pki-kra-9.0.11-1.fc15$>DڅHGqMDL>?Q?Pd   C #>\bi m  87 7  7  7  7 7  777,7 h_(89:">E ?E@EGE$7HF7IF7XGYG\G87]H7^JbLdLlLtL7uM7vN` wO,7xP7yPPePfPCpki-kra9.0.111.fc15Certificate System - Data Recovery ManagerCertificate System (CS) is an enterprise software system designed to manage enterprise Public Key Infrastructure (PKI) deployments. The Data Recovery Manager (DRM) is an optional PKI subsystem that can act as a Key Recovery Authority (KRA). When configured in conjunction with the Certificate Authority (CA), the DRM stores private encryption keys as part of the certificate enrollment process. The key archival mechanism is triggered when a user enrolls in the PKI and creates the certificate request. Using the Certificate Request Message Format (CRMF) request format, a request is generated for the user's private encryption key. This key is then stored in the DRM which is configured to store keys in an encrypted format that can only be decrypted by several agents requesting the key at one time, providing for protection of the public encryption keys for the users in the PKI deployment. Note that the DRM archives encryption keys; it does NOT archive signing keys, since such archival would undermine non-repudiation properties of signing keys. For deployment purposes, a DRM requires the following components from the PKI Core package: * pki-setup * pki-native-tools * pki-util * pki-java-tools * pki-common * pki-selinux and can also make use of the following optional components from the PKI Core package: * pki-util-javadoc * pki-java-tools-javadoc * pki-common-javadoc * pki-silent Additionally, Certificate System requires ONE AND ONLY ONE of the following "Mutually-Exclusive" PKI Theme packages: * dogtag-pki-theme (Dogtag Certificate System deployments) * redhat-pki-theme (Red Hat Certificate System deployments)Ojx86-14.phx2.fedoraproject.org(Fedora ProjectFedora ProjectGPLv2Fedora ProjectSystem Environment/Daemonshttp://pki.fedoraproject.org/linuxnoarch# This adds the proper /etc/rc*.d links for the script /sbin/chkconfig --add pki-krad || : ( if [ -d /etc/sysconfig/pki/%i ]; then for F in `find /etc/sysconfig/pki/kra -type f`; do instance=`basename $F` if [ -f /etc/sysconfig/$instance ]; then sed -i -e 's/catalina.out/tomcat-initd.log/' /etc/sysconfig/$instance fi done fi )if [ $1 = 0 ] ; then /sbin/service pki-krad stop >/dev/null 2>&1 /sbin/chkconfig --del pki-krad || : fiif [ "$1" -ge "1" ] ; then /sbin/service pki-krad condrestart >/dev/null 2>&1 || : fi=mW~Q"JF[ o6  aRNS0T#}|`Fu}J\. gH(6큤A큤AA큤A큤AAA큤AA큤AAO^p]OjOjO^p]OjOjOjOjOjO^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]Oi8O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]O^p]OjO^p]OjOjOjO^p]O^p]OjOjO^p]O^p]OjOj34801ad2a784c73d7e9b81146672998227bd3bae8e31848f69aa270660d2f695a4d8166479f4a4843594045564070baa203c8345354610809a3a07ce22df2c9cd6bf5823021651d1cb53350adcf4bb818ac77768f5cbc43898ad06af1036b00edee52c96701e0c86be067193d25ab8c53b7d22c0750f925e2ec08e88976ec7fc15e24f33fc9f802d8941a948f116281ee211714353691da5eb43aa7c1e6d46fccbf8fb1e245a8c5c74bec4e0637279603e88a0ec4a1e6233496697544a239f35be8c77ce6524f8ba353420fbc0d2671fe4a708fe24b1cb3d69d68e9b551bbdd0e5007779fca32384e3d66b229c7e3f57257c0d44489543a11c69ebf559806c8c7d143f224693e217d6d85ccd03ab86b2a7ef0833d94303b66f3084d9bc24a92ac04ac1a4502a64b07a6d28b4c8f7c2cb3c1ef92d90fd33913bee71bd80db59dd8803ad8da05a538bf8851b52c3128a3f61077ae065cad47ae6fb277240893f9778a9ac098ede2153652b6dd086c0ff35fba88af612ffb07f032d3cf0d978cb3527ed767345475519c0b68cc96bd20f23cb2045c3829dcc72c67a4f1a133a7d155ec67643ebfdcec431c7d61966510fefc3e691ff14a09438257c5c23fe66d54bb14050386b6df46fef8e6214e41579d09c780d19d242741f29c2809ef973cefeb760a2dee6aef9a244f84690b0e80d22f419f277d615a90b129483aa669128f68c20c6a9881beb5076c205b18c5872880ba55b11e3d30337994d569a1505cd97c954891f422c57d9819265cb1cb0f9202479c0393f42b95de54c23897093aceb63194d865777ccfadbb81f25da44489ea9ec2c20ee8298d1874110df171da793767d3c20dc56e7c6f0ba342130b0160dd473330845cc80f17f5ea872d0fd50316d2fef5cea0ed6eb7496dce59508cfc322ea1cae9786b9347cde8ae760bc2ac0c146c089e0bd4179fbd3d3ad29e45a57941b46b941b8e97143c0460a191980bcbedeec9245eff367fa10240ed3175b367da06966da673aedbae63fc5164402f4448b089c45226bb2cf6dad3cdf581c3af18a90d6b911ccb66c7b2179a7a75fd151b32f677b62aeab6fbf96f30ae98190f13cb97517a2bc6b3910293c943376820ae22537d671545fae6d0307e0da6527bd2e23586237f3e8fcb6f72671124cb4bca75eac7d894fd5cd1ea75a0ed89170c0d4d1580016ef8436ecf4e619543752303a3f673928e2839845976001deaec22af953bacd3b72fe5c49443a185a898cc277158a57cc5a4c98ccea71bd7c900bd2a8b69b1037c6dcd9464d8ee2807539a932782a1ddca46316c42c1b5ae86304b5dba83ff56f204b42c31953f799f5ba26d1e3ccc9375d6256e77b91817081f349ed0b5115ce58d43c2720c3473e5e44ed889e79e21c1cd06a48cc08e784c16ad614193f2938f24e91f518b4d7f6a2c042ce5c908bf1b25bbb3da2ddfd29ed4c7d3aeb02c7866752dfbb6af4ff6a42d50ad77ea756fee60f470c24f10e3a47ec403e8120a4ef0ab957cd292fda6905e6e1f16dfc4891efbc5f8b12d38381041f75aeef95dda09a3c728bac964a8660a1bdde4c0aefb36f1162726bb551a958e9ff0de0333133702e0312e1bbe8c64c60f940b149f3278ebe2f7040e9224cb5d49ad2e896b807877864ae209975fdba39fe55d9dabe5730b830109f5d6bad9227eea0387e9b425cbdf52e9aecb5044ddfb14b4c230a7bbf75f75f7b8383bff05b43bebc00c35f224b5364958dec3705b8272612c2005dcad021f513cc99590d3eddcbd0943208feb340699371199f997cbdc94d667eb164fe14473fddcf73e6d94a900625a8b34413c3644876fa6cde88258a39db3e4dd0722b0cface2329a949212a06bdad9b842340c30281b1b3bec7db09f355a99388cd15ab51ec7f1bd09a95e00c18326725b52b7a522ca2fa6fdepki-kra-9.0.11.jarrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootpki-kra-9.0.11-1.fc15.src.rpmconfig(pki-kra)pki-kra@      /bin/bash/bin/sh/bin/sh/bin/shchkconfigchkconfigconfig(pki-kra)initscriptsinitscriptsinitscriptsjavapki-commonpki-kra-themepki-selinuxrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)9.0.11-1.fc151:1.6.09.0.03.0.4-14.6.0-14.0-15.2-14.9.1.2Oc+@OYODN@N{#@Nm@Nf @NS@N@MMML8LYV@KՀ@K[KzKoKPXKG@K&(JAde Lee 9.0.11-1Matthew Harmsen 9.0.10-1Matthew Harmsen 9.0.9-2Matthew Harmsen 9.0.9-1Matthew Harmsen 9.0.8-1Matthew Harmsen 9.0.7-1Ade Lee 9.0.6-1Ade Lee 9.0.5-1Matthew Harmsen 9.0.4-1Matthew Harmsen 9.0.3-1Matthew Harmsen 9.0.2-1Matthew Harmsen 9.0.1-1Matthew Harmsen 9.0.0-1Matthew Harmsen 1.3.4-1Ade Lee 1.3.3-1Christina Fu 1.3.2-1Matthew Harmsen 1.3.1-2Matthew Harmsen 1.3.1-1Kevin Wright 1.3.0-4Matthew Harmsen 1.3.0-3Kevin Wright 1.3.0-2Ade Lee 1.3.0-1- BZ 802396 - Change location of TOMCAT_LOG to match tomcat6 changes- Bugzilla Bug #796006 - Get DOGTAG_9_BRANCH GIT repository in-sync with DOGTAG_9_BRANCH SVN repository . . . - Bugzilla Bug #787806 - RSA should be default selection for transport key till "ECC phase 4" is implemented- Add '-DSYSTEMD_LIB_INSTALL_DIR' override flag to 'cmake' to address changes in fundamental path structure in Fedora 17- Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping unwrapping keys should be done in the token (cfu) - Bugzilla Bug #744797 - KRA key recovery (retrieve pkcs#12) fails after the in-place upgrade( CS 8.0->8.1) (cfu) - Bugzilla Bug #749945 - Installation error reported during CA, DRM, OCSP, and TKS package installation . . . (mharmsen)- Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . (mharmsen) - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu)- Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - Bugzilla Bug #699809 - Convert CS to use systemd (alee)- Bugzilla Bug #699809 - Convert CS to use systemd (alee)- Bugzilla Bug #712931 - CS requires too many ports to be open in the FW- Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser (jdennis) - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems (mharmsen) - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. (jmagne) - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs for modify/add (alee) - Bugzilla Bug #714068 - KRA: remove monitor servlet from kra (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - Updated release of 'jss'- Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems- Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta) - Bugzilla Bug #683581 - CA configuration with ECC(Default EC curve-nistp521) CA fails with 'signing operation failed' - Bugzilla Bug #684381 - CS.cfg specifies incorrect type of comments - Require "jss >= 4.2.6-15" as a build and runtime requirement- Bugzilla Bug #688763 - Rebase updated Dogtag Packages for Fedora 15 (alpha) - Bugzilla Bug #673638 - Installation within IPA hangs- Updated Dogtag 1.3.x --> Dogtag 2.0.0 --> Dogtag 9.0.0 - Bugzilla Bug #620925 - CC: auditor needs to be able to download audit logs in the java subsystems - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #583823 - CC: Auditing issues found as result of CC - interface review - Bugzilla Bug #607380 - CC: Make sure Java Console can configure all security relevant config items - Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be generated on TKS instead of TPS. - Bugzilla Bug #630121 - OCSP responder lacking option to delete or disable a CA that it serves - Bugzilla Bug #504061 - ECC: unable to install subsystems - phase 1 - Bugzilla Bug #637330 - CC feature: Key Management - provide signature verification functions (JAVA subsystems) - Bugzilla Bug #223313 - should do random generated IV param for symmetric keys - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #631179 - Administrator is not allowed to remove ocsp signing certificate using console - Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection of signature algorithm; and for ECC curves - Bugzilla Bug #451874 - RFE - Java console - Certificate Wizard missing e.c. support - Bugzilla Bug #529945 - (Instructions and sample only) CS 8.0 GA release -- DRM and TKS do not seem to have CRL checking enabled - Bugzilla Bug #609641 - CC: need procedure (and possibly tools) to help correctly set up CC environment - Bugzilla Bug #651916 - kra and ocsp are using incorrect ports to talk to CA and complete configuration in DonePanel - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets as expected - Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for validity - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #499494 - change CA defaults to SHA2 - Bugzilla Bug #649343 - Publishing queue should recover from CA crash. - Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and pkiCA, obsolete 2252 and 2256 - Bugzilla Bug #223346 - Two conflicting ACL list definitions in source repository - Bugzilla Bug #663546 - Disable the functionalities that are not exposed in the console - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added - Bugzilla Bug #668100 - DRM storage cert has OCSP signing extended key usage - Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time interface is no longer available through console - Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory During CRL Generation- Bugzilla Bug #608086 - CC: CA, OCSP, and DRM need to add more audit calls - Bugzilla Bug #527593 - More robust signature digest alg, like SHA256 instead of SHA1 for ECC - Bugzilla Bug #528236 - rhcs80 web conf wizard - cannot specify CA signing algorithm - Bugzilla Bug #533510 - tps exception, cannot start when signed audit true - Bugzilla Bug #529280 - TPS returns HTTP data without ending in 0rn per RFC 2616 - Bugzilla Bug #498299 - Should not be able to change the status manually on a token marked as permanently lost or destroyed - Bugzilla Bug #554892 - configurable frequency signed audit - Bugzilla Bug #500700 - tps log rotation - Bugzilla Bug #562893 - tps shutdown if audit logs full - Bugzilla Bug #557346 - Name Constraints Extension cant be marked critical - Bugzilla Bug #556152 - ACL changes to CA and OCSP - Bugzilla Bug #556167 - ACL changes to CA and OCSP - Bugzilla Bug #581004 - add more audit logging to the TPS - Bugzilla Bug #566517 - CC: Add client auth to OCSP publishing, and move to a client-auth port - Bugzilla Bug #565842 - Clone config throws errors - fix key_algorithm - Bugzilla Bug #581017 - enabling log signing from tps ui pages causes tps crash - Bugzilla Bug #581004 - add more audit logs - Bugzilla Bug #595871 - CC: TKS needed audit message changes - Bugzilla Bug #598752 - Common Criteria: TKS ACL analysis result. - Bugzilla Bug #598666 - Common Criteria: incorrect ACLs for signedAudit - Bugzilla Bug #504905 - Smart card renewal should load old encryption cert on the token. - Bugzilla Bug #499292 - TPS - Enrollments where keys are recovered need to do both GenerateNewKey and RecoverLast operation for encryption key. - Bugzilla Bug #498299 - fix case where no transitions available - Bugzilla Bug #595391 - session domain table to be moved to ldap - Bugzilla Bug #598643 - Common Criteria: incorrect ACLs (non-existing groups) - Bugzilla Bug #472597 - Disable policy code,UI - Bugzilla Bug #504359 - pkiconsole - Administrator Group's Description References Fedora - Bugzilla Bug #672111 - CC doc: certServer.usrgrp.administration missing information - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package - Bugzilla Bug #656662 - Please Update Spec File to use 'ghost' on files in /var/run and /var/lock - Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI subsystem instances- Bugzilla Bug 584917- Can not access CA Configuration Web UI after CA installation- Bugzilla Bug #522343 Add asynchronous key recovery mode- Bugzilla Bug #566059 - Add 'pki-console' as a runtime dependency for CA, KRA, OCSP, and TKS . . .- Bugzilla Bug #562986 - Supply convenience symlink(s) for backwards compatibility (rename jar files as appropriate)- Removed BuildRequires: dogtag-pki-kra-ui- Corrected "|| :" scriptlet logic (see Bugzilla Bug #475895) - Bugzilla Bug #553072 - Apply "registry" logic to pki-kra . . . - Bugzilla Bug #553842 - New Package for Dogtag PKI: pki-kra- Removed 'with exceptions' from License- Bugzilla Bug #X - Packaging for Fedora Dogtag/bin/sh/bin/sh/bin/sh                                                       RVX`mjdrZ_[xbavwngefitukp]Yshcyl^o\q{|}~9.0.11-1.fc159.0.11-1.fc15 pki-kradpki-kra.confpki-kra-9.0.11LICENSEpki-kra-9.0.11.jarpki-kra.jarkraconfCS.cfgacl.ldifcatalina.policycatalina.propertiescontext.xmldatabase.ldifdb.ldifindex.ldifjk2.manifestjk2.propertiesjkconf.ant.xmljkconfig.manifestlogging.propertiesmanager.ldifschema.ldifserver-minimal.xmlserver.xmlserverCert.profileserverCertNick.confshm.manifeststorageCert.profilesubsystemCert.profiletomcat-jk2.manifesttomcat-users.xmltomcat6.conftransportCert.profileuriworkermap.propertiesvlv.ldifvlvtasks.ldifweb.xmlworkers.propertiesworkers.properties.minimalworkers2.propertiesworkers2.properties.minimalsetupregistry_instancewebappsROOTWEB-INFweb.xmlindex.jspkraWEB-INFvelocity.propertiesweb.xmlkrakra/etc/rc.d/init.d//etc/tmpfiles.d//usr/share/doc//usr/share/doc/pki-kra-9.0.11//usr/share/java/pki//usr/share/pki//usr/share/pki/kra//usr/share/pki/kra/conf//usr/share/pki/kra/setup//usr/share/pki/kra/webapps//usr/share/pki/kra/webapps/ROOT//usr/share/pki/kra/webapps/ROOT/WEB-INF//usr/share/pki/kra/webapps/kra//usr/share/pki/kra/webapps/kra/WEB-INF//var/lock/pki//var/run/pki/-O2drpmnoarch-redhat-linux-gnuASCII textASCII text, with very long linesBourne-Again shell script, ASCII text executableXML document textXML document textdirectoryempty (Zip archive data)exported SGML document, ASCII textRxz2?7zXZ !PH6of=]"k%]zڗ.6ֱRN1@=h{0%&SzoګT knJը4CjD=7%ZLɍk*Emɡ{(Z;%\dRscReFs~M2TbUDQK{{Oafqfʠܫ:ďӆ'H*s{n'I/u<<|#h}/śL :R 8TD?|G%x'|ehv*v ,f 8W9D15мPl+]dq f΂W1.4DR*>C[7L&hAw7ZuwO̙NZ%j] Z&&5Вkf,>+3II[ *yC L넩w"Ј+yVDnMA0hw5[|N=%G%׍i0Z$F#r6=}]_s5ReJ%a_uoTOS5ۍNVh#J6{9FRyVMHybtM|uгįL뷨IߺNZD|<O1q ՜I$&vfHN V\UbȘT ʀibV)='j"Ou~Շ8~??&f\kAs_V>#T~]p;3$_Vx`N:GB3?d)4ܵ ia9(Ӿ<ڳ$^ܞTr_RʛlT_(p=ЯW 6It~s\e}^8ͧH$4:l qڃ7I~-T_;yyL8$e7*}h⬏t>cD] N:^u!oȌ%,G~qKmJ l|+s|{3~XC)E8xx3IP-XFj7-4H1w3M'fk8ګ:$h'&!4ۖ%& yS=UK b=%ݪ33@ȗ9%K%cּZh2l0/?RO~b"PN'0wrNvmδ{J?qwA"NbpN 3o~s[_yagh:|{)^!~-P*4:ka\ !7g)[V/ c@$;`Vr놞L%Ռ( {Q`\f(m<_feW+Vñ^No`Q8WZӐ|9&N48ߊ#GN_U?ny|?m` M=;HQ+gxAjYEg7bxl죑% l1BL H\h8ToczhG'kV^;+17G_8';?8²HH4Ic*-bI? RF'@sG2ͳU!u򟸜qE2eJ*<8$TxVa&X[b4 xÿ3EvDoc~ucp!Hoo k=V"vwA{X7# 6\wJ:$:f͙3>W9MP=OMv!SlPʼHqAhQ8SȈam_ G`:XdmM U#'̝[3+A"ߠW(WjD Bf \=% 8fX* b[wH[}@y=M4C꠳qaILa'E dg 9836e^$G ۾hG}ZM6xtQ$*ڋF< Vy~q[VëGCV%>EdB}fF1s& ݔΑ* ^iniS9sj3e]ާZ SNw Მa\g& 39bQKwc;DέhI8ywM|B c:!;-3ٗ5s"SB:p?qrE|⥿W䲹 `ӴV A%Geyum+۰'W*fdp1CrNjջ ,Yjce TE~+[-uu`yG0Ql.ȪCU q{إQ-]rj>I5$8 "q4QgZ؝ZM7tsۘP76XyTQ`m6C%%\&qtqn,Wi0G+}9A<4/m.yehIR[Wa)&Օɺ 3o7O`IA6y!f=_Rh!I'mKy7>BZd*vi=~܃,9ڏU/h p%-qYE3ʴh,Tbd] rp/2!e5) Id$]JLe0:YΑ&ߔHbwB%*ӳp*.g~\7%mj:T9Aɩ>[1ٓfbg{w¢_*eҋ&Ȓں?Pje5y=FA8x/tnym\84v AH89>@iT.~F#a?QQ~h:&(;v4&m`d~2mD}΍v1ԲbjU B}yceߋ,L@ Xܧ=PA{ME2 g^xZ}H+RCMVPP]&~Sd&qd7SF}&@c"&֋ʴeOkxnBL!xS1E[ť qZiEȳܪ>Yz{SS#?@"AJY5ʖ:f,L8[Ƃ}٠`FlUFuVy(uV nŧ4+Ls\TF.'nPjW`G'HZ@].>+\|el65F4fK_:LC}Ň0M햿+D &-c YٖEAN.̾|:Gooս1_UfHy/hrKh,ҿ[+ݑH[H.,bR 䞿q#Z0彙2YDN?Ѧl2`ddk-B4L _IuRz`7f?^?۬u8ۅS%ԥ*cQUYhPs1ګҹen룷 Ie  PQaWM &e(=U6(5F>(-k0T@@Xs.vBA3q ;Xp¹K <_ۨaP2PgRQI`upIPfO :˝]TwMKx֥BRZ./TbőQ6N0fu z0]$ m]1훳 m2D9c׉EC!ǓYQLzv!sb ZD$p)C>pƮRN8H5XaS.yfLlC׬<ܔ0ݳTB!W?eEX  p_v橡vBx3 TgYAUC +qM lTh@_<6x5>'ƌz{V*95i=%(4Ր$!H2 nyֶ3ծS~X5 Uuqk;gcb>~/A'k`CS})QVlf.fហ$V_aЎ[M־Z I+od$ +o`GfC=㷖t"Qmԝe03OTE q;4nf,1 >Fڵj9(oDAo Ar ԷYS iW/Կ 5V..솸 &SZו܅l)&Sakh]qVVW}_+LȃG,J~ V\6⪽-if/K0q鯦c%xYzk ]e#0e\ͷYM%|Vnwhh)<"a`.wsf [K>*Gas+2כg^LS%?H77(3.}Lh;ĜoƫJPlr`\Zl&vdLE‚Ȩ϶0¸8Bv<ÿS瀍/J<ڍM`坣E4,?u'1;m,PӲW 'Y~j1SG4~J'Hf?HW5%~O\D(_c'6:r|qs uD#M}ImHM>R||͉ChMJGPfmQS*M/*SCb^(ԦybˈTF5.vm+F /Q|\ rCNN/JB(UM§b!Y8435RvTFY;b$57,\-D5'|XҊSY׭2}]_})<[!ycO qh%v[RAG/^K0M 0Sɖl~o0u]ي-xZu[iiӼdaz).)h>j֙^)Rc)]uO) u7욀Ը/QFR"L|0OSZz`Ib^k!]THȓw9zLc[7Eք`NdIeC_@h?L=9ÁTN(NC*N$yc<7]39%&dlXx^CͰ՗)#! $̷Hak&3ao b ĭwDF;}+,wk o4h(`u':U8(S;||;#rcއgmz \ٮ-^DBa|_e˘Chk (+V觫3 e 5^A$]i -B+siܢ!6^>vՄ{,">wлzrbܠcbR&8-/Үт#׀:0rs. .' iP_=G$RRs+)cޘ8FIݿ^6 \p'KAf)VGidiڛZ aEqꖮmJMUT74g~z_ԩaSQKb~$•)fB$ՈĚM74TC$lTTQz8/7xQq`TEئ#RDh5hZz!DGU{*f|eL!5OʾVp>TU3 1EF=hV0l:.v)o F'4 Uَf[+uW,"նR4S.Ujm y,"9^~_.g:r9 ZaGNKݒO\f`O09!cbu}y Ft(jWIPqQLPs`ݘYVLs5@qe1b9;8szxƭ2~A D ~FT pu8SgIgbu^{!kKKuv|fbkqj$3Ѫ6C3{ ѫ 3Q%v4Km2.Vtr^gx-cK|TxkTƁf<.Vǃ( IE"Wt,<=5Qn?Nzq*Uey"12|]<Ym,Xĵo8Q"oBu;pW[GYk<%i b| \Qj/2ssh Dº+Uy% w}SKI.|;A6 CԳsGRb, ]~**~f?]L&f"ϪM(,ģn*e6JnveX 9O\L;pBP kf/c +V?>6)B,~_!&m&YTE]'W6'L2;{=\=+?+ApIhkL% u#8 ?zFx 9ٵr6{r[Tܟ"㮐/j0 1_Hأ"Ii.I ] ?e󠑧tِUq?+ +J4ѴojC4!L}E|QX2 լm.:J$XZe)H0}\jY8-aPjpʉ&>2nKq"1'%H1`h9$rzET>7Y޿N>4pĦ6VJ3`\q$uK#d*WMD$A9>X6#"Pr ոlk)hxxy#k~1ts( J}xv"o%s,G,`:QTM4~. sfد^oPZ6n=D?ĥNڢ87rdAAa̾شT2CEsH.]ޱ84fgQ~Bq"N}2ҿRƅ@r%}n hURWc1cvUƇ{@m *߾D!d۔ߓe`T:o@b/v r2|.S$oֵBwڂm˰-nfc)<͝yy S*ǜy"??XEX$߹2’*-K,,|--Ecqkga˜Q|׵_C]sYMǖӿ͚L6%ii-G0(!} ɫG\˓ĴH0zx&"@$R߲㉅{Jg5Qs ik OJN+C0WmN$, 8Y>~ i+R8XZ} 4iBay8Ύ<#-ܡ]3,mP*_+Q{rE! D}ķꀻ:6smM'I!OL XY2)~3e?F~&qFMH4#k&g0 JKPEro C0kSs%bh`_!1(GNS;ݤf=fTuS'91i;f*B QCCUHS]necd휍Ɖ)5b>|@Vgvr/Wک|~xORcDBͭ Vo*8~)L5;aNJWDVY0jhuӔFϤ"'62ڗc!eyI:g㔑[KJ/ Q~@ϔbO0[`Yΰ 8aL?og \ o`ZR*: {JA9hź#/ޙϝW h2ky868c:# ǠF?q-gx~5-vJ<1ϔv ‚oc~uIF=sioAM2֋ÅKxw^zp37$* lZtnP7Ypv2ljD8VU;bQ_\tPU?cIv>k\|fԫT4&)$Z1ZTWک ֭_tbHJm7Qf}B?R'޾VxT-2yiJ伜J+mRw˯- EKC0h>@Δr 3koc"ti d$6f{1 ؘN8na7PH48\NkMX]W}7WqNI@_ߪ ruu{T}w/Vbɒ`U-Tn<"1,iMTR%Q9h%qy!gbtQ"mM3; 9a!= Am2$'.QWՏ by'ΗnvX-7[F!qhrA/Ŀmֿ25D&C250niUe\ e0ϸf18k hpA-h::D$0) 0>&a:̆,646j2sI#rCjuH*Vc^K5+s~˚'!NXwjONwH6*zW, cvzē>.sb)ҿڜ-R J_3śH,8,|O;]ca?+P$dCNywmP:@!=8CRԶaC8h &*mD۟dUqp)!Mo5G|?!|hKVp7&XY} I% iQST5S+?"졯Z_vU(ހ'ZA=4[\sB8cl,m~Ƭqց+Z0~xb =#;AE~OU/еMhrb3(=cl%g釢\)"kK4뎥8+Kr.s˭kE8 2ڴJ-I?);j7kxU3, +ݥ=%`kMh>'t/e$m8)<}U0+h~b-KB!nԽ &j7)Lр>#'Ė劘i3옚)Ce!fN+4\vhCXy*gbOV:nmnʸ81twXn4qpCg>0"xq~\{X:Wxcv=a̺7ư|H((+ߐt괒 sxuYPBz),kP0L%|5FTo702e 57f$'l5sᤕoY]}sjg)~Y菦pܐ72``U H]Ș~;T,rPB5ǖWEK3eIh__}ES`:̪ oK]! Z6LFWrƙ*A+ca˴!6>2hWGɒhEo2PF .3cjy'8a?#ٸ] k4>~_.0 % UȦ?ٰS˷95.z >!F:/V+A!uRXjɶ 0eMJ.>t5YNbZMmDՎ7%y-ә϶y/䱯 3McUAz=Y+'CO'37zξ¸rFc򚉰#BY 8߉V-F1a4ބ@c 5z5nP!^g:h$篚C˳=klc#[ d:@-yϠ2nZ 32zyeQ)WVר_CS5>p eOCݢ,)tːdPn۷`,@%KD&oX#0ˎs5i-ӌ>~AtM포2|WR]87jxp "a ϣ#no @zEQ0(_RAg:jb4_<­}BoJāf+ҝ8g/IDpc\ Y?{kKnHm BYwf%]MF抄)fH֯|8=5f\yp&%R6wO鳚$??d\ßLFqKj!mG jKEu'HQTԧȬ)Φ{/fcP;6uyGzW8=JӞZ_Gj%˘ti"Lf.d;;kLҴv-r*{şEWQQ|DçG `_ 0/Ca%>#_^[k{NqSƀ\!/ ֋v9Oc^iI`9.}l,'jkЙ%MLKp?gEӃ%?Ph)MU2ŔTU5a:"'f)a K+02\xO~/ckR|PYK[V)dļDKF+B 0kfݼ.sy%Zu`=RʻFM`CWnQEb(KN2N@z-٩IJ~Z `pZzXYrRsBըCu`yR("ސG% u8BN' <#got:E-G1)`:y)O{Zu*rL5h+1'Ck4B:--Pȴ( #H,bN\l7^zL; *;Y::g?ΐHETy_e1[!lʹ %S[ -[ c"uo@8  Ry 9z{ B9Jh 򫶡/ĠDgKː4@zd/8N+gּԧӧe_s"Ify3֐G2Rs[Bǫ4oMi<~٪ߘMj:l2G;_*mT W2)A /۝UjG/(t[_ͅUC/ûAMi?jPL¦2%5-r(v!N`),GΦyO2h NրQON -R|eH|/$@[&BsXɬ=Se ً]+UySF3 $eˎF2051\. :v DžSJөPɐ@YskHeזe&GFs={*`k =E&Ƣ(Ba q,]SDZ''\ #$)k6L/RdH2w0ɮSw%͖͗&$FT$D3Xjm}Z(Շҗ)˵QY݀q5n!S% ;tܢ?%w ~.kY$.c(v+y,I& E?(_o)/,j oL E,ן#\t@3LpژWk3Z~;MĂElQԸ@vV*TcHf_f>QSҜ^[j  P݌}ؿLjn.2͌&ڄ'KL٢X<=XtHhKaBs0QE κ ԗ$][uk$Y|C?l쟥=P zaN W_Q!E/A25~61,ݱDZiw} TBc9 j6p,n6xJ`uB.ֻ^{x aCT qCYBnyM?C+Dr*E`|iտ[d?i<ˍ=g0^̗3q~ j1 ]K^V]g=B-EA<=z>^Mbz1}H ]0Z&ꞆScr [VN ;$9*q %D{CDo(u@rTgyvS**t$Y!^Ao_Y-F V\Q(i5Y96I4&i/"? 癡}saҧ!f" B~5W+jq{\/l~ %#=# Kl\ˮ&{1O(D}Q `$3ľl/ϙ24,RU0qFs.;;H@Eb團^ _Z"o4B+91gl.s>b n"0M2.XyѨmRi-/prP:!g?Y&Uo]äcpUدs@M#pr"KT:jOɂ?_{m}M/`"dyFiʂɨ8Dέs#vJY̘#{RZY99],FebK9Fy[//&_Nc48҅'F/[o}>q="Q[-i=Duq_ىx0E+SZ'dJ {v^}h"?(Xx  xCg-VU] Iܓ)%f*[*vY8nTE;:qb 7'# QŔ4*XBk z8зMς8k;^(ea"XDnۀeD]䏕6lmcLSp[rU_!(K `N)ƷW;^%*$.Y L_`-mԊG'&We~^"~T2%G7}C&_~~uI(U %ic 2(_6c/HV<6 w3Vp8i!ٵZ##4iG#̄R = .zn/a"p<`['+|ȡU-"oxH/BNyx߬O~i``$*%dž[snP:jEfz+R& VKP,'\>ye7cjEmXuDozHWy'ֶzG#񆂩jG[IلsTJ%_ƓoH;S{;d<efpmC(:bس\}w}̹ab)oIq3,Q.6!]0p 5nn[WC|thC4gE.zG\$"F ~drp.( 2D`F3龠.qz{rl ܏C"Odb&c C;q Z oYB 6|A:K IlҕkŰRIcw>9לnɉj)qRA1~[amJ508H4>iS")ф,sd~1 1It;1śaF_$5Δ~A=%-G-=;3̺}iйg{ߘ3=t QoL]B]~EV9+E4@Bݩ`tK0=ߡnv 2 NOO=U_֪(UڎMzRV2c'd2Nq|=Msa ~3lL)Ѹ$}$9PL`xٺ9?N8- 6Og9FOiD# m?" 8q%T 2\x+eI!*` =yi5&}jmժ;I{=5J {sVd3_8^T9+5MP8N4痝yN9Nm3bW2ko@˦酝yHB! 'n` Ob$񓢅aҁ<|6t R]AmqN@ڔg&9 :Uԋ!]m6':fBd/dkt!K(0VcSy~oԳ_kI{"'1abT di@"P!!VuW NHWBњ,.{@A,/aJ+:s>4L KW8,m|m3Auxƌ4O2?"C{.'IJ:[ۦg|:cK"2XrÚM Yw!W'-ILjփ:GD_xҹɚ1(`U@3q0vE:0ǗtuB)*K8gqTJ4blVÞɑkΓ56ÏLzR)roYCp(M4903-%*04 kGLdy)g`1!V /llOC/3rU1x\m!#q=+UNehq, AQcbuI&̸? BV v=~~UU!@Y˰Fx~*Cn_X>b}yguxSJjo(E߇<^iXޚ8UG(׍󯡅@!Y[gW_V0̀1R^7aEvWjJd:v@Ug|m[[:|.n>(=gI pvE4 wVC>Ӝ:h.lؓE]K?P/;זvп3FaM6vi܃/2x&g).z|5J /9잏wBMlCOƍs; HrQqMΆK_dP=>A)罔Ăd F>"k7Vy|DÔT'(4; :-|o,z%/^(0Kѿ9I$W \:Ҷf|Lz}P?-Nc@}vZK3θ:kBl&SFCO,oǬ Hm@;/!*R& (&%0F9hq3*o-6!_poJ odQ ΛJzKif-)R`y"_}T^`lm2.I-V^.UxJY!,WYYwٞ'D4u@ sҀה4NwXPqTM_){2r]cyb@S?Æ~T✉DOBM-yF} <=\g-C+`2~jRa"!Xc5JO2lwt5 b%N/7ZXϱEJI&SgFo{=I7=0 F+fNJ3Gtp)zXiwL= *]Oal`nԤ#0{Gd_TJޑCsYƣ qgqrukۄG\p{ܵ4Ӧ-R_xmbA䀣C,Gد6@9r~螯xkj𰳼W =үU6_y0_kJe7>-QFL:`@}yO^<ȳS'Tw\YCyd*$]&9onmiT33jQENMfVuwۥax\ڻB_BjPC@˜X9,KLC0y?' ^:`},ez͗d+O5p;~Q G 3q~B#"O_<]ʆkEal|p,1Jne>ϢQWmW7~iū<~8i) R+R'JOXz'Ao&B4L/Pp- |+Hlhvy08dz+;_mY6F"J.rB{aP2Op@9{T۬c 5Fo;Id~Y^_;iqYd5"S ;r+Jlpru6w'ʑ c" bAybON!:;86B MӜcX'ƛvҠ5eWCa =dXLLI|D{5I,̖;W!]y(rܚ6&@\Lt开.i/G^rft(&)swX`  G$#8Ua 0uT(I?\~:zXm EeM92h22 CEI`T9@bJv )JSBE}5N#Ճ`aCmj0~5'7a:?s)`f鶱1 6ȍe2*5Ds?wZnda!}kMUU&m;Aiҭ#Ч]쎑i8qa(fB)oz9A~l# 4 :ȑ>Q (e=aJ)7H+pJK]][O|deyaO#qvLv  YZ