(List
  (FunctionDef try []
    (List
      (Com {[LIT_CHARS echo]} {[DQ [VarSub @]]})
      (AndOr OP_OR_IF
        (Com {[DQ [VarSub @]]})
        (Com {[LIT_CHARS exit]} {[LIT_CHARS 1]})
      )
    )
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS rm]} {[LIT_CHARS -rf]} {[LIT_CHARS out]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS mkdir]} {[LIT_CHARS out]})
  (= scope=<EAssignScope.GLOBAL 1> flags=0 words=[] bindings=[('eku_test_root', {[DQ [LIT_CHARS 2048-rsa-root]]})])
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "echo 01 > "][\ LIT_ESCAPED_CHAR "\\\""][LIT_CHARS out/][VarSub eku_test_root][LIT_CHARS -serial][\ LIT_ESCAPED_CHAR "\\\""]]})
  (Com {[LIT_CHARS touch]} {[DQ [LIT_CHARS out/][VarSub eku_test_root][LIT_CHARS -index.txt]]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS genrsa]} {[LIT_CHARS -out]} {[DQ [LIT_CHARS out/][VarSub eku_test_root][LIT_CHARS .key]]} {[LIT_CHARS 2048]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -key]} {[DQ [LIT_CHARS out/][VarSub eku_test_root][LIT_CHARS .key]]} {[LIT_CHARS -extensions]} {[LIT_CHARS ca_cert]} {[LIT_CHARS -out]} {[DQ [LIT_CHARS out/][VarSub eku_test_root][LIT_CHARS .csr]]} {[LIT_CHARS -config]} {[LIT_CHARS ca.cnf]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "2048 RSA Test Root CA"]]}), ('CA_DIR', {[LIT_CHARS out]}), ('CA_NAME', {[LIT_CHARS req_env_dn]}), ('KEY_SIZE', {[LIT_CHARS 2048]}), ('ALGO', {[LIT_CHARS rsa]}), ('CERT_TYPE', {[LIT_CHARS root]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS x509]} {[LIT_CHARS -req]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -in]} {[DQ [LIT_CHARS out/][VarSub eku_test_root][LIT_CHARS .csr]]} {[LIT_CHARS -extensions]} {[LIT_CHARS ca_cert]} {[LIT_CHARS -extfile]} {[LIT_CHARS ca.cnf]} {[LIT_CHARS -signkey]} {[DQ [LIT_CHARS out/][VarSub eku_test_root][LIT_CHARS .key]]} {[LIT_CHARS -out]} {[DQ [LIT_CHARS out/][VarSub eku_test_root][LIT_CHARS .pem]]} {[LIT_CHARS -text]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "2048 RSA Test Root CA"]]}), ('CA_DIR', {[LIT_CHARS out]}), ('CA_NAME', {[LIT_CHARS req_env_dn]})]
  )
  (For cert_type [{[LIT_CHARS non-crit-codeSigning]}, {[LIT_CHARS crit-codeSigning]}])
    (List
      (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS genrsa]} {[LIT_CHARS -out]} {[DQ [LIT_CHARS out/][VarSub cert_type][LIT_CHARS .key]]} {[LIT_CHARS 2048]})
      (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -key]} {[DQ [LIT_CHARS out/][VarSub cert_type][LIT_CHARS .key]]} {[LIT_CHARS -out]} {[DQ [LIT_CHARS out/][VarSub cert_type][LIT_CHARS .csr]]} {[LIT_CHARS -config]} {[LIT_CHARS eku-test.cnf]} {[LIT_CHARS -reqexts]} {[DQ [VarSub cert_type]]})
      (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS ca]} {[LIT_CHARS -batch]} {[LIT_CHARS -in]} {[DQ [LIT_CHARS out/][VarSub cert_type][LIT_CHARS .csr]]} {[LIT_CHARS -out]} {[DQ [LIT_CHARS out/][VarSub cert_type][LIT_CHARS .pem]]} {[LIT_CHARS -config]} {[LIT_CHARS ca.cnf]}
            more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "2048 rsa Test Root CA"]]}), ('CA_DIR', {[LIT_CHARS out]}), ('CA_NAME', {[LIT_CHARS req_env_dn]}), ('KEY_SIZE', {[LIT_CHARS 2048]}), ('ALGO', {[LIT_CHARS rsa]}), ('CERT_TYPE', {[LIT_CHARS root]})]
      )
    )
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS cp]} {[DQ [LIT_CHARS out/][VarSub eku_test_root][LIT_CHARS .pem]]} {[LIT_CHARS ../certificates/eku-test-root.pem]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "cat out/crit-codeSigning.key out/crit-codeSigning.pem "][LIT_CHARS "  > ../certificates/crit-codeSigning-chain.pem"]]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "cat out/non-crit-codeSigning.key out/non-crit-codeSigning.pem "][LIT_CHARS "  > ../certificates/non-crit-codeSigning-chain.pem"]]})
)