(CommandList
  children: [
    (C {(set)} {(-e)})
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:CN_BASE)
          op: Equal
          rhs: {(DQ (generic_webhook_admission_plugin_tests))}
          spids: [62]
        )
      ]
      spids: [62]
    )
    (SimpleCommand
      words: [{(cat)}]
      redirects: [
        (Redir op_id:Redir_Great fd:-1 arg_word:{(server.conf)} spids:[70])
        (HereDoc
          op_id: Redir_DLess
          fd: -1
          body: 
            {
              (DQ ("[req]\n") ("req_extensions = v3_req\n") 
                ("distinguished_name = req_distinguished_name\n") ("[req_distinguished_name]\n") ("[ v3_req ]\n") ("basicConstraints = CA:FALSE\n") 
                ("keyUsage = nonRepudiation, digitalSignature, keyEncipherment\n") ("extendedKeyUsage = clientAuth, serverAuth\n") ("subjectAltName = @alt_names\n") ("[alt_names]\n") 
                ("IP.1 = 127.0.0.1\n")
              )
            }
          do_expansion: True
          here_end: EOF
          was_filled: True
          spids: [74]
        )
      ]
    )
    (SimpleCommand
      words: [{(cat)}]
      redirects: [
        (Redir op_id:Redir_Great fd:-1 arg_word:{(client.conf)} spids:[92])
        (HereDoc
          op_id: Redir_DLess
          fd: -1
          body: 
            {
              (DQ ("[req]\n") ("req_extensions = v3_req\n") 
                ("distinguished_name = req_distinguished_name\n") ("[req_distinguished_name]\n") ("[ v3_req ]\n") ("basicConstraints = CA:FALSE\n") 
                ("keyUsage = nonRepudiation, digitalSignature, keyEncipherment\n") ("extendedKeyUsage = clientAuth, serverAuth\n") ("subjectAltName = @alt_names\n") ("[alt_names]\n") 
                ("IP.1 = 127.0.0.1\n")
              )
            }
          do_expansion: True
          here_end: EOF
          was_filled: True
          spids: [96]
        )
      ]
    )
    (C {(openssl)} {(genrsa)} {(-out)} {(caKey.pem)} {(2048)})
    (C {(openssl)} {(req)} {(-x509)} {(-new)} {(-nodes)} {(-key)} {(caKey.pem)} {(-days)} {(100000)} {(-out)} 
      {(caCert.pem)} {(-subj)} {(DQ ("/CN=") (${ VSub_Name CN_BASE) (_ca))}
    )
    (C {(openssl)} {(genrsa)} {(-out)} {(badCAKey.pem)} {(2048)})
    (C {(openssl)} {(req)} {(-x509)} {(-new)} {(-nodes)} {(-key)} {(badCAKey.pem)} {(-days)} {(100000)} 
      {(-out)} {(badCACert.pem)} {(-subj)} {(DQ ("/CN=") (${ VSub_Name CN_BASE) (_ca))}
    )
    (C {(openssl)} {(genrsa)} {(-out)} {(serverKey.pem)} {(2048)})
    (C {(openssl)} {(req)} {(-new)} {(-key)} {(serverKey.pem)} {(-out)} {(server.csr)} {(-subj)} 
      {(DQ ("/CN=webhook-test.default.svc"))} {(-config)} {(server.conf)}
    )
    (C {(openssl)} {(x509)} {(-req)} {(-in)} {(server.csr)} {(-CA)} {(caCert.pem)} {(-CAkey)} {(caKey.pem)} 
      {(-CAcreateserial)} {(-out)} {(serverCert.pem)} {(-days)} {(100000)} {(-extensions)} {(v3_req)} {(-extfile)} {(server.conf)}
    )
    (C {(openssl)} {(genrsa)} {(-out)} {(clientKey.pem)} {(2048)})
    (C {(openssl)} {(req)} {(-new)} {(-key)} {(clientKey.pem)} {(-out)} {(client.csr)} {(-subj)} 
      {(DQ ("/CN=") (${ VSub_Name CN_BASE) (_client))} {(-config)} {(client.conf)}
    )
    (C {(openssl)} {(x509)} {(-req)} {(-in)} {(client.csr)} {(-CA)} {(caCert.pem)} {(-CAkey)} {(caKey.pem)} 
      {(-CAcreateserial)} {(-out)} {(clientCert.pem)} {(-days)} {(100000)} {(-extensions)} {(v3_req)} {(-extfile)} {(client.conf)}
    )
    (Assignment
      keyword: Assign_None
      pairs: [(assign_pair lhs:(LhsName name:outfile) op:Equal rhs:{(certs_test.go)} spids:[356])]
      spids: [356]
    )
    (SimpleCommand
      words: [{(cat)}]
      redirects: [
        (Redir op_id:Redir_Great fd:-1 arg_word:{($ VSub_Name "$outfile")} spids:[362])
        (HereDoc
          op_id: Redir_DLess
          fd: -1
          body: 
            {
              (DQ ("/*\n") ("Copyright 2017 The Kubernetes Authors.\n") ("\n") 
                ("Licensed under the Apache License, Version 2.0 (the ") (Right_DoubleQuote "\"") (License) (Right_DoubleQuote "\"") (");\n") 
                ("you may not use this file except in compliance with the License.\n") ("You may obtain a copy of the License at\n") ("\n") 
                ("    http://www.apache.org/licenses/LICENSE-2.0\n") ("\n") ("Unless required by applicable law or agreed to in writing, software\n") 
                ("distributed under the License is distributed on an ") (Right_DoubleQuote "\"") ("AS IS") (Right_DoubleQuote "\"") (" BASIS,\n") 
                ("WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n") ("See the License for the specific language governing permissions and\n") 
                ("limitations under the License.\n") ("*/\n") ("\n")
              )
            }
          do_expansion: True
          here_end: EOF
          was_filled: True
          spids: [366]
        )
      ]
    )
    (SimpleCommand
      words: [{(echo)} {(DQ ("// This file was generated using openssl by the gencerts.sh script"))}]
      redirects: [(Redir op_id:Redir_DGreat fd:-1 arg_word:{($ VSub_Name "$outfile")} spids:[401])]
    )
    (SimpleCommand
      words: [{(echo)} {(DQ ("// and holds raw certificates for the webhook tests."))}]
      redirects: [(Redir op_id:Redir_DGreat fd:-1 arg_word:{($ VSub_Name "$outfile")} spids:[411])]
    )
    (SimpleCommand
      words: [{(echo)} {(DQ )}]
      redirects: [(Redir op_id:Redir_DGreat fd:-1 arg_word:{($ VSub_Name "$outfile")} spids:[420])]
    )
    (SimpleCommand
      words: [{(echo)} {(DQ ("package webhook"))}]
      redirects: [(Redir op_id:Redir_DGreat fd:-1 arg_word:{($ VSub_Name "$outfile")} spids:[430])]
    )
    (ForEach
      iter_name: file
      iter_words: [
        {(caKey)}
        {(caCert)}
        {(badCAKey)}
        {(badCACert)}
        {(serverKey)}
        {(serverCert)}
        {(clientKey)}
        {(clientCert)}
      ]
      do_arg_iter: False
      body: 
        (DoGroup
          children: [
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:data)
                  op: Equal
                  rhs: 
                    {
                      (CommandSubPart
                        command_list: 
                          (CommandList
                            children: [(C {(cat)} {(${ VSub_Name file) (.pem)})]
                          )
                        left_token: <Left_CommandSub "$(">
                        spids: [461 468]
                      )
                    }
                  spids: [460]
                )
              ]
              spids: [460]
            )
            (SimpleCommand
              words: [{(echo)} {(DQ )}]
              redirects: [
                (Redir
                  op_id: Redir_DGreat
                  fd: -1
                  arg_word: {($ VSub_Name "$outfile")}
                  spids: [476]
                )
              ]
            )
            (SimpleCommand
              words: [
                {(echo)}
                {
                  (DQ ("var ") ($ VSub_Name "$file") (" = []byte(") 
                    (EscapedLiteralPart token:<Lit_EscapedChar "\\`">) ($ VSub_Name "$data") (EscapedLiteralPart token:<Lit_EscapedChar "\\`">) (")")
                  )
                }
              ]
              redirects: [
                (Redir
                  op_id: Redir_DGreat
                  fd: -1
                  arg_word: {($ VSub_Name "$outfile")}
                  spids: [493]
                )
              ]
            )
          ]
          spids: [457 497]
        )
      spids: [439 455]
    )
    (C {(rm)} {(Lit_Other "*") (.pem)})
    (C {(rm)} {(Lit_Other "*") (.csr)})
    (C {(rm)} {(Lit_Other "*") (.srl)})
    (C {(rm)} {(Lit_Other "*") (.conf)})
  ]
)