pki-base-java-10.5.9-13.el7_6$>*tƉgpu,ٗ>7L?<d  D          % ,' '  '  d'  '  g' P'''r'0@(38<9:GG8'H'Ip'XؘY؜\ج']H'^bcd2e7f:l<tT'u'vތw'xߜ'8Cpki-base-java10.5.913.el7_6Certificate System - Java FrameworkThe PKI Framework contains the common and client libraries and utilities written in Java. This package is a part of the PKI Core used by the Certificate System. This package is a part of the PKI Core used by the Certificate System. ================================== || ABOUT "CERTIFICATE SYSTEM" || ================================== Certificate System (CS) is an enterprise software system designed to manage enterprise Public Key Infrastructure (PKI) deployments. PKI Core contains ALL top-level java-based Tomcat PKI components: * pki-symkey * pki-base * pki-base-python2 (alias for pki-base) * pki-base-python3 * pki-base-java * pki-tools * pki-server * pki-ca * pki-kra * pki-ocsp * pki-tks * pki-tps * pki-javadoc which comprise the following corresponding PKI subsystems: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) Python clients need only install the pki-base package. This package contains the python REST client packages and the client upgrade framework. Java clients should install the pki-base-java package. This package contains the legacy and REST Java client packages. These clients should also consider installing the pki-tools package, which contain native and Java-based PKI tools and utilities. Certificate Server instances require the fundamental classes and modules in pki-base and pki-base-java, as well as the utilities in pki-tools. The main server classes are in pki-server, with subsystem specific Java classes and resources in pki-ca, pki-kra, pki-ocsp etc. Finally, if Certificate System is being deployed as an individual or set of standalone rather than embedded server(s)/service(s), it is strongly recommended (though not explicitly required) to include at least one PKI Theme package: * dogtag-pki-theme (Dogtag Certificate System deployments) * dogtag-pki-server-theme * redhat-pki-server-theme (Red Hat Certificate System deployments) * redhat-pki-server-theme * customized pki theme (Customized Certificate System deployments) * -pki-server-theme NOTE: As a convenience for standalone deployments, top-level meta packages may be provided which bind a particular theme to these certificate server packages.\.x86-02.bsys.centos.orgCentOSGPLv2CentOS BuildSystem System Environment/Basehttp://pki.fedoraproject.org/linuxnoarch Pb !& #-+,).*)&##"!81;8+70#%A큤A큤A\.\.\.\.\.|[!T[!T\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|104e693105a0f33323a500b28140eb73edbddc312c59aff2af732bfcbe4c468394551476c6e1669c47fcfc7410317b2cd505bfe5c3ecefb1e74fecebcf90f871b2df657063377311c021e0fd7006b3ab5ad93e365860dc3ecf68ba0078a90481fdd8d5ef0c8813c633e77997d6dbe23557a5112937962d5ab7b1053de866027b643b71cec56efdc737a20687bb05ccbba40c3481b2c0e100ccf53331e0fba620/usr/share/java/commons-cli.jar/usr/share/java/commons-codec.jar/usr/share/java/commons-httpclient.jar/usr/share/java/commons-io.jar/usr/share/java/commons-lang.jar/usr/share/java/commons-logging.jar/usr/share/java/httpcomponents/httpclient.jar/usr/share/java/httpcomponents/httpcore.jar/usr/share/java/jackson/jackson-core-asl.jar/usr/share/java/jackson/jackson-jaxrs.jar/usr/share/java/jackson/jackson-mapper-asl.jar/usr/share/java/jackson/jackson-mrbean.jar/usr/share/java/jackson/jackson-smile.jar/usr/share/java/jackson/jackson-xc.jar/usr/share/java/jaxb-api.jar/usr/lib/java/jss4.jar/usr/share/java/ldapjdk.jar/usr/share/java/pki/pki-certsrv.jar/usr/share/java/pki/pki-cmsutil.jar/usr/share/java/pki/pki-nsutil.jar/usr/share/java/pki/pki-tools.jar/usr/share/java/resteasy-base/resteasy-atom-provider.jar/usr/share/java/resteasy-base/resteasy-client.jar/usr/share/java/resteasy-base/resteasy-jackson-provider.jar/usr/share/java/resteasy-base/resteasy-jaxb-provider.jar/usr/share/java/resteasy-base/jaxrs-api.jar/usr/share/java/resteasy-base/resteasy-jaxrs-jandex.jar/usr/share/java/resteasy-base/resteasy-jaxrs.jar/usr/share/java/servlet.jar/usr/share/java/slf4j/slf4j-api.jar/usr/share/java/slf4j/slf4j-jdk14.jarrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootpki-core-10.5.9-13.el7_6.src.rpmpki-base-java      apache-commons-cliapache-commons-codecapache-commons-ioapache-commons-langapache-commons-loggingjakarta-commons-httpclientjava-1.8.0-openjdk-headlessjavassistjpackage-utilsjssldapjdkpki-baseresteasy-base-atom-providerresteasy-base-clientresteasy-base-jackson-providerresteasy-base-jaxb-providerresteasy-base-jaxrsresteasy-base-jaxrs-apirpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)slf4jxalan-j2xerces-j2xml-commons-apisxml-commons-resolverrpmlib(PayloadIsXz)0:1.7.5-104.4.4-54.19-510.5.9-13.el7_63.0.6-13.0.6-13.0.6-13.0.6-13.0.6-13.0.6-13.0.4-14.6.0-14.0-15.2-14.11.3\f\T4\R@\\U@\[@[{[l,[`O@[U@[>@[d@[@[o[@ZUZ@Z@ZZxG@Zg#Z.s@Z@Z ZYYY@Y@Y@YoIYlYGY>@Y5GY-^Y$$@Y"Y@Y#@X@XX@XO@X*XRXOX!@X&X2@WWҤ@WίW#W:WWt@W{@Wu WgWV@WV@WV@WV@WV@WV@W 10.5.9-13Dogtag Team 10.5.9-12Dogtag Team 10.5.9-11Dogtag Team 10.5.9-10Dogtag Team 10.5.9-9Dogtag Team 10.5.9-8Dogtag Team 10.5.9-7Dogtag Team 10.5.9-6Dogtag Team 10.5.9-5Dogtag Team 10.5.9-4Dogtag Team 10.5.9-3Dogtag Team 10.5.9-2Dogtag Team 10.5.9-1Dogtag Team 10.5.1-13.1Dogtag Team 10.5.1-13Dogtag Team 10.5.1-12Dogtag Team 10.5.1-11Dogtag Team 10.5.1-10Dogtag Team 10.5.1-9Dogtag Team 10.5.1-8Dogtag Team 10.5.1-7Dogtag Team 10.5.1-6Dogtag Team 10.5.1-5Dogtag Team 10.5.1-4Troy Dawson - 10.5.1-3Dogtag Team 10.5.1-2Dogtag Team 10.5.1-1Dogtag Team 10.5.0-1Dogtag Team 10.4.1-15Dogtag Team 10.4.1-14Dogtag Team 10.4.1-13Dogtag Team 10.4.1-12Dogtag Team 10.4.1-11Dogtag Team 10.4.1-10Dogtag Team 10.4.1-9Dogtag Team 10.4.1-8Dogtag Team 10.4.1-7Dogtag Team 10.4.1-6Dogtag Team 10.4.1-5Dogtag Team 10.4.1-4Dogtag Team 10.4.1-3Dogtag Team 10.4.1-2Dogtag Team 10.4.1-1Dogtag Team 10.4.0-1Dogtag Team 10.3.3-18Dogtag Team 10.3.3-17Dogtag Team 10.3.3-16Dogtag Team 10.3.3-15Dogtag Team 10.3.3-14Dogtag Team 10.3.3-13Dogtag Team 10.3.3-12Dogtag Team 10.3.3-11Dogtag Team 10.3.3-10Dogtag Team 10.3.3-9Dogtag Team 10.3.3-8Dogtag Team 10.3.3-7Dogtag Team 10.3.3-6Dogtag Team 10.3.3-5Dogtag Team 10.3.3-3Dogtag Team 10.3.3-2Dogtag Team 10.3.3-1Dogtag Team 10.3.3-0.1Dogtag Team 10.3.2-5Dogtag Team 10.3.2-4Dogtag Team 10.3.2-3Dogtag Team 10.3.2-2Dogtag Team 10.3.2-1Dogtag Team 10.3.2-0.1Dogtag Team 10.3.1-1Dogtag Team 10.3.0-1Dogtag Team 10.3.0.b1-1Dogtag Team 10.3.0.a2-2Dogtag Team 10.3.0.a2-1Dogtag Team 10.3.0.a1-2Dogtag Team 10.3.0.a1-1Dogtag Team 10.3.0-0.5Dogtag Team 10.3.0-0.4Dogtag Team 10.3.0-0.3Dogtag Team 10.3.0-0.2Dogtag Team 10.3.0-0.1Dogtag Team 10.2.7-0.3Tomas Radej - 10.2.7-0.2Dogtag Team 10.2.7-0.1Dogtag Team 10.2.6-1Dogtag Team 10.2.6-0.3Dogtag Team 10.2.6-0.2Dogtag Team 10.2.6-0.1Dogtag Team 10.2.5-1Dogtag Team 10.2.5-0.2Dogtag Team 10.2.5-0.1Dogtag Team 10.2.4-1Dogtag Team 10.2.4-0.2Dogtag Team 10.2.4-0.1Dogtag Team 10.2.3-1Dogtag Team 10.2.3-0.1Dogtag Team 10.3.0-0.1Dogtag Team 10.2.3-0.1Dogtag Team 10.2.2-1Dogtag Team 10.2.2-0.1Dogtag Team 10.2.1-1Matthew Harmsen - 10.2.1-0.4Ade Lee 10.2.1-0.3Christina Fu 10.2.1-0.2Dogtag Team 10.2.1-0.1Ade Lee 10.2.0-3Matthew Harmsen - 10.2.0-2Dogtag Team 10.2.0-1Matthew Harmsen - 10.2.0-0.10Matthew Harmsen - 10.2.0-0.9Matthew Harmsen - 10.2.0-0.8Fedora Release Engineering - 10.2.0-0.5Jack Magne - 10.2.0-0.7Matthew Harmsen - 10.2.0-0.6Matthew Harmsen - 10.2.0-0.5Ade Lee - 10.2.0-0.4Fedora Release Engineering - 10.2.0-0.3Michael Simacek - 10.2.0-0.2Dogtag Team 10.2.0-0.1Ade Lee 10.1.0-1Ade Lee 10.1.0-0.14Ade Lee 10.1.0-0.13Ade Lee 10.1.0-0.12Ade Lee 10.1.0-0.11Endi S. Dewata 10.1.0-0.10Abhishek Koneru 10.1.0.0.9Abhishek Koneru 10.1.0.0.8Endi S. Dewata 10.1.0-0.7Endi S. Dewata 10.1.0-0.6Endi S. Dewata 10.1.0-0.5Ade Lee 10.1.0-0.4Endi S. Dewata 10.1.0-0.3Matthew Harmsen 10.1.0-0.2Ade Lee 10.1.0-0.1Endi S. Dewata 10.0.2-5Ade Lee 10.0.2-4Ade Lee 10.0.2-3Endi S. Dewata 10.0.2-2Ade Lee 10.0.2-1Ade Lee 10.0.2-0.8Endi S. Dewata 10.0.2-0.7Endi S. Dewata 10.0.2-0.6Ade Lee 10.0.2-0.5Endi S. Dewata 10.0.2-0.4Endi S. Dewata 10.0.2-0.3Endi S. Dewata 10.0.2-0.2Endi S. Dewata 10.0.2-0.1Endi S. Dewata 10.0.1-9Ade Lee 10.0.1-8Endi S. Dewata 10.0.1-7Matthew Harmsen 10.0.1-6Endi S. Dewata 10.0.1-5Endi S. Dewata 10.0.1-4Matthew Harmsen 10.0.1-3Matthew Harmsen 10.0.1-2Ade Lee 10.0.1-1Matthew Harmsen 10.0.0-5Matthew Harmsen 10.0.0-4Ade Lee 10.0.0-3Ade Lee 10.0.0-2Ade Lee 10.0.0-1Matthew Harmsen 10.0.0-0.56.b3Endi S. Dewata 10.0.0-0.55.b3Endi S. Dewata 10.0.0-0.54.b3Ade Lee 10.0.0-0.53.b3Ade Lee 10.0.0-0.52.b3Endi S. Dewata 10.0.0-0.51.b2Endi S. Dewata 10.0.0-0.50.b2Matthew Harmsen 10.0.0-0.49.b2Ade Lee 10.0.0-0.48.b2Matthew Harmsen 10.0.0-0.47.b1Ade Lee 10.0.0-0.46.b1Ade Lee 10.0.0-0.45.b1Ade Lee 10.0.0-0.44.b1Ade Lee 10.0.0-0.43.b1Ade Lee 10.0.0-0.42.b1Ade Lee 10.0.0-0.41.b1Ade Lee 10.0.0-0.40.b1Endi S. Dewata 10.0.0-0.40.a2Endi S. Dewata 10.0.0-0.39.a2Ade Lee 10.0.0-0.38.a2Endi S. Dewata 10.0.0-0.37.a2Ade Lee 10.0.0-0.36.a2Endi S. Dewata 10.0.0-0.36.a1Endi S. Dewata 10.0.0-0.35.a1Endi S. Dewata 10.0.0-0.34.a1Ade Lee 10.0.0-0.33.a1Matthew Harmsen 10.0.0-0.32.a1Endi S. Dewata 10.0.0-0.31.a1Endi S. Dewata 10.0.0-0.30.a1Endi S. Dewata 10.0.0-0.29.a1Endi S. Dewata 10.0.0-0.28.a1Endi S. Dewata 10.0.0-0.27.a1Endi S. Dewata 10.0.0-0.26.a1Endi S. Dewata 10.0.0-0.25.a1Endi S. Dewata 10.0.0-0.24.a1Matthew Harmsen 10.0.0-0.23.a1Endi S. Dewata 10.0.0-0.22.a1Endi S. Dewata 10.0.0-0.21.a1Matthew Harmsen 10.0.0-0.20.a1Matthew Harmsen 10.0.0-0.19.a1Matthew Harmsen 10.0.0-0.18.a1Endi S. Dewata 10.0.0-0.17.a1Matthew Harmsen 10.0.0-0.16.a1Ade Lee 10.0.0-0.15.a1Christina Fu 10.0.0-0.14.a1Endi S. Dewata 10.0.0-0.13.a1Endi S. Dewata 10.0.0-0.12.a1Ade Lee 10.0.0-0.11.a1Matthew Harmsen 10.0.0-0.10.a1Matthew Harmsen 10.0.0-0.9.a1Jack Magne 10.0.0-0.8.a1Matthew Harmsen 10.0.0-0.7.a1Endi S. Dewata 10.0.0-0.6.a1Ade Lee 10.0.0-0.5.a1Endi S. Dewata 10.0.0-0.4.a1Matthew Harmsen 10.0.0-0.3.a1Matthew Harmsen 10.0.0-0.2.a1Nathan Kinder 10.0.0-0.1.a1Ade Lee 9.0.16-3Endi S. Dewata 9.0.16-2Matthew Harmsen 9.0.16-1Matthew Harmsen 9.0.15-1Matthew Harmsen 9.0.14-1Ade Lee 9.0.13-1Matthew Harmsen 9.0.12-1Matthew Harmsen 9.0.11-1Matthew Harmsen 9.0.10-1Matthew Harmsen 9.0.9-1Matthew Harmsen 9.0.8-2Matthew Harmsen 9.0.8-1Matthew Harmsen 9.0.7-1Matthew Harmsen 9.0.6-2Matthew Harmsen 9.0.6-1Matthew Harmsen 9.0.5-2Matthew Harmsen 9.0.5-1Matthew Harmsen 9.0.4-1Matthew Harmsen 9.0.3-2Matthew Harmsen 9.0.3-1Matthew Harmsen 9.0.2-1Matthew Harmsen 9.0.1-3Matthew Harmsen 9.0.1-2Matthew Harmsen 9.0.1-1Matthew Harmsen 9.0.0-3Matthew Harmsen 9.0.0-2Matthew Harmsen 9.0.0-1- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] [manpage] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1659939 - CC: Simplifying Web UI session timeout configuration [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA, - # Added Batch Update Information to Product Version (mharmsen)- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1657922 - CC: CA/OCSP startup fail on SystemCertsVerification if enableOCSP is true [rhel-7.6.z] (jmagne) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1645262 - pkidestroy may not remove all files [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1645263 - Auth plugins leave passwords in the access log and audit log using REST [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1645429 - pkispawn fails due to name collision with /var/log/pki/ [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1655951 - CC: tools supporting CMC requests output keyID needs to be captured in file [rhel-7.6.z] (cfu) - Bugzilla Bug #1656297 - Unable to install with admin-generated keys [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- Require "tomcatjss >= 7.2.1-8" as a build and runtime requirement - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1632116 - CC: missing audit event for CS acting as TLS client [rhel-7.6.z] (cfu) - Bugzilla Bug #1632120 - Unsupported RSA_ ciphers should be removed from the default ciphers list [rhel-7.6.z] (cfu) - Bugzilla Bug #1632615 - Permit certain SHA384 FIPS ciphers to be enabled by default for RSA and ECC . . . [rhel-7.6.z] (cfu) - Bugzilla Bug #1632616 - X500Name.directoryStringEncodingOrder overridden by CSR encoding (coverity changes) [rhel-7.6.z] (mharmsen) - Bugzilla Bug #1633104 - CMC: add config to allow non-clientAuth [rhel-7.6.z] (cfu) - Bugzilla Bug #1636490 - Installation of CA using an existing CA fails [rhel-7.6.z] (edewata) - Bugzilla Bug #1643878 - pki cli command for RHCS doesn't prompt for a password [rhel-7.6.z] (edewata) - Bugzilla Bug #1643879 - CC: Identify version/release of pki-ca, pki-kra, pki-ocsp, pki-tks, and pki-tps remotely [RHEL] [rhel-7.6.z] (cfu, jmagne) - Bugzilla Bug #1643880 - PKI subsystem process is not shutdown when there is no space on the disk to write logs [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- Updated nuxwdog dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #673182 - ECC keys not supported for signing audit logs (cfu) - Bugzilla Bug #1593805 - Better understanding of NSS_USE_DECODED_CKA_EC_POINT for ECC (cfu) - Bugzilla Bug #1601071 - Certificate generation happens with partial attributes in CMCRequest file (cfu) - Bugzilla Bug #1601569 - CC: Enable all config audit events (cfu) - Bugzilla Bug #1608375 - CMC Revocations throws exception with same reqIssuer & certissuer (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1596629 - ipa-replica-install --setup-kra broken on DL0 with latest version (abokovoy) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1548203 - pki console configurations that involves ldap passwords leave the plain text password in signed audit logs (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1494591 - keyGen fails when only Identity- Re-spin alpha builds- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1471935 - X500Name.directoryStringEncodingOrder overridden by CSR encoding (cfu) - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a certificate (ftweedal) - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in SharedToken scenario's (cfu) - Bugzilla Bug #1550742 - Address ECC profile overrides (cfu) - Bugzilla Bug #1562841 - servlet profileSubmitCMCSimple throws NPE (cfu) - Bugzilla Bug #1572432 - AuditVerify failure due to line breaks (cfu) - Bugzilla Bug #1592961 - Need proper default subjectDN for CMC request authenticated through SharedToken (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a certifcate (ftweedal) - Bugzilla Bug #1544843 - ExternalCA: Installation failed during csr generation with ecc (rrelyea, gkapoor) - Bugzilla Bug #1557569 - Re-base pki-core from 10.5.1 to latest upstream 10.5.x (RHEL) (mharmsen) - Bugzilla Bug #1580394 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC (cfu) - Bugzilla Bug #1580527 - CVE-2018-1080 pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access (ftweedal, cfu) - Bugzilla Bug #1585866 - CRMFPopClient tool - should allow option to do no key archival (cfu) - Bugzilla Bug #1588655 - Cert validation for installation with external CA cert (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- Rebuild due to build system database problem- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a certifcate [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1585945 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC [rhel-7.5.z] (cfu) - Bugzilla Bug #1587826 - ExternalCA: Installation failed during csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor) - Bugzilla Bug #1588944 - Cert validation for installation with external CA cert [rhel-7.5.z] (edewata) - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow option to do no key archival (cfu) - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access [rhel-7.5.z] (ftweedal, cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- Updated "jss" build and runtime requirements (mharmsen) - ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu) - Bugzilla Bug #1572548 - IPA install with external-CA is failing when FIPS mode enabled. [rhel-7.5.z] (edewata) - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE [rhel-7.5.z] (cfu) - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu) - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs improvement [rhel-7.5.z] (jmagne) - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in pkispawn configuration step [rhel-7.5.z] (cfu) - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong input class_id [rhel-7.5.z] (cfu) - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System 9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for standard conformance [rhel-7.5.z] (cfu) - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1560233 - libtps does not directly depend on libz- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1550581 - CMCAuth throws org.mozilla.jss.crypto.TokenException: Unable to insert certificate into temporary database [rhel-7.5.z] (cfu) - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata) - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers [rhel-7.5.z] (cheimes, mharmsen) - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a certifcate [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for standard conformance [rhel-7.5.z] (cfu) - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu) - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu) - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1558919 - Not able to generate certificate request with ECC using pki client-cert-request [rhel-7.5.z] (akahat) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1560233 - libtps does not directly depend on libz- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event set (RHEL) (edewata) - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata) - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM and FIPS (edewata) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1542210 - pki console configurations that involves ldap passwords leave the plain text password in debug logs (jmagne) - Bugzilla Bug #1543242 - Regression in lightweight CA key replication (ftweedal) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event set (RHEL) (edewata) - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and audit event logging at startup (jmagne) - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA instance (alee) - Bugzilla Bug #1525306 - CC: missing CMC request and response record (cfu) - Bugzilla Bug #1532933 - Installing subsystems with external CMC certificates in HSM environment shows import error (edewata) - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm (edewata) - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers permitted in fips mode (mharmsen) - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED outcomes. (edewata) - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in SharedToken scenario's (cfu) - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown revRequest.issuer (cfu) - Bugzilla Bug #1541853 - ProfileService: config values with backslashes have backslashes removed (ftweedal) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the- Updated jss, nuxwdog, and openssl dependencies - ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in few cases (ftweedal) - Bugzilla Bug #1428021 - CC: shared token storage and retrieval mechanism (cfu) - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause error (cfu) - Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog (alee) - Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during pkispawn (alee) - Bugzilla Bug #1520526 - p12 admin certificate is missing when certificate is signed Externally (edewata) - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA instance (alee) - Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to missing nextupdate field (ftweedal) - Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen) - Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords in several different files after installation completes (alee) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - Bugzilla Bug #1466066 - CC: Secure removal of secret data storage (jmagne) - Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to setup with CMC signed certificates (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- dogtagpki Pagure Issue #2853 - Cleanup spec file conditionals- Patch applying check-ins since 10.5.1-1- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- #Bugzilla Bug #1492560 - ipa-replica-install --setup-kra broken on DL0- #Require "jss >= 4.4.0-8" as a build and runtime requirement - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Resolves: rhbz #1486870,1485833,1487509,1490241,1491332 - # Bugzilla Bug #1486870 - Lightweight CA key replication fails (regressions) - # Bugzilla Bug #1485833 - Missing CN in user signing cert would cause error - # Bugzilla Bug #1487509 - pki-server-upgrade fails when upgrading from - # Bugzilla Bug #1490241 - PKCS12: upgrade to at least AES and SHA2 (FIPS) - # Bugzilla Bug #1491332 - TPS UI: need to display tokenType and tokenOrigin - # dogtagpki Pagure Issue #2764 - py3: pki.key.archive_encrypted_data: - ########################################################################## - # RHCS 9.2: - ########################################################################## - # Resolves: rhbz #1486870,1485833,1487509,1490241,1491332,1482729,1462271 - # Bugzilla Bug #1462271 - TPS incorrectly assigns "tokenOrigin" and - # Bugzilla Bug #1482729 - TPS UI: need to display tokenType and tokenOrigin- Resolves: rhbz #1463350 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1463350 - Access banner validation (edewata)- # Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing - # Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause - # Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert - # Bugzilla Bug #1463350 - Access banner validation (edewata) - # Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal - # Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen) - # Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with - # Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option - # Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03 - # Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system- # Resolves: rhbz #1469432 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1469432 - CMC plugin default change - # Resolves CVE-2017-7537 - # Fixes BZ #1470948- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1458043 - Key recovery on token fails with invalid public key error on KRA (alee) - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client authentication cert against CMC signer (cfu) - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after deleting the any of the subsystem certs from it (ftweedal)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret) using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne) - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing certificate requests (cfu) - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC revocation non-signing cert requests (cfu) - Bugzilla Bug #1458047 - change the way aes clients refer to aes keysets (alee) - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code (alee) - Bugzilla Bug #1460028 - In keywrap mode, key recovery on KRA with HSM causes KRA to crash (ftweedal)- Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement - ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS enabled system (edewata) - Bugzilla Bug #1447144 - CA brought down during separate KRA instance creation (edewata) - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure ACCESS_SESSION_ESTABLISH_FAILURE (edewata) - Bugzilla Bug #1454450 - SubCA installation failure with 2 step installation in fips enabled mode (edewata) - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import is asking for password when already provided (edewata) - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes) - Bugzilla Bug #1458043 - Key recovery using externalReg fails with java null pointer exception on KRA (alee) - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter (edewata) - Bugzilla Bug #1458429 - client-cert-import --ca-cert should import CA cert with trust bits "CT,C,C" (edewata) - ########################################################################## - # RHCS 9.2: - ########################################################################## - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret) using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne) - Bugzilla Bug #1445519 - CA Server installation with HSM fails (jmagne) - Bugzilla Bug #1452617 - Unable to create IPA Sub CA (ftweedal) - Bugzilla Bug #1454471 - Enabling all subsystems on startup (edewata) - Bugzilla Bug #1455617 - Key recovery on token fails because key record is not marked encrypted (alee)- Bugzilla Bug #1454603 - Unable to install IPA server due to pkispawn error (mharmsen)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal non-signing cert requests (cfu) - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed) CMC with identity proof (cfu) - Bugzilla Bug #1447144 - CA brought down during separate KRA instance creation (mharmsen) - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata) - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne) - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen) - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in ConnectorServlet. (edewata) - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata) - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED audit event. (edewata)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when HSM is used. (alee) - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes) - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause error (cfu) - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from the KRA (ftweedal) - Bugzilla Bug #1448204 - pkispawn of clone install fails with InvalidBERException (ftweedal) - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on thales hsm (alee) - Updated "jss" build and runtime requirements (mharmsen) - ########################################################################## - # RHCS 9.2: - ########################################################################## - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)- ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1303683 - dogtag should support GSSAPI based auth in conjuction with FreeIPA (ftweedal) - Bugzilla Bug #1385208 - RHCS 9.1 RC5 CA in the certificate profiles the startTime parameter is not working as expected. (jmagne) - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing certificate requests (cfu) - Bugzilla Bug #1426754 - PKCS12: upgrade to at least AES and SHA2 (ftweedal) - Bugzilla Bug #1445088 - profile modification cannot remove existing config parameters (ftweedal) - Bugzilla Bug #1445535 - CC: Crypto Operation (AES Encryption/Decryption) (RHEL) (alee) - Bugzilla Bug #1446874 - Missing ClientIP and ServerIP in audit log when pki CLI terminates SSL connection (edewata) - Bugzilla Bug #1446875 - Session timeout for PKI console (RHEL) (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1404480 - CC: Crypto Operation (AES Encryption/Decryption) (RHCS) (alee)- ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1282504 - Installing pki-server in container reports scriptlet failed, exit status 1 (jpazdziora) - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS enabled system (edewata) - Bugzilla Bug #1410650 - [RFE] Add SCP03 support for sc 7 g & d cards (RHEL) (jmagne) - Bugzilla Bug #1437591 - cli authentication using expired cert throws an exception (edewata) - Bugzilla Bug #1437602 - non-CA cli looks for CA in the instance during a request (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1274086 - [RFE] Add SCP03 support for sc 7 g & d cards (RHCS) (jmagne) - ############################################################################ - # Common Criteria - ############################################################################ - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures (edewata) - Bugzilla Bug #1417307 - CC: Audit Review /Searches (edewata) - Bugzilla Bug #1419737 - CC: CMC: id-cmc-popLinkWitnessV2 feature implementation (cfu)- Require "nss >= 3.28.3" as a build and runtime requirement - Require "jss >= 4.4.0-4" as a build and runtime requirement - Require "tomcatjss >= 7.2.1-3" as a build and runtime requirement - dogtagpki Pagure Issue #2612 - Unable to clone due to pki pkcs12-cert-find failure (edewata) - ############################################################################ - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4 - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.4.x - ############################################################################ - # RHEL 7.4: - ############################################################################ - ############################################################################ - # RHCS 9.2: - ############################################################################ - ############################################################################ - # Common Criteria - ############################################################################ - Bugzilla Bug #1419734 - CC: CMC: id-cmc-identityProofV2 feature implementation (cfu) - Bugzilla Bug #1419742 - CC: CMC: provide Proof of Possession for encryption cert requests (cfu) - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures (edewata) - Bugzilla Bug #1428020 - CC: CMC feature support: provided issuance protection cert mechanism (cfu)- Require "jss >= 4.4.0-1" as a build and runtime requirement - Require "tomcatjss >= 7.2.1-1" as a build and runtime requirement - ############################################################################ - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4 - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.4.x - ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1222557 - ECDSA Certificates Generated by Certificate System 8.1 fail NIST validation test with parameter field. (cfu) - Bugzilla Bug #1238684 - Generting Symmetric key fails with key-generate when --usages verify (vakwetu) - Bugzilla Bug #1246635 - user-cert-add --serial CLI request to secure port with remote CA shows authentication failure (edewata) - Bugzilla Bug #1249400 - CA EE: Submit caUserCert request without uid does not show proper error message (vakwetu) - Bugzilla Bug #1305993 - Add profile component that copies CN to SAN (ftweedal) - Bugzilla Bug #1316653 - pki ca-cert-request-submit fails presumably because of missing authentication even if it should not require any (edewata) - Bugzilla Bug #1325071 - add options to enable/disable cert or crl publishing. (vakwetu) - Bugzilla Bug #1330800 - Failed to start pki-tomcatd Service ("ipa-cacert-manage renew" failed?) (edewata) - Bugzilla Bug #1368410 - Misleading Logging for HSM (edewata) - Bugzilla Bug #1372052 - Unable to search certificate requests using the latest request ID (edewata) - Bugzilla Bug #1375347 - Typo in comment line of UserPwdDirAuthentication.java (edewata) - Bugzilla Bug #1376226 - IPA replica-prepare failed with error "Profile caIPAserviceCert Not Found" (ftweedal) - Bugzilla Bug #1376488 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - Bugzilla Bug #1378275 - two-step externally-signed CA installation fails due to missing AuthorityID (ftweedal) - Bugzilla Bug #1378277 - Spurious host authority entries created (ftweedal) - Bugzilla Bug #1378527 - Miscellaneous Minor Changes (edewata) - Bugzilla Bug #1381084 - KRA installation failed against externally-signed CA with partial certificate chain (edewata) - Bugzilla Bug #1382066 - Problems with FIPS mode (edewata) - Bugzilla Bug #1386371 - Remove xenroll.dll from pki-core (mharmsen) - Bugzilla Bug #1386424 - Fix packaging duplicates of classes in multiple jar files (edewata) - Bugzilla Bug #1391737 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (RHEL 7) (edewata) - Bugzilla Bug #1392068 - [RFE] add express archivals and retrievals from KRA (vakwetu) - Bugzilla Bug #1395817 - Unable to install subordinate CA with HSM in FIPS mode (edewata) - Bugzilla Bug #1397200 - pkispawn does not change default ecc key size from nistp256 when nistp384 is specified in spawn config (jmagne) - Bugzilla Bug #1399862 - Dogtag 10.3.9 Man Pages (edewata) - Bugzilla Bug #1404881 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - Bugzilla Bug #1405654 - Token memory not wiped after key deletion (RHEL) (jmagne) - Bugzilla Bug #1409946 - Request ID undefined for CA signing certificate (vakwetu) - Bugzilla Bug #1409949 - CA Certificate Issuance Date displayed on CA website incorrect (vakwetu) - Bugzilla Bug #1410650 - [RFE] Add SCP03 support (RHEL) (jmagne) - Bugzilla Bug #1411428 - Unable to create a CA clone in FIPS (edewata) - Bugzilla Bug #1412211 - Unable to set up KRA in FIPS (edewata) - Bugzilla Bug #1412681 - update to 7.3 IPA with otpd bugfixes, tomcat will not finish start, hangs (ftweedal) - Bugzilla Bug #1413132 - pki-tomcat for 10+ minutes before generating cert (edewata) - Bugzilla Bug #1413136 - Problem with default AJP hostname in IPv6 environment. (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1 (cfu) - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne) - Bugzilla Bug #1274096 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed tokens (jmagne) - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working when a token is physically damaged and a temporary token is issued (jmagne) - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches (cfu) - Bugzilla Bug #1381635 - Token format with external reg fails when op.format.externalRegAddToToken.revokeCert=true (cfu) - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when set on a token (jmagne) - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (RHCS 9) (edewata) - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (RHCS) (jmagne) - Bugzilla Bug #1404900 - Dogtag 10.3.9 logging properties (edewata) - Bugzilla Bug #1405655 - Token memory not wiped after key deletion (RHCS) (jmagne) - ############################################################################- ## RHEL 7.3.z Batch Update 4 - Bugzilla Bug #1429492 - Add profile component that copies CN to SAN (ftweedal)- ## RHCS 9.1.z Batch Update 3 - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - ## RHEL 7.3.z Batch Update 3 - Bugzilla Bug #1417063 - ECDSA Certificates Generated by Certificate System 8.1 fail NIST validation test with parameter field. (cfu) - Bugzilla Bug #1417064 - Unable to search certificate requests using the latest request ID (edewata) - Bugzilla Bug #1417065 - CA Certificate Issuance Date displayed on CA website incorrect (alee) - Bugzilla Bug #1417066 - update to 7.3 IPA with otpd bugfixes, tomcat will not finish start, hangs (ftweedal) - Bugzilla Bug #1417067 - pki-tomcat for 10+ minutes before generating cert (edewata) - Bugzilla Bug #1417190 - Problem with default AJP hostname in IPv6 environment. (edewata)- Separate original patches into RHEL and RHCS portions - ## RHEL 7.3.z Batch Update 2 - Bugzilla Bug #1404176 - logging properties and man pages (edewata) - Bugzilla Bug #1405328 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - ## RHCS 9.1.z Batch Update 2 - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - Bugzilla Bug #1404900 - RHCS logging properties (edewata)- ## RHEL 7.3.z Batch Update 2 - Bugzilla Bug #1404173 - user-cert-add --serial CLI request to secure port with remote CA shows authentication failure (edewata) - Bugzilla Bug #1404175 - pki ca-cert-request-submit fails presumably because of missing authentication even if it should not require any (edewata) - Bugzilla Bug #1404178 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI [pki-base] (edewata) - Bugzilla Bug #1404172 - Unable to install subordinate CA with HSM in FIPS mode (edewata) - Bugzilla Bug #1403689 - pkispawn does not change default ecc key size from nistp256 when nistp384 is specified in spawn config (jmagne) - Bugzilla Bug #1404176 - logging properties and man pages (edewata) - ## RHCS 9.1.z Batch Update 2 - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI [pki-tps] (edewata) - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne)- Marked the following RHCS 9.1.z bug: Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel when TPS and TKS security db is on fips mode. (jmagne) as a duplicate of RHEL 7.3.z bug: Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) and moved the patch from the RHCS 9.1.z bug to the RHEL 7.3.z bug.- ## RHEL 7.3.z Batch Update 1 - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) (added KRA key recovery via CLI in FIPS mode) - ## RHCS 9.1.z Batch Update 1 - Reverted patches associated with Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (edewata)- ## RHEL 7.3.z Batch Update 1 - Bugzilla Bug #1390318 - CA EE: Submit caUserCert request without uid does not show proper error message (alee) - Bugzilla Bug #1390319 - Failed to start pki-tomcatd Service ("ipa-cacert-manage renew" failed?) (edewata) - Bugzilla Bug #1390320 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - Bugzilla Bug #1390321 - two-step externally-signed CA installation fails due to missing AuthorityID (ftweedal) - Bugzilla Bug #1390322 - Spurious host authority entries created (ftweedal) - Bugzilla Bug #1390324 - KRA installation failed against externally-signed CA with partial certificate chain (edewata) - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) - Bugzilla Bug #1390311 - Fix packaging duplicates of classes in multiple jar files (edewata) - Bugzilla Bug #1390325 - Typo in comment line of UserPwdDirAuthentication.java (edewata) - ## RHCS 9.1.z Batch Update 1 - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1" (cfu) - Bugzilla Bug #1274096 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed tokens (jmagne) - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working when a token is physically damaged and a temporary token is issued (jmagne) - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches - Bugzilla Bug #1381635 - Token format with external reg fails when op.format.externalRegAddToToken.revokeCert=true (cfu) - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when set on a token (jmagne) - Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel when TPS and TKS security db is on fips mode. (jmagne) - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (edewata)- PKI TRAC Ticket #1527 - TPS Enrollment always goes to "ca1" (cfu) - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - PKI TRAC Ticket #2478 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - PKI TRAC Ticket #2483 - Unable to read an encrypted email using renewed tokens (jmagne) - PKI TRAC Ticket #2496 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches (cfu) - PKI TRAC Ticket #2505 - Fix packaging duplicates of classes in multiple jar files (edewata)- Revert Patch: PKI TRAC Ticket #2449 - Unable to create system certificates in different tokens (edewata) - Resolves: rhbz #1374054 - ipa-replica-install fails setting up certificate - Restores: rhbz #1319557 - pkispawn KRA instance is failing server - Removes from Errata: rhbz #1372041 - Unable to create system certificates in different tokens- PKI TRAC Ticket #1638 - Lightweight CAs: revoke certificate on CA deletion (ftweedal) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (edewata) - PKI TRAC Ticket #2443 - Prevent deletion of host CA's keys if LWCA entry deleted (ftweedal) - PKI TRAC Ticket #2444 - Authority entry without entryUSN is skipped even if USN plugin enabled (ftweedal) - PKI TRAC Ticket #2446 - pkispawn: make subject_dn defaults unique per instance name (for shared HSM) (cfu) - PKI TRAC Ticket #2447 - CertRequestInfo has incorrect URLs (vakwetu) - PKI TRAC Ticket #2449 - Unable to create system certificates in different tokens (edewata)- PKI TRAC Ticket #1578 - Authentication Instance Id PinDirEnrollment with authType value as SslclientAuth is not working (jmagne) - PKI TRAC TIcket #2414 - pki pkcs12-cert-del shows a successfully deleted message when a wrong nickname is provided (gkapoor) - PKI TRAC Ticket #2423 - pki_ca_signing_token when not specified does not fallback to pki_token_name value (edewata) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (akasurde) - ticket remains open - PKI TRAC Ticket #2439 - Outdated deployment descriptors in upgraded server(edewata)- PKI TRAC Ticket #690 - [MAN] pki-tools man pages (mharmsen) - CMCEnroll - PKI TRAC Ticket #833 - pki user-mod fullName="" gives an error message "PKIException: LDAP error (21): error result" (edewata) - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade. (cheimes, edewata, mharmsen) - PKI TRAC Ticket #2432 - Kra-selftest behavior is not as expected (edewata) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (edewata, mharmsen) - PKI TRAC Ticket #2437 - TPS UI: while adding certs for users from TPSUI pem format with/without header works while pkcs7 with header is not allowed (edewata) - PKI TRAC Ticket #2440 - Optional CA signing CSR for migration (edewata)- Bugzilla Bug #1366465 - Errata TPS upgrade test fails- PKI TRAC Ticket #978 - TPS connector man page: add revocation routing info (cfu) - PKI TRAC Ticket #1285 - [MAN] Apply 'generateCRMFRequest() removed from Firefox' workarounds to appropriate 'pki' man page (jmagne) - PKI TRAC Ticket #2246 - [MAN] Man Page: AuditVerify (cfu) - PKI TRAC Ticket #2381 - Throws exception while providing invalid module. (edewata) - PKI TRAC Ticket #2383 - CLI :: pki client-cert-request --extractable should accept only boolean value (edewata) - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter beyond CA signing cert in case of external or existing CA (cfu) - PKI TRAC Ticket #2399 - Dogtag 10.3.5: Miscellaneous Enhancements (akasurde, alee, cheimes, edewata, jmagne, mharmsen) - PKI TRAC Ticket #2401 - pkispawn calls dnsdomainname even if it does not rpm-require hostname (mharmsen) - PKI TRAC Ticket #2402 - Conflict in file ownership in pki-base and pki-server (cheimes) - PKI TRAC Ticket #2403 - Deployment problem with RESTEasy 3.0.17 (edewata) - PKI TRAC Ticket #2406 - Make starting CRL Number configurable (jmagne) - PKI TRAC Ticket #2412 - pki client-cert-import --trust option does not apply the specified trust bits (alee) - PKI TRAC Ticket #2418 - [TPS] Some template substitution didn't happen during installation (alee) - PKI TRAC Ticket #2420 - CA subsystem OSCP responder fails when LWCAs are not used (ftweedal) - PKI TRAC Ticket #2421 - Incorrect SELinux contexts Installation/Configuration (edewata) - PKI TRAC Ticket #2424 - ipa-ca-install fails on replica when IPA server is converted from CA-less to CA-full (edewata) - PKI TRAC Ticket #2428 - broken request links for CA's system certs in agent request viewing (cfu) - PKI TRAC Ticket #2430 - CA Agent certificate list is not sorted by serial number in migration case (jmagne) - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade. (mharmsen) - PKI TRAC Ticket #2433 - Lightweight CA GET /chain returns bogus PEM data (ftweedal)- PKI TRAC Ticket #691 - [MAN] pki-server man pages (mharmsen) - PKI TRAC Ticket #1114 - [MAN] Generting Symmetric key fails with key-generate when --usages verify is passed (jmagne) - PKI TRAC Ticket #1306 - [RFE] Add granularity to token termination in TPS (cfu) - PKI TRAC Ticket #1308 - [RFE] Provide ability to perform off-card key generation for non-encryption token keys (cfu) - PKI TRAC Ticket #1405 - [MAN] Add additional HSM details to 'pki_default.cfg' & 'pkispawn' man pages (mharmsen) - PKI TRAC Ticket #1607 - [MAN] man pkispawn has inadequate description for shared vs non shared tomcat instance installation (mharmsen) - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - PKI TRAC Ticket #1711 - CLI :: pki-server ca-cert-request-find throws IOError (edewata, ftweedal) - PKI TRAC Ticket #2285 - freeipa fails to start correctly after pki-core update on upgraded system (ftweedal) - PKI TRAC Ticket #2311 - When pki_token_name=Internal, consider normalizing it to "internal" (mharmsen) - PKI TRAC Ticket #2349 - Separated TPS does not automatically receive shared secret from remote TKS (jmagne) - PKI TRAC Ticket #2364 - CLI :: pki-server ca-cert-request-show throws attribute error (ftweedal) - PKI TRAC Ticket #2368 - pki-server subsystem subcommands throws error with --help option (edewata) - PKI TRAC Ticket #2374 - KRA cloning overwrites CA signing certificate trust flags (edewata) - PKI TRAC Ticket #2380 - Pki-server instance commands throws exception while specifying invalid parameters. (edewata) - PKI TRAC Ticket #2384 - CA installation with HSM prompts for HSM password during silent installation (edewata) - PKI TRAC Ticket #2385 - Upgraded CA lacks ca.sslserver.certreq in CS.cfg (ftweedal) - PKI TRAC Ticket #2387 - Add config for default OCSP URI if none given (ftweedal) - PKI TRAC Ticket #2388 - CA creation responds 500 if certificate issuance fails (ftweedal) - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter beyond CA signing cert in case of external or existing CA (cfu) - PKI TRAC Ticket #2390 - Dogtag 10.3.4: Miscellaneous Enhancements (akasurde, edewata)- PKI TRAC Ticket #2373 - Fedora 25: RestEasy 3.0.6 ==> 3.0.17 breaks pki-core (ftweedal)- Updated release number to 10.3.3-1- Updated version number to 10.3.3-0.1- Provided cleaner runtime dependency separation- Updated tomcatjss version dependencies- Updated 'java', 'java-headless', and 'java-devel' dependencies to 1:1.8.0.- Updated tomcat version dependencies- Updated version number to 10.3.2-1- Updated version number to 10.3.2-0.1- Updated version number to 10.3.1-1 (to allow upgrade from 10.3.0.b1)- Updated version number to 10.3.0-1- Build for F24 beta- PKI TRAC Ticket #2255 - PKCS #12 backup does not contain trust attributes.- Updated build for F24 alpha- PKI TRAC Ticket #1625 - Allow multiple ACLs of same name (union of rules) [ftweedal] - PKI TRAC Ticket #2237 - Add CRL dist points extension to OIDMap unconditionally [edewata] - PKI TRAC Ticket #1803 - Removed unnecessary URL encoding for admin cert request. [edewata] - PKI TRAC Ticket #1742 - Added support for cloning 3rd-party CA certificates. [edewata] - PKI TRAC Ticket #1482 - Added TPS token filter dialog. [edewata] - PKI TRAC Ticket #1808 - Fixed illegal token state transition via TEMP_LOST. [edewata]- Build for F24 alpha- PKI Trac Ticket #1399 - Move java components out of pki-base- PKI TRAC Ticket #1850 - Rename DRMTool --> KRATool- PKI TRAC Ticket #1714 - mod_revocator and mod_nss dependency for tps should be removed- PKI TRAC Ticket #1623 - Runtime dependency on python-nss is missing- Updated version number to 10.3.0-0.1- Added dep on tomcat-servlet-3.1-api [Fedora 23 and later] or dep on tomcat-servlet-3.0-api [Fedora 22 and later] to pki-tools - Updated dep on tomcatjss [Fedora 23 and later]- Updated dep on policycoreutils-python-utils [Fedora 23 and later]- Updated version number to 10.2.7-0.1- Update release number for release build- Remove setup directory and remaining Perl dependencies- Remove ExcludeArch directive- Updated version number to 10.2.6-0.1- Update release number for release build- Resolves rhbz #1230970 - Errata TPS tests for rpm verification failed- Updated version number to 10.2.5-0.1- Update release number for release build- Updated nuxwdog and tomcatjss requirements (alee)- Updated version number to 10.2.4-0.1 - Added nuxwdog systemd files- Update release number for release build- Reverted version number back to 10.2.3-0.1 - Added support for Tomcat 8.- Updated version number to 10.3.0-0.1- Updated version number to 10.2.3-0.1- Update release number for release build- Updated version number to 10.2.2-0.1 - Moved web application deployment locations. - Updated Resteasy and Jackson dependencies. - Added missing python-lxml build dependency.- Update release number for release build- PKI TRAC Ticket #1187 - mod_perl should be removed from requirements for 10.2 - PKI TRAC Ticket #1205 - Outdated selinux-policy dependency. - Removed perl(XML::LibXML), perl-Crypt-SSLeay, and perl-Mozilla-LDAP runtime dependencies- Change resteasy dependencies for F22+- Ticket 1198 Bugzilla 1158410 add TLS range support to server.xml by default and upgrade (cfu) - PKI Trac Ticket #1211 - New release overwrites old source tarball (mharmsen) - up the release number to 0.2- Updated version number to 10.2.1-0.1. - Added CLIs to simplify generating user certificates - Added enhancements to KRA Python API - Added a man page for pki ca-profile commands. - Added python api docs- Disable pylint dependency for RHEL builds - Added jakarta-commons-httpclient requirements - Added tomcat version for RHEL build - Added resteasy-base-client for RHEL build- PKI TRAC Ticket #1130 - Add RHEL/CentOS conditionals to spec- Update release number for release build- PKI TRAC Ticket #1017 - Rename pki-tps-tomcat to pki-tps- Merged jmagne@redhat.com's spec file changes from the stand-alone 'pki-tps-client' package needed to build/run the native 'tpsclient' command line utility into this 'pki-core' spec file under the 'tps' package. - Original tps libararies must be built to support this native utility. - Modifies tps package from 'noarch' into 'architecture-specific' package- PKI TRAC Ticket #1127 - Remove 'pki-ra', 'pki-setup', and 'pki-silent' packages . . .- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild- Respin to include the applet files with the rpm install. No change to spec file needed.- Bugzilla Bug #1120045 - pki-core: Switch to java-headless (build)requires -- drop dependency on java-atk-wrapper - Removed 'java-atk-wrapper' dependency from 'pki-server'- PKI TRAC Ticket #832 - Remove legacy 'systemctl' files . . .- Update rawhide build- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild- Use Requires: java-headless rebuild (#1067528)- Added option to build without server packages. - Replaced Jettison with Jackson. - Added python-nss build requirement - Bugzilla Bug #1057959 - pkispawn requires policycoreutils-python - TRAC Ticket #840 - pkispawn requires policycoreutils-python - Updated requirements for resteasy - Added template files for archive, retrieve and generate key requests to the client package.- Trac Ticket 788 - Clean up spec files - Update release number for release build - Updated requirements for resteasy- Change release number for beta build- Updated requirements for tomcat- Removed additional /var/run, /var/lock references.- Removed delivery of /var/lock and /var/run directories for fedora 20.- Moved Tomcat-based TPS into pki-core.- Listed new packages required during build, due to issues reported by pylint. - Packages added: python-requests, python-ldap, libselinux-python, policycoreutils-python- Added pylint scan to the build process.- Added man pages for upgrade tools.- Cleaned up the code to install man pages.- Reorganized deployment tools.- Bugzilla Bug 973224 - resteasy-base must be split into subpackages to simplify dependencies- Updated dependencies to Java 1.7.- TRAC Ticket 606 - add restart / start at boot info to pkispawn man page - TRAC Ticket 610 - Document limitation in using GUI install - TRAC Ticket 629 - Package ownership of '/usr/share/pki/etc/' directory- Change release number for 10.1 development- Fixed incorrect JNI_JAR_DIR.- TRAC Ticket 605 Junit internal function used in TestRunner, breaks F19 build- TRAC Ticket 604 Added fallback methods for pkispawn tests- Added default pki.conf in /usr/share/pki/etc - Create upgrade tracker on install and remove it on uninstall- Change release number for official release.- Added %pretrans script for f19 - Added java-atk-wrapper dependency- Added pki-server-upgrade script and pki.server module. - Call upgrade scripts in %post for pki-base and pki-server.- Added dependency on commons-io.- Add /var/log/pki and /var/lib/pki directories- Run pki-upgrade on post server installation.- Added dependency on python-lxml.- Added pki-upgrade script.- Updated version number to 10.0.2-0.1.- Renamed base/deploy to base/server. - Moved pki.conf into pki-base. - Removed redundant pki/server folder declaration.- Removed jython dependency- Added minimum python-requests version.- Bugzilla Bug #919476 - pkispawn crashes due to dangling symlink to jss4.jar- Added dependency on python-requests. - Reorganized Python module packaging.- Added dependency on python-ldap.- TRAC Ticket #517 - Clean up theme dependencies - TRAC Ticket #518 - Remove UI dependencies from pkispawn . . .- Removed runtime dependency on 'pki-server-theme' to resolve Bugzilla Bug #916134 - unresolved dependency in pki-server: pki-server-theme- TRAC Ticket 214 - Missing error description for duplicate user - TRAC Ticket 213 - Add nonces for cert revocation - TRAC Ticket 367 - pkidestroy does not remove connector - TRAC Ticket #430 - License for 3rd party code - Bugzilla Bug 839426 - [RFE] ECC CRL support for OCSP - Fix spec file to allow f17 to work with latest tomcatjss - TRAC Ticket 466 - Increase root CA validity to 20 years - TRAC Ticket 469 - Fix tomcatjss issue in spec files - TRAC Ticket 468 - pkispawn throws exception - TRAC Ticket 191 - Mapping HTTP Exceptions to HTTP error codes - TRAC Ticket 271 - Dogtag 10: Fix 'status' command in 'pkidaemon' . . . - TRAC Ticket 437 - Make admin cert p12 file location configurable - TRAC Ticket 393 - pkispawn fails when selinux is disabled - Punctuation and formatting changes in man pages - Revert to using default config file for pkidestroy - Hardcode setting of resteasy-lib for instance - TRAC Ticket 436 - Interpolation for pki_subsystem - TRAC Ticket 433 - Interpolation for paths - TRAC Ticket 435 - Identical instance id and instance name - TRAC Ticket 406 - Replace file dependencies with package dependencies- TRAC Ticket #430 - License for 3rd party code- TRAC Ticket #469 - Dogtag 10: Fix tomcatjss issue in pki-core.spec and dogtag-pki.spec . . . - TRAC Ticket #468 - pkispawn throws exception- Replaced file dependencies with package dependencies- Updated man pages- Update to official release for rc1- TRAC Ticket #315 - Man pages for pkispawn/pkidestroy. - Added place-holders for 'pki.1' and 'pki_default.cfg.5' man pages.- Added system-wide configuration /etc/pki/pki.conf. - Removed redundant lines in %files.- Moved default deployment configuration to /etc/pki.- Cleaned up spec file to provide only support rhel 7+, f17+ - Added resteasy-base dependency for rhel 7 - Update cmake version- Update release to b3- Removed dependency on CA, KRA, OCSP, TKS theme packages.- Renamed pki-common-theme to pki-server-theme.- TRAC Ticket #395 - Dogtag 10: Add a Tomcat 7 runtime requirement to 'pki-server'- Update release to b2- TRAC Ticket #350 - Dogtag 10: Remove version numbers from PKI jar files . . .- Added Obsoletes for pki-selinux- Remove build of pki-selinux for f18, use system policy instead- Update required tomcatjss version - Added net-tools dependency- Update selinux-policy version to fix error from latest policy changes- Fix typo in selinux policy versions- Added build requires for correct version of selinux-policy-devel- Update release to b1- Merged pki-silent into pki-server.- Renamed "shared" folder to "server".- Added required selinux versions for new policy.- Added Provides to packages replacing obsolete packages.- Update release to a2- Modified CMake to use RPM version number- Added VERSION file- Merged pki-setup into pki-server- Added Conflicts for IPA 2.X - Added build requires for zip to work around mock problem- TRAC Ticket #312 - Dogtag 10: Automatically restart any running instances upon RPM "update" . . . - TRAC Ticket #317 - Dogtag 10: Move "pkispawn"/"pkidestroy" from /usr/bin to /usr/sbin . . .- Fixed pki-server to include everything in shared dir.- Added build dependency on redhat-rpm-config.- Merged Javadoc packages.- Added pki-tomcat.jar.- Moved webapp creation code into pkispawn.- Split pki-client.jar into pki-certsrv.jar and pki-tools.jar.- Merged pki-native-tools and pki-java-tools into pki-tools. - Modified pki-server to depend on pki-tools.- Split pki-common into pki-base and pki-server. - Merged pki-util into pki-base. - Merged pki-deploy into pki-server.- Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 17 - Changed Dogtag 10 build-time and runtime requirements for 'pki-deploy' - Altered PKI Package Dependency Chain (top-to-bottom): pki-ca, pki-kra, pki-ocsp, pki-tks --> pki-deploy --> pki-common- Added pki-client.jar.- Merged pki-jndi-realm.jar into pki-cmscore.jar.- PKI TRAC Task #254 - Dogtag 10: Fix spec file to build successfully via mock on Fedora 17 . . .- Moved 'pki-jndi-real.jar' link from 'tomcat6' to 'tomcat' (Tomcat 7)- Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 18- Added CLI for REST services- Integration of Tomcat 7 - Addition of centralized 'pki-tomcatd' systemd functionality to the PKI Deployment strategy - Removal of 'pki_flavor' attribute- BZ 813075 - selinux denial for file size access- Bug 745278 - [RFE] ECC encryption keys cannot be archived- Replaced candlepin-deps with resteasy- Added option to build without Javadoc- BZ 802396 - Change location of TOMCAT_LOG to match tomcat6 changes - Corrected patch selected for selinux f17 rules- Corrected 'junit' dependency check- Initial attempt at PKI deployment framework described in 'http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment'.- Added support for pki-jndi-realm in tomcat6 in pki-common and pki-kra. - Ticket #69.- For 'mock' purposes, removed platform-specific logic from around the 'patch' files so that ALL 'patch' files will be included in the SRPM.- Removed dependency on OSUtil.- 'pki-selinux' - Added platform-dependent patches for SELinux component - Bugzilla Bug #739708 - Selinux fix for ephemeral ports (F16) - Bugzilla Bug #795966 - pki-selinux policy is kind of a mess (F17)- Added dependency on Apache Commons Codec.- Add '-DSYSTEMD_LIB_INSTALL_DIR' override flag to 'cmake' to address changes in fundamental path structure in Fedora 17 - 'pki-setup' - Hard-code Perl dependencies to protect against bugs such as Bugzilla Bug #772699 - Adapt perl and python fileattrs to changed file 5.10 magics - 'pki-selinux' - Bugzilla Bug #795966 - pki-selinux policy is kind of a mess- Integrated 'pki-kra' into 'pki-core' - Integrated 'pki-ocsp' into 'pki-core' - Integrated 'pki-tks' into 'pki-core' - Bugzilla Bug #788787 - added 'junit'/'junit4' build-time requirements- Updated package version number- Added resteasy-jettison-provider-2.3-RC1.jar to pki-setup- Added JUnit tests- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping unwrapping keys should be done in the token (cfu) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #744797 - KRA key recovery (retrieve pkcs#12) fails after the in-place upgrade( CS 8.0->8.1) (cfu) - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #746367 - Typo in the profile name. (jmagne) - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping unwrapping keys should be done in the token (cfu) - Bugzilla Bug #749927 - Java class conflicts using Java 7 in Fedora 17 (rawhide) . . . (mharmsen) - Bugzilla Bug #749945 - Installation error reported during CA, DRM, OCSP, and TKS package installation . . . (mharmsen) - 'pki-silent'- Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . (mharmsen) - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-setup' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - Bugzilla Bug #737192 - Need script to upgrade proxy configuration (alee) - 'pki-symkey' - Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode (hsm+NSS). (jmagne) - 'pki-native-tools' - Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk) - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-util' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - Bugzilla Bug #737218 - Incorrect request attribute name matching ignores request attributes during request parsing. (awnuk) - Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode (hsm+NSS). (jmagne) - 'pki-selinux' - Bugzilla Bug #739708 - pki-selinux lacks rules in F16 (alee) - 'pki-ca' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-silent' - Bugzilla Bug #739201 - pkisilent does not take arch into account as Java packages migrated to arch-dependent directories (mharmsen)- 'pki-setup' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-symkey' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-java-tools' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-common' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-silent' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .- 'pki-setup' - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-ca' - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-common' - Bugzilla Bug #699809 - Convert CS to use systemd (alee)- 'pki-setup' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-symkey' - 'pki-native-tools' - Bugzilla Bug #717643 - Fopen without NULL check and other Coverity issues (awnuk) - Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk) - 'pki-util' - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #700522 - pki tomcat6 instances currently running unconfined, allow server to come up when selinux disabled (alee) - Bugzilla Bug #731741 - some CS.cfg nickname parameters not updated correctly when subsystem cloned (using hsm) (alee) - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-selinux' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-ca' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-silent'- 'pki-setup' - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee) - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #724861 - DRMTool: fix duplicate "dn:" records by renumbering "cn=" (mharmsen) - 'pki-common' - Bugzilla Bug #717041 - Improve escaping of some enrollment inputs like (jmagne, awnuk) - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee) - Bugzilla Bug #708075 - Clone installation does not work over NAT (alee) - Bugzilla Bug #726785 - If replication fails while setting up a clone it will wait forever (alee) - Bugzilla Bug #728332 - xml output has changed on cert requests (awnuk) - Bugzilla Bug #700505 - pki tomcat6 instances currently running unconfined (alee) - 'pki-selinux' - Bugzilla Bug #700505 - pki tomcat6 instances currently running unconfined (alee) - 'pki-ca' - Bugzilla Bug #728605 - RFE: increase default validity from 6mo to 2yrs in IPA profile (awnuk) - 'pki-silent' - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee)- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an ECC CA to generate ECC certs from CRMF. (jmagne) - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any component value which is equal to its default value (alee) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #720510 - Console: Adding a certificate into nethsm throws Token not found error. (jmagne) - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an ECC CA to generate ECC certs from CRMF. (jmagne) - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any component value which is equal to its default value (alee) - Bugzilla Bug #722989 - Registering an agent when a subsystem is created - does not log AUTHZ_SUCCESS event. (alee) - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #719113 - Add client usage flag to caIPAserviceCert (awnuk) - 'pki-silent'- Updated release of 'jss' - Updated release of 'tomcatjss' for Fedora 15 - 'pki-setup' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser (jdennis) - Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-symkey' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-native-tools' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #717765 - TPS configuration: logging into security domain from tps does not work with clientauth=want. (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-util' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-java-tools' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (config file and record processing) (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (tweaks) (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-common' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs throws 'Invalid protocol' for OCSP subsystems (alee) - Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee) - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages (alee) - Bugzilla Bug #694143 - CA Agent not returning specified request (awnuk) - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages (jmagne) - Bugzilla Bug #698885 - Race conditions during IPA installation (alee) - Bugzilla Bug #704792 - CC_LAB_EVAL: CA agent interface: SubjectID=$Unidentified$ fails audit evaluation (jmagne) - Bugzilla Bug #705914 - SCEP mishandles nicknames when processing subsequent SCEP requests. (awnuk) - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added. (jmagne) - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs for modify/add (alee) - Bugzilla Bug #707416 - additional audit messages for GetCookie (alee) - Bugzilla Bug #707607 - Published certificate summary has list of non-published certificates with succeeded status (jmagne) - Bugzilla Bug #717813 - EV_AUDIT_LOG_SHUTDOWN audit log not generated for tps and ca on server shutdown (jmagne) - Bugzilla Bug #697939 - DRM signed audit log message - operation should be read instead of modify (jmagne) - Bugzilla Bug #718427 - When audit log is full, server continue to function. (alee) - Bugzilla Bug #718607 - CC_LAB_EVAL: No AUTH message is generated in CA's signedaudit log when a directory based user enrollment is performed (jmagne) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-selinux' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #720503 - RA and TPS require additional SELinux permissions to run in "Enforcing" mode (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-ca' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser (jdennis) - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems (mharmsen) - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. (jmagne) - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs for modify/add (alee) - Bugzilla Bug #716269 - make ra authenticated profiles non-visible on ee pages (alee) - Bugzilla Bug #718621 - CC_LAB_EVAL: PRIVATE_KEY_ARCHIVE_REQUEST occurs for a revocation invoked by EE user (awnuk) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-silent' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Added 'DRMTool.cfg' configuration file to inventory - 'pki-common' - 'pki-selinux' - 'pki-ca' - 'pki-silent'- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #532548 - Tool to do DRM re-key - 'pki-common' - 'pki-selinux' - 'pki-ca' - 'pki-silent'- 'pki-setup' - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser - Bugzilla Bug #694569 - parameter used by pkiremove not updated - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs throws 'Invalid protocol' for OCSP subsystems - Bugzilla Bug #694569 - parameter used by pkiremove not updated - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages - Bugzilla Bug #694143 - CA Agent not returning specified request - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages - Bugzilla Bug #698885 - Race conditions during IPA installation - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems - 'pki-silent'- Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.- Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta) - Bugzilla Bug #693327 - Missing requires: tomcatjss - 'pki-setup' - Bugzilla Bug #690626 - pkiremove removes the registry entry for all instances on a machine - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port throws file not found exception. - 'pki-common' - Bugzilla Bug #692990 - Audit log messages needed to match CC doc: DRM Recovery audit log messages - 'pki-selinux' - 'pki-ca' - 'pki-silent'- Bugzilla Bug #693327 - Missing requires: tomcatjss- Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta) - Require "jss >= 4.2.6-15" as a build and runtime requirement - Require "tomcatjss >= 2.1.1" as a build and runtime requirement for Fedora 15 and later platforms - 'pki-setup' - Bugzilla Bug #688287 - Add "deprecation" notice regarding using "shared ports" in pkicreate -help . . . - Bugzilla Bug #688251 - Dogtag installation under IPA takes too much time - SELinux policy compilation - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #689501 - ExtJoiner tool fails to join the multiple extensions - 'pki-common' - Bugzilla Bug #683581 - CA configuration with ECC(Default EC curve-nistp521) CA fails with 'signing operation failed' - Bugzilla Bug #689662 - ocsp publishing needs to be re-enabled on the EE port - 'pki-selinux' - Bugzilla Bug #684871 - ldaps selinux link change - 'pki-ca' - Bugzilla Bug #683581 - CA configuration with ECC(Default EC curve-nistp521) CA fails with 'signing operation failed' - Bugzilla Bug #684381 - CS.cfg specifies incorrect type of comments - Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port throws file not found exception.(profile and CS.cfg only) - 'pki-silent'- Bugzilla Bug #688763 - Rebase updated Dogtag Packages for Fedora 15 (alpha) - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA instance - Bugzilla Bug #675742 - Profile caIPAserviceCert Not Found - 'pki-setup' - Bugzilla Bug #678157 - uninitialized variable warnings from Perl - Bugzilla Bug #679574 - Velocity fails to load all dependent classes - Bugzilla Bug #680420 - xml-commons-apis.jar dependency - Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's classpath - Bugzilla Bug #673508 - CS8 64 bit pkicreate script uses wrong library name for SafeNet LunaSA - 'pki-common' - Bugzilla Bug #673638 - Installation within IPA hangs - Bugzilla Bug #678715 - netstat loop fixes needed - Bugzilla Bug #673609 - CC: authorize() call needs to be added to getStats servlet - 'pki-selinux' - Bugzilla Bug #674195: SELinux error message thrown during token enrollment - 'pki-ca' - Bugzilla Bug #673638 - Installation within IPA hangs - Bugzilla Bug #673609 - CC: authorize() call needs to be added to getStats servlet - Bugzilla Bug #676330 - init script cannot start service - 'pki-silent' - Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's classpath- 'pki-common' - Bugzilla Bug #676051 - IPA installation failing - Fails to create CA instance - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA instance- 'pki-common' - Bugzilla Bug #674894 - ipactl restart : an annoy output line - Bugzilla Bug #675179 - ipactl restart : an annoy output line- Bugzilla Bug #673233 - Rebase pki-core to pick the latest features and fixes - 'pki-setup' - Bugzilla Bug #673638 - Installation within IPA hangs - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package - 'pki-common' - Bugzilla Bug #672291 - CA is not publishing certificates issued using "Manual User Dual-Use Certificate Enrollment" - Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error. - Bugzilla Bug #504056 - Completed SCEP requests are assigned to the "begin" state instead of "complete". - Bugzilla Bug #504055 - SCEP requests are not properly populated - Bugzilla Bug #564207 - Searches for completed requests in the agent interface returns zero entries - Bugzilla Bug #672291 - CA is not publishing certificates issued using "Manual User Dual-Use Certificate Enrollment" - - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package - Bugzilla Bug #672920 - CA console: adding policy to a profile throws 'Duplicate policy' error in some cases. - Bugzilla Bug #673199 - init script returns control before web apps have started - Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI subsystem instances - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #504013 - sscep request is rejected due to authentication error if submitted through one time pin router certificate enrollment. - Bugzilla Bug #672111 - CC doc: certServer.usrgrp.administration missing information - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #672333 - Creation of RA agent fails in IPA installation - Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI subsystem instances - 'pki-silent' - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package- Bugzilla Bug #656661 - Please Update Spec File to use 'ghost' on files in /var/run and /var/lock- 'pki-symkey' - Bugzilla Bug #671265 - pki-symkey jar version incorrect - 'pki-common' - Bugzilla Bug #564207 - Searches for completed requests in the agent interface returns zero entries- Allow 'pki-native-tools' to be installed independently of 'pki-setup' - Removed explicit 'pki-setup' requirement from 'pki-ca' (since it already requires 'pki-common') - 'pki-setup' - Bugzilla Bug #223343 - pkicreate: should add 'pkiuser' to nfast group - Bugzilla Bug #629377 - Selinux errors during pkicreate CA, KRA, OCSP and TKS. - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from OpenLDAP instead of the Mozldap - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #658926 - org.apache.commons.lang class not found on F13 - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #665388 - jakarta-* jars have been renamed to apache-*, pkicreate fails Fedora 14 and above - Bugzilla Bug #23346 - Two conflicting ACL list definitions in source repository - Bugzilla Bug #656733 - Standardize jar install location and jar names - 'pki-symkey' - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #644056 - CS build contains warnings - 'pki-native-tools' - template change - Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from OpenLDAP instead of the Mozldap - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #644056 - CS build contains warnings - 'pki-util' - Bugzilla Bug #615814 - rhcs80 - profile policyConstraintsCritical cannot be set to true - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #635033 - At installation wizard selecting key types other than CA's signing cert will fail - Bugzilla Bug #645874 - rfe ecc - add ecc curve name support in JSS and CS interface - Bugzilla Bug #488253 - com.netscape.cmsutil.ocsp.BasicOCSPResponse ASN.1 encoding/decoding is broken - Bugzilla Bug #551410 - com.netscape.cmsutil.ocsp.TBSRequest ASN.1 encoding/decoding is incomplete - Bugzilla Bug #550331 - com.netscape.cmsutil.ocsp.ResponseData ASN.1 encoding/decoding is incomplete - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #658188 - remove remaining references to tomcat5 - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #223319 - Certificate Status inconsistency between token db and CA - Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory During CRL Generation - 'pki-java-tools' - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1 - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #662156 - HttpClient is hard-coded to handle only up to 5000 bytes - Bugzilla Bug #656733 - Standardize jar install location and jar names - 'pki-common' - Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review - Bugzilla Bug #623745 - SessionTimer with LDAPSecurityDomainSessionTable started before configuration completed - Bugzilla Bug #620925 - CC: auditor needs to be able to download audit logs in the java subsystems - Bugzilla Bug #615827 - rhcs80 - profile policies need more than 5 policy mappings (seem hardcoded) - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #548699 - subCA's admin certificate should be generated by itself - Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA - Bugzilla Bug #563386 - rhcs80 ca crash on invalid inputs to profile caAgentServerCert (null cert_request) - Bugzilla Bug #621339 - SCEP one-time PIN can be used an unlimited number of times - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #629677 - TPS: token enrollment fails. - Bugzilla Bug #621350 - Unauthenticated user can decrypt a one-time PIN in a SCEP request - Bugzilla Bug #503838 - rhcs71-80 external publishing ldap connection pools not reliable - improve connections or discovery - Bugzilla Bug #629769 - password decryption logs plain text password - Bugzilla Bug #583823 - CC: Auditing issues found as result of CC - interface review - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #586700 - OCSP Server throws fatal error while using OCSP console for renewing SSL Server certificate. - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #607380 - CC: Make sure Java Console can configure all security relevant config items - Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be generated on TKS instead of TPS. - Bugzilla Bug #489342 - com.netscape.cms.servlet.common.CMCOutputTemplate.java doesn't support EC - Bugzilla Bug #630121 - OCSP responder lacking option to delete or disable a CA that it serves - Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1 - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #635033 - At installation wizard selecting key types other than CA's signing cert will fail - Bugzilla Bug #621341 - Add CA support for new SCEP key pair dedicated for SCEP signing and encryption. - Bugzilla Bug #223336 - ECC: unable to clone a ECC CA - Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned by Reason Code - onlySomeReasons ? - Bugzilla Bug #637330 - CC feature: Key Management - provide signature verification functions (JAVA subsystems) - Bugzilla Bug #223313 - should do random generated IV param for symmetric keys - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #630176 - Improve reliability of the LdapAnonConnFactory - Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on ECC curve names (not on key sizes). - Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple Certificates from the Same Request - Bugzilla Bug #648757 - expose and use updated cert verification function in JSS - Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection of signature algorithm; and for ECC curves - Bugzilla Bug #451874 - RFE - Java console - Certificate Wizard missing e.c. support - Bugzilla Bug #651040 - cloning shoud not include sslserver - Bugzilla Bug #542863 - RHCS8: Default cert audit nickname written to CS.cfg files imcomplete when the cert is stored on a hsm - Bugzilla Bug #360721 - New Feature: Profile Integrity Check . . . - Bugzilla Bug #651916 - kra and ocsp are using incorrect ports to talk to CA and complete configuration in DonePanel - Bugzilla Bug #642359 - CC Feature - need to verify certificate when it is added - Bugzilla Bug #653713 - CC: setting trust on a CIMC cert requires auditing - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #499494 - change CA defaults to SHA2 - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets as expected - Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for validity - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1 - Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA. - Bugzilla Bug #661889 - The Servlet TPSRevokeCert of the CA returns an error to TPS even if certificate in question is already revoked. - Bugzilla Bug #663546 - Disable the functionalities that are not exposed in the console - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #658188 - remove remaining references to tomcat5 - Bugzilla Bug #649343 - Publishing queue should recover from CA crash. - Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and pkiCA, obsolete 2252 and 2256 - Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added - Bugzilla Bug #642741 - CS build uses deprecated functions - Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error - Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time interface is no longer available through console - 'pki-selinux' - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #667153 - store nuxwdog passwords in kernel ring buffer - selinux changes - 'pki-ca' - Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review - Bugzilla Bug #620925 - CC: auditor needs to be able to download audit logs in the java subsystems - Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA - Bugzilla Bug #583824 - CC: Duplicate servlet mappings found as part of CC interface doc review - Bugzilla Bug #621602 - pkiconsole: Click on 'Publishing' option with admin privilege throws error "You are not authorized to perform this operation". - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #583823 - CC: Auditing issues found as result of CC - interface review - Bugzilla Bug #519291 - Deleting a CRL Issuing Point after edits throws 'Internal Server Error'. - Bugzilla Bug #586700 - OCSP Server throws fatal error while using OCSP console for renewing SSL Server certificate. - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be generated on TKS instead of TPS. - Bugzilla Bug #630121 - OCSP responder lacking option to delete or disable a CA that it serves - Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1 - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned by Reason Code - onlySomeReasons ? - Bugzilla Bug #637330 - CC feature: Key Management - provide signature verification functions (JAVA subsystems) - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on ECC curve names (not on key sizes). - Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple Certificates from the Same Request - Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection of signature algorithm; and for ECC curves - Bugzilla Bug #529945 - (Instructions and sample only) CS 8.0 GA release -- DRM and TKS do not seem to have CRL checking enabled - Bugzilla Bug #609641 - CC: need procedure (and possibly tools) to help correctly set up CC environment - Bugzilla Bug #509481 - RFE: support sMIMECapabilities extensions in certificates (RFC 4262) - Bugzilla Bug #651916 - kra and ocsp are using incorrect ports to talk to CA and complete configuration in DonePanel - Bugzilla Bug #511990 - rhcs 7.3, 8.0 - re-activate missing object signing support in RHCS - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #499494 - change CA defaults to SHA2 - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets as expected - Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for validity - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661128 - incorrect CA ports used for revoke, unrevoke certs in TPS - Bugzilla Bug #512496 - RFE rhcs80 - crl updates and scheduling feature - Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA. - Bugzilla Bug #649343 - Publishing queue should recover from CA crash. - Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and pkiCA, obsolete 2252 and 2256 - Bugzilla Bug #223346 - Two conflicting ACL list definitions in source repository - Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added - Bugzilla Bug #668100 - DRM storage cert has OCSP signing extended key usage - Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time interface is no longer available through console - Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory During CRL Generation - 'pki-silent' - Bugzilla Bug #627309 - pkisilent subca configuration fails. - Bugzilla Bug #640091 - pkisilent panels need to match with changed java subsystems - Bugzilla Bug #527322 - pkisilent ConfigureDRM should configure DRM Clone. - Bugzilla Bug #643053 - pkisilent DRM configuration fails - Bugzilla Bug #583754 - pki-silent needs an option to configure signing algorithm for CA certificates - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #640042 - TPS Installlation Wizard: need to move Module Panel up to before Security Domain Panel - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #588323 - Failed to enable cipher 0xc001 - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #645895 - pkisilent: add ability to select ECC curves, signing algorithm - Bugzilla Bug #658641 - pkisilent doesn't not properly handle passwords with special characters - Bugzilla Bug #642741 - CS build uses deprecated functions- Bugzilla Bug #668839 - Review Request: pki-core - Removed empty "pre" from "pki-ca" - Consolidated directory ownership - Corrected file ownership within subpackages - Removed all versioning from NSS and NSPR packages- Bugzilla Bug #668839 - Review Request: pki-core - Added component versioning comments - Updated JSS from "4.2.6-10" to "4.2.6-12" - Modified installation section to preserve timestamps - Removed sectional comments- Initial revision. (kwright@redhat.com & mharmsen@redhat.com)  !"#$%&'10.5.9-13.el7_6pkipki-certsrv.jarpki-cmsutil.jarpki-nsutil.jarjavaCACertClientExample.javaCAClientExample.javalibcommons-cli.jarcommons-codec.jarcommons-httpclient.jarcommons-io.jarcommons-lang.jarcommons-logging.jarhttpclient.jarhttpcore.jarjackson-core-asl.jarjackson-jaxrs.jarjackson-mapper-asl.jarjackson-mrbean.jarjackson-smile.jarjackson-xc.jarjaxb-api.jarjss4.jarldapjdk.jarpki-certsrv.jarpki-cmsutil.jarpki-nsutil.jarpki-tools.jarresteasy-atom-provider.jarresteasy-client.jarresteasy-jackson-provider.jarresteasy-jaxb-provider.jarresteasy-jaxrs-api.jarresteasy-jaxrs-jandex.jarresteasy-jaxrs.jarservlet.jarslf4j-api.jarslf4j-jdk14.jar/usr/share/java//usr/share/java/pki//usr/share/pki/examples//usr/share/pki/examples/java//usr/share/pki//usr/share/pki/lib/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tablesdrpmxz2i686-redhat-linux-gnudirectoryASCII text, with CRLF line terminators (Zip archive data, at least v2.0 to extract)C source, ASCII text?7zXZ !#,]"k%IGL\(sVUSrMp $HR8/ *@rtZtk,]ɧPKʍ?lWI L-J_yK"Q9(YuEJI"Ol3#7Vn]hʲ oYanJl[ fDIK(5: &o{yfvν/t0e\K!ޖEd)\h/4[ּg C..7X\2R<'PSˆqHY ڽzats39JUzSWdJl54*tqŶ鯴ɽ-IcؑtԬa" ,_φ[|N3IøԝSxUeugd<{8yPu}B38'vs⁕,6Qv*Tx)tB=9F滀1+|QQ >ѱy[8-v6)rSȥE6IKW3.É|Dg>}&2`Mw>1ίY·sR_ 59rXI| Kjpjbt n{,Mp7;.<߼ޒ}@+| 4N*_.4;TWQ@Va0';YM_je=B|:'V}1l<(=[ݖ`+bxKD[31x?ںtrkm9O7hJ=HfZG KWm@=4xm)eRk$H? p: P+Flmyy'i*A1k/8ði#6ϯ]в-&F){AωG-a[y3Rp}Pm鋜Á3C7*qc/qP_(Jq;8O#v]Pdd+Iחv9d s+<2s߻s+j(roKg.7>cr15QHbT址6*ʊa ѓ,[B̗Y[]@ d܌{!7xE/:EB',1,A: *;3@b('>b^OsT#BK{q*3e 3I3U!Şɦ̭U-Vñ  밭HkN-iKΫ;EhEuNa@"v˩s tl䬿]~)9BLKgcGJ]4H$;38cb:d7z BܱVIXRh8i*.D% p8@ /I[Had߶yM#| 9V2Ky|c*$|vOyt5#70D,{pٓDD`P!Dxކ̨'59x ]<89xs_%cэ)P7_Ida[Op)F_=/tVp[y;0D=UJ4\Џۉf\L`g3XNФY?pJtn*xdfQ*D>ءqǙѓߵ F܆QצN{IG˛!y4#ֹomV5@ 8{0$e_aBM(3bќ}?ٶqY?2rVbkj-o9x7꩎[,E3 F[Sᗸ i";e"V 4 .7 /2/z}}5Ƹk:efuo 5GC$J/fG|v=*=0M-5ɢdݸ .b-_f]ݩ4^6p7`,HUCh+v0`b]B/N:-sJbsӕ.do.M}(}BWkQj,#yH}(P! h V)ןiVrT}p!ҵ:O2U hle6Kx5iAl̀!IIE N("TU e}GRN엎b<ȽEp Iv}i?gvSn )8 zK騜>л MX yS٢%7_?S]rm EEھ؇,mtE ߩBXA! [t1 w0.șP!0OhIl-~bQ(w tgx&릫_S^z*k(2H"])Ę2NY5}&!%!oY11c#BKOہE >"AdEJޑ b*If oXZtzOa:8MaA`HsA ʁů*f9og-F偺m4[Q3+wM?9 C(7w8˩7[5P\]3hi1x(:KD<ɋw/cS~in䬡LM!<6ժ22$V$PRpC~IL:u Xi2$0zF7\nu80 [tm^+5tforǝ nIg6Y*Nw&{v{=T2@r- Pcy+|e8%QG ?!& juV=I\/;g[(7M=-)RV#qY.t.}o1.F͊8{N]̵ͥX5J ƍbF"B2,DvvAK0%qv^3 b n(^^E۴SJwf>PZ&b! |A ^-38ɏ䡅,܇LDM7Ja0 M_ ߳痭>YuuEm0ûRƯ׾cb"yk8pwh4X+v,0rkA wƿ5UiqM?G)Ѓ~ *V}c-`ytV$ygǩxxձ ,綟(n3uٹ)ېqqJdH@adʳrG'k(7啫a=45?HL^YV:Vg|dF^-m{6MaeMqf@+ksZsnvkG$>;3z.%^x4mjKh[}FF%f-y@XNWzB-M 01G^+ZD4nDӣULH_##9p=s|1UH"Yk'Ppy-^T/Ը0L834^#NJ&a ~Xq%{$q@/huV{Ԗ䰁?[_;F C2r@IvuÇᬳ~$@ޤ<>v N3wd_z";Z/dbvoy  }+<_#;ɘ /TڿSzX!FXكKS؊!d[qvz LGZψW7!bPm4"3bq/v`yt8 npo$K;f2Gֹ۟nMRQ ~|:vw=IpLw& *l^U5g4s!=)$A0u.$p~PC#BF1a,ۡ?MsAP̼ܠ_R体v>\&$42T#t6CB xmoY'ͼ $jޭ,դs4MM-FS~\<,s ,~l9n x?ӓoydCe/8Fq@Okgy,[mW?R'P?A6JoS lF;`}1hCRA7roMa/YS Lb@R{0G}=2uT9; -\ ԕ<\34>K7$@(N\px#QѴc?bWerNl? :>r#zJMK8_лbJAM¨W"돨~^ j.έ8Y`AiSZ(lfT^N j`n:!kg!" .KD:4!r ::il͑8S6CUa/"WB ˨acu̍2ղAU-+F>ә|,RUYKhsҞ5b9BZGL>WSK,v)XOB;3HX4šj5Ǻo|P>^*"+MЯ@n! )\t0KM#gvIsɊ-akzF1"Q>Ï aCN $yH\j ]oi)I֠6hرtd%x93wA%LqL-ap,e̎鼦eo `h&aE2Ugz(U_3}o zMh7ꓳ6;l/I_u7I k9]y:8:wf}{wJ\͂,SS{DGXmѣe2G6@Xܑnڞ }Y uKAkc6KA C+pA|2wn>hM?D/ %+T2$uE~n6OIp1b%ǔ1=WgoMg2 hɡxϏk7*W`vcVCi+1Ř1U$ԻQcLz&T4S#%tm[ȹT#Ca9Y]EӧZ^ ױ73TŦM-9i@}9ZR\ 1-]f4]+ksGԧ%b!ʽ\ȠF~mS?iyp0!ڎKrݧm7Ӭa_e{j>ew(jr`vW1:k,%daA0i iku&bx?bESMY|{4:JϢSu5A\QTh8yאUUnߝ4; iB[fTKE>bgH:cjϦ(oR}"žЗH%۸u cvKrhnTkGAc)Rvz9pْ@N;M2Otח@VxAw. jBj|8LH 0쏣h#X9h*0Aj>LjԧЛwuW9N,:j~VDHg,B PÝrjIo[q33E$Y0Q0[^V!ͼA9CS+\*LVil?һ1 J}p-|-BxQ9>lzW1"l۳ضG;à7{-Gӂ^b qN86x:%+_{Ve@>8T+[5yʮYw|jC,m;;gv.&^fw.D{4]i'TmfD0+7HMSM'Vh`(O"d_Jd Nu^*g1ULptח1b"K[\uOFb 3rceqw+*V@7F*",R{´Ġtf1$WȺ&2ݹ~7& *ǂL$w4HA**׮ mo.$Çy嬧Fk򟚚 9vu3ӝb K{{&l0jـE7MPhXu r﬐@~E9 $SS[Fc|;L 9UJ G|oh`ed.wg9=T׫2כNp鞓PBZhRI.>po;yvlZC[w|,9gC10J>MPGXvt6$/g:0YDtN"/㑸MJ:+o-0!B&y ^ꖰK5n@Y=? Q`_j$+SFnklN6&fY٢0NqltH Q\xq[FS7tRt!-:p:L&{JL| Ni]I%%p9(Ax{v@IW%A2U-.Hг*ž|[8a *"A._6p\@<P:G5.tɍğ%xE5ɋbQhU~VW8xn>*=ɠ޷?{,Y ]e{vRU1-8ke!=+Lϗ@bԐk{c|<;epL j(}B Xt\^n(&R5D0C3q& _=RGJ=Ay.Fem+]OH GS>Ƥt\PD:-.^t\PwJ:JZpD]l"uqaG&N-m|=܁SxrH†h[Ws1$AZet$ $zIͮVCCo| p̊ЫΤ7MI!*][Y D{KsQaR G hW=d Ve.Ɵ&_}-. }%leՔfQ+e ٣~dZz#3(o4`_M+\Pd&d_ݰI@ n~gPBM *r䚏|QUAB*zp6KKf>`ܖİۊj'ų|mq jD) mů@CiM9JR}$mzy?݌nx$n?dՑˡ-Yn&<ʁe8m&#|c^#jO6PH޺z+eCbc !?B/ϥnj$Us`'jW̘)ɶhNrD!+yDutJǏl2{8`@5rYYתl"* vWO,rwP}tV}(p)M+ aP qOUP6rOPC ΍/:C5KXC4BfɪqH4y c|^ /DrjuQ.)m ފ݅l1~A=DA]K&7%WczӉi{ Y| q*gDE-IfU} ox9w^Kþu$۴nx?^9x=嗐aՊ_={oC`W\~E1(_G%n <>[Xyٌ'U'*WLOC`ꓥH{6ri<'Z'׬=@;28^s^ & vqRJg]0 2\dK!I>zJxwtë)tID@=kދWp]քY'%%Z=/^ Kg{y1!Nݎ~VWB2f`v<&Zíj?0Ri1ί"DE[F1v1Mv4u mCYEnԌl9 Ӊ~}8 T%QZx[gęew'Q#*aze}lY4AپW\'փ0D hq5wcܐKQ$PJLRc𰠾!p|$SkXofT3!#bXO'qYƌBնPxrHpRQ (a mՐF`_QyoӤʕ:za 9~uX9Y>{2# sCLDS? wfɋ˿ c*sGN4mU {W!xfdc?e~[p]V(OQ@1E{F6<ήk b=f׹~E#9h^`\>xg:H*`;aũz9AͳPa4`V4{'r3UYN%U4u!p5DgW c@I7=-()4Xq8ڷ"_teMK*l>5>sڒ{(ZZ7菽A6 HCq72補sZXv/ǍBq{TvѐGp{nGVMzZt26h 2t]َ,Tl˅Cm޹Y>1(qQ$8yYkFZG41 ]W5#6Zn\Z:jڿl6أ^-#imx_ix$L$hǐHǏH>JC*Tcȵ:KZ4;Tum0fJ|M'?000+o "(4C-^ ع&`*3V_'zwVDl$E!$o/E0 ԣpoD#_14w%5y3=CFON*4_EdN ' rz̎KU>6q@ΰ#s{ϼ+uo9AC5 R,Jĸ*Et @8Y8Qr&bz|ίHqH`F$hFe8YP8У;+: .FU㧠֘j<"9/!/_=OӅMl\qgBRe$lsM74x{;NI 8КwdZ\sO@?>fVtSD^ܴ{MMhWcj غfjU3(z6lvl*-`zj6lNgak~-cX6L6pϘ[de4>ܒ=>mVŀPVgLNSf]'(/%]5Vgſjr q |ב*`Nca*K~E"6+x $" G.Plk2R*! U;|BYrWURxбChCrcם v&r*v=EY-afDM$ d,EaZc l/z0ZXuH; S:,\D'\!;Um{32/šXL$:}bsv=.Q|8 im).MIԟnB6I =7veԬ"tYygnxϡYaid" -ScU+>-B»>{T'S0%Xv|]ջ< vA_x-֚.$b'\$JȜrЋI+<D)5Py>lWiE0Iq;"@d0zMcT,,(0[5`j2T ]*' _:<bu0V,]{Nہ=̚S@_F*Cm?`3A{HXЧ{?>[sؤ03Na@{\bT$K?%1G:ߋm^8X>"2TwZf'r;#M Tg"EO;QXWK:;3D`_D@( lt$S}@a|/>[~KΧrĨgHfa&"H ˇJVo'\|AdjDI[k֪b':hy*7jnٻ) -TWk;>4C\]50V///vRޫJ48Cο_ぅ1G"G+n^d\,I'*&FU`13@$ݵC3 Hr4gٴz`S*AS% D ӽ %N/Qw1(gEW'QEќ52 ̳#ޞ^M2c\B$m&N7ؔ+FBaAW q71LuxS)׌%"Q!!|'-pala ?CrKrgbI߳Ielg3IS4~I`ૌfIA(E)|c`]ڈ 0Z؋~nx|2W0l=XQ|4zo:t ?^cڹ(Vz$ 3f4:mw0v?Pig^y{F)IP=ܐS)SZ$"wTi+~mBiBA6cotfb@T@A_b &JS_bի wQ=QU$hb ̯Ajng;:AؙX-Z|ux&tKsp~5,}m|Ja5bڂj4ЩWw NzB c]W?AYt%CD@!nOQK1iE|:+%S+8W&4Jud>S$ d/QQ_b~'@)WU7e )n[]Vp.@Z o1x ϶yˁg5)XY н*z#)KRMCdZޓӡ]RqN% qghU6YQtS%ancAkpeu_~d0I<`OTJf U_:>]w/&zY]Fѱ2?+ cCc~'UHɝy8.FI ߑ΍Juvj \q9|Pvz&@ux7WHͯ4wkb8JHFR9:_.754FRR@VJU&ιE7zv\{ +n{/Pz$eGHfkAq 2@?mnVRhdCf-"w'G$dbp;$p,0QLj|Oz!~h?@"*ލxxOS3C@;қDN;(vY}jpFjYˡAGjdTt漁nBi,> F38$)E(߀w>}Mp1Td5e7oB:׏.*:."Q?z],*D3q>aT3nW7$Y<=N),)_>Y?ԫ%sHfcqQ)$XƭI&pV9@7`Z<$6%| 8 EPmNQ6p|oOY"EUJMGe 4=A= K'/թ@^xƑ r-|/[1y ޵Fh>38 3+#Qc@R*1\AO`iv΢u_ Ft^nf= ~#3;Ɇ+H<926Gn F8GJj՟Om .W@7+C=-k[i/eƖKc#i.@>É,B)إ􉔟6IK@sSۇ U,Ϧ3pkzj%g=q~ǭB"KOچ .͠ w`M ҉Dj 0. -̥I>HTjUPz"fl}G_5iі\O3ʛPd g2ZWֲ/ݖ_&4N]Gl+K+Ƕ{ +N*z~]sᚰ\|+AG끢_~>qOLbW~f92n}+P qӀ37qQv&UBF SS_իi'Zi?_g̝UoA/@"`;l.<-TM^35VX[,\xEK-5 8H> _X%`ѥ cӦ@f&~UPs_!nr5mD1I)qҋɏ9˄f8H<.dϤ͗WG?^O¨CcRP/z KOvXlQ"  nwmCvNP$Y1IrFe-4nKf6 8AsSPiW E0^'K< 4_(8*Q'8a%H@K͍0mЂ MϾۣ &.P%}o6%< _ YCKo3mMuթ#irx'llG;},TEl ΎEᘲo"3c&A^]=5%rXO0D: p1R9} ͣ c,bhs>f# m PYէn0rlA檕K3(xv=>3"P82uo쳳 ~+HSO(i'qCCҜq:r v&֒"szY3'PWP3AqV-`@]xQO!oSUoO|zeډ,bкygXqj\PKcx@-퉔@,6|pjCklPwSdk/JƇ^:X Q`vź3[sND`~0|CQܲo/wXa¨Z U~ 1%àt= IP"RU/k@ u1ZD% ]s??3}0oh1Okˣ PAAf|(&4K2K5"0; NZg%Oyk:vtަC뚯J-RU(:COq^Z}kkJ"Kp5ZxmxTg]akf`j1V>vJjţ]~tPWHag価Q>Y Gm7Tzw|xF :iF=0RtJYfh!igVsCN!WQtѭ̋/^r%tOѱ=!3 B5O%JGYZ| +Ds6ϩVZ~x q8 yuM%'Z-j|+Ic ϋ+``ߛdv$2;DUirF(4>qFQEQid CoCP=b_łvk#6az?\CW(E8YjRKa~LQ?RkInDH]vso&8FJ~]n:k#r4e#?EYD'Z|cq6f§ ]WyfoF ܦ]|6CAt Xz~ͥBVAU2Ѷ=:B2%q5S_ 37gh6(Ǡ,)I$1uB 7GPXճѹjHO<K,xSZ <~y.fzb3O0&fqp3lh Jx./+ՅRyVȲ_JS5wGpN@zX DXBI)HVo`3lj:'cH& UXcE1g;j 9mPaɬhy8RRӬXcLJJ|0S'5XO ϣg6A9(0n`SUD,ޛF/^\N^W:C?oҪHxj4sFy\>.=Ԯ *=otژ.փfs CRa˓|`3ؐ[R@DU5A L;Fɏ(/;KB S$򫻷B$آ4c8/GQ帹'oN0^>I9tt,RDO'dO,smgõt:xEaF[%Ğb7!v;r -=?=(ť x-YbV^W C`PCpXgRO q$ Ov,z OaMcWxZ//h;(abv2զOA *~ l\>9Z"ɛjh Ǧ]=D+Ek,q %Ӧ;]_ Ϙgظ8TG ZT ̴K""YJPt.3bIrKLRq[ClAxVs`ɻGj (^wW_բյ ̙{+F&R ClzRL<}# u{ck=NRF:)UlWLV/i8sD )]A}&@c={}aZpș"s#vR3R!R.4W@3qpRv'ceDBQ,D44l9fÉYli NtfiJK|F4F=ZFw5za[{#fatĤ3hBҴH5SS!#N Av]WWES01Hk &!MEMȿ&#у[N)+)6`LhּONtA-ϡ"6ͥW@w0]Bs"/b%:^r>m 5mZTKd}G4Ci!":?B]흁d|.}ݚ!#]L"΂)ݘU$-LA 2*"Fd; ^G^„)]@B$t&|`x\v(^.CĨ:iR+=U&c,/z"'+d^/Պ? a. MLP'O+XF} Ḉ0b2MpjV'L{m⇹7rѡ'}?x v@O&|ԣ5Cм+uתy/soZnٷzKF}` j I9h>mIa7-w(MrǠUtY+<Ӓ,* ڂpti1> ÃU"OZ_iś#aj= ]'J*^É;7`UNzjO-!`MXeM+iuXoEh´UzR9}/vĄ|?W\m40Mc3?q]-lt58 l[YX(v"ubRAI#Q*3tv8A3xQ!Cb.3H;ү~$:%xD* zTQpr،6;R\,Aג{Qnw9log+L^}C߯EL8(u^NtEʧ,N_#R<[qĸ&P_$ۈP! }Acʚ46~($ZY9՞  s~Cf,?EyJ*~Icq>;'nѳ*&̙DS$}պ䱔d{`r +] 8Z7nj>9#E;'q;~bǧ :.q>m&xj6TƔ~`;>+L>^#@"sɨ*yrOʚ4<z۔lU(zٺ/m9g[Utoߩ 7q:$-MNy9U41mdUTb3c_B:oTyEm7r @@E0 cW=iWSq ?[*&jdB GnܶnFYQ-BӅ4vVXR1@[fgAŀD*۟}qz $D%o0 +.%eP+m8,ڳgZ!VTP p8àͷшJ^tmh1|0jL;ſf~G 0rX`Vk0vT^oQ a#mCxbg܅f}ZY<_b+F1G`ۢ]F:7ژ{)H7XKbBwY,}Pڦ.Fka{He{k x+);mAw.@)1H2כ< hcJKnؽF᳜'7(\irڌAtQ TyXJ_39Z\EF p==9Ƙnfa1 60iS!lJɮ!28*8ro_0f^Az\k!=s#ѾGxdªB;Acd\Si5}ZlK-`@koDl~hE[Fst!XO!BA E+ۈzUw}-Җt~:ojvGfǍyQh)PC7@x-ڙo!$hT/_DJkgbm(\^:(=EoQ(\٠GnaD*$wNTF.B2"V<]TsWպd\sVd$8nhAr I6 U1;n\618Ɣ}2a*.G)'+n"͖ɫ*0&E/uCt8c0D熹pbWFJei]=mSW-/Cq5dx ?@:ל|^#s0^kFKU{dhk<4 FZ;yq& X݈5<~ʼq"`kڠ){շ\w`AVaqsиUu55boߗ#z"]bأq9G˺F\l(̩ڮiKt@Q2Aih}OnWo$b=bC"P!DkIRw̗~pp䣨P20nǨ5w d]lTTddMud ؘhpZO!{N=SKڤ#*0`#[yﾢ;𬓍Bc*85y>vrFoՕ4zxje§l7'd['zFujz)~ϊVYw9;oAsT>/Qaa7s2.1+͛?Ys*xfF܍*mbh[G-l]hKb (5T됋MeJ ~ [`=>F?~BU'IS "kKlIĻ|*̲& ybތaM!i pmv;qVēMOgPх )lW3mj 'W&n|}d^WTO#Gy67G̦1Ɗ@gmYɩPz1,O7y2x5KzI ks_' 8ow5MI#숤 `vkvwF7ө1mmuo!|Z "hЙ1)dĨf4>?^y՝Tg Yx2X#@^u=tuDDg1㎻jG+dGW_ }*9乺f96eB8k\uTA;ܣ[ 8jxQ2ϲ~;?鮟L#1gQ}]a갭gy݈PU P[XjCUHw˦BUA![[$q6c)skyO7#¯xxO\Mꚤ_5fЧ2hCQUaeV4E\⽞s-!?=]M 8%E<5UmdC܅:{Cosi>T{ƣ&`"Kifi r FY\jҵq 30?%C8INu  F[6\[(XuOOPGf605Sc>I q;3vՊ?6ژuBKۃ4{黅2H gCW| dßNxM %sY.ѧx^h9b{84JND>K8cxl Ƭ)R=NF3VY^*aBрzy!z}=ě4Rh!SηD؎ +Z#xO^Loqnϼ f%L%ci 3;#O\vL餑j`؋<3~)1;,puAVU%&“MM)#9TJwkfe:l=0]V3U[+ՖD@G5p;"֏1#{ѽڳ!ޘ5ƂkoQlr%lG)ɑ%YIUCM6>UǓ*Eݑ~L+>&舩Nh#7n2}y|_;QAHvm,н+:2۪ʚ3Wϔ{[u8_c&FVqd-kan=m ;"aBq5 J41EF\,w!&i^1l鿺t嫎 آ  Ҧie'y.&mpIQ2qzE37O(8IE)4[?僛/Hzhsk][mCM{zU9{Lã[?L0Y~{Wr  6ϗێn֬;lݽk%l*+vX &N1888-TG%[.=U'~P ̴_`. XvPv(;ݨiRRCtq=?_ȷ]} w4}_9JdBoc-+' cQQgx]s)b8J}ӛ2+^\꺨 RWJMFDϲeZ/b(Vbu,L%05:/|yuTl3kXUK}W_\ZK yy 7@7‡F iЖk*]6OQŌ, 2f,z.j6 dYrҧp)4rYԅ\8/jE: ΰǢpEstD{r+!D,3 nu ~wgKaP%>WٜRkTH2h l^e ރUIч>N'!Ӏȏlf@,.ЖehƃiAm\qR¿^:R T<^1q8w/ 3YQH &#p"2u~K#kb61@`]v[E'Tw EY| +^ԁ岚Y4fWNrЉ({ Z&útSX_3IJ;j`+\BЊ9I>wjf3l60+/wcKo0 Op<~ʌX 鴑D[X (8(y$9rQUtdG6cχ%VVʂKu )~fΘ #\pud=2E|:#Lv:Rp('O ě~_.*9K2cIp5Nso72{ժ[YX7يhPA. $5(mu hU~OVEhQV(Q/..>f S/+qI-vG&S_S{"YLƶ:HxsLS`Ϫ9ullP͞ f葳4hknLԵʱbmLΚ%X)2ou]؝I<}ϞLP]E*|zޝ 꿒!r]0ѱ"l%g9%B*GIԖA瓯Y^k˲,g}hA*rmS8A~)V̦eڀ:YR^S2C*Hf 2dt' \3ZLAzmȁ(Yn}Urb&Fy'x؇NYz&.ޣ/agK8OTĽX2}8`!&qF]R˾Iuj+  6$Ka =N_߾A G G5O>:;ŒW5< q%#ѲmЂS+dؑb|L=.`g3UBh&tNFy! V05J뼚d{HGQy^|&'b6v^-oپ% -MojTxT1ĢMO58Y&u;DzN캶f h%bx8{#dThٹ'%f#fᏓ-^Q$n{BdS 3cv钬 GaNFf VVw,GC}` ^2'(- ."==v~&J]R"=9eCowUF: /dN Gu a_c=-`ZhTx5i=vfSB*e+XΌV^NjFne^z̯~s=[[y6}l. 7R?=rعWLXMO1ӫX Uh'Pz ThOvnx'p>-J/s>#>6[L7TԐ ZL=g~9 Wo=OՐ#2ս6+.O@v\7Pn/|?^̾ L|."tgz)!8:z%*g7^T'⽆vu"i#vS*UWmo )9#(żi r!Z+T|*=,|Z^BrZZիiTn4|5 / ŶФ^}DȌ^^9|qc-j {&uRfTX%c#QhN r1qF]t?.ݛbZ/,Y͵n}>H+6ǿI.cr4=~W-g3zf0yVƦGL4GjSY@_sÚå! BltHR ٦e⤆_tsksOQqbӺݹVݹ"Wyk O劸0-Dm9alCӲ|i׵$^opP ,V6ܝ;[GrHیIi8 @ri=6-hȿȸ^RƓ(4B[g7M66 Kƭ^1+ʨK0u TaMr9,:[n" {mmCoUe¤#Hx.DdžKGr%4Q|!(/ DR;qf{]S @"*'i7|G2N=zEȎo##!/ D"[8'`.p / Ѥ`Q̗;VQF*C{2IGs^{j8SL\jO|Ղq2ܘ[ l{jeLN0ֽ=[fH?!?7b`qt*.tл2~r]x>ڇu7Y~"?;W@4ZvNv$[D#$Ȑ>|H&˜T9$ZA0)=7)Ƙ6)|2]8q7i&1ȿd$`sP@QߤiD 4R.S۴ ;ZWVdDIGWJsnFjʲzCM9L`/e'BCXjX?u*wF"^بwyԹЖH2v+0XKKp's՝zD;཮neaZ"n7C`o^܈kHֲH ?K e高-%}p?0!ZP-#b3s W߈|&'@IgVp{і$ޑE^1uBCRCYثfC`LO/|\R4Mݾ饹(R+ްc^+ dh 4|Aedk$9;D~2XuG'| `+n+,kѨω>g.@L8K#L/bÐԖڽq4A,A` Z/Y:|fC}./UOmF4e36."yAAZ@3Vlr C 8/IZF8Q{]ڌj+=,>o;߯'WkZMQ%@4WvV9Q2o w(ijC;mKd˟Ba߫yɆ|qΔ-%(WrT[EU85>VF`0{>wf'JNw[:LڄEzxҍ -uG'bpf]<`7kGX\$T * H.@aO'Vr=<[F 0·&>eaCvK{9$i1 r)4B[{F!e}i:f}$<¥ng_[E/Jō&KKJRZDʱù~9|0jIyߋ%,8Z ~sW#[ 5HA/I;In("S1]T?zQϱ!tNJD &&[i_WM<tFYrR[Ԩ23%S'پ"}VF`؊f94gnc8RԙEEfB_6BWĜ-ͽH/kۍTZIwa@Iɮ'tr&2 #}$ٲ9~lԑ6iP\4b>&SҖ`} owV{nzWH?2elRv+<&auu"ѧd,Y\*=^" 3c. V'C䳳*ڳH5fFHYp'9a!J%ч'8:47Rd*1qJSd`wAS4+E,^Ҹi*v!Gȷ,̅5]DT[_.-;rt2,JUNjP#҂5eܣOP?B*(a4#6zv+c,]lX ;YuYʍހ%Sʕq *wp-Zx%!E ~4J,)RCx{ҘB?2G!G3ۈLWzEV_(}pD%dȣQ51nI+&^6ͫKDVyJ<,Z˥a3?#{F%N$]PI|qqT׃_|rHe0̸5=oCVy$oPA!'S{ψH-Asg$/ d ~4pXNDhL2o=ɟ;Ge?~I'XhKz/ C~0i+]cݳ~Qd۔ꦘWa!1M-1PN>x]S+iy6}^3|rݍ5ZIŷ*=<,꜆,cY#94R"hoM 6?cĥc#j:Z^wό+?XsJ#%FoH q*UNb¡&琡mR+<6ADaőt^WAՙL>TLτKf8/Ҿ" ,ENK|rr^žt77f^ċP *}nn|ʦj !}6,.p[| Gdd^6b6T8-j'?Ыw5IAUU8^|bIFiz( ڸXDxZ$|cv*Ֆ%cҌkk!pty i^_ ihq;P&)Pz4zO-ژQLL$(ٙ]-}WS O kXXr)O:# f . 4Kq=YBjd>\l1U=uغ`3[?}!? V?舓-|eъj6Y|cbU-TVs!@*jByאD(*Mhp8@9\hcհ}:Ø2*H-]ͯRBsD6~jg*?:#1EKdw4i4?jox/ca94LR6VX] iN-vWfö8܌-o$(vqhqӣ.`J׾.C .mjlEWfbBd¡XPZC9@U0~Yex9o]n2]*o!XM=>Ĉ* (s^1WFe,4]]SI( ɯb$\S:Lؿ+sR& 2m0( ֥eO  @%<{My84Fq#q3Do#⃑Hі5S.`gM0^80Of@ h!n@*JdAV~:rap :ĞCZz>GgQ!)Kz<1HXZ,)ً\MYD9ܣul24撢$82k2texF(Ssԅ+콿ele?ɧjxa ŁU|Ğ04ј~ Kw_?>;RIp ~x̣'9&H G] dҡ107(R%5[ɠb|<5SÊ%6D*4uTFڌ15?tSeN7"| !6NuJUԷTNv9 w>ıg8uo\S]',plR zv T7qJa۴fD?#wlO(!ېw-uq1PnއIj&'WɧL乶d ij\[SDnx$z%TVW'gM`ה[6J.I=F%dLWtʂon%;J"Q<lʫhbf hMJw8<̔Ϳ1micȼYv/O'#kuz|z2MH qް-=y7>$ UAGQs燀7ې{50q: W|Z&/4_d((z!e12!Nw G[!7~sClP ӬzFc ܃ @ =l*,_(6Q,x|v/'һDx.`^EIhXդm>0{{pbd3ߜDB;b̕S3gLgPDW}W'lÇ:2H{ën}"}uX hRX4r}%m tTDƍ}o#s&,ITx{$oϩ<VbGl\! RQymYg< =B&kxۄi ls?p3G Ejaj6K虳Z3"6vWKo@fv`gS>&vm5OlB*7pڤxwA&ܨq‹):Ob~5fy\{Pƌ0^V_<:dMym5lƒyҰ$ ޓ#IitDxI! =N@3K .9o8 Qݟ.cv,1Y}e~og* }E$bTH(_OFžD|XEKbi0CX534_06$?}7Ca xㆻF&Ĩ훒k(t'wGh^W''5w%s˪=F)vaL[+R$v4GͪHuaRy. yl%`GvШ ` K㚖Y]-r>!nd%-ڰD( bAjPʄ22;40c9Ծ@-*fd"v"ZPE#~~fo5^Np C<|P']_PBJgTXh\ kc/>ڍiWxTl_7t 4_N|]صB'ӹ^zba7aTnNT`OYMR˷cfdlزGc5 P?l(WI_W]!6) 8w}% U ߹%#~ŀ_gKvL>W ; 5 pyYBrFe x`2πwRH͡ p ^فlvpyӐF<=5Śva;/s=lqcJ鸖JΫgSjMU=wk-zV&\BJH%?&8ei)[/PWV<yQ!PRwټ;< IYR_M*i8~qijaE"[YSp![SԣY? u&+t!sB1v=IE<#M6q@_G da{Q$˛0x5h 7[x4e  S \fhAW1C:Hr8k+uyZO'abttp^|sBIg+U2#}&PӉN[qʀG~מ<.at?ߤw7r |jˁGzoIc6"rX.S`7C{&BE7 ȅ%t5@۬8_jko>mD:( ;$ǝZ?ͰBO\&'*J{d˅i.V\lfžA#\+=1ZpiI/J|>+d{I%_Nu2H)e+h?Vsq"hU kbw[5qqK 9)d9oncR~xXr解?f1\inIf_'``4ohvӒjt3"]K篪v0Imp"bj|ǕV_(*34P^hP%2uYbD(X$[tW{j uFLfyt|\>N L'roLuCp*.%jy2/) e<ŷ{cH@s~d+,Gp%~gخH1 >Yx#ɶ3g={D\HrnP:@VƟȓEHXa!^cSޥrc2rkyCdw}6$f}aT~DWLQADݻMH6#:䬾֜i0jUH 2.x#9H Js<̗Y{^~C(}7λy᫙pS8@G`' .Ν6m P-Yʊ4d v\ Fp|դz; *Sրf; O7{5Ō83YBL&~MM!բsLF !lo-9o1-J6x*J6*x:IHd8df;p6Y D 4_7],W(@)"BB l]@pQyhk,Ы!6LM}*q*mLktҗ? l7"6L"UQ@δ7v T0yF/kGn^"FU8JJ&Bѯ7p$= oˀӲܭc 1 ̳ iI2JH9ة c>Cu]δĺ"v:X=&;hB-2l7 L|ŇBXx?#>oMd ]c, mmo1ᮙȌ~$POJ%EŋݠHeSٳ9ZC:\t%ǨD;W-WkVRzT84%[xbLB$xh鎄p%@iGH! ]ceHؚpXo G0)ĖCD:;]tJW"ʡӎ~le!aI> ! WEw>-zIv5h8d>~>akP$dJq"/1pmN bS(DMÆwV~out%"Cm+GLjpKk[Žf%AGO—/ǂw&'<|"J5}Ͻ<7maA-2{df_\D"\%eԳ =LxEW/7(!LԒ~"= NNZ' nQFsfgڸ3ޟ2jbA;)hy Og:M1#Mԗ`ǹx:8_˾bLEl$eKYB`^fՂ(KEʢ.J&vV-z)DžK6PK:GzSơ#@Ҹ Hu]G#Ó,0z4 }Z~!$㢞o?*.]cO33/HwY7C&ëɽrvVt I Y^|RԭxrZxQȕWͤC@qHu_K;eТuS:]Պ?f8 BЖJ&d0nUXR_vRKtdK4kW]HgԱLvԧE#E-*ƓԂx8UO3;ay8dVs+= c>QP2PbIq,q}˰0.^6JFZ5Ni*Ecwݷy LjkL͈|ߐ{W@RW&k*uDRAttov}Yއ4dԛog<N% NX'r8 ,ăAInAmdDxHID8/ sJM8&@G2䲁j>9#@G5n5ֲ&N_ l;](3@ 0tࢵiߩ~G9{+d˵\I94 <)cL!r%}]R9F> ip-8;o)s|1(("eX\pL/LP(+60D坆c7BqVA Oъ.~Tބҡ"q>98آ_CW|"*4X~Θ`ULޱ1:b^"NBM$w ,lsv5dV?TWX e MxcQiIwDqcR4%jUR[ I ҒD^w<-` RjjLp\Ywڴb&(`o~ FKnׂE+ױ ?aa._HTOd2k]n*P6&Hȶ a;nS83ZBE+=:;EqlP*y휗i`$C7^W9Ka_7Oe#xKu#d 5dqɅQ'z**R⧏tNaû <Ҋ3b͉DgPY$0x"D3)Hog3sq:T!'HW^|L]{^YmV+Ut S}6J2 2n*YapQNj(Dڣ:<؅|S_ڑlhnDd$oү^\ўcc3C%e^Y_UBY/Dh&ܫzkټ?:r]k(炘^OAf:)JҜ‹J'ww篴latY : X&hn]bƛ*)}db)FLsmU=OɩɍUWW?iف̔f Bg vKR юQ3@C"mQ,g/ nadI9!hfi$of"9Evǝ Mߎ8ړ˖J"Y&Qs ŦㄗnpKol|_2lwJ|xK=Z]ImÙ0kڀu.Ƌþm@x{l*.v_=>e!Z0|ǏɗEeRb P)4z֗,%seè#Uh*5e'(M==qs$7SrCrDc URn:$N2s8GIuc `rmcχhh| QBǵIl B/EjYALYG\L4.:yGn7,Et^^x{v[[ڿ` BC@'B)sm#$|q LJM4LpKM9<1zÏrz ,2.'eY˝Bq'j"!qI]:G=LU\2B yZ¬-1;D0\E7e̳G@0. 0SS˲k#CI <ن24K3=A;9!SKb^,"0,F۰#N:60gak;I{k(gﰔxlUhPqm3ezM@e )~sզwפNLx愳fc# ;&- @N%}pR%}^g=92Nck(}xP6(JQ&o4L,+$dwci|Q@ܘ-V}M^@Y݄IAj!{|+73| C3jȦ%8rz%5U.dƍv{#X?ENۅkF-Qbn'd;c'h)鎀y<4%'vn$[]}oׯFg<"পw? ţ#>AZ%* >\^ϼ_ۿGjy! )fGQPf,S -*:º QlZ4wt\3*{Э.a7/x&H7N*Mmr{8c?ImuA#v}ֶlO\*L,Y`ܯSiUs@HBeP$"^ Hw!K @n뉅N{87萦Ul<-{[Z)ax/{z싗#|;3H>J Lt9p "7$мǵJ9L xX4~.P6ӯn3'zNOH۞w7[0A\H w_Y:e459y*v vhT?z5V >Ig@<q%=LP:}Ԛ`[ƦG-qe{CهZ ?3~:*NqIj%X Rck2MlO,n7^{!qPd_3dK4A'IS]v3j ճo&@ fRGت庙7,Yl_VjW0O.)Nm^Nj}xi;!QK"ӑ.jDA hT|ګ38`"Vq8C&q ْjdw?{(d|dKE Z臩|sJm2-^3|- ѐ҄qS{ǘf) 30CMN*.%@Ǥܔ5]h9E^C6d9y#)tﲔ E#E0%鉦9\C~*aV&`Qyy +- Wr`u"Nmy6TD&7FNfɮ_ɨwj `}`Px1JV|gK Ʀa˪,U- O<=1wrd؃X62Ɩ֞E>I8% !p2ZZZ/-jTRnO2ֹ9}e|X3vm?~l J3m;^of`6C0ʌaǾ [LT8@((6nA&H"̑´&F;\P"2 s&>*\#xb֑9yUZ{gq:8PKubvߐkdMx7\Ԋz]r4ӎf(#bfיM`FC>c}Di E{v8&l.9?wuruKwgH1"-&58`ؗJrn 0~W@B[kt}^6FsGlv:Y #Pz;AS:mٖMv5 qv Mke%1Y/`ϋ%Q|.ZWXZyA |d%nyH?F(T!{M $@Y|jH ~DL JM%+x{Q_ts*s5.Ť#O)Yf ʜ~x1{1;Gڷs@0IR8kl(g_ZgȢ:g50+$j+У&rݪ7Cb>i^KKJ~J"ԈRb]!^sPoM.qEmWH *g]H-/c2癤:kVI\hbiy3rb{lH6F}\TF<74fj9l :m+y"w/]C1,nk7봷&f+8ߐ+Ϝsۜ%wp;/3 # }ԢhVk|z㉜xuMK%ˁ2&4b9#.}ܭdѩ]G2]鞆߳RuDA)!LlC2R'cAbS?Ǧ('+kv\mWvʼnMD5l$46؋JݥdWI.'D1s`R\2QG7lSc"rl@Zֵ{1skPg}ܷ9Jg|vc][}]okih)ù\F6YN:pTD:~z!--|&m:FNo lfQY*Ǵ"O#&X CorZsTf$g6 *-Õ 8p ڐ8#I4OIKA"kbbXoS$K#=N3N㿖p"7 6d>j2 '2u@vK*뇷Hrc|CvG6򐇣dC`hHr{L$Z冨<}F M%>G.0)7."AԷr*ܹ5;v-Z XB#VɝVt Nx o2a`y=ˊ7˙\yU! (:[IkIˀ7!^}Ͻ]\O@{Se"c 4:seг۟Ե)˞^/1"~d#BГ[խϒP-*[*U~/4W?){SMb";K05 f-<+ 2O"BӢf2| E`Z,JW4n5G\@Te NXc!he|GoOȊA.AEzYÂx6&Q'Sxl@0_-:XRpvhbY|, "mt038Q9nzQ+9䢓$yɯ2K9QwSŰnI*\齦zp줗K9&".D"+rkv||˼ IEM-,[Y%Et0s~] \&lO^ ?#fT=.Jx&+@Z ]gCy0"l3>O )a7V f>G%ƐDaK\;ZDL#nĂh+HeÖ篵Y%xYfbFs\Uu4\cƯLFKHK|X_ *+S`IY \Jk <c<^\+ #4.djU lge]-Σk04H:j5臉CBIom%'-u"s DWk0],k}{_E^xDIVzZ{ );"w)$$o@셭%UB\lH:ʉ8/Nj^/O/gx]j3W&VΟc;\o\8AӥxylwE0RBf.@Y.QiL V~ QKL%X#{Bq^T_taDŋp%$~QIpd<蜘I.gVvF;仞)Q3"ڇ! O>co/8>PQad@붹UIxFFSro~6E`}B;GlCHL}Z"<}ա*y#zcҘ$#4X)Xi }"W.8Y&~pSyIL"NFY,o:1 W#m  PFr+)y\#)8RлIl6,<IC4$rb р4oJ#N~ysKZ1phI2,f\7F?y2)(4<1#P1+Mh{?̿paS-hX`${sbmLJw f'+X$T;w'd_a%oӣp*جJ.HiOpNYRt֩ ;30Q)Mv]W'mVS]}dKp~驢I*+c: ,lamj#51c|BjYaw IIGwh-)bu>e%># =%LWcڡ|~@>F~:w#Y6/W-WExXmw,,EqXS93j[צ"d6؅^իZ$ >pg#tar90 bRi^*lBup|wd&hfF|BcN,yaaKwxň{Z%mFVk6xOG|?8jnQG,Yךa|4^ɖ{e @N73ΑY0BHs/3 M$x̼yCJY^-VJ 1a7-d;F^<̉SXy͢\bt-~5]M&r $WG1/EB{ Ө *jJFa&jڏKlyk^Ȫ`KVC ߆?(*eAيI4-ɪ;oj0{{ }pa"h](5gқkJI-M{]Nsz "F%{.Ef\$=*9{P\P~w-E~ #t,g '9k'm9 :._)vǟj؋$`G*g_}?2l[ FْSw|AXcR2׎ z}6&Ɛt TL;ys3g%$kTV=.aLZ MiŦ?^1RCf|[lymU^0iN&`"?QKKsvZ+n@_T(!_7tO(K|æ鬓E8ڿ=ZE2cյډPDJK>G 9ٟ gRna`ݯBmb|$݃JӸ%KA1Rtޛ9ڗV U]PfB)Ȟs j Rm1KXR UN}v9Tje5(= )F9b0QˊkiAs[ Zc12!S xS̉C R뭛Qy\?L1?Z0V,Ȩ7gO1:v!uPQu$ʠw2N[OT z r֖9wY[yi7]H ],9{p%1`7E()ʃ̖)+0jR5bjd^jf}(5löoi}[>8E ^p$9Tk.ԏl4 |kH(uçAM+ K ~?;AOt D%8܏ dI7)G؋UeJ^5P ]4NЍc.Υ^_M~X!)9BHBq]ۄ;b˿80PiR w5EnS]W@tby2.6`~/nS6^MqWm}SE}U<9N 9X4 Z6a#^W$?2&n{Gm?GҧffƻUg!+ a!4=&-/cG9w6Fvw-s'qv K(cjXpT:"5jʔ_a |v r`Ղ/'x)X<0 vs>`i׀ŋCM0<~Y IaXi۞(#d* 7wX% o7-\˱Ӧ -`DNwITQқMSx!hrtek'#>ej+J(++pK T[";28w]/qu}SGz[%D[eGTU@Jaw92Cpy ^3w)sᰓ5kFzS}?.|'%RQFKC Au+u//붠m\,8(,x p;O䇒-c!D׎$'Ќٿk{^i[, fWpt?φ9P^S++;_[y7fOɟJ~MQig~zB4>+TlP"睨JOPθߐ0xnAѣ3bv=&ݥXG|WGJs|LDARhtvd=Ja!aB4 gAW;mO-)@X!`oahM~} ],d |[nNt {}w-#'KGLA+@FXy!39H#zZ\:gPN28k:.G@nߞl=;_II +MzhB oMEz1]5P &ZU7^߮`^VyNY'CD,6U"su~eECO Xm*_d/kJ6g96S FE.o:Qҝ_<twi,d{nZL jWĞG%g;#X~xԩO6~ϳJM$Mx O'jiޏjX!C0w"|A˥ǤWaM)*wͲf APtoTMMVy-+\<<<ӝB2^2KpW;д57 _u{fI_Ik@4@|j+@6cp{Ɍt߫9dGR7i] ߰=ǧߟQ`څGP/CKMvKzy jvGņ?XTIݬy_,0pz] t0@ɠ2wMYT7&Wi|]h+rQX} Dr~%_lZǝyT>bgw?%v:GWIw,an(u4o8I=vi]~/`9zW]@(ĭ|D2U:W:Ukc}+wvRo6ߖv0_Bh`)TV,Ȁe 珹 ;#!ARRV4_!|s&bǠ\1Ai2ͧU%e5M-54hYH 5mhBpĒӉe汮8>Ϗ^Z8$c7r ƻL_?n@y+HmJFjSUj2H!Ivml_KJdb;tXGf%|ԓM7y ABFaJ 2 ՟%aPd*ںIdlkv0(ytbEd͠DBPqJ;xQ(+d)ю$xvhCy}_^4ē+ɰ#P@;*[Utdzb[~E@ ܌&m}Ԩ,sߢ{~qb/UdStx,orx gADM )~i3ӈ eb{#lpgc.Qy^c"%bhnVڐ3nfau4΀%?ĶR0A4vEke/N0 s^Mf@=4BrɩJwrq+(}D1vz}>yC:]X'qnaWŋ e g>'@OIrU}Tcq $5tYB^BQWBS%Upԡ3iab?GIw5D]`ǽ| Z,# #7nZ(;V@<ʜك107<; >^bQ_Vg9U!wHGp/|_sֶ-_دnV>M~~`%.^ͬKe^wmQ"05l `s+r`@f6PLx7Ş,X eR*ѣ'Ł"vʐN:Z."9Q(/VzKyԣwvk= j\?nd1⇹.#K kFAKx=jͺ|#3l|zDq[a/2n'cؚ t+BH+kӻUQaV q/8L1{r%Z>5ڄiwE' 0t x!#* 0P:[e6a(6۫cq >IEۚt[K)W\u4? )*Hcv!-Ӡ~V[` = #+PGFA_t=o!Rޤu3lڞhv >Ω{#ރTajw|LX;W1cwDM #}Q< ],wgݷ>'1( 1>ЉnNo9^g`My񚥕%2<#gv0 (F>- )(tZj˓aR8 1וF_RG]qYhCЦVCs:=ztP}P/{{vCN 3n۞ Bzϝݰ}`7O5uXh!SLW1wE}j Ϙ䧛XxfEF31[EdۯV"EDZq͐ଢÈڲhɌf_X۟\][kӤf]"-p>qQVیIGxV|v]n+{v傿Ǎf3t%mm еC9d''jf 6;.NJ56^[+dk'bTϊ֜RmG*WL/#F>+pm4y>k퀥BVn[ M HeD:JO)e|a؈?[bm@7YOeD CB> c:7'e2x2՚ia0ԅJ*AcW'L}M 8\.D<*U?(5n۩XhƎ r~3Wc*]FufYS7N}8NDvs>cj\.׾Ԇ₹Hy ؘfs@ _:u˄}h7rWñ8fNXSnaB(oˠ'H+*%點& qd ȸ0Pƒ#񒔘mQ2v޳DߕAO syeߎM 8.OWV<.EjsEBB\ 2P+Tl{Rs:EmX gm͘{;c/NN3HB_gTea/9sa[ٛ뫠,{;Ưݰ"U)&`wT,h/*b$e (r.; Y-eN $*Yn|L--FP]A=@|-MO`RT|߱e>SXNs_Ǵf%d?EaçP*0ۤS,E2,]sg40-ĻGH` ޺mLsF|F\Q\G /Hn' !U\+ɟ}8e\XhO ˪'HyR|\`34L㠺yTt!wi' Aj9!s$s #pl41kL`9q=C.[{hcJyXozE&2|uJbG$9G+~cYYӟ?rue2)Ёߒ%mLf,#1dp%0/s~Y/ 3 JЊd͆g[Njz!6>IW`(l9Sv krQN|ge,r5|G^ q]eoi'KYv7n&> \Xy @ï$!Z84׬aBwUeDۖ'ͤ[}Sۄd|ԍzs\ed R{m2e>1y(&7RkniR22itR}7_w=pe 1ԓE5\WpMI,ʛuNY$HrdY7n0lUWh7f ʀVL_U8b#4`aB<~N2VJ?ܽ\8y3YP]2v}Ҍw |8*!8A0`)%<Ξ j@ci$Nۑz]KBTǩ,SgJJCy&4./ƇiJ#1DCnR_JyMބ2R>@#m7@q#d#1 `4d}p @c 3&$ݘ N0V^,.c-A{,cǠ8So,G#[ Ce*2a0^'aQWa46!c`l^V~5F#zl0WI԰7h\q"jbG~CAOk؋A .CA\4іF c&Nlh/qxi=O %_J΢+ %34skr"c1ki@6Cmpx 07YAaXjeê{.Mbdc e4}?I~/&uȝʩ@a+pptA4u ڔ߉/xbwtchmQaWeC;8.8_@+K'q_鞂1Ad41yȻ~ Wige K.BH9[ܟZrPQ<~SBD5,"F ̲Z3iO r"-xn-+)*7kƟh@5.i\II@3S YxM,鐆j ~QV^yk&a&AiU 92yG\ՕyA73P^f5y5,ׂ)h3F6beAefȬl{F(1lRMfm-dbH8ۡHj6Ŧ7$y5uN.>> E~q׹GTN˗ o](gf*e_ewBٝ!#s/:z<-hBf ȃ&C8;5?g\v˪^s9$؛KDE61Q>x?H3YMBʼzay-\oa  S 5WTr$8E$7#!{VA/}UcoDGVeRzeDJH0V[3)~;_>ZJKEG HDP-:21_jb:b57BsKՙ5'-) \6%7vB/ 9 ތNNQU܉*V ܍ 8K߀vl~gz?CYl:_pBNqFy#(j} >ZZZZ@w[ʭls0UDt3EZ#96#[\6o78ڤK꘿b#@+7l?a4FZogY՚ZnbS11:]b۪1.UUƙ AR\<%@(]\􌳠o\JUǧrxiVngk=~+%"MJ͈R953J%_0‰+.Ⲡn\-hWՅq͸u.4}=GE CI޾(;cY2h? NA]b]V:g%tnWJo=vR.mPY$,;އn =`Za8.A# }E"x, !Ѣ!$YqˢO $[I>jѧ, BE#x-!â"dZt%BM>eU,E Աu-!ۢ/ Գ-BТE, BcChbW)Gȱ7", E7#4h1BsnAha\nEhim,BkXEYE#Y4;:Zt'U@d]v#t=͢{[M݋Ӣpٿ$â-\wC0=w2s}d|0> #a caO,L?GDDƗ0=7az:{d0~ ӟ%LE[?Ɵa2v ӳ80·d\t´2X `$(2ÐLF00Ӑ; #Ld90K@F Dd$9 +̒0R, ft5, F0#;!hf a4&90##0Y3d4w-,-F0k6mCF{fa\fKuEF7=z fa 3 OY?f(tׄYd\0 0`d qׇYCư00#ƨ01cl݄qWyoI`nMrӷZlbnzŦo;T7uT+:SOw{t79cyMĹx7Г&yjb[y'MIry,7y'M>IqzRC47'M.x# 7'M.t k>v#ѮCbOmudF>J2;?"W_ʾJ,v ctZZ3"76t `8LW4#:y7] =$~H$Ej1c kB<Қ#pҕJz$=Jek` co2"?tI!42GjLHɽ!iY*M"OJw#d(ud>*}Eʤ?NY&oȩd܈ۑr_<|"BNs򽼊"o&ȻY0=/B/?J߈Q$Fd [R3g1J+)m;0] 7b?\AAVC<,Q̒i1KÒyX KU .cirD\ü+,CYe*e)X-⻬rQ!~ʲSrV_5PB<5ReD5VY51:,G؈f,"aN'k\?@RZ7"a[Xu2tVSF\ګ-g b}"R8A} {H=%VR=Aϖ +IW;i1ʖHc+:9b#hV-۲5F7[kg/%c x13#^5{c h,E|m2VjXm16!Mom;5?ﳐ +5>G?rgv< vv IdZl^7"K1syѼۼTR>ɾƾe7VFqlocW6vllgcksmlf&66ul̲14mL1FFFFAZi?m&G|\' \*P]S*>B M8,D*ɀ#LT~9#` zF߰]0U]&xF ŢIFHUsYhJG҈rrbq*Nc{HMS)@zCɑL7̂i#&ZEY0">*B'*2,SoN.N+Pm$}*(8\jA%"Փ ZvDPTy4i#'릊]T"h$B&{5爘V 7avY[Сa5hXunF.װ5܂j&kaLk}x U4K{fCDf4dK"(bخ`~A6o[,ߧU}./1( ~A > Ikhlá=FG~h[z3.Rp͸R4`*ŠT(lg°Y fA/+^o;~KM+ xq' !lea$q?c/{[T^5T%iA*S'U1y=&s6ÈZ;  ĸչj+/&ܾ_.4c30k=8B.9E&!/+)cJdiDV1-)h}(bRRPoyϪ܋.iq}ܣ%#[-ˬ`KWoUv cE"EX<[ -G9ά3b}߯Ęc$b4j>7wf-6S朻uϿ؍O4l2܃!!'<"Q1 E 8rFňgB$|FbTa5J:aӰ%*&4)C[C&5LRV TTTXՃQ#HʌΙ7l-o:i^zB(".WKqo˻Vzj VwpM~w1-I`6f⸟ٳEc-[wQA{͟fݕ5靓nEP/d6K6ΗNz+i>.R{Ɗgq7__ Ĥq6/sN:BB\Q~DLH\HBHeN򔓮Et;2wxN {kCo顬*&데wװ9N *#2ʹˑQ&:c0}*p.v¸*_5x,YkL:E!}ݫdCq/ڵnUW&d~@*!~#DoK%`hAm˕/G["M%AՈJOX!9v6Ja%< h#q{*yw᫉fpwQc03} 4 g8;¿ 0r1\8w)ѾQNA;~$:q]cؓՄ**Sg6QU[qC%ݕLu0W/b07]KhkYQ^dPd1O˜9Ϲrfdt kՌGңVtl'W(xm}ԯr G禀- hW[T=DňDG2 *AGHfpf8:51I$4KkmDMij4 Xfw߼7?޳s~s}|_6la##bNH9-##2b>)b~RSb~Z)1?#'b>-Y19 /&E/xY/dqN+6,/UzM ~eůmhy+~cVoxS[6wNJ6 ͸de㰰X^ PK  "؈+Nc#*X*w#ڽB[yt;vY' ,.񞉗UGӛ$:vJtR LtHM"̎]x2>oK$lvL'G\p$tJ\D: Gbt&欈`p_0{HJ;IE=Rβd:ϳ2 BJ Apok^AlFN+X> 9R0(txT;irNBܓs>*\`}QOB(bœ`$|Rnh)G&S u,dH C,{V E۰ҾcbLU\ӄugf`kWKID*Z֞7kֵ%ְq+(yw ާ(r2pĥ r[Rt{xnuw z4[-aFx{(ms_K Lִ:h sr&eek~OkKZ2ioqQ\x>o`Pn(PQ]+U0(V[pVJ"T*nPʥ_9:7mrqwĵ%){,`MFAlKBwy oVw5;]?OŪ!5|S)º";5'f/up䷈䶈ϋd:%ghxƆu ~2xS^,5lႧ;QTxKK a5}p+Eђ_9M2tܨ`)8 nDy`Bd/l'n3n8]M&thaDo!D{p9Kg8' ]BBC0ȪJs]p_qV<`sV02VILPHT,QEbATcsI3 1iLLއ{%*e]3،eԮjVlDsK,Ո,a׈Fdž]gJ'DZ1s x!\an'؁?D>⑏Q~my?a8Wx1&fجPlJ1O?=zS0QoG!&C_o-BMw3Bп / . tO\guts|_|Ie|Y- 򐆇uGuIg?#o< tEu'Mƙ!{ȟicE qĤP]B&&r 2}RP$u̢VK&ҚhB4'X]' w/h 3Ew#XeKFۅoe (9I`M])+euN+U-Ndv5K;)lqq<Ǵ-B+2v,QzQPg[R)/+e=1Χ)9-ʞeeq(=GLM8֑kRXW´3)FyTۮqNF6o)3Z[S|2bc&nTЗč[,lJ$S=f@.3& iPK4irȐ*In#>>`\LuE^}7MFTeDUHS.4DZpVVCJ~CnQ[1Qn[k-*Upb6K iW=j3p.`5ƎfR)+asBU [.[],L3;*kwÌ:5uň]4\*;v2ߗg𛽽V ?1n'91v)(u.E9*l粫3$a1[d4:r=1[dg I4Aשt:͉uiƓik01{n}j.Y1mnq'z'Dܭ\qw,qVՒLGV34$Z`z;m 沔hxeBK!\qy(sYw߼GhFbaބIub1by!|qM\ߌ#x nI8naD5$U4~ )?ݒ?3(CC;y j{ m!Q _+KP1mU>tH`p 6{}ro0];yCWI:o فY\;AꜢ7QP/cm f8dK3ti; %22Jxޫqӭ־Ikڷڷww ]ݴ=<}~0GQ>EW.aClЍ? ^.[@,lQ[T~VL迌Y |{ʜ!|z73c%]*P"Geپ`eDcН|ĝ|r).hܭQjvvaiE0mfi*]ߏy|lVxUMw_Z4J bVX5Occ0.dKZdDEbtk>>Xyʞ bΞ1Ũy1?M}a| _`"y ?6<fŏeɗY %=LYQ#t٣̠af>Q'.ۡkx[U,8z aOW^lf\ޅ?FaV@c~zcP^a%80Cy+L'Qo`!rT3P4{ s$/)HzO!I>GRdI[ Hz(S$Ißd+}YI[=x;/aBInUn¶OBC5Np}nBUd |)]Fy, XjumZQ1g~1W^ձem߹xv{e;Gnuݵ왃ޏ _!`rW]cJzzT%??zLx^ T7ʇ\nV] _y>lۙ¹]鋜5ߐ+to@^a#uc ;ℎ& 4~w6B`h+~9!+ERaos.§jNBlÃ5S-s( 6D%#hV-|*&3#w #*A?zWzvNG(N MHuz:ڏ|t۲ɾK_dX>bqz{+fIw/gjFjKA=M|hw0͵ K< uM%YվA,*8WS3+ˊ(M8+7/ e CHx8Ef˥ &xCL5bIOYn?ddj)t")ԝZ;Zf$3suUHcya+(ܝ.E":RvF޸ AmD-w{x[ tuvhF?n(-*Q9xFܢy3KiEXݘǑg#M-.Y-I=i~Iqm~yoIItJ}a;OK$&Gc#i#< +r3ƅ_T={WubInʾWTIvf$ь~,Bzjp I=~YC%=7?L]f/H5Ut N1-P%!`n+k 4z9vTyUgZ8շTjHņ=1iQR4Q .mo\bOF9*)zgbëFJ)iHZ2%_ @@u%$4UmNBg^_#ͨ.7\5S8Trrp- g6xЀa1 adSXZURAkmKٺBbdu <`g騱y°C;-~p!.e6+=T 2$S :̀7Y?Yiw"dGѵKM03|BkL|G0(tl`xkLc>&~ xL^`"&2yL>`!|&2L`%|&]Yejd}F3fk)j&)s!LP5BSj5B7=鶀g!܁Ʈ3&u_t6䫭3wM%A~QG7-?TѸc!+;\P x>jF5J[ȞZHQXN ?'tT5r㫮.om궥 iKOt`Q| Ѱ  ah+d?ҲMq;?ؒS!D<*{ߧ{IşRişQYK/(/)(55늿ۊjx+*+*+_*_+Zj)?(?)()()TI~\H@Q;)dm@tuJa)!'jLEWӹ$T(SvuIpBBFIK}0d7+vb'8=Z;vc7DW AhX?D0j 70{ɀ@F9-N&$5wzWx;!&Cb"}7%CTo`=ek`4@jV\uNo{ȷkoAvTj; wx^G; C<=6 Y0Φ#96{.$@PWB9\a-f,87yp+\p5lK~#54(j'J [5Nf j eoN8,w@LPB(A&+h; D-b% h#ݐɩ нaH(WvbMA<0$#clM{MFXPh{]~ Kפ|6*6vUcVѼvoXjrat?s/J=tS@u$%8RAΰ}`vad׻! Q'w~4<FEO,Rʷ{殒YW-5yM`޵}*yr,rCJ;e)t&}Si$Qwȫ98dwyTcѱ6z] .o n{ /7{:`='REI%+)Pnq=|k?Tj8TaD0-pSTsAd?@:;&|SyPv5ꬊDJ"ٔ3?g5̕&,:MX;#΋R-C\:G*'I>P,M+IwvRZj%JG .W|FʊܼQ.zƒe<ߒo$p8#`0!GB.->5y1%m}|Imfn=acR[gJ`%{ dHLԅnI3H:ӒYY$m<CIJ/e$clGZkٖ[y>RϷ ,u?R/hK=ԋ,1zXK]iY%RWoK-u k- DK]GzK`-uYfKBҀ%m'tI\iٝl٭ 7K=b0x`4N8㨖S  G@΀f,U8 Nٰ*,X 7\؉ ΃(x۸Dž V_x4ETౘ8Éùbiqq9p)^5kq>ǧF'6(l1*(8<ƈҟax[?V ;\`l&Iv:=L]4 6H9l޺=[>O>,a^O:!n ^vpmK *YD,MMg9fH}U'T>iL]t%O CCr%AE;\zA5/J1b0d!0KKD\g PI+1>[rqοtę6H;7D&j!9/pN=AX;\vH]rD AD?nR " [ENÞ JWr H}Kp[6 K;>)/?y8A3rQ*$^ܭr\^{P.__W$}**`dLLm2d_jq@骾t6&3[K9ӓY϶-~E7[FU^&ʗ$M d:i8?.mnjZݹLלV1aoU_%P.r]VJ\3m3kȶ)0nlNL2cٹY6wF?Ӂ,m^X}MeݎP%dǓ53̠ò;3m<-eg,+(~ m9,qIfDu@UqH z,^K.2nɾ}Ւ۾Di sa%i'ҶHq)]=JI*m-H"*.!H62Iz쵚:񀊯xWjsBqN\TxU xG$14VLI5LnvxiLDa|2;lk_RsFha'sP ?ᇇG(k1,-ͭPl_R(|(.E+`zCVVj{/1H!"$~!8mae s".c<@'SQt1w7qp<.櫸VŦ: |Z>̢)cVnFxDqVa:7_Ѽɴ Uo`SehGP7V76٣^}E^Ne ZLK*F7Cv/}ФPØ|~ [XSu1% B#8?FCJX;( 7C( !qZgݭgwɇc~Y#cW޿ƒ)Kg(KJj*nBmoQqcqu1 iZj]{hʷF٤ NLcsh'{Rc\3ʺ:V*hL +qM"JMaR%VB_*l"H oޘ^la;`H _^/C=:ǵzGaЃAT䗔6KMp/ (cL_ mDqB44}E"swr*UI( CdxP.uN|= N7`{xOl ʙ76˽'z/߰Ί9]/`|K16Heԩ)K= np ꡶)1Qԍ)V\f YZ