Engines/Terraform/Initialize-AvmTerraformPolicyStage.ps1
|
function Assert-AvmTerraformPolicyPath { [CmdletBinding()] param( [Parameter(Mandatory)] [string] $Path, [Parameter(Mandatory)] [string] $StageRoot ) $root = [System.IO.Path]::GetFullPath($StageRoot) $full = [System.IO.Path]::GetFullPath($Path) $relative = [System.IO.Path]::GetRelativePath($root, $full) if ([System.IO.Path]::IsPathRooted($relative) -or @($relative -split '[\\/]' | Where-Object { $_ -eq '..' }).Count -gt 0) { throw [AvmConfigurationException]::new( "Policy configuration '$full' is outside its isolated staging directory. Use module sources inside the repository or downloaded by Terraform.") } $current = $root foreach ($segment in @('.') + @($relative -split '[\\/]')) { $current = Join-Path $current $segment $item = Get-Item -LiteralPath $current -Force -ErrorAction Stop if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw [AvmConfigurationException]::new( "Policy configuration '$full' traverses a link. Use regular files in the isolated module tree so provider safeguards cannot change another scope.") } } } function Get-AvmTerraformPolicyEnvironment { [CmdletBinding()] [OutputType([hashtable])] param( [Parameter(Mandatory)] [string] $StageRoot, [hashtable] $Environment = @{} ) foreach ($name in @('TF_CLI_ARGS', 'TF_CLI_ARGS_init', 'TF_CLI_ARGS_providers', 'TF_CLI_ARGS_validate', 'TF_CLI_ARGS_plan', 'TF_CLI_ARGS_show')) { $value = if ($Environment.ContainsKey($name)) { $Environment[$name] } else { [Environment]::GetEnvironmentVariable($name) } if (-not [string]::IsNullOrWhiteSpace([string]$value)) { throw [AvmConfigurationException]::new( "Unset '$name' for policy checks; extra Terraform arguments can bypass isolated planning. Supply inputs through .tfvars or TF_VAR_* instead.") } } $result = @{} + $Environment $result.TF_DATA_DIR = Join-Path $StageRoot 'data' $result.ARM_SKIP_PROVIDER_REGISTRATION = 'true' $result.ARM_RESOURCE_PROVIDER_REGISTRATIONS = 'legacy' return $result } function Read-AvmTerraformPolicyConfiguration { [CmdletBinding()] [OutputType([pscustomobject])] param( [Parameter(Mandatory)] [string] $Path, [Parameter(Mandatory)] [string] $StageRoot, [Parameter(Mandatory)] [string] $ConftestPath ) Assert-AvmTerraformPolicyPath -Path $Path -StageRoot $StageRoot $directoryFiles = @(Get-ChildItem -LiteralPath $Path -File -Force | Where-Object { -not $_.Name.StartsWith('.') }) if (@($directoryFiles | Where-Object { $_.Name -cmatch '\.(tfquery|tfmigrate)\.(hcl|json)$' }).Count -gt 0) { throw [AvmConfigurationException]::new( "Policy configuration '$Path' contains query or state-migration files outside normal provider override precedence. Use a dedicated example without those files for policy checks.") } $files = @($directoryFiles | Where-Object { ($_.Name -clike '*.tf' -or $_.Name -clike '*.tf.json') -and -not $_.Name.EndsWith('~') }) $documents = [System.Collections.Generic.List[object]]::new() $hclFiles = @($files | Where-Object { $_.Name -clike '*.tf' }) foreach ($file in $files) { Assert-AvmTerraformPolicyPath -Path $file.FullName -StageRoot $StageRoot } if ($hclFiles.Count -gt 0) { $parsed = Invoke-AvmProcess -FilePath $ConftestPath ` -ArgumentList (@('parse', '--parser', 'hcl2', '--combine') + @($hclFiles.FullName)) ` -WorkingDirectory $Path -IgnoreExitCode if ($parsed.ExitCode -ne 0) { throw [AvmConfigurationException]::new( "Cannot parse Terraform configuration in '$Path' for provider-registration safeguards. Correct the HCL before retrying policy checks.") } try { $records = ConvertFrom-Json -InputObject $parsed.StdOut -AsHashtable -Depth 100 -NoEnumerate -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new("The HCL parser returned invalid JSON for '$Path'. Reinstall the configured Conftest tool.") } if ($records -isnot [array] -or $records.Count -ne $hclFiles.Count) { throw [AvmConfigurationException]::new("The HCL parser did not return every Terraform file in '$Path'. Policy planning is blocked.") } $remaining = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::Ordinal) foreach ($file in $hclFiles) { $null = $remaining.Add($file.FullName) } foreach ($record in $records) { if ($record -isnot [System.Collections.IDictionary] -or -not $record.Contains('path') -or -not $record.Contains('contents') -or $record.path -isnot [string] -or -not $remaining.Remove($record.path) -or $record.contents -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("The HCL parser returned an incomplete or ambiguous file set for '$Path'. Policy planning is blocked.") } $documents.Add($record.contents) } } foreach ($file in @($files | Where-Object { $_.Name -clike '*.tf.json' })) { try { $document = ConvertFrom-Json -InputObject ([System.IO.File]::ReadAllText($file.FullName)) -AsHashtable -Depth 100 -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new("Cannot parse Terraform JSON configuration '$($file.FullName)' for provider safeguards.") } if ($document -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Terraform JSON configuration '$($file.FullName)' must be an object.") } $documents.Add($document) } $sources = [System.Collections.Generic.Dictionary[string, string]]::new([System.StringComparer]::Ordinal) $providers = [System.Collections.Generic.Dictionary[string, object]]::new([System.StringComparer]::Ordinal) $hasModules = $false $hasBackend = $false $mayRequireProviders = $false foreach ($document in $documents) { foreach ($key in $document.Keys) { if ($key -cnotin @('terraform', 'module', 'variable', 'locals', 'output', 'moved', 'removed')) { $mayRequireProviders = $true } } if ($document.Contains('removed')) { foreach ($removed in @($document.removed)) { if ($removed -isnot [System.Collections.IDictionary] -or -not $removed.Contains('from') -or $removed.from -isnot [string] -or [string]::IsNullOrWhiteSpace($removed.from) -or -not $removed.Contains('lifecycle') -or @($removed.Keys | Where-Object { $_ -cnotin @('from', 'lifecycle') }).Count -gt 0) { $mayRequireProviders = $true continue } $lifecycle = @($removed.lifecycle) if ($lifecycle.Count -ne 1 -or $lifecycle[0] -isnot [System.Collections.IDictionary] -or $lifecycle[0].Count -ne 1 -or -not $lifecycle[0].Contains('destroy') -or $lifecycle[0].destroy -isnot [bool] -or $lifecycle[0].destroy) { $mayRequireProviders = $true } } } if ($document.Contains('module')) { if ($document.module -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect module declarations in '$Path'. Correct the configuration before policy checks.") } if ($document.module.Count -gt 0) { $hasModules = $true } foreach ($module in $document.module.Values) { foreach ($call in @($module)) { if ($call -isnot [System.Collections.IDictionary] -or $call.Contains('providers')) { $mayRequireProviders = $true } } } } if ($document.Contains('terraform')) { foreach ($terraform in @($document.terraform)) { if ($terraform -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect a Terraform block in '$Path' for provider safeguards.") } if ($terraform.Contains('backend') -or $terraform.Contains('cloud')) { $hasBackend = $true } foreach ($key in $terraform.Keys) { if ($key -cnotin @('required_version', 'required_providers')) { $mayRequireProviders = $true } } if (-not $terraform.Contains('required_providers')) { continue } foreach ($requirements in @($terraform.required_providers)) { if ($requirements -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect required_providers in '$Path'. Use explicit provider source addresses.") } foreach ($name in $requirements.Keys) { $requirement = $requirements[$name] $source = "hashicorp/$name" if ($requirement -is [System.Collections.IDictionary] -and $requirement.Contains('source')) { if ($requirement.source -isnot [string] -or $requirement.source -cnotmatch '^(?:[a-zA-Z0-9.-]+/)?[a-zA-Z0-9-]+/[a-zA-Z0-9-]+$') { throw [AvmConfigurationException]::new("Provider '$name' in '$Path' must have a static source address for policy safeguards.") } $source = $requirement.source } if (($source -split '/').Count -eq 2) { $source = "registry.terraform.io/$source" } $source = $source.ToLowerInvariant() if ($sources.ContainsKey($name) -and $sources[$name] -cne $source) { throw [AvmConfigurationException]::new("Provider '$name' in '$Path' has conflicting source declarations. Consolidate them before policy checks.") } $sources[$name] = $source $mayRequireProviders = $true } } } } if (-not $document.Contains('provider')) { continue } if ($document.provider -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect provider blocks in '$Path'. Policy planning is blocked.") } foreach ($name in $document.provider.Keys) { foreach ($provider in @($document.provider[$name])) { if ($provider -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Cannot inspect provider '$name' in '$Path'. Policy planning is blocked.") } $alias = '' if ($provider.Contains('alias')) { if ($provider.alias -isnot [string] -or $provider.alias -cnotmatch '^[\p{L}_][\p{L}\p{N}_-]*$') { throw [AvmConfigurationException]::new("Provider '$name' in '$Path' must have a static alias for policy safeguards.") } $alias = $provider.alias } $key = "$name`0$alias" $configured = @($provider.Keys | Where-Object { $_ -cnotin @('alias', 'version') }).Count -gt 0 if ($providers.ContainsKey($key)) { $configured = $configured -or $providers[$key].Configured } $providers[$key] = [pscustomobject]@{ Name = $name; Alias = $alias; Configured = $configured } } } } return [pscustomobject]@{ Path = $Path Files = $files Sources = $sources Providers = @($providers.Values) HasModules = $hasModules HasBackend = $hasBackend MayRequireProviders = $mayRequireProviders } } function Get-AvmTerraformPolicyProviderSetting { [CmdletBinding()] [OutputType([hashtable])] param( [Parameter(Mandatory)] [string] $Payload, [switch] $ProviderFree, [string[]] $RequiredSources = @() ) try { $schema = ConvertFrom-Json -InputObject $Payload -AsHashtable -Depth 100 -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new('Terraform returned invalid provider schemas. Policy planning is blocked; reinitialize the configured providers.') } if ($schema -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new('Terraform did not return provider_schemas. Policy planning is blocked.') } if (-not $schema.Contains('provider_schemas') -or ($schema.provider_schemas -is [System.Collections.IDictionary] -and $schema.provider_schemas.Count -eq 0)) { if ($ProviderFree -and $RequiredSources.Count -eq 0 -and $schema.Contains('format_version') -and $schema.format_version -is [string] -and $schema.format_version -cmatch '^1\.[0-9]+$') { return @{} } throw [AvmConfigurationException]::new('Terraform did not return provider_schemas. Policy planning is blocked.') } if ($schema.provider_schemas -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new('Terraform did not return provider_schemas. Policy planning is blocked.') } foreach ($source in $RequiredSources) { if (-not $schema.provider_schemas.Contains($source)) { throw [AvmConfigurationException]::new("Terraform did not return the required provider schema for '$source'. Policy planning is blocked.") } } $settings = @{} foreach ($address in $schema.provider_schemas.Keys) { $source = $address.ToLowerInvariant() $providerName = ($source -split '/')[-1] if ($providerName -notin @('azurerm', 'azapi')) { continue } if ($source -notin @('registry.terraform.io/hashicorp/azurerm', 'registry.terraform.io/azure/azapi')) { throw [AvmConfigurationException]::new("Policy checks cannot enforce automatic registration for '$address'. Use the official AzureRM or AzAPI provider source.") } $provider = $schema.provider_schemas[$address] if ($provider -isnot [System.Collections.IDictionary] -or -not $provider.Contains('provider') -or $provider.provider -isnot [System.Collections.IDictionary] -or -not $provider.provider.Contains('block') -or $provider.provider.block -isnot [System.Collections.IDictionary] -or -not $provider.provider.block.Contains('attributes') -or $provider.provider.block.attributes -isnot [System.Collections.IDictionary]) { throw [AvmConfigurationException]::new("Provider '$address' has no inspectable configuration schema. Policy planning is blocked.") } $attributes = $provider.provider.block.attributes $required = @{ skip_provider_registration = 'bool' } $values = @{ skip_provider_registration = $true } if ($providerName -eq 'azurerm' -and $attributes.Contains('resource_provider_registrations')) { $required = @{ resource_provider_registrations = 'string'; resource_providers_to_register = @('list', 'string') } $values = @{ resource_provider_registrations = 'none'; resource_providers_to_register = @() } if ($attributes.Contains('skip_provider_registration')) { $required.skip_provider_registration = 'bool' $values.skip_provider_registration = $false } } foreach ($name in $required.Keys) { if (-not $attributes.Contains($name) -or $attributes[$name] -isnot [System.Collections.IDictionary] -or -not $attributes[$name].Contains('optional') -or $attributes[$name].optional -isnot [bool] -or -not $attributes[$name].optional -or -not $attributes[$name].Contains('type') -or (ConvertTo-Json -InputObject $attributes[$name].type -Compress) -cne (ConvertTo-Json -InputObject $required[$name] -Compress)) { throw [AvmConfigurationException]::new("Provider '$address' has an unsupported '$name' schema. Select a supported AzureRM/AzAPI version before policy checks.") } } $settings[$source] = $values } return $settings } function Set-AvmTerraformPolicyProviderOverride { [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Low')] param( [Parameter(Mandatory)] $Configuration, [Parameter(Mandatory)] [hashtable] $Settings ) $providers = [ordered]@{} foreach ($provider in $Configuration.Providers) { if (-not $provider.Configured) { continue } $source = if ($Configuration.Sources.ContainsKey($provider.Name)) { $Configuration.Sources[$provider.Name] } else { "registry.terraform.io/hashicorp/$($provider.Name)".ToLowerInvariant() } if (-not $Settings.ContainsKey($source)) { if (($source -split '/')[-1] -in @('azurerm', 'azapi')) { throw [AvmConfigurationException]::new("Provider '$($provider.Name)' in '$($Configuration.Path)' does not match a protected provider schema. Declare its official required_providers source.") } continue } $values = @{} + $Settings[$source] if ($provider.Alias) { $values.alias = $provider.Alias } if (-not $providers.Contains($provider.Name)) { $providers[$provider.Name] = @() } $providers[$provider.Name] += $values } if ($providers.Count -eq 0) { return } $lastName = '' $lastKey = '' foreach ($file in $Configuration.Files) { if ($file.Name -cnotmatch '(^override|_override)\.tf(\.json)?$') { continue } $key = [Convert]::ToHexString([System.Text.Encoding]::UTF8.GetBytes($file.Name)) if ([System.StringComparer]::Ordinal.Compare($key, $lastKey) -gt 0) { $lastName = $file.Name $lastKey = $key } } $name = if ($lastName) { "$lastName.avm_override.tf.json" } else { 'avm_provider_safety_override.tf.json' } $destination = Join-Path $Configuration.Path $name if ([System.Text.Encoding]::UTF8.GetByteCount($name) -gt 255 -or (Test-Path -LiteralPath $destination)) { throw [AvmConfigurationException]::new("Cannot create a final provider override in '$($Configuration.Path)'. Shorten or rename the authored override filenames.") } if (-not $PSCmdlet.ShouldProcess($destination, 'Disable automatic Azure provider registration in the staged policy configuration')) { throw [System.OperationCanceledException]::new('Policy provider safeguards were not approved; planning is blocked.') } $json = ConvertTo-Json -InputObject @{ provider = $providers } -Depth 20 [System.IO.File]::WriteAllText($destination, $json.ReplaceLineEndings("`n") + "`n", [System.Text.UTF8Encoding]::new($false)) } function Initialize-AvmTerraformPolicyStage { [CmdletBinding()] param( [Parameter(Mandatory)] [string] $WorkingDirectory, [Parameter(Mandatory)] [string] $StageRoot, [Parameter(Mandatory)] [string] $TerraformPath, [Parameter(Mandatory)] [string] $ConftestPath, [Parameter(Mandatory)] [hashtable] $EnvVars ) $root = Read-AvmTerraformPolicyConfiguration -Path $WorkingDirectory -StageRoot $StageRoot -ConftestPath $ConftestPath if ($root.HasBackend) { throw [AvmConfigurationException]::new( "Policy example '$WorkingDirectory' declares a backend or cloud execution. Use a local, backend-free example so provider safeguards are enforced in isolated staging.") } $null = Invoke-AvmTerraformInit -TerraformPath $TerraformPath -WorkingDirectory $WorkingDirectory ` -EnvVars $EnvVars -NoColor -SkipPluginCacheLock -PreserveDependencySelections ` -Label 'terraform init (policy safeguards)' $directories = @() $manifestPath = Join-Path -Path $EnvVars.TF_DATA_DIR -ChildPath 'modules' -AdditionalChildPath 'modules.json' if (Test-Path -LiteralPath $manifestPath -PathType Leaf) { Assert-AvmTerraformPolicyPath -Path $manifestPath -StageRoot $StageRoot $payload = [System.IO.File]::ReadAllText($manifestPath) $directories = @(ConvertFrom-AvmTerraformModuleManifest -Payload $payload -WorkingDirectory $WorkingDirectory) $manifest = ConvertFrom-Json -InputObject $payload -AsHashtable $rootRecord = @($manifest.Modules | Where-Object { $_.Key -ceq '' })[0] $manifestRoot = [System.IO.Path]::GetFullPath($rootRecord.Dir, $WorkingDirectory) if ([System.IO.Path]::GetRelativePath($WorkingDirectory, $manifestRoot) -cne '.') { throw [AvmConfigurationException]::new('The installed module manifest does not identify this isolated example as its root. Policy planning is blocked.') } } elseif ($root.HasModules) { throw [AvmConfigurationException]::new("Terraform did not produce an installed module manifest for '$WorkingDirectory'. Policy planning is blocked.") } $configurations = [System.Collections.Generic.List[object]]::new() $configurations.Add($root) foreach ($directory in $directories) { if ($directory -ceq $WorkingDirectory) { continue } $configurations.Add((Read-AvmTerraformPolicyConfiguration -Path $directory -StageRoot $StageRoot -ConftestPath $ConftestPath)) } $schema = Invoke-AvmProcess -FilePath $TerraformPath -ArgumentList @('providers', 'schema', '-json') ` -WorkingDirectory $WorkingDirectory -EnvVars $EnvVars -Label 'terraform provider schemas (policy safeguards)' $requiredSources = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) foreach ($configuration in $configurations) { foreach ($source in $configuration.Sources.Values) { $null = $requiredSources.Add($source) } foreach ($provider in $configuration.Providers) { $source = if ($configuration.Sources.ContainsKey($provider.Name)) { $configuration.Sources[$provider.Name] } else { "registry.terraform.io/hashicorp/$($provider.Name)".ToLowerInvariant() } $null = $requiredSources.Add($source) } } $providerFree = @($configurations | Where-Object { $_.MayRequireProviders }).Count -eq 0 $settings = Get-AvmTerraformPolicyProviderSetting -Payload $schema.StdOut -ProviderFree:$providerFree -RequiredSources @($requiredSources) $azureRm = 'registry.terraform.io/hashicorp/azurerm' # Implicit and inherited configurations use skip=true/legacy; explicit modern blocks use skip=false/none. if ($settings.ContainsKey($azureRm) -and -not $settings[$azureRm].ContainsKey('skip_provider_registration')) { $EnvVars.ARM_RESOURCE_PROVIDER_REGISTRATIONS = 'none' } foreach ($configuration in $configurations) { Set-AvmTerraformPolicyProviderOverride -Configuration $configuration -Settings $settings } $validation = Invoke-AvmProcess -FilePath $TerraformPath -ArgumentList @('validate', '-json') ` -WorkingDirectory $WorkingDirectory -EnvVars $EnvVars -Label 'terraform validate (policy safeguards)' -IgnoreExitCode try { $validated = ConvertFrom-Json -InputObject $validation.StdOut -AsHashtable -ErrorAction Stop } catch [System.ArgumentException] { throw [AvmConfigurationException]::new('Terraform returned invalid validation output after provider safeguards; policy planning is blocked.') } if ($validation.ExitCode -ne 0 -or $validated -isnot [System.Collections.IDictionary] -or -not $validated.Contains('valid') -or $validated.valid -isnot [bool] -or -not $validated.valid) { throw [AvmConfigurationException]::new( "Terraform configuration in '$WorkingDirectory' failed validation after provider safeguards. Run terraform validate on the source and correct the configuration; no policy plan was started.") } if ($settings.Count -gt 0) { Write-AvmLog 'policy: automatic AzureRM/AzAPI provider registration is disabled in the staged plan.' -Level Info | Out-Null } } # SIG # Begin signature block # MIInOQYJKoZIhvcNAQcCoIInKjCCJyYCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCwpC22vXurXzZm # xfmGKvOL0zDi5kErNtfDNQbDBaoWD6CCDMkwggYEMIID7KADAgECAhMzAAACHPrN # xZvoL37EAAAAAAIcMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQxWhcNMjcwNDE1MTg1 # OTQxWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDVsZfgOKmM31HPfoWOoNEiw0SlCiIxUMC0I9NMWbucKOw/e9lP # oAoehQVu6SG65V4EPzrYsnBnFPNoi4/HoOdjhz1qkrEt4I6tEcxXU6oOeY9zGveC # /3iBeuhLYxM3M/PkcUoebF+Nednm8OkdSPoDu8imViHPQq/8CQUu0WRR4rE+dMRf # rpVqfmNi2qWCX94T4MsepijGVkwE//tJg0ryAiYdHT34LSnlG/RSBZmQRGWZ5g8j # qnKjRParSqMft1gvjuUTVgtWNZfgcLFSK5Wa0myrq8OPcgTGGsRgun+tnSS+IxDT # xVsAPH1OzvPjwomguByhUe/OcvUN0D5Wmp7xAgMBAAGjggGqMIIBpjAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFNoH7a2YDjOSwpkp6DHcmUS7J+0yMFQGA1UdEQRNMEukSTBHMS0wKwYDVQQL # EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxFjAUBgNVBAUT # DTIzMDAxMis1MDc1NjkwHwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEw # YAYDVR0fBFkwVzBVoFOgUYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9w # cy9jcmwvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # bDBtBggrBgEFBQcBAQRhMF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmcl # MjBQQ0ElMjAyMDI0LmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IC # AQAUnEqhaRXe0T3hIJjvdQErEkrA/7bByjn6t5IArODkkRjzkYwtKMc2yYj2quaN # rLutWw2YZcngKPy1b71YyDJQTy4NDRwaSh9Tw5thrk3NmcPrAHia5vtcBJ1CgtKK # 7mQbIcQ22d/N3813ayCDDFewu1+jsZmX+r/aTEqaOM4TVxVtRSkuCy8nAXKuChOK # Li/zA4XuH8iEYqIsj2YoNaeSxVmeGiERXpKdo3dDmYi0kO5w2D8VS4c3+9h6gElY # BaAAg/dYErBg27qT3vv0zRDJhJufvCNylA8S7/+8H5E/PV5cng6na9VV/w9OV3qu # uND6zdGa2EX38Glp50F9AIQk3p2xXmcvorDeM4XJ7UlWYBi6g80J1SSOQnInCYFE # msfUNn3+1AaTJKSJL83quKArTac2pKhu0Yzzzrzo6HrsRiQKzpnRBb1/dMa6P3hz # 75XbMRBctNsFhZC07WCmjExdLg2eHW5uV0TY8D5+6wozJf7vF3+WHkYPO85Z+BC6 # U4FkNbYNycZ9cE4j1tXRdyDCfml6c0HWPHjNVDObrv9lKt3qUqFpX38VCqVCyNOO # 1UcXfQiVjJw32U2WUKZjt/neJKHEBsm9kFsLuWzkQ53+qcaSaytmsCnk2gOglrlD # 5d3kKyvvAw+rzm0lT8K38P6PLxfZQHhu4W8dV7Av8N2ZmDCCBr0wggSloAMCAQIC # EzMAAAA5O7Y3Gb8GHWcAAAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYT # AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS # b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoX # DTM2MDMyMjIyMTMwNFowVzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQ # Q0EgMjAyNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeq # lRYHNa265v4IY9fH8TKhemHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo # 0dtS/EW6I/yEL/bLSY8hKpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATv # QVL4tcf03aTycsz8QeCdM0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a # 1uv1zerOYMnsneRRwCbpyW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1 # FyQfK0fVkaya8SmVHQ/tOf23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfO # GSWHIIV4YrTJTT6PNty5REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7 # ttOu1bVnXfHaqPYl2rPs20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJ # uz2MXMCt7iw7lFPG9LXKGjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxS # CwyoGIq0PhaA7Y+VPct5pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOm # VQop36wUVUYklUy++vDWeEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3 # SkE/xIkgpfl22MM1itkZ35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8E # BAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPX # LQaUEggxMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMB # Af8wHwYDVR0jBBgwFoAUci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBP # oE2gS4ZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAw # TgYIKwYBBQUHMAKGQmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOC # AgEAFJQfOChP7onn6fLIMKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D # 5W4wMwYeLystcEqfkjz4NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBY # nbu0+THSuVHTe0VTTPVhily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSI # vgn0JksVBVMYVI5QFu/qhnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6 # aR9y34aiM1qmxaxBi6OUnyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4w # PKC5OmHm1DQIt/MNokbbH3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7 # RTX8AdBPo0I6OEojf39zuFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK # /fg8B2qjW88MT/WF5V5uvZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSK # YBv0VisCzfxgeU+dquXW9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkw # YTu/9dLeH2pDqeJZAABVDWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVT # Ql0v4q8J/AUmQN5W4n101cY2L4A7GTQG1h32HHAvfQESWP0xghnGMIIZwgIBATBu # MFcxCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # KDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIc # +s3Fm+gvfsQAAAAAAhwwDQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwG # CisGAQQBgjcCAQQwLwYJKoZIhvcNAQkEMSIEINbcATpk/UnOY++R9iULHnM+0P1Q # oqwdKtWq6NLQI4h8MEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBv # AGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAE # ggEAt1EIYIf1Fql9kb9jOALff+kycm6fovMXV8Mxq4gLYgAPncsgUhn7ohFVCpqC # g8t9VHd9nkVdavr+gMZdCfMMamNHVgDbuGc4IQgnBIV0WRUlbnV8WYzAhjj0t/c9 # GgVND7OfYkyfixitumUoMerMR+NWia++zxSCfQVTtd5Qw31S+3kwryY1loqPZUAq # mcm83oE7V/gibHJ9ZsTYNZjxsUPTlcd3rZ+3AoCJq0FFvMkUm1pR/3JXtiwB9TN4 # K7JRLSxBaxnZCRVEqVOV6qb/QLX9UbkRurcJ9NddxSJDfmfccMUlStM8VcpbxWAN # htkMalraH/uMNyft7M1DRjJhDKGCF5YwgheSBgorBgEEAYI3AwMBMYIXgjCCF34G # CSqGSIb3DQEHAqCCF28wghdrAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFRBgsqhkiG # 9w0BCRABBKCCAUAEggE8MIIBOAIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQC # AQUABCB1gAZqAKvHisjXnQiBE8OW6CaiNb3hk+WONAVAN/fbtwIGarf1vbceGBIy # MDI2MTEwMzE0MjA0OC41MlowBIACAfSggdGkgc4wgcsxCzAJBgNVBAYTAlVTMRMw # EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN # aWNyb3NvZnQgQ29ycG9yYXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNh # IE9wZXJhdGlvbnMxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjozMzAzLTA1RTAt # RDk0NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaCCEe0w # ggcgMIIFCKADAgECAhMzAAACITPANfvSDyGkAAEAAAIhMA0GCSqGSIb3DQEBCwUA # MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS # ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMT # HU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTI2MDIxOTE5Mzk1NFoX # DTI3MDUxNzE5Mzk1NFowgcsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5n # dG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9y # YXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMxJzAl # BgNVBAsTHm5TaGllbGQgVFNTIEVTTjozMzAzLTA1RTAtRDk0NzElMCMGA1UEAxMc # TWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZTCCAiIwDQYJKoZIhvcNAQEBBQAD # ggIPADCCAgoCggIBANtxMAKpTVi9GhzJYvY8v1/J//5QuzaortTVpmxGcNlKeUKv # sruOADd4UIQkvkFnt1RMLQN5l6l/5kL7scRsHgh3OYl9ABQMUV6upjlVMeZC8/Zc # DeVZIWPvjSJ1wZQeCU/kf89sIlTsYAdY/Yd1wKN3HWVgCjQD7MsjvHCdNB4zI5df # bXYSDhSYM88mDF1MzDpYVVawE9ZEGLmAOLHLaz7tHwAOTmVsEEUMHmHQKOs1Yg3u # 4IDMXmDu2usvydcgqnXSaP1HGFwZD62WG3pUi93KBFVNQZ3MUHb+cG8mpD2THEWW # 1BJPvR8R3HhPJoqjD9/n4FKHjPj/1/s1chVVMuf/yRwkB9GoWZGusW3cgpvLtWvO # Zi6hBYPSWY0W0ZDnsGsmQ+s8UA96TUAu1xtvsUfedCm+LyeDP8wVf/5yeY0VYVTb # 1VUubMH1e8tnFti+R5623SaHmV+1543asTBTKt2sq5/P2HZLqltq174LaHTYKtfB # KRrTHp7OlOYaQgksW3bm5v9Rhc0t0d2zEYPoR9yQ4igliybgxL0X+9Kos0crz0jS # 9MsGeBASnosgWQg1qdFPc+03Hek0pEolEAtzovqaFbiEvhocvvj2o99Dva3moAyb # nGIpgyAnZZqeJ1Es24jbnUkg3utpp4D/a9vRcWRlwhtNHWl9AaxyjhTSDm2PAgMB # AAGjggFJMIIBRTAdBgNVHQ4EFgQU5iMizmprql+6q4/LIrUVOvlAMKcwHwYDVR0j # BBgwFoAUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXwYDVR0fBFgwVjBUoFKgUIZOaHR0 # cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIwVGlt # ZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3JsMGwGCCsGAQUFBwEBBGAwXjBcBggr # BgEFBQcwAoZQaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9N # aWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcnQwDAYDVR0T # AQH/BAIwADAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8EBAMCB4Aw # DQYJKoZIhvcNAQELBQADggIBADgj/duR2dPEPasW6bcwXzFUp0SSiEA5tt4+tD7R # +vltGKaPP2xWQpP/uByPg4xwKVJgb4h1foyncRiwsdZ+O/B/MWh5kT7JNt0GP/VU # dlBG4KbDpCp5UJNvDaedLucHGdZ32hlds9SmoRrAfkOpdBpYWBH0DgpZUr8i9dUM # yPU+U8IRLU/cmic1t2GSSTPj2sm4o6blvt78EfyWioCZc5dFzbbLFZVMxasSnimy # Wa/x5PtWhjxf+N0phM9URex+YttUVyrMy4Hy8UZ9TJaxZE5LzCCruVBh9ZxiqHs3 # KagBNf7BZgrfNYbtpFyI8ZQDPOdd1/5oe0hadAs1rkcWZJeSJqTd9K6mtZhmIeG5 # iMTXqGugClwEemb7xL+Q2qGb1aNBf7YHGdi/4l6PLqWpOLx8sEtLTr1ZdXD+m1/k # hX4W1iXfga9Wh6DfVShSZVVl7VINQmSb10NdzyX+oENiIAhPYIKw9PK31cD0lW4f # F0/refsKG9YA7/jtBG4IOxSUUmhbDIHCXuN5ilpFUy1C3SK4kwYaOARolfVD/aPy # xdRG9Nx4scMP2Kla3T3ZkNYxByINGaEc0U5fV2eMG+T+TVQxyD33uPmhjOcCdKkm # +WD/gE/dpUTSH9gfYqCwptTg1dkcCMlePZKWqjULXXkIbqoFloWQzxbq89kKbmqd # J7M6MIIHcTCCBVmgAwIBAgITMwAAABXF52ueAptJmQAAAAAAFTANBgkqhkiG9w0B # AQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNV # BAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEyMDAG # A1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTAw # HhcNMjEwOTMwMTgyMjI1WhcNMzAwOTMwMTgzMjI1WjB8MQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1T # dGFtcCBQQ0EgMjAxMDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOTh # pkzntHIhC3miy9ckeb0O1YLT/e6cBwfSqWxOdcjKNVf2AX9sSuDivbk+F2Az/1xP # x2b3lVNxWuJ+Slr+uDZnhUYjDLWNE893MsAQGOhgfWpSg0S3po5GawcU88V29YZQ # 3MFEyHFcUTE3oAo4bo3t1w/YJlN8OWECesSq/XJprx2rrPY2vjUmZNqYO7oaezOt # gFt+jBAcnVL+tuhiJdxqD89d9P6OU8/W7IVWTe/dvI2k45GPsjksUZzpcGkNyjYt # cI4xyDUoveO0hyTD4MmPfrVUj9z6BVWYbWg7mka97aSueik3rMvrg0XnRm7KMtXA # hjBcTyziYrLNueKNiOSWrAFKu75xqRdbZ2De+JKRHh09/SDPc31BmkZ1zcRfNN0S # idb9pSB9fvzZnkXftnIv231fgLrbqn427DZM9ituqBJR6L8FA6PRc6ZNN3SUHDSC # D/AQ8rdHGO2n6Jl8P0zbr17C89XYcz1DTsEzOUyOArxCaC4Q6oRRRuLRvWoYWmEB # c8pnol7XKHYC4jMYctenIPDC+hIK12NvDMk2ZItboKaDIV1fMHSRlJTYuVD5C4lh # 8zYGNRiER9vcG9H9stQcxWv2XFJRXRLbJbqvUAV6bMURHXLvjflSxIUXk8A8Fdsa # N8cIFRg/eKtFtvUeh17aj54WcmnGrnu3tz5q4i6tAgMBAAGjggHdMIIB2TASBgkr # BgEEAYI3FQEEBQIDAQABMCMGCSsGAQQBgjcVAgQWBBQqp1L+ZMSavoKRPEY1Kc8Q # /y8E7jAdBgNVHQ4EFgQUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXAYDVR0gBFUwUzBR # BgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNyb3Nv # ZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRtMBMGA1UdJQQMMAoGCCsG # AQUFBwMIMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsGA1UdDwQEAwIBhjAP # BgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNX2VsuP6KJcYmjRPZSQW9fOmhjE # MFYGA1UdHwRPME0wS6BJoEeGRWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kv # Y3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNybDBaBggrBgEF # BQcBAQROMEwwSgYIKwYBBQUHMAKGPmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9w # a2kvY2VydHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3J0MA0GCSqGSIb3DQEB # CwUAA4ICAQCdVX38Kq3hLB9nATEkW+Geckv8qW/qXBS2Pk5HZHixBpOXPTEztTnX # wnE2P9pkbHzQdTltuw8x5MKP+2zRoZQYIu7pZmc6U03dmLq2HnjYNi6cqYJWAAOw # Bb6J6Gngugnue99qb74py27YP0h1AdkY3m2CDPVtI1TkeFN1JFe53Z/zjj3G82jf # ZfakVqr3lbYoVSfQJL1AoL8ZthISEV09J+BAljis9/kpicO8F7BUhUKz/AyeixmJ # 5/ALaoHCgRlCGVJ1ijbCHcNhcy4sa3tuPywJeBTpkbKpW99Jo3QMvOyRgNI95ko+ # ZjtPu4b6MhrZlvSP9pEB9s7GdP32THJvEKt1MMU0sHrYUP4KWN1APMdUbZ1jdEgs # sU5HLcEUBHG/ZPkkvnNtyo4JvbMBV0lUZNlz138eW0QBjloZkWsNn6Qo3GcZKCS6 # OEuabvshVGtqRRFHqfG3rsjoiV5PndLQTHa1V1QJsWkBRH58oWFsc/4Ku+xBZj1p # /cvBQUl+fpO+y/g75LcVv7TOPqUxUYS8vwLBgqJ7Fx0ViY1w/ue10CgaiQuPNtq6 # TPmb/wrpNPgkNWcr4A245oyZ1uEi6vAnQj0llOZ0dFtq0Z4+7X6gMTN9vMvpe784 # cETRkPHIqzqKOghif9lwY1NNje6CbaUFEMFxBmoQtB1VM1izoXBm8qGCA1AwggI4 # AgEBMIH5oYHRpIHOMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv # bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0 # aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYD # VQQLEx5uU2hpZWxkIFRTUyBFU046MzMwMy0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1p # Y3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2WiIwoBATAHBgUrDgMCGgMVAAtsSBlm # fJgdcnUMZvl8aOmVem25oIGDMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgT # Cldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENB # IDIwMTAwDQYJKoZIhvcNAQELBQACBQDuk91iMCIYDzIwMjYxMTAzMDQxMTE0WhgP # MjAyNjExMDQwNDExMTRaMHcwPQYKKwYBBAGEWQoEATEvMC0wCgIFAO6T3WICAQAw # CgIBAAICNjgCAf8wBwIBAAICElowCgIFAO6VLuICAQAwNgYKKwYBBAGEWQoEAjEo # MCYwDAYKKwYBBAGEWQoDAqAKMAgCAQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG # 9w0BAQsFAAOCAQEAHWj3lFfWW3NtsFwj7cuNNkzEBLO61y/qFx7zzvp5nr/GlLEL # 9EVlKX4SyptZanLjDH2MRM3TIKWW9CCWRPU5qJGjLJfuVGtZMKqtC69IHJeJwX6t # aQ3+jP61UAm33gVZcQJ2YtDpN5uh+h60ffDhOk2/TmyPMrsihvwEmE2IDIkbbP/P # Uwfvz8h+57NxtKLnBvJ4zokWxeYmR2aKJ7B46qN+jLxyCZHFcDaOGkhrScWmIm72 # ce8WglQPmk8FaEhzmIyBqGYECTommplsxGV3vVtdwdJLxga6hgpkp4K1u9xv0MAj # j25sGmoAn3hyg03hIkqctnGCdMSriEB6YYbnljGCBA0wggQJAgEBMIGTMHwxCzAJ # BgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25k # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jv # c29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAACITPANfvSDyGkAAEAAAIhMA0G # CWCGSAFlAwQCAQUAoIIBSjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwLwYJ # KoZIhvcNAQkEMSIEIA6IqrWR43tkrsKI0v0b8kUj3YsMfq5C0+ii3J5cqWUVMIH6 # BgsqhkiG9w0BCRACLzGB6jCB5zCB5DCBvQQgAO8hB58VVRrgEnLwhnLAwC+YZIp1 # RWoSbL0D748KPUQwgZgwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz # aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv # cnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAx # MAITMwAAAiEzwDX70g8hpAABAAACITAiBCD2NmAxLCuMxxOMydyjIzk7FqjujDU0 # RDYq0TValGrknDANBgkqhkiG9w0BAQsFAASCAgBwJCl6wUzAyMyaoJGjxtKTLsrS # 1Jn3oqTkFL9SETuq9LDD5Et1KNTElzirajE2j8YTYXSMs8kd4BZqlyby9EbZiQZG # AsDbRGOJIjtb9pH2ieLwCVHNk1U4fLgqLDjrXO0BLplhjFLPo9vCQ+fxCFO5Tf6z # TrZghkCmnfii9EfYVACcrJOKfoZb7sA9mTJO9Bgz0wIpSO3QyAtqQ2fHcieFoWZW # hJAWNnCl0BHaiSu77e3W4CiQfqb1f3dbl6tEAEEcqmujdha1Pk/TnXAicL9PStT6 # cmsZMJ8GqWvSct6DPuILVxy8o7Wka6rOgTIfXckR5pJu47EFxWLFh75SATyakHiS # unWlDRIE83YJj4gSoncBNUwK72xBHe/0mdH9VvleOY5reyeqtTtP+5BgwDaoTUtI # KZV7fvFV5EyzCLe3cg6ZEl/fKjoPKmuyehgzMFahGubYmG14fepgE/ZGP8wS6+ym # Oppw4D2Mv3JupKvAaj/vNh0JjZsoquYT8lcG++oKwmlNlyMOHTLpNkZOSNZ2jKQF # u63x5GqcNpO5QTA3KmolOM2CJrp7VnlSdylF7WfuvKmCblIovykCDc4GyErXZerd # WnO91t0y82SP1HX0mz1Rp4FLmfy/wMq9NO4m0eIdFnjj4qUMWpOrHAMopp0EqNOz # u7CgbTtDcW7myNh3yA== # SIG # End signature block |