(List
  (FunctionDef try []
    (List
      (Com {[LIT_CHARS echo]} {[DQ [VarSub @]]})
      (AndOr OP_OR_IF
        (Com {[DQ [VarSub @]]})
        (Com {[LIT_CHARS exit]} {[LIT_CHARS 1]})
      )
    )
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS rm]} {[LIT_CHARS -rf]} {[LIT_CHARS out]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS mkdir]} {[LIT_CHARS out]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "echo 01 > out/policy-root-serial"]]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "echo 01 > out/policy-intermediate-serial"]]})
  (Com {[LIT_CHARS touch]} {[LIT_CHARS out/policy-root-index.txt]})
  (Com {[LIT_CHARS touch]} {[LIT_CHARS out/policy-intermediate-index.txt]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS genrsa]} {[LIT_CHARS -out]} {[LIT_CHARS out/policy-root.key]} {[LIT_CHARS 2048]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS genrsa]} {[LIT_CHARS -out]} {[LIT_CHARS out/policy-intermediate.key]} {[LIT_CHARS 2048]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS genrsa]} {[LIT_CHARS -out]} {[LIT_CHARS out/policy-cert.key]} {[LIT_CHARS 2048]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -key]} {[LIT_CHARS out/policy-root.key]} {[LIT_CHARS -out]} {[LIT_CHARS out/policy-root.csr]} {[LIT_CHARS -config]} {[LIT_CHARS policy.cnf]}
    more_env=[('COMMON_NAME', {[DQ [LIT_CHARS "Policy Test Root CA"]]}), ('CA_DIR', {[LIT_CHARS out]}), ('CA_NAME', {[LIT_CHARS policy-root]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS x509]} {[LIT_CHARS -req]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -in]} {[LIT_CHARS out/policy-root.csr]} {[LIT_CHARS -out]} {[LIT_CHARS out/policy-root.pem]} {[LIT_CHARS -signkey]} {[LIT_CHARS out/policy-root.key]} {[LIT_CHARS -extfile]} {[LIT_CHARS policy.cnf]} {[LIT_CHARS -extensions]} {[LIT_CHARS ca_cert]} {[LIT_CHARS -text]}
    more_env=[('COMMON_NAME', {[DQ [LIT_CHARS "Policy Test Root CA"]]}), ('CA_DIR', {[LIT_CHARS out]}), ('CA_NAME', {[LIT_CHARS policy-root]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -key]} {[LIT_CHARS out/policy-intermediate.key]} {[LIT_CHARS -out]} {[LIT_CHARS out/policy-intermediate.csr]} {[LIT_CHARS -config]} {[LIT_CHARS policy.cnf]}
    more_env=[('COMMON_NAME', {[DQ [LIT_CHARS "Policy Test Intermediate CA"]]}), ('CA_DIR', {[LIT_CHARS out]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS ca]} {[LIT_CHARS -batch]} {[LIT_CHARS -in]} {[LIT_CHARS out/policy-intermediate.csr]} {[LIT_CHARS -out]} {[LIT_CHARS out/policy-intermediate.pem]} {[LIT_CHARS -config]} {[LIT_CHARS policy.cnf]} {[LIT_CHARS -extensions]} {[LIT_CHARS intermediate_cert]}
    more_env=[('COMMON_NAME', {[DQ [LIT_CHARS UNUSED]]}), ('CA_DIR', {[LIT_CHARS out]}), ('CA_NAME', {[LIT_CHARS policy-root]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -key]} {[LIT_CHARS out/policy-cert.key]} {[LIT_CHARS -out]} {[LIT_CHARS out/policy-cert.csr]} {[LIT_CHARS -config]} {[LIT_CHARS policy.cnf]}
    more_env=[('COMMON_NAME', {[DQ [LIT_CHARS policy_test.example]]}), ('CA_DIR', {[LIT_CHARS out]}), ('CA_NAME', {[LIT_CHARS policy-intermediate]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS ca]} {[LIT_CHARS -batch]} {[LIT_CHARS -in]} {[LIT_CHARS out/policy-cert.csr]} {[LIT_CHARS -out]} {[LIT_CHARS out/policy-cert.pem]} {[LIT_CHARS -config]} {[LIT_CHARS policy.cnf]} {[LIT_CHARS -extensions]} {[LIT_CHARS user_cert]}
    more_env=[('COMMON_NAME', {[DQ [LIT_CHARS "Policy Test Intermediate CA"]]}), ('CA_DIR', {[LIT_CHARS out]}), ('CA_NAME', {[LIT_CHARS policy-intermediate]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "cat out/policy-cert.pem "][LIT_CHARS "    out/policy-intermediate.pem "][LIT_CHARS "    out/policy-root.pem >../certificates/explicit-policy-chain.pem"]]})
)