Engines/Terraform/Initialize-AvmTerraformPolicyStage.ps1
|
function Assert-AvmTerraformPolicyPath { [CmdletBinding()] param( [Parameter(Mandatory)] [string] $Path, [Parameter(Mandatory)] [string] $StageRoot ) $root = [System.IO.Path]::GetFullPath($StageRoot) $full = [System.IO.Path]::GetFullPath($Path) $relative = [System.IO.Path]::GetRelativePath($root, $full) if ([System.IO.Path]::IsPathRooted($relative) -or @($relative -split '[\\/]' | Where-Object { $_ -eq '..' }).Count -gt 0) { throw [AvmConfigurationException]::new( "Policy configuration '$full' is outside its isolated staging directory. Use module sources inside the repository or downloaded by Terraform.") } $current = $root foreach ($segment in @('.') + @($relative -split '[\\/]')) { $current = Join-Path $current $segment $item = Get-Item -LiteralPath $current -Force -ErrorAction Stop if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw [AvmConfigurationException]::new( "Policy configuration '$full' traverses a link. Use regular files in the isolated module tree so provider safeguards cannot change another scope.") } } } function Get-AvmTerraformPolicyEnvironment { [CmdletBinding()] [OutputType([hashtable])] param( [Parameter(Mandatory)] [string] $StageRoot, [hashtable] $Environment = @{} ) foreach ($name in @('TF_CLI_ARGS', 'TF_CLI_ARGS_init', 'TF_CLI_ARGS_providers', 'TF_CLI_ARGS_validate', 'TF_CLI_ARGS_plan', 'TF_CLI_ARGS_show')) { $value = if ($Environment.ContainsKey($name)) { $Environment[$name] } else { [Environment]::GetEnvironmentVariable($name) } if (-not [string]::IsNullOrWhiteSpace([string]$value)) { throw [AvmConfigurationException]::new( "Unset '$name' for policy checks; extra Terraform arguments can bypass isolated planning. Supply inputs through .tfvars or TF_VAR_* instead.") } } $result = @{} + $Environment $result.TF_DATA_DIR = Join-Path $StageRoot 'data' $result.ARM_SKIP_PROVIDER_REGISTRATION = 'true' $result.ARM_RESOURCE_PROVIDER_REGISTRATIONS = 'legacy' return $result } function Read-AvmTerraformPolicyConfiguration { [CmdletBinding()] [OutputType([pscustomobject])] param( [Parameter(Mandatory)] [string] $Path, [Parameter(Mandatory)] [string] $StageRoot, [Parameter(Mandatory)] [string] $ConftestPath ) Assert-AvmTerraformPolicyPath -Path $Path -StageRoot $StageRoot $directoryFiles = @(Get-ChildItem -LiteralPath $Path -File -Force | Where-Object { -not $_.Name.StartsWith('.') }) if (@($directoryFiles | Where-Object { $_.Name -cmatch '\.(tfquery|tfmigrate)\.(hcl|json)$' }).Count -gt 0) { throw [AvmConfigurationException]::new( "Policy configuration '$Path' contains query or state-migration files outside normal provider override precedence. Use a dedicated example without those files for policy checks.") } $files = @($directoryFiles | Where-Object { ($_.Name -clike '*.tf' -or $_.Name -clike '*.tf.json') -and -not $_.Name.EndsWith('~') }) $documents = [System.Collections.Generic.List[object]]::new() $hclFiles = @($files | Where-Object { $_.Name -clike '*.tf' }) foreach ($file in $files) { Assert-AvmTerraformPolicyPath -Path $file.FullName -StageRoot $StageRoot } if ($hclFiles.Count -gt 0) { $parsed = Invoke-AvmProcess -FilePath $ConftestPath ` -ArgumentList (@('parse', '--parser', 'hcl2', '--combine') + @($hclFiles.FullName)) ` -WorkingDirectory $Path -IgnoreExitCode if ($parsed.ExitCode -ne 0) { throw [AvmConfigurationException]::new( "Cannot parse Terraform configuration in '$Path' for provider-registration safeguards. Correct the HCL before retrying policy checks.") } try { $records = ConvertFrom-Json -InputObject $parsed.StdOut -AsHashtable -Depth 100 -NoEnumerate -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new("The HCL parser returned invalid JSON for '$Path'. Reinstall the configured Conftest tool.") } if ($records -isnot [array] -or $records.Count -ne $hclFiles.Count) { throw [AvmConfigurationException]::new("The HCL parser did not return every Terraform file in '$Path'. Policy planning is blocked.") } $remaining = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::Ordinal) foreach ($file in $hclFiles) { $null = $remaining.Add($file.FullName) } foreach ($record in $records) { if ($record -isnot [System.Collections.IDictionary] -or -not $record.Contains('path') -or -not $record.Contains('contents') -or $record.path -isnot [string] -or -not $remaining.Remove($record.path) -or $record.contents -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("The HCL parser returned an incomplete or ambiguous file set for '$Path'. Policy planning is blocked.") } $documents.Add($record.contents) } } foreach ($file in @($files | Where-Object { $_.Name -clike '*.tf.json' })) { try { $document = ConvertFrom-Json -InputObject ([System.IO.File]::ReadAllText($file.FullName)) -AsHashtable -Depth 100 -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new("Cannot parse Terraform JSON configuration '$($file.FullName)' for provider safeguards.") } if ($document -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Terraform JSON configuration '$($file.FullName)' must be an object.") } $documents.Add($document) } $sources = [System.Collections.Generic.Dictionary[string, string]]::new([System.StringComparer]::Ordinal) $providers = [System.Collections.Generic.Dictionary[string, object]]::new([System.StringComparer]::Ordinal) $hasModules = $false $hasBackend = $false foreach ($document in $documents) { if ($document.Contains('module')) { if ($document.module -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect module declarations in '$Path'. Correct the configuration before policy checks.") } if ($document.module.Count -gt 0) { $hasModules = $true } } if ($document.Contains('terraform')) { foreach ($terraform in @($document.terraform)) { if ($terraform -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect a Terraform block in '$Path' for provider safeguards.") } if ($terraform.Contains('backend') -or $terraform.Contains('cloud')) { $hasBackend = $true } if (-not $terraform.Contains('required_providers')) { continue } foreach ($requirements in @($terraform.required_providers)) { if ($requirements -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect required_providers in '$Path'. Use explicit provider source addresses.") } foreach ($name in $requirements.Keys) { $requirement = $requirements[$name] $source = "hashicorp/$name" if ($requirement -is [System.Collections.IDictionary] -and $requirement.Contains('source')) { if ($requirement.source -isnot [string] -or $requirement.source -cnotmatch '^(?:[a-zA-Z0-9.-]+/)?[a-zA-Z0-9-]+/[a-zA-Z0-9-]+$') { throw [AvmConfigurationException]::new("Provider '$name' in '$Path' must have a static source address for policy safeguards.") } $source = $requirement.source } if (($source -split '/').Count -eq 2) { $source = "registry.terraform.io/$source" } $source = $source.ToLowerInvariant() if ($sources.ContainsKey($name) -and $sources[$name] -cne $source) { throw [AvmConfigurationException]::new("Provider '$name' in '$Path' has conflicting source declarations. Consolidate them before policy checks.") } $sources[$name] = $source } } } } if (-not $document.Contains('provider')) { continue } if ($document.provider -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect provider blocks in '$Path'. Policy planning is blocked.") } foreach ($name in $document.provider.Keys) { foreach ($provider in @($document.provider[$name])) { if ($provider -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect provider '$name' in '$Path'. Policy planning is blocked.") } $alias = '' if ($provider.Contains('alias')) { if ($provider.alias -isnot [string] -or $provider.alias -cnotmatch '^[\p{L}_][\p{L}\p{N}_-]*$') { throw [AvmConfigurationException]::new("Provider '$name' in '$Path' must have a static alias for policy safeguards.") } $alias = $provider.alias } $key = "$name`0$alias" $configured = @($provider.Keys | Where-Object { $_ -cnotin @('alias', 'version') }).Count -gt 0 if ($providers.ContainsKey($key)) { $configured = $configured -or $providers[$key].Configured } $providers[$key] = [pscustomobject]@{ Name = $name; Alias = $alias; Configured = $configured } } } } return [pscustomobject]@{ Path = $Path Files = $files Sources = $sources Providers = @($providers.Values) HasModules = $hasModules HasBackend = $hasBackend } } function Get-AvmTerraformPolicyProviderSetting { [CmdletBinding()] [OutputType([hashtable])] param( [Parameter(Mandatory)] [string] $Payload ) try { $schema = ConvertFrom-Json -InputObject $Payload -AsHashtable -Depth 100 -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new('Terraform returned invalid provider schemas. Policy planning is blocked; reinitialize the configured providers.') } if ($schema -isnot [System.Collections.IDictionary] -or -not $schema.Contains('provider_schemas') -or $schema.provider_schemas -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new('Terraform did not return provider_schemas. Policy planning is blocked.') } $settings = @{} foreach ($address in $schema.provider_schemas.Keys) { $source = $address.ToLowerInvariant() $providerName = ($source -split '/')[-1] if ($providerName -notin @('azurerm', 'azapi')) { continue } if ($source -notin @('registry.terraform.io/hashicorp/azurerm', 'registry.terraform.io/azure/azapi')) { throw [AvmConfigurationException]::new("Policy checks cannot enforce automatic registration for '$address'. Use the official AzureRM or AzAPI provider source.") } $provider = $schema.provider_schemas[$address] if ($provider -isnot [System.Collections.IDictionary] -or -not $provider.Contains('provider') -or $provider.provider -isnot [System.Collections.IDictionary] -or -not $provider.provider.Contains('block') -or $provider.provider.block -isnot [System.Collections.IDictionary] -or -not $provider.provider.block.Contains('attributes') -or $provider.provider.block.attributes -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Provider '$address' has no inspectable configuration schema. Policy planning is blocked.") } $attributes = $provider.provider.block.attributes $required = @{ skip_provider_registration = 'bool' } $values = @{ skip_provider_registration = $true } if ($providerName -eq 'azurerm' -and $attributes.Contains('resource_provider_registrations')) { $required = @{ resource_provider_registrations = 'string'; resource_providers_to_register = @('list', 'string') } $values = @{ resource_provider_registrations = 'none'; resource_providers_to_register = @() } if ($attributes.Contains('skip_provider_registration')) { $required.skip_provider_registration = 'bool' $values.skip_provider_registration = $false } } foreach ($name in $required.Keys) { if (-not $attributes.Contains($name) -or $attributes[$name] -isnot [System.Collections.IDictionary] -or -not $attributes[$name].Contains('optional') -or $attributes[$name].optional -isnot [bool] -or -not $attributes[$name].optional -or -not $attributes[$name].Contains('type') -or (ConvertTo-Json -InputObject $attributes[$name].type -Compress) -cne (ConvertTo-Json -InputObject $required[$name] -Compress)) { throw [AvmConfigurationException]::new("Provider '$address' has an unsupported '$name' schema. Select a supported AzureRM/AzAPI version before policy checks.") } } $settings[$source] = $values } return $settings } function Set-AvmTerraformPolicyProviderOverride { [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Low')] param( [Parameter(Mandatory)] $Configuration, [Parameter(Mandatory)] [hashtable] $Settings ) $providers = [ordered]@{} foreach ($provider in $Configuration.Providers) { if (-not $provider.Configured) { continue } $source = if ($Configuration.Sources.ContainsKey($provider.Name)) { $Configuration.Sources[$provider.Name] } else { "registry.terraform.io/hashicorp/$($provider.Name)".ToLowerInvariant() } if (-not $Settings.ContainsKey($source)) { if (($source -split '/')[-1] -in @('azurerm', 'azapi')) { throw [AvmConfigurationException]::new("Provider '$($provider.Name)' in '$($Configuration.Path)' does not match a protected provider schema. Declare its official required_providers source.") } continue } $values = @{} + $Settings[$source] if ($provider.Alias) { $values.alias = $provider.Alias } if (-not $providers.Contains($provider.Name)) { $providers[$provider.Name] = @() } $providers[$provider.Name] += $values } if ($providers.Count -eq 0) { return } $lastName = '' $lastKey = '' foreach ($file in $Configuration.Files) { if ($file.Name -cnotmatch '(^override|_override)\.tf(\.json)?$') { continue } $key = [Convert]::ToHexString([System.Text.Encoding]::UTF8.GetBytes($file.Name)) if ([System.StringComparer]::Ordinal.Compare($key, $lastKey) -gt 0) { $lastName = $file.Name $lastKey = $key } } $name = if ($lastName) { "$lastName.avm_override.tf.json" } else { 'avm_provider_safety_override.tf.json' } $destination = Join-Path $Configuration.Path $name if ([System.Text.Encoding]::UTF8.GetByteCount($name) -gt 255 -or (Test-Path -LiteralPath $destination)) { throw [AvmConfigurationException]::new("Cannot create a final provider override in '$($Configuration.Path)'. Shorten or rename the authored override filenames.") } if (-not $PSCmdlet.ShouldProcess($destination, 'Disable automatic Azure provider registration in the staged policy configuration')) { throw [System.OperationCanceledException]::new('Policy provider safeguards were not approved; planning is blocked.') } $json = ConvertTo-Json -InputObject @{ provider = $providers } -Depth 20 [System.IO.File]::WriteAllText($destination, $json.ReplaceLineEndings("`n") + "`n", [System.Text.UTF8Encoding]::new($false)) } function Initialize-AvmTerraformPolicyStage { [CmdletBinding()] param( [Parameter(Mandatory)] [string] $WorkingDirectory, [Parameter(Mandatory)] [string] $StageRoot, [Parameter(Mandatory)] [string] $TerraformPath, [Parameter(Mandatory)] [string] $ConftestPath, [Parameter(Mandatory)] [hashtable] $EnvVars ) $root = Read-AvmTerraformPolicyConfiguration -Path $WorkingDirectory -StageRoot $StageRoot -ConftestPath $ConftestPath if ($root.HasBackend) { throw [AvmConfigurationException]::new( "Policy example '$WorkingDirectory' declares a backend or cloud execution. Use a local, backend-free example so provider safeguards are enforced in isolated staging.") } $null = Invoke-AvmTerraformInit -TerraformPath $TerraformPath -WorkingDirectory $WorkingDirectory ` -EnvVars $EnvVars -NoColor -SkipPluginCacheLock -PreserveDependencySelections ` -Label 'terraform init (policy safeguards)' $directories = @() $manifestPath = Join-Path -Path $EnvVars.TF_DATA_DIR -ChildPath 'modules' -AdditionalChildPath 'modules.json' if (Test-Path -LiteralPath $manifestPath -PathType Leaf) { Assert-AvmTerraformPolicyPath -Path $manifestPath -StageRoot $StageRoot $payload = [System.IO.File]::ReadAllText($manifestPath) $directories = @(ConvertFrom-AvmTerraformModuleManifest -Payload $payload -WorkingDirectory $WorkingDirectory) $manifest = ConvertFrom-Json -InputObject $payload -AsHashtable $rootRecord = @($manifest.Modules | Where-Object { $_.Key -ceq '' })[0] $manifestRoot = [System.IO.Path]::GetFullPath($rootRecord.Dir, $WorkingDirectory) if ([System.IO.Path]::GetRelativePath($WorkingDirectory, $manifestRoot) -cne '.') { throw [AvmConfigurationException]::new('The installed module manifest does not identify this isolated example as its root. Policy planning is blocked.') } } elseif ($root.HasModules) { throw [AvmConfigurationException]::new("Terraform did not produce an installed module manifest for '$WorkingDirectory'. Policy planning is blocked.") } $configurations = [System.Collections.Generic.List[object]]::new() $configurations.Add($root) foreach ($directory in $directories) { if ($directory -ceq $WorkingDirectory) { continue } $configurations.Add((Read-AvmTerraformPolicyConfiguration -Path $directory -StageRoot $StageRoot -ConftestPath $ConftestPath)) } $schema = Invoke-AvmProcess -FilePath $TerraformPath -ArgumentList @('providers', 'schema', '-json') ` -WorkingDirectory $WorkingDirectory -EnvVars $EnvVars -Label 'terraform provider schemas (policy safeguards)' $settings = Get-AvmTerraformPolicyProviderSetting -Payload $schema.StdOut $azureRm = 'registry.terraform.io/hashicorp/azurerm' # Implicit and inherited configurations use skip=true/legacy; explicit modern blocks use skip=false/none. if ($settings.ContainsKey($azureRm) -and -not $settings[$azureRm].ContainsKey('skip_provider_registration')) { $EnvVars.ARM_RESOURCE_PROVIDER_REGISTRATIONS = 'none' } foreach ($configuration in $configurations) { Set-AvmTerraformPolicyProviderOverride -Configuration $configuration -Settings $settings } $validation = Invoke-AvmProcess -FilePath $TerraformPath -ArgumentList @('validate', '-json') ` -WorkingDirectory $WorkingDirectory -EnvVars $EnvVars -Label 'terraform validate (policy safeguards)' -IgnoreExitCode try { $validated = ConvertFrom-Json -InputObject $validation.StdOut -AsHashtable -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new('Terraform returned invalid validation output after provider safeguards; policy planning is blocked.') } if ($validation.ExitCode -ne 0 -or $validated -isnot [System.Collections.IDictionary] -or -not $validated.Contains('valid') -or $validated.valid -isnot [bool] -or -not $validated.valid) { throw [AvmConfigurationException]::new( "Terraform configuration in '$WorkingDirectory' failed validation after provider safeguards. Run terraform validate on the source and correct the configuration; no policy plan was started.") } if ($settings.Count -gt 0) { Write-AvmLog 'policy: automatic AzureRM/AzAPI provider registration is disabled in the staged plan.' -Level Info | Out-Null } } # SIG # Begin signature block # MIInKAYJKoZIhvcNAQcCoIInGTCCJxUCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD4qjuY9OlUuiZ8 # PJVYxqum36JRIQutVegIeqoOEqBcJ6CCDLowggX1MIID3aADAgECAhMzAAACHU0Z # yE7XD1dIAAAAAAIdMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQzWhcNMjcwNDE1MTg1 # OTQzWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDQvewXxx9gZZFC6Ys1WBay8BJ8kGA4JQnH5CMafqOASlTpK9H8 # o5ZXTXt0caVQTNMUPt445wXYD+dFtaKWTwDn1I52oUSrC9vJin1Gsqt+zyKJL5Dg # 3eQXbQNR61DmMy20GLTIO3SFed9Rfi/ophgCLGFLDR3r0KvHjwMb/jYWS0celV/4 # Lz27LfAekm8v9E5IXaeiXbAUYZKK090n4CVl3JBtbN+9DtI9SNu/yjvozW52/u7R # X/Ttpa/KDlpuokZ+Zcbvmtd9ur9gFLvZzh41o9MsE/clQtdaFWGvuo6Jua/ntpgk # ey3E5/vBFe+MJPG6phdnuo6r57ZudCudiI1bAgMBAAGjggGbMIIBlzAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFH6QuMwqcPG0hQlQ6c5jCtTTLrVeMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQL # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDc1NTkw # HwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEwYAYDVR0fBFkwVzBVoFOg # UYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNybDBtBggrBgEFBQcBAQRh # MF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBKTbYOjzwTG/DXGaz9 # s6+fQeaTtDcFmMY+5UyVFCyj7Pv+5i37qfX8lSL/tBIfYQfWsMuBQlfZurJD6r4H # VJ2CeH+1fgiq8dcHdVKoZ3Sa2qXoX3cq9iS8cVb06B7+5/XJ7I0OxHH9fDsvJ3T3 # w5V/ZtAIFmLrl+P0CtG+92uzRsn0nTbdFjOkLMLWPLAU3THohKRlSEMgFJpPkm5n # 5UAZ35xX6FWCrDLsSKb555bTifwa8mJBwdlof0bmfYidH+dxZ1FdDxvLnNl9zeKs # A4kejaaIqqIPguhwAti5Ql7BlTNoJNwxCvBmqW2MQLnCkYN/VVUsR3V2x/rcTNzo # Bf/Z/SpROvdaA2ZOOd1uioXJt3tdLQ7vHpqpib0KfWr/FWXW10q38VxfCnRQBqzb # SuztR7nEMuzX7Ck+B/XaPDXd1qh72+QYyB0Z2VzWmO9zsnb9Uq/dwu8LGeQqnyu6 # 7SDGACvnXii2fb9+US492VTnXSnFKyqwgzUyFMtZK1/sHYTv6bG4TtQUygQxTN+Z # V+aJIlKO2MqZ7bKrAnOzS9m6NgoTdWOq11bTOZwKlIEV/EhV9SWkDmdpR/hPPT2v # 6TEj4F8PT/zHjRezIU5c/DGlt/VhY/pK0XkJtEyMmmS1BMtjU/rqBZVMIm3dnxQs # /TBByr+Cf8Z1r7aifQVQ+WSqzjCCBr0wggSloAMCAQICEzMAAAA5O7Y3Gb8GHWcA # AAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoXDTM2MDMyMjIyMTMwNFow # VzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEo # MCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAyNDCCAiIwDQYJ # KoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeqlRYHNa265v4IY9fH8TKh # emHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo0dtS/EW6I/yEL/bLSY8h # KpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATvQVL4tcf03aTycsz8QeCd # M0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a1uv1zerOYMnsneRRwCbp # yW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1FyQfK0fVkaya8SmVHQ/t # Of23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfOGSWHIIV4YrTJTT6PNty5 # REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7ttOu1bVnXfHaqPYl2rPs # 20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJuz2MXMCt7iw7lFPG9LXK # Gjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxSCwyoGIq0PhaA7Y+VPct5 # pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOmVQop36wUVUYklUy++vDW # eEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3SkE/xIkgpfl22MM1itkZ # 35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8EBAMCAYYwEAYJKwYBBAGC # NxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPXLQaUEggxMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU # ci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny # bC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAwTgYIKwYBBQUHMAKGQmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOCAgEAFJQfOChP7onn6fLI # MKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D5W4wMwYeLystcEqfkjz4 # NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBYnbu0+THSuVHTe0VTTPVh # ily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSIvgn0JksVBVMYVI5QFu/q # hnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6aR9y34aiM1qmxaxBi6OU # nyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4wPKC5OmHm1DQIt/MNokbb # H3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7RTX8AdBPo0I6OEojf39z # uFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK/fg8B2qjW88MT/WF5V5u # vZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSKYBv0VisCzfxgeU+dquXW # 9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkwYTu/9dLeH2pDqeJZAABV # DWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVTQl0v4q8J/AUmQN5W4n10 # 1cY2L4A7GTQG1h32HHAvfQESWP0xghnEMIIZwAIBATBuMFcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jv # c29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIdTRnITtcPV0gAAAAAAh0w # DQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwLwYJ # KoZIhvcNAQkEMSIEIPJXOd//RRCmXSZxVbqx8tH1gsj+sffOwxUkELkyb6jbMEIG # CisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAEggEAujetn5v/3zRYxj7b # NoPXGJfI18OpEnWM2n3qkQtfQHtGWMdMk+Ctmt3rGOgvIOFb2UDjO5cTfULiG5VK # fP85Ip1MuWiAZn5PYsk1/97ZVsy6pQQVrXXNC/ha+OYgg2qhgMgv73r+F3MciUBS # vM8dJFuJAUz4hau+YPAoNXmjAnIbbbh74fkLByhb6hbcMFzmcYBl8gdQswQbz+sM # XMJufya09oHud06v/yCq42h9FhUu4X+1GZQfGl3sTIHmGMCvWoBkqFBzWGVxTXdt # riuwUvHWcSeK4CnutEHZts0UPR7va0i3NggSfph3Vck4HErudq8izUCVdRpUu7Me # Pb+CoaGCF5QwgheQBgorBgEEAYI3AwMBMYIXgDCCF3wGCSqGSIb3DQEHAqCCF20w # ghdpAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFSBgsqhkiG9w0BCRABBKCCAUEEggE9 # MIIBOQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCBfdfdZumnQrXao # 10Nks/ADQsV18uqnsU6qEfDXzty1iAIGarfx3nASGBMyMDI2MTAxNTE5MDM0OS43 # NzJaMASAAgH0oIHRpIHOMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScw # JQYDVQQLEx5uU2hpZWxkIFRTUyBFU046MzMwMy0wNUUwLUQ5NDcxJTAjBgNVBAMT # HE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2WgghHqMIIHIDCCBQigAwIBAgIT # MwAAAiEzwDX70g8hpAABAAACITANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJV # UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE # ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGlt # ZS1TdGFtcCBQQ0EgMjAxMDAeFw0yNjAyMTkxOTM5NTRaFw0yNzA1MTcxOTM5NTRa # MIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQL # ExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxk # IFRTUyBFU046MzMwMy0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1l # LVN0YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDb # cTACqU1YvRocyWL2PL9fyf/+ULs2qK7U1aZsRnDZSnlCr7K7jgA3eFCEJL5BZ7dU # TC0DeZepf+ZC+7HEbB4IdzmJfQAUDFFerqY5VTHmQvP2XA3lWSFj740idcGUHglP # 5H/PbCJU7GAHWP2HdcCjdx1lYAo0A+zLI7xwnTQeMyOXX212Eg4UmDPPJgxdTMw6 # WFVWsBPWRBi5gDixy2s+7R8ADk5lbBBFDB5h0CjrNWIN7uCAzF5g7trrL8nXIKp1 # 0mj9RxhcGQ+tlht6VIvdygRVTUGdzFB2/nBvJqQ9kxxFltQST70fEdx4TyaKow/f # 5+BSh4z4/9f7NXIVVTLn/8kcJAfRqFmRrrFt3IKby7VrzmYuoQWD0lmNFtGQ57Br # JkPrPFAPek1ALtcbb7FH3nQpvi8ngz/MFX/+cnmNFWFU29VVLmzB9XvLZxbYvkee # tt0mh5lfteeN2rEwUyrdrKufz9h2S6pbate+C2h02CrXwSka0x6ezpTmGkIJLFt2 # 5ub/UYXNLdHdsxGD6EfckOIoJYsm4MS9F/vSqLNHK89I0vTLBngQEp6LIFkINanR # T3PtNx3pNKRKJRALc6L6mhW4hL4aHL749qPfQ72t5qAMm5xiKYMgJ2WanidRLNuI # 251JIN7raaeA/2vb0XFkZcIbTR1pfQGsco4U0g5tjwIDAQABo4IBSTCCAUUwHQYD # VR0OBBYEFOYjIs5qa6pfuquPyyK1FTr5QDCnMB8GA1UdIwQYMBaAFJ+nFV0AXmJd # g/Tl0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0El # MjAyMDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6 # Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGlt # ZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0l # AQH/BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUA # A4ICAQA4I/3bkdnTxD2rFum3MF8xVKdEkohAObbePrQ+0fr5bRimjz9sVkKT/7gc # j4OMcClSYG+IdX6Mp3EYsLHWfjvwfzFoeZE+yTbdBj/1VHZQRuCmw6QqeVCTbw2n # nS7nBxnWd9oZXbPUpqEawH5DqXQaWFgR9A4KWVK/IvXVDMj1PlPCES1P3JonNbdh # kkkz49rJuKOm5b7e/BH8loqAmXOXRc22yxWVTMWrEp4pslmv8eT7VoY8X/jdKYTP # VEXsfmLbVFcqzMuB8vFGfUyWsWROS8wgq7lQYfWcYqh7NymoATX+wWYK3zWG7aRc # iPGUAzznXdf+aHtIWnQLNa5HFmSXkiak3fSuprWYZiHhuYjE16hroApcBHpm+8S/ # kNqhm9WjQX+2BxnYv+Jejy6lqTi8fLBLS069WXVw/ptf5IV+FtYl34GvVoeg31Uo # UmVVZe1SDUJkm9dDXc8l/qBDYiAIT2CCsPTyt9XA9JVuHxdP63n7ChvWAO/47QRu # CDsUlFJoWwyBwl7jeYpaRVMtQt0iuJMGGjgEaJX1Q/2j8sXURvTceLHDD9ipWt09 # 2ZDWMQciDRmhHNFOX1dnjBvk/k1UMcg997j5oYznAnSpJvlg/4BP3aVE0h/YH2Kg # sKbU4NXZHAjJXj2Slqo1C115CG6qBZaFkM8W6vPZCm5qnSezOjCCB3EwggVZoAMC # AQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNV # BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w # HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29m # dCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEwMB4XDTIxMDkzMDE4MjIy # NVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp # bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw # b3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAw # ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDk4aZM57RyIQt5osvXJHm9 # DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25PhdgM/9cT8dm95VTcVrifkpa/rg2 # Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N # 7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6GnszrYBbfowQHJ1S/rboYiXc # ag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJ # j361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50ZuyjLVwIYwXE8s4mKyzbnijYjk # lqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3EXzTdEonW/aUgfX782Z5F37Zy # L9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M # 269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLX # pyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLU # HMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode # 2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEA # ATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYE # FJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARVMFMwUQYMKwYBBAGCN0yDfQEB # MEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # RG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAKBggrBgEFBQcDCDAZBgkrBgEE # AYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB # /zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEug # SaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9N # aWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsG # AQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jv # b0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt # 4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0xM7U518JxNj/aZGx80HU5bbsP # MeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmCVgADsAW+iehp4LoJ7nvfam++ # Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449xvNo32X2pFaq95W2KFUn0CS9 # QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wMnosZiefwC2qBwoEZQhlSdYo2 # wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aR # AfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2dY3RILLFORy3BFARxv2T5JL5z # bcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxnGSgkujhLmm77IVRrakURR6nx # t67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3 # Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokLjzbaukz5m/8K6TT4JDVnK+AN # uOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/Z # cGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggNNMIICNQIBATCB+aGB0aSBzjCB # yzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl # ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMc # TWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEnMCUGA1UECxMeblNoaWVsZCBU # U1MgRVNOOjMzMDMtMDVFMC1EOTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1T # dGFtcCBTZXJ2aWNloiMKAQEwBwYFKw4DAhoDFQALbEgZZnyYHXJ1DGb5fGjplXpt # uaCBgzCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw # DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # JjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMA0GCSqGSIb3 # DQEBCwUAAgUA7nt5ojAiGA8yMDI2MTAxNTE2MTExNFoYDzIwMjYxMDE2MTYxMTE0 # WjB0MDoGCisGAQQBhFkKBAExLDAqMAoCBQDue3miAgEAMAcCAQACAg28MAcCAQAC # AhMMMAoCBQDufMsiAgEAMDYGCisGAQQBhFkKBAIxKDAmMAwGCisGAQQBhFkKAwKg # CjAIAgEAAgMHoSChCjAIAgEAAgMBhqAwDQYJKoZIhvcNAQELBQADggEBAAySXSWt # GodB34/SsS1miDHufIQPBMaGhiDgLUzq7zVf1NRnTNdhpQWADQAtBxpwYd48lBps # xDSHXIDi9NC89oxzs6UPMdEUByWZuNg/UCFALGSoCpxqdgybnkfQWuP5EAqMs783 # lqT4bMO91MhZJF4FnS9mMp9KKau+2TNBv2AUquhrajgZ26PFexbPM5C11Zax13BT # VN/T9D2u9XSMvkiSGxX6wbJjhEVVvWWtBZVZArO6i3WAM6mJ5coprrFAmPegVizc # O/4tAhhrp9HM94B44ss24ev/mgWhgYwMVdpALVDcL9Jkb6zZL6Gpbrm9fJgMsSxQ # sRRhVINjpyejDh8xggQNMIIECQIBATCBkzB8MQswCQYDVQQGEwJVUzETMBEGA1UE # CBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9z # b2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQ # Q0EgMjAxMAITMwAAAiEzwDX70g8hpAABAAACITANBglghkgBZQMEAgEFAKCCAUow # GgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMC8GCSqGSIb3DQEJBDEiBCCyeApc # It1X19Pxv9lukEnw8keyUuNBIdt68FC5GCTC/TCB+gYLKoZIhvcNAQkQAi8xgeow # gecwgeQwgb0EIADvIQefFVUa4BJy8IZywMAvmGSKdUVqEmy9A++PCj1EMIGYMIGA # pH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT # B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UE # AxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAIhM8A1+9IPIaQA # AQAAAiEwIgQgzQ4ZkIPr0QRCu8Mbs1ndnmIGEgmF1u5GRTeAyT66u68wDQYJKoZI # hvcNAQELBQAEggIAaeU0Uwt0OxQ4eV0hvKX9A6iXBPtdGj+jXL23nkcp0r/Kq+WU # kBfoS2nP8c3WwTyyZhI+Aoo23kEC5k2RtgDfwP5AEgVnZXJoDVpzUvRMC5cF/r+6 # ogkT/Drwko3IkUiy4zQHqdYDx5cHItEExUF9rh/wwgF1gkrP8HuJjDf0sK6vbQjU # XMaWklY9ptssZFRB2XF/M0HTzYuWlY+yDXFrIaWbz+yXaUSt/YeZ4RRHrG/vnQiz # 45zA6IhgPn9ub/WIcsNg0fegsAKKNOqA30O6YQhSWwMWh+9ieBEzfT4q6d2IKBDn # x1XYhyUCd0BiPEqHzR5kaZqE8U9/L/t5ZP8wI/DnRLTjrZgYKq9/Rm75nGRxlZYn # XdCNjaKl7c49P5T0u8I1VHCBrM23oyLN3wdnqGbYZaYgj/2gxpk/y93e3u0MSFpA # HNfrw0EJeg9X9TUfBqg1ayYG9ku77LoS4bCdnyVOnuhpfS5na0AIGIC4+7qhNWQ+ # XVKA71vX9JemGsg6Evh0ZODVUT1KnoaGNlS+ks/eXj7sJuhizVMsmtteAaGV4CL+ # eSjoWpzrs6vQy8EgZ4IJYsUnkrA3Ak5F5a34JBQ3DO6/qEpb1OXDhyvXc9XfZbMG # PgIgt6BViV9JShqO+4bTkcZ8Sst2UnQ7YRiOdCqfM7rvigrbTPbWkVwDMDI= # SIG # End signature block |