@synopackageland/cli 0.8.0 → 0.9.0

package/templates/_executor/process.go

@@ -1,142 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"errors"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"time"
-)
-
-const maxOutput = 1 << 20
-
-type cappedBuffer struct {
-	buf bytes.Buffer
-	n   int
-}
-
-func (b *cappedBuffer) Write(p []byte) (int, error) {
-	if len(p) > maxOutput-b.n {
-		return 0, errors.New("output limit")
-	}
-	n, err := b.buf.Write(p)
-	b.n += n
-	return n, err
-}
-
-type processCommand struct{}
-
-func command(ctx context.Context, path string, args []string) *exec.Cmd {
-	cmd := exec.CommandContext(ctx, path, args...)
-	cmd.Env = []string{"PATH=/usr/syno/bin:/usr/syno/sbin:/usr/bin:/bin", "LANG=C", "HOME=/"}
-	cmd.Dir = "/"
-	cmd.WaitDelay = time.Second
-	configureProcess(cmd)
-	return cmd
-}
-func (processCommand) Exec(ctx context.Context, path string, args []string) ([]byte, error) {
-	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
-	defer cancel()
-	cmd := command(ctx, path, args)
-	var out cappedBuffer
-	cmd.Stdout = &out
-	cmd.Stderr = io.Discard
-	if err := cmd.Run(); err != nil {
-		if ctx.Err() != nil {
-			return nil, ctx.Err()
-		}
-		return nil, err
-	}
-	return out.buf.Bytes(), nil
-}
-
-type scriptRunner struct{ Dir string }
-
-func (r scriptRunner) Run(ctx context.Context, name, digest string) (string, error) {
-	if !tokenRE.MatchString(name) || !idRE.MatchString(digest) {
-		return "", errors.New("script")
-	}
-	path := filepath.Join(r.Dir, "root", name+".sh")
-	// Open once, hash and execute that same inode via an inherited descriptor.
-	f, err := openRegular(path)
-	if err != nil {
-		return "", err
-	}
-	defer f.Close()
-	info, err := f.Stat()
-	if err != nil || info.Mode().Perm()&0022 != 0 || !ownedByRoot(info) {
-		return "", errors.New("script ownership")
-	}
-	h := sha256.New()
-	if _, err = io.Copy(h, f); err != nil {
-		return "", err
-	}
-	if hex.EncodeToString(h.Sum(nil)) != digest {
-		return "", errors.New("digest")
-	}
-	if _, err = f.Seek(0, 0); err != nil {
-		return "", err
-	}
-	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
-	defer cancel()
-	cmd := command(ctx, "/bin/sh", []string{"/proc/self/fd/3"})
-	cmd.ExtraFiles = []*os.File{f}
-	var out cappedBuffer
-	cmd.Stdout = &out
-	cmd.Stderr = &out
-	if err = cmd.Run(); err != nil {
-		return "", err
-	}
-	return out.buf.String(), nil
-}
-
-const maxExecutorBytes int64 = 128 << 20
-const maxPolicyBytes int64 = 1 << 20
-
-func digestFile(ctx context.Context, path string, limit int64) (string, error) {
-	info, err := os.Lstat(path)
-	if err != nil {
-		return "", err
-	}
-	if !info.Mode().IsRegular() || info.Size() > limit {
-		return "", errors.New("digest file limit")
-	}
-	f, err := openRegular(path)
-	if err != nil {
-		return "", err
-	}
-	defer f.Close()
-	info, err = f.Stat()
-	if err != nil || !info.Mode().IsRegular() || info.Size() > limit {
-		return "", errors.New("digest file limit")
-	}
-	h := sha256.New()
-	buf := make([]byte, 64<<10)
-	var total int64
-	for {
-		if err := ctx.Err(); err != nil {
-			return "", err
-		}
-		n, err := f.Read(buf)
-		total += int64(n)
-		if total > limit {
-			return "", errors.New("digest file limit")
-		}
-		h.Write(buf[:n])
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return "", err
-		}
-	}
-	if err := ctx.Err(); err != nil {
-		return "", err
-	}
-	return hex.EncodeToString(h.Sum(nil)), nil
-}

package/templates/_executor/purge_log.go

@@ -1,18 +0,0 @@
-package main
-
-import (
-	"log"
-	"log/syslog"
-)
-
-// Purge removes executor.log with the protected state, so its diagnostics
-// also go to the system log, where they survive the uninstall.
-func purgeLogger() func(string) {
-	system, err := syslog.New(syslog.LOG_NOTICE|syslog.LOG_DAEMON, "synopkgland-executor")
-	return func(s string) {
-		log.Print(s)
-		if err == nil {
-			_ = system.Notice(s)
-		}
-	}
-}

package/templates/_executor/records.go

@@ -1,242 +0,0 @@
-package main
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-)
-
-const maxJournalBytes int64 = 10 << 20
-const maxAuditBytes int64 = 50 << 20
-const maxMoveBytes int64 = 16 << 30
-const maxQueued = 16
-
-type directoryIdentity struct {
-	Device uint64 `json:"dev"`
-	Inode  uint64 `json:"ino"`
-}
-type Operation struct {
-	Version       int           `json:"v"`
-	Package       string        `json:"package"`
-	ID            string        `json:"delegation_id"`
-	Job           string        `json:"job_id"`
-	Subject       Subject       `json:"subject"`
-	Staging       string        `json:"staging"`
-	Name          string        `json:"name"`
-	Size          int64         `json:"size"`
-	State         string        `json:"state"`
-	Path          string        `json:"path,omitempty"`
-	Code          string        `json:"code,omitempty"`
-	Reason        string        `json:"reason,omitempty"`
-	Part          *partMetadata `json:"part,omitempty"`
-	PublishIntent bool          `json:"publish_intent,omitempty"`
-	// CancelRequested durably keeps an acknowledged cancel of a copy in flight.
-	CancelRequested string    `json:"cancel_requested,omitempty"`
-	Updated         time.Time `json:"updated_at"`
-}
-
-// canceledBeforeAdmission marks the tombstone of a cancel that found no
-// operation; admitted operations always carry their staging name.
-func (op Operation) canceledBeforeAdmission() bool {
-	return op.State == "canceled" && op.Staging == ""
-}
-
-type MoveReceipt struct {
-	Path           string `json:"path,omitempty"`
-	CleanupPending bool   `json:"cleanup_pending,omitempty"`
-}
-type AuditEvent struct {
-	At        time.Time `json:"at"`
-	Package   string    `json:"package"`
-	Username  string    `json:"username"`
-	UID       int       `json:"uid"`
-	Operation string    `json:"operation"`
-	Job       string    `json:"job_id,omitempty"`
-	Path      string    `json:"path,omitempty"`
-	Result    string    `json:"result"`
-}
-
-func recordKey(job string) string { h := sha256.Sum256([]byte(job)); return hex.EncodeToString(h[:]) }
-func (s *Store) atomic(name string, b []byte) error {
-	f, err := os.CreateTemp(s.Dir, ".record-")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(f.Name())
-	defer f.Close()
-	if err = f.Chmod(0600); err != nil {
-		return err
-	}
-	if _, err = f.Write(b); err != nil {
-		return err
-	}
-	if err = f.Sync(); err != nil {
-		return err
-	}
-	if err = f.Close(); err != nil {
-		return err
-	}
-	if err = os.Rename(f.Name(), filepath.Join(s.Dir, name)); err != nil {
-		return err
-	}
-	dir, err := os.Open(s.Dir)
-	if err != nil {
-		return err
-	}
-	defer dir.Close()
-	return dir.Sync()
-}
-func (s *Store) record(name string, v any) error {
-	info, err := os.Lstat(filepath.Join(s.Dir, name))
-	if err != nil {
-		return err
-	}
-	if !info.Mode().IsRegular() || info.Mode().Perm() != 0600 || info.Size() > maxRequest {
-		return errors.New("record mode")
-	}
-	b, err := os.ReadFile(filepath.Join(s.Dir, name))
-	if err != nil {
-		return err
-	}
-	return strictJSON(b, v)
-}
-func (s *Store) Disabled() (bool, error) {
-	var b struct {
-		Disabled bool `json:"disabled"`
-	}
-	err := s.record("disabled.record", &b)
-	if os.IsNotExist(err) {
-		return false, nil
-	}
-	return b.Disabled, err
-}
-func (s *Store) SetDisabled(disabled bool) error {
-	b, _ := json.Marshal(map[string]bool{"disabled": disabled})
-	return s.atomic("disabled.record", b)
-}
-func (s *Store) PutOperation(op Operation) error {
-	if op.Version != 1 || !tokenRE.MatchString(op.Job) || !idRE.MatchString(op.ID) || !validState(op.State) {
-		return errors.New("operation")
-	}
-	b, err := json.Marshal(op)
-	if err != nil || len(b) > maxRequest {
-		return errors.New("operation size")
-	}
-	entries, err := os.ReadDir(s.Dir)
-	if err != nil {
-		return err
-	}
-	var total int64
-	name := "operation-" + recordKey(op.Job) + ".record"
-	for _, ent := range entries {
-		if strings.HasPrefix(ent.Name(), "operation-") && ent.Name() != name {
-			info, err := ent.Info()
-			if err != nil {
-				return err
-			}
-			total += info.Size()
-		}
-	}
-	if total+int64(len(b)) > maxJournalBytes {
-		return errors.New("journal full")
-	}
-	return s.atomic(name, b)
-}
-func validState(state string) bool {
-	return contains([]string{"queued", "copying", "committed", "canceled", "interrupted", "uncertain"}, state)
-}
-func (s *Store) GetOperation(job string) (Operation, error) {
-	var op Operation
-	if !tokenRE.MatchString(job) {
-		return op, errors.New("job")
-	}
-	err := s.record("operation-"+recordKey(job)+".record", &op)
-	if err != nil {
-		return op, err
-	}
-	if op.Version != 1 || op.Job != job || !idRE.MatchString(op.ID) || !validState(op.State) {
-		return op, errors.New("operation schema")
-	}
-	return op, nil
-}
-func (s *Store) Operations() ([]Operation, error) {
-	entries, err := os.ReadDir(s.Dir)
-	if err != nil {
-		return nil, err
-	}
-	out := []Operation{}
-	for _, ent := range entries {
-		if !strings.HasPrefix(ent.Name(), "operation-") || !strings.HasSuffix(ent.Name(), ".record") {
-			continue
-		}
-		var op Operation
-		if err = s.record(ent.Name(), &op); err != nil {
-			return nil, err
-		}
-		if ent.Name() != "operation-"+recordKey(op.Job)+".record" || op.Version != 1 || !validState(op.State) || !idRE.MatchString(op.ID) {
-			return nil, errors.New("operation schema")
-		}
-		out = append(out, op)
-	}
-	return out, nil
-}
-func (s *Store) Audit(event AuditEvent) error {
-	path := filepath.Join(s.Dir, "audit.jsonl")
-	b, err := json.Marshal(event)
-	if err != nil {
-		return err
-	}
-	b = append(b, '\n')
-	info, err := os.Lstat(path)
-	if err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	if err == nil {
-		if !info.Mode().IsRegular() || info.Mode().Perm() != 0600 {
-			return errors.New("audit mode")
-		}
-		if info.Size()+int64(len(b)) > maxAuditBytes/2 {
-			if err = os.Rename(path, filepath.Join(s.Dir, "audit.previous")); err != nil {
-				return err
-			}
-		}
-	}
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	if _, err = f.Write(b); err != nil {
-		return err
-	}
-	if err = f.Sync(); err != nil {
-		return err
-	}
-	dir, err := os.Open(s.Dir)
-	if err != nil {
-		return err
-	}
-	defer dir.Close()
-	return dir.Sync()
-}
-func (e *Executor) auditLocked(s Subject, operation, job, path, result string) error {
-	return e.Store.Audit(AuditEvent{At: e.Now().UTC(), Package: e.Policy.Package, Username: s.Username, UID: s.UID, Operation: operation, Job: job, Path: path, Result: result})
-}
-
-type partMetadata struct {
-	Temporary   string            `json:"temporary"`
-	Directory   directoryIdentity `json:"directory"`
-	Part        directoryIdentity `json:"part"`
-	Destination string            `json:"destination"`
-}
-type partRecordKey struct{}
-type legacyPublishKey struct{}
-
-type publishRejectedError struct{ Code string }
-
-func (e publishRejectedError) Error() string { return e.Code }

package/templates/_executor/scope_cancel_contract_test.go

@@ -1,91 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"testing"
-)
-
-// killedChildWriter models the subprocess writer: its child dies with the
-// context and the copy ends with a transport error, before any publish guard.
-type killedChildWriter struct{ copying chan struct{} }
-
-func (w killedChildWriter) Write(context.Context, Subject, string, string, string, string) error {
-	return nil
-}
-func (w killedChildWriter) Move(ctx context.Context, _ Subject, _ Operation, _ Delegation, _ func(func() (MoveReceipt, error)) (MoveReceipt, error)) (MoveReceipt, error) {
-	close(w.copying)
-	<-ctx.Done()
-	return MoveReceipt{}, errors.New("child copy")
-}
-
-func TestStopDuringCopySettlesExecutorPausedNotWriteFailed(t *testing.T) {
-	e, _, _ := setup(t)
-	id := longGrant(t, e)
-	w := killedChildWriter{copying: make(chan struct{})}
-	e.Writer = w
-	if err := e.startOperations(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	if r := offline(e, "files.moveFromStaging", moveParams(id, "job")); !r.OK {
-		t.Fatal(r)
-	}
-	<-w.copying
-	e.stopOperations()
-	if err := e.startOperations(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	defer e.stopOperations()
-	// An executor stop is not an I/O failure of the destination.
-	wantOperation(t, offline(e, "files.operationStatus", map[string]any{"delegation_id": id, "job_id": "job"}), "interrupted", "EXECUTOR_PAUSED", "")
-}
-
-func TestScopeChangeCancelsCopyDurablyAcrossStop(t *testing.T) {
-	e, _ := selectedExecutor(t)
-	if r := selectScope(e, "home", 0); !r.OK {
-		t.Fatal(r)
-	}
-	d := selectedGrant(t, e, "/home")
-	w := newStubbornWriter()
-	e.Writer = w
-	startedCopy(t, e, w, d.ID, "job")
-	if r := selectScope(e, "shared:reports", 0); !r.OK {
-		t.Fatal(r)
-	}
-	ref := map[string]any{"delegation_id": d.ID, "job_id": "job"}
-	wantOperation(t, offline(e, "files.operationStatus", ref), "copying", "CANCEL_REQUESTED", "scope-changed")
-	stopped := make(chan struct{})
-	go func() { e.stopOperations(); close(stopped) }()
-	w.let()
-	<-stopped
-	if err := e.startOperations(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	defer e.stopOperations()
-	wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "scope-changed")
-	select {
-	case <-w.published:
-		t.Fatal("published to a revoked destination")
-	default:
-	}
-}
-
-func TestScopeChangeCancelRecordedBeforeCrashSettlesCanceled(t *testing.T) {
-	e, _ := selectedExecutor(t)
-	if r := selectScope(e, "home", 0); !r.OK {
-		t.Fatal(r)
-	}
-	d := selectedGrant(t, e, "/home")
-	w := newStubbornWriter()
-	e.Writer = w
-	startedCopy(t, e, w, d.ID, "job")
-	if r := selectScope(e, "shared:reports", 0); !r.OK {
-		t.Fatal(r)
-	}
-	e.commitMu.Lock()
-	op, err := e.Store.GetOperation("job")
-	e.commitMu.Unlock()
-	if err != nil || op.CancelRequested != "scope-changed" {
-		t.Fatal("scope cancellation not durable before the writer stops", op, err)
-	}
-}

package/templates/_executor/scope_client.go

@@ -1,37 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"encoding/json"
-	"errors"
-	"net"
-	"path/filepath"
-	"time"
-)
-
-// This command runs from the protected, pinned binary via the DSM root task.
-// It asks the live executor to serialize selection with admission and publish;
-// a second process must never write the authority file around that fence.
-func rootSelectScope(pkg, scope, actor string, expectedGeneration uint64) error {
-	c, err := net.DialTimeout("unix", filepath.Join(socketBase, pkg, "executor.sock"), 5*time.Second)
-	if err != nil {
-		return errors.New("scope executor unavailable")
-	}
-	defer c.Close()
-	if err = c.SetDeadline(time.Now().Add(30 * time.Second)); err != nil {
-		return err
-	}
-	if err = json.NewEncoder(c).Encode(map[string]any{"v": 1, "op": "delegate.setScope", "auth": map[string]string{}, "params": map[string]any{"scope": scope, "actor": actor, "expected_generation": expectedGeneration}}); err != nil {
-		return err
-	}
-	scan := bufio.NewScanner(c)
-	scan.Buffer(make([]byte, 4096), maxRequest)
-	if !scan.Scan() {
-		return errors.New("scope response unavailable")
-	}
-	var out Response
-	if strictJSON(scan.Bytes(), &out) != nil || !out.OK {
-		return errors.New("scope selection refused")
-	}
-	return nil
-}

package/templates/_executor/scope_contract.go

@@ -1,12 +0,0 @@
-package main
-
-// The immutable policy opts into administrator-selected scope. Only the
-// password-confirmed root task may populate the protected runtime selection.
-const installSelectedScope = "install-selected"
-const maxScopeGeneration = uint64(1<<53 - 1)
-
-type SelectedScope struct {
-	Schema     int    `json:"schema"`
-	Scope      string `json:"scope"`
-	Generation uint64 `json:"generation"`
-}

package/templates/_executor/selected_scope.go

@@ -1,146 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"strings"
-)
-
-func validSelectedScope(scope string) bool {
-	if scope == "home" {
-		return true
-	}
-	if !strings.HasPrefix(scope, "shared:") {
-		return false
-	}
-	name := strings.TrimPrefix(scope, "shared:")
-	return validName(name) && name != "." && strings.TrimSpace(name) == name && !strings.ContainsAny(name, "\\:%") && !strings.EqualFold(name, "home") && !strings.EqualFold(name, "homes")
-}
-func (s *Store) SelectedScope() (SelectedScope, error) {
-	var out SelectedScope
-	if err := s.record("selected-scope.record", &out); err != nil {
-		return out, err
-	}
-	if out.Schema != 1 || !validSelectedScope(out.Scope) || out.Generation == 0 || out.Generation > maxScopeGeneration {
-		return SelectedScope{}, errors.New("selected scope state")
-	}
-	return out, nil
-}
-
-// Caller holds commitMu; root selection and publish share the same fence.
-func (e *Executor) selectionLocked() (SelectedScope, string) {
-	if e.Policy.Scope != installSelectedScope {
-		return SelectedScope{Schema: 1, Scope: e.Policy.Scope}, ""
-	}
-	state, err := e.Store.SelectedScope()
-	if os.IsNotExist(err) {
-		return SelectedScope{}, "needs-scope-confirmation"
-	}
-	if err != nil {
-		return SelectedScope{}, "STORAGE_ERROR"
-	}
-	return state, ""
-}
-func (e *Executor) selection() (SelectedScope, string) {
-	e.commitMu.Lock()
-	defer e.commitMu.Unlock()
-	return e.selectionLocked()
-}
-func (e *Executor) scopeMatchesLocked(d Delegation) bool {
-	state, code := e.selectionLocked()
-	return code == "" && state.Scope == d.Scope && state.Generation == d.ScopeGeneration
-}
-func (e *Executor) scopeMatches(d Delegation) bool {
-	e.commitMu.Lock()
-	defer e.commitMu.Unlock()
-	return e.scopeMatchesLocked(d)
-}
-
-// Only a kernel-verified root peer can reach this operation. It is absent from
-// the public wire allowlist, even when a package supplies an administrator SID.
-func (e *Executor) handlePeer(ctx context.Context, r Request, peerUID, packageUID int) Response {
-	if peerUID == 0 && r.Op == "delegate.setScope" {
-		if r.Version != 1 || r.Auth.hasKeys || r.Auth.Cookie != "" || r.Auth.SynoToken != "" {
-			return deny("INVALID_REQUEST")
-		}
-		return e.setSelectedScope(ctx, r.Params)
-	}
-	if peerUID != packageUID {
-		return deny("PEER_DENIED")
-	}
-	return e.Handle(ctx, r)
-}
-func (e *Executor) setSelectedScope(ctx context.Context, raw json.RawMessage) Response {
-	if ctx.Err() != nil {
-		return deny("EXECUTOR_PAUSED")
-	}
-	if e.Policy.Scope != installSelectedScope || e.Policy.Lifetime != "until-revoked" {
-		return deny("POLICY_DENIED")
-	}
-	var in struct {
-		Scope              string  `json:"scope"`
-		Actor              string  `json:"actor"`
-		ExpectedGeneration *uint64 `json:"expected_generation"`
-	}
-	if strictJSON(raw, &in) != nil || !validSelectedScope(in.Scope) || in.Actor == "" || in.ExpectedGeneration == nil || *in.ExpectedGeneration > maxScopeGeneration {
-		return deny("INVALID_REQUEST")
-	}
-	actor, err := e.DSM.Account(ctx, in.Actor)
-	if err != nil || actor.Username != in.Actor || !actor.Admin || actor.Expired != "normal" || actor.UID < 1024 {
-		return deny("ADMIN_REQUIRED")
-	}
-	if e.DSM.Allow(ctx, actor, e.Policy.App, e.Policy.Entry) != nil {
-		return deny("APP_DENIED")
-	}
-	// Scope selection grants no data permission. Resolve existence only; each
-	// destination and subsequent write still checks its owner's current ACL/UID.
-	if in.Scope != "home" {
-		if _, err = e.DSM.ScopeRoot(ctx, actor, in.Scope); err != nil {
-			return deny("SCOPE_DENIED")
-		}
-	}
-	e.commitMu.Lock()
-	defer e.commitMu.Unlock()
-	old, err := e.Store.SelectedScope()
-	if err != nil && !os.IsNotExist(err) {
-		return deny("STORAGE_ERROR")
-	}
-	if old.Generation != *in.ExpectedGeneration {
-		return deny("SCOPE_APPROVAL_STALE")
-	}
-	if err == nil && old.Scope == in.Scope {
-		return success(old)
-	}
-	if old.Generation >= maxScopeGeneration {
-		return deny("STORAGE_ERROR")
-	}
-	next := SelectedScope{Schema: 1, Scope: in.Scope, Generation: old.Generation + 1}
-	if e.auditLocked(actor, "delegate.scope.confirm", "", scopeVirtual(in.Scope), "admitting") != nil {
-		return deny("STORAGE_ERROR")
-	}
-	b, _ := json.Marshal(next)
-	if e.Store.atomic("selected-scope.record", b) != nil {
-		return deny("STORAGE_ERROR")
-	}
-	// New generation is already authoritative if cleanup fails. Old grants fail
-	// admission/publish before acknowledgement, and switching back cannot revive them.
-	grants, err := e.Store.List()
-	if err != nil {
-		return deny("STORAGE_ERROR")
-	}
-	for _, d := range grants {
-		if d.Package == e.Policy.Package && !d.Revoked {
-			d.Revoked = true
-			if e.Store.Put(d) != nil {
-				return deny("STORAGE_ERROR")
-			}
-			e.cancelGrantLocked(d.ID, "scope-changed")
-		}
-	}
-	if e.auditLocked(actor, "delegate.scope.confirm", "", scopeVirtual(in.Scope), "confirmed") != nil {
-		return deny("STORAGE_ERROR")
-	}
-	return success(next)
-}