snapd-selinux-2.68.3-0.el10_1$>-GCApM٤9>C!?d  9 ".PV]T        8  >  D \ z       ( 28 <+9 +:>+=">*@2G<HTIlXtYx\׈]נ^bؓdReWf\l_txuڐvڨھS\`܅܋Csnapd-selinux2.68.30.el10_1SELinux module for snapdThis package provides the SELinux policy module to ensure snapd runs properly under an environment with SELinux enabled.g9buildhw-x86-06.iad2.fedoraproject.orgFedora ProjectFedora ProjectGPL-2.0-or-laterFedora ProjectUnspecifiedhttps://github.com/snapcore/snapdlinuxnoarch if selinuxenabled; then if [ -e /etc/selinux/config ]; then . /etc/selinux/config fi _policytype= if [ -z "${_policytype}" ]; then _policytype="targeted" fi if [ "${SELINUXTYPE}" = "${_policytype}" ]; then [ -f /var/lib/rpm-state/file_contexts.pre ] || cp -f /etc/selinux/${SELINUXTYPE}/contexts/files/file_contexts /var/lib/rpm-state/file_contexts.pre fi fi if [ -e /etc/selinux/config ]; then . /etc/selinux/config fi _policytype= if [ -z "${_policytype}" ]; then _policytype="targeted" fi if [ "${SELINUXTYPE}" = "${_policytype}" ]; then rm -rf /var/lib/selinux/${_policytype}/active/modules/400/extra_varrun || : semodule -n -s ${_policytype} -X 200 -i /usr/share/selinux/packages/snappy.pp.bz2 || : selinuxenabled && load_policy || : /usr/libexec/selinux/varrun-convert.sh ${_policytype} || : fi if [ -e /etc/selinux/config ]; then . /etc/selinux/config fi _policytype= if [ -z "${_policytype}" ]; then _policytype="targeted" fi if selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then if [ -f /var/lib/rpm-state/file_contexts.pre ]; then fixfiles -C /var/lib/rpm-state/file_contexts.pre restore &> /dev/null rm -f /var/lib/rpm-state/file_contexts.pre fi fi if [ -e /etc/selinux/config ]; then . /etc/selinux/config fi _policytype= if [ -z "${_policytype}" ]; then _policytype="targeted" fi if [ $1 -eq 0 ]; then if [ "${SELINUXTYPE}" = "${_policytype}" ]; then rm -rf /var/lib/selinux/${_policytype}/active/modules/400/extra_varrun || : semodule -n -X 200 -s ${_policytype} -r snappy &> /dev/null || : selinuxenabled && load_policy || : /usr/libexec/selinux/varrun-convert.sh ${_policytype} || : fi fi if [ $1 -eq 0 ]; then if [ -e /etc/selinux/config ]; then . /etc/selinux/config fi _policytype= if [ -z "${_policytype}" ]; then _policytype="targeted" fi if selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then if [ -f /var/lib/rpm-state/file_contexts.pre ]; then fixfiles -C /var/lib/rpm-state/file_contexts.pre restore &> /dev/null rm -f /var/lib/rpm-state/file_contexts.pre fi fi fiFJA큤A큤g+g+g+g+g+g+a8b72e15a96a1cddc283bc610d96286baae218e2ad130d6ea3c877e49bdfb27d8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643c5bcc588c9dedd301c0bd26aa78d2d0d32c0b5ac5a67e4eac73bb8d5fb51113a612eff9884b5b4089fcba863893c91491af3af73e4920bc47c959d50903f8a68rootrootrootrootrootrootrootrootrootrootrootrootsnapd-2.68.3-0.el10_1.src.rpmsnapd-selinux      /bin/sh/bin/sh/bin/sh/bin/shlibselinux-utilspolicycoreutilspolicycoreutils-python-utilsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsZstd)selinux-policyselinux-policy-base3.0.4-14.6.0-14.0-15.4.18-140.13.2540.13.254.19.1.1g@gSg_@ggg@g@gNgNgIg=@g@g @ffff@fyf@ffff(@e!@eZeN@eȶe@ee@e`@e)1@eG@dd@dd d@dqd^*@dRLd>@d"Ernest Lotter Ernest Lotter Ernest Lotter Ernest Lotter Zygmunt Krynicki Fedora Release Engineering - 2.66.1-3Ernest Lotter Orion Poplawski Zygmunt Krynicki Zygmunt Krynicki Zygmunt Krynicki Zygmunt Krynicki Ernest Lotter Ernest Lotter Ernest Lotter Ernest Lotter Ernest Lotter Ernest Lotter Miroslav Suchý - 2.63-3Miroslav Suchý - 2.63-2Ernest Lotter Fedora Release Engineering - 2.63-1Ernest Lotter Ernest Lotter Ernest Lotter Ernest Lotter Maxwell G - 2.61.1-2Fedora Release Engineering - 2.61.1-1Zygmunt Krynicki - 2.61.1-1Zygmunt Krynicki - 2.58.3-3Ernest Lotter Philip Meulengracht Michael Vogt Michael Vogt Michael Vogt Fedora Release Engineering - 2.58.3-2Michael Vogt Michael Vogt Michael Vogt Michael Vogt Michael Vogt Michael Vogt Michael Vogt - New upstream release 2.68.3 - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to old keyring path - Fix Plucky snapd deb build issue related to /var/lib/snapd/void permissions - Fix snapd deb build complaint about ifneq with extra bracket- New upstream release 2.68.2 - FDE: use boot mode for FDE hooks - FDE: add snap-bootstrap compatibility check to prevent image creation with incompatible snapd and kernel snap - FDE: add argon2 out-of-process KDF support - FDE: have separate mutex for the sections writing a fresh modeenv - FDE: LP: #2099709 update secboot to e07f4ae48e98 - Confdb: support pruning ephemeral data and process alternative types in order - core-initrd: look at env to mount directly to /sysroot - core-initrd: prepare for Plucky build and split out 24.10 (Oracular) - Fix missing primed packages in snapd snap manifest - Interfaces: posix-mq | fix incorrect clobbering of global variable and make interface more precise - Interfaces: opengl | add more kernel fusion driver files- New upstream release 2.68.1 - Fix snap-confine type specifier type mismatch on armhf- New upstream release 2.68 - FDE: add support for new and more extensible key format that is unified between TPM and FDE hook - FDE: add support for adding passphrases during installation - FDE: update secboot to 30317622bbbc - Snap components: make kernel components available on firstboot after either initramfs or ephemeral rootfs style install - Snap components: mount drivers tree from initramfs so kernel modules are available in early boot stages - Snap components: support remodeling to models that contain components - Snap components: support offline remodeling to models that contain components - Snap components: support creating new recovery systems with components - Snap components: support downloading components with 'snap download' command - Snap components: support sideloading asserted components - AppArmor Prompting(experimental): improve version checks and handling of listener notification protocol for communication with kernel AppArmor - AppArmor Prompting(experimental): make prompt replies idempotent, and have at most one rule for any given path pattern, with potentially mixed outcomes and lifespans - AppArmor Prompting(experimental): timeout unresolved prompts after a period of client inactivity - AppArmor Prompting(experimental): return an error if a patch request to the API would result in a rule without any permissions - AppArmor Prompting(experimental): warn if there is no prompting client present but prompting is enabled, or if a prompting-related error occurs during snapd startup - AppArmor Prompting(experimental): do not log error when converting empty permissions to AppArmor permissions - Confdb(experimental): rename registries to confdbs (including API /v2/registries => /v2/confdb) - Confdb(experimental): support marking confdb schemas as ephemeral - Confdb(experimental): add confdb-control assertion and feature flag - Refresh App Awareness(experimental): LP: #2089195 prevent possibility of incorrect notification that snap will quit and update - Confidential VMs: snap-bootstrap support for loading partition information from a manifest file for cloudimg-rootfs mode - Confidential VMs: snap-bootstrap support for setting up cloudimg- rootfs as an overlayfs with integrity protection - dm-verity for essential snaps: add support for snap-integrity assertion - Interfaces: modify AppArmor template to allow owner read on @{PROC}/@{pid}/fdinfo/* - Interfaces: LP: #2072987 modify AppArmor template to allow using setpriv to run daemon as non-root user - Interfaces: add configfiles backend that ensures the state of configuration files in the filesystem - Interfaces: add ldconfig backend that exposes libraries coming from snaps to either the rootfs or to other snaps - Interfaces: LP: #1712808 LP: 1865503 disable udev backend when inside a container - Interfaces: add auditd-support interface that grants audit_control capability and required paths for auditd to function - Interfaces: add checkbox-support interface that allows unrestricted access to all devices - Interfaces: fwupd | allow access to dell bios recovery - Interfaces: fwupd | allow access to shim and fallback shim - Interfaces: mount-control | add mount option validator to detect mount option conflicts early - Interfaces: cpu-control | add read access to /sys/kernel/irq/ - Interfaces: locale-control | changed to be implicit on Ubuntu Core Desktop - Interfaces: microstack-support | support for utilizing of AMD SEV capabilities - Interfaces: u2f | added missing OneSpan device product IDs - Interfaces: auditd-support | grant seccomp setpriority - Interfaces: opengl interface | enable parsing of nvidia driver information files - Allow mksquashfs 'xattrs' when packing snap types os, core, base and snapd as part of work to support non-root snap-confine - Upstream/downstream packaging changes and build updates - Improve error logs for malformed desktop files to also show which desktop file is at fault - Provide more precise error message when overriding channels with grade during seed creation - Expose 'snap prepare-image' validation parameter - Add snap-seccomp 'dump' command that dumps the filter rules from a compiled profile - Add fallback release info location /etc/initrd-release - Added core-initrd to snapd repo and fixed issues with ubuntu-core- initramfs deb builds - Remove stale robust-mount-namespace-updates experimental feature flag - Remove snapd-snap experimental feature (rejected) and it's feature flag - Changed snap-bootstrap to mount base directly on /sysroot - Mount ubuntu-seed mounted as no-{suid,exec,dev} - Mapping volumes to disks: add support for volume-assignments in gadget - Fix silently broken binaries produced by distro patchelf 0.14.3 by using locally build patchelf 0.18 - Fix mismatch between listed refresh candidates and actual refresh due to outdated validation sets - Fix 'snap get' to produce compact listing for tty - Fix missing store-url by keeping it as part of auxiliary store info - Fix snap-confine attempting to retrieve device cgroup setup inside container where it is not available - Fix 'snap set' and 'snap get' panic on empty strings with early error checking - Fix logger debug entries to show correct caller and file information - Fix issue preventing hybrid systems from being seeded on first boot - LP: #1966203 remove auto-import udev rules not required by deb package to avoid unwanted syslog errors - LP: #1886414 fix progress reporting when stdout is on a tty, but stdin is not- The changelog date and author have been modified to maintain linearity. - Drop 0001-data-selinux-remove-timedatex.patch - applied upstream. - New upstream release 2.67 - AppArmor prompting (experimental): allow overlapping rules - Registry view (experimental): Changes to registry data (from both users and snaps) can be validated and saved by custodian snaps - Registry view (experimental): Support 'snapctl get --pristine' to read the registry data excluding staged transaction changes - Registry view (experimental): Put registry commands behind experimental feature flag - Components: Make modules shipped/created by kernel-modules components available right after reboot - Components: Add tab completion for local component files - Components: Allow installing snaps and components from local files jointly on the CLI - Components: Allow 'snapctl model' command for gadget and kernel snaps - Components: Add 'snap components' command - Components: Bug fixes - eMMC gadget updates (WIP): add syntax support in gadget.yaml for eMMC schema - Support for ephemeral recovery mode on hybrid systems - Support for dm-verity options in snap-bootstrap - Support for overlayfs options and allow empty what argument for tmpfs - Enable ubuntu-image to determine the size of the disk image to create - Expose 'snap debug' commands 'validate-seed' and 'seeding' - Add debug API option to use dedicated snap socket /run/snapd- snap.socket - Hide experimental features that are no longer required (accepted/rejected) - Mount ubuntu-save partition with no{exec,dev,suid} at install, run and factory-reset - Improve memory controller support with cgroup v2 - Support ssh socket activation configurations (used by ubuntu 22.10+) - Fix generation of AppArmor profile with incorrect revision during multi snap refresh - Fix refresh app awareness related deadlock edge case - Fix not caching delta updated snap download - Fix passing non root uid, guid to initial tmpfs mount - Fix ignoring snaps in try mode when amending - Fix reloading of service activation units to avoid systemd errors - Fix snapd snap FIPS build on Launchpad to use Advantage Pro FIPS updates PPA - Make killing of snap apps best effort to avoid possibility of malicious failure loop - Alleviate impact of auto-refresh failure loop with progressive delay - Dropped timedatex in selinux-policy to avoid runtime issue - Fix missing syscalls in seccomp profile - Modify AppArmor template to allow using SNAP_REEXEC on arch systems - Modify AppArmor template to allow using vim.tiny (available in base snaps) - Modify AppArmor template to add read-access to debian_version - Modify AppArmor template to allow owner to read @{PROC}/@{pid}/sessionid - {common,personal,system}-files interface: prohibit trailing @ in filepaths - {desktop,shutdown,system-observe,upower-observe} interface: improve for Ubuntu Core Desktop - custom-device interface: allow @ in custom-device filepaths - desktop interface: improve launch entry and systray integration with session - desktop-legacy interface: allow DBus access to com.canonical.dbusmenu - fwupd interface: allow access to nvmem for thunderbolt plugin - mpris interface: add plasmashell as label - mount-control interface: add support for nfs mounts - network-{control,manager} interface: add missing dbus link rules - network-manager-observe interface: add getDevices methods - opengl interface: add Kernel Fusion Driver access to opengl - screen-inhibit-control interface: improve screen inhibit control for use on core - udisks2 interface: allow ping of the UDisks2 service - u2f-devices interface: add Nitrokey Passkey- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild- New upstream release 2.67.1 - Fix apparmor permissions to allow snaps access to kernel modules and firmware on UC24, which also fixes the kernel-modules-control interface on UC24 - AppArmor prompting (experimental): disallow /./ and /../ in path patterns - Fix 'snap run' getent based user lookup in case of bad PATH - Fix snapd using the incorrect AppArmor version during undo of an refresh for regenerating snap profiles - Add new syscalls to base templates - hardware-observe interface: allow riscv_hwprobe syscall - mount-observe interface: allow listmount and statmount syscalls- Drop RestartMode from snapd.service on EL8 (rhbz#2315759)- Constrain dependency on xdelta to EPEL-9- Re-cherry pick fix for SELinux timedatex problem from upstream as it was not released in 2.66.1, sorry.- Drop only patch, applied upstream.- Cherry pick fix for SELinux timedatex problem from upstream- New upstream release 2.66.1 - AppArmor prompting (experimental): Fix kernel prompting support check - Allow kernel snaps to have content slots - Fix ignoring snaps in try mode when amending- New upstream release 2.66 - AppArmor prompting (experimental): expand kernel support checks - AppArmor prompting (experimental): consolidate error messages and add error kinds - AppArmor prompting (experimental): grant /v2/snaps/{name} via snap-interfaces-requests-control - AppArmor prompting (experimental): add checks for duplicate pattern variants - Registry views (experimental): add handlers that commit (and cleanup) registry transactions - Registry views (experimental): add a snapctl fail command for rejecting registry transactions - Registry views (experimental): allow custodian snaps to implement registry hooks that modify and save registry data - Registry views (experimental): run view-changed hooks only for snaps plugging views affected by modified paths - Registry views (experimental): make registry transactions serialisable - Snap components: handle refreshing components to revisions that have been on the system before - Snap components: enable creating Ubuntu Core images that contain components - Snap components: handle refreshing components independently of snaps - Snap components: handle removing components when refreshing a snap that no longer defines them - Snap components: extend snapd Ubuntu Core installation API to allow for picking optional snaps and components to install - Snap components: extend kernel.yaml with "dynamic-modules", allowing kernel to define a location for kmods from component hooks - Snap components: renamed component type "test" to "standard" - Desktop IDs: support installing desktop files with custom names based on desktop-file-ids desktop interface plug attr - Auto-install snapd on classic systems as prerequisite for any non- essential snap install - Support loading AppArmor profiles on WSL2 with non-default kernel and securityfs mounted - Debian/Fedora packaging updates - Add snap debug command for investigating execution aspects of the snap toolchain - Improve snap pack error for easier parsing - Add support for user services when refreshing snaps - Add snap remove --terminate flag for terminating running snap processes - Support building FIPS complaint snapd deb and snap - Fix to not use nss when looking up for users/groups from snapd snap - Fix ordering in which layout changes are saved - Patch snapd snap dynamic linker to ignore LD_LIBRARY_PATH and related variables - Fix libexec dir for openSUSE Slowroll - Fix handling of the shared snap directory for parallel installs - Allow writing to /run/systemd/journal/dev-log by default - Avoid state lock during snap removal to avoid delaying other snapd operations - Add nomad-support interface to enable running Hashicorp Nomad - Add intel-qat interface - u2f-devices interface: add u2f trustkey t120 product id and fx series fido u2f devices - desktop interface: improve integration with xdg-desktop-portal - desktop interface: add desktop-file-ids plug attr to desktop interface - unity7 interface: support desktop-file-ids in desktop files rule generation - desktop-legacy interface: support desktop-file-ids in desktop files rule generation - desktop-legacy interface: grant access to gcin socket location - login-session-observe interface: allow introspection - custom-device interface: allow to explicitly identify matching device in udev tagging block - system-packages-doc interface: allow reading /usr/share/javascript - modem-manager interface: add new format of WWAN ports - pcscd interface: allow pcscd to read opensc.conf - cpu-control interface: add IRQ affinity control to cpu_control - opengl interface: add support for cuda workloads on Tegra iGPU in opengl interface- New upstream release 2.65.3 - Fix missing aux info from store on snap setup- New upstream release 2.65.2 - Bump squashfuse from version 0.5.0 to 0.5.2 (used in snapd deb only)- New upstream release 2.65.1 - Support building snapd using base Core22 (Snapcraft 8.x) - FIPS: support building FIPS complaint snapd variant that switches to FIPS mode when the system boots with FIPS enabled - AppArmor: update to latest 4.0.2 release - AppArmor: enable using ABI 4.0 from host parser - AppArmor: fix parser lookup - AppArmor: support AppArmor snippet priorities - AppArmor: allow reading cgroup memory.max file - AppArmor: allow using snap-exec coming from the snapd snap when starting a confined process with jailmode - AppArmor prompting (experimental): add checks for prompting support, include prompting status in system key, and restart snapd if prompting flag changes - AppArmor prompting (experimental): include prompt prefix in AppArmor rules if prompting is supported and enabled - AppArmor prompting (experimental): add common types, constraints, and mappings from AppArmor permissions to abstract permissions - AppArmor prompting (experimental): add path pattern parsing and matching - AppArmor prompting (experimental): add path pattern precedence based on specificity - AppArmor prompting (experimental): add packages to manage outstanding request prompts and rules - AppArmor prompting (experimental): add prompting API and notice types, which require snap-interfaces-requests-control interface - AppArmor prompting (experimental): feature flag can only be enabled if prompting is supported, handler service connected, and the service can be started - Registry views (experimental): rename from aspects to registries - Registry views (experimental): support reading registry views and setting/unsetting registry data using snapctl - Registry views (experimental): fetch and refresh registry assertions as needed - Registry views (experimental): restrict view paths from using a number as first character and view names to storage path style patterns - Snap components: support installing snaps and components from files at the same time (no REST API/CLI) - Snap components: support downloading components related assertions from the store - Snap components: support installing components from the store - Snap components: support removing components individually and during snap removal - Snap components: support kernel modules as components - Snap components: support for component install, pre-refresh and post-refresh hooks - Snap components: initial support for building systems that contain components - Refresh app awareness (experimental): add data field for /v2/changes REST API to allow associating each task with affected snaps - Refresh app awareness (experimental): use the app name from .desktop file in notifications - Refresh app awareness (experimental): give snap-refresh-observe interface access to /v2/snaps/{name} endpoint - Improve snap-confine compatibility with nvidia drivers - Allow re-exec when SNAP_REEXEC is set for unlisted distros to simplify testing - Allow mixing revision and channel on snap install - Generate GNU build ID for Go binaries - Add missing etelpmoc.sh for shell completion - Do not attempt to run snapd on classic when re-exec is disabled - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse - Add snap debug API command to enable running raw queries - Enable snap-confine snap mount directory detection - Replace global seccomp filter with deny rules in standard seccomp template - Remove support for Ubuntu Core Launcher (superseded by snap- confine) - Support creating pending serial bound users after serial assertion becomes available - Support disabling cloud-init using kernel command-line - In hybrid systems, apps can refresh without waiting for restarts required by essential snaps - Ship snap-debug-info.sh script used for system diagnostics - Improve error messages when attempting to run non-existent snap - Switch to -u UID:GID for strace-static - Support enabling snapd logging with snap set system debug.snapd.{log,log-level} - Add options system.coredump.enable and system.coredump.maxuse to support using systemd-coredump on Ubuntu Core - Provide documentation URL for 'snap interface ' - Fix snapd riscv64 build - Fix restarting activated services instead of their activator units (i.e. sockets, timers) - Fix potential unexpected auto-refresh of snap on managed schedule - Fix potential segfault by guarding against kernel command-line changes on classic system - Fix proxy entries in /etc/environment with missing newline that caused later manual entries to not be usable - Fix offline remodelling by ignoring prerequisites that will otherwise be downloaded from store - Fix devmode seccomp deny regression that caused spamming the log instead of actual denies - Fix snap lock leak during refresh - Fix not re-pinning validation sets that were already pinned when enforcing new validation sets - Fix handling of unexpected snapd runtime failure - Fix /v2/notices REST API skipping notices with duplicate timestamps - Fix comparing systemd versions that may contain pre-release suffixes - Fix udev potentially starting before snap-device-helper is made available - Fix race in snap seed metadata loading - Fix treating cloud-init exit status 2 as error - Fix to prevent sending refresh complete notification if snap snap- refresh-observe interface is connected - Fix to queue snapctl service commands if run from the default- configure hook to ensure they get up-to-date config values - Fix stop service failure when the service is not actually running anymore - Fix parsing /proc/PID/mounts with spaces - Add registry interface that provides snaps access to a particular registry view - Add snap-interfaces-requests-control interface to enable prompting client snaps - steam-support interface: remove all AppArmor and seccomp restrictions to improve user experience - opengl interface: improve compatibility with nvidia drivers - home interface: autoconnect home on Ubuntu Core Desktop - serial-port interface: support RPMsg tty - display-control interface: allow changing LVDS backlight power and brightness - power-control interface: support for battery charging thesholds, type/status and AC type/status - cpu-control interface: allow CPU C-state control - raw-usb interface: support RPi5 and Thinkpad x13s - custom-device interface: allow device file locking - lxd-support interface: allow LXD to self-manage its own cgroup - network-manager interface: support MPTCP sockets - network-control interface: allow plug/slot access to gnutls config and systemd resolved cache flushing via D-Bus - network-control interface: allow wpa_supplicant dbus api - gpio-control interface: support gpiochip* devices - polkit interface: fix "rw" mount option check - u2f-devices interface: enable additional security keys - desktop interface: enable kde theming support- New upstream release 2.65 - Support building snapd using base Core22 (Snapcraft 8.x) - FIPS: support building FIPS complaint snapd variant that switches to FIPS mode when the system boots with FIPS enabled - AppArmor: update to latest 4.0.2 release - AppArmor: enable using ABI 4.0 from host parser - AppArmor: fix parser lookup - AppArmor: support AppArmor snippet priorities - AppArmor: allow reading cgroup memory.max file - AppArmor: allow using snap-exec coming from the snapd snap when starting a confined process with jailmode - AppArmor prompting (experimental): add checks for prompting support, include prompting status in system key, and restart snapd if prompting flag changes - AppArmor prompting (experimental): include prompt prefix in AppArmor rules if prompting is supported and enabled - AppArmor prompting (experimental): add common types, constraints, and mappings from AppArmor permissions to abstract permissions - AppArmor prompting (experimental): add path pattern parsing and matching - AppArmor prompting (experimental): add path pattern precedence based on specificity - AppArmor prompting (experimental): add packages to manage outstanding request prompts and rules - AppArmor prompting (experimental): add prompting API and notice types, which require snap-interfaces-requests-control interface - AppArmor prompting (experimental): feature flag can only be enabled if prompting is supported, handler service connected, and the service can be started - Registry views (experimental): rename from aspects to registries - Registry views (experimental): support reading registry views and setting/unsetting registry data using snapctl - Registry views (experimental): fetch and refresh registry assertions as needed - Registry views (experimental): restrict view paths from using a number as first character and view names to storage path style patterns - Snap components: support installing snaps and components from files at the same time (no REST API/CLI) - Snap components: support downloading components related assertions from the store - Snap components: support installing components from the store - Snap components: support removing components individually and during snap removal - Snap components: support kernel modules as components - Snap components: support for component install, pre-refresh and post-refresh hooks - Snap components: initial support for building systems that contain components - Refresh app awareness (experimental): add data field for /v2/changes REST API to allow associating each task with affected snaps - Refresh app awareness (experimental): use the app name from .desktop file in notifications - Refresh app awareness (experimental): give snap-refresh-observe interface access to /v2/snaps/{name} endpoint - Improve snap-confine compatibility with nvidia drivers - Allow re-exec when SNAP_REEXEC is set for unlisted distros to simplify testing - Allow mixing revision and channel on snap install - Generate GNU build ID for Go binaries - Add missing etelpmoc.sh for shell completion - Do not attempt to run snapd on classic when re-exec is disabled - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse - Add snap debug API command to enable running raw queries - Enable snap-confine snap mount directory detection - Replace global seccomp filter with deny rules in standard seccomp template - Remove support for Ubuntu Core Launcher (superseded by snap- confine) - Support creating pending serial bound users after serial assertion becomes available - Support disabling cloud-init using kernel command-line - In hybrid systems, apps can refresh without waiting for restarts required by essential snaps - Ship snap-debug-info.sh script used for system diagnostics - Improve error messages when attempting to run non-existent snap - Switch to -u UID:GID for strace-static - Support enabling snapd logging with snap set system debug.snapd.{log,log-level} - Add options system.coredump.enable and system.coredump.maxuse to support using systemd-coredump on Ubuntu Core - Provide documentation URL for 'snap interface ' - Fix restarting activated services instead of their activator units (i.e. sockets, timers) - Fix potential unexpected auto-refresh of snap on managed schedule - Fix potential segfault by guarding against kernel command-line changes on classic system - Fix proxy entries in /etc/environment with missing newline that caused later manual entries to not be usable - Fix offline remodelling by ignoring prerequisites that will otherwise be downloaded from store - Fix devmode seccomp deny regression that caused spamming the log instead of actual denies - Fix snap lock leak during refresh - Fix not re-pinning validation sets that were already pinned when enforcing new validation sets - Fix handling of unexpected snapd runtime failure - Fix /v2/notices REST API skipping notices with duplicate timestamps - Fix comparing systemd versions that may contain pre-release suffixes - Fix udev potentially starting before snap-device-helper is made available - Fix race in snap seed metadata loading - Fix treating cloud-init exit status 2 as error - Fix to prevent sending refresh complete notification if snap snap- refresh-observe interface is connected - Fix to queue snapctl service commands if run from the default- configure hook to ensure they get up-to-date config values - Fix stop service failure when the service is not actually running anymore - Fix parsing /proc/PID/mounts with spaces - Add registry interface that provides snaps access to a particular registry view - Add snap-interfaces-requests-control interface to enable prompting client snaps - steam-support interface: remove all AppArmor and seccomp restrictions to improve user experience - opengl interface: improve compatibility with nvidia drivers - home interface: autoconnect home on Ubuntu Core Desktop - serial-port interface: support RPMsg tty - display-control interface: allow changing LVDS backlight power and brightness - power-control interface: support for battery charging thesholds, type/status and AC type/status - cpu-control interface: allow CPU C-state control - raw-usb interface: support RPi5 and Thinkpad x13s - custom-device interface: allow device file locking - lxd-support interface: allow LXD to self-manage its own cgroup - network-manager interface: support MPTCP sockets - network-control interface: allow plug/slot access to gnutls config and systemd resolved cache flushing via D-Bus - network-control interface: allow wpa_supplicant dbus api - gpio-control interface: support gpiochip* devices - polkit interface: fix "rw" mount option check - u2f-devices interface: enable additional security keys - desktop interface: enable kde theming support- convert license to SPDX- convert license to SPDX- New upstream release 2.64 - Support building snapd using base Core22 (Snapcraft 8.x) - FIPS: support building FIPS complaint snapd variant that switches to FIPS mode when the system boots with FIPS enabled - AppArmor: update to AppArmor 4.0.1 - AppArmor: support AppArmor snippet priorities - AppArmor prompting: add checks for prompting support, include prompting status in system key, and restart snapd if prompting flag changes - AppArmor prompting: include prompt prefix in AppArmor rules if prompting is supported and enabled - AppArmor prompting: add common types, constraints, and mappings from AppArmor permissions to abstract permissions - AppArmor prompting: add path pattern parsing and matching - Registry views (experimental): rename from aspects to registries - Registry views (experimental): support reading registry views using snapctl - Registry views (experimental): restrict view paths from using a number as first character and view names to storage path style patterns - Snap components: support installing snaps and components from files at the same time (no REST API/CLI) - Snap components: support downloading components related assertions from the store - Snap components: support installing components from the store (no REST API/CLI) - Snap components: support removing components (REST API, no CLI) - Snap components: started support for component hooks - Snap components: support kernel modules as components - Refresh app awareness (experimental): add data field for /v2/changes REST API to allow associating each task with affected snaps - Refresh app awareness (experimental): use the app name from .desktop file in notifications - Refresh app awareness (experimental): give snap-refresh-observe interface access to /v2/snaps/{name} endpoint - Allow re-exec when SNAP_REEXEC is set for unlisted distros to simplify testing - Generate GNU build ID for Go binaries - Add missing etelpmoc.sh for shell completion - Do not attempt to run snapd on classic when re-exec is disabled - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse - Add snap debug api command to enable running raw queries - Enable snap-confine snap mount directory detection - Replace global seccomp filter with deny rules in standard seccomp template - Remove support for Ubuntu Core Launcher (superseded by snap- confine) - Support creating pending serial bound users after serial assertion becomes available - Support disabling cloud-init using kernel command-line - In hybrid systems, apps can refresh without waiting for restarts required by essential snaps - Ship snap-debug-info.sh script used for system diagnostics - Improve error messages when attempting to run non-existent snap - Switch to -u UID:GID for strace-static - Support enabling snapd logging with snap set system debug.snapd.{log,log-level} - Fix restarting activated services instead of their activator units (i.e. sockets, timers) - Fix potential unexpected auto-refresh of snap on managed schedule - Fix potential segfault by guarding against kernel command-line changes on classic system - Fix proxy entries in /etc/environment with missing newline that caused later manual entries to not be usable - Fix offline remodelling by ignoring prerequisites that will otherwise be downloaded from store - Fix devmode seccomp deny regression that caused spamming the log instead of actual denies - Fix snap lock leak during refresh - Fix not re-pinning validation sets that were already pinned when enforcing new validation sets - Fix handling of unexpected snapd runtime failure - Fix /v2/notices REST API skipping notices with duplicate timestamps - Fix comparing systemd versions that may contain pre-release suffixes - Fix udev potentially starting before snap-device-helper is made available - Fix race in snap seed metadata loading - Fix treating cloud-init exit status 2 as error - Fix to prevent sending refresh complete notification if snap snap- refresh-observe interface is connected - Fix to queue snapctl service commands if run from the default- configure hook to ensure they get up-to-date config values - Fix stop service failure when the service is not actually running anymore - Add registry interface that provides snaps access to a particular registry view - steam-support interface: relaxed AppArmor and seccomp restrictions to improve user experience - home interface: autoconnect home on Ubuntu Core Desktop - serial-port interface: support RPMsg tty - display-control interface: allow changing LVDS backlight power and brightness - power-control interface: support for battery charging thesholds, type/status and AC type/status - cpu-control interface: allow CPU C-state control - raw-usb interface: support RPi5 and Thinkpad x13s - custom-device interface: allow device file locking - lxd-support interface: allow LXD to self-manage its own cgroup - network-manager interface: support MPTCP sockets - network-control interface: allow plug/slot access to gnutls config and systemd resolved cache flushing via D-Bus- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild- New upstream release 2.63 - Support for snap services to show the current status of user services (experimental) - Refresh app awareness: record snap-run-inhibit notice when starting app from snap that is busy with refresh (experimental) - Refresh app awareness: use warnings as fallback for desktop notifications (experimental) - Aspect based configuration: make request fields in the aspect- bundle's rules optional (experimental) - Aspect based configuration: make map keys conform to the same format as path sub-keys (experimental) - Aspect based configuration: make unset and set behaviour similar to configuration options (experimental) - Aspect based configuration: limit nesting level for setting value (experimental) - Components: use symlinks to point active snap component revisions - Components: add model assertion support for components - Components: fix to ensure local component installation always gets a new revision number - Add basic support for a CIFS remote filesystem-based home directory - Add support for AppArmor profile kill mode to avoid snap-confine error - Allow more than one interface to grant access to the same API endpoint or notice type - Allow all snapd service's control group processes to send systemd notifications to prevent warnings flooding the log - Enable not preseeded single boot install - Update secboot to handle new sbatlevel - Fix to not use cgroup for non-strict confined snaps (devmode, classic) - Fix two race conditions relating to freedesktop notifications - Fix missing tunables in snap-update-ns AppArmor template - Fix rejection of snapd snap udev command line by older host snap- device-helper - Rework seccomp allow/deny list - Clean up files removed by gadgets - Remove non-viable boot chains to avoid secboot failure - posix_mq interface: add support for missing time64 mqueue syscalls mq_timedreceive_time64 and mq_timedsend_time64 - password-manager-service interface: allow kwalletd version 6 - kubernetes-support interface: allow SOCK_SEQPACKET sockets - system-observe interface: allow listing systemd units and their properties - opengl interface: enable use of nvidia container toolkit CDI config generation- New upstream release 2.62 - Aspects based configuration schema support (experimental) - Refresh app awareness support for UI (experimental) - Support for user daemons by introducing new control switches --user/--system/--users for service start/stop/restart (experimental) - Add AppArmor prompting experimental flag (feature currently unsupported) - Installation of local snap components of type test - Packaging of components with snap pack - Expose experimental features supported/enabled in snapd REST API endpoint /v2/system-info - Support creating and removing recovery systems for use by factory reset - Enable API route for creating and removing recovery systems using /v2/systems with action create and /v2/systems/{label} with action remove - Lift requirements for fde-setup hook for single boot install - Enable single reboot gadget update for UC20+ - Allow core to be removed on classic systems - Support for remodeling on hybrid systems - Install desktop files on Ubuntu Core and update after snapd upgrade - Upgrade sandbox features to account for cgroup v2 device filtering - Support snaps to manage their own cgroups - Add support for AppArmor 4.0 unconfined profile mode - Add AppArmor based read access to /etc/default/keyboard - Upgrade to squashfuse 0.5.0 - Support useradd utility to enable removing Perl dependency for UC24+ - Support for recovery-chooser to use console-conf snap - Add support for --uid/--gid using strace-static - Add support for notices (from pebble) and expose via the snapd REST API endpoints /v2/notices and /v2/notice - Add polkit authentication for snapd REST API endpoints /v2/snaps/{snap}/conf and /v2/apps - Add refresh-inhibit field to snapd REST API endpoint /v2/snaps - Add refresh-inhibited select query to REST API endpoint /v2/snaps - Take into account validation sets during remodeling - Improve offline remodeling to use installed revisions of snaps to fulfill the remodel revision requirement - Add rpi configuration option sdtv_mode - When snapd snap is not installed, pin policy ABI to 4.0 or 3.0 if present on host - Fix gadget zero-sized disk mapping caused by not ignoring zero sized storage traits - Fix gadget install case where size of existing partition was not correctly taken into account - Fix trying to unmount early kernel mount if it does not exist - Fix restarting mount units on snapd start - Fix call to udev in preseed mode - Fix to ensure always setting up the device cgroup for base bare and core24+ - Fix not copying data from newly set homedirs on revision change - Fix leaving behind empty snap home directories after snap is removed (resulting in broken symlink) - Fix to avoid using libzstd from host by adding to snapd snap - Fix autorefresh to correctly handle forever refresh hold - Fix username regex allowed for system-user assertion to not allow '+' - Fix incorrect application icon for notification after autorefresh completion - Fix to restart mount units when changed - Fix to support AppArmor running under incus - Fix case of snap-update-ns dropping synthetic mounts due to failure to match desired mount dependencies - Fix parsing of base snap version to enable pre-seeding of Ubuntu Core Desktop - Fix packaging and tests for various distributions - Add remoteproc interface to allow developers to interact with Remote Processor Framework which enables snaps to load firmware to ARM Cortex microcontrollers - Add kernel-control interface to enable controlling the kernel firmware search path - Add nfs-mount interface to allow mounting of NFS shares - Add ros-opt-data interface to allow snaps to access the host /opt/ros/ paths - Add snap-refresh-observe interface that provides refresh-app- awareness clients access to relevant snapd API endpoints - steam-support interface: generalize Pressure Vessel root paths and allow access to driver information, features and container versions - steam-support interface: make implicit on Ubuntu Core Desktop - desktop interface: improved support for Ubuntu Core Desktop and limit autoconnection to implicit slots - cups-control interface: make autoconnect depend on presence of cupsd on host to ensure it works on classic systems - opengl interface: allow read access to /usr/share/nvidia - personal-files interface: extend to support automatic creation of missing parent directories in write paths - network-control interface: allow creating /run/resolveconf - network-setup-control and network-setup-observe interfaces: allow busctl bind as required for systemd 254+ - libvirt interface: allow r/w access to /run/libvirt/libvirt-sock- ro and read access to /var/lib/libvirt/dnsmasq/** - fwupd interface: allow access to IMPI devices (including locking of device nodes), sysfs attributes needed by amdgpu and the COD capsule update directory - uio interface: allow configuring UIO drivers from userspace libraries - serial-port interface: add support for NXP Layerscape SoC - lxd-support interface: add attribute enable-unconfined-mode to require LXD to opt-in to run unconfined - block-devices interface: add support for ZFS volumes - system-packages-doc interface: add support for reading jquery and sphinx documentation - system-packages-doc interface: workaround to prevent autoconnect failure for snaps using base bare - microceph-support interface: allow more types of block devices to be added as an OSD - mount-observe interface: allow read access to /proc/{pid}/task/{tid}/mounts and proc/{pid}/task/{tid}/mountinfo - polkit interface: changed to not be implicit on core because installing policy files is not possible - upower-observe interface: allow stats refresh - gpg-public-keys interface: allow creating lock file for certain gpg operations - shutdown interface: allow access to SetRebootParameter method - media-control interface: allow device file locking - u2f-devices interface: support for Trustkey G310H, JaCarta U2F, Kensington VeriMark Guard, RSA DS100, Google Titan v2- New upstream release 2.61.3 - Install systemd files in correct location for 24.04- New upstream release 2.61.2 - Fix to enable plug/slot sanitization for prepare-image - Fix panic when device-service.access=offline - Support offline remodeling - Allow offline update only remodels without serial - Fail early when remodeling to old model revision - Fix to enable plug/slot sanitization for validate-seed - Allow removal of core snap on classic systems - Fix network-control interface denial for file lock on /run/netns - Add well-known core24 snap-id - Fix remodel snap installation order - Prevent remodeling from UC18+ to UC16 - Fix cups auto-connect on classic with cups snap installed - u2f-devices interface support for GoTrust Idem Key with USB-C - Fix to restore services after unlink failure - Add libcudnn.so to Nvidia libraries - Fix skipping base snap download due to false snapd downgrade conflict- Rebuild for golang 1.22.0- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild- Changelog resynchronization- Require xdelta on Fedora or EPEL >= 9 (for delta updates)- New upstream release 2.61.1 - Stop requiring default provider snaps on image building and first boot if alternative providers are included and available - Fix auth.json access for login as non-root group ID - Fix incorrect remodelling conflict when changing track to older snapd version - Improved check-rerefresh message - Fix UC16/18 kernel/gadget update failure due volume mismatch with installed disk - Stop auto-import of assertions during install modes - Desktop interface exposes GetIdletime - Polkit interface support for new polkit versions - Fix not applying snapd snap changes in tracked channel when remodelling- New upstream release 2.61 - Fix control of activated services in 'snap start' and 'snap stop' - Correctly reflect activated services in 'snap services' - Disabled services are no longer enabled again when snap is refreshed - interfaces/builtin: added support for Token2 U2F keys - interfaces/u2f-devices: add Swissbit iShield Key - interfaces/builtin: update gpio apparmor to match pattern that contains multiple subdirectories under /sys/devices/platform - interfaces: add a polkit-agent interface - interfaces: add pcscd interface - Kernel command-line can now be edited in the gadget.yaml - Only track validation-sets in run-mode, fixes validation-set issues on first boot. - Added support for using store.access to disable access to snap store - Support for fat16 partition in gadget - Pre-seed authority delegation is now possible - Support new system-user name daemon - Several bug fixes and improvements around remodelling - Offline remodelling support- New upstream release 2.60.4 - i/b/qualcomm_ipc_router.go: switch to plug/slot and add socket permission - interfaces/builtin: fix custom-device udev KERNEL values - overlord: allow the firmware-updater snap to install user daemons - interfaces: allow loopback as a block-device- New upstream release 2.60.3 - i/b/shared-memory: handle "private" plug attribute in shared- memory interface correctly - i/apparmor: support for home.d tunables from /etc/- New upstream release 2.60.2 - i/builtin: allow directories in private /dev/shm - i/builtin: add read access to /proc/task/schedstat in system- observe - snap-bootstrap: print version information at startup - go.mod: update gopkg.in/yaml.v3 to v3.0.1 to fix CVE-2022-28948 - snap, store: filter out invalid snap edited links from store info and persisted state - o/configcore: write netplan defaults to 00-snapd-config on seeding - snapcraft.yaml: pull in apparmor_parser optimization patches from https://gitlab.com/apparmor/apparmor/-/merge_requests/711 - snap-confine: fix missing \0 after readlink - cmd/snap: hide append-integrity-data - interfaces/opengl: add support for ARM Mali- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild- New upstream release 2.60.1 - install: fallback to lazy unmount() in writeFilesystemContent - data: include "modprobe.d" and "modules-load.d" in preseeded blob - gadget: fix install test on armhf - interfaces: fix typo in network_manager_observe - sandbox/apparmor: don't let vendored apparmor conflict with system - gadget/update: set parts in laid out data from the ones matched - many: move SnapConfineAppArmorDir from dirs to sandbox/apparmor - many: stop using `-O no-expr-simplify` in apparmor_parser - go.mod: update secboot to latest uc22 branch- New upstream release 2.60 - Support for dynamic snapshot data exclusions - Apparmor userspace is vendored inside the snapd snap - Added a default-configure hook that exposes gadget default configuration options to snaps during first install before services are started - Allow install from initrd to speed up the initial installation for systems that do not have a install-device hook - New `snap sign --chain` flag that appends the account and account-key assertions - Support validation-sets in the model assertion - Support new "min-size" field in gadget.yaml - New interface: "userns"- New upstream release 2.59.5 - Explicitly disallow the use of ioctl + TIOCLINUX This fixes CVE-2023-1523.- New upstream release 2.59.4 - Retry when looking for disk label on non-UEFI systems (LP: #2018977) - Fix remodel from UC20 to UC22- New upstream release 2.59.3 - Fix quiet boot - i/b/physical_memory_observe: allow reading virt-phys page mappings - gadget: warn instead of returning error if overlapping with GPT header - overlord,wrappers: restart always enabled units - go.mod: update github.com/snapcore/secboot to latest uc22 - boot: make sure we update assets for the system-seed-null role - many: ignore case for vfat partitions when validating- New upstream release 2.59.2 - Notify users when a user triggered auto refresh finished- New upstream release 2.59.1 - Add udev rules from steam-devices to steam-support interface - Bugfixes for layout path checking, dm_crypt permissions, mount-control interface parameter checking, kernel commandline parsing, docker-support, refresh-app-awareness/bin/sh/bin/sh/bin/sh2.68.3-0.el10_1snapd-selinuxREADME.mdsnapd-selinuxCOPYINGsnappy.ifsnappy.pp.bz2/usr/share/doc//usr/share/doc/snapd-selinux//usr/share/licenses//usr/share/licenses/snapd-selinux//usr/share/selinux/devel/include/contrib//usr/share/selinux/packages/-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wno-complain-wrong-lang -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -march=x86-64-v3 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 drpmzstd19x86_64-redhat-linux-gnudirectoryASCII text if [ -e /etc/selinux/config ]; then . /etc/selinux/config fi _policytype= if [ -z "${_policytype}" ]; then _policytype="targeted" fi if selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then if [ -f /var/lib/rpm-state/file_contexts.pre ]; then fixfiles -C /var/lib/rpm-state/file_contexts.pre restore &> /dev/null rm -f /var/lib/rpm-state/file_contexts.pre fi fi/bin/shhttps://bugz.fedoraproject.org/snapdutf-802caf5743acb9092af5f5e5b58848d6659164c75776d439e95b034e57e18c1e48acf8ea50126b364a22edb9dc95540b8aea690b94d43fd3a4c4f82f666ca48a1?(/h^DLT3snapd-selinux-2.67-0.el10_0&4 xB`tA#MѦ@6[d8.31> 6 _ ܉3!}Nbh&3م~Xg *$Gf*s (dG3^@YBdJ pT[5}6 FNi)0;7mSlO?mt-14]4x^VA@b,#)~6}M_]JT>W8_ ~"Iijx9^LK 9B]> }d dh-c~!f)z"!0]RAEZLq豝U&FWkVx@"LѼ=_Vk=Zk{I-WUMS Ȇ揵k>`]~xȫGBtIͩ.#~$}M2@~M)'Q [5g2؜لTkIߨ@?y׻BeBЋLK4T=f7c41a55e0283d0e7ac9341ce93e240a2d0dd18f2311ad992010af9351eb7c6facec9a980f51da7553b09010c9de06b88a764IYw6u6c>R7|(7Fk=7|yBZh91AY&SYƇR@L@B T6dzMCOPp$ƒ$ ,y]Y웴rG|7u(!w$S hu H$Exmz/>sS5L{݉ F鄅#<RS|:-v| c8)ݎJ٨<-: ٶe"RꀎJ  *@WS jz7zMM=OM O61?L&&FFz4iFQCM4ѣ@2& L$H4~4f !4TRdiS$2a2h =F# CF&@ѡɀ!`i4``LLL OTRmS!zh =@44 4$BbSj?!4i4ژ4'Ԛh&PSOHb  hdM z44zF" @ޡ*f Q6&fdh4_st>W1lHcC+jI$-ְ$#a^bW[ Я+WT߀`ASz0AG #$dU'IO<5] WPI~ W| cZOoN9ߏ4z0X*}>\$$>JvOwOwr yA__m$ #%J UA X?FyD%Öyu֡]Pa:ũzS,%u[hjѡRlX0 :~q!P6#mohZUU`(q#BV \^Z+T"Q(*X[XۛUk5wM񿸕EWZ_Xٴ'HVuϿ!!azQq1Nq Ehi44}F>CU5r~6?KLIkn'`w,7_y=V}QԔLi3x|HUWry\d7YtkzU8WcYve]w߳xg<^?%qwxУS1dσ¥8j?#rug?ѭWt:=:Ա,=sw<km\]4`?84ikop^kFxv%0 hFI ]}Nڌ9߀r$!< o6YǞ5.%^8b BtWx[^:{n"5@4bxuaљw  |>ky"Ǩ4=j^ju9/mfo4&,Xr,1n..4} mKt.ot}WĢ(! [B}|т`**a m 7EA|dA8XvY6q+v9[Ί ~N1J  x%;>t<Cm;rL;wR};eq"< ׯ^cr:&`V7x9eŰ9dE0d-w^N5@t˞$9/°hȂ̂:,<i ^/h:"}nݰaq(Vh ڔߧO+9wH.|Bs3sNxEdEU)F'=K~hk?jqm8J@tZo8<@(8T3*H"Mgp%n_@Rp@ǒ H9ח(_c,[/";"t{m :E'ƔU񃸀)jko`ʌ'.۔Z~Q ׆7CtNBw|rٽʃᙇg Wp&3ħvL+z"H%iݫYGZ:̶Wz+$`{~D[M/~;QYr4°fg]ժ+QiА_2[O|ۅ{;dvc+ 'n?E:DDn`#(лlSVѣP':EljGm8Uv RhN:_ “ݸ cc f(++Z΄κmC~m'-I4ܞe4ex+|o)Me7[-r{]׊d"GXMpXksgݰ8Pܖ4F (YmyX^S?C~ǧB~;|Ó_wrׁVe7"_2n2do;3#|z0<Þ$Mwe_\}OvkqBh}rgN\Ӯ vMnS7 9qdž'U~Z8h>޺>d.=ٕ׎'O\mƽ9~oNyxGCz_w3O:ǸקWt-x.pm|xgӟc#N=<< nfjn>&0ˌ}97虁0<@< Frی mwIHUP"=] PA{@]R*ȑF1IFأh܊Kb Z d-DlTTDjci*2TB >T`h+CG # QCUkQVƭ֍QFw^*XEF4hѭkUzޜ|xFX^ U7 &IF1 "4Tli81'@4xT&s۵y|k«K &qn55@-I ,P*ČK"!66M[Vս4XQbƋ-Eբ*$`^"")D/@bx7JᏱۀz=2h(,_.`yHGhLqzX-; W*YU_syHh͛9IXMN>>E8iYim^;ukrY cr}p((g0eEf΅6Tj)**d͛&@T D@Q,+$PB MD|;m1ք#ŽO>@yǎ F4bTL" gTURKM|۽ Э$[vvH$f&Lg&A;UbEU; C.9{m=xZm/UO2Ewn ];>צxc lp^LI}37쾽]yOZ )vR`nhyWZlT̬Ojkh3MK;Q9Lf<$:[ն[dm<)wTce0Ԇzܼx=;׊i9g)1E"WaW- {vKZR>Dyc\9\M\My<آa([ -SUI]}MќFj,vzlŗYiܷ *ݓYwtyXS\r OյCPp\ A:?6&!13Pƫ $pȆ!TV7Va`j-6W2"' # uw+N _.v-ၯ+4VF j28 E-j0; PԒicRG: ;ѡ! $rWb5(z yd@!¨:[HuBx|}:cCYY;?cQM 70[>9epxY.*#LD { {[-0 XsU_"BAk>e[NuifJT~|.nёt;1 V޸19}j Ƕ7ԧ?q:kս^8<3~fzd'-i0poۊȮxyS,Zظᕫ n֒8n&̅Í#\/SW%79 \pU}[xvu}xFXצ癄8f_؝˿\v+V {!n*[c^Ej k75mk#|]-tZN2f̄fx@oz`sX&~oyh,AQ7ڪVPdA//!p-d˺3Ч~R!^o"oM8?_)0ˮ=YlwN<]G׮  C$Tj[ݩ)a:\\%wC ' 0_ct_'wnCo\ڰ}?Kzcϱ=֋r!:owTc}D1qp>~cl3=oXZRYV}WsLx/JXKRff)'a:iTRwY飱uCVT P*j*\n7O RZq KF;p%hv@Ԗ P In! [F9@Y+w@S{tY7/Z[u]dhUKĒf\ UOcpxdl>C):5L+mv{zӶ@ nFo{מwׯomPwq%[̢ޝR;޻7vޮ]͵Ē{ӽ:]AۍQ]NAͮzww{_Ʃ]ޕI-;7{.n7o]oYD5UTﵓEw;eo+n xPiouS|H$ojuw&z% 2ðFv6%x&E+iUk+q겋ͽ෋+ý<tXFRKP>-V}w-@7%-EkDn2XsPDn@qww4hn4m]73084Aa7֞oƗKj]bXתp"v}UKĢLȦb6F3FGWfr7:J6SPDxwd&%lmVӧDmޝ6XqeU#7M4 $n6F͋@bA9`ʼn^LX [nqJ@Y mf՝7{/[<sjzuXx}ki}d<)Jڼ|u 7yي=K!|LT=v3&=CBroxA2t ʡ 8k 3*l7@̪ ̻6=ͥnVH3(K$5s:j@uf{͛ջ6stNW{Sٙٯ#6mE;rzE]֫b$##$nz8S *pn5f- 0@qu$`v@]V]f:#uV@$$o1 (;zx};y S sնWfQ[N.bTθoV#V<wl9 11 WVEaT_ ~U*"t8ЭPaE,;czrr&IdGB EI-j#{9ț`]Bc%bvuģEfiqX̡#gv"z^$^ݶK0fho@q1  h9-=d[nhfS6{5PKIE B9e#"Q c Jn5+4oV7iVVHBn6z6* KĻW*Sm0 pز3rs {2[8ݮW}xaP(Ȣ 1>!&+ak}k}NC#9 yF <jȣ$Ii7Io;,jNW܅A ۲F;"f2? s0+0p ahCqqi!&fﵭV.`eCc0s=Nn޴2(UUFXp6'bV$ =JUI 'vmU9k-˵mk.mXg c\Lz} ߮߯}ڷL{wu4ݟt7rlJƲ˭鍹`ûwl q̹͋cM4ojyv b|s؜V)&f|MM%z>1+{u4xlp:z^O]n+aj{={S|;O.;xw^QNN%kK7 V٘6.H[1ǖ.29_.mMWÀٙx;c{45$8XIc]9f1gз Wp6C %V&D.ό|DD (FB$\6sn; bOwO#0( [sȥG-;[R.籙n! 'ͶЊ8XN|{;&f,oN Q:kd@9;/[c\ Y_n$~NGq7qz~G| 8ylZ LS'd8W  # ZꥵE@z8$99X&2˃HD [H72tp\^88"C#9:+?[W&wNaw4(}aaP&4Fh,wBX!"vyScyl$N}͌I.05ƪ0NZ @ia8m%˰pp(4qoU񧏉lAD ,"H<Ib26NC˕{箙XB:tHK!7a4V :ex>EaC`D"۽310BdJSC'z'ە\'y/ ""\4p)rz^ʁhUT*4ʉSD cC2)N %!;smzP,8``AZZa( %9{U,]e]p3052-t TԱˇ_32%mb#xPdC$%V!잤Ծ T,W=:ِ<J-BFXާ@! Ǐnoex9ҋ]48&ǣbWǂ\z8JW%6=#4j(W^ycDSTKwGaǨcdY翀aO>!A`lwLCT0R>2L>Fv.djYJ"Pec Ǣ ú!<*MI cp >`rZ]HމEDr)$ʹ!jIes#f (wgՐzDC 'ԂQbBR<=(}jH0 sTY&]1&84@\`e/{VIa\Ba! b09w4@Kf_=E_#(KZߔ햚W,I66n}孉7qEīAX 1;Ēbl1Nif]uyBfœP|.i=::nyϢ~dWi]-r5)X hq/00-HUO*g\CcM$V(T2BȊskY[|(S O^F(p/u⌻t0()]^XXv@7AO719=N|2I5[`@HukHזDۡ:7zElyp I$[==D@<# F0! A0?z? [~^@9yĒ$i<"Zȅ"Š!(G?r:J 둱DSVviX֖$*1u$n9$ABߧ4ڊo0sd7v16x2D  θ+/w`Ahd)Ho PCgB# W5 e@m @B$z(`9d!2ݘx>޾zD ~y })r7w7)8O/!ggHN.]v;k<,{sViBI\Q$ hCqUjG@2t!8awd̹oga%g7ߙ\Pݰ{>^ Š"DOsN #yl-{ЇRR+\v[U̻&{4"Ow7N2I,i[IⰬ;q5Lq TE89'8 N>8Nw1< ƌ#pq1ǁ_1n#|Is\τĢQ;C_?3>RM2O.xEzb~Reoțo|!|uo c6uuZg:<%Ac2-y‘} bI\'4AE"Uu.ƾU6cu3 ē5Vf!'3W"LG3ZKƢ. XǼc+#^=J B3ҬpA-y%F$!c P29rȶHjo1=xkGo*F}"pRNXtC  pu݊t /sߍ;bi/im/uǧjt\WneCCE˛QGpa qL%F`c`X;g >z!Inҧ.i4= S~%[7ǺƀZEExirXøIr5$wBGK7oۡZ}%"'u:7 ^,7u$!ѪI$nh+Et>m۲I$UU| "D?B(8- :XLQ!8<{ I)LH2FNYCy,wh|.n343.37RRI$zlpf'zz^ǔԐ 9edȧɺ&]oyj(֬`biWk݀"k $W3Y^ꍈ0J0A}9y~jFj M{9ub!oa2Λa.k_ۡ2L-[02e"D$:w4phHd*) wKH|X4Lͳf7c֌72i>! XY HBq0 UsOEEqD A  Rh43:Ыy` Z]eԀs l `f[sC/dHW b`i@JSց,",T*'C}a"JHrYonCzǠLC#"5@)JK@<չ38E[rqb o8=<0I9Ru`Cy}3uU6 CÒFCB o^oI( ]eu"cr':bǑzo8AǾG@ȳp[5T-$2>A rnqE`4L oQ']9DSЈ!gNc9ʪC3%fm9XK]ʭHHbWhEx=6Cž| e `t1_4@Hll]>'V%,X7VX(6O6 :C>u4¦1/AV^*v; M(ޚ6,AHaX6Q- zeD6552 Ш!N T**i[%@+guh""HD "0Pcb* @0-W˒BA8ؠ : w{ @ &VAYd(>Z&wlֿ tp y!T7i`HVVjha'@))/$ 0eDR"Jl+PAP`Vs;hx UE1  *Wd)D2+pQ+NX O.p!(pfh&mu J#Pck; L\DD 7%`vD.Yc̐;(bmUCSu#kVvv1 |NL2Ok{?hxx@,I|C9_k*^^2M{\I _|y[̅)Wq+wXL!D$H1^8[K(# ~^FS"pI=+i3zrN~(M1DJٰI6[Ba 2p01srhiKITᴁ&չgϐ2z6`qndiTvb-SekKopbl鍱"|1'DȠnr`cz\aB$