anchor.diff:  
       chown vcap:vcap $CF_CA_CERT
       chmod 0400 $CF_CA_CERT
  +
  +    chown vcap:vcap $POSTGRESQL_CA_CERT
  +    chmod 0400 $POSTGRESQL_CA_CERT
  +
  +    chown vcap:vcap $POSTGRESQL_CLIENT_CERT
  +    chmod 0400 $POSTGRESQL_CLIENT_CERT
  +
  +    chown vcap:vcap $POSTGRESQL_CLIENT_KEY
  +    chmod 0400 $POSTGRESQL_CLIENT_KEY
   
       setcap cap_net_bind_service=+ep /var/vcap/packages/atc/bin/atc
   
  
positive.code: SIGNING_KEY=/var/vcap/packages/generated_signing_key/id_rsa
  PIDFILE=$RUN_DIR/atc.pid
  CF_CA_CERT=/var/vcap/jobs/atc/config/cf_ca_cert
  
  source /var/vcap/packages/pid_utils/pid_utils.sh
  
  
negative.code:       --postgres-user <%= esc(postgres_role_name) %> \
        --postgres-password <%= esc(postgres_role_password) %> \
        <% if_p("postgresql.ca_cert") do |_| %> \
        --postgres-ca-cert $POSTGRESQL_CA_CERT \
        <% end %> \
        <% if_p("postgresql.client_cert", "postgresql.client_key") do |*_| %> \
        --postgres-client-cert $POSTGRESQL_CLIENT_CERT \
        --postgres-client-key $POSTGRESQL_CLIENT_KEY \
        <% end %> \
        --postgres-connect-timeout <%= p("postgresql.connect_timeout") %> \
        <% if_p("encryption_key") do |key| %> \
  