ContinuousAssurance/ContinuousAssurance.ps1
|
Set-StrictMode -Version Latest function Install-AzSKADOContinuousAssurance { <# .SYNOPSIS This command would help in setting up Continuous Assurance feature of AzSK.ADO in your subscription .DESCRIPTION This command will create a resource group (Name: ADOScannerRG) which runs security scan on organization and projects which are specified during installation. Security scan results will be populated in Log Analytics workspace which is configured during installation. Also, detailed logs will be stored in storage account (Name: adoscannersayyMMddHHmmss format). .PARAMETER SubscriptionId Subscription id in which CA setup needs to be done. .PARAMETER Location Location in which all resources need to be setup. .PARAMETER ResourceGroupName Resource group name where CA setup need to be done. (Default : ADOScannerRG) .PARAMETER LAWSId Workspace ID of Log Analytics workspace where security scan results will be sent .PARAMETER LAWSSharedKey Shared key of Log Analytics workspace which is used to monitor security scan results. .PARAMETER OrganizationName Organization name for which scan will be performed. .PARAMETER PATToken PAT token secure string for organization to be scanned. .PARAMETER PATTokenURL KeyVault URL for PATToken. .PARAMETER IdentityResourceId Resource id of user assigned managed identity to be used to access KeyVault for PATToken. .PARAMETER ProjectName Project to be scanned within the organization. .PARAMETER ExtendedCommand Extended command to narrow down the scans. .PARAMETER ScanIntervalInHours Overrides the default scan interval (24hrs) with the custom provided value. .PARAMETER CreateLAWorkspace Switch to create and map new log analytics workspace with CA setup. .NOTES This command helps the application team to verify whether their ADO resources are compliant with the security guidance or not #> Param( [Parameter(Mandatory = $true, ParameterSetName = "Default", HelpMessage="Subscription id in which CA setup needs to be done.")] [Parameter(Mandatory = $true, ParameterSetName = "CentralCA")] [Parameter(Mandatory = $true, ParameterSetName = "OAuthBasedCA")] [string] [Alias("sid")] $SubscriptionId , [Parameter(Mandatory = $true, ParameterSetName = "Default", HelpMessage = "Organization name for which scan will be performed.")] [Parameter(Mandatory = $true, ParameterSetName = "CentralCA")] [Parameter(Mandatory = $true, ParameterSetName = "OAuthBasedCA")] [ValidateNotNullOrEmpty()] [Alias("oz")] [string] $OrganizationName, [Parameter(Mandatory = $true, ParameterSetName = "Default", HelpMessage = "Project to be scanned within the organization.")] [Parameter(Mandatory = $true, ParameterSetName = "CentralCA")] [Parameter(Mandatory = $true, ParameterSetName = "OAuthBasedCA")] [Alias("pns", "ProjectNames","pn")] [string] $ProjectName, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "PAT token secure string for organization to be scanned.")] [ValidateNotNullOrEmpty()] [Alias("pat","tkn")] [System.Security.SecureString] $PATToken, [Parameter(Mandatory = $true, ParameterSetName = "CentralCA", HelpMessage = "KeyVault URL for PATToken")] [ValidateNotNullOrEmpty()] [Alias("ptu")] [string] $PATTokenURL, [Parameter(Mandatory = $true, ParameterSetName = "CentralCA", HelpMessage = "Resource id of user assigned managed identity")] [ValidateNotNullOrEmpty()] [Alias("ici")] [string] $IdentityResourceId, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Resource group name where CA setup needs to be done")] [Parameter(Mandatory = $false, ParameterSetName = "CentralCA")] [Parameter(Mandatory = $false, ParameterSetName = "OAuthBasedCA")] [string] [ValidateNotNullOrEmpty()] [Alias("rgn")] $ResourceGroupName, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Location in which all resources need to be setup.")] [Parameter(Mandatory = $false, ParameterSetName = "CentralCA")] [Parameter(Mandatory = $false, ParameterSetName = "OAuthBasedCA")] [string] [ValidateNotNullOrEmpty()] [Alias("loc")] $Location, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Workspace ID of Log Analytics workspace which is used to monitor security scan results.")] [Parameter(Mandatory = $false, ParameterSetName = "CentralCA")] [Parameter(Mandatory = $false, ParameterSetName = "OAuthBasedCA")] [string] [ValidateNotNullOrEmpty()] [Alias("lwid","wid")] $LAWSId, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Shared key of Log Analytics workspace which is used to monitor security scan results.")] [Parameter(Mandatory = $false, ParameterSetName = "CentralCA")] [Parameter(Mandatory = $false, ParameterSetName = "OAuthBasedCA")] [string] [ValidateNotNullOrEmpty()] [Alias("lwkey","wkey")] $LAWSSharedKey, [switch] [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Switch to create and map new Log Analytics workspace with CA setup.")] [Parameter(Mandatory = $false, ParameterSetName = "CentralCA")] [Parameter(Mandatory = $false, ParameterSetName = "OAuthBasedCA")] [Alias("cws")] $CreateLAWorkspace, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Use extended command to narrow down the target scan.")] [Parameter(Mandatory = $false, ParameterSetName = "CentralCA")] [Parameter(Mandatory = $false, ParameterSetName = "OAuthBasedCA")] [Alias("ex")] [string] $ExtendedCommand, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Overrides the default scan interval (24hrs) with the custom provided value.")] [Parameter(Mandatory = $false, ParameterSetName = "CentralCA")] [Parameter(Mandatory = $false, ParameterSetName = "OAuthBasedCA")] [Alias("si")] [int] $ScanIntervalInHours, [Parameter(Mandatory = $true, ParameterSetName = "OAuthBasedCA")] [Alias("oai")] [System.Security.SecureString] $OAuthAppId, [Parameter(Mandatory = $true, ParameterSetName = "OAuthBasedCA")] [ValidateNotNullOrEmpty()] [Alias("csec")] [System.Security.SecureString] $ClientSecret, [Parameter(Mandatory = $true, ParameterSetName = "OAuthBasedCA")] [Alias("ausc")] [string] $AuthorizedScopes, [switch] [Parameter(Mandatory = $false, HelpMessage = "Create a storage account to store common data(eg. bug logging etc.).")] [Alias("cdsa")] $CreateCommonDataStorageAccount ) Begin { [CommandHelper]::BeginCommand($PSCmdlet.MyInvocation); [ListenerHelper]::RegisterListeners(); } Process { try { if ([string]::IsNullOrWhiteSpace($PATToken) -and [string]::IsNullOrWhiteSpace($PATTokenURL) -and $PSCmdlet.ParameterSetName -ne 'OAuthBasedCA' ) { $PATToken = Read-Host "Provide PAT for [$OrganizationName] org:" -AsSecureString } $resolver = [Resolver]::new($OrganizationName) $caAccount = [CAAutomation]::new($SubscriptionId, $Location,` $OrganizationName, $PATToken, $PATTokenURL, $ResourceGroupName, $LAWSId,` $LAWSSharedKey, $ProjectName, $IdentityResourceId,` $ExtendedCommand, $ScanIntervalInHours, $PSCmdlet.MyInvocation, $CreateLAWorkspace,` $OAuthAppId, $ClientSecret, $AuthorizedScopes, $CreateCommonDataStorageAccount); if ($PSCmdlet.ParameterSetName -eq 'Default') { $caAccount.InvokeFunction($caAccount.InstallAzSKADOContinuousAssurance) } elseif ($PSCmdlet.ParameterSetName -eq 'CentralCA') { $caAccount.InvokeFunction($caAccount.InstallAzSKADOCentralContinuousAssurance) } else { $caAccount.InvokeFunction($caAccount.InstallAzSKADOOAuthBasedContinuousAssurance) } } catch { [EventBase]::PublishGenericException($_); } } End { [ListenerHelper]::UnregisterListeners(); } } function Update-AzSKADOContinuousAssurance { <# .SYNOPSIS This command would help in updating user configurable properties of Continuous Assurance in your subscription .DESCRIPTION This command will update configurations of existing AzSK.ADO CA setup in your subscription. Security scan results will be populated in Log Analytics workspace which is configured during installation. Also, detailed logs will be stored in storage account (Name: adoscannersayyMMddHHmmss format). .PARAMETER SubscriptionId Subscription id in which CA setup is present. .PARAMETER ResourceGroupName Resource group name where CA setup is available (Default : ADOScannerRG). .PARAMETER LAWSId Workspace ID of Log Analytics workspace which is used to monitor security scan results. .PARAMETER LAWSSharedKey Shared key of Log Analytics workspace which is used to monitor security scan results. .PARAMETER AltLAWSId Alternate workspace ID of Log Analytics workspace where security scan results will be sent .PARAMETER AltLAWSSharedKey Alternate shared key of Log Analytics workspace which is used to monitor security scan results. .PARAMETER OrganizationName Organization name for which scan will be performed. .PARAMETER PATToken PAT token secure string for organization to be scanned. .PARAMETER PATTokenURL KeyVault URL for PATToken. .PARAMETER ProjectName Project to be scanned within the organization. .PARAMETER ExtendedCommand Extended command to narrow down the target scan. .PARAMETER ScanIntervalInHours Overrides the default scan interval (24hrs) with the custom provided value. .PARAMETER ClearExtendedCommand Use to clear extended command. .PARAMETER WebhookUrl Provide webhook url to enable it in CA setup. .PARAMETER WebhookAuthZHeaderName Provide webhook header name. .PARAMETER WebhookAuthZHeaderValue Provide webhook header value. .PARAMETER AllowSelfSignedWebhookCertificate Use this switch to allow self signed webhook certificate. #> Param( [Parameter(Mandatory = $true, ParameterSetName = "Default", HelpMessage="Subscription id in which CA setup is present.")] [string] [Alias("sid")] $SubscriptionId , [Parameter(Mandatory = $true, ParameterSetName = "Default", HelpMessage = "Orgnanization name for which scan will be performed.")] [Alias("oz")] [string] $OrganizationName, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Project to be scanned within the organization.")] [Alias("pns", "ProjectNames", "pn")] [string] $ProjectName, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "PAT token secure string for organization to be scanned.")] [Alias("pat")] [System.Security.SecureString] $PATToken, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "KeyVault URL for PATToken")] [Alias("ptu")] [string] $PATTokenURL, [Parameter(Mandatory = $false, ParameterSetName = "Default")] [Alias("oai")] [switch] $RefreshOAuthToken, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Resource group name where CA setup is available. (Default : ADOScannerRG)")] [string] [Alias("rgn")] $ResourceGroupName, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Workspace ID of Log Analytics workspace where security scan results will be populated.")] [string] [Alias("lwid","wid","WorkspaceId")] $LAWSId, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Shared key of Log Analytics workspace which is used to monitor security scan results.")] [string] [Alias("lwkey","wkey","SharedKey")] $LAWSSharedKey, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Alternate workspace ID of Log Analytics workspace which is used to monitor security scan results.")] [string] [ValidateNotNullOrEmpty()] [Alias("alwid","awid")] $AltLAWSId, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Alternate shared key of Log Analytics workspace which is used to monitor security scan results.")] [string] [ValidateNotNullOrEmpty()] [Alias("alwkey","awkey")] $AltLAWSSharedKey, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Use extended command to narrow down the scans.")] [Alias("ex")] [string] $ExtendedCommand, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Overrides the default scan interval (24hrs) with the custom provided value.")] [Alias("si")] [int] $ScanIntervalInHours, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Use to clear extended command.")] [Alias("cec")] [switch] $ClearExtendedCommand, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Provide webhook url to enable it in CA setup.")] [Alias("wu")] [string] $WebhookUrl, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Provide webhook header name.")] [Alias("wan")] [string] $WebhookAuthZHeaderName, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Provide webhook header value.")] [Alias("wav")] [string] $WebhookAuthZHeaderValue, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Use this switch to allow self signed webhook certificate.")] [Alias("awc")] [switch] $AllowSelfSignedWebhookCertificate, #Dev-Test support params below this [string] $RsrcTimeStamp, [string] $ContainerImageName, [string] $ModuleEnv, [bool] $UseDevTestImage, [int] $TriggerNextScanInMin ) Begin { [CommandHelper]::BeginCommand($PSCmdlet.MyInvocation); [ListenerHelper]::RegisterListeners(); } Process { try { if (-not [string]::IsNullOrEmpty($PATToken) -and -not [string]::IsNullOrEmpty($PATTokenURL)) { throw [SuppressedException] "'PATToken' and 'PATTokenURL' are exclusive parameters. Please use only one of them in the command" } if (-not [string]::IsNullOrEmpty($ExtendedCommand) -and $ClearExtendedCommand -eq $true) { throw [SuppressedException] "'ExtendedCommand' and 'ClearExtendedCommand' are exclusive parameters. Please use only one of them in the command" } else { $resolver = [Resolver]::new($OrganizationName) $caAccount = [CAAutomation]::new($SubscriptionId, $OrganizationName, $PATToken, $PATTokenURL, ` $ResourceGroupName, $LAWSId, $LAWSSharedKey, ` $AltLAWSId, $AltLAWSSharedKey, $ProjectName, $ExtendedCommand, ` $WebhookUrl, $WebhookAuthZHeaderName, $WebhookAuthZHeaderValue, $AllowSelfSignedWebhookCertificate, ` $RsrcTimeStamp, $ContainerImageName, $ModuleEnv, $UseDevTestImage, $TriggerNextScanInMin, ` $ScanIntervalInHours, $ClearExtendedCommand, $RefreshOAuthToken, $PSCmdlet.MyInvocation); return $caAccount.InvokeFunction($caAccount.UpdateAzSKADOContinuousAssurance); } } catch { [EventBase]::PublishGenericException($_); } } End { [ListenerHelper]::UnregisterListeners(); } } function Get-AzSKADOContinuousAssurance { <# .SYNOPSIS This command would help in getting details of Continuous Assurance Setup .PARAMETER SubscriptionId Subscription id in which CA setup is present. .PARAMETER OrganizationName Organization name for which CA is setup. .PARAMETER ResourceGroupName Resource group name where CA setup is available (Default : ADOScannerRG). .PARAMETER RsrcTimeStamp Timestamp of function app if multiple CA are setup in same resource group. #> Param( [Parameter(Mandatory = $true, ParameterSetName = "Default", HelpMessage="Subscription id in which CA setup is present.")] [string] [Alias("sid")] $SubscriptionId , [Parameter(Mandatory = $true, ParameterSetName = "Default", HelpMessage = "Orgnanization name for which scan will be performed.")] [Alias("oz")] [string] $OrganizationName, [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Resource group name where CA setup is available. (Default : ADOScannerRG)")] [string] [Alias("rg")] $ResourceGroupName , [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Timestamp of function app if multiple CA are setup in same resource group.")] [string] [Alias("rts")] $RsrcTimeStamp ) Begin { [CommandHelper]::BeginCommand($PSCmdlet.MyInvocation); [ListenerHelper]::RegisterListeners(); } Process { try { $resolver = [Resolver]::new($OrganizationName) $caAccount = [CAAutomation]::new($SubscriptionId, $OrganizationName, $ResourceGroupName, $RsrcTimeStamp, $PSCmdlet.MyInvocation); return $caAccount.InvokeFunction($caAccount.GetAzSKADOContinuousAssurance); } catch { [EventBase]::PublishGenericException($_); } } End { [ListenerHelper]::UnregisterListeners(); } } # SIG # Begin signature block # MIInvwYJKoZIhvcNAQcCoIInsDCCJ6wCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCC3wLhs67eLDSiz # A/P21SwXqmoksKQ60fAm0+Fg93nDrqCCDXYwggX0MIID3KADAgECAhMzAAADrzBA # DkyjTQVBAAAAAAOvMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p # bmcgUENBIDIwMTEwHhcNMjMxMTE2MTkwOTAwWhcNMjQxMTE0MTkwOTAwWjB0MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB # AQDOS8s1ra6f0YGtg0OhEaQa/t3Q+q1MEHhWJhqQVuO5amYXQpy8MDPNoJYk+FWA # hePP5LxwcSge5aen+f5Q6WNPd6EDxGzotvVpNi5ve0H97S3F7C/axDfKxyNh21MG # 0W8Sb0vxi/vorcLHOL9i+t2D6yvvDzLlEefUCbQV/zGCBjXGlYJcUj6RAzXyeNAN # xSpKXAGd7Fh+ocGHPPphcD9LQTOJgG7Y7aYztHqBLJiQQ4eAgZNU4ac6+8LnEGAL # go1ydC5BJEuJQjYKbNTy959HrKSu7LO3Ws0w8jw6pYdC1IMpdTkk2puTgY2PDNzB # tLM4evG7FYer3WX+8t1UMYNTAgMBAAGjggFzMIIBbzAfBgNVHSUEGDAWBgorBgEE # AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQURxxxNPIEPGSO8kqz+bgCAQWGXsEw # RQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEW # MBQGA1UEBRMNMjMwMDEyKzUwMTgyNjAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzci # tW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5j # b20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEG # CCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQu # Y29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0 # MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAISxFt/zR2frTFPB45Yd # mhZpB2nNJoOoi+qlgcTlnO4QwlYN1w/vYwbDy/oFJolD5r6FMJd0RGcgEM8q9TgQ # 2OC7gQEmhweVJ7yuKJlQBH7P7Pg5RiqgV3cSonJ+OM4kFHbP3gPLiyzssSQdRuPY # 1mIWoGg9i7Y4ZC8ST7WhpSyc0pns2XsUe1XsIjaUcGu7zd7gg97eCUiLRdVklPmp # XobH9CEAWakRUGNICYN2AgjhRTC4j3KJfqMkU04R6Toyh4/Toswm1uoDcGr5laYn # TfcX3u5WnJqJLhuPe8Uj9kGAOcyo0O1mNwDa+LhFEzB6CB32+wfJMumfr6degvLT # e8x55urQLeTjimBQgS49BSUkhFN7ois3cZyNpnrMca5AZaC7pLI72vuqSsSlLalG # OcZmPHZGYJqZ0BacN274OZ80Q8B11iNokns9Od348bMb5Z4fihxaBWebl8kWEi2O # PvQImOAeq3nt7UWJBzJYLAGEpfasaA3ZQgIcEXdD+uwo6ymMzDY6UamFOfYqYWXk # ntxDGu7ngD2ugKUuccYKJJRiiz+LAUcj90BVcSHRLQop9N8zoALr/1sJuwPrVAtx # HNEgSW+AKBqIxYWM4Ev32l6agSUAezLMbq5f3d8x9qzT031jMDT+sUAoCw0M5wVt # CUQcqINPuYjbS1WgJyZIiEkBMIIHejCCBWKgAwIBAgIKYQ6Q0gAAAAAAAzANBgkq # hkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x # EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv # bjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 # IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEwOTA5WjB+MQswCQYDVQQG # EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG # A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQg # Q29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC # CgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+laUKq4BjgaBEm6f8MMHt03 # a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc6Whe0t+bU7IKLMOv2akr # rnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4Ddato88tt8zpcoRb0Rrrg # OGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+lD3v++MrWhAfTVYoonpy # 4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nkkDstrjNYxbc+/jLTswM9 # sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6A4aN91/w0FK/jJSHvMAh # dCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmdX4jiJV3TIUs+UsS1Vz8k # A/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL5zmhD+kjSbwYuER8ReTB # w3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zdsGbiwZeBe+3W7UvnSSmn # Eyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3T8HhhUSJxAlMxdSlQy90 # lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS4NaIjAsCAwEAAaOCAe0w # ggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRIbmTlUAXTgqoXNzcitW2o # ynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD # VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBa # BgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny # bC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsG # AQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29t # L3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MIGfBgNV # HSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEFBQcCARYzaHR0cDovL3d3 # dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1hcnljcHMuaHRtMEAGCCsG # AQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkAYwB5AF8AcwB0AGEAdABl # AG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn8oalmOBUeRou09h0ZyKb # C5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7v0epo/Np22O/IjWll11l # hJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0bpdS1HXeUOeLpZMlEPXh6 # I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/KmtYSWMfCWluWpiW5IP0 # wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvyCInWH8MyGOLwxS3OW560 # STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBpmLJZiWhub6e3dMNABQam # ASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJihsMdYzaXht/a8/jyFqGa # J+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYbBL7fQccOKO7eZS/sl/ah # XJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbSoqKfenoi+kiVH6v7RyOA # 9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sLgOppO6/8MO0ETI7f33Vt # Y5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtXcVZOSEXAQsmbdlsKgEhr # /Xmfwb1tbWrJUnMTDXpQzTGCGZ8wghmbAgEBMIGVMH4xCzAJBgNVBAYTAlVTMRMw # EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN # aWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNp # Z25pbmcgUENBIDIwMTECEzMAAAOvMEAOTKNNBUEAAAAAA68wDQYJYIZIAWUDBAIB # BQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEO # MAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIIcpQ818mr9VbCfNpM+ky+Dh # 5XW74hoHzKe2lCTN+N6YMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8A # cwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEB # BQAEggEAQfL1gi1i9jwyaKijZRGRcf5yphhBn5k/uyRK2hFn+z20fttl4IFUOCcu # 3KNIKCSDntf8lXbK8sDePaJ/4ECGZbZOzas+zmOo/NZOxITZizXhpp4URTr3A9yH # RxN0R60re/oIFUDvAqTUUz96SkLzEw8MKJv4klZTjImKlr2m6D+mL7yuXjewTHEm # hF4PsAV0zXk8SVqj0UltzsfGs+fiIxTXALfzBjHvzA6s167vHGZKaP/EUurUwsYw # o6Q2j3QVwkyqqd8buGGjQvxgOiU8/nzA8r1MO/gLfftSIXoBcjaQV1CMStiC8hZd # OcIWRDd1XYOkx0QSJQKxux35nheNp6GCFykwghclBgorBgEEAYI3AwMBMYIXFTCC # FxEGCSqGSIb3DQEHAqCCFwIwghb+AgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFZBgsq # hkiG9w0BCRABBKCCAUgEggFEMIIBQAIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFl # AwQCAQUABCBZbWmIr9Xr58I4TRDk8D3FNOh8vf4Q/HFFuF+nLljs1QIGZdXwH5rZ # GBMyMDI0MDMxMjA2NTUzOC42MjJaMASAAgH0oIHYpIHVMIHSMQswCQYDVQQGEwJV # UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE # ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJl # bGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxJjAkBgNVBAsTHVRoYWxlcyBUU1MgRVNO # OjhENDEtNEJGNy1CM0I3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBT # ZXJ2aWNloIIReDCCBycwggUPoAMCAQICEzMAAAHj372bmhxogyIAAQAAAeMwDQYJ # KoZIhvcNAQELBQAwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x # EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv # bjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwHhcNMjMx # MDEyMTkwNzI5WhcNMjUwMTEwMTkwNzI5WjCB0jELMAkGA1UEBhMCVVMxEzARBgNV # BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv # c29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IElyZWxhbmQgT3Bl # cmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjo4RDQxLTRC # RjctQjNCNzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZTCC # AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL6kDWgeRp+fxSBUD6N/yuEJ # pXggzBeNG5KB8M9AbIWeEokJgOghlMg8JmqkNsB4Wl1NEXR7cL6vlPCsWGLMhyqm # scQu36/8h2bx6TU4M8dVZEd6V4U+l9gpte+VF91kOI35fOqJ6eQDMwSBQ5c9ElPF # UijTA7zV7Y5PRYrS4FL9p494TidCpBEH5N6AO5u8wNA/jKO94Zkfjgu7sLF8SUdr # c1GRNEk2F91L3pxR+32FsuQTZi8hqtrFpEORxbySgiQBP3cH7fPleN1NynhMRf6T # 7XC1L0PRyKy9MZ6TBWru2HeWivkxIue1nLQb/O/n0j2QVd42Zf0ArXB/Vq54gQ8J # IvUH0cbvyWM8PomhFi6q2F7he43jhrxyvn1Xi1pwHOVsbH26YxDKTWxl20hfQLdz # z4RVTo8cFRMdQCxlKkSnocPWqfV/4H5APSPXk0r8Cc/cMmva3g4EvupF4ErbSO0U # NnCRv7UDxlSGiwiGkmny53mqtAZ7NLePhFtwfxp6ATIojl8JXjr3+bnQWUCDCd5O # ap54fGeGYU8KxOohmz604BgT14e3sRWABpW+oXYSCyFQ3SZQ3/LNTVby9ENsuEh2 # UIQKWU7lv7chrBrHCDw0jM+WwOjYUS7YxMAhaSyOahpbudALvRUXpQhELFoO6tOx # /66hzqgjSTOEY3pu46BFAgMBAAGjggFJMIIBRTAdBgNVHQ4EFgQUsa4NZr41Fbeh # Z8Y+ep2m2YiYqQMwHwYDVR0jBBgwFoAUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXwYD # VR0fBFgwVjBUoFKgUIZOaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9j # cmwvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3JsMGwG # CCsGAQUFBwEBBGAwXjBcBggrBgEFBQcwAoZQaHR0cDovL3d3dy5taWNyb3NvZnQu # Y29tL3BraW9wcy9jZXJ0cy9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIw # MjAxMCgxKS5jcnQwDAYDVR0TAQH/BAIwADAWBgNVHSUBAf8EDDAKBggrBgEFBQcD # CDAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggIBALe+my6p1NPMEW1t # 70a8Y2hGxj6siDSulGAs4UxmkfzxMAic4j0+GTPbHxk193mQ0FRPa9dtbRbaezV0 # GLkEsUWTGF2tP6WsDdl5/lD4wUQ76ArFOencCpK5svE0sO0FyhrJHZxMLCOclvd6 # vAIPOkZAYihBH/RXcxzbiliOCr//3w7REnsLuOp/7vlXJAsGzmJesBP/0ERqxjKu # dPWuBGz/qdRlJtOl5nv9NZkyLig4D5hy9p2Ec1zaotiLiHnJ9mlsJEcUDhYj8PnY # nJjjsCxv+yJzao2aUHiIQzMbFq+M08c8uBEf+s37YbZQ7XAFxwe2EVJAUwpWjmtJ # 3b3zSWTMmFWunFr2aLk6vVeS0u1MyEfEv+0bDk+N3jmsCwbLkM9FaDi7q2HtUn3z # 6k7AnETc28dAvLf/ioqUrVYTwBrbRH4XVFEvaIQ+i7esDQicWW1dCDA/J3xOoCEC # V68611jriajfdVg8o0Wp+FCg5CAUtslgOFuiYULgcxnqzkmP2i58ZEa0rm4LZymH # BzsIMU0yMmuVmAkYxbdEDi5XqlZIupPpqmD6/fLjD4ub0SEEttOpg0np0ra/MNCf # v/tVhJtz5wgiEIKX+s4akawLfY+16xDB64Nm0HoGs/Gy823ulIm4GyrUcpNZxnXv # E6OZMjI/V1AgSAg8U/heMWuZTWVUMIIHcTCCBVmgAwIBAgITMwAAABXF52ueAptJ # mQAAAAAAFTANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgT # Cldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNh # dGUgQXV0aG9yaXR5IDIwMTAwHhcNMjEwOTMwMTgyMjI1WhcNMzAwOTMwMTgzMjI1 # WjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQD # Ex1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDCCAiIwDQYJKoZIhvcNAQEB # BQADggIPADCCAgoCggIBAOThpkzntHIhC3miy9ckeb0O1YLT/e6cBwfSqWxOdcjK # NVf2AX9sSuDivbk+F2Az/1xPx2b3lVNxWuJ+Slr+uDZnhUYjDLWNE893MsAQGOhg # fWpSg0S3po5GawcU88V29YZQ3MFEyHFcUTE3oAo4bo3t1w/YJlN8OWECesSq/XJp # rx2rrPY2vjUmZNqYO7oaezOtgFt+jBAcnVL+tuhiJdxqD89d9P6OU8/W7IVWTe/d # vI2k45GPsjksUZzpcGkNyjYtcI4xyDUoveO0hyTD4MmPfrVUj9z6BVWYbWg7mka9 # 7aSueik3rMvrg0XnRm7KMtXAhjBcTyziYrLNueKNiOSWrAFKu75xqRdbZ2De+JKR # Hh09/SDPc31BmkZ1zcRfNN0Sidb9pSB9fvzZnkXftnIv231fgLrbqn427DZM9itu # qBJR6L8FA6PRc6ZNN3SUHDSCD/AQ8rdHGO2n6Jl8P0zbr17C89XYcz1DTsEzOUyO # ArxCaC4Q6oRRRuLRvWoYWmEBc8pnol7XKHYC4jMYctenIPDC+hIK12NvDMk2ZItb # oKaDIV1fMHSRlJTYuVD5C4lh8zYGNRiER9vcG9H9stQcxWv2XFJRXRLbJbqvUAV6 # bMURHXLvjflSxIUXk8A8FdsaN8cIFRg/eKtFtvUeh17aj54WcmnGrnu3tz5q4i6t # AgMBAAGjggHdMIIB2TASBgkrBgEEAYI3FQEEBQIDAQABMCMGCSsGAQQBgjcVAgQW # BBQqp1L+ZMSavoKRPEY1Kc8Q/y8E7jAdBgNVHQ4EFgQUn6cVXQBeYl2D9OXSZacb # UzUZ6XIwXAYDVR0gBFUwUzBRBgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYz # aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnku # aHRtMBMGA1UdJQQMMAoGCCsGAQUFBwMIMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIA # QwBBMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNX2 # VsuP6KJcYmjRPZSQW9fOmhjEMFYGA1UdHwRPME0wS6BJoEeGRWh0dHA6Ly9jcmwu # bWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dF8yMDEw # LTA2LTIzLmNybDBaBggrBgEFBQcBAQROMEwwSgYIKwYBBQUHMAKGPmh0dHA6Ly93 # d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYt # MjMuY3J0MA0GCSqGSIb3DQEBCwUAA4ICAQCdVX38Kq3hLB9nATEkW+Geckv8qW/q # XBS2Pk5HZHixBpOXPTEztTnXwnE2P9pkbHzQdTltuw8x5MKP+2zRoZQYIu7pZmc6 # U03dmLq2HnjYNi6cqYJWAAOwBb6J6Gngugnue99qb74py27YP0h1AdkY3m2CDPVt # I1TkeFN1JFe53Z/zjj3G82jfZfakVqr3lbYoVSfQJL1AoL8ZthISEV09J+BAljis # 9/kpicO8F7BUhUKz/AyeixmJ5/ALaoHCgRlCGVJ1ijbCHcNhcy4sa3tuPywJeBTp # kbKpW99Jo3QMvOyRgNI95ko+ZjtPu4b6MhrZlvSP9pEB9s7GdP32THJvEKt1MMU0 # sHrYUP4KWN1APMdUbZ1jdEgssU5HLcEUBHG/ZPkkvnNtyo4JvbMBV0lUZNlz138e # W0QBjloZkWsNn6Qo3GcZKCS6OEuabvshVGtqRRFHqfG3rsjoiV5PndLQTHa1V1QJ # sWkBRH58oWFsc/4Ku+xBZj1p/cvBQUl+fpO+y/g75LcVv7TOPqUxUYS8vwLBgqJ7 # Fx0ViY1w/ue10CgaiQuPNtq6TPmb/wrpNPgkNWcr4A245oyZ1uEi6vAnQj0llOZ0 # dFtq0Z4+7X6gMTN9vMvpe784cETRkPHIqzqKOghif9lwY1NNje6CbaUFEMFxBmoQ # tB1VM1izoXBm8qGCAtQwggI9AgEBMIIBAKGB2KSB1TCB0jELMAkGA1UEBhMCVVMx # EzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoT # FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IElyZWxh # bmQgT3BlcmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjo4 # RDQxLTRCRjctQjNCNzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2Vy # dmljZaIjCgEBMAcGBSsOAwIaAxUAPYiXu8ORQ4hvKcuE7GK0COgxWnqggYMwgYCk # fjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQD # Ex1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQUFAAIF # AOmaIwcwIhgPMjAyNDAzMTIwODQwMzlaGA8yMDI0MDMxMzA4NDAzOVowdDA6Bgor # BgEEAYRZCgQBMSwwKjAKAgUA6ZojBwIBADAHAgEAAgIO3TAHAgEAAgITNDAKAgUA # 6Zt0hwIBADA2BgorBgEEAYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAID # B6EgoQowCAIBAAIDAYagMA0GCSqGSIb3DQEBBQUAA4GBAGYBdBR/opErZLN4EDBk # URR6nGPamowK422Ikte0CAl3X5tshsYeML97Iw/O0HHor0aMmRP5C0uYSi2Fr3mJ # WihqwOQwc2f3YsM5nCZPOUipeGa2LwAKEznZlwzILBldgSbmowNfn87w+cW9o9jE # o55pxCho8Jc6Q9M1kAQ6uioYMYIEDTCCBAkCAQEwgZMwfDELMAkGA1UEBhMCVVMx # EzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoT # FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUt # U3RhbXAgUENBIDIwMTACEzMAAAHj372bmhxogyIAAQAAAeMwDQYJYIZIAWUDBAIB # BQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG9w0BCQQx # IgQg2ctmzsTAQ097v/tuqXuadvRAPWyP9Ur5LqqWK7580E4wgfoGCyqGSIb3DQEJ # EAIvMYHqMIHnMIHkMIG9BCAz1COr5bD+ZPdEgQjWvcIWuDJcQbdgq8Ndj0xyMuYm # KjCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw # DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # JjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAAB49+9 # m5ocaIMiAAEAAAHjMCIEIAZoZnllIPSIf8eubdn6rvh8+hxcNSW1XkquzfrqPMZt # MA0GCSqGSIb3DQEBCwUABIICAEENaCYsOmJko3qTknMiH/aEwKMH5XnGtxIIOWNX # 0M8gk3yX3O6Vq3/eQc0A1t8jHhA6HwePEx0TwH+NZNV5EF2s+yVPKPdO5x71fsr/ # zRxQM3DaPsG99dpOAIzUw7KXN1OjY9T+/Lj/PK+iuqKerhVMYOTQm6UEXzSMF3WF # qTCwZ3ld920wmxxxB1wDU8pIYTAW3lR3VCiDyUJhh664ls5SFSjFaNwrpxP8JbsN # HFGE3jq5r7GwA0S2nFf3USuxZgKwDRYMXWiTd0AN0hcDYJSoyBnJVuybNtpaei1c # RYR3UQi7k4NcUmLpvermaGeMqSTUCqA1MamrrnnR/PqxwJAnp02qIFRjm6IymUgT # BYRw6uJiKh1dlL7ZD7rbVYFaRxIt+9x30+jI9v5bZV3SY8Kgg+qCb5oSbGedX5fS # hAvFX1aUwJqho3lLo3Sxrz2Hx+1tOm0Je8nv8TFdr0MJ2RSKUobiX3CcCqddkxsy # lOapmufFesa7NlVu+CS96xCYgJWrGFW6saOm6LJamoqpvRxg/2Y4zT9FXutThxGq # 1Yn+nrx/aq1WVlaLjzj2GxmiUvhhfhYWC+I2DxpqcwnSjJBC1f0SlC0HOYGmBi4i # WmQBzi4C6vsYpVGI2+Dyeu3ubkMoT4eGKVsk/cIlz5AGcAM9epXK5dCzIK91ONP9 # EGw2 # SIG # End signature block |