lxc-4.0.12-lp154.2.3.1<>,# b/=„{Dc9FoUn$>{⒒'6- Z{\L"[o|| f%|uk SBhzNx"4GCe<ɔ}7q3PKz|.Qad3`'P2 ozl`ˣk3p^#׬D1¼Ӝ厑G]\yEJS?*vG_ST5ݑZ+bsއ'9Of,>O `? Pd   E &`9 n blb 0b b |b (b )Pb*b,b..b0T0p"0"3"(484$G95@G:=5G=>?@F G bHߨbI0bXY\b]db^ubcd2e7f:l<uPbv&w`bxbypRz              LClxc4.0.12lp154.2.3.1Userspace tools for Linux kernel containersLXC is the well-known and heavily tested low-level Linux container runtime.blamb17openSUSE Leap 15.4openSUSELGPL-2.1-or-laterhttp://bugs.opensuse.orgSystem/Managementhttp://linuxcontainers.org/linuxx86_64 if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in lxc@.service lxc.service lxc-net.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi#restart_on_update apparmor - but non-broken (bnc#853019) systemctl is-active -q apparmor && systemctl reload apparmor ||: if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in lxc@.service lxc.service lxc-net.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable lxc@.service lxc.service lxc-net.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop lxc@.service lxc.service lxc-net.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in lxc@.service lxc.service lxc-net.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart lxc@.service lxc.service lxc-net.service ) || : fi fi}hh nhh$hh(h0p(gph  &S';Q 5 . c(A0 5!8 )*ed '/MWphjTr1A큤큤A큤AA큤A큤A큤A큤A큤bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb5d8ae1e7c3191e60e8162dfef8fe2d729ecdb52d03cc7cd4ec3ae511b3bc7b87e8ebfb74a7d8100025159f5ebd4fae7cb2c9ef9654c885163889fe4349523832b572a78f97a76d5616cadcc9114828b28ed88a1bac276835538a97438de616c07cc5915e1a44c5ebc156f6bc43abedcad0ebb9a458e8ccedc36cce698b02baf5d5abf19a8b72678f742139ad05394c3b7d51089d5446a477a6c5c6f57bfcab1b89e1d395fea1caa7c82c809efa93755ea92791c9135975a0f3492f2362f08760ff79bf270a6e192f7df3a02bb8fad2e41c53faa5d339827bceae7db4725f52f037a41a08784394d5bdbd9cc35ae903c024800624ac89b56439537f1637a8fd28330ef84022a6ba1089890e48f4baac6e25c14c24a9eb5237c0494e4140f0f0f2f9d6661eddde3a53d02b1911cc00eddad242b055f1ae7a33f323f3ff05cb63049c4d8ba771818b547642f5c70834e31c3064c571e95fff3cd44b528800894fa4509ff4534b0c8e7f0ff7edbb2a74decd75a49e534262691043467fd4c70777613c3b053bd413e4ebacc76c4d808256e5cd1cc64b42040f7ac82e0adc574d2bab1e3460fd0ebe1046a4c82129415980d43fe2335e91eaade21935a6c402e36d47984a15a5cc6c2db7333460eb992468450bbd809677fc6b3dd6f09afb210d90c5cb5103ec85167070c9c9a6a0cbe7ec07ef364853f9263c4747232a889d4994e67519b5ee756914a1759b8b1d53d48026fe1eeb7e11fb4a9311efa89b2e3ab3b29f55dc8b4bed3bc81a43d2a49dcce93cb09bfa9b40821bb7db98e22a0ac0cd00fa1e2410a89f96a855874e077bb929dc20b88a9f6ba7e9dab1512b5ce47532ab43ef45e3f8f855507e1bdd2bc5c452286730f689b781527c13c723445bf2bd8d5d0705a4eb4692968166319301945ee20b6ac6896eec54ccc846408ae994088bf50a222f7422a7000c2821ddfffde6680b6e6dbdb52850f600b68dbf35d32454e2f0edeac8842b5240a5e4e15aa5d8db344cf2ca0167ea7faee310acb5af5dc24e385b6c1e9630b19f8d4e5b26ec4e361c4f78eff59d1a87383e15908a6947a70afe4201a1afb96278fd96f596575d1b223e8dde2370a2ac0c803ea90272cc2a4475e90f4691a3f375d43a1b2832d7165605322f511a7b18c5944b90ebb6f6e9099c6ec021438d00073a597171e4276326cef5362827e06a7495cb2e75c7933d3197221750fb115dbf6a5a94a7c7b671b87bb9846ebe9015620d455e14390138ab07084ce92f6f8bdaa3773145960db41fe56fd47ec49b42a9f11102368730d61b13540a93d700fcea6c742a1a85b780010160f2e1c5ede0b972902ff9f50d26d1bb7b857bf62530209af5f7761c97a6e01ec4bf8cc3dabcab3594e8b322f0a6cfeeb97bf8af1932a06db2ef1b04c0d1fb2ceea9d372e2d0b26db44a529dc212b5c1da6d271bf123dae4d8dc71e1f1505f5b0241fe8250ad78eaf33adf4a594e1d11c202cb56aa24537ee658d663b3c8434d435d9464db3c81806206ef793415489c2fec72d9f45935c7f30f8e91be6a346c6fdc67603ff7c68c15d34662afa9eac2622d3e2532eb3c1abd4bf27955b520bfeb4a7d3d026bc1467a3ad67fb051550bea4bfb96b477517957115e03e34689df10976b3bcb8de3cde6def2ac1d4fe13861c004041d9ea6d2449ce40592c1bb178d508fc66cd9a6a797959dcd07db7edc33aed6c760339ce953d6df733a765080feef9d7574f55f68f9523cab76e850738bf3e82861cd96320d596d453018f4c60f2e5df7403d1e170b056d8fbd0c1d5b083ad243a8e20128ad984bccd47da4d16a31ad295f35754f50f93cc7946305f5f8c63fa8b379300b38ade68378950d3bc6ef1fe9da40aa4d568be63141d6a8068c9833606a58f24b93278b8b86ad8f9c68c5d3b3663a9f37d1e46f65926411a4ec47df9eada3a2008eb0776503a1c5546aa5d603f530e846012212702c5c06e4fcecba4044156bbda1d22f74b873cab0f5fdcbcdd863115a9e9f7ff5405fca48503e7f25092390d658402c702a6b1a82d6c3408ea68116782f92c739680e39ce08d4d1938f944f146f6862f9acebd0312ffd840461aa1f606a8828055d710423cf74b626d105ca49d04549ea1ef6449c4cde0a7f51738ec7cf17de636e937c314dcbbc33dc926faadaf63d7cfa8618d78d40abb9b5d1b90c8ffed530c043152ae7f42b08f8bb50a46f49e8422805dc5cc3c7ce0a520eea177ad06d8a5b693a645950120a42f545d7ca760ee14470ab4121bf8ea613e3d3af70d8cc8b626be12fa6c51fe9e9ba5223eeee60c36c2f34390bccf4dfdd13a7bdd8714f1260d0dcfc401b10a107afee84afbde5e339a7d6ca67d76522268022cdeaf72e8331884f887601adb16c3a92cde607dff789ee7ce2558d2e789f061850f75deaae20daf979202972a8fbce9918dcbbd290670fefe8ca9b2223abc6c692fc03dcce6a11d3797fd58062abc93189fee1e614416d22fd0937aca41c17403d4a75da37c7384a2d983f2959b17653a3bb39c9c1536f20b98c33253bccad5a2174cfe96d4d95edc7b028b50c643519b7176ef585034255416c8548dbc72b4d4aaf3fd60ac27f8bd674f09771a0f9e96a7be3a6bfcc65400e18503946cf4e2558145da5690b16afad66cefb2e5d8029369dacbf089a4593e067144b5a995d14e370ad3db8e385ec457c3edebb44b6bb08a8f443a337ce644a5dbe140a38774af8aa35ffba16de9a7488abd98be8de98c8bca528dd8f2fce6bef1ef1894da6a5778da0a5285a702334fcbaa2485e81c96efaebb2f52de6bb34e037bfd09006dd67cf76b8b8c6342d9f9e6da259fa48b5db8137016d94345d160237f713c126de63575196c61e064cca583861f5371ce7287a02243ccad69eb6eef78ead18e091d043f88c1798d2c5dd9c5c4edfd3242167b8987fd6c419606ec2d7e8d09adb9e9cafcaa98179da1ab9c30409b968aa05b5b901fef01dc065feec90bafc6fff3bee636d6726eefb9520fa97ba3e5660f18de0d986aa21db89baaa43fae5d5d719bdd2f98def31b5492fd66fe5e9252599b707e18a2d2226ab3482efb9ec86558fdc3c11d4d6eb18e4a0ae167d7b438dde5f748e90cece9cc1daac68fdc1088ffe40b602011f803f52a9e6ed8ded7f053f660b8013520628cf5faeb94a806a83eb9aafcdcbeb0cc7e6302ed7665037e70ce1eb73aace0c872d7ce5ae06c7aed3b8cf10c4751385c906aa3a849e8c141b3e36b458801cae17ca7ca3c24c90b75c1fbf28f5e0781c373379d6ca145e928f888db32b0794706921bab4b6980bb51bda4ec56b9787d4517cb318d918b1445e896530b960005c6d69145fba4a9407e4e2c601b0369726ac121c2f442ccf46d5ac8c0251ed61f63e3babcb102f705128e99897fd2699b7ffde2a27e8cc1db26a67bd91ebdf88f7d1d59ef4c8e5c6f674a0a307f6ac69e3c6ef60398dfe8ed376b6a6c2eb5515e0f97dc58c64471f0df044fb5a8b66b69ab61ddbf41e7df8c84e002f6241e38277441d8de53f97e18dfd1572a0c69fb7a61f7393fce6942bad81b2fc35327cba5c3a02156c61de2a00c40c77ff26a6857cef46e913c7be1d3b10a8019bfe9d089b5faba1b549329b2ed265a994c9a0a8e1412d9fcc5577acf5c55d2b5bf58752a117405349e434ec5dc2ed1c9214f4ab8ef534bd0ff90a8b4a57c8b9b29f2136c46c963cc629dc2eb7d7db0125754c8ee2936d6e924f718535b20249d0d6cf30402c84f1c50078598e1424614809764d462052a589b7c24b4252d6301073faf956a10d27d948019a1ae0886f4170dad0766342b8e3fa7fb7b56ea4146398385a6c67bcb9a11344b0a56398712adbcd3674dbb9f2ca10e2b7a25f3c94956211e0c2c5b49ebf28ff605934606841c973ee3d2fe9d2d9bf8ac1ffe1d5cf9e45d620e18d248fb514f145acb44098fde2c05fb7d2serviceservicerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootlxc-4.0.12-lp154.2.3.1.src.rpmconfig(lxc)lxclxc(x86-64)@ @@@@@@@@@@@@@@@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/bin/shconfig(lxc)libc.so.6()(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.27)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.2)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.7)(64bit)libc.so.6(GLIBC_2.8)(64bit)libc.so.6(GLIBC_2.9)(64bit)libcap-progslibcap.so.2()(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libgcc_s.so.1(GCC_3.3.1)(64bit)liblxc.so.1()(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2.5)(64bit)lxcfslxcfs-hooks-lxcrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)rsync4.0.12-lp154.2.3.13.0.4-14.6.0-14.0-15.2-14.14.3b@bb@b@aex``@`@_@_@^^^k@^^@^8 @^6]M@]z3@\ \\@\@\\@\@\X)@[@[[[dC[P}@[!@YeY@YKYYYY[@YX@X@XۡX6@XAXF@W@WW\@W@W@W~D@WZVKV @V @V @UU@U4@T@Tp@Tp@TTA@TTy@TuTl@TN3Aleksa Sarai munix9@googlemail.comJohannes Kastl Johannes Kastl Johannes Kastl Johannes Kastl Johannes Kastl Johannes Kastl Dirk Mueller Johannes Kastl Pavol Cupka Paolo Stivanin Aleksa Sarai Aleksa Sarai Aleksa Sarai Dominique Leuenberger Aleksa Sarai Pavol Cupka Aleksa Sarai Aleksa Sarai Dirk Mueller Aleksa Sarai Aleksa Sarai Jan Engelhardt Aleksa Sarai Aleksa Sarai Bjoern Voigt Johannes Kastl Johannes Kastl bernd-obs@wachter.fimatthias.gerstner@suse.commchandras@suse.dedcassany@suse.comopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.demchandras@suse.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.dejengelh@inai.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.decbosdonnat@suse.comschwab@suse.decbrauner@suse.dejengelh@inai.decbrauner@suse.decbrauner@suse.decbrauner@suse.detiwai@suse.det1loc@opensuse.orgt1loc@opensuse.orgt1loc@opensuse.orgcbosdonnat@suse.comjslaby@suse.comjslaby@suse.comjslaby@suse.comLed opensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.deopensuse_buildservice@ojkastl.de- Always build with seccomp support on every architecture. boo#1199963- Fix Tumbleweed build.- update to 4.0.12: Bugfixes¶ * Fixed CRIU restoration of containers with pre-created veth interfaces * Fixed issue with kernels lacking SMT support * Extended cgroup2 config options in lxc.mount.auto (cgroup2) * lxc-download now relies on HTTPS for validation (avoids GPG issues) - drop patch 0003-templates-lxc-download.in-use-GPG-option-receive-key.patch as upstream remove the GPG functionality- update to 4.0.11: Bugfixes * Core scheduling support (lxc.sched.core) * riscv64 support in lxc.arch * Significantly improved bash completion profile * Greater use of the new VFS mount API (when supported by the kernel) * Fix containers with empty network namespaces * Handle kernels that lack TIOCGPTPEER * Improve CPU bitmask/id handling (handle skipped CPU numbers) * Reworked the tests to run offline- use --withpamdir and use pam macros to fix UsrMerge problems - update to 4.0.10 Bugfixes * Fix issues with less common architectures * Support for additional idmap mounts * nft support in lxc-net * Cleaner mount entries for sys:mixed * Switched GPG server to keyserver.ubuntu.com- fix wrong Source URLs in spec-update to 4.0.9: * You may have noticed the sudden jump from 4.0.6 to 4.0.9, that's because 4.0.7 and 4.0.8 both included regressions that were reported by early users and were considered bad enough to require a new release. * Testing improvements including fixes from oss-fuzz * Rework of the attach codepath * Cgroup handling rework * for full list of changes see https://discuss.linuxcontainers.org/t/lxc-4-0-9-lts-has-been-released/10999- update to 4.0.6: * Improve handling for compatibility architectures for seccomp * Harden seccomp notifier implementation * Rework parsing of /proc//mountinfo to handle kernel regression https://bugzilla.kernel.org/show_bug.cgi?id=209971 * Improve network device restoration * Significantly cleanup and harden config file parsing * Support new capabilities CAP_PERFORM, CAP_BPF, and CAP_CHECKPOINT_RESTORE * Harden containers started without CAP_NET_ADMIN * for full list of changes see https://discuss.linuxcontainers.org/t/lxc-4-0-6-lts-has-been-released/9926- update to 4.0.5: * Support allocating PTS devices from within the container * Harden more path/mount handling logics * Rework LSM logic to limit initializer use * for full list of changes see https://discuss.linuxcontainers.org/t/lxc-4-0-5-lts-has-been-released/9269 - remove 0001-templates-lxc-download.in-fix-wrong-if-condition-use.patch, 0002-templates-lxc-download.in-make-shellcheck-happy.patch (upstream)- add patches from upstream: * 0001-templates-lxc-download.in-fix-wrong-if-condition-use.patch * 0002-templates-lxc-download.in-make-shellcheck-happy.patch * 0003-templates-lxc-download.in-use-GPG-option-receive-key.patch- Update to LXC 4.0.2 - https://discuss.linuxcontainers.org/t/lxc-4-0-2-lts-has-been-released/7449- Update to LXC 4.0.1: + Tweak systemd ordering (start after remote-fs.target) + Fix various issues around attach and cgroups + Fix shutdown timeout not working on pidfd systems + Fix cgroup issue on 4.9 kernel + Fix write issues in /dev/stdout - Remove 0001-autotools-don-t-install-run-coccinelle.sh.patch - Remove 0002-cgroups-fix-uninitialized-transient_len-warning.patch - Remove 0003-cgroups-fix-build-warning-on-GCC-7.patch- Fix mis-use of %suse_version when we actually want to check against %sle_version when determining whether lxc-user-nic should be setuid.- Add backport of https://github.com/lxc/lxc/pull/3347 and https://github.com/lxc/lxc/pull/3349 to fix builds on Leap. + 0002-cgroups-fix-uninitialized-transient_len-warning.patch + 0003-cgroups-fix-build-warning-on-GCC-7.patch- Update to LXC 4.0.0. The full upstream changelog is available from: https://discuss.linuxcontainers.org/t/lxc-4-0-lts-has-been-released/7182 Related to the LXD 4.0.0 update (boo#1168338). + cgroups: Full cgroup2 support + cgroups: Freezer support in CGroup2 + cgroups: eBPF device controller support in CGroup2 + AppArmor: Deny access to /proc/acpi/** + config: Add lxc.autodev.tmpfs.size configuration key + config: Add lxc.selinux.context.keyring key + config: Add lxc.keyring.session + seccomp: Add s390 support * network: Improved network device creation and removal + network: Allow moving wireless devices - Add backport of patch to fix build: + 0001-autotools-don-t-install-run-coccinelle.sh.patch - Remove upstreamed patches: - lxc-3.2.1-cgroups-init-cpuset-properly.patch - 0001-tree-wide-initialize-all-auto-cleanup-variables.patch- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to shortcut through the -mini flavors.- Fix bash-completion paths to match the binary names (and to avoid conflicts with LXD). boo#1162426- adding a patch to fix "Containers fail to start regression lxc 3.2" - patch name: lxc-3.2.1-cgroups-init-cpuset-properly.patch - upstream issue - https://github.com/lxc/lxc/issues/3108- Add backport of https://github.com/lxc/lxc/pull/3102 to fix build failures on openSUSE Leap. + 0001-tree-wide-initialize-all-auto-cleanup-variables.patch - Update to lxc 3.2.1. The changelog can be found at https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322 + seccomp: support syscall forwarding to userspace + add lxc.seccomp.allow_nesting + pidfd: Add initial support for the new pidfd api * Many hardening improvements. * Use /sys/kernel/cgroup/delegate file for cgroup v2. * Fix CVE-2019-5736 equivalent bug.- Rework /var/adm/update-messages handling to be far less complicated, and more packaging-friendly (by update-messages be owned by the rpm) as well as storing the update message in a autoconf-templated source file.- fix apparmor dropin to be compatible with LXC 3.1.0 (bsc#1131762)- Avoid wrong permissions warning by conditionally setting the setuid bit based on what version of permissions is available in that distribution (makes no difference but results in less confusion to users).- Fix builds on SLE12, by depending on apparmor-profiles instead of apparmor-abstractions. In addition, remove the Requires on abstractions.- Trim project history from package description.- Update to LXC 3.1.0. The changelog is far too long to include here, please look at the changelogs posted on https://linuxcontainers.org/. boo#1131762 * Includes fixes for CVE-2019-5736 bsc#1122185. + pam_cgfs is now provided by this package, since upstream has moved the sources to LXC (it used to be part of lxcfs). * All of the patches have been upstreamed or are no longer relevant: - 0001-apparmor-Allow-usr-lib-paths-for-mount-and-pivot_roo.patch - 0001-utils-add-LXC_PROC_PID_FD_LEN.patch - 0001-lxc-user-nic-verify-file-descriptor-stable-2.0.patch - 0001-Backport-autodev-fix-from-lxc-master.patch - 0001-PyOS_AfterFork-python3.7.patch - Add a warning if lxc-user-nic is not setuid after set_permissions, to ensure users actually read the warning (which means we get to remove README.SUSE). It also supports people using paranoid mode, which is why it's done in post-install and isn't packaged. boo#988348 - Quite a lot of the runtime helpers and configuration have been moved to liblxc, in order to allow LXD to make use of them (because, in truth, they were always a requirement of liblxc and not just the lxc-* tools). - Add workaround for pre-15 distros, where _sharedstatedir was inexplicably /usr/com, to use the correct directory of /var/lib.- Rework packaging to be a more modern openSUSE-style.- compilation fixed for Python 3.7 (PyOS_AfterFork() replaced with PyOS_AfterFork_Child()) added patch 0001-PyOS_AfterFork-python3.7.patch- fix for bsc#988348 (lxc: enable setuid bit on lxc-user-nic) - do not remove setuid bit for lxc-user-nic on releases with suse_version >=1550 - remove setuid stuff from README.SUSE on releases with suse_version >=1550- move bash completion file from /etc/bash_completion.d/lxc to /usr/share/bash-completion/completions/ to avoid warning- 0001-Backport-autodev-fix-from-lxc-master.patch: fix unprivileged lxc containers on kernel >= 4.18- 0001-utils-add-LXC_PROC_PID_FD_LEN.patch: prerequisite for applying the next patch - 0001-lxc-user-nic-verify-file-descriptor-stable-2.0.patch: fix information leak and possible open() side effects accessible to regular users via lxc-user-nic (bsc#988348, CVE-2018-6556)- Add upstream patch to fix container start up problems when AppArmor is enabled (boo#1099239) * 0001-apparmor-Allow-usr-lib-paths-for-mount-and-pivot_roo.patch- Make use of %license macro- update to version 2.0.9 Bugfixes: * apparmor: Allow containers to start in AppArmor namespaces * apparmor: Drop useless apparmor denies * caps: Move ifndef/define to the top * cgfsng: Fail when limits fail to apply * cgfsng: Log when we defer to cgfsng * cgfsng: Only output debug info when we set cgroup data * cgroups: Handle hybrid cgroup layouts * cgroups: Use tight scoping * cgroups: Workaround gcc-7 bug * commands: Abstract cmd socket handling + logging * commands: Add missing translation * commands: Delete meaningless comments * commands: Handle EINTR * commands: Make state server interface flexible * commands: Move lxc_make_abstract_socket_name() * commands: Rename to lxc_cmd_add_state_client() * commonds: Fix typo * conf: Adapt to lxc-user-nic usage * conf: Add lxc_get_idmaps() * conf: Add userns_exec_full() * conf: Allow to clear all config items * conf: Allow to get lxc.autodev * conf: Allow to get lxc.haltsignal * conf: Allow to get lxc.kmsg * conf: Allow to get lxc.rebootsignal * conf: Allow to get lxc.stopsignal * conf: Allow writing uid mappings with euid != 0 * conf: Avoid double-frees in userns_exec_1() * conf: Clear lxc.include * conf: Do not check for empty value twice * conf: Do not check union on wrong net type * conf: Do not deref null pointer * conf: Do not free static memory * conf: Do not log uninitialized memory * conf: Do not write out trailing spaces * conf: Don't send ttys when none are configured * conf: Dump lxc_get_config_item() * conf: Error out on too many mappings * conf: Fix bionic builds * conf: Fix build without libcap * conf: Fix tty creation * conf: Fix userns_exec_1() * conf: Free netdev->downscript * conf: Implement config item clear callback * conf: Improve lxc_map_ids() * conf: Improve tty shifting function * conf: Improve write_id_mapping() * conf: Increase lxc-user-nic buffer * conf: Log lxc-user-nic output * conf: lxc_listconfigs -> lxc_list_config_items * conf: Move clearing config items into one place * conf: Non-functional changes * conf: NOTICE() on mounts on container's /dev * conf: Performance tweaks * conf: Preserve newlines * conf: Properly parse lxc.idmap entries * conf: Record idmap that gets written * conf: Refactoring of most config parsing code * conf: Refactor network deletion * conf: Remove dead assignments in parse_idmaps() * conf: Remove dead mount code * conf: Rework lxc_map_ids() * conf: Rework userns_exec_1() * conf: Send ttys in batches of 2 * conf: Switch API to new callback system * conf: Use a minimal {g,u}id map * conf: Use correct check on char array * conf: Use run_command for lxc-usernsexec * console: Clean tty state + return 0 on peer exit * console: DO NOT add the handles of adjust winsize when the 'stdin' is not a tty * console: Fix memory leak of 'lxc_tty_state' * console: Remove dead assignments * core: Do remount with the MS_REMOUNT flag when mounts with MS_RDONLY * core: Fix a format string build failure on x32 * core: Fix includes for Android * core: Fix memory and resource leak * core: Fix some cppcheck warnings * core: Fix the bug of 'ts->stdoutfd' did not fill with parameters 'stdoutfd' * core: Include custom mntent for Android * core: Log function called in userns_exec_1() * core: Remove the __func__ macro * core: Remove the unused macro * core: Replace "priority" with "level" * core: Revert "Add a prefix to the lxc.pc" * core: root -> am_root * core: struct bdev -> struct lxc_storage * core: Update .gitignore * core: Use strerror(errno) instead of %m * criu: Add cmp_version() * criu: Use correct check initialization check * doc: Add CII Best Practices badge to README * doc: Add console behavior to Japanese lxc.container.conf(5) * doc: Document missing env variables * doc: Fix regex-typo in Japanese and Korean lxc-monitor(1) * doc: Fix regex-typo in lxc-monitor.sgml.in * doc: Reword id mapping restrictions when unpriv * doc: Rework README * doc: Tweak Japanese lxc.container.conf(5) * doc: Tweak lxc.container.conf a little * doc: Untabify Japanese lxc.container.conf(5) * doc: Update API documentation for get_config_item * execute: Enable console & standard /dev symlinks * init: Add comment for exclude 32 and 33 signals * init: Adjust include statements * init: Become session leader * init: Move initialization of act to outside of the loop * init: Report exec*() failure * init: Use lxc-stop to stop systemd service * liblxc: Make sure memory is free()ed * liblxc: Only spawn monitord on demand * liblxc: Remove 5s timeout on error * liblxc: Use snprintf() * liblxc: Use userns_exec_full() * lock: Non-functional changes * lock: Return the right error when open lock file failed * log: Prevent stack smashing * log: Switch to a new lxc_log_init function * monitor: Abstract lxc_abstract_unix_{send,recv}_fd for af_unix * monitor: Add lxc_cmd_state_server() * monitor: Add TRACE()ers * monitor: Delete unneccessory include file * monitor: Remove dead assignments * monitor: Remove the workaround-code for lxc_abstract_unix_connect * monitor: Remove unlink operation for af_unix * network: Add arg to config clear method * network: Add data arg to set callback * network: Add ifindex field for host veth device * network: Add lxc_log_configured_netdevs() * network: Add missing checks for empty links * network: Add network counter * network: Add warning when ignoring MTU * network: Clear ifindeces * network: Delete ovs for unprivileged networks * network: Document all fields in struct lxc_netdev * network: Don't delete net devs we didn't create * network: Fix grammar * network: Implement lxc_get_netdev_by_idx() * network: Log cleanup thread pid for openswitch * network: Log ifindex * network: Log ifindex for host side veth device * network: Log veth_attr.pair and veth_attr.veth1 * network: Move config_value_empty() to confile_utils * network: Perform network validation at creation time * network: Remove allocation from lxc_mkifname() * network: Remove dead assignments * network: Remove netpipe * network: Retrieve correct names and ifindices * network: Retrieve the host's veth device ifindex * network: Rework network creation * network: Send ifindex for unpriv networks * network: Stop recording saved physical net devices * network: Use correct network device name * network: Use send()/recv() * network: Use single helper to delete networks * network: Use static memory for net device names * openvswitch: Delete ports intelligently * seccomp: Export the seccomp filter after load it into kernel successful * seccomp: Print action name in log * seccomp: s/n-new-privs/no-new-privs/g * seccomp: Update comment for function parse_config * start: Add lxc_free_handler() * start: Add lxc_init_handler() * start: Document all handler fields * start: Don't call lxc_map_ids() without id map * start: Don't close inherited namespace fds * start: Don't let data_sock users close the fd * start: Dup std{in,out,err} to pty slave * start: Ensure cgroups are cleaned up * start: Generalize lxc_check_inherited() * start: Log sending and receiving of tty fds * start: lxc_setup() after unshare(CLONE_NEWCGROUP) * start: Move env setup before container setup * start: Pass LXC_LOG_LEVEL to hooks * start: Pin rootfs when privileged * start: Remove dead variable * start: Send state to legacy lxc-monitord state server even if no state clients registered * start: Set environment variables correctly * start: Switch from SOCK_DGRAM to SOCK_STREAM * start: Switch ids at last possible instance * start: Use separate socket on daemonized start * start: Use userns_exec_full() * state: Remove lxc_rmstate declaration * storage: Add storage_utils.{c.h} * storage: Avoid segfault * storage: Default to orig type on identical paths * storage: Record output from mkfs.* * storage: Rename files "bdev" -> "storage" * storage: Use userns_exec_full() * storage/dir: Using 'add-required_remount_flags' function to add required flags * storage/loop: Detect loop file * storage/overlayfs: Fix wrong path * storage/overlay: Handle overlay for stable 2.0 * template: Remove obsolete bind-mounts from userns.conf * template: Use "rsync -SHaAX" to copy the cached rootfs into place * template/alpine: Add support for ppc64le * template/alpine: Change file check to also check file size (-f => -s) * template/archlinux: Change locale "en-US.UTF-8" to "en_US.UTF-8" * template/centos: Add cronie to the pkg list * template/centos: Use altarch mirror for CentOS on arches other than i386 and x86_64 * template/debian: Add aarch64 -> arm64 mapping * template/debian: Add buster as a valid release * template/debian: Don't force getty@ configuration * template/debian: Use deb.debian.org as the default Debian mirror * template/download: Fix syntax error * template/download: Sanitize script with shellcheck * template/opensuse: Add Tumbleweed as supported release * template/opensuse: Fix tumbleweed software selection * template/opensuse: getty.target.wants does not always exists * template/opensuse: Support leap 42.3 * template/opensuse: Tumbleweed has no update repo * template/plamo: Delete unnecessary process during container shutdown * template/ubuntu: Check that there is netplan binary, rather than just just a config directory * template/ubuntu: Conditionally move upstart ssh job, as it is now optional * template/ubuntu: Support netplan in newer releases by default * tests: Adapt lxc-user-nic tests to new syntax * tests: Add corner-case tests for lxc_safe_{u}int() * tests: Add item clear and config file tests * tests: Add test script to test the ro option of lxc.rootfs.options * tests: Add unit tests for idmap parser * tests: Avoid NULL pointer dereference * tests: Compare return value to expected value whenever we can * tests: Define a network before checks * tests: Don't fail when no processes for the user exist * tests: Enforce all methods for config items * tests: Remove dead assignments * tests: Remove the temp container directory * tests: Shortlived daemonized containers * tests: Support systemd hybrid cgroups * tools: Add additional cgroup checks * tools: Print "-devel" when LXC_DEVEL is true * tools: Use "which" * tools/lxc-attach: Allow for situations without /dev/tty * tools/lxc-checkconfig: Add CONFIG_NETFILTER_XT_MATCH_COMMENT * tools/lxc-checkconfig: Add probe status checking * tools/lxc-execute: Print error message when failed * tools/lxc-ls: Return all containers by default * tools/lxc-monitord: Exit when receiving a quit command * tools/lxc-unshare: Do not pass NULL pointer * tools/lxc-user-nic: Add new {create,delete} subcommands * tools/lxc-user-nic: Check db before trying to delete * tools/lxc-user-nic: Fix adding database entries * tools/lxc-user-nic: Fix memleak * tools/lxc-user-nic: Free memory and check for error * tools/lxc-user-nic: Initialize vars to silence gcc-7 * tools/lxc-user-nic: Keep lines from other {users,links} * tools/lxc-user-nic: Remove delta between master + stable * tools/lxc-user-nic: Remove double initialization * tools/lxc-user-nic: Rework renaming net devices * tools/lxc-user-nic: Simplify logic * tools/lxc-user-nic: Test privilege over netns on delete * tools/lxc-usernsexec: Remove dead assignments * travis: Fix builds * utils: Add has_fs_type() + is_fs_type() * utils: Add lxc_nic_exists() * utils: Add lxc_safe_ulong() * utils: Add run_command * utils: Close parent end in child process after fork * utils: Do not write to 0 sized buffer * utils: Duplicate stderr as well in lxc_popen() * utils: Fix lxc_mount_proc_if_needed() * utils: Fix lxc_popen()/lxc_pclose() * utils: Fix mem leak with realpath * utils: Fix num parsing functions * utils: Fix ppc64le builds * utils: Fix the way to detect blocking signal * utils: lxc_popen() remove dead assignments * utils: Move helpers from cgfsng.c to utils.{c,h} * utils: Rework lxc_deslashify() * utils: Switch to has_fs_type() * utils: Use 1LU otherwise we overflow * utils: Use access instead of stat- removed ldconfig from lxc %post section- Fix libcap-progs dependency. The 'setcap' binary is located in /sbin instead of /usr/sbin but it's best to depend on the actual package instead since the location might change in the future.- removed apparmor-rpm-macros again, as it is not needed for the current %post solution- added Requires for apparmor-abstractions and BuildRequires for apparmor-rpm-macros to apply the fix for boo#1036360- added correct reload of apparmor to %post- added workaround for #bsc1041291 to allow builds on Tumbleweed with gcc7, until this bug in gcc7 is fixed...- Update to version 2.0.8 * Security fix for CVE-2017-5985 * All templates have been updated to not set default passwords anymore, instead requiring lxc-attach be used to configure users. * This may affect some automated environments that were relying on our default (very much insecure) users. Bugfixes: Make lxc-start-ephemeral Python 3.2-compatible Fix typo Allow build without sys/capability.h lxc-opensuse: fix default value for release code util: always malloc for setproctitle util: update setproctitle comments confile: clear lxc.network..ipv{4,6} when empty lxc_setup_tios(): Ignore SIGTTOU and SIGTTIN signals Make lxc-net return non-zero on failure seccomp: allow x32 guests on amd64 hosts. Add HAVE_LIBCAP c/r: only supply --ext-mount-map for bind mounts Added 'mkdir -p' functionality in create_or_remove_cgroup Use LXC_ROOTFS_MOUNT in clonehostname hook squeeze is not a supported release anymore, drop the key start: dumb down SIGCHLD from WARN() to NOTICE() log: fix lxc_unix_epoch_to_utc() cgfsng: make trim() safer seccomp: set SCMP_FLTATR_ATL_TSKIP if available lxc-user-nic: re-order #includes lxc-user-nic: improve + bugfix lxc-user-nic: delete link on failure conf: only try to delete veth when privileged Fix lxc-containers to support multiple bridges Fix mixed tab/spaces in previous patch lxc-alpine: use dl-cdn.a.o as default mirror instead of random one lxc-checkconfig: verify new[ug]idmap are setuid-root [templates] archlinux: resolve conflicting files [templates] archlinux: noneed default_timezone variable python3: Deal with potential NULL char* lxc-download.in / allow setting keyserver from env lxc-download.in / Document keyserver change in help Change variable check to match existing style tree-wide: include directly conf/ile: make sure buffer is large enough tree-wide: include directly tests: Support running on IPv6 networks tests: Kill containers (don't wait for shutdown) Fix opening wrong file in suggest_default_idmap do not set the root password in the debian template do not set insecure passwords don't set a default password for altlinux, gentoo, openmandriva and pld tools: exit with return code of lxc_execute() Keep veth.pair.name on network shutdown Makefile: fix static clang init.lxc build Avoid waiting for bridge interface if disabled in sysconfig/lxc | lxc-net via USE_LXC_BRIDGE Increased buffer length in print_stats() avoid assigning to a variable which is not POSIX shell proof (bug #1498) remove obsolete note about api stability conf: less error prone pointer access conf: lxc_map_ids() non-functional changes caps: add lxc_{proc,file}_cap_is_set() conf: check for {filecaps,setuid} on new{g,u}idmap conf: improve log when mounting rootfs ls: simplify the judgment condition when list active containers fix typo introduced in #1509 attach|unshare: fix the wrong comment caps: skip file capability checks on android autotools: check for cap_get_file caps: return false if caps are not supported conf: non-functional changes to setup_pts() conf: use bind-mount for /dev/ptmx conf: non-functional changes utils: use loop device helpers from LXD create ISSUE_TEMPLATE.md cgroups: improve cgfsng debugging issue template: fix typo conf: close fd in lxc_setup_devpts() conf: non-functional changes utils: tweak lxc_mount_proc_if_needed() Change sshd template to work with Ubuntu 17.04 conf: order mount options conf: add MS_LAZYTIME to mount options monitor: report errno on exec() error af unix: allow for maximum socket name commands: avoid NULL pointer dereference commands: non-functional changes lxccontainer: avoid NULL pointer dereference monitor: simplify abstract socket logic precise is not the latest LTS, let's use xenial instead fix the wrong exit status conf: non-functional changes lxc_fill_autodev() conf: remove /dev/console from lxc_fill_autodev() conf: non-functional changes lxc_setup() conf: non-functional changes to console functions conf: improve lxc_setup_dev_console() conf: lxc_setup_ttydir_console() config: remove /dev/console bind mount doc: document console behavior utils: add lxc_unstack_mountpoint() conf: unstack all mounts atop /dev/console console: fail when we cannot allocate peer tty start: remove umount2() conf: non-functional changes utils: handle > 2^31 in lxc_unstack_mountpoint() Install systemd units for CentOS Merge ubuntu and debiancase start: add crucial details about lxc_spawn() - Deleted patches that have been backported before: - 0003-CVE-2017-5985-Ensure-target-netns-is-caller-owned.patch - 0001-tree-wide-include-sys-sysmacros.h-directly.patch - 0002-tree-wide-include-sys-sysmacros.h-directly.patch - added signature verification- Replace %__cp by cp- fix for boo#1028264 added patch 0003-CVE-2017-5985-Ensure-target-netns-is-caller-owned.patch- backported two patches to get the package to build again for Tumbleweed (applied only on tumbleweed aka suse_version >1315) 0001-tree-wide-include-sys-sysmacros.h-directly.patch 0002-tree-wide-include-sys-sysmacros.h-directly.patch- all patches (00*.patch) are upstream already, thus deleted; patch lxc-aa_allow_incomplete-default.patch is now reworked and added as a drop-in file in /usr/share/lxc/config/common.conf.d/ 0001-bdev-use-correct-overlay-module-name.patch 0002-cleanup-tools-remove-name-from-lxc-top-usage-message.patch 0003-cleanup-whitespaces-in-option-alignment-for-lxc-exec.patch 0004-Use-full-GPG-fingerprint-instead-of-long-IDs.patch 0005-tools-move-rcfile-to-the-common-options-list.patch 0006-tools-set-configfile-after-load_config.patch 0007-doc-add-rcfile-to-common-opts.patch 0008-doc-Update-Korean-lxc-attach-1.patch 0009-doc-Add-rcfile-to-Korean-common-opts.patch 0010-doc-Add-rcfile-to-Japanese-common-opts.patch 0011-tools-use-exit-EXIT_-everywhere.patch 0012-tools-unify-exit-calls-outside-of-main.patch 0013-utils-Add-mips-signalfd-syscall-numbers.patch 0014-seccomp-Implement-MIPS-seccomp-handling.patch 0015-seccomp-Add-mips-and-mips64-entries-to-lxc_config_pa.patch 0016-seccomp-fix-strerror.patch 0017-confile-add-more-archs-to-lxc_config_parse_arch.patch 0018-seccomp-add-support-for-s390x.patch 0019-seccomp-remove-double-include-and-order-includes.patch 0020-seccomp-non-functional-changes.patch 0021-templates-use-fd-9-instead-of-200.patch 0022-templates-fedora-requires-openssl-binary.patch 0023-tools-use-boolean-for-ret-in-lxc_device.c.patch 0024-c-r-use-proc-self-tid-children-instead-of-pidfile.patch 0025-c-r-Fix-pid_t-on-some-arches.patch 0026-templates-Add-mips-hostarch-detection-to-debian.patch 0027-cleanup-replace-tabs-wth-spaces-in-usage-strings.patch lxc-aa_allow_incomplete-default.patch 0001-attach-do-not-send-procfd-to-attached-process.patch- update to version 2.0.7 This is the seventh bugfix release for LXC 2.0. The main bugfixes in this release are: - attach: Close lsm label file descriptor - attach: Non-functional changes - attach: Simplify lsm_openat() - caps: Add lxc_cap_is_set() - conf: attach: Save errno across call to close - conf: Clearly report to either use drop or keep - conf: criu: Add make_anonymous_mount_file() - conf: Fix suggest_default_idmap() - configure: Add --enable-gnutls option - configure: Check for memfd_create() - configure: Check whether gettid() is declared - configure: Do not allow variable length arrays - configure: Remove -Werror=vla - configure: Use AC_HEADER_MAJOR to detect major()/minor()/makedev() - conf: Non-functional changes - conf: Remove thread-unsafe strsignal + improve log - init: Add cgroupfs-mount to Should-Start/Stop sysvinit LSB headers - log: Add lxc_unix_epoch_to_utc() - log: Annotate lxc_unix_epoch_to_utc() - log: Drop all timezone conversion functions - log: Make sure that date is correctly formatted - log: Use lxc_unix_epoch_to_utc() - log: Use N/A if getpid() != gettid() when threaded - log: Use thread-safe localtime_r() - lvm: Supress warnings about leaked files - lxccontainer: Log failure to send sig to init pid - monitor: Add more logging - monitor: Close mainloop on exit if we opened it - monitor: Improve log + set log level to DEBUG - monitor: Log which pipe fd is currently used - monitor: Make lxc-monitord async signal safe - monitor: Non-functional changes - python3-lxc: Fix api_test.py on s390x - start: Check for CAP_SETGID before setgroups() - start: Fix execute and improve setgroups() calls - state: Use async signal safe fun in lxc_wait() - templates: lxc-debian: Don't try to get stuff from /usr/lib/systemd on the host - templates: lxc-debian: Fix getty service startup - templates: lxc-debian: Fix typo in calling dpkg with --print-foreign-architectures option - templates: lxc-debian: Handle ppc hostarch -> powerpc - templates: lxc-opensuse: Change openSUSE default release to Leap 42.2 - templates: lxc-opensuse: Remove libgcc_s1 - templates: lxc-opensuse: Remove poweroff.target -> sigpwr.target copy - templates: lxc-opensuse: Set to be unconfined by AppArmor - templates: lxc-opensuse: Update for Leap 42.2 - tests; Don't cause test failures on cleanup errors - tests: Skip unpriv tests on broken overlay module - tools: Improve logging - tools: lxc-start: Remove c->is_defined(c) check - tools: lxc-start: Set configfile after load_config - tools: Only check for O_RDONLY - tree-wide: Random macro cleanups - tree-wide: Remove any variable length arrays - tree-wide: Sic semper assertis! - utils: Add macro __LXC_NUMSTRLEN - utils: Add uid, gid, group convenience wrappers - commented out the patches, as they no longer apply cleanly- CVE-2016-8649: lxc: guest escape via ptrace of lxc-attach (bsc#1010933). 0001-attach-do-not-send-procfd-to-attached-process.patch- setcap has been moved to /usr/sbin (boo#998326).- update lxc to 2.0.4 - add 0001-bdev-use-correct-overlay-module-name.patch - add 0002-cleanup-tools-remove-name-from-lxc-top-usage-message.patch - add 0003-cleanup-whitespaces-in-option-alignment-for-lxc-exec.patch - add 0004-Use-full-GPG-fingerprint-instead-of-long-IDs.patch - add 0005-tools-move-rcfile-to-the-common-options-list.patch - add 0006-tools-set-configfile-after-load_config.patch - add 0007-doc-add-rcfile-to-common-opts.patch - add 0008-doc-Update-Korean-lxc-attach-1.patch - add 0009-doc-Add-rcfile-to-Korean-common-opts.patch - add 0010-doc-Add-rcfile-to-Japanese-common-opts.patch - add 0011-tools-use-exit-EXIT_-everywhere.patch - add 0012-tools-unify-exit-calls-outside-of-main.patch - add 0013-utils-Add-mips-signalfd-syscall-numbers.patch - add 0014-seccomp-Implement-MIPS-seccomp-handling.patch - add 0015-seccomp-Add-mips-and-mips64-entries-to-lxc_config_pa.patch - add 0016-seccomp-fix-strerror.patch - add 0017-confile-add-more-archs-to-lxc_config_parse_arch.patch - add 0018-seccomp-add-support-for-s390x.patch - add 0019-seccomp-remove-double-include-and-order-includes.patch - add 0020-seccomp-non-functional-changes.patch - add 0021-templates-use-fd-9-instead-of-200.patch - add 0022-templates-fedora-requires-openssl-binary.patch - add 0023-tools-use-boolean-for-ret-in-lxc_device.c.patch - add 0024-c-r-use-proc-self-tid-children-instead-of-pidfile.patch - add 0025-c-r-Fix-pid_t-on-some-arches.patch - add 0026-templates-Add-mips-hostarch-detection-to-debian.patch - add 0027-cleanup-replace-tabs-wth-spaces-in-usage-strings.patch- Abolish old macro use. Remove ancient %clean section. Avoid sh invocation for simple ldconfig calls.- add lxcfs dependency: lxc relies on lxcfs for a long time now to provide container aware /proc files. The /sys/fs/cgroup part is slowly phased out because we now have cgroup namespaces.- Split into packages to follow best practice. * lxc * liblxc1 * liblxc-devel Also, we need liblxc1 to be separately installable from LXC for LXD. - Tweak descriptions.- Update to 2.0.3 (changes since 2.0.1): * apparmor: Refresh generated file * apparmor: add make-rslave to usr.bin.lxc-start * apparmor: Allow bind-mounts and {r}shared/{r}private * apparmor: allow mount move * apparmor: Update mount states handling * core: Drop lxc-devsetup as unneeded by current autodev * core: Fix redefinition of struct in6_addr * core: Include all lxcmntent.h function declarations on Bionic * c/r: c/r: use criu's "full" mode for cgroups * systemd: start containers in foreground when using the lxc@.service * templates: debian: Make sure init is installed * templates: oracle: Fix console login * templates: plamo: Fix various issues * templates: ubuntu: Install apt-transport-https by default * travis: ensure 'make install' doesn't fail * travis: test VPATH builds * upstart: Force lxc-instance to behave like a good Upstart client- Update to 2.0.1: Lots of fixes and enhancements. https://linuxcontainers.org/lxc/news/#lxc-201-release-announcement-16th-of-may-2016 - Add criu to recommends for C/R support - Add a workaround for lxc-start failure without apparmor: lxc-aa_allow_incomplete-default.patch - Drop obsoleted patch: lxc-1.0.7-fix-bashisms.patch- Update to 1.1.5- Remove attach-mount-a-sane-prox-for-LSM-setup.patch- Update to 1.1.4 * Remove CVE-2015-1331-lxclock-use-run-lxc-lock-rather-than-r.patch * Remove CVE-2015-1334-Don-t-use-the-container-s-proc-during-.patch * Remove CVE-2015-1335-Protecti-container-mounts-against-symlinks.patch * Remove templates-lxc-opensuse-use-rpm-to-determine-build-ve.patch Now integrated into the current version- Added CVE-2015-1335-Protecti-container-mounts-against-symlinks.patch (bsc#946744)- Added templates-lxc-opensuse-use-rpm-to-determine-build-ve.patch- Added CVE-2015-1331-lxclock-use-run-lxc-lock-rather-than-r.patch (bnc#938522) - Added attach-mount-a-sane-prox-for-LSM-setup.patch (bnc#938523) - Added CVE-2015-1334-Don-t-use-the-container-s-proc-during-.patch (bnc#938523)- update to 1.1.2 - Removed 0001-added-upstream-action-fallback-create-directory-loca.patch - Removed 0003-lxc-opensuse-template-now-understands-release-argume.patch - Removed 0004-lxc-opensuse.in-Added-explanation-on-how-to-use-the-.patch - Removed 0005-lxc-opensuse.in-Check-if-given-argument-is-a-valid-r.patch - Removed 0006-lxc-opensuse-default-release-changed-to-13.1-as-12.3.patch - Removed 0007-lxc-opensuse-Disabling-builds-on-13.2-Tumbleweed-onl.patch- fix bashisms in lxc-autostart-helper script - add patches: + lxc-1.0.7-fix-bashisms.patch- Improved error message- Disabling builds on 13.2/Tumbleweed only, if build version before 20141120 Patch 0007-lxc-opensuse-Disabling-builds-on-13.2-Tumbleweed-onl.patch- lxc-opensuse default release changed to 13.1, as 12.3 reaches end-of-life soon Patch 0006-lxc-opensuse-default-release-changed-to-13.1-as-12.3.patch- patch 0002-Disable-building-opensuse-containers-on-openSUSE13.2.patch has been sent upstream and is included in version 1.0.7- update to version 1.0.7 Core: Include network prefix when ipv4/ipv6 keys are queried apparmor: silence 'silent' mount denials add file/func/line to debug info apparmor: restrict signal and ptrace for processes cgmanager: several fixes lxc: don't call pivot_root if / is on a ramfs fix lxc.mount.auto clearing conf.c: Define MS_PRIVATE for Android network: convert param ifname to const. network: check result of if_nametoindex(). network: allow lxc_network_move_by_index() rename netdev in moving. network: introduce a interface named lxc_netdev_isup(). lxccontainer.c: rename enter_to_ns to enter_net_ns lxc_global_config_value can return the default lxc.cgroup.pattern whether root or non-root do_rootfs_setup: fix return bugs lxc-start: don't re-try to mount rootfs if we already did so attach: don't use confstr(_CS_PATH) lxc_global_config_value: simplify the theme Fixed mismatch on ipvX gateway attach: don't ignore sigint/sigkill if stdin is redirected cgmanager: fix 'attach' with "all" controller support lxc/utils: bugfix freed pointer return value conf.c: change 'instanciate' to 'instantiate' fix wrong nlmsg_len Remounts bind mounts if read-only flag is provided Allow lxc_clear_config_item to clear idmaps. overlay and aufs clone_paths: be more robust overlayfs: overlayfs.v22 or higher needs workdir option Fix clone issues Improve veth error cases logging fixed typo in comment audit: added capacity and reserve() to nlmsg rmdir and lxc_unpriv returns non-negative error codes typofixes - https://github.com/vlajos/misspell_fixer Bindings: add src/python-lxc/setup.py into .gitignore Tests: tests: Fix unpriv test lxc-test-unpriv: don't clear out /etc/lxc/lxc-usernet lxc-test-unpriv: test for different cgroups per subsystem tests: try again when waitpid() sets errno as EINTR Commands: lxc_start: ERROR if container is already running. lxc-start: return 0 rather than error if container is already running Make legacy lxc-ls more robust lxc_info: flush stdout before calling routines which may fork Templates: Fix typo in lxc-gentoo template busybox template: support for unprivileged containers busybox template: mount fstab when available Fix another gentoo template typo Create the apt proxy in the cache instead of the 1st container lxc-plamo: mount tmpfs on /dev/shm lxc-cirros: support creating+running unprivileged Fix lxc-openmandriva.in typo. Fix lxc-centos.in typo. lxc-opensuse: Disable on 13.2 lxc-alpine: make sure /dev/shm is world writeable lxc-alpine: create a default tty for console lxc-debian: added support for package installation lxc-debian: Fix default mirrors lxc-debian: support systemd as PID 1 lxc-debian: adjust init system configurations lxc-debian: mask both Wheezy and Jessie udev services lxc-opensuse: Disabling builds on openSUSE Tumbleweed, detection improved. Documentation: Fix the lxc manpage a bit lxc-create -t option is not optional doc: Update kernel and cgroup info in Japanese lxc(7) tabs/spaces consistency- changed patch 0002 to work on newer Tumbleweed snapshots, where os-release does not contain 'Harlequin' anymore- backported the patches from upstream, so that the opensuse template now accepts releases as arguments, and it is possible to install 12.3, 13.1 or 13.2 * 0003-lxc-opensuse-template-now-understands-release-argume.patch * 0004-lxc-opensuse.in-Added-explanation-on-how-to-use-the-.patch * 0005-lxc-opensuse.in-Check-if-given-argument-is-a-valid-r.patch- Added 0002-Disable-building-opensuse-containers-on-openSUSE13.2.patch Disable building opensuse containers on openSUSE 13.2 due to changed build behaviour (bsc#905638)- added 0001-added-upstream-action-fallback-create-directory-loca.patch * adds action fallback available upstream * creates directory /run/lock/subsys/ if not available - deleted 0001-systemd-Ensure-action-is-defined.patch/bin/sh/bin/sh/bin/sh/bin/shlamb17 1656328964  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ab4.0.12-lp154.2.3.14.0.12-lp154.2.3.14.0.12-lp154.2.3.1  usr.bin.lxc-startlxclxcdefault.conflxc-attachlxc-autostartlxc-cgrouplxc-checkconfiglxc-checkpointlxc-configlxc-consolelxc-copylxc-createlxc-createconfiglxc-destroylxc-devicelxc-executelxc-freezelxc-infolxc-lslxc-monitorlxc-snapshotlxc-startlxc-stoplxc-toplxc-unfreezelxc-unsharelxc-update-configlxc-usernsexeclxc-waitlxc-net.servicelxc.servicelxc@.serviceinit.lxcrclxcrclxc-netlxcFAQ.txtlxcconfigcommon.confcommon.conf.d30-openSUSE-apparmor.confREADMEcommon.seccompnesting.confoci.common.confuserns.confhooksclonehostnamedhclientdhclient-scriptmountecryptfsrootnvidiasquid-deb-proxy-clientubuntu-cloud-preplxc-patch.pylxc.functionsselinuxlxc.iflxc.tetemplateslxc-busyboxlxc-downloadlxc-locallxc-ocilxc-attach.1.gzlxc-autostart.1.gzlxc-cgroup.1.gzlxc-checkconfig.1.gzlxc-checkpoint.1.gzlxc-config.1.gzlxc-console.1.gzlxc-copy.1.gzlxc-create.1.gzlxc-destroy.1.gzlxc-device.1.gzlxc-execute.1.gzlxc-freeze.1.gzlxc-info.1.gzlxc-ls.1.gzlxc-monitor.1.gzlxc-snapshot.1.gzlxc-start.1.gzlxc-stop.1.gzlxc-top.1.gzlxc-unfreeze.1.gzlxc-unshare.1.gzlxc-update-config.1.gzlxc-user-nic.1.gzlxc-usernsexec.1.gzlxc-wait.1.gzlxc-usernet.5.gzlxc.conf.5.gzlxc.container.conf.5.gzlxc.system.conf.5.gzlxc.7.gzpam_cgfs.8.gz/etc/apparmor.d//etc/default//etc//etc/lxc//usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/doc/packages//usr/share/doc/packages/lxc//usr/share//usr/share/lxc//usr/share/lxc/config//usr/share/lxc/config/common.conf.d//usr/share/lxc/hooks//usr/share/lxc/selinux//usr/share/lxc/templates//usr/share/man/man1//usr/share/man/man5//usr/share/man/man7//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:17549/openSUSE_Leap_15.4_Update/f9b6af32061aed3645c7119033ecc60d-lxc.openSUSE_Leap_15.4_Updatedrpmxz5x86_64-suse-linux     !"#$%$%$%#%%$%%$$%#%%%%%%%%%%$%$$$C source, ASCII textASCII textdirectoryELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=97f14e15bfc16413aec55485344fff2257a3a837, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=f071cb92af649db4dbe7a84283e496362d38bf5d, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=0b75a68897ab237cdec2b10aac84c1ffbfc5cb13, for GNU/Linux 3.2.0, strippedPOSIX shell script, ASCII text executableELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=1b088652ca0e34dc535d24ffc72ce31881901df1, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=799a001c9f00cc84431a71c20c09f3956da8a3d2, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b027458c1e376f3df71246ddf13595d2d06b4fda, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=21576993f6f22b5ab60f7eb29cdec76d4964b8b2, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=adfbcbb0cf5f45b1d6e8f7c28fbc6f7b6bb1a6ed, for GNU/Linux 3.2.0, strippedBourne-Again shell script, ASCII text executableELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=0fc13e5a2ce9b77cc405ea76e503eddadf03e22f, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b7fd7eb0c6e6dd562e6966dc65a4d37e9220e552, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=1b45040bde5a700fa3537bf276500ddf35a43839, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=8368373fbcd2def056f97bf788493bf2258519c3, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=c405a4e1ca71acbb32e965bc87f0658e5eddd381, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=73b10fe7ba308f2545d1dfe33f01bbee03da0f95, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=bc5050649e38f99f1d335a643baf643675f4933c, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=77340def3ad6cea5dbd164a92a1ce8280a105da5, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=7b5b87c69e100a87ad81281586f79bdc1a038d9f, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=30ba8a93ffebf622117860db77d4f184c42f4dcd, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=830d9887fe556a8f1e6d099089c643eebc444f41, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=d389503ee9dbc4a20ffe2ff3c121a3021821740b, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=8ec00f1ed82eb1d38d34a0f909180c6ebd1df77c, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=876bd2b06ef831bf00015d21a3d25313b32caab0, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=fbdf8a6fc1502d78a10ef2678611f7f4252e1ebe, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=76fc3a9735852838f578367e1bf315ccef1b8dbb, for GNU/Linux 3.2.0, strippedPOSIX shell script, UTF-8 Unicode text executablePython script, ASCII text executableSE Linux policy interface sourceC++ source, ASCII textBourne-Again shell script, UTF-8 Unicode text executabletroff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix))*7CP^kly +8GHIJKLMNOPQ         RRRRRR R RR R RRRRRRRRRR R RR RRRRRRRRRR R RR RRRRRRRRRRR R RR RRRRRRRRRR R RRRRRRRRRRR R RR RRRRRRRRRRR R RR RRRRRRRRRR R RR RRRRRRRRRRR R RR RRRRRRRRRRR R RR RRRRRRRRRR R RR RRRRRRRRRR R RR RRRRRRRRRR R RR RRRRRRRRRRR RR R RRRRRRRRRR R RR RRRRRRRRRR R RR RRRRRRRRRRR R RR RRRRRRRRRR R RR RRRRRRRRRR RR R RR RRRRRRRRRR R RR RRRRRRRRRRR R RR RRRRRRRRRR RRR RRR RRRRRRRRRR R RR RRRRRRRRRRRR RRR RRRRRRRRRRRRRRRRr!=Fsystemdbuildcriu2.0 systemdutf-8afe18ea939a700623ee4f886bf5203f45976b722261ff401abd198d7a669bcab?7zXZ !t/]"k%aͼdF1UJg9~ t ʍpkǎ\K{- *6ҡ4`.2O?xyѭh8^I.@6me;]ʬ>Q\LkDԝ0ZGSA" G J齃sͨZAsB߆oF$7M&(iޥ5uW<>fR{KD'෱kp \HN.=:4;}7 oњy DF2({\juj\?E~#ÂzL| v׉fa[e+D(%E#pu4qu+kC8@u o|v\/}x YIaXsuwfR; }?6*Cq`݆5e NOgsIEaPZR8E7|§ku/Jaf*۟-BAE:[7vJX4J xO"~ѡYrUEBƓmؾඒqBdPey]`s1 r#7W{Ay5Osc@@ c5}0I cULs]9Ao6W -B `Jf5 qjɯC`s z:(*ž?h^(2GK0CLW/a䷷=UѬ~YtUAuBa2u[$לxHyG[4_96y :Ih܄zc[iuw 3Ϟ]*nLwKy`lZx>@{!jaB+1ͱRJ~}Fko &ouߩMΓ=&q88a ~\e$R%: Cg_&BХoa ;ӳ sa@a]I]VH\Tb@\Դd"8RIS`嵝>_"عN:7rV8d Fa\)͕H!L)júiعkS"Xxdf՚ )IbP#璘;/u+cJ딨 wiIQ臕yWr*>&qYfjmPv-;4`gkAhBnKr!t ̈;L$"'/Te5g@Ra/?8H=0+_re׬G-g0f3-q o{TV>Jk$K0 yk9tN;};Ǵ<}E>ug *&N~ xWϛgU~ɮ:VХN͙P5B*OS9ZCmDNPG&~^Q,d'{8,!ԝ9kf!o2&ox",X6PW^ƝN[E˯{5_`L]W;oP%G&{BrƯtEcZ'CkP#ƢΜqeCмcɘzvvN1$W5`!_AFBDt"0hsA^h2 Ey29k1h:#17OG"). |pJl%bɒ.&a0He}9Y4Oe[ Ǿ aP+*̐oel4m>́S 4[Mt&Ñ˚:6@~k,[[NďM17+rSyBǨ oS9xtId6gq a  Ȩ XWňr,dG[KM3D"ct̓YLlˬ>.\͡>s(\BE LXvc/S`bfAtM<~ƗZ~&,"_<|bIrWt E0_&{h^54Vh})`/ =dI⺍l'@ZGpDJY

 ҈mgBE/VoD7@qY-3WlKH\CH06KEp.8raTaś]{7.i>\Vz 8dϷ%4Tt5#{m&(ܛ $|L@|W9nd)RH~38;d)H:r3A,|􏢩k! "s qZz s% 5D^aHiM9Dg6M vQ+-Z5;CmQ8cP{<c!݃7E)wŝSIgbo٢`e)/Ui7L^.ki=MY |Cc'^#ߧx0ސZ']H>w / :K).61KWU::a4V[9u(n?HcF)/BkcB)(lPQk-mL]\@|kg(9 o U@nfeKd puϫG!"yS&H"1Lo`i$9p︖z_Ol@GTBQ.軌OQi!ф GsvHaB[kZ2Ϫw^YW&Sv8-%(HA% tPI c-][>-0µϻ^e Ξ9DCL?АF_oLAŨI|5c[AM忻/%/ ɍ`[tp,Fl7Xru; )#ÆNzvs=$N}! _R>G!'f&01q'Qss  tVTJ ])B~2VPJsJ= Kmd8͜ҸFףx>wNW}ˑaZ2ݪAa;1[5*^VlH<:Vf_ KS;Ž~Jh6mt<*G\};5 "* ɔ͎}ԛ'>>uԱ60_9oqҵ>XL{q>eQ31-㭂HZŦy(U {#ާ4GM=Rr(K+傠 by`bٖ,GٞEZ (a O%ΙyuVVY˸A8:(؀VW-.{\HAއ@qAqPXEL޾93m$U^='y/h :vW`V}*\'5,@DaиֿiaW 4$ZN3T`9hщ:6:3EjbAW0xcVFbcƾ̜3?paSz"Ը1l:& l(JJНISO]`ɴۤXz ,sT?4h{VAc6ɩg+^=ib! HCtKx bӵK:1}R,ZPQ 4eT &]_uLB;eZ bOCK*4o=E}IOnnUAUP;p*2ӈE4D9!ykP1 ȟ":ޤ7ɏT`ë{&F޽/~R/,;e(ij<+ Yu%yVi;υI ,5C&_!wD{;K8⍠c#/%q 퍫/Ѓˑ)H<nb,Ot]hyM3ާ#)#0Y%gޘTQsǛF~fE-H EU"`{5 H8אf2aq=})Ve>^pSi{x _#s(&'AS ƱG@kl3oӦ>N3dۦ &^!i@?WN~mYZZ jCUx OxM:V@m:#Umd-%3@:%8XpgeBv9)d n9{qX#$Ӛ9ܩ4ݷBwP5%C|Cvd;#(6K$Ebjw p`S\˼*PQ%: mIGdZ[Ykf]J #1;\mK&:9v{92/xpyB/ӻ/_qhR'~T;>NmZ2;7R@%X4:I7Bɱ`_#a]xIVaS.!׻‚θPItD*K4J Y+C {cn>[ƪh1$ ]\Ɍ%}05pH;&An_m 1k~ WA|uH[ԙ'MR4Dd;E.Wo J947c@#\-a)>\l+M:MFSF=z)]qw@h! "0v#$=a!IoS o e%2tו@oNJC :QYƸ|l}CJ;Iy-u>pR; wmƵs}G M2ɛ~: $*|RMCyJi:-vcu{B.uQSG'd$_ mOq ":En$ j`#4\:©ymF8gkpe_75W~dS` }I?sZa0=:K<@A="£_7~ჾ -$o3昽/?1JuQlZ8wE9"eߨXhKE_i#L PCn#kQOձJc/Cz˚8xgh_'v"#@֐8ą{|kE&#Ͼ3'Њ3( MЍ__$N<ؕ)tgbq;A(a8I_y6;+s >42-a_)Rǭ)v{P8V57%G #Zc$CCդ%j]ϑָrPjdН%V7fCLUa D]āLzz`[c #$LiC4iBG63gjXQ>:$aԓȩ!Lc![FMvt[c'YhDu ?mERJrO&ZfejN ^\]#TA'0ZZ*R\0vgH}a/@P+=W|wvzvP IIBdڒr3۸oF'-%>?XhHn.LIp=WgӍq)E2"C<]$LR Y=u⓾')M_kMw VJTe( J(ԗNbn jol2-ѲLK69Q,;zGQI9s;i>8# ق$Cڟ F GhE*; #Р8P`XWc>p7./)^%&#ۆ)!Z@B&O+»kl7RqIgkJBF(Us?0%Nn@sanQx"JJ՛Q[xZ}z~OC^&~ƀ:nJ~lr9|":c3\Z?{Y8^Z$&qKqm|o5o\6ib$sf뒩xM5/elK;W&GVFg9aƨV8V}Gg^ Kb]:}{ K.G?ll]81#,b Tpd(-9+:0T65k~.C-0<#uxy<>k"?)ֵbwBaj:mO,STpė,D%5[t13dhO"6ɻe(93fpa.$+]+RYT/j6UZZ짭/UXe쿄sPZ82a*5||;#'Dwi%Z#7U!yߜ!`Ng2t{H`$C[`׉adLBƌcsڈ,xV̓QWO{Iq$m܀н$;X772J'0 iu$c-ICWi-Q48ytt &UGAn6͆GC 7xKJI7ىxr/n|]VW>?W:TkMW֧6I~Zw+*E'JA5zkIo@+q7f{}6Ds6`G~"`7Kh`7-~|ZUG0jQgP,ȃٹZ{D |3Qh Szŭ 2h¨4IIhx5-Ec.wcKh V./g[.y#8Ҽ]9]̞}wwU[Gi3:_^sóg>5D  qm$u_M8zOpT11S75tdϬ%.A2V&9g=݈ۉvgm%:VFdYj0}ZMZVEzp ^vTnPJgNU{fk4LeT7F>s e6鼊o^XpȿB %a8#:j _ȥ4_v6t$`w~muLy뵶G-p5ӎkrt %Xl\6p[=Br QiL/%ĭ$I(R\U* 5;H2CL]1HϷ0G.9 `NHo!tv]_}sͩiBz0a.x)o\zU+C1=Lf@6*vG^4%̉4 Ҟ3[2 ;KU:LEv`2؂*vk5~>;|d5nW r0Ү f߱q p.sСû{ǝ",zHv@*Zc;@B̫@z}{]d=K :zAT(µȸmE`Uv рS?Vuwga-BE 3WgjF)^) 81D ["i/gzBŤ8: %8qy>sg T!V߮ݫ$<Ѡo d%ċf<'/J׸` >.$GHeT>8vpoLEע „,.8U^t _‚@EPBK0WEdLiD׆׮ngɡ۪3ȩ t4틨i(V8)s5AǎG\5͵q ! X#2ΉC5kqǑu\j3+I&˛Y(5KYSI0=>En;1%^%h A > +Ej7J!hd9&9Cݤc(Pe@X!*^VאGW^6zDZ f8zD4s1:WYC3ToȂ?& aU4G~ 2]}v >Z+Ě9Y V37Wx< i({NQ[W_~^W:M6KOjhĶ8eK,j9 }uܦaU顴ǸwURY^QJw\\V׸.sVƜ~XҖ"mjgXO7E vvHβNNi+ $.XkKIj dQvGFw$+'iaYa64IWmműBmf)>TPG%`;f)reA";I& PA $ xp`*AI$x5-K!jڡrUZ\btҟ|m䮷3*=?#N;1)c»fV_׮s8-ǜ}읊IiW-!\^5i-3NjNkĉPbɺd CC{\uٝr1+)cͅg_ԙ)p30SBʣ*G7.MOeYKlZbc~$k{٣(po  ,KH+JQܚ[G .W9LʣPuDIN@ȑ`qqkvĜl֫:-+}qMi-,WW  c XNت}$*ZK{ofhI+Ef'mL>dfeU2M!qA(]|#EShW9%?%Ϸ]PUen{ؾ}pf#*Ḣ^ypigB@\ۛbt,;A9ARWx_"0B0-"w`WKS&.Xrde09A^chL93L:Z >p4/u?[@) nvjHh84"3kV/*qGdb.a<btov@]u9}qViS(FN_R8 Mm)~MPiQwQk9cMul҆ BtL'wo>0c+`tnWw2,ru? eXU HE23bU96v.sj/el7-"j9),K_\75D[$āzH(611D,0 (8c6I,rY @8rA= *H{YM,cO75O}ㆿm63#yAH(TpaRa4T:D}]S,-7dUXp(mLd2562UʘWO [t|Ez9ByJ7* э+GMw$c&X! C՜;.Q8~Uk`k:AU;0QlGni" 𔕛rgS`OPt: 4vDܙɢ^dki לͭ_`O"͏R}L1q(3QlWۺ'|7c3P:u^gf MZծN+:M@QW7LxVQ9{dUoqrD(>$4=U p^5ru.q4J @ջ\[ꎮ0#X58p5;cY>Ak=B@b1j+%<3 ^6dY _FToi'|J+6J5B]Bw8+a2 ֒Ͻa/CaHt1δI*6PVe& %HEM5۳фL ’ G߂F(Z3ĹB[ sX{\Py TLp &Kq7Y !w5ּ۫{pMW;(u&-8E.8]ot/C&}ޚ@CY89pxR*/'V-J=› Ш%#VJ&=IGY̆YmvQ{`(K&!5Ug[E #a_A 2g` rH\ $_ˎ ^bYC<o-,BAR<$U[2"rC;)D>abxDZw=t_|l#Yb=_6ozRЫᬡ}jMSG >G ) ۦ'LADXY3H3N8iPAWľsIY{mڞ tepjB4"jq@el/֢{^@إFhU=Qz$2By^ܓH?V!;c`bOpN+- ~|{& _ ~QNIDe'^IiBe5Sj.Q2T 2'WM S)Jo'Ne^*I$x"k&1ٜU" mhT0pV;U-@Q_L}ZJY2":`(S8qxsl8m2~MSt 10P҃!HܝkrT'됛 ])$Q3w4c&`J`".ANn:Ρ ZyME1d pX ӮmAۤ4T"-j0]RWwt|Z' Qc+ΒՋ&iAR0GO&! #ҧ?T@ʛQ/G :%Y2*62ʠ[\%oSr[ȯ$~؏V*C Qs%&X㊐vwO[2'EJ@*m>%|BU'<80uߘeOtcF%݀OPiaIqO/#^@wUR &iggm5xGx cV Y*醄ݟ us&l3 A+kM}=eՓbvNORPX I) j$ɴ,s<bJN8cv4?hy kWU<=QjomdѣM,u ln)[)UML"v+O#G$YRyHmYYn?,[s#c m*m AQ%}jxBM@Lܰ~=#aUym UQlCbq'Rk`ho$,<ͯ߰^2ܨ釔ǙPŐ,KU1, ̪0Dan. o3V#ELꥄ8U27dB|t76 Ԡ=K_&tVr Ȓ;Y)u`:08j҈ ە8X]}F:DZ{ɂ#U aBzȇtKȟۿoޛ"C%mhQ? >kkɾfG8U{]N2:]_ORȑ*c;?Wl򽕖f㦸^2ͼ ;=a sJ,;߃ΣomQMX 49atbCּٰߨNI)4mTE&^MDO&5OA>ZAtQe4Z%9jm;,p w3.WOE'4@~K3ge+Xw7r)DnyUF< @򫞊L"tI蛵.jIJOژwߪ]aS$D7Zarݼ?g#H4o6}ܗ8Lu~iJȟI>v[cj6Lk3mR@*, .kz> /Ũ9Df[je:VP ch:,t%QaL/ Nn.: X`R<)~9E- ̅ ++O!DAFGY5k@%LѐB$AVH=F;oe')zO b>p }3l6'Cͭ'3¸nr$kl\Lpէf02qN倏| 7-Q큣%?\^6ʪ.a :Io>,X 4[og>p ӻmMʿ >hJ ,hv>\jTek'י4zT]Kfg i1v|Qê_$‰C0sV~ig)1u[2f$lZhΌ'5PPu Yvvhiu5 RH@3}=7$5iFWrI3!_~*17ϝ 4lK<&١ux%%Szӹ4y%t??u';!n;.̌$YNp"LGyJ[I؇IKъ%#҅&*SsP{{ fz9VB' 7ƺ0},RR?kx-6lKf~9ΌnO|3D|`@]U7//0G諍 9Pv~("G oTyZ?8lC)~ڦɖC,>,Vq#1 cՃp1:WbO/ᴱ,K -4]=*7r*FV*D9%F!B̈@X)Y,=c>)UNh!R+=c9)ɕ!y<'^) . )m Gg>s۪RA;tQ'hNuâكzz%$(n[4?i&>Vi4\Г!E#Wᖟ.b"Y2MWPUqs.M Τ{l H܆̆f rOߛ􌓐[/P:R?H%_lQ wM7$X!R01[i,.PgÇ$*HZ7;|Z!Ӭ0KNbKUAa{֨U`YYi_ǰ?mtd9sӄ YDvgF%E 1`,PbRL&G&1|;;G@=A!ˢ Q(htwleW\Y;mx !Ϙdzj&28T@Dg*iҫti`- OG -x7jg}3z%E7pYXx3&`K/o;k\(S-ǭrK\68el ;p7L}ZMJyមdkbae/}uE|_!$$iB^Ui5$qILyit˃ya}mn_+ !_ 2H'){|bi ]9Jy h JԄ/V!V")(S0́2(. Ra\E u( r0f2v:$3K|5=MZ(1 XK5!g0-M'THz:3QgY*n`#ǫ_*?Gi*)q 3"] n]hx#o8#m } C  eayi'HHm &CA3&DHot9nn#ܮ1a js:ѾSBcхBvmGQ$D^UdH.UsZ8j?΋3I}39P:\>L_GȔ$" X%_jN /53DMp"H;N3RNfBL)6)UG"5; LU( 8UDAYfp~rht2* O&+:F14N>(וigJē#&ϋsvZpp306EU9vr R4-p_斘MXb؇H2qˏf-$e [=KeV꽄}=߾ycYXގd"jH9ؾYK{h&tC/ݬܺ,%Vgz-|};f +w7ξڍ+&Xy|Ij`uDwMJr - rnx4$ӧ9R{Ng xq'@7-aSco/a [ !rW^@t{4x')=vN) bp%`(=`M^7a ;{\r%%&vgs!s<whO7$+-7}E .徵\7SꉅQAc`)UEk[}zY#C h ;\PWf Ho2nB,×}嫼Xc3_"v} çQ,8*Ϣ Ce?C߾n e`wjR20VYbZZp =b$ʩϩA Qǂk.+}A1'~)4_r:PF!THRJk(l/yAE!d ӏAmgn$vsn>#梞]O8UkRŖBT!~KB`NN^r:dM%0YA^wK~1r(G9)x8w~QaWlAۂH`H-4C_7MSb+)nw2adGEO'm+߉1/q\2ARK|?wi3CmrG8uUh raP# -7ߕŝ8}hP:5dw-x7H銷w"_>{dq<䮂#t xQ<4v'^yjW8NINΝ*v$ h9=j*^z ufEh~j֜4`_@mIGI,۶vfJW\h墸\ ؝mG\ ,%Ƿ桹h Qqtx5Tj1 VdrFWN)VrV˫b?xH;P:Na8䟴?`O}017pdHjnEza%ةwN.thxW=:_ӽΦY .tyM]e]| kI2׋ kϘm*G”3*s֞'[zHbÕP7I5ڼ{|ȼe9W@Ja`,f40bA4JO#֪So0~EA)/cp꼤;yHhF ~2533$Sza\-Xe Di},zUfh=+RV Hn&o /E=T?geʻ$ט9srkj@ᗌj&h0CN]  OZSmFӯVӔj>.z34h+)}ݹPt@T 0D[=q;5Kfx/Se9jޝ>Ȟ{#I+U>g;ʞK:VOx7 ەXZ` ?TVԿluIS5l>1T✴dg]s 7q$! 9^$#Ã:7M,X&$]ZRcl}[XN>{ˊ8ȸsWH|;:9(?PXGa1HbhƣLI7Uncbmzԡ xXIͯp^Å}Qq׷PW*(.ƁWJq\*D6H< '{;5k h5`7 xؒ%4+1CrŸBPһXM`~Й7S8/Ohp#iAa+m7^3uI_ޕ6ꛣ^pǡtCAi~y&MsҀ+6P?^A,;x<0dT^uѢ̨asc?`E|=oP랂c8J$>UFRҏ NE{SIX}aASVX}4ARuSl)Dp\ųb8"P}qgRWں6NYg_;bGشYWT!Q`/9Չ2su 57^b>Dh1Y6R|ۤX(gMnWÚ;wY[hjMjD3еUpraT7JQ&BCCKZc=%^ş/ڞ,G\}J1K5z&/)TgI,wEpNQ:e4q~QV Z*yFu.}>ߣ?NLdvav*L)%Iv|Lg<$[!bGIzI3!kLY+`^].aHWFt# .`ڦ9QfpFc=Kp0tW;<%k|{e~5vd^Z;sPuN׋X ?#q|=}T[bsSvbhox ^Ϙw_ˁ ؘB]1F1)c5ыa)~>WE oLH#E[~ͭ A{Xh)bVI1mݷn.չ1}oNl+;*,jYdG922? ASJ5-R>,.#̌!L{,_:Dn}vF&I^_~pJ*3/v;b$vof8;VǾirbiM![mJl`j4 f ʐ,W9FOn} g\B@C\37K{\F:0yѫlWI$$|A(?T]&Yox~L+4FG־;!]vjJ1M|ΚPwam2BL'? SLxh9x1WI8_ĥ1_]zC vy9WUc?9;,5pho{|^Z:j{q[8)6 |#;KRr0CъvUlC?x>;@}ClN1N31r]I+)Tz80U4 &hHE9 r/./c1l>J8^-"6_՞/WΫs*BxGCj4dLͺj ao^Zܖ EH>'F ;G玒m֬.n ]O\9ͮXÉ S6ϳ'ǔx ksC;UcP{#:1`)Q{\7|L?%%;{K"kR! pϣ6z;c m.k2ƒ+M.9|R!5vW9p}U'΢!#vTfL4iQyzU~H*w+~k&NMx-o@c|*n{!&"<'oUԈ?mvl'Ta 'ͺ*oQZ/q>[/2'<@6eW5Ь #ck:u. D:Lyy:sߢT&oTF.EɘeIR}4t|z<װWM,e Sҁ; :])ZO(Υr.Yv Z f:IXًId]][ X+~KEbvO7jrǻe^|E1#REMS!ۥoaƠ,FOLZ_/'z,!8Nڪ9øoT)gH9cH-l{Z5x`Ixc'\>_u&s'xzGˣ6E\Ux$L#T}׌2&B8SCp>Zp+xqk-J/ظb\+82K*IJT%DoHc"Y!ZhK@Y`x`B5Ek;}]CCd4T%.&˭ֈ: VhĿ(UkjVEѐi{WTP+jޒrT^8'\VL}T7>W|r%B]m')ʴ0/Ҵ0CL$"lpL:2DSrxX|tE_}ͳ/kU(Sl96͙|<$=eAA- Dֺ&hTgRZ)H!Rg)lOTy,޹@jX4 ʻXnB'D xf([LHh_Xzu^jmv/E (ۢ T.> kRJ2q\M6&wLm DTs+%3є[ҕb*X!|{j[_֛W%v֊;Yx1GWw[X!@Z#6 dS'9_4uH"Lox SӡC&JX?-s z©tHi?.z԰BJKu9g\3>xT80cB겮$ Y*6?ɓ_"8|EĬ'c$ v;Re$)4 SSGa@x֔j@bzrs Ƥzp5mV1a M8Q Q_Z"XDVp*ya9IN$|p&佭H>OOk^戏>;o*6;jG:(c*N Վ&tm asԦ5QN{i-5mN&AY`#48fJ1B 0-JS:Rn.{J!~UA(_ DEg?]WIӳU+5e4p&%b]G"߈5e [и 궋!wk ]W"I|c(0&m6&gJM'-z7AP,rMj:h<IZ]+O]̝: * +/U JCJ |Ljmbr05#pkroX7%du5/5֫ \ouZ$.ݭDU ̂T_9C9'_ݽpĵHGs k*&/}CS稁?X>2:7>I;EMv4LE7/Iᤐ1yCOCt"P w|% Av׋*X@~xWQOgXZ[8@uY|n:x9vWc 7 TPg#t?A '7D:'QhD)DK&k>Z6:5dx=@꼺I>5F!^"j>c`rc1k/ȷ=̛bL41EbOD7t`HȒ ^M':7:O4:\ɏe%ObAhٲΓ'f%Ƕp <ӝ E,jxX\ tӤ, )?`g*Vnpkte6o][+6cM߹gibmևQK ~p;;OGNzւ,ϧU{@lGR}bps( Ip]d90\GFM:ı;Pa,v HMR˟Q4fX!;ndzܲ>: =WS0J0uϭo"sԧX{STEF){4szcxDZڰUC剕@ CS~4( 7T.5lqKLnyJ{W"ku39+ZEÜbf BCO]Q Blj=_VeY|4%UyRk'_[mɲᏲw aK=FT?t fyXG^@L؈Ũz.ɠ_ְ!ίOTӏ+$r;)%X޾,ݳcս"UWςbZ>M 3n/Ë2Ϗ6ѲdQxXVȮT>K5 {;`3 9Q2(7]$qeK>@8%9YZĦcCYTRe, wHڜLbTqG&S׉}E (}z[E,\:q۴¥1Ov]NGoh\erPIWojD7ЁwӤst3ښgm>r.&N~}x ď#ye||# &B0 5%1i,܊`wk}=.Şѵg#G*肞~ZW>qͪ<b.aL|LVUE5\>㪽Ow+ qR0rMӛǜ^^ZZfAխ.qU[B@>BEɩBĭ`Seo>ZFSHG_]ןcc:^e#fPctcK)`c68.ö+=l%-3{Y˕ȋ9~G:IBF\5 vP!C9PxgO?%ufRT@hf&Lw:Pˍ}I=Kp^ d;EwTR;. 1c3pR8$Ŗ󀦘6И;[Fb2iF(?2E/#/5Mt>9UT'Lv&Q50EF/?^h('&G m@ ϻ;Bf4[f%F8n𥿬A {ACfނC%ẍ́I0p tN2,8$C lF=GK+]bf`Cn@mkS{ފTŰxV@/Xh 8!Dx"I]F*|xL_ ™"VxŖ )ɒPOl=o=ɼֱɼcarY{ mGRQ%GX$req(PTErF˘u* k4SZC Ӗ#a}5E`jR M-DZFŤ՗fq[[?wL6\a': y qHwÏ)!> Aq4M_h93-\͖z6|nQƪFB:|m=d m(`Ǿl& 7ߍ<+o' p?غ4\;g·U}n8DTeuB`*"`tFp.?p0|A|g!)өR߼/b,VP}EZn-H8CYʩgv4$Y¶*_afu ę?X! J+{$ .ҥ[wKP ?+zW{' s]|&dmA"A#5}:6 9}.CS~e7}woI (A~O%PF(}Sy|ּ}#%S?˘$ 3vt1n,D VY哀.Zo}\z5 "hU`[{sUݧWLZfթv Ch?ӹk-?DTԒ%rO,Zl\$z(* y)㹹vGg9 :J=OPz͸ VwK&`j;X{"$~K!ʪmQ5Rc,_c^zmZ,؇ldݘJHO^*a\\_N6\oAWq.Wsݮ<", fyn`]XM|ʮl"&AJا@lBW kyԥ:+?.> P߱yπJlg]!9eA5WXݪ) ,+:.J 4 ʄ'I]E]kh-acI8=Hz 6tT k1(@W9੘rQIK 1atMUOڡ-8'FR%sL0}5Kc8oD2lh_º#Nd KԴiR{' Ģt FXct =qt+8huo`2X.&˜ژIm1Ì4X9 x3Qv˻.*pLP%8_$bYQQ~erU\ٟq¥_ܕ7yw.GF ՀZYBH =R'Y0c4s:NBU⣫P{6ޙ^s+DkXƅՇuq`[3XPp ,VCсwF|C7;ZH7:Oo|x4)##vR OteVfQrR]n2rsd ~_k S{{cΕ2%Y:#B` Ψ]ƤLeIh|[s_l~Q_)F1=-Gc,%\Iƒt%8GO֊tDgO81k7ЅRm8A*Y>6&m +YU[ XB17{} W]fmq@`]HB޴[q1ľ B.2ҳ4]2xx{HĦu:)P *6yC9J_$H9ui%(,~<+\)%%:1k(+knhPud<i2%%bu>[׺ >2(7ՙj7K>G2'`.IΫX Z :&sRM*jưϥŸ\^k Y%>dq{1=t# PxlS 8:P47ަXQWbկ"7i] +N'f7vVWf;ҟv(_sL:8@4 ?>D3_ʝHTIzE5׈ڿ<30x3<ޅaopkmQhvsL.e{QdBM}֓[-;@{lD~rB0H]!Y6Y sճΟkU@V_ʑ;eƶx>F&)*Rys#h H/ Hmc{Vc(s|{>+.x' { +qht1Ajm2gBҋm .?C@D˞u OX6؜rm1#?cӭWG>G;,MFYKYod}Į(jtt-¬!$z ʕM _ Q l6HΊݡ[3ƒX 9%JI$tLZ&JN7cwjO+~U5M=Wc!f1'zH׮/eqHͮpMCXуrru,3NY-f );~I @78B*7[hnOt qW>âh6%a &X\/I ො}~m(eRq_<>&ݰIo{vcU+EHB#tEKHZR iBaVHz?cٟ{~p.`߱r8xjT/mks3ͪXNq!n-fMHk\aO=,00vp7:zcW L\&p33FP,uߎSOkQZFҋ11H >3[h2HVT8Ʃ$>S>Pײ&Y:C+jw@CX-ktm+93ߎ ^0F{q&Z [lkg_2Aç?XLAW/^@?Wɤ5IG3wti_Nt DI>RS"5U~gVH~x{Sr~ץe;5O,텐43x ܕo6:VZf*j#hfFoY((,ʬNN)) UiKu,}ry#*H]zDKWVg 'Re/BG*z , !-É/&lzAӼOL!f6:^I]$o+Goάla3Aʗ\D r=bSX}Xʡ Bh5m&  T2ۣ͞+%Z*O+n!0– XU-['h&5s׬._q~%K-5/ܵFJ2#8!0VvorPf ;N$IXܜ >#`A5|s7c鐞:+AaY #!ƔW]XBʛ..I4϶ArCm_̩W9 LPZ> JAsi@&] '(]SLMJG}H@bB}̺bz:8)5ɕ15m0x!&ɔoqӡP!N)!o#N}dŎ&^|K~͆|Bv5q 90cESR z iB>H>zFa^u9m(o .Ixʠ) a>s]*@[mX6*jǑFp0܋< R3}&DfޟT3u,0"at!W?.q S4Dڶ^_t$lyvb Kkg8Mc.>fTy;#DՈL>J7hE|~fitUlr)iR}>fp;C+xbjgF{4HU#>q]:,)JVZ+4>ˣ M G$7݂B'N6}qjl4@ӄ.}˾CCᰭ'e#̯X_7WCci@WTw71 y`o O,jˮu7Y0en7Ƙ8xHG%|.XҹH9J7s)մ_fU_ɳ;TKse̱]uf.)wپ%ޅziN7, vT,&r\]_б~0Q8[{$ alFo?WڴF2enH񾇾)9HÝtQr^*T gi[ Ժ O"ܮXמm5›=3w'6p4OcnU#'<ra/ i, ݮǯ'EV.9˻<^.iC/R1}m.7wS?cˆw E=䏻|&n_$1S*7*5Ma rX͡DQ``i{:HjRT' PYvwϣփQ܄Ŋ쪗u**V ʹ3brqly=çP]N[ jr*$aFzľ<%)SɦM_cPGmuBGްMΰp+M|ĺ"4)]3 g qsri嚯ޮP6 QV"( .! Zٹ 1TI\+͑#߶`]!@}TdaOKx~P/X`_ÁoQÞ1F:CW|M*_[X&XzPT-iR]AxYV=rEi·C?县8"۶^cgve)kJj*c=RrsFNG];JUռʚF 'E:3,ML{or.%h,Z)/S"_:6)r9Yj;Q6~frle[< - ^}}@Gc ]=ܪn`\oKl(] =|e#^$ٚ#$=RV1>IdF9zǀ_mdk+ը>x|gUW-s m~+kh` dҁ`hLC=Ǽ@}"UZ9[DnX]MC C:bH͖[B5*. CH'A7at& ]x}Ȧ"sYػLCNPa͆K ŭv(\sߨqOu,'E,;#.Fx̭ޝ+^aΚsL)MasR_FddukW|]pxSL[J7qmIE6 P7S\y:6:aLD68V#WD$ l/rt6ۥw.d|!8I]!]<_GukQó=v1 'c&:,|*]>*V<-˜0 i6%XXZpA9QW@1htL=_ƛYCn{ ՔS,H0 k\! Dw$+oV8H:mg5j*8Gv(Vqkv ~ m KTtsE91JGKI9XQ"ڼͰWj6^R?ŭ҇Ψ֘T:v!b*C=Q)ޏ2`*HT3qlzw7hNnIv6z8T 9*/|n#;<]oDiµ{.͗"ޫ5XW%2 .h {7+ Hos *'mEveiK ;rϽw3+}<ب|j>Tq!Ee!cK1 xi J=mup9k\ J#Ygu*Y.1 㞼Y ?6RSO\υ8uKJAﰑ (ahP#P3c3o96Pۑknvh-JнYtw 1tBumb-h59˙85YF@V!Tg x^7 61N&k&MaL]dr`u)uUb[ I86s Օ# ΄Xpv!I=~*z[T6CYka m}V`G뚾sU|ihl@po*\Mh{KI Dj vZ[QC*!:tfw ڱ ߘд[C% ǿO Z r7HC *=/IFw]xY0c+$6|ݶێ(v2fJ>mޱL ɨv-mCT0+ܜ1z74QCʜ[6I,{i5n=Ճ+|zn^pCwR&tG8/78Ŷ2\IsL_1'-ͣ+2I6kk4u8x{&ijtʉb\`|~4M΀j|܋rĊe(9Wϣy$sxMWD^7Ra f0Oc7yكט0jE0玲<{04}+8$CНﴡT'LS.:Ts7Dž/ sM+u"%ܬuie !|E|-`_1Qj{P7FNɣo^=K䯜I!>.^4 s-@[d0OT\!ű`qC1t߁ 륧eX/J}JxyL옆鄿m1 ։ E qظ3>%I#mRY9K5ø#jmgZ<-@%S-9>, NܙD_68Y.XkF>U)0=O$UH^ SaS8ƒO]o6A`te-|=!ɴ\WZ'5'w1a)cjntApO|XqQ&+R!Gv/6!F˴B1+N+,.LnB4=xDgvw E jxX:YD?|"Rga nZ=&"w49,DØeV_cy=0?Mg#gDXGP-WxiAU-Tg|ȍ? *;њxD<%11e8 8x}Zʸ(yR5ESڪr"24? TN|X؛UUSc=0Vs!)0 uc_Js@ܿS vx&P_`2vF:NPyy{!b8%>gQM[NU'$ӓ T)=@ f( Vul?jlDʺ` Ec16"[#~qcE>e3Ƣ cekT\N C|.ۓY̩{IORB^?}|WvOh( gc,v HЪȳl@ՏjjI%w ^|wG`;9 "]LƓ_GW'?%cl6 %?HlE'*ٻA:v:N ^>5] S!FÁ@u]4>~9z6E6m eu-؊eߚnHưFtL8-ZJѱXYti0%AN"~jUԙ9zīʴBRpf;DzxoNo{g:qZT_ x[5f]TKt_#9ձ 3/qƤ-yf;rHvvUYteo` Ezaks l^ea7~!ˎlK*7(6X;#rXL y5Y)D9X/9_qfҞqKc$sJ ؖgsI!Day c:b㋅^gEYPGA@2>bXEvX}v+=4}oJ 2r vub5A&-SG2&Ppڹ7]:!([ @🢷ucɧZWt+\[¬;SQn?rnryuSŵMx!Unܨ*H Q#JXp{*>R͈5Ɇ 7:CZ?|ătxitxBK okA?."_;IUFk6lXf;]EL|#jFB+1%v%?|(=K "ENƋv] bN 0yD_S⥩3~3l/-]*R6#Qщ*>VG4YBoɵiڂï~a]]OSsNb%50N/equ4( D{[VҢzu8b 3*S՞64sdT(E}RF9!Oq 5; ?DiøZa%Q7 ŅjL7gQ@QRCK~:Gj 5p1 %?n߹GbQu~%ŬwD~iS_@_S+ 2&Iw߽)RՁ,e(sIޛhLpܾ̽UMr,KAqE$zO-;Da 鸔Xr9 o >N0q<`Ai~&Tɻ2::*0NU!'Wf긞ARVgl~7_vbi0!Z"D9 :d(_qdf_by3@=I)Cm#fF P޶o+7!YrҍRiQR>Kpqw7Duf,ڴz *ٟFO1՞4Zr -}(az㫉YHbvQiLs~,I+ xZJՋmgk7([}0jIcI"E#sׂ38l5i/C S,\KMvpV^[& G\W\,|Dxc+K^l h3 >Pf6@40rrrVt7'N2 (aYa- ͷa=0N"z̥Y]Dd6``wGox H ƶrQ&&SEk̛!y輦LyyN+͖_nEFX)jCUdIROA:z7'#D[v* U;~AވJ(u-+Mq4"LJ'ဝ,uJH-% ? C1W&sϑYalG!òsoe|#r ~-NcU92Z.^lCuqNubiR. %Gw>Um0!sY2(1kYER]nnaב{]Q`WN<tP{t/s۴~E1&mNkp:weuRA9+2"̶0 y aMs圊7g"؀{x8nhKV`U^^Q-ԷB'1M=Q&uw`Ϸ$.G e ۃPAZmF-.AE7,HǶE9QW=?:J]\{g @QSLh36G'`yh- @G׏ [ n/H'=D|_?*.rd/ ?*j v޿SO딩vKUlY ʾL~C}LhbH];a+BTͧr98̆_(R@cИz_7*$W%&lޭ# EY(>f\ rNq=VR()4b~:}&bbѧƲIX {$cF]E*~S>6]WRFI NCX]|(?aCI!MHgTWɰ X/ZNIM{9-Aa-*'\,"~+gMRX΢2зurq9OC#q Sa*ǘ שg&rsg.yVFdZ"OɌ`p,@1;ۿCh&^6Ԕ#|.zyت$ 8Y-\C;$6ላD*Y6!-!;vVC0BcEYgpa?;ߗ>U4vpmAT[}p(>)?`J1YY|0?Bxbk⼼!EG!ufpA:Wf?<ōa۵9Y[?b~%nB M){#݆p5`&:CI[R0W\2Ptx@s=+mЮX4"^{OF9_i*u 0{x;BU840Q7uM,[dSR$ wBqsPoBw1|QMb_6.@“Azl -Y{:{nilKeX4#tȇ'kݑ0I:*lt3 IYÝʂĄGl qRA9g`eH C\LeϊH=ptʼn'L/Rpp@?־7gB.簙z`z2EB]O@}y70g_A f .8b]uGka`yK b|?#ťpDͤ{C[*yF(36M-RV]@匄 CHV9$4Hٝ vIXd  BҩSz\'9UG;Z??W>JO>FU~NvTBuc h}9\Q (qB 70Mr,m!}cxЅH<./f}C^IPbMB-8'i=TE3$aF'g3Eq,phuCi Τ!2QДXQ.r(Սޝpon'D89ԍj*m΀F˝4`ӵvO7N;3@kϲr^p¨='V'*3N8]:|gg:lw;Tx}wptx)>WkT|Q!jhQOKx*W&md 5_?%״}2##Ȍ1ɨfOմQiKi(ꊶ8髖#ao8.^Ns(}iw J5 6+ O`֋` x*wV5C4\IQc*>:S ?9Q6nk\4*bImI*6Ւ':IS8z4o_6Jt);ld@ʺRq SKjC@`֐-f@~jy&j)vAuٿmrXf;L{}֋vxՠ9 Sb_XLd} nACᯆ*{wu@SE?*7CœuntCKrs⛇ 7au zɦ[Ԥ$ϺA#vU,5D,ëlxya(HH$ ,:z=qyXcWR:p,8huD P(0nrFcu?`,QUh,'C7|{D0MP_JvcݎzŹeyV,1?Dّo/$( 9 -1, pUsOH&%1S7~>쳖p#z7`|N EUG.m1km8Ʌ:(eycsAre bM'DK&bg9:ܸjJ my}h>~X,ʑU'A۴ś"1l+ lr Lc ݮ$#P3e)z*f| N?>*-NQ{1irEz`hWxf\7{Cؓuml ȣg{K޾ک継hehmyaIE08 &8j={P~2<?aӬԦB*S*_Z勰- $]=b287պwd6$o&- #X,`Jk=FjcӉFLMx#2Iic΋+F;E횯HĪ6yT^ I!0žng"? p 琉hBLM86i4SKD]IO3t>T].Vz?\~j _E\D!*?Ym8JfP6"<X@/·2i'[ u2 PTR tZq,uYxD WI\ /t:FX|&O$=k2{(nv8ߛɩ@KPVyHeR'KqBk(YlIW3RۃB3^%1S]aysRuiHGJ!2Ʉ™ &M%NFYJ=` 힅a(i77D i:Y e~AÀ(" !lfv=:=?#@!߉TI.x4hlXƛ/N)lDD󩝙0W0ol~Su%"yT_/8jQtE)#6 ,֤2'u _;=f)`2\{bӪd MBKx+FJ*(/ބ)%x7^~M͋YNbTR~=1kZU|Ջ)J R#m7YP)|uN]>b!V`ZAdŲ(bnw&[d=vQ: N V`̊?#\Tpo[M$'c? _ H`{gFtJ nɦ Bh EW<,S.!Qw;CJ3)vb.*X7hN{%+b^N=3zsJE#P 7.o}w;4?$1D:-77n^8;PI=sEBzqO_='ӖK ]ZٲE^p8i).O)g~u]OTW3*Pl&yt ܤH4Mgb`So7ɐ+I<wX_W2~ڡ55Evnb 9aKM-Z'{},ewPz rvxNMũb:\+o~1-9*WpWե.cRPOcuym!*ߔ, \bHoU:~D<}ՓU`>e.t\($+{wLp8grHaU}"wl흃c++-俻-vr lOJat?mfYnT:껇N%c3S: re;Fe EA(M.oI8}ҏļXx"m;e^vYh@T4_S͍Ȃy?h3G!wĄܬ")1v*i-j&>wPDJ>pAƗLwMU=YR`ѡeEvXez&#`G w/vc,zz>\I#B&7+KY/,!Y5Y3Yqov<0nImq}KLpyE:) \HLRy\^fꦧM(.Př(S1G4LgGhOqHE53-"kI.L[ 4}1OV; v,Ȧ$k"T [̀ۋiQ*Y7hl{P0K)Ԑ r83*+8D|`L\6R@r_?.cY$ڋ)J#z?WHط bf1mA(ET,1>jjvfu鸫 "&@kK] (g{4z=dbw.'Ǧ kOLt^ <]#e'{xp7C|U.Dt+cX_2{%Ru O%ew;_="ҫ3gI$` ^ψ,Z21YגWzw 5{J38'c&G5M{ lV!QE`FU51ʺ׻`ZƽvnHF4#m]J3@VvUy^dD}5wWMyEkf Lo{,8 AwBRr刲dq7~ OD.9ΒyD絝Ӫ=qw:4<֪ FPy9}ZN"vBD5;b}e'q^꽲5wgPűi"UkRSRFyFI$FeDoU;tML<4sA0v<[ay~ em +72 Hƺܿ. UUBvd ]g/ۯ'}%_5ŭM%Bn_5&>k$_1Y#釃yF`\W'v0@Q辑z\1>S&=& '8gT){i^{ b9B5ش>8/iojAѻF}87Jd9ş@21ҡX6!6*KDwy31bG2&. c|!?aj{N.UVĽZn2>rRw0u ߰][~zù]4t(LAj=Đi(_R51KPz:=VZ뙵8&2UT;Qn"yJX|ULkM='Yůdds7YÑ]j8LVB& QM-"rwΧ`h4@P}9b{lu;9v'$ܺKS!wtg Brv&[z vz&r{o7x@3蚇 Qa# ^Igohxl޵m vm\DCDC&dZ3?ՀR%yP{xZ)8 TOEx"iȺf̶2`d3iOV"RDw0GDRGCd*xGq`AW-uS=6x+2(lUy#I`S^tq=6UȨAPV\T@ob7d=5M'}9tN6@cʲmX4\AJ ጯFA Jv^@؅m0A=tRZb'@SԭN/n<䇩dC >{JL} H .ja\?a8LUz:z]œ+))Z+?-V l?,lyd1P ^&&yDAt `f0F ~cZ]&ȥr/CBM71lз +A qC1K  MR5$=$ "-3 Uf:/K&4)7BCFjC7 A|'syَ80aʉU]97pUCknLXLm9dx X56XEW],yOXf`oe%O{2ؚJ*O',[Rfݲ&ximNh\4tQ`Pyl./L@R28Ś=IhQshmӪL\; cQ+lOe tJ65Փ@2c(ER&f sǴ| Y>/:?kCʣ ڢ# << K?.?jȍqޠόwϻK:1R}  {'\|89Ռ_G;Dn2K}d3KhτpB>CO~.69뵝hk?SD1#諔A㛇HO.cyAn/(k+荮 hR E5$/s{Y$ȓi~z<<]d2ArO0AZb Єm*S?V ӍgW~94eMBR*F& 1D~6[7k\}+QNB\Oca<\qݮz1~]™bn 2xOW*Ӽ|PYut{RSmLU-곞&` je; * rr3dTzsae;h~%zfh[ecH򞑍4vQ#웛pNߜmG*=w {89Y6Q?SpcBd B\I9S|Vj?ESz1-eUC] ͘|U'kT{|&+CYgpUtX9 >|T?s9bJg"Bq+dFRLDKN5@]eWM)͆%MQ$ld LcU[Cݞh9xUo#x{+nFC?wxqy/:}܁[AZߜv~%FV6AʿKnbX&EۥX+VR,"SOQ):l F0Yh=2H:X\O&7#J OpSdz-V=K_?!GNZN, >QxXvLV4xEg}U&agI%[7s]YYvŎFn}PNTHIX#]`*sŶ|KlR)Wn.pwEC\ tu{)Τg`+V$&օ_d,V"#ek[AɊ}N?pӁl,Ue5P2J݉ݷ9[C2YBXL{)Gc,pfGFx\)%?eb/InukA6sɞ-WL)a׎e@x1,m]6Ulޛy]bڢ':IR:+2/!64;KĦdgx9vU6+,U8ʸUdN6+ ~S>It'"C#,p;eqeYz-f^dI#,:FȤ>ǃ3I3;BQt=P,>Oᔾ0Ε9D㒏;-sw"OT[A +GNbI܃Sd$4n,TR#v)5uYa>術^/pQH'[=#>bS@#F$ȲRQ.H"T([C, zǿ U&poO[[WRz)Ѽq)`v.&9ǻMfg+iIӈq AgxC!|yk>f#[h`-UlND.^EpՀOr8Xb<:lL8 ?R T=>.`@]I& gTF'`m2ܩyh?}е' v!W/ڇoS4us,ov :rw$@/z>ѯ_2J=KAm 0\rX5+OSka1itvU! w.=߁MY8c ;y9>NŠ_[f0;)l#EW:d*,!tV{0f/Zο=HȘRBѷȌ!cM tܝ=I4owodrkv?E 0svmpy*^ BjCU c.hDXnܽ2(*_w^&Vic" CK4fkSj̢ˌ?,Ϻ,0i4Fq"5Yx~0Na#Liz)Uᒞ95:cTk1gGUuͪ 'MZHk)2J^GfaEw*P0T)N%vP{&=^S)6Š? <)UOŀ( f9.;wanW΀ ^.A#( N{c0d?7Ĝ,`bi ї<=1(379˧¡r)9@aAIR*A/cu6ʓz6I}M,6Xw{/nq<כueELZAs!hRw}lڒk壮dFE3`ϴp2B2Uc:"4 ء\<iߍF/ެ`&b)ߗ91@kW{ y_\ {Z8!qDgN7MԒsTB!ʋ5-vrT6hx}8&J^WlMc l>2^IcrĎEH$Ǿ:才W[P4[g!+줩U`O(Lj|MKõG\\4%Cnj #E7 o 4nJQRi`YpFoR j<%LH |((+CA7e&Th5D`YIL^icACvIz0bmh<"vgy> !Й*Ϥ)gLnd *@JagONd+`JV,(vP~{b of}L;Wf@bqYh8a^dM@mo,GxYH䐷Ϭ/OHSA᪔q̌ _0,en\ jPE A=C*3-6_aU퍭ID&▽ZpثMՅ WOA- EkƋ3*H0ۓrEw( QBC6-Cvվ]r\|ӗ=ΩCt$ @t >DNb Qb~; o(jn_iβ)GKCD)r*7;kYՓb'_C֋ө3. 'Dξ =Pl@X=>hSjۭ㼇@Fg` g*֯՗*'A7ŜP0r;*d ?pRϨ^.\slvacRctm%o<%-+Amˏ򝔶+AX+Rw!R1AAp};gJ^HH%p9WbZOeI"bwjC']'"<LLTpðs|ei^ż]V/ V夜JF~{*V[zp8ю@Y{5|NC~_Y̑ϥ4ej>"hq52iqfȢ: Dħ)2#џHQI\f蜝 'Oyn|,%f, d.oŐD? F0WI`afYF[t85;8K#mfb'W*HZK|&C(6f 16`=33mԞ(IJ}X?ΏqF6}⊅䙌Ż:0ty`#Pc2, Kpk_q'u= VGIˍ eh /MUyi5w9-Wc | }k4(>1Ju>bdn= w 5;nj u)yHI2dp'@)Ee׈42 ^V 95m.߽gՏ4BO[b^8 7/Io[5,Ew e[@1$'(.DM8}\!lU%Y}J/"43gf+zuU9Wc= p`ng/#BljӫmDB`RaHuFEO( '3@((4 _ܽTXB(1]GEAbV~y-/|3sc5~X5D~¸7L zCmb0+qdYL #nʬ22fX=-%JpU偐h+UX:څqzAgʷSrIKAi5Dpkm%_ c.|b%eAsTD=+<}-;\x4b Z^S I6yW*3e-1#< u> /;T]:Ӈa`y;^X D/]:j-nŝf(ZRg**vџ;XL""MgbV%Ѡok .8=ܧf/gs3^;TF)ZSǿ(9Z%*)1`{`ķC9K;~_ުԟI,+3G8Gꋛ*b\Xa)N bukC/=`E"(VpE| $j9X` h9itDnu,D>V"a %_cArnt5GЭ,t )+U=SX6JMOotfـ3T+\.U VU{^rEoEЅQ=Gm0Cc(.@*s<͛{W Ai$.GHaAoȆO#p8v65òUQw5i|m| x'UXw "EH'NcJ!p{i(}~Q| Ϻ :I@ӄ6X61mԎrapML+<7@ڮĐJ!t?D+ԂPrn]a=k/.&isXIP4=2SI (듾Z|G:> wꈷbUXKx"۰sEtoE C+A\Ns *fi9[,f̴pM滜Dǣ#qT NQ|BQp572.bJ*p 'kf?-(;D>/55|2+6m&F f `12l4y4(ɎmXGWYd{.c;69ZNe 6@?#V]-UMMQʅ4=2e_zc@4բ~BG"?mn 4OGYXTJ(8ʨSr!3*jc.T,_ĩpeQ݈ZY=>Gt!'%[`颈u d2٦ďO&BXgVW"!f6|Ϸ`^aH!\ç'GK+lK/%D5cȄFeX_9Q˗?L;2`p9H:h$?=U'2XBiOzi.d=Hrc ;6ZZCJӢ" nO5.ZlyʿUO[Y^0h)ub鰀l W'RJ8RGp $U2kCذ`oPoq}5J77KQ5SPd 5I{ +H ;k>괖a|i@ORhm+,0?7NB u#8,ݔV㚟`%`1͑`0:_/a7ZE)o| "iBnୁJn~75.U6! qlM׵oOJs @} 7`B ,ZOoc@g?bEˈ)fw ~IOgW[ƵѼeӪޞMcZ 4}WVDͫQqZy3ZEE½24$'PN 18P2$FPc1E_Sd>Y]%K X0 4SpM`X>r,΢tcu^g3,H8⡗NVMv4!E\j.0k 搘t38ٴYiKzGySO\.hR Vs هݖ; *u8.)輗BvVlrvTsA]F=-2>K%7\/W ft1eLy_n I*v'iCbk;Ei|d0NL.֔!sfB1ct$?{%>Hl ZSMk#Dا4 Lmh<963B!:(ȒiEkL 5ӣXS uHB[;&$bHx#eGSqbլt24:V19顨 N6&DcK&/o٥EG}50#԰4":;af7K<$ U /M ߘ._A@A@Yn*"J{P)wqe5עPG+36eۧFwB'D'P\ 2߬2 [v/ȥV۟ʹ%(EstI|pp~l'4PX,LW58ToD,~2`SWhFѻeү;eu-zM#"^nqZ1 n?X$iS>M$dDVAgsNk +.3 )[*d?z=W(I RN H{|o DN~fT,р.ӌ% #PeR;oS-d. q_6#n\*f `?)T[M9:3oU2VpU#e</I?GD~FY-h?p h0{--"Mp|AZr |;:j75$'*Ȩ>\?RN̜1x>]97gϖ(,gU:̦';ӴȮxNJn4a$F =3Dꏢg|ˢ^^ڃ#0KB@19XOL? KqF$w_>ef]f&+GK4Ŷ6-mJM_ZÄlaO=*Iu-xA>J435nD8ҿQ!A0M=^7`r*R:nx?3z1oq\/6Q0[x%ī@+1 3t8yx>[z_'4ڣN`N,a~3BB9³Z'=֨ PFMʌV´  ;q&9B)) C1IвِKo>ArL')>TEW8'?!nлՄ>!ƚƲtY'э[kg\fD+X>|h:ɩ[7MU= ֻ!O>]mgIh^#-4ucH xZ$<˅ L{3ImZWp}U\D>.)@4}bMGOoAVG~_FiޖLe $ݠw4 `\A<2a Gņ=I|l>ixA]# %շ;iG[`CbTQel/G.|516P414 0zNCkIl ŐT_M.pt^/-/Pfnib<@NAw` W"tա#`^[i(*Mda՛|IE-?sɲQr]pI&==Sl̩Zd=szL2ӭegҰļ9fX*A`0x+p QcR%1r܁806;z4*"| +2h,a9mgMkB2}|_uy;Dߏa@%TpID|K]/M IДI2_^8 BKCJxni(p8_._&_`oFFawMؼ *oM8 re_%p i(/x{'ڕ_ܟX *]^[V %|' \ WEy(s4GG&(߹>ϔ7{} Cwk%,j J9\GhC)ΓM)2f^!`6v,ވ՚ Zx]5?;OIi^'Xet݄ŚlFoѕu=k"t1k@$۠fhj !>z|FbGظPN$VÛG;'TV *gR@$e@ܖ1%/yn*̀UCƔY6B E@kSO:~r[nQhkD~qY9Q ;_Ң46VdE7.Eݹek i=ڸL{/ZU gq ?YR mڐ(4V0Ѯ_QQړqvްnemTف }u^?ԔLA {3Uf$'&R;V"GUM'.?;͚7i !*Bjf<ۿЂf֞t+,asc&O~F*%PYj J,F|Avπϭ=SE¸(8+M)uYnf[o <%-q~s.ms96#m9z\=.j(LR@٣$}FvTSU*T0Wu)qk& |\Fd Kky&2$Ďq ADTF2`dd ƑKȗ,uI93GJ"{9޻,, i%2VbR0kU8"۸=SjRe:(:ʕc-'T39|eB$)]P/\'Ee%Ao%" ҀC"濼!tBN_BvPTͳ aOv`$}`$p18NqE|aBÞiS Ii uj $Oȳ咽F!Ce{R UK]6 /v%+ ؖ:w7!+azT3FC"%($hcVXšvܗ8@CSz TΥq a;>UKmlz_{IFF 9AcYS7iᅴpXG>Mejޔm1 dlb:*ȩo&4]aE UzRӚz67 h1V }K+BKTO |FD˹P\B~h\E㦆~mPP].R~:[o[Z} O=b4p_=t.Ƙ&`ݘ4еp`&jָGr}*I' +A)j]x)+Z[eA 0!lKucϢ]n 0M9<݀HaQ/bdVM"\p|l60Df LIc ti ;_<N)Ud+T7|Fa-){?>' BS77/*0k}Ml෶ YZ