pki-base-java-10.5.9-13.el7_6$>xKCnn./ ,ަf>7L?<d  D          % ,' '  '  d'  '  g' P'''r'0@(38<9:GG8'H'Ip'XؘY؜\ج']H'^bcd2e7f:l<tT'u'vތw'xߜ'8Cpki-base-java10.5.913.el7_6Certificate System - Java FrameworkThe PKI Framework contains the common and client libraries and utilities written in Java. This package is a part of the PKI Core used by the Certificate System. This package is a part of the PKI Core used by the Certificate System. ================================== || ABOUT "CERTIFICATE SYSTEM" || ================================== Certificate System (CS) is an enterprise software system designed to manage enterprise Public Key Infrastructure (PKI) deployments. PKI Core contains ALL top-level java-based Tomcat PKI components: * pki-symkey * pki-base * pki-base-python2 (alias for pki-base) * pki-base-python3 * pki-base-java * pki-tools * pki-server * pki-ca * pki-kra * pki-ocsp * pki-tks * pki-tps * pki-javadoc which comprise the following corresponding PKI subsystems: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) Python clients need only install the pki-base package. This package contains the python REST client packages and the client upgrade framework. Java clients should install the pki-base-java package. This package contains the legacy and REST Java client packages. These clients should also consider installing the pki-tools package, which contain native and Java-based PKI tools and utilities. Certificate Server instances require the fundamental classes and modules in pki-base and pki-base-java, as well as the utilities in pki-tools. The main server classes are in pki-server, with subsystem specific Java classes and resources in pki-ca, pki-kra, pki-ocsp etc. Finally, if Certificate System is being deployed as an individual or set of standalone rather than embedded server(s)/service(s), it is strongly recommended (though not explicitly required) to include at least one PKI Theme package: * dogtag-pki-theme (Dogtag Certificate System deployments) * dogtag-pki-server-theme * redhat-pki-server-theme (Red Hat Certificate System deployments) * redhat-pki-server-theme * customized pki theme (Customized Certificate System deployments) * -pki-server-theme NOTE: As a convenience for standalone deployments, top-level meta packages may be provided which bind a particular theme to these certificate server packages.\.x86-02.bsys.centos.orgCentOSGPLv2CentOS BuildSystem System Environment/Basehttp://pki.fedoraproject.org/linuxnoarch Pb !& #-+,).*)&##"!81;8+70#%A큤A큤A\.\.\.\.\.|[!T[!T\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|\.|104e693105a0f33323a500b28140eb73edbddc312c59aff2af732bfcbe4c468394551476c6e1669c47fcfc7410317b2cd505bfe5c3ecefb1e74fecebcf90f871b2df657063377311c021e0fd7006b3ab5ad93e365860dc3ecf68ba0078a90481fdd8d5ef0c8813c633e77997d6dbe23557a5112937962d5ab7b1053de866027b643b71cec56efdc737a20687bb05ccbba40c3481b2c0e100ccf53331e0fba620/usr/share/java/commons-cli.jar/usr/share/java/commons-codec.jar/usr/share/java/commons-httpclient.jar/usr/share/java/commons-io.jar/usr/share/java/commons-lang.jar/usr/share/java/commons-logging.jar/usr/share/java/httpcomponents/httpclient.jar/usr/share/java/httpcomponents/httpcore.jar/usr/share/java/jackson/jackson-core-asl.jar/usr/share/java/jackson/jackson-jaxrs.jar/usr/share/java/jackson/jackson-mapper-asl.jar/usr/share/java/jackson/jackson-mrbean.jar/usr/share/java/jackson/jackson-smile.jar/usr/share/java/jackson/jackson-xc.jar/usr/share/java/jaxb-api.jar/usr/lib/java/jss4.jar/usr/share/java/ldapjdk.jar/usr/share/java/pki/pki-certsrv.jar/usr/share/java/pki/pki-cmsutil.jar/usr/share/java/pki/pki-nsutil.jar/usr/share/java/pki/pki-tools.jar/usr/share/java/resteasy-base/resteasy-atom-provider.jar/usr/share/java/resteasy-base/resteasy-client.jar/usr/share/java/resteasy-base/resteasy-jackson-provider.jar/usr/share/java/resteasy-base/resteasy-jaxb-provider.jar/usr/share/java/resteasy-base/jaxrs-api.jar/usr/share/java/resteasy-base/resteasy-jaxrs-jandex.jar/usr/share/java/resteasy-base/resteasy-jaxrs.jar/usr/share/java/servlet.jar/usr/share/java/slf4j/slf4j-api.jar/usr/share/java/slf4j/slf4j-jdk14.jarrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootpki-core-10.5.9-13.el7_6.src.rpmpki-base-java      apache-commons-cliapache-commons-codecapache-commons-ioapache-commons-langapache-commons-loggingjakarta-commons-httpclientjava-1.8.0-openjdk-headlessjavassistjpackage-utilsjssldapjdkpki-baseresteasy-base-atom-providerresteasy-base-clientresteasy-base-jackson-providerresteasy-base-jaxb-providerresteasy-base-jaxrsresteasy-base-jaxrs-apirpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)slf4jxalan-j2xerces-j2xml-commons-apisxml-commons-resolverrpmlib(PayloadIsXz)0:1.7.5-104.4.4-54.19-510.5.9-13.el7_63.0.6-13.0.6-13.0.6-13.0.6-13.0.6-13.0.6-13.0.4-14.6.0-14.0-15.2-14.11.3\f\T4\R@\\U@\[@[{[l,[`O@[U@[>@[d@[@[o[@ZUZ@Z@ZZxG@Zg#Z.s@Z@Z ZYYY@Y@Y@YoIYlYGY>@Y5GY-^Y$$@Y"Y@Y#@X@XX@XO@X*XRXOX!@X&X2@WWҤ@WίW#W:WWt@W{@Wu WgWV@WV@WV@WV@WV@WV@W 10.5.9-13Dogtag Team 10.5.9-12Dogtag Team 10.5.9-11Dogtag Team 10.5.9-10Dogtag Team 10.5.9-9Dogtag Team 10.5.9-8Dogtag Team 10.5.9-7Dogtag Team 10.5.9-6Dogtag Team 10.5.9-5Dogtag Team 10.5.9-4Dogtag Team 10.5.9-3Dogtag Team 10.5.9-2Dogtag Team 10.5.9-1Dogtag Team 10.5.1-13.1Dogtag Team 10.5.1-13Dogtag Team 10.5.1-12Dogtag Team 10.5.1-11Dogtag Team 10.5.1-10Dogtag Team 10.5.1-9Dogtag Team 10.5.1-8Dogtag Team 10.5.1-7Dogtag Team 10.5.1-6Dogtag Team 10.5.1-5Dogtag Team 10.5.1-4Troy Dawson - 10.5.1-3Dogtag Team 10.5.1-2Dogtag Team 10.5.1-1Dogtag Team 10.5.0-1Dogtag Team 10.4.1-15Dogtag Team 10.4.1-14Dogtag Team 10.4.1-13Dogtag Team 10.4.1-12Dogtag Team 10.4.1-11Dogtag Team 10.4.1-10Dogtag Team 10.4.1-9Dogtag Team 10.4.1-8Dogtag Team 10.4.1-7Dogtag Team 10.4.1-6Dogtag Team 10.4.1-5Dogtag Team 10.4.1-4Dogtag Team 10.4.1-3Dogtag Team 10.4.1-2Dogtag Team 10.4.1-1Dogtag Team 10.4.0-1Dogtag Team 10.3.3-18Dogtag Team 10.3.3-17Dogtag Team 10.3.3-16Dogtag Team 10.3.3-15Dogtag Team 10.3.3-14Dogtag Team 10.3.3-13Dogtag Team 10.3.3-12Dogtag Team 10.3.3-11Dogtag Team 10.3.3-10Dogtag Team 10.3.3-9Dogtag Team 10.3.3-8Dogtag Team 10.3.3-7Dogtag Team 10.3.3-6Dogtag Team 10.3.3-5Dogtag Team 10.3.3-3Dogtag Team 10.3.3-2Dogtag Team 10.3.3-1Dogtag Team 10.3.3-0.1Dogtag Team 10.3.2-5Dogtag Team 10.3.2-4Dogtag Team 10.3.2-3Dogtag Team 10.3.2-2Dogtag Team 10.3.2-1Dogtag Team 10.3.2-0.1Dogtag Team 10.3.1-1Dogtag Team 10.3.0-1Dogtag Team 10.3.0.b1-1Dogtag Team 10.3.0.a2-2Dogtag Team 10.3.0.a2-1Dogtag Team 10.3.0.a1-2Dogtag Team 10.3.0.a1-1Dogtag Team 10.3.0-0.5Dogtag Team 10.3.0-0.4Dogtag Team 10.3.0-0.3Dogtag Team 10.3.0-0.2Dogtag Team 10.3.0-0.1Dogtag Team 10.2.7-0.3Tomas Radej - 10.2.7-0.2Dogtag Team 10.2.7-0.1Dogtag Team 10.2.6-1Dogtag Team 10.2.6-0.3Dogtag Team 10.2.6-0.2Dogtag Team 10.2.6-0.1Dogtag Team 10.2.5-1Dogtag Team 10.2.5-0.2Dogtag Team 10.2.5-0.1Dogtag Team 10.2.4-1Dogtag Team 10.2.4-0.2Dogtag Team 10.2.4-0.1Dogtag Team 10.2.3-1Dogtag Team 10.2.3-0.1Dogtag Team 10.3.0-0.1Dogtag Team 10.2.3-0.1Dogtag Team 10.2.2-1Dogtag Team 10.2.2-0.1Dogtag Team 10.2.1-1Matthew Harmsen - 10.2.1-0.4Ade Lee 10.2.1-0.3Christina Fu 10.2.1-0.2Dogtag Team 10.2.1-0.1Ade Lee 10.2.0-3Matthew Harmsen - 10.2.0-2Dogtag Team 10.2.0-1Matthew Harmsen - 10.2.0-0.10Matthew Harmsen - 10.2.0-0.9Matthew Harmsen - 10.2.0-0.8Fedora Release Engineering - 10.2.0-0.5Jack Magne - 10.2.0-0.7Matthew Harmsen - 10.2.0-0.6Matthew Harmsen - 10.2.0-0.5Ade Lee - 10.2.0-0.4Fedora Release Engineering - 10.2.0-0.3Michael Simacek - 10.2.0-0.2Dogtag Team 10.2.0-0.1Ade Lee 10.1.0-1Ade Lee 10.1.0-0.14Ade Lee 10.1.0-0.13Ade Lee 10.1.0-0.12Ade Lee 10.1.0-0.11Endi S. Dewata 10.1.0-0.10Abhishek Koneru 10.1.0.0.9Abhishek Koneru 10.1.0.0.8Endi S. Dewata 10.1.0-0.7Endi S. Dewata 10.1.0-0.6Endi S. Dewata 10.1.0-0.5Ade Lee 10.1.0-0.4Endi S. Dewata 10.1.0-0.3Matthew Harmsen 10.1.0-0.2Ade Lee 10.1.0-0.1Endi S. Dewata 10.0.2-5Ade Lee 10.0.2-4Ade Lee 10.0.2-3Endi S. Dewata 10.0.2-2Ade Lee 10.0.2-1Ade Lee 10.0.2-0.8Endi S. Dewata 10.0.2-0.7Endi S. Dewata 10.0.2-0.6Ade Lee 10.0.2-0.5Endi S. Dewata 10.0.2-0.4Endi S. Dewata 10.0.2-0.3Endi S. Dewata 10.0.2-0.2Endi S. Dewata 10.0.2-0.1Endi S. Dewata 10.0.1-9Ade Lee 10.0.1-8Endi S. Dewata 10.0.1-7Matthew Harmsen 10.0.1-6Endi S. Dewata 10.0.1-5Endi S. Dewata 10.0.1-4Matthew Harmsen 10.0.1-3Matthew Harmsen 10.0.1-2Ade Lee 10.0.1-1Matthew Harmsen 10.0.0-5Matthew Harmsen 10.0.0-4Ade Lee 10.0.0-3Ade Lee 10.0.0-2Ade Lee 10.0.0-1Matthew Harmsen 10.0.0-0.56.b3Endi S. Dewata 10.0.0-0.55.b3Endi S. Dewata 10.0.0-0.54.b3Ade Lee 10.0.0-0.53.b3Ade Lee 10.0.0-0.52.b3Endi S. Dewata 10.0.0-0.51.b2Endi S. Dewata 10.0.0-0.50.b2Matthew Harmsen 10.0.0-0.49.b2Ade Lee 10.0.0-0.48.b2Matthew Harmsen 10.0.0-0.47.b1Ade Lee 10.0.0-0.46.b1Ade Lee 10.0.0-0.45.b1Ade Lee 10.0.0-0.44.b1Ade Lee 10.0.0-0.43.b1Ade Lee 10.0.0-0.42.b1Ade Lee 10.0.0-0.41.b1Ade Lee 10.0.0-0.40.b1Endi S. Dewata 10.0.0-0.40.a2Endi S. Dewata 10.0.0-0.39.a2Ade Lee 10.0.0-0.38.a2Endi S. Dewata 10.0.0-0.37.a2Ade Lee 10.0.0-0.36.a2Endi S. Dewata 10.0.0-0.36.a1Endi S. Dewata 10.0.0-0.35.a1Endi S. Dewata 10.0.0-0.34.a1Ade Lee 10.0.0-0.33.a1Matthew Harmsen 10.0.0-0.32.a1Endi S. Dewata 10.0.0-0.31.a1Endi S. Dewata 10.0.0-0.30.a1Endi S. Dewata 10.0.0-0.29.a1Endi S. Dewata 10.0.0-0.28.a1Endi S. Dewata 10.0.0-0.27.a1Endi S. Dewata 10.0.0-0.26.a1Endi S. Dewata 10.0.0-0.25.a1Endi S. Dewata 10.0.0-0.24.a1Matthew Harmsen 10.0.0-0.23.a1Endi S. Dewata 10.0.0-0.22.a1Endi S. Dewata 10.0.0-0.21.a1Matthew Harmsen 10.0.0-0.20.a1Matthew Harmsen 10.0.0-0.19.a1Matthew Harmsen 10.0.0-0.18.a1Endi S. Dewata 10.0.0-0.17.a1Matthew Harmsen 10.0.0-0.16.a1Ade Lee 10.0.0-0.15.a1Christina Fu 10.0.0-0.14.a1Endi S. Dewata 10.0.0-0.13.a1Endi S. Dewata 10.0.0-0.12.a1Ade Lee 10.0.0-0.11.a1Matthew Harmsen 10.0.0-0.10.a1Matthew Harmsen 10.0.0-0.9.a1Jack Magne 10.0.0-0.8.a1Matthew Harmsen 10.0.0-0.7.a1Endi S. Dewata 10.0.0-0.6.a1Ade Lee 10.0.0-0.5.a1Endi S. Dewata 10.0.0-0.4.a1Matthew Harmsen 10.0.0-0.3.a1Matthew Harmsen 10.0.0-0.2.a1Nathan Kinder 10.0.0-0.1.a1Ade Lee 9.0.16-3Endi S. Dewata 9.0.16-2Matthew Harmsen 9.0.16-1Matthew Harmsen 9.0.15-1Matthew Harmsen 9.0.14-1Ade Lee 9.0.13-1Matthew Harmsen 9.0.12-1Matthew Harmsen 9.0.11-1Matthew Harmsen 9.0.10-1Matthew Harmsen 9.0.9-1Matthew Harmsen 9.0.8-2Matthew Harmsen 9.0.8-1Matthew Harmsen 9.0.7-1Matthew Harmsen 9.0.6-2Matthew Harmsen 9.0.6-1Matthew Harmsen 9.0.5-2Matthew Harmsen 9.0.5-1Matthew Harmsen 9.0.4-1Matthew Harmsen 9.0.3-2Matthew Harmsen 9.0.3-1Matthew Harmsen 9.0.2-1Matthew Harmsen 9.0.1-3Matthew Harmsen 9.0.1-2Matthew Harmsen 9.0.1-1Matthew Harmsen 9.0.0-3Matthew Harmsen 9.0.0-2Matthew Harmsen 9.0.0-1- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] [manpage] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1659939 - CC: Simplifying Web UI session timeout configuration [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA, - # Added Batch Update Information to Product Version (mharmsen)- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1657922 - CC: CA/OCSP startup fail on SystemCertsVerification if enableOCSP is true [rhel-7.6.z] (jmagne) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1645262 - pkidestroy may not remove all files [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1645263 - Auth plugins leave passwords in the access log and audit log using REST [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1645429 - pkispawn fails due to name collision with /var/log/pki/ [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1655951 - CC: tools supporting CMC requests output keyID needs to be captured in file [rhel-7.6.z] (cfu) - Bugzilla Bug #1656297 - Unable to install with admin-generated keys [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- Require "tomcatjss >= 7.2.1-8" as a build and runtime requirement - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1632116 - CC: missing audit event for CS acting as TLS client [rhel-7.6.z] (cfu) - Bugzilla Bug #1632120 - Unsupported RSA_ ciphers should be removed from the default ciphers list [rhel-7.6.z] (cfu) - Bugzilla Bug #1632615 - Permit certain SHA384 FIPS ciphers to be enabled by default for RSA and ECC . . . [rhel-7.6.z] (cfu) - Bugzilla Bug #1632616 - X500Name.directoryStringEncodingOrder overridden by CSR encoding (coverity changes) [rhel-7.6.z] (mharmsen) - Bugzilla Bug #1633104 - CMC: add config to allow non-clientAuth [rhel-7.6.z] (cfu) - Bugzilla Bug #1636490 - Installation of CA using an existing CA fails [rhel-7.6.z] (edewata) - Bugzilla Bug #1643878 - pki cli command for RHCS doesn't prompt for a password [rhel-7.6.z] (edewata) - Bugzilla Bug #1643879 - CC: Identify version/release of pki-ca, pki-kra, pki-ocsp, pki-tks, and pki-tps remotely [RHEL] [rhel-7.6.z] (cfu, jmagne) - Bugzilla Bug #1643880 - PKI subsystem process is not shutdown when there is no space on the disk to write logs [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- Updated nuxwdog dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #673182 - ECC keys not supported for signing audit logs (cfu) - Bugzilla Bug #1593805 - Better understanding of NSS_USE_DECODED_CKA_EC_POINT for ECC (cfu) - Bugzilla Bug #1601071 - Certificate generation happens with partial attributes in CMCRequest file (cfu) - Bugzilla Bug #1601569 - CC: Enable all config audit events (cfu) - Bugzilla Bug #1608375 - CMC Revocations throws exception with same reqIssuer & certissuer (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1596629 - ipa-replica-install --setup-kra broken on DL0 with latest version (abokovoy) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1548203 - pki console configurations that involves ldap passwords leave the plain text password in signed audit logs (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1494591 - keyGen fails when only Identity- Re-spin alpha builds- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1471935 - X500Name.directoryStringEncodingOrder overridden by CSR encoding (cfu) - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a certificate (ftweedal) - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in SharedToken scenario's (cfu) - Bugzilla Bug #1550742 - Address ECC profile overrides (cfu) - Bugzilla Bug #1562841 - servlet profileSubmitCMCSimple throws NPE (cfu) - Bugzilla Bug #1572432 - AuditVerify failure due to line breaks (cfu) - Bugzilla Bug #1592961 - Need proper default subjectDN for CMC request authenticated through SharedToken (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a certifcate (ftweedal) - Bugzilla Bug #1544843 - ExternalCA: Installation failed during csr generation with ecc (rrelyea, gkapoor) - Bugzilla Bug #1557569 - Re-base pki-core from 10.5.1 to latest upstream 10.5.x (RHEL) (mharmsen) - Bugzilla Bug #1580394 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC (cfu) - Bugzilla Bug #1580527 - CVE-2018-1080 pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access (ftweedal, cfu) - Bugzilla Bug #1585866 - CRMFPopClient tool - should allow option to do no key archival (cfu) - Bugzilla Bug #1588655 - Cert validation for installation with external CA cert (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- Rebuild due to build system database problem- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a certifcate [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1585945 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC [rhel-7.5.z] (cfu) - Bugzilla Bug #1587826 - ExternalCA: Installation failed during csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor) - Bugzilla Bug #1588944 - Cert validation for installation with external CA cert [rhel-7.5.z] (edewata) - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow option to do no key archival (cfu) - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access [rhel-7.5.z] (ftweedal, cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- Updated "jss" build and runtime requirements (mharmsen) - ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu) - Bugzilla Bug #1572548 - IPA install with external-CA is failing when FIPS mode enabled. [rhel-7.5.z] (edewata) - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE [rhel-7.5.z] (cfu) - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu) - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs improvement [rhel-7.5.z] (jmagne) - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in pkispawn configuration step [rhel-7.5.z] (cfu) - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong input class_id [rhel-7.5.z] (cfu) - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System 9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for standard conformance [rhel-7.5.z] (cfu) - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1560233 - libtps does not directly depend on libz- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1550581 - CMCAuth throws org.mozilla.jss.crypto.TokenException: Unable to insert certificate into temporary database [rhel-7.5.z] (cfu) - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata) - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers [rhel-7.5.z] (cheimes, mharmsen) - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a certifcate [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for standard conformance [rhel-7.5.z] (cfu) - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu) - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu) - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1558919 - Not able to generate certificate request with ECC using pki client-cert-request [rhel-7.5.z] (akahat) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1560233 - libtps does not directly depend on libz- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event set (RHEL) (edewata) - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata) - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM and FIPS (edewata) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1542210 - pki console configurations that involves ldap passwords leave the plain text password in debug logs (jmagne) - Bugzilla Bug #1543242 - Regression in lightweight CA key replication (ftweedal) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event set (RHEL) (edewata) - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and audit event logging at startup (jmagne) - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA instance (alee) - Bugzilla Bug #1525306 - CC: missing CMC request and response record (cfu) - Bugzilla Bug #1532933 - Installing subsystems with external CMC certificates in HSM environment shows import error (edewata) - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm (edewata) - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers permitted in fips mode (mharmsen) - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED outcomes. (edewata) - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in SharedToken scenario's (cfu) - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown revRequest.issuer (cfu) - Bugzilla Bug #1541853 - ProfileService: config values with backslashes have backslashes removed (ftweedal) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the- Updated jss, nuxwdog, and openssl dependencies - ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in few cases (ftweedal) - Bugzilla Bug #1428021 - CC: shared token storage and retrieval mechanism (cfu) - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause error (cfu) - Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog (alee) - Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during pkispawn (alee) - Bugzilla Bug #1520526 - p12 admin certificate is missing when certificate is signed Externally (edewata) - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA instance (alee) - Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to missing nextupdate field (ftweedal) - Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen) - Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords in several different files after installation completes (alee) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - Bugzilla Bug #1466066 - CC: Secure removal of secret data storage (jmagne) - Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to setup with CMC signed certificates (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- dogtagpki Pagure Issue #2853 - Cleanup spec file conditionals- Patch applying check-ins since 10.5.1-1- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- #Bugzilla Bug #1492560 - ipa-replica-install --setup-kra broken on DL0- #Require "jss >= 4.4.0-8" as a build and runtime requirement - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Resolves: rhbz #1486870,1485833,1487509,1490241,1491332 - # Bugzilla Bug #1486870 - Lightweight CA key replication fails (regressions) - # Bugzilla Bug #1485833 - Missing CN in user signing cert would cause error - # Bugzilla Bug #1487509 - pki-server-upgrade fails when upgrading from - # Bugzilla Bug #1490241 - PKCS12: upgrade to at least AES and SHA2 (FIPS) - # Bugzilla Bug #1491332 - TPS UI: need to display tokenType and tokenOrigin - # dogtagpki Pagure Issue #2764 - py3: pki.key.archive_encrypted_data: - ########################################################################## - # RHCS 9.2: - ########################################################################## - # Resolves: rhbz #1486870,1485833,1487509,1490241,1491332,1482729,1462271 - # Bugzilla Bug #1462271 - TPS incorrectly assigns "tokenOrigin" and - # Bugzilla Bug #1482729 - TPS UI: need to display tokenType and tokenOrigin- Resolves: rhbz #1463350 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1463350 - Access banner validation (edewata)- # Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing - # Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause - # Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert - # Bugzilla Bug #1463350 - Access banner validation (edewata) - # Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal - # Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen) - # Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with - # Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option - # Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03 - # Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system- # Resolves: rhbz #1469432 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1469432 - CMC plugin default change - # Resolves CVE-2017-7537 - # Fixes BZ #1470948- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1458043 - Key recovery on token fails with invalid public key error on KRA (alee) - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client authentication cert against CMC signer (cfu) - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after deleting the any of the subsystem certs from it (ftweedal)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret) using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne) - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing certificate requests (cfu) - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC revocation non-signing cert requests (cfu) - Bugzilla Bug #1458047 - change the way aes clients refer to aes keysets (alee) - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code (alee) - Bugzilla Bug #1460028 - In keywrap mode, key recovery on KRA with HSM causes KRA to crash (ftweedal)- Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement - ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS enabled system (edewata) - Bugzilla Bug #1447144 - CA brought down during separate KRA instance creation (edewata) - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure ACCESS_SESSION_ESTABLISH_FAILURE (edewata) - Bugzilla Bug #1454450 - SubCA installation failure with 2 step installation in fips enabled mode (edewata) - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import is asking for password when already provided (edewata) - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes) - Bugzilla Bug #1458043 - Key recovery using externalReg fails with java null pointer exception on KRA (alee) - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter (edewata) - Bugzilla Bug #1458429 - client-cert-import --ca-cert should import CA cert with trust bits "CT,C,C" (edewata) - ########################################################################## - # RHCS 9.2: - ########################################################################## - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret) using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne) - Bugzilla Bug #1445519 - CA Server installation with HSM fails (jmagne) - Bugzilla Bug #1452617 - Unable to create IPA Sub CA (ftweedal) - Bugzilla Bug #1454471 - Enabling all subsystems on startup (edewata) - Bugzilla Bug #1455617 - Key recovery on token fails because key record is not marked encrypted (alee)- Bugzilla Bug #1454603 - Unable to install IPA server due to pkispawn error (mharmsen)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal non-signing cert requests (cfu) - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed) CMC with identity proof (cfu) - Bugzilla Bug #1447144 - CA brought down during separate KRA instance creation (mharmsen) - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata) - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne) - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen) - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in ConnectorServlet. (edewata) - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata) - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED audit event. (edewata)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when HSM is used. (alee) - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes) - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause error (cfu) - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from the KRA (ftweedal) - Bugzilla Bug #1448204 - pkispawn of clone install fails with InvalidBERException (ftweedal) - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on thales hsm (alee) - Updated "jss" build and runtime requirements (mharmsen) - ########################################################################## - # RHCS 9.2: - ########################################################################## - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)- ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1303683 - dogtag should support GSSAPI based auth in conjuction with FreeIPA (ftweedal) - Bugzilla Bug #1385208 - RHCS 9.1 RC5 CA in the certificate profiles the startTime parameter is not working as expected. (jmagne) - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing certificate requests (cfu) - Bugzilla Bug #1426754 - PKCS12: upgrade to at least AES and SHA2 (ftweedal) - Bugzilla Bug #1445088 - profile modification cannot remove existing config parameters (ftweedal) - Bugzilla Bug #1445535 - CC: Crypto Operation (AES Encryption/Decryption) (RHEL) (alee) - Bugzilla Bug #1446874 - Missing ClientIP and ServerIP in audit log when pki CLI terminates SSL connection (edewata) - Bugzilla Bug #1446875 - Session timeout for PKI console (RHEL) (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1404480 - CC: Crypto Operation (AES Encryption/Decryption) (RHCS) (alee)- ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1282504 - Installing pki-server in container reports scriptlet failed, exit status 1 (jpazdziora) - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS enabled system (edewata) - Bugzilla Bug #1410650 - [RFE] Add SCP03 support for sc 7 g & d cards (RHEL) (jmagne) - Bugzilla Bug #1437591 - cli authentication using expired cert throws an exception (edewata) - Bugzilla Bug #1437602 - non-CA cli looks for CA in the instance during a request (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1274086 - [RFE] Add SCP03 support for sc 7 g & d cards (RHCS) (jmagne) - ############################################################################ - # Common Criteria - ############################################################################ - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures (edewata) - Bugzilla Bug #1417307 - CC: Audit Review /Searches (edewata) - Bugzilla Bug #1419737 - CC: CMC: id-cmc-popLinkWitnessV2 feature implementation (cfu)- Require "nss >= 3.28.3" as a build and runtime requirement - Require "jss >= 4.4.0-4" as a build and runtime requirement - Require "tomcatjss >= 7.2.1-3" as a build and runtime requirement - dogtagpki Pagure Issue #2612 - Unable to clone due to pki pkcs12-cert-find failure (edewata) - ############################################################################ - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4 - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.4.x - ############################################################################ - # RHEL 7.4: - ############################################################################ - ############################################################################ - # RHCS 9.2: - ############################################################################ - ############################################################################ - # Common Criteria - ############################################################################ - Bugzilla Bug #1419734 - CC: CMC: id-cmc-identityProofV2 feature implementation (cfu) - Bugzilla Bug #1419742 - CC: CMC: provide Proof of Possession for encryption cert requests (cfu) - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures (edewata) - Bugzilla Bug #1428020 - CC: CMC feature support: provided issuance protection cert mechanism (cfu)- Require "jss >= 4.4.0-1" as a build and runtime requirement - Require "tomcatjss >= 7.2.1-1" as a build and runtime requirement - ############################################################################ - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4 - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.4.x - ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1222557 - ECDSA Certificates Generated by Certificate System 8.1 fail NIST validation test with parameter field. (cfu) - Bugzilla Bug #1238684 - Generting Symmetric key fails with key-generate when --usages verify (vakwetu) - Bugzilla Bug #1246635 - user-cert-add --serial CLI request to secure port with remote CA shows authentication failure (edewata) - Bugzilla Bug #1249400 - CA EE: Submit caUserCert request without uid does not show proper error message (vakwetu) - Bugzilla Bug #1305993 - Add profile component that copies CN to SAN (ftweedal) - Bugzilla Bug #1316653 - pki ca-cert-request-submit fails presumably because of missing authentication even if it should not require any (edewata) - Bugzilla Bug #1325071 - add options to enable/disable cert or crl publishing. (vakwetu) - Bugzilla Bug #1330800 - Failed to start pki-tomcatd Service ("ipa-cacert-manage renew" failed?) (edewata) - Bugzilla Bug #1368410 - Misleading Logging for HSM (edewata) - Bugzilla Bug #1372052 - Unable to search certificate requests using the latest request ID (edewata) - Bugzilla Bug #1375347 - Typo in comment line of UserPwdDirAuthentication.java (edewata) - Bugzilla Bug #1376226 - IPA replica-prepare failed with error "Profile caIPAserviceCert Not Found" (ftweedal) - Bugzilla Bug #1376488 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - Bugzilla Bug #1378275 - two-step externally-signed CA installation fails due to missing AuthorityID (ftweedal) - Bugzilla Bug #1378277 - Spurious host authority entries created (ftweedal) - Bugzilla Bug #1378527 - Miscellaneous Minor Changes (edewata) - Bugzilla Bug #1381084 - KRA installation failed against externally-signed CA with partial certificate chain (edewata) - Bugzilla Bug #1382066 - Problems with FIPS mode (edewata) - Bugzilla Bug #1386371 - Remove xenroll.dll from pki-core (mharmsen) - Bugzilla Bug #1386424 - Fix packaging duplicates of classes in multiple jar files (edewata) - Bugzilla Bug #1391737 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (RHEL 7) (edewata) - Bugzilla Bug #1392068 - [RFE] add express archivals and retrievals from KRA (vakwetu) - Bugzilla Bug #1395817 - Unable to install subordinate CA with HSM in FIPS mode (edewata) - Bugzilla Bug #1397200 - pkispawn does not change default ecc key size from nistp256 when nistp384 is specified in spawn config (jmagne) - Bugzilla Bug #1399862 - Dogtag 10.3.9 Man Pages (edewata) - Bugzilla Bug #1404881 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - Bugzilla Bug #1405654 - Token memory not wiped after key deletion (RHEL) (jmagne) - Bugzilla Bug #1409946 - Request ID undefined for CA signing certificate (vakwetu) - Bugzilla Bug #1409949 - CA Certificate Issuance Date displayed on CA website incorrect (vakwetu) - Bugzilla Bug #1410650 - [RFE] Add SCP03 support (RHEL) (jmagne) - Bugzilla Bug #1411428 - Unable to create a CA clone in FIPS (edewata) - Bugzilla Bug #1412211 - Unable to set up KRA in FIPS (edewata) - Bugzilla Bug #1412681 - update to 7.3 IPA with otpd bugfixes, tomcat will not finish start, hangs (ftweedal) - Bugzilla Bug #1413132 - pki-tomcat for 10+ minutes before generating cert (edewata) - Bugzilla Bug #1413136 - Problem with default AJP hostname in IPv6 environment. (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1 (cfu) - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne) - Bugzilla Bug #1274096 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed tokens (jmagne) - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working when a token is physically damaged and a temporary token is issued (jmagne) - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches (cfu) - Bugzilla Bug #1381635 - Token format with external reg fails when op.format.externalRegAddToToken.revokeCert=true (cfu) - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when set on a token (jmagne) - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (RHCS 9) (edewata) - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (RHCS) (jmagne) - Bugzilla Bug #1404900 - Dogtag 10.3.9 logging properties (edewata) - Bugzilla Bug #1405655 - Token memory not wiped after key deletion (RHCS) (jmagne) - ############################################################################- ## RHEL 7.3.z Batch Update 4 - Bugzilla Bug #1429492 - Add profile component that copies CN to SAN (ftweedal)- ## RHCS 9.1.z Batch Update 3 - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - ## RHEL 7.3.z Batch Update 3 - Bugzilla Bug #1417063 - ECDSA Certificates Generated by Certificate System 8.1 fail NIST validation test with parameter field. (cfu) - Bugzilla Bug #1417064 - Unable to search certificate requests using the latest request ID (edewata) - Bugzilla Bug #1417065 - CA Certificate Issuance Date displayed on CA website incorrect (alee) - Bugzilla Bug #1417066 - update to 7.3 IPA with otpd bugfixes, tomcat will not finish start, hangs (ftweedal) - Bugzilla Bug #1417067 - pki-tomcat for 10+ minutes before generating cert (edewata) - Bugzilla Bug #1417190 - Problem with default AJP hostname in IPv6 environment. (edewata)- Separate original patches into RHEL and RHCS portions - ## RHEL 7.3.z Batch Update 2 - Bugzilla Bug #1404176 - logging properties and man pages (edewata) - Bugzilla Bug #1405328 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - ## RHCS 9.1.z Batch Update 2 - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - Bugzilla Bug #1404900 - RHCS logging properties (edewata)- ## RHEL 7.3.z Batch Update 2 - Bugzilla Bug #1404173 - user-cert-add --serial CLI request to secure port with remote CA shows authentication failure (edewata) - Bugzilla Bug #1404175 - pki ca-cert-request-submit fails presumably because of missing authentication even if it should not require any (edewata) - Bugzilla Bug #1404178 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI [pki-base] (edewata) - Bugzilla Bug #1404172 - Unable to install subordinate CA with HSM in FIPS mode (edewata) - Bugzilla Bug #1403689 - pkispawn does not change default ecc key size from nistp256 when nistp384 is specified in spawn config (jmagne) - Bugzilla Bug #1404176 - logging properties and man pages (edewata) - ## RHCS 9.1.z Batch Update 2 - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI [pki-tps] (edewata) - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne)- Marked the following RHCS 9.1.z bug: Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel when TPS and TKS security db is on fips mode. (jmagne) as a duplicate of RHEL 7.3.z bug: Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) and moved the patch from the RHCS 9.1.z bug to the RHEL 7.3.z bug.- ## RHEL 7.3.z Batch Update 1 - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) (added KRA key recovery via CLI in FIPS mode) - ## RHCS 9.1.z Batch Update 1 - Reverted patches associated with Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (edewata)- ## RHEL 7.3.z Batch Update 1 - Bugzilla Bug #1390318 - CA EE: Submit caUserCert request without uid does not show proper error message (alee) - Bugzilla Bug #1390319 - Failed to start pki-tomcatd Service ("ipa-cacert-manage renew" failed?) (edewata) - Bugzilla Bug #1390320 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - Bugzilla Bug #1390321 - two-step externally-signed CA installation fails due to missing AuthorityID (ftweedal) - Bugzilla Bug #1390322 - Spurious host authority entries created (ftweedal) - Bugzilla Bug #1390324 - KRA installation failed against externally-signed CA with partial certificate chain (edewata) - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) - Bugzilla Bug #1390311 - Fix packaging duplicates of classes in multiple jar files (edewata) - Bugzilla Bug #1390325 - Typo in comment line of UserPwdDirAuthentication.java (edewata) - ## RHCS 9.1.z Batch Update 1 - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1" (cfu) - Bugzilla Bug #1274096 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed tokens (jmagne) - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working when a token is physically damaged and a temporary token is issued (jmagne) - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches - Bugzilla Bug #1381635 - Token format with external reg fails when op.format.externalRegAddToToken.revokeCert=true (cfu) - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when set on a token (jmagne) - Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel when TPS and TKS security db is on fips mode. (jmagne) - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (edewata)- PKI TRAC Ticket #1527 - TPS Enrollment always goes to "ca1" (cfu) - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - PKI TRAC Ticket #2478 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - PKI TRAC Ticket #2483 - Unable to read an encrypted email using renewed tokens (jmagne) - PKI TRAC Ticket #2496 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches (cfu) - PKI TRAC Ticket #2505 - Fix packaging duplicates of classes in multiple jar files (edewata)- Revert Patch: PKI TRAC Ticket #2449 - Unable to create system certificates in different tokens (edewata) - Resolves: rhbz #1374054 - ipa-replica-install fails setting up certificate - Restores: rhbz #1319557 - pkispawn KRA instance is failing server - Removes from Errata: rhbz #1372041 - Unable to create system certificates in different tokens- PKI TRAC Ticket #1638 - Lightweight CAs: revoke certificate on CA deletion (ftweedal) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (edewata) - PKI TRAC Ticket #2443 - Prevent deletion of host CA's keys if LWCA entry deleted (ftweedal) - PKI TRAC Ticket #2444 - Authority entry without entryUSN is skipped even if USN plugin enabled (ftweedal) - PKI TRAC Ticket #2446 - pkispawn: make subject_dn defaults unique per instance name (for shared HSM) (cfu) - PKI TRAC Ticket #2447 - CertRequestInfo has incorrect URLs (vakwetu) - PKI TRAC Ticket #2449 - Unable to create system certificates in different tokens (edewata)- PKI TRAC Ticket #1578 - Authentication Instance Id PinDirEnrollment with authType value as SslclientAuth is not working (jmagne) - PKI TRAC TIcket #2414 - pki pkcs12-cert-del shows a successfully deleted message when a wrong nickname is provided (gkapoor) - PKI TRAC Ticket #2423 - pki_ca_signing_token when not specified does not fallback to pki_token_name value (edewata) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (akasurde) - ticket remains open - PKI TRAC Ticket #2439 - Outdated deployment descriptors in upgraded server(edewata)- PKI TRAC Ticket #690 - [MAN] pki-tools man pages (mharmsen) - CMCEnroll - PKI TRAC Ticket #833 - pki user-mod fullName="" gives an error message "PKIException: LDAP error (21): error result" (edewata) - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade. (cheimes, edewata, mharmsen) - PKI TRAC Ticket #2432 - Kra-selftest behavior is not as expected (edewata) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (edewata, mharmsen) - PKI TRAC Ticket #2437 - TPS UI: while adding certs for users from TPSUI pem format with/without header works while pkcs7 with header is not allowed (edewata) - PKI TRAC Ticket #2440 - Optional CA signing CSR for migration (edewata)- Bugzilla Bug #1366465 - Errata TPS upgrade test fails- PKI TRAC Ticket #978 - TPS connector man page: add revocation routing info (cfu) - PKI TRAC Ticket #1285 - [MAN] Apply 'generateCRMFRequest() removed from Firefox' workarounds to appropriate 'pki' man page (jmagne) - PKI TRAC Ticket #2246 - [MAN] Man Page: AuditVerify (cfu) - PKI TRAC Ticket #2381 - Throws exception while providing invalid module. (edewata) - PKI TRAC Ticket #2383 - CLI :: pki client-cert-request --extractable should accept only boolean value (edewata) - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter beyond CA signing cert in case of external or existing CA (cfu) - PKI TRAC Ticket #2399 - Dogtag 10.3.5: Miscellaneous Enhancements (akasurde, alee, cheimes, edewata, jmagne, mharmsen) - PKI TRAC Ticket #2401 - pkispawn calls dnsdomainname even if it does not rpm-require hostname (mharmsen) - PKI TRAC Ticket #2402 - Conflict in file ownership in pki-base and pki-server (cheimes) - PKI TRAC Ticket #2403 - Deployment problem with RESTEasy 3.0.17 (edewata) - PKI TRAC Ticket #2406 - Make starting CRL Number configurable (jmagne) - PKI TRAC Ticket #2412 - pki client-cert-import --trust option does not apply the specified trust bits (alee) - PKI TRAC Ticket #2418 - [TPS] Some template substitution didn't happen during installation (alee) - PKI TRAC Ticket #2420 - CA subsystem OSCP responder fails when LWCAs are not used (ftweedal) - PKI TRAC Ticket #2421 - Incorrect SELinux contexts Installation/Configuration (edewata) - PKI TRAC Ticket #2424 - ipa-ca-install fails on replica when IPA server is converted from CA-less to CA-full (edewata) - PKI TRAC Ticket #2428 - broken request links for CA's system certs in agent request viewing (cfu) - PKI TRAC Ticket #2430 - CA Agent certificate list is not sorted by serial number in migration case (jmagne) - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade. (mharmsen) - PKI TRAC Ticket #2433 - Lightweight CA GET /chain returns bogus PEM data (ftweedal)- PKI TRAC Ticket #691 - [MAN] pki-server man pages (mharmsen) - PKI TRAC Ticket #1114 - [MAN] Generting Symmetric key fails with key-generate when --usages verify is passed (jmagne) - PKI TRAC Ticket #1306 - [RFE] Add granularity to token termination in TPS (cfu) - PKI TRAC Ticket #1308 - [RFE] Provide ability to perform off-card key generation for non-encryption token keys (cfu) - PKI TRAC Ticket #1405 - [MAN] Add additional HSM details to 'pki_default.cfg' & 'pkispawn' man pages (mharmsen) - PKI TRAC Ticket #1607 - [MAN] man pkispawn has inadequate description for shared vs non shared tomcat instance installation (mharmsen) - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - PKI TRAC Ticket #1711 - CLI :: pki-server ca-cert-request-find throws IOError (edewata, ftweedal) - PKI TRAC Ticket #2285 - freeipa fails to start correctly after pki-core update on upgraded system (ftweedal) - PKI TRAC Ticket #2311 - When pki_token_name=Internal, consider normalizing it to "internal" (mharmsen) - PKI TRAC Ticket #2349 - Separated TPS does not automatically receive shared secret from remote TKS (jmagne) - PKI TRAC Ticket #2364 - CLI :: pki-server ca-cert-request-show throws attribute error (ftweedal) - PKI TRAC Ticket #2368 - pki-server subsystem subcommands throws error with --help option (edewata) - PKI TRAC Ticket #2374 - KRA cloning overwrites CA signing certificate trust flags (edewata) - PKI TRAC Ticket #2380 - Pki-server instance commands throws exception while specifying invalid parameters. (edewata) - PKI TRAC Ticket #2384 - CA installation with HSM prompts for HSM password during silent installation (edewata) - PKI TRAC Ticket #2385 - Upgraded CA lacks ca.sslserver.certreq in CS.cfg (ftweedal) - PKI TRAC Ticket #2387 - Add config for default OCSP URI if none given (ftweedal) - PKI TRAC Ticket #2388 - CA creation responds 500 if certificate issuance fails (ftweedal) - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter beyond CA signing cert in case of external or existing CA (cfu) - PKI TRAC Ticket #2390 - Dogtag 10.3.4: Miscellaneous Enhancements (akasurde, edewata)- PKI TRAC Ticket #2373 - Fedora 25: RestEasy 3.0.6 ==> 3.0.17 breaks pki-core (ftweedal)- Updated release number to 10.3.3-1- Updated version number to 10.3.3-0.1- Provided cleaner runtime dependency separation- Updated tomcatjss version dependencies- Updated 'java', 'java-headless', and 'java-devel' dependencies to 1:1.8.0.- Updated tomcat version dependencies- Updated version number to 10.3.2-1- Updated version number to 10.3.2-0.1- Updated version number to 10.3.1-1 (to allow upgrade from 10.3.0.b1)- Updated version number to 10.3.0-1- Build for F24 beta- PKI TRAC Ticket #2255 - PKCS #12 backup does not contain trust attributes.- Updated build for F24 alpha- PKI TRAC Ticket #1625 - Allow multiple ACLs of same name (union of rules) [ftweedal] - PKI TRAC Ticket #2237 - Add CRL dist points extension to OIDMap unconditionally [edewata] - PKI TRAC Ticket #1803 - Removed unnecessary URL encoding for admin cert request. [edewata] - PKI TRAC Ticket #1742 - Added support for cloning 3rd-party CA certificates. [edewata] - PKI TRAC Ticket #1482 - Added TPS token filter dialog. [edewata] - PKI TRAC Ticket #1808 - Fixed illegal token state transition via TEMP_LOST. [edewata]- Build for F24 alpha- PKI Trac Ticket #1399 - Move java components out of pki-base- PKI TRAC Ticket #1850 - Rename DRMTool --> KRATool- PKI TRAC Ticket #1714 - mod_revocator and mod_nss dependency for tps should be removed- PKI TRAC Ticket #1623 - Runtime dependency on python-nss is missing- Updated version number to 10.3.0-0.1- Added dep on tomcat-servlet-3.1-api [Fedora 23 and later] or dep on tomcat-servlet-3.0-api [Fedora 22 and later] to pki-tools - Updated dep on tomcatjss [Fedora 23 and later]- Updated dep on policycoreutils-python-utils [Fedora 23 and later]- Updated version number to 10.2.7-0.1- Update release number for release build- Remove setup directory and remaining Perl dependencies- Remove ExcludeArch directive- Updated version number to 10.2.6-0.1- Update release number for release build- Resolves rhbz #1230970 - Errata TPS tests for rpm verification failed- Updated version number to 10.2.5-0.1- Update release number for release build- Updated nuxwdog and tomcatjss requirements (alee)- Updated version number to 10.2.4-0.1 - Added nuxwdog systemd files- Update release number for release build- Reverted version number back to 10.2.3-0.1 - Added support for Tomcat 8.- Updated version number to 10.3.0-0.1- Updated version number to 10.2.3-0.1- Update release number for release build- Updated version number to 10.2.2-0.1 - Moved web application deployment locations. - Updated Resteasy and Jackson dependencies. - Added missing python-lxml build dependency.- Update release number for release build- PKI TRAC Ticket #1187 - mod_perl should be removed from requirements for 10.2 - PKI TRAC Ticket #1205 - Outdated selinux-policy dependency. - Removed perl(XML::LibXML), perl-Crypt-SSLeay, and perl-Mozilla-LDAP runtime dependencies- Change resteasy dependencies for F22+- Ticket 1198 Bugzilla 1158410 add TLS range support to server.xml by default and upgrade (cfu) - PKI Trac Ticket #1211 - New release overwrites old source tarball (mharmsen) - up the release number to 0.2- Updated version number to 10.2.1-0.1. - Added CLIs to simplify generating user certificates - Added enhancements to KRA Python API - Added a man page for pki ca-profile commands. - Added python api docs- Disable pylint dependency for RHEL builds - Added jakarta-commons-httpclient requirements - Added tomcat version for RHEL build - Added resteasy-base-client for RHEL build- PKI TRAC Ticket #1130 - Add RHEL/CentOS conditionals to spec- Update release number for release build- PKI TRAC Ticket #1017 - Rename pki-tps-tomcat to pki-tps- Merged jmagne@redhat.com's spec file changes from the stand-alone 'pki-tps-client' package needed to build/run the native 'tpsclient' command line utility into this 'pki-core' spec file under the 'tps' package. - Original tps libararies must be built to support this native utility. - Modifies tps package from 'noarch' into 'architecture-specific' package- PKI TRAC Ticket #1127 - Remove 'pki-ra', 'pki-setup', and 'pki-silent' packages . . .- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild- Respin to include the applet files with the rpm install. No change to spec file needed.- Bugzilla Bug #1120045 - pki-core: Switch to java-headless (build)requires -- drop dependency on java-atk-wrapper - Removed 'java-atk-wrapper' dependency from 'pki-server'- PKI TRAC Ticket #832 - Remove legacy 'systemctl' files . . .- Update rawhide build- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild- Use Requires: java-headless rebuild (#1067528)- Added option to build without server packages. - Replaced Jettison with Jackson. - Added python-nss build requirement - Bugzilla Bug #1057959 - pkispawn requires policycoreutils-python - TRAC Ticket #840 - pkispawn requires policycoreutils-python - Updated requirements for resteasy - Added template files for archive, retrieve and generate key requests to the client package.- Trac Ticket 788 - Clean up spec files - Update release number for release build - Updated requirements for resteasy- Change release number for beta build- Updated requirements for tomcat- Removed additional /var/run, /var/lock references.- Removed delivery of /var/lock and /var/run directories for fedora 20.- Moved Tomcat-based TPS into pki-core.- Listed new packages required during build, due to issues reported by pylint. - Packages added: python-requests, python-ldap, libselinux-python, policycoreutils-python- Added pylint scan to the build process.- Added man pages for upgrade tools.- Cleaned up the code to install man pages.- Reorganized deployment tools.- Bugzilla Bug 973224 - resteasy-base must be split into subpackages to simplify dependencies- Updated dependencies to Java 1.7.- TRAC Ticket 606 - add restart / start at boot info to pkispawn man page - TRAC Ticket 610 - Document limitation in using GUI install - TRAC Ticket 629 - Package ownership of '/usr/share/pki/etc/' directory- Change release number for 10.1 development- Fixed incorrect JNI_JAR_DIR.- TRAC Ticket 605 Junit internal function used in TestRunner, breaks F19 build- TRAC Ticket 604 Added fallback methods for pkispawn tests- Added default pki.conf in /usr/share/pki/etc - Create upgrade tracker on install and remove it on uninstall- Change release number for official release.- Added %pretrans script for f19 - Added java-atk-wrapper dependency- Added pki-server-upgrade script and pki.server module. - Call upgrade scripts in %post for pki-base and pki-server.- Added dependency on commons-io.- Add /var/log/pki and /var/lib/pki directories- Run pki-upgrade on post server installation.- Added dependency on python-lxml.- Added pki-upgrade script.- Updated version number to 10.0.2-0.1.- Renamed base/deploy to base/server. - Moved pki.conf into pki-base. - Removed redundant pki/server folder declaration.- Removed jython dependency- Added minimum python-requests version.- Bugzilla Bug #919476 - pkispawn crashes due to dangling symlink to jss4.jar- Added dependency on python-requests. - Reorganized Python module packaging.- Added dependency on python-ldap.- TRAC Ticket #517 - Clean up theme dependencies - TRAC Ticket #518 - Remove UI dependencies from pkispawn . . .- Removed runtime dependency on 'pki-server-theme' to resolve Bugzilla Bug #916134 - unresolved dependency in pki-server: pki-server-theme- TRAC Ticket 214 - Missing error description for duplicate user - TRAC Ticket 213 - Add nonces for cert revocation - TRAC Ticket 367 - pkidestroy does not remove connector - TRAC Ticket #430 - License for 3rd party code - Bugzilla Bug 839426 - [RFE] ECC CRL support for OCSP - Fix spec file to allow f17 to work with latest tomcatjss - TRAC Ticket 466 - Increase root CA validity to 20 years - TRAC Ticket 469 - Fix tomcatjss issue in spec files - TRAC Ticket 468 - pkispawn throws exception - TRAC Ticket 191 - Mapping HTTP Exceptions to HTTP error codes - TRAC Ticket 271 - Dogtag 10: Fix 'status' command in 'pkidaemon' . . . - TRAC Ticket 437 - Make admin cert p12 file location configurable - TRAC Ticket 393 - pkispawn fails when selinux is disabled - Punctuation and formatting changes in man pages - Revert to using default config file for pkidestroy - Hardcode setting of resteasy-lib for instance - TRAC Ticket 436 - Interpolation for pki_subsystem - TRAC Ticket 433 - Interpolation for paths - TRAC Ticket 435 - Identical instance id and instance name - TRAC Ticket 406 - Replace file dependencies with package dependencies- TRAC Ticket #430 - License for 3rd party code- TRAC Ticket #469 - Dogtag 10: Fix tomcatjss issue in pki-core.spec and dogtag-pki.spec . . . - TRAC Ticket #468 - pkispawn throws exception- Replaced file dependencies with package dependencies- Updated man pages- Update to official release for rc1- TRAC Ticket #315 - Man pages for pkispawn/pkidestroy. - Added place-holders for 'pki.1' and 'pki_default.cfg.5' man pages.- Added system-wide configuration /etc/pki/pki.conf. - Removed redundant lines in %files.- Moved default deployment configuration to /etc/pki.- Cleaned up spec file to provide only support rhel 7+, f17+ - Added resteasy-base dependency for rhel 7 - Update cmake version- Update release to b3- Removed dependency on CA, KRA, OCSP, TKS theme packages.- Renamed pki-common-theme to pki-server-theme.- TRAC Ticket #395 - Dogtag 10: Add a Tomcat 7 runtime requirement to 'pki-server'- Update release to b2- TRAC Ticket #350 - Dogtag 10: Remove version numbers from PKI jar files . . .- Added Obsoletes for pki-selinux- Remove build of pki-selinux for f18, use system policy instead- Update required tomcatjss version - Added net-tools dependency- Update selinux-policy version to fix error from latest policy changes- Fix typo in selinux policy versions- Added build requires for correct version of selinux-policy-devel- Update release to b1- Merged pki-silent into pki-server.- Renamed "shared" folder to "server".- Added required selinux versions for new policy.- Added Provides to packages replacing obsolete packages.- Update release to a2- Modified CMake to use RPM version number- Added VERSION file- Merged pki-setup into pki-server- Added Conflicts for IPA 2.X - Added build requires for zip to work around mock problem- TRAC Ticket #312 - Dogtag 10: Automatically restart any running instances upon RPM "update" . . . - TRAC Ticket #317 - Dogtag 10: Move "pkispawn"/"pkidestroy" from /usr/bin to /usr/sbin . . .- Fixed pki-server to include everything in shared dir.- Added build dependency on redhat-rpm-config.- Merged Javadoc packages.- Added pki-tomcat.jar.- Moved webapp creation code into pkispawn.- Split pki-client.jar into pki-certsrv.jar and pki-tools.jar.- Merged pki-native-tools and pki-java-tools into pki-tools. - Modified pki-server to depend on pki-tools.- Split pki-common into pki-base and pki-server. - Merged pki-util into pki-base. - Merged pki-deploy into pki-server.- Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 17 - Changed Dogtag 10 build-time and runtime requirements for 'pki-deploy' - Altered PKI Package Dependency Chain (top-to-bottom): pki-ca, pki-kra, pki-ocsp, pki-tks --> pki-deploy --> pki-common- Added pki-client.jar.- Merged pki-jndi-realm.jar into pki-cmscore.jar.- PKI TRAC Task #254 - Dogtag 10: Fix spec file to build successfully via mock on Fedora 17 . . .- Moved 'pki-jndi-real.jar' link from 'tomcat6' to 'tomcat' (Tomcat 7)- Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 18- Added CLI for REST services- Integration of Tomcat 7 - Addition of centralized 'pki-tomcatd' systemd functionality to the PKI Deployment strategy - Removal of 'pki_flavor' attribute- BZ 813075 - selinux denial for file size access- Bug 745278 - [RFE] ECC encryption keys cannot be archived- Replaced candlepin-deps with resteasy- Added option to build without Javadoc- BZ 802396 - Change location of TOMCAT_LOG to match tomcat6 changes - Corrected patch selected for selinux f17 rules- Corrected 'junit' dependency check- Initial attempt at PKI deployment framework described in 'http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment'.- Added support for pki-jndi-realm in tomcat6 in pki-common and pki-kra. - Ticket #69.- For 'mock' purposes, removed platform-specific logic from around the 'patch' files so that ALL 'patch' files will be included in the SRPM.- Removed dependency on OSUtil.- 'pki-selinux' - Added platform-dependent patches for SELinux component - Bugzilla Bug #739708 - Selinux fix for ephemeral ports (F16) - Bugzilla Bug #795966 - pki-selinux policy is kind of a mess (F17)- Added dependency on Apache Commons Codec.- Add '-DSYSTEMD_LIB_INSTALL_DIR' override flag to 'cmake' to address changes in fundamental path structure in Fedora 17 - 'pki-setup' - Hard-code Perl dependencies to protect against bugs such as Bugzilla Bug #772699 - Adapt perl and python fileattrs to changed file 5.10 magics - 'pki-selinux' - Bugzilla Bug #795966 - pki-selinux policy is kind of a mess- Integrated 'pki-kra' into 'pki-core' - Integrated 'pki-ocsp' into 'pki-core' - Integrated 'pki-tks' into 'pki-core' - Bugzilla Bug #788787 - added 'junit'/'junit4' build-time requirements- Updated package version number- Added resteasy-jettison-provider-2.3-RC1.jar to pki-setup- Added JUnit tests- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping unwrapping keys should be done in the token (cfu) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #744797 - KRA key recovery (retrieve pkcs#12) fails after the in-place upgrade( CS 8.0->8.1) (cfu) - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #746367 - Typo in the profile name. (jmagne) - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping unwrapping keys should be done in the token (cfu) - Bugzilla Bug #749927 - Java class conflicts using Java 7 in Fedora 17 (rawhide) . . . (mharmsen) - Bugzilla Bug #749945 - Installation error reported during CA, DRM, OCSP, and TKS package installation . . . (mharmsen) - 'pki-silent'- Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . (mharmsen) - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-setup' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - Bugzilla Bug #737192 - Need script to upgrade proxy configuration (alee) - 'pki-symkey' - Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode (hsm+NSS). (jmagne) - 'pki-native-tools' - Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk) - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-util' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - Bugzilla Bug #737218 - Incorrect request attribute name matching ignores request attributes during request parsing. (awnuk) - Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode (hsm+NSS). (jmagne) - 'pki-selinux' - Bugzilla Bug #739708 - pki-selinux lacks rules in F16 (alee) - 'pki-ca' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-silent' - Bugzilla Bug #739201 - pkisilent does not take arch into account as Java packages migrated to arch-dependent directories (mharmsen)- 'pki-setup' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-symkey' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-java-tools' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-common' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-silent' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .- 'pki-setup' - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-ca' - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-common' - Bugzilla Bug #699809 - Convert CS to use systemd (alee)- 'pki-setup' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-symkey' - 'pki-native-tools' - Bugzilla Bug #717643 - Fopen without NULL check and other Coverity issues (awnuk) - Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk) - 'pki-util' - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #700522 - pki tomcat6 instances currently running unconfined, allow server to come up when selinux disabled (alee) - Bugzilla Bug #731741 - some CS.cfg nickname parameters not updated correctly when subsystem cloned (using hsm) (alee) - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-selinux' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-ca' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-silent'- 'pki-setup' - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee) - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #724861 - DRMTool: fix duplicate "dn:" records by renumbering "cn=" (mharmsen) - 'pki-common' - Bugzilla Bug #717041 - Improve escaping of some enrollment inputs like (jmagne, awnuk) - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee) - Bugzilla Bug #708075 - Clone installation does not work over NAT (alee) - Bugzilla Bug #726785 - If replication fails while setting up a clone it will wait forever (alee) - Bugzilla Bug #728332 - xml output has changed on cert requests (awnuk) - Bugzilla Bug #700505 - pki tomcat6 instances currently running unconfined (alee) - 'pki-selinux' - Bugzilla Bug #700505 - pki tomcat6 instances currently running unconfined (alee) - 'pki-ca' - Bugzilla Bug #728605 - RFE: increase default validity from 6mo to 2yrs in IPA profile (awnuk) - 'pki-silent' - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee)- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an ECC CA to generate ECC certs from CRMF. (jmagne) - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any component value which is equal to its default value (alee) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #720510 - Console: Adding a certificate into nethsm throws Token not found error. (jmagne) - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an ECC CA to generate ECC certs from CRMF. (jmagne) - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any component value which is equal to its default value (alee) - Bugzilla Bug #722989 - Registering an agent when a subsystem is created - does not log AUTHZ_SUCCESS event. (alee) - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #719113 - Add client usage flag to caIPAserviceCert (awnuk) - 'pki-silent'- Updated release of 'jss' - Updated release of 'tomcatjss' for Fedora 15 - 'pki-setup' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser (jdennis) - Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-symkey' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-native-tools' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #717765 - TPS configuration: logging into security domain from tps does not work with clientauth=want. (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-util' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-java-tools' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (config file and record processing) (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (tweaks) (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-common' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs throws 'Invalid protocol' for OCSP subsystems (alee) - Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee) - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages (alee) - Bugzilla Bug #694143 - CA Agent not returning specified request (awnuk) - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages (jmagne) - Bugzilla Bug #698885 - Race conditions during IPA installation (alee) - Bugzilla Bug #704792 - CC_LAB_EVAL: CA agent interface: SubjectID=$Unidentified$ fails audit evaluation (jmagne) - Bugzilla Bug #705914 - SCEP mishandles nicknames when processing subsequent SCEP requests. (awnuk) - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added. (jmagne) - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs for modify/add (alee) - Bugzilla Bug #707416 - additional audit messages for GetCookie (alee) - Bugzilla Bug #707607 - Published certificate summary has list of non-published certificates with succeeded status (jmagne) - Bugzilla Bug #717813 - EV_AUDIT_LOG_SHUTDOWN audit log not generated for tps and ca on server shutdown (jmagne) - Bugzilla Bug #697939 - DRM signed audit log message - operation should be read instead of modify (jmagne) - Bugzilla Bug #718427 - When audit log is full, server continue to function. (alee) - Bugzilla Bug #718607 - CC_LAB_EVAL: No AUTH message is generated in CA's signedaudit log when a directory based user enrollment is performed (jmagne) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-selinux' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #720503 - RA and TPS require additional SELinux permissions to run in "Enforcing" mode (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-ca' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser (jdennis) - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems (mharmsen) - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. (jmagne) - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs for modify/add (alee) - Bugzilla Bug #716269 - make ra authenticated profiles non-visible on ee pages (alee) - Bugzilla Bug #718621 - CC_LAB_EVAL: PRIVATE_KEY_ARCHIVE_REQUEST occurs for a revocation invoked by EE user (awnuk) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-silent' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Added 'DRMTool.cfg' configuration file to inventory - 'pki-common' - 'pki-selinux' - 'pki-ca' - 'pki-silent'- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #532548 - Tool to do DRM re-key - 'pki-common' - 'pki-selinux' - 'pki-ca' - 'pki-silent'- 'pki-setup' - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser - Bugzilla Bug #694569 - parameter used by pkiremove not updated - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs throws 'Invalid protocol' for OCSP subsystems - Bugzilla Bug #694569 - parameter used by pkiremove not updated - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages - Bugzilla Bug #694143 - CA Agent not returning specified request - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages - Bugzilla Bug #698885 - Race conditions during IPA installation - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems - 'pki-silent'- Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.- Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta) - Bugzilla Bug #693327 - Missing requires: tomcatjss - 'pki-setup' - Bugzilla Bug #690626 - pkiremove removes the registry entry for all instances on a machine - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port throws file not found exception. - 'pki-common' - Bugzilla Bug #692990 - Audit log messages needed to match CC doc: DRM Recovery audit log messages - 'pki-selinux' - 'pki-ca' - 'pki-silent'- Bugzilla Bug #693327 - Missing requires: tomcatjss- Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta) - Require "jss >= 4.2.6-15" as a build and runtime requirement - Require "tomcatjss >= 2.1.1" as a build and runtime requirement for Fedora 15 and later platforms - 'pki-setup' - Bugzilla Bug #688287 - Add "deprecation" notice regarding using "shared ports" in pkicreate -help . . . - Bugzilla Bug #688251 - Dogtag installation under IPA takes too much time - SELinux policy compilation - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #689501 - ExtJoiner tool fails to join the multiple extensions - 'pki-common' - Bugzilla Bug #683581 - CA configuration with ECC(Default EC curve-nistp521) CA fails with 'signing operation failed' - Bugzilla Bug #689662 - ocsp publishing needs to be re-enabled on the EE port - 'pki-selinux' - Bugzilla Bug #684871 - ldaps selinux link change - 'pki-ca' - Bugzilla Bug #683581 - CA configuration with ECC(Default EC curve-nistp521) CA fails with 'signing operation failed' - Bugzilla Bug #684381 - CS.cfg specifies incorrect type of comments - Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port throws file not found exception.(profile and CS.cfg only) - 'pki-silent'- Bugzilla Bug #688763 - Rebase updated Dogtag Packages for Fedora 15 (alpha) - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA instance - Bugzilla Bug #675742 - Profile caIPAserviceCert Not Found - 'pki-setup' - Bugzilla Bug #678157 - uninitialized variable warnings from Perl - Bugzilla Bug #679574 - Velocity fails to load all dependent classes - Bugzilla Bug #680420 - xml-commons-apis.jar dependency - Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's classpath - Bugzilla Bug #673508 - CS8 64 bit pkicreate script uses wrong library name for SafeNet LunaSA - 'pki-common' - Bugzilla Bug #673638 - Installation within IPA hangs - Bugzilla Bug #678715 - netstat loop fixes needed - Bugzilla Bug #673609 - CC: authorize() call needs to be added to getStats servlet - 'pki-selinux' - Bugzilla Bug #674195: SELinux error message thrown during token enrollment - 'pki-ca' - Bugzilla Bug #673638 - Installation within IPA hangs - Bugzilla Bug #673609 - CC: authorize() call needs to be added to getStats servlet - Bugzilla Bug #676330 - init script cannot start service - 'pki-silent' - Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's classpath- 'pki-common' - Bugzilla Bug #676051 - IPA installation failing - Fails to create CA instance - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA instance- 'pki-common' - Bugzilla Bug #674894 - ipactl restart : an annoy output line - Bugzilla Bug #675179 - ipactl restart : an annoy output line- Bugzilla Bug #673233 - Rebase pki-core to pick the latest features and fixes - 'pki-setup' - Bugzilla Bug #673638 - Installation within IPA hangs - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package - 'pki-common' - Bugzilla Bug #672291 - CA is not publishing certificates issued using "Manual User Dual-Use Certificate Enrollment" - Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error. - Bugzilla Bug #504056 - Completed SCEP requests are assigned to the "begin" state instead of "complete". - Bugzilla Bug #504055 - SCEP requests are not properly populated - Bugzilla Bug #564207 - Searches for completed requests in the agent interface returns zero entries - Bugzilla Bug #672291 - CA is not publishing certificates issued using "Manual User Dual-Use Certificate Enrollment" - - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package - Bugzilla Bug #672920 - CA console: adding policy to a profile throws 'Duplicate policy' error in some cases. - Bugzilla Bug #673199 - init script returns control before web apps have started - Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI subsystem instances - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #504013 - sscep request is rejected due to authentication error if submitted through one time pin router certificate enrollment. - Bugzilla Bug #672111 - CC doc: certServer.usrgrp.administration missing information - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #672333 - Creation of RA agent fails in IPA installation - Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI subsystem instances - 'pki-silent' - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package- Bugzilla Bug #656661 - Please Update Spec File to use 'ghost' on files in /var/run and /var/lock- 'pki-symkey' - Bugzilla Bug #671265 - pki-symkey jar version incorrect - 'pki-common' - Bugzilla Bug #564207 - Searches for completed requests in the agent interface returns zero entries- Allow 'pki-native-tools' to be installed independently of 'pki-setup' - Removed explicit 'pki-setup' requirement from 'pki-ca' (since it already requires 'pki-common') - 'pki-setup' - Bugzilla Bug #223343 - pkicreate: should add 'pkiuser' to nfast group - Bugzilla Bug #629377 - Selinux errors during pkicreate CA, KRA, OCSP and TKS. - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from OpenLDAP instead of the Mozldap - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #658926 - org.apache.commons.lang class not found on F13 - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #665388 - jakarta-* jars have been renamed to apache-*, pkicreate fails Fedora 14 and above - Bugzilla Bug #23346 - Two conflicting ACL list definitions in source repository - Bugzilla Bug #656733 - Standardize jar install location and jar names - 'pki-symkey' - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #644056 - CS build contains warnings - 'pki-native-tools' - template change - Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from OpenLDAP instead of the Mozldap - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #644056 - CS build contains warnings - 'pki-util' - Bugzilla Bug #615814 - rhcs80 - profile policyConstraintsCritical cannot be set to true - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #635033 - At installation wizard selecting key types other than CA's signing cert will fail - Bugzilla Bug #645874 - rfe ecc - add ecc curve name support in JSS and CS interface - Bugzilla Bug #488253 - com.netscape.cmsutil.ocsp.BasicOCSPResponse ASN.1 encoding/decoding is broken - Bugzilla Bug #551410 - com.netscape.cmsutil.ocsp.TBSRequest ASN.1 encoding/decoding is incomplete - Bugzilla Bug #550331 - com.netscape.cmsutil.ocsp.ResponseData ASN.1 encoding/decoding is incomplete - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #658188 - remove remaining references to tomcat5 - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #223319 - Certificate Status inconsistency between token db and CA - Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory During CRL Generation - 'pki-java-tools' - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1 - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #662156 - HttpClient is hard-coded to handle only up to 5000 bytes - Bugzilla Bug #656733 - Standardize jar install location and jar names - 'pki-common' - Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review - Bugzilla Bug #623745 - SessionTimer with LDAPSecurityDomainSessionTable started before configuration completed - Bugzilla Bug #620925 - CC: auditor needs to be able to download audit logs in the java subsystems - Bugzilla Bug #615827 - rhcs80 - profile policies need more than 5 policy mappings (seem hardcoded) - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #548699 - subCA's admin certificate should be generated by itself - Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA - Bugzilla Bug #563386 - rhcs80 ca crash on invalid inputs to profile caAgentServerCert (null cert_request) - Bugzilla Bug #621339 - SCEP one-time PIN can be used an unlimited number of times - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #629677 - TPS: token enrollment fails. - Bugzilla Bug #621350 - Unauthenticated user can decrypt a one-time PIN in a SCEP request - Bugzilla Bug #503838 - rhcs71-80 external publishing ldap connection pools not reliable - improve connections or discovery - Bugzilla Bug #629769 - password decryption logs plain text password - Bugzilla Bug #583823 - CC: Auditing issues found as result of CC - interface review - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #586700 - OCSP Server throws fatal error while using OCSP console for renewing SSL Server certificate. - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #607380 - CC: Make sure Java Console can configure all security relevant config items - Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be generated on TKS instead of TPS. - Bugzilla Bug #489342 - com.netscape.cms.servlet.common.CMCOutputTemplate.java doesn't support EC - Bugzilla Bug #630121 - OCSP responder lacking option to delete or disable a CA that it serves - Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1 - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #635033 - At installation wizard selecting key types other than CA's signing cert will fail - Bugzilla Bug #621341 - Add CA support for new SCEP key pair dedicated for SCEP signing and encryption. - Bugzilla Bug #223336 - ECC: unable to clone a ECC CA - Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned by Reason Code - onlySomeReasons ? - Bugzilla Bug #637330 - CC feature: Key Management - provide signature verification functions (JAVA subsystems) - Bugzilla Bug #223313 - should do random generated IV param for symmetric keys - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #630176 - Improve reliability of the LdapAnonConnFactory - Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on ECC curve names (not on key sizes). - Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple Certificates from the Same Request - Bugzilla Bug #648757 - expose and use updated cert verification function in JSS - Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection of signature algorithm; and for ECC curves - Bugzilla Bug #451874 - RFE - Java console - Certificate Wizard missing e.c. support - Bugzilla Bug #651040 - cloning shoud not include sslserver - Bugzilla Bug #542863 - RHCS8: Default cert audit nickname written to CS.cfg files imcomplete when the cert is stored on a hsm - Bugzilla Bug #360721 - New Feature: Profile Integrity Check . . . - Bugzilla Bug #651916 - kra and ocsp are using incorrect ports to talk to CA and complete configuration in DonePanel - Bugzilla Bug #642359 - CC Feature - need to verify certificate when it is added - Bugzilla Bug #653713 - CC: setting trust on a CIMC cert requires auditing - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #499494 - change CA defaults to SHA2 - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets as expected - Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for validity - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1 - Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA. - Bugzilla Bug #661889 - The Servlet TPSRevokeCert of the CA returns an error to TPS even if certificate in question is already revoked. - Bugzilla Bug #663546 - Disable the functionalities that are not exposed in the console - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #658188 - remove remaining references to tomcat5 - Bugzilla Bug #649343 - Publishing queue should recover from CA crash. - Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and pkiCA, obsolete 2252 and 2256 - Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added - Bugzilla Bug #642741 - CS build uses deprecated functions - Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error - Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time interface is no longer available through console - 'pki-selinux' - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #667153 - store nuxwdog passwords in kernel ring buffer - selinux changes - 'pki-ca' - Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review - Bugzilla Bug #620925 - CC: auditor needs to be able to download audit logs in the java subsystems - Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA - Bugzilla Bug #583824 - CC: Duplicate servlet mappings found as part of CC interface doc review - Bugzilla Bug #621602 - pkiconsole: Click on 'Publishing' option with admin privilege throws error "You are not authorized to perform this operation". - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #583823 - CC: Auditing issues found as result of CC - interface review - Bugzilla Bug #519291 - Deleting a CRL Issuing Point after edits throws 'Internal Server Error'. - Bugzilla Bug #586700 - OCSP Server throws fatal error while using OCSP console for renewing SSL Server certificate. - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be generated on TKS instead of TPS. - Bugzilla Bug #630121 - OCSP responder lacking option to delete or disable a CA that it serves - Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1 - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned by Reason Code - onlySomeReasons ? - Bugzilla Bug #637330 - CC feature: Key Management - provide signature verification functions (JAVA subsystems) - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on ECC curve names (not on key sizes). - Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple Certificates from the Same Request - Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection of signature algorithm; and for ECC curves - Bugzilla Bug #529945 - (Instructions and sample only) CS 8.0 GA release -- DRM and TKS do not seem to have CRL checking enabled - Bugzilla Bug #609641 - CC: need procedure (and possibly tools) to help correctly set up CC environment - Bugzilla Bug #509481 - RFE: support sMIMECapabilities extensions in certificates (RFC 4262) - Bugzilla Bug #651916 - kra and ocsp are using incorrect ports to talk to CA and complete configuration in DonePanel - Bugzilla Bug #511990 - rhcs 7.3, 8.0 - re-activate missing object signing support in RHCS - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #499494 - change CA defaults to SHA2 - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets as expected - Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for validity - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661128 - incorrect CA ports used for revoke, unrevoke certs in TPS - Bugzilla Bug #512496 - RFE rhcs80 - crl updates and scheduling feature - Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA. - Bugzilla Bug #649343 - Publishing queue should recover from CA crash. - Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and pkiCA, obsolete 2252 and 2256 - Bugzilla Bug #223346 - Two conflicting ACL list definitions in source repository - Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added - Bugzilla Bug #668100 - DRM storage cert has OCSP signing extended key usage - Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time interface is no longer available through console - Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory During CRL Generation - 'pki-silent' - Bugzilla Bug #627309 - pkisilent subca configuration fails. - Bugzilla Bug #640091 - pkisilent panels need to match with changed java subsystems - Bugzilla Bug #527322 - pkisilent ConfigureDRM should configure DRM Clone. - Bugzilla Bug #643053 - pkisilent DRM configuration fails - Bugzilla Bug #583754 - pki-silent needs an option to configure signing algorithm for CA certificates - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #640042 - TPS Installlation Wizard: need to move Module Panel up to before Security Domain Panel - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #588323 - Failed to enable cipher 0xc001 - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #645895 - pkisilent: add ability to select ECC curves, signing algorithm - Bugzilla Bug #658641 - pkisilent doesn't not properly handle passwords with special characters - Bugzilla Bug #642741 - CS build uses deprecated functions- Bugzilla Bug #668839 - Review Request: pki-core - Removed empty "pre" from "pki-ca" - Consolidated directory ownership - Corrected file ownership within subpackages - Removed all versioning from NSS and NSPR packages- Bugzilla Bug #668839 - Review Request: pki-core - Added component versioning comments - Updated JSS from "4.2.6-10" to "4.2.6-12" - Modified installation section to preserve timestamps - Removed sectional comments- Initial revision. (kwright@redhat.com & mharmsen@redhat.com)  !"#$%&'10.5.9-13.el7_6pkipki-certsrv.jarpki-cmsutil.jarpki-nsutil.jarjavaCACertClientExample.javaCAClientExample.javalibcommons-cli.jarcommons-codec.jarcommons-httpclient.jarcommons-io.jarcommons-lang.jarcommons-logging.jarhttpclient.jarhttpcore.jarjackson-core-asl.jarjackson-jaxrs.jarjackson-mapper-asl.jarjackson-mrbean.jarjackson-smile.jarjackson-xc.jarjaxb-api.jarjss4.jarldapjdk.jarpki-certsrv.jarpki-cmsutil.jarpki-nsutil.jarpki-tools.jarresteasy-atom-provider.jarresteasy-client.jarresteasy-jackson-provider.jarresteasy-jaxb-provider.jarresteasy-jaxrs-api.jarresteasy-jaxrs-jandex.jarresteasy-jaxrs.jarservlet.jarslf4j-api.jarslf4j-jdk14.jar/usr/share/java//usr/share/java/pki//usr/share/pki/examples//usr/share/pki/examples/java//usr/share/pki//usr/share/pki/lib/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tablesdrpmxz2i686-redhat-linux-gnudirectoryASCII text, with CRLF line terminators (Zip archive data, at least v2.0 to extract)C source, ASCII text?7zXZ !#,i]"k%vzIRG6"il'u fl.d8/ ϒdkUΨ;u r {E#4}x:R^bjD7xp/6H`H pw+K6]9ѵ23e,Ǘ m :FZɲ.\Sхn-n*sZgˢҾmAU.ypLgEAi=IZUx8kBL]bܚ*t90 6N;D(Rok=*+g'xL2˓XH@t.1"|~T>JQXǒ2: e@KzieܹJ=m%(}09*_a.$e<M51_=ܥ9E[n!lwl*m?(;(}>]2 1-B T&& h{;CywJj7e4 }CmY*"sMe9XVGe0%d>ya:ӿz"+M!3b5lю? QTg(Xz'6>#9FbH{qzZ׎6M E,&PH>+td%|dNwxe1ڥ3rܜנ}EB}2 9DX1Е}NLՋ<`~pC}s&' Ey3)d"~XRCx8QzME) ޔ'C8 kr>ҕLh|{]݋b@HP/a A F2$RdYCڊI SsH Zct.(g2lA}|9{Oc!Z H0>8F1g`e%S* /2V~( mEh2THX;h{^ 3r zeA>*?e|-}l[>+7DS .&3yBKT# mwۭxFD{jӓ4;9=O3vJ RLhw5:j G4M(es"{̇PP OqD' huH&&ZmY0+aơ^oNg?+ xz'~r\>Ė\==|IE4=C)Uy o;Y iuқ1'a ޤu|!0`l|e1 iZ 5پa\uIaoWwT CAjCrR܀J.0}Hl)jkJ_5WB22 ATW*I',Mn:&{+wfE;.Kó%9({Y?8L*`򶥵BY8xLPvJ}QCnZ BI"MQօV:(` vVM-|TL*QmAL)?4&k:.vl )=#*p}N.P$S٦rѬ'' 3b f2L݁Fba Q'R0ό*Iatt+Y2}!a/4 2קN%ﲶU{ 8]6wGsFx脃[^t1yб j=C DH]B VHZW BS޽ [m?]ipj_i$Qg1cNW.K|?P˳1}ZS0_8]Yqg("$mv@^Sdq+לL%nJ]ʦ!W4p&&``U sem,#QT~˱doJ:Q#`]Ӽ()0pTfh1vls35#ƦKƔ8>B. ܜ Zfgk~Q<^:oEq|Fߤ{ng<9MQAHQ)he[K?"Q`./#[sQ⋝o9<8=ߙc,!Ur nds QAvw}rks|~NI~eQ[Vm{WޖDc~ԓ4k~̧} 9 U4M˂ՁO)gܵZۯt^xRXhCg P5rʰgL9 fn 쥎a^ iKڅSP5c>01*Aԧ>Uk`ScrQyXo$3=]oLZ/mGvW`j_bzŀXwn_a}#(cvgJLܯƿ'ew!%OڹYXtIUjw9r fhH#}1 PcVw#~D=RD.c1ƴɞScX7G5\DԴzC񮑝C t_*~Xi/opHi0LB ;Վr Vva}\؄ѡQ| xE|JW}ɕC1,ⵚ6eЅ)@U]2YY:o{Pe| E"pw`Xm=37{hl{$Ik1qUDڶAcTJNPUS짤hi\ c,&f5hnقǩۑwXu1M.(kaN0 mJ4~.-^<+K5 c1*Ѓ * gX\ >Y.፪vh4cwQ1HR_1?03TCʄG*Z!HEfݠ2HP)⩐}@,:(ɇpE+.\-w^ȽK#PaJmc)%^?6,%@#p5]"Aѐx).j$pb ,'Y:<ͻ႕ߜWM "|)7OG 85hmǡ+{̚##]_q&.f4 p9 nՍwAK(]} PrH0*t{G6uǚb(.FJXliD<H fXV:64Vt8u1:)t+2ZX9BJӒuiSh{ GJ`sZmу%/@n ԇo2[18ISy+˳5QQ]FS`r@î'&>F&:t37jå&^bϑ>BY)^RR*]SL K( cǓ#j#$ejmN2Ӧa:БMY"HD >1 nʦ[E"pe|/#^G|&OnemC2?J3 0mlvbub-s3tAI%ztHbc@ ?u%9[p] yYe:~{' wWWf/5hM/S+9), SZ)lCCj`=ʺO<+,j* l7e:[e{ *i0D^U63m(U7}K^ͷ$'1  ]^0%79A.B\jn_vƮt7J8,f^EsksyP3bU xuL?\-]}"d%~mĒ%xHj,s%pL/yP[ g] Qd`;23>  k ۺV($n]4!Lm$S@ٽ塧kb M0/nK|quYGH֡Q `xGRUKj(q/u#(0}ɅO[,c,SjZ6JjZc|C=-29X> Y^{!+%PY#=Y3gSt\wC}{^gɭDE߉iT?O۶sdѳO,:箼ZRJlRSѿdWeL9Ri [Q4z(CTb ?kҊ@qJs9X5P?OR:d'3LT(ǥjL z w oS𦵟=m>C}(V?4B8Nݵ߻YsL gBd"r޸F0K1 p>Q{ԋД4ۥ+djɳѾ|qg~Ke,ɂ:w?t@oz$Hq%*ZM~@5dS9Ö MARo$UTLtxαTSWT{.vx50;< p3lNUQ_c]1#j%H-}rNRN& ![XB#2r9 "g r'Ћʑ9ݡ†$bE'eU_9?b2jGQJ'HBWTw͝.ZvmF ˜я+zj6/itz#>"Uōbzm 쮥]q,/d-2QN.OXѬ_@cޝE"&rN ۬7,wNa`x~wbSV/I2|Q:U/ )$} :PR7/ʋ)~E%"} [w8-m^Nȗhw\ӹDG41KP[Ρ9p ;a6˒./A#9mTpM? CpU:aj`5y0n.~p0.o2OAq_~1PMKCuC)ѭ22PtWF ܏N$R ]ڕ (W(|Iv.V~e:kxȏD=:*6b1aC \ "7rf4bΜi[p[jӗ,f|%4P .E»7Y]j8_\ϞVr }*-AW kIv㧹J!JG7-g]V':z5eR~whkd[-?2'`bazehˣ%'RG'l}r*蒙*uբR: ot`6ȢOv◠8f0ˠzdђ  /0%1tk\ m/&z(xvY\tm|/ꭊ )~A<. hi:swFvW<&/5B@~hRO,g>p- 'a#"ME5F]:e9@5,D}P#?h_An0[ G}{H>{F674]jC^ʂqٛ1 wmV_$ %cӦ?,aaMX#@AY@]u.&U%ZwyC*#9(.e &ws{K.v-H"Ɇ0Ut$57O~PtfElٷHq ys)ZpNJ˖R7]uv*0$κɷm`D_{݉`kaņ L5soR\<3cotg+@q~nv"𓵜IQ#zJbRQUh|݀UÙfWf/~"-LmpX9X^;]M vudk_i44$I&bCcĜKKwm$F~Q0\Xѓ?vO)$͢?xl*]!pf/$ it5`xaJG=`|-UIǡOw &A#RK%86ֈ eX,_S4W8B~cHb-e_$3gR?|Ku(Go`>ҹqnlM-nН"1ž W;$nKOA+Zfڹ&7g[|a§*O|c!0I]U5FKE73ᕚK L#Zc4Ɲ[lezѥvXOؒ`odQum)Hpizh6P[B ɣ/9 gW4Z"R6ؐ?!"Fp`ߌzs:CSŕ94Om+}tR'&7A?c{#\O[5}ONe|P KRu"CSH2z½z"VR@Uhp'{> yf+c%1iXVRXQm8U{SG?)ǁ١梴ϲ"9`zd~v f\pU0=.!`k;_7']ew[Xotڗ+kUvҧP_X|VK=Jny }2\r?s7k58/Lz*cQKI5`$F8@_x1.o`&l> ]G\CLy\Pv=_R UE#4[d pf2(*oªCM^RpϿB\ =E2Tff(&pѨ|LSiXƄ9dKi➇qY3/%.}Q= 9s/5-FWPgGլ]\%8 sߋf!bfK/ D> ͈,ˊ7We[.Ү@yOf Jˉq wDgB1yW2wCKe;JyVs-UߎӼg7y nϫTBo3S |0LsDŽwƠ^RHpHf|I7~t1Zt[Qvol?U$cfOJyu 8 A .M:@ˁBb NG 5owG(g|CUu9qWxEX1fJ2n85Jt/g_ sUwtSlJy&1 % Rkw>XU>;KT?~uO*3xF˙7!FO4}8M.aKߩyjGCW<{NI MvO$ۊCS@>gtib29_/p1|Ǿ?ÿyl`߲@z?R4J<"YscoaۀT+y`nJ)y.~d}n!>maltFHE H'YD`LP֕j\?dU͏eӠJ0&w x:nQ@k'ݝ}u1ޫ؜{pS4JS.unb[VEE⇲7 خj ccpA'?:cRMEa/'7 ɠ9_gOm$YpSaLì4jphmNښ E?ͦqP"% ,..iSY:&ʄ!aϰPC˰<)Lk[~4K::RM,m[u^]/i5)YM66} kY) p$}Y͇؈9cY={ Kp&J+)tdYՊk :ݸB]~8Z)SeeS| ,aH:[KQhU Cd8] ݈"[s¡]t̗hv}{7k\K CpL paFH?R3e#}ugHHL/ )*2B7z&=%HIe ,͜ *iv <򘭴a2vFt}^>eb}mOQhѵGy~=o^-1, ǣws+sV>}`BuW54նMgSC\ރ@4iFi`:S~/ 2 k'5,UZZ|1=6?nXҠy_3s5ۿ *8B3]Cϝ>l:qeb#kx޼{[ˆLBCƤAmMDsK0%qѓ̀쮺ؾ̘ ɨ{P}%źj[IDMbPL=;6oe:q-5߫떖ŸU97["y7L`oמ`\U\Y/5dWˏ%М*L̘V&[wpKuDTƿb]_8-EX|mޒPK-2s(YW={2;2'AB*Jmh~fi V֛HJ5#%8* M, fȳ;[IFۚy. P\Us MmY) %}{ά'M gԖulEҶIη)Zޝ[xn>FnXҨ(O(úKԂd(;:L|&rRQP^ A/A}^݅?:L!.)}maZlG]o9Hڱ }HhS!iBi}QN!6 %aEE? /JGOH.)Bb; T%IQY'V y_ː|p@RSoO Gh8țM:a83P=- ckjGӟPѿċܞTXLNfj8Z`&sHb`mQI+̵Os/C;O q\&%30aM,?j( N#kbqJ|oǢ7URsK]VNdIP)>:CwϤ}X}]=-vUP]onY+2n=09˪{ 18ŝqglnfv993 vؠ5N o|c on(cyvQt`IC]hluwY7[-@ޥ00.B\<?rC V("VVI佩ЈR$JXod"kt'FwSBVQk}eYTхJӉi'shIG5Cv?44:oI-ݖgn)4C=f'T]8~D&2[1շZ8 1 Q3' \QՏO;Eˌ\o.DI@?nũXEmݢHmm. Q$K pPc`K&R`il72gЇ\V-u: #PGHvB;:b1GV/4=ف7 B^i?Dڲ_ͿvLF߃}'m}I(gk<g^G ^TW>̈Ɇ \y*? 1{<@*z[?_ۥ_<؇Y"h/jFVQ~rһ4P]{ω!Nb%m?ۧҾuOd>2 ua3F5bnHƄ\'v3¾KF*e^ީtҧFVVD#F͈t/[?6HE_)sF*&=1ڿ .=7ĭyy6E6Pzj.>Iv4j-v\2n%"~.Ӝ<`jk QŔҵ{npb02.S`5y#'tDY' w$oUϝKZ8mHr!&#zx¥! (,A0V`)RUJuqߕ/q Qn-3lWj^G g?b+orFE p y[!,7TТ:7zJ1ț5_n>fښ3cJ$Prl r3:daqWUJKCʘfK]I@C5ّD1CɺO`1hY\E#h ښ <)Zx(~.Ju3ai0r ' 浠ALЍtɪU| L.DMo@cX>9`T</q)|+^\!ЊE fs=lZbWf2J:F ݯ3mw ^bN Y#ou' #;bIS!46S`\k%HL;eO,2~=UXLg2)2>k xwS=jN1Zb)hiӲRk2̝aUg+SCeE#SReÿc2ɂ)K7(0~I6x>T%.d.$GJ72ph31l7/~5!5;.}Fnrx(t;K%gt݋g VGi@ada1)UdzKu-wy&W$L- H6+Y xRIWhHS*B'Cf[QPlzpQH.u$>dT&x/ptU!"u!no22I,n/Pg~nW2sp_E͕%XpzuWȏ[} kfd;!Q{NeQưp.s x;6UdA*YZ(BҀތ|rZ2=FJ6-.ȓ^7J-^Cښ;gGm(CZ?8UUOKse'$wRGᒻF!g~|r'A5 {ʼnх:tu]Ylw8xgiKܻ[=Q^VVKݓ B1^وJ yq_4EV#7;!&f!( )~Tz;E`(G8!6^{zUFdXx1,$^Otv85:d:q*< 1a>s+BNT>$lK h&jN T[-U)an.!n;?9I,R]/#ߤàѮb-KA ϬHGA|Oe57|GtvUP60>o\o.ptM"m ۛO.!3:MzY(5xg*apQJEXk4m5zCy 31qz[3rq W xVlp%V lAz7{: iLۧWu`iU)=E>_ @t\6`p|s_OU8ܐT^ w Vכ0!!KO+!aaMxlh?S`Yz6b%NzQ?{D,y V#we34HJVoRowPVu a{Y?,Ls3 UVw3{aҌFҞif]*LI:Cr;4^_gKrElȢWTAnv=YjQ b| Fȳ0{R Ŀ3|Y)VXϺ̪6=Ԑ$A2 g&>kҧhHd<:}D*=IW< EPhmH\'H+`Ϯq@-*QNuP zuNҤeECP[ 6M A/*A輣` 7Jxk/-hŹMK y`(_,M)xcYK3|yiNKu咇\jHeX8ocD#Vkƽ*v6 /y_T怈ln3)I eSe4O9Q_)OM5^ԄmPBxL|x(GOI8E?< xBPaQ^3T?3à4 7L؟eڠ5|4 K ! ${ֶu\ȹI5(jtp/ E/(zHҸ&ljVzl[!N4(+94ۺ7P,zFk5J:־h,'K2Zc 8_aQ)AikRp:[혎y SpQ 9 lHۓv-Ǭ\ڼ+= { CwG Y3"p*O/ يK0C՜aOX{oh$95Nq{= f[ Ž/U5X*! Tʹ)xٽ9 @Tc-՘n(*kH?as!^v  %Dk$j SIOZ69qʎO|g+}~gE{MScS$(ڋea2c,j&cf:ĿEL= ZnX)U.\X)]%Sf~(sZbܪ|R & e# y)_R 1Mٸ-ye@3,TBsʗ\\]hRvuv̖5L=tYQ.u:RyUOjAu+qu9+ vy*JMDŽUU2"NxnZ)lz5&]ݩ.E_񜠍j2ݎ6m E][x2֘eԳ:%> 1'r=uKre.yLf\ E4.~ZHWSEqbe%nP.-N& k,=EwKb5 7o2>멢QD& #=:Ψ~u}U#e`Ɯ0F Qi|E%8 E_Yy5BlS3^&0+M(# n샱2 {ϖF"|T=[5 ?'2 P~t^ =~xF*`̹NБ틺Gq?ǀsqb5!㥏YlKך{j{TXT6ʌ1'08a2A=uxppA`dvP,Hߘ"=$NM kr?͊rTy뜸*sGEs e8EP窽vz(B7P^UӔZ^;$:`7qG-Hw^Rrxol}بZ>.7M(b BS밮y|nBuZ8daN TG^g(4Ca% xҔ7%W+Y8쭷)?kI)`Ni5d-5Ns=9LDx*R$%cEDsI7ytY_&?ɣ94^6&O.'˾DV/7񭁿(14jU:V# Iՙ`>xb7SyqG깘3EV˱-r{ZҚ4>cAUbS!Y+b,k:?Ĵ䪞h@F N!ޟ|^"8dLofbJ Tn# k.kQ" +|ЋuǴowl]Tl~km)XqKn8iZ<''UvK:o흫$^lWjo|.q̞KhMڕ>rY{Q}ŠKr%&Ʒ%; &k3S5O+%'lXp:fG*3`4Y#n*qGKa-:hRr[cu*dqĂ8BGoBaSv4hkq"V Rrzulz*d@,aneYp_)}ĝcaZQn߆@WVc@}j&TE3Nɚ^t>G벼(]vuDD[t5Y^|nY W%4fZA9$w>%zNj-BBKq>p:]<ЙZ/ AKMN=[ʺv9*kF'8Gd2hDrgL%Z P4՟^+dr MNkOs8HJbEy^w&a|sH}lRܡh0 >oD΅k||k,6֞r?i+Sax s}Q'N5'*v2?-SeM L zQO7m$wYh4L`A:K =(WyfKDn2e }% |aZxԫ"Ln-[:Yn.ṥ\ "ƱTLOeSLS5N;P'7(u[+ϻO|Rz5R$]@ I7,rH \eL_:}#ڶdkl fzz=$JS.{ Z&J tHkD/ >:BCԸE %@P^%qi-CMPTt nmA_aBB Ƣ5*0(}ؚ:BwzuL3J6݇B&0/*)$s$cd 6܆(벦}[ =o=_YMÑpPۻ[:>0&̏)'cfH/tSFGƞl' Xˤ +:rJN[XmOn51H[aRؑ:1 X9s^XfQa:g1\ ЊzSj2^+\ӝF L C@]BeΨw_ڨc$ljnɧwHaui@ϋR[/4+#޲Uv`A h}j]y)~D=VV4GMc)gk>fv ڔfKcaú@;X7ݓBSxa!8R2P( ̥I]ӀlU,&սSӖ77X 'Bɳ'L{).gFQ}r'x%Z\{"ᬻ*S{ȼS z*. qȴqwm *9D/0.&DFȄcL zjt=qn$ZL? S7%Պ( >G%ѫ"򴒅(G&S>#t neXv? țVtU(*8J(fBedeQH5l6"bjJ ΌZCoխNGBcCV<;$']هR>,qu]pVh;j4Iڿ@Yr" _}u[\q&e_G% 5d:h =]cxrTwyyUjaNmi r)nf+]Crtq11jIK6{Կ·:_ޣ+ŽcƬb;ip#\(k6!  _(Iwm=\Eᮂ\*E~ÞԘx ੌwm7Kg<,/ AB>X;|D#Rg YZ%bNuGUW1*bHU!|xIh'.G|Mu4|o-s(KA#U0}nR2"aU+(akY=={6H3yzkLl =~Kh 1W=̏B0G7p\@q @' vcg#ŦnC]:m5Ɓ5,0{| W҂jq Z}yf䅐0.0E+a;nd{/??\|7Us>xP׋ xvtx+ʝDLVY.R{/{|~r26oDgțFTup7(^T+}LbdP{_؅).Ӭ`Ɵ:iSn1MTG&Eµg-}k"lpҍXo~X.-8UxK+H9AhAKApa(=F2=:)q/Ptka]pFfœ#f#81& :]LboTeK7]`Qň:[![t0u ̞OA-;CI! yM*?`*,s$ltpfP1/ Y2[zJEYϱ?=} e,ɯ-e.|>(ô ٷF /t?.i(zYڃpwBh]\wU?SQ-a&5:bϱcڀv- $=n/繚9\g:4_d3TCU>^&S>"_>}6OB/ Zݢ2nA!öǹZ㷕1Y221S[hkv}!]rΉrud||]o==4g 4:06kU_S.vOv@4$JBJ5/\Rr|K'';+֐KO*q)1|d@oL˫͇lw$%?@mU$X1,sz&D"ER 3Kh->j E_ 3ݮ CD6kLKvÜTw4VwX'5o)rߨ~D泯eQ%g{8!bov/C^XQgK#9s_%jD j.B޵9p@Oہsr}#ΗXr(VcɌ]K[dp&W2]6(p]l/v{4hps,FPP2L:(^>܅2*>F_ )OIyaBjOkQS'aԖ+Yz;XBI?'VFkv4e&1.8#9kd5cտkcZw(_> ]Fr2c&"IxFc#9y'/YXVm=12M ὘_)8dnga Vi9c1A RUOpm#% aEaX'̻|}_CЕ12|N5+L%3q.]EU6eMUYQ1k'ION5OPVIAg%PjgkJ7[-F9Sfg#'w{OI- cBb޻bdD7v^'K/F--> F C+[W!a!sQ:%$5ўsE`2:%aNѨ3nI0QRJPVY # 2CSUBh1|ftڇ駨w ].W t&KGel$ݞbzhLʬ3h^_#fRM| HϨP1dP}Bc?T$ M^Tjd!yRhxRГ r3oo:&5 6\H_:˼I /T*HDǙ:nFԈcw]ҕW?$1L$Pck&A`YՁ)ftR/ D<{f6i-[W]#xv1vK?V8A-[s'lE}mA*IpIyѼǢVX9WHqrR=w6JqDbv|HK3&oTCVcNՌS6,zقN.:9UTuǔy`_Ͽ֕qJ7@hT+MU?\ioHmpB6%Si UmLeB|8v8{:,Fti(*ž@)(IԪUM3Q@gbl=Cس<LJ:Oז2XX*E6?vޘcuoJ4J3ҍB&KSV:\`Sw}bLk~9B+M _tD>``(Ͷ?6n .tPpHDav\3S%S?1m{3r"tXd5yjԮpաi&J;i߈I˼T-k?9aLxv/s&i{Գ96Jz$a%hmƍqH .e&kF4|x&Dv 3.?֮]SO>S|3&/΋b}q=i>a8pc*`V65, -X'QBmEۛai日F !Kd8YmW]Dmn`9| n"d+*{IO/:Ώa!Rg_c9%E\Vv{!&KǨZF# 1 "D<ъᄪK53SŁٽ^OZat? "l'TG-%cu:$7>ՉZ%IVMzYzj:fԼ'K y-8Ƚ,\ \BA X[%K8D%ZqKd> h /8O b\7/)(;_hTpV/Er67i(<d֘ъ?f*_[N4핺Å ЪМYj:n IVnK,^њvKqf!䭝PgAEM RuuEVzR2 l|pCbo7ά%XH6-< r#NP$XŊ4_}MNO+6N!iXٮkbMrK(7M{ HWCIe|tO'Ř9^3{]%|'=9u:>|pjLpƠO0"31@LnbLxBc%fGS|G'kH\) _Ql,z(IQ8T\\9RYj:>h8'ĄU+YjȮn7NRͩ#j̞;g' l\ Ys6,EvsIݫLpY"I鈙D>DǃZp_a.|y=Σi+5b4_rIf/Qc(x~y|`z}c9ƾUq pu-##`}"5sa ULYV;.6:rm$Zu**/6։tp\8;G55 I̍g`>K鋪w$_%|G)FG 0*fr/Nu2e:AlPftt:W~ibo^PO| |dB'`^beeKi%%]p@XY_8Ĺ7,G*@x 7+ &6o& N1`a|}0V5mQfGz7 ip'՞Wә eI ۰vAQ(wpqmJǷ2T&轈h8t哋/jҷz%w۫XV7NnÍL$.z mj~;8<[Uz5vDG3?„oIT-S7 gmBXCaZgA 0+i}+f)‘{w5 fk8@E.#6LNg)oeL;K=S>9|s Ya'l4&WI(m} m<(x7PVS`&gu.{Ei|Zf<`%--l6|4f8Iz'&,l?,e2Uȸn svqZEح#BhlYx 6E8ŝq?[x6qЃ_5y5>|HXH7 B fjrĢ5upB JDdvYg$%Kb#3^}AN^ǷCt"  $QtyV) .鼺sltP G}PO(7qiBjc-G,D:>S l?"eS4gzNUVZd1QDcкdAF0tT2ayǾcݖMñƢaѹ)1WzК[Xֈsv'IXSRPGr#[2g1֭$AE"Q9 )#Ɂ$cEbgu( @Bw'PSԂVa~iaY-iep؉zT{@MފD)˼robKJ,Z=Q+4SioұXCK.fQM(Gtz@KruA:)ڬOC;0>9lZrhA)F`Jd7/S{~x(yJdLU(~q+3`qEtAȩ46yr5얠vVH;4ЎРNw\n1~@eL}4" ,eO Utt h[u]iB 5 ^ӑ0|p&E#;g_6og/=aJXp Wh(Y&|qNbm.jF,hgӃ)i #_x%\;'oCDLjMq6NؓnNg %d"xaԲL {Hs1._<7MM5G~R]3CՏr(p,rNKlzzP'wXcxk,4:)|s GSˎDj&CF;| P4)c_g?Ȭ z%lDӉ:fHQBo[-Snms? RFjH_S}ÊGj"1 sc]"nX7ڣS|YpEKa nR.S_]]F=B\ru|Jmi%ۊjөP|G& )X ô(dHAnSVg3vaa(#$-^6pdr.W6\ٲL%0;_&!L{Z\ݩ2bakW[Qg"[6)2_-no C=7aյi8oA'dƬ;@x̣-!C4*̳Bht&HM`tu]w9gS])んf!fk"ś1LzE_P0n}EtQ ؽC." \6@Q v9?U}z ᗕ'kc帮8SA9WX=L_Wݤ8E'ZyΩ-s!uYj\J_LĆc sf'^'=z🼍 tÔoQs]+\rTv* :UCyu-+uvGvwLRe{ήӪKVG_ngAIZS}?2M"Z.7;ҿY}_ǥYs\NѰeYk%4qN@}nRҟ9*)@n%ǰxsCq%H730AH9.svY>&'Kz.? _o+cIQB>\X|mh=t.?/欨jE)H ť,ܕygǙף|bk|ŬMEUV`gkbxKJ)w,8(ܨ^` X(OހsL}d+EfֶXI-bE%G`f!:yts-(s\y렿 {,R(--y{UQ3VO,9oJ^H+W o0[淮?Y M~EZ!-0;+ccO52l2ah,6M1`bF?k&.A4#>7: W~-T{0:=Ӡ,&Eu&E?i"1Ir8*xU]/e`Z)֞(& ADv#7@S}P\r 4in7=М^ǢSzULdsGJg7 iل_P 3\N xz*eu0/0¸h*0IU!^C丅:,qL˥HuSۙCRdfaRpyh^ah\8y"-<\Gі`aeuR0$:J{ݮx+EfXDЈ,"%EW?}K9oꄴ \"'fXWLV>w "zEpȵ-abv JõP~wvVaDMAҮH:\` 8[2v @ +cm0\F[_apݪsI]"VB& Q1~On? 5UI4 (7op.%9+Rc(YG"; GZF!l9E|שGOh'4ҀזK:*U\">vm JceצEZcc B Ý/dvxv>/5ޠSw3G~8Z2yҏjƲT!W;IPxwCjzȽI]QYuMTvy\&H˥,вo7zUe4rj9]ʶM[o>=&UA8Fر+pY\ˣeNl>zyQvfT{4F;q:]ºt`ѪZeWR ;Ƶ,3P%d+rtlax1ؖ H$Ŕ9M]>Nl7kY*ZNྉs,_s@rX#`·}L,$28tնpظh֧nѯ6%V}@$ۈ$S*bRi;i^1" e*zHKNi޷l,c6y\qth:`-d~X5U?躢tr\K RϹe lҗI$(`^O\-_GK iV6لxd[{`{oLq ~FKtPJW79niS髡wvp 1 *;;b%H׈bKA ,A&oĥ b'^ȪƁP)SV?TW!h02hVӲiB악dn烚?=r ; WVVyb%l0K|Bzi~l<5[d|Z~mN^(],= `ԣ$e)3[E?,.yy0U4gC$N͈_ u-U&. W ڈ ܢq2ޚ+ei6뼜{jn)/AA!z sZ-)3gg?7I[nFNC_r9: Ҟ[W4}$}W~8s xV i$peT`ylQO>@)ODHc.9hM NP?֪CAL(zLSlm%Vn-GtCb} !!G,(o3^gp(Q!@&yL|`7yjN-6"VKAp_E} XrBkYU ׃[<#B3֛{y}5ݽXr1,=ٍ#QHr2+cjx5պwIJ{֍Svb S1!Ϩ*\⫃a=9†jFU)&u1T/W-zlEkIz\2`h:;v$lਕRWڵJbQuX+883Cv.KF-2OE;elɽفF.(C]'YCڀȄro ] v>rs2 ZI`.ϫh^Fg ѕOVp3 hG)w~Y mQ&.ǴEr#w:W1$PV9ihVgoUSt-&Y0&eޔDDm*/*Y.6$Q{z;2WY C8z 'Fdf$-"I0<:*2I08YK(2Qv`rsKSYwd*8Sw@v NZwi{ƀ-WȌ~B|t0/ʅ6!RHr[^* H=ޔ3OӐ~t۱yU?ƺIӖ Uۗ"eJbH,IDyg.:Y ]za̢ ~QuujS#jP޻UZή@gsʘQI oUC0l<J`mSutX ݞ.1]d@2ɦQ#B]&|>o6۾46ԍZwgN !|cUCW}?B\ H:?nJۖ(x ww]{|u|m3co$N 멁+#D폢zŝh% lϯR uOwStt>d}g8oAǥ;3uyh+1 %^>4_H),xe͔|t5 @^0H;gep:zTFRrXXU;|E *#.:`iPIcܶ0ͭrM4$bU?uօGb^t -l5bAKC;Y-Nc|M(6iNXtlVo/py,ew͟yi(!a[g>kG!Xiuh`=[ *QfS? BFGL4geSm NY@\4lDNrҮ$Kg'ÈF_9œy.Śl -Yz;##jnI aH8$X^iToٙU^/Ը E@VOI('AΫv(Q:ɜhʂϵt85p ?BG>Nw O έbUl2SW9 <2OYt=Fg ԃoxRLj&3-ifks7ܠ_+) ݛ&+O#$ | qnϼw7/[ e&Ft7nIY'd [ |Nc)tI VxeY6~:2y+r593*i;_& Gq/zTtIJFp! b=wd4O{?}#%4 >#+4J (uz4Hgp@S MbGRiyJj'R]t:T7F7mI۟F[ُ5Qa@1je׻yd No#Q7$0f𴇩9,~n #Y=c :K b͇݉x1ʢV,jH4ݧZuvd3[.n!ZoK^Af-úS5,n^[|1ώlIH"+7)_%L#jԫ"Lϛ ~tbG'=i!+?Z4`3aT$(@\^K|o/e!}d+'{X$j56~0' BӦH&ii$Pn2(٭$iju%7p:Wu婢&3R p^X A:U|S,g㱲W縈e4 GPCQukQ >ՕM6ߠv|bEJfIb4mM{~O݂^aCzx4urvR28/D9V'_,ؕeUl+H03r$Ƒ0s톤=ۺ27ك@c( #XTE诓i%+X]ӴVqȋLsb`}ЂWrf pbGF>=,j&f`qXI-PxQ Uk!@^m#9 UxH`gnJOit=-E!lV5/ ?POH>?j"wfhh5d p'P#-e(\q{ I#t^!\Q;T,j~%Pw [AtBtak\ye)͔{˰iv_;ﱐL8N 1*. +ֽ雇7XxC|ęۍzS&l!'r& ~lM%@5p^eoWytYc6gax/2hwʔc N,"mN'%5u*}f loMN?!ImMP[?JrMi JACPFF+ьΨv,gqH)(_ eݛ4 6G\.%n ^ER=%{5{*J^"CKT+CE357 ]|TN0Öp]9 nɒɀ}wve+Й ;m"L S*l|K*C#JB0;k.n6M\Ȓ)5U6psKb81fGvœjAbUXcd([@qhwh,rZ/ZQ4q͔E[,xR^}Jgiʢty~ 4d~$$3K6L:RL 5oYQͲE fF+(q)ő38kD;A#и7[H4> C@EvU&!s،J_t0 ̇x_ ui^d#rJԥHT}qpvCÙE4;3..)y򂧓9z|X@^ɇQ]E xBpK- d0e%֫>`bM`kM]L4rO|Y7'ʺk>X0^ Խô.-lECGh@qiӈyw0Iyx| RZ3ppD .>{hoGhܫcmāљ,Ry/E4}U\b?Hkl&/B=s&a}H{3YG0,-Ey}SHk-hfw듿 hS=!Nqéb똸ti20m kQy0D !]`HLG*)_"bBhwXpYf+cHHA^d9M )$an0 sxxIjVV+R߯-_zlDD0)o;\Ok.@*r("241'!_]ku-ȼG'DK[4Uem%d"HmˆO&A0t\K]A -5v.H& eUi amL/~ۯ2;@0&k.Npа[!q37hdIN(ceZoٱ w#0Rݐ|4HO*!&X<}סda[}Z +k۶\Uhq ֯L T;.e8s= @G@4[w]}$nL3'h%9Tl`.ï BQTC!R;&10ڹP6nf0s߳q,XQZqE4yk1I8ALA:Q%E[*`ޣuaK lkW؞CG}v#(.LY\a` `L,baƌ(U->gއͳAF`e ]Tپ\Fȡp";Pa{ƸyD#pIf=I; ҭ26gs98^#l$ xKb.;ai{RrP%b-K Кxz3i9;vK _OR/vP>&)Q"!1{S&=XVd~|Aux[ׁ!=3ݻ ͠9.{2'>%bq8]äevyV8Lh`J:fӨ @ 9 <,Fd $NWΏVwͰ/_M[Ioots}3V[Iþrwh˛d'{4 N3h;-Ma^"l>|t3Hl^b|M9G[oo!קµ7jk 9}U&/ٶn\7Px[0xnr#x7T}e#1aKbWv<9_'N ]}㌂4 ͓PAȊ-wP]6ZQI~uOHͧw)KiW?R<;Z7u&UIk|bBHF9Ye?$NgqvYp:۔oRޛ:M!5;k P[s4 ;#htԇʣ DFcV`F1O Nu7Lxf+ҟb(\ _N8Օf㣟G[e l'^I?g>ѩa(#adMh(ߙ\=hfl2|7Pz03\h b6™~DY)lu+\pj8Q^+R@s䅰?MGy6؂LjDN)'#B*^T?{÷p:hLLH3B*jȫB2[V3Fi1\?2wxI{[8T[vv ;ܛ[_J#۠EP#x7Ģ{62%W lJAG[|_q)h^ETɫɹ0e2UC"pIvS?q`݃7 Y4619b$Pr/=V0q8g!8!=u0G/ B!=1 {6Q݋'8>Xb7˪u=|NёRWVV+f=$Ҁeuo3O?FL8 ,XCVaĢ&xaQ*|V跛Ք`O v*m-aeQ[Jڸl֝?fGW뒐*eZմXBK ,C ͚ffO7*y tvS<ݯM9EZR!H~15H0'*C1YU[XrYz:'MXeP\B٣KB>{J:@=\4z5Nzck? !eXnx7hz]Rcc2!74pߝxMb?[|Bzښإ2KԞo> caSƭ-4jY6:7y r,=uhI@}/oQGRgF R;upGÖV(TuPxmSDjԬzAָ Spg$SݑZ, #+)^JK#;xH8KLfEwBx`1W|eMq-#66œ/~ZsF<=ܧH/U=Ti&)ڃqUY&z|ȸ96L7Apce sj䶎 34ΪL{tnNbA|1u"~Ǵ,CVs -s(!PfSiu(p( &cHKu+\ml/}<*X{HڿXf:#XpSS!a y~ud ָ8S4Ceՙ}O >AyD{X}o.!njKVwe8$Z ![pCf+LŠ Df1EVY yH۾ݳ^ F(e>'%C @p_UpX!='&pK>Hᏻ<ڷ `DRB1 *FEI&;O_x˙XzĞ`$؀Щ,C;Fh0ןyֵDW[:moH${?W7%AɞZ Ygx^]}:2?l!ۭ"1CqKbݜHƬSׂO-=nncߒ0qYӷ0ϳϜz.[\E5PC?5YIJTt(EL}IJ*{u 1^-6 %BJ)hFɪW~1 o#B~ʔG2_5ȔH|`U"e#OQ.F|=16ăʹ>4yKD_]jsY}mՍuן);-  8vɀtQ26R/eeO#:#l%/ohg7Id*(f?7ۙ 8i !C|њ,jօ=_n)e.BeRq;j_fsL=0KԳqb`^"v+]"6&@t08K"ieZΆk}y4 ~DHv5PQ?uk8_=֜noX:+.=9Rrd!Te0[H#öFǠ's-y[ũ2 .*FQ= !%kTsՌ+.T CY5@Řrtn-ߐx?8;W>Uםa/&sڂ%ejHy9OYfv#ypY,=ؒpuB uyޏk7K/P M0G$@UfeGRJ ݤ)G)*Hu[P)5|9tAi*4(ꮃYw3-/!HohJv홐PU׵ }zs" G(ϕ:?ZjLqZ8p8iLLaE0OZ(BFkN&ղxZ{ﻯw @%v|/#d7Eޭ*)i973XN8C: bNo&G駁{ #R%X/"'l.۔bD+mqY!3ed|V$g<YCRc|p*pވ`r{×62^(jPjGGBZ[ #&s {c\7P55$`E55 X*Uf|L!\|mlW KV.,4}$"Hw)p*p}s]12 {)R*+5@Ovxk$6`̘3][ (!K 'xW[$?Q.j-1 ɟ/\_!SGIˤ)z J>Ϫh_{F,[^s=->D098]7Ew؎VMh- mO3?cKA24c'ܺK\(?N~DodBqk(\2Th$KnR+r9n}@bsEJ>u C\'Ak+42 $ ki]8-'1&Ԣz_F6)EVi络ӂ-%8+څF|A,8MN_w >ѺiĄp4'qC7G1NBU8 %& w խ X!.6٢u潸][h裃05Ouew̕Kd1"(6jm6y(C.X2[ovAnoN0}?$*XkhɱZ}] ]8H8!ZC\M@}+M. g"/$p c:u>Ȉ6qgFَU(p0p d+πC6 Y:vJFB]_/\!hYV1{m+ !rmlҝma<{)4zX2|>paJ%("u 8IVջJ:0I9Y:Yj+ZԪ"%Ie?z m:%D#vOZ)*R\j$7 A]ĠD7Qr<`X娺JF1 X77@59%[@,bs'0"~8DھK*|dnlD wf}Di~Tъu~91/a+:9ZJ. F .s"b,֋ rL?ίZdHzi᜖fdy25#C1iZ1^u2-qbҶa+(\ݻaås_,o'˚>rSUrX"sw˘#EP(JSQQW7JMK=aO$s7Ut۰S(0yr8DpJyb#/"%+n=97c16>^8J:d 1+2>9s뚞|ޖ5HFՑa 3 i`UtAyff4vja2y;2̒pa\㬴aQ7qYU*uf1.l4f;ۤh)XH)[>Xa Xh'bHZjc_7Rf Zj$ Iuƀs"/icxyk'E d/gbE=} jDF"pS+\鐼C&W%40:o.<`34@\y=#P>Ѱ .iB6o,Fx :.swydyځ3 __V-W=L>C )XVf7 vD:0*p_^3`9S&t7&ӣ Q-<$W$FwZG9L,myܢqMAEiGX2~9r s'7)aP_V碫Ȫ{_OV\_6Y#;O\8hV}6iW )8)z/¸ܚmVeplĥ)EB8O!~GŅ7I.9TO6׈>~vfTðQ,s{@3ep|y4hDH*_:(΃\tQ`PQ+ZY5\BL/tj2aި:C↩Й$JSH7?=@^KE3#аبʄ"=dѯïҷG+WCVbzŔk$eW0wzP23Qpʔ F0lsW_XѸ$z l=Lᑋ5D9k$C*Q_,zS&C1^70-7GmcPJ[ 'dhwq赡rRƘI šL\h[.,ӝah:G-v.`*) c@ڔRN2x;䆣}*Φ./99]&a6pbbZ A89E.ǂhj|KFpBR{e.cN[QWIJs|mBc:8|֬O{D\` gڨ54a?09ipN6)-O0G&pp\(5`FSɅgD_Ca~7@~=; sX˵wV7 +i;]tvo[(-m-=H0:b;2@ DيX#򺑻*l|Bd6Z|4i6ka}ZdqgˮiX&ACUo}kJuEVOxcux`S}DT{h]"{âySC__, K8Ё=$ _A ]?!¾ \NZ7:z\&vXPۻ"J59cr줙|oScڭ'P>@11$ORS쥍 WOe/#GNkkWCM;ؑZYe,Ԝghu.q*pYɖ^\O|vLAϮ#S )! %u1ݰl"lJV;H38c0ϬW)Ba:N ʔ1cTt~xTm7kt1T^,Zc-l 7{jr}?b|Y1ΡXGZ\屠O#u߮) ]~w^Ǝ 4*eG8{n"̏T<OC؄5]yi[c"p5jLi3dI,hcء?AY¬׽bPiEHY )pYzq=Ab8dS9fsE$A!*̆lXF {YYl8o9X &ZwRF:ݝA"4^+T ؤ8eʻmXK,05?ء'2xF-œ^Jk4:ΫEBԃc<)?1+GĬudskVgˍk1^$E.vqO:e@lac::dO> sZ;8oj\r?lûӶRDn@H-tòB}6ذv,i ؈R̠S&8g-ɬrXY)_T+l-P 6!8H#mb2H|):*o jjeJz RJBFH 3$DЍu(Q _ 1?wU aBSqaEX+=m߮VZ>Yc^0#JE E+2;{##J+(>6]J6.".U\|cJ1 Zoxd=1z!g80ӟwdA yjMNyTNqDrG? Z*Y,p]2'iBDH]Y1W!bg$Ӭq(H%(FQޫL_Z}2Ӱ5uEa,? Dͻ\.\,\yo|0X.!|5 0DSSb- W<PjɩU6~&ǛO9^1OdicJ)6<|;msKwkKm50QSYzLݎ<|i`Ab8Qv`UJ0&޼pmHrZTf>pc3O'PFRU@W+ofJ w~ീYr% (U|_}8mSCJR:#W>Υ [bs NK`n8XwlՓm6(&<kl{wrL'՘݅ ?Lk{_a_y߃Q)-'-]rSsL7 ߖ( 8PDL88DaQdK{8+{wyg=׽lk^&isnJh6Ӓ@n|*|DwR8qpVLk2ڝ.3Ht zXQ \5wABqzG/ ?Tש>  Sx+v;T/L m礱Eԏ6Ht"|;Gq=˅͂\,H*ZeCgaZpX;X"cQ[[Vs`PQ.6OEYv]}l4' NmWO le~G 3+)hj$%DV&"ӈJt\ )4QVⴐ^3p8ަYboc :WEWF=+|ȑ^5Lf;VXb`6>䒇o{9C:k>v |ȯ)\MY[qcw+ydM]Qq<r5+ٺHJ43VBY9uA~ vlXFB=6Wfz3N^-YbrmzӃI6Ia*{~hWo PFru`'Ldnd}ު?\Edn1EnTf9.L8@=MDpȜX /]GNH_ +j$Q&20dLZQ!Fq^8W?cH“21CrTZ:@9W Jd/aXhmWePέ\b@^ 4å-S^Zyis{^bz|Ug1\m/<>=BqQe. h`}Oڣ8 HUka6eu^bԲIUqQ BIβ$a+vBa'M wmz%R{E%afM`fN{8XP9\39@';岗 O'GXōjGskBO>>S 0J27d'r_v)?"џU~G t-J o$JhW9D4ّ~4MZkb h0f#=f;z.=vU_7n[%=Dǭ^q12 h D[0ֆ;J٬ q-Rq$"YhXX%orjYO'/͹^,qڳJL_)*НH!{6P[3{Nqmr̫M-N*jt u ^y_QQpBGYă ʨ=.հ V#^_s-}pe8pXEӶ}ۛZrߩrIG*C}reNEÞg^)CO+澉mݬasEgN3ۆ2s.}j}vC|R Ε)Hjˎe, T$Ϝq &a{ C2?;b'2ep*hVgRZ=lzt<\.@7.mTj+FBv~'9-&,ٸ Yݞ{n!:;)3.~JZ DŽk+VXes Axng/V¼k1  mэhm$>L!TŤdE~Gnrd9q`sپyYNJRH閑H9O(2+,ެ~j/] ? N&L2pʽ.@i=9w1xӁ7rюZc@X bi5i4ՔMdNj4FLNIԆU@]MCB!Xya­MJzñE/aSl-bR:=>c?&?+Bx .ʁm eVM)c4ޱ72LۆEMpf5t*_e_&KjwK LuIoHuB P>OXϿ&qK6:$BآC'흲 (1dYz]=vxoO]ІVNd'zM9N~ 0``SFQL{F0H@ay NC'r\*`4Ңu uԤ[cs~ϰD{jwShK kf/0%f?n?6n1CRF(ڰ̝4(>zà )a Q#Ow4=gwO{twȁpWW*8J'Lx. ̇gx%x$0ӊ-єw'I[eoٙ-)ɕ"S:LInCYuA>縕:ZARFSVYLgt|I8oG ƷZq0}^Mw}kkw7| T5K0ZjVi&UvFnj%e(]a7ޕȥ`zHNG͒E Ej(s jwJt4@uޅQӕu! /ܰ2G PGs Mo\=(y0٤kj!/Hi}^5i²I7;ȆERYnyRA8XA;Ƕmrmo:s/|KuIP}n'p#v:[^ ~~ SQ-AovYē&qERa5BJ+7tp~Xu8ln&xJݺaC倒߸x& |bTQpMR$iI c٥-~qM?v!,s`{?PIGJ75-|A^\Nw{) ^@ S"$LPFU0flM^qY^01&09 fg}ȋ۷O=X}7Pf]2#| YwT ʵj. 7s1I1&Ѣvs?V8SD\|i*K8JNn?=jfSt`Mw|Rg\e>ϵ./%S&P߇%X6逼X->oXyGSI}5sON[("!؜/uLE > q ͅ ?WXe]%|CAm!V>ú\K^U96ܮhKylW׼NKxc1Ik\PKhwtvrgtKmrW"̓qv8o A1-7ۄl [Nt'v'io7?>ڑ6`_]KlJBJ|#*)wbQQ7'smm,F@wcOHapkrIC L_'[l񜋱rt:K0~Gې 6 'Y>6w!LFS.{7'imb;nlyTIa "=!^3; Ir&=4BCi<H~G\,0`.`4 nOpzme 4 t=2MIwyz|yqyˍn Yepp|E! 36Ň?/hJTu"oC[~1OKrкaLwMdHbMD?dBz)y#[b}}G ӓ2w[9)]~թzбM $N,)8<ie6 GR#BU!Nz봭.vK}0⦙1`Z&vEx"݂:9NB<&e&1 gn!k0>7|R $ԛx/w9ݞ4kw&'4Qe&%!8}gj׀^Iٰ-\j[L< *>\0%,@@^Ow%i,5V95Pg.ݪWt*3{VbgH I4V.wRwg*x-D +׃N·w,$U)A̬;ਦ/ ǂ.uN3ۓ[p -5q? {{Xz9ټ巸}`jd}Yv#d;䡌@\?yῨ3u M咛npG^_AH$aeıGSv'ai}2`Q2uaS%W&,ÃH0 &!-TW5:p>8px%43a΍escV.y[zm{> R7ڰ+h]qi->eFt`m?і4cAFk7]1ᳲM-ZF_4$J#\t/QEEBzƩ9UW<zFatNh?Kv`=7H[%./AmrjzO8`CtKHgp`"y)ߋWuD

W`lP,w,8/x-O,BYᨢfx(`}:g5dPmʑT:5H$W9d1zEE3D郫ghŔwy[ r_{t68QN+i*Y߄coFdx4nECfjne>$e[fR(a.Z;R(6…q Hx늮z?b׎PcE\"B> .4wD۟s-Q6HſD4Z{ d 6F^Vp\:k?ZiT`U\!_WatuTGSdLmʐ6YIQ([fɮMSę#né[B|}/@I!BI#kr*XםaOAe1 V:KϵF{JPti\v˷NJ:U@%Kr-O :Ngԧe=@x'Z_ bTL\Ϣ_8/U;5;K5PYPL9-םP)GV#́Ut)JI{$Ba)pf5aKnB{l 2b;Gu8q~ D(#E1h9كʻQh;>𾔡}tR|Bwaċތ_ޗvh JOeڪ:w1qX7SJsQB]7a(D5‘j@bkÔr8zZςຓ)T?ց$|}hPmW=8tlJuhܦD*Лyv mՌ=z)CgӺΈ?> SFo5+)O-\L64F8XjZNN$h*V)ZdQ\ _w\#($dڒuF]QZy[ ?Žt^QJ sR#i.糢M޾-eYԑ>Tc6RA[|i F?5NvlWRv9/UaN!MPfZ7z5==<ӶM Jv#U"Q$6jtѯ2\EO4}O4^M"^j֢J6(|<r,.ׂq_gvgТÝc-5gߵD͍S0'}qR#%lѩjڰT[?PA ohkHF3fQ!k&Ys5mK[t0w1 CQA^eϴ%DL7}unÚ{Pz9ڦ|I[h"Qz#I@ފkLP¶ V3.lZgvʄ|B[a~3:$9y{Ɉr޷$$Θo]lmc ˵yk0p}XlOYc\dm$w4ɠwD>|`~UNCmpvF,Vǹ㬂}5Ks8i h-;82%y,/S^iLŀVt߽=!$btA#y>ZŁ{V7Xg(\13m0_0O֏Q=&G;a͸oU))c&$iNR ^wIu '( g\hEf2lbz eOy_$`ݑt:MQlKr`nc mi6zdv!Wr>hyvrg\9.k#\CAr/y0~KvgJ}~^+)ǣtU||y9'-Jĩ'd5MAN#sͱeejPV\ {3TUِRrRж1! g 嫽 `jۓTeKZCtÒn\l}G` DM'=zM= "Ol!?>Rq^0mӯ[L xn*IR5*V(5yuG F1$ϻ^l)%:m[e-X&!?o24COaGEUs|se;*nZ> E~q׹GTN˗ o](gf*e_ewBٝ!#s/:z<-hBf ȃ&C8;5?g\v˪^s9$؛KDE61Q>x?H3YMBʼzay-\oa  S 5WTr$8E$7#!{VA/}UcoDGVeRzeDJH0V[3)~;_>ZJKEG HDP-:21_jb:b57BsKՙ5'-) \6%7vB/ 9 ތNNQU܉*V ܍ 8K߀vl~gz?CYl:_pBNqFy#(j} >ZZZZ@w[ʭls0UDt3EZ#96#[\6o78ڤK꘿b#@+7l?a4FZogY՚ZnbS11:]b۪1.UUƙ AR\<%@(]\􌳠o\JUǧrxiVngk=~+%"MJ͈R953J%_0‰+.Ⲡn\-hWՅq͸u.4}=GE CI޾(;cY2h? NA]b]V:g%tnWJo=vR.mPY$,;އn =`Za8.A# }E"x, !Ѣ!$YqˢO $[I>jѧ, BE#x-!â"dZt%BM>eU,E Աu-!ۢ/ Գ-BТE, BcChbW)Gȱ7", E7#4h1BsnAha\nEhim,BkXEYE#Y4;:Zt'U@d]v#t=͢{[M݋Ӣpٿ$â-\wC0=w2s}d|0> #a caO,L?GDDƗ0=7az:{d0~ ӟ%LE[?Ɵa2v ӳ80·d\t´2X `$(2ÐLF00Ӑ; #Ld90K@F Dd$9 +̒0R, ft5, F0#;!hf a4&90##0Y3d4w-,-F0k6mCF{fa\fKuEF7=z fa 3 OY?f(tׄYd\0 0`d qׇYCư00#ƨ01cl݄qWyoI`nMrӷZlbnzŦo;T7uT+:SOw{t79cyMĹx7Г&yjb[y'MIry,7y'M>IqzRC47'M.x# 7'M.t k>v#ѮCbOmudF>J2;?"W_ʾJ,v ctZZ3"76t `8LW4#:y7] =$~H$Ej1c kB<Қ#pҕJz$=Jek` co2"?tI!42GjLHɽ!iY*M"OJw#d(ud>*}Eʤ?NY&oȩd܈ۑr_<|"BNs򽼊"o&ȻY0=/B/?J߈Q$Fd [R3g1J+)m;0] 7b?\AAVC<,Q̒i1KÒyX KU .cirD\ü+,CYe*e)X-⻬rQ!~ʲSrV_5PB<5ReD5VY51:,G؈f,"aN'k\?@RZ7"a[Xu2tVSF\ګ-g b}"R8A} {H=%VR=Aϖ +IW;i1ʖHc+:9b#hV-۲5F7[kg/%c x13#^5{c h,E|m2VjXm16!Mom;5?ﳐ +5>G?rgv< vv IdZl^7"K1syѼۼTR>ɾƾe7VFqlocW6vllgcksmlf&66ul̲14mL1FFFFAZi?m&G|\' \*P]S*>B M8,D*ɀ#LT~9#` zF߰]0U]&xF ŢIFHUsYhJG҈rrbq*Nc{HMS)@zCɑL7̂i#&ZEY0">*B'*2,SoN.N+Pm$}*(8\jA%"Փ ZvDPTy4i#'릊]T"h$B&{5爘V 7avY[Сa5hXunF.װ5܂j&kaLk}x U4K{fCDf4dK"(bخ`~A6o[,ߧU}./1( ~A > Ikhlá=FG~h[z3.Rp͸R4`*ŠT(lg°Y fA/+^o;~KM+ xq' !lea$q?c/{[T^5T%iA*S'U1y=&s6ÈZ;  ĸչj+/&ܾ_.4c30k=8B.9E&!/+)cJdiDV1-)h}(bRRPoyϪ܋.iq}ܣ%#[-ˬ`KWoUv cE"EX<[ -G9ά3b}߯Ęc$b4j>7wf-6S朻uϿ؍O4l2܃!!'<"Q1 E 8rFňgB$|FbTa5J:aӰ%*&4)C[C&5LRV TTTXՃQ#HʌΙ7l-o:i^zB(".WKqo˻Vzj VwpM~w1-I`6f⸟ٳEc-[wQA{͟fݕ5靓nEP/d6K6ΗNz+i>.R{Ɗgq7__ Ĥq6/sN:BB\Q~DLH\HBHeN򔓮Et;2wxN {kCo顬*&데wװ9N *#2ʹˑQ&:c0}*p.v¸*_5x,YkL:E!}ݫdCq/ڵnUW&d~@*!~#DoK%`hAm˕/G["M%AՈJOX!9v6Ja%< h#q{*yw᫉fpwQc03} 4 g8;¿ 0r1\8w)ѾQNA;~$:q]cؓՄ**Sg6QU[qC%ݕLu0W/b07]KhkYQ^dPd1O˜9Ϲrfdt kՌGңVtl'W(xm}ԯr G禀- hW[T=DňDG2 *AGHfpf8:51I$4KkmDMij4 Xfw߼7?޳s~s}|_6la##bNH9-##2b>)b~RSb~Z)1?#'b>-Y19 /&E/xY/dqN+6,/UzM ~eůmhy+~cVoxS[6wNJ6 ͸de㰰X^ PK  "؈+Nc#*X*w#ڽB[yt;vY' ,.񞉗UGӛ$:vJtR LtHM"̎]x2>oK$lvL'G\p$tJ\D: Gbt&欈`p_0{HJ;IE=Rβd:ϳ2 BJ Apok^AlFN+X> 9R0(txT;irNBܓs>*\`}QOB(bœ`$|Rnh)G&S u,dH C,{V E۰ҾcbLU\ӄugf`kWKID*Z֞7kֵ%ְq+(yw ާ(r2pĥ r[Rt{xnuw z4[-aFx{(ms_K Lִ:h sr&eek~OkKZ2ioqQ\x>o`Pn(PQ]+U0(V[pVJ"T*nPʥ_9:7mrqwĵ%){,`MFAlKBwy oVw5;]?OŪ!5|S)º";5'f/up䷈䶈ϋd:%ghxƆu ~2xS^,5lႧ;QTxKK a5}p+Eђ_9M2tܨ`)8 nDy`Bd/l'n3n8]M&thaDo!D{p9Kg8' ]BBC0ȪJs]p_qV<`sV02VILPHT,QEbATcsI3 1iLLއ{%*e]3،eԮjVlDsK,Ո,a׈Fdž]gJ'DZ1s x!\an'؁?D>⑏Q~my?a8Wx1&fجPlJ1O?=zS0QoG!&C_o-BMw3Bп / . tO\w/gjFjKA=M|hw0͵ K< uM%YվA,*8WS3+ˊ(M8+7/ e CHx8Ef˥ &xCL5A9a԰e0 Ss M57T5l *wjiyQqyYMKj*OT!]K/r9@JiY+ӧU1ΦrޠRm$3sd#ډBj#jA\yR֛WbIOYn?ddj)t")ԝZ;Zf$3suUHcya+(ܝ.E":RvF޸ AmD-w{x[ tuvhF?n(-*Q9xFܢy3KiEXݘǑg#M-.Y-I=i~Iqm~yoIItJ}a;OK$&Gc#i#< +r3ƅ_T={WubInʾWTIvf$ь~,Bzjp I=~YC%=7?L]f/H5Ut N1-P%!`n+k 4z9vTyUgZ8շTjHņ=1iQR4Q .mo\bOF9*)zgbëFJ)iHZ2%_ @@u%$4UmNBg^_#ͨ.7\5S8Trrp- g6xЀa1 adSXZURAkmKٺBbdu <`g騱y°C;-~p!.e6+=T 2$S :̀7Y?Yiw"dGѵKM03|BkL|G0(tl`xkLc>&~ xL^`"&2yL>`!|&2L`%|&]Yejd}F3fk)j&)s!LP5BSj5B7=鶀g!܁Ʈ3&u_t6䫭3wM%A~QG7-?TѸc!+;\P x>jF5J[ȞZHQXN ?'tT5r㫮.om궥 iKOt`Q| Ѱ  ah+d?ҲMq;?ؒS!D<*{ߧ{IşRişQYK/(/)(55늿ۊjx+*+*+_*_+Zj)?(?)()()TI~\H@Q;)dm@tuJa)!'jLEWӹ$T(SvuIpBBFIK}0d7+vb'8=Z;vc7DW AhX?D0j 70{ɀ@F9-N&$5wzWx;!&Cb"}7%CTo`=ek`4@jV\uNo{ȷkoAvTj; wx^G; C<=6 Y0Φ#96{.$@PWB9\a-f,87yp+\p5lK~#54(j'J [5Nf j eoN8,w@LPB(A&+h; D-b% h#ݐɩ нaH(WvbMA<0$#clM{MFXPh{]~ Kפ|6*6vUcVѼvoXjrat?s/J=tS@u$%8RAΰ}`vad׻! Q'w~4<FEO,Rʷ{殒YW-5yM`޵}*yr,rCJ;e)t&}Si$Qwȫ98dwyTcѱ6z] .o n{ /7{:`='REI%+)Pnq=|k?Tj8TaD0-pSTsAd?@:;&|SyPv5ꬊDJ"ٔ3?g5̕&,:MX;#΋R-C\:G*'I>P,M+IwvRZj%JG .W|FʊܼQ.zƒe<ߒo$p8#`0!GB.->5y1%m}|Imfn=acR[gJ`%{ dHLԅnI3H:ӒYY$m<CIJ/e$clGZkٖ[y>RϷ ,u?R/hK=ԋ,1zXK]iY%RWoK-u k- DK]GzK`-uYfKBҀ%m'tI\iٝl٭ 7K=b0x`4N8㨖S  G@΀f,U8 Nٰ*,X 7\؉ ΃(x۸Dž V_x4ETౘ8Éùbiqq9p)^5kq>ǧF'6(l1*(8<ƈҟax[?V ;\`l&Iv:=L]4 6H9l޺=[>O>,a^O:!n ^vpmK *YD,MMg9fH}U'T>iL]t%O CCr%AE;\zA5/J1b0d!0KKD\g PI+1>[rqοtę6