ConnectedKubernetes.Autorest/custom/helpers/HelmHelper.ps1
[CmdletBinding()] param() function Set-HelmClientLocation { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] [CmdletBinding(SupportsShouldProcess = $true)] param( ) process { Write-Debug "Setting Helm client location." $HelmLocation = Get-HelmClientLocation ` -Verbose:($PSCmdlet.MyInvocation.BoundParameters["Verbose"].IsPresent -eq $true) ` -Debug:($PSCmdlet.MyInvocation.BoundParameters["Debug"].IsPresent -eq $true) if ($null -eq $HelmLocation) { Write-Debug "Helm location not found." return } if (!($env:Path.contains($HelmLocation)) -and (Test-Path $HelmLocation)) { Write-Debug "Updating PATH environment variable with Helm location." $PathStr = $HelmLocation + ";$env:Path" if ($PSCmdlet.ShouldProcess($Env:Path)) { Set-Item -Path Env:Path -Value $PathStr } } } } function Get-HelmClientLocation { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] param( ) process { Write-Debug "Getting Helm client location." if (IsWindows -and IsAmd64) { Write-Debug "Detected Windows AMD64 architecture." if (Test-Path Env:HELM_CLIENT_PATH) { $CustomPath = (Get-Item Env:HELM_CLIENT_PATH).Value Write-Debug "Custom Helm path detected: $CustomPath" if ($CustomPath.EndsWith("helm.exe") -and (!((Get-Item $CustomPath) -is [System.IO.DirectoryInfo]))) { $CustomPath = $CustomPath.Replace("helm.exe", "") } return $CustomPath } if (Test-Path Env:Home) { $HomePath = (Get-Item Env:HOME).Value } else { $HomePath = $Home } # $Version = "v3.6.3" $Version = "v3.12.2" $ZipName = "helm-$Version-windows-amd64.zip" $RootFolder = Join-Path -Path $HomePath -ChildPath ".azure" | Join-Path -ChildPath "helm" | Join-Path -ChildPath "$Version" $ZipLocation = Join-Path -Path $RootFolder -ChildPath $ZipName $InstallLocation = Join-Path -Path $RootFolder -ChildPath "windows-amd64" $HelmLocation = Join-Path -Path $InstallLocation -ChildPath "helm.exe" try { if (!(Test-Path $RootFolder)) { Write-Debug "Creating Helm root folder: $RootFolder" $null = New-Item $RootFolder -ItemType Directory } if ((!(Test-Path $HelmLocation))) { Write-Debug "Downloading Helm zip to: $ZipLocation" Invoke-WebRequest -Uri "https://k8connecthelm.azureedge.net/helmsigned/$ZipName" -OutFile $ZipLocation -UseBasicParsing Write-Debug "Extracting Helm zip to: $RootFolder" Expand-Archive $ZipLocation $RootFolder Write-Verbose "Downloaded helm: $HelmLocation" } } catch { throw "Failed to download helm ($_)" } } else { Write-Warning "Helm version 3.6.3 is required. Learn more at https://aka.ms/arc/k8s/onboarding-helm-install" } return $InstallLocation } } function Get-ReleaseInstallNamespace { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] param( ) process { Write-Debug "Getting Helm release install namespace." return "azure-arc-release" } } function IsWindows { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] param( ) process { Write-Debug "Determining if the system is Windows." return (Get-OSName).contains("Windows") } } function Get-OSName { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] param( ) process { Write-Debug "Getting the operating system name." if ($PSVersionTable.PSEdition.Contains("Core")) { $OSPlatform = $PSVersionTable.OS } else { $OSPlatform = $env:OS } return $OSPlatform } } function IsAmd64 { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] param( ) process { Write-Debug "Checking if the architecture is AMD64." $isSupport = [Environment]::Is64BitOperatingSystem -and ($env:PROCESSOR_ARCHITECTURE -eq "AMD64") return $isSupport } } function Get-AzureHelmPath { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] param( [string]$ChildPath ) # The top-level directory is always determined from HOME or USERPROFILE # and ".azure" if (Test-Path Env:USERPROFILE) { $Path = $Env:USERPROFILE } elseif (Test-Path Env:HOME) { $Path = $Env:HOME } else { throw "No environment to use as Azure/helm path root." } # In Powershell v5.1 (Desktop), Join-Path lacks the AdditionalChildPaths # argument so we have to avoid using it. $Path = Join-Path -Path $Path -ChildPath '.azure' $Path = Join-Path -Path $Path -ChildPath $ChildPath return $Path } function Get-HelmValue { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] param ( [Parameter(Mandatory)] [string]$HelmClientLocation, [Parameter(Mandatory)] [string]$Namespace, [string]$KubeConfig, [string]$KubeContext, [string]$ValuesFile = 'userValues.txt' ) try { $userValuesLocation = Get-AzureHelmPath -ChildPath $ValuesFile $cmdHelmValuesPull = @($HelmClientLocation, "get", "values", "azure-arc", "--namespace", $ReleaseInstallNamespace) if ($KubeConfig) { $cmdHelmValuesPull += "--kubeconfig", $KubeConfig } if ($KubeContext) { $cmdHelmValuesPull += "--kube-context", $KubeContext } Write-Debug "Pull helm values: $cmdHelmValuesPull[0] $cmdValuesPull[1..($cmdHelmValuesPull.Count - 1)]" Invoke-ExternalCommand $cmdHelmValuesPull[0] $cmdHelmValuesPull[1..($cmdHelmValuesPull.Count - 1)] > $userValuesLocation } catch { throw "Unable to get helm values: `n$_" } return $userValuesLocation } function Get-HelmChartPath { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] param ( [Parameter(Mandatory)] [string]$RegistryPath, [Parameter(Mandatory)] [string]$HelmClientLocation, [string]$KubeConfig, [string]$KubeContext, [string]$ChartFolderName = 'AzureArcCharts', [string]$ChartName = 'azure-arc-k8sagents', [bool]$NewPath = $true ) Write-Debug "Preparing to export Helm chart to a specific path." # Special path! $PreOnboardingHelmChartsFolderName = 'PreOnboardingChecksCharts' $ChartExportPath = Get-AzureHelmPath -ChildPath $ChartFolderName try { if (Test-Path $ChartExportPath) { Write-Debug "Cleaning up existing Helm chart folder at: $ChartExportPath" Remove-Item -Path $ChartExportPath -Recurse -Force } } catch { Write-Warning -Message "Unable to cleanup the $ChartFolderName already present on the machine. In case of failure, please cleanup the directory '$ChartExportPath' and try again." } Write-Debug "Starting Helm chart export to path: $ChartExportPath" Get-HelmChart ` -RegistryPath $RegistryPath ` -ChartExportPath $ChartExportPath ` -KubeConfig $KubeConfig ` -KubeContext $KubeContext ` -HelmClientLocation $HelmClientLocation ` -NewPath $NewPath ` -ChartName $ChartName ` -Verbose:($PSCmdlet.MyInvocation.BoundParameters["Verbose"].IsPresent -eq $true) ` -Debug:($PSCmdlet.MyInvocation.BoundParameters["Debug"].IsPresent -eq $true) # Returning helm chart path $HelmChartPath = Join-Path $ChartExportPath $ChartName if ($ChartFolderName -eq $PreOnboardingHelmChartsFolderName) { $ChartPath = $HelmChartPath } else { $ChartPath = if ($env:HELMCHART) { $env:HELMCHART } else { $HelmChartPath } } Write-Debug "Helm chart path is: $ChartPath" return $ChartPath } function Get-HelmChart { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] param ( [Parameter(Mandatory)] [string]$RegistryPath, [Parameter(Mandatory)] [string]$ChartExportPath, [string]$KubeConfig, [string]$KubeContext, [Parameter(Mandatory)] [string]$HelmClientLocation, [bool]$NewPath, [string]$ChartName = 'azure-arc-k8sagents', [int]$RetryCount = 5, [int]$RetryDelay = 3 ) $chartUrl = $RegistryPath.Split(':')[0] $chartVersion = $RegistryPath.Split(':')[1] if ($NewPath) { # Version check for stable release train (chart_version will be in X.Y.Z format as opposed to X.Y.Z-NONSTABLE) if (-not $chartVersion.Contains('-') -and ([version]$chartVersion -lt [version]"1.14.0")) { $errorSummary = "This CLI version does not support upgrading to Agents versions older than v1.14" # Assuming telemetry.set_exception and consts.Operation_Not_Supported_Fault_Type are handled elsewhere throw "Operation not supported on older Agents: $errorSummary" } # We do not use Split-Path here because it results in "\" characters in # the results. $basePath, $imageName = if ($chartUrl -match "(^.*?)/([^/]+$)") { $matches[1], $matches[2] } $chartUrl = "$basePath/v2/$imageName" # Write-Error "Chart URL: $chartUrl" } $cmdHelmChartPull = @($HelmClientLocation, "pull", "oci://$chartUrl", "--untar", "--untardir", $ChartExportPath, "--version", $chartVersion) if ($KubeConfig) { $cmdHelmChartPull += "--kubeconfig", $KubeConfig } if ($KubeContext) { $cmdHelmChartPull += "--kube-context", $KubeContext } Write-Debug "Pull helm chart: $cmdHelmChartPull[0] $cmdHelmChartPull[1..($cmdHelmChartPull.Count - 1)]" for ($i = 0; $i -lt $RetryCount; $i++) { try { Invoke-ExternalCommand $cmdHelmChartPull[0] $cmdHelmChartPull[1..($cmdHelmChartPull.Count - 1)] break } catch { Start-Sleep -Seconds $RetryDelay } } if ($i -eq $RetryCount) { # Assuming telemetry.set_exception and consts.Pull_HelmChart_Fault_Type are handled elsewhere throw "Unable to pull '$ChartName' helm chart from the registry '$RegistryPath'." } } # This method exists to allow us to effectively Mock the call operator (&). # We cannnot do that directly so instead we have this wrapper, which we can mock! function Invoke-ExternalCommand { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] param ( [Parameter(Mandatory = $true)] [string]$Command, [array]$Arguments ) & $Command $Arguments } function Set-HelmModulesAndRepository { [Microsoft.Azure.PowerShell.Cmdlets.ConnectedKubernetes.DoNotExportAttribute()] [CmdletBinding(SupportsShouldProcess = $true)] param ( [string]$KubeConfig, [string]$KubeContext, [string]$Location ) Write-Debug "Setting Helm repository and checking for required modules." if ((Test-Path Env:HELMREPONAME) -and (Test-Path Env:HELMREPOURL)) { $HelmRepoName = (Get-Item Env:HELMREPONAME).Value $HelmRepoUrl = (Get-Item Env:HELMREPOURL).Value helm repo add $HelmRepoName $HelmRepoUrl --kubeconfig $KubeConfig --kube-context $KubeContext } $resources = Get-Module Az.Resources -ListAvailable if ($null -eq $resources) { Write-Error "Missing required module(s): Az.Resources. Please run 'Install-Module Az.Resources -Repository PSGallery' to install Az.Resources." return } if (Test-Path Env:HELMREGISTRY) { $RegistryPath = (Get-Item Env:HELMREGISTRY).Value } else { $ReleaseTrain = '' if ((Test-Path Env:RELEASETRAIN) -and (Test-Path Env:RELEASETRAIN)) { $ReleaseTrain = (Get-Item Env:RELEASETRAIN).Value } else { $ReleaseTrain = 'stable' } $AzLocation = Get-AzLocation | Where-Object { ($_.DisplayName -ieq $Location) -or ($_.Location -ieq $Location) } $Region = $AzLocation.Location if ($null -eq $Region) { Write-Error "Invalid location: $Location" return } else { $Location = $Region } $ChartLocationUrl = "https://${Location}.dp.kubernetesconfiguration.azure.com/azure-arc-k8sagents/GetLatestHelmPackagePath?api-version=2019-11-01-preview&releaseTrain=${ReleaseTrain}" $Uri = [System.Uri]::New($ChartLocationUrl) $Account = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext.Account $Env = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureEnvironment]::PublicEnvironments[[Microsoft.Azure.Commands.Common.Authentication.Abstractions.EnvironmentName]::AzureCloud] $TenantId = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext.Tenant.Id $PromptBehavior = [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never $Token = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($account, $env, $tenantId, $null, $promptBehavior, $null) $AccessToken = $Token.AccessToken $HeaderParameter = @{ "Authorization" = "Bearer $AccessToken" } $Response = Invoke-WebRequest -Uri $Uri -Headers $HeaderParameter -Method Post -UseBasicParsing if ($Response.StatusCode -eq 200) { $RegistryPath = ($Response.Content | ConvertFrom-Json).repositoryPath } else { Write-Error "Error while fetching helm chart registry path: ${$Response.RawContent}" return } } if ($PSCmdlet.ShouldProcess($Env:HEML_EXPERIMENAL_OCI)) { Set-Item -Path Env:HELM_EXPERIMENTAL_OCI -Value 1 } return $RegistryPath } function Get-HelmReleaseNamespace { param ( [string]$KubeConfig, [string]$KubeContext ) Write-Debug "Getting release namespace." $ReleaseInstallNamespace = Get-ReleaseInstallNamespace ` -Verbose:($PSCmdlet.MyInvocation.BoundParameters["Verbose"].IsPresent -eq $true) ` -Debug:($PSCmdlet.MyInvocation.BoundParameters["Debug"].IsPresent -eq $true) $ReleaseNamespace = $null try { $ReleaseNamespace = (helm status azure-arc -o json --kubeconfig $KubeConfig --kube-context $KubeContext -n $ReleaseInstallNamespace 2> $null | ConvertFrom-Json).namespace } catch { Write-Error "Fail to find the namespace for azure-arc." } # return @{"site" = $($site); "app" = $($app)} return , @{"ReleaseNamespace" = $($ReleaseNamespace); "ReleaseInstallNamespace" = $($ReleaseInstallNamespace) } } function Confirm-HelmVersion { param ( [string]$KubeConfig ) Write-Debug "Setting up Helm client location and validating Helm version." try { Set-HelmClientLocation ` -Verbose:($PSCmdlet.MyInvocation.BoundParameters["Verbose"].IsPresent -eq $true) ` -Debug:($PSCmdlet.MyInvocation.BoundParameters["Debug"].IsPresent -eq $true) $HelmVersion = helm version --template='{{.Version}}' --kubeconfig $KubeConfig if ($HelmVersion.Contains("v2")) { Write-Error "Helm version 3+ is required (not ${HelmVersion}). Learn more at https://aka.ms/arc/k8s/onboarding-helm-install" return } $HelmVersion = helm version --short --kubeconfig $KubeConfig # Compare the helm version to 3.8 in a symantic versioning valid way # Strip the leading "v" from the helm version and discard any metadata $HelmVersion = $HelmVersion.Substring(1) $HelmVersion = $HelmVersion.Split('+')[0] $helmV380 = [System.Version]::Parse("3.8.0") $helmThisVersion = [System.Version]::Parse($HelmVersion) if ($helmThisVersion -lt $helmV380) { Write-Error "Helm version of at least 3.8 is required for latest OCI handling." return } } catch { throw "Failed to install Helm version 3+ ($_). Learn more at https://aka.ms/arc/k8s/onboarding-helm-install" } } # SIG # Begin signature block # MIIoOQYJKoZIhvcNAQcCoIIoKjCCKCYCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCuEYnEnz7BrQ9z # Xc3P+M+K8S7jhfz3aRjr4AH1OK7T7qCCDYUwggYDMIID66ADAgECAhMzAAAEA73V # lV0POxitAAAAAAQDMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p # bmcgUENBIDIwMTEwHhcNMjQwOTEyMjAxMTEzWhcNMjUwOTExMjAxMTEzWjB0MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB # AQCfdGddwIOnbRYUyg03O3iz19XXZPmuhEmW/5uyEN+8mgxl+HJGeLGBR8YButGV # LVK38RxcVcPYyFGQXcKcxgih4w4y4zJi3GvawLYHlsNExQwz+v0jgY/aejBS2EJY # oUhLVE+UzRihV8ooxoftsmKLb2xb7BoFS6UAo3Zz4afnOdqI7FGoi7g4vx/0MIdi # kwTn5N56TdIv3mwfkZCFmrsKpN0zR8HD8WYsvH3xKkG7u/xdqmhPPqMmnI2jOFw/ # /n2aL8W7i1Pasja8PnRXH/QaVH0M1nanL+LI9TsMb/enWfXOW65Gne5cqMN9Uofv # ENtdwwEmJ3bZrcI9u4LZAkujAgMBAAGjggGCMIIBfjAfBgNVHSUEGDAWBgorBgEE # AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQU6m4qAkpz4641iK2irF8eWsSBcBkw # VAYDVR0RBE0wS6RJMEcxLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJh # dGlvbnMgTGltaXRlZDEWMBQGA1UEBRMNMjMwMDEyKzUwMjkyNjAfBgNVHSMEGDAW # gBRIbmTlUAXTgqoXNzcitW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIw # MTEtMDctMDguY3JsMGEGCCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDov # L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDEx # XzIwMTEtMDctMDguY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIB # AFFo/6E4LX51IqFuoKvUsi80QytGI5ASQ9zsPpBa0z78hutiJd6w154JkcIx/f7r # EBK4NhD4DIFNfRiVdI7EacEs7OAS6QHF7Nt+eFRNOTtgHb9PExRy4EI/jnMwzQJV # NokTxu2WgHr/fBsWs6G9AcIgvHjWNN3qRSrhsgEdqHc0bRDUf8UILAdEZOMBvKLC # rmf+kJPEvPldgK7hFO/L9kmcVe67BnKejDKO73Sa56AJOhM7CkeATrJFxO9GLXos # oKvrwBvynxAg18W+pagTAkJefzneuWSmniTurPCUE2JnvW7DalvONDOtG01sIVAB # +ahO2wcUPa2Zm9AiDVBWTMz9XUoKMcvngi2oqbsDLhbK+pYrRUgRpNt0y1sxZsXO # raGRF8lM2cWvtEkV5UL+TQM1ppv5unDHkW8JS+QnfPbB8dZVRyRmMQ4aY/tx5x5+ # sX6semJ//FbiclSMxSI+zINu1jYerdUwuCi+P6p7SmQmClhDM+6Q+btE2FtpsU0W # +r6RdYFf/P+nK6j2otl9Nvr3tWLu+WXmz8MGM+18ynJ+lYbSmFWcAj7SYziAfT0s # IwlQRFkyC71tsIZUhBHtxPliGUu362lIO0Lpe0DOrg8lspnEWOkHnCT5JEnWCbzu # iVt8RX1IV07uIveNZuOBWLVCzWJjEGa+HhaEtavjy6i7MIIHejCCBWKgAwIBAgIK # YQ6Q0gAAAAAAAzANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNV # BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv # c29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlm # aWNhdGUgQXV0aG9yaXR5IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEw # OTA5WjB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYD # VQQDEx9NaWNyb3NvZnQgQ29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG # 9w0BAQEFAAOCAg8AMIICCgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+la # UKq4BjgaBEm6f8MMHt03a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc # 6Whe0t+bU7IKLMOv2akrrnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4D # dato88tt8zpcoRb0RrrgOGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+ # lD3v++MrWhAfTVYoonpy4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nk # kDstrjNYxbc+/jLTswM9sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6 # A4aN91/w0FK/jJSHvMAhdCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmd # X4jiJV3TIUs+UsS1Vz8kA/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL # 5zmhD+kjSbwYuER8ReTBw3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zd # sGbiwZeBe+3W7UvnSSmnEyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3 # T8HhhUSJxAlMxdSlQy90lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS # 4NaIjAsCAwEAAaOCAe0wggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRI # bmTlUAXTgqoXNzcitW2oynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAL # BgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBD # uRQFTuHqp8cx0SOJNDBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jv # c29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf # MDNfMjIuY3JsMF4GCCsGAQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3 # dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf # MDNfMjIuY3J0MIGfBgNVHSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEF # BQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1h # cnljcHMuaHRtMEAGCCsGAQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkA # YwB5AF8AcwB0AGEAdABlAG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn # 8oalmOBUeRou09h0ZyKbC5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7 # v0epo/Np22O/IjWll11lhJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0b # pdS1HXeUOeLpZMlEPXh6I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/ # KmtYSWMfCWluWpiW5IP0wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvy # CInWH8MyGOLwxS3OW560STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBp # mLJZiWhub6e3dMNABQamASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJi # hsMdYzaXht/a8/jyFqGaJ+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYb # BL7fQccOKO7eZS/sl/ahXJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbS # oqKfenoi+kiVH6v7RyOA9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sL # gOppO6/8MO0ETI7f33VtY5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtX # cVZOSEXAQsmbdlsKgEhr/Xmfwb1tbWrJUnMTDXpQzTGCGgowghoGAgEBMIGVMH4x # CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt # b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01p # Y3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTECEzMAAAQDvdWVXQ87GK0AAAAA # BAMwDQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQw # HAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIDRp # cOHxad5hm69MGGNJGpKzmLa2q710iw1DH4yC/2u1MEIGCisGAQQBgjcCAQwxNDAy # oBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5j # b20wDQYJKoZIhvcNAQEBBQAEggEAhBxGShtFiQWuslsCPQem9JSA611NpWY8IjKE # 9mTmocxrMgt+TLVXJN8I8BhyG2IxScD2vEcYFTEi5MvmBGk2Gz1Am0v4VUvVnt6S # 4Wjl+PPRy9XnCeTTzrEUiTK5tMRCh/6T53N126YWx1SI34jod+0unJ9PW4gVgNi/ # IBFSmflifmEbWXTypAdeFIs9jItYNcQcwNhO2WFE0SQH+1a7lucdF/BVBOCF6l00 # 7256cittBkze4yjYJxs6h/iW2mjyWOGXTg1+lUOuFjGptFdamxDdgegBflVL9GcU # s93Kln6AS31tY11dMIJw6rkfnr/1bkp9MF4KWe0mJ+4XB3Nvx6GCF5QwgheQBgor # BgEEAYI3AwMBMYIXgDCCF3wGCSqGSIb3DQEHAqCCF20wghdpAgEDMQ8wDQYJYIZI # AWUDBAIBBQAwggFSBgsqhkiG9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGE # WQoDATAxMA0GCWCGSAFlAwQCAQUABCDvzPx3xd5SxevKhPbn5Mx121Bor1DLwZZZ # /caZNwk2AQIGZ1ruJOCiGBMyMDI1MDEwOTA2MzY0NC40NjdaMASAAgH0oIHRpIHO # MIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQL # ExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxk # IFRTUyBFU046N0YwMC0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1l # LVN0YW1wIFNlcnZpY2WgghHqMIIHIDCCBQigAwIBAgITMwAAAfAqfB1ZO+YfrQAB # AAAB8DANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz # aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv # cnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAx # MDAeFw0yMzEyMDYxODQ1NTFaFw0yNTAzMDUxODQ1NTFaMIHLMQswCQYDVQQGEwJV # UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE # ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1l # cmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046N0YwMC0w # NUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2Uw # ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Hi1Tozh3O0czE8xfRnry # mlJNCaGWommPy0eINf+4EJr7rf8tSzlgE8Il4Zj48T5fTTOAh6nITRf2lK7+upcn # Z/xg0AKoDYpBQOWrL9ObFShylIHfr/DQ4PsRX8GRtInuJsMkwSg63bfB4Q2UikME # P/CtZHi8xW5XtAKp95cs3mvUCMvIAA83Jr/UyADACJXVU4maYisczUz7J111eD1K # rG9mQ+ITgnRR/X2xTDMCz+io8ZZFHGwEZg+c3vmPp87m4OqOKWyhcqMUupPveO/g # QC9Rv4szLNGDaoePeK6IU0JqcGjXqxbcEoS/s1hCgPd7Ux6YWeWrUXaxbb+JosgO # azUgUGs1aqpnLjz0YKfUqn8i5TbmR1dqElR4QA+OZfeVhpTonrM4sE/MlJ1JLpR2 # FwAIHUeMfotXNQiytYfRBUOJHFeJYEflZgVk0Xx/4kZBdzgFQPOWfVd2NozXlC2e # pGtUjaluA2osOvQHZzGOoKTvWUPX99MssGObO0xJHd0DygP/JAVp+bRGJqa2u7Aq # Lm2+tAT26yI5veccDmNZsg3vDh1HcpCJa9QpRW/MD3a+AF2ygV1sRnGVUVG3VODX # 3BhGT8TMU/GiUy3h7ClXOxmZ+weCuIOzCkTDbK5OlAS8qSPpgp+XGlOLEPaM31Mg # f6YTppAaeP0ophx345ohtwIDAQABo4IBSTCCAUUwHQYDVR0OBBYEFNCCsqdXRy/M # mjZGVTAvx7YFWpslMB8GA1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8G # A1UdHwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y3JsL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBs # BggrBgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0 # LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUy # MDIwMTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUH # AwgwDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4ICAQA4IvSbnr4jEPgo # 5W4xj3/+0dCGwsz863QGZ2mB9Z4SwtGGLMvwfsRUs3NIlPD/LsWAxdVYHklAzwLT # wQ5M+PRdy92DGftyEOGMHfut7Gq8L3RUcvrvr0AL/NNtfEpbAEkCFzseextY5s3h # zj3rX2wvoBZm2ythwcLeZmMgHQCmjZp/20fHWJgrjPYjse6RDJtUTlvUsjr+878/ # t+vrQEIqlmebCeEi+VQVxc7wF0LuMTw/gCWdcqHoqL52JotxKzY8jZSQ7ccNHhC4 # eHGFRpaKeiSQ0GXtlbGIbP4kW1O3JzlKjfwG62NCSvfmM1iPD90XYiFm7/8mgR16 # AmqefDsfjBCWwf3qheIMfgZzWqeEz8laFmM8DdkXjuOCQE/2L0TxhrjUtdMkATfX # dZjYRlscBDyr8zGMlprFC7LcxqCXlhxhtd2CM+mpcTc8RB2D3Eor0UdoP36Q9r4X # WCVV/2Kn0AXtvWxvIfyOFm5aLl0eEzkhfv/XmUlBeOCElS7jdddWpBlQjJuHHUHj # OVGXlrJT7X4hicF1o23x5U+j7qPKBceryP2/1oxfmHc6uBXlXBKukV/QCZBVAiBM # YJhnktakWHpo9uIeSnYT6Qx7wf2RauYHIER8SLRmblMzPOs+JHQzrvh7xStx310L # Op+0DaOXs8xjZvhpn+WuZij5RmZijDCCB3EwggVZoAMCAQICEzMAAAAVxedrngKb # SZkAAAAAABUwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQI # EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv # ZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmlj # YXRlIEF1dGhvcml0eSAyMDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIy # NVowfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT # B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UE # AxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEB # AQUAA4ICDwAwggIKAoICAQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXI # yjVX9gF/bErg4r25PhdgM/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjo # YH1qUoNEt6aORmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1y # aa8dq6z2Nr41JmTamDu6GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v # 3byNpOORj7I5LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pG # ve2krnopN6zL64NF50ZuyjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viS # kR4dPf0gz3N9QZpGdc3EXzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYr # bqgSUei/BQOj0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlM # jgK8QmguEOqEUUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSL # W6CmgyFdXzB0kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AF # emzFER1y7435UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIu # rQIDAQABo4IB3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIE # FgQUKqdS/mTEmr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWn # G1M1GelyMFwGA1UdIARVMFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEW # M2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5 # Lmh0bTATBgNVHSUEDDAKBggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBi # AEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV # 9lbLj+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3Js # Lm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAx # MC0wNi0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2 # LTIzLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv # 6lwUtj5OR2R4sQaTlz0xM7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZn # OlNN3Zi6th542DYunKmCVgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1 # bSNU5HhTdSRXud2f8449xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4 # rPf5KYnDvBewVIVCs/wMnosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU # 6ZGyqVvfSaN0DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDF # NLB62FD+CljdQDzHVG2dY3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/ # HltEAY5aGZFrDZ+kKNxnGSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdU # CbFpAUR+fKFhbHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKi # excdFYmNcP7ntdAoGokLjzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTm # dHRbatGePu1+oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZq # ELQdVTNYs6FwZvKhggNNMIICNQIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMx # EzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoT # FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJp # Y2EgT3BlcmF0aW9uczEnMCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOjdGMDAtMDVF # MC1EOTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMK # AQEwBwYFKw4DAhoDFQDCKAZKKv5lsdC2yoMGKYiQy79p/6CBgzCBgKR+MHwxCzAJ # BgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25k # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jv # c29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA6ymsTjAi # GA8yMDI1MDEwOTAyMDA0NloYDzIwMjUwMTEwMDIwMDQ2WjB0MDoGCisGAQQBhFkK # BAExLDAqMAoCBQDrKaxOAgEAMAcCAQACAhAbMAcCAQACAhJlMAoCBQDrKv3OAgEA # MDYGCisGAQQBhFkKBAIxKDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAI # AgEAAgMBhqAwDQYJKoZIhvcNAQELBQADggEBAC1cdMDEbkRcY2RQqIzvaE4HZKAj # EmimvnsiEBkklaFm6rlyZt9DvGP6qPI2o9uoDgj5p1lqIdL6mL4/N42GeRRMKldn # SWngymbhkCX8RyiExho1KZ5jhz57pWFxjKAotc0FnVhoE6DCsEUO9uOmhu7Ct9Dh # 3mxo0TTG0Y3PWRNXSkhT1ZZ+X4g6PgHyalO5jpg2mBXVsyN3ECE7yjGGt6/9OHTX # y4d0YqKqcPmIzxTyrZ5gsWJKwA+N2EAf7ePa2e4WVF4Wo3aLlCqa1205pOti3tP3 # R7g5EplvMU96xHXXaJCpDtSmz/cEC40EGtPwjuD5tCnadCT0X4FunUDS/FUxggQN # MIIECQIBATCBkzB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQ # MA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u # MSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAfAq # fB1ZO+YfrQABAAAB8DANBglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0G # CyqGSIb3DQEJEAEEMC8GCSqGSIb3DQEJBDEiBCB8kl76iq/lhB2Tg91AxH5KIo1P # 37ZU5tM8lTr4W/jflDCB+gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EIFwBmqOl # cv3kU7mAB5sWR74QFAiS6mb+CM6asnFAZUuLMIGYMIGApH4wfDELMAkGA1UEBhMC # VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV # BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRp # bWUtU3RhbXAgUENBIDIwMTACEzMAAAHwKnwdWTvmH60AAQAAAfAwIgQgNav9MbTl # eN9i36swrfpwTySv7j07igK/LBfrwEBJl3cwDQYJKoZIhvcNAQELBQAEggIAEeqj # /WAuXpWu2AsLznFxKAz51mdAKwWFb6Ba+09ek9/WhsHQyfvU1hARoJC6SODe84/R # DKgMYdy8/SExN2gYkNNB/lhJ2BabDFr9alGBvUsFJeWcIKRGxZ95/IiKT8KwTcaQ # Cc9C7kpghHMaJ8HCoLzv9m8B6C0pl+7uzNdr6VTwpWIvJlBcTFUsCa7QGmouQplM # RZHHxCIx9slTOXlRVPdHcOkDkLCp0DdmDOtROPfp8v2POELeqnhbtZx8JcXgkcbL # b14b5segSS5Wyc2dt8sR+kNgMVScLbLquFJTgw88aIq9+hz+pC8sTLPnbIXxfgL6 # Ut9n+UbsdEHfs63xo/TWTDiC4ROcPQD9g6bpiuwUsLQTkUu2F4beOEiTqS1ePlCs # Jj9c1hIPVUl0ZWJdsCCgg7LMfwU9fNZ1nYoHUoGqY912kQFLqmmyhiHWw/wyYa9D # 5BBB1aStjC9rJ+luRLbEfd8Tl+9MNMZ/EE2B0tU476Txwp0bcuGbA7NN3ptbaIoS # sFTDXhO6650YiOd4pqd1PpITTEYc1yTMQsL7kVgLXdDPs+1eEc8YZbvC0LesFeBr # UYGb+on1kPzzWLIVmxoscdcT9nYZHuaVBbkmp8CYrRh+Dhh/yAKieY/Uhxt0fXOM # AKCkDp2dFngCuMbZUWAog8o0mVr1Wqr2zzIFuJY= # SIG # End signature block |