[WireGuard] Seeking Ubuntu PPA Maintainer

[WireGuard] Seeking Ubuntu PPA Maintainer

[Jason A. Donenfeld]

Hey folks,

Looks like there are various Ubuntu PPAs for WireGuard floating
around. I'd like to officially endorse one on the install section of
the website. Is anybody interested in being the Ubuntu downstream for
WireGuard?

Thanks,
Jason

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Egbert Verhage]

[-- Attachment #1: Type: text/plain, Size: 1932 bytes --]

On 2016-11-15 21:44, Jason A. Donenfeld wrote:
> Hey folks,
>
> Looks like there are various Ubuntu PPAs for WireGuard floating
> around. I'd like to officially endorse one on the install section of
> the website. Is anybody interested in being the Ubuntu downstream for
> WireGuard?
>
> Thanks,
> Jason
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> http://lists.zx2c4.com/mailman/listinfo/wireguard

Hey Jason,

I'm trying to maintain one now, but it is my first one and trying to
keep it up to date.
https://launchpad.net/~eggiecode/+archive/ubuntu/wireguard

Testing it constantly on 4 of my servers and works it great!
Even added a patch for ifupdown to setup WireGuard in
/etc/network/interfaces

The only downside is that I disabled AVX2 cpu extention in the code,
because of kernel panics on VPS's by a hosting company
(https://eggiecode.org/wg-kernel-panic.png).

Greetz,
Egbert Verhage

Below example config of wireguard in network/interfaces

iface wg0 inet wireguard
        netmask 255.255.255.0
        address 192.168.2.254
        wg_config /etc/network/wg0.ini

        up ip -4 route add 10.20.1.0/24 dev wg0
        pre-down ip -4 route del 10.20.1.0/24 dev wg0
        up ip -4 route add 10.20.3.0/24 dev wg0
        pre-down ip -4 route del 10.20.3.0/24 dev wg0
        up ip -4 route add 10.20.2.0/24 dev wg0
        pre-down ip -4 route del 10.20.2.0/24 dev wg0

iface wg0 inet6 wireguard
        netmask 64
        address fd4a:2831:fc20:f528:fe::1

        up ip -6 route add 2001:41d0:2:5c39::/64 dev wg0
        pre-down ip -6 route del 2001:41d0:2:5c39::/64 dev wg0
        up ip -6 route add 2a00:f10:700:5f::/60 dev wg0
        pre-down ip -6 route del 2a00:f10:700:5f::/60 dev wg0
        up ip -6 route add 2001:41d0:d:2a83::/64 dev wg0
        pre-down ip -6 route del 2001:41d0:d:2a83::/64 dev wg0

(Forgot to send it to the mailinglist.)


[-- Attachment #2: Type: text/html, Size: 2639 bytes --]

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Jason A. Donenfeld]

Hey Egbert,

Great to see! How much does this deviate from debian's? As far as I
can tell, you should be able to keep things basically the same.


> Testing it constantly on 4 of my servers and works it great!
Happy to hear that.

> Even added a patch for ifupdown to setup WireGuard in
> /etc/network/interfaces
Cool!


> The only downside is that I disabled AVX2 cpu extention in the code,
> because of kernel panics on VPS's by a hosting company
> (https://eggiecode.org/wg-kernel-panic.png).

This isn't okay. Downstream packages really shouldn't be applying
patches like that. If you revert that, I can list this as the primary
PPA for WireGuard. With that said, let's actually try to fix this
issue for good...

AVX2 is advertised through CPUID. Is it possible that your VPS passes
through the CPUID from the host while not supporting all instructions?
Or perhaps, rather, fakes a CPUID that isn't the host's, while only
supporting instructions of the host? Very mysterious. What hosting
company is this? Is there a chance I can poke around at this setup? Do
you know if it's KVM or Xen or VMWare or something else?

If it turns out that your VPS host just does something horrible, I'll
look for a way to globally disable kernel usage of AVX2, without
having to patch WireGuard like that. If it's particular to the host,
perhaps we can come up with either a particular kernel module to do
the disabling, or some ungodly hack to /dev/kmem... Are you compiling
your own kernel for this system, or just using stock Ubuntu kernel?

I'm pretty sure, by the way, that we're using the right detection
function within WireGuard, seeing as every other place in the tree
uses the same thing: https://paste.kde.org/pdljfawf7/79eh62 .

Thanks a bunch for helping out.

Jason

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Egbert Verhage]

[-- Attachment #1: Type: text/plain, Size: 2628 bytes --]

On 2016-11-16 01:12, Jason A. Donenfeld wrote:
> Hey Egbert,
>
> Great to see! How much does this deviate from debian's? As far as I
> can tell, you should be able to keep things basically the same.
I just copyed the debian folder of the experimental package of the
debian repo.
Left all the copyrights intact and added my name.
> This isn't okay. Downstream packages really shouldn't be applying
> patches like that. If you revert that, I can list this as the primary
> PPA for WireGuard. With that said, let's actually try to fix this
> issue for good...
Can't agree more, but I wanted to test it and deploy it with ansible,
that was the simplest solution.
> AVX2 is advertised through CPUID. Is it possible that your VPS passes
> through the CPUID from the host while not supporting all instructions?
> Or perhaps, rather, fakes a CPUID that isn't the host's, while only
> supporting instructions of the host? Very mysterious. What hosting
> company is this? Is there a chance I can poke around at this setup? Do
> you know if it's KVM or Xen or VMWare or something else?
It is hosted at PCexterme, dutch company. Cheap and good service. The
use KVM with CloudStack on top of it.
I mailed/called with one of the sys admins and discussed with him about
the problem in the AVX2 extention.
He told me that they disabled AVX already because of the raid 6 system.
It crashes the whole KVM host.

Can give you a vps if you want to. Just 3 euro the month.
> If it turns out that your VPS host just does something horrible, I'll
> look for a way to globally disable kernel usage of AVX2, without
> having to patch WireGuard like that.
If I can found the kernel parmameter for that, I will.
> If it's particular to the host,
> perhaps we can come up with either a particular kernel module to do
> the disabling, or some ungodly hack to /dev/kmem...
You are going above my intellect of the kernel at this point.
>  Are you compiling
> your own kernel for this system, or just using stock Ubuntu kernel?
No not yet. I was planning on this email to tell your my ppa / kernel
problem.
> I'm pretty sure, by the way, that we're using the right detection
> function within WireGuard, seeing as every other place in the tree
> uses the same thing: 		
* lib/raid6/avx2.c
* 36:     return boot_cpu_has(X86_FEATURE_AVX2) &&
boot_cpu_has(X86_FEATURE_AVX);
I think I'm going to mail/call the hosting company again.
> Thanks a bunch for helping out.
You to with this great this VPN.
> Jason
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> http://lists.zx2c4.com/mailman/listinfo/wireguard


[-- Attachment #2: Type: text/html, Size: 4742 bytes --]

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Jason A. Donenfeld]

[-- Attachment #1: Type: text/plain, Size: 819 bytes --]

Hey Egbert,

On Wed, Nov 16, 2016 at 1:34 AM, Egbert Verhage <egbert@eggiecode.org> wrote:
> I mailed/called with one of the sys admins and discussed with him about the
> problem in the AVX2 extention.
> I think I'm going to mail/call the hosting company again.

It seems like the crux of the issue is that if they disable AVX2
instructions, they need to make this known in the CPUID. Otherwise the
operating system will assume it's there when it isn't.

> Can give you a vps if you want to. Just 3 euro the month.

See the attached tarball. Compile the kernel module in there and load
it BEFORE WireGuard. You might have to manually unload wireguard for
this to work: "rmmod wireguard && insmod ./avx2disabler.ko && modprobe
wireguard", for example. It should disable avx2 inside the kernel,
solving the issue.

Jason

[-- Attachment #2: avx2disabler.tar.xz --]
[-- Type: application/x-xz, Size: 700 bytes --]

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Dan Luedtke]

Hi Egbert,

thank you for maintaining the PPA. I am using it and it works great on my se=
rvers. I wish the version bumps would happen more often as long as the code i=
s experimental. Testing "old" code does not make too much sense (I think we m=
ailed a couple of days ago about that). Other from that I strongly support E=
gbert's PPA becoming the official one. Had no problems so far and I like the=
 test setup.

Cheers,

Dan

> On 16 Nov 2016, at 02:31, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
>=20
> Hey Egbert,
>=20
>> On Wed, Nov 16, 2016 at 1:34 AM, Egbert Verhage <egbert@eggiecode.org> wr=
ote:
>> I mailed/called with one of the sys admins and discussed with him about t=
he
>> problem in the AVX2 extention.
>> I think I'm going to mail/call the hosting company again.
>=20
> It seems like the crux of the issue is that if they disable AVX2
> instructions, they need to make this known in the CPUID. Otherwise the
> operating system will assume it's there when it isn't.
>=20
>> Can give you a vps if you want to. Just 3 euro the month.
>=20
> See the attached tarball. Compile the kernel module in there and load
> it BEFORE WireGuard. You might have to manually unload wireguard for
> this to work: "rmmod wireguard && insmod ./avx2disabler.ko && modprobe
> wireguard", for example. It should disable avx2 inside the kernel,
> solving the issue.
>=20
> Jason
> <avx2disabler.tar.xz>
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> http://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Daniel Kahn Gillmor]

[-- Attachment #1: Type: text/plain, Size: 719 bytes --]

Hi Egbert--

On Wed 2016-11-16 09:34:12 +0900, Egbert Verhage wrote:
> I just copyed the debian folder of the experimental package of the
> debian repo.

I'm the package maintainer in debian.  Glad to hear that my packaging
work has been useful for you.

If you're tracking the debian packaging, you might also be interested in
the revision control history of it:

    git clone https://anonscm.debian.org/git/collab-maint/wireguard.git

If you find that there are specific changes to the debian packaging that
you find useful when packaging for ubuntu, i'd be happy to hear about
them.  Also, if you run into packaging difficulties and want someone to
brainstorm with, feel free to reach out.

Regards,

        --dkg

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 962 bytes --]

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Egbert Verhage]

Hey Jason,

The kernel module worked for my. ([1020751.674357] AVX2 disabler loaded:
1 -> 0)
Going to update the PPA to remove my disable of AVX2.

The problem is that the hosting company hides the cpuuid, but from the
call with the sysadmin it is a XEON E5-2??? v3.

Greetz,
Egbert


On 2016-11-16 02:31, Jason A. Donenfeld wrote:
> Hey Egbert,
>
> On Wed, Nov 16, 2016 at 1:34 AM, Egbert Verhage <egbert@eggiecode.org> wrote:
>> I mailed/called with one of the sys admins and discussed with him about the
>> problem in the AVX2 extention.
>> I think I'm going to mail/call the hosting company again.
> It seems like the crux of the issue is that if they disable AVX2
> instructions, they need to make this known in the CPUID. Otherwise the
> operating system will assume it's there when it isn't.
>
>> Can give you a vps if you want to. Just 3 euro the month.
> See the attached tarball. Compile the kernel module in there and load
> it BEFORE WireGuard. You might have to manually unload wireguard for
> this to work: "rmmod wireguard && insmod ./avx2disabler.ko && modprobe
> wireguard", for example. It should disable avx2 inside the kernel,
> solving the issue.
>
> Jason

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Egbert Verhage]

[-- Attachment #1: Type: text/plain, Size: 1097 bytes --]

Hey Deniel,

Thank your for the support.

I was search for the git repo of the debian package, thank you for the link.
Besides that only difference between ours repo's is that I use a 
submodule for the wireguard source.

Git repo: https://git.launchpad.net/wireguard?h=master

Greetz,
Egbert

On 2016-11-16 07:45, Daniel Kahn Gillmor wrote:
> Hi Egbert--
>
> On Wed 2016-11-16 09:34:12 +0900, Egbert Verhage wrote:
>> I just copyed the debian folder of the experimental package of the
>> debian repo.
> I'm the package maintainer in debian.  Glad to hear that my packaging
> work has been useful for you.
>
> If you're tracking the debian packaging, you might also be interested in
> the revision control history of it:
>
>      git clone https://anonscm.debian.org/git/collab-maint/wireguard.git
>
> If you find that there are specific changes to the debian packaging that
> you find useful when packaging for ubuntu, i'd be happy to hear about
> them.  Also, if you run into packaging difficulties and want someone to
> brainstorm with, feel free to reach out.
>
> Regards,
>
>          --dkg


[-- Attachment #2: Type: text/html, Size: 2018 bytes --]

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Egbert Verhage]

Hey Dan,

Thank you for the support, and I will try to keep it up to date. I just 
launched a patch to remove the AVX2 hard disable.
But I never received / send a email to you.

Greetz,

Egbert


On 2016-11-16 07:20, Dan Luedtke wrote:
> Hi Egbert,
>
> thank you for maintaining the PPA. I am using it and it works great on my servers. I wish the version bumps would happen more often as long as the code is experimental. Testing "old" code does not make too much sense (I think we mailed a couple of days ago about that). Other from that I strongly support Egbert's PPA becoming the official one. Had no problems so far and I like the test setup.
>
> Cheers,
>
> Dan
>
>> On 16 Nov 2016, at 02:31, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
>>
>> Hey Egbert,
>>
>>> On Wed, Nov 16, 2016 at 1:34 AM, Egbert Verhage <egbert@eggiecode.org> wrote:
>>> I mailed/called with one of the sys admins and discussed with him about the
>>> problem in the AVX2 extention.
>>> I think I'm going to mail/call the hosting company again.
>> It seems like the crux of the issue is that if they disable AVX2
>> instructions, they need to make this known in the CPUID. Otherwise the
>> operating system will assume it's there when it isn't.
>>
>>> Can give you a vps if you want to. Just 3 euro the month.
>> See the attached tarball. Compile the kernel module in there and load
>> it BEFORE WireGuard. You might have to manually unload wireguard for
>> this to work: "rmmod wireguard && insmod ./avx2disabler.ko && modprobe
>> wireguard", for example. It should disable avx2 inside the kernel,
>> solving the issue.
>>
>> Jason
>> <avx2disabler.tar.xz>
>> _______________________________________________
>> WireGuard mailing list
>> WireGuard@lists.zx2c4.com
>> http://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Dan Lüdtke]

> But I never received / send a email to you.

You are right. I was talking to other PPA maintainers as well.
Nevertheless, I user your repo on my servers since it was the one that =
worked the best.

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Jason A. Donenfeld]

On Wed, Nov 16, 2016 at 12:34 PM, Dan L=C3=BCdtke <mail@danrl.com> wrote:
>
>> But I never received / send a email to you.
>
> You are right. I was talking to other PPA maintainers as well.
> Nevertheless, I user your repo on my servers since it was the one that wo=
rked the best.

Can you loop these other PPA people in on this thread. Let's all
consolidate around Egbert's one PPA. He can decide to allow
co-maintainers if he wants.

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Jason A. Donenfeld]

Hi Egbert,

On Wed, Nov 16, 2016 at 11:03 AM, Egbert Verhage <egbert@eggiecode.org> wrote:
> Going to update the PPA to remove my disable of AVX2.

Good. Can you remove this garbage immediately:
https://git.launchpad.net/wireguard/tree/debian/patches/update-hard-disable-patch-to-upstream
https://git.launchpad.net/wireguard/tree/debian/patches/0001-disable-hard-avx2

There are two principles I would like to see adamantly applied before
I'll endorse this PPA:

1. Stay as close to vanilla upstream snapshots as possible. Do not
have patches that differ from Debian's too much. If you need changes,
consult the very active and very willing upstream instead.
2. Only package snapshots. Do not choose your own git commits.

Are these two things you're willing to do?

Thanks,
Jason

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Jason A. Donenfeld]

Hello Eugene & Egbert,

You too both maintain Ubuntu PPAs. Could you decide some way of
consolidating your efforts? Egbert heeded to the call for help first,
so if it comes down to choosing a repository, choosing his would be
most fair. But you can work it out amongst yourselves.

Thanks,
Jason

On Tue, Nov 15, 2016 at 9:44 PM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> Hey folks,
>
> Looks like there are various Ubuntu PPAs for WireGuard floating
> around. I'd like to officially endorse one on the install section of
> the website. Is anybody interested in being the Ubuntu downstream for
> WireGuard?
>
> Thanks,
> Jason

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Egbert Verhage]

Hey Jason,

On 2016-11-16 15:04, Jason A. Donenfeld wrote:
> Can you loop these other PPA people in on this thread. Let's all
> consolidate around Egbert's one PPA. He can decide to allow
> co-maintainers if he wants.
>
Yes. If some one wants to co-maintain with me, send me an email.

On 2016-11-16 15:09, Jason A. Donenfeld wrote:
> On Wed, Nov 16, 2016 at 11:03 AM, Egbert Verhage <egbert@eggiecode.org> wrote:
>> Going to update the PPA to remove my disable of AVX2.
> Good. Can you remove this garbage immediately:
> https://git.launchpad.net/wireguard/tree/debian/patches/update-hard-disable-patch-to-upstream
> https://git.launchpad.net/wireguard/tree/debian/patches/0001-disable-hard-avx2
Done: 
https://git.launchpad.net/wireguard/commit/?id=f69e7e6f6eb9c34d7fcd364c10f5a792fc63e3b2 

> There are two principles I would like to see adamantly applied before
> I'll endorse this PPA:
>
> 1. Stay as close to vanilla upstream snapshots as possible. Do not
> have patches that differ from Debian's too much. If you need changes,
> consult the very active and very willing upstream instead.
Ofc. Source (wireguard-src in git) is a submodule of the last taged 
experimental
> 2. Only package snapshots. Do not choose your own git commits.
>
> Are these two things you're willing to do?
Yes!

Greetz,
Egbert

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Jason A. Donenfeld]

Hey Egbert, Daniel,

On Wed, Nov 16, 2016 at 12:10 PM, Egbert Verhage <egbert@eggiecode.org> wrote:
> Git repo: https://git.launchpad.net/wireguard?h=master

Is there a good machine readable URL that I can check for getting the
latest package version?

For Debian I currently use this cludge, which is totally wrong and terrible:
curl -s https://anonscm.debian.org/git/collab-maint/wireguard.git/refs/
| sed -n 's/.*debian\/\([^ ]*\)-experimental[0-9]\+.*/\1/p' | head -n
1

Thanks,
Jason

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Jason A. Donenfeld]

Hey Egbert,

On Wed, Nov 16, 2016 at 3:22 PM, Egbert Verhage <egbert@eggiecode.org> wrote:
> Hey Jason,
> Ofc. Source (wireguard-src in git) is a submodule of the last taged
> experimental

Oh, awesome. Git submodules for the win!

Jason

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Daniel Kahn Gillmor]

[-- Attachment #1: Type: text/plain, Size: 749 bytes --]

On Wed 2016-11-16 23:24:35 +0900, Jason A. Donenfeld wrote:
> Hey Egbert, Daniel,
>
> On Wed, Nov 16, 2016 at 12:10 PM, Egbert Verhage <egbert@eggiecode.org> wrote:
>> Git repo: https://git.launchpad.net/wireguard?h=master
>
> Is there a good machine readable URL that I can check for getting the
> latest package version?
>
> For Debian I currently use this cludge, which is totally wrong and terrible:
> curl -s https://anonscm.debian.org/git/collab-maint/wireguard.git/refs/
> | sed -n 's/.*debian\/\([^ ]*\)-experimental[0-9]\+.*/\1/p' | head -n
> 1

for debian, you could use:

   rmadison wireguard

if you don't have rmadison installed, you can inspect the content here:

   https://qa.debian.org/madison.php?package=wireguard

        --dkg

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 962 bytes --]

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Jason A. Donenfeld]

Hey Daniel,

On Wed, Nov 16, 2016 at 11:17 PM, Daniel Kahn Gillmor
<dkg@fifthhorseman.net> wrote:
>    https://qa.debian.org/madison.php?package=wireguard

Perfect, thanks. I wound up using:
https://qa.debian.org/madison.php?package=wireguard&table=debian&a=&c=&g=on&s=&text=on
And then I just match on the capture group in:
    >= ([0-9.]+)-experimental[0-9]+

Jason

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Egbert Verhage]

On 2016-11-16 16:00, Jason A. Donenfeld wrote:
> On Wed, Nov 16, 2016 at 3:37 PM, Anonymous Anonymous <admin@hda.me> wrote:
>> Btw, as for jabber Jason, seems like I need to search for new tor gateway,
>> thats why I disconnected.
> Sounds sketchy. Egbert - take the lead, you're the boss, no obligation
> to work with sketchorama if you find this weird too.
Ok, can get that.
PPA under the group wireguard: 
https://launchpad.net/~wireguard/+archive/ubuntu/wireguard
Or my one: https://launchpad.net/~eggiecode/+archive/ubuntu/wireguard
GIT: https://code.launchpad.net/~eggiecode/wireguard/+git/wireguard

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Jason A. Donenfeld]

On Wed, Nov 16, 2016 at 3:37 PM, Anonymous Anonymous <admin@hda.me> wrote:
> Btw, as for jabber Jason, seems like I need to search for new tor gateway,
> thats why I disconnected.

Sounds sketchy. Egbert - take the lead, you're the boss, no obligation
to work with sketchorama if you find this weird too.

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Anonymous Anonymous]

[-- Attachment #1: Type: text/plain, Size: 686 bytes --]

>You too both maintain Ubuntu PPAs. 
>Could you decide some way of consolidating your efforts? Egbert heeded to the call for help first, so if it comes down to choosing a repository, choosing his would be most fair. But you can work it out amongst yourselves.
I could join Egbert. We could create group on launchpad, I can give publishing permission to current hda PPA, or join Egbert's. Not a big difference for me.
Egbert pls contact me privately about that, basically I need to know you idea about PPA. Do we need group on launchpad? What PPA you want us to use and etc.
Btw, as for jabber Jason, seems like I need to search for new tor gateway, thats why I disconnected.






[-- Attachment #2: Type: text/html, Size: 1069 bytes --]

Re: [WireGuard] Seeking Ubuntu PPA Maintainer

[Anonymous Anonymous]

[-- Attachment #1: Type: text/plain, Size: 691 bytes --]

>You too both maintain Ubuntu PPAs. Could you decide some way of >consolidating your efforts? Egbert heeded to the call for help first, >so if it comes down to choosing a repository, choosing his would be >most fair. But you can work it out amongst yourselves.
I could join Egbert. We could create group on launchpad, I can give publishing permission to current hda PPA, or join Egbert's. Not a big difference for me.
Egbert pls contact me privately about that, basically I need to know you idea about PPA. Do we need group on launchpad? What PPA you want us to use and etc.
Btw, as for jabber Jason, seems like I need to search for new tor gateway, thats why I disconnected.




[-- Attachment #2: Type: text/html, Size: 970 bytes --]