í«îÛwpa_supplicant-gui-2.9-150000.4.36.1Žè<>,èêìâ`‰b£Wp¯ž9Û|‚)ûƒ ¿$!ÐdAAœú “ñQÛDŸOtThÔ<¾•‚$â'ñ³jÍÕïx;·5h©†o…Q&L1RUqWùš®æ¿§¸¦¢ˆ³#ÆÓqZ;ÌýÏy•ëà´MMFL; ø*ØOÜå>ü&#1e-x°²;‰·O§ƒ‚9åF²rEÝøµ\:æÆì¼ø‰ìIm;[öT‹¥Id&*Ùn´ã#IuB‚þc E+ê„ïã;×M;ñûv–ÝëÀ_KEœž?Ô]Aäô=1‘S¿ÌæG6ÂìýéºYËªMÀ‚–U¬¸õdÛÉQPãSWä É`Š5é[ÉÛätžÄ6SË^%]¡;^‹R\P™ÊPÚ>ÿÿÿÀŽè>—¼?—¬dèéêì 'í Jî¼ïÀñÐòÔóíö÷0ø FüRýoþu€ˆ Œ ˜ $.8dlœð*(W8`(9(: 0(F“ÞG“øH”I”X”Y”\”8]”@^”Ub”uc•d•Ÿe•¤f•§l•©u•¼v•Äw–üx—y—z—L“—\Æ—`ä—få—¨Cwpa_supplicant-gui2.9150000.4.36.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.b£Wibs-power9-13BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxppc64le@üí¤b£Tb£Q2f18374518adb0b049675c677bf7a12bdba87fd3ed4569440b01cb73245736c7b88d2e4686481dd240f44e052421fe8e627beb64bf43df1bcf595ea8d4664b37rootrootrootrootwpa_supplicant-2.9-150000.4.36.1.src.rpmÿÿÿÿÿÿÿÿwpa_supplicant-guiwpa_supplicant-gui(ppc-64)@@@@@@@@@@@@@@@@ libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.17)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.1bƒŽ@bþ@`lM@`?z@`:4@`áÀ_|\@_iç@_iç@^¡ƒ@^™š@^|™@^|™@^YÀ]ÀÀ]>ßÀ[Ü<@[ÅÒÀ[Ä@[ÀŒÀ[¿;@[¤Ý@[QÎÀYäŸ@Xùô@X]ÀWö<ÀWgÀVò…@VÐ>@VÈU@VÅ²@VÄ`ÀV³=@UKSÀUCjÀU8ÞÀU'»@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliableÂ· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)ibs-power9-13 16548509032.9-150000.4.36.12.9-150000.4.36.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:24619/SUSE_SLE-15_Update/115db8ea68d41b7b073ab75c067eea19-wpa_supplicant.SUSE_SLE-15_Updatedrpmxz5ppc64le-suse-linuxELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld64.so.2, BuildID[sha1]=aa3a9005754eedac05948fd91ef7a34e948adb9e, for GNU/Linux 3.10.0, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)R RRRRRRR RRRRR RRRÐüôýd„Xó¹…úÁ±Eutf-831ae63c275631bb6b8c40f29c0103c77c0c13bf108bd4cd35a2882fa0311f916?ÿÿü ý7zXZ áû¡!t/å£àY5F[]"ÌkÀ%{m{ð#r“¼ùD~öÊd tÓ÷»éG’µJfÍšu<îg)`3|ùæ%‘d¥…XÍ 3®”¨ã#Œ•gøZ>?|nŠáÔã‰"*¬tTäÒ|h_ŽÕ‘¤VE•þ:‘ö‡úˆM]\3ØÏUbâ_f„öt£Åö¿;×À~|ô7ÉÑö“;¾»‰TEÞÝJg øwåê¿¨¬¾M#HÓSUð ›qö@ ¾ÉÑ0Vˆ¨ÎM@í. ¤±|áª9Šódú‚¼”–öo|âÁÑ—…X#Éþ‚õ¶…Kxé`š'5Á^(PXÒ™Ým³¸Ñ°Xc¡Œg:Ìgÿ¨dÞ›*” ˆƒR’Õ¹ßmæŒgÿ–{e7‰qøÝ®Ç<@žû>žÎ¬d‹ín2töê?™^‡¸;OXÒ´¢ÆBT¢0=Á;Íù•(g~õHGcÝ6c«UÇè }ÇCÍkcþ²l+™O*=ŒåGâãòÂ]å(A¨iüiûœ´g‚ ÕÐác×¥÷¨þåô¥ˆC,XôýÛYš‘'ö[2!Ñ8çuÌBˆ(ëÙ(?°>âc4ø ê{8šíÊD0I~É)g«|¨GÅÒp1ûßt"¸nQ|¸ðâÒ#îbÈ\Óë,ò«lööO@Lg Öúk`ÞHšx°2Ê—8LXuƒ,ÊŠ–lj‡šNóÝxŸ ŠÅsBGnÁ¹ŠqËé!]æïsíTxétÇOWìˆ Û$`laÒ¥áBúaPRqþA•ÀsfŠ„–‘-Ç&Ûè=Û)]£_Ý’ÑÑì©G+úC«ß‘ˆ±l®;)°Ï³|Ïq~,¹LÜV;f¨Õ.jæ3ŒöZ£GîÈPQqd¡Økº6ëòùa–ÎÎãV˜zã_$uF¡Ç¾ÅYÑÅE‹o/Æâ=½-"á`¢Ï3(þÈ.àµÔÎJ`06[f”Í>y“æÝš4Kg§þ_‘L5ŽéÇ3¹$€ ‡¿ˆ3‡tCÌÀ¨mÐ÷ }Vï(KªÆMëþÉ(¾ÊbN~ße½ “ØqY¤ŠüõÄ|vPÒÌ |\ÌÆÁcÉ"éb=>E÷²HbÖ“œ¿c·µÑ ‚Ókwü¡)+GSI]}žgL/ž“ðáÅC§ÃcÓÁ#ÉÈa>HXSaÙ2‚XgpüBª>cô÷?þP‚éýÕ@RÂ0‹f´¬õ`î¶™ jï0Þ€)e¼2=äŽO•P÷2¥æƒ6)˜óPµÕNÊÖŽ$Ÿœ[jƒ,¼BkÈ\l¥óÚ±ëï8Kpµy˜¡êëýFUNé±kÓ˜=?®ÑAhÐufTÜ œ 1Ê¨&½q½,ñü×Ó+ßZZã*‰ WdÈÙ¤§‚TÁµŒ9Ìº7ižÊh(«j!4Ô4=øÌ fŒ‘?Z×–& Ër:ÉÀš8ªˆÐšKPí¸§†…™#›’2©¡éÓúf8¼ÐÕ,>BÕ‰ŒT_“T€©*‹—Î_'™fƒ¯ðä&è"|QŒ÷í·s9+Ñßåi–9¥ˆ[ßZ‡ äÔCÎÊ¥Šm>Œ'ýhbAEúF†'CoÂ"—2N»”Zy¼|ÝÔ[„8\Ç4ÃùÇ@/¢ïZÀY}J±ìêöiAß_ý^˜=›k4ýðäš@|%)ÀóªoèîiË*šr/ÜÓä~ìÊzY tÄÄ‘þÂã*žç’Ä.Š=´ÞØá*‚Ü“A‚ÔOJPY[ "gÇRâÕš?µ^.?^K<¢ÁÝëŸ½*Þu cgÉ]ðPù÷ÔG”:œ*7ö“»O.€Ù˜âÌx¨]òËoZ *¡x™.Í€ÅYéƒêŽx<ØE1Fx W&˜ÇÛ-ú“ÙÚ_ï*ˆØ©Ï €3ì*Û-”Lèd%ÊÎâWŠ…Ö(Pæ%…ààtÆ¼6)g™=´Á´L©¶¶$„øäA=»lfÏ˜;O-CùƒÒºÏÜŽW0ü÷éeßŸvÍNêŠSŽ!ÎÍXÖœM»>®Mƒìd³® ÿ¶z¯Âí'¦bYŠ$aŸ(¦‘g–éý>}LÁ`‰ÅLQåQ£•ü€‚K¢ï9¼„Üßb+Ÿß^ÿÐpâ#‰®µw¤/ClOuXþG/n¸0|¤"ìº;,Î>ÙLÄÃbû@-Ï’ß±¹ˆ“HÒŽý¡B#Ö[¥ïÛîe²4ÛÄ°I‚øšÞ:ŸÅ+ß˜’ý¿‘A#XI»³aoßëÀš …Þ}ç¾¶hœHv|«Ó)`é™QÌÙyþóÖzøäÞØ¥wÃQºÚVƒ®Ÿ›w²XnÚòŠ†%Mv¶¦Y$;Ò&Ú/Á€u§Û(qOA)t¢%ÃJ]ùÉ±ús£»Ž®EYFØÖ®ã)“"t¬}š‚”˜õŸd¿Hº´u·Ÿ0G»ˆyEGïKäÃw¯mSýÇ“T=Ät¨$ß¡|ûRUWüˆVÓ€š{žq/o§™ÜMäM¦ÿkeA]þp„Æq¬€!„@¶KÜ½É;@<4)àì…Ï¬Û[qag½éNö¢‹íØCÐZf‰ªn¾|Ùj.ºí%6LÞ½îÍuÑÏB«LœçÝñY„ž÷n¯Œ[¡RÌ[k·=3ŒL·òõ~4LÚõ- Á’uáB×¤ò¨ºÕÉÚÄÔB}•\Ò25mØ®¹ ØuÂpºø¿.{ÀíÅ™mmXŽcZ{G° CpAì”¥U)×Ë@_µv ~ËÍ–¦Î”©Õ¹½'/=—šcÙü%sª¾žæ0º‰pKÝøñ"QX×‡]¨¿pWÊº¡‰tJ4nS)nƒŸYvKÑ½Džƒ(Æw«V»¡7ÈÂœ‡l”#&´3ÁwÔ\ûòð)t¤)âð†ïÕb{rw"W¬i¹ãDc¦ w€be~¡fïèÄ9ÚÙj!ØƒT,%×=ÔÕEåeFÎ®ß3y´Ø€|“yÎµÞK&Šsã Ê+-lÑzÀÕ7›~rN—Ã•†d¤F¶íGuW$Â%cmeÖUº|!y!‹óípbÌèáÄ¼¶f4wñ*uëGc¯+€cQQjüGXjXá–Jû)J%3BúÛÐÅYe£ó_}ñ,yó·³8ÎÞ;Cç‡ý{ã”•ý%µ7í¸å§g–óZË‡Ë!ØwV¡EJ‡¡Ê]‚5q–jz/¼7³ W8$Çšï&´B¥ø.C@s7e—å”†9Ï—ÜoáZµö½cPl™Òõ÷÷š˜Ð¸«½QdUürdoLÜ½ÝhX»1Ð£ûªq›Ópƒæ æ`dÙíÇ'/87ŽSÑÈ×bÒ`°¬(¯‹Þ 1B¢¥sõ—Ð^«óÍj¸¨ÖD¡Ÿ£$¾çäo[¿-Ol1WE¾½ÎðïÃ·wÌ6MMäW & F,ÈïëpÒ®ç.ÙºMØm'Äã” ¹VZF*#ÔS&õq"W½ÜbU*q|¾ƒ¤ªvžÑ^ÅÁPƒvªõvZ8Ùê \8µøºáîð[@W²s•Þz½·`±ÔàöõéÇ’72Uq Dq«(ß¬òA ý>ŒXÚ‚-‡`1h¬h>OFÆ½h\M3ÌöðzÒ¤ãäÕá«³Æ Æ;9ƒS[\QVfMæb8‚¡€4w@\ŽøŠõjS½.šW+I‡>Ÿ(ÙwÏŸ…ÀdPÏ~›¦z.³>ÜÑ‚ÑÏnÛ/ÛQ¢5K#Œ¹Ë’É®D lÎ®ÿ½ièÐ%»;^Î;¦` —Ïo7¼nÛe—_ \™Ö-i»»yˆS™ð©Z³^X\Ú}ƒÄpéî¼t‘oÆ(€ëÙüù?!˜¢—éuP¼Fë;¬vAFh8'†âdŽ/O×Ú"‡I<¸ÑÀæ¬!¹ G÷(Ä®n›[ÿó¸]´U?þ~Ò±d:¯Æ]SÊ«06 v› òêÐr–ëK+Îžv-Òø1Í±ˆoñÎ¨–,ãùGcâYY.-oj×½*ñô@mÀ7â1K](,TÙè4ðqI¢-ŽKN¶8Ø&a*†ÄCr5Ï(B/”‰+àìK£:³1tÈéšjÖ¨‘”ŒÈ5x=Ýk Èá¯ÜÝ> úa3“„‚¯·ìV.cÁ¶È¼|D—e]nˆï-Æ€´m/ð,?É!7õ%R†ýÙ›¢\çK@ÔšÁÍ$\Þí5#p;3ÑÁ¶åœbëêjÌ–ÝîíŠ/›¸uÍÐaŒëD•öº=e€»!|gõ‡JÌô³H.ÿ"kYØds¬SÚÄ¾C.¢¸éú®7“0Ê@•SÒ5÷DÜ4VÙc@~ñ]Y{øÇzóî|’ô}‰Í[¦£ÁBÌg×w.2(ˆVò±ðb\lÚúx@u¸}pâ0ES +žõ)¦)•a†`ßUÐùxõ–GkNK…4˜Ú})¸r£0¡ŠÛÑ¼ò¬¿(“É«æ¢ÿQáœá”!Õ[BwâF†Âíú=ö;*}%J¦½õZI6úë]•¸Ð`eê?´<^¹IG¬o©¹›VQ0 adÓÜ³ät‹ª(¬ž[Vò ò©%Æ¦7gYcrõ¬…‚K'¼?Á.ä4yQ Æ7#£ç¦ïj!¼¸Á’K-ú>ã|<ˆÅ@ü¾ŒQÉ‘%jŽ²ùcŠ®+òZp´-ë·¸7Lç*¹2„„.”ØÎG¸1BŠq$Ë¤»F^,Ði‹’*vÆ`«±Dºbs~šYöC ÛœÌ,-²Þ Ž÷ã4#g‚îºÅu®Ééí½oÁ Áä¨¬ßÅVb}U’%{f$e<ö¯:h@¨~š˜ª¹ÄÌ¦Þ–fÏ+6•¥DÈçõô.734…×}b ÿY¸ƒ=á¼«Šüz¥«Çm4öÑÕî}€ðÛe¿¼ªTó%°Péß¬¶…–R²¯Çn×ŒŸ6¨õøß½„hôZ%8~ K.b¥Yõ›tNÅvîä¬ñGHÒò¾¯N¡yYÉœW³˜7Õ »Zc'ÚgIE©‚^òù eíâ¹˜ì^©3-ôya¹ŠP½¢’O¦ážº&¹}ÐËé+!cÅ(OF~Iz)ÚXØŽ4xÉÒ¨t“ÇÑ0ô-î‹9ÕNŠ&õ¾F7ûx[çH¯–¦Ñù,ìúw‘®Û›ƒ¥Qnžâ(_ø‚BÍ8jïÑEúôpt\ÉX‡^åŽêÐXz€SaO(Þ!'’ÆßÃ9ò!*>” u…r‰l›DÖÛ$0°H%eéÕ6Hôfªˆ&ñ½0(g¼iÌö7Ø™¾–†N®C_lÎiŒ†mN«VÛC: ¡öêìþq§›¡ÊU\N‹×Óx+!! ™„‘óÕ€qR´À*WmÇttZZ¡m‹ôÞ•oÕ–ÁÜ£üGZÐ–£›ÉG#Ä)Ž7i[>»¤¼P³æÐÓ·MTïæ¢’#É™¿¢d.C±!Àóƒ~ù<°zMáé‡¿77ØÜâº{æêÛ¯Ç”^86–1â£å -¹<™ª¦mˆ?É‰f‰r‚™ùÆ%-! êù(AÏ¥ËâÃÎÁ4sÆ„Ñ¿¦¨Šµ=”D‰fíÞ5TŸø•¬MfJ?BeqgSGµà|U¤Òœt›XS±Ñu—ÞU©³3½4…Æƒç‚+‘à)-‰}Îû†Q®È_=Ù!S<$¡3ÛæYR×ÿ~à–•®z;¿7Kåæ]¸ìf‚j¦KèµÂ*:öÚBÜ{gÞž£‰®ò»Ü`Zœ©¶ª×Ô8æÿíÓÞ& HÂâ‹r VMX²Mƒ§ëÇ¤,¥Q¼2´Ÿ÷ÁJÛ êBëybwä–á¿IVAbÂD9]M©*n¢?©¢/Á¶ÀÀÐ×‡¶;Ô%Q¥CfN5j]ZØ’×oÒ>§ñ~BÜîú&F!¬’C´¸ŸØGúfR”˜vö±^#ùÒVú- ŒqR9(Z‰ÍæVØS‚i>vDúQ+œ;ŸÝƒ ¶8ó<8ù]«lNØr“ ˜NóØØÛ/\[¥Œ^ç)]gÜŽ~Î\» S¶²’,p2ïj¶Ú<:!ÝÍï£Û£,Ýz^Wä¶BÉ¡Ø™0Ç”BU•úZïm‰D^ð×áð1Å]øÐJC®g €¶žŒœÅ,Àÿ;ëPì ÀqFDçè§Ý$Y•²º*Øìûz(hj#Vˆ\=û–rq´¶KÍz\¼0…úû¼svJT§Á¹bØ÷ê—áGö}Â_Ší™,òÐ„ÓóÈ+eá}Eu)›ßÄ\ì<ÞñgÜÜ×~‹zÑæ#Ä&d!]+;õ¢zŽ{è.ˆ¸š%‚Ôg_¯Ñëé°Œ·¸Ý8§Ç—éìŽ®ñ¬)uý¨Ùwœ¬Å°EAO{-¾£FµÒ#éêÿÂÊXëQ‡¨]T4R÷¹AÆÄêèIM÷Ö–MœÞo}\.ÈÔv „¸óm\w”fFx Oë´¤æ…•_™¦òÇqÏÞ"åS*×%˜ž+ñÝõNi1|÷©µ°ã™µFp¯ªMf+Åüfñ–2e@HñU(’O,T:¨æ¸©]Ëþ¾€Þ©Oðg1`ÌÂw'fá7ø©õFG»`áx®ÊÕ\ŸæÞƒ ê›è‹Ï‹hÒ{—… Çu»Ž,õâ©ÆWqÉAØÃØ<òg²Ô÷úc¥Ãˆx-·í nK'ÞÙbZ™%ˆ%>T~ðcQ‚k´¿þÇ€1túÇCi—ÝÇR3e‚N/‹^}®ÖQ;ê,F‹–4‹ûÏ#®Ým —ml¾Ù*µ´X•²fÛk…B |Zdô0š°ÊC]Iˆ…ø¶bíî²ŒÊ¥/Íï¾ßL¹£nt$uêmM²G~‚ëQoHkõÿ1,=C¾¶bLApÎ5jM ø*#Íõ(÷‹vFSÝwevÁ+£C`X{”ÊÈ af‚¢ÿ¦¤ smhõE+JÌpÑZŸ Æ]ä›öt»xºQåXØá!p/X{7“AË±§òõÍ0:Š/>ÉÒ ææ*‚A Ú§Å9µœ’¤Ear²’§ÿðÏ WŽ :syÈ:+[F©àDHy5ÜŸ-DÈšè¬r–ª‰(àí¼Kÿ`Z8¿ÈŽR}¯›29ÔZRüvlÈ'Ï&Ó™Ý½‚íyß¬Êàæ†àê_[] YÿÃpméqYpvþtµæ*£Î3·./â¿F#ø{MJ41DCéÞYçíøV,OŒÜ¥³vÀ-×0 b]•Ë¼ªyW\£#¦¡‡Ôëæ/ÛMÞÇ£g4ë¢~/…µ÷˜©x™x8°@Ò€ªí#'Ö.Îªƒ4y§å Wkk¿”b‡>hxüçæNü¤1Ÿ—†Hï-ÄãT›Éuv,´‚]Ö·ùÿòlÛMxÃI±Ý˜Ö+ïòÃ'T6”jî–Ñ‹sIaD`~Ú%z á9ù>˜þì)*Ÿâ†IGÝÓõx?.=^ÕÉu[lµ0îG?‡~³ïÆk¬ {=ôÎ¡/öh»;ò@æbý3«´X-Ã£üÏÿ?Hê¾Vß_–4Ä„¤ à…‹´xY·œ\ÒSóß>ïí|ÃVzÒ+xIl1YØÍU›ÿ}µîÔ 6K‰ˆ;K·ÚÀçâŠÄsBQH’tå1ìö{‚»*6²ïà[z\uÞée¡©v£U#†–qîj°d–Tn\ìŸ/SÔ¯yl¶‚]Ø ß_øRUc½ø¾ý¿S§Àßs¶ÝdæþN§.O¶O÷»n.P6ÿøòàKH©ÏÍ]™ k!ý`JQØŒÁ³)T.ñn¶æµÆö¹(—cúÚ&Á^Y¯ŽÕD¯çgÀý‹ãü¿:ñÙ6Z°ï¬¢R,àøMô§xõþÞë0fÌ3G`]Päû‡T°ÂCý˜IŒé‘N|½o£%KH—4 mÈî:’DÒÿSÞQY»„I³.û‹úØŒ9ÆÅè}pNB{úqÉ4$GŒÝÿ0³Ò!9Öš6÷›|N¡*ƒÎ8‚ù“*È¬ B[Ó©‹§/C#`BŸ+y»†‚`îØ»N±tþËþÆ&_Ü:Íni‚Aí×êÉÏ6X%ó‰ï¢fyÙýƒ¬¥Ñ>x (ß—Š|d ]v’æåR'Û!¨<€mÓtèÔ#YÛ#HÖZR#Ô¤§e»Úú%Ó×°µ`áv| #!Æ,D(ûçÕ¹ƒÁú€Å÷>p:´£Ñ¶ zz³îL„7ô›ŽÂ/ËÄPrzÒ/#.‚»ÓÔ[‘Õ¿Qú3SWCyÝÖ®Ó#gÍìÞt¼rð[ý´ÄÞ@¯!½i!Èßå9ÖRLi¨:Ä·/¦±f‰®¥SÜ·4»L ¥ôx!LOs^¤ßÇ½<´w/»±”eN¥–è?e+og<ØÅ8yÅÜx•ÕÂâz^EnÝQFé·bOváö–9ìø^eèñ`›T&3f½)~Ã$"zx1@ 5â;jÀ4ÐØ#i)EI}´ÎÙz²öÍfR¹Zô+Bžr>¬¢½Wz5DÃ·E÷ÿ/±vêŸeí^¯ 3X¾•|ºÈ`~¶ƒÊ‰"QNÇ|±‡ÓÁ6kìP îCÄ¶V_É8N9Ð³Ò^“ØòRäºÈ,_Ç9F]¡ÉôZH –á´Êe.<-¯ )×`>|AF¡÷Ðzµ‘›Å!6í)õÉã$è] zÙ%¦öè?&”ûCrFNAî°ifHô2)E‘º¡ÜÔÏ@ÜÕŒÞ¢A›¯µ 0öàr¾phÂæ‡rIƒ8e»X¥š«i« åUó€Ö`¢/£ZtïÏŒïÒjFó½ªç·ºõ*`‚Gr§–Î…ý³¿cÊ§B‹D~üm*¾GdM ”-‰÷†U‡“~°ëç+ñôrÓ¬/öN& ´Ã“Ç¶âD›Mñ¿òµÁñÑ¤ÐºŒ(Ú‚ /túÊ˜(Š•ãâC «Ì~]|™à;T— ”Á@Ï¨û‡4w>©a™w5»Æèn<¼ÿö÷b˜°¶j2;ŸøáÚÍ&&¢êæÚ7-Æ°øHþË‚Šo 4§ò–}I”²¿ùó3‡’Vco@V·~ÀÃÞE^—0;ŠÓ!Á³“‰¾¹3î–èµƒÂÈÃFÎA°'pC3ôÂ³5R³Æø{ ï¢=;Ï·“0¬\eŽÿÁùÑ\ê5óâ#vûxÑ¨`3è9¸¤;|Ì)´õ—+»¼Œé‚‹Ž}Ð]Ç>8»%8‘Â/Ïñ©_[5²ÏmÖ<£ÄÍLD°tH³€õè§þâÌÆNtÑ1 Ñ+> —ÞzÐrJ½êþ–+8§‡þ]íM, ]o2ð' €Vz–€ÕåB¤™¸€©ª A‡]Œž´ØY‹Ä¢¡Àþ ð.[ˆê¤¦íô©CYz—×ß¯ÞT&¿l›©kñ`¥Vr¸ÍàÐ~'œ_^¨Ô/ÿ¹.±Äù4Ü©2 \¾£ç¼•ˆFÖiî ð$Ñ7·Lü5·ÇÌKˆø‹6é‹Â–Œ`1ÚSáÝÇî´xþÇf’2ä!Þ¢0F‹a¡dŸß:¾(Ôõ8¸§%¨ØRcÛ6å´d9ÅÐå«ƒ¬¾È^ ˆÃÃ;7Ê%\W?jã ¹G‚4ôëÐ8¸±êC"/Áí|IõàþLÚI3ÿdrÝwäïÈ´XÄÕ+;†U ·!òC¬§ÿ}‘ˆñ¥eÝt•Ôqn¹0/Àö%µÌ™š$úhöv@·ŠáŠ ûÕÞ¦‘³ŽWc<ØY‚‚çg~@£‡”Ý„5ˆ§s§O}9Ê,œ§•…ãcã=¶…k‡†Ý96,/Þ ½¿cF&hk{ÛµRÜsê¥WÁ¢œû‹,n¨ÄØpæµôþ›¿bÖLÑg¨Ù`ÙÌÒ¾GYÂ[Jb-GÅ€¤snÙØHAf›ûœÀXÕÑ+ÖÁ¡Jûž ³ ½ZÔº½°¨žQÇBž2øh]ËÑw«ÿç®gx¥§UJñGÕpWó_øýáª“õU2ªÅ§\qozðâ ÿÓ³b›\]’‚qŠÀSõé;’ðã”œ‡+d¾%ÄÕ¾ôx5; 6û«Q~yázwÅ"<3çM]?–"8ÇXeYãl¬3ÍÿûpÐÊI%ñ¡ÂÖX¶o9H2žJ¤›¨Q–’û˜M³Qâ1©DçüÍŒ?ØšzÖÖ} ¿ó«¢ÜÇÜ:Qò˜]ŸÇ+Ë«¼À€¼`½æäÉtå‘åÇîý¸^ü(Ñî¿x•Ç…–þôŽÄø°a8£ÒÆW3—=Y"É‘úSûG”V¥ËÙÛ·p½{Ÿš&-œu¼vðË=_ÚÑùÓI›;U*E?<^ˆ¢JƒqÄÜr·šTÊŠºSÑ°u8ðóN3z¬!žé"ƒRUæ©ÕšYŒøy<–4gÉ=+ŽEyÆíW;eõì©£ºc@ÿ¤mÄCûÝc¼ìzÕájlà«\øVëp_fó¤ÇƒÃÚ{Œ&$˜;y3¸ƒÉ@Û·m8=6’ø‚rûXëù‘Þ©h…þ?ì»e$¸DÀA–¤DÚÍcøË<°m¼§2Oä©BvþØ¶2-X¸j[*èœçç/T¼ôžÁl†)….J(Wöô÷ŠK®¥GXàqb3G]•›NŒÆ›]âÈšwe\lð‘ð|–6s¢0•í¯q!óiu×hI[ ]Äzã¤¡¯åæÔ#ºì(µÍïåŸTœ`"[Õu‡}LÀìé9IfbtôQ¼ñ‡ÄÛÍ17ìò\S.aè€„‚·åÓ1m'|Mý:—Í•»¥E°Zh¤à˜Ù¸¤€û&&j7^†|t .z%Ÿ¶²M+7ŸTÅ¥G ï}}äÈ¤ÚÆ²£Ža'ß£WÄ » ~À¹=ßyáv‰Ø${Ã€ÌfçmÛöfÀXô8*y§“ôðÖ"X/YWò`š3ƒÒÊy!(rh$û²‡$šì–m‡¹l€0„·ÂÆÐnÌêÝ¢~› ²Ó¸ôdæ ¯pÅÍW¦kYÝŠŒµ4¹Ç‰6–³mîs½qïõƒ^D8©¦Žn€ŸÑRNB”xw¤oHÆäAL×'%è ;˜‚ò[Óç<ž¿7··¬oiƒðçþØF¦¦.ÂC„£zWÐà²j/G%RÛj÷ËE8»3ä¦Òî‹Qý¡n™*ç-1B¨9"Ë?Ô%žLeh]k§:J…4ep±ß]ÕXŸªÍæ3Ú:MˆGìÄ"éÆ³Ëæõ¶x(¡°vü€ï.IµL“…å®ÍgQk‰ÿ>$tÔ¯þÜw áÞ ±ÙÄßåh×:éÜyE-,Ÿ”kŒR·ù!ÆÓ#<_• äº.ßôøÅ}.cË´Cä7ÆÆˆ-=HqÆD³p9ó×Ã91ƒ6½Hà‚)YÄ8¨Õ\;+€áz0ýëÃ+ãŠ}Æôãxã•6íg‚ÕaË¹e‚~6ëˆ$‡”[zê{w’uÙ¶–ïh1{É×8i–F›„kw5 ?ÜÄÄ•ëb´Îu°ëKÀ»ÖX‹ ºèb=|ëÅŽ)P(‹d±òÍrz€žáCy>ÊÚçØ$%¹ì”?–±®<„×ëÄ,JKö<·øàŸ…\zÔ…gP¼ä\dz67ç»Q¡óF;Wd·äÄüK˜mm+„ï –K[ð»¶JUß*4@7±7Sˆj¼æ/P2Wâ¶Á‚éwQy•×íŠWY+àðPGô›ÊvÕ;¸V9æØRF»"#ÕJ(Ú Q§ÑÊ–ÍnÿñÜ^Îþ oL¶—6g›bIÀq¨f`ÝïS²µI ]í /ÓWÇ[Q<;²Ú1»þ,a^¨¦ô|BÖë÷Àï—±ˆ¤! Äþg™$’Ü‘áŸ6ˆ…‰[òñ/;îmÌq·×ž ˜¡óˆéÄ{7dkuÌœ“è²x{ÏäàÌÿÌj…†š Û„lMöìG¸Ä˜G9¿ÜÏlµfË~Æ¦É±Jƒ€Óçå)]øÜëlëJ¦xGÐe4”h²!"k£dvÄ|U™ ˆ6g)Ztç˜^BÞ´«¢õVä¦øÞ‹_y….£lf±a—šÈ¢s¶ûõ ˆéBúAn¯z†bFNqËáèþw›'r€šÅ Ë`$”ßhß”5|›t™º‹7È±Ü$†ç¯€=Ãòh›²[÷·O\™6WX‚^Á—º‚ÛZLh¿¿1›¼Xìû iÛw˜†àíˆ…-Þ…_ßÁŽŽðìPCÉficx $KV(ˆ(<"„}]”¯lWÇá¹®œ<@-:Çþh¾>¡}ý~µÙMœñ@e)ädï~Ú}a@V˜Š¦ˆÁû‰"{íÀÔ!0ÕöT&Ýìþãò»‚gÇ¨EÚ@¼™)ùÀš³¯©¾^²$é?™‰ê25Ã•ò8EpèÆoxÅ7Cùê·àñz”ZýAÒÚØ…lKŸ’ŸWìÝE•Î#ßø÷ÚÒr ð¦»[EJA]°î` zVb3/âÐL¶ÉZ¾?6¼œº¦DKRÌÍ”ÔÊò©@lÜÁü©óð«IîP$q²4ÐÛ‰Éðí°{!O6»cø=ø1ãËÓÉv÷‚ø‘QÒÆÖHè(¾Ï:a"¾ªlææ/óÉ¨<å ¸‘¼ZsÏ§r¤ÓZ¶z5näA,Ÿ•¯¼+cHß]ÌÂÐ;= R¾fÏúÌoU^oü•9ø`þ‡µ “&Ú))ŸÇ)Ì3aénÿâJ—Ásô›ZI¦dÏéM¶âïæ•¿0¶ÃÏ•5~ü&ÚsíÞé]Ø¹zŠr:PÏè<å`šGæ`Hé£øˆYýH ¸ï¬¬äâ¸¾Æåw‡˜Ÿ“ï|ýs þŽ/g¨WU EŒÞ8 Î•¸ñ¬¬ñèÃJFåcÓ˜oJ—[J#˜ëÀ³Î.¨[¼ò…<ší¾ÿŽ8 Ò‡t/›iÚ¿$ü³6Ns‡oT½ ó•;˜&¾•¡lëšnÄ˜Š°†Ð ðã¶žrWe±³Ê#.¬5ûÒ˜’PåŠDJ)šÕÖ%©ˆÉ4"P:_›†Iwöïöµw7Ç@ëžåwüU°yõà†H¬Û‰¯26ÇmðFÔ˜¾¢î¤wèÉ5¾³H‡‹ý§a:ˆuÊŽ"X½4‘M“R)ÄU¼˜V¥‚ý(^o…»–Ú‡má>Æ˜Kãƒ‡7KÂï÷ÎA®µóÆ™¦ÍOTž´Iâ¬žq8 Áí¯ˆÀ÷s(Káš³MZ+hÕ0\ÃMíf²q ¾š¨Í©“ÖØ/lµ cÁÆƒ‘kt0=}f9è§î³ñã¹âNðŽW@´%¢‹ñˆ°þ^¼Àùjà/F‹úCh¿FÍW¶Û_a˜4®—µ9¾*ñ&bÇ8›©Ÿ†Œ)ZvkgDÝÂòËîñ‡î^5 {\BÐö®1^ª\žD0d»-o¶(:°@ª ·éùcßä«M2Ù®üeŒ\¶´E*ùHñ¼Ì3ïÊþÐ_d,M¢™©×eEÂ eèU€{.”Iäô¬˜“^Ä”_iOç¨áàt”ÊÞœøSÅz¸{›`¾QMÍ—5*Ï¯Ö˜=5ž8Ä6ˆæNŒBc]}H`‚³äô {ÚYK¯18xµ›§¼ ú‘káˆÝQ°õ«IÚQþ°§˜ôáuy1ôÈY#¸bÿ¹øm&¸pE2Âô¨iiÄÍhÂ¾e¯pFýDA@+Rm ö(½$@{œ™MÅ4{ãs³©%{ªï¹x½k€¦Ú…‘TÒÚâ¨¸“FÍà‘]õ~¢I‹EåðZôïËG¡,ŸŠZðßÚ¶Ü Ý!1Óè¹ã7wëêÏåî—*Ð*¡áêÿƒ¹4÷µ¢pE ÏkHµéI-è>Æw©þ&ç·ìBÎ¸hœí?˜ÀþîDr¿ñ>ÿ³[Y_ù\b¹â:—úÖŒ¼Ï«á;{[E8¤AÄ¸Ì¾¾Ã^":Éç5A¼Ê’aÍ´×>¸Ø³ÆcZ4ÅVi^+ZNÓ8ã<0µïöW*}½¶VŽ„»T–ï0á!|%¤É8õ-]fe «SÁ0{RzrÈëjË ²ž?fÜj.vð¼²vª·ö6E¶íKd‚Áä$&weM]”/ŽQ!\"“&Ë;>ìg¼ògÂÍ¥ÉMˆÀB« =ª^ÿem/*ˆ ÐD¦/ ¾ pUE´I¬þ¹‘ø²ccìzí¹I»Iöº^Rð F€ ¿ç[:÷©ÿÁ=žÎ‚X3e²°Ó/{ÞTá¸½ŸBI£ðIØhS}…èOð6æ!‚u2å¡4Ù©î¦ÖžÊx¹ûeR(Â98JYEhAªFÂ7¿î"!¶ÆLØyéPç6‰2ßò—Õ»‹Â@WA£6ÿPµÄuÄê2Ââ¯Š.-¿²’0—,8²]6ó•QèGgÃ=åð`™ß«ÉœŒ*B}åN2¥dõ®åJ5ø¥&fÖ$ñmnÎ£†‡‚UxÏŠ³-íÐD¹x·tÞ¯6 ž·¦ÓÜTÏÜð ÐQ+£Z}í l•aUZ½h€«Ú1;j@‰§RC2fUÂpÁ;<:ó-ý¢BÑ }ýûâ–,É=ÅG&4FÏ_?l¥UTCã“ë8§Ó¨»Z93NÇ^jn\-j½šýF&ïT÷«¬/| ’)k¶õn4àf›¶k6ßû:è{ÚyaÇQ¬1.UAhE¹¹ÄýIüc-YO[Ûz¼¨!tÁúJŒ™Þ¢J1@uš¯H+ÖBª_u”@=Rm°?ðÕRbÕõ--;>"Î c T &»ÅdËHæç—È(Žƒê&šëë54Ì`›ï±uúâÄÅkúË`{ØŒªHó?0ÞquÈzxÉd°8óå'aÝåñ£/V1PA½–Ýëx&í·Û©Ð½ÿ^ fí›ê~gøf§ú[%qãÒB å²ô¦îºQc±ú«ÇÈ¬în×ûx¾Œ¸,¾Ë÷ŠæÀ$²’¸QYå#tNÞƒ~fö¢°®Oâ1ˆ/á1dÛ|²/YÓ")uõYSD ±îÀf/l ºÃ·S¨ƒœ´1 iÑÊÀþ]¿n¾ù*9ñ¡äªÜ€ïƒ…ko„™Ó¿ò¼ÕÇrò¢ÞŠ…b²Í¼ "ÍH…‹meðEK“7mQsC¬ô|Ò>Ð–4NYWØÅi Jc;Ýî Ê½¸€è!©±ª8ÞH§£™èÜ;«\–Éïòsã3LþÿÍ+”é±FP°YÙØV•Æð‚ù½q íÌêÁFKo:ØÔXï[6JðZ1‡KÓm2 â(¿…ÜD†Ù<”ÌófSAˆýð!ùYƒSð×~µu72ˆäaT—0ÏÔ ŠFÏ9K‹ŸcóþoP¾,=dèÂ‡K2æ†Õò]®p‚ãž“º¦ûíQr»J»ýŽûGÕ9a‰}Ò?¿Â§Ò3óÅ d¨9I,tŽ@?B¬É´n³tTcµ›S_â{øh“sÿ-ÛO:ÇÑoÊx¦eíÐðÐ*>J«Û Èc`ï*ã–sµ±°rqäâ©¢d–on)«ð¸œÅX$¤5Öñu*‰RÔc³þ(ÈÂ‰¥m¯_dD Öv ø7a´{T£ï2d_+…}8V$ÊazùAK_Êôû¸Ò¤àÅc’ÓgqMfuþvÓ?4÷B=œœÉ0AP?“}K„íûÐ±Š¦â.8Œ…Mv~näÝX¯„û-¥šmA¨‘òº_@ƒ%€¶;öµ1)UËÞþ3Óù˜Ùÿ¸SÚy™Â¹‚ÕQBvv‚ß7h…žÚ^¤z•Cßm¶z–B s6â£ÑxNàøÖX†ŸîÛK¡•}†k7óQÂôº)m‡h8œX0uñ#c#®où”¢¸Ê"¨ü— 0O‚ûýs)ÑFë4ò™]n>ÅÕÀž/”r”žº¤ë°ÀgþµõCÇûuz`]¡Çæ‚’¨<Ÿœã?ŠÒ’ììCYïº7°/½ñ™D•–ùŒ•ìF¶Æ:6“ûºi£÷3‡°‚“Òì0öèK¤Þ¨æ&wÉ"î]ÑEÂsH&.'Ñ„±wUÑ,0Y£ó® Ï¬˜‚ëïü]ƒºú}€ÈÖx§uEþ1Ò2`Gw¾‹¢7Ï°Éa–‡–$ýö=Ü<è›aG©»WB|HÏàØUr]4ù©ÁþVkâØþÖ‰©ê]£’ ôü7.QœOâäai· K¹1Úë]8`‡|œGõ4„…#Ò a§ñ *èøžÎ8ðžÙ@ÔŒ•V›&J8‘úùeÃ…Ú—}ÕS³æY~á©¡æXL½ | üûl¸¸C&]Þk~š8æJ¥ÍõÜ¾!G²ï c]?d‡PÑŠa`#tÙ{êä#*'*âCFª¶3Ö%eÅ!—o+pý–5öSÏÛobd¤¡`ž…ÍßBaz†mõÒF Õçœ‚ë‰a„S0³u±~.6ýk|à‡@nÚ¢Ó™ƒa]]biâ>íùØÓæišì{2$½-ÄéŠ!CjÅrëï;F%¸‰õ¶ëž³dî¶Ï›1`Ôg‚UÐ&UéudÉŒêWBÉ¾ôˆ¥³¸úý”®Ø#µÁ¹B˜ÞsžcHNö2©*_ž³×y–wPú«ýð<÷Oæ•UÈ× qu¾Þ-ºß^Fêˆ,ÜIÜ¨dq,î, ^»u$‰ [Eï‘ýà’Bv‡MrÆ¼rÚ¾ÓâÄôÎîÙr~‚üÝ&t1Æ¯0‰Tf¢(O—{8Q²:ÐA)ìíQØ…a¦ú¿fÖ´ƒï£m»¬ôBiÈ!MÇ–ÒIÅ¯<8Açn»®ßÙÛo²½z‹ÖN+ã£ùß¶ÔqÔ¶¸IJ©![ëã3Ô?‰ñòêî˜›ñ©=J½€n|*z¹Í½hªu4¬Sæzì¨PNùAŸ‚ñÇNr²,^Òµ¶õ£f‚.â²îu!Ó-’•fD•àhÄÔ"û´àæG=cÝë¹mæw¤Üf8ó|¼Þß‡=Õ)…-ÊÆŽÜ°‚7*›!˜}+yé¨C[‹(.%‡²…XO\OÄ4®7`ÿUaíŠok½²÷5Ò´²ÑÕ`©²XVÌb˜ñ ž2Ž"âÊ$ßú§’b®¾F¢fƒY& îí¦s>œ†„;IÀú›‰úª¦çð×ÜÑû8™wgóØ\ŒNæØFxùÏ×BÿÍ¾MäI2\r¸ Í(0¿¿¬W}Ì{À€{Or¥/—ÞÏ„zõ±]¯«á‘ØgÖ%TFýåÄ©<¶Î…ðœ=çüËã ”¦±÷W÷¸'Q©½_ç¢ªƒÿ‘ŸIädœ,OþkÃdéro1ñj¦’^SóìX§Æ¯¢•ý§ƒ½É·J†O¹Þz Ó¼RƒaM&ºíÊyæ€Õ6Éã¨ƒ,êè€åcmë¶8aF~æŒXÿ9œPÝÙÉÝº›×D;nNÔö—Iµe÷ÆZE¿Q¯[&üç,LZFc(Þ;O!èP†I¢U ´ß¬«L !“ y¼¿œœ•ÉEvCMÄ5!k€uÈSa‹9o¬Fe•÷;ã_º§oîÅÌ4Xøó¸oÎÚ?sœ;)†7=§Rçéæ8âÅvÓH}ã¸ý“!Éñ4yÏ¼ž#b²´ D°€÷d8äFÁnMbD O$&‘hhî9‰dîDJ%kªÍ+¬¢yŸÊÿ{½TŠo‰ü™r ö¡Å8„ˆß'o…1ô¥Ê¢èÓéx# ¡ÿv`;ÛÑ’é ßÆÁ|zë“štY×—²ç3è q.1…ñ‹ùÞUÃ]òu+ý¶yR0&…äw¤õáŒYµ–×R‘…#êçËäóoŒÙæIÿ-pûkFïHÉ×¯7ì!D}ú©¯‹hÕÄà"4 8,‡÷#)- ü€/*Ãu™¨Dú^Š?˜.pëPßÇ|Ã ‡KÍg¢œýe‰¯9ÊÇ®xP}[ôøÀ÷å ˆ½Í£GN¤ ÐÃ‹^ÛlÐÓ§ç÷Ïü’5„Åý †Ÿ7zn2ÜŒ V{uƒÇûW ÇÐj—1Û2Wò»ÂF" ¯Z#\z´ó²jwaIŠ[2tWÌÆ¤žÓŒ<Îß±üï4`ýÈ_·•‹77Ç}'“ÀÇÎ~˜ùÛ+.URUÿ°Ùá(j”š°Ü€ ùìõÜèÆã9ŠäŽúà†ÆT‰YIÀ`Yé_ž¶‰ØÑùÆŸ+E4D nmAm´8E£{R˜àoÐ8>ÐÍHûÓ·Uc‘ôÍ‹j_®¸^ëQltÆIÐJÚzÑæx»ÄAuÂhAIY£Uw±„åHÓH§ðYJðí+C§ò:“qýœ%ƒ÷÷…ùÌv%¼Îª§Ÿ¬¨_j‹ôÓM`üfô6A„ª¨¥XÅÄ„¯—4Ï!_¶¹^‚FÝ¡À6.`<õÃ$’ÞF©¥ž¯¢¥Ê4ßë…Õl=ø #µ˜Üÿ@ Yû<)—„GBÄ,|ücLâ;£o"5e{ã»ˆå(îÉ%RÎˆY&–ë„¨®¿_÷œ}uf¼þPÃžtY'0ÖzT+BPüù È.;Å@•“‚®â(… q˜ÐZF[q5•çï[ò(«PÅHetBhñ7ÜS»”Rä/ºrÉf0¾ã+-®1Ÿúp_Il25ØTÎDUãõý-FR§æQõª ?t¸õú½,‹§CŸ(Î?g³YBàA½ï¹užbüÜm¹y\¡G!Ÿ”uÊŠÐÒ$W¡M8‘©FKM ºÒï•x`¾“Fo.F¢Çûð“–3èß¡îd˜yÍ™>§;¤ÕÄ¼.ÞßÂíäa˜PÑ&}¥êµs{¥û¶ƒF¤ÚNœS§(SCw6ž§‰U©#ÝÊ2ÉJ3ÿ¹tÞp4õÓø¹¯[–ÌçÖ¼„ÍcÞ*lo.q…a|-dß:ršìÖ™3ƒ’T½Äõ7‡óØmÖ'Ì¸Óä¢ãœC`ì0^» Úø/«qæÅµ]&ƒH¥É¿ƒþL‚,^9wzPöÔ.]¦Ì$°z4•ŸF7Ø$Ãï>Äýðü>²GtÚ×“côà¬¾ß:œAŽ3!Y!,¨ƒãÅN³æHØÀNŠó."ÉÄ§\÷ÅOªw#Æ›î=¾ eSÏo¥¡ù¶A/cð éu%´Õ3özp+–Á0âðÂž°aSd[Hè¿ Ö£BèQˆ½çü?ÁWaÐØ—Ò¢·Ä »N‹Ç+Ru QøûÒëk!WÉYŒëõ7g, ™Í@è·j…ãÌLý±Š_Ätf©¤?Ç¹ÅNYm×zG°e îE7)BgŽ:+ß×ÁhÈ^·¦ÁPg•Wdª&QOCŽtøˆáÓ…ïöžÑg¢ˆxq“ÙÍÜI+Å34Š¾4ÿ°Eê¦GÊ´•û.FjS›E~–¢2Þå®» Mófsˆêúï×°<¨½Ä¦òÎkP›ŸŽÂ Ê¹âbQ· $¯Z„Ó}wÒ—Ì0ŠÐ|mâäwÀÎÄÜ?¬RPÀVü_¥ÍöÀ“ìö2D ÷ÚŒï(kO¶\›áwwˆ ›ü‘âµñù6Ï4;‡aÏú±ßL¨°ÃAoŸo¼¢Hz«ºK‚eà³O.G–Å·ìÎ“©ÿ“ö*ÏPä±ì|˜ø6Ù²C³÷ÏüÂ"Óå—èaT—iœQè±5¦u<§«aùµºK2¾=âUVeÉÃ‚ uS[{{ÃöqPvj€áÆza²§¾OFñü$Ø¬¸ÍÏHë||XñËcÏ[¤€fÖÐ¾Ô=ñ.T…·Qô8+Ñw®&Š-&SËó%[ñ÷ÅbäM¢ÈXƒ45©ðj®{É`T´w˜Z½KâòyèoÂV¸jgZm{L;ZCµÆ;†SÀóEb>r^ƒ\nÇîí:íí"Ö°e ®P„åLìêamC&ó‘åqˆãÚìù0ûl¦Çw$õjž&ÚZÙ+ò|Sác÷oÀzJ¡ê‚ í8~Ê8`ìèõ‘A^pä+œ¡Ï[h{&ÅwMçº…¶Íœ÷™üøøC,·>*Ë³~/ŒPÃ_PºèÂÜ[M”h¦JàæÓÝçãaGáí¥Ãúfs)©ö³Q$‘ö>9Ï¢öàT§KèÃ cIË6R£1l›Ãb Ùÿ…ø ZŠÍA¢]ÁWˆ#ÉÞybU[(7êÃ¸==&‡«_ø¦it©òß9G¢mìØŽø¨ÌÙ–|S6Y#!€à™«†¡ÆÚ?oÄ¼ÄžZ³ð‘Ž¡WnÍ^?*Ü²Áq¿½Ø}–ßšùçÚf:¶Ýÿ}žâÕìšúÌh ï÷¶]ëU¿{éfºÑ°~ú*[óÞ6ßŸìÅÿ“ÈI ¹a±3ûÆ¾Ïž×Œ¿€ñTè…˜$Ü\¦ò18uÂ-T,qÆ}…²T9b9À'¡²ÅÆÀ›·˜¾°ü†AÉ¡šùt•M©ofÝéð¡mö½ðÁtrø©Ü70DV±—4ž]PåÀHQóØ² ~Ãep÷ºÆ©*sŽ¤ãI2zÃ€£:á´&Þ«\CÁŒ¬ËM{jW÷ðë<ÿ¥á LŠÂh3Æy% ”†Éœ"!‚ñ"x#ê†*=¥Æ†+pâî³ñšÂŽ$q¤§´À(ÿ˜°Ùaê<=†¯…¥"ÍbH·Ì’ŠOæ¡«Ã¿oÆÊ{EÉÇ2€n’¶<ôz&FåßC[k±f"e.ÐM±cñpy8ˆ²múŸ®7[gÅ 2dQ3@¦ç?Ö» 5?‹«a@¥S=ŸGÕLF×CÌ‚T{TNWEô<Û•ž$Ç]Ö:+lDôxã™ Ý¡^çO’ÝõJ;‡4@'ãè0Óç^1-Æð¯¬ò 4ÐFˆ#Rš·èHöÇK,õB|sŠ)·Á‰>ññjÈŠ¤év¹XœÝ äSþ²ã¨pƒôll2PõYPàÍÊ>v¨NqCu@vÞt‘ˆ1ê|_ØÇá³qÙÙ)‰±c+‚‰‰˜Æfê ¬Ôàæ<ôTQÙ¸¬u)ãæÐúý^