(List
  (FunctionDef try []
    (List
      (Com {[LIT_CHARS echo]} {[DQ [VarSub @]]})
      (AndOr OP_OR_IF
        (Com {[DQ [VarSub @]]})
        (Com {[LIT_CHARS exit]} {[LIT_CHARS 1]})
      )
    )
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS rm]} {[LIT_CHARS -rf]} {[LIT_CHARS out]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS mkdir]} {[LIT_CHARS out]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "echo 01 > out/2048-sha256-root-serial"]]})
  (Com {[LIT_CHARS touch]} {[LIT_CHARS out/2048-sha256-root-index.txt]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS genrsa]} {[LIT_CHARS -out]} {[LIT_CHARS out/2048-sha256-root.key]} {[LIT_CHARS 2048]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -key]} {[LIT_CHARS out/2048-sha256-root.key]} {[LIT_CHARS -out]} {[LIT_CHARS out/2048-sha256-root.req]} {[LIT_CHARS -config]} {[LIT_CHARS ca.cnf]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "Test Root CA"]]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS x509]} {[LIT_CHARS -req]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -in]} {[LIT_CHARS out/2048-sha256-root.req]} {[LIT_CHARS -out]} {[LIT_CHARS out/2048-sha256-root.pem]} {[LIT_CHARS -signkey]} {[LIT_CHARS out/2048-sha256-root.key]} {[LIT_CHARS -extfile]} {[LIT_CHARS ca.cnf]} {[LIT_CHARS -extensions]} {[LIT_CHARS ca_cert]} {[LIT_CHARS -text]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "Test Root CA"]]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -keyout]} {[LIT_CHARS out/expired_cert.key]} {[LIT_CHARS -out]} {[LIT_CHARS out/expired_cert.req]} {[LIT_CHARS -config]} {[LIT_CHARS ee.cnf]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -keyout]} {[LIT_CHARS out/ok_cert.key]} {[LIT_CHARS -out]} {[LIT_CHARS out/ok_cert.req]} {[LIT_CHARS -config]} {[LIT_CHARS ee.cnf]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS ca]} {[LIT_CHARS -batch]} {[LIT_CHARS -extensions]} {[LIT_CHARS user_cert]} {[LIT_CHARS -startdate]} {[LIT_CHARS 060101000000Z]} {[LIT_CHARS -enddate]} {[LIT_CHARS 070101000000Z]} {[LIT_CHARS -in]} {[LIT_CHARS out/expired_cert.req]} {[LIT_CHARS -out]} {[LIT_CHARS out/expired_cert.pem]} {[LIT_CHARS -config]} {[LIT_CHARS ca.cnf]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "Test Root CA"]]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS ca]} {[LIT_CHARS -batch]} {[LIT_CHARS -extensions]} {[LIT_CHARS user_cert]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -in]} {[LIT_CHARS out/ok_cert.req]} {[LIT_CHARS -out]} {[LIT_CHARS out/ok_cert.pem]} {[LIT_CHARS -config]} {[LIT_CHARS ca.cnf]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "Test Root CA"]]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS ca]} {[LIT_CHARS -batch]} {[LIT_CHARS -extensions]} {[LIT_CHARS name_constraint_bad]} {[LIT_CHARS -subj]} {[DQ [LIT_CHARS "/CN=Leaf certificate/"]]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -in]} {[LIT_CHARS out/ok_cert.req]} {[LIT_CHARS -out]} {[LIT_CHARS out/name_constraint_bad.pem]} {[LIT_CHARS -config]} {[LIT_CHARS ca.cnf]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "Test Root CA"]]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS ca]} {[LIT_CHARS -batch]} {[LIT_CHARS -extensions]} {[LIT_CHARS name_constraint_good]} {[LIT_CHARS -subj]} {[DQ [LIT_CHARS "/CN=Leaf Certificate/"]]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -in]} {[LIT_CHARS out/ok_cert.req]} {[LIT_CHARS -out]} {[LIT_CHARS out/name_constraint_good.pem]} {[LIT_CHARS -config]} {[LIT_CHARS ca.cnf]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "Test Root CA"]]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "cat out/ok_cert.key out/ok_cert.pem "][LIT_CHARS "    > ../certificates/ok_cert.pem"]]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "cat out/expired_cert.key out/expired_cert.pem "][LIT_CHARS "    > ../certificates/expired_cert.pem"]]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "cat out/2048-sha256-root.key out/2048-sha256-root.pem "][LIT_CHARS "    > ../certificates/root_ca_cert.pem"]]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "cat out/ok_cert.key out/name_constraint_bad.pem "][LIT_CHARS "    > ../certificates/name_constraint_bad.pem"]]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "cat out/ok_cert.key out/name_constraint_good.pem "][LIT_CHARS "    > ../certificates/name_constraint_good.pem"]]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -x509]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -config]} {[LIT_CHARS ../scripts/ee.cnf]} {[LIT_CHARS -newkey]} {[LIT_CHARS rsa] [LIT_OTHER ":"] [LIT_CHARS 2048]} {[LIT_CHARS -text]} {[LIT_CHARS -sha256]} {[LIT_CHARS -out]} {[LIT_CHARS sha256.pem]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -x509]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -extensions]} {[LIT_CHARS req_spdy_pooling]} {[LIT_CHARS -config]} {[LIT_CHARS ../scripts/ee.cnf]} {[LIT_CHARS -newkey]} {[LIT_CHARS rsa] [LIT_OTHER ":"] [LIT_CHARS 2048]} {[LIT_CHARS -text]} {[LIT_CHARS -out]} {[LIT_CHARS ../certificates/spdy_pooling.pem]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -x509]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -extensions]} {[LIT_CHARS req_san_sanity]} {[LIT_CHARS -config]} {[LIT_CHARS ../scripts/ee.cnf]} {[LIT_CHARS -newkey]} {[LIT_CHARS rsa] [LIT_OTHER ":"] [LIT_CHARS 2048]} {[LIT_CHARS -text]} {[LIT_CHARS -out]} {[LIT_CHARS ../certificates/subjectAltName_sanity_check.pem]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -x509]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -extensions]} {[LIT_CHARS req_punycode]} {[LIT_CHARS -config]} {[LIT_CHARS ../scripts/ee.cnf]} {[LIT_CHARS -newkey]} {[LIT_CHARS rsa] [LIT_OTHER ":"] [LIT_CHARS 2048]} {[LIT_CHARS -text]} {[LIT_CHARS -out]} {[LIT_CHARS ../certificates/punycodetest.pem]}
    more_env=[('SUBJECT_NAME', {[DQ [LIT_CHARS req_punycode_dn]]})]
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS python]} {[LIT_CHARS crlsetutil.py]} {[LIT_CHARS -o]} {[LIT_CHARS ../certificates/crlset_by_leaf_spki.raw]}
    <
    (HereDocRedirectNode here_end='CRLBYLEAFSPKI' do_expansion=True body_word={[DQ [LIT_CHARS "{\n"][LIT_CHARS "  "][RIGHT_D_QUOTE "\""][LIT_CHARS BlockedBySPKI][RIGHT_D_QUOTE "\""][LIT_CHARS ": ["][RIGHT_D_QUOTE "\""][LIT_CHARS ../certificates/ok_cert.pem][RIGHT_D_QUOTE "\""][LIT_CHARS "]\n"][LIT_CHARS "}\n"]]} <REDIR_DLESS "<<"> 0),
    >
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS python]} {[LIT_CHARS crlsetutil.py]} {[LIT_CHARS -o]} {[LIT_CHARS ../certificates/crlset_by_root_serial.raw]}
    <
    (HereDocRedirectNode here_end='CRLBYROOTSERIAL' do_expansion=True body_word={[DQ [LIT_CHARS "{\n"][LIT_CHARS "  "][RIGHT_D_QUOTE "\""][LIT_CHARS BlockedByHash][RIGHT_D_QUOTE "\""][LIT_CHARS ": {\n"][LIT_CHARS "    "][RIGHT_D_QUOTE "\""][LIT_CHARS ../certificates/root_ca_cert.pem][RIGHT_D_QUOTE "\""][LIT_CHARS ": [2]\n"][LIT_CHARS "  }\n"][LIT_CHARS "}\n"]]} <REDIR_DLESS "<<"> 0),
    >
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS python]} {[LIT_CHARS crlsetutil.py]} {[LIT_CHARS -o]} {[LIT_CHARS ../certificates/crlset_by_intermediate_serial.raw]}
    <
    (HereDocRedirectNode here_end='CRLSETBYINTERMEDIATESERIAL' do_expansion=True body_word={[DQ [LIT_CHARS "{\n"][LIT_CHARS "  "][RIGHT_D_QUOTE "\""][LIT_CHARS BlockedByHash][RIGHT_D_QUOTE "\""][LIT_CHARS ": {\n"][LIT_CHARS "    "][RIGHT_D_QUOTE "\""][LIT_CHARS ../certificates/quic_intermediate.crt][RIGHT_D_QUOTE "\""][LIT_CHARS ": [3]\n"][LIT_CHARS "  }\n"][LIT_CHARS "}\n"]]} <REDIR_DLESS "<<"> 0),
    >
  )
)