Engines/Terraform/Initialize-AvmTerraformPolicyStage.ps1
|
function Assert-AvmTerraformPolicyPath { [CmdletBinding()] param( [Parameter(Mandatory)] [string] $Path, [Parameter(Mandatory)] [string] $StageRoot ) $root = [System.IO.Path]::GetFullPath($StageRoot) $full = [System.IO.Path]::GetFullPath($Path) $relative = [System.IO.Path]::GetRelativePath($root, $full) if ([System.IO.Path]::IsPathRooted($relative) -or @($relative -split '[\\/]' | Where-Object { $_ -eq '..' }).Count -gt 0) { throw [AvmConfigurationException]::new( "Policy configuration '$full' is outside its isolated staging directory. Use module sources inside the repository or downloaded by Terraform.") } $current = $root foreach ($segment in @('.') + @($relative -split '[\\/]')) { $current = Join-Path $current $segment $item = Get-Item -LiteralPath $current -Force -ErrorAction Stop if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw [AvmConfigurationException]::new( "Policy configuration '$full' traverses a link. Use regular files in the isolated module tree so provider safeguards cannot change another scope.") } } } function Get-AvmTerraformPolicyEnvironment { [CmdletBinding()] [OutputType([hashtable])] param( [Parameter(Mandatory)] [string] $StageRoot, [hashtable] $Environment = @{} ) foreach ($name in @('TF_CLI_ARGS', 'TF_CLI_ARGS_init', 'TF_CLI_ARGS_providers', 'TF_CLI_ARGS_validate', 'TF_CLI_ARGS_plan', 'TF_CLI_ARGS_show')) { $value = if ($Environment.ContainsKey($name)) { $Environment[$name] } else { [Environment]::GetEnvironmentVariable($name) } if (-not [string]::IsNullOrWhiteSpace([string]$value)) { throw [AvmConfigurationException]::new( "Unset '$name' for policy checks; extra Terraform arguments can bypass isolated planning. Supply inputs through .tfvars or TF_VAR_* instead.") } } $result = @{} + $Environment $result.TF_DATA_DIR = Join-Path $StageRoot 'data' $result.ARM_SKIP_PROVIDER_REGISTRATION = 'true' $result.ARM_RESOURCE_PROVIDER_REGISTRATIONS = 'legacy' return $result } function Read-AvmTerraformPolicyConfiguration { [CmdletBinding()] [OutputType([pscustomobject])] param( [Parameter(Mandatory)] [string] $Path, [Parameter(Mandatory)] [string] $StageRoot, [Parameter(Mandatory)] [string] $ConftestPath ) Assert-AvmTerraformPolicyPath -Path $Path -StageRoot $StageRoot $directoryFiles = @(Get-ChildItem -LiteralPath $Path -File -Force | Where-Object { -not $_.Name.StartsWith('.') }) if (@($directoryFiles | Where-Object { $_.Name -cmatch '\.(tfquery|tfmigrate)\.(hcl|json)$' }).Count -gt 0) { throw [AvmConfigurationException]::new( "Policy configuration '$Path' contains query or state-migration files outside normal provider override precedence. Use a dedicated example without those files for policy checks.") } $files = @($directoryFiles | Where-Object { ($_.Name -clike '*.tf' -or $_.Name -clike '*.tf.json') -and -not $_.Name.EndsWith('~') }) $documents = [System.Collections.Generic.List[object]]::new() $hclFiles = @($files | Where-Object { $_.Name -clike '*.tf' }) foreach ($file in $files) { Assert-AvmTerraformPolicyPath -Path $file.FullName -StageRoot $StageRoot } if ($hclFiles.Count -gt 0) { $parsed = Invoke-AvmProcess -FilePath $ConftestPath ` -ArgumentList (@('parse', '--parser', 'hcl2', '--combine') + @($hclFiles.FullName)) ` -WorkingDirectory $Path -IgnoreExitCode if ($parsed.ExitCode -ne 0) { throw [AvmConfigurationException]::new( "Cannot parse Terraform configuration in '$Path' for provider-registration safeguards. Correct the HCL before retrying policy checks.") } try { $records = ConvertFrom-Json -InputObject $parsed.StdOut -AsHashtable -Depth 100 -NoEnumerate -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new("The HCL parser returned invalid JSON for '$Path'. Reinstall the configured Conftest tool.") } if ($records -isnot [array] -or $records.Count -ne $hclFiles.Count) { throw [AvmConfigurationException]::new("The HCL parser did not return every Terraform file in '$Path'. Policy planning is blocked.") } $remaining = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::Ordinal) foreach ($file in $hclFiles) { $null = $remaining.Add($file.FullName) } foreach ($record in $records) { if ($record -isnot [System.Collections.IDictionary] -or -not $record.Contains('path') -or -not $record.Contains('contents') -or $record.path -isnot [string] -or -not $remaining.Remove($record.path) -or $record.contents -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("The HCL parser returned an incomplete or ambiguous file set for '$Path'. Policy planning is blocked.") } $documents.Add($record.contents) } } foreach ($file in @($files | Where-Object { $_.Name -clike '*.tf.json' })) { try { $document = ConvertFrom-Json -InputObject ([System.IO.File]::ReadAllText($file.FullName)) -AsHashtable -Depth 100 -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new("Cannot parse Terraform JSON configuration '$($file.FullName)' for provider safeguards.") } if ($document -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Terraform JSON configuration '$($file.FullName)' must be an object.") } $documents.Add($document) } $sources = [System.Collections.Generic.Dictionary[string, string]]::new([System.StringComparer]::Ordinal) $providers = [System.Collections.Generic.Dictionary[string, object]]::new([System.StringComparer]::Ordinal) $hasModules = $false $hasBackend = $false foreach ($document in $documents) { if ($document.Contains('module')) { if ($document.module -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect module declarations in '$Path'. Correct the configuration before policy checks.") } if ($document.module.Count -gt 0) { $hasModules = $true } } if ($document.Contains('terraform')) { foreach ($terraform in @($document.terraform)) { if ($terraform -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect a Terraform block in '$Path' for provider safeguards.") } if ($terraform.Contains('backend') -or $terraform.Contains('cloud')) { $hasBackend = $true } if (-not $terraform.Contains('required_providers')) { continue } foreach ($requirements in @($terraform.required_providers)) { if ($requirements -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect required_providers in '$Path'. Use explicit provider source addresses.") } foreach ($name in $requirements.Keys) { $requirement = $requirements[$name] $source = "hashicorp/$name" if ($requirement -is [System.Collections.IDictionary] -and $requirement.Contains('source')) { if ($requirement.source -isnot [string] -or $requirement.source -cnotmatch '^(?:[a-zA-Z0-9.-]+/)?[a-zA-Z0-9-]+/[a-zA-Z0-9-]+$') { throw [AvmConfigurationException]::new("Provider '$name' in '$Path' must have a static source address for policy safeguards.") } $source = $requirement.source } if (($source -split '/').Count -eq 2) { $source = "registry.terraform.io/$source" } $source = $source.ToLowerInvariant() if ($sources.ContainsKey($name) -and $sources[$name] -cne $source) { throw [AvmConfigurationException]::new("Provider '$name' in '$Path' has conflicting source declarations. Consolidate them before policy checks.") } $sources[$name] = $source } } } } if (-not $document.Contains('provider')) { continue } if ($document.provider -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect provider blocks in '$Path'. Policy planning is blocked.") } foreach ($name in $document.provider.Keys) { foreach ($provider in @($document.provider[$name])) { if ($provider -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect provider '$name' in '$Path'. Policy planning is blocked.") } $alias = '' if ($provider.Contains('alias')) { if ($provider.alias -isnot [string] -or $provider.alias -cnotmatch '^[\p{L}_][\p{L}\p{N}_-]*$') { throw [AvmConfigurationException]::new("Provider '$name' in '$Path' must have a static alias for policy safeguards.") } $alias = $provider.alias } $key = "$name`0$alias" $configured = @($provider.Keys | Where-Object { $_ -cnotin @('alias', 'version') }).Count -gt 0 if ($providers.ContainsKey($key)) { $configured = $configured -or $providers[$key].Configured } $providers[$key] = [pscustomobject]@{ Name = $name; Alias = $alias; Configured = $configured } } } } return [pscustomobject]@{ Path = $Path Files = $files Sources = $sources Providers = @($providers.Values) HasModules = $hasModules HasBackend = $hasBackend } } function Get-AvmTerraformPolicyProviderSetting { [CmdletBinding()] [OutputType([hashtable])] param( [Parameter(Mandatory)] [string] $Payload ) try { $schema = ConvertFrom-Json -InputObject $Payload -AsHashtable -Depth 100 -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new('Terraform returned invalid provider schemas. Policy planning is blocked; reinitialize the configured providers.') } if ($schema -isnot [System.Collections.IDictionary] -or -not $schema.Contains('provider_schemas') -or $schema.provider_schemas -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new('Terraform did not return provider_schemas. Policy planning is blocked.') } $settings = @{} foreach ($address in $schema.provider_schemas.Keys) { $source = $address.ToLowerInvariant() $providerName = ($source -split '/')[-1] if ($providerName -notin @('azurerm', 'azapi')) { continue } if ($source -notin @('registry.terraform.io/hashicorp/azurerm', 'registry.terraform.io/azure/azapi')) { throw [AvmConfigurationException]::new("Policy checks cannot enforce automatic registration for '$address'. Use the official AzureRM or AzAPI provider source.") } $provider = $schema.provider_schemas[$address] if ($provider -isnot [System.Collections.IDictionary] -or -not $provider.Contains('provider') -or $provider.provider -isnot [System.Collections.IDictionary] -or -not $provider.provider.Contains('block') -or $provider.provider.block -isnot [System.Collections.IDictionary] -or -not $provider.provider.block.Contains('attributes') -or $provider.provider.block.attributes -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Provider '$address' has no inspectable configuration schema. Policy planning is blocked.") } $attributes = $provider.provider.block.attributes $required = @{ skip_provider_registration = 'bool' } $values = @{ skip_provider_registration = $true } if ($providerName -eq 'azurerm' -and $attributes.Contains('resource_provider_registrations')) { $required = @{ resource_provider_registrations = 'string'; resource_providers_to_register = @('list', 'string') } $values = @{ resource_provider_registrations = 'none'; resource_providers_to_register = @() } if ($attributes.Contains('skip_provider_registration')) { $required.skip_provider_registration = 'bool' $values.skip_provider_registration = $false } } foreach ($name in $required.Keys) { if (-not $attributes.Contains($name) -or $attributes[$name] -isnot [System.Collections.IDictionary] -or -not $attributes[$name].Contains('optional') -or $attributes[$name].optional -isnot [bool] -or -not $attributes[$name].optional -or -not $attributes[$name].Contains('type') -or (ConvertTo-Json -InputObject $attributes[$name].type -Compress) -cne (ConvertTo-Json -InputObject $required[$name] -Compress)) { throw [AvmConfigurationException]::new("Provider '$address' has an unsupported '$name' schema. Select a supported AzureRM/AzAPI version before policy checks.") } } $settings[$source] = $values } return $settings } function Set-AvmTerraformPolicyProviderOverride { [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Low')] param( [Parameter(Mandatory)] $Configuration, [Parameter(Mandatory)] [hashtable] $Settings ) $providers = [ordered]@{} foreach ($provider in $Configuration.Providers) { if (-not $provider.Configured) { continue } $source = if ($Configuration.Sources.ContainsKey($provider.Name)) { $Configuration.Sources[$provider.Name] } else { "registry.terraform.io/hashicorp/$($provider.Name)".ToLowerInvariant() } if (-not $Settings.ContainsKey($source)) { if (($source -split '/')[-1] -in @('azurerm', 'azapi')) { throw [AvmConfigurationException]::new("Provider '$($provider.Name)' in '$($Configuration.Path)' does not match a protected provider schema. Declare its official required_providers source.") } continue } $values = @{} + $Settings[$source] if ($provider.Alias) { $values.alias = $provider.Alias } if (-not $providers.Contains($provider.Name)) { $providers[$provider.Name] = @() } $providers[$provider.Name] += $values } if ($providers.Count -eq 0) { return } $lastName = '' $lastKey = '' foreach ($file in $Configuration.Files) { if ($file.Name -cnotmatch '(^override|_override)\.tf(\.json)?$') { continue } $key = [Convert]::ToHexString([System.Text.Encoding]::UTF8.GetBytes($file.Name)) if ([System.StringComparer]::Ordinal.Compare($key, $lastKey) -gt 0) { $lastName = $file.Name $lastKey = $key } } $name = if ($lastName) { "$lastName.avm_override.tf.json" } else { 'avm_provider_safety_override.tf.json' } $destination = Join-Path $Configuration.Path $name if ([System.Text.Encoding]::UTF8.GetByteCount($name) -gt 255 -or (Test-Path -LiteralPath $destination)) { throw [AvmConfigurationException]::new("Cannot create a final provider override in '$($Configuration.Path)'. Shorten or rename the authored override filenames.") } if (-not $PSCmdlet.ShouldProcess($destination, 'Disable automatic Azure provider registration in the staged policy configuration')) { throw [System.OperationCanceledException]::new('Policy provider safeguards were not approved; planning is blocked.') } $json = ConvertTo-Json -InputObject @{ provider = $providers } -Depth 20 [System.IO.File]::WriteAllText($destination, $json.ReplaceLineEndings("`n") + "`n", [System.Text.UTF8Encoding]::new($false)) } function Initialize-AvmTerraformPolicyStage { [CmdletBinding()] param( [Parameter(Mandatory)] [string] $WorkingDirectory, [Parameter(Mandatory)] [string] $StageRoot, [Parameter(Mandatory)] [string] $TerraformPath, [Parameter(Mandatory)] [string] $ConftestPath, [Parameter(Mandatory)] [hashtable] $EnvVars ) $root = Read-AvmTerraformPolicyConfiguration -Path $WorkingDirectory -StageRoot $StageRoot -ConftestPath $ConftestPath if ($root.HasBackend) { throw [AvmConfigurationException]::new( "Policy example '$WorkingDirectory' declares a backend or cloud execution. Use a local, backend-free example so provider safeguards are enforced in isolated staging.") } $null = Invoke-AvmTerraformInit -TerraformPath $TerraformPath -WorkingDirectory $WorkingDirectory ` -EnvVars $EnvVars -NoColor -SkipPluginCacheLock -PreserveDependencySelections ` -Label 'terraform init (policy safeguards)' $directories = @() $manifestPath = Join-Path -Path $EnvVars.TF_DATA_DIR -ChildPath 'modules' -AdditionalChildPath 'modules.json' if (Test-Path -LiteralPath $manifestPath -PathType Leaf) { Assert-AvmTerraformPolicyPath -Path $manifestPath -StageRoot $StageRoot $payload = [System.IO.File]::ReadAllText($manifestPath) $directories = @(ConvertFrom-AvmTerraformModuleManifest -Payload $payload -WorkingDirectory $WorkingDirectory) $manifest = ConvertFrom-Json -InputObject $payload -AsHashtable $rootRecord = @($manifest.Modules | Where-Object { $_.Key -ceq '' })[0] $manifestRoot = [System.IO.Path]::GetFullPath($rootRecord.Dir, $WorkingDirectory) if ([System.IO.Path]::GetRelativePath($WorkingDirectory, $manifestRoot) -cne '.') { throw [AvmConfigurationException]::new('The installed module manifest does not identify this isolated example as its root. Policy planning is blocked.') } } elseif ($root.HasModules) { throw [AvmConfigurationException]::new("Terraform did not produce an installed module manifest for '$WorkingDirectory'. Policy planning is blocked.") } $configurations = [System.Collections.Generic.List[object]]::new() $configurations.Add($root) foreach ($directory in $directories) { if ($directory -ceq $WorkingDirectory) { continue } $configurations.Add((Read-AvmTerraformPolicyConfiguration -Path $directory -StageRoot $StageRoot -ConftestPath $ConftestPath)) } $schema = Invoke-AvmProcess -FilePath $TerraformPath -ArgumentList @('providers', 'schema', '-json') ` -WorkingDirectory $WorkingDirectory -EnvVars $EnvVars -Label 'terraform provider schemas (policy safeguards)' $settings = Get-AvmTerraformPolicyProviderSetting -Payload $schema.StdOut $azureRm = 'registry.terraform.io/hashicorp/azurerm' # Implicit and inherited configurations use skip=true/legacy; explicit modern blocks use skip=false/none. if ($settings.ContainsKey($azureRm) -and -not $settings[$azureRm].ContainsKey('skip_provider_registration')) { $EnvVars.ARM_RESOURCE_PROVIDER_REGISTRATIONS = 'none' } foreach ($configuration in $configurations) { Set-AvmTerraformPolicyProviderOverride -Configuration $configuration -Settings $settings } $validation = Invoke-AvmProcess -FilePath $TerraformPath -ArgumentList @('validate', '-json') ` -WorkingDirectory $WorkingDirectory -EnvVars $EnvVars -Label 'terraform validate (policy safeguards)' -IgnoreExitCode try { $validated = ConvertFrom-Json -InputObject $validation.StdOut -AsHashtable -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new('Terraform returned invalid validation output after provider safeguards; policy planning is blocked.') } if ($validation.ExitCode -ne 0 -or $validated -isnot [System.Collections.IDictionary] -or -not $validated.Contains('valid') -or $validated.valid -isnot [bool] -or -not $validated.valid) { throw [AvmConfigurationException]::new( "Terraform configuration in '$WorkingDirectory' failed validation after provider safeguards. Run terraform validate on the source and correct the configuration; no policy plan was started.") } if ($settings.Count -gt 0) { Write-AvmLog 'policy: automatic AzureRM/AzAPI provider registration is disabled in the staged plan.' -Level Info | Out-Null } } # SIG # Begin signature block # MIInOQYJKoZIhvcNAQcCoIInKjCCJyYCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD4qjuY9OlUuiZ8 # PJVYxqum36JRIQutVegIeqoOEqBcJ6CCDMkwggYEMIID7KADAgECAhMzAAACHPrN # xZvoL37EAAAAAAIcMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQxWhcNMjcwNDE1MTg1 # OTQxWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDVsZfgOKmM31HPfoWOoNEiw0SlCiIxUMC0I9NMWbucKOw/e9lP # oAoehQVu6SG65V4EPzrYsnBnFPNoi4/HoOdjhz1qkrEt4I6tEcxXU6oOeY9zGveC # /3iBeuhLYxM3M/PkcUoebF+Nednm8OkdSPoDu8imViHPQq/8CQUu0WRR4rE+dMRf # rpVqfmNi2qWCX94T4MsepijGVkwE//tJg0ryAiYdHT34LSnlG/RSBZmQRGWZ5g8j # qnKjRParSqMft1gvjuUTVgtWNZfgcLFSK5Wa0myrq8OPcgTGGsRgun+tnSS+IxDT # xVsAPH1OzvPjwomguByhUe/OcvUN0D5Wmp7xAgMBAAGjggGqMIIBpjAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFNoH7a2YDjOSwpkp6DHcmUS7J+0yMFQGA1UdEQRNMEukSTBHMS0wKwYDVQQL # EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxFjAUBgNVBAUT # DTIzMDAxMis1MDc1NjkwHwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEw # YAYDVR0fBFkwVzBVoFOgUYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9w # cy9jcmwvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # bDBtBggrBgEFBQcBAQRhMF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmcl # MjBQQ0ElMjAyMDI0LmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IC # AQAUnEqhaRXe0T3hIJjvdQErEkrA/7bByjn6t5IArODkkRjzkYwtKMc2yYj2quaN # rLutWw2YZcngKPy1b71YyDJQTy4NDRwaSh9Tw5thrk3NmcPrAHia5vtcBJ1CgtKK # 7mQbIcQ22d/N3813ayCDDFewu1+jsZmX+r/aTEqaOM4TVxVtRSkuCy8nAXKuChOK # Li/zA4XuH8iEYqIsj2YoNaeSxVmeGiERXpKdo3dDmYi0kO5w2D8VS4c3+9h6gElY # BaAAg/dYErBg27qT3vv0zRDJhJufvCNylA8S7/+8H5E/PV5cng6na9VV/w9OV3qu # uND6zdGa2EX38Glp50F9AIQk3p2xXmcvorDeM4XJ7UlWYBi6g80J1SSOQnInCYFE # msfUNn3+1AaTJKSJL83quKArTac2pKhu0Yzzzrzo6HrsRiQKzpnRBb1/dMa6P3hz # 75XbMRBctNsFhZC07WCmjExdLg2eHW5uV0TY8D5+6wozJf7vF3+WHkYPO85Z+BC6 # U4FkNbYNycZ9cE4j1tXRdyDCfml6c0HWPHjNVDObrv9lKt3qUqFpX38VCqVCyNOO # 1UcXfQiVjJw32U2WUKZjt/neJKHEBsm9kFsLuWzkQ53+qcaSaytmsCnk2gOglrlD # 5d3kKyvvAw+rzm0lT8K38P6PLxfZQHhu4W8dV7Av8N2ZmDCCBr0wggSloAMCAQIC # EzMAAAA5O7Y3Gb8GHWcAAAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYT # AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS # b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoX # DTM2MDMyMjIyMTMwNFowVzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQ # Q0EgMjAyNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeq # lRYHNa265v4IY9fH8TKhemHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo # 0dtS/EW6I/yEL/bLSY8hKpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATv # QVL4tcf03aTycsz8QeCdM0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a # 1uv1zerOYMnsneRRwCbpyW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1 # FyQfK0fVkaya8SmVHQ/tOf23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfO # GSWHIIV4YrTJTT6PNty5REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7 # ttOu1bVnXfHaqPYl2rPs20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJ # uz2MXMCt7iw7lFPG9LXKGjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxS # CwyoGIq0PhaA7Y+VPct5pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOm # VQop36wUVUYklUy++vDWeEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3 # SkE/xIkgpfl22MM1itkZ35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8E # BAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPX # LQaUEggxMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMB # Af8wHwYDVR0jBBgwFoAUci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBP # oE2gS4ZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAw # TgYIKwYBBQUHMAKGQmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOC # AgEAFJQfOChP7onn6fLIMKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D # 5W4wMwYeLystcEqfkjz4NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBY # nbu0+THSuVHTe0VTTPVhily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSI # vgn0JksVBVMYVI5QFu/qhnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6 # aR9y34aiM1qmxaxBi6OUnyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4w # PKC5OmHm1DQIt/MNokbbH3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7 # RTX8AdBPo0I6OEojf39zuFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK # /fg8B2qjW88MT/WF5V5uvZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSK # YBv0VisCzfxgeU+dquXW9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkw # YTu/9dLeH2pDqeJZAABVDWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVT # Ql0v4q8J/AUmQN5W4n101cY2L4A7GTQG1h32HHAvfQESWP0xghnGMIIZwgIBATBu # MFcxCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # KDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIc # +s3Fm+gvfsQAAAAAAhwwDQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwG # CisGAQQBgjcCAQQwLwYJKoZIhvcNAQkEMSIEIPJXOd//RRCmXSZxVbqx8tH1gsj+ # sffOwxUkELkyb6jbMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBv # AGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAE # ggEAJL2+mOdzb3aveZ7eVBrzoTh9u8ARzWIKAyVoovVPt+HsyPSxfXVkxaBihsVv # NRdPtXaFUPU51tHNFy0IJ35m3D9r1Jex6JwM5x13SHj+AcS5C6bIwysvWqKJT7uH # k+H8E5oHAmuO7+2jNC5dewgclji6Z0g0cj0sQAwcUke7cEk3/xej6uEsV3iGShGu # 8WarBfJhtqXTfW++mld0eb2m/kEWz6yBmU9Z9PpvOXVk0guRbAtyPaPhTDpi9wfX # WA0W9+dvscJGV2xPr/73S9QAa0rZAbcASjChKAZB/j3puKlgUNP6GX6Bhb9bbCwp # Am8Qyc7znbJqDMkzcI1dirPp2qGCF5YwgheSBgorBgEEAYI3AwMBMYIXgjCCF34G # CSqGSIb3DQEHAqCCF28wghdrAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFRBgsqhkiG # 9w0BCRABBKCCAUAEggE8MIIBOAIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQC # AQUABCDI+MaYrw0/qGu5HfrGDqbZGyfLndqne8mpZkD2fJd7FQIGaqptLa10GBIy # MDI2MTAyNTExMjgyMi40NFowBIACAfSggdGkgc4wgcsxCzAJBgNVBAYTAlVTMRMw # EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN # aWNyb3NvZnQgQ29ycG9yYXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNh # IE9wZXJhdGlvbnMxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjo5NjAwLTA1RTAt # RDk0NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaCCEe0w # ggcgMIIFCKADAgECAhMzAAACJjW0PmdDk/YfAAEAAAImMA0GCSqGSIb3DQEBCwUA # MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS # ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMT # HU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTI2MDIxOTE5NDAwMloX # DTI3MDUxNzE5NDAwMlowgcsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5n # dG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9y # YXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMxJzAl # BgNVBAsTHm5TaGllbGQgVFNTIEVTTjo5NjAwLTA1RTAtRDk0NzElMCMGA1UEAxMc # TWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZTCCAiIwDQYJKoZIhvcNAQEBBQAD # ggIPADCCAgoCggIBAL//D5lkgvlEUWlUjwPdnK427wjNwAQ4PfQ4tiOHffuteNys # iU5LOklzhl5TETKWLrHoXrObg1Hx1s9v12IOn+E5TMdYbGIDVndFcoFv/gX+iPK8 # 3jdIQZapJ9VzcjcGWxhPfl5xUAn2RV/3Rg6/b20WMkEFmRi+tP8PDDJEuxw7I/in # 73+XImMP5QuzdhcGFWt9n4xtAH4FgoupG8EpuP/BH1qQ2szFAg2gZoPmNk783+dK # yYbY/XO/9y/iBKgwGdZ5AgGSN3YjnDUN5e6mna9KI2ZHmwDZmQErfKJBZom9HE4O # WR+LIeT0yST9OthOOaM8JuF766qEc1HLxSVs69awKrS1G1TKQe/f0OCoB8k2sTw5 # K3zfmsHMOmutwCHCaB+GhWLgAp6rCKRjSdRrjwrRDLzRdPh+IQDcTERk1pEWj02r # 8bBt+CoqoaZz3GEq5EVyO25rgodm+cC+laAQVI4KSi9ez8FwueQQcz3FnyJRqDkL # KE2pdhgT/PSlxd1ho0iRDrwRaa68ubuD2ih9Xa86bkZU2iCGeRYbqcY+j8nASCYD # 2hJLQR+8VExY8D+ClK8XeyECsoedoSlVJKLcM1vKK5iISz0qjQiRlzzEoV5BFqoZ # HGsH7av/sHdfzVOmz30qEXCD7APzuh3bYXYxSDXHu3C3eBpWcWTQhkjBQ8IbAgMB # AAGjggFJMIIBRTAdBgNVHQ4EFgQUXeGf19gk3Zj9n0tVsE8jEDNcexAwHwYDVR0j # BBgwFoAUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXwYDVR0fBFgwVjBUoFKgUIZOaHR0 # cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIwVGlt # ZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3JsMGwGCCsGAQUFBwEBBGAwXjBcBggr # BgEFBQcwAoZQaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9N # aWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcnQwDAYDVR0T # AQH/BAIwADAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8EBAMCB4Aw # DQYJKoZIhvcNAQELBQADggIBADZTHS2v2xgKOyrQVHKJWnHXk66s1e/pCTuJf4Ct # U+XPfDi2qNxM2bV23e1O5rbAkykmE8fyftReGZP3x3kO7jguXhp2ex7hJB9WDdAv # ppGRceclSfzL2J+0H8/Lbaf3GfA8V+PdCUM5KAu4eV673tTSIfZlqW5hptZcmKF2 # Jikrxw8cWWpk4CKi3T4YPx0/5Ey6+nG38XYuZh6WmhnCuKIU5SaXERRXvEkfJlmU # Oq6yR7K6rTUNO/3U3iozxx88+GX/alzgd4x/+d3Yei6J8lsNAU13hY+EvOfRLLe7 # VmHf5Le2NB2o353LDrRFpX5FcKg4uAVncwCD8agOX5+9vmHL/VrvVy1fzARp3U9/ # p15/amp+XfAVz76GQXwNddNmh8k3hhVo3cifBsAZAMOQ0riWp5wKLHGZIrCJ0/Kc # Z4Tk6282grWmQuyb+LwXVGMZzNn+RIXZUOSobzrqJD6NVsY5DoO7d7LIVwUpmgMn # gHmYQBL1pPZIqqWUt7Js5ugfqvruyJHkH/Yee7v4pi5hnLQERp20DqeAbhydJH0m # yuSGGwqZvXW6OrCAnI3H3YyygYbA2A3VojRAgPwKyMIXCl+YzOUDjjEcpi/eGaPF # 6oFLi5TmtB6ICdWCkl5pUYqb+XM8O2emkZX7teFGnlvVnFP9ntfFz4jsfv+MK1AN # mhplMIIHcTCCBVmgAwIBAgITMwAAABXF52ueAptJmQAAAAAAFTANBgkqhkiG9w0B # AQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNV # BAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEyMDAG # A1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTAw # HhcNMjEwOTMwMTgyMjI1WhcNMzAwOTMwMTgzMjI1WjB8MQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1T # dGFtcCBQQ0EgMjAxMDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOTh # pkzntHIhC3miy9ckeb0O1YLT/e6cBwfSqWxOdcjKNVf2AX9sSuDivbk+F2Az/1xP # x2b3lVNxWuJ+Slr+uDZnhUYjDLWNE893MsAQGOhgfWpSg0S3po5GawcU88V29YZQ # 3MFEyHFcUTE3oAo4bo3t1w/YJlN8OWECesSq/XJprx2rrPY2vjUmZNqYO7oaezOt # gFt+jBAcnVL+tuhiJdxqD89d9P6OU8/W7IVWTe/dvI2k45GPsjksUZzpcGkNyjYt # cI4xyDUoveO0hyTD4MmPfrVUj9z6BVWYbWg7mka97aSueik3rMvrg0XnRm7KMtXA # hjBcTyziYrLNueKNiOSWrAFKu75xqRdbZ2De+JKRHh09/SDPc31BmkZ1zcRfNN0S # idb9pSB9fvzZnkXftnIv231fgLrbqn427DZM9ituqBJR6L8FA6PRc6ZNN3SUHDSC # D/AQ8rdHGO2n6Jl8P0zbr17C89XYcz1DTsEzOUyOArxCaC4Q6oRRRuLRvWoYWmEB # c8pnol7XKHYC4jMYctenIPDC+hIK12NvDMk2ZItboKaDIV1fMHSRlJTYuVD5C4lh # 8zYGNRiER9vcG9H9stQcxWv2XFJRXRLbJbqvUAV6bMURHXLvjflSxIUXk8A8Fdsa # N8cIFRg/eKtFtvUeh17aj54WcmnGrnu3tz5q4i6tAgMBAAGjggHdMIIB2TASBgkr # BgEEAYI3FQEEBQIDAQABMCMGCSsGAQQBgjcVAgQWBBQqp1L+ZMSavoKRPEY1Kc8Q # /y8E7jAdBgNVHQ4EFgQUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXAYDVR0gBFUwUzBR # BgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNyb3Nv # ZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRtMBMGA1UdJQQMMAoGCCsG # AQUFBwMIMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsGA1UdDwQEAwIBhjAP # BgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNX2VsuP6KJcYmjRPZSQW9fOmhjE # MFYGA1UdHwRPME0wS6BJoEeGRWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kv # Y3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNybDBaBggrBgEF # BQcBAQROMEwwSgYIKwYBBQUHMAKGPmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9w # a2kvY2VydHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3J0MA0GCSqGSIb3DQEB # CwUAA4ICAQCdVX38Kq3hLB9nATEkW+Geckv8qW/qXBS2Pk5HZHixBpOXPTEztTnX # wnE2P9pkbHzQdTltuw8x5MKP+2zRoZQYIu7pZmc6U03dmLq2HnjYNi6cqYJWAAOw # Bb6J6Gngugnue99qb74py27YP0h1AdkY3m2CDPVtI1TkeFN1JFe53Z/zjj3G82jf # ZfakVqr3lbYoVSfQJL1AoL8ZthISEV09J+BAljis9/kpicO8F7BUhUKz/AyeixmJ # 5/ALaoHCgRlCGVJ1ijbCHcNhcy4sa3tuPywJeBTpkbKpW99Jo3QMvOyRgNI95ko+ # ZjtPu4b6MhrZlvSP9pEB9s7GdP32THJvEKt1MMU0sHrYUP4KWN1APMdUbZ1jdEgs # sU5HLcEUBHG/ZPkkvnNtyo4JvbMBV0lUZNlz138eW0QBjloZkWsNn6Qo3GcZKCS6 # OEuabvshVGtqRRFHqfG3rsjoiV5PndLQTHa1V1QJsWkBRH58oWFsc/4Ku+xBZj1p # /cvBQUl+fpO+y/g75LcVv7TOPqUxUYS8vwLBgqJ7Fx0ViY1w/ue10CgaiQuPNtq6 # TPmb/wrpNPgkNWcr4A245oyZ1uEi6vAnQj0llOZ0dFtq0Z4+7X6gMTN9vMvpe784 # cETRkPHIqzqKOghif9lwY1NNje6CbaUFEMFxBmoQtB1VM1izoXBm8qGCA1AwggI4 # AgEBMIH5oYHRpIHOMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv # bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0 # aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYD # VQQLEx5uU2hpZWxkIFRTUyBFU046OTYwMC0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1p # Y3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2WiIwoBATAHBgUrDgMCGgMVAKL98zEW # 2Sqvtcxd2xHJZTSVIodnoIGDMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgT # Cldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENB # IDIwMTAwDQYJKoZIhvcNAQELBQACBQDuiE9GMCIYDzIwMjYxMDI1MDk0OTU4WhgP # MjAyNjEwMjYwOTQ5NThaMHcwPQYKKwYBBAGEWQoEATEvMC0wCgIFAO6IT0YCAQAw # CgIBAAICGlECAf8wBwIBAAICEtEwCgIFAO6JoMYCAQAwNgYKKwYBBAGEWQoEAjEo # MCYwDAYKKwYBBAGEWQoDAqAKMAgCAQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG # 9w0BAQsFAAOCAQEAsf2WOGe+yZtaoyX72eWoq+QeyOoue5Qmsnc1V1bBcn16GRJN # dmjskRfZmrOHqD6+wRXJEkAQZ+xvTNyIgziNdalFpRhxhQTJWN9/Ljm5MMhxiGMj # Y+Guauo6oM+fpTBiMAwtjVRCFpqeV3Ul8RvE7eyZNS7A8OhuTkQujtOYPKYuDwd3 # CUXWfSU6nsayrF+NW9SncaOymuMXAookXx2+1H9AsuyXoIaCVlzUsFrGUhewt55y # nj7HFd4X92qcOvtrPwXS+og9aQ16YlcAWFoPGq4/LdKkvVYeUJ7BHBlYN4ZoW2CU # oRC7kMjfDmBT4ZCLAY72cimWyZUldFkDAISRljGCBA0wggQJAgEBMIGTMHwxCzAJ # BgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25k # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jv # c29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAACJjW0PmdDk/YfAAEAAAImMA0G # CWCGSAFlAwQCAQUAoIIBSjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwLwYJ # KoZIhvcNAQkEMSIEIOPeEQorlk4WE5ulTVulVbhT7Ulpl0suvRwufvEjBytoMIH6 # BgsqhkiG9w0BCRACLzGB6jCB5zCB5DCBvQQgzDJcYWdM2xlEGuzoY38FtXSiRo0/ # dUFiosWNSwWduCowgZgwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz # aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv # cnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAx # MAITMwAAAiY1tD5nQ5P2HwABAAACJjAiBCCxuFXkMAgx+yGOyFTh6wzr5GsFxeIc # kx24q/kz9RhrIDANBgkqhkiG9w0BAQsFAASCAgBiz3ShxjNNAG22SyzT+0/SZuk1 # Zhk7aRXEDoSSarpc1DmkVoh7kvb/Y+mC2F1OGdz7sr9Mnniy731g8sJyK4U7guu5 # s2jd9QA/4jRwM8JuljCkOm5+Xzq6/8GjTYvFz20KgCoho5ahX16wfMNnhnSO+Kyd # Pa+krnWmGUEsTSJqyqf3/j5a47nfl2HDDHHuG9GI1SMg6c/+lnCE2lk1+TpKdeRU # hDg68ZJTp6l8BoqHcISNLE4sYf9VF1V3QlgtKmHgJc++dQB2SYKEP+hBAzsNiDCF # wgM2YCNE7WIw0wv1AHSQmIKYJkY53TR15eS/tXQ9/I42forCchB+iWYuny+5Revz # agDbJfHG8EmXAqn8qzThYp78adyV/xrxui61eRpUuQGrNSM9Jq6cQOJszTz3SRl6 # qBUnW0CvLjyJHmd9TiFHM51j8NRTeu83NBCrSu8E3YsmSHxnyrYOtdJC/e9v93i7 # +Pzd2OgxpZFh5JyCLFCPU2yXEOVCI3tTHxgQc81NyxJeX7Cn8W9DCrnNsf2eGkUn # od8XznZEj7XyVLKu6BTodorq4IS1Egmm8fku18rcJEfLZ6KlKJcLSk1oKMUIQpOM # UrVe4P3iQHXWgk/Zc9Nt1bXeHbqYgO16EbuR/dVE2+oLm1Gxq/jH4wEQSqKyRdoP # U0AJY2K5Xc4Rwxs21A== # SIG # End signature block |