bouncycastle-tls-1.79-150200.3.32.2<>,gp9| ^|,5~P7>%>x?hd & S  'DJTh r |     $(8(#9#: C#FGHIX YD\]^bwc defluvwxyz"dCbouncycastle-tls1.79150200.3.32.2Bouncy Castle JSSE provider and TLS/DTLS APIThe Bouncy Castle Java APIs for TLS and DTLS, including a provider for the JSSE.gh03-ch2a&SUSE Linux Enterprise 15SUSE LLC MIThttps://www.suse.com/Development/Libraries/Javahttps://www.bouncycastle.orglinuxnoarch HA큤ggggg5449cea87447afdf782aa1c79d22cfb11e4740248d6cff7824e6938ca037b36bedbbb10380b1271998b867a2e36b1cbee226e03d438726e1a91f80c5dde118496200bd1dbcda4c580b1a86227659843f91d84129629907b0d693db6b0eec4d5c3c7e052d11c90cb213dc6b5071120bed53732e8dc5f5a78d6000eeab992c35cerootrootrootrootrootrootrootrootrootrootbouncycastle-1.79-150200.3.32.2.src.rpmbouncycastle-tlsmvn(org.bouncycastle:bctls-jdk15)mvn(org.bouncycastle:bctls-jdk15:pom:)mvn(org.bouncycastle:bctls-jdk15on)mvn(org.bouncycastle:bctls-jdk15on:pom:)mvn(org.bouncycastle:bctls-jdk15to18)mvn(org.bouncycastle:bctls-jdk15to18:pom:)mvn(org.bouncycastle:bctls-jdk16)mvn(org.bouncycastle:bctls-jdk16:pom:)mvn(org.bouncycastle:bctls-jdk18)mvn(org.bouncycastle:bctls-jdk18:pom:)mvn(org.bouncycastle:bctls-jdk18on)mvn(org.bouncycastle:bctls-jdk18on:pom:)osgi(bctls)@@@@    java-headlessjavapackages-filesystemmvn(org.bouncycastle:bcprov-jdk18on)mvn(org.bouncycastle:bcutil-jdk18on)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)1.791.793.0.4-14.6.0-14.0-15.2-14.14.1g(@f/f/em@e/dC@dGcObbbDF@b4t@b3"`@`__@_ @^l@^{G]µ]@]@]@]@[P}@[d@ZYY4Y@VU@V*!@U hT!Tpmonreal@suse.comfstrba@suse.compmonreal@suse.compmonreal@suse.compmonreal@suse.compmonreal@suse.compmonreal@suse.compmonreal@suse.comshvetz.anton@gmail.comfstrba@suse.comfstrba@suse.comfstrba@suse.comfstrba@suse.compmonreal@suse.comfstrba@suse.compmonreal@suse.compmonreal@suse.compmonrealgonzalez@suse.comfstrba@suse.compmonrealgonzalez@suse.compmonrealgonzalez@suse.compmonrealgonzalez@suse.compmonrealgonzalez@suse.comfstrba@suse.comtchvatal@suse.comabergmann@suse.comfstrba@suse.comfstrba@suse.comfstrba@suse.compcervinka@suse.comtchvatal@suse.comtchvatal@suse.comtchvatal@suse.comtchvatal@suse.comtchvatal@suse.com- Update to 1.79: * Defects Fixed: - Leading zeroes were sometimes dropped from Ed25519 signatures leading to verification errors in the PGP API. - Default version string for Armored Output is now set correctly in 18on build. - The Elephant cipher would fail on large messages. - CMSSignedData.replaceSigners() would re-encode the digest algorithms block, occassionally dropping ones where NULL had been previously added as an algorithm parameter. The method now attempts to only use the original digest algorithm identifiers. - ERSInputStreamData would fail to generate the correct hash if called a second time with a different hash algorithm. - A downcast in the CrlCache which would cause FTP based CRLs to fail to load has been removed. - ECUtil.getNamedCurveOid() now trims curve names of excess space before look up. - The PhotonBeetle and Xoodyak digests did not reset properly after a doFinal() call. - Malformed AlgorithmIdentifiers in CertIDs could cause caching issues in the OCSP cache. - With Java 21 a provider service class will now be returned with a null class name where previously a null would have been returned for a service. This can cause a NullPointerException to be thrown by the BC provider if a non-existant service is requested. - CMS: OtherKeyAttribute.keyAttr now treated as optional. - CMS: EnvelopedData and AuthEnvelopedData could calculate the wrong versions. - The default version header for PGP armored output did not carry the correct version string. - In some situations the algorithm lookup for creating PGPDigestCalculators would fail due to truncation of the algorithm name. * Additional Features and Functionality: - Object Identifiers have been added for ML-KEM, ML-DSA, and SLH-DSA. - The PQC algorithms, ML-KEM, ML-DSA (including pre-hash), and SLH-DSA (including pre-hash) have been added to the BC provider and the lightweight API. - A new spec, ContextParameterSpec, has been added to support signature contexts for ML-DSA and SLH-DSA. - BCJSSE: Added support for security property "jdk.tls.server.defaultDHEParameters" (disabled in FIPS mode). - BCJSSE: Added support for signature_algorithms_cert configuration via "org.bouncycastle.jsse.client.SignatureSchemesCert" and "org.bouncycastle.jsse.server.SignatureSchemesCert" system properties or BCSSLParameters property "SignatureSchemesCert". - BCJSSE: Added support for boolean system property "org.bouncycastle.jsse.fips.allowGCMCiphersIn12" (false by default). - (D)TLS: Remove redundant verification of self-generated RSA signatures. - CompositePrivateKeys now support the latest revision of the composite signature draft. - Delta Certificates now support the latest revision of the delta certificate extension draft. - A general KeyIdentifier class, encapsulating both PGP KeyID and the PGP key fingerprint has been added to the PGP API. - Support for the LibrePGP PreferredEncryptionModes signature subpacket has been added to the PGP API. - Support for Version 6 signatures, including salts, has been added to the PGP API. - Support for the PreferredKeyServer signature supacket has been added to the PGP API. - Support for RFC 9269, "Using KEMs in Cryptographic Message Syntax (CMS)", has been added to the CMS API. - Support for the Argon2 S2K has been added to the PGP API. - The system property "org.bouncycastle.pemreader.lax" has been introduced for situations where the BC PEM parsing is now too strict. - The system property "org.bouncycastle.ec.disable_f2m" has been introduced to allow F2m EC support to be disabled. * Rebase bouncycastle-notests.patch- Update to version 1.78.1 * Defects Fixed: - The new dependency of the the PGP API on the bcutil jar was missing from the module jar, the OSGi manifest, and the Maven POM. This has been fixed. - Missing exports and duplicate imports have been added/removed from the OSGi manifests. - The OSGi manifests now have the same bundle IDs as 1.77 and lock down dependencies to the equivalent variations - A check in the X.509 Extensions class preventing the parsing of empty extensions has been removed.- Update to version 1.78: [bsc#1223252, CVE-2024-30171] [bsc#1224304, CVE-2024-30172] [bsc#1224299, CVE-2024-29857] * Security Advisories. - CVE-2024-29857: Importing an EC certificate with specially crafted F2m parameters can cause high CPU usage during parameter evaluation. - CVE-2024-30171: Possible timing based leakage in RSA based handshakes due to exception processing eliminated. - CVE-2024-30172: Crafted signature and public key can be used to trigger an infinite loop in the Ed25519 verification code. - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE and an SSL socket is not created with an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address. This has been fixed. * Defects Fixed: - Issues with a dangling weak reference causing intermittent NullPointerExceptions in the OcspCache have been fixed. - Issues with non-constant time RSA operations in TLS handshakes. - Issue with Ed25519, Ed448 signature verification causing intermittent infinite loop have been fixed. - Issues with non-constant time ML-KEM implementation ("Kyber Slash"). - Align ML-KEM input validation with FIPS 203 IPD requirements. - Make PEM parsing more forgiving of whitespace to align with RFC 7468. - Fix CCM length checks with large nonce sizes (n=12, n=13). - EAC: Fixed the CertificateBody ASN.1 type to support an optional Certification Authority Reference in a Certificate Request. - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized and the contents octets for both types are now limited to 4096 bytes. - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(), which could cause issues for HSM RSA keys. - BCJSSE: When endpoint identification is enabled and an SSL socket is not created with an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address. - The missing module import of java.logging to the provider module has been added. - GOST ASN.1 public key alg parameters are now compliant with RFC 9215. - An off-by-one error in the encoding for EccP256CurvePoint for ITS. - PEM Parser now enforces PEM headers to start at the beginning of the line to be meaningful. * Additional Features and Functionality. - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol) has been added as a new module. - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373. - Improvements to PGP support, including Camellia key wrapping and Curve25519, Curve448 key types (including XDH with HKDF). - Added initial support for ML-KEM in TLS. - Added XWing hybrid KEM construction (X25519 + ML-KEM-768). - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+. - Introduced initial composite signature support for X509 Certificates. - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM, PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM. - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set using the org.bouncycastle.pkcs12.default system/security property. - The PGP SExpParser will now handle Ed25519 and Ed448 keys. - Dilithium and Kyber key encoding updated to latest Draft RFCs (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates) - Support has been added for encryption key derivation using HKDF in CMS, see draft-housley-lamps-cms-cek-hkdf-sha256. - X500Name now recognises jurisdiction{C,ST,L} DNs. - CertPathValidationContext and CertificatePoliciesValidation now include implementations of Memoable. - The Composite post-quantum signatures implementation has been updated to the latest draft draft-ounsworth-pq-composite-sigs. * Full release notes: bouncycastle.org/releasenotes.html#r1rv78 * Rebase bouncycastle-notests.patch- Update to version 1.77: * Defects Fixed: - Using an unescaped '=' in an X.500 RDN would result in the RDN being truncated silently. The issue is now detected and an exception is thrown. - asn1.eac.CertificateBody was returning certificateEffectiveDate from getCertificateExpirationDate(). This has been fixed to return certificateExpirationDate. - DTLS: Fixed retransmission in response to re-receipt of an aggregated ChangeCipherSpec. - (D)TLS: Fixed compliance for supported_groups extension. Server will no longer negotiate an EC cipher suite using a default curve when the ClientHello includes the supported_groups extension but it contains no curves in common with the server. Similarly, a DH cipher suite will not be negotiated when the ClientHello includes supported_groups, containing at least one FFDHE group, but none in common with the server. - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi. - TLS: class annotation issues that could occur between the BC provider and the TLS API for the GCMParameterSpec class when the jars were loaded on the boot class path have been addressed. - Attempt to create an ASN.1 OID from a zero length byte array is now caught at construction time. - Attempt to create an X.509 extension block which is empty will now be blocked cause an exception. - IES implementation will now accept a null ParameterSpec if no nonce is needed. - An internal method in Arrays was failing to construct its failure message correctly on an error. - HSSKeyPublicParameters.generateLMSContext() would fail for a unit depth key. * Additional Features and Functionality: - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean system properties to control (for client and server resp.) whether the signature_algorithms_cert extension should be omitted if it would be identical to signature_algorithms. Defaults to true, the historical behaviour. - The low-level HPKE API now allows the sender to specify an ephemeral key pair. - Support has been added for the delta-certificate requests in line with the current Chameleon Cert draft from the IETF. - Some accommodation has been added for historical systems to accommodate variations in the SHA-1 digest OID for CMS SignedData. - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as the newer RSAPSS algorithm names when used with the JCA. - TLS: RSA key exchange cipher suites are now disabled by default. - Support has been added for PKCS#10 requests to allow certificates using the altSignature/altPublicKey extensions. * Notes: - Kyber and Dilithium have been updated according to the latest draft of the standard. Dilithium-AES and Kyber-AES have now been removed. Kyber now produces 256 bit secrets for all parameter sets (in line with the draft standard). - NTRU has been updated to produce 256 bit secrets in line with Kyber. - SPHINCS+ can now be used to generate certificates in line with those used by (Open Quantum Safe) OQS. - Falcon object idenitifiers are now in line with OQS as well. - PQC CMS SignedData now defaults to SHA-256 for signed attributes rather than SHAKE-256. This is also a compatibility change, but may change further again as the IETF standard for CMS is updated.- Update to version 1.76: * Defects Fixed: - Service allocation in the provider could fail due to the lack of a permission block. This has been fixed. - JceKeyFingerPrintCalculator has been generalised for different providers by using "SHA-256" for the algorithm string. - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that prevents a BCJSSE server from negotiating TLSv1.1 or earlier. - DTLS: Fixed server support for client_certificate_type extension. - Cipher.unwrap() for HQC could fail due to a miscalculation of the length of the KEM packet. This has been fixed. - There was exposure to a Java 7 method in the Java 5 to Java 8 BCTLS jar which could cause issues with some TLS 1.2 cipher suites running on older JVMs. This is now fixed. * Additional Features and Functionality: - BCJSSE: Following OpenJDK, finalizers have been removed from SSLSocket subclasses. Applications should close sockets and not rely on garbage collection. - BCJSSE: Added support for boolean system property "jdk.tls.client.useCompatibilityMode" (default "true"). - DTLS: Added server support for session resumption. - JcaPKCS10CertificationRequest will now work with EC on the OpenJDK provider. - TimeStamp generation now supports the SHA3 algorithm set. - The SPHINCS+ simple parameters are now fully supported in the BCPQC provider. - Kyber, Classic McEliece, HQC, and Bike now supported by the CRMF/CMS/CMP APIs. - Builder classes have been add for PGP ASCII Armored streams allowing CRCs and versions to now be optional. - An UnknownPacket type has been added to the PGP APIs to allow for forwards compatibility with upcoming revisions to the standard. * Rebase patch bouncycastle-notests.patch - Update to version 1.75: * Defects Fixed: - Several Java 8 method calls were accidentally introduced in the Java 5 to Java 8 build. The affected classes have been refactored to remove this. - (D)TLS: renegotiation after resumption now fixed to avoid breaking connection. * Notes: - The ASN.1 core package has had some dead and retired methods cleaned up and removed.- Update to version 1.74: [bsc#1212508, CVE-2023-33201] * Defects Fixed: - AsconEngine: Fixed a buffering bug when decrypting across multiple processBytes calls (ascon128a unaffected). - Context based sanity checking on PGP signatures has been added. - The ParallelHash clone constructor was not copying all fields. - The maximimum number of blocks for CTR/SIC modes was 1 block less than it should have been. * Additional Features and Functionality: - The PGP API now supports wildcard key IDs for public key based data encryption. - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256 (the additional SP 8000-208 parameter sets). - The PGP API now supports V5 and V6 AEAD encryption for encrypted data packets. - The PGP examples have been updated to reflect key size and algorithm changes that have occurred since they were first written (10+ years...). - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called when the connection is closed (including by failure). - BCJSSE: Improved logging of connection events and include unique IDs in connection-specific log messages. - BCJSSE: Server now logs the offered cipher suites when it fails to select one. - BCJSSE: Added support for SSLParameters namedGroups and signatureSchemes properties (can also be used via BCJSSE extension API in earlier Java versions). - DTLS: The initial handshake re-send time is now configurable by overriding 'TlsPeer.getHandshakeResendTimeMillis'. - DTLS: Added support for connection IDs per RFC 9146. - DTLS: Performance of DTLSVerifier has been improved so that it can reasonably be used for all incoming packets. - Initial support has been added for A Mechanism for Encoding Differences in Paired Certificates. - The PGP API now supports parsing, encoding, and fingerprinting of V6 EC/EdEC keys. - A thread safe verifier API has been added to the PGP API to support multi-threaded verification of certifications on keys and user IDs. - The number of keys/sub-keys in a PGPKeyRing can now be found by calling PGPKeyRing.size(). - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU are now supported directly by the BC provider. * Notes: - The now defunct PQC SIKE algorithm has been removed, this has also meant the removal of its resource files so the provider is now quite a bit smaller. - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour for shorter IVs can be supported where required by padding the IV to the 128 bits with zero. - PGP encrypted data generation now uses integrity protection by default. Previous behaviour for encrypted data can be supported where required by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when data encryption is set up. - There are now additional sanity checks in place to prevent accidental mis-use of PGPSignature objects. If this change causes any issues, you might want to check what your code is up to as there is probably a bug. * Security Advisories: - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi where a specially crafted certificate subject could be used to try and extract extra information out of an LDAP server with wild-card matthing enabled. * Rebase bouncycastle-javadoc.patch * Add bouncycastle-notests.patch- Update to version 1.73: [jsc#PED-3756] * Defects Fixed: - BCJSSE: Instantiating a JSSE provider in some contexts could cause an AccessControl exception. - The EC key pair generator can generate out of range private keys when used with SM2. A specific SM2KeyPairGenerator has been added to the low-level API and is used by KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has been updated to check for out of range keys as well.. - The attached signature type byte was still present in Falcon signatures as well as the detached signature byte. - There was an off-by-one error in engineGetOutputSize() for ECIES. - The method for invoking read() internally in BCPGInputStream could result in inconsistent behaviour if the class was extended. - Fixed a rounding issue with FF1 Format Preserving Encryption algorithm for certain radices. - Fixed RFC3394WrapEngine handling of 64 bit keys. - Internal buffer for blake2sp was too small and could result in an ArrayIndexOutOfBoundsException. - JCA PSS Signatures using SHAKE128 and SHAKE256 now support encoding of algorithm parameters. - PKCS10CertificationRequest now checks for empty extension parameters. - Parsing errors in the processing of PGP Armored Data now throw an explicit exception ArmoredInputException. - PGP AEAD streams could occassionally be truncated. - The ESTService class now supports processing of chunked HTTP data. - A constructed ASN.1 OCTET STRING with a single member would sometimes be re-encoded as a definite-length OCTET STRING. The encoding has been adjusted to preserve the BER status of the object. - PKIXCertPathReviewer could fail if the trust anchor was also included in the certificate store being used for path analysis. - UTF-8 parsing of an array range ignored the provided length. - IPAddress has been written to provide stricter checking and avoid the use of Integer.parseInt(). - A Java 7 class snuck into the Java 5 to Java 8 build. * Additional Features and Functionality: - The Rainbow NIST Post Quantum Round-3 Candidate has been added to the low-level API and the BCPQC provider (level 3 and level 5 parameter sets only). - The GeMSS NIST Post Quantum Round-3 Candidate has been added to the low-level API. - The org.bouncycastle.rsa.max_mr_tests property check has been added to allow capping of MR tests done on RSA moduli. - Significant performance improvements in PQC algorithms, especially BIKE, CMCE, Frodo, HQC, Picnic. - EdDSA verification now conforms to the recommendations of Taming the many EdDSAs, in particular cofactored verification. As a side benefit, Pornin's basis reduction is now used for EdDSA verification, giving a significant performance boost. - Major performance improvements for Anomalous Binary (Koblitz) Curves. - The lightweight Cryptography finalists Ascon, ISAP, Elephant, PhotonBeetle, Sparkle, and Xoodyak have been added to the light-weight cryptography API. - BLAKE2bp and BLAKE2sp have been added to the light-weight cryptography API. - Support has been added for X.509, Section 9.8, hybrid certificates and CRLs using alternate public keys and alternate signatures. - The property "org.bouncycastle.emulate.oracle" has been added to signal the provider should return algorithm names on some algorithms in the same manner as the Oracle JCE provider. - An extra replaceSigners method has been added to CMSSignedData which allows for specifying the digest algorithm IDs to be used in the new CMSSignedData object. - Parsing and re-encoding of ASN.1 PEM data has been further optimized to prevent unecessary conversions between basic encoding, definite length, and DER. - Support has been added for KEM ciphers in CMS in accordance with draft-ietf-lamps-cms-kemri - Support has been added for certEncr in CRMF to allow issuing of certificates for KEM public keys. - Further speedups have been made to CRC24. - GCMParameterSpec constructor caching has been added to improve performance for JVMs that have the class available. - The PGPEncrytedDataGenerator now supports injecting the session key to be used for PGP PBE encrypted data. - The CRMF CertificateRequestMessageBuilder now supports optional attributes. - Improvements to the s calculation in JPAKE. - A general purpose PQCOtherInfoGenerator has been added which supports all Kyber and NTRU. - An implementation of HPKE (RFC 9180 - Hybrid Public Key Encryption) has been added to the light-weight cryptography API. * Security Advisories: - The PQC implementations have now been subject to formal review for secret leakage and side channels, there were issues in BIKE, Falcon, Frodo, HQC which have now been fixed. Some weak positives also showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last set has been ignored as the algorithms will either be updated if they reappear in the Signature Round, or deleted, as is already the case for SIKE (it is now in the legacy package). Details on the group responsible for the testing can be found in the CONTRIBUTORS file. - For at least some ECIES variants (e.g. when using CBC) there is an issue with potential malleability of a nonce (implying silent malleability of the plaintext) that must be sent alongside the ciphertext but is outside the IES integrity check. For this reason the automatic generation of nonces with IED is now disabled and they have to be passed in using an IESParameterSpec. The current advice is to agree on a nonce between parties and then rely on the use of the ephemeral key component to allow the nonce (rather the so called nonce) usage to be extended.- Update to version 1.72: * Defects Fixed: - There were parameter errors in XMSS^MT OIDs for XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have been fixed. - There was an error in Merkle tree construction for the Evidence Records (ERS) implementation which could result in invalid roots been timestamped. ERS now produces an ArchiveTimeStamp for each data object/group with an associated reduced hash tree. The reduced hash tree is now calculated as a simple path to the root of the tree for each record. - OpenPGP will now ignore signatures marked as non-exportable on encoding. - A tagging calculation error in GCMSIV which could result in incorrect tags has been fixed. - Issues around Java 17 which could result in failing tests have been addressed. * Additional Features and Functionality: - BCJSSE: TLS 1.3 is now enabled by default where no explicit protocols are supplied (e.g. "TLS" or "Default" SSLContext algorithms, or SSLContext.getDefault() method). - BCJSSE: Rewrite SSLEngine implementation to improve compatibility with SunJSSE. - BCJSSE: Support export of keying material via extension API. - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266. - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are offered now. Earlier versions are still supported if explicitly enabled. Users may need to check they are offering suitable cipher suites for TLS 1.3. - (D)TLS (low-level API): Add support for raw public keys per RFC 7250. - CryptoServicesRegistrar now has a setServicesConstraints() method on it which can be used to selectively turn off algorithms. - The NIST PQC Alternate Candidate, Picnic, has been added to the low level API and the BCPQC provider. - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1 and support for Haraka has been added. - Evidence records now support timestamp renewal and hash renewal. - The SIKE Alternative Candidate NIST Post Quantum Algorithm has been added to the low-level PQC API. - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm has been added to the low-level API and the BCPQC provider. - The Falcon Finalist NIST Post Quantum Algorithm has been added to the low-level API and the BCPQC provider. - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been added to the low-level API and the BCPQC provider. - Argon2 Support has been added to the OpenPGP API. - XDH IES has now been added to the BC provider. - The OpenPGP API now supports AEAD encryption and decryption. - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms have been added to the low-level API and the BCPQC provider. - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has been added to the low-level API and the BCPQC provider. - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been added to the low-level API and the BCPQC provider. - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been added to the low-level API and the BCPQC provider. - Grain128AEAD has been added to the lightweight API. - A fast version of CRC24 has been added for use with the PGP API. - Some additional methods and fields have been exposed in the PGPOnePassSignature class to (hopefully) make it easier to deal with nested signatures. - CMP support classes have been updated to reflect the latest editions to the the draft RFC "Lightweight Certificate Management Protocol (CMP) Profile". - Support has been added to the PKCS#12 implementation for the Oracle trusted certificate attribute. - Performance of our BZIP2 classes has been improved. * Notes: - Keep in mind the PQC algorithms are still under development and we are still at least a year and a half away from published standards. This means the algorithms may still change so by all means experiment, but do not use the PQC algoritms for anything long term. - The legacy "Rainbow" and "McEliece" implementations have been removed from the BCPQC provider. The underlying classes are still present if required. Other legacy algorithm implementations can be found under the org.bouncycastle.pqc.legacy package. * Security Notes: - The PQC SIKE algorithm is provided for research purposes only. It should now be regarded as broken. The SIKE implementation will be withdrawn in BC 1.73. * Rebase bouncycastle-javadoc.patch- Version update to 1.71 * Defects Fixed - In line with GPG the PGP API now attempts to preserve comments containing non-ascii UTF8 characters. - An accidental partial dependency on Java 1.7 has been removed from the TLS API. - JcaPKIXIdentityBuilder would fail to process File objects correctly. This is now fixed. - Some byte[] parameters to the CMP API were not being defensively cloned to prevent accidental changes. Extra defensive cloning has been added. - CMS primitives would sometimes convert ASN.1 definite-length encodings into indefinite-length encodings. The primitives will now try and preserve the original encoding where possible. - CMSSignedData.getAttributeCertificates() now properly restricts the tag values checked to just 1 (the obsolete v1 tag) and 2 (for the more current v2 certificates). - BCJSSE now tries to validate a custom KeyManager selection in order to catch errors around a key manager ignoring key type early. - Compressed streams in PGP ending with zero length partial packets could cause failure on parsing the OpenPGP API. This has been fixed. - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper would lose track of any algorithm parameters generated in the initial attempt. The algorithm parameters are now propagated. - An accidental regression introduced by a fix for another issue in PKIXCertPathReviewer around use of the AuthorityKeyIdentifier extension and it failing to match a certificate uniquely when the serial number field is missing has been fixed. - An error was found in the creation of TLS 1.3 Export Keying Material which could cause compatibility issues. This has been fixed. * Additional Features and Functionality - Support has been added for OpenPGP regular expression signature packets. - Support has been added for OpenPGP PolicyURI signature packets. - A utility method has been added to PGPSecretKeyRing to allow for inserting or replacing a PGPPublicKey. - The NIST PQC Finalist, Classic McEliece has been added to the low level API and the BCPQC provider. - The NIST PQC Alternate Candidate, SPHINCS+ has been added to the BCPQC provider. - The NIST PQC Alternate Candidate, FrodoKEM has been added to the low level API and the BCPQC provider. - The NIST PQC Finalist, SABER has been added to the low level API and the BCPQC provider. - KMAC128, KMAC256 has been added to the BC provider (empty customization string). - TupleHash128, TupleHash256 has been added to the BC provider (empty customization string). - ParallelHash128, ParallelHash256 has been added to the BC provider (empty customization string, block size 1024 bits). - Two new properties: "org.bouncycastle.rsa.max_size" (default 15360) and "org.bouncycastle.ec.fp_max_size" (default 1042) have been added to cap the maximum size of RSA and EC keys. - RSA modulus are now checked to be provably composite using the enhanced MR probable prime test. - Imported EC Fp basis values are now validated against the MR prime number test before use. The certainty level of the prime test can be determined by "org.bouncycastle.ec.fp_certainty" (default 100). - The BC entropy thread now has a specific name: "BC-ENTROPY-GATHERER". - Utility methods have been added for joining/merging PGP public keys and signatures. - Blake3-256 has been added to the BC provider. - DTLS: optimisation to delayed handshake hash. - Further additions to the ETSI 102 941 support in the ETSI/ITS package: certification request, signed message generation and verification now supported. - CMSSignedDataGenerator now supports the direct generation of definite-length data. - The NetscapeCertType class now has a hasUsages() method on it for querying usage settings on its bit string. - Support for additional input has been added for deterministic (EC)DSA. - The OpenPGP API provides better support for subkey generation. - BCJSSE: Added boolean system properties "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and "org.bouncycastle.jsse.server.dh.disableDefaultSuites". Default "false". Set to "true" to disable inclusion of DH cipher suites in the default cipher suites for client/server respectively. * Notes - The deprecated QTESLA implementation has been removed from the BCPQC provider. - The submission update to SPHINCS+ has been added. This changes the generation of signatures - particularly deterministic ones. - Version update to 1.70 * Defects Fixed - Blake 3 output limit is enforced. - The PKCS12 KeyStore was relying on default precedence for its key Cipher implementation so was sometimes failing if used from the keytool. The KeyStore class now makes sure it uses the correct Cipher implementation. - Fixed bzip2 compression for empty contents (GH #993). - ASN.1: More robust handling of high tag numbers and definite-length forms. - BCJSSE: Fix a concurrent modification issue in session contexts (GH#968). - BCJSSE: Don't log sensitive system property values (GH#976). - BCJSSE: Fixed a priority issue amongst imperfect-match credentials in KeyManager classes. - The IES AlgorithmParameters object has been re-written to properly support all the variations of IESParameterSpec. - getOutputSize() for ECIES has been corrected to avoid occassional underestimates. - The lack of close() in the ASN.1 Dump command line utility was triggering false positives in some code analysis tools. A close() call has been added. - PGPPublicKey.getBitStrength() now properly recognises EdDSA keys. * Additional Features and Functionality - Missing PGP CRC checksums can now be optionally ignored using setDetectMissingCRC() (default false) on ArmoredInputStream. - PGPSecretKey.copyWithNewPassword() now has a variant which uses USAGE_SHA1 for key protection if a PGPDigestCalculator is passed in. - PGP ASCII armored data now skips "\t", "\v", and "\f". - PKCS12 files with duplicate localKeyId attributes on certificates will now have the incorrect attributes filtered out, rather than the duplicate causing an exception. - PGPObjectFactory will now ignore packets representing unrecognised signature versions in the input stream. - The X.509 extension generator will now accumulate some duplicate X.509 extensions into a single extension where it is possible to do so. - Removed support for maxXofLen in Kangaroo digest. - Ignore marker packets in PGP Public and Secret key ring collection. - An implementation of LEA has been added to the low-level API. - Access, recovery, and direct use for PGP session keys has been added to the OpenPGP API for processing encrypted data. - A PGPCanonicalizedDataGenerator has been added which converts input into canonicalized literal data for text and UTF-8 mode. - A getUserKeyingMaterial() method has been added to the KeyAgreeRecipientInformation class. - ASN.1: Tagged objects (and parsers) now support all tag classes. Special code for ApplicationSpecific has been deprecated and re-implemented in terms of TaggedObject. - ASN.1: Improved support for nested tagging. - ASN.1: Added support for GraphicString, ObjectDescriptor, RelativeOID. - ASN.1: Added support for constructed BitString encodings, including efficient parsing for large values. - TLS: Added support for external PSK handshakes. - TLS: Check policy restrictions on key size when determining cipher suite support. - A performance issue in KeccakDigest due to left over debug code has been identified and dealt with. - BKS key stores can now be used for collecting protected keys (note: any attempt to store such a store will cause an exception). - A method for recovering user keying material has been added to KeyAgreeRecipientInformation. - Support has been added to the CMS API for SHA-3 based PLAIN-ECDSA. - The low level BcDefaultDigestProvider now supports the SHAKE family of algorithms and the SM3 alogirthm. - PGPKeyRingGenerator now supports creation of key-rings with direct-key identified keys. - The PQC NIST candidate, signature algorithm SPHINCS+ has been added to the low-level API. - ArmoredInputStream now explicitly checks for a '\n' if in crLF mode. - Direct support for NotationDataOccurances, Exportable, Revocable, IntendedRecipientFingerPrints, and AEAD algorithm preferences has been added to PGPSignatureSubpacketVector. - Further support has been added for keys described using S-Expressions in GPG 2.2.X. - Support for OpenPGP Session Keys from the (draft) Stateless OpenPGP CLI has been added. - Additional checks have been added for PGP marker packets in the parsing of PGP objects. - A CMSSignedData.addDigestAlgorithm() has been added to allow for adding additional digest algorithm identifiers to CMS SignedData structures when required. - Support has been added to CMS for the LMS/HSS signature algorithm. - The system property "org.bouncycastle.jsse.client.assumeOriginalHostName" (default false) has been added for dealing with SNI problems related to the host name not being propagate by the JVM. - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with ciphers that do not have algorithm parameters (e.g. AESKWP). - Support is now added for certificates using ETSI TS 103 097, "Intelligent Transport Systems (ITS)" in the bcpkix package. * Notes. - While this release should maintain source code compatibility, developers making use of some parts of the ASN.1 library will find that some classes need recompiling. Apologies for the inconvenience. - Version update to 1.69 * Defects Fixed - Lightweight and JCA conversion of Ed25519 keys in the PGP API could drop the leading byte as it was zero. This has been fixed. - Marker packets appearing at the start of PGP public key rings could cause parsing failure. This has been fixed. - ESTService could fail for some valid Content-Type headers. This has been fixed. - Originator key algorithm parameters were being passed as NULL in key agreement recipients. The parameters now reflect the value of the parameters in the key's SubjectPublicKeyInfo. - ContentType on encapsulated data was not been passed through correctly for authenticated and enveloped data. This has been fixed. - NTRUEncryptionParameters and NTRUEncryptionKeyGenerationParameters were not correctly cloning the contained message digest. This has been fixed. - CertificateFactory.generateCertificates()/generateCRLs() would throw an exception if extra data was found at the end of a PEM file even if valid objects had been found. Extra data is now ignored providing at least one object found. - Internal class PKIXCRLUtil could throw a NullPointerException for CRLs with an absent nextUpdate field. This has been fixed. - PGP ArmoredInputStream now fails earlier on malformed headers. - The McElieceKobaraImaiCipher was randomly throwing "Bad Padding: invalid ciphertext" exception while decrypting due to leading zeroes been missed during processing of the cipher text. This has been fixed. - Ed25519 keys being passed in via OpenSSH key spec are now validated in the KeyFactory. - Blowfish keys are now range checked on cipher construction. - In some cases PGPSecretKeyRing was failing to search its extraPubKeys list when searching for public keys. - The BasicConstraintsValidation class in the BC cert path validation tools has improved conformance to RFC 5280. - AlgorithmIdentifiers involving message digests now attempt to follow the latest conventions for the parameters field (basically DER NULL appears less). - Fix various conversions and interoperability for XDH and EdDSA between BC and SunEC providers. - TLS: Prevent attempts to use KeyUpdate mechanism in versions before TLS 1.3. * Additional Features and Functionality - GCM-SIV has been added to the lightweight API and the provider. - Blake3 has been added to the lightweight API. - The OpenSSL PEMParser can now be extended to add specialised parsers. - Base32 encoding has now been added, the default alphabet is from RFC 4648. - The KangarooTwelve message digest has been added to the lightweight API. - An implementation of the two FPE algorithms, FF1 and FF3-1 in SP 800-38G has been added to the lightweight API and the JCE provider. - An implementation of ParallelHash has been added to the lightweight API. - An implementation of TupleHash has been added to the lightweight API. - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the mask generation function and digest. - ECDSA now supports the use of SHAKE128 and SHAKE256. - PGPPBEEncryptedData will now reset the stream if the initial checksum fails so another password can be tried. - Iterators on public and secret key ring collections in PGP now reflect the original order of the public/secret key rings they contain. - KeyAgreeRecipientInformation now has a getOriginator() method for retrieving the underlying orginator information. - PGPSignature now has a getDigestPrefix() method for people wanting exposure to the signature finger print details. - The old BKS-V1 format keystore is now disabled by default. If you need to use BKS-V1 for legacy reasons, it can be re-enabled by adding: org.bouncycastle.bks.enable_v1=true to the java.security file. We would be interested in hearing from anyone that needs to do this. - PLAIN-ECDSA now supports the SHA3 digests. - Some highlevel support for RFC 4998 ERS has been added for ArchiveTimeStamp and EvidenceRecord. The new classes are in the org.bouncycastle.tsp.ers package. - ECIES has now also support SHA256, SHA384, and SHA512. - digestAlgorithms filed in CMS SignedData now includes counter signature digest algorithms where possible. - A new property "org.bouncycastle.jsse.config" has been added which can be used to configure the BCJSSE provider when it is created using the no-args constructor. - In line with changes in OpenSSL 1.1.0, OpenSSLPBEParametersGenerator can now be configured with a digest. - PGPKeyRingGenerator now includes a method for adding a subkey with a primary key binding signature. - Support for ASN.1 PRIVATE tags has been added. - Performance enhancements to Nokeon, AES, GCM, and SICBlockCipher. - Support for ecoding/decoding McElieceCCA2 keys has been added to the PQC API - BCJSSE: Added support for jdk.tls.maxCertificateChainLength system property (default is 10). - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize system property (default is 32768). - BCJSSE: Added support for jdk.tls.client.enableCAExtension (default is 'false'). - BCJSSE: Added support for jdk.tls.client.cipherSuites system property. - BCJSSE: Added support for jdk.tls.server.cipherSuites system property. - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8 versions after u251/u252. - BCJSSE: Key managers now support EC credentials for use with TLS 1.3 ECDSA signature schemes (including brainpool). - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734. * Notes - There is a small API change in the PKIX package to the DigestAlgorithmIdentifierFinder interface as a find() method that takes an ASN1ObjectIdentifier has been added to it. For people wishing to extend their own implementations, see DefaultDigestAlgorithmIdentifierFinder for a sample implementation. - A version of the bcmail API supporting Jakarta Mail has now been added (see bcjmail jar). - Some work has been done on moving out code that does not need to be in the provider jar. This has reduced the size of the provider jar and should also make it easier for developers to patch the classes involved as they no longer need to be signed. bcpkix and bctls are both dependent on the new bcutil jar. - Add build dependencies on mvn(jakarta.activation:jakarta.activation-api) and mvn(jakarta.mail:jakarta.mail-api) - Remove unneeded script bouncycastle_getpoms.sh from sources- Build against the standalone JavaEE modules unconditionally- Build with source/target levels 8- Add glassfish-activation-api dependency so that we can build with JDK that does not contain the JavaEE modules- Directory core/docs does not exist- Add bouncycastle_getpoms.sh to get pom files from Maven repos- Version update to 1.68 * Defects Fixed: - Some BigIntegers utility methods would fail for BigInteger.ZERO. This has been fixed. - PGPUtil.isKeyRing() was not detecting secret sub-keys in its input. This has been fixed. - The ASN.1 class, ArchiveTimeStamp was insisting on a value for the optional reducedHashTree field. This has been fixed. - BCJSSE: Lock against multiple writers - a possible synchronization issue has been removed. * Additional Features and Functionality - BCJSSE: Added support for system property com.sun.net.ssl.requireCloseNotify. Note that we are using a default value of 'true'. - BCJSSE: 'TLSv1.3' is now a supported protocol for both client and server. For this release it is only enabled by default for the 'TLSv1.3' SSLContext, but can be explicitly enabled using 'setEnabledProtocols' on an SSLSocket or SSLEngine, or via SSLParameters. - BCJSSE: Session resumption is now also supported for servers in TLS 1.2 and earlier. For this release it is disabled by default, and can be enabled by setting the boolean system property org.bouncycastle.jsse.server.enableSessionResumption to 'true'. - The provider RSA-PSS signature names that follow the JCA naming convention. - FIPS mode for the BCJSSE now enforces namedCurves for any presented certificates. - PGPSignatureSubpacketGenerator now supports editing of a pre-existing sub-packet list.- Version update to 1.67 [bsc#1180215, CVE-2020-28052] * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password * Defects Fixed: - BCJSSE: SunJSSE compatibility fix - override of getChannel() removed and 'urgent data' behaviour should now conform to what the SunJSSE expects - Nested BER data could sometimes cause issues in octet strings - Certificates/CRLs with short signatures could cause an exception in toString() in the BC X509 Certificate implmentation - In line with latest changes in the JVM, SignatureSpis which don't require parameters now return null on engineGetParameters() - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey where it can on requests for a KeySpec based on an RSAPrivateKey - CMSTypedStream$FullReaderStream now handles zero length reads correctly - Unecessary padding was added on KMAC when the key string was block aligned - Zero length data would cause an unexpected exception from RFC5649WrapEngine - OpenBSDBcrypt was failing to handle some valid prefixes * Additional Features and Functionality - Performance improvement of Argon2 and Noekeon - A setSessionKeyObfuscation() method has been added to PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key obfuscation (default is on, method primarily to get around early version GPG issues with AES-128 keys) - Implemented 'safegcd' constant-time modular inversion (as well as a variable-time variant). It has replaced Fermat inversion in all our EC code, and BigInteger.modInverse in several other places, particularly signers. This improves side-channel protection, and also gives a significant performance boost - Performance of custom binary ECC curves and Edwards Curves has been improved - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU' allows to disable ExtendedKeyUsage restrictions when selecting credentials (although the peer may still complain) - Initial support has been added for "Composite Keys and Signatures For Use In Internet PKI" using the test OID. Please note there will be further refinements to this as the draft is standardised - The BC EdDSA signature API now supports keys implementing all methods on the EdECKey and XECKey interfaces directly - Work has begun on classes to support the ETSI TS 103 097, Intelligent Transport Systems (ITS) in the bcpkix package - Further optimization work has been done on GCM - A NewHope based processor, similar to the one for Key Agreement has been added for trying to "quantum hard" KEM algorithms - PGP clear signed signatures now support SHA-224 - Treating absent vs NULL as equivalent can now be configured by a system property. By default this is not enabled - Mode name checks in Cipher strings should now make sure an improper mode name always results in a NoSuchAlgorithmException - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding- Version update to 1.66 [bsc#1186328, CVE-2020-15522] * Defects Fixed: - EdDSA verifiers now reset correctly after rejecting overly long signatures. - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException. - qTESLA-I verifier would reject some valid signatures. - qTESLA verifiers now reject overly long signatures. - PGP regression caused failure to preserve existing version header when headers were reset. - PKIXNameConstraintValidator had a bad cast preventing use of multiple OtherName constraints. - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException. - An extra 4 bytes was included in the start of HSS public key encodings. - CMS with Ed448 using a direct signature was using id-shake256-len rather than id-shake256. - Use of GCMParameterSpec could cause an AccessControlException under some circumstances. - DTLS: Fixed high-latency HelloVerifyRequest handshakes. - An encoding bug for rightEncoded() in KMAC has been fixed. - For a few values the cSHAKE implementation would add unnecessary pad bytes where the N and S strings produced encoded data that was block aligned. - There were a few circumstances where Argon2BytesGenerator might hit an unexpected null. These have been removed. * Additional Features and Functionality - The qTESLA signature algorithm has been updated to v2.8 (20191108). - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension. - Support has been added for "ocsp.enable", "ocsp.responderURL" and PKIXRevocationChecker for users of Java 8 and later. - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator. - BCJSSE: Now supports system property 'jsse.enableFFDHE' - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes' and 'jdk.tls.server.SignatureSchemes'. - Multi-release support has been added for Java 11 XECKeys. - Multi-release support has been added for Java 15 EdECKeys. - The MiscPEMGenerator will now output general PrivateKeyInfo structures. - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to make the provider only produce version 1 PKCS8 PrivateKeyInfo structures. - The PKIX CertPathBuilder will now take the target certificate from the target constraints if a specific certificate is given to the selector. - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list. - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards). - Performance of the Base64 encoder has been improved. - The PGPPublicKey class will now include direct key signatures when checking for key expiry times. * NOTES: - The qTESLA update breaks compatibility with previous versions. Private keys now include a hash of the public key at the end, and signatures are no longer interoperable with previous versions.- Version update to 1.65 * Defects Fixed: - DLExternal would encode using DER encoding for tagged SETs. - ChaCha20Poly1305 could fail for large (>~2GB) files. - ChaCha20Poly1305 could fail for small updates when used via the provider. - Properties.getPropertyValue could ignore system property when other local overrides set. - The entropy gathering thread was not running in daemon mode, meaning there could be a delay in an application shutting down due to it. - A recent change in Java 11 could cause an exception with the BC Provider's implementation of PSS. - BCJSSE: TrustManager now tolerates having no trusted certificates. - BCJSSE: Choice of credentials and signing algorithm now respect the peer's signature_algorithms extension properly. - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory. * Additional Features and Functionality: - LMS and HSS (RFC 8554) support has been added to the low level library and the PQC provider. - SipHash128 support has been added to the low level library and the JCE provider. - BCJSSE: BC API now supports explicitly specifying the session to resume. - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is negotiated (except in FIPS mode). - BCJSSE: Added support for extended_master_secret system properties: jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption, jdk.tls.useExtendedMasterSecret . - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is negotiated (except in FIPS mode). - BCJSSE: KeyManager and TrustManager now check algorithm constraints for keys and certificate chains. - BCJSSE: KeyManager selection of server credentials now prefers matching SNI hostname (if any). - BCJSSE: KeyManager may now fallback to imperfect credentials (expired, SNI mismatch). - BCJSSE: Client-side OCSP stapling support (beta version: via status_request extension only, provides jdk.tls.client.enableStatusRequestExtension, and requires CertPathBuilder support). - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around NoneWithDSA limitations in default provider.- Added patch: * bouncycastle-osgi.patch + Add OSGi manifests to the distributed jars so that they can be used from eclipse- Fix arch dependent macros in noarch package [bsc#1109539]- Update pom files with those from Maven repository.- Version update to 1.64 [bsc#1153385, CVE-2019-17359] [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613] * Security Advisory: - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced a regression that can cause an OutOfMemoryError to occur on parsing ASN.1 data. * Defects Fixed: - OpenSSH: Fixed padding in generated Ed25519 private keys. - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest. - Validation of headers in PemReader now looks for tailing dashes in header. - Some compatibility issues around the signature encryption algorithm field in CMS SignedData and the GOST algorithms have been addressed. * Additional Features and Functionality: - PKCS12 key stores containing only certificates can now be created without the need to provide passwords. - BCJSSE: Initial support for AlgorithmConstraints; protocol versions and cipher suites. - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol versions and cipher suites. - BCJSSE: Add SecurityManager check to access session context. - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION. - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility (default enabled protocols). - The digest functions Haraka-256 and Haraka-512 have been added to the provider and the light-weight API - XMSS/XMSS^MT key management now allows for allocating subsets of the private key space using the extraKeyShard() method. Use of StateAwareSignature is now deprecated. - Support for Java 11's NamedParameterSpec class has been added (using reflection) to the EC and EdEC KeyPairGenerator implementations.- Version update to 1.63 * Defects Fixed: - The ASN.1 parser would throw a large object exception for some objects which could be safely parsed. - GOST3412-2015 CTR mode was unusable at the JCE level. - The DSTU MACs were failing to reset fully on doFinal(). - The DSTU MACs would throw an exception if the key was a multiple of the size as the MAC's underlying buffer size. - EdEC and QTESLA were not previously usable with the post Java 9 module structure. - ECNR was not correctly bounds checking the input and could produce invalid signatures. - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character). - TLS: Fix X448 support in JcaTlsCrypto. - Fixed field reduction for secp128r1 custom curve. - Fixed unsigned multiplications in X448 field squaring. - Some issues over subset Name Constraint validation in the CertPath analyser - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null. - Unnecessary memory usage in the ARGON2 implementation has been removed. - Param-Z in the GOST-28147 algorithm was not resolving correctly. - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC. * Additional Features and Functionality: - QTESLA is now updated with the round 2 changes. Note: the security catergories, and in some cases key generation and signatures, have changed. The round 1 version is now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in 1.64. Please keep in mind that QTESLA may continue to evolve. - Support has been added for generating Ed25519/Ed448 signed certificates. - A method for recovering the message/digest value from an ECNR signature has been added. - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider and the lightweight API. - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539. - Improved performance for multiple ECDSA verifications using same public key. - Support for PBKDF2withHmacSM3 has been added to the BC provider. - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a hosts name in internal MimeMessage preparation. - The valid path for EST services has been updated to cope with the characters used in the Aruba clearpass EST implementation. - Version update to 1.62 * Defects Fixed: - DTLS: Fixed infinite loop on IO exceptions. - DTLS: Retransmission timers now properly apply to flights monolithically. - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites. - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting. - BCJSSE: Handle SSLEngine closure prior to handshake. - BCJSSE: Provider now configurable using security config under Java 11 and later. - EdDSA verifiers now reject overly long signatures. - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391. - XMSS/XMSS^MT keys now encoded with OID at start. - An error causing valid paths to be rejected due to DN based name constraints has been fixed in the CertPath API. - Name constraint resolution now includes special handling of serial numbers. - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has no backing array. - CertificateFactory now enforces presence of PEM headers when required. - A performance issue with RSA key pair generation that was introduced in 1.61 has been mostly eliminated. * Additional Features and Functionality: - Builders for X509 certificates and CRLs now support replace and remove extension methods. - DTLS: Added server-side support for HelloVerifyRequest. - DTLS: Added support for an overall handshake timeout. - DTLS: Added support for the heartbeat extension (RFC 6520). - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios. - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK). - BCJSSE: Improved ALPN support, including selectors from Java 9. - Lightweight RSADigestSigner now support use of NullDigest. - SM2Engine now supports C1C3C2 mode. - SHA256withSM2 now added to provider. - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs). - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS'). - The BLAKE2xs XOF has been added to the lightweight API. - Utility classes added to support journaling of SecureRandom and algorithms to allow persistance and later resumption. - PGP SexprParser now handles some unprotected key types. - NONEwithRSA support added to lightweight RSADigestSigner. - Support for the Ethereum flavor of IES has been added to the lightweight API. - Version update to 1.61 * Defects Fixed: - Use of EC named curves could be lost if keys were constructed. via a key factory and algorithm parameters. - RFC3211WrapEngine would not properly handle messages longer than 127 bytes. - The JCE implementations for RFC3211 would not return null AlgorithmParameters. - TLS: Don't check CCS status for hello_request. - TLS: Tolerate unrecognized hash algorithms. - TLS: Tolerate unrecognized SNI types. - Incompatibility issue in ECIES-KEM encryption in cofactor fixed. - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed. - StateAwareSignature.isSigningCapable() now returns false when the key has reached it's maximum number of signatures. - The McEliece KeyPairGenerator was failing to initialize the underlying class if a SecureRandom was explicitly passed. - The McEliece cipher would sometimes report the wrong value on a call to Cipher.getOutputSize(int). - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values. - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations. - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which could result in an exception on key pair generation has been fixed. - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a SecureRandom and will not throw an exception if it receives one. - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted literal data has been fixed. - Several parsing issues related to the processing of CMP PKIPublicationInfo. - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors. * Additional Features and Functionality: - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider. - The password hashing function, Argon2 has been added to the lightweight API. - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS). - BCJSSE: Added support for 'useCipherSuitesOrder' parameter. - BCJSSE: Added support for ALPN. - BCJSSE: Various changes for improved compatibility with SunJSSE. - BCJSSE: Provide default extended key/trust managers. - TLS: Added support for TLS 1.2 features from RFC 8446. - TLS: Removed support for EC point compression. - TLS: Removed support for record compression. - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04. - TLS: Improved certificate sig. alg. checks. - TLS: Finalised support for RFC 8442 cipher suites. - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms. - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms. - Utility classes have been added for handling OpenSSH keys. - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API. - The provider now recognises the standard SM3 OID. - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API. - SM2 in public key cipher mode has been added to the provider API. - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital signatures for verifying the integrity of BCFKS key stores.- Package also the bcpkix bcpg bcmail bctls artifacts in separate sub-packages - Revert to building with source/target 6, since it is still possible - Added patch: * bouncycastle-javadoc.patch + fix javadoc build- Version update to 1.60 bsc#1100694: * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code * CVE-2018-1000180: issue around primality tests for RSA key pair generation if done using only the low-level API [bsc#1096291] * Release notes: http://www.bouncycastle.org/releasenotes.html- Version update to 1.59: * CVE-2017-13098: Fix against Bleichenbacher oracle when not using the lightweight APIs (boo#1072697). * CVE-2016-1000338: Fix DSA ASN.1 validation during encoding of signature on verification (boo#1095722). * CVE-2016-1000339: Fix AESEngine key information leak via lookup table accesses (boo#1095853). * CVE-2016-1000340: Fix carry propagation bugs in the implementation of squaring for several raw math classes (boo#1095854). * CVE-2016-1000341: Fix DSA signature generation vulnerability to timing attack (boo#1095852). * CVE-2016-1000342: Fix ECDSA ASN.1 validation during encoding of signature on verification (boo#1095850). * CVE-2016-1000343: Fix week default settings for private DSA key pair generation (boo#1095849). * CVE-2016-1000344: Remove DHIES from the provider to disable the unsafe usage of ECB mode (boo#1096026). * CVE-2016-1000345: Fix DHIES/ECIES CBC mode padding oracle attack (boo#1096025). * CVE-2016-1000346: Fix other party DH public key validation (boo#1096024). * CVE-2016-1000352: Remove ECIES from the provider to disable the unsafe usage of ECB mode (boo#1096022). * Release notes: http://www.bouncycastle.org/releasenotes.html - Removed patch: * ambiguous-reseed.patch- Build with source and target 8 to prepare for a possible removal of 1.6 compatibility- Version update to 1.58 - Added patch: * ambiguous-reseed.patch + Upstream fix for an ambiguous overload- Set java source and target to 1.6 to allow building with jdk9- New build dependency: javapackages-local - Fixed requires - Spec file cleaned- Version update to 1.54: * No obvious changelog to be found * Fixes bnc#967521 CVE-2015-7575- Version update to 1.53 (latest upstream) * No obvious changelog * Fixes bnc#951727 CVE-2015-7940- Fix build with new javapackages-tools- Disable tests on obs as they hang- Version bump to 1.50 to match Fedora - Cleanup with spec-cleanerh03-ch2a 17385999501.79-150200.3.32.21.791.791.791.791.791.791.791.791.791.791.791.791.79.0bctls.jarbouncycastle-tlsLICENSE.htmlbouncycastle-bctls.xmlbctls.pom/usr/share/java//usr/share/licenses//usr/share/licenses/bouncycastle-tls//usr/share/maven-metadata//usr/share/maven-poms/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:37066/SUSE_SLE-15-SP2_Update/1b69562caf1bd6e1d5b481073ac412dd-bouncycastle.SUSE_SLE-15-SP2_Updatedrpmxz5noarch-suse-linuxgzip ERROR: Stdin has more than one entry--rest ignored (Zip archive data, at least v1.0 to extract Java archive data (JAR))directoryHTML document, ASCII textASCII textXML 1.0 document textP P PPPPP P PPPPP RRRRT~NJ;Ĉutf-8c567beec39ce69a7e93b0edd1147b3c61d534df6d1eb144139308975100c2594? 7zXZ !t/]"k%'+ woBܸ4/> m:Q2mc$A: Zeݝ7ЯR7VrwӴ`> N]$^{l ? D »Ti \e.Xa"<}>6R`ͽ&C$q<b;?F)WVhI.\F QթdGmo^%naG=1Te)Eyy3;toVUKQ--tIgI1&ʬ"$lZDeyqE# OuhNLp9'Ewcn>zO"^i Kcl> C 8ߠsY&3a/ c6I4kG?Ik]it׍._"z4q<U9~S/@QJw5K_" 4}~,q›i5>^Ŋ{ЍA;"SR$ˎ=$Fb}׎Jxq ^$`{ʞ`^Z mHWᶼHFB&y[ .ZrP1}eD[4b)0j?c=@`}aT $;`0z%s\$@'Sd2-`N_X_bF, /#x&/x@ 3=# LL< !+"T]`X 9sQAʄv^@rr.GTcܿu2 WEIW( )GloS L<-Y߆m2%a{Oϒ- hw5`(ژe`o E1FAZp{Ue٧1oV"%?W[T#/w\)w[@<"`.!_]53`UJ ! >QB ;{x9ւ8Pl Je/ݐp @KLI0o օ,Aq(.cKp] G$rGK0_P_lqv'K viJ5ONA>;dž̗biddOtm_g|@ou!Z5}9*FE~B ֲ)8žN)ȴ*8mv/y$OK&KiTDdl.~Q Z] g(T7X;}d)!gPRlܚMbpmԯ8lbaqxν8G?0 y8 ^$ )vj6EK}mcMae}ʉ@ Rc䈃I"l'>ѯJ; s2 R}:=|@UrsT_z)UyTA^3剝&?>ʆ[!%y*řAvKbs U`U3~n2SݑAiOM՚o3yf[v~+Vޕ}BAFOTf%<&ܠ`xjDjr+yk; : XỿV`{N('MTjHXUMldw ْ06t8G\4)VkAMR!`撚cZFT w#[,~8Ѷ\q_Z03/+]yէ@)9e N*bv]EV#W^;VGwBw] Vh6*Ǘ@~ǃr¾"im"Nz\Lշ3R9:\8,Mw@ҊZs'$ 0}xP8 \_Cȹ(v=o7A7Z/^)} D3黴*HG 4c8|~YCg5X]ET͢G 4$/s1A #'8R%̣Q!QT>q;IHSZ'c0;pѧHiTޯ8z5Ҿ:-F25TF?9ɲb9(z]eRu};\Ēg7aO9{0M\z9Zg,:r!4Cd5A='̗gUٓOEvTbBN_bYX&y-2*>T`}lvk^Š"): Xk?-e`>A[Jl1Fgnv kT'^$F:I j 3{ "BmbUNA[o!k{9*~QbccCWl`AR繌}mdR&(K\TO5K.J2{lt0YLFmO\a[L`ŒyPHjZeB5s(kZ?+S-gexw}]$6¨ ٿӏ=ZuvĮ*v bbnnZ]CM]Bj95{uElˡt2?'(HV kH K[TSsv*^[I9+s҄M;QfJomf$b7}60Yc.ҡt&9+> U.ߞJ3#g"(B1D?^OQ jR>'.]hi{wS'GVL: +*ytjbFuxḄg_I͝tT}I&͚@7s HWžavȸЫYV,zɯ`RAt6+=,CyѺrYVB}Qp:bCި1]  ,DNv &*p6p+5-Uy&NqяG"d4;/wfVyt :4v  f \PKZ&0lxOൻ#GE|Mb[ruu B]lI-/MZrQ?^ #"`#|SoU[ FxT ѡ1)V[aT@n#󻴑6ƃ=^hipŠYf>?kSLQK$#UyD2E!]t`.fR.}J}{07AxuGM;dƨeKKr~ <6k:L-p>@Cc.a#5eh1m)H - IMWVMZ`G0݂vBL뽝aN_S_\/S`YysV;@vxE:ۯn6h)q&Li՟Ť^2) 90ZQҀk4^ˌo~bwHS)Vo%%|1/<'oXoעw5qțZdx6<0azܞdȻ +~x,p^pHbq+ lg 퓶ȗYv#dpvH>S(A;JO]%?Slrzt5.{U^E"`9U]si4mf؎&t"(r:*8;6lo{I߈x/oLOne ]IiG+ @9CesKPN)[eäpMNdK&9֍[]!k<8 ?ETKèߨ.pnws`W6qlI(ҶA?IZJ3ClyjA~|](&j&~`vtMq@*F7_rm;^_}u!mq*uOmGCJ*?r9,쪷ZŃ5Gv['Ky8jTVѠ\bvg ~3Sx [t`KyH sSܹMo2D8?@@{s=+ 9B$n?JƮ܀ceNƀnuZ*Է&ziG@mfLCF l^粥c#$S(\hbK=}C# mۺ*Г pm!uNV> ЬFGHb yӨ#4$ej 4]՟W^p7U eeeRTC"XY;KRVb?tĦxGےӣ$QݥdL8r7, _bp{7eXDɎ&hF){&ʞeu1fL wUITm9nd ܯͧ%gZ@䡖|R#+%8N{-t#h~Rtg!.(es%'K6ԁA)B?Y/V~O\Nqԗ:L)GwjAWb^#-J?m@oc2M.DJjL /2l\!uKRV'< 2}䇂ɐAn- ;dG (m6 }ekXOV0? >eH֧Qblb#s l:$--X.:͞@&|HIX亄_eZЉcW;m9VG{Q)`4RB 酐ʕhfV#QOnviMt*kN7/Uih*=o. (x; CJ!:e?,YN{8h1=0K\䏈樐pw*5ya~&jF<)@(B7p)Ř =[=uh< Eخ#'Epl 2\r Z=e-PO܏}cpIqɌXu).ۻ#Z<tJ1ϛK|2, -׶?_zGKLD-XɆ(Yg7@!Ǖ'b,~(y4[ 񌉰!+'5r>B ^J M :*=]މm`Y0 -Y,7 |ynx&$@ {"d˚'fsXEMxL w}#).HH8\(cKG$^0 ?Jj>ƇT˜%zyÀ%f_Sdg٭- ~Ǥ#FI.XT[b%an+1^|~Fv udKN5f~noZj0D??ḩ <)=~2\+:9a./a(ϼ4S9VP*Q:d$ L3\c]p =Eso0$A^Qܴ* v}~Զ8Y{(s2/[ids$d>>蘳,]5"q֖ Sϕܦ)+PWD/)@& }ƻ&zFTq9x^1Lbw"{<4aLȐcCI3>:Vmȿ@]𿼎S#32Y@Y)| +Ǩb _b(&+PsA֊*/ճ^SAi59{t/W}n~O>Fk`v߈sGXD+5<K̑@nJ6ٛdޭRGrb&}{A+Ll(nuZ2%23w3*bA)i*ؤi[Tm^:Ȅ6du.+;SwҾO@l󷷢7"|!DR:ѥ dc675Cڏ%zMe%~)-LuB؍TLXM X^^toתANds oK}d7@"EoU\_z9uU$@/BRYTů z I٪}HVaGRvF04ew3KIC i|gYfT\al~X9GoV3wF%Xfﰾ=;$nS֙z*` aSo 44085 Y0"tXGY}ǩ8*d~6;=xN-{~lq U=t4&JR5kY5u&+M'h\ޭQb#6`Kt#ýyAX dqakF '3f.|Yh AbfR4 d~4{b-ȼ@{*X,G x`*`oA7x){GMgZ,AlY`Ce(~_Fs_\pPtPۯsߴy%&-Z-so9ҝO f_ ~+QBIaRM׭lԂa.p*ojO-Y鄨v\aqL4;LtD(e>vcʎ%( G}^0^3!+$dnƾK E)ߩP֦{smc@^ܶr/sr %-\nKLIAJ9 /TJ QFZ1ƙfrOhIϔB|Qg jluW^%> ނNE _xE+N!K7 ;A~/eJ%Crsm7~C$táߏx O"K tI0L٧UUkkxl*x~|uj$2`3sk.w\c>OY2G׶ 6-- !-4+ U(-C`49ͣGyL3\g,a|#lPeho'.(3f9УTJW5`)U`H:{\q)3%|O06oP1^pROFgw/c:*Gf{㾔Ȍȝ+=pٻض{ds z0 __,nSWI mfRq9#dHWGј2<_DފVgjжJwx4Q=>x-Mt?d(U?2^Q%xY&&ېʕ޿c:^}q?`CGqk)Ruʊ@j>C3vA3n]iXi7t2 txDbNF R#٥$TQʕ6򦙳۷9Y{aK1wFx z:CJ{PetTU|urO#&%vjk XZX3I|K"&LO>ɗv KـcUIʮܩ{f&h*-SfqY*[(aj2bb#^kBƠ IƵr]}D _`V! ?*@Hi +A1M"%]XBVӑ0@{iM,*ZL"k `V`w[Z{\2*2r?Y̿o6CJGP3q-6{L 5`eg֋eHO@r45F[n,O(u+y\&NrB*dΤ/A@Y'=ہJ:*eHQRQalygi^=&.,Cn'b&]lTGN L_2mxlrk~ۺLc*^LV?LOUJ Ѷ'΢oGr5E \n?ְ$3/)? 7Oi%03r*H_.aYJsr໎%ch2Xq`^6!hA(&*d3 mnNaUB'SqfsڣM:0AsA_eZ|R="xuX;vq-1BA(S"[qc}^~'x ",/ O)^ Yo"C:Hzg0Y!a\vqv`'m ސ;im2G7I<0U9(P6VK\AػEo dHb X1|wjң%\"%`%etwZ+wžb>眚b1sk z 7(B~53S!:E! hhε],-w\J.)nBc3J1RN^G-cU 伞:69)sX,ArK.VIe&%>S-F@4M6uNC%_,h A>+9;W`t\+C/-ڿX^DxS}9pl8;bP.;"{lp亅+3'+:D?Nq[+lKB:gEJ̍䖻nal cMڱ&$\vɒKU~,c:]WUH-kf@`/^0/= iPhAQ+i%f? Tj  (i!5 W@?z)&$і6t>KXF~泜qhմi{i-C76p3Йk\1"U+TF)6ڻ&'c1;.Hb ,䠅'.wIs+>_3ne+C:21C؎,8j`4HRTA]#P7h>H. JZ0g66u:O|RptI`szˬYNB }th|6EnP2~tni#>Es"Kf؋+Zǖ5;L4VR:!)SBi"_eObb2wbG7TetgǓ׎^f ä >tǗb 1r6(5GRkfŸIKfXnapô7XV)*ONPJ!t:g hyӨ>wEor/BvA:l R*=`XR]Za0<Ƹ튱f.F ZI" Լo76:Ϻ2LP)λ0&fœkqXV,I[A"z!(M(yK2W;2VkkqǢi,GW<[5>t] H'f[:`*o/|\D^S^vCkLp pa!AϗWqpÂ׻0: ~@5FNU_8#%i~Pz0LR=4.Ozï@f F&lZ ;@LdTo3[?`*{qVLvi;EtU;B>3=LJ"Bu1mƇ@6#7urԌ*,(MX+O֬HȀq:ʱ Ll8(ĝ(܄ ,`vK+="zg%@+0 T:5tuK ᵎـYaIO[1::bf0α#Ʉ<_Z*}`a4~QQ0RjjJ&{>&mw,Fgy{0'9,l!쭏 $yҍM m5@Pjh?ŽQЋK=n)o"jVv@hg˹U1{,O-}krViuS *k#(+U fByae3mbl ,w`s]+d8Z{tń5x}9 4(`7tWt]Z.l#gX ؊OiQX3/f+O&11 C42x"Oc\wuv.gصDkw^FWty auNn"Zhܜ$7;DQF\һF8N*(~YE{5k~|-JİUϭ1ԺKŒCK-\acka Ι AkXHjrG> 4PwQܝz]ʼnZt%1hYJ<&:KKE,{in.}qn(\%;Yp`/Ibf0ӎe2&?QlJJ7t#}lyP|IӜn}9JtH@MrBa> W`IPuXlĒ`-W cSi*COhr'}+`O)@"{FEMt}1 G}q_A`Ngn` D~Υ8ҎDbH``Dvj=-T>Y\Oͩ `s4$A)ACn*, ǒOR%fJNV& i+$b;&^?";8yόU"/^wv7AhWp `z`jq%[,N[-Gn3aY9^嶪r}zV'M$9ܛC}A5,]ƖH`nk|Մl*Fnqb.7{ÓO;gx2YЊQ%P(Idؚ|PYH#4^Ksk'kf"Y|ʪ"Tlt,_,*~\-x,wf΍'wXw۠Ѽj4``?#4 G~w5yL;ʎd?s[j*}z=`tHt׏5R?3 s! @ny\[Kzݖ7PE9,8żkiSz #mXgqvMYy~ƸUZO:!2<X`M3~eZB :A#?],r48)5ގ!i?Ku/dTLHE y#1m[D!@pRǧ^A[4(v8F8؄!=>T)2wk~.D"itHm3|B5tFI!h3L]7F"ʻ;`m Txw"EyX)FeE4`q8Ip(\&`wY|]?_S5.@owk 6R[(ؿcG5| aJUp qTxM slRZl\x&"IĴ7eI}" BelV,?1Aj7n_ЕG kX!1aœ"az,Rb]!z4DA]~SrGxxd_p<*)~T 0"rGn4{[ !oƪL 926vn8d#8jv8eӶ >We< ?Ka-լG阓( $XcZ78/#y4:6< ܫkH|UpVR/|4j`! 6qHW ֝yNa ۙ d?c#aX*+Q}Es\$T4eԯiv(í6r-YNAVİd4c_͜g?왢K<V?t<"9;U}n]pRs[ Ds\jqAP쮣ڱ{XZ|?4@qpƏn°!G֛d]I'YRW #lAV1ThN1 =sX_hyq"/a#S>˒&"xBݽL]jr<óDB7c]h#ҜώjOroNO,_u?E[ g mkNf*rt)]5.}_]`Aue+ h rݙ<nI Z-Ool2?&?셡MTS1MCG[.RvY{@I6:Cv'4`d aƝ JЅ p v9-c늍}H]E,)Zbҥ@0" ֥BL+)\ocpf4n\JEwQw٭f({ B?{aY7Oj] BwicC&տi0ۧJ:-vUOopbadBnH SO߼s.f  Gv?:y@JuTMjƻ넨,wELmg/IӺMeM{&Bcԇ3ӑSq!YO}vUWHGw:a y]4sG!*"vTu.QӃW`5DZ4Q#CsIYkrv%zz ٨&AZl rNja9KeIB'X?`'s^Μs d(/t?8utfgy=Ί6 j! 0v?q|0w(-޺ ޟBMQ~ǂNO/N` P2ef-щ80HF1=i"2ß(蕦C,XAP; MF ӡO׍)~_F;kfsW)bz 1!Z6.6D$@E|CVQI|EG_j}zga6:>埐Z"PzEi.pM~Y3]׹6ԐqF]emLOA #S\OM 'U-CS\fDךu18'`m >7)lUB>yAA!V\خd'{Ef#%HoW3TOheP@o?)  $:zkr4s&JO)Q}b[JA(b}=P*BAHBJyhϋ4=7[UTr.ݙ;9lL-&Qf,^xP^qA]KL`T Ǡ"=fh,]Pɧk-Ҵ^L j F@JLt/Bt"Sg)inphߥ|z3Bk, d{sQ1maGSZ>l'E!-(KEU&.0+a-y`\xB[ہljpC_Ac=R ϟI4ƕ} Y<4$.QEm5E 3eĊ{'ld8hEZDUO<1:4.m>9$ph~37"8u}q) : vtcWă\L{ڂ_[ye_2qXR䧋s]\\W l:'<qdLcSsA{T7߃ӆCmPau{( ?% eA˜Zцe=G]A۴pFfꓡ sDmbhVa|;;;=9-ҍ3X[BgMoI$U;=bƜT5rqpoҺěwET[ryۥ!_a+'_Rţ%)=G/O"z^DuKޭ]!\/Ȣp}]7UT9tvW3u4-VDf%'vV4pn\2wYnO7;VAd^OY2;Rq$˸ A{c*^G6a,篼:eq&܏:,A%gT&Uq8qK$K6Kn -N&~v[!JQ=^j$a rblLdMj@}p]˴um :v`*5 }< ԑ}ȉB}g2HEfĭr 4^DCi*|;t_y(j5Nw}9Iuz@ܮͳdj6^ԛ|_rZ~ȏ_8?:벗4sjx,,1s%( A`n-X94Y>}Y|>_CZ۳[dP?;(و8k4w19l? ЬRȱNiTF@q/[r|ފ'˳,})@>W$JxЖ"'Zծ7WV^>84@WOv QP}V^8?T!8/fm?Ưk)CFbH^ӟ*v[*',5˜7'HW+ǏbGAi4!yɚ]CYT'9߉C] Q/SʕWįߵ~\jY0(C[]D (⺰򛴕US6Z*kT+'ڵSW)􎩪Ž}ެeM%Q=D~ZFX#Y %7`JCe:a~}C/WGVdi+LdT,mAF*BDlML܁1Fqʢ0]*i} c*:NINwjQ@bM}6t% ,z^\;|VJQa; 7Q)o']fd\1 7gVO3L: !1Mv3렬MVĬTF-W',KH퍇_n7 = ȃD҃˃IKs ܾ0gwG9 qf0}vX'5FEJ՚i|VjX˻æ)zUQH49ZR(mv*M!~%>vֲ=c0Z{8Щ,=FRěw/>bvhcI:0RhoHڄCJKdɷ y&0z,Cq63b@FJB[R͘O?!NXѷ! -DW{,r ˅CP7)TWvvU<#@aU2 b `$z͉5#YJz}L2S|;aqJ.ܙ(jYB{ÝM*wqXG,{zR]|y`((a")w\`Z @G9"?&6Uម("6~BK' G4xvs)]J$dtFA jiV!6#GcLp;O,AGvd.`dTUHh{h"A8ͣȧȆm60DLq.z@6u d7/<e^VSxUB tNxZ[32I>ؖ{sP+[]V;}ik-FQnQۛgb]{߹Q-~n|~ES!h>L -c ]eEe7O ף:(œ&9lthtpbR4FJ .$vkQ N&R 4rpcaOaG&] }r@|rJ)f5~ŻӪ(wӥ`ޢ̈́*hC<ejIM82Սia/QmS@EYzvbX<$G'\ُoҳ!*0rjB1Z$T`P1E oVVljPA/]X -H]G\7 ڄ؎[ 4@?ĒzŽ;J}`}IR-UE2*.dËJa}fk%G,Gԁ}+N%;ĩ~Ϊ3xn4 P%=y ,rڔr f!KbǸ5;&=욻!r^- Yv=/t8lNhUT= +~GO']co* H8j1䱮DýZW1@m9c][̼FVqpj u;,*mJ4ɁO;@gόF26Y:EAh"AkQRvj<51KE\,2,0u E0\ # 7}b8g?`&÷L{CM$.}. 5❫2au3O#Uv>H9$"qe]qUI!фp.6)˳pj(r m̐J` Wlh Y{p|7ij@xU(,Ŏ8YOۻw_[J눈vh㹞MĩN.)UAw{-K pa["pzm7 q Rg(ohwYg%)LZGش%+"( ûw߭2 Pw N;ҊWh3t&|`2g"^W[|tR4G|u0}ol4%#|D[嗀%ﻭi%]}PtToIQqx$;Q1!,Wqvii<RC{١&yp8%BM0v]. Z maMjtރ<)i'!4F5gޏ4?#/1M6EJB UC6 )ɤȐzR9C:y'*.:ь x/  22 'gPVc} ^nlD~p=Ww7Gͳ6n\: G߫U4"O5oc^ {~ p]gkJ) f?٪ , QV /G^OLB^5 {cdX:fMO| ϼMcJ?vLs'ױVy5ݳCi2`ʼHNTs\yog:!2*64U[*g*xfz.1{߮91ۜ7e_s+F2}LOk $,aZQI\-77U(RU:~AiP)r# *{]6cE ɞT"C8#ǎ$Rě mbnÛW'ͮ'NYv4?Nc T E S;Y%-+@sx<LpL?:V)U4w{rEI=p&{TZcyd-n9(" Wt8x-2Jl_SYM~C\l1.21]̰b9h]%bu?eh A5ށLH!쳖8/KY`^(ew \{cuw4-\>߷ȇ:xA2 oܳaϽæ߈~b?#j2ȵ>ir{(z}7mVK>'K=_enOM3/PܨT0 WUH86k9} E0xcu }] A7u5O Qb^iG(qHb@dqiB xccfal>1eݷ[$l+$Ҷ]3~>iqGՌ53|ʬSRVOU} WICgRT"9r୤vG&%K <BFrqN+Zd)]L:b0l/240zx]ψs(xHj$/,DMs {Qpi3wvZmWdgƒȰmp ڲޣ8aㄒP;@Czmc SCѕ!f&ӼX` PV˹M)?@M:Jn[5b3wNnƕ.Ewt[qbW9xQWsqTdPڥ`-R@vC$IP-w4Uʖ]ʉ)ib=$6l05- "vIT(xa<}B#/+DP05Ç"7h\cyIKW?kzGΛ1izɥthZtC6 }~hrE/[H zߵQF r!ԛ],9 Ѡ qQGcAI1m8QA`!͒=*H[B6+6?ՋwWCQsɞFI_d#. B8 !VK50[DsMG:Q]@>w{[^I9*U}m><_^zAla -\Z.ȥ)"d?b˦u?V+0/$Xy !anDqNu2]YGż"kK)"z ,8bD`0 {OPVddA|ҵWЕZ6{#3|YKM 3/'o{{o,TLw>#^ҫk"3^^6Q$jI_&\[Ky\h.Ys yܝ~n9h1ח|bwGG|\f?| Tǰ6|ޟPA2>%rנ$b̤ⰰ3BJ}XBcֆ]6%C3қS_Ÿ9,gpx-F7,UEPp .čg[;{N0_d\)I$V0 zVMk2?;$vɦ5,##Gi5=Q'N׫Fof3;?WVlcfUـ}Ԧ'lU'7οMxX/d]Ur8w,aN7ӔyB*ג헾&*z$A^@+׭r~{ O\%U񺉤6U:j̾1shѶ&ݠa+8)2p~_ HМVx(,#>*ΟBջu"((uVS Xl̰F &wc8^ :ܔ[vK{}N`=BbnH{+gs|{sFe^r] #"RzaEPF}iı`ٻ9CA.PpzW.63抧 7!!~C>V(@+ܪcA`J>Rr~@#Yס! GBVҁjH.Ifxf>+ǎoqO6kif\cTתFEp{y}s˵!%aMC1yƟq\G X*A[sUVbqY6`p2WMcJdt5?@EF BR[Qi|)}׬5 ْs%fK8R=E)MƯ)ៜ#m r䎻DߐlgГ~0J11LGaPaB!߰ooy "]`dz6FP9L2,H3;L;9_ Nʀd@1w)f7BOl{QBPZͱ&2^&0ZUu*O ~?|Wf4zX7n:bƂ=ol˚|bPBZMHKO2kc}c9:Vz+h.v2w徬AƐ癶N`5ֽ`4#vLaGA̸ϜJ(G؟(H# elZm[3?P\$ffcF\9 4g86ޣ#5{)N[&j=G`p `Q1]zNx7á4%;?S _{9g_qEWS%mA=KMif\+?36Ÿ˘٨v!zpRh[mj{ OSEGT9/j29-L4!K7S|kv]l@e-$F !V9_x :E?pؾ)HrBoːAwnz?cOIJXּ6oN^iPL- mhc[T g/O¾Z-t%o^-7:T2am^T e@S-"I̿zkTIwyr/KFtaBW@vh\ ,0K`[* >8|amggE  H],6P as8ޅ勉FHz>6qN1J|l[ՊBꐉ#i0F0 nzQvwkpC'Y;8y/J2hBƐYWXbW& <' ?ߨnm3``hwd$f|Pb2''/\~ \:)X?FPBU8A)~_[5qqȚ-7RV4 d;8coe|`3ґ@& ;0QHy .%'ak-CX%Uj1ɠဠ45C +n䶂4ؼͯ) M77:$T{aLCǫl~t0`X2D<%3ws+}}:b#I5!kOH6rCB\QAJ3t!0gKZy p<!HM-_t9;Sw8$&fSEWSͳw0ĉx#ώymQYZ9uSQ0rd!"{q>Nyn"$5#Q~ftxڰV&,a?ѳH tK>o#{h߾nbMΚq0!*1]Pu:>͝Lh斩k==@<qaˬA.cHg]bfJ{\+iZVn}pp~UTbBIB єS,ϗK]iS; ,,"|ߙ4Jwv-sxK̤Ut2 ~C 3'֋;("_ q&\m.T{])*'S=J:YjuhL(d7gꭢOH1`k/[\B.ͤ4p V#HXkQ .C럱|!oakE-IeGub ޾nBݱ,ʬg`CZ$h8.#Nк".N*$z*c"!A޴fP_TeC@:Eee$v/R=,r*%~٤e6`d>%6so[8r؄ =@oorަHnr:{n 53w/졲SU<:$Ƹxbp9}b0LXңUs\ Xg]8va+%2w| Er?)MukL2}32h9DIM9_Yځ'Lh ^>Ȣ搹w4kF+weSN6YdY+~F}@}ms Y3\|b#۰) <*opsj%)]V]+­:|~^sbNczTihNSqvs?8^Z&N߳ 523%5:Πl) ܓt4~ VM{h-eȰnhQΟ[7"F»/fa?f,;d&&uX;IQ{^ڼU-z'{ J(TZ"n}/.Qњf4eg/\kxju!5/'0\x@vMl'e+|;UG&jZ~{b~lVH{!+cV?:!,22#AI^BBf_U`D$sSjI2af#rACXU`W*V*gh<U]qŨˢD'w( Sy2r9UJ{2>@ȟr[ݖCRA_RT5S\ث?xvrN8lv%}u `(8ih4`6 g60uMJ5!YRV7²\N~L>{clOe<05{zw?;q/>5"/f$_ryR(iHgu > -3!Dˎ>I⍀ȢHcq/5ceڂtdhꀙP߸#{7)3W{g39 aIJlP;w^XN ,A+@@S9ew[7Ms&I`"t1/~=hoHz)M̄2$u /.n.] Pa䛱lKuw[ W_&R :1uD.mxȥ`DY=mVH\N! $r eE^ ) oW"uE3%Sjט% o`jQ:[ | ~@;X+bk/WHUgٙDdelĻoK0A Q# mpi{G;Gs 0kj.W#FZ0HL˰DBUN䒦 NB 4;hd(p r'!K&QF)(RTG CUaڍ82MǓ4fdQX'6b)I뛌f+Vl+uߒ$Nj˵:jXK%S^E]*NzK R?L:4i#WEɂ4@\\Bya" /+IAMoi83a@YkSr5/Wa`< ԆtWLw[B9eȫc {'ͼۨncͣ@`ɇВ}B&hieդcLr8'6bi:b4 YAR( Om̚l/R$sC 7u=h @dVG#NhPI傉kLm=Ͱūl[{)$TTiYuYa [O.WrwHj:df!o" @رRCGyXe(`I8bok4fPXBg$JmK3M9ۉzՄ*h\s,C\fZ?=U @ Pk@ qS Pf PB7nkTpuL𖟛}-öSRe[n6|OP2\d`V H3.Zĉe7Uc? h .66jgsa"VHpSdK&D=~L3}/Mx4Xjy|ۨd%SP;c.g,Nĉ!'&_/VqD|J99fĮD] N^ ). -6 ebb]ݔ$H$8 % }`(DRx"8) 7}!# ?BV$J!\ Hr_$Op;aCz>.ov 4$ !r%ZBG0^י.GOv6bǫ%(ep(HOd5mʎp7 mdH19,7SyPC G>//0JZ0\?(eXDZfXI F[sL]Fd< "/T*gG`75S:DX cv֜hf>gٴu2~C[@k#a#(!r-#w}t jޟ'{UUCEVgaa7 hFg&dV=AjZcEn:f~Uj`8uZ&-8zr׌E%@ښF{P$e7t.rL?lLfTp2޲9r*Beg(ĎOӼ./ߔZ~\4:)hɸgG.-M7Le%UN!Nd$$[Iz|}H ^ +/O<;a\.q;)]Q1U8;#rz-O0SOS>,OREqt N[R_~yn1?j,׾h&tDW>Ԡ=?4U?[]nd` Mwq:Q+6[=OS/)Yz z:hFA>d\bg<" zXPNܡTaQza|;zg!#kls.b!G;VOW0 VLJnR1qUW=:( MW@\<C ,SFt2ܒh`M}m X5hieOgzI^k9q\) L>Aj_u4בsK$$kksPx+OKX+IœO8Wj`<Ɩ8jX>O’cRv ưͩ߃u' 825gƁ ,DŎ~Ir ]# 4Rj/ aME9ty-<-w gmC14?E 񩡓t!#޿\g (4Z[d([ͬ^NsmWm-B'OiHxwJšfk6CsII\n\[7iE 27|m=w  ӧv+ClYyUj!%`TaKZ1cfoʔcvC kWI|+3Nռ%dZw"a~:e9{2 :JxB Edx^*_h'H0"Ɛ %p!%^&32I/-&6ꀭ3by5<<0ZZyŰ gYrrdJ.jaU 'Oh@1a GDW[xF2 kHnNV+4d++4`q..s%3^QݐBKw,hA b-b,bBiIkop`<llnm+-c V4Awk^Qۂf57fE#1%$얖F{b[ z ZEXitJr6,TJ٨:͑cgKEw|QEt&(>\\$ bsFWs6f  hfܬ~1rψ/"\ߚGrL:^plyrw}h]I0 bo&/(m:%H#CN͂5 ߅a(qZ% YN{g1f@JN/(HIyO/]̢lV{gpET09KDS~iHǂ9uymFNF.1 w/qhڜDU*64{O³W[D=mi(ɽtgu/$WGZ$&{U@|6{&X3P 2buDx x!V`nl`J{|8*bB&&`v8E00G-ua(lv!{Nq kB/LtPKyL*1ꬢP:i7mlᓖIhJ OH+vşg#r8BGQ[$<˾NܵE}TD `M%Yh)8)(=3)!S\tU,V+*LǭulciF$ %vP9U|oGϠvS32 uJ)|i w4oJD/$O!3x1ub0MIk5hϷsu)0]@SQv!&1X`=Zgqנ*Ko*6A1=;;G]r?<"5%V%lcrS^5M~Ɓ$?0,3*>JQb(l^Q`V` s4a(s0_t8&!߭=R[\?J,+fLZZ>!ke ,5(:H-mRl5&&`#Nu/ |d WzmRq߫w\_3L0Z X{v˲y3BvBv}I*H|3!Oazz2$NsM?`}_,W7vjoH;l68߱g^0; H^8YrF}JMϿ f0eVC8R_yV*`>$ywoLs +} $]9'6#ZVFW \=ocʦcǠ›puWZwb4$XܔZC>ęؔEƟSSιBa3+ɼi*od01(|&>wGLaP:5\Z\L&chAt_(,Gu\ WNIc73T߉Dxr3)#B-$:,QMA֒PHr4$ ~3:#?iApMCT6J`l7XE_@"d͝@.AWae)v~u$!071"1;UF(NSoSfȱx)PxA2SD"\\Z13u)2 NSJ^ ETcpRwYLgȧNpLeǾl ID]͕(ڤyFp|}%ek3z$C-ػ}G];6>e*7z-i`WTػI|zlC5 N)dZݠF1y9mcRZ GU4rn3W4t$q@}g+ h1Ӗ w`?SpL1qE[H7UXA?V$K¶6N9. Nn*)ҭUQbT/ԤB{_rzt1@&ߞHmdgڅ2588܏ '9&qD8 #Hux黩FU0G5$4+E(4Qva:3ڽt9t"ÄcyJ7MIy: f\W,EDN+*pae5&h?>jO31ֵ_`7t-:9Nzlkl5<||ů_;Rq]umU, |(I7@W q; #Ӝfȸt3iM|S8T_Ġw(QһE(vDeh*ЀcA+sq TqPU~?:2W@<bsd11:@>haDв{ep &@66u>w'axA`FKN\`2mj%^񡸚glo%-M8ž+FUQ{f$2wf)W6g6$%<=97H; -܊עUR&|0A5b)^k/ksFt]ҿ~qD,$?wG^9^6ȿxD&0Vbz!OЗu!>R*N螡&~L/}8TrQ_Ym E' H0H?!hٴMw1jx朇Yx+|z覸«8(?JdZ1̔:vOyVD@q`J0QV;9*;}P 0x&}`Hsj;Ky Ex e'hY4Sc3Z5F]RL7u1CD+%]ަ;OAҴoksڊ CKI{WA8YKϚ?$,h*ֵ\=(vAi%vyaӡc[>ԋo9 0[=S9}xtf\cQ1H(GzΈ~̼hƹ=Fs5SSǂ"#zm^riĖiW&`"$F+Y-)8aKA 奻mV cnPLW%Fֈ>8Tf(#p,2 Ϯؖ-N]2,$J}Z~\܂F ]rS>GnTyyc2jQmVzSDѴLRiO%(̓}E{̛]oAJ]MUHKZ+m+U'8e-_ևvPH֪ec;HƘQM^{| !}2g%V5_ +='EDu5_ bΚ ]˭oo $ Ѯ3 Ll"&y\R[ohҬ \Tg vl0(͖1!D-k_ : M ^$qβ9 GR>7-#q* d/  ) =ڭ]ԺDSS o8*@bK12e-BʿZ s-uVhIތh;ѵZyVaWU7#ꔢ6,kDZPJ>Z/wf!fQQ\ݳ9B7Msؕ9?V6QIMO"b(羽pnr>+Yg@b(,ED2뱍yz(f=Π ZDt'`Y˓ֵ8@g*]$ldo(暐(-=9ŊětCߴT,`ؗbwT"ב2+B{.|% c1 -W ;vtJqqښYDk"HPwzܐ!BsWȰ@ ~j>xboYsە mM6FWv_X].e;$χ AUv<KSb7TAojB37&s၎s iG%n:#5W۾jpc`kC4AJ;GW9.Ȱ32Wؒb7NR _?7ktDN~݈TыlFjo${^O2D@+QmUm͂j8[21՞ Wfzj ڌE$=IyDI|:>ZR̨stx P brOο}CX,Lt#)hۍSA74551ӝ=@ H.2Yt :=ULfrFrḡ0s˘ ίN >MY8M#pGy[a1xWMHgy0Iƙ؊[l@*20{[ţQnlh%6|Մ>;k'W$טBjNB͹Z3҄)V]~&&0g#$[N7/ڏ c+`gO &wn)FZd_@ls*CRV;l "®T /PҔϞwvhC"{J4f> m yDDwҍbY'E>]т51"`B^S[518 Cvp H1x:84m>LdAU,zp_\Z!qD~1 \Q))6&?Yx&g/*]t#Ausxj8 fJkޥnIˋ"Eu; 6VRi P SI}Ķ4. "hr{,ӑ|7A*qH-I[*2y8i/g0(6ܓ~g d@ <2 =lYlC& gA 9GtXCP4|nĮ?>5Pb!cJ.D'Fzbxkz&NɆA^d2fA0dBEʰP' 87B9*>~@'P^`Bk={ښl=Cdu&i5cO7 —|&\9ۮŲ zVT"%G\u &fhy4hH:b(<98/UBj~uCcrft1%tfr8 9˩8 "$}5t-"hM mlNNT/&vdznM!"wЁ}^pP79MUIn_4^tte *qp$aa.8 ͻ,I\]dC?ۻ- @2tO|J!\i]<*#vbٲӬ.k**R;oa}vyn:צ {)nݛF>7}cc2}$3!Y+h#"{w[][9rUe3(e Ŀ'hl7@`8OUxr> k/M(A*i i5r7PK]K؞vC~ĂrPt]?$ܴo0& R*A|/i (7$9:aC$Ճ`84BdfjȐpxzn^$T.78$ hF?Q*tZ:PC1H4@6HJYF;@\o73B1@'5QIbjd}GL6w2zIќ`=g?u~{=>n)2̎Dn;f'n))`5OOLώѧcW`^!rr̰qlO_l_ylq>Uo/򒅩\֣9(K5ٛIZrWv_,N7a8H -O~XigQPR,E=u +ˮ%{r 8\A# dG~Є5iY }٨l /r{RNލx|zZGLc! ܮ 6$F>Dbӭyqf,5~Y? Y?Dฑ$3'_Wtؒ.INo%Uibyp 9,<#~B.@ t*}Tk*?0ahBݳNҚ67v-&؛\)ˎ#e@ #?t`fjCKZE>_'QU (u3^PݷKe:lN=(Z r 2bkSESj 䕹JbgÏ܋=.->ɲ{. ܖnLvqS|zR jw!bVRKBzAGoߥ)uAIa59@żl]/,.ɑӝ]O;s _QV#0ȩ$ UfEmNkd{<J[x-ㅟI /{iAWǂP)ZY2|cU[rHC|`idM,@]dmV}VnS6:9d}ĜqDΚS |^2Jni- vXpB217bWiS%) *~ikr[l)nXa܇m*ښ>G(/˖PPNz)k,jǥ^L-$= <~vkG+UFEu*'1R:x>?7vZsXO&juSc=mq렠^gV8FmXƦ~݉Y,j4|аOg!^?T7>Y+s)ViX֢(x3_"AUqYPNjPk)b/Nu:G* >V:j;1h]& RîuE?= U42Iгik4^άJ%VG|4l3~ѻZUfWpӑPv~3erV;8nӢg:K؄Be-0md0r^ _{W:\qG+ dwpA:0w@=)QlkeN0<#I5H-nז ͈ W0i7R*/ɐzOv=g]7vxkزp\!]+isv/gA YvEyJ!%x!AQ{*QY޲bX.kyhI^^NYFٯi-0bb8"$W@k_HFV )Z#01+gHhqU&4YvutޏYqȈtGA0+s7!xlROPHhRzcMA1!lL|ŌI 8_AUČJa2O Jlp_ ߥZ$o#^i%OˆIvUxn! G8N]JTTd|k%ǡ+()|W_T0)e@wƠ" ?|1"eh'-h:O'Vi*ٛ0 %q r;Bݲp(VFN*}d~ lҠc#lT_C&)3>ԝ @vM؂ )K6:`XaP OK)/rJʐ;?yr?\gBs2"K0~brv&ؒ\£mHO]9[*Cgx|;n@LsI<5QwxJf#fZ=:R8Y(3s%=MH)ƻrFk<| OwH}/C) 4s<~ZN0Bh2gFN!ZN6{ An(ɈE<^{(j* ڒVR B#{vMUs W%](UrAτ CQb fzkP}$ug*WZaoq|%^ɗjF1 ev[y0$xjJॆ / \͚ +V2FB:8:]gufUz y~-300HXw;C?;G6BHkjh=9?^>*cp+QqSO..Lb(Q׆}hK!n'؁h3,382‰EwYU==zg❾|zi1v(>ys_f1c;A$G&OY^և,=8CSd5|:X612נ Q29,A"c1 $Ȣ)jM7NO `6Զ}?~ ۞gH+흎dG{pl. ^} ?@Pv*@M;aŒ j_~?g RP/ƘL[bXCOzH@cͨZwY=,X۬,^,٘Q&3pF(Iwݛܤ*J@"bbQy8KH,n\J~^Y/Rja { Vz5VZOLؼa=]\~%yq!PM}0I{?<7~Fͺ"ϧ.Z\n:͟.cI?W/Y} k EL=.d2 oVs#=?_f(!Lo:Se-jk7 #mRz m.îpdahJmDkҘSOJ=<{n?c l2PdLw*{K,KS{.e~vWXnykܜ; S@kRijLfc!MAeHQt\5| u?i{FlBbu1g:g~8wVK@b%7oCsyE4za (( >`UIXT.wNp2,*06E dD|[cnA}ro|'ޔib'$[SmFş-`XчS0Gҝ}3ij|'B7ExhmCT;W2<iմwcP g@pz4ue|xkW1E0'4"6ѿZ×OW""dKDc.IKKz#*(^;42NI#VCZD6?7N ڝO.G|/D^8L_ӀwV/m>,7ƞ!(1j{շƓ2Aj/Qa-yi%2-&빥eoo|i͉{\Ae!f) 6U#KW_?\hIiK )6G,體ғ lϫ{),̒ [`īv=\-)'[`Ϧ3R*֓2oޙ"{-btya6ACk˜Ew[D /'*=܂n[tgIᮯ~KcpL[p>`hDfrat*yr+XwMR IHS"C9s֬1E $E>©N 9vdMI?ϙX>u@K:blrdyZ)΋c2FĽP_~fdž,i8`|X>o'9{ySj{U(cN{2~M.::e@M>-ozz ,mϸ/5/+Z|RbY u^X&AbV R@zUc_Ȭ^]]-7 Q*£peuQˈ -v<=zplW: &y:"h*.d@>grn{vHrܟĒB,彷 ō֜թ7HgA܄-`5IS)@qkO&)^i |Ɔm2} a!E񚋪*kx38"sq`q {BYl.VP/`_a\:IrZf'Y!BD-Nn|hd|R#u80|r:ַ.9?O4uN -AbN֩+Qr3[m= aʸ"Z?^yS4+njO+EpL&HkV$xχTWU>Y:Fr ԥ96wa d]3K$ǵz(W' Ngn6 c+vD5q2S_8V{,~9R3SSzm$SCLAvsq%%KhuZh~_gTp zz8᠅,zơ|qW[-+]~rF&TV6(d\Ǔ H-uE~.S.LfԱrʮ& olIg-T/ z9Xg:/p,BaoAEظ@3:vt6kl]!Y5SM2ǕDyEM:W.vSY}ʼLx;!sǘr-?P2ٝ( 6W5Ix4Rpny2#vMcv?^4!en`al@HrXA!XFoޤwuPA;5k8ɡ2]E``{{;8gBN͠WTD.-=a+]d2ϴkg c^SS$`X{ _|'I/ 3OӰh?%Eo-k[).I3c#/oسToN'J3`N>5aO]簍ۘ$YGzko"qtq/ ͩi ?ϤyaSdn$s(')F=f /<)W0P.DR҃a 3h&MmV:JmYIpHvO?D'$~MĖԝtMǗ l"3Gf0?hst'>*)J/A>.ifܫd5g=J[wr0gr6>r~Z|Rog-5_Yv{ )gq< ]v-Y)', Ln{}ϓNr҆U}{e k;^6{ j3CϿ:DPA V7|[j­"}6.tf2 c Z_B]|GE= /j*#+SE`bb=˸ a~׉`$qp G=iDnc}o3މ"rH6raݩS1 Xk#@-?WÒ4fSF]gcS^^VC.@3XV/ c8#[PLx[X[[igTm ?èysM4VfL1_, /GcpĕJ` J]5~uN ɮvk|gx ݸYݶK]HSjy]ar/W=' =?n,uo< '9]|.ceU+/fֶ'GwϛGRJm5*,l.#6L>ZlHEo]WI?UT/hR)$oAa6VS a4+: =`9-T}& jnsUv b(Fc3)ƙ)с8BP*an/'-M?oZ_>NgxC_=&FJc#J*g%u Kg D#2>|x9$ҎdzNt9#|+Z9lwˏ\[7`E%}=ghnVQ׹1{ YZ2ΥoW/xgDE<`$ VTe* kvV_ᥗp|yƋP@UF|X(uy{ U^U)0 n2r(kþgK8e䫤jr ҐYPҸ(o ןx \@po`bxj;g+r DV 4: aTђ-ia[۴PFe[0A|FW/$՘?_-7;`#~zHw?sNܻ51RNtȹ~04R^HaU![/ *g +;_ )FP[C}|aS$2Prr7>RI<+nS!d-7=XC1)zU{B9Z% A0e,}W H6R8~^U¸ @l>l;nZD&TF͂?2pkIBwj7Ƿ(Pgq +w>DH/}g];rwƴKz ,\w,uijra4}?b} ;ڱD;(iJ)xDq?GPE7%{N93dps){ r?ۮ4?Ai/j?a|K|I>|8@5@8XHb9&/V k1mh`Qе 51mߍaڠ U.XMYPWQЎ 9e#[;k^Fl-d,PP< Ҁ 5ݤ5y|O(WҀz $\LxBO]f)5͓$u2-6SvS$ٹ&35Oj|S.'7}m톗r* ߄(jq IZ#C;R"ؼE`DdPDVr̓A-IĻ+DdAuQgL$_` >5FL0OY$2TBa!1;^mW. <,#윲U ~OiugEw`If|ťK<;O;V/M7V%ѩnHUdwfN=77,ƪWK8bՂ)R%0Rh>~`Y7Һ1 .RC P8̘OI~^m+wx77j6O[rحn*F{%ㆁ USB;Tz,r̆ h} sOL Nw`]:Ө> ZU}G7Gp=o4fi||UUtvK[*G[vmc׻ȫ_o`>5-͢`ܸj:~ LW[F^G͔+=h9`J1wH.Ak S" MTv|ɒEξm}Nҷv @ !Һnryei`\d9"R7\ j\NqybdKBlKN-䪻h 2xu,~X',D%jM=_P HV,.‹rb܉U4ce?aW[#2O<#aC `*QvG6&^01Xv ^KBrNu B&t="7nk͏9`-:)5srz9#Ho}o#囎AgG +p@3&0+7:a Cp]&j_ns]..40 K g'Q| \Ej/vtX'Ïf;?Ϳ;5"szI޼u\΢_>q^w20;(x> b_>XĄ'Mg 2U3S7mcT.kGDL-xUtzV$ ˟bFkdɦPhT)GP4K#-oeL2yP DՊla|,yT$|eu!1(c~UKi<Ek55oLvhLkIgu%!9NۼvB-Ir-;"w!UV$Z7𲔝42ǐ݄ h[t.fRܬ2жYPE]s#|cA1Mſ)}‹6;`r z"XpimS; {{UWuLnF._+k1_5D,^#.7͚AB)·hKB)TUs ɘv5D ýZ+6gbyë=dF5AvƠLfOQ2%|V@ŝμzD1 Tw)!1 ,8uSre;領K(AI[{-xo@'GCuE'G-5yBlɰ @yڈ؟t4ٗuڭ,_o}CK=|u~;8-ǯ<E5 G+¦1tޟQ0A_.Pq4݃*K)\.$5%l|BjcFJ-5rOx[={PG*Bu3%.f~|nj{;y1JMoH,a`9ը,)\095#~X 2,qw{a XtVwlyk, R9{]J7:s;De 1i e^oGg յz&\9hIl'f搸w3]O,& :'vLucL<+람E^>z!ws,a"-V=_._EUȮwݡG (Bjcd:՞Mf>/4 S҅:K7dؒZ<4 CZ:*ua}OaSVUт]Q0! +M>悑@J3~ +()lղU5g?6b8+0J[|??"bD67uw^7, ) ZzнɈj۰oNp[*` |dJOx@7r4s~T+I1KMJB])›gg).~EJm-'Ցr_ xaԈ6 [i/Uu/L=MۣJ.X/g̶F̧^?'şfnc%OD0!nVcK6výQs<{*"tu&:SnuLU OAW?3fWեXY 3q[mЯA3ʄ g}`I`$RGh z۸.zi8)!V,X:+/O@(7!qfFx5l5D&$~Qg/(S.5`(Pּ&к8D1\oZo *4>mc\HƲuաh%yQAN9.0k#Uզ",sH5![{ * nncu|G(p$`@6iAlW0҆0]MA*$刅VͲ7:H-1Lvj=Gd @QblF3fYˠ+OUWL9!D5Tա&j `>'CT G4\C\|m ":=F \NŖuTSd 0RmrP'14*757& zG+X0-DU\:곥q&a/,GD \ kk 2~} ɞjiẖ #kФt!`S"^6Z k Vlnk GWLFhoJ^5+(j 4,4&۠:6<, $e6uBk&4^M F-ߺ- GD&&b(%K:Sčm--VaoU2},Ra0b'ZZ8OJ % 4! # #{?0^n!Dg]0ZfMCѳ4uD#@bYrkhRɑPb QշgDf,ֈq7IyC4#{Ǿ\D.RUI2͞l/d-@KK)ᱢ&r]ZKBiD[9Қ Wo$Śq2XT4zgŎ}>@B,bgKot-tVӬwCW*mavčݪDE YG-qiRuO=z- H  Q_֘p1%`qPd9"S1F$ڏwX fj-mn0>\w,0ӬHiSMCW}"GTˌ*<0'F܁/h3B!R>'4aXd ð\D^~S`NJѾ u%2!KVghqlHg>dqhܷ.ZT  R#IW3zJR԰ 3xA/4],^+t- aAg.^' M7ě.blۼ)r ԆC%-\E!ț`v_lķYU;]]' PCң8>t1IA86JSCM_ds([n#EԢ4iBCg?ӗ@u-RLg d'l5;Yg~6S|Vl&W?:CtvZɷr:$D[ =EދH"T̄UB@kg`tE?#H ?KK!%^\ҭIMK/NL'],\f2SY&Mf2Ģed_]c?er. OG^ˣ_`9}lk_""9ٽ$u^cpMe`Ds83r. eKP$8BYR!p]R]= (M9VxR٪I :VH Eel4$0ѽEVM"Q٦ ܅jf|_F]nIⶠ'k\D}@=R>" 64y:&5Ԋ.BRx<Y:ly.ϑbFl5ķH| rEsJď.*/> (b:pmkD^ː|U+C52ȇ#ty%@.JWk_j|-b,CW)*ٿH4UBt>Fv0cWʲL<ę5MfFe'[tyM;tVǡw⫼gtFxiyD~{]G/uyܩ.]>H~Hf0gRnk,DfLMdb;Gw=F'f6t9묺܋A4V|]q_}1ˇ#/cD>r_[O6zR>˧]>CYs|NI_(_o *=菐 X` 0PiHWou;U38g%>hskumX3w C5|$!o >z7'K"R 3pW߈ņ$e")?ʷ0|{[w{|xv"Șq-8+BfV=<̱9C^|frC3]~ aH$G>`ݴ.KC)ICb={,aqmNik왙lgW1:=!S;ĔIyc?[A_i_֓T.>̺[OXiJ0S±@4)+`xҼ Je'Ft9`D4>hlKgW${QbLiNi3kF HE} zϙ>5-mZ-jsjVAXV۸Mf7֊ߴwsZZoVRɌYfGaC VC>g[m{J#jqzA֜SV3z#H51S6 Ƕbamu 8jK gȢ=EO4l|~ 0~HJ&.:ggV JUW:[TiaD;IXkn+SI4[PLľNuOtJ|#ˮKQ0źV g&;A;Ҧ.Y(v8;7XvC-BX{+ձ\'aC)ĝRcj`i^k:O0QRmCw˸{ q$4H_Py.6c5y])kvx(yHoQEL9ɫxIWbsc3E63]>,.KIca3gΘUV֭Ƥx4";$Kq)LDښ`4WX>f&\M܂ˢ# >;.ϱCo}H D1-f#=}Yvʞn~wyq$HZ8e U¡a8JlhtͬZH" 8S{ru7Ů,gwQeg73e0Řl~ 57 Rm g25IWUg*P1ؕKÄdzZ_nc䔓 +*v`uh+V[9\1퐂m HB Q{wC;ABfp Pyد=*Th8]A $GׂP^Rn<sF1Xfjgˆ c۽&]bT|6,[6L!#]0j|QU.>`X䋱be]OZRU7C֠; Wnϣ0gSW|`+%#6S.3ou-F7Ϧ_&8cg6$2$,ǁBt4YwQH]7"usT] FZT\_/PLmvRn]t,4y`TnQEm%:3HnrS=!rN4H-aJ8rE|9QMUh̸8ϖZ1gHN;[#;ҁ1VzvPJt@d1-T͍ӣ9a6L 'x1>\E'P*Ui/G)SȊe~z4:+!G.*Xa5W{l~|!4iuyݳ °&vЧA59H)O# p1ٱUMCWaXfNOuOI*DNaTt9cJJؚd&{9ac6򈵕5 \ 8{33 QayC5c;[^cr3?oתFe*wjő[Ҟ8ewez86#5Ǘ>V;#嵎CElyɮGлhP5iE2qMuCjNj?*JV72VℚSԛ ӑo`eȝR(oK0m!(i]#

_=}c{%V?RR_O֍FȣY f[ mivs# c锛(5C$9xoMR|,uOhPBRmDR[-Ly0[t"o3Vp{}`B?+av0rvuVמPG?\e0i))i1<ލ·з([2KMDlS3G)1L>823(ό3Ĕu`OsuIظ&!)m$>YvB7 HE*|쐦4{F@9:l|\=d h`lRuӋuqqRԊOZ9+9z)jƦ࿩ "ާJ697r'Y^f>f}VyއéP"u_̖]ҙ:u_VJv"[_^X5—A;AavvܢpOɗwҷ}-Z>^JyxW+NGiEH ;\2sj\ K!({:h+'SQ({*a1&_[--*)P!I򊲧%ŹJΓlǡ2WHwZ#xT,rqF% g| 3[ADuv @3>G-̭F?Hܱxv5Fq&iu-!v=NT wn<c4ξome7 lc.*;aY)iE5P(Y66qHGUq3 aebەhKv X[}LvNފm`/Fs;fJ.DX?tbs cGh)l0J0}!b3tv'*oksq4ơh8y~%4q#:`^'OAVhct cvXU:v"vP3iREK1 cm}[2w7 {)s}`+%;K~GC'?bk3Hs  Kꄥ[av uVR+:`e; gӉ!GY>|scV Hbb2VT!΄^hcsa8%ph;%7vvo_fvƥL&OLBȰC*:oؠQae%(boFH܀vV)yf5Pnj٦AG''pFDn?wY.<l 5/wsJyrpr9mr),wb8̆lD{>D5 '{ gP;tdB { QWqAM  Ecg )·57œ8ޠk :o? @ (&>I3ۈKwQ]{I<d!t]5>P2,)R}ߠGO&sXAKrbxe $H,;'02lvsx2j KfLdY*)"Pi9Ż&]/>| K-?ۋ~A>hd cWU!T/KڶQHU81'Ĭ<ހRU<3yf 0o Xτ,8|/sŰ_;pW+z#o? ~+|oo÷>|Q py7;jbA}K'p!L|8}dr)Jع`ld' k d/ѠSyWd̩ûVZ=V=F)le?2a9-N`53'dQowt[W});; e'Q3$@K}]RiƗoi0126w 39ަ@wbdŸ l+%f1`, (d fh3gq5/yu^~a:<rEjɵ)qg<0 q]px8<ˆéCqh; 6 3c(8 6 n(;xt,۶i$Wh74PWoy[&@pLB8 ! .)l9\\[\Ok-]@So9\i-0P^GnC;\t;-";f \|jp#Ƌ0V^FAbKx?";`V; lj`v$MovwY:$z2DDj%RjdDF&g',V`8΂^ O>/7B6B |Ro4?7a';>H"W|նlw‡[p6zbV}Gɨ|570VaӟS O6 Zy5e,Rbzx/|0Tt,EϴUXC<6(͓}mhE?:vc1)Π;b幷Aj޿ _{t?d۪NiW'ʟ=yl;$\@]";̫R 2`bx϶B}%A3v}CCR 9J7,` 226l,9\$r969Gkr!r|(Od9KNCr*+XVYނ|9Vj\ЗR8J*P3;U2@UȪoWyZNqeW2Q>{栗ɳr>"@\^\m'1&H1\[;Y)OC%yi{YGXwei̫^QCᓮ]I55cC碬^0)H)c;Y.esD9G之>5my.vo2lm/뇴`<[OIcyii9,o`FHCc ' G((v䳇)ӈ;ِxApK6C?df 0Onr3(9Ng gsly>rpRK^JJ#F%r-Afy3-,G;x3vN;X-Ux'nv11˿>3擟l'ٿYH~v]w g&d%IêTDvK-IjW<\G@HɏG-%?.x^Rf:\Gc>جcɏѲ\_ ?PgJ)sX݉E0f#ācɾVRbrZ*a#:$˓fBKN;:4V2Srؗ.}\n(piPB$WLsٮl+Yfyeǔ,R!F)2 B(2`_jc+3Rj⪢V#mY%[HRXx)NL -MG8&-.u8xhhЬʃBʇak0Ժ 1pt½0dBWqM<<,^ؑ'LF}zFULWR$7[lVQxKferC6V&o2iWf6{zYT E~ a)K ʍr$ao]Y| LB`:Z0NQ0 &q],įu0G hhf?nE1ؖٝ&40=]P*Yc4ƤHRIb|cY\v, _|1>}w`Bv;9w~pCp0c~ b@uUQE 7 =T J0Ktn\6RL"J撷Lkay'ϰ?f2K&@s%O+ex} ba4 .=lYyC~gc>q'"Ji)u>&{^A?!O v>h)7C6Ӳa7ãϺs ~\~?/z!y<)/H\~IVf.I@#>3zZ#qKp[ fn ݀Skehygt  |m0pmJ.XZd*V,nga1aAvmb 5_`% +.YC6b>+nN?1|6or@(mk?fi(#Vٶ͹3vt{#,jjsѺuLB}o _t⽝0y1E<}МV>l|+0Emǚ8`_@p7̴CM0fAJsuxtaZ(x-[Kn; uQN-xo-v,vR5oB#$y$"3P&ҳC؆<+b[!}9l12MtӴ"j$NJ.`SU9Vʼn H3ᕘۋ85O)Agin:ݎjٺ 6q^[Ѷ:e%t(8-e\- [ݭ=e?vvSm {>U$y6{劕)Aq;fB6X^$Jo8&3&LZk!;cz='1M/]xZ<~{c ؛9@N8{e_"Se.sE,AU\L PBɞ(YF•09"YZJn+ْ1Ffg* 5faTq/ے+$D2TFPՆcMDcSKCsg,%j 16·=WKri*$2% -k[{@8ԍ7w_ H*vll]4{;2y4# 4Vk7X˚L9J+Hw!;-%pFxwoukbz^tTB Fcۺlm(f$V?Nf\5Y]Ew#jjS]vکVxvT 9V6UX4v$2|ygϊ3T},}5|Ewq_؂qTaj<\F#pnY}>[KdELKDy'/=u&O&ljy#BThɜ|H4$Oaf{Mugzy<|ޯn@KSaq %JY|T7B][:;7AwoR{ unQZ c4.7I!]%;.KվU!g[m]l#P{LuiL{ԗta4^eaqw3`| :BGMu72`ă-{_ ;6"h|\]nL IrP[ @}iB|Ԥˆ:`ԧۗT}dCҏuOU6g#zT8YZSq^8ban-`/kF ;i9-L+JyACi":3ӘlTOCzR\8}7M%@2՗}_Q__> %ɂTVDE ]vʼֈ֔KO g5Ls?C2r(p5maqMs-Lvsc+Bx)D K躤VD!>bg0uxۂ%oܜ80}:;Ű6s㆒ܭf ny-=wsϪjt\D1 joKwF^-INܷPg.?[ldVbɅ/SgmkY\d&Kg_'>/Wj 1!{yd(ΐ>}W;;a:9QM͝31kn`|>jU4px=*CyI)'(Jۡ%r1lE PHPu& Bal] ɑebČ]!m%GӍV<-G#SYs5A0hW,Ǵv^v>[X.;tF+T%;9KW5rgl%=<pjIɦB;gzTu^ȈV(/ DqdvMFtIy:öƘxHIz?+:3{JULM1(=Ket#ZI+֭e`mM[I%RA&&(y@ءQu':Fu%g=]%e\]7vUVo2J6QE]KF]mҮ40\V*=6Da-DD`zIi]Nԩ ?Aܷz'H\]WwFM|F5L;t4nxA:}"C`/bJ`/"8*yi F3Z` {XNJXك)k\nu \rx4be<Sdӿpv*Vſ:[\h-`/syK3Lbv1] %Wo/ab_ӿF~lv,D#>DKˤ{~OeC_.fV=^ *BH٠^=Hkzi RkqZr^/Aj{6+.MA1BX4@fߥjI`G\V5?Ū#+__c/j~?g^ :i+!@SFnhd:a.w<2*{&4_ž~ՠ{ @# I𶗾Cޠ`&WC-fRo/MGU\؋^2!dc:Q穆!ڒB:X4 Uu1:%6V &:mOǦ@P7=4Mʣ\c2Kky)ޒ5 @_MQ9` ^1dt 3Uc#Z}j8ynomu-tոN>FSj\AEBZ ZS2 _@D<&Mh_3RYj5d/P6STú%*b3ҟD6?RAWoO,g)EyKh꽥޲c7D< jhB1Q3!EZ^dSpS~B7Aa!&s yt!ϧY% ~1ekF\ bH AR\-F./ 4 0߁0Sȱ-ĶT-*m$٩wqiv"7h*O޸<O#v}CA fK"聶4TEC%zhPS$ɜ=Hq$Jy=i6_6֌uzAS3iYWttq힐EG-vx}bb~?HCڑQ 4]-M~m% Ct}a_@A4wQ pʰ'Dz); yA_KtK&aKM7H| %XB%,3x .rR FFƽa / DztS?Hn]XZ"UzMc8&܎kY^#4lߍT}>,r.Z_yJ2Hrp죇 y[6H;z(B{P$\RO{*݇Xq?5嶺aR=|n'5vA7.@(Dx Dke|F$:7h̺/ብN(Kyjw269Kj=%9TS5xp1 +!iʑ,d;߃t}\ATe2K{/}H04^j kEXu%&:d& ]' &z sv485p I3K{Q$u7i^'-؀F. .ռF;[#h hnM~:thV<%Tup _>:dHOӝUO zV=ҍ%Br\H/q"0͎E%;~Odaa$$d@$K+0ę TVK(][kh;ee[n֪hVkm-k=g2L b L$FbP&_'6j6/Ӌ-ūh'ъ qKWw!)vx]o~hSRKgMTyE/(:EE/)R+^U+E)z]ѯ7T[Eo)QW&9ڜ*x)S={<>{pyp!{pG<Ӄ<ۃ{<8in9OPa%:;bHr[W},HÑh2!ش=# G;BqkkՖ 5[mK 5Li '#x,ku&19-sY4Zmqh+HC3ڻc\݊&#[;c0:suUᶫdkzDNu!{x)L TGaURh8Z۶Y6Kkfkil'͖PMXn~DVbe݊>m)D#EuW}gZ-=][uk w #(]m;)mDvN+=B؎W 6 y$6$uFsJf!SvdTS>Đ%Se;=Ht {ѭIҤ9xHGpŇ:^BQ+BdV}m{PS$dOW)2NԼ Sy3mx$eG97 lvh߶4_E68sCqX|`<xlu$Qm3-yBvFj%/͕G-s|8,s}C..2߇{8Guo,aTpPj|8;iZ]|]udpsqv",K}!ư;QuOH=7C,UtTe^9h<ͭ+O<X.<r9I=-?jI,i>i֓щis`@h>iQ.+/d[j|'x+UJRY#k}N fx֑m ?| `Q20JgϢ>+||Z@^9TzAjUhY>u=mHKb7h}84i@yˢP0⡒};,DkiV׬,ۢ& IFp~(x.s[g ~%Hl'f]uE.G, wEzܙ3 {̪wɹ-MO\qwX+jh6fv JӠlF4:;?'9Ean\sA.MO2%-שg|sYI IDVqzǾHtGjJ&|zn_ʕ6\DlDۛ1p9fk*n-1QLVǑ{ϑy#osGt<ÎÑGy#rݎǑG?I|(D) 'YFYc;>|҃~{0.n: F( bT+qJ~{Rқ})VYE)UOaƫBTNLasR8WTCⱓ&Kb|_sQcsMosM.pMП5XM<:ضڜ2N-m lxh[lg.嵣+h3 .IאF}Y>Ӷ,cL 藧ȫK +xQ^ާ̼p>o!wG)</E2QJph9\˱1ɜ^|(J%=hзدW +)7ҩ;yIW29I`OTd?H7EfVs$ ^B+ŚjadƵԬΗ|Oa=5.)Ha5R6w t+S(U) f|,-)lOR5RH'FH^"5/F"E`DžRs5u ҀfYVY ҌKVj8FZYdo+C*$>iqt1JۧUWdg|zMljFG+77$ $Ra2IsM=az$QҠWaiq(d[>nT_Lm~4h%m>zuN6f|`fi3ˤtf&\Ԭűh3e_Լp)fbԼxYfeYvaNf'Dv3MhTN4hTN4'y~()#%!%d)y-)܍Zك-k urr/f,}8,_Q9x@ y@ŏk8%)"xC;+o[+Ld<-s'DNiMv1s=.d=.b?KGt"Ms.!MXMW2٤%S6V#HAή%+`MWʙi;$P ɦғI{_U+ ^t]G{{5A4P' X' =w0=ր:f; 0;e  Xh,ƀ`uA' wFz| PQ TD3XAUz 1Idt1_Y:q&]wwg&kdXB`4&3qf "FV]\X!ԭvw};w^f|wy'z֢ n$^$_$%_&_%:ox-Ww&|VD4-)p04 %&*K \Jzp@6D%* Zij9=E9!} 50(N#$Ud<HIݡZ#x8k6s$k͚:bhp0O}ݱDg00"x2AJdžok``dъ7*wơ^3%AF7dY1ĕ3htBȶ`%]|LN/ӏ"_G[;=TGV|7kmM7I{ Ù>|X}*dh|da W8@JU2xs5Zlf(U*'Ce>f }5ĵDDY?LDːUHO@W 7L*Jd_ 7ZE.MYD#H1r4CdLdAƷPbQmךkЭn[| M^vBXGIEɵwJnmȾ|WȤ F덅π:wIC|Gei-7`kk2džQΟx&eehMyܜ_WppЌ1X]Ѥo'cXFVDw=^ FWX27?r{K5W$K_HRAWI<$jHVaI^ ox#G%,G%J];"x%!NwIM=x&,pû=: yRPxǰ}(]o&XOh4ޖ3!jz.a'sQ^>10q˓&"DW TVv:.N! ml9=(=x+fEԬH%cX~T>݈g\B.AZZZZU咶eVY=&x4FTmy*n%[ s;vLHeJJg(R>{(0gy~c <3e>qkC5Oi(c`c ƀ}1P>^e ~(Sp 8nP>Ǡm^klpP_o}|;p>zRZJ5jjT_ s9 v3Ja&0O0"et@$mSa_lLpB?#N8AsF5.TcϩΜ gL^c>=g+3X^c􌟃1vNڟk옞'ۧgsMcθ7> ϧ;N+Oce׹bp1X s:FQ!Jn,4 ntݨ\je7j%W'z2˶ApKs-㥂lϳ rnc,ȕ\u1Γd [5 Ւl@4oZAT;K}6KۍKhw2D32#H!+6#dI'wjnilXۘ;F9fD"*3bƠ xV vS HAeǙŁW =J =<  -C@r%(-jC(HZ5 S(Sp-z .D0Rp ¬@(IA/7&Bi v!N9)"Rpy]~Ea.%Pۧjj5܈7R$^/bp-Z5B;넵ֳ}MAfO%^; [lնw]^  ĿdKOU.0;| evRX؊m0 0CffWࣟ&BQ1>b|EGܙavvv {o09.̴&x.W3 s c(25&3<$qiJO#p#b{H?w@RĉG|y(u#z8,0^dEdd<@ 'm]x.ZſIzkġIO~}$ִ%e]bWǶӜ 7Jh9-xIj^8jX9$BC> gIF*BE8$qS~[4VM1Hhz':WS>tr;Tof`přMS3c~ _[oQ얋himk7Ԫt{YUĄ 1a9mdw!?G8VĐf7ߜY>z49i1YN"b0tۭ6dy m|DŮl[IrAx7g(gI2n{_o`ʩxMmC$W iKaJ)hRicp,-Yu_XYc< 3E tR:ӽsJ B蔑rQcX@72ZDPNdPg34|_}G?p?1G[]N\PWDR]D!/T)$5H8O(ԝR:ˤ)&2G7BfՀ2I $Pqvh6Z5\RΑъhAPKaM&_$@-{ @1BJ >&Cfҙ UZmk7jZmWhWڽEYiϝo&`{v9|N>p^*WIQ/M^7|j"s[8_R&c)mLdv Jᐌ . F)$]c^f~,뽴c[:)xo3r Jy./]{Fi^~&/R|A!R'˷e6Ky?*!!a/?;e= /ş K.WFR5K~RbHd1)>#g8.VoCR|NK_R<,~EJ5{$ȧ7- cvmh27dvDFD(Tp,j k:wHc$5vŗ2 'x8lM%v3qvŖd  DJ1F/ojZI1Pp$$k:ݽ0>#%vǭ5h#( }++WldGQlF#ĈcyŏOr|Kޞ{p_rx_՛21{~z(nJ@;i02;r\X 2>xl7ufWlY\oppw?ZO\r`xXӛi4=bs\J/p %?&pvapHOԑwDŹ#v$^rhںD*CF8޶UQ^+5.%>n*ř6 U=)m#BEUv1dXBz1.OIɹ;jewW5*IcdיъAT2F xPo~cqMrI֐2IR]O2]=Un`J뀮YwTN CmXǴ8JbD"+f*/No̷_@o<qOH Gm&eغ[gpX  %͛8h:M, F,aIL I&17(I~ %ӪsЙ<e)L:OAEA[Miڈ,eCn>3a:@rL96'?{6y/7/rx:]7`4uΣ!Ydrg-KȨej!hmS91`8#K&D_0ɧxY7)6Ŧr(5\kr YiOƃ/i e(Isi n&%Z(")eE~+ymLX-1Ify/cS-^| 1 +D0 0տyc#ic0R1oKk}UYt@⟶sMvz˅"tm)7>9˲ḃY~`yZ{6jԅJ=q-L$o'<' 2vKGoz{s^}C7zW"-H 7K6vtM˓Є؈IUقJ@KgTW#ߵ {/[7e[G%_RuyHH֤0xLJySyN%'dyDwz;w\FbD|Zi.w:CЭ:|*/ts؜/0EΈ %/YgH6@F!8{)us2p9)l9ˋhŪ;s ǖD@ _\=PVZz)Ea@F Y$(xT'P*-9!cUvtQ!QqfP_;^;$:x-+5e{ LiDoEx߷f9NT05Ği*% T&/QbzڊމF=YoV}?7g?sLfCL+? ѭh Qx$D]㩨z.y pz%7j;u { Q2ƸU!ʻIȅ?@ F'1"+}d{qOsiAG ڤr)C3Y $;QZ㬭b!/՝d&pF&Avj} Co){Oe ȗ_w KS4[Leoo.Ї!W+C _>HR9rHq!XR1qHg";٩%v#ARgUd~i̳hϡV|Mt/kx ϧy)^A0ҷ0(Z _H?i^GN:] <_sx#&^ȝ—Jު slre dF1f2C_˜װLCJJE05\^MeB'Sxn+ujimEƬ[J8t+u%| ӝ }-GWm0,;]ʧPI]YsfŜKX`cm fAKKr**kd~ȫMBUÓXNt*:Ҭ/O82,bKjaZw՗Tьg}yRKfJ/%qfo;a~(:eb2XmGh:S9amOg-Ԟ OOϱ_UCZW%Z.P_i΅!H)ȧ"Kh:bWqdKs﮹Fӱ*Шc}TsSI Hy,Q(N1YnCMFrp]fYWYK>DZ\wk7qC"; ذohW鄫|~Vј`0WCsI~0BK<-/R76ߠ{pS7"4필i8\ ~~浬z RsZQ< ^kgXfE^aqg@M6V$=v42y>H|!Zf݃. lk;@a0\PyǨ| l:+/sŸ?s F<ԹdQzu mH6?8M䟂Q?04I +ZOZPg+y4^~Ey;8~C0`|IƁܔq 7Oj@dV^rp9ޠ_nw3Z yP55+!>Q,&'nMUPMQSwjk|#YD* Buj8veVBHuK|-6-;Wq"{5]~WLO*h𤶈ܝm'_7\mǂ¿a,X.cso-F d2M_ni-^*ٳ5Oز۰ |- d;-u&pv8ݑ&[u{~f=`KV0KكnjGU K6), vI65տ";TTS{& ~ ԣpTr dn΂nILdz Nh޹/ApJGme$Ğ| 6n4gCFS+o`phNP/Ar^p.BV,?~jPת_bKx_d%gز[S)FV[lYWuԡi55YqP۽t:'H4=RiȎ?USF{8ofI+/ȊS#k j5U\zf"G#b˾Ilw" g,=/)7ћW 5Q8s;y +S2۠`7b(QF_Uet'{u Ԙ_A&#UXm B[I> C2tfSҷjmk];3C>df}wLW-eઊ*N`ZzFEfûZQҜR==ٌ[||C||SR7, S}}]ϔ}Nh<ߦˮ/CNMZ VeR+wbf){Y<3L\0KOn\ZHZ4 ^џ |fJ D gVɜ).`Xr]K#>ϳ $ji 9|ݸ=E(M9dǓy-/]4E6O ˶nW`*XjPcz2Y38S2ʮkم%9#2 /г96tlV5+JpiŊ0)pdhA^G|ٲMW}j'R \x| qG]ȼP}.7{G;Q|gu{cV:dsS\N)Z3Օ{|b;讇ZNM̓9ϧC;^lKA_[3K '\ϩ1Ëf65mԢm>aiF_et Ӭw ~S:(xwQn@]`PnB<6-?BT"=?F5>;g?T¶`S1XEI r+' 7!n9#}llfQ}{gql͹ܜĭ]F>t!s7ܻW/e<+xx%f J_#(P0Ej {7A' ꣁH}W o áh #P0BCLI߿G}(ֵ 6n}= Kyހ.c\y6{@rOdSԳ!#._vmۖ4vhp-BIgKsGZ}r'BQ4L4{mT4 P/o3Pg1 K1Q1O97 Ӷl2B46.Y$ #%aYjcY^k`V}?.FvG!bi3 XC=tjn?k wX yOZtTlDo԰O"ԮіSB(3S`q$))gQ?C@ tٞZbZ=| Iֻ=3E33عIh/|J'[ <[}}Mbq(Xj\ Ulifu@"Jřb y6r4 LJC4M*W22tSW|f2OH6 ^4O~ 5˪Ғ &0kޘC[Er"@%]em(H O pS&bue[~6Aph[k;HG 'Hp̲FƕÙɏ0\bN2K(ԢGa_p+B;Uit1 RO#cl z:SX &U$-`%X3QF)3)_8RaK>Q3%r,4w<$c͹!2 9`OdtR_?8!#N.+Ti~ ڐ Dc"Z}&tp =+Nc "4GG3kY'rbfX&B tyjƦ>/ۛ;c:юnb(td$6'bGXV($B#]-fskaB^b14+qY '(hh"M&gbyF Ms0+=adBRILJTD)櫩 ݥI?)bpj!AzkzFkochъ#8CI ;Uڰ(t(?ڹŔ'\_t}}/ HBւd2T7CcNJ VdA){~èkƀ$^38-Zl #ʄEPIuDV(ښ pRq\.'YnxW zY]RJ){37R9݌#:ߛ ;etPii= 6=pV< /\Mf(T;4QWp%ʈQVjgeD fdT*>ϩ[j{}U9|^ E*Va{V)_ŗ +𜂯'FvAyU 7T3m3i7$@'Mb/ eK?&2񨅟o_U|QbDſ*\ Kr]WplSp pZnU nV]W‚MG?!>Tx^RͧC ~ƽ!}_%~_xBq% '  O.BQa ~Ip,U~N"NB Ʃpt'#P6-*9t&e%s"O䫰 D*Kԃxn<#+(#D 1QTQ)&S5i9h]+;}ǯ4=TFimugWe{GW_@Sy?SYsXtST1FDg^g &JU1STZ8#ń)ND* Â7-UG,9#{ :9L(5=idi#_&6:P}Kq,9Dg:0*CcD15Tp_BK˦s򕉄!dJ;a2]JIK|^iD7ѥϳyEϦ;L &  O+(p2W1+R%,qRS,t8\: &‰No*oI7D;Ã,S>F!|ZŰ$EqciOrs/nwF_d>o%ˏ7{LU&ke~[K;cdG$l$m0v k392ۉQj֒֕Ƃ& y\ڛ_MHk.,%UX9k.ݴ:V̏)O6koR4y&ok$o;ޚCdי)٤ 'WsSqR;ʱ؍HIjg׵kY9 4:Jf}JcٮtDK[;ۊݝ/8e| tg?=!-yzz2T)-f pMBYzK['CkI]뵟և5]H5&[!̤s7kwG!(S$OvΣ2dxH*hS ?p&T:U'$>Z7fJ Qk^"ݿ\dYeh`Yj a^TGħM٧B.B@9xT=$>2Nsx!`sniC_ xsz\C + uBaoe3uOLKe#&MsYǔk=J5ad&,GmH6WID$8 f亃΃c)4QMz J`dl0֤3f0 AI-b"Pd+ɶuEZ~ !oYQ}&<$rB섒 R!Pj X_(Mh71}b~%Yޯ'd7 Vɴ Dq,'7)xZcG){e VN9Ni AD[jtޥvUgTM;:XVu0qI!(^R.[AQp*ųKs)Esǐ.!9,6'mNao-S-;ɔ (raޤKKK lYͺ(DiV>UmeTs$XL'?ܜK~F9Vp %AEK߉Ph8.]3toUǍ"/4DHYKZf8ktlxO5FmX{;d?색ޓI!A~Jv KJ#>(NЉQD#qIl~W<% LN^7+{&QGakMu z'}-d66(B;T*i<z."ΰ) = yemLh;t_¼C#BAv;Jo[B@"y:ݒk/)M ;}/̈lJMV[lHXVL_ s6-yiJ6H^=x_w+ }PU{j*֫ᦖ:^U-('qa8".X¥PMPa Ujf 0W;Z'.k<6 N}&! CȂLJR.ҚQOp'ґEC1OȽI(N5@RD)|*# oS~IŘDW'j2mZޡ|{0v.WAyڸZ\KJ;½P~bE̢L"e8SLA1Z|XIVS?bJ*ˢ ō= *1c0"|Mł\`*pPC >_Pr1Obe񅗒{_f8./ F]ړ 6:35#0/"||>81 hBvG.bg1{a1 U#uK]vT/e_o#Ps4mTWS z(A n'퀅XB'=xN*rfe|xQ 9bWaYE.AlVa2ҍt>hfБ2/@)/+kf F>`<&|,|ȓ(|.-*?M=d9n72%F=d9)VyRd 4yCnK^EG5obG-o|G=.;NiGryjS'Ktp5xQURs|!^Knn ?aV,h"bnXKF6t4X]`KAq)vRIuݥjpT.FqaH{.THEI>芫i-HM/Ra;^&K|k;ށ#hƏ)p|_p}O&Bl{%\BsWVm$?̔%L6eQVAY"}Vh`yG9?E&]NTfA\*f `)MFclrȅ~9v"c%I9WYINJՋ(n8hw ma'MTA9M8E4rICl=|Z^kLO'2[X֌|]?a}PEPm5^8n iqMHC ' [`]4(Qj#S>rkȲv%v ٹ4 \Y nȺA&K;RPF4N3gȄ@AOY0QA b"# 1 V*Yp[B,E#.aXVxN+b%:>k# _u()#9Dfe,UAEXF=Q DX4U~\ _C Xdžt/+ǯv! VNKrKVĒ:*dfp ~+CN}ȉagS0l*l O^lAeþᨡ}V>8?IIjK6mWG +8TjkQ>HRҪ}l&deٍ4s?R_p<}/{'[J)3?sg3|PKX(wE c(1>fg'uƧ\<.tp犱W4۾PM+aR7ȨI. !]Y%IGwf)$8t%O{[(8_W~>#|Ҕ.+_+yr|n3?'~ )knq HB%$ppNdpqf*MsP4$^WY&:IEK´DqW$rk%oK;=AﻀM].|gtW} hת>9o܅z}ku\:\9?e~~a'䟍d䢍d䥍d䨍,6^䮍d䱍d䴍dd%5)z|{ '젇# q8$c1bd ԯ4E扫D!O0 4FD1apVۘhh7w%ǢwŏX?"~ hLY XܱϠmY9nC|Xp$"$K$+ݸZ *XZVUA}߷fwCUo{o޼k~zbS88BgU~7N<u@&~_d{~m?r>~ןq98P IB:pPp@/5&4 W9\Mr<~;Dpua6-z0TOMqu1?z9U懋/7c:y. 3*aDNR!Fr2.s]b<\wᆱ\uG(& \:Kn.M1\:K8b̥JMLߩ<4MLw1x≫# :몹4k |~2p7,pbNܰKx8I'˸fbJn~xiC6Ljƒ懟 `J"N7iF50ZnXiө$/(.ɒYz6?֣t.&r<.˥q?.EK$.e/c2/*~\ͯ0'u |=Ss#}#ď $̥[VK1]yOw;ĝ\Z [uoem\1Kl3x⺇yGQ.=ƥǹ-|Gl&t;a&w ǓWi3lxZ0~7ijxwr=y~)x5>s+̨s۫^LOόś\-ʏ6ce:cgn&w'} sYȍOgO9s_N|O|kKfxoxoy?\!K},/~?=$i p)E#_3#_ANE\C\R> K=h9eOn(b~ůť>\K-?-@ȁmY­n0?8Pyc&K59TMڈ'EЫoh{$Y:b!l پwNkJoγO5BOV4h+pGO]kP FAD>HGfiDjY ! KOԯɑ,d&+h \zzV:aДݤ{x@MC>+Zgq N1ja%N7yhk!-AOekѨ=í--~o3!XO 6G('V Z^|>__k xh̢M1֖wlfN儽5P74"X/aV/qcHԐ>D[9Fc fҙ`Bw D=b+AM4'Vfy±4Pq"X- 3uk,P0I_4zy5ir&ɱjDdIN>\ٺ amx+C!ֈ^ݘ #L(䶆3|2[B*7O36NgS^j֒+-O:`K0غ&OĽ ZE hd*1h)z$Vsm9>ܭ0 2ZZE밒 P`aA;x_v4dbckV8W R;WE5n`&jx&x,%x^E Bϕg}Rip=[KX̗xO#ͼ! f iFw5c5AyC侄n7'j(MNф/56\-`=)S[S&?N1-ʢ> i܄dliɤ0TRk*L{i?JC!9=lo1҄bw:_j^@RU7Z Zdk`?Y2@UxZHZ}M#n} zEU7W! FQ9pditC3\d&:U6z"iV(0A]7P]9 ӟFr\{:ݐ}I Sc 'KVYv zY[-&vM5IMMYtod8Gl+?ѱ-.덞؏JDEMҥS]3UӢ1>ns0fQv[C>2JnSkpW[B@c1 #%+%VƐY3mnպ$!'#sJc.e˩r.)g EڝP9^':F]V<;xCs\Wb= c()L tO0v5'؁#~ZYQx^EHp\F;kX].Kuy3Y<9\:K1.]ȥV]^,/G5wuq2xB:JWkutyA7ʛt 7f^z$6uy=pܬ&oD1]Sޥ-r.ɳ C8Vw2{佺OޯXa.q٦vfv~tc$w2ȯ䓺%wx/ Si]>Áu|N{^/u< ^zi}Q0{)>UX_U]A.,_-]͏w仺|OOxPC.?.!?OX ~7sK.}"F2{A㟑'k']P+m>HҢG4Pe1}xCWN*fW*OWx PUOUbDR.]Q}uՏ$Ii*u5H . U!v]c΀*U#t5R%ގTFx'ޕvhV+S/Z5dH%Fq}]ɥ(]M`ݯ+w:ZSn]MTX5IWǩɚ)j^SJWǫt5[U]͕uUCFSuUKH:Z`K "]bDWK⌍JZlI.ilfߠ$d %gdOjPތ)XReZEUQWM):$Z+?mMլh{ 8UtV]Yr6Фf`Wbl%*Dʩg<{Ŧ5;ӤDJ<րw]Iךby1p):W⸆kuNi*kNL-YKnWI/ldMeOR uPՙ̟ٺ:\~dԅ,1.fv].eru$↫pתtu=ޥF6pi#n[hV]mRj3)!u;uSWw-ڪmn]}/ݶLv ڙCֽӗtx%oD'CxB٘C#зndӪ5!KE(;T-ݝ\N ҭb Nv.Jք @1,)z/YZv7EnDiP=E>kd2 p>c O}2 a#x@: OXY:2S*ei-Xih0Kv? :- &'֜'[~?6v: MpF;gi9HrE"Jkg<®HRtE# Ђjχ4V#d. Y~|0YUkd53Z,aDdR9L]3Kkͬin[-Ӊ4byJ`2z"fHȌFQ.4ԕ$A+4r:$ziiOjK祐EZ UetZ u[?g7/3 MP̱4mdo0n:rO*]ŕITO\39nψ_[wٚ!-fn'r8 aB6g XQK]p'vn#L Ogpn1֚m3P=Ty¥ڐœ6O%O7 lX*߾w=k O3{U"yƐI*!R8NzL?ny+!B1v<8w)$Qzh!y8ke]240=vCezZZIĀq7bú:JKcwf}n^#kt#ʩen|BVĻݍ65 :P3/%X-7 ~Oq̰'Zݽh}8b_ɕyާ&0G?9f~(2zD{;JZ*<^ݽ,!MρVj@8CGǖxɮ1Q: bX}M1ub'?? wgH "NU鎝0oPS $mԝOrhs;EI9PLGIkyFkz7yWO 4< 䯆V3Ҭ8Op9E7ڧK1w.RѼ㛐z(E}} h›^j:#Jddi;Cr TtS6+ʨTRDr$J@k򄫃`IthXqg5T#ODz<5VeZ_khB@J{|T#ħhSM_~4wA*R]L*vϊͪ+`Eޔ/T9fN&pW@N }-K8Է8EZF7۩O@>Fc:Ί{qCO>$>ДUŞl/lS}X>FC6RZI['.͍*TY3 5ԬjO}9+, .-_3o N1Z-3g8I<"|2+5 ?? XHur~z%/)8\l t k9"ӧtoA oR]죇*%6."LP֓#'#ä[NeVJQeCX38}]E+;Ս aN _s2Fn| UP3@8g/bO4( ȦBN vPˣo2 a;d ًí\ .UzYPQpeP|6( +ʷCwf+s0ҥ\P\PvkFKkriםkq~Kw!v1-p렏{'3~wƯ4 (E0 JC`$FGp8F 9aTI0pq9Τs`<jqLX hɰC0f ,cAVG9gF9Xs4J$rqKZZܑp3# "`DD\L|"M÷!N< mN'p@(B)> fQ_0K":d/,#H^h/@9 :ŵ\/2z)Inc[\=*9H^Jp5![!.O ˷ ؘG*YnL7 #Hpfn ̔/T A&!4,:\QO_C&<^%I.vx 9x <ƙ$ &f'PȮI$hx㻆F. UYCeݘE' /E^%{q~^Z;GXF<:S}<ڇ9JKxmkëXn&z˜r n?N"ii<Ϗ" m/"M1$u?Ux9sƑ$=h؟fr~#):aQbLvbGa+o]i;\A~=mpoQЩ>*ߏ0YF8BzK!tmʏPNv|GL9]ENж9HMF}{husUSGaCh'6BtZMbb[+.͝W +nv3V2``mO&&D랉~ϲ\YEY 2rE<ߚտ1} Eh_쀗FYό)S P\T@8/Ë&,o/[ /<.K<鼭lr^]̯C>'ؕ]ҝgʢ'w܅ Wa;l@BR~ 4^ I50 QxL 04p"nf,}$E}#4>{- c§{$ {|oq(*p"_hS]\.Gd#>9/H~7x#~`@|JdoE+kQ?B1Hab.&FV7ML1Mj.uT;S|TmPTnwZ!tհ5 z@qD- q4#F9 N f*eb(Qv+«E?DuN~J:3L&NN;'Rx'Ep nqA2+4BӠY251nn:q2=MH8`k+rfa8GdGsN5pHsF7L F[֧'yS@y.SDOd%fW[%L0-&RѤ-ڪVXU1XL3M@̞ Eb.`bT~,6~LP A+dVpc6{ XPoB͐SmmY*X7+t-:kw6Zs8x0*LQƉܙ4(+*0"&T۔.!@,!1_J~ 2/V8ד 7@XE`8* -0_h" "NVqFY,CLmc[sm `k"9 GTkT_hضzkx,M#' >ab ]yZKF8na%`>MD^ʠߣX/jyfG_Y)9qY4[4Ű̢x#K\O[&+6a!6xq8k(fG = wĤ~9~EHF;I*wa~mS5cZ ma‚Ƃf[ Emd9%3*dOܙNO *ꉍ6k]6C!1Cp px6NdmBmBmBY#+!CatsTPq)=A' VR :5jlK33Kd)  .^ ^$~=+0@>NPd hQlQk#k~X0*Q maxOqZI?~&& >U( ,O5''<Nx;|]Yہ.Vpm0(H'HIg˭;L}_r˩rrwnΧq3 yyzrL=;?D6ΣŶC(?6Gw9.(#WGo@ag0(فSYmP5v`?}f qICx 8Gr;;qKQ0crہ']Yk%=Cc re(*Nl:;P9@B5<ށy`u9c@QF8b3=+Mwbأl"Z+,n^ r۰@#-g+Yܢ\&(Oݧ KHmZd6p,eOQM[dx@gd?x]d |.Or:(,GP9+8t X)*9ʩX'R9r*ϔ'er9 q TOqw˫Yy ߗuGߗ#%o]*&typɇ8Vnb)'E#BrX'_Wq|Mlo{#M!{9xA~(^ȿwgR~!?ɯS'9X,WBUReC֪BK*kT<]>&_nU}j|L cMкIs&o8bKA]T:*({0%(|7C|drr_R.A{|ri8bTL!=qL7V+J)/7dR6L㟨T{EUi{iA;>l0v{ 0~bW}PC~!g4xq!);p`߷]Jw}O"}*lU=hs${Bo]m;.y)l[~T8? ǻUԇZChIhvdtOV_1^)b|]eV*˝9R2ee:]L~;2nȢ b䮢1=}sIGNѲ|bUUP^V3aj::_dQb:T/JQI^4ǟbx1~n/48 'SZ)FXC"l)UzCA=͌D\PAd HDqE0HX$u֌ 38ӡ|?ܗ{;q) erN=>}{|}0hhpa8m;  w&1dS5JK>GTwEoNnxE>v<_acejWA06{:6cSF/g%P+};lx[(%+jV;c R4T,Dm4~1;-9?sՂ=j8y*xb+/]SiӇSUrRT+:oUm]˂82]|QQ)ϵZ%.D KQVIq8)юN9nHO"~Dj? %_$.`(3Z;Qff2E/t؅@Rm?9 Wder2lҏOcn/'%->g<ր+0=$PD"B ~HS8 R '?\$tM*T9 /#ޭ7CЪA_*D|!Tſwj/ \G"Ȓ)P3^j;6[jV{~63h"n9llFh 2}qp(j #AC%d=SmjG%j D!mao0 GCso%9wP<h!B:@p-4kL??sy-w2yMHKRAbxyCӫWZSF~l^|b5l0n) dT F};QgVnkgntD IY8XJҨ#vyi|Q_8\4$Ua_S(ܼ6[xD@o.Ve*sU|R ʹ}hFhMǞk`2K,E~}9HDҴTVDYmn֛;}_ ZjDvE:6_dE(5yҿߤslաa4_.F{#c,\UΕhC4Q¦*oM\g_x7s Vi{rjT 66t2[y|M^,eM?I um!)+ 5e~ }M0[g5EC,& $]Ia* UYʡ**V%4h%4 3q^fU) 8c 'ŌwzB&'/!'t$NF~^utD|jW;fv ZBQ?uA] Z FR%;`@=6gUe1*WP}C>\P?e/k5*dV[״ vc*>W2lh aTBQ2,+jJS0ڷLcZoRPGɷa-$jp#pKoydTM.&Cڬx8Por !VXo A;ۚ,cq rhxjx|P+4Y#k5RiY i8ZZ\'krq"F*{ǚx_KeUߩUM^yy$[+os;]M{O/57&ߗp/ޭxKU&?Ǹ\x;b7H1GCd) oVlbI1I8kwg=~vGHLo.BXW[<)Ej84%CQ5%Mqå5ES4e-hJ)J*E2KqG!i PFj(eQ5e,SkUȏIGd.(QhJ))9o*:M)38uWUfqj6(9|\M92O9JS*HD<ėќZPޱ)#!yS֔*&`DS(˔R)++$[JUjzTTMW8QSVQVP(k5e^S64('8)4eNC}[áY̯L !o3O=>t+d!Qinw Kl'h$`u9[|pSJҸ[)#i;E0Hk1Gj8f̡CtLy6,4fܬS뛓.aέ $8(R(3~zz;$Mz8bȒ) )-^;GqPOH{z_֍+sF:WWn{m,37W t&2RƱRbDYR8! "%Z&>ovJ۔%!!YݼW2e4a#E`+j[`Y"A_3 km Q_Ej*@h澁5o\GkFaI{uPh 4u0%q묙ЯFȣ ]7sHOgZrcwt46CdKiY"yjɆEel3vM ;i ~[CU&"pHjgR7fP2$푭_\P_g+{\Q@ȵlZU= `>0a+ Ƨx%L` MDi bMNOXoGMt%Dд i h+Sc[g)% tN,Bqp<]ɼQ^F+:[≃lA435Vjv(@Kyk[kn2 v:+uPn;LoـүY bh#[)與SDm0!CەEK[e7/fUu̖p[掆8Z4?K{?I*Lda汆%+|Q:-m$ZH-O5-Oy[cR f#ێɶe`\>1nti^?,NռsS9J|%+#D=MJ{2M N8 Sk#6*R8h| Gަ󗀧RX K ;_b]CME|bFp,3z؆3@y5۴h]㒆46yU+k WS1t vt;6cFq FBVbDX qHG$bž]$y}ް1Ľ:Y֭fHXHa0{KRii$ĕDȼcK/U2fM|X41d_~$8MRmG +9Ug>qU}ANA$^;X%G$=1g%m:~HUDf JRPhpld?(*-8Mt,[~EkJ]aJ,=p̘ 6?&NMSSJOINRǖp+7, "wRQzvj[Id' VDΈM)]K)p]#$4H/@'5뽈QR'ىT0Y odC$iV3)[ ' SZ"N4y H-4'[Tvk+ͪ#-OgR Sq!xIk陔ѧe+a_qSB^upK&djRm-FD.F0,R4UPS&zHAǬ+7Bs3%9V<8ilq)bJZFfnB1~4 *. a劺Z+7._ Ņؙq=8xi[m/0x>l+IC~dk; i |ַ7cݲd +j/0n2hiL2ejU/W$Cv78 b0' ƙhpI?42Q}pcC$ ݓNژ1̦Ĕ?UiáN=k6P;`Ю%탽_d]?A$xcz0˵H(V2g *jT܈Qlϛ68vF=p#AO8v9u_GË>bF[S0`3j~ta05f/e_WNi@-W64VV-I>m~1MmE :/4Tօ}vgĽbK77ka:0XxxD]MvVnVfo&1^ { F7,_~ӒKȆ[Y߸d&úxQ%0MNa5}ksZrBcTϱ_AIKDXC5 E熜vNY(l؇6>Yy}.Xfd!y<<  G<2W>R }%C@ҳ'"ҌXW\K͞S 9J$C;px!!v\zhp"xR40VqԆZJ3ᙥeyoZ&=u2Gzy&`-XIirFIDJ.{.ϱ2ǿTz\~pZ(,C =̣@R܊ OCPAaZQ{H@)5V`hE'#& fP,(90B pTSj%1j8p Xq1C i.p-ռ@-\{b@'ak9xC&l^(*JX{O{V2aJ3 z@kቸ$'I T<̄!Y!*SѫfT*9A*^= DBowƏ+o6.5[Sr뤢bjE?U7:oHf=Y =0<ƭ8ʙƓ6`b8vQc0Xxjr#䔖qrJ J0AC`*֒`14Uq`<£:<gloNxxAG{0/Gy2a ]0k/2]ʅ1XX.E;I2f]P8K`i< ]p\<}|`!Ԗ{%p#Pd C:{yV!М!.i(zf k`mv:&g}7lZHyXICTQ=ZC,@0Ӝ' 0^ϥ 4Mw :nٷHel![~V!)Z 7ZĭgcQf́<j+RVvMw15b:hnm e\mzӗ= a&6No2wt6fG|k4V/6<N Yd'm0̨|>,}r?|d8 YY8[ߑc05n{siҲo˱۷ 1їKlX\/MNv .2f0M1ߗ{{ SD6&K D;!z1DhvL%,euy-W_Wj]Vcp k{9v L~0}c n7anc9ۻǰDǭXR쁏ȇV~w[h#;"%iτ&m8,w)bʹG2$+w5? u-Iu~sp#7# p|B܉db8*xBzO ~Yp/GRx wx <1sWmzGx$L8LdtD LbDhg$q [O9L[O}F_h/Pa㸢1 SREBM}'8M9C#jK jiOŦ;;&*X{ӽxKlp /Yx‹E#2a~L&~)^fلy4F~F&wct])Fo;S0GfH7x1r5$8r!sLϻ<ݰwʐQ肻=sUPeX.דA!thv`L X:Hnfgй p!ys]L~ =ek,pvNbIށ}4G{~ET1o̟if.xй &28H-`IEM(tv/tRO2j|jKvyin\;!K6W ӗePpRG/0%4|77@7oi 奝:~x^1 6\w{'4n] ^]c 'ǨZ ^_rr PEu ԧM ozGsҷ =7m¡'0 ޡ-.BIf邿*$ul^̿u{JwyN6Afh;ubxl}*3Z}Oי͏q]!Uyu疣C s0F/c{DW0Pd| 2FZ_ЎY\_%pȄn/Q O\bxUC1> LbSp(Ib8KGYP(\)*pX-b!D%vxXWe[ZK.Qz<(Vʼn8 'b3~"S*lCxb8[犥ۢ^|G-RB.Wĵr7nqIKGM5\, ͌CaZ3Y*(G3Pl0L3$W!1nл(+ f5p%ހlG%ބ1$ޅ2{0K OFo(>V9!hil)ZnZs-qΖ&Y%UMҭ!C_"RG`Η0BŘh-d2@ԃv.0nt# tÂBz76 $DH2Q63> 8+fx*#C,$ uoӃa3ȱ]82Ѝzp"gA¸qdKpe*]8xҀX )RNgUƓ.,8q*Y{#gޅ3}D=`c9y#je,+lNԃdAV_AT-zI|l)r5̐kBncFX,Oe>N 5 exV&Cp<Q^n;O?g\x^^k-"o>.T彘/a G}X") .O`|_f+lmAO# _NZnf8RdUJ1[ Hm, 9؂&X#q2`eM%TCLR up+>1> V_ċ:0!(lg!%<2n!(U +d7`"Y~jzB*`|$w%,6$7,:M1Wt㑺JhOxx߱)#,2FXd $e<y\lB'18R%]5m6v  g"Jv=BHj#bmrE|B¸Rśc ?A!;+hZgSC*4+S[S@"w{Uxiqtƾdht tƏէӳ!9:}p`~=7P@*)8Kg3`v`yv*M9/ ]*/G ZIUD$d.59}xMsSjI#JGQqk;Ҥ"ʐ(`0CuM 4']sbҹt[Id0`n$nD{8(g0O|YE,lR8# uQiZe3xcjO~6b4:v3;=RTvjzլJ8`P ^`,fhu/w<'8`X]6g; U.&ߴ Ga2v uu%5׼kZmKl} S+׷{ck~մ`?57w+ Gp`I]Iƍ `z@rf Q itx%Ρ#Q18zx =M93<84wz977i~IKP6cmA&Hl -{n7\pV$(RKr(%0W?dCPQWt]2"(Ȓ*IUTI7+u l\a%XJwÔUAzd2h%m9UKSLbZF|M%e/4 ;HRST`HWF/he(ץԂ̝fBPex{ll7YHlm7prw'G̓c S8˜ggY<yx%5y W,dAʪ|80J>&o͠H f h?,MHBNI쒽|w#u8R#;R#ژAaWDD{J7H̒=ҳOZryjHu+s=uKR*'‘o9GGCM!9dSh-Zj}7ofH#! -P5J!9{=X׆]b˺Zֵem(s{23s}{ιs? 7K'9@Nq2"NpR=JLQe^PS s^41RB؟sp2Kq`@Εb q\2P/ >ILd {a: NbYb6I#\ qJ.Ϲ,Ex1'KNrr$'GyFq4qr ʋܷs5\d)j'raܾ+EWA΅Dhd5[es891M$NS>1i=CL,8sxsyϤG8]¹K=2~q䊫xykZCI+Xe7pōfNnO\v+ι;x;]9 ^mp^qWϹx0 q)6bm\+EVϜ n`x3<*G/aE}SP 'zʄrg[jXKsnشu~jn:1PLy<9/4@-UN 4^ &I'毫kD/m*)Wj# Lf+y%j46 8!%ͪ+_\J}R=;;Mi@Cy<,AMjg4g/3hUu ~w U@jx#l2'X<2@㰊栿~LpvKs2,IB^1Fjj_rWͬjr%J\ĨkiU 5U EG~A90)`RЊA 2]&hT&,5$15A\]S1*L(TaxQeޝjidƲB08( 檺 {x45"5z`Q(RKh+V5fcbDv h1c6XInyˊIQ2 <&S"r)L&qYL)Nm, u@#OhaFzМy1sm,XM͍ {l@-MMuZUMjbUD I4rk#A!u vNULJ$Lh:Ɣ'dSbSMy)OGȷc?iA-JPez6Uk#:`` YˎX:Dz9dp@2Fc+Hr ܊Hnc.:b5j-M=W<Ôg,R+c7.Skj9aͩ;N6cf [S ˋ-,d*WVS8wۊ7PՊfg=TMo R$`>nHcZ!~7٦<ǔ璦Ij?}1v'JG*&UאԊy +uLIuS 擕6s$HVVcc a5:)ʕ!Vėnʶ;n^]O hOI9'rĵ `XcIg55#jE)#}.~vJ^ξ7D$kJTb~K"T SWPb}voBK~†Ad$ J\NfCBQչ1[ ']1SH4E#- "@vjH LwFJ;xiWS`[5=%?l o ;R9raXZjϨ\=b@~qqa#SP /qxu .'_FƖ!wY UFYKr۟ 7ה8|B 4%WvUll VKp#2[؈MXK-<h\f1XcŲZ\iapYX c5I+P7!XRŰ瑰 .jhhl.\/lh}a3FG(ll[cM Vr|ŔYby O%/[ y閼 ϴՄa"Y )- ,!VRJnBl.'WN*VZ7'/+ \' F WчLy%oXOVSfyQw;-^eɻ Kn-yג e䃖|ssMsdKIZsR"vKvG,Uْ p-5" eK>Kyz0n}I%MÒg-7}mŔ o(_-|Yb!-ŔZ5n||Seɷ;|Y=^@~hɏ?,1ON>Z3W%z18w/-ڒU֒-Il᯼_,nMn= ,m%9Q/e(L\R^fM҉H*2--]X*WY*_OTeܾK-IEԈDUrLR@K "BUXXXTYjFZ#3kqF@K\Xb5N!PKMP-5Щ&BTS0n7 jfp<,5Rsx1s-R_YK.J}mo,o㹾W?XGR;yŸϖERSKv[7E~c@10cC2/b^ACY>qԆ v6 veIzkiaȨ1-#)v܀0M9dcɥXB/*H'ICM1T`\^{S؇(- ;#x`H/]};vS S M Y}H?1(Bzjuhy]c*BS1h[ŎkY@v'E*Y4>'t+ãؑhZlCɶ4xv}bO{`6- KySKR)!|ea0Ow^L#ZN}6!چƠ6fN& q<=+Z S|&;KgvG_֔s/Y6iڄYˈFa 6D=RlPPo` G&opY}W})k7GD#1\2geU?.rGb߫^: o`1 asꢠ>OR5_UGÍMuflɎDyI,{TT @$X,Ny4!F9"& AIwXv"13c55DRt &H<%9: sqBP3 "\\ ;nU};{'Z$g6зqΈАTOE*[5*Aq}LA0oKCi|*?HiDs9bmj\yψK ν7SguQ\JGAİ}}343x֧ZrҾj*'CQXn]6A{Uqac?:1ϛ1X.9]ÇIRٽ*N+7AbbLl[V̍d;f'`t(Dle֝w}znz1Z6Ǚ=] g߰њ`9vj?$)mc+4T=⮦&/xEZQ%uh{9̟R Ed9uf%i*~g@=HEuI W b|l³b_ֹghQ&|DKFA24e&c&Nn2S6| 'E.;/K{qĜ׮4X=^0F6{d$>_:uEF !{k_-MSYOܮܿg~-S_*ҖI^Ϣ+Vr_ܠ73'H+ @4v^c%XZv8i}-~Ȋ 49PIj1tۊ⢊ս)d[_m ]YmoeeԂo2'HAQh=頯Ͳw8fN袠YZ|{R|u8גC|3#1ZXcҗ-`NF,ы$øin8(QxǍt F cLG)ï='|\ogOY<_ܓaZ %>C/3')h}Rlܬ&̛LZ=jvR&u,bNpc| 5ӬKPz\GլX4~G kF IW3H!hꪺ:m,Ѕ3.;G# OYLX3ɢѰj 4p2#1xHxsV5 ̪*֠DsN}[Չ~@hBKgDjj"ia1ȹ$|,7_N_͍viU&\}ڭpX/-mTY{e.l"4AJ&Iz(rP7bf-+'̘3+d,,iUQ4z$)lyIV29:pXb}O&I܇*1&y&j;}qgV?5XUˆ CmʘͤTX9w8@laLYU3A gOkeGw9Ѿ1?=:0>Fh x ߐ LS?/ӱK~ܘql>DL >"be.[7vwdx~^ώߢ"&VD>fCU*1:jvwX;nbsRxۃ<.12 q52u(pm&v XDžyVw(}tr@X]}$¦Z"&E G9JsZlǮOC],#:#HQeVxuq5eҹT;9j`k/AW)k jj|1.G=b1`/G޴l󻼀ъR.N'|P"HM8\S!mi 5?ݑݜ?"8ATVX=*n{S avW#e] !p< v` uz,2 '٥ˉ|}ackN}dcD}w6lav'BIiM 45akPhQEC![*1sr^6 ЌqKm\cߗҸrwjEEߢx 8I:zyR3IM,ԑ:S}?g'|{ľC-]jeC'г% rbhͫ@?+`G+YCj!ΟHC(M&0_0Ku9MNv/= ]DWDy)SwuԊJs"OM%.IvToȻ_$<"%2"; rPdt I0,XO~G._%R'HF33µ)l.~D_67/z폠A.@/)I?=կߏY+3*zlg! yJ@sdb ɉʼnɉ' C!RPCpB:CwA7S(Y[x ց/.)iLE0LS.Aԓ`Ki4`j y8pk' ^AE%;Vdwo 2dgnGKx[!{IItG9j'; W@Iq (mO=ZiUmH,)4a ZtZ,Zl8!0|*]HŔgY"@'S9OaS;Nӝͦ5` $` fEn6uXIK_EP̘13iiΊ^a"b>hV&3HL B]M$=n-1 1Vl<Ǚpx 2K/$$,:w>/i ":RxE黎9pI-ߣy/(<4 f*H(NЬ`}AC`wߧKw3zfF‹9|ك:;?i7@ac8 imK`@qI^2cw iYJj`qfo&1xAT5x2ӣ;ݚt~N?9oH[7%6ƹ1q9P y$!zK;΢g-c(R{A7gaXr}|EAƝ~F>{f[af){QblfOgf2F t`8.p9f=4hCt8eV1v >a{2#`CC~U4L%D ?õ\- [~6PhЁcQOxX I>KEWx57 _ ~g~ş7(y#%c7Qbf]L1 {y@`o 5OYX,qpq/6bOx<*^I],>)s6=ik[crFCKTլM6qpd+r3rgtԄT2.ncZ|fvXsﰱ3iD0jbS;Ԁ9ϳHt@-yS3 Vg: $FK*|lqfahoUMPԕ9Ju3zU5AimiLTVKk_8RӮaCGy/_iW!i`/ /DE/8?.+e6[: $81?';eͰ?Hԟ8ЅVȥ)ZE4;&՛r]G`#9A8aYaU:BxArL>xKx.\Ax .+(H݌FFz*وx>C 7Sw`;Lo3>#_.|IXWEw|CIOI&b9~!FDNߋ R;ōp)bns.YbȗE@B9R E}7=G!ݫrR*gex}N޸CS7vi-Kplpp'*VϭW{|d&er34TDX/Qv:nb;ZPKnh9I2ڧC!G X(` 0UNr#r4 X-ir&/erKNGxL.d k5ޑ?e= PFt0[6cOX&O98^sxX+Ġky-^ [27-FSބț:C8V[uH^3I+$6ۈsHhIBz |iӓ1r 8Wm&O22&^Im#=<i`ë 4qɊߡ\gGrM|f7d,y@hooG6q{9|މl]L$ ﯽmԥcӫƦ`mݺu;z?Dl+dl{?~_!unej3<6کmP+j=1fxu{h{s="gezy۟bp s=#˽>oie͉mڹc 7dvӄ{Z; Ro1k A,muti6cBO([>:qvblY=Ƃ\0[ r=mC=a|`>ڑc#P+B YqH> ȧU>峰I>I"m '_|~?w/1_~}7O~8FS8W. ߰ETj{U:nQiϫ<|]=VꍿQD(륊`2JT8Pjq+dB- ssrs?r^v~FT_@| _&3R2z^WHE ֢s CFtQ숖1-=EGLmт_7|r-P.=֚d%d2,TُrvG{؛J@M9vCL|C -Y[j& FB23VHR$}vφåOaoC;>XfduPBd(QS`Wls$r`Fp7 B9cCjh3Y*eYЧOY=It6h-odUn8dz첣`zf uAA neփ3b,cLg Moq 9AG łHT{܍fC Ms  h.vC"h-,q&0VI6x_g̰ѐۣZ}ukՑ7|\Vn[Mn!Po-5|ƗV>ۖVxex56x]ۈeM{V$~m4u,w;]Ϸ₩ڱ_D~hw8y#ya \C?T>7)$5@v~H%1GPY??#1?z?Dp*SШ(s%fKSJ f;~Ūw;q iMoF妵{Q{{˕%Nl|7fQOH}vrOG+<.})hf%Ͱo9bKu٬w12RZsDE&i3 5jdyC/u4`9jVBժNSAPr WpZwulUTxBϫ%u6΁wy1߫` = QWuUduWX&u'VwYnXmVu?ޢ|@mM/چO%,zDg课"vqj~3 S,0ܢ KhS 8'.2JF&6v`#6ƉCī1QӘ,5;1O4B9X,Ur\0j/2j1J0VF5\ 0Q@OZɍm%8[8[5d]~ޅ #my2P.5VXRցZI!kCj#ׁjNly>Oi\r: zi`[dHzd<Ȝ@^`!mYDێU.tL6K.H 0m?yWw+2O* Sp]07=ͦ2cdgƙ_WQc :ahۗ#*iⴡ_eIAD-QG_1E?xr?C_Q(2RIm< 9c<c̍X?sɏZ[?sm}ɶ~|e7︅~ Tơ 9>*mG9NEvV_"U U%R^M(WevuCYD54UVFX9( y2-G%w}/ t> Y(/%y'+1^P`|`15>gPa| s` ,7 w2dc'cWunnwܰ\+>peW\ѕ {$x`mx `|C`g;b-~O[U\5MCPz8Oo_Bp޾. sG7BJ쁱k.LQ7f8( LӍCb1sq8q/b '0;J }U7d!UR(t@P(v 1a qW,`)Bw,NaD3.z(xy|t:;+'p# #lpgﴡw&6L,XXZ8.knQ~vM4dwM~ BtBL(w͊#c"pqX+ /xb#G<,PM!>޽+ 9WqIwl*p͏APŎkds,m"XkR}fΥ8=Lߵܮ!UE>Q[3pEh|in|l>ߎտiXnʞN@*Y:cq\D|MꮃA"zmhu+_TƃS7I#EZmH0T>JV&׷ ~"+t~Hɾe TM7M stofb%f.0}8,if_\håf 8s5KL 3Gxy bx93c95s~mͬnsm.ͥbyjVfXlz0E\-6׈3ōY~a/4׊7͛d'mު=pky iڻRX켇u#A=tq# T.A YaI+Ӵ0R|䌼XluF>ZlvF@/2WSE\*EwtcDc1\]\O$DTN#Aȧ,oM|_t-"2m_>o첋Iv0C蹇LuKP#"UK/dоT8wŹpO eȈiP濾p^1$2-c[6ym9˕)[ײ75b͘ ǧlg-l-k7kl!>-L$ - KhCs-gpٶV5 ӱ<p)]ۏcY/[I8RKż)%9jT&6u#U$ w効d0ñTt31ttib \8wTC_M˝t{ŴHD$ZJ 4V sØHOچ7xݴKsïA=k.,(Zo tH^5rdwJns$knxh}i_\aX6%mݸj FKbZ%Zv,k8x!os(Sx&'xF8#Tq*֑U%TQQ+bel(# $U|3*>*ADV_d#9YkN.+ZU}[e>׭ic3rq׍fˮTF&GAb6;Ln=c)6E c0M}T޼=fyWHV{/tK{ԬBF[Xyj^<\pOG^U$1J< pʹ V\Jywf3k_+:pj>=׾~tm.:4Up Dr<¯8gs}SH|C7LjZ>HWyJOz箮ԅA3[枢g,v=#C}ߊ6\wqyغpg%!Ɨ0>9-=D* o o=ꚮP=_i3R <#O 'H'>@i Z?is>>g{+{< b.(cǡa*PuZ_7Q~=Ws Sy5]>O/&@py{p'-Rg[anAڪ7"M.PgEJw|"e/<5!%EB$ަM} y9 7H$cOj:.ɎqL5?Ak0Xi&@i#~ǃH݌a1||R 6^ar#ʗCbTey ,=&[)ioJiLΤ= ! ;7w"HcBOϩ_P%T|ETo4ש/f{ TQ??n(X?z{() + 熢hJKS47)n7LQtjЕtMЕD&dKєTQ"='*nv@HE&4%TP1~VP\*R1̭ WF#:Trn@)Ԕ"7N7WP1Ga"M§ݕRqM>LT2MN MvhMNhz<[S_J9)OZ"QB**tWCwt:*ꩭV\櫕v tWMw讖i򱄊8V]3+pҢ)n+^*XMOʉwJ;CS:i.$7U0 u=졻uPZN֔_>7<@ZSNՕܰyw: ?FI+hٚrϥ'ה߸ D=\+"]XW~+hʥqe4r*翣JMJWvë|<+ue\+ע(Mr&خוtF}܌¤ܢ)[u6]Օ5nTfYrU=4|KhxЕ>jީ+hݺ졦╇T#BOuTBTDLj&TM> NaO,OQTߢ;ʻ4ퟩ{4/4*J>.~LmP|f&xo%W|Ew_Ӕoho5_nVJ| ۭO7`M0Mp7#f &\4ԍШNE?/ܚwb4a E'HI"Gkj<NQD+2hN&h,*Ap\e Mu΀9X ucښ;VxW{$Szow7keM z:;%m=^$A")(nhZP^YYC͌A -[R^g67Օ75bhqy}uaX=T̉3P`08\^]VXP> a/^*PŵUʦfSեb^Erz1ȎѰXyrq C}7"e fWϗÐxi[S-'0mZ,T3|v]ea]b"! H4w`=AC8Hf3~A\z`JDrHsd>S iM㚪{Vc`Mcq*NVWPS]وmjHh^2ȭecKsw;&=fƀW@q7yš5kVt[~os;st)AKe-b!5+O[F{PdW{}'㪬eAs/ֽM@1:Zpsuuv{[8Ϫf_u/#R ttpU]X~ݸ qMu3%HK䙄uqbn ! P%zmGM >TK(5NqohvLH"niDՉ I c;on p|X Q윎N%Qm&nWDc^}=Tu6RTn̽g:/mw s<9E%RTnsB+ ZN`64wxK4;ل ;RhiX\/ڃ˥ksL`´y硲ctiE"H V9Wuz%T8"k)f>jJFbfM 0CwXռayu;Joj4]AՉр,Zk0$GFvhYmY[S%'K9ńվG8򴖠(]RZ41\#6wt9m6hb$n ۺ wãT9J ]d.B$;XLwY^ZێfHﲦB5glknF>(Ҋ56E`c6@s[b‚$Z@y[͎&:VUj.;ֳl|h#PMӅ"=i\soFw*o߻]of<?͎(5nۜfjl5V{-=WALgbP)l0K dBz5im%[" ǀ2c79Ni멹??~-zQZE$p夿c&3]_ݫM[~69sដ[:;ej5k[YL\+-Wq45~]WGPS#DŽIXQ,[;@1G&DC3IfZev,T&Pk@hLgɆ*ױG-7@oCCn6`߼ɍD~X*6-h͚ٛ(B7df__JҌΡ&q{)֡m܄Aڕ@#oVrBһ,plȦ %}N)>2g3o4N_G z $0ʑGn)H"ǘhoҶ޷mM9ML&r8Dx?ن.cLe;@^߃ Kjs)1̘_2@:+}wSyP4 AB3( pHEc ?@ +:R.l=![!V'dHAvAZKK l2;Kł>T&H@apG7<7EN_NIYOw}g;G'$G4#l^e>a{9]k머]3Fb1Mfn5X/`gwN`wQq7P{mc{I`; vlm=Df{ GiǨx'h#I#i ZþB݈x]&c֎掎@.Z܈(r^~#8* Ciq{ݸ\[SRw4qn /!ŀ_`ab<A c}nO|9aV26`_|]` 8P'bk5hWe5Z]OGtb.!&I(e(*&7ZS؇*b:3p4+qv8Z2lI~9vॴ{}CajsEy,C+Nw3 fb!*cTT *j&|ԈZC,T4ŚXbb!2Ï'-'GNJT[sz|m2wF_F.g!' B4bh1DbXm5gZCуvn4DݝDw~D!Qzُ8_ZPkq!NM4|!X q:tyg+\ DnܞѬ@ޚK~\C)΢b!%@ڝX7{isy xQ.ZܙX?_, >9r qcq>b2qy,9< I3NuO[<+W[mwfz7Pp|ݎ^G[ʕ\G)\l 59h0ZS)܇k܆A儜+ qgf!}tf(``_;Kא^KZ'ؠUwb5UCu| 03\:;S,rgz [IXބDggWCG  ,pp>nsFȦWy<5J9rh$M(6]YdyݏsL?}i8 ׶1U~d'WK g_E"Gs ܱW{QDžQQBр5-C;t:ClokDٛ<+;,G"3"֞oGԅ<,8O U Cp']_B>߱ˍœ. j|!&xn{I(GJ%;Uhya>B,v*0 ^C[ ~9R;ȝ飻AC!/!r]N^rXG xL !"i*MԨ#sx.`Rй!GU@~d0r݄\35+1Z:jl%R~Ad/?e\PUGkF봟x""_4_ɯBdrZ&@/V7j8O )ogs 0J/ G#GL+o^dvvQȩIqC!;,;R~+tGѶĢ +3OJX4abCFՆO@\Wc1^rԕtNlKCjJ^18CV^yg]Q9Zy}ܺ>a]dOݳ9XU.Do6e9z~f A%t@{~Ȅx~]^ŰGEpװ(/G"=U ;ʫK{`'=4*;AUޫh^oľ; w2M<FP@EbNd*RHCөȠb 4 ˢ"1*rL*rq0oG0 oG7 ߨA9rI lȃa\0.9ṗˑW",+XVfD Ap# 7l7yp \[qmpbv݋2< +&A$^@?IDwaQ$OX]X &-;؛Oo!s)؛F@AcJN(Wa̽ BjH݁* 7`A(qR:cCt#o:8խyلdrYyWA>TT JÜss7?b[h"B$ 7"e^>(G5f"ߑB,} ;5&( Ey) a}nAv@˺SPKk[jw8tkſyDI)Iy;aھBlqSKYhЍ#BIL,f0"摻I7!wS'4PG$iqqar,DyI :NҚbɸ[`IsǩHY\ISfJ,lnor\00He# ,Y(ac(6ޱ'gA O + KML(JY( ^s YE}PNX()ΦCyl)$SϾa| Jl#!D &pqX4=raFZĭ{u{`z2X g5Y#pkaPpQp:az :XNv< tۄ>6B20haEQ}'j2YhpH(?Ar+YmqFf]óvACP!ԒЋ$=kņQ-d q!]dd+mM :2ʭ&ləP< N  efor"k\ؽ!~\(%l=asj #5s>Xى lX{QPql+InANGs01 d–W~mqeU$<wC#C=pl#:C~iiLd78A8w8`ޏr mF]wX8_S>8/}p& Ϣv&$e/)ZαnYX I0cLZGI"A7} q9￡~<g_#E~KOAgp.p9Wa fwrQx xo"I1Ox*||,˳Y!a<#<>Uu|U6CC'[kYM7(ǃbf-VC].酵T /~'\ gbZ3UP򸮇Wc9*o%C!cD'>t3D6eχyct^ ZEp| [aJpb"3ص-)$?L ۋܱG*#J-9VKC\nrR{t9} iiqr@ѼL]Nx3sv[  }%kwuS?Tx"}+L1O w܈ \r3Q$"T%AffWֲ}hi@)C 8Y2YuTFQl]d#N:Nx>܅XDD8v.I-eMK*2ܶBe3 ńgd|{@< xzCVHy( =xyHy/,Mj )ORdM)U=jͰ0ۣwJAwpyoA#l:y 6mzFc;q{7~'!'E'(E"O?<"ñ͊ kc %VPеHQp,/UR12ye%ΔQA^r"AMqwѣ#KBxe;& %t 02$e~~C-y½٭BsZK=tz|cm S(#n& XA> ;Sv6fy<8n skNՐ#Q}Cɇ*0B)"eLP& (a2 jD9Wfj |1ХT)J5HDͦ ` IkF:&6ηIuI*I8Ќ!Ia,4ml#٠M>ڐWp^,*Ho*<=Oq);u8<(K!Nir,x C9ѳ*0\iA4yXYexܨA'nލ@u : q>`x Tis4/=fy"r28C't¤}9X!$DN!! I>>s8tX^>Gn>G"ҍW]BrNDIA_!O23a &),\L* ZyX\ -ȃWG#BM" sz|R AZ&)dJ#6͖AdKDŔEHn)r d.30]ۄg/S݇-U +*a^%Z *bX-2$m(OA aa}LX1d'`$,PCVNУ!1CS!&wa9O5DeA"[3|5N\wϓdžPy*s/@2DKptbSa6MmRBN%"b*7A1믠)U䃿D~Ō:Lx/Ou5%O=?˫Isܠ$#>B1*Oۿ@{wG_C T(Z{XfӅpH˅pLC {P%P E(OD |!b,|+1&͎wGqۥAwEûE h7= ha2v;XnJ9DPmc6@Zd]zz+ 6ha,+x{}_A|Rbĉ0B̂|1,-%@&>ٸAAR ~j$Q˾ĥh1JOXe9חnqؖ fۋgS>H I<.,ƀy,E1ke[!?S<&7Qق7ICX\IKZ!@"H .\q-P'ZaX b=*N3p8gV gʯr¥fcommWJ( (-%L1|""+b|YGK!,H/.3Ő,.qIz+dsߴj~ N_h_nFEdM?Ć[ד~e}GYAKфcM܆ "f G=ht2 .9(-|#d05F6:E6-LJ eea}^wMᱼĚ=q鿗*GtfBWކ+9v$}0Bc>G8PH'`\ Lb),@/"Dc4h.L@gG "2;p5x X JK-*e;!\GCӪɦH+b"?ZSZPz-XPUU@3})SlY,H+Ӳ ePq22 ^J + 4W $<0ȕ]Әl䛔A3(RBp WZI Myk`'emT+2%]?h+cP؍G*2>Qv1!rBZVD |Օn`HtBk qQQPʃbW!wLW r P ) 'Ak]`k6glmoM3'ȼv 7M0{*D4ln @A 7@CSY'oeNJ(=)t0p7Co&l<OCTFsHHsU B<v-:s-FD,qJI{s鷄-X,롔dCn!,}L8MZX.IBoo~_U1Ƌw_SU,PL2]xd@8ӵ%9j2G-um'%  9g0W;)P:Np \C,;\ͳFp

 `IOP׳HJ3\/\+:2gO/g@&bhtp3>+_[r9:zb)tTou Xm2<_FKh@7Cj*Dpt/daYI;Y6 vq5'SEōcДBLHDdR]Hw.<>|'Ϡ9,r \Vv7֖ *5?U2rFX~O'T2^(aP ^00 {g3-f$섧J8*ChEaZN cd#V~Db?2\?pTWŚ54i,tV;veY进l2 )ܱ9+'Y/rͰy\&s X^BHq&ds&Z#28F OIV} ppKp~~'3FiE(Ȼh6il&+l.d]jW㭰`S 6IjMe#Nڭ!GwOΤ֢U֢)(OEQ>nv JwB۱HtBE:HrʳARnV¡jfЋd4770mZG!C{!ș::ݙ1A!o7Z{ .6v{ s 'DR8EO9K<bw E2 FyW/.[qˈWOOձRiw8cmlioID{6H $SmGLbjI!Z)z #}hv@8{Ur;l;YQ=q';`PMn,ɦT!b":(q-gӷxb2 ċ[u+ Ao#??,4Cu:TO-pLd\q(".Oْirg$kjNJ0<'p:XsWE{/ĽWK Go;%ö\LxRBDQfD&1uCdFg=ևH}(LՇ|}$Tp^'p>'!lX)&PXSkkĶ{;%$L)~~H, 9N: >S)!6R-6R<")?TluGlt|rhL*C&lDb"8 *!WQzL`/68Xh 6-Ā͌:qſAaKM2FHOBfFmBOd@aPfs{# & ;Imd]߹H"iCIN6_kLu'|8BDu!UD|nPzo>\dH;%wRLE|dT`{Y0Zz}%gȒ#¶?hmh+yA+(D U"̧9&@ZY) =7:PPG! f]#U(i,0Cl2 `~!/|bQH=d~VwȄdD7鿗 k{ĈVT "yĚrSdڪ,E:uIǡ_t5$&0՜\fH# sVɑEĹE?YXCAz+w+rQ6<>-y-/nF$#y򉼇;!^IA }M"4 I&-i]mꏷp.ӸhhXvr#22 52 Ux#Xzǎ+U=B /TWvko0~#yT,aU.,==%?Tߋ̽Uc0Z a,՟ _D5Xl2QbkpWa͒jh#?ꔈZHBsΎEA7? a+5Ɉ03!u!a(}h1g˿APf vOJ sX#lU'1VDÖf9~zLS]H\k@yY-p]TFe3`!ZleCaiRw0$ l-:2~EVV|c:~V7x)5izi'*(WHP\"鞞0yv]rXff,%'%)h +(AIkXP]I<= z UסիW^e5@GP׽V8D/UtAe]jMzE3O]E|#u1EVpQ᦬f*Z׽c"nST1U/36ф۔ZEhN$u6R(F+Ι64hOSitF)-2*nFOn=Fo;Xv aju4h,@.֑24v,">?禖E ͗C3րC&NQ!bsZu/ߵaK8T': u mqw8ɲ=h,̓D5+q=Q+Zv0Ǹ5~0C1Z'lٴPmjP3i2T 衤z9n&̍"Ֆ;q-xBTłYIʪǐckD.WqJ9긄B*OÍ2X(Sx,yTK5%u۠\Mmd6g1)h,"6/78X-Y-Zbզ65\ P.=o0,+1%"0zL՚c,c֗3+Y·R#6JlSZ+Yob^RnetBǪqB2֑Xhb Fm'deafR"v,06rlr b!dpATGQ@iS-/a=p:$|!l_Дb6T 3!q/E )aa;kg#`nF\)p`BflDcOwܬu^"9^ 888 8888x?;wz/}~A]!~A? => <<>OOOOg>u,E C72a  u ӍӍtn "A'@'A@n%V[n%tg (GG鞠{ 辠z@_z Az(a=#A=cA=A_ *Г@O=T@_ Ar.=4]zBׁ"ЋAF7^z)e^z%AVз^z55ׂ^z= o}荠7f[@o}AoK?KŽaac2 Xa XQ X1',|FTZ3 P=x!s=x!WjUha (-Z =5i@D'ܵ." ]+/qWk׷.*yfE^b{ u[[ܷ7to1~45=e'=yuu?yy^vs'+Y3uVgѳ)Z::"@qJiPV%ZPFEbҲxRnW)%.UJяvB8.wW:n,X9ZQ'su5Qs$gʴ6ridg`r.F!Nv6\l6BN!eɟ"NWϊYJX,)dg_`2(96P>2aCkh%5 ИWŲGa)CCNZ\ 2rΥU,Inw)ՅXjҢdSL939l*59E}11C2;".:󵉲rȌ8sшrszQr:k^8YtzjЭ],z %?'vݧ+fCuSqM)k0/bt@tǚɸ)Z.ru1o˨jJif6mijk@Q]YDXl,XJH!!?EN<*Mt m0M]F)m2 7BM&$j Դ4DQzPzSJo9|UJJ<ɈRgݯ7^b$iܾߒoр*rUC{SU@8Rԋ`,D2dE(Ye,%U uɇ"3^mg"ffY^[k֓J['2 YzkYrMl4dSn6X vrMq? 4ws`m)9ô|V.y?)1abUWN I[汱ע3zNɸ&kusfeax-kl =ԘTZB6-kXrAڊKsDm>KϏ3SWӫnײ QGLʨR#!}q-h.0fJg1֪Qdy)m/uŽ*eJbRIT~gFʲ[eGeYLJ'p]/ s<+kj߲y}O 4ɼHS jtM˽\" "Ve4.ux+VbbiԖK#cެDO7c|Y!N2$ "CV!.yMdFPtk(^6- hI${O)nL{짜THf2(PƗh)mu/)kd"ݛM9z"oZz#ԑݼ1ͳO*Zre'm53KD}) 1=6aOGIILWj9z9;uybx 8%,hbm2ISLpye˝ۀ )mBqo3j-6uS?o+mCmm'dvqmGj.x1^[/Y4DryMPmv|-<{Uv2-ibo<…}wĤK̈).M0 1_ٮ ,SyڟDS,xUgEjYL gYĚ؍ =72HC 4;{GZKkiJz;{Rڳw?jsL 9 v54=fcFmⲫL|L9}He5r˦>́2mR|w]Oad|nOb2eݚhfhwzӫkkUbKٚfm=Z`Uhߵ`yUT1^&VzgqɟMw. ҆t^Ŵ,9ïGjաI\D]] ru=:;rMRFAK&Wӱ_],#wEF]Bͽ˸x`t[쎏5Ak%N$bf{vw;amk41O5(GNMEm3miyWSc)w8: m8kb 1ئޭ{w۹IvvA7Mļ9Ed:]+k7c^nyw:Z]]bjEBۙ;ȒђArf\*x /~`SxؒQ,jl ll ll8DNR`g$]q@HyZ8Dss<Ыҫ5u ; Ǎgٌ[p}+ߍ6\ہ;;3^X$J%^@ > CGA~ HHa/57 ?_O#_OOOOȟg>d`r^lsՓ-'zEDO6X=fb״f#[Hq߃&{q߇(}?q?a܏~ p?up=],su^`C`#o 覠.ttҒCcȒn%V[nnxag@Τ;A1g?bGrٜDrYAt/нAt?A}A=`C@=q"1gs*1gI=(УA=8AO== dS@O= ; 3A=sA=x:1gQ>Řo4<1g%Ɯ%J7o jk@z@Ao}'͠ .wۆ >A.Т`c&ТLsbLZ>C@?~t9 ?OXŘ6oƤ֘bLZ#Gǀ[*bLZ|OI}S-rY~_?Z+rV?T.ra.;?NN?9){G{.fwo999Wh^kl%1.x Jso9ͷԜb13b.f{\\y V߿վou}͍TEԟmYUٳe{ގmgy-omR.g: pqF[BtWVC'+Af;sv om?:?;h?xN?Z'!K-6OȷTlǤu6J?Z 8hO[%x|)}-w~o}??Lx|.>o>Bˀ![ [A!5kp=|6\6QOQOH?ZsۀNqEEE} {x-HHH~cǁOX(+G_ ?JG}?z1?zp ;7N_zB&]cN_NjkvovϚ`ʺ웵uyy1sP sh֯Ym6 U ) sZvosz97󳗛 o5e;3opxqX^*o -垟ndMph8(hQ̪Tf'U 2gLֺɓ}egoHf4{+̾}ֺfk֠˝̤yC+qҧܓqdepd[ BA'):νlF X, F, z{gཙY9yx p-pp=pF&fV{ۀn $n^>~C2C> }QO~ 1]i''gi3ggthtdmGFpd#!YP D9@W JGV ʱtdF1`0DyB`]`=`}``C`#KNґnts I+,ΤagҰ3ґHGV\3ґ4td ;#YAt}AЗ@Ѓ@=PÐ+Á##ccWNNNNN^ ~A ;+YA{ssx:׃^z1@&K@/Eˀˁ++7o x;F&-wA!}v;@ 444444444444444444 |sx?sx?_~vUi6r5k=Kȳsr̦9S͢=f"笙y@p8&ߛGqrܝ-GLrXpl/-FbW`7`w` L,l\<{{ˀ>|X| 4$4 0 |,,9(*h*ԀKb`S`3`90LSb` `K`+`k` =HCЃ4@T<{{/^  8888 8888888x%*$dT4kӁ(7i4M&rFI܈Go  x3ۀkknn  x7v& ;IΤagҰ3iؙ4Lv& ;IΤagҰ3iؙ4Lv& ;#*OX(z@$*@s=x!s=x_E<"QHˣ4Q2/g?yS{F[GUb{s+vC yJZ(nsYdeceޖik[VeA[#їJ@U-u8~K/)n["#h؝+}}*DFN`T7w7m-{siOڟ{ʭsH:SY~/؛֥rtv@2YGL =0i|GkAui|"Sr:?ޖ>).9]IQsC?ZoQG]]-7&N&1Z ǕBľz]=_&6GȽ S*Ѥ/*"X(TX)p$_a܏iQ_iI2.k+=_x߰sC>9-+O{D{Ev+>"T.TKVR;LNwE9k(J}i#KqNR֩~c[&Kʣ=ev9Dt{'+;اC9iD= 9Ts|vD)jSCk>=nj*6LI%;)ҟ8G(:5g4i=%c1udVa j,:UBCAKwqpNԎ3ĩyY'tůkb ^.ݘYMbʃ ?vei(ɼ㐶,/TOs'3ߝv(!Ίa7J{*1}lEu-`Rk23}r Y_ E' -s.!D>)N%7db!TM+|r;,0fb8y#XGQ?q@vloANHR;)vr@~kǣhi c`" kut\EOu|*^oF\aOii,nUr$ڔ ) kdSzZt^'o 'wHf\RF)Ĉ~GPmlq_K?P\-)IE}6y_DADK)_^A+㿍W@_O#hD3[h.Z俇nWwЭ]t{wiGR#C%i<'!Fm[61lQoڅi O%\g><%HK߉2mvEj9cntxG`o(_ϏjIVxN2et9/?i,q;_F!jZ˩q.~..c4WًٲIp9N]})M#6[Pu47v=Ni̖M }Zyb܄]/*\nh9Bud?{*-WTB֟pE/vppO+,ޓ++PR1;%QܮP;(Ы;āp27rضnt^dIlp˷vR<7I=?kӏ;6piV6u&W4偖*І ]JPa<JU\':Ћ ?3@?:П.0P`b+9QJ<0Zi,0Nita\mPC܈řu!\)n"B?,AqvJxjg87%ﭖl n)+0 0KlCsih`[gxlN}eF)A읨/czG\}kGqPX NE&^2e +vv.ˮn#1Z!R#:A+k؇)due/-ESU6U`꽸zjvӻʼsV}MqGvGjV~⬾-dnkhm`M\Ё=TNOvnz>^f|5p> <R?Ijп?#yq Q5.:zX}u|,;*9|< /#sl#_tuz)}x⇊|VwJs ):SB Qw" } i60 eRbPRquStt }_R>%+?ig8JLfⱟd?wLd6ɉK<ibڇbPBykx ~'_s3 qaqrDs%'/JYAłnP"s8=`PdWamoH(pqB 4J'F_ڿ,&m26W*O=:d  6t ӾѾE]T72V˽~؁OQiWéiY2nSj6!v(5]%^%n vډ;J|h}5,W*K&#Y{9%22WL8q%ވ7GBdtWW'*ѡlՌ0XLE*؊:P`[@4,؅Ѵ`wI z<8tDZ38J r5ceF7ߛjqj߻>yyMrԅje7fΎ]";{YYeiNr* EE۠u6"O=q"[KQCj eWDЉyV~&+~^M [&JTLPFR!vRiX bo~IEZQ:-8e<+V)$ӨIp:%3}puΦ4(8*0N.+hip m e@{w;,e9MTuPFTd] J"-V[E*rXנ"*r@ũ"uT$q$ [(J-wj+G>HcU xxtCh,B{wBlEvTyJ9ҐJښVNxDxOEKB9rf1:UIw9ʙ %mm8 5g+~SdES2S SQNp;.b7^l+ iT-|ۓ{\8fP+ԽCh(mOϒnmvzK:]9*C[\:ꊍzs{Zy٦Q4g XI`W:'X~(Yj|_>tEp"CWeHB.nMXngAYU%ƾzPA{OV,kC6bXVK+E K0@O+_FK=αsBո'y\yJSH{V?g*?/c+A!oiL;=.W߻Ǖj:LP hhF1(4spߖ6-% qbx!\hYf &#{M"34Bip~h.ʳG $C4^Q 9Ovv)r`017]aIW~qIMRbءH"YoY}FP0Zig \LdkQ9i i i i l'10AG4;ivYu&MȌppKh'J巵 f򆶲 = t/%9:f?wГ`%Gf*`&So^\6%JBJ/FG"ωG-gWv vC8099hZIqf5..ѿ$>?O?ʟ~?}?}?}֧_k~ qIWC^>Kvebĉ} Y5]wIGru#I .gvs#Sz'0q;A:%Oyr% T>qRJm>~G9dgz)/;c\5WjȽSh)w4j`(;ț<|R///Ts%n>c|WT?jHNEO'QWQH{2H6_pIʕLNZz>KVJ<})* 8a:s\z7m;|)b]nƸŜ'jvw=lћ]󇂽խb}qR-Y?%TҽV}%4~C+58ֹOtMp\(P~8J yTCZp]O=ÍP>=Ĭ OtK{{ޮwDzO6n_Z3"{'I_BnYx/P(ŭ!k9(u* #$_ ℴj2#B1R( D'E_^N 2yJl.H=|:8|s|![%;WBJ4)$`6S۠+vq?wNE@Hq|7npV4*oQ+N:jK8",R;S4܅ ݨi' C}pƆ`FWвZCciGx< Ot$<{ʖSnl։6r9-i~>2҇I[e9øqh5 D8]zʧ97 S_Q2 m*ޒɷKfO86,r,N﮽ t\e(yb,4{x: geK3>:^D7*fWҵ9_nhUx5m s·-v>lai )}73'H|@4jI~>6yvmbI~t]J!"zAuk\7Qnx3wQ(QE4A k`TxͣM}QXU<%_l Q'6@Wv--sӏNΝٲ<@fi' S]*ínuӏ_bD~2g*#oaff*c9\7MĐGE}s}'*qQ-CX/tql88XubU^5)43~) f}et:>ˎۺ~V;fUbpj~px8*5$y*5¤j'vﯠ61#3jGQn#gVSYfᯨ85 JQj=U4kmtoĠ#/UEl$ޏH>DH~)FK%;o|~$y$7'S؟+r^;z]j2Я֯aO_dFkj)9Rjʻd!QrMlB|Z#kov,8O- }z=2C VXHR~%&:Q1Pr|VqeGP4ҐESH3E)WJA$⯙,.JD2 3pc{Yw&qIyثSOvɫyB]*uyr\2 ^p{({Vfv\zWZJ+#@KZ.C‘T?ҚcjKm"suHg"ҕFFzФH/K#hm?m\F#h/2v@Mmh>[jPn Ȟ@- уRB:.ym 0yl[UU! :&%~ 7>B-n^[zm!?rDն:&!(ʉ8@"WR"2FRIA}"iLd̥͌#iid!wVE 4ITgK}ݛ[k HHAZY!Ȁ"Hq~-*d[HTq1RsɯYBFdeEV:ܩ=pp'|d KV"@_BX_%9 z!"k(7G/DjD3FBս!Z ,@D#aC.A $CJᣴLzd+ .*K";lAdQu?i/o_Q DvJTҿ)$e*iQ0gH~(vUҜbf%]ߛ(vRhrMv"{gu{rlQC"uc&YVc\~>.-O؁؅OBUwt5kuV1X\~-KGLrX@qjOS\š, V㹄qkkTC:q-PSnbAm@.|9im礽 `%CAC>3_$\qe穫hd 7JSgٳ:[|ۀ.)ԀDwx] DgGzt]>@=49f7=BX} MN4E*@ӖY?q-ӜxFiV^\Z3]u+[E|ʗ-ÓB!Y5#sމ <9Ovx"'~ tL=?'ɾH*"Ģeq(VJѳJJQWJkJʀ{Uя?**k+_)REQW啘Ky5Q>e)(T-Uݱ<+m5ﴊqXW{8_Q) l+Va0ބP{ aSPZY Rn7ZXI䄀JqǕ!O7rBi".VԪOM ewԨ}/ oS)4ZkiʱNE8'ec!ͱdJ(@biÔ7}v5+w~5"WgMS~@?hetǩL+t& ۔jZ:P!:&OǥC*ա3yc)IX΄:ؙ֟~H/M{L]7{Q%NͲvo\#Eۯ)q=bm0gpu#i ÅZY]rD[#qfq֘\[]b)+6Up8ʏXjGű TDcShHl]Mccmf=>335Qr^t_%ڟGrytTD9)ПfyL^ڎէ?^hɧqxkR|,&ɞ[~ej8N((uDbOVq=7^+=fDܔ+ExWli{=|*XK"j;rOBj}n%)zĖW[hr6712/vg2ay؇K=hTO 8d1$E-68`gRYwYg8?OiVmg 7Ų=ne];Կu(oĐ*Fp OI.(^#Ogueq,+%*q'Ɂ='9펩zXONRㆴ fz5z]T.n7=Q4YV<+nV3K,љӮ$W+q7fo*9b!BùUJ _FYLEɥvB;.<ΫRڪӥ~>͉ƳJ@<U vP脺p\7xqN2 zhJqW-x>2c)7 ..P>j;f ѸCtU+űXӭ#)v*qt4vN3V90"}{SJVM%{G\NNQwW\Gh|G.}f1\6t+ղ]KDK~#ޢֈ ?ágve}ҜxdhpZ!9qy9<ޥt;LŧBb])hh Bs6N=C]"l7\ u"/?>.z/"ϥ^ (#_A b.ځuvX$5k.TW?vuWvBOXS>rmZ:ܚkU|y7&{rqDpaMWvl%(?

v c'HFkK|J<jc;ىdA[!>yoNN61ȭ".)uzth8DU,),ҩ,ҫY3Bw\ZY ?ԫA#>8BZCF!:my7P o*$#!AiR3nqS,nT|R$nW[*խO҃'izInIߓ=S'%RyY.Rwc.۳ƴ}܀O.6_RC)p)kdcz9yԅA_ODcbH&Dd) ]nMXL<P¡/^fQ8̣ɠ{`(wEI>bGZƠGn8ÐزJB %}e.;WǴrtDTgE$V4ֹi  \yC'}:+FCc=z^"ˉ1={fHz!Ȱ٫F7yhrEʉP|qh;wSlx b0ٟvpRo"df4# ]}^ɅŔɥ䕔+jʫZk7(bj,Z1~'% uIR6yv%UVwWn2$,4!Biff!.1N6C6,*UbZR[-IZ8M=~/z<_<xX;3nM[{;w<}~?{w^lI0,` 'NPsԋ|zD1E_?$tRH{p>d`!pNĔ1 5/O)4}G% 2[3ޭvٝ +5]=U3Qe4I+|/_}\dю(MK?|" x_RW1(I5C$qe43LܭW%4A?p ?[ُn▄cZ f>~'d `u-.VQ.KZ*(7Nz~in[dgcr\GQ+/U"E$0:6P\6\rҲŹ\g'by;qS݇uekk8NC =uֵ8DK{H8;(Bz[L*5*#p0/~̈1ܺ# :CrGغPX)nCMVܢP{e}aMe `xLFSTʼniٽl[2cJ˰)JNv^lvnk62TD3/鼢q;jI2Zbi,BOZ:k _;+\nD\1Wd*μ+ y1/ \iճ1 a mHcQC'~R:ї Pi~F}FF"L=G\oW*w=sZrX95F@GCEV9NPlqI=EOEXyY\`} +ڃNa/b}Ȇ1[dm蜷<c-IQL-6*7!@. ar(C9@.8fDUD Q:">hWD1 &k%Xʔ=yٛru^^g&޼ܵb.QAN+l5^ck:Y5*ۈkyYn&bxbݸ.ĽBIJêVO-(=\qBU'Bkƺr^Ɗۨg^ݐ6FBFF>qssVYl D,6J4gQrHy}^2j}il W>;+!zMfu ]luƼPC~BO ϰtP;*Gp L=JA9>tZX$tuvʴ,Kf)1svXftA$l/S VIv{N-o$!1 ?}@2c#!zd2ivV8䐍SNF\r6:䖃!An?664+p[xGK1cB@ # 6ز c r &/VJ΋pc8qc\f\&9&54e sLq W8r8Ѱ_AGBڐ԰B^p8f>/f*#?"Y'Mdsc]Qr`{٨hˆSSƶi7:.sLX: 3gLCD 1I!+uLo6=x`)B X6)͌ȥ™iƳn]S/+ݧqcVIƨlcޠ.LJzVfRw{2hx5$YS!WF]e.# cPoaOVyõt[2I9efL4ßkb=VlЂfMadY=gy*-,NӐQ[m+&Mx6)޵7thKc.yX!a_d<^a\Uz,Z(GVR~X.4YVq5WwcvHժ!L:p*u_߉5d,AJ7-ʉL*:fY"[CN*?zgfi@JFqpδ::K 3-"za7gYɁp7qSBBB>e_J_1 @,>׵C2[=ݿ}3Nv6'2v?4:/6-^䱞?O>YXB\9$l{le^"m[d =g+t,>]L ~0%K#+}|Q|" ].j6r zقZ.BJs>qC]B6A K#}+lvG{ӎEܽxEce:陠.I]؆0|;*t,N B q^$I;St9[6b. ~Y9<!m!VBꢛ{u'\:YEqn~_tDcEqXJӣIF –'Q/Ŷ AJQMNytfخ *F:P5x7)I[$OI2^?Y)џyg9qbpl'N[v"!sJl4N&QdȒ+Ri!P J  R VzA)=h)hKK/zS~3VOO%ϻo߾ꙷ4(;T 4xrQqYUTܫ89_x>gC9 q6م9Q1pW" JqL,,KTTx3A pJ^j`^gP^kxoР?هUY>~o[5 ?;TN?A ~R3.֠QSl{UONkp>Ԡ!~>Q>|y1>ڧgqsc}̯ѷG58clE9;8{ ξ*> ~YůpW5׸gOsu74\`~_s*~W= 2hp9?W\ϟhp5Og眽 .2_VW*Z܃oT~4#I?kp Eſjp6|UſipɕwUw?Up=o>|SŷTB/ zBad};G=\CCYkAd=r-OD3C{|᝞=%vy~~ȠvK(< zǼHFp$ {VH#*P=K¾Bc̅d$xݭڀ/brj"6TDI Sl_?m`Eϴ#c{{"ݞa/N ?< #](m=C/<Օ,iJBk -u u v!T5C׬=4vխ-hNQ+UN`h^G[b\+y3g ە5D\Cpe.PǸ56'"d%~?{!nbLXN' +?l$)]7B 'R&BCJpp@R꓊AHKp'Bz"|{4(^ΐ֕ge=q5=Z *8#8DAj.IpgI-n xcķbwC i2W;ifģ..67Miw }!Gk˧j;3Tà:&!<}S){̗eH5Wb]P`CCЫwC0aKGK!>+JzhX>ɒ dAywQ5~2Yͬ]-z}QB})=om眈6enWI#[wK7& 4j4#0/&t= xO_Zzd>:Z AfRA)yPGpTd:3Hf1~bճ*%yOGG{J!j$ön7 5 7wJ2YDcKcJO.S+)x X1X7H).?wA[İhYG۬8ݦPX_gzz0wI8ؾMLgG3vy&<+.Bs>[O_f1ʜJYSUXd}}"cg,uvJj8嬞tJ#w*'N,Tc" aUf3ީΘN;q 615Nll6!>m2a6$NؑɊȄil`(Y4d{f#[tgCN8ywcδ`;Ҕh߫ġoiϕd -F$^MJ+ b H;0)y#nѴe˂1m꙳;eېt؈-٩t*]S)) 4`"ĩЎ>2NJ"%R#ȭ)II6!gOKd.] E!8eH$FLDb]LKѪRV^*~*QÏ4'VXJMEE̗PJ &|]Vsyλ#,2/F#ão#~9AEֱ__:*_0vCfzokSӉ=rX &_@Җ_wj۞ms 2234f kln)67<3< SS%y\9Ji %3sv$W!VLn-H]iϢ%ʼnIVb:+b,韽OK۝ )_zUff5wɗ'(vϑQ#aNB :&^0~Y=Zh OVpj'm KE 5ة-c{5?l#QD\ HT酇w\4{**Sk+,/.FR_[d(jOwqtמZk /Ęn۴*}tLʪ~xfZlmKe2kU+4 9Fa.$px/" _Tzn$?VxnNx=| ^Opa |xAXEý;&ֻTz ޥ *}J6sap8r8:Y䱷@d6|[sՒZ2ORx)J u/c!pʨXH_r4۟#~*juC]!>^M/ϓMRpQR(@(CAas%Mv8Tǡr\+P(r\]=+zQX)~E@>h,,%Ǩ?^h?Ӎ'4/O [>9諝̣K9#p%*Ҥ mُA)F*alFZd?^lG.Z f~xVZ猽ͥ|t^h_ *4ψikzdG?"*Ծo+d]US1u'*T ;<H b҃Z^X]T~dѤVCZ7DW骑!j_ OKqcX槅N <.ZN _ @y۫Vr%V=tiVe (ZRe%ߍ>xQn@Pݐ"]%CEl Lr/7U/&04=_jZ.5],=JBPa 0I.7$'zy!7(VHd 4]%% ~ CvX ,_5R'aC u{ ox< A,FsdxǒEgߊx?G}CQ,O˗M.οs@ +zjϓe#r 5riuN;a&/^ێ8P_7>i ߯$`z-"ARl/]AYvsP&H߅6|^ +%H`Ѕ6c8!ޢt{$:mqUqhN e 1`vxbd%%~E5dz9v ֺX*u _|ԁE"AMt`\tʱ;On5&4SLx Oi% Xn(lr [zQE;WGʛ) (tQ4.өwiuq^<QoE\STC]߆NNE^>% .TREk&w6[N\Rw\ȩ͵S%# +04R(HR ( S( Ɖ.zA3m+M[# ggn e6(s`26*Edbخ™"8OY RVaC-?L̟8Us|\JЙG[UyqXZ*gA P tLdTg.) Ǚ=y9RKfk!T+M_Y( ާ=lh{& şi{j%/4mep+Y`srd^R n-?:dnp{&kѓhwA&I I ,"p]aQ>m$%C$(d!Pً%bIUv l(Q5m+ ձSbTJ%b6b).$\%HYg(gh, G8N:)q' ᓎsIJ&0#~9vq.rYɻ rP2B@# M5U5>Mj=(H-.83P.AXNQ *ٺ4CVCؙ }lv 2⻐PvXA+%u<@_xֿ;]UD >C O,PQ%uȃRau9DU)%# M Q5vs&@oF< ' (g\3(P.]Y9oɿD?t>N)i\I.LஒON&1i q^mf4|~yGj\ì9l;_5JnbmZf5p8U75%˘\aVz9f g(OV˲A\T4},W JmXjJ˗zF‹Je®=频^O+R`WZ$EZdG`ͮ <==*+g ޚ,SrJ/O ˊezF Z^]3]k'eطiv0OL/,ْBjx,KK(d:5^iO-Ouz;g1@e)Nr!Jb:>v nͷ䌭hm蹹a긌yx[CQR;cXuOwqIj -ȽA8 :W8/o?`X:Y0*cVVsi1ĩ#;KZWυڶk9G!J$ ]Sp]z? 2m^p#"pm\:ymPR?:SROz:~Š^Ȉm3$:ж)PI2:^BFwx3/SGBzאz.eJW0Hä#R@4s GJ$ 10!?LcDҕp>ͣ>:\~b:vd:ĔܦaJjj&n|6пmj6H=l"i"JhwVs,鑥vhaA=#!MLKemDomain.classWWUtXDi [-( H0@I',nu=1>A<*x-:z+p {RX3 ˕|YOu|YO@o;$ptIONn3~#~1[ݕ4vјXZX"d;ʾ)&yѹHtwv-Ld -cW fe$bw CLg _i.뺜UIҎ26]')IOG)7Ϡ̷J$J%|+[42lXeu(?M˼mOCP>%VhtjJTweYZB'T NP5Bu7z> ןSoClЈTd4a\~5FzF%h!\uVZ NH&i~=g+k0G& /0玚 {)bMhd&pp|hVSP#ͼkA7(A70oVu Nq ̓Q^ufGptuDz[8d.L3yxʪ,ƛJnԡ&nq|HZ+  P1$|S6>з N =Y.>iUg&Ɂ*Fe44K|!6gkT]%f5+m JJ׸ÍU ))mg hՍ*<̡͌j>VU_a1N3a_KiMl 5 aN [MLodQw9G;M~ E8P2ZJ3}_drzU>ÛS7m)z}iA[-JTyV] >Hr:12f;RW#* ^s5O ?*;d3Odm{3m}1nez=/k/fZy1*.hFtvl[V7D휃$7^붰JڳzM|>PT|X"Yn(ΐ/ҝ:My&K8BN_bAhHoW6LoMC@ H)>:_ZIpʗnr7 *n69Fn:}7nA(5J "ĩ?1ԳF'*A/-{U E<>3$%I}EP8,:2X]3Eb;KlÇS(6H+<L4HcpGd2?OgHN$W1Fu 㬏 ^9B񺯷@knp,%_ЂH[s |[ykoc!D(8ObĮeRJlHrBڮee]]ulRBLqXc@`emG`Xn-{u}\=9s~g}1Mt ރ xW2|W}Zed/P]() W UW]X(gy xMVu%yW?s?P_*x΅UB o*x˅vaEYڅu &MEqa9yrSHqR>\<ȅ|RYLT$P]<ȪT2PR+bJ)XN,E5T2-2ʰR\-52\* qڞȰwh|28GcAol4շQPk ʑ!hx kx}CXh(K·'&c'a ,i7X0ٞv{E6lXМ~ZaZSf–̰=RVpTmp(%loKp JzBɱ`d?4o{ѽHHH(Jؖ=~1&=Xvo#/6@a`n]. DFgX'4BhtwB9oY?.nR_8?aHyk 8 y:_ 2/#i!=c/0c E|vyFLxPldVg!HTp0#,O GM&R1>o#QY`77ϧyvgz|i6AvLw8*nQ6 շgmfᘮB0~-r"z,!,b';?c#޶pw8 +\CU?9{}H(<"GU)VD"wnOp8wO6e c|#Yz Lw.;UQv`Cx6s% t%96 Sey@DےtR˶Lo祦\ 1.NNLGbQ;rrHGI}r 1v"f&Qfa)̗ɵ[$XjlqnF-|G7mfY ]3k&tהTBhHɏF[; nF^ңA\"\!w杊8NQ1oV&o]H V@E 5HUaR*8"C*1"*`Tx ?+H.Κ'M᫄ ٗjLLazKg1h(D"!͌çSALH Qi-SaAhȀj }6wst%|Y4q]5+booleC`gذhmVhJ[ILeFGbi•IGO m 55ei*ِ:_)ԪRb]ILe!M:K`\N)벮Ҝ 'ujKnPivXqq_'iJS13iLդ]4dSyIGk't%ꂋ;ͮNQ0Ω).Z:?4@7*WwM* > gE׏ [޳sǯO gR~hkN;M߶5nw8LM'| xGad7Ը:ŻyV꺵2ps'E!;AvAUZ5YŖn5Cn;MOgcJF!{~g|y3'WGڳ/%H0i3nȩjcQon33F%me(b]vwtGDWzt$3Ј(xfP<͡x/%s(,]=ǵ1s/c6za1Yڊ僚oi+‡aܦGO0L'e:?˗4 *[<53bkgq崧 yz_m<ޢady,JcИw0[e"]63X<%,s,N|bz+ PkrT{6B԰odϨcXްw?bk: ?e|? ܉p0["J>Bco9|xbʫࣆBUT]HIIEMubE¦Z'y`gQ4s\9x3h>s1΋S~W۳i?c/p`8{(՝lxy.^@~io0% 6A4C|N=mcwMy^&s\Tc[|2bv$q/oAGR'DxjCk#?I,tP2 s·/!ᾟc-]>ĸG~c-lpGwq]AmqeC6}p?ޙ 3;'aL[ -Tk$ŝ ̘U`&VLPS؀)_zcʃJ'PeRe)sSSRb!)_/Q.g3ʭOT@rgXgXg;B gqƈf&r&\LƔS>N0: EB n?ޏ3OY@ Y6_74y [w'ü0m݊M2 Kgf??sqPI;$+gJ\uO=4 ;䟛fqũ -?dOQK~/v+CHp_9'I^`]MfzZujЯ}6M:=aAzB_K8Ibަ\"`S?7 /O[H|9eR9";J,g|zԌ+9$ŕӢBcr+DS)#DFsSWhҪ\iy3jk.}7:rA5tִlR MGv\~|,훾1"{˴MpR'X{^CIgea9'HwuCVYk-!eM})=|eJ>TtgG'RbRPoxZ<%-P29]Tqv7ʱñN1N, N/uC$]?6"f4| =s,[Cpd{)0Uw <ս84ovku,A\!3i&u_O ׷aZFf)4ilF+I2whAQ{~b6~1Z [lE,"Y\N؅vhMHK?Z])AN$7g#Y' y߅.JdYVEY7]~/K2K=bC ^bQIqFz8lucC-P[(Ärгa{|Gg?1myC'y7EQ\#$N֓8a'q~9a0 BDHfAq2df&HjZKP룾EXZWGnvmUak߽wܙL^l=~3yO=CD }ALNbf'8ɩlW8|:NwR:;ALR8[s`r8W<;x's=UB'E(_3%li#KJs4OWx 4K^R.r9+\!%N*ŕY >])I p >S:+*!JNZEN^g>Gke5uw:ٻ ,&78x6rY79QެN:[d#M4[D[y oSM8<_ Ƞ7'_;|kt]af4tI[@p\PN҄ +QJ۸eg{qǽuKK=2k{7XɅ͛woRnuojf͵ -Mͭ2e3TVKa1Uok[Z5dΔږFs(M_sSsc+x]}¸)2h uV}>o8t+@O_wnw_mjAv|ވi^n>oE"2Y%jc߾?Ptc)vy}pE] c[k' 쩯Ix 6Y)>tWa]©]jmo{Vo{7F\>oVo( }c|*=oOE~P7ZI".H[7kN:R`X(2QQi "}<z;N&&{ uz+j"P;O$`/cM`yZ S ާ= _ Pk@l'irV*n7lꂓISA?w 1BW$^,VâτP4; z#!L\DbH^uwg/D 0-qro#5w{0g2PO+}ᰧh u7LWBdzh#|VOQ?FiI 3ySn/#4?}.i$t ۭI#x#]5N7FX:! U^tepUu JդJQQػy gYBjp-$쁥-,IVОj+MTKVsb;qF*QQx?ֲV&T]n$q`p__o(N$q|M޷gKwR1 G$8zơMg4Y{[yXf&wp ec~D܊d$$^BDF4JYc$ܨPSM "ut3XўdӴn(u捵JMyU %q%eJ2λs@{>ĸB/|3E4´|B.WLٺb^PN @}m >OLHʧ"5SH`ƭ*Wk*XWq~Q*T>ȷ#anmSzI;[tZTQdGF5uMU|ߋ6:-,&YU6}*/T>W _>c=3C~L/O@/#*F:mER4Q"=*MRpʏw4=h'TxZ-Hj`ޡUgzE?*}$͟mAc WRT>O.yHaQ(bPZteII꣎2D+>n.Y"Sr0"qK})iL`kuFv|kٵCЮFfl^=RXLީ%Hϙ%Ze"r"@~Ʉr4=`4ɸe+{vȒ$ʌdu8w;-qI7~`^W x<"B^p xjgm 6urJr஘,m.0vLf/ҫiW7⪭IWiœXt4]Hr^v˙Z &5Xh'"`&X?IAc^ $"CwӬ7O58q;V _B'9iUlAgp$gsnd2J ߿iҝKƿ`jrArF/ x%zCqX_6D'b6DˡǓc$9CL_c5!/#g@ =УZ@ brdg3DYeeCt ?LOh*=Ijz酵/!̖g`Fv*SKI*HeObI; "C^I! -LZfDh] C*QqᣤUZ:Ds@m+= a: :-g0ִP=p|a1o \&fU&UU=͍jr'a?Tsuh& P(?;QxJ*-0Ҷ"r`i'j1a&`%ytDPE3SWvvnQabGtŦꑈ_iCO>:Wr _vVVA,~k6|/l15+B>;xY|1 ,0Gg ˜mGg!0[uD׉~;drZ8mA"!4H0%y1&" 8?fmq62-!eOy,-Zr':BIR;&"n3$&W FW ~AZiP6"Wy:1bFQFr9Ho䰥Zee/z,IoYЛq4b,&nBxh4^u4ҤpGI*%_Q-rU)0v-v|c>i7nz;;)ǩR>lx J՜M+ bDL9$?FnGa#g,Hsc)ps!@fJy 4t wfUgګH/]KKq,.9 %rIV9̕ž_"~ ~O_%:7ߴZgZg9V)(+Bvc+>74>"5FM.:ۥqUS \uoJ%HLI_~{\ɿG?v+_lKIDhE5`ا#i2Np>{bGqI|KL(jbQ$$o搵`Oއڮp@+lpXۼ15t)8pPO;E#?R!!ꓛ@c+2K4k&;}RW]^f QW1utSs@q'A!h[5i&L1o3"n8%G?3lE5l4_2EB􉁯I&IE@mM5ZleS0˹`T\"gDREw>.SL~=( /X"F*$[crW D2^ Tͥwٙyfn~$"&ІL0pԮ; 50оeWռt0L=e^͵,RMKmUt֫ҬXb SxPv8ԩ1Z|I@#:fD*vt$хYEw|ĽJB#'·iI\ Dss:b",b> a^b ԓ؀䕬=cӄZ"C4sui3_*+oS,4?Rz"zx2J.tY򈄞X6Hv =dBy- I4Xؓ.bۋ2s{hЂV ߡ+MH3@>.==~¸ZV0gPJѳ-E_5dzE#lYкAV!F!i#8OVa6~PK  CZڋ-v<org/bouncycastle/tls/crypto/impl/jcajce/JcaTlsCrypto$2.classT]OA=Vb X?YDD4 IMc enm@w Trov/*q ӹ|K:*9{ ӊ:Zq-kmx'B:~\LbO ,&1+I\5맢# X!&,"|G) Kdoj]X|W! w?8E5EU|Ykk19M2)>Fۄjcwe%(x𙙻ͅ% , 0@ȃ@xADH,B6&(V+?m->Z4*VZkCG[kkBΙ;{fllܹ35g9sf³>8׹=Lw_WzEmz]gp—:ٿ2ٿu'{Wg`/5 f:;dDv:gs k.:Os$T#|$Ȣ('w;hf#G:M'% Z f|Ot^$,'Sc'#'| T94|뼄ң|::fst>^>̧+ugSt/u~ Kt^傍ԸWx9R'_N9r'_.Wң\|5Rm׺:~8z*7,z9Nr1wx+=.Vos弝]B˻Pux.;<; ]Ht~1\B/u]2z] 'ů_.q/kte|.\p&FWu~ 7| Vk.ߦ]˿A\~^EL[wPy wtt~u>'O^RAz|=Dt:?w9#qD?;!'O:a'Hv93Nc'f9ßON3R\ ^翢_7:oWU'p?:57 v_wwAږ@{gAɊPW[POno=`{i~i@켐@G+Թ+{^V:ZC۱#Ŏ Z:];;PGU{[lَ0%z_oS{e[|˺B=}ռ28J;% /fhc}VjE2W;M=7׾wը wKʃ;#"kڻkC5@AeцiÀ@xX>|C5ު;\M8?rU'eT7I|;Ha[S e}Dd40!D>kHA)$DHTTidp..砼=by`gU[W  v_G[7hWsܠ/=ڃ;i4!bm y{[b!L8. "2Hvg&t_TDyzcB?/:+QA?VHem#gjEfuEaC;;7T4epfI֚}]hP64 = t4.F`t`]EVv29oAM+JК%z["H^b܂\@ 1$jfxִB ul2LL Ƞ8u$j"o~ʦxsnW:6]N 'DB@eXz];hlӒXMtHBҽm aM 1Bhaˋ2AjsEN AKl`5(lt}2Uj.Z |Ev[֠Bd0jtXL&lz[$ an?Zgw3৘6nlM@uFiL#]ձm"[6'O[O/jg$7 |UGk٤*h u'mw;znbiEHV^B6V|~ ^">/͉#AoM1"\Qk =aXO#q`m-E/ jb>dbv[ `;ڴPl] |4mؿ٭Idgmݤ~yR 1Ʊ&ӠTDBЊ|ˏ #Wh4Vi,lj\\Ճ0)dKKII*f)4w3RjeB?ԎMp`FL2I)bž ৶6Dkt"T["G ìC,ejR%/Uɳ3oaT ҚBA ARB\UUvIv)SrHoi/ (Ő*ƯnE;f(4:F55=2XTvSO{{Bsea{!N*gM!uG IS/:qDڳ}ΈȜ]qH:vڃĞIRwF(?tY h3ۂa_{IQkN|F0k/6]O #E%let.$n8sVnS%)?)=FnMR4̱~#ݧwS3bnr0*L*ېeD IN"G Ω\~YQ~2[5qE7'0Ϝ'2/McXqjMTbeˬ/sfV(@Yhlwͬ3gU̘YQ&ǎ,zVY (` 1X.N6Dl)l.HLE15mÕ hXYZec! Hu kѣT56.[C 1_ uq!.TU:J=7D5DRC,hb!VFC4m B{jfOM^^6e†X)Lj2b. b4bؠ3 q8AAOPltw)K.6liIҽMU,a0oPLOjpkd I|$iIX7˷VNbشA 2 le E@n;T!v1D|08f )5>Ct +q̽osWhGaCv K,A8!Q8;&i%=T&yUe^!.ԋuq!.kQC\&.gp*z7ÃaOdc9*V!+a 5V8mYlfc\H4;!n̛3kzH`?pS;j hqBm1 q!_Ն#(Nd 0؝`0Vt|k ac=8X80D( )& YQĨ0P'sT;m &KaGv(Ӎ Wˠ̓.yDF!DsBQl2k 0F~O0:Exښէa@jna3\Ia=AtAvhLw隷;Of2!-onlyC &=kLy?a$wg/M| \aqGX?/֢ye⸑n"Qʶ ƞy?"guG2$ġޞrh'cxہ\rRR'"BQܟG$LPKcS+A۴ f0nPF6FeЬ&+dqF8t:ǭ/gNЛv:}~SpQ9luy: SMJ_5b@"ecO)͟L <۽ӵIekܢoffϺR`ۧ!8sW8ScnE}W Yي@GiPd\ƬY1s.Olei0o}N_S{0C eH` +BI@[v8B5 fDF$!eb]ïFŘQ-߇t%6~FX`n` \9c@Px0%0r0H:8X/yFstx}qi}`0a[[PZyTGz!q0X%7S-F{P_ů4WQ7Kꑆit#5õl,Hk8'Qx9#$!l+@IAE4i::ePtLd6E d!&$z@Ni-*u6%I6lQcќOh xh&ɄîgwbXG*0ZƲbV"i+rɳ@ŋA_Lb8{h< /5pna=װ=%kd܏l['- 3_gq ƎɽXY_?L5kNmEfǂHcձ8-b;Z6,5c{Rc?Srk{U퇙Y+RY-0>GKj>}C!\3(nvp,˲#pXOF/k|.㺢r˕6QX,K\YcKdYŖrke;C-/VVe'@3u\!'#c|)!R RRS4/ъW$xo<BΖ Z௬f[ !OEhuƕLX#UMgfnV5!Mx>\tgϑr9 6.,6[ݽʆEl,N}p j"K P @ qᔱLl@IB'X@*+FUPݒGai,J"%.22iAcRj%#[<}EPvx?A8Q&Vprdf-khyw˜2z_h]hh)mvؓv(؀ɀUE,AF2,{XU YT38*0<| ~T0oE,8&8۠o vkyu0hFܚnŬ@<'TC|A0t"Y'(;v[*>Q8M/ P*Ůh0dvp]~p6=7ʱMjl9ocK6?F$JɧmRc,:r:̃JtKӶOø@ſcCq!< 8 ` *`!?+iXʟL<3e dH ,9FК$gsPpjvr]s2 $r1Mˌh3ȥlsƚzD7Fss%?f/,;jnen3& t9ۭ߃j ݋q|TClH}k߀L o4q[[L7Mȣ\0VW+0ܣu} 75i$GЊg-a0j<2?W TԤEg8E5KlLySǔL r0_(X塙sC ˂lO'ٻjPFLH|]F.RD%+}ո1-Ցc{ؗ(?2B}=Y3u6RM% \\ZnlIs`S06 ]þ,':["M^vBK!RL^RY]>3ݧϥCRhDcbp%!- 2!ɲ=0²túwNnw_e}ӻc7HQȾ`]`K6-p;Aob[SSڍP aX bS,JNa_e7) qŝ O-Vm ֩J2(G o X,Cm4FoM }ubyW[~+fȖs[0͍HfߔH} wm_џpZ笺6fVI=0"`E1cpELPrxZs-\ n{wJ+P(mB§ ݥo@Ҩm)).A=D+=`%9+?*-̊$һ= fB`VX>~Bx&, WG0Yf{QMJ]}*oEs}"3Y4Vz'I+1QG/hk})GN=z)ec~xRGtz}0kOVhĴG?T0<~xҜs`JW*|k`t$Lqra'~i(?J,ԊAV:ċ/APob2\%~{ğ Q%H5jaL'QNtCSz 994F]fyٚ0Y{YΜ{ X?R|G [gQGt6_gOt;bzӡEg&61>xU| m[,©R*MWsHQJ˹vm^۬oDњ֬o8,]F).s֧/m<>!( m"ϔHF= ,"Pj !:l/Iqj8qňS iZ&dh GsC6i0K5,Vˇ&$h 8W䠶8)Z/ũ, mJigZ<癖84oH!لI{E^%/^|Y_#\=~c˫ї^A7m \M۴G xJks~kg{ xa7v 0*¡)08 /Iy{^}?6tz3O2IoIXa\:5g!q2 .2jdYVRdiKi[pCPav.%ڥLۍJX}Z=Юvm/jE KɊ.RIkOFFBzaf&wո~5HGus> sFmncnbh_Gu;xo8ۖkܺoѓϞV'_\1Kŏ3V*ל,ET hT0"{0B.z-TBFjhn̞MpQ 5gZT@p P6tu`@q,F_1"?Zڣ | =e; kKP~yM[Pzu-F*O˼R2o^oZ/_&:?$sIiL4TX;+`Ċ=%e&?^&wڋ&h/ª k%).kWb)y))%/X`QWWW>#%LJɋi%5uHɯ,Jq.QP-% mH>5;'Qi5?㑌 kji%WG*x@W8hK{x}}hūâtE|kͷ|[0П^fP. ٫XKC/~~HkΘNmVJSee-V~=CɛjV);Lv@K9&NVNK2W-^hJ'Ҕ4D?/ {wzu^R4Ȃ0ˑsc`8TxvL:DwcEtmN7gum yB9cI蜶EsϚRtGΆv-im#+кQkn>kq6'bN~2u$rRQ6#;X\iutͺeM9/.Y3'prǓ1!5.62YC ))Wk:Q]iH6G΋s KNr1+PԠ@Pa絜},xdt*2l׼bz v& H9ub o),Gu#㚎-ɮakY.(+CSSC&Opn2}zΊl`F\a9^Z#[n3Cx١p2I:n6eސGP'$?RyhTY&5昶kdK^?Vчc*IŤUPZ,#Lʒ}ti󦕒 eKhWSL*~_^:%^U+k ^WVZ;#[6F΍W{Mo*MTtuZs5+fYm9=k'Vq S*.KUp[13Y-o*wUUh^݅9C G}P`p-6WNٲyvMfk~WM'PP/=ū,Yx2'yja!V:iX6ߒu%^ ͌PO/pZb^tMr/9/ćO; Ί=tb1} a*{xd\CO$'bU$y)l%]]#d&jcI ?zg]>bx{6ȧC89Z!<}ۨbZ:XY015KHgq;;\6{@zN8iYy6؋uWzOהrm;uپ,=NzA>SU{ԼI7i]ۣ]/ND.q,aԢEvzMj͞c|$p <8K3QYxc<ֻG u:$:Z:EܐHvXWVyf5ZdJ/{T_nPFw !R0lH2MG5 QDru/2/qe+z 2\B*O7Aq!/S5;P7}$WUmXV/[G E2j`L`,ueZ*J,:<ͻ,a9'Y׸^n1~DLvňC WD1opƻx%eM>n7'ԭW+x F;#)?y.f"xKg]/LhOL4'F#>mφTbC:Qtmcڞz%uô;B=R+ >!Uld:,"}V KB[(J0@I'Zwc#GydB0~{Ͽ fdqWo80N㞊xGe]}Ovd}:C0ThXAY,՜YRQ3erEE=bD !8ʎ-TNV {-X ,{1:oƚ:T435XtЗ eӱԠ;ѫfem^wt[ G)C%YxlEģcCBĩ4SS^垂E"wGFZ \̄H ;8R7fzlFM%m+$USnIoALUF<)e">h%M3d,~oAnu3AW KׯV_)aQp%rF&#K`C?@Zl뎠BAҿh  thAz2Q^"[Kd檫r-/F`*x@,f%a;1=rc v:JE$,[N'=3 { ɬΣ*5ClnU.̸, ԙmfU"GsuѮOv:@ΐf1!%&Scg#!┶McЍ!OHL3GXRɍibVm̈ϥ # 5Y| 6|e #  4i8'^Ť,^ S e<3m=/Rs _KN|Ug5|o; =eKzRn81wc}9봷utqq[J%~&[~LW3/W5zد7ì;Ydzu/ZkS(OQo]Y-,%s ҇SF^2pXG8ކv *lބͭ3Tf߹"OasNPTx&iےnQV.A7u+X@esJP ژY ˮ'KN\YQU՝,_3xHi-T϶lf<-o> pծC-[OW40rou\+ eB.?qSϾj utG%)Xh@;rʪ0=T$i6l^6аVz6B 7!B֐-7qOT*):5 x<9UgptvZp