DataProtection.Autorest/custom/Cmdlets/Platform/Vault/Set-AzDataProtectionMSIPermission.ps1
|
function Get-VaultIdentity { [Microsoft.Azure.PowerShell.Cmdlets.DataProtection.DoNotExportAttribute()] param ( [Parameter(Mandatory=$true)] [System.Object] $vault, [Parameter(Mandatory=$false)] [System.String] $UserAssignedIdentityARMId ) #Determine the vault MSI to be used $vaultIdentity = $null if ($UserAssignedIdentityARMId) { $vaultIdentity = $vault.Identity.UserAssignedIdentity[$UserAssignedIdentityARMId].PrincipalID Write-Host "Using Vault UAMI with ARMId: $UserAssignedIdentityARMId with Principal ID: $vaultIdentity" } else { $vaultIdentity = $vault.Identity.PrincipalId Write-Host "Using system-assigned identity with Principal ID: $vaultIdentity" } if (-not $vaultIdentity) { throw "Vault identity could not be determined. Please check the UserAssignedIdentityARMId or the vault configuration." } return $vaultIdentity } function Set-AzDataProtectionMSIPermission { [OutputType('System.Object')] [CmdletBinding(PositionalBinding=$false, SupportsShouldProcess, ConfirmImpact = 'High')] [Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Description('Grants required permissions to the backup vault and other resources for configure backup and restore scenarios')] param( [Parameter(ParameterSetName="SetPermissionsForBackup", Mandatory, HelpMessage='Backup instance request object which will be used to configure backup')] [Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Models.Api20250201.IBackupInstanceResource] ${BackupInstance}, [Parameter(ParameterSetName="SetPermissionsForBackup", Mandatory=$false, HelpMessage='ID of the keyvault')] [ValidatePattern("/subscriptions/([A-z0-9\-]+)/resourceGroups/(?<rg>.+)/(?<id>.+)")] [System.String] ${KeyVaultId}, [Parameter(ParameterSetName="SetPermissionsForRestore", Mandatory=$false, HelpMessage='Subscription Id of the backup vault')] [System.String] ${SubscriptionId}, [Parameter(Mandatory, HelpMessage='Resource group of the backup vault')] [Alias('ResourceGroupName')] [System.String] ${VaultResourceGroup}, [Parameter(Mandatory, HelpMessage='Name of the backup vault')] [System.String] ${VaultName}, [Parameter(Mandatory, HelpMessage='Scope at which the permissions need to be granted')] [System.String] [ValidateSet("Resource","ResourceGroup","Subscription")] ${PermissionsScope}, [Parameter(ParameterSetName="SetPermissionsForRestore", Mandatory=$false, HelpMessage='Datasource Type')] [Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Support.DatasourceTypes] ${DatasourceType}, [Parameter(ParameterSetName="SetPermissionsForRestore", Mandatory, HelpMessage='Restore request object which will be used for restore')] [Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Models.Api20250201.IAzureBackupRestoreRequest] ${RestoreRequest}, [Parameter(ParameterSetName="SetPermissionsForRestore", Mandatory=$false, HelpMessage='Snapshot Resource Group')] [System.String] [ValidatePattern("/subscriptions/([A-z0-9\-]+)/resourceGroups/(?<rg>.+)")] ${SnapshotResourceGroupId}, [Parameter(ParameterSetName="SetPermissionsForRestore", Mandatory=$false, HelpMessage='Target storage account ARM Id. Use this parameter for DatasourceType AzureDatabaseForMySQL, AzureDatabaseForPGFlexServer.')] [System.String] ${StorageAccountARMId}, [Parameter(Mandatory=$false, HelpMessage='User Assigned Identity ARM ID of the backup vault to be used for assigning permissions')] [Alias('AssignUserIdentity')] [System.String] ${UserAssignedIdentityARMId} ) process { CheckResourcesModuleDependency $OriginalWarningPreference = $WarningPreference $WarningPreference = 'SilentlyContinue' $MissingRolesInitially = $false if($PsCmdlet.ParameterSetName -eq "SetPermissionsForRestore"){ $DatasourceId = $RestoreRequest.RestoreTargetInfo.DatasourceInfo.ResourceId $DatasourceTypeInternal = "" $subscriptionIdInternal = "" if($DataSourceId -ne $null){ $DatasourceTypeInternal = GetClientDatasourceType -ServiceDatasourceType $RestoreRequest.RestoreTargetInfo.DatasourceInfo.Type $ResourceArray = $DataSourceId.Split("/") $ResourceRG = GetResourceGroupIdFromArmId -Id $DataSourceId $SubscriptionName = GetSubscriptionNameFromArmId -Id $DataSourceId $subscriptionIdInternal = $ResourceArray[2] if($DatasourceType -ne $null -and $DatasourceTypeInternal -ne $DatasourceType){ throw "DatasourceType is not compatible with the RestoreRequest" } } elseif($DatasourceType -ne $null){ $DatasourceTypeInternal = $DatasourceType if($SubscriptionId -eq ""){ $err = "SubscriptionId can't be identified. Please provide the value for parameter SubscriptionId" throw $err } else{ $subscriptionIdInternal = $SubscriptionId } } else{ $err = "DatasourceType can't be identified since DataSourceInfo is null. Please provide the value for parameter DatasourceType" throw $err } $manifest = LoadManifest -DatasourceType $DatasourceTypeInternal.ToString() $vault = Az.DataProtection\Get-AzDataProtectionBackupVault -VaultName $VaultName -ResourceGroupName $VaultResourceGroup -SubscriptionId $subscriptionIdInternal $vaultIdentity = Get-VaultIdentity -vault $vault -UserAssignedIdentityARMId $UserAssignedIdentityARMId if(-not $manifest.supportRestoreGrantPermission){ $err = "Set permissions for restore is currently not supported for given DataSourceType" throw $err } if(($manifest.dataSourceOverSnapshotRGPermissions.Length -gt 0 -or $manifest.snapshotRGPermissions.Length -gt 0) -and $SnapshotResourceGroupId -eq ""){ $warning = "SnapshotResourceGroupId parameter is required to assign permissions over snapshot resource group, skipping" Write-Warning $warning } else{ foreach($Permission in $manifest.dataSourceOverSnapshotRGPermissions) { if($DatasourceTypeInternal -eq "AzureKubernetesService"){ CheckAksModuleDependency $aksCluster = Get-AzAksCluster -Id $RestoreRequest.RestoreTargetInfo.DataSourceInfo.ResourceId -SubscriptionId $subscriptionIdInternal $dataSourceMSI = "" if($aksCluster.Identity.Type -match "UserAssigned"){ $UAMIKey = $aksCluster.Identity.UserAssignedIdentities.Keys[0] if($UAMIKey -eq "" -or $UAMIKey -eq $null){ Write-Error "User assigned identity not found for AKS cluster." } $dataSourceMSI = $aksCluster.Identity.UserAssignedIdentities[$UAMIKey].PrincipalId } else{ $dataSourceMSI = $aksCluster.Identity.PrincipalId } $dataSourceMSIRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $dataSourceMSI } # CSR: $SubscriptionName might be different when we add cross subscription restore $CheckPermission = $dataSourceMSIRoles | Where-Object { ($_.Scope -eq $SnapshotResourceGroupId -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission} if($CheckPermission -ne $null) { Write-Host "Required permission $($Permission) is already assigned to target resource with Id $($RestoreRequest.RestoreTargetInfo.DataSourceInfo.ResourceId) over snapshot resource group with Id $($SnapshotResourceGroupId)" } else { # can add snapshot resource group name in allow statement if ($PSCmdlet.ShouldProcess("$($RestoreRequest.RestoreTargetInfo.DataSourceInfo.ResourceId)","Allow $($Permission) permission over snapshot resource group")) { $MissingRolesInitially = $true AssignMissingRoles -ObjectId $dataSourceMSI -Permission $Permission -PermissionsScope $PermissionsScope -Resource $SnapshotResourceGroupId -ResourceGroup $SnapshotResourceGroupId -Subscription $SubscriptionName Write-Host "Assigned $($Permission) permission to target resource with Id $($RestoreRequest.RestoreTargetInfo.DataSourceInfo.ResourceId) over snapshot resource group with Id $($SnapshotResourceGroupId)" } } } foreach($Permission in $manifest.snapshotRGPermissions) { $AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity # CSR: $SubscriptionName might be different when we add cross subscription restore $CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $SnapshotResourceGroupId -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission} if($CheckPermission -ne $null) { Write-Host "Required permission $($Permission) is already assigned to backup vault over snapshot resource group with Id $($SnapshotResourceGroupId)" } else { $MissingRolesInitially = $true AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $SnapshotResourceGroupId -ResourceGroup $SnapshotResourceGroupId -Subscription $SubscriptionName Write-Host "Assigned $($Permission) permission to the backup vault over snapshot resource group with Id $($SnapshotResourceGroupId)" } } } foreach($Permission in $manifest.datasourcePermissionsForRestore) { # set context to the subscription where ObjectId is present $AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity $CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $DataSourceId -or $_.Scope -eq $ResourceRG -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission} if($CheckPermission -ne $null) { Write-Host "Required permission $($Permission) is already assigned to backup vault over DataSource with Id $($DataSourceId)" } else { $MissingRolesInitially = $true AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $DataSourceId -ResourceGroup $ResourceRG -Subscription $SubscriptionName Write-Host "Assigned $($Permission) permission to the backup vault over DataSource with Id $($DataSourceId)" } } foreach($Permission in $manifest.storageAccountPermissionsForRestore) { # set context to the subscription where ObjectId is present $AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity $targetResourceArmId = $restoreRequest.RestoreTargetInfo.TargetDetail.TargetResourceArmId if($targetResourceArmId -ne $null -and $targetResourceArmId -ne ""){ if(-not $targetResourceArmId.Contains("/blobServices/")){ $err = "restoreRequest.RestoreTargetInfo.TargetDetail.TargetResourceArmId is not in the correct format" throw $err } $storageAccId = ($targetResourceArmId -split "/blobServices/")[0] $storageAccResourceGroupId = ($targetResourceArmId -split "/providers/")[0] $storageAccountSubId = ($targetResourceArmId -split "/resourceGroups/")[0] } else{ if($StorageAccountARMId -eq ""){ $err = "Permissions can't be assigned to target storage account. Please input parameter StorageAccountARMId" throw $err } # storage Account subscription and resource group $storageAccountSubId = ($StorageAccountARMId -split "/resourceGroups/")[0] $storageAccResourceGroupId = ($StorageAccountARMId -split "/providers/")[0] # storage Account ID $storageAccId = $StorageAccountARMId } $CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $storageAccId -or $_.Scope -eq $storageAccResourceGroupId -or $_.Scope -eq $storageAccountSubId) -and $_.RoleDefinitionName -eq $Permission} if($CheckPermission -ne $null) { Write-Host "Required permission $($Permission) is already assigned to backup vault over storage account with Id $($storageAccId)" } else { $MissingRolesInitially = $true AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $storageAccId -ResourceGroup $storageAccResourceGroupId -Subscription $storageAccountSubId Write-Host "Assigned $($Permission) permission to the backup vault over storage account with Id $($storageAccId)" } } } elseif($PsCmdlet.ParameterSetName -eq "SetPermissionsForBackup"){ $DatasourceId = $BackupInstance.Property.DataSourceInfo.ResourceId $DatasourceType = GetClientDatasourceType -ServiceDatasourceType $BackupInstance.Property.DataSourceInfo.Type $manifest = LoadManifest -DatasourceType $DatasourceType.ToString() $ResourceArray = $DataSourceId.Split("/") $ResourceRG = GetResourceGroupIdFromArmId -Id $DataSourceId $SubscriptionName = GetSubscriptionNameFromArmId -Id $DataSourceId $subscriptionId = $ResourceArray[2] $vault = Az.DataProtection\Get-AzDataProtectionBackupVault -VaultName $VaultName -ResourceGroupName $VaultResourceGroup -SubscriptionId $ResourceArray[2] $vaultIdentity = Get-VaultIdentity -vault $vault -UserAssignedIdentityARMId $UserAssignedIdentityARMId $AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity # If more DataSourceTypes support this then we can make it manifest driven if($DatasourceType -eq "AzureDatabaseForPostgreSQL") { CheckPostgreSqlModuleDependency CheckKeyVaultModuleDependency if($KeyVaultId -eq "" -or $KeyVaultId -eq $null) { Write-Error "KeyVaultId not provided. Please provide the KeyVaultId parameter to successfully assign the permissions on the keyvault" } $KeyvaultName = GetResourceNameFromArmId -Id $KeyVaultId $KeyvaultRGName = GetResourceGroupNameFromArmId -Id $KeyVaultId $ServerName = GetResourceNameFromArmId -Id $DataSourceId $ServerRG = GetResourceGroupNameFromArmId -Id $DataSourceId $KeyvaultArray = $KeyVaultId.Split("/") $KeyvaultRG = GetResourceGroupIdFromArmId -Id $KeyVaultId $KeyvaultSubscriptionName = GetSubscriptionNameFromArmId -Id $KeyVaultId if ($PSCmdlet.ShouldProcess("KeyVault: $($KeyvaultName) and PostgreSQLServer: $($ServerName)"," 1.'Allow All Azure services' under network connectivity in the Postgres Server 2.'Allow Trusted Azure services' under network connectivity in the Key vault")) { Update-AzPostgreSqlServer -ResourceGroupName $ServerRG -ServerName $ServerName -PublicNetworkAccess Enabled| Out-Null New-AzPostgreSqlFirewallRule -Name AllowAllAzureIps -ResourceGroupName $ServerRG -ServerName $ServerName -EndIPAddress 0.0.0.0 -StartIPAddress 0.0.0.0 | Out-Null $SecretsList = "" try{$SecretsList = Get-AzKeyVaultSecret -VaultName $KeyvaultName} catch{ $err = $_ throw $err } $SecretValid = $false $GivenSecretUri = $BackupInstance.Property.DatasourceAuthCredentials.SecretStoreResource.Uri foreach($Secret in $SecretsList) { $SecretArray = $Secret.Id.Split("/") $SecretArray[2] = $SecretArray[2] -replace "....$" $SecretUri = $SecretArray[0] + "/" + $SecretArray[1] + "/"+ $SecretArray[2] + "/" + $SecretArray[3] + "/" + $SecretArray[4] if($Secret.Enabled -eq "true" -and $SecretUri -eq $GivenSecretUri) { $SecretValid = $true } } if($SecretValid -eq $false) { $err = "The Secret URI provided in the backup instance is not associated with the keyvault Id provided. Please provide a valid combination of Secret URI and keyvault Id" throw $err } if($KeyVault.PublicNetworkAccess -eq "Disabled") { $err = "Keyvault needs to have public network access enabled" throw $err } try{$KeyVault = Get-AzKeyVault -VaultName $KeyvaultName} catch{ $err = $_ throw $err } try{Update-AzKeyVaultNetworkRuleSet -VaultName $KeyvaultName -Bypass AzureServices -Confirm:$False} catch{ $err = $_ throw $err } } } foreach($Permission in $manifest.keyVaultPermissions) { if($KeyVault.EnableRbacAuthorization -eq $false ) { try{ $KeyVault = Get-AzKeyVault -VaultName $KeyvaultName $KeyVaultAccessPolicies = $KeyVault.AccessPolicies $KeyVaultAccessPolicy = $KeyVaultAccessPolicies | Where-Object {$_.ObjectID -eq $vaultIdentity} if($KeyVaultAccessPolicy -eq $null) { Set-AzKeyVaultAccessPolicy -VaultName $KeyvaultName -ObjectId $vaultIdentity -PermissionsToSecrets Get,List -Confirm:$False break } $KeyvaultAccessPolicyPermissions = $KeyVaultAccessPolicy."PermissionsToSecrets" $KeyvaultAccessPolicyPermissions+="Get" $KeyvaultAccessPolicyPermissions+="List" [String[]]$FinalKeyvaultAccessPolicyPermissions = $KeyvaultAccessPolicyPermissions $FinalKeyvaultAccessPolicyPermissions = $FinalKeyvaultAccessPolicyPermissions | select -uniq Set-AzKeyVaultAccessPolicy -VaultName $KeyvaultName -ObjectId $vaultIdentity -PermissionsToSecrets $FinalKeyvaultAccessPolicyPermissions -Confirm:$False } catch{ $err = $_ throw $err } } else { $CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $KeyVaultId -or $_.Scope -eq $KeyvaultRG -or $_.Scope -eq $KeyvaultSubscription) -and $_.RoleDefinitionName -eq $Permission} if($CheckPermission -ne $null) { Write-Host "Required permission $($Permission) is already assigned to backup vault over KeyVault with Id $($KeyVaultId)" } else { $MissingRolesInitially = $true AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $KeyVaultId -ResourceGroup $KeyvaultRG -Subscription $KeyvaultSubscriptionName Write-Host "Assigned $($Permission) permission to the backup vault over key vault with Id $($KeyVaultId)" } } } foreach($Permission in $manifest.dataSourceOverSnapshotRGPermissions) { $SnapshotResourceGroupId = $BackupInstance.Property.PolicyInfo.PolicyParameter.DataStoreParametersList[0].ResourceGroupId if($DatasourceType -eq "AzureKubernetesService"){ CheckAksModuleDependency $aksCluster = Get-AzAksCluster -Id $BackupInstance.Property.DataSourceInfo.ResourceId -SubscriptionId $subscriptionId $dataSourceMSI = "" if($aksCluster.Identity.Type -match "UserAssigned"){ $UAMIKey = $aksCluster.Identity.UserAssignedIdentities.Keys[0] if($UAMIKey -eq "" -or $UAMIKey -eq $null){ Write-Error "User assigned identity not found for AKS cluster." } $dataSourceMSI = $aksCluster.Identity.UserAssignedIdentities[$UAMIKey].PrincipalId } else{ $dataSourceMSI = $aksCluster.Identity.PrincipalId } $dataSourceMSIRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $dataSourceMSI } # CSR: $SubscriptionName might be different when we add cross subscription restore $CheckPermission = $dataSourceMSIRoles | Where-Object { ($_.Scope -eq $SnapshotResourceGroupId -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission} if($CheckPermission -ne $null) { Write-Host "Required permission $($Permission) is already assigned to DataSource with Id $($BackupInstance.Property.DataSourceInfo.ResourceId) over snapshot resource group with Id $($SnapshotResourceGroupId)" } else { # can add snapshot resource group name in allow statement if ($PSCmdlet.ShouldProcess("$($BackupInstance.Property.DataSourceInfo.ResourceId)","Allow $($Permission) permission over snapshot resource group")) { $MissingRolesInitially = $true AssignMissingRoles -ObjectId $dataSourceMSI -Permission $Permission -PermissionsScope $PermissionsScope -Resource $SnapshotResourceGroupId -ResourceGroup $SnapshotResourceGroupId -Subscription $SubscriptionName Write-Host "Assigned $($Permission) permission to DataSource with Id $($BackupInstance.Property.DataSourceInfo.ResourceId) over snapshot resource group with Id $($SnapshotResourceGroupId)" } } } foreach($Permission in $manifest.snapshotRGPermissions) { $SnapshotResourceGroupId = $BackupInstance.Property.PolicyInfo.PolicyParameter.DataStoreParametersList[0].ResourceGroupId # CSR: $SubscriptionName might be different when we add cross subscription restore $AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity $CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $SnapshotResourceGroupId -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission} if($CheckPermission -ne $null) { Write-Host "Required permission $($Permission) is already assigned to backup vault over snapshot resource group with Id $($SnapshotResourceGroupId)" } else { $MissingRolesInitially = $true AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $SnapshotResourceGroupId -ResourceGroup $SnapshotResourceGroupId -Subscription $SubscriptionName Write-Host "Assigned $($Permission) permission to the backup vault over snapshot resource group with Id $($SnapshotResourceGroupId)" } } foreach($Permission in $manifest.datasourcePermissions) { $AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity $CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $DataSourceId -or $_.Scope -eq $ResourceRG -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission} if($CheckPermission -ne $null) { Write-Host "Required permission $($Permission) is already assigned to backup vault over DataSource with Id $($DataSourceId)" } else { $MissingRolesInitially = $true AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $DataSourceId -ResourceGroup $ResourceRG -Subscription $SubscriptionName Write-Host "Assigned $($Permission) permission to the backup vault over DataSource with Id $($DataSourceId)" } } foreach($Permission in $manifest.datasourceRGPermissions) { $AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity $CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $ResourceRG -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission} if($CheckPermission -ne $null) { Write-Host "Required permission $($Permission) is already assigned to backup vault over DataSource resource group with name $($ResourceRG)" } else { $MissingRolesInitially = $true # "Resource","ResourceGroup","Subscription" $DatasourceRGScope = $PermissionsScope if($PermissionsScope -eq "Resource"){ $DatasourceRGScope = "ResourceGroup" } AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $DatasourceRGScope -Resource $DataSourceId -ResourceGroup $ResourceRG -Subscription $SubscriptionName Write-Host "Assigned $($Permission) permission to the backup vault over DataSource resource group with name $($ResourceRG)" } } } if($MissingRolesInitially -eq $true) { Write-Host "Waiting for 60 seconds for roles to propagate" Start-Sleep -Seconds 60 } $WarningPreference = $OriginalWarningPreference } } # SIG # Begin signature block # MIIoKgYJKoZIhvcNAQcCoIIoGzCCKBcCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCANLdjNcUfrGKpw # z9D2CS1PVfZavcNikDSr2zoOGkjd9KCCDXYwggX0MIID3KADAgECAhMzAAAEhV6Z # 7A5ZL83XAAAAAASFMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p # bmcgUENBIDIwMTEwHhcNMjUwNjE5MTgyMTM3WhcNMjYwNjE3MTgyMTM3WjB0MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB # AQDASkh1cpvuUqfbqxele7LCSHEamVNBfFE4uY1FkGsAdUF/vnjpE1dnAD9vMOqy # 5ZO49ILhP4jiP/P2Pn9ao+5TDtKmcQ+pZdzbG7t43yRXJC3nXvTGQroodPi9USQi # 9rI+0gwuXRKBII7L+k3kMkKLmFrsWUjzgXVCLYa6ZH7BCALAcJWZTwWPoiT4HpqQ # hJcYLB7pfetAVCeBEVZD8itKQ6QA5/LQR+9X6dlSj4Vxta4JnpxvgSrkjXCz+tlJ # 67ABZ551lw23RWU1uyfgCfEFhBfiyPR2WSjskPl9ap6qrf8fNQ1sGYun2p4JdXxe # UAKf1hVa/3TQXjvPTiRXCnJPAgMBAAGjggFzMIIBbzAfBgNVHSUEGDAWBgorBgEE # AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUuCZyGiCuLYE0aU7j5TFqY05kko0w # RQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEW # MBQGA1UEBRMNMjMwMDEyKzUwNTM1OTAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzci # tW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5j # b20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEG # CCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQu # Y29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0 # MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBACjmqAp2Ci4sTHZci+qk # tEAKsFk5HNVGKyWR2rFGXsd7cggZ04H5U4SV0fAL6fOE9dLvt4I7HBHLhpGdE5Uj # Ly4NxLTG2bDAkeAVmxmd2uKWVGKym1aarDxXfv3GCN4mRX+Pn4c+py3S/6Kkt5eS # DAIIsrzKw3Kh2SW1hCwXX/k1v4b+NH1Fjl+i/xPJspXCFuZB4aC5FLT5fgbRKqns # WeAdn8DsrYQhT3QXLt6Nv3/dMzv7G/Cdpbdcoul8FYl+t3dmXM+SIClC3l2ae0wO # lNrQ42yQEycuPU5OoqLT85jsZ7+4CaScfFINlO7l7Y7r/xauqHbSPQ1r3oIC+e71 # 5s2G3ClZa3y99aYx2lnXYe1srcrIx8NAXTViiypXVn9ZGmEkfNcfDiqGQwkml5z9 # nm3pWiBZ69adaBBbAFEjyJG4y0a76bel/4sDCVvaZzLM3TFbxVO9BQrjZRtbJZbk # C3XArpLqZSfx53SuYdddxPX8pvcqFuEu8wcUeD05t9xNbJ4TtdAECJlEi0vvBxlm # M5tzFXy2qZeqPMXHSQYqPgZ9jvScZ6NwznFD0+33kbzyhOSz/WuGbAu4cHZG8gKn # lQVT4uA2Diex9DMs2WHiokNknYlLoUeWXW1QrJLpqO82TLyKTbBM/oZHAdIc0kzo # STro9b3+vjn2809D0+SOOCVZMIIHejCCBWKgAwIBAgIKYQ6Q0gAAAAAAAzANBgkq # hkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x # EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv # bjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 # IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEwOTA5WjB+MQswCQYDVQQG # EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG # A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQg # Q29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC # CgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+laUKq4BjgaBEm6f8MMHt03 # a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc6Whe0t+bU7IKLMOv2akr # rnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4Ddato88tt8zpcoRb0Rrrg # OGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+lD3v++MrWhAfTVYoonpy # 4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nkkDstrjNYxbc+/jLTswM9 # sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6A4aN91/w0FK/jJSHvMAh # dCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmdX4jiJV3TIUs+UsS1Vz8k # A/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL5zmhD+kjSbwYuER8ReTB # w3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zdsGbiwZeBe+3W7UvnSSmn # Eyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3T8HhhUSJxAlMxdSlQy90 # lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS4NaIjAsCAwEAAaOCAe0w # ggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRIbmTlUAXTgqoXNzcitW2o # ynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD # VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBa # BgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny # bC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsG # AQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29t # L3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MIGfBgNV # HSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEFBQcCARYzaHR0cDovL3d3 # dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1hcnljcHMuaHRtMEAGCCsG # AQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkAYwB5AF8AcwB0AGEAdABl # AG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn8oalmOBUeRou09h0ZyKb # C5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7v0epo/Np22O/IjWll11l # hJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0bpdS1HXeUOeLpZMlEPXh6 # I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/KmtYSWMfCWluWpiW5IP0 # wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvyCInWH8MyGOLwxS3OW560 # STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBpmLJZiWhub6e3dMNABQam # ASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJihsMdYzaXht/a8/jyFqGa # J+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYbBL7fQccOKO7eZS/sl/ah # XJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbSoqKfenoi+kiVH6v7RyOA # 9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sLgOppO6/8MO0ETI7f33Vt # Y5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtXcVZOSEXAQsmbdlsKgEhr # /Xmfwb1tbWrJUnMTDXpQzTGCGgowghoGAgEBMIGVMH4xCzAJBgNVBAYTAlVTMRMw # EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN # aWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNp # Z25pbmcgUENBIDIwMTECEzMAAASFXpnsDlkvzdcAAAAABIUwDQYJYIZIAWUDBAIB # BQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEO # MAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIHeWTmCZ0HsbmsVz21It6uUO # RtG7fXmBGRCzif6Yn7pMMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8A # cwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEB # BQAEggEAogOsxnaBTVWdylmitdGC7Bt1/Y1UW5Y9dyzLtIhDE7tAjPRp2ynGvB/d # EP+YPoCAP2wfuLnsQCVMdOvWzKW4hAma697AAAdrkUew9Yuzs8DppkJNeAy7oJRp # xxLFXr1+Be/oGEjKEubV7pI/Cxnah87bYKrh9el/92vVVloE98UlkHAkZqGeRHl8 # 1qDQHkhS2g9LePSReP8tQxXkuAb3vnYoY9Y5X9KXY1Vsb28JWjGddzLhm9zuhslh # 3eRjaE00LDHyimkjYNQlb+/37tmt/qLzE5m5ODrxtVDIKQtg19Hez2LX+qpxZSBW # K2s9ul5tH499zjmozKCV1AxR1ZAlL6GCF5QwgheQBgorBgEEAYI3AwMBMYIXgDCC # F3wGCSqGSIb3DQEHAqCCF20wghdpAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFSBgsq # hkiG9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFl # AwQCAQUABCCKNrkOLNWE9QaEOge6H/E3uEguIWCrva9kfIKZwdkVHwIGaPAA9fNg # GBMyMDI1MTAyOTEyMDE1NC4xMzZaMASAAgH0oIHRpIHOMIHLMQswCQYDVQQGEwJV # UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE # ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1l # cmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTAwMC0w # NUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2Wg # ghHqMIIHIDCCBQigAwIBAgITMwAAAgh4nVhdksfZUgABAAACCDANBgkqhkiG9w0B # AQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYD # VQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDAeFw0yNTAxMzAxOTQy # NTNaFw0yNjA0MjIxOTQyNTNaMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz # aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv # cnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25z # MScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTAwMC0wNUUwLUQ5NDcxJTAjBgNV # BAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEB # AQUAA4ICDwAwggIKAoICAQC1y3AI5lIz3Ip1nK5BMUUbGRsjSnCz/VGs33zvY0Ne # shsPgfld3/Z3/3dS8WKBLlDlosmXJOZlFSiNXUd6DTJxA9ik/ZbCdWJ78LKjbN3t # FkX2c6RRpRMpA8sq/oBbRryP3c8Q/gxpJAKHHz8cuSn7ewfCLznNmxqliTk3Q5LH # qz2PjeYKD/dbKMBT2TAAWAvum4z/HXIJ6tFdGoNV4WURZswCSt6ROwaqQ1oAYGvE # ndH+DXZq1+bHsgvcPNCdTSIpWobQiJS/UKLiR02KNCqB4I9yajFTSlnMIEMz/Ni5 # 38oGI64phcvNpUe2+qaKWHZ8d4T1KghvRmSSF4YF5DNEJbxaCUwsy7nULmsFnTaO # jVOoTFWWfWXvBuOKkBcQKWGKvrki976j4x+5ezAP36fq3u6dHRJTLZAu4dEuOooU # 3+kMZr+RBYWjTHQCKV+yZ1ST0eGkbHXoA2lyyRDlNjBQcoeZIxWCZts/d3+nf1ji # SLN6f6wdHaUz0ADwOTQ/aEo1IC85eFePvyIKaxFJkGU2Mqa6Xzq3qCq5tokIHtjh # ogsrEgfDKTeFXTtdhl1IPtLcCfMcWOGGAXosVUU7G948F6W96424f2VHD8L3FoyA # I9+r4zyIQUmqiESzuQWeWpTTjFYwCmgXaGOuSDV8cNOVQB6IPzPneZhVTjwxbAZl # aQIDAQABo4IBSTCCAUUwHQYDVR0OBBYEFKMx4vfOqcUTgYOVB9f18/mhegFNMB8G # A1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCG # Tmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUy # MFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4w # XAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2Vy # dHMvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwG # A1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQD # AgeAMA0GCSqGSIb3DQEBCwUAA4ICAQBRszKJKwAfswqdaQPFiaYB/ZNAYWDa040X # TcQsCaCua5nsG1IslYaSpH7miTLr6eQEqXczZoqeOa/xvDnMGifGNda0CHbQwtpn # IhsutrKO2jhjEaGwlJgOMql21r7Ik6XnBza0e3hBOu4UBkMl/LEX+AURt7i7+RTN # sGN0cXPwPSbTFE+9z7WagGbY9pwUo/NxkGJseqGCQ/9K2VMU74bw5e7+8IGUhM2x # spJPqnSeHPhYmcB0WclOxcVIfj/ZuQvworPbTEEYDVCzSN37c0yChPMY7FJ+HGFB # NJxwd5lKIr7GYfq8a0gOiC2ljGYlc4rt4cCed1XKg83f0l9aUVimWBYXtfNebhpf # r6Lc3jD8NgsrDhzt0WgnIdnTZCi7jxjsIBilH99pY5/h6bQcLKK/E6KCP9E1YN78 # fLaOXkXMyO6xLrvQZ+uCSi1hdTufFC7oSB/CU5RbfIVHXG0j1o2n1tne4eCbNfKq # UPTE31tNbWBR23Yiy0r3kQmHeYE1GLbL4pwknqaip1BRn6WIUMJtgncawEN33f8A # YGZ4a3NnHopzGVV6neffGVag4Tduy+oy1YF+shChoXdMqfhPWFpHe3uJGT4GJEiN # s4+28a/wHUuF+aRaR0cN5P7XlOwU1360iUCJtQdvKQaNAwGI29KOwS3QGriR9F2j # OGPUAlpeEzCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZI # hvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw # DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # MjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAy # MDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMC # VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV # BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRp # bWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC # AQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25Phdg # M/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPF # dvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6 # GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBp # Dco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50Zu # yjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3E # XzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0 # lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1q # GFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ # +QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PA # PBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkw # EgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxG # NSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARV # MFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWlj # cm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAK # BggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMC # AYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvX # zpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20v # cGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYI # KwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5j # b20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG # 9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0x # M7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmC # VgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449 # xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wM # nosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDS # PeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2d # Y3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxn # GSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+Crvs # QWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokL # jzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL # 6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggNN # MIICNQIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp # bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw # b3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEn # MCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOkEwMDAtMDVFMC1EOTQ3MSUwIwYDVQQD # ExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMKAQEwBwYFKw4DAhoDFQCN # kvu0NKcSjdYKyrhJZcsyXOUTNKCBgzCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1w # IFBDQSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA7KxKHzAiGA8yMDI1MTAyOTA4MDkw # M1oYDzIwMjUxMDMwMDgwOTAzWjB0MDoGCisGAQQBhFkKBAExLDAqMAoCBQDsrEof # AgEAMAcCAQACAh5eMAcCAQACAhJNMAoCBQDsrZufAgEAMDYGCisGAQQBhFkKBAIx # KDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAIAgEAAgMBhqAwDQYJKoZI # hvcNAQELBQADggEBABhF8Kk7t5teyx1FsAG+Ek400Zd+ikdusxDbNQQdWFauo21h # yXSUl1xcFB00Cpp8g0VVL5+xGx9umT+mNxMRtaB57IxTHDAA5MXq0s7oVz9RhLEO # i1Iv2UeqGNAobhBr/ufq+jDvQ+0O216rz5pcu5HdMlk6no7XFZiY5+rTOy4dSTUO # 71WP/NoXTIe3z76fRpYm67q+HuaJNdsoQ4NTsQD7ge/6zS9wNvYxZptWtaQQqam4 # gx9d3a/e6KiXV66CEHqZUY2pEyyPb4Wjdtq7oLhkcDO8rpUBKM9P4WKAeJljodOO # 9gPpw+C7if1dvrdl+AoivwJL+S8ud2X4SIcePKExggQNMIIECQIBATCBkzB8MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNy # b3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAgh4nVhdksfZUgABAAACCDAN # BglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMC8G # CSqGSIb3DQEJBDEiBCCFE4a6nMJa83o+l+GpvcEdTjhBRgXPnJm8ApxSFBZ0CDCB # +gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EII//jm8JHa2W1O9778t9+Ft2Z5Nm # KqttPk6Q+9RRpmepMIGYMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh # c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD # b3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIw # MTACEzMAAAIIeJ1YXZLH2VIAAQAAAggwIgQgw6AKjEA7/SO0k/tCdFOXe0tDV2Nm # u/JhijtgOLucIUEwDQYJKoZIhvcNAQELBQAEggIARDyzXrtLORkXlnioHGf5MmEx # RcSpHRLzU+r7IH1htdLXQ/JvtgeX9oh4MNBOizWIpEgJ8TKWswo9F15sZ8kB6tfm # VaPiCaDgx9gTcCZVqwWEcfvgFJAlSp/EN2vbYMHty644i+qefucjCEmJtn2tyFo9 # jfZC3qVnphT+547gYymIYPU23fSu3Z9rT8lWAJDHEuaTlzHq0w3QdBnhCkEZe0Pp # rA8TYVSAb3P+Pvf9iunut1zsn/rn3ACb03K4cykIvKJFo9Az+jwNG+JvOV9/4Ww7 # U2em7RYBfvkeBp7Ve8AWuRJzwd0URK2MGhSj8dknmA+iy0BMAMQpRVoaLSKqcLd6 # iRJ07aXnTMr9f+6gFdwmnroCYUXMkxYaWTdybGYYOEs07sEkV3Ue5keaFkhYsvge # uhpYE1QS6d8jBXjreXGNX2/APSLwi0GzGXb5g0NfOCpZOEMRyjGKUPBdOFoSEnD1 # tD/I7//eNS/3N2BwbS71ECydine3G6plaL/uXg7Snyg1lAQCpQf89gA5RezLio/Q # tTscmo22E0FiodM4ILUpbLwzOU/f5t3Q7lY53VQxtsUhaoeqxyh+fmVQtHoPJKjp # rguUSdNwtjOFzUAYY9tepHxDFj/LgJ/n36blSI15TdqXM6YbS8zx3sOpUvVWtyAs # 2fk4wBEBqo+ezyQA7RI= # SIG # End signature block |