container-selinux-2:2.130.0-1.module+el8.5.0+770+e2f49861 > 6 6_6 3!pQp)Tξ7]mtZ`bh) ]mtZ`F46 `Hax囚94Hg5n$Cѫt_siiŜ"[ͯDxscd#`Ozȣ*jSOTi`znGO. Rzlk%.ܬ+=+פ:/8~ kQ't4D`m)EIpEޜvNݓ?T $W;c2IVaޫ-vxIǻr't<$1irỸ* m PYsz|PJUҕp¥C iy}pϠ+ g,𺰮Z)Nۮ; {:T ˇNX# ^`}P.o=ߗA0;@fS@yk%:Bg 59*. j+ @* Ѫ"yV(τm'//vSђ΄"ˊ|Þ}ѕ.PJ\t 951467f89fd44696f52d2595e3c3efd425ea9f6d04237afe1d58a04aa419ba214a0b9735f22c42dcfd5461c10a76717c273171c8M3!pQp)Tξ7]mtZ`bh) ]mtZ`H&TahХep/2ER9Ti#Qj\ /*E]f-T!b]4NέC ǢRs˺6by?<Usuq1?cLiVHtTχOwf( @p9Lo}%Ҝ>tꐛUމQ(JthWaoH뛏tfM<`uKQ-SVt ) b(o~3Ld@gĢ)Ӡ G@R:gI(&QnJ?; 3ǓI5^VUU:d ޡQFp'7xK7`c̰.t We}޾99tŵ 8K]- olswj+e9SFU jiÃ!Ke eB٘jYܛ%JlL RRGHՎTh_o(DZ}7c1>pF:?:d< @ h CIPx   , L     < d    $ ` `( 8 M9 M:?M=4&>4.@46B4>G4`H4I4X4Y4Z5,[54\5L]5l^5b6d7e7f7l7t7u8v8 8_::: :&:h:lCcontainer-selinux2.130.01.module+el8.5.0+770+e2f49861SELinux policies for container runtimesSELinux policy modules for use with container runtimes.bh&Vord1-prod-a64build002.svc.aws.rockylinux.orgKojiRockyGPLv2infrastructure@rockylinux.orgUnspecifiedhttps://github.com/containers/container-selinuxlinuxnoarch . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then [ -f /var/lib/rpm-state/file_contexts.pre ] || cp -f /etc/selinux/${SELINUXTYPE}/contexts/files/file_contexts /var/lib/rpm-state/file_contexts.pre fi# Install all modules in a single transaction if [ $1 -eq 1 ]; then /usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 fi export MODULES=""; for x in container; do MODULES+=/usr/share/selinux/packages/$x.pp.bz2; MODULES+=" "; done; /usr/sbin/semodule -n -s targeted -r container 2> /dev/null /usr/sbin/semodule -n -s targeted -d docker 2> /dev/null /usr/sbin/semodule -n -s targeted -d gear 2> /dev/null . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if [ "${SELINUXTYPE}" = "${_policytype}" ]; then /usr/sbin/semodule -n -s ${_policytype} -X 200 -i $MODULES /usr/sbin/selinuxenabled && /usr/sbin/load_policy || : fi . /etc/selinux/config sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types matchpathcon -qV /var/lib/containers || restorecon -R /var/lib/containers &> /dev/null || :if [ $1 -eq 0 ]; then . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if [ $1 -eq 0 ]; then if [ "${SELINUXTYPE}" = "${_policytype}" ]; then /usr/sbin/semodule -n -X 200 -s ${_policytype} -r container docker &> /dev/null || : /usr/sbin/selinuxenabled && /usr/sbin/load_policy || : fi fi fi)M^A큤AAA큤A큤bh&V^txbh&Vbh&Vbh&V^txbh&Vbh&V0389dab4c8de315b75e65f20f4e606a015aac29056e561d6f7cb6aa588f431a9bb42ed8caafe82e1c4c84bc7a8b3fe2b5aef929064660662f8b1d9f46916b72664d41f7aaf65124abf9a513c8c78bc608300774bb5e67d316f7d47343b7cfdedrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootcontainer-selinux-2.130.0-1.module+el8.5.0+770+e2f49861.src.rpmcontainer-selinuxdocker-engine-selinuxdocker-selinux         /bin/sh/bin/sh/bin/sh/bin/shlibselinux-utilspolicycoreutilspolicycoreutils-python-utilsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)sedselinux-policyselinux-policy-baseselinux-policy-targeted2.5-113.0.4-14.6.0-14.0-15.2-13.14.3-9.el83.14.3-9.el83.14.3-9.el84.14.3^k@]@]7@]]@]|@]@]X]W]R@]@\M[[ͻ[[@[[Xf@[L[K7@["X[@[@[[[Z@Z?ZZZ%Z%Z@Z - 2:2.130.0-1Jindrich Novy - 2:2.124.0-1Jindrich Novy - 2:2.123.0-2Jindrich Novy - 2:2.123.0-1Jindrich Novy - 2:2.122.0-1Jindrich Novy - 2:2.119.0-3.gita233788Jindrich Novy - 2:2.119.0-2Jindrich Novy - 2:2.119.0-1Jindrich Novy - 2:2.116-1Jindrich Novy - 2:2.107-2Lokesh Mandvekar - 2:2.107-1Lokesh Mandvekar - 2:2.89-1.git2521d0dLokesh Mandvekar - 2:2.75-1.git99e2cfdLokesh Mandvekar - 2:2.74-1Frantisek Kluknavsky - 2:2.73-3Frantisek Kluknavsky - 2:2.73-2Dan Walsh - 2.69-3Dan Walsh - 2.69-2Dan Walsh - 2.68-1Dan Walsh - 2.67-1Dan Walsh - 2.66-1Dan Walsh - 2.64-1Dan Walsh - 2.62-1Dan Walsh - 2.61-1Dan Walsh - 2.60-1Dan Walsh - 2.58-2Dan Walsh - 2.58-1Dan Walsh - 2.57-1Dan Walsh - 2.56-1Dan Walsh - 2.55-1Dan Walsh - 2.52-1Dan Walsh - 2.51-1Dan Walsh - 2.50-1Dan Walsh - 2.49-1Dan Walsh - 2.48-1Dan Walsh - 2.41-1Dan Walsh - 2.40-1Dan Walsh - 2.39-1Dan Walsh - 2.38-1Dan Walsh - 2.37-1Dan Walsh - 2.36-1Dan Walsh - 2.35-1Dan Walsh - 2.34-1Dan Walsh - 2.33-1Dan Walsh - 2.32-1Dan Walsh - 2.31-1Dan Walsh - 2.29-1Dan Walsh - 2.28-1Dan Walsh - 2.27-1Dan Walsh - 2.24-1Dan Walsh - 2.23-1Dan Walsh - 2.22-1Troy Dawson - 2.21-3Fedora Release Engineering - 2:2.21-2Dan Walsh - 2.21-1Dan Walsh - 2.20-2Dan Walsh - 2.20-1Lokesh Mandvekar - 2:2.19-2.1Dan Walsh - 2:2.19-1Lokesh Mandvekar - 2:2.15-1.1Dan Walsh - 2:2.10-2.1Dan Walsh - 2:2.10-1Lokesh Mandvekar - 2:2.9-4Lokesh Mandvekar - 2:2.9-3Lokesh Mandvekar - 2:2.9-2Lokesh Mandvekar - 2:2.8-2Lokesh Mandvekar - 2:2.7-1Lokesh Mandvekar - 2:2.4-2Dan Walsh - 2:2.4-1Dan Walsh - 2:2.3-1Lokesh Mandvekar - 2:2.2-4Jonathan Lebon - 2:2.2-3Lokesh Mandvekar - 2:2.2-2Lokesh Mandvekar - 2:2.2-1Lokesh Mandvekar - 2:2.0-2Lokesh Mandvekar - 2:2.0-1Lokesh Mandvekar - 2:1.12.4-29- update to https://github.com/containers/container-selinux/releases/tag/v2.130.0 - don't use macros in changelog - Related: #1821193- update to 2.124.0 - Related: RHELPLAN-25139- implement spec file refactoring by Zdenek Pytela, namely: Change the uninstall command in the %postun section of the specfile to use the %selinux_modules_uninstall macro which uses priority 200. Change the install command in the %post section if the specfile to use the %selinux_modules_install macro. Replace relabel commands with using the %selinux_relabel_pre and %selinux_relabel_post macros. Change formatting so that the lines are vertically aligned in the %postun section. (https://github.com/containers/container-selinux/pull/85) - Related: RHELPLAN-25139- update to 2.123.0 - Related: RHELPLAN-25139- update to 2.122.0 - Related: RHELPLAN-25139- update to master container-selinux - bug 1769469 - Related: RHELPLAN-25139- fix post scriptlet - fail if semodule fails - bug 1729272 - Related: RHELPLAN-25139- update to 2.119.0 - Related: RHELPLAN-25139- update to 2.116 Resolves: #1748519- Use at least selinux policy 3.14.3-9.el8, Resolves: #1728700- Resolves: #1720654 - rebase to v2.107- bump to v2.89- bump to v2.75 - built commit 99e2cfd- Resolves: #1641655 - bump to v2.74 - built commit a62c2db- tweak macro for fedora - applies to rhel8 as well- moved changelog entries: - Define spc_t as a container_domain, so that container_runtime will transition to spc_t even when setup with nosuid. - Allow container_runtimes to setattr on callers fifo_files - Fix restorecon to not error on missing directory- Make sure we pull in the latest selinux-policy- Add map support to container-selinux for RHEL 7.5 - Dontudit attempts to write to kernel_sysctl_t- Add label for /var/lib/origin - Add customizable_file_t to customizable_types- Add policy for container_logreader_t- Allow dnsmasq to dbus chat with spc_t- Allow containers to create all socket classes- Label overlay directories under /var/lib/containers/ correctly- Allow spc_t to load kernel modules from inside of container- Allow containers to list cgroup directories - Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.- Run restorecon /usr/bin/podman in postinstall- Add labels to allow podman to be run from a systemd unit file- Set the version of SELinux policy required to the latest to fix build issues.- Allow container_runtime_t to transition to spc_t over unlabeled filesAllow iptables to read container state Dontaudit attempts from containers to write to /proc/self Allow spc_t to change attributes on container_runtime_t fifo files- Add better support for writing custom selinux policy for customer container domains.- Allow shell_exec_t as a container_runtime_t entrypoint- Allow bin_t as a container_runtime_t entrypoint- Add support for MLS running container runtimes - Add missing allow rules for running systemd in a container- Update policy to match master branch - Remove typebounds and replace with nnp_transition and nosuid_transition calls- Add support to nnp_transition for container domains - Eliminates need for typebounds.- Allow container_runtime_t to use user ttys - Fixes bounds check for container_t- Allow container runtimes to use interited terminals. This helps satisfy the bounds check of container_t versus container_runtime_t.- Allow container runtimes to mmap container_file_t devices - Add labeling for rhel push plugin- Allow containers to use inherited ttys - Allow ostree to handle labels under /var/lib/containers/ostree- Allow containers to relabelto/from all file types to container_file_t- Allow container to map chr_files labeled container_file_t- Dontaudit container processes getattr on kernel file systems- Allow containers to read /etc/resolv.conf and /etc/hosts if volume - mounted into container.- Make sure users creating content in /var/lib with right labels- Allow the container runtime to dbus chat with dnsmasq - add dontaudit rules for container trying to write to /proc- Add support for lxcd - Add support for labeling of tmpfs storage created within a container.- Allow a container to umount a container_file_t filesystem- Allow container runtimes to work with the netfilter sockets - Allow container_file_t to be an entrypoint for VM's - Allow spc_t domains to transition to svirt_t- Make sure container_runtime_t has all access of container_t- Allow container runtimes to create sockets in tmp dirs- Add additonal support for crio labeling.- Fixup spec file conditionals- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild- Allow containers to execmod on container_share_t files.- Relabel runc and crio executables- Allow container processes to getsession- update release tag to isolate from 7.3- Fix mcs transition problem on stdin/stdout/stderr - Add labels for CRI-O - Allow containers to use tunnel sockets- Resolves: #1451289 - rebase to v2.15 - built @origin/RHEL-1.12 commit 583ca40- Make sure we have a late enough version of policycoreutils- Update to the latest container-selinux patch from upstream - Label files under /usr/libexec/lxc as container_runtime_exec_t - Give container_t access to XFRM sockets - Allow spc_t to dbus chat with init system - Allow containers to read cgroup configuration mounted into a container- Resolves: #1425574 - built commit 79a6d70- Resolves: #1420591 - built @origin/RHEL-1.12 commit 8f876c4- built @origin/RHEL-1.12 commit 33cb78b-- built origin/RHEL-1.12 commit 21dd37b- correct version-release in changelog entries- Add typebounds statement for container_t from container_runtime_t - We should only label runc not runc*- Fix labeling on /usr/bin/runc.* - Add sandbox_net_domain access to container.te - Remove containers ability to look at /etc content- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7- properly disable docker module in %post- depend on selinux-policy-targeted - relabel docker-latest* files as well- bump to v2.2 - additional labeling for ocid- install policy at level 200 - From: Dan Walsh - Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a standalone package) - include projectatomic/RHEL-1.12 branch commit for building on centos/rhel- new package (separated from docker)/bin/sh/bin/sh/bin/shcontainer-selinuxdocker-selinux2:2.130.0-1.module+el8.5.0+770+e2f498612:2.130.0-1.module+el8.5.0+770+e2f498612:2.130.0-1.module+el8.5.0+770+e2f49861 2:1.12.5-142:1.12.4-28container-selinuxREADME.mddevelincludeservicescontainer.ifpackagescontainer.pp.bz2/usr/share/doc//usr/share/doc/container-selinux//usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/include//usr/share/selinux/devel/include/services//usr/share/selinux/packages/-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -fasynchronous-unwind-tables -fstack-clash-protectioncpioxz2noarch-redhat-linux-gnudirectoryUTF-8 Unicode textSE Linux policy interface source . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then if [ -f /var/lib/rpm-state/file_contexts.pre ]; then /usr/sbin/fixfiles -C /var/lib/rpm-state/file_contexts.pre restore &> /dev/null rm -f /var/lib/rpm-state/file_contexts.pre fi fi #define license tag if not already defined/bin/shutf-8e2b120842b74d4339b25e7a9e55bba3d9ba755621d15bbc842ed28fe4beb08fdcontainer-tools:2.0:8050020220426164243:faa19cc5?7zXZ !#,g] b2u jӫ`(y-mߨѱj Eח[ %}P3t@b%D^c]K&Pz Z1ّD}T߷֊{9Pf}6# W o!=i9 Ryy`2 B+s{n *\1.C=vSӢinZ]b \Z/ 6,S) 2,cV냢,1ױ;7bs= 8n`F v6N~sJsZhQNeqS |wB6KLw覴,|h(=k$,T8*-B²O+_H~^}0Xl vւD 3CvQJA~VoHk~>Aic[ysb"I4^[IGB/5{S0+}Ƙ"}@W6# I>2 5JYeTm f+]R05^Qrqo?-= K1?fQŨ4L`dZ .+εa\0rތbH{uޯ\*v ~$2]agIny>E=X_sgF@\ΫBtb@q;D[?nIE).ٟbhs rPP4/cgiٌ@J?!{z l,?~Wbaxas#f jkWO 0A% z&2=r7?-fk'fcR8k /iʛ[dÑ  [끋:{AtrƁNj֊hJN nHYrV{GEpi2z0{ /%j2غՈFuOРe}J h $si7̕vŌNU4Bgfv-l,9uxR;G B^hZ>H:dޯDvg\Dr{j-:PtO$:ȵǧ WZ ̌AHπluZoԴzԾzYnj Fͷ :LV yeC8ݶ9T,y%C3<$c "6c$U ӵDJY0AܵR-FIz宴vvxSJf{@$Jb) S:Z[?7WmkbiP5.(\3i?<)kv#~ŊPSvR.߫!3Y8%`9 nm2!+ox[=3 Yؕd[*yfM*oG"fTq!.3q _ZAT3}8r@n;;2eIՉ͡R-9\\vxH6XϠWf@aMHtwrz  >vvL4ZYD?<< fL2 [f MF3r)NݽigD:HÍEkjDM,xmRު.DfvZ3q h#F@fAYaArǢqw\ZVnk/]ȰfJߙ]DQn1j*4i8ֈ9ѣNt~^?eZE?ZF[XkBs m1vr)2[E(J؀ۼk9^WvnL\aiMWV9TSgQԕ&@sBcO*2P22MSpGP'wbeV Twڲ`@y9pw&VFbA3L3%V->-=?MᕐO}qNSC 6n0bRᛓMA*"Q+24,17oi`U)BtwYT 3msB^[<BEϛ`T~`2$l*ע=m*0?%7Q$/G*W|k#ѕ74w0!H/Ó2^l)M;& y>;~O'N~=М+–:j\]A£,a`8I(1v!Q8"Ob#~u}K:738񺖫- 29)MfaIWzl9~hy]9T(,+֬MdSwW;U$6M9^ush~-1iNn$/郣"}_TY ƞjĭy/-7*v|+a5ԏxKܡ=2%Xd.ü_ EKrGD†P^6P$>f ]!wO얧xHEwpŤ"E8Y }ZMzT$=1oѝR6C7GaMo5~Ɇ~! D!psiX{])$S$g }f2ek5K aRf03%GS,zfXxf ,뻂lj\,f`,UJq]8bȔ㍋vuLzBo!a 9cqvEAY7f"9F)gxvUDy֓"(/0 y ?$_nzp6uO`жz1Z&rk@A H# Ǿ;A}N*LAjGFQ@kNWw,{8ĨcBjޅ4U7'MibJ08N{& _ZE20#L;pC-ͷ&(y#U._'׼fQW<7E5GIWo7"M k 5]h  8Or}$c C*+aP`I׵#:'S2y>̴gH 5<A'Fk:@Pwz-0:3g UɏCS|;l{)[Y+g]%t:.g)YXIZx<%B[KO,8g-6*Ɠ_ ^X2fo ;X'n}`bPƭjIIK e+4c2'LRkBxJL]+TNuoJ&~Զ?NlaISQA ބG$?ދ3< ~+PO<%KvmXڧ o%LcBƉAWOătƨ䭁by3^k{5=q\07VU 3d1Y#F(bJbyFBrrЭŞIV;b?5ӀQowF({ y"؛r'ܩ7h18nCENI_h҆\%B_>F틸'c)KO/#|x-^˥RN%Jsh˪fWwG:WbA{ -Ӽ;g/A( q76;eek勲V'rPSwa11\h>~KL3-T@';my HEcZw1_%In7jr1yD&QiC:Oث +m#|=b\}jŤֵ~у upC ӏwYxlMTdp޷a^'.~7EAWE[ґNC tvj0xmh XP~VDt#D#%FsgӖ|%YhA;?&eQ ;!2HJ쓟XjR/ sSas% ĥ"|흏Lj >Xjj _mnn|*tb\LKrJf>l uq[vs>%11&M.v|« #ZU3ް1m_M<ВRz+* .]oׇ߷1<(  snɉn A2p9ɕZl 9Jcށ.vYmW89FH@ʝcLԥ qFMJOdk&8lO[yRdSTFȉ q~SϽn6IPV /Zdt}MElk ;1Y9(y})3tzDRWD{h7lgϟU=;%_ W8ZCc`d`Oeаe%fASf-٤f|WH|E̚\Q #Ejy ,0`JG] =]p{*2<qPJ'P zԜ[5L{H7ݠ>tl uFg)i4e<ɁqMx,l< k,0䑶tPqoF#o)Fr\}^MjVW0۶J6i ms]_ a,4B{fz64˵"O ?{ mkز5ɍeWʙ?8hjsg09Z]L[9m~s27~dZ2<:ElnЪ6vaxNUj"]H`/Z`<72ؒv wjN6fk3D]xI e!1v.ʼl~]UgF7$t\znWl.B Ajw1/Aa o(<2"|]uwƻd<6e*m:J'YtxyjIHYr|~ ݸ{"az9ݕBsNqtV06N3ش[זCZS2O>#oP#jބ;[-N*"+ Iw *$~U_>+=(Lgկ1~!zQYIig5OI\EH2w.QA=+[\ߕr2(Wɭi/r!b [ƏϏg$Obac5$znJLP]rז9 7B61Y}^jb{*:r[XMqYI e9(igW5̋f4Ϫ"b\67_C6}?<(,4&zd _u}Ski jז4bR ^U+¦bּs\v029YHL~X@6?44W O* xDYŲ_6 O=Z ոjgau |-2n޲ʉ;tMko|CS`ZN]׽+2V2kT\5ɵ4GLP(c.HY047~ҙQMƒ,TA PE^՟ TB+y= "ڦ"'*yI#Οf9hKBS= /B^;+|7?bCa> ,CTrܡGǧN=':&E`<1&PNom5U%kĠ-1m>q+Z±^ll>`VHGwQ#1׆tJ*mbMLT~6v*Q:0QZ4w+wl 2̄\0O6$~ϔ 6'NR;'fh{IN`1֮02` q22UfV@⁕̊ &w1{SUyUzkbCFܤ-R.bܠOQL>sPu}1R8u/lWfXr )Ye:BI/oWi%}x F01U(EK=,[^mxY$#irg++TgvﺎՀ&Sӿ'OJxHd<,XjZ >3'tɽ]"7RbfQ}R3FN!#9c@FS;l/F~N Hg;AXC6C.>#< ꔇ=|ukpnTZ},8gL*]8.cY elQXcw)Ti'}E}*<7bh5!ORf^YzkF-xvZB${&A1X#I i({T! {zb*_cR)A%S٬|Zo&_4فI !$QeD jEQ:+lYwd Qr0H^U8{p6NB5Xgu' ـde5]~( v!WRy^Jo<Es%n7`g29\`:A2C4a> 5!,8i6dDmG$PHNB,Ka⾟cӻ{E f@cե2R酈4*R\>vG< sopNZ5!Y 6oMͳfR1x*J\VDݟە`n҇.X {^qf:?bf<+ !jN [(o}Uʭ_Gѯ;r[~5#&&x>V a"uO2vvkr4N̴2ʩj=GeBR <}BUav: +[M&=|O#.W +zg1zK:ff~i!?T.FBmMPfȁk_s"# y,%W ̄ 3n}jV>O tl N]&MhU4K:٨a%9yzetK것aPQP"vU?^6IRMCM:U]s~+"> ; S. sy, XŸcҪ;(wt H5Y@沈Pwejq>;'gJ>n?nɊ a5\&Oaw}1x2.jo(uCyܲ){gR-Cy9b kX*p8~7|RӢq!00X,GvX-G=[?6s^J.Tx$r]xhȿ;*Z3Gl>JoHu;dM@a6p~2T1bP==GE$ [~箃U/ePl&l5)IIee\,¡䲏 wdSn2aztp -VK h&NAK ڴ@bB k7/'ݕVR6I^%]B,j9aHNBsO]ǎd]Nu ZCvf菟!=KĎ3{U%7Bg+e;XRz[=rDġ2!Vt!HPa,.HEB-b5h$Zd~u {6 /D:#t6/S0WQzbp}g龚vQ@VVUo8*&5IiTN3Opk;:i5)ioXi{-tY#NxJ ÿ,t"ȜwGna~N/MB.?Y7ӝ{<&D9rL#=XP4qqM{oLV6ױqR ·)Aǁ|Sp:Xl}+[˽K FGD_3jG 憡u0bbnci*rp1iХOq4l*K+t3 S/@GBv:bquBPm$,g|Yi惕?2^t]TW/Òg_Bu8YcjhZ]HʧjA"'Ф,uvgc.LNajD2&m?,MZ Y[xRhOfZf\{|;az{Z]P!3FPn{85GQfŃVaT֤ cw@_/AS(bN8)9Q+E)0t!ҾS^ֽzG ³su(ާxb W,9e"}D]d}5~-46]bE;2k=vLr^`2r9&8uoc .{f)Vhە 4S -%҇-ܡPW0mZxf ~ԋaHZjnJnt-L"Ƙ#`D*#Pȯ=c4ͪ9߃7L oԖD1*R(b+\ՆKR-<5uI:xe^B'9]9pzn=]=?Q;+=zH'ܛFx<|5ID_cԻgN?b{#IņT{ ˘ګh8M+ݪ]EXIʡlj"iLӧ+d݌̔d9H_jHJ<aQ[LMvF9z7/z om*~\iqpF[wdݣw:V{oI8DzQZ^N[SWtv0;eHT2i5/U@B 0;&B4'@x8y &9:T4DŖOȾޮ  (4>RYK8iЧ>eIBDŽ8.TwWOm":6r 3!mZbKv2ԕ-eTfB4(9h@*qbHuڟz*xE +2~@eգX=r9DnN2pT Ez\ytJ_[>4 .-N _÷U. gÇi& anLB"Aҍ}nC] (Zj$O%.+jT'я7mDU۾`g>H9;Po*$pxZy*+:͇\Ӈp ⽼y9BSuL$ǭ) |w8@L3^`xG6d /MZ5&b}+AKjȌaP]j9Z,Sg ZvjpCSrB}&6fS?2Pro="I`ǘfuoYZ*ޘT%M(Ev7BzzcWθ}n#7ԳgkoCaqSm,eayft47]PZId3uDIr|z&ɊHDbJd^G2BM?1qJvB 6p,yi' "moq?y6t}aueZG#s6`=f] +!A#M{Ɂ{^lM8[ s̑ f:qs. $乲kCAʻԑe::VoBX<3rǯ?U""7]*B7_LM+-n<љvP31$ dG/iqbC\@ҝׂ'CRALnV8FL ?bI|!SM{psr̂ӛxmXC(atu&TGMhI.F"&RKG~ދl0mrNپ!!!Lnk,H{ •Xf ce-O֥J2[JK/1Ef#> ;2wPu (Hµ9k nIܞB3qn(3}9y5`Ȳ9~kOf<$(_=?nH v'[/ЈwItkPu$5ʷ Y' gSY}m0 aĆ<^*;Ҡ4c֥݉7*d &Bqz^bH#WM/0N~R&TjrWd INuS OQj*|AY`(.7o ZIA'Ȉ+aq(=c4FN@Xu߿h?{gI΍PܱJŃsJDwL3` jl @԰jq,X_GxLWCu\\+&y-6XoEəl*]pvA1 H ŋg?zٶb~uÈdKc e~'|#a9%2ҶAyk㛬eEyܶUӝ?XV2ө |O<x|y9K% c-zj} ^Ix4q1R z)*Vj 3dC0 Q(r6Yu`؞0y'h;X4{(B <.u2WhXd돾Z|ZOMqfsNڸC 㠓!%emAgZ6g1׋&}3٠km}^`^Eh7 DR͓M{MsL9!bIJ8~"=1Z#(f?m62칗LL]؃1L-( (#!kqƺg+r 0%WV("?z7-f5ɉĄh<4">~=k`AQx?@?E'g"Z `@Rʴ;0^4ㅺ>%mwʝ4ec(*G9Oμ3 CzɲWy.0V71]:%3a.b\2Wo۝*Ai{oZ#d?viأ\ňԢ x&ͣq=8x@͙d7 A, V|v}xև)J%Fo0P5Y;X} 3 "Ǧ(sJ ~(U5Ujkv9O2vT+~qVuZ@ʑty7UmSm‚&+]r1 ]A/*8Z$zs XmŤ+y Zd|X/M;sB{ 9Y- :iC ¶?iAڶ I\^CddG Y I/J/r3)~| \Phjzt"A};CQ >huVٸnEƌI4!ųA[ Zʑ c `xhC_55Vd'P<+{H@mEAA/^v ò_aH:QL tk];):F%908ӳίʉd<1Q7QqcȮ}LF@q;.;9DXM4 'U!b>rqt1GO]Pc_;ZhÄ׹{[JA(f-L/lQIfzJCC1i29ayEH~Yv!'$s )DE,E@s4Iq"E2!Gv"VYȝLElۭ ؔ[vȳDEѡ8^06 `~gၢ@ǿ}<"gwU̶[E83ܘD"`܋ Z) FF[bL)@6Rħ\ic3FĽ DBݖ͇T[ xE5#GѦw䶚WaݱWΒrQ(NC/Q˓_5c^~L5Q뫂 eiЩ1?:[M&g-@o,I4N=Sk+>*I]f/u&VwodU.GCvyʫj#Tül4\48EMt:J) ʩ_>4^ TNoN //.&kEIl9W7i 1F%DTcm üѴ}j#Xm(y.rǽUm^;)x=!;Mo,V[.4$ ,#dty}GHr1q`⮰{W|uƯF 3a|ryfӆ=~[3!V/\Fx ^nPAHͲKeE)Ib|.٘ ĂXa%MN& 7 bUkiױ3%&&fPn0| (Er {vJ Fo{FtӕLn\)Qi*$iƒEW~w!;n4 ˕B8GdL`xQz JV?UI= pRA*2+/4R׊95p;~MҐ:{꪿,zVN㉧ t'N "q}1h,ڏ0\#7CdkF8ՒN*>qI 8)DW,L6ukؠ!'Ab TJ/ismoç J;IvtlR2^)GrpB 3 n䤅#Af_˙ۂ6/eWՕDQ@ t߇[5̪u &3Ù[Cy cS|[)0Lc,;KZUb(;S )~=925Շ+7N)WꚺV=oDO_ NNHxwH$'. C˿[~hӹO £U$I-7܇>24-9C<ώ&vLZ˼3i }ʺ@v AyeFKÂ[easEq n*o2uUSIj IY;m%BkW [F=87+]SVY-K!h]Ӻ8#Bdw/S+t;xs?Wd$[jNB4V.2mڸ~GXa6Cz0Ƽo @6(}bN?r +-Xh W"`1 Q%1Fá*8?Ÿ+$5Sz5yN?D n$<1D9rZ9u~Iӟ1eR0f̏6!'T.L2ŷ3FRɒI:3(g;BneTa)FZqǶ1˙j̒?0|&Hrm!"z5@s=8Is,A7:d d tW^ 1ٲ`O\߮'3JRo :8lX` n }_W.D >C9`7>>oE&1!SG-7edd]w CҬ(W: >ή$m;<~ S82az8I O5,ɭX&ǬR`闬N›'%&,9Ρ2Wy{MZKZ?N09[>"ʘ9 H2 `ɋKF߾(~|΢!_hG˯/xE'Ky8G~ëtՒ7[/yl|W*O *mުäzUXFhɣH5%]SIR$ylW)rD=fBf+*$ѭ,<ȌJzpY@[Ճj!:$X/oN$my΅n'{-]\\h %׊6 ,1BDfx80C2@ ($[ĞoQwѩl e_G1&CćDKj j-hﲭzƮT1FzRM&px:t~a'q wh)kvyBxnφg&ͻ7oGh+@-"ÞUZ=<-}tp |,AѢizZLGj9(S bl07 U%@OZtZp&ZxF cBk{CVg{EyH6JJrdk-RV |uO_ܷ$<^f aje2R}R~yj`]z]?=3, nm'. ivQ;90ɬ1UsbvϸʑEH1+z6-iˋJ Z!'mzbhcW1oBcWژ֠% < ~)+:c,!"* =@[3Z$w-p*w]ڤ/o% &$Gyw&@lX$." l).ȅ&2٧%Βp ,PJ 㵫CV|sϩ`j|E'+9C}W0;iT&{^W~ ņχ˭pxXmÑh]8cYbVk_?FsS\}fS9 B 6jN@t[V o!c{%AKGaD{5 fյaܯ3޸佚F(Oder\m;;C$$k}@d^iőu'%3~S7e쮹/D PUPZq{!4o/2 BwzM^ E+/6r+9 TQ/m˞*]w1#lҖZ&\0ĵA,խ4h)iz{fTS`"EOOl,29rM@ e,`͓ѵuȊv0Exe%Υ E% zmlLٸD '"֟b uԮiEijnXȭd6%8p9z(Fö`&6rҥZP]舖$Uʭp3ʏg>u>mįB/̺>^ +Fqw@֒JG%lJp)5IVϞ4v Hj]9M!~M;IPo.fK0TF&>hkOïk2ů1[ͳoЃֆwx$$^PAa~9N~BM7CSydY)>bẹ1pY)\b}q]ݡ_[@H٧7ÀLFD>˹x-pM BBiZ\A\MlM7 F o\zwҨ)I4V y٩Uiht܋)|+_82 //B%ݩ[.uVy  Bp4g{yR#렉8yQր yG`} 1~n`JC΍ xz6QiZ7|sJYCr&j fvY~ p< 涩Í3]<6*y̹ֆS-Jă^ZM {Auu4dzNu¦r!J\\%ArU* 4`i+r{Z*"'V^fU,[|*`5Ҡdb`mBeTg>g9Ե"q[X*W#h(ňXΗ8"%YHRD^@_=mEWu%[n0Ÿ:"y}CnYXJng`)>Cj)IR~]eMR,e*V.{FFpqvAC?ǐ{ηFPL9Y&[lv$\0ZhS5ے<;[UN>_M)fV*W>#uat UѬj&}> حm#`[>OG߳9/cbb%2u胗7*lgV֛ AjaB#] =/-<ħ/C-JH~/'3I +K5)L<`}!.OYEqV)UVI¥-~kc]G,JW=~_gi 3q_ssqpw}'a`WPPb,ҳi!О&׸0n!'ȘbRt>E,O$dM~ OR>DZ{$rvڲUE|+iA@tww䑵{*zC`e%W=9p˂@4cT] s*Ʒ048^?t,ZoF[sr=k:fnr48R#d JJ~,J;P^KU|>=Ĺ`zZOuf^ ^P@XLAi]{ypHjwԥybmʣ<\Į]L88P=6J#;:D|h9`AV r8֗.ϒ s8MZ7!>e,W^~Rel=S߶ B-;94]KA)q`u&}FLYcscބ9{V"#7c݇)\;u~P{gISQ (`?86M?]!h}Ίگ8+::6"%Q%,OȕED!@~`l}^/d%$ VW|H6vQ@  nz[1#ɍglyƺ(?qSjs # ;o˸ow _v1jS#!"~k?QUz=_NyڏyWɿ6š: #t?(ȈZYf$`wX",(7et g[z2uQ 9OTe9bZ zLY+  njbj0 o lT[7S:aIYQGo$~oUMYTuDkz|Fy}JaoE8- J!\߆ 8Sei$Z1!҆}!!6L3 R,dzX ֡şb}.ܡd3AV}QS|D]_}˜1ؿBi|,!]pKM n)1"-D޾2VJ5DH1xMz@/$ |g'Q­43>lI,F&j] >d)kU #^~3ʗb \\Iy*Q+hxe:h6Gtvrm|DL3G0 e,7>+A&ԂF=6.#B燠>#!M;HB؞?׬:8u{^JAFÔbNDaz՘g>Yņ ߩU A^<9:fq> Ww}lyK3Y`UMaT܍c䱮) P a_FF(&'BZF8){L(RS~o'#JybJIY'-CU'ݥ\ Š2k`Y";bn2>Ư b0٭b:.}IC.נ#_UʛwGN$l^8;л8P9cH*Akٵ ;gy©k|QB "вcn17DdԎҹ<~S3}kh * A1,W2n9լw }d&]bi/ >^QմNPcn Ra]Ln'0p;۪LB2*uTN؎?pL6`B浭AkuZ9O%ǐ/C!B9Tѫ|*F`n2C÷P7.;;rժ.` 3xI Kݥ^݀c7,HR]@u|9۪8%)cҿPySZgo2N6X|9#aoׂ2!F;gw/Iån ̂XF& /@p#O|NȚSu pCg#qaद }Z>6Wדq4}6k.H&-'`D;M2o)BU`'[5#\f!+W]Sa-;-ױBga؏\U>{]x$s\)k#IęA[y v!Ds*'NN?"~o.R#'~*kl9MU}:n6jaG 5G}o{2f0y_|8_@[.5qć.ik:OIG;`BpzD3~Ha>Q; @r7ÛK/bGX m۩?,\ 8βmۑof] t_$o_O m@ơ"D$F溇kqH 1d/Sw[6m@%+\:抈:ϼ:%`*cd]1;my圂l}/EOrpOzwZ%/W_[,Uc&@t81[nkmgnBj = G)**9 CE<[PNq&)<~$Ν^'*bA97=$2qo8D.নh}yq[`C`Q0&]E5ekȼN%̲G'CP  .cʢ-g?y ʰ:hEFy.XwS*PV<Vp0F(n6k. 0[9Es]kp1}8( h7w=j?i첅NaWIDkς+b\8Sж&Z#xm8b@FN4F Fg> ZDVi& k?a񶢳( 2x+U~q\]񂪕|\G,!㿥vϧ:IV^`ޜK2nT#.jWy3bEUowjf63#hT+wxoQhQ8`N[AJQ}L[Ll׀-7%>|?b~|FNwdM-w|+)O\kiUU{ H̀ ev`kggl*eV$5gp!?r !"k(F/e#|4 q{[`9 ?dQ%\ %Qk3&?ioh u=@*e*$vFXK\Z{Ekjªar"`…AO0ƐXx5ATniA]3;{1y2!SA6QCxBT&u~Қc$Df#b7+DCEs!\ .^#&6xƤ [xfKIX,܎5ԋfKϹfz![?o;1n/V? .O#D b3&?:mv*#WҪ SA}€z!sZ$P9 @<ṁm-K})G YZ