Engines/Terraform/Initialize-AvmTerraformRepository.ps1
|
function Initialize-AvmTerraformRepository { <# .SYNOPSIS Create and set up an AVM Terraform module repository, resuming any incomplete stage. .DESCRIPTION Each stage checks GitHub and the local directory first, so running the command again continues from wherever an earlier run stopped: 1. Write metadata.json to the local directory. 2. Create the public repository in the Azure organization. 3. Wait for open source portal setup and JIT elevation. 4. Restore a ruleset opt-out that an interrupted run left changed. 5. Grant the module contributors and readers teams access. 6. Publish metadata.json, the packaged minimal scaffold, and the avm pre-commit output as the first commit on main. 7. Request the AVM app installations in microsoft/github-operations. 8. Clone the repository into the local directory. 9. Show the final open source portal steps, which this command cannot check: tie the repository to the shared AVM just-in-time rule, then, last, leave jaredholgate and jatracey as the only individual Direct Owners. A failed stage is reported in the result and stops the run. .PARAMETER Path Local repository directory. Its name is the repository name. .PARAMETER ModuleType Resource, pattern, or utility. .PARAMETER InputObject Metadata values; missing required values are prompted for. .PARAMETER SkipModuleVersionCheck Skip the installed-module version check. #> [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Medium')] [OutputType([pscustomobject])] param( [Parameter(Mandatory)] [string] $Path, [Parameter(Mandatory)] [ValidateSet('resource', 'pattern', 'utility')] [string] $ModuleType, [System.Collections.IDictionary] $InputObject = @{}, [switch] $SkipModuleVersionCheck ) Set-StrictMode -Version 3.0 $ErrorActionPreference = 'Stop' Test-AvmModuleVersion -SkipModuleVersionCheck:$SkipModuleVersionCheck # Nested verbs such as avm pre-commit must not repeat the version check, as in the dispatcher. $PSDefaultParameterValues = if ($PSDefaultParameterValues) { $PSDefaultParameterValues.Clone() } else { @{} } $PSDefaultParameterValues['*:SkipModuleVersionCheck'] = $true $PSDefaultParameterValues['Test-AvmModuleVersion:SuppressSkipWarning'] = $true $organization = 'Azure' $teams = @( [pscustomobject]@{ Slug = 'azure-verified-modules-module-contributors'; Permission = 'push' } [pscustomobject]@{ Slug = 'azure-verified-modules-module-readers'; Permission = 'triage' } ) $jitRule = 'service-AVM-azure-verified-modules-module-owners' $directOwners = 'jaredholgate and jatracey' $target = Resolve-AvmTerraformRepositoryTarget -Path $Path -ModuleType $ModuleType $repository = "$organization/$($target.Name)" $repositoryUrl = "https://github.com/$repository" $metadataPath = Join-Path -Path $target.Root -ChildPath 'metadata.json' $metadataEndpoint = "repos/$repository/contents/metadata.json?ref=main" $steps = [System.Collections.Generic.List[object]]::new() $state = @{ Changed = $false; Metadata = $null; PullRequest = $null; Stage = 'metadata' } $addStep = { param([string] $Name, [string] $Status, [string] $Detail, [string] $ErrorText, [object] $Result) $step = [ordered]@{ Step = if ($Detail) { "$Name`: $Detail" } else { $Name }; Status = $Status } if ($ErrorText) { $step.Error = $ErrorText } if ($null -ne $Result) { $step.Result = $Result } $steps.Add([pscustomobject]$step) } $finish = { [pscustomobject][ordered]@{ Engine = 'terraform' Tool = 'module-initialize/1' ToolPath = $null ToolSource = 'builtin' Status = if (@($steps | Where-Object { $_.Status -eq 'fail' }).Count -gt 0) { 'fail' } else { 'pass' } Issues = @() Repository = $repository RepositoryUrl = $repositoryUrl Path = $target.Root Changed = $state.Changed Steps = $steps.ToArray() Metadata = $state.Metadata AppInstallationPullRequest = $state.PullRequest } } $isAdministrator = { param($value) $null -ne $value -and $value['permissions'] -is [System.Collections.IDictionary] -and $value['permissions']['admin'] -eq $true } $gh = Get-AvmApplicationPath -Name gh $null = Get-AvmApplicationPath -Name git $authentication = Invoke-AvmProcess -FilePath $gh -ArgumentList @('auth', 'status', '--hostname', 'github.com', '--active') ` -IgnoreExitCode -Label 'gh auth status' -EnvVars @{ GH_PROMPT_DISABLED = '1'; NO_COLOR = '1' } if ($authentication.ExitCode -ne 0) { throw [AvmConfigurationException]::new( 'The GitHub CLI is not signed in to github.com. Run gh auth login, then run avm init again.') } # Fine-grained tokens list no scopes, so only OAuth and classic tokens are checked. $scopeLine = [regex]::Match("$($authentication.StdOut)`n$($authentication.StdErr)", 'Token scopes:(?<scopes>[^\r\n]*)') $scopes = @(if ($scopeLine.Success) { [regex]::Matches($scopeLine.Groups['scopes'].Value, "'(?<scope>[^']+)'") | ForEach-Object { $_.Groups['scope'].Value } }) if ($scopes.Count -gt 0) { $missingScopes = @( if ($scopes -notcontains 'repo') { 'repo' } if (@($scopes | Where-Object { $_ -in @('read:org', 'write:org', 'admin:org') }).Count -eq 0) { 'read:org' } if ($scopes -notcontains 'workflow') { 'workflow' } ) if ($missingScopes.Count -gt 0) { throw [AvmConfigurationException]::new( "The GitHub CLI token is missing the $($missingScopes -join ', ') scope(s). Run gh auth refresh " + "--hostname github.com --scopes $($missingScopes -join ','), or use a GH_TOKEN with those scopes, then run avm init again.") } } try { $remote = Invoke-AvmGitHubApi -Endpoint "repos/$repository" -AllowNotFound $published = $null -ne $remote -and $null -ne (Invoke-AvmGitHubApi -Endpoint $metadataEndpoint -AllowNotFound) if (-not $published) { $values = [ordered]@{} foreach ($key in $InputObject.Keys) { $values[$key] = $InputObject[$key] } if (-not (Test-Path -LiteralPath $metadataPath) -and -not $values.Contains('telemetryIdPrefix') -and $ModuleType -ne 'utility') { $kind = @{ resource = 'res'; pattern = 'ptn' }[$ModuleType] $values['telemetryIdPrefix'] = New-AvmTelemetryIdPrefix -Ecosystem terraform -Kind $kind ` -KnownPrefix @(Get-AvmCatalogTelemetryPrefix -SkipModuleVersionCheck) -SkipModuleVersionCheck } $metadataPlan = Get-AvmModuleMetadataInitializationPlan -Path $target.Root -InputObject $values ` -Ecosystem terraform -ModuleType $ModuleType -CreateDirectory -SkipModuleVersionCheck $state.Metadata = $metadataPlan.Metadata if ($metadataPlan.Plans.Count -eq 0) { & $addStep 'metadata' 'pass' $metadataPath } elseif ($PSCmdlet.ShouldProcess($metadataPath, 'Write module metadata')) { Test-AvmModuleInitializationPlan -Root $target.Root -Plan $metadataPlan.Plans $null = Write-AvmModuleInitializationPlan -Root $target.Root -Plan $metadataPlan.Plans -Confirm:$false $state.Changed = $true & $addStep 'metadata' 'pass' "wrote $metadataPath" } else { & $addStep 'metadata' 'planned' "write $metadataPath" if (-not $WhatIfPreference) { return (& $finish) } } } $state.Stage = 'repository' $createdNow = $false if ($null -eq $remote) { if (-not $PSCmdlet.ShouldProcess($repository, 'Create the public GitHub repository')) { & $addStep 'repository' 'planned' "create $repositoryUrl" return (& $finish) } try { $null = Invoke-AvmGitHubApi -Method POST -Endpoint "orgs/$organization/repos" ` -Body @{ name = $target.Name; visibility = 'public' } $createdNow = $true $state.Changed = $true & $addStep 'repository' 'pass' "created $repositoryUrl" } catch [AvmGitHubException] { if ($_.Exception.StatusCode -ne 422 -or $_.Exception.Message -notmatch 'already exists') { throw } & $addStep 'repository' 'pass' "$repositoryUrl exists but is not accessible yet" } } else { & $addStep 'repository' 'pass' "$repositoryUrl exists" } $state.Stage = 'open source portal setup' if ($WhatIfPreference -and ($null -eq $remote -or [string]$remote['visibility'] -ne 'public')) { & $addStep 'open source portal setup' 'planned' 'complete the portal setup and elevate with JIT' return (& $finish) } $remote = Wait-AvmTerraformRepositoryAccess -Repository $repository -ModuleName $target.ModuleName ` -Requirement PortalSetup -AlwaysPrompt:$createdNow if ($null -eq $remote) { & $addStep 'open source portal setup' 'fail' '' ` "Complete the open source portal setup for $repository and elevate with JIT, then run avm init again." return (& $finish) } & $addStep 'open source portal setup' 'pass' 'complete' $state.Stage = 'team access' $published = $null -ne (Invoke-AvmGitHubApi -Endpoint $metadataEndpoint -AllowNotFound) $recordExists = Test-Path -LiteralPath (Get-AvmRulesetOptOutRecordPath -Repository $repository) -PathType Leaf $teamPlan = @(Sync-AvmRepositoryTeamAccess -Organization $organization -Repository $target.Name -Team $teams -PlanOnly) $teamsNeeded = @($teamPlan | Where-Object { $_.Status -eq 'planned' }).Count -gt 0 if (($teamsNeeded -or -not $published -or $recordExists) -and -not (& $isAdministrator $remote)) { $state.Stage = 'administrator access' if ($WhatIfPreference) { & $addStep 'administrator access' 'planned' 'elevate with JIT' return (& $finish) } $remote = Wait-AvmTerraformRepositoryAccess -Repository $repository -ModuleName $target.ModuleName ` -Requirement Elevation if ($null -eq $remote) { & $addStep 'administrator access' 'fail' '' "Elevate your access to $repository with JIT, then run avm init again." return (& $finish) } & $addStep 'administrator access' 'pass' 'elevated' } $state.Stage = 'organization rulesets' if ($recordExists) { $restore = Restore-AvmRulesetOptOut -Repository $repository -RepositoryId ([long]$remote['id']) $restored = if ($null -eq $restore.Value) { 'unset' } else { $restore.Value } switch ($restore.Status) { 'restored' { $state.Changed = $true & $addStep 'organization rulesets' 'pass' "restored global-rulesets-opt-out to $restored" } 'planned' { & $addStep 'organization rulesets' 'planned' 'restore global-rulesets-opt-out if an earlier run left it changed' if (-not $WhatIfPreference) { return (& $finish) } } 'stale' { & $addStep 'organization rulesets' 'pass' 'removed a record for an earlier repository with this name' } default { & $addStep 'organization rulesets' 'pass' 'no earlier change to restore' } } } elseif ((Get-AvmRepositoryRulesetOptOut -Repository $repository) -ceq 'true' -and -not (Test-AvmRepositorySyncManaged -Repository $repository)) { & $addStep 'organization rulesets' 'fail' '' ( 'global-rulesets-opt-out is true, but repository sync does not manage the repository and this machine has ' + 'no record of avm init changing it. If avm init was interrupted on another machine, run it there to ' + 'restore the original value. Otherwise set the property back to false, then run avm init again.') return (& $finish) } $state.Stage = 'team access' $teamDetail = ($teams | ForEach-Object { "$($_.Slug) ($($_.Permission))" }) -join ', ' if ($teamsNeeded) { $granted = @(Sync-AvmRepositoryTeamAccess -Organization $organization -Repository $target.Name -Team $teams) if (@($granted | Where-Object { $_.Status -eq 'granted' }).Count -gt 0) { $state.Changed = $true } if (@($granted | Where-Object { $_.Status -eq 'planned' }).Count -gt 0) { & $addStep 'team access' 'planned' $teamDetail if (-not $WhatIfPreference) { return (& $finish) } } else { & $addStep 'team access' 'pass' $teamDetail } } else { & $addStep 'team access' 'pass' "$teamDetail already granted" } $state.Stage = 'initial content' $contentReady = $published if ($published) { $file = Invoke-AvmGitHubApi -Endpoint $metadataEndpoint $json = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(([string]$file['content'] -replace '\s', ''))) $validation = Test-AvmMetadataContent -Json $json -Ecosystem terraform -ModuleType $ModuleType if ($validation.Issues.Count -gt 0) { $invalid = [pscustomobject]@{ Issues = $validation.Issues } & $addStep 'initial content' 'fail' '' 'metadata.json on main is invalid. Correct it with a pull request, then run avm init again.' $invalid return (& $finish) } $root = @((Invoke-AvmGitHubApi -Endpoint "repos/$repository/git/trees/main")['tree']) $examplesTree = @($root | Where-Object { $_ -is [System.Collections.IDictionary] -and $_['path'] -ceq 'examples' -and $_['type'] -ceq 'tree' }) $examples = @(if ($examplesTree.Count -gt 0) { (Invoke-AvmGitHubApi -Endpoint "repos/$repository/git/trees/$($examplesTree[0]['sha'])")['tree'] }) $missingFiles = @(Get-AvmTerraformMissingModuleFile -Root $root -Examples $examples) if ($missingFiles.Count -gt 0) { & $addStep 'initial content' 'fail' '' ( "main has metadata.json but is missing $($missingFiles -join ', '). " + 'Add the module files with a pull request, then run avm init again.') return (& $finish) } $state.Metadata = $validation.Metadata & $addStep 'initial content' 'pass' 'metadata.json and module files are on main' } else { $publication = Publish-AvmTerraformRepositoryContent -Repository $repository -RepositoryId ([long]$remote['id']) ` -MetadataPath $metadataPath -Metadata $state.Metadata switch ($publication.Status) { 'pass' { $state.Changed = $true $contentReady = $true & $addStep 'initial content' 'pass' "pushed $($publication.Commit) to main" } 'planned' { & $addStep 'initial content' 'planned' 'run avm pre-commit and push the first commit to main' if (-not $WhatIfPreference) { return (& $finish) } } 'blocked' { & $addStep 'initial content' 'fail' '' ( "main already contains files without metadata.json ($((@($publication.Files) | Select-Object -First 5) -join ', ')). " + 'Add metadata.json with a pull request instead.') return (& $finish) } default { & $addStep 'initial content' 'fail' '' 'avm pre-commit failed. Fix the reported issues, then run avm init again.' ` $publication.PreCommit return (& $finish) } } } $state.Stage = 'app installation' $request = Request-AvmAppInstallation -Repository $target.Name -ModuleName $target.ModuleName $state.PullRequest = $request.PullRequest switch ($request.Status) { 'installed' { & $addStep 'app installation' 'pass' 'approved' } 'pending' { & $addStep 'app installation' 'pending' "awaiting approval in $($request.PullRequest)" } 'requested' { $state.Changed = $true & $addStep 'app installation' 'pending' "requested in $($request.PullRequest)" } default { & $addStep 'app installation' 'planned' 'open a pull request in microsoft/github-operations' if (-not $WhatIfPreference) { return (& $finish) } } } $state.Stage = 'local clone' if ($contentReady) { $clone = New-AvmTerraformRepositoryClone -Path $target.Root -Repository $repository & $addStep 'local clone' $clone.Status $clone.Detail # The open source portal offers no API to check these, so the steps are always shown. $state.Stage = 'just-in-time rule' $portal = "https://repos.opensource.microsoft.com/orgs/$organization/repos/$($target.Name)" $lines = @( "Finish the setup of $repository in the open source portal: $portal" " 1. If not already done, tie the repository to the shared AVM just-in-time rule. Select 'Advanced JIT options', then" " 'Propose a new tie', enter the rule ID $jitRule, then select 'Review' and 'Create tie'." ' If you do not have permission, skip this step and email avm@microsoft.com with the repository name.' " 2. Last, once everything else is done, make $directOwners the only individual Direct Owners." " Elevate to Administrator, select 'Change owners' under Direct Owners, remove everyone else, including" ' yourself and whoever created the repository, keep the azure-verified-modules-module-owners fallback' ' security group, then save.' ) foreach ($line in $lines) { Write-AvmLog $line -Level Info } & $addStep 'just-in-time rule' 'manual' "if not already done, tie the repository to $jitRule in the open source portal" $state.Stage = 'direct owners' & $addStep 'direct owners' 'manual' "last, make $directOwners the only individual Direct Owners in the open source portal" } } catch { & $addStep $state.Stage 'fail' '' $_.Exception.Message } return (& $finish) } # SIG # Begin signature block # MIInKgYJKoZIhvcNAQcCoIInGzCCJxcCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDDmHNNqLt7WF6r # YbsySlXrtS5ARpiX+PDJ9f4ahiTw/KCCDLowggX1MIID3aADAgECAhMzAAACHU0Z # yE7XD1dIAAAAAAIdMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQzWhcNMjcwNDE1MTg1 # OTQzWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDQvewXxx9gZZFC6Ys1WBay8BJ8kGA4JQnH5CMafqOASlTpK9H8 # o5ZXTXt0caVQTNMUPt445wXYD+dFtaKWTwDn1I52oUSrC9vJin1Gsqt+zyKJL5Dg # 3eQXbQNR61DmMy20GLTIO3SFed9Rfi/ophgCLGFLDR3r0KvHjwMb/jYWS0celV/4 # Lz27LfAekm8v9E5IXaeiXbAUYZKK090n4CVl3JBtbN+9DtI9SNu/yjvozW52/u7R # X/Ttpa/KDlpuokZ+Zcbvmtd9ur9gFLvZzh41o9MsE/clQtdaFWGvuo6Jua/ntpgk # ey3E5/vBFe+MJPG6phdnuo6r57ZudCudiI1bAgMBAAGjggGbMIIBlzAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFH6QuMwqcPG0hQlQ6c5jCtTTLrVeMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQL # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDc1NTkw # HwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEwYAYDVR0fBFkwVzBVoFOg # UYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNybDBtBggrBgEFBQcBAQRh # MF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBKTbYOjzwTG/DXGaz9 # s6+fQeaTtDcFmMY+5UyVFCyj7Pv+5i37qfX8lSL/tBIfYQfWsMuBQlfZurJD6r4H # VJ2CeH+1fgiq8dcHdVKoZ3Sa2qXoX3cq9iS8cVb06B7+5/XJ7I0OxHH9fDsvJ3T3 # w5V/ZtAIFmLrl+P0CtG+92uzRsn0nTbdFjOkLMLWPLAU3THohKRlSEMgFJpPkm5n # 5UAZ35xX6FWCrDLsSKb555bTifwa8mJBwdlof0bmfYidH+dxZ1FdDxvLnNl9zeKs # A4kejaaIqqIPguhwAti5Ql7BlTNoJNwxCvBmqW2MQLnCkYN/VVUsR3V2x/rcTNzo # Bf/Z/SpROvdaA2ZOOd1uioXJt3tdLQ7vHpqpib0KfWr/FWXW10q38VxfCnRQBqzb # SuztR7nEMuzX7Ck+B/XaPDXd1qh72+QYyB0Z2VzWmO9zsnb9Uq/dwu8LGeQqnyu6 # 7SDGACvnXii2fb9+US492VTnXSnFKyqwgzUyFMtZK1/sHYTv6bG4TtQUygQxTN+Z # V+aJIlKO2MqZ7bKrAnOzS9m6NgoTdWOq11bTOZwKlIEV/EhV9SWkDmdpR/hPPT2v # 6TEj4F8PT/zHjRezIU5c/DGlt/VhY/pK0XkJtEyMmmS1BMtjU/rqBZVMIm3dnxQs # /TBByr+Cf8Z1r7aifQVQ+WSqzjCCBr0wggSloAMCAQICEzMAAAA5O7Y3Gb8GHWcA # AAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoXDTM2MDMyMjIyMTMwNFow # VzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEo # MCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAyNDCCAiIwDQYJ # KoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeqlRYHNa265v4IY9fH8TKh # emHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo0dtS/EW6I/yEL/bLSY8h # KpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATvQVL4tcf03aTycsz8QeCd # M0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a1uv1zerOYMnsneRRwCbp # yW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1FyQfK0fVkaya8SmVHQ/t # Of23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfOGSWHIIV4YrTJTT6PNty5 # REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7ttOu1bVnXfHaqPYl2rPs # 20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJuz2MXMCt7iw7lFPG9LXK # Gjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxSCwyoGIq0PhaA7Y+VPct5 # pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOmVQop36wUVUYklUy++vDW # eEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3SkE/xIkgpfl22MM1itkZ # 35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8EBAMCAYYwEAYJKwYBBAGC # NxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPXLQaUEggxMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU # ci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny # bC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAwTgYIKwYBBQUHMAKGQmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOCAgEAFJQfOChP7onn6fLI # MKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D5W4wMwYeLystcEqfkjz4 # NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBYnbu0+THSuVHTe0VTTPVh # ily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSIvgn0JksVBVMYVI5QFu/q # hnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6aR9y34aiM1qmxaxBi6OU # nyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4wPKC5OmHm1DQIt/MNokbb # H3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7RTX8AdBPo0I6OEojf39z # uFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK/fg8B2qjW88MT/WF5V5u # vZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSKYBv0VisCzfxgeU+dquXW # 9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkwYTu/9dLeH2pDqeJZAABV # DWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVTQl0v4q8J/AUmQN5W4n10 # 1cY2L4A7GTQG1h32HHAvfQESWP0xghnGMIIZwgIBATBuMFcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jv # c29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIdTRnITtcPV0gAAAAAAh0w # DQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwLwYJ # KoZIhvcNAQkEMSIEIGNZYQEMzXVjz58v8G0peHw8j9jwRxiZRMEHI/BlqI1jMEIG # CisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAEggEAouAzZJLwGyTw9U+c # ldGEClXwUBBd5ZEXcg6HwSRsqWDOxiiP5OJLsktHu1chw1+tVbEAIUI0WyavPwqV # 8oTs3/rIk3eOYt4U+TOmVOVZpavfkLTdMX6TD1YuDBfcHfYuxaC9HzZM5iBnDlZb # 6bS1y2Pw+hdktfzKohEuBr95YMjvZGSkOwPBZknnsbGf51kKCxHvyqUyfzrjdSk5 # lFrRMNXUKwMjxppWYDzp4loegYBFiHTZAbeyTlwq8/a+FqCD5galfFq9TlKDNlVn # LPp54fIRaqwR0qcjXSDSnEPzViilND0b6FqJT9p1F3WT3FAWC25s62RybEiUHxWD # K48WQaGCF5YwgheSBgorBgEEAYI3AwMBMYIXgjCCF34GCSqGSIb3DQEHAqCCF28w # ghdrAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFRBgsqhkiG9w0BCRABBKCCAUAEggE8 # MIIBOAIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCBYtr4SYg9Opccz # Jd9nvvik+qlNakDhEc7gZtdGD3BC2gIGaqnQFIXfGBIyMDI2MTAwMTExMzgzNC4x # N1owBIACAfSggdGkgc4wgcsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5n # dG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9y # YXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMxJzAl # BgNVBAsTHm5TaGllbGQgVFNTIEVTTjpEQzAwLTA1RTAtRDk0NzElMCMGA1UEAxMc # TWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaCCEe0wggcgMIIFCKADAgECAhMz # AAACJDuEIbAsrGQiAAEAAAIkMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVT # MRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQK # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1l # LVN0YW1wIFBDQSAyMDEwMB4XDTI2MDIxOTE5Mzk1OVoXDTI3MDUxNzE5Mzk1OVow # gcsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS # ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJTAjBgNVBAsT # HE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMxJzAlBgNVBAsTHm5TaGllbGQg # VFNTIEVTTjpEQzAwLTA1RTAtRDk0NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUt # U3RhbXAgU2VydmljZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKPp # bdRpDZmviE29LLuPtQw8VXKztoTEYH4kXDKTPNeDeNrJib2A4tcnu02FTZ6aGstA # I5lyAu/PoWSqaCHNDHOaSAq0tiIpoTOGiA79x7SVOF0s11W0zBA5iCj5e1cBlxWI # FfgtweTfxG6xmIXvDFJrm38vGJzTj5n+GXLWAlCkh4UOqnhr0+4u3yux8fTm9b2l # T26uIZ0PF8lef+Vzj0LFteoDcRfXsvbhtzq36YW48MAkoqlqLddeoXacmWlM992s # Db2xZNI0qKD0K0ELm3NCPR+Vuxr/jCo7275GS7CllvdvuqdbkV0WsNHW9CZd+OXJ # Q/1k7fzzf03BK6Ie2+wUI2RM0hfw4vldWrWewrK7/8Z4hn1i7Gx8sF52obTbg8MR # HKsCzSm99RY4tqlVBqMc+gKe41Iq9sSHuzkhDRiC6kaOL4fusgPHb+YgQj7pDxbA # G2TdjHKGOPQZfD3T2LQSRORXLL7XIAOPBILxvDaozj4xziHLK2VnNJzQg9QGrVga # djAKMjBrn+UxbSkWf8ekl0Hpd4y5O1hM6lo+ijrgWNCvItdaN3ii+nDmU7Dtf6/c # T2TA31UEL7AkRIEQILWBkwJLlNpXB8TXDimdddvWpP1uOBGw+Dh2SWu5RN2if/dI # 23RrRDk1zZSX6syVDFeg/2KxfAw2co7kkmSpENFVAgMBAAGjggFJMIIBRTAdBgNV # HQ4EFgQUcx+RfW7/MksIx7SCpiK3HW0Ad6gwHwYDVR0jBBgwFoAUn6cVXQBeYl2D # 9OXSZacbUzUZ6XIwXwYDVR0fBFgwVjBUoFKgUIZOaHR0cDovL3d3dy5taWNyb3Nv # ZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUy # MDIwMTAoMSkuY3JsMGwGCCsGAQUFBwEBBGAwXjBcBggrBgEFBQcwAoZQaHR0cDov # L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNyb3NvZnQlMjBUaW1l # LVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcnQwDAYDVR0TAQH/BAIwADAWBgNVHSUB # Af8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQAD # ggIBAD7AdJuaEikzwJFVni2TrbiFD4t1lcTiqh5C6LvsJ41reOrUU7OLsxEqSSjp # 2IQMdc81a8BqDFqy0J7A/OblMI2HWzioIeHhHYb+vjzBT8ylzrz9YOYnLkIhCf8X # CmzWxs1QS7sHODTTipQshUn3reOj9qbjHAqDCH69JUvv92Gx9Pt2+GlF11tgtBMd # mDC40HpCFwQSyCiAtXA1GPftURZkOLCgx3HILthitC7owJW2LMec62RJfsWoiiLq # OVx+p+jrX24Mf2vyTaoA4cJ4QCopcrKYhcMxwYaUR0MVtiINmA8IEzQgeAB6KVRK # ifTvCMe7R7SywGa0Fp89vgZ37kW5GdYbdcZ73U0KksqqYVr/gaRXP04zNlSDyhzP # EL/glPcd/jkkS2zNOhfA2yRXck0Jy7Ygi2vpIkeaLcQNUAMNFI2F3MVGliamUYSU # +XkZGg+0mIMS9Ehu/kwUojDbH2Cd6F/ki8GMLhmQGD7gZOmoYTeaafMXech6Q6Rf # i6DT/SY3YJJquG5KL02Ycg6lQ3Z5AdS2BNv/4aaruCS0IzAir8k4JgiJNiqm/Whu # MAYp1Yw8KuVLI0CzSNljOSFrnfnXnw0zH7AEa+x8WhWwIwbk5ynq9boJfK5ZFtRW # oxTU6tBsd93LMmluEkLU9sBkjIkJs35UGANMDNMpjzDghJLBMIIHcTCCBVmgAwIB # AgITMwAAABXF52ueAptJmQAAAAAAFTANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UE # BhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAc # BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0 # IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTAwHhcNMjEwOTMwMTgyMjI1 # WhcNMzAwOTMwMTgzMjI1WjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDCC # AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOThpkzntHIhC3miy9ckeb0O # 1YLT/e6cBwfSqWxOdcjKNVf2AX9sSuDivbk+F2Az/1xPx2b3lVNxWuJ+Slr+uDZn # hUYjDLWNE893MsAQGOhgfWpSg0S3po5GawcU88V29YZQ3MFEyHFcUTE3oAo4bo3t # 1w/YJlN8OWECesSq/XJprx2rrPY2vjUmZNqYO7oaezOtgFt+jBAcnVL+tuhiJdxq # D89d9P6OU8/W7IVWTe/dvI2k45GPsjksUZzpcGkNyjYtcI4xyDUoveO0hyTD4MmP # frVUj9z6BVWYbWg7mka97aSueik3rMvrg0XnRm7KMtXAhjBcTyziYrLNueKNiOSW # rAFKu75xqRdbZ2De+JKRHh09/SDPc31BmkZ1zcRfNN0Sidb9pSB9fvzZnkXftnIv # 231fgLrbqn427DZM9ituqBJR6L8FA6PRc6ZNN3SUHDSCD/AQ8rdHGO2n6Jl8P0zb # r17C89XYcz1DTsEzOUyOArxCaC4Q6oRRRuLRvWoYWmEBc8pnol7XKHYC4jMYcten # IPDC+hIK12NvDMk2ZItboKaDIV1fMHSRlJTYuVD5C4lh8zYGNRiER9vcG9H9stQc # xWv2XFJRXRLbJbqvUAV6bMURHXLvjflSxIUXk8A8FdsaN8cIFRg/eKtFtvUeh17a # j54WcmnGrnu3tz5q4i6tAgMBAAGjggHdMIIB2TASBgkrBgEEAYI3FQEEBQIDAQAB # MCMGCSsGAQQBgjcVAgQWBBQqp1L+ZMSavoKRPEY1Kc8Q/y8E7jAdBgNVHQ4EFgQU # n6cVXQBeYl2D9OXSZacbUzUZ6XIwXAYDVR0gBFUwUzBRBgwrBgEEAYI3TIN9AQEw # QTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9E # b2NzL1JlcG9zaXRvcnkuaHRtMBMGA1UdJQQMMAoGCCsGAQUFBwMIMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/ # MB8GA1UdIwQYMBaAFNX2VsuP6KJcYmjRPZSQW9fOmhjEMFYGA1UdHwRPME0wS6BJ # oEeGRWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01p # Y1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNybDBaBggrBgEFBQcBAQROMEwwSgYIKwYB # BQUHMAKGPmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9v # Q2VyQXV0XzIwMTAtMDYtMjMuY3J0MA0GCSqGSIb3DQEBCwUAA4ICAQCdVX38Kq3h # LB9nATEkW+Geckv8qW/qXBS2Pk5HZHixBpOXPTEztTnXwnE2P9pkbHzQdTltuw8x # 5MKP+2zRoZQYIu7pZmc6U03dmLq2HnjYNi6cqYJWAAOwBb6J6Gngugnue99qb74p # y27YP0h1AdkY3m2CDPVtI1TkeFN1JFe53Z/zjj3G82jfZfakVqr3lbYoVSfQJL1A # oL8ZthISEV09J+BAljis9/kpicO8F7BUhUKz/AyeixmJ5/ALaoHCgRlCGVJ1ijbC # HcNhcy4sa3tuPywJeBTpkbKpW99Jo3QMvOyRgNI95ko+ZjtPu4b6MhrZlvSP9pEB # 9s7GdP32THJvEKt1MMU0sHrYUP4KWN1APMdUbZ1jdEgssU5HLcEUBHG/ZPkkvnNt # yo4JvbMBV0lUZNlz138eW0QBjloZkWsNn6Qo3GcZKCS6OEuabvshVGtqRRFHqfG3 # rsjoiV5PndLQTHa1V1QJsWkBRH58oWFsc/4Ku+xBZj1p/cvBQUl+fpO+y/g75LcV # v7TOPqUxUYS8vwLBgqJ7Fx0ViY1w/ue10CgaiQuPNtq6TPmb/wrpNPgkNWcr4A24 # 5oyZ1uEi6vAnQj0llOZ0dFtq0Z4+7X6gMTN9vMvpe784cETRkPHIqzqKOghif9lw # Y1NNje6CbaUFEMFxBmoQtB1VM1izoXBm8qGCA1AwggI4AgEBMIH5oYHRpIHOMIHL # MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk # bW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxN # aWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRT # UyBFU046REMwMC0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0 # YW1wIFNlcnZpY2WiIwoBATAHBgUrDgMCGgMVAKYI8duax4BJ97/9sa1f15Ab7T7j # oIGDMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAO # BgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEm # MCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcN # AQELBQACBQDuaLtiMCIYDzIwMjYxMDAxMTA1ODQyWhgPMjAyNjEwMDIxMDU4NDJa # MHcwPQYKKwYBBAGEWQoEATEvMC0wCgIFAO5ou2ICAQAwCgIBAAICNWMCAf8wBwIB # AAICEkswCgIFAO5qDOICAQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYKKwYBBAGEWQoD # AqAKMAgCAQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG9w0BAQsFAAOCAQEAu4ys # h6qubFn+uTEllU9umXXIHNNXlRK9r9p92dc6w8nsD2Gu1UYoF6SNOjDkASPCeetb # sBy1gMQZeSzvckq2ohvUwPkJ6I0Kqv4h35G5CZ9gAw/pUgnOO3zlZY9emYOBXlJO # 7YOXPg+aF4I3N6Mr5dJBtvN1Vjd5hOgkzca71HuPwLjiwQ9lR8vDWqlrZI3QSEVj # rEjU9gxTl4nZAy/+hLrWF+VxkrnULn3n1OKEKkA12zG/SmD+4EhYDr6FoSiDrjdW # Su95ANTddPVFS4qOYFFw7KPX3zj36DozS7gVOXbOzYfNKSzjOxpETaqHgcGBJ4HZ # kWfDNvIQ55ePNRZytDGCBA0wggQJAgEBMIGTMHwxCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1w # IFBDQSAyMDEwAhMzAAACJDuEIbAsrGQiAAEAAAIkMA0GCWCGSAFlAwQCAQUAoIIB # SjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwLwYJKoZIhvcNAQkEMSIEIE+y # Pkct9gQ77iLrDOsKvm1b31XMdd6FAt+fHnIqd8/sMIH6BgsqhkiG9w0BCRACLzGB # 6jCB5zCB5DCBvQQgSCE9N2qb91HJnQFzNdx2WhUSogJ1yalU1sf0IRXNZI4wgZgw # gYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYD # VQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAiQ7hCGwLKxk # IgABAAACJDAiBCAaghBOtlYe2VUZ9Qh2tv4zo/LzOhn4sUBNFqjnGG5JGTANBgkq # hkiG9w0BAQsFAASCAgAoWVc4g3muizF/yZnpwhmbgSdMGUxfTAiQabexFSb2lVf8 # Shx2MGg9elqMN6h6q8cmljYaT4vK15T+0Sw0yPSqOLYkfwaaulo4ePRBtTCA0Cry # rjCvM36pDDoWUd4t6j8fZ1WWbi2Q3fl0r9h8pGELKUAFXjFempIauTqjKbN3Q0fS # /QkTipVCgqXu2wK+NEMKJ8+KF3ZnBvdjzhDWLFIw9uFCZLscFmHyYj718IenEQ7l # viHiBArG6ru4ORq6bAzS14YOcYiv32hiDcmizLrlnb2e5cAtMqdgg0Oemms2Ft6p # ne278Aw2fV1hhP/BvGPJYFlCH+9QhWSB2lKTsJx3oJkxG7xr3Im5WlwvAIEbM4EF # ubMmDaWxydX4m7dLtUZOJh2n93UnRIPyzX1Tvs5iiyeqF1NRfWUmXSiXcpmhbeWQ # V7u9L/9+Qb5HHpouV+hBMBfXahaMyoKV5/YDvmhhOtTaJ8yXa37Uxx+rkCOddSSE # JpAlBIOg/dL38j4I5W6CASUlXVIRfvF8aR7K1AKmYZBKMTXKWCMpBgiIckBDKb// # NeTWQpxdh3LSVnk+gWC9l8TMmdQfooB0vVkaskjs8755GhkcwcvMIwECMikzlec/ # HdjdNhVfh6jGNtRtDlY8/sNrPDvzvN6w9kC1den9hQxocFzEbBA2IykSynScKg== # SIG # End signature block |