AzStackHci.EnvironmentChecker

1.2100.2627.343

AzStackHciConnectivity/TestXmlSigning.ps1

                                <###################################################

 #                                                 #

 #  Copyright (c) Microsoft. All rights reserved.  #

 #                                                 #

 ##################################################>

<#

.DESCRIPTION

    Ensure XML is signed by Microsoft.

.PARAMETER XmlPath

    Path to XML File

.EXAMPLE

    .\BuildEndpointTargets.ps1 -TargetDirectory .

    Build XML from all json services under current directory (.)

#>

[CmdletBinding()]

param (

    [Parameter()]

    [System.String]

    $XmlPath

)

function Test-XMLSignatureByMicrosoft

{

    [CmdletBinding()]

    param (

        [Parameter(Mandatory = $true)]

        [System.String]

        $XmlPath

    )

    # Read the xml file so we can test the signature.

    try

    {

        $XmlDocument = New-Object -TypeName System.Xml.XmlDocument

        $XmlDocument.PreserveWhitespace = $true

        $xmlTextReader = New-Object -TypeName System.Xml.XmlTextReader -ArgumentList $XmlPath

        $XmlDocument.Load($xmlTextReader)

        $xmlTextReader.Dispose()

    }

    catch

    {

        throw ($LocalizedStrings.OEMMetadataInvalid -f $XmlPath)

    }

    $validSignature = $false

    $isSignedByMicrosoft = $false

    Write-Verbose "Testing $XmlPath"

    $signatures = $XmlDocument.GetElementsByTagName('Signature')

    if (-not [System.String]::IsNullOrEmpty($signatures))

    {

        foreach($signature in $signatures)

        {

            # Get the signed XML to validate the signature.

            Add-Type -AssemblyName System.Security

            $signedXml = New-Object System.Security.Cryptography.Xml.SignedXml -ArgumentList $XmlDocument

            $signedXml.LoadXml([System.Xml.XmlElement]$signature)

            $x509certificates = $signature.KeyInfo.x509Data

            if (-not [System.String]::IsNullOrEmpty($x509certificates))

            {

                # Find the signing certificate, and add intermediate certificate to enable disconnected validation

                foreach($x509certificate in $x509certificates.X509Certificate)

                {

                    $certBytes = [System.Convert]::FromBase64String($x509certificate)

                    $certificate = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList $certBytes,$null

                    Write-Verbose $certificate.Thumbprint

                    if ($signedXml.CheckSignature($certificate,$true))

                    {

                        # This is the signing certificate

                        Write-Verbose "This is the signing certificate $($certificate.Thumbprint)"

                        Write-Verbose "$XmlPath,$($certificate.Thumbprint)"

                        $signingCertificate = $certificate

                    }

                    elseif (Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq $certificate.Thumbprint})

                    {

                        # This is an existing trusted root

                        Write-Verbose "This is an existing trusted root $($certificate.Thumbprint)"

                    }

                    else

                    {

                        # This is not the signing certificate or an existing trusted root, add it to Intermediate CAs...

                        # ...this allows IsMicrosoftCertificate and x509Chain.Build to function, even when disconnected.

                        Write-Verbose "$($certificate.Thumbprint)"

                        if (Get-ChildItem -Path Cert:\LocalMachine\CA | Where-Object {$_.Thumbprint -eq $certificate.Thumbprint})

                        {

                            Write-Verbose "existing $($certificate.Thumbprint)"

                        }

                        else

                        {

                            Write-Verbose "Add $($certificate.Thumbprint)"

                            $x509Store = New-Object System.Security.Cryptography.X509Certificates.X509Store('CA','LocalMachine')

                            $x509Store.Open('ReadWrite')

                            $x509Store.Add($certificate)

                            $x509Store.Dispose()

                        }

                    }

                }

                # Test that the signing certificate is a trusted certificate.

                if ($signingCertificate)

                {

                    if (Test-MicrosoftCertificate -Certificate $signingCertificate)

                    {

                        Write-Verbose "Valid and msft $XmlPath,$($signingCertificate.Thumbprint)"

                        $validSignature = $true

                        $isSignedByMicrosoft = $true

                    }

                    elseif (Test-AlternateRoot -Certificate $signingCertificate)

                    {

                        Write-Verbose "Alt $XmlPath,$($signingCertificate.Thumbprint)"

                        $validSignature = $true

                        $isSignedByMicrosoft = $true

                    }

                    else

                    {

                        Write-Warning "Untrusted $XmlPath,$($signingCertificate.Thumbprint)"

                    }

                }

                else

                {

                    # We did not find a signing certificate, so the signature is not valid.

                    Write-Verbose "Invalid $XmlPath"

                }

            }

        }

    }

    else

    {

        Write-Warning ($LocalizedStrings.OEMPackageUnsigned -f $XmlPath)

    }

    # Fail if the package is unsigned or the signature is invalid or untrusted.

    if (-not $validSignature)

    {

        throw ("OEMPackageInvalid -f $XmlPath")

    }

    return $isSignedByMicrosoft

}

# this function is based on code from PowerShellGet

function Test-MicrosoftCertificate

{

    [CmdletBinding()]

    [OutputType([System.Boolean])]

    param (

        [Parameter(Mandatory = $true)]

        [System.Security.Cryptography.X509Certificates.X509Certificate2]

        $Certificate

    )

    try

    {

        $requiredAssembly = @( [System.Management.Automation.PSCmdlet].Assembly.FullName,

                               [System.Net.IWebProxy].Assembly.FullName,

                               [System.Uri].Assembly.FullName )

        $source = @"

using System;

using System.Net;

using System.Management.Automation;

using Microsoft.Win32.SafeHandles;

using System.Security.Cryptography;

using System.Runtime.InteropServices;

namespace Microsoft.PowerShell.CodeSigning

{

    [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]

    public struct CERT_CHAIN_POLICY_PARA {

        public CERT_CHAIN_POLICY_PARA(int size) {

            cbSize = (uint) size;

            dwFlags = 0;

            pvExtraPolicyPara = IntPtr.Zero;

        }

        public uint   cbSize;

        public uint   dwFlags;

        public IntPtr pvExtraPolicyPara;

    }

    [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]

    public struct CERT_CHAIN_POLICY_STATUS {

        public CERT_CHAIN_POLICY_STATUS(int size) {

            cbSize = (uint) size;

            dwError = 0;

            lChainIndex = IntPtr.Zero;

            lElementIndex = IntPtr.Zero;

            pvExtraPolicyStatus = IntPtr.Zero;

        }

        public uint   cbSize;

        public uint   dwError;

        public IntPtr lChainIndex;

        public IntPtr lElementIndex;

        public IntPtr pvExtraPolicyStatus;

    }

    public class Helper

    {

        [DllImport("Crypt32.dll", CharSet=CharSet.Auto, SetLastError=true)]

        public extern static

        bool CertVerifyCertificateChainPolicy(

            [In]     IntPtr                       pszPolicyOID,

            [In]     SafeX509ChainHandle pChainContext,

            [In]     ref CERT_CHAIN_POLICY_PARA   pPolicyPara,

            [In,Out] ref CERT_CHAIN_POLICY_STATUS pPolicyStatus);

        [DllImport("Crypt32.dll", CharSet=CharSet.Auto, SetLastError=true)]

        public static extern

        SafeX509ChainHandle CertDuplicateCertificateChain(

            [In]     IntPtr pChainContext);

        public static bool IsMicrosoftCertificate([In] SafeX509ChainHandle pChainContext)

        {

            const uint MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG       = 0x00010000;

            CERT_CHAIN_POLICY_PARA PolicyPara = new CERT_CHAIN_POLICY_PARA(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_PARA)));

            CERT_CHAIN_POLICY_STATUS PolicyStatus = new CERT_CHAIN_POLICY_STATUS(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_STATUS)));

            int CERT_CHAIN_POLICY_MICROSOFT_ROOT = 7;

            PolicyPara.dwFlags = (uint) MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG;

            if(!CertVerifyCertificateChainPolicy(new IntPtr(CERT_CHAIN_POLICY_MICROSOFT_ROOT),

                                                 pChainContext,

                                                 ref PolicyPara,

                                                 ref PolicyStatus))

            {

                return false;

            }

            return (PolicyStatus.dwError == 0);

        }

    }

}

"@

        Add-Type -ReferencedAssemblies $requiredAssembly -TypeDefinition $source -Language CSharp -ErrorAction Stop

    }

    catch

    {

        Write-Verbose "Error $($_.ToString())"

        return $false

    }

    try

    {

        $X509Chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain

        $null = $X509Chain.Build($Certificate)

    }

    catch

    {

        Write-Verbose "eror $($_.ToString())"

        return $false

    }

    $SafeX509ChainHandle = [Microsoft.PowerShell.CodeSigning.Helper]::CertDuplicateCertificateChain($X509Chain.ChainContext)

    return [Microsoft.PowerShell.CodeSigning.Helper]::IsMicrosoftCertificate($SafeX509ChainHandle)

}

function Test-AlternateRoot

{

    [CmdletBinding()]

    [OutputType([System.Boolean])]

    Param (

        [Parameter(Mandatory = $true)]

        [System.Security.Cryptography.X509Certificates.X509Certificate2]

        $Certificate,

        # Alternate roots are select Microsoft roots published here --> https://www.microsoft.com/pkiops/docs/repository.htm

        [System.String[]]

        $AlternateRoots = @(

            '8F43288AD272F3103B6FB1428485EA3014C0BCFE'

            '3B1EFD3A66EA28B16697394703A72CA340A05BD5'

        )

    )

    $result = $false

    $x509Chain = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Chain

    $null = $x509Chain.Build($Certificate)

    foreach ($alternateRoot in $AlternateRoots)

    {

        if ($x509Chain.ChainElements.Certificate[-1].Thumbprint -eq $alternateRoot)

        {

            $result = $true

        }

    }

    return $result

}

Test-XMLSignatureByMicrosoft -XmlPath $XmlPath

# SIG # Begin signature block

# MIInzgYJKoZIhvcNAQcCoIInvzCCJ7sCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBfHGnPgodyxRpv

# G/St++7Y0eIwAbuTLv/kEWu2O2T3TKCCDYUwggYDMIID66ADAgECAhMzAAADri01

# UchTj1UdAAAAAAOuMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD

# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p

# bmcgUENBIDIwMTEwHhcNMjMxMTE2MTkwODU5WhcNMjQxMTE0MTkwODU5WjB0MQsw

# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u

# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB

# AQD0IPymNjfDEKg+YyE6SjDvJwKW1+pieqTjAY0CnOHZ1Nj5irGjNZPMlQ4HfxXG

# yAVCZcEWE4x2sZgam872R1s0+TAelOtbqFmoW4suJHAYoTHhkznNVKpscm5fZ899

# QnReZv5WtWwbD8HAFXbPPStW2JKCqPcZ54Y6wbuWV9bKtKPImqbkMcTejTgEAj82

# 6GQc6/Th66Koka8cUIvz59e/IP04DGrh9wkq2jIFvQ8EDegw1B4KyJTIs76+hmpV

# M5SwBZjRs3liOQrierkNVo11WuujB3kBf2CbPoP9MlOyyezqkMIbTRj4OHeKlamd

# WaSFhwHLJRIQpfc8sLwOSIBBAgMBAAGjggGCMIIBfjAfBgNVHSUEGDAWBgorBgEE

# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUhx/vdKmXhwc4WiWXbsf0I53h8T8w

# VAYDVR0RBE0wS6RJMEcxLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJh

# dGlvbnMgTGltaXRlZDEWMBQGA1UEBRMNMjMwMDEyKzUwMTgzNjAfBgNVHSMEGDAW

# gBRIbmTlUAXTgqoXNzcitW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8v

# d3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIw

# MTEtMDctMDguY3JsMGEGCCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDov

# L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDEx

# XzIwMTEtMDctMDguY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIB

# AGrJYDUS7s8o0yNprGXRXuAnRcHKxSjFmW4wclcUTYsQZkhnbMwthWM6cAYb/h2W

# 5GNKtlmj/y/CThe3y/o0EH2h+jwfU/9eJ0fK1ZO/2WD0xi777qU+a7l8KjMPdwjY

# 0tk9bYEGEZfYPRHy1AGPQVuZlG4i5ymJDsMrcIcqV8pxzsw/yk/O4y/nlOjHz4oV

# APU0br5t9tgD8E08GSDi3I6H57Ftod9w26h0MlQiOr10Xqhr5iPLS7SlQwj8HW37

# ybqsmjQpKhmWul6xiXSNGGm36GarHy4Q1egYlxhlUnk3ZKSr3QtWIo1GGL03hT57

# xzjL25fKiZQX/q+II8nuG5M0Qmjvl6Egltr4hZ3e3FQRzRHfLoNPq3ELpxbWdH8t

# Nuj0j/x9Crnfwbki8n57mJKI5JVWRWTSLmbTcDDLkTZlJLg9V1BIJwXGY3i2kR9i

# 5HsADL8YlW0gMWVSlKB1eiSlK6LmFi0rVH16dde+j5T/EaQtFz6qngN7d1lvO7uk

# 6rtX+MLKG4LDRsQgBTi6sIYiKntMjoYFHMPvI/OMUip5ljtLitVbkFGfagSqmbxK

# 7rJMhC8wiTzHanBg1Rrbff1niBbnFbbV4UDmYumjs1FIpFCazk6AADXxoKCo5TsO

# zSHqr9gHgGYQC2hMyX9MGLIpowYCURx3L7kUiGbOiMwaMIIHejCCBWKgAwIBAgIK

# YQ6Q0gAAAAAAAzANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNV

# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv

# c29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlm

# aWNhdGUgQXV0aG9yaXR5IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEw

# OTA5WjB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE

# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYD

# VQQDEx9NaWNyb3NvZnQgQ29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG

# 9w0BAQEFAAOCAg8AMIICCgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+la

# UKq4BjgaBEm6f8MMHt03a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc

# 6Whe0t+bU7IKLMOv2akrrnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4D

# dato88tt8zpcoRb0RrrgOGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+

# lD3v++MrWhAfTVYoonpy4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nk

# kDstrjNYxbc+/jLTswM9sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6

# A4aN91/w0FK/jJSHvMAhdCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmd

# X4jiJV3TIUs+UsS1Vz8kA/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL

# 5zmhD+kjSbwYuER8ReTBw3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zd

# sGbiwZeBe+3W7UvnSSmnEyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3

# T8HhhUSJxAlMxdSlQy90lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS

# 4NaIjAsCAwEAAaOCAe0wggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRI

# bmTlUAXTgqoXNzcitW2oynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAL

# BgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBD

# uRQFTuHqp8cx0SOJNDBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jv

# c29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf

# MDNfMjIuY3JsMF4GCCsGAQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3

# dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf

# MDNfMjIuY3J0MIGfBgNVHSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEF

# BQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1h

# cnljcHMuaHRtMEAGCCsGAQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkA

# YwB5AF8AcwB0AGEAdABlAG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn

# 8oalmOBUeRou09h0ZyKbC5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7

# v0epo/Np22O/IjWll11lhJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0b

# pdS1HXeUOeLpZMlEPXh6I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/

# KmtYSWMfCWluWpiW5IP0wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvy

# CInWH8MyGOLwxS3OW560STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBp

# mLJZiWhub6e3dMNABQamASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJi

# hsMdYzaXht/a8/jyFqGaJ+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYb

# BL7fQccOKO7eZS/sl/ahXJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbS

# oqKfenoi+kiVH6v7RyOA9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sL

# gOppO6/8MO0ETI7f33VtY5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtX

# cVZOSEXAQsmbdlsKgEhr/Xmfwb1tbWrJUnMTDXpQzTGCGZ8wghmbAgEBMIGVMH4x

# CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt

# b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01p

# Y3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTECEzMAAAOuLTVRyFOPVR0AAAAA

# A64wDQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQw

# HAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIGTx

# nPG/fsuRxOYg6xZ73ZLVMXq7b9tGjBLalt7Ymi81MEIGCisGAQQBgjcCAQwxNDAy

# oBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5j

# b20wDQYJKoZIhvcNAQEBBQAEggEARyU12858lZtnzWKGRNVNRCKuEqNut7PssKmK

# vK4mXD6s0IrQh+u6op88ROvb9wnlPrzutYKQNsc1NCDtR91QI2uEv+1vNnCU83GY

# f4L1AdfeZtTzAdgnPxoXDQ2y/r+2bNaumc1mGXHqM9xHpHw3RxUaomJgMFHl34sy

# 1YGs/hUwbFJhwJR7NsQPJp2KAJq4TVI9d3j+OZHTq16Go9z7bpcU634Ef6TzPgb/

# XJW93KPJlOjVIXhNBSTB20j67VzoxFmNaQMFlW3ACbu/uSy6oS1lQJ3oi+0Wl9tM

# moYLG6rcaxmpFTrLKVRI80xsZOTCJcTXVsI/nAaI+yNosbQs0aGCFykwghclBgor

# BgEEAYI3AwMBMYIXFTCCFxEGCSqGSIb3DQEHAqCCFwIwghb+AgEDMQ8wDQYJYIZI

# AWUDBAIBBQAwggFZBgsqhkiG9w0BCRABBKCCAUgEggFEMIIBQAIBAQYKKwYBBAGE

# WQoDATAxMA0GCWCGSAFlAwQCAQUABCD1Q1UNYajkOyGLofpuEB9ZBOsc+dlK2Sxs

# 7+ZmL/LNKAIGZdY1c9ZaGBMyMDI0MDMxMTE4MTcwOS4yMDNaMASAAgH0oIHYpIHV

# MIHSMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH

# UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQL

# EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxJjAkBgNVBAsT

# HVRoYWxlcyBUU1MgRVNOOkZDNDEtNEJENC1EMjIwMSUwIwYDVQQDExxNaWNyb3Nv

# ZnQgVGltZS1TdGFtcCBTZXJ2aWNloIIReDCCBycwggUPoAMCAQICEzMAAAHimZmV

# 8dzjIOsAAQAAAeIwDQYJKoZIhvcNAQELBQAwfDELMAkGA1UEBhMCVVMxEzARBgNV

# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv

# c29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAg

# UENBIDIwMTAwHhcNMjMxMDEyMTkwNzI1WhcNMjUwMTEwMTkwNzI1WjCB0jELMAkG

# A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx

# HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9z

# b2Z0IElyZWxhbmQgT3BlcmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMg

# VFNTIEVTTjpGQzQxLTRCRDQtRDIyMDElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUt

# U3RhbXAgU2VydmljZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALVj

# tZhV+kFmb8cKQpg2mzisDlRI978Gb2amGvbAmCd04JVGeTe/QGzM8KbQrMDol7DC

# 7jS03JkcrPsWi9WpVwsIckRQ8AkX1idBG9HhyCspAavfuvz55khl7brPQx7H99UJ

# bsE3wMmpmJasPWpgF05zZlvpWQDULDcIYyl5lXI4HVZ5N6MSxWO8zwWr4r9xkMmU

# Xs7ICxDJr5a39SSePAJRIyznaIc0WzZ6MFcTRzLLNyPBE4KrVv1LFd96FNxAzwne

# tSePg88EmRezr2T3HTFElneJXyQYd6YQ7eCIc7yllWoY03CEg9ghorp9qUKcBUfF

# cS4XElf3GSERnlzJsK7s/ZGPU4daHT2jWGoYha2QCOmkgjOmBFCqQFFwFmsPrZj4

# eQszYxq4c4HqPnUu4hT4aqpvUZ3qIOXbdyU42pNL93cn0rPTTleOUsOQbgvlRdth

# FCBepxfb6nbsp3fcZaPBfTbtXVa8nLQuMCBqyfsebuqnbwj+lHQfqKpivpyd7KCW

# ACoj78XUwYqy1HyYnStTme4T9vK6u2O/KThfROeJHiSg44ymFj+34IcFEhPogaKv

# NNsTVm4QbqphCyknrwByqorBCLH6bllRtJMJwmu7GRdTQsIx2HMKqphEtpSm1z3u

# fASdPrgPhsQIRFkHZGuihL1Jjj4Lu3CbAmha0lOrAgMBAAGjggFJMIIBRTAdBgNV

# HQ4EFgQURIQOEdq+7QdslptJiCRNpXgJ2gUwHwYDVR0jBBgwFoAUn6cVXQBeYl2D

# 9OXSZacbUzUZ6XIwXwYDVR0fBFgwVjBUoFKgUIZOaHR0cDovL3d3dy5taWNyb3Nv

# ZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUy

# MDIwMTAoMSkuY3JsMGwGCCsGAQUFBwEBBGAwXjBcBggrBgEFBQcwAoZQaHR0cDov

# L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNyb3NvZnQlMjBUaW1l

# LVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcnQwDAYDVR0TAQH/BAIwADAWBgNVHSUB

# Af8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQAD

# ggIBAORURDGrVRTbnulfsg2cTsyyh7YXvhVU7NZMkITAQYsFEPVgvSviCylr5ap3

# ka76Yz0t/6lxuczI6w7tXq8n4WxUUgcj5wAhnNorhnD8ljYqbck37fggYK3+wEwL

# hP1PGC5tvXK0xYomU1nU+lXOy9ZRnShI/HZdFrw2srgtsbWow9OMuADS5lg7okrX

# a2daCOGnxuaD1IO+65E7qv2O0W0sGj7AWdOjNdpexPrspL2KEcOMeJVmkk/O0gan

# hFzzHAnWjtNWneU11WQ6Bxv8OpN1fY9wzQoiycgvOOJM93od55EGeXxfF8bofLVl

# UE3zIikoSed+8s61NDP+x9RMya2mwK/Ys1xdvDlZTHndIKssfmu3vu/a+BFf2uIo

# ycVTvBQpv/drRJD68eo401mkCRFkmy/+BmQlRrx2rapqAu5k0Nev+iUdBUKmX/iO

# aKZ75vuQg7hCiBA5xIm5ZIXDSlX47wwFar3/BgTwntMq9ra6QRAeS/o/uYWkmvqv

# E8Aq38QmKgTiBnWSS/uVPcaHEyArnyFh5G+qeCGmL44MfEnFEhxc3saPmXhe6MhS

# gCIGJUZDA7336nQD8fn4y6534Lel+LuT5F5bFt0mLwd+H5GxGzObZmm/c3pEWtHv

# 1ug7dS/Dfrcd1sn2E4gk4W1L1jdRBbK9xwkMmwY+CHZeMSvBMIIHcTCCBVmgAwIB

# AgITMwAAABXF52ueAptJmQAAAAAAFTANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UE

# BhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAc

# BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0

# IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTAwHhcNMjEwOTMwMTgyMjI1

# WhcNMzAwOTMwMTgzMjI1WjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu

# Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv

# cmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDCC

# AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOThpkzntHIhC3miy9ckeb0O

# 1YLT/e6cBwfSqWxOdcjKNVf2AX9sSuDivbk+F2Az/1xPx2b3lVNxWuJ+Slr+uDZn

# hUYjDLWNE893MsAQGOhgfWpSg0S3po5GawcU88V29YZQ3MFEyHFcUTE3oAo4bo3t

# 1w/YJlN8OWECesSq/XJprx2rrPY2vjUmZNqYO7oaezOtgFt+jBAcnVL+tuhiJdxq

# D89d9P6OU8/W7IVWTe/dvI2k45GPsjksUZzpcGkNyjYtcI4xyDUoveO0hyTD4MmP

# frVUj9z6BVWYbWg7mka97aSueik3rMvrg0XnRm7KMtXAhjBcTyziYrLNueKNiOSW

# rAFKu75xqRdbZ2De+JKRHh09/SDPc31BmkZ1zcRfNN0Sidb9pSB9fvzZnkXftnIv

# 231fgLrbqn427DZM9ituqBJR6L8FA6PRc6ZNN3SUHDSCD/AQ8rdHGO2n6Jl8P0zb

# r17C89XYcz1DTsEzOUyOArxCaC4Q6oRRRuLRvWoYWmEBc8pnol7XKHYC4jMYcten

# IPDC+hIK12NvDMk2ZItboKaDIV1fMHSRlJTYuVD5C4lh8zYGNRiER9vcG9H9stQc

# xWv2XFJRXRLbJbqvUAV6bMURHXLvjflSxIUXk8A8FdsaN8cIFRg/eKtFtvUeh17a

# j54WcmnGrnu3tz5q4i6tAgMBAAGjggHdMIIB2TASBgkrBgEEAYI3FQEEBQIDAQAB

# MCMGCSsGAQQBgjcVAgQWBBQqp1L+ZMSavoKRPEY1Kc8Q/y8E7jAdBgNVHQ4EFgQU

# n6cVXQBeYl2D9OXSZacbUzUZ6XIwXAYDVR0gBFUwUzBRBgwrBgEEAYI3TIN9AQEw

# QTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9E

# b2NzL1JlcG9zaXRvcnkuaHRtMBMGA1UdJQQMMAoGCCsGAQUFBwMIMBkGCSsGAQQB

# gjcUAgQMHgoAUwB1AGIAQwBBMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/

# MB8GA1UdIwQYMBaAFNX2VsuP6KJcYmjRPZSQW9fOmhjEMFYGA1UdHwRPME0wS6BJ

# oEeGRWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01p

# Y1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNybDBaBggrBgEFBQcBAQROMEwwSgYIKwYB

# BQUHMAKGPmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9v

# Q2VyQXV0XzIwMTAtMDYtMjMuY3J0MA0GCSqGSIb3DQEBCwUAA4ICAQCdVX38Kq3h

# LB9nATEkW+Geckv8qW/qXBS2Pk5HZHixBpOXPTEztTnXwnE2P9pkbHzQdTltuw8x

# 5MKP+2zRoZQYIu7pZmc6U03dmLq2HnjYNi6cqYJWAAOwBb6J6Gngugnue99qb74p

# y27YP0h1AdkY3m2CDPVtI1TkeFN1JFe53Z/zjj3G82jfZfakVqr3lbYoVSfQJL1A

# oL8ZthISEV09J+BAljis9/kpicO8F7BUhUKz/AyeixmJ5/ALaoHCgRlCGVJ1ijbC

# HcNhcy4sa3tuPywJeBTpkbKpW99Jo3QMvOyRgNI95ko+ZjtPu4b6MhrZlvSP9pEB

# 9s7GdP32THJvEKt1MMU0sHrYUP4KWN1APMdUbZ1jdEgssU5HLcEUBHG/ZPkkvnNt

# yo4JvbMBV0lUZNlz138eW0QBjloZkWsNn6Qo3GcZKCS6OEuabvshVGtqRRFHqfG3

# rsjoiV5PndLQTHa1V1QJsWkBRH58oWFsc/4Ku+xBZj1p/cvBQUl+fpO+y/g75LcV

# v7TOPqUxUYS8vwLBgqJ7Fx0ViY1w/ue10CgaiQuPNtq6TPmb/wrpNPgkNWcr4A24

# 5oyZ1uEi6vAnQj0llOZ0dFtq0Z4+7X6gMTN9vMvpe784cETRkPHIqzqKOghif9lw

# Y1NNje6CbaUFEMFxBmoQtB1VM1izoXBm8qGCAtQwggI9AgEBMIIBAKGB2KSB1TCB

# 0jELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl

# ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMk

# TWljcm9zb2Z0IElyZWxhbmQgT3BlcmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1U

# aGFsZXMgVFNTIEVTTjpGQzQxLTRCRDQtRDIyMDElMCMGA1UEAxMcTWljcm9zb2Z0

# IFRpbWUtU3RhbXAgU2VydmljZaIjCgEBMAcGBSsOAwIaAxUAFpuZafp0bnpJdIhf

# iB1d8pTohm+ggYMwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu

# Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv

# cmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDAN

# BgkqhkiG9w0BAQUFAAIFAOmZvzcwIhgPMjAyNDAzMTIwMTM0NDdaGA8yMDI0MDMx

# MzAxMzQ0N1owdDA6BgorBgEEAYRZCgQBMSwwKjAKAgUA6Zm/NwIBADAHAgEAAgIK

# aTAHAgEAAgIf8jAKAgUA6ZsQtwIBADA2BgorBgEEAYRZCgQCMSgwJjAMBgorBgEE

# AYRZCgMCoAowCAIBAAIDB6EgoQowCAIBAAIDAYagMA0GCSqGSIb3DQEBBQUAA4GB

# AEjsCabGCHxos3ipKIT3NWf5vbFYfDLvGcQSZ5z3Q/Elo/+ED+YdG5WE9eAg3qTr

# FPcLD8FS/E9A1DLdDPKo5im/xshN5px9AE1Zl40CMo+jvqcNC9vyI4GpnsgXwrVz

# 5lHf60DAIwswrR2ZjxxCRQjn2C8c+rqccCVQ4X/QzLSyMYIEDTCCBAkCAQEwgZMw

# fDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl

# ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMd

# TWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAHimZmV8dzjIOsAAQAA

# AeIwDQYJYIZIAWUDBAIBBQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRAB

# BDAvBgkqhkiG9w0BCQQxIgQgj8X4EfvGpEBkj5JSzebDfPebl8q+PuX19q7tXIyZ

# /rMwgfoGCyqGSIb3DQEJEAIvMYHqMIHnMIHkMIG9BCAriSpKEP0muMbBUETODoL4

# d5LU6I/bjucIZkOJCI9//zCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQI

# EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv

# ZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBD

# QSAyMDEwAhMzAAAB4pmZlfHc4yDrAAEAAAHiMCIEILIaWLwVuDhiUmIjrNPJ/3AM

# dlJ8txSKs4ROcdzbejLQMA0GCSqGSIb3DQEBCwUABIICAKK/G/WrTs7UGMaVP4/a

# q1PmPabDs+ca15ujhy060zYR5vPJ9j8IuYBk0oE3t7Z997IeGF1LGVhXzsnYUUyK

# ZmKMpH/x18jep3C6p0pL9n6K7WRkbxmWIq2GtXcX3M04wDmC9aIDcEudcb2LsyQn

# j07NBdfRCoLGDV4l8DoNH3r13QVvXvbupFEILT10KWynUb/DqUatyk0V8SnMgyDx

# O5P4E1rR41LQlRPprmlKqYTIaR0aaqwm3E628PPWYrrSrI/IL9v/F0gYIlV8fbME

# ct+S3mLb4B6EF5JTO2WVkMRsKbuTf9UVmHYgDWyD15TuYVcF7pUT1l7ry7rUDT/i

# PbzZoubtS1lboYP6/i40YRjEKTWCHiZeSN/JjhKyUZ1x7EKKkOpRHtaZWk4RNQXD

# JBT2b8VqExwQLRnVLFaYCVVO4HVS5qLJ6xv8zUKBI6HGl9b1BQIx9Q4M9HLKDraK

# b87JqU59IN95KZXH8wuW1FPHNzt+TyEDfLW6/Z8AOQ4wsd4dUU3h0vGjJfjirIwM

# csPV98YGzA06NILM+PJdL+8ctZO6+aZp8Wl1DRoBHe0g9YytlNSEKgRwouH0wbt1

# P1uOl/VL8L60iEQGjTbML1ZcVy9sugsQLjcA9pK46L4CSCqqAH5hMIpqnP1AUXcu

# QgKlgJHST35zcuMUwbLtANRd

# SIG # End signature block