veltro-cli 0.15.7__py3-none-any.whl

veltro_cli/lib/install.py

@@ -0,0 +1,400 @@
+"""veltro install — materialise a release directory and boot it."""
+
+from __future__ import annotations
+
+import hashlib
+import shutil
+import tarfile
+import tempfile
+import urllib.request
+from pathlib import Path
+from typing import Any, Callable
+
+from veltro_cli.lib.compose import ComposeClient, RunResult
+from veltro_cli.lib.env_init import init_env
+from veltro_cli.lib.errors import VeltroCliError
+from veltro_cli.lib.host import check_compose, check_disk, check_docker, check_host_minimums
+from veltro_cli.lib.products import read_env_file, resolve_selection
+from veltro_cli.lib.release import latest_release_version, release_tag
+from veltro_cli.lib.toml_config import TLS_MODES, VELTRO_TOML, VeltroConfig, read_config, write_config
+from veltro_cli.lib.tls import tls_compose_env, validate_tls_public_url, write_caddyfile
+
+# Files copied from a source checkout into an install directory.
+INSTALL_TREE = (
+    "cli",
+    "docker-compose.yml",
+    "versions.env",
+    ".env.example",
+    "Makefile",
+    "compose",
+    "nginx",
+    "scripts",
+    "docs",
+    "conformance",
+    "observability",
+    # Demo sandbox corpora (`veltro demo seed --dataset …`, Apache-2.0).
+    "content",
+    "README.md",
+)
+
+
+def _copy_tree(src: Path, dst: Path) -> None:
+    if src.resolve() == dst.resolve():
+        return
+    if src.is_dir():
+        if dst.exists():
+            shutil.rmtree(dst)
+        shutil.copytree(src, dst, symlinks=True)
+    elif src.is_file():
+        dst.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copy2(src, dst)
+
+
+def materialise_from_checkout(source: Path, dest: Path) -> None:
+    source = source.resolve()
+    dest = dest.resolve()
+    missing = [name for name in ("docker-compose.yml", "versions.env", ".env.example") if not (source / name).exists()]
+    if missing:
+        raise VeltroCliError(
+            f"source checkout incomplete: missing {', '.join(missing)}",
+            remedy="point --source at a full Veltro repository checkout",
+        )
+    if source == dest:
+        return
+    dest.mkdir(parents=True, exist_ok=True)
+    for name in INSTALL_TREE:
+        src = source / name
+        if not src.exists():
+            continue
+        _copy_tree(src, dest / name)
+
+
+def materialise_from_tarball(
+    url: str,
+    dest: Path,
+    *,
+    opener=urllib.request.urlopen,
+    expected_sha256: str | None = None,
+) -> str:
+    dest.mkdir(parents=True, exist_ok=True)
+    with tempfile.TemporaryDirectory(prefix="veltro-install-") as tmp:
+        tarball = Path(tmp) / "release.tar.gz"
+        digest = hashlib.sha256()
+        with opener(url) as resp, tarball.open("wb") as fh:
+            while chunk := resp.read(1024 * 1024):
+                digest.update(chunk)
+                fh.write(chunk)
+        actual_sha256 = digest.hexdigest()
+        if expected_sha256 is not None and actual_sha256 != expected_sha256.removeprefix("sha256:"):
+            raise VeltroCliError(
+                f"release archive digest mismatch: got sha256:{actual_sha256}",
+                remedy="do not install; use the digest published with the immutable release",
+            )
+        with tarfile.open(tarball, "r:*") as tar:
+            # Safe extract: only regular files/dirs, no absolute paths.
+            for member in tar.getmembers():
+                name = member.name
+                if (
+                    name.startswith("/")
+                    or ".." in Path(name).parts
+                    or not (member.isfile() or member.isdir())
+                ):
+                    raise VeltroCliError(
+                        f"refusing unsafe tarball member {name!r}",
+                        remedy="use an official Veltro release asset",
+                    )
+            tar.extractall(Path(tmp) / "extracted")
+        extracted = Path(tmp) / "extracted"
+        # Tarballs often wrap a single top-level directory.
+        children = [p for p in extracted.iterdir()]
+        root = children[0] if len(children) == 1 and children[0].is_dir() else extracted
+        materialise_from_checkout(root, dest)
+    return actual_sha256
+
+
+def set_public_url(env_path: Path, public_url: str) -> None:
+    if not env_path.is_file():
+        return
+    lines = []
+    found = False
+    for line in env_path.read_text(encoding="utf-8").splitlines(keepends=True):
+        if line.startswith("PUBLIC_BASE_URL="):
+            lines.append(f"PUBLIC_BASE_URL={public_url}\n")
+            found = True
+        else:
+            lines.append(line if line.endswith("\n") else line + "\n")
+    if not found:
+        lines.append(f"PUBLIC_BASE_URL={public_url}\n")
+    env_path.write_text("".join(lines), encoding="utf-8")
+
+
+def _public_url(env_path: Path) -> str | None:
+    return read_env_file(env_path).get("PUBLIC_BASE_URL") or None
+
+
+def install(
+    *,
+    products: str | None = None,
+    directory: str | Path = "./veltro",
+    public_url: str | None = None,
+    tls_mode: str = "off",
+    yes: bool = False,
+    source: Path | None = None,
+    release_url: str | None = None,
+    release_sha256: str | None = None,
+    suite_version: str | None = None,
+    monitoring: bool = False,
+    client_factory: Callable[..., ComposeClient] | None = None,
+    skip_up: bool = False,
+    stream=None,
+    opener: Callable[..., Any] = urllib.request.urlopen,
+) -> Path:
+    if products is not None:
+        from veltro_cli.lib.products import parse_products
+
+        parse_products(products)
+    if tls_mode not in TLS_MODES:
+        raise VeltroCliError(f"unknown tls mode {tls_mode!r}", remedy=f"choose one of: {', '.join(TLS_MODES)}")
+    if tls_mode != "off" and public_url is not None:
+        validate_tls_public_url(public_url)
+
+    dest = Path(directory).expanduser().resolve()
+    # Refuse legacy product-local installations before replacing any release files.
+    read_config(dest / VELTRO_TOML)
+    # A named release is validated before anything is written; the newest one
+    # is looked up only when an official release is actually fetched.
+    tag = release_tag(suite_version) if suite_version else None
+    if source is not None and release_url is not None:
+        raise VeltroCliError("choose either --source or --release-url, not both")
+    if source is not None:
+        materialise_from_checkout(source, dest)
+    elif release_url is not None:
+        if release_sha256 is None:
+            raise VeltroCliError(
+                "custom --release-url requires --release-sha256",
+                remedy="supply the publisher's lowercase SHA-256 digest",
+            )
+        materialise_from_tarball(
+            release_url,
+            dest,
+            opener=opener,
+            expected_sha256=release_sha256,
+        )
+    else:
+        # Official installs are bound to the release-gated manifest before any
+        # bytes replace the destination. A checkout is used only with --source.
+        from veltro_cli.lib.upgrade import (
+            load_release_manifest,
+            release_urls,
+            verify_staged_release,
+        )
+
+        if tag is None:
+            tag = release_tag(latest_release_version(opener=opener))
+        manifest = load_release_manifest(tag, opener=opener)
+        _, official_url = release_urls(tag)
+        with tempfile.TemporaryDirectory(prefix="veltro-install-stage-") as tmp:
+            staged = Path(tmp)
+            materialise_from_tarball(official_url, staged, opener=opener)
+            verify_staged_release(staged, manifest)
+            materialise_from_checkout(staged, dest)
+    if tls_mode == "custom":
+        missing_certificates = [
+            str(dest / "tls" / name)
+            for name in ("fullchain.pem", "privkey.pem")
+            if not (dest / "tls" / name).is_file()
+        ]
+        if missing_certificates:
+            raise VeltroCliError(
+                "custom TLS certificate material is missing: "
+                + ", ".join(missing_certificates),
+                remedy="copy the PEM files into DIR/tls and re-run install --tls custom",
+            )
+
+    env_path = dest / ".env"
+    if not env_path.is_file():
+        init_env(dest, force=False)
+    explicit_products = products
+    selected = resolve_selection(dest, products)
+    checks = [check_docker(), check_compose(), check_disk(dest), *check_host_minimums()]
+    for check in checks:
+        if check.status == "fail":
+            raise VeltroCliError(f"{check.name}: {check.detail}", remedy=check.remedy)
+        if check.status == "warn" and stream is not None:
+            print(f"[WARN] {check.name}: {check.detail}", file=stream)
+    replay_dir = dest / ".suite" / "vf-agent" / "demo"
+    replay_dir.mkdir(mode=0o755, parents=True, exist_ok=True)
+    replay_dir.chmod(0o755)
+    # --yes confirms non-interactive operations; it never rotates credentials.
+    existing_public_url = _public_url(env_path)
+    if public_url is not None:
+        set_public_url(env_path, public_url)
+    effective_public_url = public_url or existing_public_url or "http://localhost"
+    if tls_mode != "off":
+        validate_tls_public_url(effective_public_url)
+
+    # CHAD_INGEST_BIND_ADDRESS guard lives in CHAD; we only surface the value.
+    # Identity runs for every integrated selection, including core only.
+    _validate_identity(dest, selected)
+    if explicit_products is not None and "VELTRO_PRODUCTS" in read_env_file(env_path):
+        # Otherwise the env selector would undo this install on the next command.
+        _remove_env_key(env_path, "VELTRO_PRODUCTS")
+
+    installed_version = f"source:{source.resolve()}" if source is not None else tag or ""
+    cfg = VeltroConfig(
+        products=",".join(selected),
+        public_url=effective_public_url,
+        tls_mode=tls_mode,
+        dir=str(dest),
+        installed_suite_version=installed_version,
+        monitoring=monitoring,
+    )
+    write_config(dest / VELTRO_TOML, cfg)
+
+    if tls_mode != "off":
+        write_caddyfile(
+            dest,
+            tls_mode=tls_mode,
+            public_url=effective_public_url,
+            products=selected,
+        )
+        # Custom certificate material was validated before config or generated
+        # files were written, so a refusal leaves no partial TLS configuration.
+        # Stash TLS env into .env so compose interpolation sees it. Move the
+        # plaintext origin to loopback so Caddy is the only public listener.
+        tls_env = tls_compose_env(tls_mode, effective_public_url)
+        port_key = "VELTRO_HTTP_PORT"
+        default_port = "8088"
+        existing_port = _env_value(dest / ".env", port_key)
+        port = (existing_port or default_port).rsplit(":", 1)[-1]
+        tls_http_port = _env_value(dest / ".env", "VELTRO_TLS_HTTP_PORT") or "80"
+        tls_env["VELTRO_TLS_HTTP_PORT"] = tls_http_port.rsplit(":", 1)[-1]
+        if port == tls_env["VELTRO_TLS_HTTP_PORT"]:
+            port = default_port
+        tls_env[port_key] = f"127.0.0.1:{port}"
+        _merge_env(dest / ".env", tls_env)
+    if skip_up:
+        return dest
+
+    factory = client_factory or ComposeClient
+    client = factory(
+        dest, products=selected, tls_mode=tls_mode, monitoring=monitoring,
+    )
+    result = start_stack(client)
+    if result.returncode != 0:
+        raise VeltroCliError(
+            f"failed to start stack: {result.stderr.strip() or result.stdout.strip()}",
+            remedy="run `veltro doctor` and inspect `veltro logs`",
+        )
+    return dest
+
+
+def start_stack(client: ComposeClient, *compose_args: str) -> RunResult:
+    """Start identity, project its live signing ring into .env, then everything.
+
+    Products verify request assertions against the public ring in .env, so
+    whatever ring identity holds (a fresh one, or one a restore brought back)
+    is projected before they start. Returns the final ``compose up`` result.
+    """
+    result = client.invoke(["up", "-d", "--wait", "veltro"])
+    if result.returncode != 0:
+        raise VeltroCliError(
+            f"failed to start identity: {result.stderr.strip() or result.stdout.strip()}",
+            remedy="run `veltro doctor` and `veltro logs`",
+        )
+    _materialise_assertion_authority(client.root)
+    return client.up(*compose_args)
+
+
+
+
+def _validate_identity(root: Path, products: tuple[str, ...] | None = None) -> None:
+    import sys
+
+    scripts = root / "scripts"
+    sys.path.insert(0, str(scripts))
+    try:
+        import validate_identity_credentials as vic  # type: ignore
+    except ImportError as exc:
+        raise VeltroCliError(
+            "identity credential validator is missing from the install",
+            remedy="restore scripts/validate_identity_credentials.py from the release",
+        ) from exc
+    env_file = root / ".env"
+    problems = (
+        vic.missing(env_file, {}, products=products)
+        + vic.dsn_problems(env_file, {})
+        + vic.session_secret_problems(env_file, {})
+        + vic.signing_passphrase_problems(env_file, {})
+    )
+    if problems:
+        raise VeltroCliError(
+            "identity credentials incomplete: " + "; ".join(problems[:5]),
+            remedy="ensure VELTRO_IDENTITY_* secrets are set (re-run install or edit .env)",
+        )
+
+
+def _materialise_assertion_authority(root: Path) -> None:
+    script = root / "scripts" / "materialize_suite_assertion_authority.py"
+    if not script.is_file():
+        return
+    import runpy
+    import sys
+
+    argv = sys.argv[:]
+    try:
+        sys.argv = [
+            str(script),
+            "--env-file",
+            str(root / ".env"),
+            "--write-env",
+            str(root / ".env"),
+            "--compose-file",
+            str(root / "docker-compose.yml"),
+            "--audience",
+            "chad",
+            "--audience",
+            "warden",
+            "--audience",
+            "vectorflow",
+        ]
+        runpy.run_path(str(script), run_name="__main__")
+    except SystemExit as exc:
+        if exc.code not in (0, None):
+            raise VeltroCliError(
+                f"materialize_suite_assertion_authority failed (exit {exc.code})",
+                remedy="inspect identity logs and re-run `veltro up`",
+            ) from exc
+    finally:
+        sys.argv = argv
+
+
+def _env_value(env_path: Path, key: str) -> str | None:
+    return read_env_file(env_path).get(key)
+
+
+def _remove_env_key(env_path: Path, key: str) -> None:
+    lines = env_path.read_text(encoding="utf-8").splitlines()
+    kept = [line for line in lines if line.partition("=")[0].strip() != key]
+    env_path.write_text("\n".join(kept) + "\n", encoding="utf-8")
+
+
+def _merge_env(env_path: Path, values: dict[str, str]) -> None:
+    """Upsert KEY=VALUE lines without moving comments or unrelated values."""
+    lines = env_path.read_text(encoding="utf-8").splitlines() if env_path.is_file() else []
+    seen: set[str] = set()
+    out: list[str] = []
+    for line in lines:
+        if not line.strip() or line.lstrip().startswith("#") or "=" not in line:
+            out.append(line)
+            continue
+        key, _, _value = line.partition("=")
+        if key in values:
+            out.append(f"{key}={values[key]}")
+            seen.add(key)
+        else:
+            out.append(line)
+    for key, value in values.items():
+        if key not in seen:
+            out.append(f"{key}={value}")
+    env_path.write_text("\n".join(out) + "\n", encoding="utf-8")

veltro_cli/lib/k8s.py

@@ -0,0 +1,57 @@
+"""veltro k8s render — helm template helper."""
+
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+from collections.abc import Sequence
+
+from veltro_cli.lib.errors import VeltroCliError
+from veltro_cli.lib.products import PRODUCTS
+
+# Chart value key for each product's subchart.
+PRODUCT_CHARTS = {"vectorflow": "vectorflow-server", "chad": "chad", "warden": "warden"}
+
+
+def selection_values(products: Sequence[str]) -> list[str]:
+    """Helm flags for core plus exactly the selected products."""
+    argv = ["--set", "veltro-gateway.enabled=true", "--set", "veltro-identity.enabled=true"]
+    for product in PRODUCTS:
+        enabled = "true" if product in products else "false"
+        argv.extend(["--set", f"{PRODUCT_CHARTS[product]}.enabled={enabled}"])
+    # --set-json: plain --set turns `{}` into [""], not an empty list.
+    argv.extend(["--set-json", f"global.products={json.dumps([p for p in PRODUCTS if p in products], separators=(',', ':'))}"])
+    return argv
+
+
+def render(
+    *,
+    products: Sequence[str],
+    values: Sequence[str] = (),
+    chart: str = "oci://ghcr.io/veltrosecurity/charts/veltro",
+    release_name: str = "veltro",
+    dry_run: bool = False,
+) -> str:
+    helm = shutil.which("helm")
+    if not helm:
+        cmd = f"helm template {release_name} {chart}"
+        for v in values:
+            cmd += f" -f {v}"
+        raise VeltroCliError(
+            "helm not found on PATH",
+            remedy=f"install helm 3.x, then run: {cmd}",
+        )
+    argv = [helm, "template", release_name, chart]
+    argv.extend(selection_values(products))
+    for v in values:
+        argv.extend(["-f", v])
+    if dry_run:
+        return " ".join(argv)
+    completed = subprocess.run(argv, capture_output=True, text=True, check=False)
+    if completed.returncode != 0:
+        raise VeltroCliError(
+            completed.stderr.strip() or "helm template failed",
+            remedy="check chart values and network access to ghcr.io",
+        )
+    return completed.stdout

veltro_cli/lib/paths.py

@@ -0,0 +1,42 @@
+"""Resolve install / checkout directories."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+# When running from a source checkout, the package lives at <root>/cli/veltro_cli.
+_PACKAGE_DIR = Path(__file__).resolve().parent
+_CLI_DIR = _PACKAGE_DIR.parent  # veltro_cli/
+_PKG_ROOT = _CLI_DIR.parent  # cli/
+# Repo root when developing from the monorepo; install dir otherwise.
+DEFAULT_INSTALL_DIR = Path.cwd() / "veltro"
+
+
+def find_repo_root(start: Path | None = None) -> Path | None:
+    """Walk up looking for versions.env + docker-compose.yml (a Veltro checkout)."""
+    cur = (start or Path.cwd()).resolve()
+    for candidate in [cur, *cur.parents]:
+        if (candidate / "versions.env").is_file() and (candidate / "docker-compose.yml").is_file():
+            return candidate
+    # Source tree layout: cli/ is under the repo root.
+    monorepo = _PKG_ROOT.parent
+    if (monorepo / "versions.env").is_file() and (monorepo / "docker-compose.yml").is_file():
+        return monorepo
+    return None
+
+
+def resolve_dir(explicit: str | Path | None = None) -> Path:
+    if explicit is not None:
+        return Path(explicit).expanduser().resolve()
+    env = os.environ.get("VELTRO_DIR")
+    if env:
+        return Path(env).expanduser().resolve()
+    found = find_repo_root()
+    if found is not None:
+        return found
+    return DEFAULT_INSTALL_DIR.resolve()
+
+
+def enrollment_token_dir(root: Path) -> Path:
+    return (root / ".suite" / "vf-agent").resolve()

veltro_cli/lib/products.py

@@ -0,0 +1,54 @@
+"""Installed-product selection shared by CLI commands and host preflight."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from veltro_cli.lib.errors import VeltroCliError
+from veltro_cli.lib.toml_config import VELTRO_TOML, read_config
+
+PRODUCTS = ("vectorflow", "chad", "warden")
+
+
+def read_env_file(path: Path) -> dict[str, str]:
+    """Read Compose-style assignments; the last assignment to a key wins."""
+    values: dict[str, str] = {}
+    if path.is_file():
+        for raw in path.read_text(encoding="utf-8").splitlines():
+            line = raw.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            key, value = line.split("=", 1)
+            value = value.strip()
+            if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
+                value = value[1:-1]
+            values[key.strip()] = value
+    return values
+
+
+def parse_products(value: str) -> tuple[str, ...]:
+    if not value.strip():
+        return ()
+    names = [name.strip() for name in value.split(",")]
+    seen: set[str] = set()
+    for name in names:
+        if name not in PRODUCTS:
+            raise VeltroCliError(
+                f"unknown VELTRO_PRODUCTS product {name!r}",
+                remedy=f"choose a comma-separated subset of {', '.join(PRODUCTS)}",
+            )
+        if name in seen:
+            raise VeltroCliError(f"duplicate VELTRO_PRODUCTS product {name!r}")
+        seen.add(name)
+    return tuple(name for name in PRODUCTS if name in seen)
+
+
+def resolve_selection(root: Path, explicit_products: str | None = None) -> tuple[str, ...]:
+    """Explicit selection > present .env selector > saved selection > all products."""
+    cfg = read_config(root / VELTRO_TOML)
+    if explicit_products is not None:
+        return parse_products(explicit_products)
+    env = read_env_file(root / ".env")
+    if "VELTRO_PRODUCTS" in env:
+        return parse_products(env["VELTRO_PRODUCTS"])
+    return parse_products(cfg.products) if cfg else PRODUCTS

veltro_cli/lib/release.py

@@ -0,0 +1,88 @@
+"""Veltro release versions, the tags they are published under, and the newest one.
+
+One Veltro version, ``X.Y.Z``, names a release (ADR-016 §30). Releases up to
+0.14.2 were tagged ``suite-vX.Y.Z``; every later one is ``vX.Y.Z``. The
+numbering never overlaps, so the version alone names the tag. The release
+workflow resolves tags through ``scripts/suite_manifest.py release-tag``, which
+calls :func:`release_tag` here.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import urllib.request
+from typing import Any, Callable
+
+from veltro_cli.lib.errors import VeltroCliError
+
+RELEASE_REPO = "veltrosecurity/veltro"
+RELEASE_BASE = f"https://github.com/{RELEASE_REPO}"
+# GitHub lists releases newest first, so the newest release is on page one.
+RELEASES_API = f"https://api.github.com/repos/{RELEASE_REPO}/releases?per_page=100"
+LAST_SUITE_TAGGED_RELEASE = (0, 14, 2)
+
+_VERSION_RE = re.compile(r"^(?:suite-v|v)?(\d+)\.(\d+)\.(\d+)$")
+_TAG_RE = re.compile(r"^(?:suite-)?v\d+\.\d+\.\d+$")
+
+
+def parse_release_version(text: str) -> tuple[int, int, int]:
+    """``X.Y.Z``, ``vX.Y.Z`` or ``suite-vX.Y.Z`` -> ``(X, Y, Z)``."""
+    match = _VERSION_RE.match(text.strip())
+    if not match:
+        raise VeltroCliError(
+            f"unparseable Veltro release version {text!r}",
+            remedy="name a release as X.Y.Z, e.g. 0.15.0",
+        )
+    major, minor, patch = (int(part) for part in match.groups())
+    return major, minor, patch
+
+
+def release_version(text: str) -> str:
+    """The bare ``X.Y.Z`` a version or either tag spelling names."""
+    return "{}.{}.{}".format(*parse_release_version(text))
+
+
+def release_tag(version: str) -> str:
+    """The tag the release of ``version`` is published under."""
+    parsed = parse_release_version(version)
+    prefix = "suite-v" if parsed <= LAST_SUITE_TAGGED_RELEASE else "v"
+    return prefix + "{}.{}.{}".format(*parsed)
+
+
+def is_release_tag(text: str) -> bool:
+    """True for a release tag of either series, false for a ``source:`` path."""
+    return bool(_TAG_RE.match(text))
+
+
+def latest_release_version(
+    *,
+    opener: Callable[..., Any] = urllib.request.urlopen,
+    timeout: float = 15,
+) -> str:
+    """The newest published Veltro release, ``X.Y.Z``.
+
+    Drafts, prereleases and tags outside the release series (the retired
+    ``identity-v*`` lane) are skipped.
+    """
+    remedy = "name the release with --suite-version X.Y.Z, or allow HTTPS to api.github.com"
+    request = urllib.request.Request(
+        RELEASES_API, headers={"Accept": "application/vnd.github+json"}
+    )
+    try:
+        with opener(request, timeout=timeout) as response:
+            payload = json.load(response)
+    except Exception as exc:
+        raise VeltroCliError(f"could not list Veltro releases: {exc}", remedy=remedy) from exc
+    published = [
+        parse_release_version(release["tag_name"])
+        for release in (payload if isinstance(payload, list) else ())
+        if isinstance(release, dict)
+        and not release.get("draft")
+        and not release.get("prerelease")
+        and isinstance(release.get("tag_name"), str)
+        and is_release_tag(release["tag_name"])
+    ]
+    if not published:
+        raise VeltroCliError("no published Veltro release found", remedy=remedy)
+    return "{}.{}.{}".format(*max(published))