AzSKStaging.ADO

1.17.1

Framework/Abstracts/ADOSVTBase.ps1

class ADOSVTBase: SVTBase {

    hidden [ControlStateExtension] $ControlStateExt;
    hidden [AzSKSettings] $AzSKSettings;
    # below variable will be used by SVT's and overriden for each individual resource.
    hidden [bool] $isResourceActive = $true;
    # below variable will contains the inactivity period for resources in days.
    hidden [int] $InactiveFromDays = -1;
    ADOSVTBase() {

    }

    ADOSVTBase([string] $organizationName):
    Base($organizationName) {
        $this.CreateInstance();
    }
    ADOSVTBase([string] $organizationName, [SVTResource] $svtResource):
    Base($organizationName) {
        $this.CreateInstance($svtResource);
    }
    #Create instance for organization scan
    hidden [void] CreateInstance() {
        [Helpers]::AbstractClass($this, [SVTBase]);
        Write-Host -ForegroundColor Yellow "No mapping!? Do we use this .ctor?"
        #$this.LoadSvtConfig([SVTMapping]::OrganizationMapping.JsonFileName);
        $this.ResourceId = $this.OrganizationContext.Scope;
    }

    #Add PreviewBaselineControls
    hidden [bool] CheckBaselineControl($controlId) {
        if (($null -ne $this.ControlSettings) -and [Helpers]::CheckMember($this.ControlSettings, "BaselineControls.ResourceTypeControlIdMappingList")) {
            $baselineControl = $this.ControlSettings.BaselineControls.ResourceTypeControlIdMappingList | Where-Object { $_.ControlIds -contains $controlId }
            if (($baselineControl | Measure-Object).Count -gt 0 ) {
                return $true
            }
        }
        return $false
    }
    hidden [bool] CheckPreviewBaselineControl($controlId) {
        if (($null -ne $this.ControlSettings) -and [Helpers]::CheckMember($this.ControlSettings, "PreviewBaselineControls.ResourceTypeControlIdMappingList")) {
            $PreviewBaselineControls = $this.ControlSettings.PreviewBaselineControls.ResourceTypeControlIdMappingList | Where-Object { $_.ControlIds -contains $controlId }
            if (($PreviewBaselineControls | Measure-Object).Count -gt 0 ) {
                return $true
            }
        }
        return $false
    }

    hidden [void] UpdateControlStates([SVTEventContext[]] $ControlResults) {
        if ($null -ne $this.ControlStateExt -and $this.ControlStateExt.HasControlStateWriteAccessPermissions() -and ($ControlResults | Measure-Object).Count -gt 0 -and ($this.ResourceState | Measure-Object).Count -gt 0) {
            $effectiveResourceStates = @();
            if (($this.DirtyResourceStates | Measure-Object).Count -gt 0) {
                $this.ResourceState | ForEach-Object {
                    $controlState = $_;
                    if (($this.DirtyResourceStates | Where-Object { $_.InternalId -eq $controlState.InternalId -and $_.ChildResourceName -eq $controlState.ChildResourceName } | Measure-Object).Count -eq 0) {
                        $effectiveResourceStates += $controlState;
                    }
                }
            }
            else {
                #If no dirty states found then no action needed.
                return;
            }

            #get the uniqueid from the first control result. Here we can take first as it would come here for each resource.
            $id = $ControlResults[0].GetUniqueId();
            $resourceType = $ControlResults[0].FeatureName
            $resourceName = $ControlResults[0].ResourceContext.ResourceName

            $this.ControlStateExt.SetControlState($id, $effectiveResourceStates, $true, $resourceType, $resourceName, $ControlResults[0].ResourceContext.ResourceGroupName)
        }
    }

    #isRescan parameter is added to check if method is called from rescan. state data is fetching for rescan
    hidden [ControlState[]] GetResourceState([bool] $isRescan = $false) {
        if ($null -eq $this.ResourceState) {
            $this.ResourceState = @();
            if ($this.ControlStateExt -and $this.ControlStateExt.HasControlStateReadAccessPermissions()) {
                $resourceType = "";
                if ($this.ResourceContext) {
                    $resourceType = $this.ResourceContext.ResourceTypeName
                }
                #Fetch control state for organization only if project is configured for org spesific control attestation (Check for Organization only, for other resource go inside without project check).

                if($resourceType -ne "Organization" -or $this.ControlStateExt.GetProject())
                {
                    $resourceStates = $this.ControlStateExt.GetControlState($this.ResourceId, $resourceType, $this.ResourceContext.ResourceName, $this.ResourceContext.ResourceGroupName, $isRescan)
                    if ($null -ne $resourceStates) {
                        $this.ResourceState += $resourceStates

                    }
                }
            }
        }

        return $this.ResourceState;
    }

    hidden [void] PostProcessData([SVTEventContext] $eventContext) {
        $tempHasRequiredAccess = $true;
        $controlState = @();
        $controlStateValue = @();
        try {
            $resourceStates = $this.GetResourceState($false)
            if (!$this.AzSKSettings)
            {
                $this.AzSKSettings = [ConfigurationManager]::GetAzSKSettings();
            }
            $enableOrgControlAttestation = $this.AzSKSettings.EnableOrgControlAttestation

            if (($resourceStates | Measure-Object).Count -ne 0) {
                $controlStateValue += $resourceStates | Where-Object { $_.InternalId -eq $eventContext.ControlItem.Id };
                $controlStateValue | ForEach-Object {
                    $currentControlStateValue = $_;
                    if ($null -ne $currentControlStateValue) {
                        if ($this.IsStateActive($eventContext, $currentControlStateValue)) {
                            $controlState += $currentControlStateValue;
                        }
                        else {
                            #add to the dirty state list so that it can be removed later
                            $this.DirtyResourceStates += $currentControlStateValue;
                        }
                    }
                }
            }
            # If Project name is not configured in ext storage & policy project parameter is not used or attestation repo is not present in policy project,
            # then 'IsOrgAttestationProjectFound' will be false so that HasRequiredAccess for org controls can be set as false
            elseif (($eventContext.FeatureName -eq "Organization" -and [ControlStateExtension]::IsOrgAttestationProjectFound -eq $false) -and ($enableOrgControlAttestation -eq $true)){
                $tempHasRequiredAccess = $false;
            }
            elseif ($null -eq $resourceStates) {
                $tempHasRequiredAccess = $false;
            }
        }
        catch {
            $this.EvaluationError($_);
        }

        $eventContext.ControlResults |
        ForEach-Object {
            try {
                $currentItem = $_;
                # Copy the current result to Actual Result field
                $currentItem.ActualVerificationResult = $currentItem.VerificationResult;

                # override the default value with current status
                $currentItem.IsResourceActive = $this.IsResourceActive;
                $currentItem.InactiveFromDays = $this.InactiveFromDays;
                #Logic to append the control result with the permissions metadata
                [SessionContext] $sc = $currentItem.CurrentSessionContext;
                $sc.Permissions.HasAttestationWritePermissions = $this.ControlStateExt.HasControlStateWriteAccessPermissions();
                $sc.Permissions.HasAttestationReadPermissions = $this.ControlStateExt.HasControlStateReadAccessPermissions();
                # marking the required access as false if there was any error reading the attestation data
                $sc.Permissions.HasRequiredAccess = $sc.Permissions.HasRequiredAccess -and $tempHasRequiredAccess;

                # Disable the fix control feature
                if (-not $this.GenerateFixScript) {
                    $currentItem.EnableFixControl = $false;
                }

                if ($currentItem.StateManagement.CurrentStateData -and $currentItem.StateManagement.CurrentStateData.DataObject -and $eventContext.ControlItem.DataObjectProperties) {
                    $currentItem.StateManagement.CurrentStateData.DataObject = [Helpers]::SelectMembers($currentItem.StateManagement.CurrentStateData.DataObject, $eventContext.ControlItem.DataObjectProperties);
                }

                if ($controlState.Count -ne 0) {
                    # Process the state if its available
                    $childResourceState = $controlState | Where-Object { $_.ChildResourceName -eq $currentItem.ChildResourceName } | Select-Object -First 1;
                    if ($childResourceState) {
                        $validatePreviousAttestation = $true
                        # if EnforceApprovedException is true and controls is not attested with exception id, based on configuration, invalidate the previous attestation
                        if ([Helpers]::CheckMember($this.ControlSettings, "EnforceApprovedException") -and $this.ControlSettings.EnforceApprovedException -eq $true -and (-not [Helpers]::CheckMember($childResourceState.state, "ApprovedExceptionID") -or [string]::IsNullOrWhiteSpace($childResourceState.state.ApprovedExceptionID))) {
                            $attestationExpiryDays = ""
                            # check if InvalidatePreviousAttestations is set to true to invalidate previous attestation
                            if ([Helpers]::CheckMember($this.ControlSettings, "ApprovedExceptionSettings") -and $this.ControlSettings.ApprovedExceptionSettings.InvalidatePreviousAttestations -eq $true) {
                                $approvedExceptionsControlList = $this.ControlSettings.ApprovedExceptionSettings.ControlsList
                                # verify if the control attested is in the list of approved exception enabled controls
                                if ($approvedExceptionsControlList -contains $controlState.ControlId) {
                                    $validatePreviousAttestation = $false
                                    Write-Host "Per your org policy, this control now requires an associated approved exception id. Previous attestation has been invalidated." -ForegroundColor Yellow
                                    #add to the dirty state list so that it can be removed later
                                    $this.DirtyResourceStates += $childResourceState
                                }
                            }
                        }
                        # Skip passed ones from State Management
                        # Skip the validation if invalidatePreviousAttestations is enabled to true in control settings
                        if ($currentItem.ActualVerificationResult -ne [VerificationResult]::Passed) {
                            #compare the states
                            if (($childResourceState.ActualVerificationResult -eq $currentItem.ActualVerificationResult) -and $childResourceState.State) {

                                $currentItem.StateManagement.AttestedStateData = $childResourceState.State;

                                # Compare dataobject property of State
                                if ($null -ne $childResourceState.State.DataObject) {
                                    if ($currentItem.StateManagement.CurrentStateData -and $null -ne $currentItem.StateManagement.CurrentStateData.DataObject) {
                                        $currentStateDataObject = [JsonHelper]::ConvertToJsonCustom($currentItem.StateManagement.CurrentStateData.DataObject) | ConvertFrom-Json

                                        try {
                                            # Objects match, change result based on attestation status
                                            if ($eventContext.ControlItem.AttestComparisionType -and $eventContext.ControlItem.AttestComparisionType -eq [ComparisionType]::NumLesserOrEqual) {
                                                $dataObjMatched = $false
                                                if ([Helpers]::CompareObject($childResourceState.State.DataObject, $currentStateDataObject, $true, $eventContext.ControlItem.AttestComparisionType)) {
                                                    $dataObjMatched = $true
                                                }
                                                if (-not $dataObjMatched)
                                                {
                                                    #In Linux env base24 encoding is different from that in Windows. Therefore doing a comparison of decoded data object as fallback
                                                    $decodedAttestedDataObj = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($childResourceState.State.DataObject))  | ConvertFrom-Json
                                                    $decodedCurrentDataObj = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($currentStateDataObject))  | ConvertFrom-Json
                                                    if ([Helpers]::CompareObject($decodedAttestedDataObj, $decodedCurrentDataObj, $true))
                                                    {
                                                        $dataObjMatched = $true
                                                    }

                                                    # Don't fail attestation if current state data object is a subset of attested state data object
                                                    if (($decodedCurrentDataObj | Measure-Object).Count -lt ($decodedAttestedDataObj | Measure-Object).Count) {
                                                        if ([Helpers]::CompareObject($decodedAttestedDataObj, $decodedCurrentDataObj, $false, $eventContext.ControlItem.AttestComparisionType))
                                                        {
                                                            $dataObjMatched = $true
                                                        }
                                                    }
                                                }
                                                if ($dataObjMatched)
                                                {
                                                    $this.ModifyControlResult($currentItem, $childResourceState);
                                                }

                                            }
                                            else {
                                                $dataObjMatched = $false
                                                if ([Helpers]::CompareObject($childResourceState.State.DataObject, $currentStateDataObject, $true)) {
                                                    #$this.ModifyControlResult($currentItem, $childResourceState);
                                                    $dataObjMatched = $true
                                                }
                                                if (-not $dataObjMatched)
                                                {
                                                    #In Linux env base24 encoding is different from that in Windows. Therefore doing a comparison of decoded data object as fallback
                                                    $decodedAttestedDataObj = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($childResourceState.State.DataObject))  | ConvertFrom-Json
                                                    $decodedCurrentDataObj = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($currentStateDataObject))  | ConvertFrom-Json
                                                    if ([Helpers]::CompareObject($decodedAttestedDataObj, $decodedCurrentDataObj, $true) -and [Helpers]::CompareObject($decodedCurrentDataObj, $decodedAttestedDataObj, $true))
                                                    {
                                                        $dataObjMatched = $true
                                                    }
                                                    
                                                    # Don't fail attestation if current state data object is a subset of attested state data object
                                                    if (($decodedCurrentDataObj | Measure-Object).Count -lt ($decodedAttestedDataObj | Measure-Object).Count) {
                                                        if ([Helpers]::CompareObject($decodedCurrentDataObj, $decodedAttestedDataObj, $false))
                                                        {
                                                            $dataObjMatched = $true
                                                        }
                                                    }
                                                    elseif ($decodedCurrentDataObj.GetType() -eq [Int] -and $decodedAttestedDataObj.GetType() -eq [Int]) {
                                                        if ($decodedCurrentDataObj -lt $decodedAttestedDataObj) {
                                                            $dataObjMatched = $true
                                                        }
                                                    }
                                                }
                                                if ($dataObjMatched)
                                                {
                                                    $this.ModifyControlResult($currentItem, $childResourceState);
                                                }
                                            }
                                        }
                                        catch {
                                            $this.EvaluationError($_);
                                        }
                                    }
                                }
                                else {
                                    if ($currentItem.StateManagement.CurrentStateData) {
                                        if ($null -eq $currentItem.StateManagement.CurrentStateData.DataObject) {
                                            # No object is persisted, change result based on attestation status
                                            $this.ModifyControlResult($currentItem, $childResourceState);
                                        }
                                    }
                                    else {
                                        # No object is persisted, change result based on attestation status
                                        $this.ModifyControlResult($currentItem, $childResourceState);
                                    }
                                }
                            }
                        }
                        else {
                            #add to the dirty state list so that it can be removed later
                            $this.DirtyResourceStates += $childResourceState
                        }
                    }
                }
            }
            catch {
                $this.EvaluationError($_);
            }
        };
    }

    # State Machine implementation of modifying verification result
    hidden [void] ModifyControlResult([ControlResult] $controlResult, [ControlState] $controlState) {
        # No action required if Attestation status is None OR verification result is Passed
        if ($controlState.AttestationStatus -ne [AttestationStatus]::None -or $controlResult.VerificationResult -ne [VerificationResult]::Passed) {
            $controlResult.AttestationStatus = $controlState.AttestationStatus;
            $controlResult.VerificationResult = [Helpers]::EvaluateVerificationResult($controlResult.VerificationResult, $controlState.AttestationStatus);
        }
    }

    #Function to validate attestation data expiry validation
    hidden [bool] IsStateActive([SVTEventContext] $eventcontext, [ControlState] $controlState) {
        try {
            $expiryIndays = $this.CalculateExpirationInDays([SVTEventContext] $eventcontext, [ControlState] $controlState);
            #Validate if expiry period is passed
            #Added a condition so as to expire attested controls that were in 'Error' state.
            if (($expiryIndays -ne -1 -and $controlState.State.AttestedDate.AddDays($expiryIndays) -lt [DateTime]::UtcNow) -or ($controlState.ActualVerificationResult -eq [VerificationResult]::Error)) {
                return $false
            }
            else {
                $controlState.State.ExpiryDate = ($controlState.State.AttestedDate.AddDays($expiryIndays)).ToString("MM/dd/yyyy");
                return $true
            }
        }
        catch {
            #if any exception occurs while getting/validating expiry period, return true.
            $this.EvaluationError($_);
            return $true
        }
    }

    hidden [int] CalculateExpirationInDays([SVTEventContext] $eventcontext, [ControlState] $controlState) {
        try {
            #For exempt controls, either the no. of days for expiry were provided at the time of attestation or a default of 6 motnhs was already considered,
            #therefore skipping this flow and calculating days directly using the expiry date already saved.
            $isApprovedExceptionEnforced = $false
            $approvedExceptionControlsList = @();
            if ([Helpers]::CheckMember($this.ControlSettings, "EnforceApprovedException") -and ($this.ControlSettings.EnforceApprovedException -eq $true)) {
                if ([Helpers]::CheckMember($this.ControlSettings, "ApprovedExceptionSettings") -and (($this.ControlSettings.ApprovedExceptionSettings.ControlsList | Measure-Object).Count -gt 0)) {
                    $isApprovedExceptionEnforced = $true
                    $approvedExceptionControlsList = $this.ControlSettings.ApprovedExceptionSettings.ControlsList
                }
            }
            
            if ($controlState.AttestationStatus -ne [AttestationStatus]::ApprovedException) {
                #Get controls expiry period. Default value is zero
                $controlAttestationExpiry = $eventcontext.controlItem.AttestationExpiryPeriodInDays
                $controlSeverity = $eventcontext.controlItem.ControlSeverity
                $controlSeverityExpiryPeriod = 0
                $defaultAttestationExpiryInDays = [Constants]::DefaultControlExpiryInDays;
                $expiryInDays = -1;

                if (($eventcontext.ControlResults | Measure-Object).Count -gt 0) {
                    $isControlInGrace = $eventcontext.ControlResults.IsControlInGrace;
                }
                else {
                    $isControlInGrace = $true;
                }
                if ([Helpers]::CheckMember($this.ControlSettings, "AttestationExpiryPeriodInDays") `
                        -and [Helpers]::CheckMember($this.ControlSettings.AttestationExpiryPeriodInDays, "Default") `
                        -and $this.ControlSettings.AttestationExpiryPeriodInDays.Default -gt 0) {
                    $defaultAttestationExpiryInDays = $this.ControlSettings.AttestationExpiryPeriodInDays.Default
                }
                #Expiry in the case of WillFixLater or StateConfirmed/Recurring Attestation state will be based on Control Severity.
                # Checking if the resource id is present in extended expiry list of control settings
                if ($controlState.AttestationStatus -eq [AttestationStatus]::NotAnIssue -or $controlState.AttestationStatus -eq [AttestationStatus]::NotApplicable) {
                    $expiryInDays = $defaultAttestationExpiryInDays;
                }
                else {
                    # Expire WillFixLater if GracePeriod has expired
                    if (-not($isControlInGrace) -and $controlState.AttestationStatus -eq [AttestationStatus]::WillFixLater) {
                        $expiryInDays = 0;
                    }
                    else {
                        if ($controlAttestationExpiry -ne 0) {
                            $expiryInDays = $controlAttestationExpiry
                        }
                        elseif ([Helpers]::CheckMember($this.ControlSettings, "AttestationExpiryPeriodInDays")) {
                            $controlsev = $this.ControlSettings.ControlSeverity.PSobject.Properties | Where-Object Value -eq $controlSeverity | Select-Object -First 1
                            $controlSeverity = $controlsev.name
                            #Check if control severity has expiry period
                            if ([Helpers]::CheckMember($this.ControlSettings.AttestationExpiryPeriodInDays.ControlSeverity, $controlSeverity) ) {
                                $expiryInDays = $this.ControlSettings.AttestationExpiryPeriodInDays.ControlSeverity.$controlSeverity
                            }
                            #If control item and severity does not contain expiry period, assign default value
                            else {
                                $expiryInDays = $defaultAttestationExpiryInDays
                            }
                        }
                        #Return -1 when expiry is not defined
                        else {
                            $expiryInDays = -1
                        }
                    }
                }
            }
            else {
                #Calculating the expiry in days for exempt controls
                if ([String]::IsNullOrEmpty($controlState.State.ExpiryDate))
                {
                    $expiryPeriod = $this.ControlSettings.DefaultAttestationPeriodForExemptControl
                    $expiryDate = ($controlState.State.AttestedDate).AddDays($expiryPeriod)
                }
                else
                {
                    $expiryDate = [DateTime]$controlState.State.ExpiryDate
                }
                # #Adding 1 explicitly to the days since the differnce below excludes the expiryDate and that also needs to be taken into account.
                # $expiryInDays = ($expiryDate - $controlState.State.AttestedDate).Days + 1
                # #Calculating the expiry in days for exempt controls

                # $expiryDate = [DateTime]$controlState.State.ExpiryDate
                # #Adding 1 explicitly to the days since the differnce below excludes the expiryDate and that also needs to be taken into account.
                $expiryInDays = ($expiryDate - $controlState.State.AttestedDate).Days + 1
            }

            if (($controlState.AttestationStatus -eq [AttestationStatus]::ApprovedException) -or ( $isApprovedExceptionEnforced -and $approvedExceptionControlsList -contains $controlState.ControlId)) {
                $expiryInDays = $this.ControlSettings.DefaultAttestationPeriodForExemptControl
            }
            elseif([Helpers]::CheckMember($this.ControlSettings, "ExtendedAttestationExpiryResources") -and [Helpers]::CheckMember($this.ControlSettings, "ExtendedAttestationExpiryDuration")){
                # Checking if the resource id is present in extended expiry list of control settings
                if(($this.ControlSettings.ExtendedAttestationExpiryResources | Get-Member "ResourceType") -and ($this.ControlSettings.ExtendedAttestationExpiryResources | Get-Member "ResourceIds")) {
                    $extendedResources = $this.ControlSettings.ExtendedAttestationExpiryResources | Where { $_.ResourceType -match $eventcontext.FeatureName }
                    # type null check
                    if(($extendedResources | Measure-Object).Count -gt 0 -and [Helpers]::CheckMember($extendedResources, "ResourceIds") -and $controlState.ResourceId -in $extendedResources.ResourceIds){
                        $expiryInDays = $this.ControlSettings.ExtendedAttestationExpiryDuration;
                    }
                }
            }
        }
        catch {
            #if any exception occurs while getting/validating expiry period, return -1.
            $this.EvaluationError($_);
            $expiryInDays = -1
        }
        return $expiryInDays
    }

    [SVTEventContext[]] FetchStateOfAllControls() {
        [SVTEventContext[]] $resourceSecurityResult = @();
        if (-not $this.ValidateMaintenanceState()) {
            if ($this.GetApplicableControls().Count -eq 0) {
                $this.PublishCustomMessage("No security controls match the input criteria specified", [MessageType]::Warning);
            }
            else {
                $this.EvaluationStarted();
                $resourceSecurityResult += $this.GetControlsStateResult();
                if (($resourceSecurityResult | Measure-Object).Count -gt 0) {
                    $this.EvaluationCompleted($resourceSecurityResult);
                }
            }
        }
        return $resourceSecurityResult;
    }

    hidden [SVTEventContext[]] GetControlsStateResult() {
        [SVTEventContext[]] $automatedControlsResult = @();
        $this.DirtyResourceStates = @();
        try {
            $this.GetApplicableControls() |
            ForEach-Object {
                $eventContext = $this.FetchControlState($_);
                #filter controls if there is no state found
                if ($eventContext) {
                    $eventContext.ControlResults = $eventContext.ControlResults | Where-Object { $_.AttestationStatus -ne [AttestationStatus]::None }
                    if ($eventContext.ControlResults) {
                        $automatedControlsResult += $eventContext;
                    }
                }
            };
        }
        catch {
            $this.EvaluationError($_);
        }

        return $automatedControlsResult;
    }
 #isRescan parameter is added to check if method is called from rescan.
    hidden [SVTEventContext] FetchControlState([ControlItem] $controlItem, $isRescan = $false) {
        [SVTEventContext] $singleControlResult = $this.CreateSVTEventContextObject();
        $singleControlResult.ControlItem = $controlItem;

        $controlState = @();
        $controlStateValue = @();
        try {
            $resourceStates = $this.GetResourceState($isRescan);
            if (($resourceStates | Measure-Object).Count -ne 0) {
                $controlStateValue += $resourceStates | Where-Object { $_.InternalId -eq $singleControlResult.ControlItem.Id };
                $controlStateValue | ForEach-Object {
                    $currentControlStateValue = $_;
                    if ($null -ne $currentControlStateValue) {
                        #assign expiry date
                        $expiryIndays = $this.CalculateExpirationInDays($singleControlResult, $currentControlStateValue);
                        if ($expiryIndays -ne -1) {
                            $currentControlStateValue.State.ExpiryDate = ($currentControlStateValue.State.AttestedDate.AddDays($expiryIndays)).ToString("MM/dd/yyyy");
                        }
                        $controlState += $currentControlStateValue;
                    }
                }
            }
        }
        catch {
            $this.EvaluationError($_);
        }
        if (($controlState | Measure-Object).Count -gt 0) {
        #Added check to resolve duplicate log issue in rescan
            if (!$isRescan) {
               $this.ControlStarted($singleControlResult);
            }
            if ($controlItem.Enabled -eq $false) {
                $this.ControlDisabled($singleControlResult);
            }
            else {
                $controlResult = $this.CreateControlResult($controlItem.FixControl);
                $singleControlResult.ControlResults += $controlResult;
                $singleControlResult.ControlResults |
                ForEach-Object {
                    try {
                        $currentItem = $_;

                        if ($controlState.Count -ne 0) {
                            # Process the state if it's available
                            $childResourceState = $controlState | Where-Object { $_.ChildResourceName -eq $currentItem.ChildResourceName } | Select-Object -First 1;
                            if ($childResourceState) {
                                $currentItem.StateManagement.AttestedStateData = $childResourceState.State;
                                $currentItem.AttestationStatus = $childResourceState.AttestationStatus;
                                $currentItem.ActualVerificationResult = $childResourceState.ActualVerificationResult;
                                $currentItem.VerificationResult = [VerificationResult]::NotScanned
                            }
                        }
                    }
                    catch {
                        $this.EvaluationError($_);
                    }
                };

            }
            #Added check to resolve duplicate log issue in rescan
            if (!$isRescan) {
               $this.ControlCompleted($singleControlResult);
            }
        }

        return $singleControlResult;
    }

    hidden [void] GetManualSecurityStatusExt($arg) {
        $this.PostProcessData($arg);
    }

    hidden [void] RunControlExt($singleControlResult) {
        $this.PostProcessData($singleControlResult);
    }

    hidden [void] EvaluateAllControlsExt($resourceSecurityResult) {
        $this.PostEvaluationCompleted($resourceSecurityResult);
    }

    hidden [void] PostEvaluationCompleted([SVTEventContext[]] $ControlResults) {
        $this.UpdateControlStates($ControlResults);

        $BugLogParameterValue =$this.InvocationContext.BoundParameters["AutoBugLog"]
        #perform bug logging after control scans for the current resource
        if ($BugLogParameterValue)
        {
            # using checkmember without null check, if field is present in control settings but no value has been set then allow bug logging for inactive resources.
            if([Helpers]::CheckMember($this.ControlSettings.BugLogging, "LogBugsForInactiveResources", $false))
            {
                # if bug logging is enabled for inactive resources, then only bug will be logged for inactive resources.
                if ($this.ControlSettings.BugLogging.LogBugsForInactiveResources -eq $false)
                {
                    $logBugsForInactiveResources = $this.isResourceActive;
                }
                # if bug logging is not enabled or its value has not been set in control setting, then treat bug logging is active for all resources.
                else
                {
                    $logBugsForInactiveResources = $true;
                }
            }
            # if required field is not present in the controlSettings,json then follow the older approach
            else
            {
                $logBugsForInactiveResources = $true;
            }
            #added check azuretable check here, if ((azuretable is used for storing bug info and scan mode is CA) OR azuretable bug info is disabed) then only allow bug logging
            $scanSource = [AzSKSettings]::GetInstance().GetScanSource();
            $isAzureTableEnabled = [Helpers]::CheckMember($this.ControlSettings.BugLogging, "UseAzureStorageAccount");
            if (!$isAzureTableEnabled -or ($isAzureTableEnabled -and ($scanSource -eq "CA")) )
            {
                if ($logBugsForInactiveResources) {
                    if (($ControlResults.ControlResults.VerificationResult -contains "Failed") -or ($ControlResults.ControlResults.VerificationResult -contains "Verify")) {
                        $this.BugLoggingPostEvaluation($ControlResults, $BugLogParameterValue)
                    }
                }
                else {
                    $this.PublishCustomMessage("The current resource is inactive. Bug logging is disabled for inactive resources.", [MessageType]::Warning);
                }
            }

        }
    }

    #function to call AutoBugLog class for performing bug logging
    hidden [void] BugLoggingPostEvaluation([SVTEventContext []] $ControlResults,[string] $BugLogParameterValue)
    {
        $AutoBugLog = [AutoBugLog]::AutoBugInstance
        if (!$AutoBugLog) {
            #Settting initial value true so will evaluate in all different cmds.(Powershell keeping static variables in memory in next command also.)
            [BugLogPathManager]::checkValidPathFlag = $true;
            $AutoBugLog = [AutoBugLog]::GetInstance($this.OrganizationContext.OrganizationName, $this.InvocationContext, $this.ControlStateExt, $BugLogParameterValue);
        }
        $AutoBugLog.LogBugInADO($ControlResults)
    }


}

# SIG # Begin signature block
# MIInugYJKoZIhvcNAQcCoIInqzCCJ6cCAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCKfbEWpofgHXl
# hSqTbOa6HvBrLRPpjstYXukQxnty66CCDYEwggX/MIID56ADAgECAhMzAAACUosz
# qviV8znbAAAAAAJSMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p
# bmcgUENBIDIwMTEwHhcNMjEwOTAyMTgzMjU5WhcNMjIwOTAxMTgzMjU5WjB0MQsw
# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u
# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
# AQDQ5M+Ps/X7BNuv5B/0I6uoDwj0NJOo1KrVQqO7ggRXccklyTrWL4xMShjIou2I
# sbYnF67wXzVAq5Om4oe+LfzSDOzjcb6ms00gBo0OQaqwQ1BijyJ7NvDf80I1fW9O
# L76Kt0Wpc2zrGhzcHdb7upPrvxvSNNUvxK3sgw7YTt31410vpEp8yfBEl/hd8ZzA
# v47DCgJ5j1zm295s1RVZHNp6MoiQFVOECm4AwK2l28i+YER1JO4IplTH44uvzX9o
# RnJHaMvWzZEpozPy4jNO2DDqbcNs4zh7AWMhE1PWFVA+CHI/En5nASvCvLmuR/t8
# q4bc8XR8QIZJQSp+2U6m2ldNAgMBAAGjggF+MIIBejAfBgNVHSUEGDAWBgorBgEE
# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUNZJaEUGL2Guwt7ZOAu4efEYXedEw
# UAYDVR0RBEkwR6RFMEMxKTAnBgNVBAsTIE1pY3Jvc29mdCBPcGVyYXRpb25zIFB1
# ZXJ0byBSaWNvMRYwFAYDVQQFEw0yMzAwMTIrNDY3NTk3MB8GA1UdIwQYMBaAFEhu
# ZOVQBdOCqhc3NyK1bajKdQKVMFQGA1UdHwRNMEswSaBHoEWGQ2h0dHA6Ly93d3cu
# bWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY0NvZFNpZ1BDQTIwMTFfMjAxMS0w
# Ny0wOC5jcmwwYQYIKwYBBQUHAQEEVTBTMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3
# Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY0NvZFNpZ1BDQTIwMTFfMjAx
# MS0wNy0wOC5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAFkk3
# uSxkTEBh1NtAl7BivIEsAWdgX1qZ+EdZMYbQKasY6IhSLXRMxF1B3OKdR9K/kccp
# kvNcGl8D7YyYS4mhCUMBR+VLrg3f8PUj38A9V5aiY2/Jok7WZFOAmjPRNNGnyeg7
# l0lTiThFqE+2aOs6+heegqAdelGgNJKRHLWRuhGKuLIw5lkgx9Ky+QvZrn/Ddi8u
# TIgWKp+MGG8xY6PBvvjgt9jQShlnPrZ3UY8Bvwy6rynhXBaV0V0TTL0gEx7eh/K1
# o8Miaru6s/7FyqOLeUS4vTHh9TgBL5DtxCYurXbSBVtL1Fj44+Od/6cmC9mmvrti
# yG709Y3Rd3YdJj2f3GJq7Y7KdWq0QYhatKhBeg4fxjhg0yut2g6aM1mxjNPrE48z
# 6HWCNGu9gMK5ZudldRw4a45Z06Aoktof0CqOyTErvq0YjoE4Xpa0+87T/PVUXNqf
# 7Y+qSU7+9LtLQuMYR4w3cSPjuNusvLf9gBnch5RqM7kaDtYWDgLyB42EfsxeMqwK
# WwA+TVi0HrWRqfSx2olbE56hJcEkMjOSKz3sRuupFCX3UroyYf52L+2iVTrda8XW
# esPG62Mnn3T8AuLfzeJFuAbfOSERx7IFZO92UPoXE1uEjL5skl1yTZB3MubgOA4F
# 8KoRNhviFAEST+nG8c8uIsbZeb08SeYQMqjVEmkwggd6MIIFYqADAgECAgphDpDS
# AAAAAAADMA0GCSqGSIb3DQEBCwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMK
# V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0
# IENvcnBvcmF0aW9uMTIwMAYDVQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0
# ZSBBdXRob3JpdHkgMjAxMTAeFw0xMTA3MDgyMDU5MDlaFw0yNjA3MDgyMTA5MDla
# MH4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS
# ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMT
# H01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTEwggIiMA0GCSqGSIb3DQEB
# AQUAA4ICDwAwggIKAoICAQCr8PpyEBwurdhuqoIQTTS68rZYIZ9CGypr6VpQqrgG
# OBoESbp/wwwe3TdrxhLYC/A4wpkGsMg51QEUMULTiQ15ZId+lGAkbK+eSZzpaF7S
# 35tTsgosw6/ZqSuuegmv15ZZymAaBelmdugyUiYSL+erCFDPs0S3XdjELgN1q2jz
# y23zOlyhFvRGuuA4ZKxuZDV4pqBjDy3TQJP4494HDdVceaVJKecNvqATd76UPe/7
# 4ytaEB9NViiienLgEjq3SV7Y7e1DkYPZe7J7hhvZPrGMXeiJT4Qa8qEvWeSQOy2u
# M1jFtz7+MtOzAz2xsq+SOH7SnYAs9U5WkSE1JcM5bmR/U7qcD60ZI4TL9LoDho33
# X/DQUr+MlIe8wCF0JV8YKLbMJyg4JZg5SjbPfLGSrhwjp6lm7GEfauEoSZ1fiOIl
# XdMhSz5SxLVXPyQD8NF6Wy/VI+NwXQ9RRnez+ADhvKwCgl/bwBWzvRvUVUvnOaEP
# 6SNJvBi4RHxF5MHDcnrgcuck379GmcXvwhxX24ON7E1JMKerjt/sW5+v/N2wZuLB
# l4F77dbtS+dJKacTKKanfWeA5opieF+yL4TXV5xcv3coKPHtbcMojyyPQDdPweGF
# RInECUzF1KVDL3SV9274eCBYLBNdYJWaPk8zhNqwiBfenk70lrC8RqBsmNLg1oiM
# CwIDAQABo4IB7TCCAekwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFEhuZOVQ
# BdOCqhc3NyK1bajKdQKVMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsGA1Ud
# DwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFHItOgIxkEO5FAVO
# 4eqnxzHRI4k0MFoGA1UdHwRTMFEwT6BNoEuGSWh0dHA6Ly9jcmwubWljcm9zb2Z0
# LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y
# Mi5jcmwwXgYIKwYBBQUHAQEEUjBQME4GCCsGAQUFBzAChkJodHRwOi8vd3d3Lm1p
# Y3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y
# Mi5jcnQwgZ8GA1UdIASBlzCBlDCBkQYJKwYBBAGCNy4DMIGDMD8GCCsGAQUFBwIB
# FjNodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2RvY3MvcHJpbWFyeWNw
# cy5odG0wQAYIKwYBBQUHAgIwNB4yIB0ATABlAGcAYQBsAF8AcABvAGwAaQBjAHkA
# XwBzAHQAYQB0AGUAbQBlAG4AdAAuIB0wDQYJKoZIhvcNAQELBQADggIBAGfyhqWY
# 4FR5Gi7T2HRnIpsLlhHhY5KZQpZ90nkMkMFlXy4sPvjDctFtg/6+P+gKyju/R6mj
# 82nbY78iNaWXXWWEkH2LRlBV2AySfNIaSxzzPEKLUtCw/WvjPgcuKZvmPRul1LUd
# d5Q54ulkyUQ9eHoj8xN9ppB0g430yyYCRirCihC7pKkFDJvtaPpoLpWgKj8qa1hJ
# Yx8JaW5amJbkg/TAj/NGK978O9C9Ne9uJa7lryft0N3zDq+ZKJeYTQ49C/IIidYf
# wzIY4vDFLc5bnrRJOQrGCsLGra7lstnbFYhRRVg4MnEnGn+x9Cf43iw6IGmYslmJ
# aG5vp7d0w0AFBqYBKig+gj8TTWYLwLNN9eGPfxxvFX1Fp3blQCplo8NdUmKGwx1j
# NpeG39rz+PIWoZon4c2ll9DuXWNB41sHnIc+BncG0QaxdR8UvmFhtfDcxhsEvt9B
# xw4o7t5lL+yX9qFcltgA1qFGvVnzl6UJS0gQmYAf0AApxbGbpT9Fdx41xtKiop96
# eiL6SJUfq/tHI4D1nvi/a7dLl+LrdXga7Oo3mXkYS//WsyNodeav+vyL6wuA6mk7
# r/ww7QRMjt/fdW1jkT3RnVZOT7+AVyKheBEyIXrvQQqxP/uozKRdwaGIm1dxVk5I
# RcBCyZt2WwqASGv9eZ/BvW1taslScxMNelDNMYIZjzCCGYsCAQEwgZUwfjELMAkG
# A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx
# HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9z
# b2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAxMQITMwAAAlKLM6r4lfM52wAAAAACUjAN
# BglghkgBZQMEAgEFAKCBrjAZBgkqhkiG9w0BCQMxDAYKKwYBBAGCNwIBBDAcBgor
# BgEEAYI3AgELMQ4wDAYKKwYBBAGCNwIBFTAvBgkqhkiG9w0BCQQxIgQg5yfEoPx4
# JhTfWhOeHplKDNPknbblR3C6Rb1Lg17Opn8wQgYKKwYBBAGCNwIBDDE0MDKgFIAS
# AE0AaQBjAHIAbwBzAG8AZgB0oRqAGGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbTAN
# BgkqhkiG9w0BAQEFAASCAQBJ9AQDCGSECYMs7jL9y+bBemdA47fGTKHIovaFswUo
# ENHapu+uDuVzmm3zBRiuUH+RTtYWNIdEwZkBd3Zu6m5sTzX+ONCUaDSpqCXWCCv5
# fnfomzBPdmD3qs/i59H1ReGkbULuWxH+tL8dcd/QNwviT+sykaml4WF4KKPm43iH
# Y4fyxQiuJEPwiZk34NaZrRhzlkOZdtnnGRdTA/AZ9wVKAsDCYJRIr8486ljcYba2
# C2N1FcbNod8kkq0puwBeiRunT5J5Vr6JouUkGMwNAMH70/fuPmJN7HVdE8UGders
# V+gF9AnDcJRMDEmBiEUoMpYLrdit7IwbaTdbF0JxMfKAoYIXGTCCFxUGCisGAQQB
# gjcDAwExghcFMIIXAQYJKoZIhvcNAQcCoIIW8jCCFu4CAQMxDzANBglghkgBZQME
# AgEFADCCAVkGCyqGSIb3DQEJEAEEoIIBSASCAUQwggFAAgEBBgorBgEEAYRZCgMB
# MDEwDQYJYIZIAWUDBAIBBQAEIE2K02Bgl+AAaIS6T9sgazrngn7SS5aynl9dHVHA
# KME2AgZiF5aidroYEzIwMjIwMzEwMDc1NjE4LjgzNlowBIACAfSggdikgdUwgdIx
# CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt
# b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLTArBgNVBAsTJE1p
# Y3Jvc29mdCBJcmVsYW5kIE9wZXJhdGlvbnMgTGltaXRlZDEmMCQGA1UECxMdVGhh
# bGVzIFRTUyBFU046RDA4Mi00QkZELUVFQkExJTAjBgNVBAMTHE1pY3Jvc29mdCBU
# aW1lLVN0YW1wIFNlcnZpY2WgghFoMIIHFDCCBPygAwIBAgITMwAAAY/zUajrWnLd
# zAABAAABjzANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMK
# V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0
# IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0Eg
# MjAxMDAeFw0yMTEwMjgxOTI3NDZaFw0yMzAxMjYxOTI3NDZaMIHSMQswCQYDVQQG
# EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG
# A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQg
# SXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxJjAkBgNVBAsTHVRoYWxlcyBUU1Mg
# RVNOOkQwODItNEJGRC1FRUJBMSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFt
# cCBTZXJ2aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAmVc+/rXP
# Fx6Fk4+CpLrubDrLTa3QuAHRVXuy+zsxXwkogkT0a+XWuBabwHyqj8RRiZQQvdvb
# Oq5NRExOeHiaCtkUsQ02ESAe9Cz+loBNtsfCq846u3otWHCJlqkvDrSr7mMBqwcR
# Y7cfhAGfLvlpMSojoAnk7Rej+jcJnYxIeN34F3h9JwANY360oGYCIS7pLOosWV+b
# xug9uiTZYE/XclyYNF6XdzZ/zD/4U5pxT4MZQmzBGvDs+8cDdA/stZfj/ry+i0XU
# YNFPhuqc+UKkwm/XNHB+CDsGQl+ZS0GcbUUun4VPThHJm6mRAwL5y8zptWEIocbT
# eRSTmZnUa2iYH2EOBV7eCjx0Sdb6kLc1xdFRckDeQGR4J1yFyybuZsUP8x0dOsEE
# oLQuOhuKlDLQEg7D6ZxmZJnS8B03ewk/SpVLqsb66U2qyF4BwDt1uZkjEZ7finIo
# UgSz4B7fWLYIeO2OCYxIE0XvwsVop9PvTXTZtGPzzmHU753GarKyuM6oa/qaTzYv
# rAfUb7KYhvVQKxGUPkL9+eKiM7G0qenJCFrXzZPwRWoccAR33PhNEuuzzKZFJ4De
# aTCLg/8uK0Q4QjFRef5n4H+2KQIEibZ7zIeBX3jgsrICbzzSm0QX3SRVmZH//Aqp
# 8YxkwcoI1WCBizv84z9eqwRBdQ4HYcNbQMMCAwEAAaOCATYwggEyMB0GA1UdDgQW
# BBTzBuZ0a65JzuKhzoWb25f7NyNxvDAfBgNVHSMEGDAWgBSfpxVdAF5iXYP05dJl
# pxtTNRnpcjBfBgNVHR8EWDBWMFSgUqBQhk5odHRwOi8vd3d3Lm1pY3Jvc29mdC5j
# b20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIwMjAx
# MCgxKS5jcmwwbAYIKwYBBQUHAQEEYDBeMFwGCCsGAQUFBzAChlBodHRwOi8vd3d3
# Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMFRpbWUtU3Rh
# bXAlMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoG
# CCsGAQUFBwMIMA0GCSqGSIb3DQEBCwUAA4ICAQDNf9Oo9zyhC5n1jC8iU7NJY39F
# izjhxZwJbJY/Ytwn63plMlTSaBperan566fuRojGJSv3EwZs+RruOU2T/ZRDx4VH
# esLHtclE8GmMM1qTMaZPL8I2FrRmf5Oop4GqcxNdNECBClVZmn0KzFdPMqRa5/0R
# 6CmgqJh0muvImikgHubvohsavPEyyHQa94HD4/LNKd/YIaCKKPz9SA5fAa4phQ4E
# vz2auY9SUluId5MK9H5cjWVwBxCvYAD+1CW9z7GshJlNjqBvWtKO6J0Aemfg6z28
# g7qc7G/tCtrlH4/y27y+stuwWXNvwdsSd1lvB4M63AuMl9Yp6au/XFknGzJPF6n/
# uWR6JhQvzh40ILgeThLmYhf8z+aDb4r2OBLG1P2B6aCTW2YQkt7TpUnzI0cKGr21
# 3CbKtGk/OOIHSsDOxasmeGJ+FiUJCiV15wh3aZT/VT/PkL9E4hDBAwGt49G88gSC
# O0x9jfdDZWdWGbELXlSmA3EP4eTYq7RrolY04G8fGtF0pzuZu43A29zaI9lIr5ul
# KRz8EoQHU6cu0PxUw0B9H8cAkvQxaMumRZ/4fCbqNb4TcPkPcWOI24QYlvpbtT9p
# 31flYElmc5wjGplAky/nkJcT0HZENXenxWtPvt4gcoqppeJPA3S/1D57KL3667ep
# Ir0yV290E2otZbAW8DCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkAAAAAABUw
# DQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5n
# dG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9y
# YXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRlIEF1dGhv
# cml0eSAyMDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVowfDELMAkG
# A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx
# HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9z
# b2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
# ggIKAoICAQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg
# 4r25PhdgM/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aO
# RmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41
# JmTamDu6GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byNpOORj7I5
# LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2krnopN6zL
# 64NF50ZuyjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4dPf0gz3N9
# QZpGdc3EXzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgSUei/BQOj
# 0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8QmguEOqE
# UUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0
# kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzFER1y7435
# UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQIDAQABo4IB
# 3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTE
# mr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwG
# A1UdIARVMFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93
# d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNV
# HSUEDDAKBggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNV
# HQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo
# 0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1pY3Jvc29m
# dC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5j
# cmwwWgYIKwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jv
# c29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNydDAN
# BgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4
# sQaTlz0xM7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN3Zi6th54
# 2DYunKmCVgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRX
# ud2f8449xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBew
# VIVCs/wMnosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0
# DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB62FD+Cljd
# QDzHVG2dY3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltEAY5aGZFr
# DZ+kKNxnGSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFpAUR+fKFh
# bHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7n
# tdAoGokLjzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRbatGePu1+
# oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQdVTNYs6Fw
# ZvKhggLXMIICQAIBATCCAQChgdikgdUwgdIxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
# EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv
# ZnQgQ29ycG9yYXRpb24xLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJh
# dGlvbnMgTGltaXRlZDEmMCQGA1UECxMdVGhhbGVzIFRTUyBFU046RDA4Mi00QkZE
# LUVFQkExJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2WiIwoB
# ATAHBgUrDgMCGgMVAD5NL4IEdudIBwdGoCaV0WBbQZpqoIGDMIGApH4wfDELMAkG
# A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx
# HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9z
# b2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcNAQEFBQACBQDl0+ARMCIY
# DzIwMjIwMzEwMTAyNTIxWhgPMjAyMjAzMTExMDI1MjFaMHcwPQYKKwYBBAGEWQoE
# ATEvMC0wCgIFAOXT4BECAQAwCgIBAAICCPMCAf8wBwIBAAICEUAwCgIFAOXVMZEC
# AQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYKKwYBBAGEWQoDAqAKMAgCAQACAwehIKEK
# MAgCAQACAwGGoDANBgkqhkiG9w0BAQUFAAOBgQCS/cgnFk6Yq7v+/9RUpkR+XKef
# jL4q2C196ikgSKHQqUa/G3jbxsdxH4jLAE0gQcMh8m9SlKYQxjSOl5DD69sRIAPo
# w8h4CKSFe5XOB+yZq4Lll4uK/H/Mu8OQy2jx5nmtWnYqgE1ShlDo2heDDZ7xe0Rn
# t/96vRi+MgMVKciQVzGCBA0wggQJAgEBMIGTMHwxCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1w
# IFBDQSAyMDEwAhMzAAABj/NRqOtact3MAAEAAAGPMA0GCWCGSAFlAwQCAQUAoIIB
# SjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwLwYJKoZIhvcNAQkEMSIEIMr9
# usK5QgTpk1SBIIyCg+duwtODiFo+amkaLe4fmvvVMIH6BgsqhkiG9w0BCRACLzGB
# 6jCB5zCB5DCBvQQgl3IFT+LGxguVjiKm22ItmO6dFDWW8nShu6O6g8yFxx8wgZgw
# gYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE
# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYD
# VQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAY/zUajrWnLd
# zAABAAABjzAiBCCFRu0P0Y0qpU6s2Z0ry8XkNHG/SAVM/siw9172W0DCTTANBgkq
# hkiG9w0BAQsFAASCAgBlYxF8+TkpQdlKHPEM0MwzYmkGap9M+7S+T2rFhyI/z/EJ
# xUFSfxXS8NOLdfSuRixBuX70cRt32xwOh381f4Y4JAHgPdpU09uZiawqsB41YXg1
# 9EB2gCJZPTqqJZUDy6M1l06Iv6FQlBUb99kFobhERiJkvh1q2BC2qfiFom7xGpir
# ZhFAzX++2hdWab6kTnfsShnj+7+uP9cxT5+/JpO6C/ZiekrAKSjK8ZVxeGZ8ifVo
# q+JYrsur/osTO+1gYRzhJEYUhtu6fO/3ki5y7BOFIYcT07hDI6yqO4m3HqUUAxIc
# DonBtY3DVEY9CUvpLqntba3tcTHQCOJNXVl1iptEhSOkF/9qMs0MEDvgrqFxtCKd
# H8Y3Rs73d0Z736rfVSBx5ihkb3JBfg2F0A8OGx5YRSYoFKn+6rm+kmhZK1YQttbU
# Qp4HsFDrICLtwraNvB/V/PGlHjb7uQl2Gh9fGJZh0Ts15r3ZgbSBeSjSapbhgapQ
# O114yJW+YTdUEkA4vO7uqBIHtUZzHnClQLnD3FcHenbpKlWA5LqdngzPOvVhLzCv
# iZ5pguZAaWRcKS4EWo0Pwjs5k93vlmK//8ZMd8FvGcc2WjFfdUbDMwPd3ClrXtaX
# 41vpxUHZ/clomHQc5zJ4CK4So9ZGsvCWCSLb6J3JmYU/AU2r5LETmr1lPucMew==
# SIG # End signature block