Skip to content
This repository was archived by the owner on Jul 11, 2023. It is now read-only.

Commit cc6a97a

Browse files
shashankramshashankram
committed
charts/osm: use image digest for default images
Default images corresponding to the latest released image should use the image digest instead of tags to avoid supply chain attacks, which tags are vulernable to due to being mutatble. Image digests are immutable. This change updates the way images are published during a release and also the release workflow as noted in the release guide. The change does the following: 1. Uses image digests for the control plane images instead of tags when the digests are specified. The digests must always be specified in release branches, while the code in the main branch can continue to use tags for better compatibility between the charts and images. As a result of this change, all images in the main branch will leverage the `latest-main` tag instead of release tags. This is necessary because the CLI/charts are not backward compatible with the previous release and thus unusable. The image refs in the main branch will thus use the `latest-main` tag. 2. Updates the release workflow to include a pre-release step to publish the control plane images for the release prior to the final release being cut. This is necessary because the image digests for the released images published to the container registry must be included in the charts and CLI as a part of the final release step. The release step will not rebuild the control plane images, but instead encode them into the charts/CLI and upload the release binaries. 3. Updates the release guide to reflect the new release process. Part of #3715 Signed-off-by: Shashank Ram <[email protected]>
1 parent 217d79b commit cc6a97a

23 files changed

+245
-93
lines changed

‎.github/workflows/pre-release.yml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Pre-release
2+
on:
3+
push:
4+
tags:
5+
- "pre-rel-v*"
6+
7+
jobs:
8+
version:
9+
name: Set Version from git ref
10+
runs-on: ubuntu-latest
11+
outputs:
12+
version: ${{ steps.version.outputs.version }}
13+
steps:
14+
- id: version
15+
run: echo "::set-output name=version::$(sed 's#^refs/tags/pre-rel-\(.*\)#\1#' <<< '${{ github.ref }}')"
16+
17+
images:
18+
name: Docker Images
19+
runs-on: ubuntu-latest
20+
needs: version
21+
env:
22+
DOCKER_USER: ${{ secrets.RELEASE_DOCKER_USER }}
23+
DOCKER_PASS: ${{ secrets.RELEASE_DOCKER_PASS }}
24+
steps:
25+
- name: Checkout
26+
uses: actions/checkout@v2
27+
- name: Restore Module Cache
28+
uses: actions/cache@v2
29+
with:
30+
path: ~/go/pkg/mod
31+
key: ${{ runner.os }}-gomod2-${{ hashFiles('**/go.sum') }}
32+
restore-keys: |
33+
${{ runner.os }}-gomod2-
34+
- name: Restore Build Cache
35+
uses: actions/cache@v2
36+
with:
37+
path: ~/.cache/go-build
38+
key: ${{ runner.os }}-gobuild-${{ hashFiles('**/*.go') }}
39+
- name: Setup Go 1.16
40+
uses: actions/setup-go@v1
41+
with:
42+
go-version: 1.16
43+
- name: Docker Login
44+
run: docker login --username "$DOCKER_USER" --password-stdin <<< "$DOCKER_PASS"
45+
- name: Push images with version tag
46+
env:
47+
CTR_TAG: ${{ needs.version.outputs.version }}
48+
run: make docker-push VERIFY_TAGS=1
49+
- name: Push images with latest tag
50+
env:
51+
CTR_TAG: latest
52+
run: make docker-push
53+
- name: Upload image digest
54+
uses: actions/upload-artifact@v2
55+
with:
56+
name: osm_image_digests
57+
path: /tmp/osm_image_digest_*

‎.github/workflows/release.yml

Lines changed: 0 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -105,40 +105,3 @@ jobs:
105105
asset_path: _dist/sha256sums.txt
106106
asset_name: sha256sums.txt
107107
asset_content_type: text/plain
108-
109-
images:
110-
name: Docker Images
111-
runs-on: ubuntu-latest
112-
needs: version
113-
env:
114-
DOCKER_USER: ${{ secrets.RELEASE_DOCKER_USER }}
115-
DOCKER_PASS: ${{ secrets.RELEASE_DOCKER_PASS }}
116-
steps:
117-
- name: Checkout
118-
uses: actions/checkout@v2
119-
- name: Restore Module Cache
120-
uses: actions/cache@v2
121-
with:
122-
path: ~/go/pkg/mod
123-
key: ${{ runner.os }}-gomod2-${{ hashFiles('**/go.sum') }}
124-
restore-keys: |
125-
${{ runner.os }}-gomod2-
126-
- name: Restore Build Cache
127-
uses: actions/cache@v2
128-
with:
129-
path: ~/.cache/go-build
130-
key: ${{ runner.os }}-gobuild-${{ hashFiles('**/*.go') }}
131-
- name: Setup Go 1.16
132-
uses: actions/setup-go@v1
133-
with:
134-
go-version: 1.16
135-
- name: Docker Login
136-
run: docker login --username "$DOCKER_USER" --password-stdin <<< "$DOCKER_PASS"
137-
- name: Push images with version tag
138-
env:
139-
CTR_TAG: ${{ needs.version.outputs.version }}
140-
run: make docker-push VERIFY_TAGS=1
141-
- name: Push images with latest tag
142-
env:
143-
CTR_TAG: latest
144-
run: make docker-push

‎Makefile

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ BINNAME ?= osm
55
DIST_DIRS := find * -type d -exec
66
CTR_REGISTRY ?= openservicemesh
77
CTR_TAG ?= latest
8-
CTR_DIGEST_FILE ?= /tmp/osm_image_digest
8+
CTR_DIGEST_FILE ?= /tmp/osm_image_digest_$(CTR_TAG).txt
99
VERIFY_TAGS ?= 0
1010

1111
GOPATH = $(shell go env GOPATH)
@@ -253,7 +253,7 @@ DOCKER_PUSH_CONTROL_PLANE_TARGETS = $(addprefix docker-push-, init osm-controlle
253253
.PHONY: $(DOCKER_PUSH_CONTROL_PLANE_TARGETS)
254254
$(DOCKER_PUSH_CONTROL_PLANE_TARGETS): NAME=$(@:docker-push-%=%)
255255
$(DOCKER_PUSH_CONTROL_PLANE_TARGETS):
256-
@if [ $(VERIFY_TAGS) != 1 ]; then make docker-build-$(NAME) && docker push "$(CTR_REGISTRY)/$(NAME):$(CTR_TAG)"; else bash scripts/publish-image.sh $(NAME) "linux"; fi
256+
@if [ $(VERIFY_TAGS) != 1 ]; then make docker-build-$(NAME) && docker push "$(CTR_REGISTRY)/$(NAME):$(CTR_TAG)"; else bash scripts/publish-image.sh "$(NAME)" "linux" "$(CTR_REGISTRY)"; fi
257257
@docker images --digests | grep "$(CTR_REGISTRY)/$(NAME)\s*$(CTR_TAG)" >> "$(CTR_DIGEST_FILE)"
258258

259259

@@ -262,15 +262,15 @@ DOCKER_PUSH_LINUX_TARGETS = $(addprefix docker-push-, $(DEMO_TARGETS))
262262
.PHONY: $(DOCKER_PUSH_LINUX_TARGETS)
263263
$(DOCKER_PUSH_LINUX_TARGETS): NAME=$(@:docker-push-%=%)
264264
$(DOCKER_PUSH_LINUX_TARGETS):
265-
@if [ $(VERIFY_TAGS) != 1 ]; then make docker-build-$(NAME) && docker push "$(CTR_REGISTRY)/$(NAME):$(CTR_TAG)"; else bash scripts/publish-image.sh $(NAME) "linux"; fi
265+
@if [ $(VERIFY_TAGS) != 1 ]; then make docker-build-$(NAME) && docker push "$(CTR_REGISTRY)/$(NAME):$(CTR_TAG)"; else bash scripts/publish-image.sh "$(NAME)" "linux" "$(CTR_REGISTRY)"; fi
266266

267267

268268
# Windows demo applications
269269
DOCKER_PUSH_WINDOWS_TARGETS = $(addprefix docker-push-windows-, $(DEMO_TARGETS))
270270
.PHONY: $(DOCKER_PUSH_WINDOWS_TARGETS)
271271
$(DOCKER_PUSH_WINDOWS_TARGETS): NAME=$(@:docker-push-%=%)
272272
$(DOCKER_PUSH_WINDOWS_TARGETS):
273-
@if [ $(VERIFY_TAGS) != 1 ]; then make ARGS=--output=type=registry docker-build-$(NAME); else bash scripts/publish-image.sh $(addprefix windows-, $(NAME)) "windows"; fi
273+
@if [ $(VERIFY_TAGS) != 1 ]; then make ARGS=--output=type=registry docker-build-$(NAME); else bash scripts/publish-image.sh "$(NAME)" "windows" "$(CTR_REGISTRY)"; fi
274274

275275

276276
.PHONY: docker-control-plane-push

‎charts/osm/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ version: 0.9.2
1818

1919
# This is the version number of the application being deployed. This version number should be
2020
# incremented each time you make changes to the application.
21-
appVersion: v0.9.2
21+
appVersion: latest-main
2222

2323
# This specifies the minimum Kubernetes version OSM is compatible with.
2424
kubeVersion: ">= 1.19.0-0"

‎charts/osm/README.md

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -101,9 +101,15 @@ The following table lists the configurable parameters of the osm chart and their
101101
| OpenServiceMesh.fluentBit.workspaceId | string | `""` | WorkspaceId for Fluent Bit output plugin to Log Analytics |
102102
| OpenServiceMesh.grafana.enableRemoteRendering | bool | `false` | Enable Remote Rendering in Grafana |
103103
| OpenServiceMesh.grafana.port | int | `3000` | Grafana service's port |
104-
| OpenServiceMesh.image.pullPolicy | string | `"IfNotPresent"` | Container image pull policy |
105-
| OpenServiceMesh.image.registry | string | `"openservicemesh"` | Container image registry |
106-
| OpenServiceMesh.image.tag | string | `"v0.9.2"` | Container image tag |
104+
| OpenServiceMesh.image.digest | object | `{"osmBootstrap":"","osmCRDs":"","osmController":"","osmInjector":"","osmSidecarInit":""}` | Image digest (defaults to latest compatible tag) |
105+
| OpenServiceMesh.image.digest.osmBootstrap | string | `""` | osm-boostrap's image digest |
106+
| OpenServiceMesh.image.digest.osmCRDs | string | `""` | osm-crds' image digest |
107+
| OpenServiceMesh.image.digest.osmController | string | `""` | osm-controller's image digest |
108+
| OpenServiceMesh.image.digest.osmInjector | string | `""` | osm-injector's image digest |
109+
| OpenServiceMesh.image.digest.osmSidecarInit | string | `""` | Sidecar init container's image digest |
110+
| OpenServiceMesh.image.pullPolicy | string | `"IfNotPresent"` | Container image pull policy for control plane containers |
111+
| OpenServiceMesh.image.registry | string | `"openservicemesh"` | Container image registry for control plane images |
112+
| OpenServiceMesh.image.tag | string | `"latest-main"` | Container image tag for control plane images |
107113
| OpenServiceMesh.imagePullSecrets | list | `[]` | `osm-controller` image pull secret |
108114
| OpenServiceMesh.inboundPortExclusionList | list | `[]` | Specifies a global list of ports to exclude from inbound traffic interception by the sidecar proxy. If specified, must be a list of positive integers. |
109115
| OpenServiceMesh.injector.autoScale | object | `{"enable":false,"maxReplicas":5,"minReplicas":1,"targetAverageUtilization":80}` | Auto scale configuration |

‎charts/osm/templates/_helpers.tpl

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,49 @@ securityContext:
3838
{{- define "osm.validatorWebhookConfigName" -}}
3939
{{- $validatorWebhookConfigName := printf "osm-validator-mesh-%s" .Values.OpenServiceMesh.meshName -}}
4040
{{ default $validatorWebhookConfigName .Values.OpenServiceMesh.validatorWebhook.webhookConfigurationName}}
41+
{{- end -}}
42+
43+
{{/* osm-controller image */}}
44+
{{- define "osmController.image" -}}
45+
{{- if .Values.OpenServiceMesh.image.digest.osmController -}}
46+
{{- printf "%s/osm-controller@%s" .Values.OpenServiceMesh.image.registry .Values.OpenServiceMesh.image.digest.osmController -}}
47+
{{- else -}}
48+
{{- printf "%s/osm-controller:%s" .Values.OpenServiceMesh.image.registry .Values.OpenServiceMesh.image.tag -}}
49+
{{- end -}}
50+
{{- end -}}
51+
52+
{{/* osm-injector image */}}
53+
{{- define "osmInjector.image" -}}
54+
{{- if .Values.OpenServiceMesh.image.digest.osmInjector -}}
55+
{{- printf "%s/osm-injector@%s" .Values.OpenServiceMesh.image.registry .Values.OpenServiceMesh.image.digest.osmInjector -}}
56+
{{- else -}}
57+
{{- printf "%s/osm-injector:%s" .Values.OpenServiceMesh.image.registry .Values.OpenServiceMesh.image.tag -}}
58+
{{- end -}}
59+
{{- end -}}
60+
61+
{{/* Sidecar init image */}}
62+
{{- define "osmSidecarInit.image" -}}
63+
{{- if .Values.OpenServiceMesh.image.digest.osmSidecarInit -}}
64+
{{- printf "%s/init@%s" .Values.OpenServiceMesh.image.registry .Values.OpenServiceMesh.image.digest.osmSidecarInit -}}
65+
{{- else -}}
66+
{{- printf "%s/init:%s" .Values.OpenServiceMesh.image.registry .Values.OpenServiceMesh.image.tag -}}
67+
{{- end -}}
68+
{{- end -}}
69+
70+
{{/* osm-bootstrap image */}}
71+
{{- define "osmBootstrap.image" -}}
72+
{{- if .Values.OpenServiceMesh.image.digest.osmBootstrap -}}
73+
{{- printf "%s/osm-bootstrap@%s" .Values.OpenServiceMesh.image.registry .Values.OpenServiceMesh.image.digest.osmBootstrap -}}
74+
{{- else -}}
75+
{{- printf "%s/osm-bootstrap:%s" .Values.OpenServiceMesh.image.registry .Values.OpenServiceMesh.image.tag -}}
76+
{{- end -}}
77+
{{- end -}}
78+
79+
{{/* osm-crds image */}}
80+
{{- define "osmCRDs.image" -}}
81+
{{- if .Values.OpenServiceMesh.image.digest.osmCRDs -}}
82+
{{- printf "%s/osm-crds@%s" .Values.OpenServiceMesh.image.registry .Values.OpenServiceMesh.image.digest.osmCRDs -}}
83+
{{- else -}}
84+
{{- printf "%s/osm-crds:%s" .Values.OpenServiceMesh.image.registry .Values.OpenServiceMesh.image.tag -}}
85+
{{- end -}}
4186
{{- end -}}

‎charts/osm/templates/cleanup-hook.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ spec:
128128
restartPolicy: Never
129129
containers:
130130
- name: garbage-collector
131-
image: "{{ .Values.OpenServiceMesh.image.registry }}/osm-crds:{{ .Values.OpenServiceMesh.image.tag }}"
131+
image: "{{ include "osmCRDs.image" . }}"
132132
imagePullPolicy: {{ .Values.OpenServiceMesh.image.pullPolicy }}
133133
command:
134134
- sh

‎charts/osm/templates/osm-bootstrap-deployment.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,15 +33,15 @@ spec:
3333
kubernetes.io/os: linux
3434
initContainers:
3535
- name: init-osm-bootstrap
36-
image: "{{ .Values.OpenServiceMesh.image.registry }}/osm-crds:{{ .Values.OpenServiceMesh.image.tag }}"
36+
image: "{{ include "osmBootstrap.image" . }}"
3737
imagePullPolicy: {{ .Values.OpenServiceMesh.image.pullPolicy }}
3838
args:
3939
- apply
4040
- -f
4141
- /osm-crds
4242
containers:
4343
- name: osm-bootstrap
44-
image: "{{ .Values.OpenServiceMesh.image.registry }}/osm-bootstrap:{{ .Values.OpenServiceMesh.image.tag }}"
44+
image: "{{ include "osmBootstrap.image" . }}"
4545
imagePullPolicy: {{ .Values.OpenServiceMesh.image.pullPolicy }}
4646
ports:
4747
- name: "tls"

‎charts/osm/templates/osm-deployment.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ spec:
4747
done
4848
containers:
4949
- name: osm-controller
50-
image: "{{ .Values.OpenServiceMesh.image.registry }}/osm-controller:{{ .Values.OpenServiceMesh.image.tag }}"
50+
image: "{{ include "osmController.image" . }}"
5151
imagePullPolicy: {{ .Values.OpenServiceMesh.image.pullPolicy }}
5252
ports:
5353
- name: "admin-port"

‎charts/osm/templates/osm-injector-deployment.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ spec:
4646
done
4747
containers:
4848
- name: osm-injector
49-
image: "{{ .Values.OpenServiceMesh.image.registry }}/osm-injector:{{ .Values.OpenServiceMesh.image.tag }}"
49+
image: "{{ include "osmInjector.image" . }}"
5050
imagePullPolicy: {{ .Values.OpenServiceMesh.image.pullPolicy }}
5151
ports:
5252
- name: "sidecar-inject"

‎charts/osm/templates/preset-mesh-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ data:
1212
"maxDataPlaneConnections": {{.Values.OpenServiceMesh.maxDataPlaneConnections}},
1313
"envoyImage": "{{.Values.OpenServiceMesh.sidecarImage}}",
1414
"envoyWindowsImage": "{{.Values.OpenServiceMesh.sidecarWindowsImage}}",
15-
"initContainerImage": "{{ .Values.OpenServiceMesh.image.registry }}/init:{{ .Values.OpenServiceMesh.image.tag }}",
15+
"initContainerImage": "{{ include "osmSidecarInit.image" . }}",
1616
"configResyncInterval": "{{.Values.OpenServiceMesh.configResyncInterval}}"
1717
},
1818
"traffic": {

‎charts/osm/values.schema.json

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,8 @@
215215
"required": [
216216
"registry",
217217
"pullPolicy",
218-
"tag"
218+
"tag",
219+
"digest"
219220
],
220221
"properties": {
221222
"registry": {
@@ -245,6 +246,51 @@
245246
"examples": [
246247
"v0.4.2"
247248
]
249+
},
250+
"digest": {
251+
"$id": "#/properties/OpenServiceMesh/properties/image/properties/digest",
252+
"type": "object",
253+
"title": "Default image digests",
254+
"description": "Default image digests for control plane.",
255+
"required": [
256+
"osmController",
257+
"osmInjector",
258+
"osmSidecarInit",
259+
"osmCRDs",
260+
"osmBootstrap"
261+
],
262+
"properties": {
263+
"osmController": {
264+
"$id": "#/properties/OpenServiceMesh/properties/image/properties/digest/properties/osmController",
265+
"type": "string",
266+
"title": "osm-controller's image digest",
267+
"description": "osm-controller container's image digest."
268+
},
269+
"osmInjector": {
270+
"$id": "#/properties/OpenServiceMesh/properties/image/properties/digest/properties/osmInjector",
271+
"type": "string",
272+
"title": "osm-injector's image digest",
273+
"description": "osm-injector container's image digest."
274+
},
275+
"osmSidecarInit": {
276+
"$id": "#/properties/OpenServiceMesh/properties/image/properties/digest/properties/osmSidecarInit",
277+
"type": "string",
278+
"title": "osm-osmSidecarInit's image digest",
279+
"description": "osm-osmSidecarInit container's image digest."
280+
},
281+
"osmCRDs": {
282+
"$id": "#/properties/OpenServiceMesh/properties/image/properties/digest/properties/osmCRDs",
283+
"type": "string",
284+
"title": "osm-crds' image digest",
285+
"description": "osm-crds container's image digest."
286+
},
287+
"osmBootstrap": {
288+
"$id": "#/properties/OpenServiceMesh/properties/image/properties/digest/properties/osmBootstrap",
289+
"type": "string",
290+
"title": "osm-boostrap's image digest",
291+
"description": "osm-bootstrap container's image digest."
292+
}
293+
}
248294
}
249295
},
250296
"additionalProperties": false

‎charts/osm/values.yaml

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,25 @@ OpenServiceMesh:
77
#
88
# -- OSM control plane image parameters
99
image:
10-
# -- Container image registry
10+
# -- Container image registry for control plane images
1111
registry: openservicemesh
12-
# -- Container image pull policy
12+
# -- Container image pull policy for control plane containers
1313
pullPolicy: IfNotPresent
14-
# -- Container image tag
15-
tag: v0.9.2
14+
# -- Container image tag for control plane images
15+
tag: "latest-main"
16+
# -- Image digest (defaults to latest compatible tag)
17+
digest:
18+
# -- osm-controller's image digest
19+
osmController: ""
20+
# -- osm-injector's image digest
21+
osmInjector: ""
22+
# -- Sidecar init container's image digest
23+
osmSidecarInit: ""
24+
# -- osm-crds' image digest
25+
osmCRDs: ""
26+
# -- osm-boostrap's image digest
27+
osmBootstrap: ""
28+
1629

1730
# -- `osm-controller` image pull secret
1831
imagePullSecrets: []

‎cmd/cli/mesh_upgrade.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import (
1515

1616
const (
1717
defaultContainerRegistry = "openservicemesh"
18-
defaultOsmImageTag = "v0.9.2"
18+
defaultOsmImageTag = "latest-main"
1919
)
2020

2121
const upgradeDesc = `

‎cmd/osm-bootstrap/osm-bootstrap_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ func TestCreateDefaultMeshConfig(t *testing.T) {
2626
"logLevel": "error",
2727
"maxDataPlaneConnections": 0,
2828
"envoyImage": "envoyproxy/envoy-alpine@sha256:6502a637c6c5fba4d03d0672d878d12da4bcc7a0d0fb3f1d506982dde0039abd",
29-
"initContainerImage": "openservicemesh/init:v0.9.2",
29+
"initContainerImage": "openservicemesh/init:latest-main",
3030
"configResyncInterval": "2s"
3131
},
3232
"traffic": {

‎docs/example/manifests/apps/bookbuyer.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ spec:
3131
kubernetes.io/os: linux
3232
containers:
3333
- name: bookbuyer
34-
image: openservicemesh/bookbuyer:v0.9.2
34+
image: openservicemesh/bookbuyer:latest-main
3535
imagePullPolicy: Always
3636
command: ["/bookbuyer"]
3737
env:

‎docs/example/manifests/apps/bookstore-v2.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ spec:
4646
kubernetes.io/os: linux
4747
containers:
4848
- name: bookstore
49-
image: openservicemesh/bookstore:v0.9.2
49+
image: openservicemesh/bookstore:latest-main
5050
imagePullPolicy: Always
5151
ports:
5252
- containerPort: 14001

0 commit comments

Comments
 (0)