Engines/Terraform/Invoke-AvmTerraformCheckPolicy.ps1
|
function Invoke-AvmTerraformPolicyExample { [CmdletBinding()] [OutputType([pscustomobject])] param( [Parameter(Mandatory)] $Example, [Parameter(Mandatory)] $Options ) Set-StrictMode -Version 3.0 $ErrorActionPreference = 'Stop' $envVars = @{} $primaryError = $null $issues = [System.Collections.Generic.List[object]]::new() $evaluated = 0 try { Invoke-AvmScriptHook ` -HookPath (Join-Path $Example.StagedPath 'pre.ps1') ` -WorkingDirectory $Example.StagedPath ` -Label ("policy {0} pre.ps1" -f $Example.Name) $envVars = ConvertFrom-AvmDotEnv -Path (Join-Path $Example.StagedPath '.env') $terraformLock = Lock-AvmTerraformPluginCache ` -WorkingDirectory $Example.StagedPath ` -EnvVars $envVars try { $null = Invoke-AvmTerraformInit ` -TerraformPath $Options.TerraformPath ` -WorkingDirectory $Example.StagedPath ` -EnvVars $envVars ` -Label ("terraform init ({0})" -f $Example.Name) ` -NoColor ` -SkipPluginCacheLock $null = Invoke-AvmProcess ` -FilePath $Options.TerraformPath ` -ArgumentList @('plan', '-out=tfplan', '-input=false', '-no-color') ` -WorkingDirectory $Example.StagedPath ` -EnvVars $envVars ` -Label ("terraform plan ({0})" -f $Example.Name) $showResult = Invoke-AvmProcess ` -FilePath $Options.TerraformPath ` -ArgumentList @('show', '-json', 'tfplan') ` -WorkingDirectory $Example.StagedPath ` -EnvVars $envVars ` -Label ("terraform show ({0})" -f $Example.Name) } finally { if ($null -ne $terraformLock) { $terraformLock.Dispose() } } $planJsonPath = Join-Path $Example.StagedPath 'tfplan.json' [System.IO.File]::WriteAllText( $planJsonPath, [string]$showResult.StdOut, [System.Text.UTF8Encoding]::new($false)) $localExceptions = Join-Path $Example.StagedPath 'exceptions' $policyRuns = @( [pscustomobject]@{ Name = 'APRL'; Path = $Options.AprlPath } [pscustomobject]@{ Name = 'AVMSEC'; Path = $Options.AvmsecPath } ) foreach ($policyRun in $policyRuns) { $arguments = [System.Collections.Generic.List[string]]::new() $arguments.Add('test') $arguments.Add('--all-namespaces') $arguments.Add('--policy') $arguments.Add([string]$policyRun.Path) $arguments.Add('--policy') $arguments.Add($Options.DefaultExceptions) if (Test-Path -LiteralPath $localExceptions -PathType Container) { $arguments.Add('--policy') $arguments.Add($localExceptions) } $arguments.Add('--output') $arguments.Add('json') $arguments.Add('tfplan.json') $policyResult = Invoke-AvmProcess ` -FilePath $Options.ConftestPath ` -ArgumentList $arguments.ToArray() ` -WorkingDirectory $Example.StagedPath ` -EnvVars $envVars ` -Label ("conftest {0} ({1})" -f $policyRun.Name, $Example.Name) ` -IgnoreExitCode $parsed = ConvertFrom-AvmPolicyResult ` -Result $policyResult ` -ExamplePath $Example.RelativePath ` -PolicyName $policyRun.Name $evaluated += $parsed.Evaluated foreach ($issue in $parsed.Issues) { $issues.Add($issue) } } } catch { $primaryError = $_ } try { Invoke-AvmScriptHook ` -HookPath (Join-Path $Example.StagedPath 'post.ps1') ` -WorkingDirectory $Example.StagedPath ` -EnvVars $envVars ` -Label ("policy {0} post.ps1" -f $Example.Name) } catch { if ($null -eq $primaryError) { throw } Write-AvmLog ` -Level Warning ` -File (Join-Path $Example.RelativePath 'post.ps1') ` -Message ("Policy post hook also failed; preserving the primary error: {0}" -f $_.Exception.Message) } if ($null -ne $primaryError) { throw $primaryError } return [pscustomobject]@{ Evaluated = $evaluated Issues = $issues.ToArray() } } function Get-AvmConftestOverrideWarning { [CmdletBinding()] [OutputType([object[]])] param( [Parameter(Mandatory)] [string] $Root, [Parameter(Mandatory)] [string[]] $ExamplePath ) $rootFull = (Resolve-Path -LiteralPath $Root).ProviderPath $warnings = [System.Collections.Generic.List[object]]::new() $seen = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::Ordinal) foreach ($example in $ExamplePath) { $exceptionsPath = Join-Path $example 'exceptions' if (-not (Test-Path -LiteralPath $exceptionsPath -PathType Container)) { continue } $exceptionFiles = @( Get-ChildItem ` -LiteralPath $exceptionsPath ` -Filter '*.rego' ` -File ` -Recurse ` -ErrorAction SilentlyContinue | Sort-Object FullName ) foreach ($exceptionFile in $exceptionFiles) { $file = [System.IO.Path]::GetRelativePath($rootFull, $exceptionFile.FullName).Replace('\', '/') $text = [System.IO.File]::ReadAllText($exceptionFile.FullName) $rules = @( @( foreach ($exceptionMatch in [regex]::Matches($text, '(?ms)\bexception\s+contains\s+rules\s+if\s*\{(?<block>[^{}]*)\}')) { foreach ($ruleListMatch in [regex]::Matches($exceptionMatch.Groups['block'].Value, '(?ms)\brules\s*(?::=|=)\s*\[(?<body>.*?)\]')) { foreach ($ruleMatch in [regex]::Matches($ruleListMatch.Groups['body'].Value, '["''](?<rule>[^"'']+)["'']')) { [string]$ruleMatch.Groups['rule'].Value } } } ) | Select-Object -Unique ) if ($rules.Count -gt 0) { foreach ($rule in $rules) { $key = "$file`0$rule" if (-not $seen.Add($key)) { continue } $warnings.Add([pscustomobject][ordered]@{ File = $file Rule = $rule Message = ("Conftest override exempts rule '{0}'." -f $rule) }) } } elseif ($text -cmatch '\bexception\s+contains\s+rules\s+if\b') { $key = "$file`0" if ($seen.Add($key)) { $warnings.Add([pscustomobject][ordered]@{ File = $file Rule = '' Message = 'Conftest override file found, but no exempted rules could be parsed.' }) } } } } return $warnings.ToArray() } function Invoke-AvmTerraformCheckPolicy { <# .SYNOPSIS Evaluate Terraform examples against the pinned APRL and AVMSEC policies. .DESCRIPTION Implements the legacy AVM pr-check policy lifecycle without mutating the repository. The module is copied beneath the AVM cache, then every direct examples/* directory is evaluated independently with bounded parallelism: - examples carrying .e2eignore are skipped - pre.ps1 runs when present; pre.sh is rejected with migration guidance - .env is loaded into Terraform and Conftest subprocesses - terraform init, plan, and show produce a plan-JSON input - APRL and AVMSEC run separately with all namespaces enabled - the pinned AVMSEC exemptions and that example's local exceptions/ directory are included in both evaluations - post.ps1 runs after the example; post.sh is rejected likewise The staging directory is deliberately beneath the policy bundle cache. Conftest strips the drive letter from --policy paths on Windows; keeping the working tree and bundles on one volume preserves resolution. Conftest output is captured as JSON rather than streamed. The legacy command used --quiet; omitting that switch here has the same user-visible silence while retaining success records needed for the Evaluated count. .PARAMETER Context Terraform module context produced by Get-AvmModuleContext. .PARAMETER AllowPathFallback Allow Terraform and Conftest to resolve from PATH. .PARAMETER ThrottleLimit Maximum number of independent examples to evaluate at once. Defaults to one for direct engine calls. .OUTPUTS A Terraform engine result with Status, Evaluated, and Issues. #> [CmdletBinding()] [OutputType([pscustomobject])] param( [Parameter(Mandatory)] $Context, [switch] $AllowPathFallback, [ValidateRange(1, 32)] [int] $ThrottleLimit = 1 ) Set-StrictMode -Version 3.0 $ErrorActionPreference = 'Stop' if ($Context.Ecosystem -ne 'terraform') { throw [System.ArgumentException]::new( "Invoke-AvmTerraformCheckPolicy requires a terraform context (got Ecosystem='$($Context.Ecosystem)').") } $conftest = Resolve-AvmTool -Name 'conftest' -AllowPathFallback:$AllowPathFallback $terraform = Resolve-AvmTool -Name 'terraform' -AllowPathFallback:$AllowPathFallback $aprlAsset = Resolve-AvmPolicyBundle -Name 'avm-policy-aprl' $avmsecAsset = Resolve-AvmPolicyBundle -Name 'avm-policy-avmsec' $defaultExceptionSource = Join-Path $avmsecAsset.Path 'avm_exceptions.rego.bak' if (-not (Test-Path -LiteralPath $defaultExceptionSource -PathType Leaf)) { throw [AvmConfigurationException]::new( "The pinned AVMSEC bundle does not contain the default exemption policy: '$defaultExceptionSource'.") } $examplesRoot = Join-Path $Context.Root 'examples' $examplePaths = @() if (Test-Path -LiteralPath $examplesRoot -PathType Container) { $examplePaths = @(Get-ChildItem -LiteralPath $examplesRoot -Directory -ErrorAction Stop | ForEach-Object FullName) [System.Array]::Sort($examplePaths, [System.StringComparer]::Ordinal) } $activeExamples = @($examplePaths | Where-Object { -not (Test-Path -LiteralPath (Join-Path $_ '.e2eignore') -PathType Leaf) }) if ($activeExamples.Count -eq 0) { return [pscustomobject][ordered]@{ Engine = 'terraform' Tool = ('{0}/{1}' -f $conftest.Name, $conftest.Version) ToolPath = $conftest.Path ToolSource = $conftest.Source Status = 'skipped' Evaluated = 0 Issues = @() } } foreach ($warning in (Get-AvmConftestOverrideWarning -Root $Context.Root -ExamplePath $activeExamples)) { Write-AvmLog ` -Message $warning.Message ` -Level Warning ` -File $warning.File } $shellHooks = [System.Collections.Generic.List[string]]::new() foreach ($sourceExample in $activeExamples) { $exampleName = Split-Path -Path $sourceExample -Leaf foreach ($hookName in @('pre.sh', 'post.sh')) { if (Test-Path -LiteralPath (Join-Path $sourceExample $hookName) -PathType Leaf) { $shellHooks.Add(('examples/{0}/{1}' -f $exampleName, $hookName)) } } } if ($shellHooks.Count -gt 0) { throw [AvmConfigurationException]::new( ("The terraform policy engine runs PowerShell hooks only. Refactor these shell hooks to '.ps1': {0}" -f ($shellHooks -join ', '))) } $stageParent = Join-Path (Get-AvmFolder -Kind Cache) 'policy-stage' $stageRoot = Join-Path $stageParent ('avm-policy-' + [guid]::NewGuid().ToString('N')) $issues = [System.Collections.Generic.List[object]]::new() $evaluated = 0 $streamOutput = Test-AvmVerboseEnabled $effectiveThrottle = if ($streamOutput) { 1 } else { $ThrottleLimit } try { Copy-AvmTerraformModuleTree -SourceRoot $Context.Root -DestinationRoot $stageRoot $defaultExceptions = Join-Path ` -Path $stageRoot ` -ChildPath 'policy' ` -AdditionalChildPath 'default_exceptions' $null = New-Item -ItemType Directory -Path $defaultExceptions -Force -ErrorAction Stop Copy-Item ` -LiteralPath $defaultExceptionSource ` -Destination (Join-Path $defaultExceptions 'avm_exceptions.rego') ` -Force ` -ErrorAction Stop $examples = [System.Collections.Generic.List[object]]::new() for ($exampleIndex = 0; $exampleIndex -lt $activeExamples.Count; $exampleIndex++) { $sourceExample = $activeExamples[$exampleIndex] $relativeExample = [System.IO.Path]::GetRelativePath($Context.Root, $sourceExample) $stagedExample = Join-Path $stageRoot $relativeExample $exampleName = Split-Path -Path $sourceExample -Leaf Write-AvmLog ` -Level Info ` -Message ("policy: example {0}/{1} = {2}" -f ($exampleIndex + 1), $activeExamples.Count, $exampleName) | Out-Null $examples.Add([pscustomobject]@{ Name = $exampleName RelativePath = $relativeExample StagedPath = $stagedExample }) } Write-AvmLog ` -Level Verbose ` -Message ("policy: processing examples with {0} worker(s)" -f $effectiveThrottle) | Out-Null $options = [pscustomobject]@{ TerraformPath = $terraform.Path ConftestPath = $conftest.Path AprlPath = $aprlAsset.Path AvmsecPath = $avmsecAsset.Path DefaultExceptions = $defaultExceptions } $exampleResults = @( Invoke-AvmParallel ` -InputObject $examples.ToArray() ` -FunctionName 'Invoke-AvmTerraformPolicyExample' ` -Argument $options ` -ThrottleLimit $effectiveThrottle ) foreach ($exampleResult in $exampleResults) { $evaluated += $exampleResult.Evaluated foreach ($issue in $exampleResult.Issues) { $issues.Add($issue) } } } finally { if (Test-Path -LiteralPath $stageRoot) { Remove-Item ` -LiteralPath $stageRoot ` -Recurse ` -Force ` -ErrorAction SilentlyContinue ` -ProgressAction SilentlyContinue } } $status = if (@($issues | Where-Object { $_.Severity -eq 'error' }).Count -gt 0) { 'fail' } else { 'pass' } return [pscustomobject][ordered]@{ Engine = 'terraform' Tool = ('{0}/{1}' -f $conftest.Name, $conftest.Version) ToolPath = $conftest.Path ToolSource = $conftest.Source Status = $status Evaluated = $evaluated Issues = $issues.ToArray() } } function ConvertFrom-AvmPolicyResult { [CmdletBinding()] [OutputType([pscustomobject])] param( [Parameter(Mandatory)] $Result, [Parameter(Mandatory)] [string] $ExamplePath, [Parameter(Mandatory)] [string] $PolicyName ) if ($Result.ExitCode -notin @(0, 1)) { $summary = "conftest $PolicyName exited with code $($Result.ExitCode)." $message = Add-AvmProcessFailureDetail ` -Message $summary ` -StdOut $Result.StdOut ` -StdErr $Result.StdErr if ($message -ceq $summary) { $message += [Environment]::NewLine + ' conftest produced no diagnostic.' } throw [AvmProcessException]::new( $message) } $payload = if ($Result.StdOut) { $Result.StdOut.Trim() } else { '' } if ($Result.ExitCode -eq 1 -and [string]::IsNullOrWhiteSpace($payload)) { $summary = "conftest $PolicyName exited before evaluating a policy." $message = Add-AvmProcessFailureDetail ` -Message $summary ` -StdOut $Result.StdOut ` -StdErr $Result.StdErr if ($message -ceq $summary) { $message += [Environment]::NewLine + ' conftest produced no result.' } throw [AvmProcessException]::new( $message) } $records = @() if (-not [string]::IsNullOrWhiteSpace($payload)) { try { $records = @($payload | ConvertFrom-Json -ErrorAction Stop) } catch { throw [AvmProcessException]::new( "Could not parse conftest $PolicyName JSON output: $($_.Exception.Message)") } } $issues = [System.Collections.Generic.List[object]]::new() $evaluated = 0 $issueFile = [System.IO.Path]::Combine($ExamplePath, 'tfplan.json').Replace('\', '/') foreach ($record in $records) { if (-not $record) { continue } $namespace = if ($record.PSObject.Properties['namespace']) { [string]$record.namespace } else { $PolicyName.ToLowerInvariant() } if ($record.PSObject.Properties['successes']) { $evaluated += [int]$record.successes } foreach ($bucket in @('failures', 'warnings', 'exceptions')) { if ($record.PSObject.Properties[$bucket] -and $record.$bucket) { $evaluated += @($record.$bucket).Count } } foreach ($bucket in @( [pscustomobject]@{ Name = 'failures'; Severity = 'error' } [pscustomobject]@{ Name = 'warnings'; Severity = 'warning' } )) { if (-not $record.PSObject.Properties[$bucket.Name] -or -not $record.($bucket.Name)) { continue } foreach ($finding in @($record.($bucket.Name))) { $message = if ($finding.PSObject.Properties['msg']) { [string]$finding.msg } else { '' } $issues.Add([pscustomobject][ordered]@{ File = $issueFile Line = 0 Column = 0 Severity = $bucket.Severity Code = $namespace Message = $message }) } } } return [pscustomobject][ordered]@{ Evaluated = $evaluated Issues = $issues.ToArray() } } # SIG # Begin signature block # MIInUwYJKoZIhvcNAQcCoIInRDCCJ0ACAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDqZKO2YnqIp15v # iB5XVx9RHpBq6qEOAhHLo4ymfVxHWqCCDMkwggYEMIID7KADAgECAhMzAAACHPrN # xZvoL37EAAAAAAIcMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQxWhcNMjcwNDE1MTg1 # OTQxWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDVsZfgOKmM31HPfoWOoNEiw0SlCiIxUMC0I9NMWbucKOw/e9lP # oAoehQVu6SG65V4EPzrYsnBnFPNoi4/HoOdjhz1qkrEt4I6tEcxXU6oOeY9zGveC # /3iBeuhLYxM3M/PkcUoebF+Nednm8OkdSPoDu8imViHPQq/8CQUu0WRR4rE+dMRf # rpVqfmNi2qWCX94T4MsepijGVkwE//tJg0ryAiYdHT34LSnlG/RSBZmQRGWZ5g8j # qnKjRParSqMft1gvjuUTVgtWNZfgcLFSK5Wa0myrq8OPcgTGGsRgun+tnSS+IxDT # xVsAPH1OzvPjwomguByhUe/OcvUN0D5Wmp7xAgMBAAGjggGqMIIBpjAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFNoH7a2YDjOSwpkp6DHcmUS7J+0yMFQGA1UdEQRNMEukSTBHMS0wKwYDVQQL # EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxFjAUBgNVBAUT # DTIzMDAxMis1MDc1NjkwHwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEw # YAYDVR0fBFkwVzBVoFOgUYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9w # cy9jcmwvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # bDBtBggrBgEFBQcBAQRhMF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmcl # MjBQQ0ElMjAyMDI0LmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IC # AQAUnEqhaRXe0T3hIJjvdQErEkrA/7bByjn6t5IArODkkRjzkYwtKMc2yYj2quaN # rLutWw2YZcngKPy1b71YyDJQTy4NDRwaSh9Tw5thrk3NmcPrAHia5vtcBJ1CgtKK # 7mQbIcQ22d/N3813ayCDDFewu1+jsZmX+r/aTEqaOM4TVxVtRSkuCy8nAXKuChOK # Li/zA4XuH8iEYqIsj2YoNaeSxVmeGiERXpKdo3dDmYi0kO5w2D8VS4c3+9h6gElY # BaAAg/dYErBg27qT3vv0zRDJhJufvCNylA8S7/+8H5E/PV5cng6na9VV/w9OV3qu # uND6zdGa2EX38Glp50F9AIQk3p2xXmcvorDeM4XJ7UlWYBi6g80J1SSOQnInCYFE # msfUNn3+1AaTJKSJL83quKArTac2pKhu0Yzzzrzo6HrsRiQKzpnRBb1/dMa6P3hz # 75XbMRBctNsFhZC07WCmjExdLg2eHW5uV0TY8D5+6wozJf7vF3+WHkYPO85Z+BC6 # U4FkNbYNycZ9cE4j1tXRdyDCfml6c0HWPHjNVDObrv9lKt3qUqFpX38VCqVCyNOO # 1UcXfQiVjJw32U2WUKZjt/neJKHEBsm9kFsLuWzkQ53+qcaSaytmsCnk2gOglrlD # 5d3kKyvvAw+rzm0lT8K38P6PLxfZQHhu4W8dV7Av8N2ZmDCCBr0wggSloAMCAQIC # EzMAAAA5O7Y3Gb8GHWcAAAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYT # AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS # b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoX # DTM2MDMyMjIyMTMwNFowVzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQ # Q0EgMjAyNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeq # lRYHNa265v4IY9fH8TKhemHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo # 0dtS/EW6I/yEL/bLSY8hKpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATv # QVL4tcf03aTycsz8QeCdM0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a # 1uv1zerOYMnsneRRwCbpyW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1 # FyQfK0fVkaya8SmVHQ/tOf23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfO # GSWHIIV4YrTJTT6PNty5REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7 # ttOu1bVnXfHaqPYl2rPs20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJ # uz2MXMCt7iw7lFPG9LXKGjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxS # CwyoGIq0PhaA7Y+VPct5pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOm # VQop36wUVUYklUy++vDWeEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3 # SkE/xIkgpfl22MM1itkZ35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8E # BAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPX # LQaUEggxMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMB # Af8wHwYDVR0jBBgwFoAUci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBP # oE2gS4ZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAw # TgYIKwYBBQUHMAKGQmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOC # AgEAFJQfOChP7onn6fLIMKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D # 5W4wMwYeLystcEqfkjz4NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBY # nbu0+THSuVHTe0VTTPVhily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSI # vgn0JksVBVMYVI5QFu/qhnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6 # aR9y34aiM1qmxaxBi6OUnyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4w # PKC5OmHm1DQIt/MNokbbH3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7 # RTX8AdBPo0I6OEojf39zuFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK # /fg8B2qjW88MT/WF5V5uvZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSK # YBv0VisCzfxgeU+dquXW9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkw # YTu/9dLeH2pDqeJZAABVDWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVT # Ql0v4q8J/AUmQN5W4n101cY2L4A7GTQG1h32HHAvfQESWP0xghngMIIZ3AIBATBu # MFcxCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # KDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIc # +s3Fm+gvfsQAAAAAAhwwDQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwG # CisGAQQBgjcCAQQwLwYJKoZIhvcNAQkEMSIEIM/o7vkt0rlC4LEcjZTSDDr/Tc3m # 6+qeo8nc0wihmCSBMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBv # AGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAE # ggEALmC5aJdRNW+pW5pXciPhUcPi0Edma4oDFY+ZDhdyRO5uxicpGlSfjVEm0nyo # XkSz0tgbSVjAacByBJuxGOmdKdk3ZfHqCRxiJ0zgNizADuYxA78myzz9eIC9TodK # U2cxT+kxF+kjfS0E5qfu2Pr5vtE9LPXRJznPNlooATaaVwphHlykBB2mlHp7amqz # 7AWLESngds8Kxgv6GWMCrDBF4TH9WVC/usW9SYNK8bIQQiI9W2GEJVp+8Ed6EnfP # 3kA5QbELsKCpc9Nvh33LJzzaiaZwA/8s4eD1jESAeGd1/i1FdO1u77wNrJT3001Q # ck85vbPb5J0RcwSr8NalMJVWr6GCF7AwghesBgorBgEEAYI3AwMBMYIXnDCCF5gG # CSqGSIb3DQEHAqCCF4kwgheFAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFaBgsqhkiG # 9w0BCRABBKCCAUkEggFFMIIBQQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQC # AQUABCCfD0g8yM2O76y9JepDXQ6LCyqhtb4mEpf4R31Wm1bd/AIGaq7tdkEAGBMy # MDI2MDkyMTEzMjgxNS4yNzFaMASAAgH0oIHZpIHWMIHTMQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFu # ZCBPcGVyYXRpb25zIExpbWl0ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjo1 # OTFBLTA1RTAtRDk0NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2Vy # dmljZaCCEf4wggcoMIIFEKADAgECAhMzAAACFI3NI0TuBt9yAAEAAAIUMA0GCSqG # SIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw # DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # JjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTI1MDgx # NDE4NDgxOFoXDTI2MTExMzE4NDgxOFowgdMxCzAJBgNVBAYTAlVTMRMwEQYDVQQI # EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv # ZnQgQ29ycG9yYXRpb24xLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJh # dGlvbnMgTGltaXRlZDEnMCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOjU5MUEtMDVF # MC1EOTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIIC # IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAyU+nWgCUyvfyGP1zTFkLkdgO # utXcVteP/0CeXfrF/66chKl4/MZDCQ6E8Ur4kqgCxQvef7Lg1gfso1EWWKG6vix1 # VxtvO1kPGK4PZKmOeoeL68F6+Mw2ERPy4BL2vJKf6Lo5Z7X0xkRjtcvfM9T0HDgf # HUW6z1CbgQiqrExs2NH27rWpUkyTYrMG6TXy39+GdMOTgXyUDiRGVHAy3EqYNw3z # SWusn0zedl6a/1DbnXIcvn9FaHzd/96EPNBOCd2vOpS0Ck7kgkjVxwOptsWa8I+m # +DA43cwlErPaId84GbdGzo3VoO7YhCmQIoRab0d8or5Pmyg+VMl8jeoN9SeUxVZp # BI/cQ4TXXKlLDkfbzzSQriViQGJGJLtKS3DTVNuBqpjXLdu2p2Yq9ODPqZCoiNBh # 4CB6X2iLYUSO8tmbUVLMMEegbvHSLXQR88QNICjFoBBDCDydoTo9/TNkq80mO77w # DM04tPdvbMmxT01GTod60JJxUGmMTgseghdBGjkN+D6GsUpY7ta7hP9PzLrs+Alx # u46XT217bBn6EwJsAYAc9C28mKRUcoIZWQRb+McoZaSu2EcSzuIlAaNIQNtGlz2P # F3foSeGmc/V7gCGs8AHkiKwXzJSPftnsH8O/R3pJw2D/2hHE3JzxH2SrLX1FdI7D # rw145PkL0hbFL6MVCCkCAwEAAaOCAUkwggFFMB0GA1UdDgQWBBTbX/bs1cSpyTYn # Yuf/Mt9CPNhwGzAfBgNVHSMEGDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNV # HR8EWDBWMFSgUqBQhk5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2Ny # bC9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYI # KwYBBQUHAQEEYDBeMFwGCCsGAQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5j # b20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAy # MDEwKDEpLmNydDAMBgNVHRMBAf8EAjAAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMI # MA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAP3xp9D4Gu0SH9B+1 # JH0hswFquINaTT+RjpfEr8UmUOeDl4U5uV+i28/eSYXMxgem3yBZywYDyvf4qMXU # vbDcllNqRyL2Rv8jSu8wclt/VS1+c5cVCJfM+WHvkUr+dCfUlOy9n4exCPX1L6uW # wFH5eoFfqPEp3Fw30irMN2SonHBK3mB8vDj3D80oJKqe2tatO38yMTiREdC2HD7e # VIUWL7d54UtoYxzwkJN1t7gEEGosgBpdmwKVYYDO1USWSNmZELglYA4LoVoGDuWb # N7mD8VozYBsfkZarOyrJYlF/UCDZLB8XaLfrMfMyZTMCOuEuPD4zj8jy/Jt40clr # IW04cvLhkhkydBzcrmC2HxeE36gJsh+jzmivS9YvyiPhLkom1FP0DIFr4VlqyXHK # agrtnqSF8QyEpqtQS7wS7ZzZF0eZe0fsYD0J1RarbVuDxmWsq45n1vjRdontuGUd # mrG2OGeKd8AtiNghfnabVBbgpYgcx/eLyW/n40eTbKIlsm0cseyuWvYFyOqQXjoW # tL4/sUHxlWIsrjnNarNr+POkL8C1jGBCJuvm0UYgjhIaL+XBXavrbOtX9mrZ3y8G # QDxWXn3mhqM21ZcGk83xSRqB9ecfGYNRG6g65v635gSzUmBKZWWcDNzwAoxsgEjT # FXz6ahfyrBLqshrjJXPKfO+9Ar8wggdxMIIFWaADAgECAhMzAAAAFcXna54Cm0mZ # AAAAAAAVMA0GCSqGSIb3DQEBCwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMK # V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0 # IENvcnBvcmF0aW9uMTIwMAYDVQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0 # ZSBBdXRob3JpdHkgMjAxMDAeFw0yMTA5MzAxODIyMjVaFw0zMDA5MzAxODMyMjVa # MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS # ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMT # HU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMIICIjANBgkqhkiG9w0BAQEF # AAOCAg8AMIICCgKCAgEA5OGmTOe0ciELeaLL1yR5vQ7VgtP97pwHB9KpbE51yMo1 # V/YBf2xK4OK9uT4XYDP/XE/HZveVU3Fa4n5KWv64NmeFRiMMtY0Tz3cywBAY6GB9 # alKDRLemjkZrBxTzxXb1hlDcwUTIcVxRMTegCjhuje3XD9gmU3w5YQJ6xKr9cmmv # Haus9ja+NSZk2pg7uhp7M62AW36MEBydUv626GIl3GoPz130/o5Tz9bshVZN7928 # jaTjkY+yOSxRnOlwaQ3KNi1wjjHINSi947SHJMPgyY9+tVSP3PoFVZhtaDuaRr3t # pK56KTesy+uDRedGbsoy1cCGMFxPLOJiss254o2I5JasAUq7vnGpF1tnYN74kpEe # HT39IM9zfUGaRnXNxF803RKJ1v2lIH1+/NmeRd+2ci/bfV+AutuqfjbsNkz2K26o # ElHovwUDo9Fzpk03dJQcNIIP8BDyt0cY7afomXw/TNuvXsLz1dhzPUNOwTM5TI4C # vEJoLhDqhFFG4tG9ahhaYQFzymeiXtcodgLiMxhy16cg8ML6EgrXY28MyTZki1ug # poMhXV8wdJGUlNi5UPkLiWHzNgY1GIRH29wb0f2y1BzFa/ZcUlFdEtsluq9QBXps # xREdcu+N+VLEhReTwDwV2xo3xwgVGD94q0W29R6HXtqPnhZyacaue7e3PmriLq0C # AwEAAaOCAd0wggHZMBIGCSsGAQQBgjcVAQQFAgMBAAEwIwYJKwYBBAGCNxUCBBYE # FCqnUv5kxJq+gpE8RjUpzxD/LwTuMB0GA1UdDgQWBBSfpxVdAF5iXYP05dJlpxtT # NRnpcjBcBgNVHSAEVTBTMFEGDCsGAQQBgjdMg30BATBBMD8GCCsGAQUFBwIBFjNo # dHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5o # dG0wEwYDVR0lBAwwCgYIKwYBBQUHAwgwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBD # AEEwCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU1fZW # y4/oolxiaNE9lJBb186aGMQwVgYDVR0fBE8wTTBLoEmgR4ZFaHR0cDovL2NybC5t # aWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0XzIwMTAt # MDYtMjMuY3JsMFoGCCsGAQUFBwEBBE4wTDBKBggrBgEFBQcwAoY+aHR0cDovL3d3 # dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0y # My5jcnQwDQYJKoZIhvcNAQELBQADggIBAJ1VffwqreEsH2cBMSRb4Z5yS/ypb+pc # FLY+TkdkeLEGk5c9MTO1OdfCcTY/2mRsfNB1OW27DzHkwo/7bNGhlBgi7ulmZzpT # Td2YurYeeNg2LpypglYAA7AFvonoaeC6Ce5732pvvinLbtg/SHUB2RjebYIM9W0j # VOR4U3UkV7ndn/OOPcbzaN9l9qRWqveVtihVJ9AkvUCgvxm2EhIRXT0n4ECWOKz3 # +SmJw7wXsFSFQrP8DJ6LGYnn8AtqgcKBGUIZUnWKNsIdw2FzLixre24/LAl4FOmR # sqlb30mjdAy87JGA0j3mSj5mO0+7hvoyGtmW9I/2kQH2zsZ0/fZMcm8Qq3UwxTSw # ethQ/gpY3UA8x1RtnWN0SCyxTkctwRQEcb9k+SS+c23Kjgm9swFXSVRk2XPXfx5b # RAGOWhmRaw2fpCjcZxkoJLo4S5pu+yFUa2pFEUep8beuyOiJXk+d0tBMdrVXVAmx # aQFEfnyhYWxz/gq77EFmPWn9y8FBSX5+k77L+DvktxW/tM4+pTFRhLy/AsGConsX # HRWJjXD+57XQKBqJC4822rpM+Zv/Cuk0+CQ1ZyvgDbjmjJnW4SLq8CdCPSWU5nR0 # W2rRnj7tfqAxM328y+l7vzhwRNGQ8cirOoo6CGJ/2XBjU02N7oJtpQUQwXEGahC0 # HVUzWLOhcGbyoYIDWTCCAkECAQEwggEBoYHZpIHWMIHTMQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFu # ZCBPcGVyYXRpb25zIExpbWl0ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjo1 # OTFBLTA1RTAtRDk0NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2Vy # dmljZaIjCgEBMAcGBSsOAwIaAxUA2RysX196RXLTwA/P8RFWdUTpUsaggYMwgYCk # fjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQD # Ex1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQsFAAIF # AO5bZh8wIhgPMjAyNjA5MjEwODE1MjdaGA8yMDI2MDkyMjA4MTUyN1owdzA9Bgor # BgEEAYRZCgQBMS8wLTAKAgUA7ltmHwIBADAKAgEAAgILbQIB/zAHAgEAAgIU7TAK # AgUA7ly3nwIBADA2BgorBgEEAYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIB # AAIDB6EgoQowCAIBAAIDAYagMA0GCSqGSIb3DQEBCwUAA4IBAQCTgckPJx4CrD5L # debafGPKQzi5empgn+e4HLR1gcPb8HouznXMIho+u0FVjYAjVKNcEPh4KAXuXw6/ # UFc2k1pjCeAru4lhGEPgg6zFgNqVm3wQryM2bZrDtRuoVqp+5gRfFdp431UEdEk7 # qkfjA4WMgmvIyNXeKudmRxyvn/KU0RGNgKxUeBGS4s/89vOIbWvdBpT0mCbbPYPP # 82Opzhls2wa7eMmBJ8nDeieINYa+nE0BiEVYTy2vr+hfJYPclOQp7gs4WuuRAANc # 0c1lAONMTCwV7K0m76wYFArFS36N3LX18/WoaXKwXZU7mc/tFVMq6o5fpKwzfgBB # bit/uBgGMYIEDTCCBAkCAQEwgZMwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh # c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD # b3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIw # MTACEzMAAAIUjc0jRO4G33IAAQAAAhQwDQYJYIZIAWUDBAIBBQCgggFKMBoGCSqG # SIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG9w0BCQQxIgQgqc3CqAaaTeCz # ngG+LW/dXiq1jxlCwle4mkHfuqPGkDMwgfoGCyqGSIb3DQEJEAIvMYHqMIHnMIHk # MIG9BCA2eKvvWx5bcoi43bRO3+EttQUCvyeD2dbXy/6+0xK+xzCBmDCBgKR+MHwx # CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt # b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1p # Y3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAACFI3NI0TuBt9yAAEAAAIU # MCIEIDTHonnw8gITFtqepO/LmwTN/1gsxGOK2uYc7Y6q66CAMA0GCSqGSIb3DQEB # CwUABIICALPcCEc7ZbHh5+ziI6/N2RRkcP8fW/zITBjpFYdsYdfrdfxvwWZr0ji0 # KYjs56LuvYkZd/g4HQIEV3NyPIKMa10HAeeyJKZEjzAlQKvui3BOSsgkRHDBzkwA # lCHhW0SgCpJoDBKytIgf7BZMEguEXv/ohn5DTlhULqW5ruW8oE8PrlhLvsQaoU3o # W2pFnyCaqkPnPVWW3yEcqJ7oiEQKX/Ix53qC/6ScdTsaCnVbVcYxi6i5Fu9hFW/3 # VWYretjvUgvWRV/PGwXFiM0bL+GwLzY+5BhdoVgHLV/L7GwKG3D2Enq+ExJaxp7S # uww2Fw8nI3IdfNadbzq6RLjJu/xLBovF1Pe3LGHB2JXU9y8mjCJG0MRhsKZ0LvBf # 2oR6Yv8Zf6dz4kWMXltWJxbYlA6acKpoKNKthyGXSckktrLT0qYZISvMAX2PF8AD # +jIDsxqokfNpSvevCI0JjEsRJwXkmregjam1UORL2xVHeHfShF1Z2YwOFXteayLM # dUMp7cspQrYVR0moGpKx1OEXPcopBdqKM60uydm4Zsygb0XDPhN0A5PpiU9r8OaE # zvqn1bIIRH9Fn/skRFO/hbAcfRQ8IjQzNIwkEIUw5lF3Azk0RAjgc3FsE2A0oX8y # m1UymUG66JjhJ5jpNEV8Z+ZHYzgxykfbpsVsyBzysMRfkdDNJUNw # SIG # End signature block |