summaryrefslogtreecommitdiff
path: root/python
AgeCommit message (Collapse)AuthorFilesLines
2025-08-27setup:adprep: Import the latest ↵Jennifer Sutton1-3/+3
{Domain-Wide,Forest-Wide,Read-Only-Domain-Controller,Schema}-Updates.md Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-27python:samba: Raise an exception if we can’t parse a Markdown operationJennifer Sutton1-4/+5
Otherwise we would continue with the wrong GUID and filename. Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-27schema: Add Validated-Write-Computer Extended Right from Windows Server 2016Jennifer Sutton1-3/+8
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-27tests/krb5: Remove redundant lineJennifer Sutton1-2/+0
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-26python:tarfile: notes about extraction_filterDouglas Bagnall1-1/+16
a reminder to delete. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Tue Aug 26 23:43:08 UTC 2025 on atb-devel-224
2025-08-26pytest: safe_tarfile: accept NotADirectoryError as bad path rejectionDouglas Bagnall1-1/+2
After recent upstream Python fixes for various path escape and symlink CVEs in tarfile, in particular this commit: commit 3612d8f51741b11f36f8fb0494d79086bac9390a Author: Łukasz Langa <lukasz@langa.pl> Date: Tue Jun 3 12:42:11 2025 +0200 gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` (#135037) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. Signed-off-by: Łukasz Langa <lukasz@langa.pl> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> our ../../ test that looks for a tarfile.OutsideDestinationError now meets a NotADirectoryError in recent Python versions (this from 3.13, Fedora 42): UNEXPECTED(error): samba.tests.safe_tarfile.samba.tests.safe_tarfile.SafeTarFileTestCase.test_dots(none) REASON: Exception: Exception: Traceback (most recent call last): File "/tmp/samba-testbase/b1/samba-o3/bin/python/samba/tests/safe_tarfile.py", line 48, in test_dots self.assertRaises(tarfile.OutsideDestinationError, ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ stf.extractall, ^^^^^^^^^^^^^^^ tarname) ^^^^^^^^ File "/usr/lib64/python3.13/unittest/case.py", line 795, in assertRaises return context.handle('assertRaises', args, kwargs) ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.13/unittest/case.py", line 238, in handle callable_obj(*args, **kwargs) ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.13/tarfile.py", line 2343, in extractall tarinfo, unfiltered = self._get_extract_tarinfo( ~~~~~~~~~~~~~~~~~~~~~~~~~^ member, filter_function, path) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.13/tarfile.py", line 2432, in _get_extract_tarinfo self._handle_fatal_error(e) ~~~~~~~~~~~~~~~~~~~~~~~~^^^ File "/usr/lib64/python3.13/tarfile.py", line 2430, in _get_extract_tarinfo filtered = filter_function(unfiltered, path) File "/usr/lib64/python3.13/tarfile.py", line 842, in tar_filter new_attrs = _get_filtered_attrs(member, dest_path, False) File "/usr/lib64/python3.13/tarfile.py", line 783, in _get_filtered_attrs target_path = os.path.realpath(os.path.join(dest_path, name), strict=os.path.ALLOW_MISSING) File "<frozen posixpath>", line 457, in realpath NotADirectoryError: [Errno 20] Not a directory: '/tmp/samba-testbase/b1/samba-o3/bin/ab/tmp/tmpbn6e69ci/tar.tar' In this commit, we say that a NotADirectoryError is OK. When we started safe_tarfile we were acting in advance of upstream Python, but now they are well ahead of us. If we trust their work in recent versions and accept the error conditions they choose, we can more easily get rid of our safe_tarfile when the time is right. For the moment we still support as far back as Python 3.6 for some old enterprise distros, and it is for those that we continue to maintain safe_tarfile. In versions before 3.11 we will see tarfile.ExtractError, and the test for that is unaffected by this change. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-26python:build: do not allow sizeof(int) != 4Douglas Bagnall1-0/+13
A non-32 bit int will (if the compiler allows it) result in code where we write into memory adjacent to a target uint32_t value in many python bindings using the python arg-parsing API. The more correct thing to do would be to always parse into an unsigned long long and error if it is greater than UINT32_MAX, but we do this in so many places that there is reason to believe we'll just keep adding more. Note, we already check in lib/replace/wscript that int is at least 32 bits; here we are effectively just checking that it is not more. There was apparently a version of 64 bit Solaris in the 1990s that had 64 bit ints. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-08-25auth:creds: Make sure to uppercase the realm of a principalAndreas Schneider1-2/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15893 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-08-20pytest:samba-tool group: remove unused importsDouglas Bagnall1-5/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Wed Aug 20 05:35:03 UTC 2025 on atb-devel-224
2025-08-20pytest: run user_keytrust tests as computer keytrust testsDouglas Bagnall1-0/+16
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20pytest: adapt user_keytrust tests to be objectclass agnosticDouglas Bagnall1-89/+95
We will reuse the tests for the computer keytrust command. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: copy user_keytrust to computer keytrustDouglas Bagnall2-0/+226
This is exactly a copy of user/keytrust.py to computer_keytrust.py with a title-case-preserving `s/user/computer/`. It works. The Computer model differs from the User model in that it appends a '$' to the end of account names if it senses the lack, otherwise these commands are using the same code paths. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool computer: remove unused importsDouglas Bagnall1-4/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: add user keytrust commandDouglas Bagnall3-0/+585
This allows manipulation of key credential links for users. See `man -l bin/default/docs-xml/manpages/samba-tool.8` for documentation. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: Command.message() can print multiple linesDouglas Bagnall1-2/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20py:key_credential_link: filter_kcl_list helper for samba-toolDouglas Bagnall1-0/+27
This will be used in `samba-tool user keytrust delete` and `samba-tool computer keytrust delete` and is mainly to deduplicate that code. Potentially it could also be used in `keytrust view`. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20py:key_credential_list: add kcl_in_list functionDouglas Bagnall1-0/+13
This compares the key material and DN of a KeyCredentialLinkDn with a list of others, which is a different sense of equality than the default (which considers GUIDs and binary equality). This will be used by samba-tool to check whether a link is in fact a duplicate even if it seems not to be due to some insignificant field being non-identical. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20py:key_credential_links: allow encoding=='auto'Douglas Bagnall1-1/+4
'auto' is the same as None. This is helpful to samba-tool. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: add verbose flag to @exception_to_command_errorDouglas Bagnall1-1/+19
Helpful in development. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20py:tests: test key_credential_link moduleDouglas Bagnall1-0/+307
These tests use the samba.key_credential_link module and a real samdb. The existing key_credential_link tests address the IDL generated structures more directly. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20python:key_credential_link: add descriptive methodsDouglas Bagnall1-2/+124
In samba-tool we are going to want a KeyCredentialLinkDn to be able to describe itself. We're adding the methods here because `samba-tool user` and `samba-tool computer` will both want to use them. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20python:models: do not re-use mutable defaultsDouglas Bagnall1-1/+1
This ensures that model.save works when a field has the many flag set, but the object has no attribute of that name, and the caller appends to the attribute list, like this: user.key_credential_link.append(link) When we get to save, and are doing this: value = getattr(self, attr) old_value = getattr(existing_obj, attr) if value != old_value: # commit the change the .append() will have added the item to both value and old_value because they are the same list. But not any more. This was a problem because the Field instance is attached to the model class, not the model instance. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-20samba-tool: add decorator to catch exception typesDouglas Bagnall1-0/+18
Often we [think we] know that all exceptions of a certain type should be formatted as CommandErrors (i.e., the traceback is suppressed, and the message is assumed intelligible). Rather than riddling .run() with try...except blocks to do this, we can @exception_to_command_error(ModelError) def run(...) which makes any ModelError into a CommandError in that samba-tool command. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-15CI: add Python test samba.tests.dcerpc.dfs.DfsTests.test_dfs_reparse_tagRalph Boehme1-0/+48
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15843 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-08-15python/tests: also populate self.server in calls LibsmbTests setup()Ralph Boehme1-0/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15843 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-08-13python:key_credential_link: old python compatibilityDouglas Bagnall1-1/+1
int.to_bytes assumed these defaults in recent versions Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-13python:models: add key credential link DN to domain fieldsDouglas Bagnall2-0/+45
This will soon be needed by samba-tool, and is also going to be used in some tests. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-08python:ndr: improve type annotation and docs for pack/unpackDouglas Bagnall1-6/+10
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Fri Aug 8 00:29:00 UTC 2025 on atb-devel-224
2025-08-07python:samdb: remove dsdb_Dn aliasDouglas Bagnall1-5/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07py:samdb: add get_linearized to dsdb_dnDouglas Bagnall2-1/+6
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07py:samdb: drop unused methods (get_binary_integer, get_bytes)Douglas Bagnall1-9/+1
get_binary_integer() is still a method on BinaryDn, but not on StringDn and PlainDn where it makes no sense. x.get_bytes() is merely an alias for x.binary. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytest: add key_credential_link_Dn testsDouglas Bagnall1-0/+83
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07python: add helpers to construct KeyCredentialLinkDn objectsDouglas Bagnall1-1/+161
We want to ensure the as best we can that the binary blob is in a useful format. This will be used by samba-tool. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07python: add KeyCredentialLinkDn BinaryDn subtypeDouglas Bagnall1-0/+56
This works as a BinaryDn, but it also does validation to ensure the binary contains a KEYCREDENTIALLINK_BLOB. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07samba_kcc: log when msDS-HasInstantiatedNCs is not BinaryDnDouglas Bagnall1-3/+10
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07samba_kcc: use dsdb_dn_guess()Douglas Bagnall2-12/+12
We also remove a bit of .decode()ing, which now happens automatically. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07dbcheck: make deleted_objects check case-insensitiveDouglas Bagnall1-3/+4
While a BinaryDn.prefix is generated in upper-case, and dsdb.DS_GUID_DELETED_OBJECTS_CONTAINER is upper-case, we can avoid having to think about that by comparing the actual bytes. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07dbcheck: use new dsdb_dn typesDouglas Bagnall1-11/+12
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytest:krb5_base: use BinaryDn not dsdb_dnDouglas Bagnall1-4/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytest:dsdb_dn: expand and rework testsDouglas Bagnall1-29/+77
We now test the specialised StringDn and BinaryDn types. There are new assertions about case-insensitivity in binary hex strings and BinaryDn prefix validation. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytest:dsdb_dn: fix binary testDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07python:samdb: replace dsdb_Dn with stricter typesDouglas Bagnall2-44/+199
dsdb_Dn() was a catchall for DN+Binary, DN+String, and plain DNs which needed to be sorted in a particular way. This meant it treated none of them exactly right. For example, a binary dsdb_Dn would be compared on the string representation of the binary portion, so 'B:2:ff:CN=foo' would not equal 'B:2:FF:CN=foo', when it should. It meant a field that expected a binary dsdb_DN would also accept a plain DN or a string DN, which is never actually allowed. Also the parsing was a bit dodgy, so a string like 'B:6:ff:CN=foo' would be accepted, when the length of the binary portion ("ff") is obviously different from that given ("6"). Here we solve many of the problems by making stricter subclasses but leaving a compatibility shim in place so that existing code continues to work. There is one INCOMPATIBLE change. Previously the `.binary` attribute of a dsdb_Dn was the hex-string, while now it is the actual binary data. In the case of StringDn, this means the utf-8 bytes. This affects dbcheck, which is fixed here (the .prefix assignment now correctly sets .binary). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07py/common: add cmp_with_nones() helper functionDouglas Bagnall2-1/+32
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07py:common: normalise_int32 checks bit sizeDouglas Bagnall1-1/+4
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytests: test normalise_int32 against out-of-range numbersDouglas Bagnall1-0/+3
For example, we don't want to "normalise" 0x9876543210 to 0x9776543210, or 0x200000000 to 0x100000000. That is just causing random damage to 64 bit values without achieving the sign switch. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-07pytests: move dsdb_dn tests out of commonDouglas Bagnall2-36/+59
dsdb_Dn hasn't been in samba.common since 85d2ff2f0003b106ca84866b7e7893723f1dd93c and the tests should follow. Although dsdb_Dn is currently in samba.samdb, we aren't moving the tests to samba.tests.samdb, because those tests need a real AD environment whereas these ones can run more cheaply in the "none" environment. Another patch will improve the remaining samba.common tests. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-08-05auth:creds: Make sure when parsing username that realm is uppercaseAndreas Schneider1-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-07-31librpc:bcrypt_rsakey_blob: exponent and modulus lengths can't be zeroDouglas Bagnall1-28/+23
Apart from it making no sense, without these ranges we end up allocating a NULL buffer and aborting. We also put a maximum size on the RSA key, in case we could get tricked into a DoS by pulling a large buffer and trying crypto maths on it. 6 0x572ebce2749a in talloc_abort samba/lib/talloc/talloc.c:506:3 7 0x572ebce271d4 in talloc_chunk_from_ptr samba/lib/talloc/talloc.c:0 8 0x572ebce271d4 in __talloc_with_prefix samba/lib/talloc/talloc.c:762:12 9 0x572ebce235f9 in __talloc samba/lib/talloc/talloc.c:825:9 10 0x572ebce235f9 in _talloc_named_const samba/lib/talloc/talloc.c:982:8 11 0x572ebce235f9 in _talloc_memdup samba/lib/talloc/talloc.c:2441:9 12 0x572ebc8f6a4f in data_blob_talloc_named samba/lib/util/data_blob.c:56:25 13 0x572ebc7d23bd in pull_BCRYPT_RSAPUBLIC_BLOB samba/librpc/ndr/ndr_keycredlink.c:878:17 14 0x572ebc7d23bd in ndr_pull_KeyMaterialInternal samba/librpc/ndr/ndr_keycredlink.c:959:10 15 0x572ebc788e90 in LLVMFuzzerTestOneInput samba/bin/default/lib/fuzzing/fuzz_ndr_keycredlink_TYPE_STRUCT.c:282:13 REF: https://issues.oss-fuzz.com/issues/435039896 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Jul 31 05:45:07 UTC 2025 on atb-devel-224
2025-07-29librpc: keycredlink support X509 public keysGary Lockyer1-0/+232
Add support for X509 encoded public keys in msDSKeyCredentialLink KeyMaterial. Note: Only RSA public keys are supported. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-07-29librpc/idl: Add idl for tpm20_rsakey_blobGary Lockyer1-0/+130
Idl and tests for TPM20_RSAKEY_BLOB, one of the possible encoding of msDSKeyCredentialLink KeyMaterial Derived from: https://dox.ipxe.org/Tpm20_8h_source.html#l00164 https://stackoverflow.com/questions/78958315/cannot-parse-tpm2-0-public-key Note: this is a greatly simplified implementation that only handles TPM version 2, RSA public keys. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 01:21:37 +0000