDƤq4npȣ:x5.QR zCT rJCON t5!&,`>_}3U,PNhFclKdV_Im[KrW_f˭Oy"t~^Q%i}Kn|udtѸz--5CբUHfS P ki'7Lknys= *sլKvě:iMnYQOroR4Vybv+T"Ou]A{kV<_)*9l-5iYi$/#=Cc>y[c:a ~YTU~ƽ:k7}5atJIhev3U:e6j|s(:?;@gapc>#Gyt8nP5a`P(]bLq|*cƒkvJo笅=Iye9.ШsSbN`0_׶r.g2>\ݴ!߯ϧSTMUcM6h>Lfp ӕ~B진LoW&pb3bb0t`okWT <'}[Ϧe1ntZΤ*o%{z*UiCXEmWҰ9C.kZd~wȗaef/ؾ2/8~/)vGxl2|Jz?5IْWpNcKϘ;4 Y:_Mv4F{%dQD;䙝" ҵtu-\ Ѣ TbQ,uayGf N4v7r>K8$?Zj:~'_p0&)3* tO26eKTSu퟈t;t0]"A=U79f=`:r 4iz+1yUF>+*e۠A W󖺙 .Mqd lגx e%:%es/kTaEDS8o!ˌ)Y+hE=I1~klln|rئeO"9>REf `eA[1Ys|w !d@Ƌk$H|+VpJx24㔨6,5P#DObdd$u_t(khm|Lc鲒; 3ڦ93+'R&E} jyX rqe˳s"{&$~oIU@oqM@•hB1)-߮)S'f؃ ;5a- ̚57ksx &' ѭ'n P7;W/5Ց{LϥzNY{$G4vP 8 vsjMVqB mQ*QVJ+i[~T9ɬ<k> LChƎ}Qt Cd/^,evۣN0~(0%k`l=6y=pM@rtd<|?EiɂHbMq r`ߊl((' ,ņGK\lSkB|?0q/V|VO;!gŢ lj}Lڛ،?3BN= FQ*`rN%1ǂ^a8ş| #8uX9Ïdqnr1#Jo%=jZxaӛQ E0ah=]鎖2zJVCp %)QD²ƒI(gT\Cy\^h`ˁ7ؗ8ɐ[̍*+|1)yM֒ܨoOK !0L&BD -WXˈ&n}y  qxȺE 4k{ǯ.eRUI$kUm9[aY%)(i*DWދҒ~_ շɧR;MD (1' 7<K rٽ yD⩋BdZ/܉$LOt5zwFvMӧse) U)Z:*jfZKLPڂ/m} țd8gw2<얻ٙV3nxx\nI,]#_ڍk,N:EdkZ$ʑ'MRbFKEӎ۳6;Qk^=d4>0+&lBwq.n@rYYUvgaªH PNUPZ₱gGv\0)Uakc.d1.6~hA&[:N@ܰd#hM1#~iwn3YP%?l@68g"0soM|\eɂ2G*e[[UИ:hrlV/G? ȥ$ ?R4}PŶE9%&n1CiO$wmESjH!Ra ;vYִ@G9o(MLX|]/U$21?'#O@P"+nxfDmaoYdEAռ#P\\) DGC0Ri4zVZKj*kW+֫m;Xyh̝!D{N&g)(o_GuVm(0/\|s#T5wJf;C[ho,jUG[F[^8SA51E.ҹEcM cs!BBN>Y`Жɀ45. Kj0X>TxU3cWT1bŸIs$(ָ) ]tEkr!1&kZj` %&f1͘ǴG~C +7ST.D~5Xޢqj1G-e#$R9xB_ fE^ w^DBOJ#׽s`kO;Wc OoN.H|4c=˿8EuִX ߟNh]ɀ jw0(r$j˦A'灏k*{D`{"nR/Eř:'MBfc+JA0Un1n=RL(8I&OJKci$;) adT&ʈѵ P`tEnZHNj߇Y00*7#=WKjʤ!o)5^?RKߪ&!eRYcgܑtO|k:Єŝ ;g D;1_bx,H<'S9_2V͏ QWdzsL;/9a) _KRF;]kI)Hd'1|3_䱁|8ٸIOݻ 疛i4V{1 0ˋ…"AUZJUڭ\a| Hz:]/SsBz]NșDML ͝].o$)sG%/+aq7CGd?N9YH_eZzkuD!3OQ3"@1Ju/IIzhΞ&^p32m%VIo`Kry-+#U#6xF]x*sJf=gnj bܸwc褃vZ{ lzۣ.АJ6H9Lc/!&_`t=uwTx»%8ZCQMG!oqF$̭el]?2kvO!$Pqh \p'_r>e17uUg_ f\Cp.9E }0<o4콢o vO܏Z~XG'Jw [1j= Ȣ#OLR®l e;ڕrkK[46{$_t}۾|6t4ejI.łQ ^Ʋ$&ɊyhK\7w`}u+:Q!)ǢLVNR,C=k!C@u:B}8*ކ@7S3A"8*!^[LsXCޗHNq *m/tC9F0vEDzT؛n4d{¤naU5/ǪT/ՆS ֤պOGL> =#sJHG)tb0*GT/tʒyi~t(  Y;0C asO @!# w#uv'yvcFϋ.uH9َ/<lpPآDf3dHޣbQX/_Bh$ bzVu{)Lb.z^99Is}DnEs;w6$y?3O73AS&6*X s*zX^;0$7#+Ttݣ([^1ER'[SC;~3=chY Er&΁ 6Sॎ.laF;ƎxgN돓&,vIY~o)(\;oV":d+2to88v :/PQEuU=O4g+IQY]+ME6ycşZ&lZfEvU)2 _07}=T7RQԬNKs'X[?8{UjX}{Ty.XVCHl`eM EGI]pԅfqQHflK楲)<I[pZuNkvYFK(4@=aZWb q:@'퓅e68 ƻ1зO K: y2w4XVO;Lնw8mvHI.`j0[bUFՏӅB u*Kr<o|DjpVo"}$e1a:2hrd+BˆoЋM螁0qg] poOV~ˇkr;pm@RNd >I>]ZTTy\}9p>w n2|EZAL?I ȏ2h|V/+Ɗ( L.5IlTE %5{o2M&=!:}HE}u2N{-v%Ľb UDE,+X:obk}f$FE5PgRU$TkwikvҝYVF&%"4AP#.],[l >jY?Sǰh}A;\tgg\JYϣztʣY7Q z0ᴆ񬿀(lY񶙂Is7e`&e9lvY<()P`64Lƽ/W;h8<.!]ͳR3>sZ VOuOEM+$ ,|Ӂ*D"o= 1yŇs=aޤ\2bHLѻ%VWMBEQN2%$.Sg!,6"d73bTIbQ9}.Wv'FKkyDž^j0lmO0Xl`fC|͖>3:'8Cowd+^Q+nY;8b23ȔE?VX_'Anޤ!A-*Xr}w\+,!=Ka^[2a@ǬT?wB]LۭBa8W vzg?䧿-齣ޒ{px\rfF",W%9%lr!|bigoMUdŎynm\Gk_@^َѫe %ѻdU/$%V1d0%hVQx?|gY>+}tb;|Ayx10]ںQ$7B;91Ktf|zC+Xvq:AM R*xlfXe{h%k}wbo﬜CJV!Y"KjCLW rU-Aff ~IiLȑR/xZi2^>Ui$lȻWS3tp՞OGS8.X%%n^\3p?Q?0,Ϛ-ˡ(#u}s3'r}eШF:~#ɱYuf$.S' Cޥ|706 EkhY3t L ?p}oƻϓN*fΥzzΖc~#-*UH<0n(ΦXxT2q:d'IAUKz$4z&^_դڑ(fZVt3rі2IG~7]HPT]ݳ4le [;tm@VEƀ?'G;z%)nd[ȭ $)5V~Vūa4Sd>cژ+ڶKL~jP˅#o\^ >#b;[S݇2/AQϬ#htr_L"ģ s(4$鋙gNLHPyE:hH 4l6:We)%/T9!ȶ]"r7& 4@4 Hu_? nN HM@CHd*ǍV sR`KSf c<\\^P|~\dmV*Ur ʓWcC:8`QA5/|X ^A¾Ja]}[dBEua_4POs}y`"RC׮)0TI|ް{QQtfꫢuVFb4YDosPuK>j }6(un'fgo'6|ҡc!f|+(կVMn<'xt̵v `mfa07_ӅE`t^Q摗?R[${7yqۻ`!eי ?0C[UϽEdJk}O0b4j0je*>8@x`81084iκ|氦 h0ZX=R+Ra״HWihshlĻ =gz[yKt^z%C6dS脑 Jx=l0lD-~l Eߊ5XָPPc:+[x"%%Z=bVy8qJYn ZO \v\<%onOۑ%,Lv,q #E #X:d tYm9Tt<Ҕ"Aw`'P0tBԣ;(кYNCi ?x|wi%lֆ;;2.3ކ;H H[ΊJދ˾*D׳Wy CV.ݬ!f('M#qms@i4Vw`n疊ě*NHQNLR߫QZ?F^}"+̟ Ӛ~-'،yrakn&U9‡W귫żWfLJN8.aYjN>~e9::Ь-#'kwagejoDZP3s;Y\9)W!K:Jx{y~T%N{|}s~"B?H>#WrÄ?'d̝X]G:Tks_ѝKϮYķכ+CEAk"!Xotaaejc&,xᗤ+`#.G? 7BX}S̀wU(=Z :@+S cx~xWfEq{h(fº*a45?1s2-d`Ur9yYng kgW|>63QڎX5:GxeRgX5T6)]A%0)K; Om s !!LK!|T %ٜOuBF>*]NroN_SÈ%b-brǖv5]XgקM:963v$/Ls2GfEH$ U蟂Z) O1$`cSoc|@>PkDG۫34~KgI;ֽ_`QtZzEtkU^iv8X2YQ7f|xm# c }}1`c;@/⣓4#?.p&$ #ٕ8Q7!hq?aR ?Z臭?KMlc.:?UZ|Q+Ok($48U2 Raje kb/g1GZqJpMÐP|yn"4q^ݑ߲FƴaaikPD[_2̏];/P)T{,!尴SR{گ &N;z/!@0+'i/nP'Tkx4z[P$ru νpZPo:ᄙz]be[AT^φAG!ESZ&@ޮ 7x,&@"ƙ&Zi3Ӑ|wF8,J QuJ?kMM[!xGx7}PeGAlqro`|88=`[m;Ni%>a0rn8(,8M䰹uɾY0_9BxA, =(36ia2ً#цdMd$9d*w 'O9`@Qd6jm[|%y ݑW:|{ڲ7 5IZ喿^Ν,N:Y?LH ۍUM޵!V7ڡc/$ 8X葺YxWU)Wۏo&J.ȕrj P*h$ӖǨ5Expjreirtr[SO.8T]xX^@Gs0pX/AzD(VFmR"Rx,bX!']*r}^hbs._xEqkD7Wp< {uYio9;ƫ5In.+1+%,.E}!0̗ͫL]kQ\F5\bvӦb$ԙIC4˂'y U]^:Lt>gQ,q?Y('GMMݩ[%K*g#йWZmH/p1@#wˬ"Y@A/3]Oָ eLuy * H7-\WX_‰kH28 ޝ1Q/R\F{x5c)]jr@B$Ty_J_-LSQOЦӂٶ^e!jt^ȏ } 6F5d0`1LSb m4ة D/|6 ҡJLnhj~2X&U]DR6"hױE bՁV*=JZJ96vFEole}H'8pXmXE ! --4RO T41#6ψ E҄;f2Tu+b wݞ:$=LGy%T42dǚZy͠gC6^3 U3h4#v1RVW献p#}=/iJuڭ#Zc֯Cha[*6^Èޜ3~kѩE]-"=TQ8{>]6 Y큲qj5|XNj9xCρIF&LmVѻr->,)Q)$N60,;oCNxqcAqӚ>?nYP1+į'~ mFW0m]/q,Fad/&7 dʢM:)q OM/ֽX& /,dku{ Hv]FΛjI$cŷ3j;bTro:/k&x9A~~Wuwnf2ƣH~*W& o-uolZ]OY6a!!8v3Biޕmu)@xLN ÕzgZB0@ݕ%wϩ>nZ"aRssj_1]%8Sk8}w^Zd( HPS\yo[dQS m.csg|x0Po`2 Bqv9%5O駷;)%\?E _Ӻ!] . |o4 LWbve#B8 5rqd)>UV4_xא|2p.~K U3z`ЭLVIbV17I`3AqTO>(?KzU@u3(ē)xDBT>tX{`#xCI8D<  Zl!䂥\{#Uxm1en 0/ '9; aʿͲK:wpx-I[4sH3ʇn@C7"Ջ1H,lk,\ ̊&!z%&rhX<>f3ʁN9CʰoH"nB%ǰ N;ֆ_|sqgn"RJo,=9}A,֛fꃶcc;Daebbo>aUU5,;i%g0!O>7?×`C6??Sao ĵU*8 G,$@oU&ͲVg1(tl <}eq*͝Sons}]IY<ͼ'ҐIhVx۬ #)ԚPniDS7҈ͣO޷DvvQ [_@R؆+?r.z.ljE܄*t|:\4m^~7.2@Y; PzUpJ{ѭxIFEUh_F`K|P.Wa9GSP+`elgXr_J7n6srBl$2g~wS]~^ p^gZd:|۳'qLC[ m`ޏ:_ժ-)Gȃfn}cS,._Swd#FL4`KPtY?ˮ3/fI> %y Sa 2CKIRReU gEŭ>*QJ!['5tAʒ۽1ʹBɨTD<74V+WؒbV +/dF;N{Zp?b]8""b+ʆ$RiS)V'ol΍{xEqVhZ>vYvGOz:|,/G> 1[#ǘ6q {'k*s$WX?\V"   g\NG8ڴ=Ҭ%tiSwd+YfVV(Գ d""*UӭHm|`d۸M7o=w;p{oQ| fu)ϧ#t4B@JǍdό&pm"m9z9]mꤗHqyHBw(1p/H>SpR6J³D#9gGeO{FY:, %u“G<@%K x%4]0 JZ#}VtH9|ͨ? a@o$ھP*H5=LYZ$._/=Gciq\/mߑp+[H!vgW0}?NѨ`DPȌI=ӫ/ {G]>|.<#h`1;;ydlQ̟5L< %Cwi4B>Lir,dUY*WU 5.եfCV&TiLn&-#T$HIHڪӘ MTt@P0z$)>6i] ܣwdP ,U0 0Ӫ5P{ܕax EWaO,,EYqKpƁw34T&:xqhu3`}nY ҠfF@ #Urzd3)V|n8-.ǀ0xi@9 @PSJ4+v&ItArRQe&,[p*(O"iul:j9[4kv]/q'cĨe yTQuV3AD`бg!,/*rp~7 ^Iv@Z4&N{)8F#BbxU9UsrF3nfOwtE53ʹSc5 k~7Ntwb۸R`Y> y&DN5IG׀@˅51u1}Q4Pɞ!T Q,,Y;v:0F,F%hӃ^?֢chc3+IWm((K_1&VʖVvWL2q?Vd5>3djJu~#zDĖ s:mOw_lΈZ)/nw`Gs|rٳFE-߸/.ulAo(m8G%QX?SՁ]ޞdE^v[S0܏fM< sIfDҤi ܍Aƻ/$F#M0Vt>EǼӫOP&-ma $PtQcf a%{>m*<ь_qw ls/ w$Mrlw~~:ބ7ߎ\x:,P7+dZnxd;j7uK@̣djYg<栜äk[c\%42Mco ۆԦnl`x+qli<\!˞&{PA1r,Z!Kں)RIu [ f Wj<ޥ:7a 愘"K]% Vȋ*<ɼ*0i$#x#Mt Вƙmccx[)luKٜEJ*E*"3P,9H꣄-xVCSz:Sfl'\ OJ4 N#Tm'#q{LN=U)u:XB]`e[FY`Vj[1ѥ2Vz8ai#e4u%cf`*,zc6"Nڇ2aq 8i O,  e=zr`ItWIU;dMx lISފͧ)zLrW#56fE,\׋H#V֔ O*ƺ ÎfTD.%5Fh9N<ʻ{ ܭj.&QZu)\n0gFytP". Uu?X;f$a$zAtŖ D{1SMFa@vIx껠\&9UxweRjJS͐S6xl<4dl!KB>}Kz>;zm\˾m7/Jhmz [s-WWrImP("0 \:fENB:Qs*K|YP %:bUGhu5=FD @XI_uh" @$z}9^T܌zu.쨑%n@6<Gր odF1c% FZR_qfQo$nx$6SͰĽ?jׯ Zs0UK;)~nK{#,9jJ}#Au-GJ46˄8>AxeQZZZq̡M'5B FWti^d^2WEe+7DP4#: d3zȋ3G[m [>%# =UOGBzד^X1%Ĩh5&ރIl,o|,()SU v'-r n{D60ǒ׃JA `/X `:u\*Tp62Yy猬 ,ڥT]s|T9ӗ X| H1"*7nLV#ܜOuF&R0Iuo9Rμt4{s[m=Cn*Z%B{\ y_@6雿c0x:CC[bkCQEYaZLoWys DZٻ\p0r 'mS"ʜKOn}Kj-+ MY[BI ?U'!(SЉtM95H{ P?q,Ëry8wX˓6 ^6Y$$f߲c=[\ڋڰ*T=C dHܚ6_^LGUv.LեP]JCCp;c.͛ \ZvRCKG>ձ?'MgAx+pKָo)w͑J2F࿲±`n!wJ oZÂ{jZ J\ps]Q'Qpsi> 5Jx%}vXuQ:;kLd8(qmk-jg*>`t)R}|25B %UJ\$)W_S.XB8>X^XrGPI-$#5kKsM%l8. ֹ>=kԠw.j.t(x3,3!%?Kbd~'GDDGe's=v y]qPCS,)wI(5IiP' 71鸤k4aF![ͩ/px0qI}YPsAgl>UM'NUݦgwBi;vAw!Fk7;.5jJ_@eԲkiQ!~&=8tl?0tu~w:~'5 yT?_C^ [2JӚ.(u)4Y QIwFahTl#(&09ם< F/f\=z!½YV<*˄ Sjإb6WZU恌) ؖߝf-Pz;ϾRADNQHBE?e (j>::-)taM]MJ}/Տ9H%;g6ch(8P9ҸG1Exy`!P<&8bTلFhu ALX)(<2naeCet4:thswIʟMS<7„R6 p«p* N 7NT[8 1R< _1]m'֢X7* SwmZ1/ˍMXe(4x`/ ?g96/mh?3k% mҪzFi-cx3{w1(ra^&#G!.ē?fUY ?:¨jv35Ά4c6׍z$탎wq O ;^![cjMZFbtn\-jc?>7沶 Nh |n^H3]RuX!`" H5׾8oKuBDsA9bS@T\NGCˊ%`f-^Ω*^9 \KB(&BQ#73ܱbo) h46#~jJZLWHW;]Uq-^E0@]C\'>`qmu}[6zOx}T:*4f(>U0XB9ʋ j< r)9HrnƇ\D~{ <Css>hyk,cv@BI$ havo0DY%g %PU襻ug*+sT ywq3z ׺OU?z p&jg!o&&Þݯ; dyn]e4mI ѰuIxg\G35}5_(,ON2)$ۦ:<^S,G|~)\Q6Y^-+M_g a&ekZvSJ8WL7j #™3$ȯtI*S+A6͏0롱@W^Sfȷ0#h܍*)G˯Zꄄf xW4~9'Ff![} Mx@dq cm(ͷS9եG=4-`P.' 9}T ??I-$9@~HNlsGFp$C-;)QPGl#ҚsO򸮈$CJ-?4~lF Μ?O ]L#ԕ2T;ѿBS-U|@EB emrH@)o*l`;㵩fBJ{FyV,ϻp%N~m4$?:g_CڌNTݖ]g~#oԗw0˴tα }̈́ P*BW[SD 巣([4c0EUP*&M^& +JlvOXx7I<p χe;`.K@J5LL'ҹ%r,FH$ڼ%={wŞEaz*-s`؝+mGyx\NL -|W@$ 8=hB@r4(h ?*vi?빘 zDߥtjp xݠcP7E egHoH<]n,ŀ_˅ M@a98MF]ԼL <x~-ش/Oeljd̥ihA.Cq\OKb;񅜞qKUP ?:[40(V-)ysE{b_V*Y&~WVI Qln*jOHE 9-rrַ\=)BM/?"79F[wwhQ䤝"rG-L gU3/6cfUJuEgʯwP;@=7GV!\񫏋F"/Ga"@Y߹o5ַٜcNSG31úu"dM]pӋj`8セՍr+(qTۦEH?d %i?|\DՙY[}rIA7.s*ZSY%E\`tRM^t eC)7.@}Bb+. v~L"v.OjM&5:fDhg>;}Rhwkz|u~5#~`5y8@7 =U-$@qUx^bJU|:D``q!14Sz;ZA8tk<V労盅N=֖,0 Hp)n]W'|-SkeHtV \ ߤa*> Q<#xI qLEDGy)) y{HAnNHYu7$8@ fb~YVR[^pdc> etם6:W2]!:adl}tkQyxج`ܤn`&ۤD8qWs+l_AA02&oi4j(ˠN<iE)u)tm>4I*U< L#wcĉ0DSCF˳, Ǣl(d| Kc@Rs.(!{ z'K̯5&;whp?Mʮ><]jsnp@\﷎1"~d_lJ;7t:x]@8x^ok.9:ӚatZr/O 6A0VtKL$o/s%9k"*,0;8d^5VM]l\9u21݋G<- W˩6eg58؝bD.͇9<[p| ʓxyN2+uю\Muﷻ q+灁OΏnz86MMgֽ NbE\d.H7}KhjSHPE,P&)w+pY t`]ƴQL7.ՓŽt}4 z [ uq{? jX?>)U۔UpPAvX03ffW0gGEƞQ$1X{Y^ c/i$c@1'7u1p ApCX"uL| U^sOI8񩢈q5ПAxD`Xc 0/vNT Pa0n&g·ˆEoDXQM"KkL:([ S]bAj.i!N:A_6)-}dx$y1vZfAS`;R-D1 j*"ۮЙ A Ug<8܋A>W":F iT9arrF ˆzXHh_%H& Qfnf6(7vH*?t$Y9'Y26 *\M7Lj~ =}gi@v\ؤOHp&wa vRd:Nc,ރlQJhY^"<Hc()xHA^龡0`>#C>R?6 }Of B eqGeʗ9McId,;>n/ѲK]A^Bfm:MRD b,T:M2KsV :sέ8k|}=fU„}+t)u@ {'|9P7Y`f CCŌVh ƐbY~l>OMF:b<E8HKx:Ʃ%oDh7IkT4i +B*;?Om!}yo_Tu`M4 䚊ǼQ vxdR=M7@Qn`ج*0fH:|w( "C eᵈ~ug"7zrޗʊ~RXAcZTwyiG~;i˴s&j0d(-Ua@|>3uV)UpR3)j@z3ΘR9xiM)1-EA0tM7a/Cx/]mݺ>K8StsX3#+\ILF - =Zom>l #whAV5{=Xb*şq7zt^NI ˬ;Ί#F%X2}}y5}Eֺ3Yk\U }>7.ѡ Àu\WWlE;}ANb&B*%Z0|merPlPMf+P3J٨e>ܨǿR[{[\ [ME)]_y(2kٽ.pu9wÛ%VտeHknǔ+҉m-SeKOhzF,Xs,X4¾Lش<69i^aw[:Zn&#j "6V'N;oU24it7[k%;o @uR7,cFLϩ4tܴWXگE3T&!wytr$F:4vQ6弹0q,2F/ ^"tK8X>z!y/g9]J?水?4Qژ9,=vVan:ј.P݂"k+k([ܸ`Փ)2#ܘ*#W4XiϮ~#Lo.i kڥ_A $&&};mC|Lʲ &?,*Gĩ)F!GhB#X DmT'Bz(Wu=ͥFbAzN6 ť]ؼףּCU0#R#rON\03|:]lMԠ4ܜ=d|V?23@¬1jjCйY9g肅'k$q'85a$K L pVx+Gh]XcX AׁlE#PqL.ZBO:}(\.A^iv_~\ytx[Rr{m8ԡXUyoOXo; 5CHݬܓ,Y;q?m7F~c~ޗ*{X,$+EY}}7c&vV1܁^ ?".+oV_Ӛqv +^k#.P@,KˀJ ٽo#љ42= a[ 0z.e^(lNi+10` ZD+ۢYƶY߽'=?H2ymv &NI㜮R-8S]n.Զr3BN鈤}_q`%T oa[hVֹG uPG!P- c=tI1oA9I%/;M{Pt`w}rW9=fTE@nClQ`$1"-2V]&:C"@^1b<%pQuc9l`{?vfb.6:83)ŢOMm[ZIANd7GظS8usr`ۢߝ+zlgoMp5$>PM< L~Ps+˘HMLlME_=I{{S!v:V$Hw`e?T`BǒeQ~aP0Bu?od .7~Q䍼 );tl6k/IꙖՌ3`C31LaӓT o+yYSyumEK2ڤ y_[r+>ߤAg.x;be6gYV}Z/>,] pEWmқ id>_W59cXm })V8 x_FAgZUbiO:*ivH$SLeK{25g!q.4IS0`K&YCc|WL*]FHyNf+PKQa/kE*q^vSw@ _0  IZAu*LQ2D\!1 Y ^ (vPXqAR'KP֓Hi%],gR} S| dҐbˏ+L> w2_r_<3W"/h4{?{J2n"!wCVzxw% $dE`"ڌAlI]˳c,ϕTŠ@@= @A\2qЌ^ 5 n0pߝ"/m0!QLE]LExW p>+[ūT`Ѝ2s L<XmujIxk.>lNAW\缬zﻠJtso&\"Zzgx`]V0Ƶ$?4pV[7F&?c KW2YMr0}Wk6$n/Rl %z. ˾-:ŷNI(w[Zc KO+etkۍVM,| Lט Ngv=&vR0z5GFH 6qj?mES#9F `- 1(Xݙ @t*xEv7ʿ(lq/Eà~?T+7{gE73{iv2ǒd_ε24J9:pځ=аxW2 H^hCZ/q"H*U18q`A wY: #|9m@l!Ϡ Ҿ^1 13 X"/W)MQcfc Ԑb N9y@yKT LO(}+t!E[1,ds X-Fi⵰">X(Ul &H;x?83%%_UҔ0J6pՉ:˷RQY& S΀4$ifPaw[3hC#b!ʳw(chujO0ֆך'CNPz+ )9w íxAۆӢv jJ ~Qf*ܫTѺO 9e0OQ泌 ^y[,c%IR377y}ܺ*$ "t"4٧p/I|vfKF|>oeЫTK?+D5~ab1 &Xh[B4[?g&Y;v<%6kœӑ8? (?"w%q۾{Kyk17 R.e= ͍n~nbؖ>nȑmpX&i`y$h`3{kv@[? N[*5@eN d·6t#0eY8%qkgGGY{qriG:=@ŕT#}{E8\_F/Âe_S8#IžѬ%]Y:wR uNΚ8q9E 0e,=.KldEHc&#`CܿR7ҞGi;٢~kT0_ɒ`;t3OI45XC m]*u ;]B"g˨j_8 *a%$ZU͟wvF' ;"5ٓ[] 4!D+_UR<4~r= ?OΧAJ/;?]7~" 9XEtCp逈Є.U)lJSofxmm|2 Ә@O 轏^̠OItgO-W7 -GW-0.+8к<kx''AqϬpZe'%U育LQ%WP1\3@hvmuR;7z%i!CYc-gLtQٴ:yuNj Ϗڶ x>-YCD [ =TcJ*]>\sl2ݗCZ&b_͵MKOL #&j1ȇyݢwɻ7fnfG3ߤLؚK%b@75c~+_yfӨ79?s+K$*(#& o0'9l9E#fI_tƌpElS?/%G:pj#d!݂%G$IQk⪱'j4u^a5v ;44$)a2Qga d̹9"'f7r4GodžeFEvܔ-o ]7ge.^B=w%Ɓ}@ʶfc f[I`z. ,ܡ=ZErD\UyC)2\. |{mn! ޿SzqŕM~ieQSJ0PhXO7EDKWnTD!6-4[M8;J7Q4a Cd:;@g/࢒@x9T~{B=P؉vcc ) +dء;Ջ9/73hZz?q+5JHSyL]~TLsOIeߓo5:ZXOٛS bOg8=ۯog,Bm3A!vj'ʷk/{[rQ^IUT,8{i&d7_~yLyTeJ<9h۾cs6k"-%= Sd hTLcS#wUQl/+;G Of 3S*pÁ$fZ >j[1ci/{; R| ]ϱ',Ul%< m/6ԗ+wKaK0^㼬9l}{~#G;e %VڪF^Zotnj5WtYbi9 K `{=3j;L_1C 3IԨ̌E5-]Жja.+. "c~U9@hdH)'(rh \<5Vєg]@l6 &ah}nxj"L$8-е9 2_qc+ꍴ޿R@ʲMNz5-},ԡ5#{xwf8OVA>~YT&>XΚ$bO-a ,ڀbDG U*.'ID4oF|ֵ^,fZSy:#.9͌>Й\0KQY=sG 2UVsj=sL:]m;2<]K%}RnSޖ)f֤$!uPRݓ<[%OZU6yqJQ!/d:'^]d%TUn/i6BEI^sq52k%4>lz8[^ҕl/ƴ ")n\VܶHWr<O'4ꁩ6 :OՕF R*O) fk[VuP.=ʔ|(c^NWh㰄*Lowl@HěDPFfͧ LHl0 xPh]흪Vo6c@b &{0PVmb;Oon)D1//Л:1TFPrfUs˷5 lWaӂ6"vpeP@@N(GjR9!=ɻy*rlB}d(I]I٢/'tUm&x1`]y4!G8JTE ,;^̻#/g}Hٝ<_KP?W4L6o-ԥ&d8-QU}(#^Zߩ"Z֏\Vs;Sₜ@Nk/TRt nlLV]v̾ إӣ+rm}hNnן9SC5C3!p48-jo3ů^4> If6/P ,25M`0JR, 9>258&K#噜ݍǜZ,S6Y6;d9=K× |qc2!ŏm`ó4cM)K*~2]y _u׎:TӁ-Gx˻3sCiRVDρ^ v.BQXı"LPg)?9C7>TxZlDZ[Zp0yٌr|w /.kp}TM_Wi {u:`{ u( 1-`r@ND.BV)ZcnzJ!s*djK#3I$.Ǐi_vO`00ppaѓ:Nc߷yky3@_4f ū܆Cg{Bm(mV"#7nE{#>S#`F, ?4kRra2@$'.Y4g'z#L -| c_ 8JNJf'W͕Ǡ&P4#7{.Wc ou)~pm̽J賉akJfvƄ[ގ,^'8;|HC,WO;YPtӁgS)9ƮKh ݛ6UIʷ2RO!; y ͳU4,4!ȟO|eߧҶҔ_8"Q*ʦ_La _L1>F!#CaHb6()h%y 0w gL]`r+X"v+U긁C5Ys3bt>IĶ_UiFu'$-eS=am %Ii!%뒧+<+Z?kqd\ gƄ:deMrme9&*e.nuoz271qiEV MZ6QS:ӠdDW h7wVkjfer8c$jUQ{=K8Ý6j*|>][D\ŌVS6-H/ B0]@>ۛO|QY6MVu_XW3A TșAQ#O{]0AN.d͉sxGύ͇YWK>bkv=\Rv/V"ӏf\}Pſ}jȊ6(Iwv,0FSp̕`eRlo1%*vں?4BIF36EfK.~ JDJIGeK.9+[!=~8[Pz.\5 ^^QEgb(xK/f!T$ .YN[Cr A1?_IZOm8=+d ib]#ل8oSUs1?ц6eHT48LBSـh]oxSwɃ}7) wxNUiMTҘW? ǥ=r^ >>,<_} s(S ;d> bqU| E Jz-3;SKZ_4>vAR5|8|҉VS*\R_Pʼn Z^}[ߏDܝ*$c@J߼B<(8fa;/3ԹA ڏtfi@oTB'&aLf"7 \D6J\'py"'7{Ƌo"" ֤6Y >H)ViXGwF to EО d"h@Ii-IDpP%>xoXf~ 9``lK+WAxCkXPdg1nUW iNIҰ= Ϊb=yQ=c0abN&(]p`_!T df=IYP s%#PUz3w9:PIm܄*JQ,dϮ*id+g 8:xjؚ[%rn\F8vn nC'pYz.0{Etjj;@PvοQMaB7fU8 c1̒c0+F7HH JE22%OL}ɝkѯǎa״LS p 0AR.(w+%|&N$[_W= %26UET " E Z@ 1 5V,:()S@*-BQU0{Zna/Y|I=c;׳B+Kb猘_{pv4>ǿ" ryl&O]ŽG( ] Jp!&zFKHRi7 D7jC qa,λy+$XUԕ#|8]l~rcj[iNy>!cf'_7\򊒚D!:O})V,vAٍ*)R~1 |+ AMT^OȚ̊fLV I#rMIFci0uGMf!8!hFw]jxAX|:I| J0-tl-m-*Qt`uQvʱ^-bWCB#|Q405Γe!%Tn tIw!h] Źmes UPW*kFj"Z ӅIs 9'}a'=sJhl#;akгB^]× CCR1(1H6,%ÿ4,r  MiG */KK zm}LlwIלz1 {#F#|L\0 UA2/i޳hmNKS}.W8~USN7P{`~ U+AgD&@z`؟B&ۓj-iM1tkЦ3W3:w@\ #V3Zܵ'#ҏ8!xb ۆAϫUt *|ׇ:*Fё&Oc\44!#*e3*АQ56F!3qاۜ8(]Ov3VA!h"6AՐ kfF}"G^*Z^9y;j4Zwhwʐ`|޺1ܭl](K_\&m;?G[ͶqW7枱}o:?dOـr-`8c272!5+ee'b]\zoY w-Po ʹձ"7\?47͏no-bp4ޘ:ԦDR&0:XM]"T*;8b#*B c̯'@d^z{#){ǖ:yb/M:2bDmQOF['M· »+XTGxL;m:|:|U92%4i'bjc!nnHs4Ԗ %H xE$u>fM94ՖܼƆx:_šx#IIWiN_*qw A\TMr* k=s =]&[Ur-&Ar*O;un1>Kguȃ8r>rY'>>mY]?okqsm~/̸8mwR@ 2[~(C׵ywY'dʌ4ʱ:Qx/ě[kU;ډ;..bK ]fPC3i8^JʪyXPv_[xgDChȼ'hA2:4kdRMN9^ u@ DΆ4!#8Q@"nvh8)mwgi Y@Q@鹼[jnUwss;sOz5VNCrPbre=nDzsm>2m1[RE~g#=5K/7дo~2S ohƍ91"yioZ8)C: M h.R-Qmӧ6r L"De2XpW$,miĬ1KI5F u`,z6țC'{G6Fzóki-\ХE}4:ys]ߵ$E/:ir e(je߸2vp3tWʇ#i6Λ2RS'߬MZq9IGD77{'vP{YIeu@H!a_71(TCާeAԙ:3Uuhԑg!% LYIaKN'g;~u5^T ,&5UkyL(6:bz=։: R7+ S&zdƔtPDvЪfՌ#w/jۄk쉺эG n SžF'ӥm큜Oֶk[-B|jWQ"`Xh5FQ%r@$v>G$a)l`+sr )?`X,l8ŕG S2@]C̠|c7_SVR+}GQW R ,!IvW~toc3hRO X 6u`V{ʴ^(O=8. "R,(F᳜ͫROG+<Y0Gtp> w{Rfzě4(QqYi1UD$W7 u OAkaǶFwIڛ$(x{^O}XABP7q|:P6T,}|}ӰGLg"yeMk[)h*-rSf,yOl>D0PZ8`Z"5 =`)/_hhu5WŏIW/{AؽBr(δ1o$ξA &Wj2~l@# ;9/UBFd{ݽ(]l߸X1$> !_1+A{jXPm Ñ]@VV'ꪐ)n6ēEXw*_;8&>SڷCAtIwpqx>ik1@ѺDߊ5ur!,ܜ@$d΃>7_ᇋ`Q/Q!xV!_S/qL"Gu6]V+اtܺ.e9Oz(v1Qٗ]okŨFȘYKKLr2TU3||7R oթy53~(xs1tK8=SLIG0 7++vy'Z:e):O|YDՂwP'2٦:Ut ~H`~2L@SOŖ̱^=\RCNݓO9Ylo+&cQ *lc6\U_#:9|+'LX6k1VYtaDx/XK׉+ -疠MzDA30(oo0 Ɵ5YՈ0dskWE.K -i, )l/\O J٨Q60PMgm-8Y_tt[ CAE65dĉP:D(Qf^qI_"3Ѧ |80I8=7:jYN^ &QT֬;Шq S ]]ZX#vқ{١` A\q(W(̥i.(H'=ڋH#lң5濡IR0jFY')/(n&CF>k)o6:fS`h^EqcJi4XM^3Iv#uvg ý^ךD͐۲*dCobpK5e?b/s7RGm25}x,-e\dO*2]j"W x4j7#^J B{ -|TlJomdGs$"Ca%;A}PYQ*K'; S JٷJv.oZ|_4Bt[ ܝ<oq`? |5b-#ϛEN~lCN`j%$uÙ:/7L[>/O{lHU۵M5&F5{x J2-t^@ >g͝s)7 fdj_%vчaƻAqgd 4;T$V 2,H=cn3u`"˸P+ T`$+x]Y*eׅ`k(cWl+ç.+C9e}Pe}q": } &CaB2I]63yBo8i v%y.ْl B0hQ zժ`2%!Sɍ{QdJpH_h$ {?cS/b1,b9a7b'&뇓npb[N΋Bֈoo@}gf}jR0<[f1;fAluqQO5p[%{RyxZ%{"͟3 Ÿ`'0֊b`b"wwL6uqxN{_"IU?0>du\lH Ji.[ɉ Ȍ!xpawmiį+^PSiŶ|%bɨ]wϯM #?`ARP,B񙞀}JV؎L)hi/|R շ~p5!HbK !Z<.ۤLc@jz2:j>qow:ޫDb\/bB_faKNdS`gBr1-ԠPI"!%y#liFB?@H]~#<{h'F]"TmGPFQXLcbu9,wp"ϓcK8) nmmP%/';Pioz쵐o38 |'$+V֮U15쀟˶HZ+i;_ԡ2G BC^-}ULP[,F vѨt5)Mi !甕vxT9\\vک<Z}L=L t&rP;@,DFp@*b)he@e9獵0/=)C@h8K9wPZ0M*aPSQ ˝#.4'|{{ȡ81"j@2)}X<.NWwRB-J,OXcSaxNG7S5O}SR#"n8{>7 OwO^)Uk)Lybw*9J/6:g<`3~ !Rw"#_==b..Q806ښ&^䄆 >в, 1|.Iu/]F1{Ȇ28%\UZ'PZ,kGIXor!`6xC\seϮ+'FUE|HEVÆç|.7OѮ 3 ~ڞw'osNP+B=y7"=ץf%-!]}3@n'gBGZ8Z^|!@nf&v9S(Iv#eqdr1:4Ew /<>;;3^#/ƀ2U*/+i'\QyFFFo7MWp>j6[ j (fyy%=H7 a4{=+vJw]7RgO"%ܶ6 D`ߺGk(G;HUz_9}z95) rB<3 Y'Oᔝ4T - (/:]pe/:) ^{Re1.) F5P"BdO3m|^Wm:u}TMA9zP2 oxM5i7$`QTs.嫍ٚ91B00F;PiK'FJ9E-Ek]}1Ko| T1'Le'>n銖 99O}'/iZlt[ [?0`+4 g-b/t0ُCf!aa8_wS[~F<&_yU.&|*{lב0Rd%T%BH`%C@}1TpE)) ";l1L[dS(ݼv6H$|㼓] ӁŐѡ +=l<@#L}{7Mt}|&NJ q;XcT{A-71K+P0-P඾F8Ml念n1 |堹H>|zVc+9G CG%%0ߟ!u!aӘ])׃2}.vf-€=~Ȼ ,=gJ` ;'?,i z v_431%xw! ~ls0#$TeeW;o yULcq`*$t7&#W u!qI! CG~2 nxHϾ&N*Kv(fAQ RsGF*a\H!aBj+LzjgEZ08*=Bq¤9>W𱤟$ڸޥzĝqͩD%_,8LV2zaS\I2:y?—J -Cdׄ4$|%FWe %V)ђάRTM/ܤ)"z*uHJy31ĦuGnAk!˒ UJ C57⟷A3Fj" f׶hkq% Bbۘ0] t0z-Y7H>d%g趬1%G-?ECy"0ބ|Is2Z}O/.4}u5+a2q'xFT31%]: AU߉'pƖrT;i5y.W2N %bײOy^|6~yd%>)=!X|La),NaaZ :!LݣZ9KP6컊]﨎WOc&m]iF7j $>@M\FJ5Mi /`jMRcU5@гi>] gd'3LX#e)&=2!݈*7^Nھ\{5Lh9bo 5`ÉLasZ]ҐpGXs]aȾ0o͒ځQV#|o\^36XYN.GtW5IJ1]L7 95=>xpIrxz$I÷{)\sTiQ~Q ,[iuµ(e PI\LwfWgW굔keS&bӦHa&32(ǁYxHV}NwLѩXFW$K+cbu@DǮ`_W>Mݤ(rC96ShuIaVjHnr+0J2b?iER^ũkY ֵ|+5Y>0X]jB/ܿOI=6UCYud#q*`w`٥mM_*L_tP# jiObدʓޭLe}S MVsyjѝ*g?\PC / n@4b[9m}6̋ R1Zawdſu{,( 1)Ђie >?9V\  b˔Nf;t3ߙim|?Ij4ΟWٌJ-J KMJt\͟q{r޼@dJKyq^YkhÄqT+nlR'V.G R/td0Zu\?m Aw(Gò&?AY40|Yh虄+\c}?1M;S. Da=4&!&CXޑH<9_Fq=ݍTV~9=O22v4#}>q4q_Uad [۶ i:gpJLl癤}`/[830~7]ݤ2sy֯q{f=嶩nsa&zw=$b"'z1!+ UJL9u8L)b[_$2Qe)P_ Zx_7V8ULɀ1}L "]V)iq5hoSU_8S*x(tS>0LZR*Rm6T8 Vl_ gL~& 4 0gdU\!ӱ!6ƴ`B㪱EAгR4%^04)žO"P IP[OyF;L3-2խ;pi/;PT#:J_?gP`Y"wu~FCzdy!hJ<5T;"x XF iNK @ %^ g4^A{ر?9/̯ʮxŕj-RUVNl|P|6cβۦe/'0 4ϊb{@.sЍjXԁ,]/9C Әz,t;8# Ɂe@*h/vs:22f>( e"̐|ǰbL40>PVAG,h~O#<-]HBw0˰yL^3b5[)QmM@lk@$}~vxtQΧYQhCQlv#s)q6Qr:yw,VEdkRj׃yZIhBgR31Ie:4zcQjUݑv7J\ ѹ5 l0+|}[r`zt6ozL\Zq-ޅ=5\ovAF+_wk%xy"JNBŖjhٟ+a)L&0kkّE.-ͩ=WV!ei}Q!LK pGEŽh-{<J$%3%K.^ͣ=}VR \ rk%XU^y`d]rIAS+h)cI$ gtx!U0q ?T^LűT6yLfb7 -AӮ"MߴГcY\\3UƮf9+ױҍ g0:6kyݒ|0#>Hie(;d0R: $>P+!(Zkk~S吭 fR7E uACQ=u9s;oվ VqS:k,δ-.YCb|8;RrO,"B}aj` "7+n/$cƊ]Jk6޺o>&n* U76qB}fIzb+ňўK0DJSXSy8o2SՆe"D`mQ/m{)cZlۑX^Il :x1%`{<7^OᬳNi`ŴM6̡(цN1E/@%iR~DigxϪ<CܽK+QI2A&8.^ | lmѶQW,%kx(?́ w1+eq֠L ?`^) 4XFK;F)~`<#93v,ݷhەZ[tIBS"=\@ZS=F,LNfh"!NjPB$1e&,K͇]X5q[4k#Nř5laW+KM^S S-]Ep74PNa8Ц]u]krd7]&W[ncFr*BW; w&ڬDkS}TtL_ \y~D m>R.ҍFDM$F)/"mCSpɺ(Fs84MB zr|WkPȾ_[tcVp0\!7s'0-LټfhI)?ҊI؛M^ }|Hf8JZ3No?=b.m kE/÷oZ܄4]7K2sY"aDȫc{P>˹XWe1默EڣW~^QP|.ܧN-; &XiUh| >;a{}lbvlq쟢찘\-t@5hpg  u))m"pyDlK S$ ]C2m?UF"_XQ,eC!{7TbO~4EGښ9<=ttV=ÐgOzܝr0Xit[" EN<Ģ[{t Ct)RnJMx ^wO+5 mz!{?)_b܁bN t70u{KR(a2'[t[N^[<59b ;Ʒ}IyZ!!1(K"ʛbЇBlx}o֚ȓzJeXjW Eis}Y#pQhxa<:5dbo` m)n2W"R8s0+S,_ȠϨdŇUSA Sl2>ɑpA+)v ˽xK `YU+UX^z {n5֠_'OpDbΟ㯠9:X4Bo7y"TRLW&+"^@)FOOu^ ?Kyp}Gb-s{ӊ+b6VK ~jk~Nۘ]WR&wz.k)Jߓ3)8l;IV=l-h m[+Xk}_/m"NPy%]Lm8$.Bf'X Fi*w4 7ŋK|gnߓFo =lPWhmhXeϾirc'm|_ =<"!6XhT(7Kܭ }wmG/~OU)%N3W2. ~$) i>[n$lAzM=͚6K}umPӲzLT{YmIfj;yԷizQnYK>L B`릫OdXg}zӷG9)6IhFPoQ7Wׯ YwEQ20X\9vDmT+|"!Ɂ1 Ns鈘$/Y]Rq3iYK?q1iIm^'`F+B ق+*W,[G~GpCaѲ\5[4̵䩒=7g:?m]4-5KvgumX,|WD_N 'T^̴~Mo;,vHw_Wzyl}BBSC @OH e&IXNRTkڦDLxgJm7V3sOd~ VѪ,!'skr_uyM";8I|%A3T_P**jy XJtL͏((&6_7cP(Tg0]#+b0H3;bAgۻ>blSnc8ݩⶑ`ٿ ̒*c_b c&) €9ծ1 m C |df~5SqJ %Uf}c} # .n+vl;?"%DJ7Sb_6+E:,~@:rqdpc] k-wy 6x[ ]oea#$ &0U}UђtYUKHt L"n˥N:ˏCsqqgx!S!1j i"0D,/7.ϼum =iOۿ?Ib6hT_[*gv } 71x K0a5Z:O{TS1<:+y7- G59ŦVWVkzϧce#ASOgf$J',:kH~AZ%6, 2C;^xJ<RSq#U ;6 ^oDϛ #$ N|\~ 3Vf+8' _o Zlq6%w/Vy`*|$[%;iT[;7J0~ĬNӮ̹ZYIqi/NI>:Q^"35l\$ẁ0c1{'GKסT'3ڕ J\B87YxjQM=)ݘފ8I94[c,&cϳϏe @%bP}盛&ﶄEn5DQ|{xCnmh @R#4jD(E<&Z4U*1_;ʖK{Gy}-bM0R± d.SXeEt HK{u|9YT]ȱ8.. yH، C?hr@ UzW줗Y9)N"&ud}r P`Ƈ- 5=}Ī -G'y Lӹ#uE';t +=I7]*4ƪd;mR au2"p:\)&+%ض}uQ#jf`ãuWMq06[0`?#BqW^ӢK;Xg1]nzJ*Tj{GHvN=8/|E7]6Ź<,BͦL06X\!f9FTP!>hsfH|#T>B2 4_I1YͿxē41gD~Ğ:'K>jX諣.^Bd:6OMp$Tjg|5X: dUORtP"F|eT{*$kN2b8RAK4Dr'2݆qwpnw^]Ev/m}@-I![(e (@ydW{u~{aY?md^J9gC-F "}In,%΀ ^@};a|oN5-`Bp\4. xs~#F4wVy yzQ ۘ5՝F #dGdVGhjZY羇Kp9ޮTWqT!Ͻ)2cB:Qoo>0c8K=7ogdb[[f!C>JPyX H?o8)6u-'u73,!%9ىO'R많Uq:/`WCmxuP/Ŕ H]c{')=],wo7D1aZdJq&c9ꔬ/ = D+N vJq>.)pp>7xB]pXEE9?$/O<-ɕ?+K(y7W1\ͱ!lHH9MTVjeUxnDy7#ۙhqڝp>_8RHS{Bpg *y\Li16@IAܯD 0xpϕIp̟xdv'%&*(O3iS'yTAm6pبOn}:Ԝr #H(`ml*WbS%erheVU>+#$IBb~=}@iY$+d?YlDw+ 0@(d[!(n“RSѶCYǛ;YBZ ~\{H=tz7=?Yd9x I#ll*P\4$is`+M;{X~̛u{8 _?~f`1.Bo*Jd/F貰cy5trD%3VP=g)ó$ʲ!W03򚁁)iz|G@ ^d{<8VNRhTLĒ2{nsmd;XT -l zVB(Ypyfwd?eE6|. 9An귨"#}X\uuabjE<JzŹÅ5s #J)ԡߜK?23%+:a>'Pӧywh_ecsHw.Qyy *W4~HoaDt% eіS/p}Ya_YF|QU rsĝӨ)^Sw}|\@1Q.(}"W W8ܚiEoËdw*g}YFVo+;H9 dMu_Gg^kV7)hᥳ E%fsqcmn"=Dqb^pkH: !(16:ȪIO"T g"|7E޻+nyx`q(YqO|RpMZ@+bu@D:c(Ƌ ~r+#97_PKʞNEIn-Y$ ;V[fHFځc ߶Tw`:qS6!L!0I T6HlB7Oʏv PL#OٰGGY_2 ]]֊e,,RuUy | 2!՜plr˓@_(Oz2G>i. ,cw=Zh֖J%!U=BA_ rٚ![D$Q=L^8e,#adZAlAx'~6ӦӖUIR{p73JfܮnWQY VF/` L.r 1k(FV}(SlR|&SSA8w>vxʥ? V:Um 0!_JFM Jܮ vŒYS:Ծ֬ jYdl6PY%m,"=IJVzׇyFӅџ=g{[kv͎30b44cBu"HҚ&|뮙b-lIC'vjd=(,Gn$i2d<_wLV]Gq012BFV5U<"ݷ)@Ҽ\ 4E D{=Oj"(QiJ= MIQրarΩE ҩͲ [iW7UҚr'eHz@:.7NǯD %E\ڇ6_64>H^F!Hf VtjnrVݮ[=qd$TܻLT/q $F AVS$mPA 2l` pBGE'4-Y| 嘗ћame@,Պ͊<ې`dR!Ox"`mi#/0+j=|uΨl2xʓ3twJ*”F8Hب)\?1N%h+#|To~~Wo? !icv5E7O9} OQ .erVN<ĝiL.5P;(œPτɀe~Vo1IJGg go94aoD'9q ku!1I#-e) L :戞C,i PHXjz ky _;dCü7{/ljZ*ْՔMl\4ẋy0'_L ]TШƧlfEΙvGX:'2}&ؔ56NrKQҝh@|w1+ &Kr&}6MXC+BǤ[RiSaTtUwB5${YfT]]Jgm\!D߿{( YAAJB~tgs".]$,W ځ7"t 纁t=(BJIF;7}_nW*j%.'ca\g wţŸ&g'vQ+w0J}cD/3E7" 5") X\0G+zX:O x;E|8JO}2M1k)Rhg8)O738bnMtkkJ[e`ihIyZ`=Aj~kiqo=McNgU3yN~ [\7lx``oD4JfǼ:@N*{x1)W,_WH)*a2T-u|epoysۮaU}C0D$6=3͖j:sD'Χ{i:$ u]4_['5Jh:Ux?W_Tī'+"δtb&H(5;Һӄ:kC%9*1%r y2-־"rf)L%>d>\ z?U߂"YZ uN9P]XH?I\'U*m&|^kt_)!&5UX<n.83`u~T3D5vI.SY2̉˛IBkIuLy]ל~ 6-fx:o~!CXVHijpСY=/e7nHQLY 4-"J}Ӻ`gd{_0w ZjInT.U }Uz %hË SS VDji 0{_7Z?fUW ^h[h0Nt9{~q_cڿ] }ʢRq!Czدxsë0<  %Q9{/ЗEU V11Rr TWdZrcoLoJ}$*nfw7,uv qY8Nyn!ss^d6fM8r*:o0vd'GF4\"REA9F½tU)䡾5g6myw,vE? A ;$q8ޔ2"i::nlf9~o|.Ӌ=9:.y~< 1Ih'i\i47jX֠JbAJCNkσxLA2ZVuIifu&-~٢Y EHyOEb`+:ڗ.?WG jJ 'G!俰tobxImƄcD95/3ZR 'nm 'oG4ؕ {!4g~ 38H*&nsRPKzM|æo_ZF/׆,Y<(ΦJc/,k"pP쨕<~Їaʏ_oSp5D/'Bx/(BR$+E Ѡr4}@7TJ"6Tߐ29K5t Io)~k #BRj`ÕLBkdcb).4 "UIhs6D:^n/-{,6yQzxYi͸XKi2}#U*#7apdbu:KݟQ6DoH_cnjZK( +iAsÊ ֯F[?*3/<;r:݄)ca-A6f ÿ{si9|[(% ÿ;̢cڛd$;bef NB1 N>.dVX`$М'WH wjqFɑ =Ci8!B| 6bk)g{Q dGrGۋ/Wz'~Gl2Tnv~MhB_[m+Ѱ.Q;?ʋe)5n#k&-Ȁ+T݉ +}+q,̦L䡜SS?Ń Xkб(74_)s?BN_-Gi>6Ƿmi)H_o3nlfUwm8IE*6ϢaxtQo9GʒVT3ߘ{D &@raKgwar; ֺbpЫhYgmS?aq@#6?BM\u]ֿtvW/y t|uTxFI@T(`R)_GE nmldX6ɋ7@.ފ; %؝?'+ywKo+jG?,%8}w/} [%_uq'TW6j2c{؟ʐ8m>():4m&{ E|t;cM| }iXR8@+ꕄ|i/tA_(a1|6N!6hQfYRN?jMϒoa5^RGn|o{rrn_?*3 l8i6"Ji$|$dsLݝc|ddx6d8+2P$g @" @C64eDhӴMZSӹw<]NNJ(|]!LO$FNINM!ByxC}i[*y1sFW: kk!}Z8(_3Z '=FbW cHϸ#Ph*VVmpDḧ p(Sk EguJ $ B)>F@t1~ZX҇Cblo7Lġ5J:XRChu0A Z}>ZRN:,%y46 ?#W7o4Y6 0PjRHr.pqFv%pT8Nr) VC]HϪ'be).NBbB @]-a3%:eпq)W^k1Ȅ|4gacxHإ_Zv ݦ*aU}TsFL,Gh, 3+=r_K3(u85Wa:1S5*5-Ő5Wd_ &S|htKs\-,U@T^=C8X{l)_7O;Lh?ξiscO:})~ &rroGyc:~<} # (6':ځuuvO[V[Ԟk7rY @2?wNsQ\%l|O$`>U0I֩K0O>69&D (FлgM);vwO}籤f,VυM8axLqՃg蛏 &/ڸ%avGy4c*@(20]&2V[MoKӸpŹ  ͞+qiY?- i;j%G~x҉CG8{&l<">E| Ag4PB"1[htK՛gRwdBIvj(}F(sퟕa'o:5-*JLwy+ xՎnӌcW`]|S{<[73Pi'(xruş" 2Y<׊$@ g^Pюt"рZHalopGf2JCh#A"lĻQW磢 h|B˫?+qoB9AWh.EBN/# u#M4[F kMfXJ䇟,m[/cthB7耆84NL9<}Mc D +n[~z!g̹m`yA{X1P@r3 Q|?ߥ51P|# An~JN\bgFG}`3kDV3>0Mk/īRe>Ok^lZԜR7js;s90{BPᶟeD2} g^k#yoeiqPYNrG\ 2e^rZKP=@1tcWPtޮ;AѮwk-@#@D4tυdnr?s[ |1 x]L;Jz1LC_f$2(>VH@LYF}~on;8n0 fo91_$u$K:ͼ9{H+/q)MPt=hGSt Yy̼:M}c’vJ{x º"9(MbGP30C]Y0v/}aNwC<`=Ekc@ 2Z|# Н6OZB{ZT]oVL,e`?)v(tr?iͅ;Vx,./*](HN}wav&W\8['V׻%P$>{YQ9@G! &-=-`:pib,@Hm*!O1vjVEV3Dmmiĭ6Fi~7[zO#>Ƀ؝*>rd2OzkʝB"?Vv^HE͡NĻœ'TC"^j cP[:I$%x?o(9 T9{<\z̛6W:dƒoS1E6+͢,,nY ?6˹,xD8}9ͬ` Mh˽gLRW>#nҍjtA֘BV<4ug1*3~;mFRKfӸ- H Z$2XwBԋ@VAbe`Hj,MwU͇79mHkH2p_&/S; #M˧krR[m񝢺c>~x97=lkyn z⟥9C[]5y]ڵg}}0⏱밈/h#9n.rʿʞvwyo ` vcsY&E'] hJ[Qkwp1FhtpނfXSs}X"JR4(*Pp (5C]}Δ]Dm]Pw%󇴔I0kpͪȦD9`Q"9>iwg_DNx>rM&*1!*<ʑou cBcؐYÅt7,3;zzǶ;a gJbp#BA o }OٌͬA'B4t>(Ч` '2bq'-]Ѓ_qNF8kl,6$ǠM!fs( r?RlN -X:"d$.f^Na]"F,ƪ~ߛS"^fgb%^)sQ#kįj;H13^>:0^7e3[p ̾ҝ!E?h6I%V)ی,4eKM[3<A#cm>~=!?L(KٕW:zcA+Óv,%K$l .\}z,{rbF}btߤт-P!61Wǹ{{~4X6`Kdxt @F b'p&>0C>m Dx3AU\| ^ŁfGCR@:X5țSy _(xY8o6|E@ [yypW%j ZѨ6h]A}*εӛhB71:RVݏp, dj|4Kw}wdTݟ|HV㼗t-@e]}M,v SoQ'St}ۂ\%>pWÊ3D+n)~ I=" V/1U[3Wp`kL`iXc䑹i f Ɖ=] ?E-ypD2{TTrf49J@x&nWR!:r˯H3o,5NE\SȄs:8-"Fwq=t~m5d5yr:O;`k#W-QSPeʞ!L޳,Fo_z>q)Vi%O+wYCc#zn % wIHƒy 0bjB!zl<"vј_VASL4t7ٞ?%](bUX>4iXFxúc]ĎEЈ5' mD@K ֩QP\nnT7 5|ib3c1B@؞[hl/u?-,&I=vU`+T7;CeBأ1v$aCi2f FIRT;$(X PI赶Wk Ch$CEqcaY}FO`B8; TmZسFcch:;,>N>݈0%q1ւX *`TPP |WȚKHaΟqYZkZ(})Fl3LHE]C9 )(AO;ސ0s>1]}$?/h{kMm?U%܂~1xe}6} r\rGqĶx8D? 52t&sбY͕6mǃ3/)$L:)!ˡ3M@/W0lOBSN/b:+K1YI-[jQ/k"Srq68e[pگGwשe)Aӵ0-l)~oT?c-n +WJ>~)l])<Կq #C,"͊trDg)6:(E)pG#᭰3$QP4&cfB=e1޶AK|qgFNM ƿFn,s~!uਲGWdVQDCmaGN1) Ӗ-ml*dXڗ|3g)wb2}\JkR.kf/cn7:Regj#XR3oY3&JbfH5"fBs?EǾT}{8Rh_uxU2QRa#}[0_,CvK3K90y6K\L{<}\ٻoX=5䨟'z((=|zxHaꎖTW `3 ŢTWb 2߫ 3F>fy℃s;騴2y3(T>1[eg`3GO=XCYEAM%؀Z5 Pv/ŮXWU#1" tWeP/^KKoM "l Mnc9K&=$.pց{Pt:uBµ9ͩ^iYumYs^8^Y\QzOJU-k(MH~):{bk=P$44[ :t'۪9Esl6&:32n=倂Lvg1dzD1ENNu6[uV-~֞=NFmT22gxaǜŦR6~o8e W5R(rCXfL^SU3DŸ՞A ``b"Ykmg{;|f2G@ԓW.-L%6c.o +yO[m8xhF,q4}ɩ֦1I+-T16c?nk2HxEZ)FŨ%Tf*BEJP}bAKSBSEcD J !b $՗Zs- teG6×Zw^Z3*[ljDz\IѸ5ćh7#lM)NJg~G00#ة),:pb!Sco1ܴ5Z$1DЩ$9ɹnGcíc$A\C4*kf0=ڜ?}XZ)ϓu*iګ<oj|\=y c oME_5=(e Ǐ7"MaC)sԿ4 WAxT\lJ&:ϩ4Twdl/C%5 }svԖzhRS86˭`aCTix7p:gETb9s'd^~ЀM}qQ}^݇sůg5b.ۡV_EQ}~eC [@YA@-e"YTwLWmz+wdǒ󧢴?L-VUgnhA'vȡFk%^5,U{A]b @ٵm :K:GFﵔ]k41.u1Gh@~w$=~=&w0<Ҡ~LOFM]w,y!AXb ֿ&bi4=|SKk%/@bT;/ b舻[\H"r8t{L6E7= U.ՇL.o43KG%# 4vc|gwe4c \ R T(HNXn<k3JZ.vTP|SlJԹ<͖PU uWGIj.~! 7_Fb\ǁTa5M]M峋64;ʵ bjrIrzpB>ɊyFgo6 BKq@_)hҫ&`]3&REIdj]n7gOw0A`ӏ< [qzL;ݕzIhx_7O04␖XFLu{9LؾGW tw$oDgFjomQQfniz}~`ڠydC9mm5ArQJ`:fa{n40e; ZnZw%]ڸR"~d"le6ie*q0 |OGI4$q+NA:>1SyѺ`5DTTS4iT$:>[}tbJIA^}ͿXVu qy olzv =  `rR6ޑ0v0W{:)$zY^EIz=lC9ߺj,}) Mm.&SZo YpR#bQGJ3C_;T|H롔W#߸K07/]~H'Q S3Y&YC*)&RwSdP.i!^ r\ᄼwr5* dij$Q`)O  ‰DŽPuևAj!&lʲ]MKG=ƓJfB<2*` Ug=I>u2̯젰O+la\bk@9?:(PnBBR\hX8J$v5Oj8͑U8c~\aCm%. dU6@zfsX,_M.`ztpXH򟯨uN梕H$*}`Hy]'pcs 9n]L#k<ڢ򵃇,M"2'a)ZXEIaM .I=۷O BۜJ/Z|l 6ة^{T.ֈ G!̈́c .#rC`\. nqWH/% [!+^/=g,Vx>DƟP}4vۈf./b0!˵|cyӌ]$}Ok@(x͋yvI w2c/̭&$q i*04 B G*F6u-Ѕc|;v'𕧓tNݼ0}-ae CuLsxufkCй^7l \~=tH}{Ef2n?|j(*0F7f¸Ţ Ř@,#$WvJdW4#?z [Dڀ~`÷SxaoF⚍p Jjdu({dwgp}iOP+"_ކW3h"p]4;GB@)?MibvegEc/[ʔt;g-:fu@-Ήt;6}2ĆVSXoT> Cod7lY%d Rw"R谤`,{3|S7w^M|XHYtC}/eax'o䝫oA). [9ʵu "ťl ͮ*k}WAh{N?7;}<t Z`"x(%pRՒsV2\T"h9iKi|H9ĨoI DFr^݅=kZ㗑޷+of YZ