python-tk-2.7.18-150000.99.1 < > , p ixѬp9| 8 Wt-+D!9áս$-҄yb0< Z/IaH^98QhVj(XYEx$ 1X_ΤVU5 BLMY BTl LUI=U}3liG e?j)>=``TAӿ
"M 'vÖ-Z廭s23Ҽ=rUWId[!CMmÀ(z%{$ Yuxc > A ? d = $ * 4 o o o
o h o ! o
" o # o % o ( (< o ) *T * + ( , 8 , { 9 - { : 6
{ B F = G T o H o I o X < Y X Z [ \ o ] X o ^ b e c d e f l u o v ` w t o x 0 o y q z C python-tk 2.7.18 150000.99.1 TkInter - Python Tk Interface Python interface to Tk. Tk is the GUI toolkit that comes with Tcl. ixѬh01-ch3a ;SUSE Linux Enterprise 15 SUSE LLC Python-2.0 https://www.suse.com/ Development/Libraries/Python https://www.python.org/ linux x86_64 ' < < " % % , ,
h
h - wZ wZ , 2 2 sk
6 + + w 4( >' >' 7 7 , , , ' ' C > > b Pm g} g} _ ) ) g 6 6 + # # m !9 !9A큤A큤A큤A큤 ixѝixњiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixіiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓixњixёiwW@ixѓixѓixњiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓixњiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓiwW@ixѓixѓ58bb06a852fd2df04e6dcadbb6c8917f897b8b4944867d7540e4e870845cdc18 074e1bb0397d6689e5dbb1ae4e5ccd1c0d0c4704656729d3cdd1fa44f986d077 1fab9aac7cbbee3a9f7c5d702f99f151184d66dd6ea8e0feaec557cd4d5ed900 1fab9aac7cbbee3a9f7c5d702f99f151184d66dd6ea8e0feaec557cd4d5ed900 886afde4c1589a688afc857a0fb5039f8388f225443283081d9ddf072571b064 edfe53b62802bd327e86fff45b478b2cc6828dfcd6fa42a5e9e02b0301e5aae8 edfe53b62802bd327e86fff45b478b2cc6828dfcd6fa42a5e9e02b0301e5aae8 9229d117eca73b48a41b6303bffed14184add10afd20273976715fdd4840042a 2e3cb523662e12dd966f1e0a032747f9a1ccedf4df4df7fd46feda020ec0c2dc 2e3cb523662e12dd966f1e0a032747f9a1ccedf4df4df7fd46feda020ec0c2dc 808ece582c4a8e502c062b23aa16949d85878a9f3485d2111fd19ac6bdbb02e8 80df814f0b1298baf8f83805d0a9053d846ce95ac2ca7850bfb1748e5dad7969 e46611adc13b9e6af87c4f1ce87eaf36a6814e3df72171a175cc50c9c9136a54 54f55b9696013117aa8758f901f77cc30dce6ad6f13df8b85c26c5af843a7fa0 c780cc1d6c02d1fed8b33c9914651f01ff6510f77233144c60127eeb7c170ea6 c780cc1d6c02d1fed8b33c9914651f01ff6510f77233144c60127eeb7c170ea6 1dbc9f1fc85237211d52b96ee1cc1c5553c81e0a62fd7143b95e16d32f5abafd 2a11bca94888f04e566b9946aca8d55096d20e82ba507721ada8268879f80f7d 2a11bca94888f04e566b9946aca8d55096d20e82ba507721ada8268879f80f7d 0e875733af8af973cb94d088dbe5b4ed36dd3db1241970ec2bf19ea97ec5fbf8 7f5180dcfdcf5caef6de6f79356f952c773cebcdc449f40676f0189c3ea9859a 7f5180dcfdcf5caef6de6f79356f952c773cebcdc449f40676f0189c3ea9859a c01314dc51d1c8effeba2528720a65da133596d4143200c68595c02067bf1da2 b70a41910606229537c716b1f07dc8914d5cddf6c906f6499cb817ec0f092c43 b70a41910606229537c716b1f07dc8914d5cddf6c906f6499cb817ec0f092c43 c8fb5c768f76788cb678922aed330e2b7ae3cc825fdabea1a09b18db557711dc d477077c3e4d3963fca2d0f51b0e92feb83f4e1c6e62c555b04481824608007e d477077c3e4d3963fca2d0f51b0e92feb83f4e1c6e62c555b04481824608007e 98b2cd8b857ff09c0e6b3a330b98415a97282d70fa80b9cd15d1e14b2d2aea88 54f1e6333c2fba46386092443ef8b395c7988310c512a41d3a5d2375f3209a6e 54f1e6333c2fba46386092443ef8b395c7988310c512a41d3a5d2375f3209a6e fe3c79d5da8616ca37f7a9d8fddaac2c9164b593c7b116580aa99690a5f59ab5 e82c816f3b0fdff328dfc84a8076385feec2208ac94a7e402af9138f8b6996e7 63549ae998dc30d95ea8c525adfe19efa7905fb0dd37d0e166b2e321f95a338c 63549ae998dc30d95ea8c525adfe19efa7905fb0dd37d0e166b2e321f95a338c e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 38c26646fec4b0915d0b8bd789d8ff70c8a46fa08c195e00535a0fb78ff3211a 38c26646fec4b0915d0b8bd789d8ff70c8a46fa08c195e00535a0fb78ff3211a 0e9cbeed9f1bbec6f79a2bcebee7e12f896caba3b1a167d935446d009262dca2 a6065d2fe95318f69e6b961b73751da6fff328684e1813ee86a63a6d8b0270c0 a6065d2fe95318f69e6b961b73751da6fff328684e1813ee86a63a6d8b0270c0 fe5f12d6412050e1414dfabc16ecc2341779d627362e1d81666e8b466986c50a 36a42c9ca642ea5b35f49ac0ea00900e98852310e4c22d11af02f4b97d0d7785 36a42c9ca642ea5b35f49ac0ea00900e98852310e4c22d11af02f4b97d0d7785 07078aa64be8d2d3a02fcfa10eb73eebf06583fae23134ae47b9d4b2bf66d23a c35451a5520d2fe3b1680ef280c595f64d216b7a4c5e921051c26ee35403fd9b c35451a5520d2fe3b1680ef280c595f64d216b7a4c5e921051c26ee35403fd9b ba8ad521638ef8148d07be0925111fb57cb1b64dadf770f1ca2bd17e1bb356d6 75622986fbd4d8aad3e42a057bc0b71092930b8fbbe4dd78901c25707a294c5c 75622986fbd4d8aad3e42a057bc0b71092930b8fbbe4dd78901c25707a294c5c 9e9439bfa528e20f0e045905ea5a3eca4cd27c4c9f190c62c192f9945caaae28 38c004f81893c09c870c680be37219eac90ada1857be8c670e47bacd77f90959 38c004f81893c09c870c680be37219eac90ada1857be8c670e47bacd77f90959 ea0ebbfcc26a428337548a5e3c6768294497b81cce8f845d23e035ea62cd1aab d7272d74b29fe2913f4c3adf44b6db4ec02f9ca6a08f12ae7a33fb3343a328cd d7272d74b29fe2913f4c3adf44b6db4ec02f9ca6a08f12ae7a33fb3343a328cd 49029a61956e79a10fb9b79000283c1e83cabc0645adacf9824a99dbe2dece5f 3549ee46d0a4e3b1757ae97a5490dc30e5e5cb3c8c273e964d97ae3b32b22503 3549ee46d0a4e3b1757ae97a5490dc30e5e5cb3c8c273e964d97ae3b32b22503 19a6ca5753fe74ec6248d166d2a54acfcd70f823ea578cfe803baf8f87ea346d 502dfa78c8bbb36ab77c708630b3e4999b844cf2ed46ad7007908b19d53092bb 502dfa78c8bbb36ab77c708630b3e4999b844cf2ed46ad7007908b19d53092bb e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 5e1d6fe8da2ad8aa795a8aed0aa505381638aff118a0b9aee18c0132094e9e02 5e1d6fe8da2ad8aa795a8aed0aa505381638aff118a0b9aee18c0132094e9e02 53b465fb6754d8c39458a1e1ba7f8504f40d724e7dbcc7ab8fc38ea65c08c02e a42571f2fc0ab69c916d3c1c3087979c982cd14bcb8a21693b6b6396058c390f a42571f2fc0ab69c916d3c1c3087979c982cd14bcb8a21693b6b6396058c390f 9d53e31b151af887cd26829a1331843c02288a8480ca74a7fc631833ce60d0cb c3c2dc9ba5e50e71075dc0ac0ef00cf2714c73f45f1486c2cd2800beb17c3ecf c3c2dc9ba5e50e71075dc0ac0ef00cf2714c73f45f1486c2cd2800beb17c3ecf 9fc1aec0a300d4754c94d77b4ee8f029540eb88bcf0ef288551f52e9410de8d3 3a905865696d96620161230e909ec4eed2357f49317f108f97e712c5de3e1c3a 3a905865696d96620161230e909ec4eed2357f49317f108f97e712c5de3e1c3a 9241c97e08b337b0b92ee5b4e029936fa3eb53bdc821c080e78b020699e2aed7 ecad5f6a29f7b218ed1b021ac644340342a8d4826bfa228715c8e3079d00f400 ecad5f6a29f7b218ed1b021ac644340342a8d4826bfa228715c8e3079d00f400 15df8a908a8e80163bca643c76ec6e4ceff80ee83da5d1fc4e10c364fadbbb85 1cae45809f63ea1ba4d355991f575f93c39e810f66cfa88cf8eba37eeecd42b2 1cae45809f63ea1ba4d355991f575f93c39e810f66cfa88cf8eba37eeecd42b2 2205693a5fa6a8b9e408b24e9dc938f74f6250a1212c5fe5bcf31f09be16d936 c3cbb26d7e0317729ba5eba8397f224c55be8a63b9507a4e2fc12dabee8a79eb c3cbb26d7e0317729ba5eba8397f224c55be8a63b9507a4e2fc12dabee8a79eb 5b6a1486c4c1ce533b146cf455c599d5ef8eec94a8eb9821a847985c12e3ddcd 0f487c9be25ae608094a4da2587d5398d4b0eb52b1a59a80e9780b85be7e78b7 0f487c9be25ae608094a4da2587d5398d4b0eb52b1a59a80e9780b85be7e78b7 9547e4f72af28ec4262f88a00b6d2eb912ff49e2f5b3aa16b5a50a3230964d83 3146714342cda3fcd215191be1b7d92e66c901b3941c52b808544c3587884335 3146714342cda3fcd215191be1b7d92e66c901b3941c52b808544c3587884335 360ba16e412f9d00617baa89c0ca476d49576a34bfff026cebebc71e630505a9 336b2f7646937fdb74d2816725efd158004344c77739e026b612deee7b635456 336b2f7646937fdb74d2816725efd158004344c77739e026b612deee7b635456 2f28b22cc571ed211824ac750e2c1b98574748f90829a7b01efd0ddfce6cbf32 704f41d6131594633a702fd27a82ffc26faa56024165f9e1faa164561a98a504 704f41d6131594633a702fd27a82ffc26faa56024165f9e1faa164561a98a504 cdb0fcb4cc54d55fe963aac128269754c09f8583afa00b445926951e5fb5118b 65128ca2a8ef548d3abfdab8a149252c634880078fdf398878d61a1e4ec8999c 65128ca2a8ef548d3abfdab8a149252c634880078fdf398878d61a1e4ec8999c 4b09f3aaccecb4a434d94937cb737b65767f7b595cd51a3fa48fcaddbde984e3 5e7717a12fb59d3080e435ed80e4b94433de0421f49010338465b80a6d628ced 5e7717a12fb59d3080e435ed80e4b94433de0421f49010338465b80a6d628ced b4c15f951994f60a263b271323e31896e8f6e049135c9f5904d8a877ee8ea8ac 5b14c1762b8469ae45e5fbb9388a6b4b83c6a67ba1e18f24c28ecc98f6534adb 5b14c1762b8469ae45e5fbb9388a6b4b83c6a67ba1e18f24c28ecc98f6534adb cdb5a419bd0bb4b98221fa23a480c7a92733824b259b8bfefaac5da7517643db 5087ebcc0a95d4d64d843bd1e969c8f0846b8788d78d8fd00ee356ae622565e6 5087ebcc0a95d4d64d843bd1e969c8f0846b8788d78d8fd00ee356ae622565e6 root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root python-2.7.18-150000.99.1.src.rpm pyth_tk pyth_tkl python-tk python-tk(x86-64) python-tkinter python2-tk python_tkinter_lib @ @ @ @ @ @ @ @
libc.so.6()(64bit) libc.so.6(GLIBC_2.2.5)(64bit) libc.so.6(GLIBC_2.4)(64bit) libpthread.so.0()(64bit) libpython2.7.so.1.0()(64bit) libtcl8.6.so()(64bit) libtk8.6.so()(64bit) python(abi) python-base rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PartialHardlinkSets) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 2.7 2.7.18 3.0.4-1 4.6.0-1 4.0.4-1 4.0-1 5.2-1 4.14.1 iwW@i_@i@i h@hxgw@g@g@g4f@fH@f?]f h@e,e @eedeee Rd˖dD@dq@du@dtdm@dxdc>@cӼc0c|ck@c pcbbb@b@b@ba@a@a(@aim@aI@a'@a#aj@a`t`8`_T^J^@^@^>^>^;^8 @^.^g@^
@]f@]@]]]d@]d@]@]z@]V]y@]9]1] \t@\\7\7\\J@\J@\C@\2[[#@[6 @[ @[
@[Za@Z@ZxG@ZtRZp^@Z,
gh#python/cpython#103848#issuecomment-2708135083). - Modify CVE-2025-0938-sq-brackets-domain-names.patch: we don't
use bracketed_host variable any more (correction of the fix for
bsc#1236705, discovered during analysis for bsc#1223694). - Add CVE-2025-0938-sq-brackets-domain-names.patch which
disallows square brackets ([ and ]) in domain names for parsed
URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704) - Add CVE-2024-11168-validation-IPv6-addrs.patch
fixing bsc#1233307 (CVE-2024-11168,
gh#python/cpython#103848): Improper validation of IPv6 and
IPvFuture addresses.
- Add ipaddress module from https://github.com/phihag/ipaddress
- Remove -IVendor/ from python-config boo#1231795 - Stop using %%defattr, it seems to be breaking proper executable
attributes on /usr/bin/ scripts (bsc#1227378). - bsc#1221854 (CVE-2024-0450) Add
CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch
detecting the vulnerability of the "quoted-overlap" zipbomb
(from gh#python/cpython!110016). - Switch to using the system libexpat (bsc#1219559,
CVE-2023-52425)
- Make sure to remove all embedded versions of other packages
(including expat).
- Add CVE-2023-52425-libexpat-2.6.0-remove-failing-tests.patch
removing failing test fixing bpo#3151, which we just not
support.
- Remove patches over those embedded packages (cffi):
- python-2.7-libffi-aarch64.patch
- sparc_longdouble.patch - Modify CVE-2023-27043-email-parsing-errors.patch to fix the
unicode string handling in email.utils.parseaddr()
(bsc#1222537).
- Revert CVE-2022-48560-after-free-heappushpop.patch, the fix was
unneeded. - Switch off tests. ONLY FOR FACTORY!!! (bsc#1219306) - Build with -std=gnu89 to build correctly with gcc14, bsc#1220970 - Add CVE-2023-27043-email-parsing-errors.patch to
gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Add CVE-2022-48560-after-free-heappushpop.patch fixing
use-after-free in Python via heappushpop in heapq (bsc#1214675,
CVE-2022-48560).
- switch from %patchN style to the %patch -P N one. - (bsc#1214691, CVE-2022-48566) Add
CVE-2022-48566-compare_digest-more-constant.patch to make
compare_digest more constant-time.
- Allow nis.so for SLE-12. - (bsc#1214685, CVE-2022-48565) Add
CVE-2022-48565-plistlib-XML-vulns.patch (from
gh#python/cpython#86217) reject XML entity declarations in
plist files.
- Remove BOTH CVE-2023-27043-email-parsing-errors.patch and
Revert-gh105127-left-tests.patch (as per discussion on
bsc#1210638). - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
gh#python/cpython#108310, backport from upstream patch
gh#python/cpython#108315
(bsc#1214692, CVE-2023-40217) - IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
partially reverting CVE-2023-27043-email-parsing-errors.patch,
because of the regression in gh#python/cpython#106669. - (bsc#1210638, CVE-2023-27043) Add
CVE-2023-27043-email-parsing-errors.patch, which detects email
address parsing errors and returns empty tuple to indicate the
parsing error (old API). - Fix the application of the python-2.7.17-switch-off-failing-SSL-tests.patch. - python-2.7.5-multilib.patch: Update for riscv64
- Don't fail if _ctypes or dl extension was not built - The condition around libnsl-devel BuildRequires is NOT
switching off NIS support on SLE < 15, support for NIS used to
be in the glibc itself. Partial revert of sr#1061583. - Add PygmentsBridge-trime_doctest_flags.patch to allow build of
the documentation even with the current Sphinx. (SUSE-ONLY
PATCH, DO NOT SEND UPSTREAM!) - Enable --with-system-ffi for non-standard architectures. - SLE-12 builds nis.so as well. - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
bsc#1208471) blocklists bypass via the urllib.parse component
when supplying a URL that starts with blank characters - Disable NIS for new products, it's deprecated and gets removed - Add skip_unverified_test.patch because apparently switching off
SSL verification doesn't work on older SLE. - Restore python-2.7.9-sles-disable-verification-by-default.patch
for SLE-12. - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
extremely long domain names. - Add bpo34990-2038-problem-compileall.patch making compileall.py
compliant with year 2038 (bsc#1202666, gh#python/cpython#79171),
backport of fix to Python 2.7. - Add patch CVE-2021-28861-double-slash-path.patch:
* BaseHTTPServer: Fix an open redirection vulnerability in the HTTP server
when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
command injection in the mailcap module. - Filter out executable-stack error that is triggered for i586
target. - Update bundled pip wheel to the latest SLE version patched
against bsc#1186819 (CVE-2021-3572).
- Recover again proper value of %python2_package_prefix
(bsc#1175619). - BuildRequire rpm-build-python: The provider to inject python(abi)
has been moved there. rpm-build pulls rpm-build-python
automatically in when building anything against python3-base, but
this implies that the initial build of python3-base does not
trigger the automatic installation. - Older SLE versions should use old OpenSSL. - Add CVE-2022-0391-urllib_parse-newline-parsing.patch
(bsc#1195396, CVE-2022-0391, bpo#43882) sanitizing URLs
containing ASCII newline and tabs in urlparse. - Add CVE-2021-4189-ftplib-trust-PASV-resp.patch (bsc#1194146,
bpo#43285, CVE-2021-4189, gh#python/cpython#24838) make ftplib
not trust the PASV response. - build against openssl 1.1.x (incompatible with openssl 3.0x)
for now. - on sle12, python2 modules will still be called python-xxxx until EOL,
for newer SLE versions they will be python2-xxxx - BuildRequire rpm-build-python: The provider to inject python(abi)
has been moved there. rpm-build pulls rpm-build-python
automatically in when building anything against python3-base, but
this implies that the initial build of python3-base does not
trigger the automatic installation. - Add CVE-2019-20907_tarfile-inf-loop.patch fixing bsc#1174091
(CVE-2019-20907, bpo#39017) avoiding possible infinite loop
in specifically crafted tarball.
Add recursion.tar as a testing tarball for the patch.
- Provide the newest setuptools wheel (bsc#1176262,
CVE-2019-20916) in their correct form (bsc#1180686).
- Add CVE-2020-26116-httplib-header-injection.patch fixing bsc#1177211
(CVE-2020-26116, bpo#39603) no longer allowing special characters in
the method parameter of HTTPConnection.putrequest in httplib, stopping
injection of headers. Such characters now raise ValueError. - Renamed patch for assigned CVE:
* bpo44022-fix-http-client-infinite-line-reading-after-a-HTTP-100-Continue.patch ->
CVE-2021-3737-fix-HTTP-client-infinite-line-reading-after-a-HTTP-100-Continue.patch
(boo#1189241, CVE-2021-3737) - Renamed patch for assigned CVE:
* bpo43075-fix-ReDoS-in-request.patch -> CVE-2021-3733-fix-ReDoS-in-request.patch
(boo#1189287, CVE-2021-3733)
- Fix python-doc build (bpo#35293):
* sphinx-update-removed-function.patch
- Update documentation formatting for Sphinx 3.0 (bpo#40204). - Add bpo43075-fix-ReDoS-in-request.patch which fixes ReDoS in
request (bpo#43075, boo#1189287).
- Add missing security announcement to
bpo44022-fix-http-client-infinite-line-reading-after-a-HTTP-100-Continue.patch. - Add bpo44022-fix-http-client-infinite-line-reading-after-a-HTTP-100-Continue.patch
which fixes http client infinite line reading (DoS) after a http
100 (bpo#44022, boo#1189241). - Modify Lib/ensurepip/__init__.py to contain the same version
numbers as are in reality the ones in the bundled wheels
(bsc#1187668). - Add CVE-2021-23336-only-amp-as-query-sep.patch which forbids
use of semicolon as a query string separator (bpo#42967,
bsc#1182379, CVE-2021-23336). - Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
_ctypes/callproc.c, which may lead to remote code execution. - (bsc#1180125) We really don't Require python-rpm-macros package.
Unnecessary dependency. - Add patch configure_PYTHON_FOR_REGEN.patch which makes
configure.ac to consider the correct version of
PYTHON_FO_REGEN (bsc#1078326). - Use python3-Sphinx on anything more recent than SLE-15 (inclusive). - Update to 2.7.18, final release of Python 2. Ever.:
- Newline characters have been escaped when performing uu
encoding to prevent them from overflowing into to content
section of the encoded file. This prevents malicious or
accidental modification of data during the decoding process.
- Fixes a ReDoS vulnerability in `http.cookiejar`. Patch by Ben
Caller.
- Fixed line numbers and column offsets for AST nodes for calls
without arguments in decorators.
- bsc#1155094 (CVE-2019-18348) Disallow control characters in
hostnames in http.client. Such potentially malicious header
injection URLs now cause a InvalidURL to be raised.
- Fix urllib.urlretrieve failing on subsequent ftp transfers
from the same host.
- Fix problems identified by GCC's -Wstringop-truncation
warning.
- AddRefActCtx() was needlessly being checked for failure in
PC/dl_nt.c.
- Prevent failure of test_relative_path in test_py_compile on
macOS Catalina.
- Fixed possible leak in `PyArg_Parse` and similar
functions for format units "es#" and "et#" when the macro
`PY_SSIZE_T_CLEAN` is not defined.
- Remove upstreamed patches:
- CVE-2019-18348-CRLF_injection_via_host_part.patch
- python-2.7.14-CVE-2017-1000158.patch
- CVE-2018-14647_XML_SetHashSalt-in_elementtree.patch
- CVE-2018-1061-DOS-via-regexp-difflib.patch
- CVE-2019-10160-netloc-port-regression.patch
- CVE-2019-16056-email-parse-addr.patch - Add CVE-2019-9674-zip-bomb.patch to improve documentation
warning about dangers of zip-bombs and other security problems
with zipfile library. (bsc#1162825 CVE-2019-9674) - Change to Requires: libpython%{so_version} == %{version}-%{release}
to python-base to keep both packages always synchronized (add
%{so_version}) (bsc#1162224). - Add CVE-2020-8492-urllib-ReDoS.patch fixing the security bug
"Python urrlib allowed an HTTP server to conduct Regular
Expression Denial of Service (ReDoS)" (bsc#1162367) - Provide python-testsuite from devel subkg to ease py2->py3
dependencies - Add python-2.7.17-switch-off-failing-SSL-tests.patch to switch
off tests coliding with the combination of modern Python and
ancient OpenSSL on SLE-12. - libnsl is required only on more recent SLEs and openSUSE, older
glibc supported NIS on its own. - Add provides in gdbm subpackage to provide dbm symbols. This
allows us to use %%{python_module dbm} as a dependency and have
it properly resolved for both python2 and python3 - Drop appstream-glib BuildRequires and no longer call
appstream-util validate-relax: eliminate a build cycle between
as-glib and python. The only thing would would gain by calling
as-uril is catching if upstream breaks the appdata.xml file in a
future release. Considering py2 is dying, chances for a new
release, let alone one breaking the xml file, are slim. - Unify packages among openSUSE:Factory and SLE versions.
(bsc#1159035) ; add missing records to this changelog.
- Add idle.desktop and idle.appdata.xml to provide IDLE in menus
(bsc#1153830) - Add python2_split_startup Provide to make it possible to
conflict older packages by shared-python-startup. - Move /etc/pythonstart script to shared-python-startup
package. - Add bpo-36576-skip_tests_for_OpenSSL-111.patch (originally from
bpo#36576) skipping tests failing with OpenSSL 1.1.1. Fixes
bsc#1149792 - Add adapted-from-F00251-change-user-install-location.patch fixing
pip/distutils to install into /usr/local. - Update to 2.7.17:
- a bug fix release in the Python 2.7.x series. It is expected
to be the penultimate release for Python 2.7.
- Removed patches included upstream:
- CVE-2018-20852-cookie-domain-check.patch
- CVE-2019-16935-xmlrpc-doc-server_title.patch
- CVE-2019-9636-netloc-no-decompose-characters.patch
- CVE-2019-9947-no-ctrl-char-http.patch
- CVE-2019-9948-avoid_local-file.patch
- python-2.7.14-CVE-2018-1000030-1.patch
- python-2.7.14-CVE-2018-1000030-2.patch
- Renamed remove-static-libpython.diff and python-bsddb6.diff to
remove-static-libpython.patch and python-bsddb6.patch to unify
filenames. - Add CVE-2019-16935-xmlrpc-doc-server_title.patch fixing
bsc#1153238 (aka CVE-2019-16935) fixing a reflected XSS in
python/Lib/DocXMLRPCServer.py - Add bpo36302-sort-module-sources.patch (boo#1041090) - Add CVE-2019-16056-email-parse-addr.patch fixing the email
module wrongly parses email addresses [bsc#1149955,
CVE-2019-16056] - boo#1141853 (CVE-2018-20852) add
CVE-2018-20852-cookie-domain-check.patch fixing
http.cookiejar.DefaultPolicy.domain_return_ok which did not
correctly validate the domain: it could be tricked into sending
cookies to the wrong server. - Skip test_urllib2_localnet that randomly fails in OBS - bsc#1138459: add CVE-2019-10160-netloc-port-regression.patch
which fixes regression introduced by the previous patch.
(CVE-2019-10160)
Upstream gh#python/cpython#13812 - Set _lto_cflags to nil as it will prevent to propage LTO
for Python modules that are built in a separate package. - bsc#1130840 (CVE-2019-9947): add CVE-2019-9947-no-ctrl-char-http.patch
Address the issue by disallowing URL paths with embedded
whitespace or control characters through into the underlying
http client request. Such potentially malicious header
injection URLs now cause a ValueError to be raised. - bsc#1130847 (CVE-2019-9948) add CVE-2019-9948-avoid_local-file.patch
removing unnecessary (and potentially harmful) URL scheme
local-file://. - bsc#1129346: add CVE-2019-9636-netloc-no-decompose-characters.patch
Characters in the netloc attribute that decompose under NFKC
normalization (as used by the IDNA encoding) into any of ``/``,
``?``, ``#``, ``@``, or ``:`` will raise a ValueError. If the
URL is decomposed before parsing, or is not a Unicode string,
no error will be raised (CVE-2019-9636).
Upstream commits e37ef41 and 507bd8c. - (bsc#1111793) Update to 2.7.16:
* bugfix-only release: complete list of changes on
https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.16rc1.rst
* Removed openssl-111.patch and CVE-2018-1000802-shutil_use_subprocess_no_spawn.patch
which are fully included in the tarball.
* Updated patches to apply cleanly:
CVE-2019-5010-null-defer-x509-cert-DOS.patch
bpo36160-init-sysconfig_vars.patch
do-not-use-non-ascii-in-test_ssl.patch
openssl-111-middlebox-compat.patch
openssl-111-ssl_options.patch
python-2.5.1-sqlite.patch
python-2.6-gettext-plurals.patch
python-2.7-dirs.patch
python-2.7.2-fix_date_time_compiler.patch
python-2.7.4-canonicalize2.patch
python-2.7.5-multilib.patch
python-2.7.9-ssl_ca_path.patch
python-bsddb6.diff
remove-static-libpython.patch
* Update python-2.7.5-multilib.patch to pass with new platlib
regime. - bsc#1109847 (CVE-2018-14647): add
CVE-2018-14647_XML_SetHashSalt-in_elementtree.patch fixing
bpo-34623. - bsc#1073748: add bpo-29347-dereferencing-undefined-pointers.patch
PyWeakref_NewProxy@Objects/weakrefobject.c creates new isntance
of PyWeakReference struct and does not intialize wr_prev and
wr_next of new isntance. These pointers can have garbage and
point to random memory locations.
Python should not crash while destroying the isntance created
in the same interpreter function. As per my understanding, both
wr_prev and wr_next of PyWeakReference instance should be
initialized to NULL to avoid segfault. - bsc#1122191: add CVE-2019-5010-null-defer-x509-cert-DOS.patch
fixing bpo-35746 (CVE-2019-5010).
An exploitable denial-of-service vulnerability exists in the
X509 certificate parser of Python.org Python 2.7.11 / 3.7.2.
A specially crafted X509 certificate can cause a NULL pointer
dereference, resulting in a denial of service. An attacker can
initiate or accept TLS connections using crafted certificates
to trigger this vulnerability. - Use upstream-recommended %{_rpmconfigdir}/macros.d directory
for the rpm macros. - Add patch openssl-111.patch to work with openssl-1.1.1
(bsc#1113755) - Apply "CVE-2018-1000802-shutil_use_subprocess_no_spawn.patch" which
converts shutil._call_external_zip to use subprocess rather than
distutils.spawn. [bsc#1109663, CVE-2018-1000802] - Apply "CVE-2018-1061-DOS-via-regexp-difflib.patch" to prevent
low-grade poplib REDOS (CVE-2018-1060) and to prevent difflib REDOS
(CVE-2018-1061). Prior to this patch mail server's timestamp was
susceptible to catastrophic backtracking on long evil response from
the server. Also, it was susceptible to catastrophic backtracking,
which was a potential DOS vector.
[bsc#1088004 and bsc#1088009, CVE-2018-1061 and CVE-2018-1060] - Apply "CVE-2017-18207.patch" to add a check to Lib/wave.py that
verifies that at least one channel is provided. Prior to this
check, attackers could cause a denial of service (divide-by-zero
error and application crash) via a crafted wav format audio file.
[bsc#1083507, CVE-2017-18207] - Apply "python-sorted_tar.patch" (bsc#1086001, boo#1081750)
sort tarfile output directory listing - update to 2.7.15
* dozens of bugfixes, see NEWS for details
- removed obsolete patches:
* python-ncurses-6.0-accessors.patch
* python-fix-shebang.patch
* gcc8-miscompilation-fix.patch
- add patch from upstream:
* do-not-use-non-ascii-in-test_ssl.patch - Add gcc8-miscompilation-fix.patch (boo#1084650). - Apply "python-2.7.14-CVE-2017-1000158.patch" to prevent integer
overflows in PyString_DecodeEscape that could have resulted in
heap-based buffer overflow attacks and possible arbitrary code
execution. [bsc#1068664, CVE-2017-1000158] - exclude test_socket & test_subprocess for PowerPC boo#1078485
(same ref as previous change) - Add python-skip_random_failing_tests.patch bypass boo#1078485
and exclude many tests for PowerPC - Add patch python-fix-shebang.patch to fix bsc#1078326 - exclude test_regrtest for s390, where it does not segfault as it should
(fixes bsc#1073269)
- fix segfault while creating weakref - bsc#1073748, bpo#29347
(this is actually fixed by the 2.7.14 update; mentioning this for purposes
of bugfix tracking) - update to 2.7.14
* dozens of bugfixes, see NEWS for details
* fixed possible integer overflow in PyString_DecodeEscape (CVE-2017-1000158, bsc#1068664)
* fixed segfaults with dict mutated during search
* fixed possible free-after-use problems with buffer objects with custom indexing
* fixed urllib.splithost to correctly parse fragments (bpo-30500)
- drop upstreamed python-2.7.13-overflow_check.patch
- drop unneeded python-2.7.12-makeopcode.patch
- drop upstreamed 0001-2.7-bpo-30714-ALPN-changes-for-OpenSSL-1.1.0f-3094.patch
- Apply "python-2.7.14-CVE-2018-1000030-1.patch" and
"python-2.7.14-CVE-2018-1000030-2.patch" to remedy a bug that
would crash the Python interpreter when multiple threads used the
same I/O stream concurrently. This issue is not classified as a
security vulnerability due to the fact that an attacker must be
able to run code, however in some situations -- such as function
as a service -- this vulnerability can potentially be used by an
attacker to violate a trust boundary. [bsc#1079300,
CVE-2018-1000030] - Call python2 instead of python in macros - Fix test broken with OpenSSL 1.1 (bsc#1042670)
* add 0001-2.7-bpo-30714-ALPN-changes-for-OpenSSL-1.1.0f-3094.patch - drop SUSE_ASNEEDED=0 as it is not needed anymore - Add libnsl-devel build requires for glibc obsoleting libnsl - obsolete/provide python-argparse and provide python2-argparse,
because the argparse module is available from python 2.7 up - SLE package update (bsc#1027282)
- refresh python-2.7.5-multilib.patch
- dropped upstreamed patches:
python-fix-short-dh.patch
python-2.7.7-mhlib-linkcount.patch
python-2.7-urllib2-localnet-ssl.patch
CVE-2016-0772-smtplib-starttls.patch
CVE-2016-5699-http-header-injection.patch
CVE-2016-5636-zipimporter-overflow.patch
python-2.7-httpoxy.patch
- Add python-ncurses-6.0-accessors.patch: Fix build with
NCurses 6.0 and OPAQUE_WINDOW set to 1.
(dimstar@opensuse.org) - Add reproducible.patch to allow reproducible builds of various
python packages like python-amqp
Upstream: https://github.com/python/cpython/pull/296 - update to 2.7.13
* dozens of bugfixes, see NEWS for details
* updated cipher lists for openssl wrapper, support openssl >= 1.1.0
* properly fix HTTPoxy (CVE-2016-1000110)
* profile-opt build now applies PGO to modules as well
- update python-2.7.10-overflow_check.patch
with python-2.7.13-overflow_check.patch, incorporating upstream changes
(bnc#964182)
- add "-fwrapv" to optflags explicitly because upstream code still
relies on it in many places - provide python2-* symbols, for support of new packages built as
python2-foo
- rename macros.python to macros.python2 accordingly
- require python-rpm-macros package, drop macro definitions from
macros.python2 - initial packaging of `python27` side-by-side variant (fate#321075, bsc#997436)
- renamed `python` to `python27` in package names and requires
- removed Provides and Obsoletes clauses
- dropped SLE12-only patch python-2.7.9-sles-disable-verification-by-default.patch,
companion sle_tls_checks_policy.py file and the python-strict-tls-checks subpackage
- dropped profile files
- removed /usr/bin/python and /usr/bin/python2, along with other unversioned
aliases
- rewrote macros file to enable stand-alone packages depending on py2.7
- re-included downloaded version of HTML documentation - update to 2.7.12
* dozens of bugfixes, see NEWS for details
* fixes multiple security issues:
CVE-2016-0772 TLS stripping attack on smtplib (bsc#984751)
CVE-2016-5636 zipimporter heap overflow (bsc#985177)
CVE-2016-5699 httplib header injection (bsc#985348)
(this one is actually fixed since 2.7.10)
- removed upstreamed python-2.7.7-mhlib-linkcount.patch
- refreshed multilib patch
- python-2.7.12-makeopcode.patch - run newly-built python interpreter
to make opcodes, in order not to require pre-built python
- update LD_LIBRARY_PATH to use $PWD instead of "." because the test
process escapes to its own directory
- modify shebang-fixing scriptlet to ignore makeopcodetargets.py - CVE-2016-0772-smtplib-starttls.patch:
smtplib vulnerability opens startTLS stripping attack
(CVE-2016-0772, bsc#984751)
- CVE-2016-5636-zipimporter-overflow.patch:
heap overflow when importing malformed zip files
(CVE-2016-5636, bsc#985177)
- CVE-2016-5699-http-header-injection.patch:
incorrect validation of HTTP headers allow header injection
(CVE-2016-5699, bsc#985348)
- python-2.7-httpoxy.patch:
HTTPoxy vulnerability in urllib, fixed by disregarding HTTP_PROXY
when REQUEST_METHOD is also set
(CVE-2016-1000110, bsc#989523) - Add python-2.7.10-overflow_check.patch to fix broken overflow checks.
[bnc#964182] - copy strict-tls-checks subpackage from SLE to retain future compatibility
(not built in openSUSE)
- do this properly to fix bnc#945401
- update SLE check to exclude Leap which also has version 1315,
just to be sure - Add python-ncurses-6.0-accessors.patch: Fix build with
NCurses 6.0 and OPAQUE_WINDOW set to 1. - add missing ssl.pyc and ssl.pyo to package
- implement python-strict-tls-checks subpackage
* when present, Python will perform TLS certificate checking by default.
it is possible to remove the package to turn off the checks
for compatibility with legacy scripts.
* as discussed in fate#318300
* this is not built for openSUSE, but retained here in case we want
to build the package for a SLE system - python-fix-short-dh.patch: Bump DH parameters to 2048 bit
to fix logjam security issue. bsc#935856 - add __python2 compatibility macro (used by Fedora) (fate#318838) - update to 2.7.10
- removed obsolete python-2.7-urllib2-localnet-ssl.patch - Reenable test_posix on aarch64 - python-2.7.4-aarch64.patch: Remove obsolete patch
- python-2.7-libffi-aarch64.patch: Fix argument passing in libffi for
aarch64 - update to 2.7.9
* contains full backport of ssl module from Python 3.4 (PEP466)
* HTTPS certificate validation enabled by default (PEP476)
* SSLv3 disabled by default (bnc#901715)
* backported ensurepip module (PEP477)
* fixes several missing CVEs from last release: CVE-2013-1752,
CVE-2013-1753
* dozens of minor bugfixes
- dropped upstreamed patches: python-2.7.6-poplib.patch,
smtplib_maxline-2.7.patch, xmlrpc_gzip_27.patch
- dropped patch python-2.7.3-ssl_ca_path.patch because we don't need it
with ssl module from Python 3
- libffi was upgraded upstream, seems to contain our changes,
so dropping libffi-ppc64le.diff as well
- python-2.7-urllib2-localnet-ssl.patch - properly remove unconditional
"import ssl" from test_urllib2_localnet that caused it to fail without ssl - skip test_thread in qemu_linux_user mode pyth_tk pyth_tkl python-tkinter h01-ch3a 1769525676
! " # $ $ & ' ( ( * + + - . . 0 1 1 3 4 4 6 7 7 9 : : < = = ? @ @ B C D D F G G I J J L M M O P P R S S U V V X Y Y [ \ \ ^ _ _ a b b d e e g h h j k k m n n 2.7.18-150000.99.1 2.7.18-150000.99.1 2.7.18 _tkinter.so lib-tk Canvas.py Canvas.pyc Canvas.pyo Dialog.py Dialog.pyc Dialog.pyo FileDialog.py FileDialog.pyc FileDialog.pyo FixTk.py FixTk.pyc FixTk.pyo ScrolledText.py ScrolledText.pyc ScrolledText.pyo SimpleDialog.py SimpleDialog.pyc SimpleDialog.pyo Tix.py Tix.pyc Tix.pyo Tkconstants.py Tkconstants.pyc Tkconstants.pyo Tkdnd.py Tkdnd.pyc Tkdnd.pyo Tkinter.py Tkinter.pyc Tkinter.pyo test README runtktests.py runtktests.pyc runtktests.pyo test_tkinter __init__.py __init__.pyc __init__.pyo test_font.py test_font.pyc test_font.pyo test_geometry_managers.py test_geometry_managers.pyc test_geometry_managers.pyo test_images.py test_images.pyc test_images.pyo test_loadtk.py test_loadtk.pyc test_loadtk.pyo test_misc.py test_misc.pyc test_misc.pyo test_text.py test_text.pyc test_text.pyo test_variables.py test_variables.pyc test_variables.pyo test_widgets.py test_widgets.pyc test_widgets.pyo test_ttk __init__.py __init__.pyc __init__.pyo support.py support.pyc support.pyo test_extensions.py test_extensions.pyc test_extensions.pyo test_functions.py test_functions.pyc test_functions.pyo test_style.py test_style.pyc test_style.pyo test_widgets.py test_widgets.pyc test_widgets.pyo widget_tests.py widget_tests.pyc widget_tests.pyo tkColorChooser.py tkColorChooser.pyc tkColorChooser.pyo tkCommonDialog.py tkCommonDialog.pyc tkCommonDialog.pyo tkFileDialog.py tkFileDialog.pyc tkFileDialog.pyo tkFont.py tkFont.pyc tkFont.pyo tkMessageBox.py tkMessageBox.pyc tkMessageBox.pyo tkSimpleDialog.py tkSimpleDialog.pyc tkSimpleDialog.pyo ttk.py ttk.pyc ttk.pyo turtle.py turtle.pyc turtle.pyo /usr/lib64/python2.7/lib-dynload/ /usr/lib64/python2.7/ /usr/lib64/python2.7/lib-tk/ /usr/lib64/python2.7/lib-tk/test/ /usr/lib64/python2.7/lib-tk/test/test_tkinter/ /usr/lib64/python2.7/lib-tk/test/test_ttk/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:42443/SUSE_SLE-15_Update/254ee4c69e35b21ca6431b0d84b9ef95-python.SUSE_SLE-15_Update drpm xz 5 x86_64-suse-linux ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=09fd97009e359bd6acf6611a7b13934ff8ec5d71, stripped directory Python script, ASCII text executable python 2.7 byte-compiled ASCII text empty Python script, UTF-8 Unicode text executable
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R |zb9=w utf-8 867ec6139f61493e9224128aac6ec1d69fc53720333bdf964c23593d46cb0a85 ? 7zXZ
! t/s;] "k%a) \/sɝoe c56 ^hDьFu^ev{;>j t`2QǑQ]2jlY#Zyp(,yIbn؞dXX1pJ0z4IMlpwgmYBLd窧PbZ`ݎa4AWGD,[9q b.],q|/X \^'
\Xkח&tPK1Ya>aq(=~TkݯbC_ 'vd-tz{qH{M'VMO䢪j Xe$g7 T[9LP;cS^f :!̶ "PQ1 `1 ՟Q J~ L#)xf-Tk_n-J]7Lw "~ @wQ]Pk挻ҙs!m7/g9ciX J쉥 @ סy lэ?П :3`~MIɹY+ɖ*yI#$bEG1t~9b]) zj) x Q%eɡcrGX ٹ#G7\Xz/(A pCL均!9!2$0?rl $i>>%Poe|
Hj9 tϮ wUvߖ˭K]MnO,7iCd=jP^duѤ .e6#8
jZcN"h 9
N9 ީUD?xyOHca-GM~+1V$`>ZuS_KWf"}3Z[.G?3)-6㑕Q|UcҶR"k xģgļ2lx)[e cqI No 2Zf` aao?HyRUcMUe@AG]Čg}&o o %n¤ ͢⽩?=u_d%~cs zC`v,W6I/=upVN{ݝ+X;Q@r8zl5\?Q4W
o -Cw*O}F+ةVpɜs/Վ++#6d9 Axyk&yΌ @HC+ؾg95^Lvq`#?besq{2[Jl =֍Yt#-:Z0G݆ ܪxv9'M՛9d +-L6
;~IkmuDņSD nK
6)pw_h7;cB2_ ݻ(; e-0,ahXD$PŰҠ[~BGFǑ
I DZN!ynY!lM(ۺ+{$u4˃mǑhoH;5@~@YP ݖösHQ; `M26JU>~Po%d ǯO3 eTˆ[ժVxZu `|5<։*
+xg
>-*:
}94Q$Q!=-![@qa7M-L<<GȦ^E'h.tV[RGrt!q^Q;N=S~;|4Zd+fDU]'-8úVͧL 5$0ݖMJ^#{=H?aM[);g;" OO1$VK#Ĭ}DU#li @,姼tkv}G' ZSP26XSm:Ut2Qg2r*2RH3;|6$QCE+1^Aѽv~ O^ 8$6;8WTy/ DEb?JCkJ|GF$' wH{jc, TykKe7ZSSＱ"nt ` ˔eӈgyJd Jr&1mdP" YT}Щ1~yڒ *T<=m~\NR vhQȔ]R+g7zMpDr3@jVjV[dLmMjU N|Rkbo0_5pkIU/98DX}l"7uaH$~iL"Z8 8V48
<^c)gxZ0N^7V<
01ۖ,jmyBfi*N'/}ؕ K
A2OA$%tKoEh՚7dSG҅W=] } sup[ez`+%, fr)N j=Gy4fΙ=(Mz e $V*WΥm#~gH[wE'M6Rb>4 uI|B4 \9g1o_;6-* 0/kx$y*Yz Z#wY?
53Y@?JJ}iUv~]B/<"I? R
eĄ16X@_-1
;x LJ 4ӔyGt'
l)k&orm3ET)?F4wLB^6MmbYE e<6Qm Jژ$n` '
[u r9> 5[`CNBazA㨺j<}F& &b[n3; )Ξ}n"{O; ,n<̂j.`+y 3Z1T#C3*ƍѾOEɼ>e L/yC҂Jscݦ ݧQCG ԡ4ZۭLMaS
/ps@M1izT.X< y72..)M i*͒t.|z a&)N5`gnѺB^*Ķ'1H*T߅,2Ňk 8/ IܩH -Q ߑ! Fm|q;g*W sn=d ){:)'
PڡƩt-Z^kHQ2_X^{_Wۆ7XN?-J[`
BQ;#Ev
58u]QGv̯cY$bMB 0q}cNdL2hϸj$C*JQ+?1 瘟hʎ21J&S% fw!Et\.@Tۏ<f)Rj ^ۤ1{q= 92hyƈI:姅X E-k0^+\! ŰbR,'k{ >[a^2ea7&[W$u\='߉҄PɇE2&pͽ?ɦECZB] 7l/{@j|Rfs6I1 5^,)A+D8"(u7qPkPXAo}'gR&c(d˽@ Zs3Ǵ{ZRoe.7wpſO'Ks=c uZE] cN!of x4đD:Fcx˽OaсUnճ^aiSQ}x2z߽~I fZ'劄K)#Z (VWH~چ3'ٯZ
pRv! 9[v|kHչLvp"{˒x۫)
k'Bu㳘H#ۆrwҤ@e
yȌ62O{i3Owt(ooq6 䆶#47!kh O{pf.}Da8T_ 02]9P /xRmks 9t~^I7 g1Ϭ4- " )cJ㵬' x 'Ͱ4%< Ó :
+/+W&,Kz'lJq-.gzJr%4E ڷڤSEk [t_> x^7\:!6E%B[ 8BT v?ESW>QQ9:쓄{Ѩ?Bm 0GZ4z EiٵgEۢ]r.vU (9E oCt!E=
@o(G[U;"TRڸ(AR;8[M˕P2mfscwCԾJg\%6'ڠh5<4bTZrѐ(oS:o`jdkvqPɉ93LEue {\1ہoTiw>d`qAH¢ix+;j}1jȦn N%i疁9?
zpy%nß_c s}B($O@ч!9hQh2O?Y.ާ9qȖA HP2 cAaU!/Ude~Gj& cEqG-
.clp-Mc<=!<X{D[eز\q"J&sd 'bS+;o8S,K=2"|\Qg)^ͤ o/"e M+I-[lpNU6\ awCL,r_+cUuA>
b{qTI
os-kߕ?Bo7pPKx֒a`0 ~.='G6-X >e2
<01sZw@ aCഥ;QR1wxt$ʰϋål
o09% 9YS0ӎs3qAk#4|$lY\j- L%D`{n`x~>Ix]Qh`%JJ{58 =&>WV$LG[sq#?rv岮MH}v,Qڢ 0Q"M `B%t9w&$qExoOaAtEQXT$X uD.-Hͷ@@~ozǾ
T}-
>
J +\&n\j j
(ӆ){AFZ_|74StۓNW~iy.w'{NHT
uM$
v l@ܼ$|IwFPKZʒ ]2s7LWV9 7 Y%u[KjYwݱN" ZxMUg)2'8]
K:!Da|L IZ
@&J Kn/ )mը[fZi
"|| K6b>h:xї:YK %.(++':]X,]9~, 8L߱i
u sq)b;r*)
4vq7 kCnuvzCJI7G[89:kr}6V`ؑٵ뵍 <| =<B]Nլ4_v1}ר0mXp~E<|fHͼʜE Giy3P#\p6\ Ղ -Jn~J7N7lTuxk/rcK}f 0bsZYmu\+a,
0œi.G@|W%KG,
cF6Xdv m]ڈPA,Щ
Pa EXN`B}&QT4[AiHXСF
pktZH)5dvA9(C h7c~$$ENk5 nIym
G ڏV7!e!A~Zpi `;$g]ԲНy߁ x@M ]?>jKh 4|W:Lug70Hl47@) ; H>1WpfTi ~I9y(l-qN4CB=AzdGGZqsS,!
,
^Xn^-,4c%kma0Fy$@9n(N "dx:9 (TT)3,% *[QZAf$5=N htqeo|13! ʕP^: 2eW}!e(Jd94Lꘅ[5 =dKOՄ4u: D!^W@r\J}s".x"GXMYJiOBpLvVNDÜM~MIo_ȔlY+CpG ŒJ0ԩVWyhUlԋQu+=yHM\2CقIAÔT$w r2*pJ\!ٸj8>\41eg ~_U=^iӆo![Et~Af00m*B^x/|YL|{ \cJ響QNYr
FgJDZZ '{IK].nIͅ+D *Ԟd-$ QKf*3AC Dp[P
[JpH2 +]<ҡyUY6vUp )h3 4$#*''[USd( on[1]7P3 6dv-aUfg
mg<%>s, ,"f_I}0q//d lZJIhbP I :Ĕt7{A/[Ab#$!͚pqZ ~x/EHSahǴy`K5a qQR&` n&N +ɻ3ən@c< !5
\{8Kq
̥ĥ0ibr\]γb/SBПlcuJ5RRdwR6(\,N'Q[keRǑ>nAސ@A `zĴˤQD4l;GH tTlTS[(uwy߿lT[Nq}9H !Q uD>}07ʷ Δom۸
: ӿj.Yv\qƟ jLT?5L@(pm$Oc@pHSh9]$H `N6OLGz|o,e[[Tk칛mUed gqe-
BnO^]w![ņ@[iEDs5~U&BeXٷ96KBga y߲UڤJzxݨ!{,dhbs 3ѫM)!^jǓGlXyя Ѩ|[h9^Utpa wudhulgqڭr|pUká a۸_XDވOD!=rY 3yl$=h5к&Mz2xcH"A-|
U_DuX [ FIf>DAƠƏ&=2ƕ#3k8[IŖL8Kx ,c*wux bJ8v加ύvQ5E5Jg N۸r ڧ=%@8?lN擥U_7j̦),YW t©Ĝҋ~;rTS)TRWW 08S|aա|RSh,-1v,i 0\rUzXUzG=Jxc
$u: HcwQFbIcHJC˧=1{S|X@>=}iJ}>gwՈ s0:QiaWKQšoD} x cSEvFJi~ \ghڷ mBpaznK춣G;o +>|B!3+4b92u-
P!IAYQ|6 (Iig;ϵ7f滩1>(CQ=Bza.ՇP!S t"^ ~]Re4r4vD742!l7!M8y N \H
'pPE()*'>_>r@7Jn\tz1vO %xϾGݚo7r
iZӷv
(28kju"d=1վ\L݄tТjfE;Q6[pF3eYH0 F]q=+NFI~-ƺET4-Ƹ'/~[}K:rKU5A 4ě{@rge++ПtPh@T^Ѐ
lN 3(.>ԝ;q} p涖k
cS;dS{A~]6|AD ol?_b60qD3F4r M #x+ƅ e .^erU IfX @ h)SB~)+W?&mWlv*dx[ Oe:5k'hT ɜXZҠ"Uwv(c]Z]
ӆM"iIXC̗GFL%^n !!:R*Ĺ.bya5 KW(,p.e9bykt+Jd`]KfB!|"Jm8LWAsx~%Rn .6(*g+gaD
TI3tLHqz@HX,|E73 $~$
: 4*e`( RxN>۟casf o>jڕ6<-NvQ|X=Y4K,e4fhFg k= 4y}\fɉh!U&XUtuڍ2E Kϒu KېIބ^ꋎmˑ/@enlDE:->A<ҷs->1Pّ`aE8?/\07 T=,fchO͢iދ`H?'Q_f?" &ūѤ}$GVTYTLU uKr8TE-'_#ժf
/D qVڴpf,@D@jc>)\ %&
~'I*% \= }`!JTu 3L7!zDoBXD ѰSJ4p5NVk;[Θ;],B6Ȕ.x5q=[,՝ѩܖmIRWP1Ұ#TEmJ#'9.ˀW#F`Jd}P۔|8{61 ?m< (rJK @c_M
,1xG>g_v5_wN Ims( SDs !'DLY mh;8/0eY/AY[ɻҞ!AԈ)/kJ;U5vm5x(DԖ/f6
/ (\]H{whΖW ?82TŖ|Oo-nZb`1wUj")JDQg ս'9µ6N_&u[t5U3xɸj~Cqy5Q^QKQwMv%xE0'zg&RoB;;G2i8#b,_ZyD=U'vN-/Sk ^XjFqT7049s}nǹ8B"{dO[ M$26*g
?HAN:AOsÍDz/M):5o2 gy 0\ @\CtBX$p!YyD탸vګɘШ:DMd1vLeɐD^"k¹mbڥ
BiUDá,:[\ŬALr[/=-g|ݛ CZo&fތ7[GbNѡSIJ &()kSYJ1_0QtXcrh7W
tu`;OXlM F<ɚeJ 85S+ݍ4Hw$7+we -ĝʞ]sm"p?&60EĮz:Z O6/pa1 p;uy5f=XX}ϚNjL;g@{1+^z5W:oSwYl
H>$s
)hR)WD2#WZS~2M |DeRYpR
#;Ոe±ro\
9u1wuKTXGL >JVh9饅L 2`xbv[UYCI >/' !
OR t y6]nj_-_Adi弗x+p 5=+$܁6eQdPWMC ŀ&\2Zjkݵ wAML@ Bc2U l/zLMPP, kR V?!ݷ4i8W7iy㜖"K ΰeeFs31K Ɣlv&Nr Us̗i(7& dӫ[ W6] lL[ awP(}>$[5!r
w+ R$gIPD9f'5`kZ9f%'ch 013!+8]9 A͉|b^fpcU% @ n n'~ׂ
:ͭᠸ8і$eDRJ9>+T$&+mItz JٜkluAP EO1t+S }S!|}{k䁹.?|Sۻ>Qp2\V`}So;ۊ"nJZ M;\z@N"=
սVI>uDG0c]`g /|8o&GDǟj#8dZ6!bT/X_F%vf4BO}7jNu*jq Qj_Z"X-Iίd+Z< hg =C03kLPu [d
£'6a?܅gj°Q7\+W]uwڻ:5h[o[ .+p4%Ů'GY9)&NJ)}- 2niΤغiKY9~Z =sޓ3Siv;Yän[iρ4Я7"$ \2^BHܩZ;t. F
zÔQ* "0v"%8+EnjwdI<ԙBBBayA;6L/ 7! z+C h=Pd*VWHu4D 6M8ͧN.X8I
f-|wWiyF$1>~b':eNJl7acGF0 :\!@!x cMRw# {
&? ,|@ OoL咋Ws
=+)F?{3CᜃYNjg vIIiP=)=G"`{o:wyT)QC,O#y, AP
c&h1|xwm7 ^ى<. Z r_d;[|8#l1{zHT]&+h MƆv$
ݺ,J8--6n
t/I#L=hO6( W* x ${&i]#Xہ^q=p{FpF oZMH|
Z
{M&HiB x
YZ