(CommandList
  children: [
    (C {(set)} {(-e)})
    (SimpleCommand
      words: [{(cat)}]
      redirects: [
        (Redir op_id:Redir_Great fd:-1 arg_word:{(server.conf)} spids:[64])
        (HereDoc
          op_id: Redir_DLess
          fd: -1
          body: 
            {
              (DQ ("[req]\n") ("req_extensions = v3_req\n") 
                ("distinguished_name = req_distinguished_name\n") ("[req_distinguished_name]\n") ("[ v3_req ]\n") ("basicConstraints = CA:FALSE\n") 
                ("keyUsage = nonRepudiation, digitalSignature, keyEncipherment\n") ("extendedKeyUsage = serverAuth\n") ("subjectAltName = @alt_names\n") ("[alt_names]\n") 
                ("IP.1 = 127.0.0.1\n")
              )
            }
          do_expansion: True
          here_end: EOF
          was_filled: True
          spids: [68]
        )
      ]
    )
    (SimpleCommand
      words: [{(cat)}]
      redirects: [
        (Redir op_id:Redir_Great fd:-1 arg_word:{(client.conf)} spids:[86])
        (HereDoc
          op_id: Redir_DLess
          fd: -1
          body: 
            {
              (DQ ("[req]\n") ("req_extensions = v3_req\n") 
                ("distinguished_name = req_distinguished_name\n") ("[req_distinguished_name]\n") ("[ v3_req ]\n") ("basicConstraints = CA:FALSE\n") 
                ("keyUsage = nonRepudiation, digitalSignature, keyEncipherment\n") ("extendedKeyUsage = clientAuth\n")
              )
            }
          do_expansion: True
          here_end: EOF
          was_filled: True
          spids: [90]
        )
      ]
    )
    (C {(openssl)} {(genrsa)} {(-out)} {(caKey.pem)} {(2048)})
    (C {(openssl)} {(req)} {(-x509)} {(-new)} {(-nodes)} {(-key)} {(caKey.pem)} {(-days)} {(100000)} {(-out)} 
      {(caCert.pem)} {(-subj)} {(DQ ("/CN=webhook_imagepolicy_ca"))}
    )
    (C {(openssl)} {(genrsa)} {(-out)} {(badCAKey.pem)} {(2048)})
    (C {(openssl)} {(req)} {(-x509)} {(-new)} {(-nodes)} {(-key)} {(badCAKey.pem)} {(-days)} {(100000)} 
      {(-out)} {(badCACert.pem)} {(-subj)} {(DQ ("/CN=webhook_imagepolicy_ca"))}
    )
    (C {(openssl)} {(genrsa)} {(-out)} {(serverKey.pem)} {(2048)})
    (C {(openssl)} {(req)} {(-new)} {(-key)} {(serverKey.pem)} {(-out)} {(server.csr)} {(-subj)} 
      {(DQ ("/CN=webhook_imagepolicy_server"))} {(-config)} {(server.conf)}
    )
    (C {(openssl)} {(x509)} {(-req)} {(-in)} {(server.csr)} {(-CA)} {(caCert.pem)} {(-CAkey)} {(caKey.pem)} 
      {(-CAcreateserial)} {(-out)} {(serverCert.pem)} {(-days)} {(100000)} {(-extensions)} {(v3_req)} {(-extfile)} {(server.conf)}
    )
    (C {(openssl)} {(genrsa)} {(-out)} {(clientKey.pem)} {(2048)})
    (C {(openssl)} {(req)} {(-new)} {(-key)} {(clientKey.pem)} {(-out)} {(client.csr)} {(-subj)} 
      {(DQ ("/CN=webhook_imagepolicy_client"))} {(-config)} {(client.conf)}
    )
    (C {(openssl)} {(x509)} {(-req)} {(-in)} {(client.csr)} {(-CA)} {(caCert.pem)} {(-CAkey)} {(caKey.pem)} 
      {(-CAcreateserial)} {(-out)} {(clientCert.pem)} {(-days)} {(100000)} {(-extensions)} {(v3_req)} {(-extfile)} {(client.conf)}
    )
    (Assignment
      keyword: Assign_None
      pairs: [(assign_pair lhs:(LhsName name:outfile) op:Equal rhs:{(certs_test.go)} spids:[335])]
      spids: [335]
    )
    (SimpleCommand
      words: [{(cat)}]
      redirects: [
        (Redir op_id:Redir_Great fd:-1 arg_word:{($ VSub_Name "$outfile")} spids:[341])
        (HereDoc
          op_id: Redir_DLess
          fd: -1
          body: 
            {
              (DQ ("/*\n") ("Copyright 2016 The Kubernetes Authors.\n") ("\n") 
                ("Licensed under the Apache License, Version 2.0 (the ") (Right_DoubleQuote "\"") (License) (Right_DoubleQuote "\"") (");\n") 
                ("you may not use this file except in compliance with the License.\n") ("You may obtain a copy of the License at\n") ("\n") 
                ("    http://www.apache.org/licenses/LICENSE-2.0\n") ("\n") ("Unless required by applicable law or agreed to in writing, software\n") 
                ("distributed under the License is distributed on an ") (Right_DoubleQuote "\"") ("AS IS") (Right_DoubleQuote "\"") (" BASIS,\n") 
                ("WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n") ("See the License for the specific language governing permissions and\n") 
                ("limitations under the License.\n") ("*/\n") ("\n")
              )
            }
          do_expansion: True
          here_end: EOF
          was_filled: True
          spids: [345]
        )
      ]
    )
    (SimpleCommand
      words: [{(echo)} {(DQ ("// This file was generated using openssl by the gencerts.sh script"))}]
      redirects: [(Redir op_id:Redir_DGreat fd:-1 arg_word:{($ VSub_Name "$outfile")} spids:[380])]
    )
    (SimpleCommand
      words: [{(echo)} {(DQ ("// and holds raw certificates for the imagepolicy webhook tests."))}]
      redirects: [(Redir op_id:Redir_DGreat fd:-1 arg_word:{($ VSub_Name "$outfile")} spids:[390])]
    )
    (SimpleCommand
      words: [{(echo)} {(DQ )}]
      redirects: [(Redir op_id:Redir_DGreat fd:-1 arg_word:{($ VSub_Name "$outfile")} spids:[399])]
    )
    (SimpleCommand
      words: [{(echo)} {(DQ ("package imagepolicy"))}]
      redirects: [(Redir op_id:Redir_DGreat fd:-1 arg_word:{($ VSub_Name "$outfile")} spids:[409])]
    )
    (ForEach
      iter_name: file
      iter_words: [
        {(caKey)}
        {(caCert)}
        {(badCAKey)}
        {(badCACert)}
        {(serverKey)}
        {(serverCert)}
        {(clientKey)}
        {(clientCert)}
      ]
      do_arg_iter: False
      body: 
        (DoGroup
          children: [
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:data)
                  op: Equal
                  rhs: 
                    {
                      (CommandSubPart
                        command_list: 
                          (CommandList
                            children: [(C {(cat)} {(${ VSub_Name file) (.pem)})]
                          )
                        left_token: <Left_CommandSub "$(">
                        spids: [440 447]
                      )
                    }
                  spids: [439]
                )
              ]
              spids: [439]
            )
            (SimpleCommand
              words: [{(echo)} {(DQ )}]
              redirects: [
                (Redir
                  op_id: Redir_DGreat
                  fd: -1
                  arg_word: {($ VSub_Name "$outfile")}
                  spids: [455]
                )
              ]
            )
            (SimpleCommand
              words: [
                {(echo)}
                {
                  (DQ ("var ") ($ VSub_Name "$file") (" = []byte(") 
                    (EscapedLiteralPart token:<Lit_EscapedChar "\\`">) ($ VSub_Name "$data") (EscapedLiteralPart token:<Lit_EscapedChar "\\`">) (")")
                  )
                }
              ]
              redirects: [
                (Redir
                  op_id: Redir_DGreat
                  fd: -1
                  arg_word: {($ VSub_Name "$outfile")}
                  spids: [472]
                )
              ]
            )
          ]
          spids: [436 476]
        )
      spids: [418 434]
    )
    (C {(rm)} {(Lit_Other "*") (.pem)})
    (C {(rm)} {(Lit_Other "*") (.csr)})
    (C {(rm)} {(Lit_Other "*") (.srl)})
    (C {(rm)} {(Lit_Other "*") (.conf)})
  ]
)