@invarn/cibuild 2.9.5 → 2.9.7

package/dist/src/yaml/a-cache-path-must-not-swallow-a-credential.test.js

@@ -1,223 +0,0 @@
-/**
- * A `cache_paths` entry must not contain the file a `file@` step writes.
- *
- * Everything else about a credential's life inside a build is bounded, and was
- * checked on the three boxes after the first build that ever wrote one: the
- * runner pushes the checkout and the guest root onto `cleanupPaths` and
- * removes them in a `finally`, the guest gets `rm -rf`, and `tart delete`
- * reclaims the VM. Nothing was left anywhere.
- *
- * The cache store is the one place a file can survive all of that.
- * `cache-push` archives whatever `cache_paths` names and uploads it to where
- * the *next* build pulls it from, so a credential swept into that archive
- * outlives the build it was delivered to — and outlives the sandbox that was
- * supposed to contain it.
- *
- * No pipeline in play trips this. Every one of them caches
- * `~/.gradle/caches`, `~/.gradle/wrapper` and `.gradle`, and none of those
- * holds a credential. It is a guard on a mistake that is easy to make and
- * invisible once made: adding `.` to `cache_paths` is a plausible way to make
- * a build faster, and it would publish the signing key.
- *
- * Refused at generation time, like issue 03's missing credential, because that
- * is the only place that can see a whole workflow at once — a cache step can
- * be written before the `file@` step whose target it would swallow — and
- * because the alternative is a build that goes green while leaking.
- */
-import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { cacheEntryContains, credentialsSwallowedByCache, swallowedCredentialMessage, convertYAMLToPipelineDef, YAMLConversionError, } from './converter.js';
-import { clearRegistry, registerStep } from './steps/registry.js';
-import { FileStepExecutor } from './steps/file.js';
-import { CachePullStepExecutor, CachePushStepExecutor } from './steps/cache.js';
-const KEYSTORE = {
-    targetPath: 'app/customer-android.jks',
-    varName: 'KEYSTORE_BASE64',
-};
-const PROPERTIES = {
-    targetPath: 'local.properties',
-    varName: 'LOCAL_PROPERTIES',
-};
-function cache(...cachePaths) {
-    return [{ stepName: 'cache-push', cachePaths }];
-}
-describe('which cache entries reach a credential', () => {
-    test('the checkout root reaches everything in it', () => {
-        for (const root of ['.', './', './/']) {
-            expect(cacheEntryContains(root, 'app/customer-android.jks')).toBe(true);
-            expect(cacheEntryContains(root, 'local.properties')).toBe(true);
-        }
-    });
-    test('a directory reaches what is under it, and nothing beside it', () => {
-        expect(cacheEntryContains('app', 'app/customer-android.jks')).toBe(true);
-        expect(cacheEntryContains('app/', 'app/customer-android.jks')).toBe(true);
-        expect(cacheEntryContains('./app', 'app/customer-android.jks')).toBe(true);
-        // `application/` is a different directory that merely shares a prefix.
-        expect(cacheEntryContains('app', 'application/customer-android.jks')).toBe(false);
-        expect(cacheEntryContains('.gradle', 'local.properties')).toBe(false);
-    });
-    test('an entry that is the credential itself reaches it', () => {
-        expect(cacheEntryContains('local.properties', 'local.properties')).toBe(true);
-    });
-    test('an absolute or home-rooted entry reaches nothing in the checkout', () => {
-        // `cache.ts` classifies these as absolute and stores them from the
-        // filesystem root, so they are somewhere the checkout is not — which is
-        // why every real pipeline's Gradle caches are safe.
-        for (const outside of ['~/.gradle/caches', '~/.gradle/wrapper', '/var/tmp/x']) {
-            expect(cacheEntryContains(outside, 'app/customer-android.jks')).toBe(false);
-            expect(cacheEntryContains(outside, 'local.properties')).toBe(false);
-        }
-    });
-});
-describe('the credentials a workflow would archive', () => {
-    test('are none for the paths every real pipeline caches', () => {
-        expect(credentialsSwallowedByCache([KEYSTORE, PROPERTIES], cache('~/.gradle/caches', '~/.gradle/wrapper', '.gradle'))).toEqual([]);
-    });
-    test('are every one of them when the entry is the checkout root', () => {
-        const found = credentialsSwallowedByCache([KEYSTORE, PROPERTIES], cache('.'));
-        expect(found.map((f) => f.varName)).toEqual(['KEYSTORE_BASE64', 'LOCAL_PROPERTIES']);
-        expect(found[0]).toEqual({
-            stepName: 'cache-push',
-            cachePath: '.',
-            targetPath: 'app/customer-android.jks',
-            varName: 'KEYSTORE_BASE64',
-        });
-    });
-    test('are only the ones the entry actually reaches', () => {
-        const found = credentialsSwallowedByCache([KEYSTORE, PROPERTIES], cache('app'));
-        expect(found.map((f) => f.varName)).toEqual(['KEYSTORE_BASE64']);
-    });
-    test('are found on a pull step as readily as a push step', () => {
-        // `cache-pull` names the same paths, and a pipeline that pulls a directory
-        // it also pushes is the normal shape — so naming the step that declared it
-        // is what makes the message actionable.
-        const found = credentialsSwallowedByCache([PROPERTIES], [
-            { stepName: 'cache-pull', cachePaths: ['.'] },
-        ]);
-        expect(found[0].stepName).toBe('cache-pull');
-    });
-    test('are none when the workflow writes no credential at all', () => {
-        expect(credentialsSwallowedByCache([], cache('.'))).toEqual([]);
-    });
-});
-describe('what the refusal tells the author', () => {
-    test('names the workflow, the entry, the file and the secret', () => {
-        const [swallowed] = credentialsSwallowedByCache([KEYSTORE], cache('.'));
-        const message = swallowedCredentialMessage('primary', swallowed);
-        expect(message).toContain('primary');
-        expect(message).toContain('cache-push');
-        expect(message).toContain('cache_paths');
-        expect(message).toContain('app/customer-android.jks');
-        expect(message).toContain('KEYSTORE_BASE64');
-        // And why it matters, not only that it is refused.
-        expect(message).toContain('outlives the build');
-    });
-});
-// ─── Through the real converter ───────────────────────────────────────────
-const mockConfig = {
-    artifactsDir: '/test/artifacts',
-    maxConcurrentJobs: 1,
-    paths: {
-        buildsDir: '/test/builds',
-        cacheDir: '/test/cache',
-        derivedDataDir: '/test/derived-data',
-    },
-    interpreters: {
-        bash: '/bin/bash',
-        python: 'python3',
-        ruby: 'ruby',
-        node: 'node',
-    },
-};
-let workdir;
-let previousCwd;
-beforeEach(() => {
-    clearRegistry();
-    registerStep('file', new FileStepExecutor());
-    registerStep('cache-pull', new CachePullStepExecutor());
-    registerStep('cache-push', new CachePushStepExecutor());
-    previousCwd = process.cwd();
-    workdir = mkdtempSync(join(tmpdir(), 'cibuild-cache-credential-'));
-    process.chdir(workdir);
-    workdir = process.cwd();
-    process.env.LOCAL_PROPERTIES = 'sdk.dir=/opt/android-sdk\n';
-});
-afterEach(() => {
-    process.chdir(previousCwd);
-    rmSync(workdir, { recursive: true, force: true });
-    clearRegistry();
-    delete process.env.LOCAL_PROPERTIES;
-});
-/** A workflow that writes a credential and then caches `cachePaths`. */
-function pipelineCaching(cachePaths) {
-    return {
-        format_version: '1',
-        app: { envs: [{ LOCAL_PROPERTIES: '' }] },
-        workflows: {
-            primary: {
-                steps: [
-                    {
-                        'file@1.0.0': {
-                            title: 'Setup local.properties',
-                            is_skippable: true,
-                            inputs: { target_path: 'local.properties', var_name: 'LOCAL_PROPERTIES' },
-                        },
-                    },
-                    {
-                        'cache-push@1.0.0': {
-                            inputs: { cache_key: 'gradle-app', cache_paths: cachePaths },
-                        },
-                    },
-                ],
-            },
-        },
-    };
-}
-describe('converting a workflow whose cache would archive a credential', () => {
-    test('refuses, rather than building green and publishing the file', async () => {
-        await expect(convertYAMLToPipelineDef(pipelineCaching(['.']), mockConfig, 'primary')).rejects.toBeInstanceOf(YAMLConversionError);
-        await expect(convertYAMLToPipelineDef(pipelineCaching(['.']), mockConfig, 'primary')).rejects.toThrow(/local\.properties/);
-    });
-    test('refuses when the cache step is written before the file step', async () => {
-        // Order cannot be the test: an author is free to pull a cache first, and
-        // the cache still ends up holding whatever the later step wrote.
-        const reordered = {
-            format_version: '1',
-            app: { envs: [{ LOCAL_PROPERTIES: '' }] },
-            workflows: {
-                primary: {
-                    steps: [
-                        { 'cache-pull@1.0.0': { inputs: { cache_key: 'k', cache_paths: ['.'] } } },
-                        {
-                            'file@1.0.0': {
-                                is_skippable: true,
-                                inputs: { target_path: 'local.properties', var_name: 'LOCAL_PROPERTIES' },
-                            },
-                        },
-                    ],
-                },
-            },
-        };
-        await expect(convertYAMLToPipelineDef(reordered, mockConfig, 'primary')).rejects.toThrow(/LOCAL_PROPERTIES/);
-    });
-    test('converts the paths every real pipeline caches, untouched', async () => {
-        const result = await convertYAMLToPipelineDef(pipelineCaching(['~/.gradle/caches', '~/.gradle/wrapper', '.gradle']), mockConfig, 'primary');
-        expect(result.pipeline.steps).toHaveLength(2);
-        expect(result.warnings).toEqual([]);
-    });
-    test('leaves a workflow with no credential alone, whatever it caches', async () => {
-        const noCredential = {
-            format_version: '1',
-            workflows: {
-                primary: {
-                    steps: [{ 'cache-push@1.0.0': { inputs: { cache_key: 'k', cache_paths: ['.'] } } }],
-                },
-            },
-        };
-        const result = await convertYAMLToPipelineDef(noCredential, mockConfig, 'primary');
-        expect(result.pipeline.steps).toHaveLength(1);
-    });
-});
-//# sourceMappingURL=a-cache-path-must-not-swallow-a-credential.test.js.map

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.d.ts

@@ -1,20 +0,0 @@
-/**
- * A credential the pipeline declares and the dispatch delivers reaches the
- * step that writes it.
- *
- * `file@1.0.0` decides at generation time, from the env map `EnvResolver`
- * hands it: a value means a write script, no value means
- * `echo "⚠️  X not set — skipping <file>"` and a green step. That map had
- * four sources — built-ins, `.cibuild-secrets.json`, `app.envs`,
- * `workflow.envs` — and a dispatched build supplies none of them. The runner
- * merges the dispatch's secrets into the environment of the `ci` invocation
- * and writes no secrets file, so every credential declared as an empty slot
- * was dropped, on every dispatched build, and the step reported success.
- *
- * The two runs that make it unambiguous are here as the first two tests: the
- * same pipeline, the same step, the same value, delivered once through the
- * process environment and once through the local store. Before the fifth
- * resolution step the first wrote nothing and the second wrote the file.
- */
-export {};
-//# sourceMappingURL=a-declared-secret-reaches-the-file-step.test.d.ts.map

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"a-declared-secret-reaches-the-file-step.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-declared-secret-reaches-the-file-step.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.js

@@ -1,201 +0,0 @@
-/**
- * A credential the pipeline declares and the dispatch delivers reaches the
- * step that writes it.
- *
- * `file@1.0.0` decides at generation time, from the env map `EnvResolver`
- * hands it: a value means a write script, no value means
- * `echo "⚠️  X not set — skipping <file>"` and a green step. That map had
- * four sources — built-ins, `.cibuild-secrets.json`, `app.envs`,
- * `workflow.envs` — and a dispatched build supplies none of them. The runner
- * merges the dispatch's secrets into the environment of the `ci` invocation
- * and writes no secrets file, so every credential declared as an empty slot
- * was dropped, on every dispatched build, and the step reported success.
- *
- * The two runs that make it unambiguous are here as the first two tests: the
- * same pipeline, the same step, the same value, delivered once through the
- * process environment and once through the local store. Before the fifth
- * resolution step the first wrote nothing and the second wrote the file.
- */
-import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { convertYAMLToPipelineDef } from './converter.js';
-import { EnvResolver } from './env-resolver.js';
-import { clearRegistry, registerStep } from './steps/registry.js';
-import { FileStepExecutor } from './steps/file.js';
-const mockConfig = {
-    artifactsDir: '/test/artifacts',
-    maxConcurrentJobs: 1,
-    paths: {
-        buildsDir: '/test/builds',
-        cacheDir: '/test/cache',
-        derivedDataDir: '/test/derived-data',
-    },
-    interpreters: {
-        bash: '/bin/bash',
-        python: 'python3',
-        ruby: 'ruby',
-        node: 'node',
-    },
-};
-/** The 61-byte document from the PRD's reproduction. Synthetic. */
-const JSON_CREDENTIAL = '{"project_info":{"project_id":"synthetic-probe"},"client":[]}';
-const TARGET = 'app/google-services.json';
-let workdir;
-let previousCwd;
-beforeEach(() => {
-    clearRegistry();
-    registerStep('file', new FileStepExecutor());
-    previousCwd = process.cwd();
-    workdir = mkdtempSync(join(tmpdir(), 'cibuild-declared-secret-'));
-    process.chdir(workdir);
-    // `workdir` is the pre-symlink path on macOS; the steps resolve paths from
-    // CIBUILD_SOURCE_DIR, which is cwd, so read files back the same way.
-    workdir = process.cwd();
-    delete process.env.PLAIN_SECRET;
-    delete process.env.B64_SECRET;
-});
-afterEach(() => {
-    process.chdir(previousCwd);
-    rmSync(workdir, { recursive: true, force: true });
-    clearRegistry();
-    delete process.env.PLAIN_SECRET;
-    delete process.env.B64_SECRET;
-});
-/**
- * The shape the Android generator emits: an empty slot under `app.envs` and a
- * skippable `file@1.0.0` step naming it.
- */
-function probePipeline(declared, fileInputs) {
-    const app = declared
-        ? { app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) } }
-        : {};
-    return {
-        format_version: '1',
-        ...app,
-        workflows: {
-            probe: {
-                steps: [
-                    {
-                        'file@1.0.0': {
-                            title: 'Setup credential',
-                            is_skippable: true,
-                            inputs: fileInputs,
-                        },
-                    },
-                ],
-            },
-        },
-    };
-}
-function writeSecretStore(global) {
-    writeFileSync(join(workdir, '.cibuild-secrets.json'), JSON.stringify({ global, workflows: {} }), { mode: 0o600 });
-}
-/**
- * Converts the pipeline and runs the generated steps the way the runner does,
- * then reads back whatever landed at `target`.
- */
-async function land(pipeline, target = TARGET) {
-    const result = await convertYAMLToPipelineDef(pipeline, mockConfig, 'probe');
-    const chunks = [...result.warnings];
-    for (const step of result.pipeline.steps) {
-        const scriptPath = join(workdir, `__step_${step.id}.sh`);
-        writeFileSync(scriptPath, step.script, 'utf-8');
-        const proc = spawnSync('bash', [scriptPath], {
-            cwd: workdir,
-            encoding: 'utf-8',
-            env: { ...process.env },
-        });
-        // A step that cannot even run would make every other assertion here
-        // vacuous, so fail on it directly rather than through the file contents.
-        expect(proc.status).toBe(0);
-        chunks.push(proc.stdout ?? '', proc.stderr ?? '');
-    }
-    const landedAt = join(workdir, target);
-    return {
-        output: chunks.join('\n'),
-        bytes: existsSync(landedAt) ? readFileSync(landedAt) : undefined,
-    };
-}
-describe('a declared credential delivered through the process environment', () => {
-    test('reaches the file step and lands byte-exact — the dispatch path', async () => {
-        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
-        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
-        expect(output).toContain('✓ Written google-services.json');
-        expect(output).not.toContain('not set');
-        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
-        expect(bytes).toHaveLength(61);
-    });
-    test('still lands when the value comes from the local store instead', async () => {
-        writeSecretStore({ PLAIN_SECRET: JSON_CREDENTIAL });
-        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
-        expect(output).toContain('✓ Written google-services.json');
-        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
-    });
-    test('the local store wins when both carry the key', async () => {
-        writeSecretStore({ PLAIN_SECRET: 'from-the-local-store' });
-        process.env.PLAIN_SECRET = 'from-the-inherited-environment';
-        const { bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
-        expect(bytes?.toString('utf-8')).toBe('from-the-local-store');
-    });
-    test('a value the YAML itself supplies is not replaced by the environment', async () => {
-        process.env.PLAIN_SECRET = 'from-the-inherited-environment';
-        const { bytes } = await land(probePipeline({ PLAIN_SECRET: 'from-the-pipeline' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
-        expect(bytes?.toString('utf-8')).toBe('from-the-pipeline');
-    });
-    test('arrives verbatim — a $ in a credential is not a variable reference', async () => {
-        // A PEM passphrase, a Play service-account key, any credential at all may
-        // hold a `$`. Interpolating one would either paste a pipeline value into
-        // the middle of a secret or refuse the build over a name nothing declares.
-        const withDollars = 'prefix $NOT_A_DECLARED_VARIABLE ${ALSO_NOT_ONE} suffix';
-        process.env.PLAIN_SECRET = withDollars;
-        const { bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
-        expect(bytes?.toString('utf-8')).toBe(withDollars);
-    });
-    test('base64_encoded round-trips bytes a text channel cannot carry', async () => {
-        // NUL and a newline together: the two bytes a keystore has and an
-        // environment variable cannot hold, which is why the slot carries base64.
-        const payload = Buffer.from([
-            0x50, 0x4b, 0x03, 0x04, 0x00, 0x0a, 0x00, 0xff, 0x00, 0x0d, 0x0a, 0x7f,
-        ]);
-        process.env.B64_SECRET = payload.toString('base64');
-        const { output, bytes } = await land(probePipeline({ B64_SECRET: '' }, { target_path: 'release.keystore', var_name: 'B64_SECRET', base64_encoded: true }), 'release.keystore');
-        expect(output).toContain('✓ Written release.keystore');
-        expect(bytes?.equals(payload)).toBe(true);
-    });
-    test('the value never appears in what ci prints', async () => {
-        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
-        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
-        // Asserted on the captured output, not read off a transcript.
-        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
-        expect(output).not.toContain(JSON_CREDENTIAL);
-        expect(output).not.toContain('synthetic-probe');
-    });
-});
-describe('the host environment is not a source of pipeline variables', () => {
-    test('an undeclared key is not imported, even where a step reads it', async () => {
-        // HOME exists in every environment this runs in. If step 5 copied
-        // `process.env` in bulk this step would write the user's home directory
-        // to a file instead of skipping.
-        expect(process.env.HOME).toBeTruthy();
-        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
-        // PLAIN_SECRET is declared, so the import runs; HOME is not.
-        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: 'home.txt', var_name: 'HOME' }), 'home.txt');
-        expect(output).toContain('HOME not set — skipping home.txt');
-        expect(bytes).toBeUndefined();
-    });
-    test('the resolver does not hold an undeclared host variable', () => {
-        const pipeline = probePipeline({ PLAIN_SECRET: '' }, {
-            target_path: TARGET,
-            var_name: 'PLAIN_SECRET',
-        });
-        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
-        const resolver = new EnvResolver(pipeline, pipeline.workflows.probe, 'probe', 'linux');
-        expect(resolver.get('PLAIN_SECRET')).toBe(JSON_CREDENTIAL);
-        expect(resolver.has('HOME')).toBe(false);
-        expect(resolver.getAll()).not.toHaveProperty('HOME');
-    });
-});
-//# sourceMappingURL=a-declared-secret-reaches-the-file-step.test.js.map

package/dist/src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts

@@ -1,37 +0,0 @@
-/**
- * A pipeline may declare a credential slot under the name a *workflow-scoped*
- * secret carries, and the workflow it names reads it under the plain name.
- *
- * Two workflows that build different product flavors cannot share one value.
- * `local.properties` is the clearest case: every workflow writes the same file
- * to the same path, and what belongs in it is the flavor's environment — a
- * different base API URL and twenty other keys the Secrets Gradle Plugin turns
- * into `BuildConfig`. One slot, one value, and one of the two flavors builds
- * against the wrong environment.
- *
- * The value side of that has always worked. `ci secrets upload` encodes a
- * workflow-scoped secret as `CIBUILD_SW__<WORKFLOW>__<VAR>`, `SecretsManager`
- * decodes it back, and `EnvResolver` asks for the workflow being run — proved
- * end to end on the dispatch path, where a fresh clone has no
- * `.cibuild-secrets.json` and the value arrives as a bare environment
- * variable. What did not work is *declaring* it. A pipeline declares its
- * credentials as empty `envs` slots, and that declaration does two jobs
- * nothing else does:
- *
- *   - `unsetEnvKeys` — what `invarn setup` searches the developer's machine
- *     by — reads `envs`, never step inputs. An undeclared credential is never
- *     discovered and never offered for upload.
- *   - `file@1.0.0` tells "nobody supplied this" from "this workflow does not
- *     need it" by whether the key is in the env map at all, and only a
- *     declaration puts an unsupplied key there. Without one, a credential that
- *     went missing is skipped with a warning and the build fails later inside
- *     the project's own build tool (issue 03).
- *
- * So a per-workflow slot has to be declarable, and a declaration naming one
- * workflow has to mean nothing in the others — otherwise `release` would
- * demand `primary`'s value. The decoding belongs here, beside the decoding of
- * the secret itself, and not in `file@`: the step keeps reading its plain
- * `var_name` and never learns the convention exists.
- */
-export {};
-//# sourceMappingURL=a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts.map

package/dist/src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG"}