Merge pull request #97 from TheTorProject/release/lepidopter-1.0.0-rc.0

Prepare release: lepidopter 1.0.0-rc.0

ChangeLog.md

@@ -1,3 +1,24 @@
+Lepidopter v1.0.0 [2017-05-05]
+-------------------------------
+
+This release version includes ooniprobe version 2.2.0.
+
+- Add bootloader configuration file
+- Adjust to the minimum GPG memory possible (16M) #49
+- Add support for hardware RNG #96
+- Verbose heartbeat-like LED activity
+- Change MOTD color prompt
+- Password-less operation for the sudo group
+- Ship ooniprobe version 2.2.0
+- Do not store folders in the zip image archive #93
+- Add a persistent directory (/persistent-data)
+- Remove older obfsproxy package
+- Add packages: OpenVPN, rng-tools, watchdog
+- Fix active meek tor bridges
+- Set mount option noatime
+- Reduce GPU memory to 32M (was 64M)
+- Pin txtorcon package version to 0.18.0
+
 Lepidopter v0.3.5-beta [2016-10-16]
 ------------------------------------
 

README.md

@@ -25,7 +25,10 @@ User documentation and detailed image installation instructions can be found
 ├── customize       customize script used to customize lepidopter image
 ├── images          where the build Lepidopter images created
 ├── lepidopter-fh   Lepidopter image filesystem hierarchy
+│   ├── boot
+│   │   └── config.txt
 │   ├── cleanup.sh  cleanup script
+│   ├── configure.sh
 │   ├── etc
 │   │   ├── apt
 │   │   │   └── apt.conf.d
@@ -52,28 +55,49 @@ User documentation and detailed image installation instructions can be found
 │   │   │   ├── lepidopter-update
 │   │   │   └── ooniprobe
 │   │   ├── motd.head                           Lepidopter MOTD ASCII logo
-│   │   ├── network
-│   │   │   └── if-up.d
-│   │   │       └── run_oonideckgen
 │   │   ├── ooniprobe
 │   │   │   └── ooniconfig.sh
 │   │   ├── ooniprobe.conf
+│   │   ├── sudoers
 │   │   ├── systemd
 │   │   │   └── system
 │   │   │       ├── lepidopter-update.service
 │   │   │       └── ooniprobe.service
-│   │   └── update-motd.d
-│   │       └── 50-lepidopter
+│   │   ├── update-motd.d
+│   │   │   └── 50-lepidopter
+│   │   └── watchdog.conf
 │   ├── opt
 │   │   └── ooni
 │   │       ├── lepidopter-update
 │   │       │   ├── public.asc
 │   │       │   ├── updater.py
 │   │       │   └── versions
+│   │       │       ├── update-1.py
+│   │       │       ├── update-1.py.asc
+│   │       │       ├── update-2.py
+│   │       │       ├── update-2.py.asc
+│   │       │       ├── update-3.py
+│   │       │       ├── update-3.py.asc
+│   │       │       ├── update-4.py
+│   │       │       ├── update-4.py.asc
+│   │       │       ├── update-5.py
+│   │       │       ├── update-5.py.asc
+│   │       │       ├── update-6.py
+│   │       │       ├── update-6.py.asc
+│   │       │       ├── update-7.py
+│   │       │       └── update-7.py.asc
 │   │       └── tor_data_dir
+│   ├── persistent-data
 │   ├── remove_ssh_host_keys.sh
 │   ├── setup-ooniprobe.sh
+│   ├── usr
+│   │   └── share
+│   │       └── ooni
+│   │           └── decks-available
 │   └── var
+│       ├── lib
+│       │   └── ooni
+│       │       └── decks-enabled
 │       └── log
 │           └── ooni
 ├── lepidopter-vmdebootstrap_build.sh   main lepidopter vmdebootstrap script

conf/lepidopter-image.conf

@@ -7,3 +7,7 @@ APT_MIRROR="http://httpredir.debian.org/debian"
 # Uncomment next line to use apt-cacher-ng
 #MIRROR="http://localhost:3142/debian"
 MIRROR="http://httpredir.debian.org/debian"
+VERSION_FILE="lepidopter-fh/etc/lepidopter_version"
+LEPIDOPTER_UPDATE_PATH="lepidopter-fh/opt/ooni/lepidopter-update/"
+UPDATE_VERSION_FILE="lepidopter-fh/etc/lepidopter-update/version"
+LEPIDOPTER_UPDATE_GIT="https://github.com/OpenObservatory/lepidopter-update"

conf/tor-pt.conf

@@ -1,5 +1,5 @@
 # Uncomment the following 4 lines to connect via meek pluggable transport in tor
 #UseBridges 1
 #Bridge meek_lite 0.0.2.0:1 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com
-#Bridge meek_lite 0.0.2.0:2 url=https://az786092.vo.msecnd.net/ front=ajax.aspnetcdn.com
+#Bridge meek_lite 0.0.2.0:2 url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com
 #ClientTransportPlugin meek_lite exec /usr/bin/obfs4proxy

customize

@@ -23,11 +23,6 @@ wget --directory-prefix=${ROOTDIR}/lib/firmware/brcm/ \
 https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm80211/brcm/brcmfmac43430-sdio.bin \
 https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm80211/brcm/brcmfmac43430-sdio.txt
 
-# Add module for hardware RNG
-cat <<EOF >> ${ROOTDIR}/etc/modules
-bcm2708_rng
-EOF
-
 # Add an apt repository with apt preferences
 set_apt_sources() {
     SUITE="$1"
@@ -82,5 +77,11 @@ chroot ${ROOTDIR} ln -s /var/run/motd /etc/motd
 # Add (optional) pluggable transport support in tor config
 cat conf/tor-pt.conf >> ${ROOTDIR}/etc/tor/torrc
 
+# Get list of apt and Python packages from lepidopter image
+rsync -av --no-R --no-implied-dirs --remove-source-files \
+${ROOTDIR}/lepidopter-apt-packages pkglist/lepidopter-${LEPIDOPTER_BUILD}-${ARCH}-apt-packages
+rsync -av --no-R --no-implied-dirs --remove-source-files \
+${ROOTDIR}/lepidopter-pip-packages pkglist/lepidopter-${LEPIDOPTER_BUILD}-${ARCH}-pip-packages
+
 echo "Customize script finished successfully."
 exit 0

lepidopter-fh/boot/config.txt

@@ -0,0 +1,8 @@
+# Minimal (with no vc_vchi_sm_init failure) GPU memory for headless mode
+gpu_mem=32
+# Enable the hardware watchdog
+dtparam=watchdog=on
+# Turn power LED into heartbeat
+dtparam=pwr_led_trigger=heartbeat
+# Enable the hardware random number generator (RNG)
+dtparam=random=on

lepidopter-fh/cleanup.sh

@@ -1,6 +1,10 @@
 #!/usr/bin/env bash
 set -ex
 
+# Generate list of installed apt and Python packages
+dpkg-query -W -f='${binary:Package} ${Version}\n' > /lepidopter-apt-packages
+pip freeze > /lepidopter-pip-packages
+
 # Clean up the local repository of retrieved package files
 apt-get clean
 apt-get autoclean

lepidopter-fh/configure.sh

@@ -7,4 +7,10 @@ cp /usr/share/zoneinfo/UTC /etc/localtime
 # Enable lepidopter-update systemd service
 systemctl enable lepidopter-update
 
+# Install newest e2fsprogs due to incompatibly with ext4 file system checks
+apt-get -y install -t jessie-backports e2fsprogs
+
+# Mount option noatime disables file access writes every time a file is read
+sed -i 's/\/ ext4/\/ ext4 defaults,noatime/' /etc/fstab
+
 history -c

lepidopter-fh/etc/lepidopter-update/version

@@ -1 +1 @@
-3
+8

lepidopter-fh/etc/lepidopter_version

@@ -1 +1 @@
-0.3.5-beta
+v1.0.0

lepidopter-fh/etc/motd.head

@@ -1,4 +1,4 @@
-@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@Oo@:@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@Oo@:@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 @@@@@@@@@@@@@@@@@@@@@@@@@@@8:::o8@@@@@Oc@@@@@@Oc:::@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 @@@@@@@@@@@@@@@@@@@@@@@@@@@:::o::::o@8O@o@8::::cc::c@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@ -10,7 +10,7 @@
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@8::::c:::C@:::c::::c@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@C::::::c@@@@8:::::::@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@OCO@@@@@@@@@@@@8CC8@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
-@@Co@@@@@@@@@@@@@@@@@@@@@@@@@:O@@@@@@O:@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+@@Co@@@@@@@@@@@@@@@@@@@@@@@@@:O@@@@@@O:@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 @@oc@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@O.@@@@@@@@@@@@@@@@@@@@oc@@@@@@@@@@@@@@@@@@@
 @@oc@@@@@@@O:coo:C@@:ccoo:o@@.O@O:coo::@@O.ooo:O@@:::oc:c@o::c8@c:co::O@c::::8@@
 @@oc@@@@@@8.@@@@@co@:C@@@@:C@:OO.@@@@O.@C:@@@@@cC@cc@@@@:c@oc@@::@@@@8:8C:O@@@@@

lepidopter-fh/etc/sudoers

@@ -0,0 +1,27 @@
+#
+# This file MUST be edited with the 'visudo' command as root.
+#
+# Please consider adding local content in /etc/sudoers.d/ instead of
+# directly modifying this file.
+#
+# See the man page for details on how to write a sudoers file.
+#
+Defaults	env_reset
+Defaults	mail_badpass
+Defaults	secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+# Host alias specification
+
+# User alias specification
+
+# Cmnd alias specification
+
+# User privilege specification
+root	ALL=(ALL:ALL) ALL
+
+# Allow members of group sudo to execute any command
+%sudo	ALL=(ALL:ALL) NOPASSWD: ALL
+
+# See sudoers(5) for more information on "#include" directives:
+
+#includedir /etc/sudoers.d

lepidopter-fh/etc/watchdog.conf

@@ -0,0 +1,45 @@
+#ping			= 172.31.14.1
+#ping			= 172.26.1.255
+#interface		= eth0
+#file			= /var/log/messages
+#change			= 1407
+
+# Uncomment to enable test. Setting one of these values to '0' disables it.
+# These values will hopefully never reboot your machine during normal use
+# (if your machine is really hung, the loadavg will go much higher than 25)
+#max-load-1		= 24
+#max-load-5		= 18
+#max-load-15		= 12
+
+# Note that this is the number of pages!
+# To get the real size, check how large the pagesize is on your machine.
+#min-memory		= 1
+#allocatable-memory	= 1
+
+#repair-binary		= /usr/sbin/repair
+#repair-timeout		= 
+#test-binary		= 
+#test-timeout		= 
+
+watchdog-device		= /dev/watchdog
+# Avoid cannot set timeout warning 
+watchdog-timeout	= 10
+
+# Defaults compiled into the binary
+#temperature-device	=
+#max-temperature	= 120
+
+# Defaults compiled into the binary
+#admin			= root
+interval		= 2
+#logtick                = 1
+#log-dir		= /var/log/watchdog
+
+# This greatly decreases the chance that watchdog won't be scheduled before
+# your machine is really loaded
+realtime		= yes
+priority		= 1
+
+# Check if rsyslogd is still running by enabling the following line
+#pidfile		= /var/run/rsyslogd.pid   
+

lepidopter-fh/opt/ooni/lepidopter-update/public.asc

@@ -1,5 +1,5 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
-Comment: GPGTools - https://gpgtools.org
+Comment: PGP
 
 mQINBFfEAKABEADNBPp2nD48xXRhMdKMVXS2qHgDzokSAn3hikA+cb2IL5ssde0o
 9HHzMxSNCbQBWo1bpmg84zsHvZTL+yEVGJ+o8DjLfdKKdMUOPsLTc0O1rqD0M6L4
@@ -13,40 +13,40 @@ e1+oI9rGxSf9m7UfAbudC+QATAlMDNeH2ngeqA0tm4vrMk/ybj5efeUjGNGNW0c8
 ra1fdEV4CK1Z0qKxbKCk/JTlD/9w/OqZQqyJLOrWXomYxR6I6lxNwhoC+3Ysj5EG
 Mmagpi+nnqAK0oIBkPytts9e6e1D54hS9sEG4uaEQRm229e0yhmQNQOKNwARAQAB
 tDZPT05JIHNvZnR3YXJlIHVwZGF0ZSBrZXkgPGNvbnRhY3RAb3Blbm9ic2VydmF0
-b3J5Lm9yZz6JAj0EEwEKACcFAlfEAKACGwMFCQHhM4AFCwkIBwMFFQoJCAsFFgID
-AQACHgECF4AACgkQw+zcBCBPnSm6ug//eVOV7RiG8q5ry64TvgeTNfPlVF0R3y3d
-2dUNaWy+4H0ay9UjW/ayxZNnSSreVZY+50pOiqsKWdV5bEgtOZXkDfth8NuCNddo
-CYmVkV/x2Mvmpf3eTBXlXtmFn9j2an3GKSSHFscdfdZsPATUUv+YFyX8LK5K6vq+
-BdNEGpqqHxPEM0wyQm2/f2s0dmjkmPFNZpCGWnuBRpQQD5O2YwFKK316VNdBXvVA
-i9+MA81vLtn40FsOKZ/kDLt65khEdgYTYj8lRXIEWGuWp1iPUuMmEL8dxtlY8K1R
-qU2JbgHHOA7RHnAUqgg0Hjmyg4ZsQ/ZyWi2/3IoLn/7QGeV0HBdiGMFuShSfkFWx
-bNNMuei9FVK4nwXRLcVfAMXv1GtqQU9jTeCYXzxgr81rkEivkdqlZ3Iins+KgWEQ
-SbEEYAXOWp/oheTBOBQvLSZi+2vjMiUeIQHQUDNfhlp3/Mk6RTVLMml6thIY/NyL
-f/vABO5V9oKAdIaFMu/70tYn8PxTqPE0uJ7FwcTa7awp10dkpXXk0tm5ywYsms8l
-CA/vizq7VMiZC9G4JvZqa3vXNBT1yFe+4Ri+fLtdZw9IDgECi5ZdQlp7dx2Rei2i
-S2XkUwWR4Qv3/WzvPDChr25BMlu0Pkb8MbynrxcMs5ODFxOuOiP2kL4YW2Qppo66
-U3Z92swhAIq5Ag0EV8QAoAEQAOQwsRo+2260kBYKnxRHr6rzTjStXtxsCsMUB08E
-XS7eTElwDSE2C+pfeQjFe366f1zNTxY/CN6wCtd7wI4cVXWKLescFfCUrsg+S0Wf
-ot85AXqCqrPKFtKwW8khUeVnQfmHwhQl1W+/t+bE2p4X+0OR8qugHsMnvYwl+KpK
-sZ094LwkO8GRySB+LKm6KQtJ+WOnsvs3X8v8fSA6GwJjYdtKqNUzPBLpw8RrIH9l
-eaT2pe9Ta48GqEwrU8wxwKyRBIfJJP/zq5n1rKcOBpvLZDVcyrVw+pIGa0zfmr/c
-qWYG7znx2Xq3i22d36xPkfkZEyVnQcCJJ28hkAfXRYpp+gMnL0Zt4u3GgzSARSBS
-VrcMyNlaft/aSOkojyjh3+2zF1PCfW1Nw9Sx50gdN3FfF0yEWjUoA1R/NW9CQZVG
-4qh/n2k508PYfZRuJ74T2jABFJIztv2pmq3VpSA7hkHGl3nXrdqpsw3V9bkFqZa/
-ihhY7IpGwUWx4pDHh1gKhjJ0qPUVK5sOx3GZfEvMCCiH9XPk70fn3nuYupRr9WNr
-HJwUSeLMhRvi4jTT+z5QLdYloFRZmDRwNg63csGZRkly9vjrAiMVHMpcJI0eCei/
-XgeKSxoiAmzNuc2J47SF2z7WIsDwHhwRj6tj4dOW3Ye0WIkcTIvHd7UTVX02v+oB
-d5YhABEBAAGJAiUEGAEKAA8FAlfEAKACGwwFCQHhM4AACgkQw+zcBCBPnSn25BAA
-xU7NKi6BokqnloYncvL74fuUpam3LJBwsOkFehuO2D+X9A2blIpbpXtUoWXwRc9V
-Jf7nL/yhMKcOB9m1MHVPtxtN5JzV9p8k2BT04/X6fa09umsJ3hwg/zhXrkGFrMVE
-hfAk6q8a0Y5oJKUOoJhzxqD9ItibxHPkqb+R/GSMfrDIRE0ecfIltDLIRQMlBF1b
-z5WN5Dwv8cikeQrsK6DNvbUUuHAbG8RZYG9QxFdkbehp46bCA8CfINENBzIskckx
-xwlTtVxcDD0Irql7EuIM1bpWdFxBZPlmcDyLrZgCYgSqPOe2mOK9V37jM3fsTqR9
-C9fmr3DDmAm8XrUBL9ORwMTFa6LIUpUoSSzG258h9qPiBySj7b51QbrJ9WXiISsQ
-5X/V8u6Qbp9PJnEUXXfIE9YVspF3+Zrfn0XqqjEND+bWi52cgDvwROSFf4KQnAto
-FdlxHtxlcZgJEFeHLyb370XI4rcNs7zMoD3B06Eyay5oY98w9JFYwrm6bVvNzis7
-CrK2K46QzSUZm1BHTOi0AlnqpYtLaJnMSQCxTmjyRBaJM5DGXs/86y/OYdBcpiYG
-aV0q9EcvDLQnSpa0vlsVM0AfMY+To1RTCMv+TGKMZHHWeV2yUABWK52raBpQHtjs
-7SonBqg04+2E4w1WmZEx1u9QyDXmlaLxnR+YIqilM7g=
-=RbWA
+b3J5Lm9yZz6JAjcEEwEKACECGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlil
+vY4ACgkQw+zcBCBPnSkinhAAhlaPOq+X1rIcCbzePaf3/g47ha2AySPPVPL1hiiG
+9b/YSemb5w9NTmPbsoJNQjQx9+4piLarSqN9Rihqw9T8IQ35EeuAd1sDBKseNbz6
+nt54FwUb29o71S5nakDALflGTmHs0dx1vaG50weZ9HBvSw07KMNK01JNmAeZ5GgV
+6B2UTa3yRoyTkBOcRVTxcn7JC0NdHpy+8OYpubDhPJPJJSMRqUaY05tfl8hLFMkh
+7g6VQRa/nBiOHgfla9ZqHr7yrFWV0g8wKF8nVBGD+R4/qchBrh+ofPk+Y7Gm39gD
+ux0mAX7xbJZpLry8BWBIUW50wlH1W4/Pq1kfw7m5vSQFCr0Ge8U/NQXkLwVf37Ow
+TT6opY9pXCrVqV8Ris+gah7XJayVyiF+SpARn+e2EPHxxhVxpF8H9cArhmU+Z9Vx
+PuLtGlCM5C0ypboHvEmqmSL2BhFhlxwchyqMf0h+6L5gR/i9GE+3QBFMewBQlgAf
+7ioddEGIUdnsAeQJHByupycCDF9rVxzWiYgDffV8B6JXDuw9iCwhIrslOkRM6mHV
+4/oe9PZ2Y+uLmcyOQa4Yk3jhr2aEa0r2Tuz1Jxw8DmY3y2GDNghuSHaKX++R4KqC
+SYuU4/yn1F0nojEy4Q+RuLfV7Bu9BDSUtsPB1LgXWBtAA6gMK66UiExd6fNLhy94
+1Dy5Ag0EV8QAoAEQAOQwsRo+2260kBYKnxRHr6rzTjStXtxsCsMUB08EXS7eTElw
+DSE2C+pfeQjFe366f1zNTxY/CN6wCtd7wI4cVXWKLescFfCUrsg+S0Wfot85AXqC
+qrPKFtKwW8khUeVnQfmHwhQl1W+/t+bE2p4X+0OR8qugHsMnvYwl+KpKsZ094Lwk
+O8GRySB+LKm6KQtJ+WOnsvs3X8v8fSA6GwJjYdtKqNUzPBLpw8RrIH9leaT2pe9T
+a48GqEwrU8wxwKyRBIfJJP/zq5n1rKcOBpvLZDVcyrVw+pIGa0zfmr/cqWYG7znx
+2Xq3i22d36xPkfkZEyVnQcCJJ28hkAfXRYpp+gMnL0Zt4u3GgzSARSBSVrcMyNla
+ft/aSOkojyjh3+2zF1PCfW1Nw9Sx50gdN3FfF0yEWjUoA1R/NW9CQZVG4qh/n2k5
+08PYfZRuJ74T2jABFJIztv2pmq3VpSA7hkHGl3nXrdqpsw3V9bkFqZa/ihhY7IpG
+wUWx4pDHh1gKhjJ0qPUVK5sOx3GZfEvMCCiH9XPk70fn3nuYupRr9WNrHJwUSeLM
+hRvi4jTT+z5QLdYloFRZmDRwNg63csGZRkly9vjrAiMVHMpcJI0eCei/XgeKSxoi
+AmzNuc2J47SF2z7WIsDwHhwRj6tj4dOW3Ye0WIkcTIvHd7UTVX02v+oBd5YhABEB
+AAGJAh8EGAEKAAkCGwwFAlilvaIACgkQw+zcBCBPnSnQmA/9F9bt+Fd3SUz/bQRx
+MDFpEmGJyT0okiCli6wPOHIGG/K7qUJrRGYIZiV6Wje92+G6YR7025D4qnJVLfBo
+IB1HtA0PeP5Px8ICfYhMuBD+Z2CQFu03gq0gD8MLpCh6lsSOYc+g+uxyI2zmRVmC
+CqH36GTf57xm9Kogc1kze9rEyUA9CR+gachWFrdhGXbyt6czop2oDDfJG/Pbllbu
+b2+n8OebaQSElqd263sCFMfVXsXn1qjuBEOao4aC14MD8EnmxUjGknYQIxI0vgyS
+a/UcGqJScsEW0LRz71O5HeyaJwGGsnFwZv3U75x3SKJvDNN+UugOAwCATAZ984c2
+/R20d28WCLQYGOMxdRib9D5zlNrfjPVXKrXRkwxm5ucLhKrjgjp89uk+gyjZ1FnN
+7V2YgJGMmL2jMsdGZpos7+MXpyoR0gTbtEaA9jWJlQNma1bAnEhnMaIZQGihyJs5
+JOhkGuhuuVQqbRJ5xLBX9xOszmWUA4itqQoYWM3k43QKZl7MT4Oxqhhmvmv4hVh0
+T8MdyzwACgAbLHsEMxb9kOMjhcIpRaP5ZzNWKIX8PPe92z4U6sqQGssBBaHAEPuN
+FkpEG6zvsyimZlrp3Vz5m6FYbDZD0j63RiTPj4LupDLGqKGseyOYPvdZrmFTKWss
+h+O+8iKVFs758eJDJtr72KlxfhQ=
+=zx02
 -----END PGP PUBLIC KEY BLOCK-----