openssl-static-1.0.1e-58.el6_10$>Cyt60<>7?pd " f8<TX_g     f hpz](8F9F:='FGH IXY \D]L^abkd eflt,u4v<w\xdlCopenssl-static1.0.1e58.el6_10Libraries for static linking of applications which will use OpenSSLOpenSSL is a toolkit for supporting cryptography. The openssl-static package contains static libraries needed for static linking of applications which support various cryptographic algorithms and protocols.]T9x86-02.bsys.centos.org<;&CentOSOpenSSLCentOS BuildSystem Development/Librarieshttp://www.openssl.org/linuxi6862ܒ ^]T9]T9292f9d2e698f96650177db86a41c61c5f65d890cf46d1325aa9fa7b2787096114e43dfc95c4b8d2f43a8664e1028de065625bef0d3e9c79f733f62d58c9c92bfrootrootrootrootopenssl-1.0.1e-58.el6_10.src.rpmopenssl-staticopenssl-static(x86-32)    openssl-develrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)1.0.1e-58.el6_103.0.4-14.6.0-14.0-15.2-14.8.0]X*XX @W%W@WW'A@V͛@V@V@VVwVa@UJ@Uyx@Uv@UmUcU@U @U hT@TT?@T>aS@SS@S@Sg@S}SB@S&SR@RʚR1@R@RrF@REs@RD!R@-@R<8R1R7R@QdQ@Q*@QLQLQQ+R@Px@P+@OE@O@OgOOdONN]NyNm@NTNI @Md@M۝MS@MK@M=iL!LL+1LKKKzKuBKV@KO@KMKEK y@KKKJJ@JJ`@J@JH@J@J@J#JJ@J@J:JjJf@JI@JB@I@Io@I@II3IJI@I@I}Iq@Iq@IpvIpvIo%@H@HCH=I@H;H1kG"G@G}GaGUA@GSGV@GaFFF;@E}H@EnEe@EIE @EDfDГD@DDp@D@D4D4DDc'@D2_C@CCZCqCBC@C{@Cp@CX@CLC B=BBo~BlBgBM7BK@BJB$Y@B#B#B LAAʳ@A@A@A@A@Ab@@͓@@X@5@@b@V@@PT@O@@Dw@@=@2@@,@@,@@*@@ @ ??@?@?~@?z?yp@?yp@?yp@?x?r?r?q@?p5?hL?I@???? U@? @>@>@>>>@>@>v>@>@>G>E>x[>u>e>]>Sq>Sq>K>G@>.>'@>%M@>d@>>{@==(====O@=I"=G@=G@=E.@=?@=5\@=@<@<<@<@@<@ 1.0.1e-58Tomáš Mráz 1.0.1e-57Tomáš Mráz 1.0.1e-55Tomáš Mráz 1.0.1e-54Tomáš Mráz 1.0.1e-53Tomáš Mráz 1.0.1e-52Tomáš Mráz 1.0.1e-50Tomáš Mráz 1.0.1e-49Tomáš Mráz 1.0.1e-48Tomáš Mráz 1.0.1e-47Tomáš Mráz 1.0.1e-46Tomáš Mráz 1.0.1e-45Tomáš Mráz 1.0.1e-44Tomáš Mráz 1.0.1e-43Tomáš Mráz 1.0.1e-42Tomáš Mráz 1.0.1e-41Tomáš Mráz 1.0.1e-40Tomáš Mráz 1.0.1e-39Tomáš Mráz 1.0.1e-38Tomáš Mráz 1.0.1e-37Tomáš Mráz 1.0.1e-36Tomáš Mráz 1.0.1e-35Tomáš Mráz 1.0.1e-34Tomáš Mráz 1.0.1e-33Tomáš Mráz 1.0.1e-32Tomáš Mráz 1.0.1e-31Tomáš Mráz 1.0.1e-30Tomáš Mráz 1.0.1e-29Tomáš Mráz 1.0.1e-28Tomáš Mráz 1.0.1e-26Tomáš Mráz 1.0.1e-25Tomáš Mráz 1.0.1e-24Tomáš Mráz 1.0.1e-23Tomáš Mráz 1.0.1e-22Tomáš Mráz 1.0.1e-21Tomáš Mráz 1.0.1e-20Tomáš Mráz 1.0.1e-19Tomáš Mráz 1.0.1e-18Tomáš Mráz 1.0.1e-17Tomáš Mráz 1.0.1e-16Tomáš Mráz 1.0.1e-15Tomáš Mráz 1.0.1e-14Tomáš Mráz 1.0.1e-13Tomáš Mráz 1.0.1e-12Tomáš Mráz 1.0.1e-11Tomas Mraz 1.0.1e-9Tomas Mraz 1.0.1e-8Tomas Mraz 1.0.1e-7Tomas Mraz 1.0.1e-6Tomas Mraz 1.0.1e-5Tomas Mraz 1.0.1e-4Tomas Mraz 1.0.1e-2Tomas Mraz 1.0.1e-1Tomas Mraz 1.0.0-28Tomas Mraz 1.0.0-27Tomas Mraz 1.0.0-26Tomas Mraz 1.0.0-25Tomas Mraz 1.0.0-24Tomas Mraz 1.0.0-23Tomas Mraz 1.0.0-22Tomas Mraz 1.0.0-21Tomas Mraz 1.0.0-20Tomas Mraz 1.0.0-19Tomas Mraz 1.0.0-18Tomas Mraz 1.0.0-17Tomas Mraz 1.0.0-16Tomas Mraz 1.0.0-15Tomas Mraz 1.0.0-14Tomas Mraz 1.0.0-11Tomas Mraz 1.0.0-10Tomas Mraz 1.0.0-8Tomas Mraz 1.0.0-7Tomas Mraz 1.0.0-6Tomas Mraz 1.0.0-5Tomas Mraz 1.0.0-4Tomas Mraz 1.0.0-3Tomas Mraz 1.0.0-2Tomas Mraz 1.0.0-1Tomas Mraz 1.0.0-0.22.beta5Tomas Mraz 1.0.0-0.21.beta5Tomas Mraz 1.0.0-0.20.beta5Tomas Mraz 1.0.0-0.19.beta4Tomas Mraz 1.0.0-0.18.beta4Tomas Mraz 1.0.0-0.17.beta4Tomas Mraz 1.0.0-0.16.beta4Tomas Mraz 1.0.0-0.15.beta4Tomas Mraz 1.0.0-0.14.beta4Tomas Mraz 1.0.0-0.13.beta4Tomas Mraz 1.0.0-0.12.beta4Tomas Mraz 1.0.0-0.11.beta4Tomas Mraz 1.0.0-0.10.beta3Tomas Mraz 1.0.0-0.9.beta3Tomas Mraz 1.0.0-0.8.beta3Tomas Mraz 1.0.0-0.7.beta3Tomas Mraz 1.0.0-0.6.beta3Tomas Mraz 1.0.0-0.5.beta3Tomas Mraz 1.0.0-0.4.beta3Tomas Mraz 1.0.0-0.3.beta3Tomas Mraz 1.0.0-0.2.beta3Tomas Mraz 1.0.0-0.1.beta3Fedora Release Engineering - 0.9.8k-7Bill Nottingham Tomas Mraz 0.9.8k-6Tomas Mraz 0.9.8k-5Tomas Mraz 0.9.8k-4Tomas Mraz 0.9.8k-3Tomas Mraz 0.9.8k-2Tomas Mraz 0.9.8k-1Tomas Mraz 0.9.8j-10Tomas Mraz 0.9.8j-9Fedora Release Engineering - 0.9.8j-8Tomas Mraz 0.9.8j-7Tomas Mraz 0.9.8j-6Tomas Mraz 0.9.8j-5Tomas Mraz 0.9.8j-4Tomas Mraz 0.9.8j-3Tomas Mraz 0.9.8j-2Tomas Mraz 0.9.8j-1Tomas Mraz 0.9.8g-11Joe Orton 0.9.8g-10Tomas Mraz 0.9.8g-9Tomas Mraz 0.9.8g-8Tom "spot" Callaway 0.9.8g-7Joe Orton 0.9.8g-6Fedora Release Engineering - 0.9.8g-5Tomas Mraz 0.9.8g-4Tomas Mraz 0.9.8g-3Tomas Mraz 0.9.8g-2Tomas Mraz 0.9.8g-1Joe Orton 0.9.8b-17Tomas Mraz 0.9.8b-16Tomas Mraz 0.9.8b-15Tomas Mraz 0.9.8b-14Tomas Mraz 0.9.8b-13Tomas Mraz 0.9.8b-12Tomas Mraz 0.9.8b-11Tomas Mraz 0.9.8b-10Tomas Mraz 0.9.8b-9Tomas Mraz 0.9.8b-8Tomas Mraz 0.9.8b-7Tomas Mraz 0.9.8b-6Tomas Mraz - 0.9.8b-5Alexandre Oliva - 0.9.8b-4.1Tomas Mraz - 0.9.8b-4Tomas Mraz Jesse Keating - 0.9.8b-3.1Tomas Mraz - 0.9.8b-3Joe Orton Tomas Mraz - 0.9.8b-2Tomas Mraz - 0.9.8b-1Tomas Mraz - 0.9.8a-6Jesse Keating - 0.9.8a-5.2Jesse Keating - 0.9.8a-5.1Tomas Mraz 0.9.8a-5Jesse Keating Tomas Mraz 0.9.8a-4Tomas Mraz 0.9.8a-3Tomas Mraz 0.9.8a-2Tomas Mraz 0.9.8a-1Tomas Mraz 0.9.7f-11Tomas Mraz 0.9.7f-10Tomas Mraz 0.9.7f-9Phil Knirsch 0.9.7f-8Tomas Mraz 0.9.7f-7Tomas Mraz 0.9.7f-6Joe Orton 0.9.7f-5Tomas Mraz 0.9.7f-4Tomas Mraz 0.9.7f-3Tomas Mraz 0.9.7f-2Tomas Mraz 0.9.7f-1Tomas Mraz 0.9.7e-3Tomas Mraz 0.9.7e-2Tomas Mraz 0.9.7e-1Tomas Mraz Joe Orton 0.9.7a-46Phil Knirsch 0.9.7a-45Nalin Dahyabhai 0.9.7a-44Nalin Dahyabhai 0.9.7a-43Nalin Dahyabhai 0.9.7a-42Nalin Dahyabhai 0.9.7a-41Phil Knirsch 0.9.7a-40Elliot Lee Phil Knirsch 0.9.7a-38Nalin Dahyabhai 0.9.7a-37Nalin Dahyabhai 0.9.7a-36Joe Orton 0.9.7a-35Phil Knirsch Nalin Dahyabhai 0.9.7a-34Nalin Dahyabhai 0.9.7a-33Elliot Lee Phil Knirsch 0.9.7a-32Phil Knirsch 0.9.7a-31Elliot Lee Phil Knirsch 0.9.7a-29Phil Knirsch 0.9.7a-28Nalin Dahyabhai Joe Orton 0.9.7a-27Tim Waugh 0.9.7a-26Nalin Dahyabhai 0.9.7a-25Phil Knirsch 0.9.7a-24Nalin Dahyabhai 0.9.7a-22.1Nalin Dahyabhai 0.9.7a-22Nalin Dahyabhai 0.9.7a-23Joe Orton Nalin Dahyabhai 0.9.7a-22Nalin Dahyabhai 0.9.7a-21Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai 0.9.7a-20Nalin Dahyabhai Matt Wilson 0.9.7a-19Phil Knirsch 0.9.7a-18Nalin Dahyabhai 0.9.7a-17Nalin Dahyabhai 0.9.7a-10.9Nalin Dahyabhai 0.9.7a-16Nalin Dahyabhai 0.9.7a-15Nalin Dahyabhai 0.9.7a-14Nalin Dahyabhai 0.9.7a-13Phil Knirsch 0.9.7a-12Nalin Dahyabhai 0.9.7a-9.9Nalin Dahyabhai 0.9.7a-11Nalin Dahyabhai 0.9.7a-10Nalin Dahyabhai 0.9.7a-9Nalin Dahyabhai Nalin Dahyabhai Elliot Lee 0.9.7a-8Phil Knirsch 0.9.7a-7Nalin Dahyabhai 0.9.7a-6Nalin Dahyabhai 0.9.7a-5Nalin Dahyabhai 0.9.7a-4Nalin Dahyabhai 0.9.7a-3Nalin Dahyabhai 0.9.7a-2Nalin Dahyabhai 0.9.7a-1Nalin Dahyabhai 0.9.7-8Elliot Lee 0.9.7-7Nalin Dahyabhai 0.9.7-6Tim Powers Phil Knirsch 0.9.7-4Nalin Dahyabhai Bill Nottingham 0.9.7-3Nalin Dahyabhai 0.9.7-2Nalin Dahyabhai 0.9.7-1Nalin Dahyabhai 0.9.7-0Nalin Dahyabhai Nalin Dahyabhai 0.9.6b-30Elliot Lee 0.9.6b-29hammer.3Nalin Dahyabhai 0.9.6b-29Nalin Dahyabhai 0.9.6b-28Nalin Dahyabhai 0.9.6b-27Nalin Dahyabhai 0.9.6b-26Nalin Dahyabhai 0.9.6b-25Nalin Dahyabhai 0.9.6b-24Nalin Dahyabhai 0.9.6b-23Tim Powers Tim Powers Nalin Dahyabhai 0.9.6b-20Nalin Dahyabhai 0.9.6b-19Nalin Dahyabhai 0.9.6b-17, 0.9.6b-18Gary Benson stronghold-0.9.6c-2Gary Benson Nalin Dahyabhai 0.9.6b-15Nalin Dahyabhai 0.9.6b-13Florian La Roche 0.9.6b-11Gary Benson stronghold-0.9.6c-1Florian La Roche Nalin Dahyabhai 0.9.6b-9Nalin Dahyabhai Nalin Dahyabhai 0.9.6b-8Nalin Dahyabhai 0.9.6b-7Nalin Dahyabhai 0.9.6b-6Nalin Dahyabhai 0.9.6b-5Nalin Dahyabhai 0.9.6b-4Nalin Dahyabhai Nalin Dahyabhai 0.9.6b-3Nalin Dahyabhai 0.9.6b-2Nalin Dahyabhai Nalin Dahyabhai 0.9.6b-1Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Florian La Roche Nalin Dahyabhai Joe Orton stronghold-0.9.6a-1Joe Orton Joe Orton Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Florian La Roche Nalin Dahyabhai Nalin Dahyabhai Florian La Roche Than Ngo Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Bill Nottingham Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Nalin Dahyabhai Florian La Roche Florian La Roche Florian La Roche Bernhard Rosenkrdnzer Bernhard Rosenkrdnzer Bernhard Rosenkrdnzer - fix CVE-2019-1559 - 0-byte record padding oracle- fix CVE-2017-3731 - DoS via truncated packets with RC4-MD5 cipher- fix CVE-2016-8610 - DoS of single-threaded servers via excessive alerts- fix handling of ciphersuites present after the FALLBACK_SCSV ciphersuite entry (#1386350)- add README.legacy-settings- deprecate and disable verification of insecure hash algorithms - disallow DH keys with less than 1024 bits in TLS client - remove support for weak and export ciphersuites - use correct digest when exporting keying material in TLS1.2 (#1376741)- fix CVE-2016-2177 - possible integer overflow - fix CVE-2016-2178 - non-constant time DSA operations - fix CVE-2016-2179 - further DoS issues in DTLS - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio() - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec() - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check - fix CVE-2016-6304 - unbound memory growth with OCSP status request - fix CVE-2016-6306 - certificate message OOB reads - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to 112 bit effective strength - replace expired testing certificates- fix CVE-2016-2105 - possible overflow in base64 encoding - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate() - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC - fix CVE-2016-2108 - memory corruption in ASN.1 encoder - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO - fix CVE-2016-0799 - memory issues in BIO_printf- fix CVE-2016-0702 - side channel attack on modular exponentiation - fix CVE-2016-0705 - double-free in DSA private key parsing - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn- fix CVE-2015-3197 - SSLv2 ciphersuite enforcement - disable SSLv2 in the generic TLS method- fix 1-byte memory leak in pkcs12 parse (#1229871) - document some options of the speed command (#1197095)- fix high-precision timestamps in timestamping authority- fix CVE-2015-7575 - disallow use of MD5 in TLS1.2- fix CVE-2015-3194 - certificate verify crash with missing PSS parameter - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak - fix CVE-2015-3196 - race condition when handling PSK identity hint- fix regression caused by mistake in fix for CVE-2015-1791- improved fix for CVE-2015-1791 - add missing parts of CVE-2015-0209 fix for corectness although unexploitable- fix CVE-2014-8176 - invalid free in DTLS buffering code - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent - fix CVE-2015-1791 - race condition handling NewSessionTicket - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function- fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on read in multithreaded applications- fix CVE-2015-4000 - prevent the logjam attack on client - restrict the DH key size to at least 768 bits (limit will be increased in future)- drop the AES-GCM restriction of 2^32 operations because the IV is always 96 bits (32 bit fixed field + 64 bit invocation field)- update fix for CVE-2015-0287 to what was released upstream- fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey() - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data - fix CVE-2015-0292 - integer underflow in base64 decoder - fix CVE-2015-0293 - triggerable assert in SSLv2 server- copy digest algorithm when handling SNI context switch - improve documentation of ciphersuites - patch by Hubert Kario - add support for setting Kerberos service and keytab in s_server and s_client- fix CVE-2014-3570 - incorrect computation in BN_sqr() - fix CVE-2014-3571 - possible crash in dtls1_get_record() - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state - fix CVE-2014-8275 - various certificate fingerprint issues - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export ciphersuites and on server - fix CVE-2015-0205 - do not allow unauthenticated client DH certificate - fix CVE-2015-0206 - possible memory leak when buffering DTLS records- use FIPS approved method for computation of d in RSA- fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV to partially mitigate CVE-2014-3566 (padding attack on SSL3)- add ECC TLS extensions to DTLS (#1119800)- fix CVE-2014-3505 - doublefree in DTLS packet processing - fix CVE-2014-3506 - avoid memory exhaustion in DTLS - fix CVE-2014-3507 - avoid memory leak in DTLS - fix CVE-2014-3508 - fix OID handling to avoid information leak - fix CVE-2014-3509 - fix race condition when parsing server hello - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS - fix CVE-2014-3511 - disallow protocol downgrade via fragmentation- fix CVE-2014-0224 fix that broke EAP-FAST session resumption support- drop EXPORT, RC2, and DES from the default cipher list (#1057520) - print ephemeral key size negotiated in TLS handshake (#1057715) - do not include ECC ciphersuites in SSLv2 client hello (#1090952) - properly detect encryption failure in BIO (#1100819) - fail on hmac integrity check if the .hmac file is empty (#1105567) - FIPS mode: make the limitations on DSA, DH, and RSA keygen length enforced only if OPENSSL_ENFORCE_MODULUS_BITS environment variable is set- fix CVE-2010-5298 - possible use of memory after free - fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment - fix CVE-2014-0198 - possible NULL pointer dereference - fix CVE-2014-0221 - DoS from invalid DTLS handshake packet - fix CVE-2014-0224 - SSL/TLS MITM vulnerability - fix CVE-2014-3470 - client-side DoS when using anonymous ECDH- add back support for secp521r1 EC curve- fix CVE-2014-0160 - information disclosure in TLS heartbeat extension- use 2048 bit RSA key in FIPS selftests- add DH_compute_key_padded needed for FIPS CAVS testing - make 3des strength to be 128 bits instead of 168 (#1056616) - FIPS mode: do not generate DSA keys and DH parameters < 2048 bits - FIPS mode: use approved RSA keygen (allows only 2048 and 3072 bit keys) - FIPS mode: add DH selftest - FIPS mode: reseed DRBG properly on RAND_add() - FIPS mode: add RSA encrypt/decrypt selftest - FIPS mode: add hard limit for 2^32 GCM block encryptions with the same key - use the key length from configuration file if req -newkey rsa is invoked- fix CVE-2013-4353 - Invalid TLS handshake crash- fix CVE-2013-6450 - possible MiTM attack on DTLS1- fix CVE-2013-6449 - crash when version in SSL structure is incorrect- add back some no-op symbols that were inadvertently dropped- do not advertise ECC curves we do not support - fix CPU identification on Cyrix CPUs- make DTLS1 work in FIPS mode - avoid RSA and DSA 512 bits and Whirlpool in 'openssl speed' in FIPS mode- installation of dracut-fips marks that the FIPS module is installed- avoid dlopening libssl.so from libcrypto- fix small memory leak in FIPS aes selftest - fix segfault in openssl speed hmac in the FIPS mode- document the nextprotoneg option in manual pages original patch by Hubert Kario- always perform the FIPS selftests in library constructor if FIPS module is installed- fix use of rdrand if available - more commits cherry picked from upstream - documentation fixes- additional manual page fix - use symbol versioning also for the textual version- additional manual page fixes - cleanup speed command output for ECDH ECDSA- use _prefix macro- add relro linking flag- add support for the -trusted_first option for certificate chain verification- rebase to the 1.0.1e upstream version- fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589) - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052) - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB environment variable is set (fixes CVE-2012-4929 #857051) - use __secure_getenv() everywhere instead of getenv() (#839735)- fix sslrand(1) and sslpasswd(1) reference in openssl(1) manpage (#841645) - drop superfluous lib64 fixup in pkgconfig .pc files (#770872) - force BIO_accept_new(*:) to listen on IPv4- use PKCS#8 when writing private keys in FIPS mode as the old PEM encryption mode is not FIPS compatible (#812348)- fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686) - properly initialize tkeylen in the CVE-2012-0884 fix- fix for CVE-2012-2110 - memory corruption in asn1_d2i_read_bio() (#814185)- fix problem with the SGC restart patch that might terminate handshake incorrectly - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725) - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489)- fix incorrect encryption of unaligned chunks in CFB, OFB and CTR modes- fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery vulnerability and additional DTLS fixes (#771770) - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775) - fix for CVE-2011-4577 - possible DoS through malformed RFC 3779 data (#771778) - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)- fix x86cpuid.pl - patch by Paolo Bonzini- add known answer test for SHA2 algorithms- fix missing initialization of a variable in the CHIL engine (#740188)- initialize the X509_STORE_CTX properly for CRL lookups - CVE-2011-3207 (#736087)- merge the optimizations for AES-NI, SHA1, and RC4 from the intelx engine to the internal implementations- better documentation of the available digests in apps (#693858) - backported CHIL engine fixes (#693863) - allow testing build without downstream patches (#708511) - enable partial RELRO when linking (#723994) - add intelx engine with improved performance on new Intel CPUs - add OPENSSL_DISABLE_AES_NI environment variable which disables the AES-NI support (does not affect the intelx engine)- use the AES-NI engine in the FIPS mode- add API necessary for CAVS testing of the new DSA parameter generation- fix OCSP stapling vulnerability - CVE-2011-0014 (#676063) - correct the README.FIPS document- add -x931 parameter to openssl genrsa command to use the ANSI X9.31 key generation method - use FIPS-186-3 method for DSA parameter generation - add OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW environment variable to allow using MD5 when the system is in the maintenance state even if the /proc fips flag is on - make openssl pkcs12 command work by default in the FIPS mode- listen on ipv6 wildcard in s_server so we accept connections from both ipv4 and ipv6 (#601612) - fix openssl speed command so it can be used in the FIPS mode with FIPS allowed ciphers (#619762)- disable code for SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG - CVE-2010-3864 (#649304)- fix race in extension parsing code - CVE-2010-3864 (#649304)- openssl man page fix (#609484)- fix wrong ASN.1 definition of OriginatorInfo - CVE-2010-0742 (#598738) - fix information leak in rsa_verify_recover - CVE-2010-1633 (#598732)- make CA dir readable - the private keys are in private subdir (#584810) - a few fixes from upstream CVS - make X509_NAME_hash_old work in FIPS mode (#568395)- update to final 1.0.0 upstream release- make TLS work in the FIPS mode- gracefully handle zero length in assembler implementations of OPENSSL_cleanse (#564029) - do not fail in s_server if client hostname not resolvable (#561260)- new upstream release- fix CVE-2009-4355 - leak in applications incorrectly calling CRYPTO_free_all_ex_data() before application exit (#546707) - upstream fix for future TLS protocol version handling- add support for Intel AES-NI- upstream fix compression handling on session resumption - various null checks and other small fixes from upstream - upstream changes for the renegotiation info according to the latest draft- fix non-fips mingw build (patch by Kalev Lember) - add IPV6 fix for DTLS- add better error reporting for the unsafe renegotiation- fix build on s390x- disable enforcement of the renegotiation extension on the client (#537962) - add fixes from the current upstream snapshot- keep the beta status in version number at 3 so we do not have to rebuild openssh and possibly other dependencies with too strict version check- update to new upstream version, no soname bump needed - fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used so the compatibility with unfixed clients is not broken. The protocol extension is also not final.- fix use of freed memory if SSL_CTX_free() is called before SSL_free() (#521342)- fix typo in DTLS1 code (#527015) - fix leak in error handling of d2i_SSL_SESSION()- fix RSA and DSA FIPS selftests - reenable fixed x86_64 camellia assembler code (#521127)- temporarily disable x86_64 camellia assembler code (#521127)- fix openssl dgst -dss1 (#520152)- drop the compat symlink hacks- constify SSL_CIPHER_description()- fix WWW:Curl:Easy reference in tsget- enable MD-2- update to new major upstream release- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild- do not build special 'optimized' versions for i686, as that's the base arch in Fedora now- abort if selftests failed and random number generator is polled - mention EVP_aes and EVP_sha2xx routines in the manpages - add README.FIPS - make CA dir absolute path (#445344) - change default length for RSA key generation to 2048 (#484101)- fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379 (DTLS DoS problems) (#501253, #501254, #501572)- support compatibility DTLS mode for CISCO AnyConnect (#464629)- correct the SHLIB_VERSION define- add support for multiple CRLs with same subject - load only dynamic engine support in FIPS mode- update to new upstream release (minor bug fixes, security fixes and machine code optimizations only)- move libraries to /usr/lib (#239375)- add a static subpackage- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild- must also verify checksum of libssl.so in the FIPS mode - obtain the seed for FIPS rng directly from the kernel device - drop the temporary symlinks- drop the temporary triggerpostun and symlinking in post - fix the pkgconfig files and drop the unnecessary buildrequires on pkgconfig as it is a rpmbuild dependency (#481419)- add temporary triggerpostun to reinstate the symlinks- no pairwise key tests in non-fips mode (#479817)- even more robust test for the temporary symlinks- try to ensure the temporary symlinks exist- new upstream version with necessary soname bump (#455753) - temporarily provide symlink to old soname to make it possible to rebuild the dependent packages in rawhide - add eap-fast support (#428181) - add possibility to disable zlib by setting - add fips mode support for testing purposes - do not null dereference on some invalid smime files - add buildrequires pkgconfig (#479493)- do not add tls extensions to server hello for SSLv3 either- move root CA bundle to ca-certificates package- fix CVE-2008-0891 - server name extension crash (#448492) - fix CVE-2008-1672 - server key exchange message omit crash (#448495)- super-H arch support - drop workaround for bug 199604 as it should be fixed in gcc-4.3- sparc handling- update to new root CA bundle from mozilla.org (r1.45)- Autorebuild for GCC 4.3- merge review fixes (#226220) - adjust the SHLIB_VERSION_NUMBER to reflect library name (#429846)- set default paths when no explicit paths are set (#418771) - do not add tls extensions to client hello for SSLv3 (#422081)- enable some new crypto algorithms and features - add some more important bug fixes from openssl CVS- update to latest upstream release, SONAME bumped to 7- update to new CA bundle from mozilla.org- fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309801) - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321191) - add alpha sub-archs (#296031)- rebuild- use localhost in testsuite, hopefully fixes slow build in koji - CVE-2007-3108 - fix side channel attack on private keys (#250577) - make ssl session cache id matching strict (#233599)- allow building on ARM architectures (#245417) - use reference timestamps to prevent multilib conflicts (#218064) - -devel package must require pkgconfig (#241031)- detect duplicates in add_dir properly (#206346)- the previous change still didn't make X509_NAME_cmp transitive- make X509_NAME_cmp transitive otherwise certificate lookup is broken (#216050)- aliasing bug in engine loading, patch by IBM (#213216)- CVE-2006-2940 fix was incorrect (#208744)- fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276) - fix CVE-2006-2940 - parasitic public keys DoS (#207274) - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940) - fix CVE-2006-4343 - sslv2 client DoS (#206940)- fix CVE-2006-4339 - prevent attack on PKCS#1 v1.5 signatures (#205180)- set buffering to none on stdio/stdout FILE when bufsize is set (#200580) patch by IBM- rebuild with new binutils (#200330)- add a temporary workaround for sha512 test failure on s390 (#199604)- add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737) - add patches for BN threadsafety, AES cache collision attack hazard fix and pkcs7 code memleak fix from upstream CVS- rebuild- dropped libica and ica engine from build- update to new CA bundle from mozilla.org; adds CA certificates from netlock.hu and startcom.org- fixed a few rpmlint warnings - better fix for #173399 from upstream - upstream fix for pkcs12- upgrade to new version, stays ABI compatible - there is no more linux/config.h (it was empty anyway)- fix stale open handles in libica (#177155) - fix build if 'rand' or 'passwd' in buildroot path (#178782) - initialize VIA Padlock engine (#186857)- bump again for double-long bug on ppc(64)- rebuilt for new gcc4.1 snapshot and glibc changes- don't include SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG in SSL_OP_ALL (#175779)- rebuilt- fix build (-lcrypto was erroneusly dropped) of the updated libica - updated ICA engine to 1.3.6-rc3- disable builtin compression methods for now until they work properly (#173399)- don't set -rpath for openssl binary- new upstream version - patches partially renumbered- updated IBM ICA engine library and patch to latest upstream version- fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which disables the countermeasure against man in the middle attack in SSLv2 (#169863) - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)- add *.so.soversion as symlinks in /lib (#165264) - remove unpackaged symlinks (#159595) - fixes from upstream (constant time fixes for DSA, bn assembler div on ppc arch, initialize memory on realloc)- Updated ICA engine IBM patch to latest upstream version.- fix CAN-2005-0109 - use constant time/memory access mod_exp so bits of private key aren't leaked by cache eviction (#157631) - a few more fixes from upstream 0.9.7g- use poll instead of select in rand (#128285) - fix Makefile.certificate to point to /etc/pki/tls - change the default string mask in ASN1 to PrintableString+UTF8String- update to revision 1.37 of Mozilla CA bundle- move certificates to _sysconfdir/pki/tls (#143392) - move CA directories to _sysconfdir/pki/CA - patch the CA script and the default config so it points to the CA directories- uninitialized variable mustn't be used as input in inline assembly - reenable the x86_64 assembly again- add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken - disable broken bignum assembly on x86_64- reenable optimizations on ppc64 and assembly code on ia64 - upgrade to new upstream version (no soname bump needed) - disable thread test - it was testing the backport of the RSA blinding - no longer needed - added support for changing serial number to Makefile.certificate (#151188) - make ca-bundle.crt a config file (#118903)- libcrypto shouldn't depend on libkrb5 (#135961)- rebuild- new upstream source, updated patches - added patch so we are hopefully ABI compatible with upcoming 0.9.7f- Support UTF-8 charset in the Makefile.certificate (#134944) - Added cmp to BuildPrereq- generate new ca-bundle.crt from Mozilla certdata.txt (revision 1.32)- Fixed and updated libica-1.3.4-urandom.patch patch (#122967)- rebuild- rebuild- rebuild- remove der_chop, as upstream cvs has done (CAN-2004-0975, #140040)- Include latest libica version with important bugfixes- rebuilt- Updated ICA engine IBM patch to latest upstream version.- build for linux-alpha-gcc instead of alpha-gcc on alpha (Jeff Garzik)- handle %{_arch}=i486/i586/i686/athlon cases in the intermediate header (#124303)- add security fixes for CAN-2004-0079, CAN-2004-0112- Fixed libica filespec.- ppc/ppc64 define __powerpc__/__powerpc64__, not __ppc__/__ppc64__, fix the intermediate header- add an intermediate which points to the right arch-specific opensslconf.h on multilib arches- rebuilt- Updated libica to latest upstream version 1.3.5.- Update ICA crypto engine patch from IBM to latest version.- rebuilt- rebuilt- Fixed libica build.- add "-ldl" to link flags added for Linux-on-ARM (#99313)- updated ca-bundle.crt: removed expired GeoTrust roots, added freessl.com root, removed trustcenter.de Class 0 root- Fix link line for libssl (bug #111154).- add dependency on zlib-devel for the -devel package, which depends on zlib symbols because we enable zlib for libssl (#102962)- Use /dev/urandom instead of PRNG for libica. - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c - Use latest ICA engine patch from IBM.- rebuild- rebuild (22 wasn't actually built, fun eh?)- re-disable optimizations on ppc64- add a_mbstr.c fix for 64-bit platforms from CVS- add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged as not needing executable stacks- rebuild- re-enable optimizations on ppc64- remove exclusivearch- only parse a client cert if one was requested - temporarily exclusivearch for %{ix86}- add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544) and heap corruption (CAN-2003-0545) - update RHNS-CA-CERT files - ease back on the number of threads used in the threading test- rebuild to fix gzipped file md5sums (#91211)- Updated libica to version 1.3.4.- rebuild- free the kssl_ctx structure when we free an SSL structure (#99066)- rebuild- lower thread test count on s390x- rebuild- disable assembly on arches where it seems to conflict with threading- Updated libica to latest upstream version 1.3.0- rebuild- rebuild- ubsec: don't stomp on output data which might also be input data- temporarily disable optimizations on ppc64- backport fix for engine-used-for-everything from 0.9.7b - backport fix for prng not being seeded causing problems, also from 0.9.7b - add a check at build-time to ensure that RSA is thread-safe - keep perlpath from stomping on the libica configure scripts- thread-safety fix for RSA blinding- rebuilt- Added libica-1.2 to openssl (featurerequest).- fix building with incorrect flags on ppc64- add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's attack (CAN-2003-0131)- add patch to enable RSA blinding by default, closing a timing attack (CAN-2003-0147)- disable use of BN assembly module on x86_64, but continue to allow inline assembly (#83403)- disable EC algorithms- update to 0.9.7a- add fix to guard against attempts to allocate negative amounts of memory - add patch for CAN-2003-0078, fixing a timing attack- Add openssl-ppc64.patch- EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(), to get the right behavior when passed uninitialized context structures (#83766) - build with -mcpu=ev5 on alpha family (#83828)- rebuilt- Added IBM hw crypto support patch.- add missing builddep on sed- debloat - fix broken manpage symlinks- fix double-free in 'openssl ca'- update to 0.9.7 final- update to 0.9.7 beta6 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)- update to 0.9.7 beta5 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)- add configuration stanza for x86_64 and use it on x86_64 - build for linux-ppc on ppc - start running the self-tests again- Merge fixes from previous hammer packages, including general x86-64 and multilib- rebuild- update asn patch to fix accidental reversal of a logic check- update asn patch to reduce chance that compiler optimization will remove one of the added tests- rebuild- add patch to fix ASN.1 vulnerabilities- add backport of Ben Laurie's patches for OpenSSL 0.9.6d- own {_datadir}/ssl/misc- automated rebuild- automated rebuild- free ride through the build system (whee!)- rebuild in new environment- merge RHL-specific bits into stronghold package, rename- add support for Chrysalis Luna token- disable AEP random number generation, other AEP fixes- only build subpackages on primary arches- on ia32, only disable use of assembler on i386 - enable assembly on ia64- fix sparcv9 entry- upgrade to 0.9.6c - bump BuildArch to i686 and enable assembler on all platforms - synchronise with shrimpy and rawhide - bump soversion to 3- delete BN_LLONG for s390x, patch from Oliver Paukstadt- update AEP driver patch- adjust RNG disabling patch to match version of patch from Broadcom- disable the RNG in the ubsec engine driver- tweaks to the ubsec engine driver- tweaks to the ubsec engine driver- update ubsec engine driver from Broadcom- move man pages back to %{_mandir}/man?/foo.?ssl from %{_mandir}/man?ssl/foo.? - add an [ engine ] section to the default configuration file- add a patch for selecting a default engine in SSL_library_init()- add patches for AEP hardware support - add patch to keep trying when we fail to load a cert from a file and there are more in the file - add missing prototype for ENGINE_ubsec() in engine_int.h- actually add hw_ubsec to the engine list- add in the hw_ubsec driver from CVS- update to 0.9.6b- move .so symlinks back to %{_libdir}- move shared libraries to /lib (#38410)- switch to engine code base- add a script for creating dummy certificates - move man pages from %{_mandir}/man?/foo.?ssl to %{_mandir}/man?ssl/foo.?- add s390x support- change two memcpy() calls to memmove() - don't define L_ENDIAN on alpha- Add 'stronghold-' prefix to package names. - Obsolete standard openssl packages.- Add BuildArch: i586 as per Nalin's advice.- Enable assembler on ix86 (using new .tar.bz2 which does include the asm directories).- make subpackages depend on the main package- adjust the hobble script to not disturb symlinks in include/ (fix from Joe Orton)- drop the m2crypo patch we weren't using- configure using "shared" as well- update to 0.9.6a - use the build-shared target to build shared libraries - bump the soversion to 2 because we're no longer compatible with our 0.9.5a packages or our 0.9.6 packages - drop the patch for making rsatest a no-op when rsa null support is used - put all man pages into
ssl instead of
- break the m2crypto modules into a separate package- use BN_LLONG on s390- fix the s390 changes for 0.9.6 (isn't supposed to be marked as 64-bit)- move c_rehash to the perl subpackage, because it's a perl script now- update to 0.9.6 - enable MD2 - use the libcrypto.so and libssl.so targets to build shared libs with - bump the soversion to 1 because we're no longer compatible with any of the various 0.9.5a packages circulating around, which provide lib*.so.0- change hobble-openssl for disabling MD2 again- re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152 bytes or so, causing EVP_DigestInit() to zero out stack variables in apps built against a version of the library without it- disable some inline assembly, which on x86 is Pentium-specific - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)- fix s390 patch- added support s390- remove -Wa,* and -m* compiler flags from the default Configure file (#20656) - add the CA.pl man page to the perl subpackage- always build with -mcpu=ev5 on alpha- add a symlink from cert.pem to ca-bundle.crt- add a ca-bundle file for packages like Samba to reference for CA certificates- remove libcrypto's crypt(), which doesn't handle md5crypt (#19295)- add unzip as a buildprereq (#17662) - update m2crypto to 0.05-snap4- fix some issues in building when it's not installed- make sure the headers we include are the ones we built with (aaaaarrgh!)- add Richard Henderson's patch for BN on ia64 - clean up the changelog- fix the building of python modules without openssl-devel already installed- byte-compile python extensions without the build-root - adjust the makefile to not remove temporary files (like .key files when building .csr files) by marking them as .PRECIOUS- break out python extensions into a subpackage- tweak the makefile some more- disable MD2 support- disable MDC2 support- tweak the disabling of RC5, IDEA support - tweak the makefile- strip binaries and libraries - rework certificate makefile to have the right parts for Apache- use %{_perl} instead of /usr/bin/perl - disable alpha until it passes its own test suite- move the passwd.1 man page out of the passwd package's way- update to 0.9.5a, modified for U.S. - add perl as a build-time requirement - move certificate makefile to another package - disable RC5, IDEA, RSA support - remove optimizations for now- Bero told me to move the Makefile into this package- add lib*.so symlinks to link dynamically against shared libs- update to 0.9.5 - run ldconfig directly in post/postun - add FAQ- Fix build on non-x86 platforms- move /usr/share/ssl/* from -devel to main package- inital packaging - changes from base: - Move /usr/local/ssl to /usr/share/ssl for FHS compliance - handle RPM_OPT_FLAGS1.0.1e-58.el6_101.0.1e-58.el6_10libcrypto.alibssl.a/usr/lib/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i686 -mtune=atom -fasynchronous-unwind-tablesdrpmxz2i686-redhat-linux-gnucurrent ar archivedirectory?7zXZ !#,‹b]"k%.?Ur8};y\~݈(HQue X. 6z?KKc^e`lՕԑgg4P=`lݾI_IȾ[R<.V򱦪%Am,aƣ/YGQ:XBEC:Qa#j/:c"|Q|Liv:ѩt2ʦ%|"vQqcx)_U K"NWE(5mB=Qi<,qVE \R̪*qħ(UݤOw_FOfXh($!^h5jAZ~1+ylp$jOKvEPfڬ4)K,6 6?rK*@@OT:y=莓9ll;~VCsϻjEۀ8VRRwvv%~7fne?sHLtm<+ǔ0>c]?e_YPa\Y.  _K2s`j\,)yBdh|SNj_3hOMZg=`N ⌧jnop"~ؗć-jc&[TF̆?l;lw\8k4:Dؑ=- *0' L%NQ4@A`oY-KXo A <+LGW>jpud.xWs',D|-O@Hƿgdܙ.q]=`=¿- ;Lt R@k-1N|+ϔ9OXGU ZgO֗Sx!uCb[cV p,b*|f:qäm1t*Ϛ~A=LhBߑ019ꟕqC)B6a TG_)m]̡j%Khc(u3dNu&ZDMںp(P, 0BHj_ a{RWJ1D|A¤ e/DYLْCsî(9"Ax "j.'uƴ8I / vddlfE'5ΕH^kyJb&>uB5}0Eg?Xm0H^O3utB`mz \~^`bC:vXNf.G3#&/YSo-z+ON1۠b^0BcOEZ=pq0ʥ'6$UeᦖdA&#~sv[U;0RdֺЯ:]- h[)06C O< `UwjLA`{GӞ#2V.xpE v-+ Ķ2Sq&'"&v/иPMnxpnV:d)cSmS³ENTk/4(Ƭ'rEY)FD܏\C)@*uINR4"tV Zߢ-bnj#gD[ﵴ8hwo8;#"7|Qk}h$vπpTarw: |}lA)A-b})S_h՛6x"gɿRI3"$R.ֳ+Zކby?sgW@ 1*>MV+ku!S{~ybjVq۰c怣 /܃F#<1:LS)k𙯌o'" O0K?Fĺ-`i<[!(z]aP-Oa!{c3.3&Qe'#GbҸџ?.70a@NA vS+Hi5LL ~zfDQ;`riLj,_:& n6RS)Qƫf#" 0 paqAUHiyIUɰ6oZlĦ8_d Eh+Kel%+xz-u}[B{vCbd.KO~#_8YW 'u)R*@udFQ&4P:վYYpV36.G6hi>y)dFe- XFM\_튤(4pp͜9J !^Lol5v[n\ͤ7~%hڳ{]wJroC{Yuj9"aY&…PUTZwxzUZX=4[ŭWj_3 O aK,zVEܺr+vAFۆl6L {sg;Y@)Eh#g%=<{l5rըϨ2=IG^9\C,O=\Y2}}T;xj)c=q,LܼwvGMQU  ‚)a"3BS Not2 "wDHk>kd BOql\\sFî\Ţ#U?OMҺBf @ Q͛[w n 8"w|LvZf &S=B|Il|Oʮ_$Hh~a&C=yy}Mm^3KsZ A^Wgæztzuup;Yߴ-M/ ~}gBWiT'#G&s%*f mtr0Ň &…ИJ~-:[ݒ)z/Tr4 ;@ئg֢Kf#+l4Fܼ8 x皎Bx> CCl/٢JA 3졺)w@G{R̃jn# "?IwobI`a~EO+L@5Nٶ x"^M5sqDx0kr4c٦A\Hf[:o(H$7=3lmU{YW^|:L!.YaKez}Ӗ9 @'ԺhѩH,潸5ğeTUsg[uTem~/`Hq%i.O!)g;|tUpv!hfjA#NZwڝ1vn%8߾c!/_aEQCZ= 1FDU^$kŜgVPT9VxzRgR9ϕ{"5@NRr[@Y6e \zHX()ouj*/ Ms&\IaO%( .}JSh4;A?js+-0@(!5^>}C9+$1O؟~+W,MD'& !5)Ie'ޥ,l{Ut2eM?iJʄmDX:c W3Gl6q|\_Iyy'#29V&T /$oSf[4# a.@q p>",:UQc=kEI25a˹\CZ xR^c(X-|̓9^g9MblOHDt :yb꾿G@8 [aM1M'愜@Pl~n]D`.? R˜x0DznwgH(e㩅ŀά9읭ޓ&{ӯky6ʄ' )/mq?n:$h Xc_%" Ub<%r v<)?پpj~Xِ39.'aXJAӕiXW,eiT;Z$߈-xBKM0&; <4FE$n d\Iߍ~3ufZxev2lsqu17ǝHģBxS / }/D/AFHkvTZ?/#ٌW pg]޿-]DC*"9Tkp:?dwhM3'11,= n]Fv}rYۇ@٘sI$}R#t -2Y1`z< YZʙ Q959#HP\nr|dh0ӡjp[Seo)'y~5 Ʊ kbMru=5D(K iz֛& jOvQk xa3NE.7UMuk"_1W/dlM4;_m{ͦQ"_=^{lׇ`w6%J)PkM<|XA뺭}or+t$o3n_v|vYp[dhHZb=ӎKٷkcOY0Z{o{O:MS *_W^2z lO<.!>s[uJFÏHeQeݪnOL4 yf\ꑛ[q QҸdaFbdŘcX,~0_0G9O\\Jh ]+OH˙W?ZI.}NUM)aB o[9,6Ctnu /qRĵ]3Ky1~MCՆ_ΠQ PU-b2d'F^m5d;i@gS2y7h/(ĶɜGJ̡iYeib%&QH'3n wS8}Պ  i[[l\6QnA9FXc"fҷ/h{VT\{uR| eYs8;ҟ)I$ξy7AqBAk0a&(Ygue?rmJ>n:dQ5}~H]6~Uxg-~ZA%wAdO#3=IToU~;hɇe^r身NkQ>@aNC"[P9_` ݙN$K>x\#1 џAyU^+x8}9!RĐf_LR3~@{ )V5^%Qi)r.W >0öf]w Kz[Df_7 ;^"q&hl܄͞~h5@%ZvK)QR1Gi˛˼lE*m]G^C ?*$6oj!\EEBoAIшٺsSbG_)E?mn|#5[NLRK. :?Vݳ]}WZ5G&ɍ!d-mhEyN fZ`c 4 {)[S /fə UUTU:h9p%r{1}G; gi߲ٝ%r(~J?0))RY+CL\4e&5̋RƐ=k)ļsbvX(Ϲ_FT#^x^gs UY݅pGh6~s qQ1eѴ0Ua5ufĿT|WjU\-{c/ҸHƎCw|8z?^yeHzu*εb 又hNP$1Nw) M!nX y Zצqu@hy ("ov,!%kШveiɤrmjyE?Rk&ߔN1hwG,*ng5#ߗwUwy\c+N,5=aCZc`ZC 1HG oy|E "ͩa䶜!z[6kRgAlk994\S6l7>H dGۨϵTv 4T~ Lw ׉YoiqJ?+2^+v;qwL i{"@o1"U sO&x.E:3;UQ usfoߨp`ېį&0sD!hd#1" (4)XcbX \ vF8o,-Ӆhwen|Og]U:g,|QfZ08"sXuE(}4Mȏ0'eI=KD }kU"?=҉ $R6 "=/@!B"¥ޞ2@|kAі~ 09s qoD$k蔐Ĥ%LxΝr*PI_ΐDH!tzH33*"HfWq_j ތu[YȄS,mIYfr?5piWC@X+B.W9md @,/ߙ?l/IF> FDǹxMuU$}up0:A,{u9·`d~z4?Q.*ͮ>?kP:Z8O!)&A-Ѡޛz<7yɨzCݓ̕:\U(y * 7rS'zF85 끊xK9{#sU$F\(~ Qѽ8ᅃ!$,t̸zkeiS$cJ.=k"U+e(u&7"ۅ>l,_J=  㠼!V딲C;_D3P8v) 8܎@5V 33Ƅ]"t~8.@vJ4wn )U%Y|7W>.zK'vcR!:K]ָs[Vg oԢGR+#!݂s!º6|? ـ$dSKwB %Llti޻c">s}{Ssm 5CISV\8a]ũTSY{Z6U4~ S66|>0.܊pU44{SClt~@Kŕ&~ Tn51sFlsŃo b MaD N) bHSѾ5φ)\у~Ω~vF8(z1=!i}(]$t*C7iWRZCȔ3L(Vڌ~7%m}`o3aё 5#7O7[L^5[Ӗ uIf)Eu~Z 2hPQdk~@HrUxQ7~ jj!aO^U|i~@p;i˩4}gU,qV%$N x/B`OR ;_wڌZb:iQ`4vP X"_TGCTOƣ#Z.bFP0E.mIҫ Sy2zϱ`>m֜&Goۗv}g td`)`Uw8Q38di䬝EiNS+'3F)Gդ47IJͭi%%7bMp:-!߾˽8ѥ .b?o| .\FY~XZ:8zU5SkkŨk[$•#zF,&4g3XVBrN<{eWx(c;iӻVզp)UZxl@*d .Wt99&rnT=o 'P4i☌t}仁ro<|aJQ*Cwqױ?rޟ-:V2 xh BF5dd׏Vq5' Gty|w$D3VT- rRF@d(q,(FFbe!b8QXk̹ؖe0:3z,+=6t-v@H$u;r. eJz39)R5$R|̮Oѧo+B:QG׮B y*߃$edS촻\*=VV`݈ s=EQy>y_rcyRU~;H4{{Nm ɞ }=aIfȹzᱹopYסA3u'gq*|D,-XtzAIJ"'J } }'Ѯ'9V)ߔSL?8HU$/InL:<>aIR,S.X*XNC㙼ȳPLC%,ۓƟnֿfFːADb?lU~/~ZFp8 2ebKѹ5ڌ D:c)@;ԬkZ ypiAw 9#҆сh-9: d53Dk(&s҉aO}ТqbͧIOǤщzlkBWt-öJCejKfvz" S}>мfףj23mjV2LJKZ5"xK'Hp[qDp"@m̺/ZW؇x] '+%HqQpPlgzO@NJyGu0} S9Q|27,ş0/!әryxd|f+ss5>gh3aBν̙*@pC@ 0M-Yz 3֡r[tldv4O)P06IB@®g@@(hm~AU!΄f >s">Y8 w#Qd;1 _f'Tqqt`4&~ntɜlmU*@*;Ghsi,3B}StCܼ+颻7Tv~oy Pqr4E逡O2Q̳=]F)tKD|ԌP4WZlHs?pE\X.b_SwP}FYlÙMr֠b _e4EEЇ%pd U6Mp+`NOw ax鹟X<(&$ytz;|zߊR1:#Up~P4CQDp 3S@VU6a$78=hm?3NVnJDLM~S$6ԗz: sRc v`u*NuD[gfA6&7l<. n`X%oxy:\VhmWtQ^Q7}3p\ⴗ֬w\l41*gݏyĉg:mSF| XE rx;ík۳}T)[9(uK!,D/oƚZFAqmR7){3m.V0z}[hz_xp?@}9-zͺu9Q'5\M/,\mjì54eEoZ~ܛ}MKgs13^}&)\lTV-ь<CX.奕}U86lJ+T=6UUo;}b蓼,ͥ1hU!nJ1$IF #PuJͲKRP:W~D 1j7qyK,b}S~DMG`S[˟/ [ʎF` =O^0.ɋ ޥ##7~ZN5wC%Lˊj(uLjtYwМ)ʼn, 5Cgf%xAy h=+3coյ Li q_, w 0n+vZ?#DʸD;g*UKe`Xb jiO%?='s>vL y\" 6Y!V%/¡9K̏;\(Z >T= mVÁs ZF P,!\+F=o:MVT&KC}#5gRFO\w,E vvl -{ש\Kvce~:da,řou+5M) o|*43fȨdXns.`^kzBhODJ:u 2ClDG_7Lr-C~I^[ +Mf0S ObN; n#LDqwQ/؏*hm63l[l߸s; _xC7.l_VN9{}ß %CpiBqiV 盠$QLFg2V z`v>ŵ# 8YzOI'`u!;mBwއfzxAK'iq‹z>?c`OEqyH.C7X`+rZ/ЖjLK_PeZ3IAŁqܡG;/hS*utx G$'e%4,ZveI+CDN;Fs4 &1{IWé>hco"mH@1|[Y{`|9lRs GۨJPpr]E_RfUNm@H)愽kl%|ڔآNh JGWضVc3AK}0 ? 7FL [V9w#7ӻ{R都^jg˖&gY[GeVvcNkYɚ+p#b|{у@Vm}BGx_? U-=mӅ͐|Иi]lb-eڛOv84:k_ :d@ <92d.kFǾ 'FF_'Yl?T$@$H}3񱏆=a)Ш=!LN1f&Yls>1 hO|I"8,{ODT;BC]RD< yI~ XJE2mLJ WqGVcdt_.wG|V_Tn2.b:8׀6<(Z Hc^;E-{:̵+)p h1+K5.Yt{4IZA;ƍkfdHF:W(a<]Q3swF,A/)^"Opm \*GPDG_܄u .S[ۺ#5N JPPKTpdfA*6yN;i9͇n kQ …v^eZ!ihr"QxM:A~| %5QyoCzDɚܪu_ZE@l9cJhڡcS!uy6@q'PxB{_ǿ|TУ*@?JM`X.Z׶s͜Z[%3&o;\5bȖ6NWv`D,yJ~񉹽2UH {U`aT&x$xY ~)&cE$ySB 6uȠxumgl/^r[O@!4+ת:/ Fj+d 7^/H8@%ax R Y;BDѴO^;:q0Q\b V@Y H26%#J~XL${P A@V[Xbi,6R{iҴtA5kqfB%~,ݠm_sѱ6Im|)" i{lq\6j˹^Qcg-8ENk oǟ:A?hRT)HmKXN#lFtm 8X ̋ Hz 8KHPy?#d  *N/2pK7 oԼ>_6+ t4(_Sa bi9Tx J5+dӈCPKo@PҢ6c/RID2wQs"J#2_sFu@zH%m|R})DL={q8F5]472[7 jMy}T9f\,hmŴd9һ;؂w#HW<2SVÚt躀?`v8,[ a ö3{SN0hV3FwV0:7o+TFT?nv:']t_; x6bBd3՝+>kXD"{VaF)hanB AhVV?**d;u[Ùa7qf9ciıL]yXi/ @qDIӪ9YY٨_ 5&bejKkOǹ g-8Y.7Řqį!#Kb3Tby;mF8N!T#= jy,g$ 3_hi[{*%!-6 LρSH֊ɇվ"a"j 'FmpM6v%D,T_dAؽ$3$@DU2yDpd[DylIdz>9=z1HCMuL›:;~j]l;Yf]\^zWҀlպ JzEVgi }=AØq=i8Y NGݺViji^ꀔ 2^^L3}/WlTBQ)cOM/sKC(s0B_Js;eP.Uaa|V:q,r88&S$14J N'M.X,Dz۲ [5c/Ba\ygG t2P?Ld@ L)2N:ye[Z>vOuJ y;;wWѶM(71{_m)EfDh|ҳ& ƻ.cH REr!e9?YC3q{ Oɺ2tShM!z1& pf*p~VHqb`CqAL}s[ayiu4ۖ;a@+BJT֔ 5/:3_;gctC E,>rJ<#^x$Ekb/Ww c- Q(BzcD,LzO͵EbC=i P Ե{`;uK{Y?n妷֔4u%:UϞYY*mAz9#בU-K rWz=>, ?j~al?;OiPzyTW|[辟A_Ng (s>&1ԣ8>Wijk,Z"` =z_CW yxۇLv vmZEoS;Z?e,j$M6^oզ𩹣Ҏ)oۍ[ͫtE$0ym{Η[3~ƹ9@JNryI" \~KY$E᡼0R0'HoGA_N2k>FW@DtҊ ( @U˭&q5Qbo߸1Qu\޺pvbV;4, 8cqƝ9~) [jEnmdܼIn, %H^b>s[SFY}oibx?VRGf”oUh6s2G)DAr:tm[L/(bʕF!,B|mX], tv=zye:'RR\z ei'| nc++Ki AYOnUqbSq8p%0Tk_|;I"p]/c[MEvд0J )ƥ oqٽac, MucfkQ*Y @3/XWRlGT79ϑ9!qdtǩcY7]N!<.)x%,-6Dq uzD`0ÚDnlۃբa!E[sǏb%id>#ǝ0Xp rZ5 (ziӺׂhSb$juoZ^ 嬒m4e!B*%׽;RۇvYQw Ғ|RԨ?f{u8AeRJQ2 <9>(ۖUs'0A!ov-Hpɲ^<.167DT1v}e dIp(~SZxG&he;bN-ք$#Sxvu4/"#ꁋ_+1Jٕ[  'Z֠$9(Zl5 "O^K[ ΡN6e 97'_7T1'" s)( 8I'j ѭ8[-v!lc4lIO-ԔsR#Ųf;M!NaRK-e`4ՐpjtTi#?%%C>˺7f*t\"/z<-fLWZG%-jU wC%bOHQ/LRB"(;Tcۣ8SgGZ_ÒJl3 }U|oS] #jף4;D \Jgv&hsW0tBc5ؙIEy |AX&?뉯`&^ƄnEe.ΔcbBkk?qCʧ1AؤaH5D 9,$0r*$m#3J-xmx_A2Z\OZ6IUש x5+vh3i2(51^t종Ћ $ mTgH1ub. FiV"jE-'`6Iݼ⌈Ӕ|ttoDZRah5Bier Z3*KDkP8̸&%e#zbBu ::lVK[Х69\6 ]=*zX$Icv?97gsb62 SsώtGf4zYR`lXHt}*S*FDDQKjWhmr5sbsf~"{O58~~q[I$8"/vQZ6涍uB5䱑~Dÿ>_#Ixސݪ˿f%U`Gu38S1٢J™3A(7j3Qw:ULQ)H|xnr Q\v;xinȳk$țlrѹUgE~pB}xЖs@Q+Y'C /§zi1d0ɏhfxuTha*Cg}5"ӃֈQQhx@8{=\f@jX%q>AοLU;C  H$9O"+ LHlB sɳщTWRx؟m ewr (C/u:ZJpo1<'Gם]ً_ ?=wܙPE ȯںwn]r52W>f1O7a̝,AjtD%!C!||y;KD}n꒓B6$~ K4m&kemq +dFO:T%lC}V&_v51 z%`E@=KLߌvJ'n.<4#(T 󥁌td~Ox4b/%HC@$֋M4| *co}ZZ6:@(eq 6#txz.tTw!+=$?講3RjT~×|3jXے(Ee5Z'# tK]ٿXq+H,ʀ!}8>nsT(PO@QhM|in*D1Ee^ [B'UVxm|ZoYreA٦WՠXr0d(9e4uXv*Dii=qD}4XhB;sGLQ St߲$X5Qv$p$bf>(Gau(2[L/9i3S`#0Hd,8-7Nzƣs`"<jޓ&9f͈L 0zygmtqGmcvoHG|rb i<2?FMƜ(Cqe1ӄ_M11g_Q#M*Mk|mf2:ڸ6nrk UO*LM7rVZ\U E 1Uk߆]엁0:4GniTIX=Dq:#ž"^H˯ҋ?:dG[JcrD 7 kXCi y̝y%AwOTo6Ĥ]"4'30B6iG}tȮMd]xz|_}Td..a!]a7$Ÿ͗60 &p 'w\:i/%Dk̛ư!P25^̕sʟ]VFrUNOheY:0wr%[7/f24ا&ù]Y#ubVV%{Syj"X9S7{!+O3I$X@/XJ;~GPʾUDt"l9 Jlв%м*Z!Vvɯ)S`TmTآK h\1KÏ6,d$v7U07L^>6@^>mZx51VrOzgs7dG b0E]32C{"ϒ4hWtK4r`D&_&Tv ?v%E !6  BYYDG:9dH.߲B~׭QTn4L?֩O"OR6>bt (GOYFv4anÊe8ؖ-dˑvSU龪 Z2kbǙfi.*^>bR1D~ NNHlDxGW&k/el)ަ:~]pNF/Ql͜oFOkt{j=A/E[0aԥs;a)د5ءmML:]OKi~^Ee1d` Mj嗭5viL?UPU,Lv??q=^:6`Zˡ82>%9T.m=vCLn-+o-?H?&ϫn7,l"<9;$kH=<`p34\|R)=L RZ)AɩyxMX^l{`JlgFgZ+rh^~`}9JAid"Lxx3x@dG19d tl *$q@Jv.Ix)"2!̼ό_gk9@wƝ CRxowBl $F:I ,9`Y$߳ۖ3Ҝq){>&J0贺&8zYu!I@q9W 6эߜR4{Sl8WyXË[ȑ"W@SQZP*4f@~8BGF)y4M$&dݟJI FPD&y#qßn:DPr,xiNwCUQ飧̷ed׸Qֵ\Ů]HvCvCt7IA;uGORPŢNM{6Wkjck"ppQ 2XYJ]oDIwk-jJzH%>\ʨ{r< <2 0R\I?9P _NTh>/])"<(e!T~Nb t Ch(/;b݂ ER`CTs G(Xa&v bW1b`΁ cn2iہ!Hsw>@~+ށjr|l?1@Ea>g\'wfJ][SeE*Gӿ[F-6#f4f /|)֓DHL5βe{{UaM˃9vN}V W(FWԜ@)}u e o8?,=Z}QO>O4g@K $.N t͍CMע,&v4F2-oIe;VO!gN&eѥ{]48Z'&}A>ZuFH&*_!ȭF Hn}SBCUwɾ@Өd'F1,oM 3^mܗdZ/0h[ôo raIBcwR/Z0 v/;sb4+;n7p%Ivfc8Xߩ .Փ"^aFJ;9ό5)O .aFm}b)EyÞa1ިk;K'djͪ+`mƣق&s՚!H scԽRW?t͇m<@RYwɪ VPwËJϤw]fkp_XxxAjjl'A(Uu즑joQg_O~^ENOTrܔV!!Î`uO0 8bL47,_"yVf8w,8AEK0ohH@ǯ%Am^ѯ}%^MWZ=t4po%Ԫzf8B6<ދYӞʀSDS Y"ZXϺ1ױ8^_KsSo*meڟ}Xke ?ٿEHwJ\'}k&obHfbzdffzi >碔L&..Q]cٺō 1#MaįLx K|_afvk۪-W q5g zKL.e{83'WX#\em6/;}B՘U%oa vDx,H~ S*DŽ% n#nK W=y8pot2+w&a W9oB ^(Xmo i~O+y^LIr$$#lquز^ q܎ÇvJ! fX7rU?C A+HN@|LI8Qರ.XMt] %⸤S;=~y!ŌXFz$9^wtxIL+m<57'X~Ӳĺ{^QK[i-RV3Y/X-g{x T"t2() w8=M9O3dh>CmTl-fXUXI p!򊨊d{Eʅ4=#敇={)Ҙ{֊ &Y/!lu#k(sgu$yrri34gPt{!j w?!Ceװ VlgcԀFQҫ5eeUW40P4]7e!Un3d` / >~>calv%h,L*39NVfuIpM GKYP==DekR10pu|L8j)l.Kz2E@ȏ=;$J+]4{*]B8d+σqR B^e&8.n`KBp Ol?)l9w|^Aٔχ$M[<*~^?PvWLi!2\ 'a-6Y:Z)@baJ)bMS!!bnD~۾M _FG d,Pn.B!}\Ysl9f)1acJ!!9wH"ш"д` ,u09i^vwX{x掵A4:Qz+zdEDQ,'UúfZ7}tL$ B.؉f [GfYESmv7?{hq7oIa}-dpO&Rӓ_ЙXw'_([#[r3XG,(5):tVڱ ֳr'}-yfU {unR50XU~b =GUb VYI>n&M=IkzV0rgJk! Q⧙lT}6fh,T;HHǽk(veY0{3s`+Yx#&<+Ep5S$׆{8۾>gz|S'ih 'D kr~ Qt3X(޸Oɸ熣' (mEyHA9b.I<$FEX&ZƼQȴė}U?)7 jN5 auƸ%gtK.}+*☏#LYohdz)H~aΘ /Ԛ aM0RײFl=@EނBiq¤0,;#a+_!98\pPȟ FaSH/l7$BzQm5$?С̳By'v\@xTҙ8RV?-fbc=)c@zCdn˞U>7uᓁE È'oT G{J˶+cyNsQջka82^\@!fƢj鈟 B[OM'T [d"Lt)TՏ~F i#ؒĵ̋`dKmGv?+換{o$5"ƁƮEQʼn}}I*9QC ]^%4݄h 4shpW.Mӑys1+RyƴJYɧp k (Gʫ;`QTm:hx0)CAcXHY l+~Y` FE)+2* C1޸YO*O W^?<4o8s#rw߷nc#܋G{5yiG?SQi ؝t*_\!sr |3[KKN2 ~%:93rDB\t*ö_b{"[ _}I/KxAyYP~rg P T@kY~O|(}¤^f%f݄g"Iõ?ky&g.қ~ZA;}֧;v/7:!WhͻG@:Y%o =;i߇I%`[4JD]k:hNR0#S_PVK.fu9S Ys&CR6bXU}]L{.-V^9!jIq!./+wO`TfVKSwaBH"񜁽VMX;IZ ;8kމݮ P6LUUkvH3mIB` r| {kZ+\5C?F)'%nog05s=_B| ܊__~ レbDTv5OHWS);VR;UiD[WUdɟL)GaXA|~/`ڮfZX9C\ޘ.Aws&K)솑\HQ8>MCĽh]+ yB/Y0&. CpÂQ`;cdz(s·8,N~Oߴrp͝yۢbkPK O e\<Ĭ9qC2T7C> _+2,8I"Nb3ghl4I am-aWY NnH4GFJº0ճ4ǓE&f=f!@1Ăp&F t5Eگ9ˊvCO\Jsq<?= ƹohka|$q2,=b뀴`|b3ębov1 4/J)M)^_jMMr9c8}fv|{"rDF[Uܤ`7k ]R\۷͈,h7D)ړ𧯡ur[ՁZ颢̝ίmT{SDh`ëV YZ