feat(all) abandon all hope ye who enter here (#390 )

* feat(all) abandon all hope ye who enter here * remove circleci
Merge pull request #387 from cuishuang/master
2025-12-15 11:03:01 +02:00 · 2025-11-05 10:44:20 -05:00 · 2024-09-25 14:30:02 -04:00 · 2024-09-25 16:21:34 +08:00 · 2024-01-17 08:23:09 -05:00 · 2023-07-13 11:11:35 -04:00
14 changed files with 119 additions and 73 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1,56 +1,56 @@
-version: 2
-
-workflows:
-  version: 2
-  build_and_test:
-    jobs:
-      - debian
-      - ubuntu
-
-jobs:
-
-  debian:
-    docker:
-      - image: debian:9.1
-    steps:
-      - checkout
-      - run:
-          name: 'Installing'
-          command: |
-            apt-get update -y
-            apt-get install -y build-essential expect git gnupg2 pinentry-tty procps rpm ruby-dev libffi-dev
-            gem install fpm
-      - run:
-          name: 'Cleaning'
-          command: |
-            rm -rf ~/.gpnupg
-            make clean
-      - run:
-          name: 'Testing'
-          command: |
-            GPG=gpg2 make test
-            make packages-deb
-            make packages-rpm
-
-  ubuntu:
-    docker:
-      - image: ubuntu:16.04
-    steps:
-      - checkout
-      - run:
-          name: 'Installing'
-          command: |
-            apt-get update -y
-            apt-get install -y build-essential expect git gnupg2 pinentry-tty procps rpm ruby-dev libffi-dev
-            gem install fpm
-      - run:
-          name: 'Cleaning'
-          command: |
-            rm -rf ~/.gpnupg
-            make clean
-      - run:
-          name: 'Testing'
-          command: |
-            GPG=gpg2 make test
-            make packages-deb
-            make packages-rpm
+#version: 2
+#
+#workflows:
+#  version: 2
+#  build_and_test:
+#    jobs:
+#      - debian
+#      - ubuntu
+#
+#jobs:
+#
+#  debian:
+#    docker:
+#      - image: debian:9.1
+#    steps:
+#      - checkout
+#      - run:
+#          name: 'Installing'
+#          command: |
+#            apt-get update -y
+#            apt-get install -y build-essential expect git gnupg2 pinentry-tty procps rpm ruby-dev libffi-dev
+#            gem install fpm
+#      - run:
+#          name: 'Cleaning'
+#          command: |
+#            rm -rf ~/.gpnupg
+#            make clean
+#      - run:
+#          name: 'Testing'
+#          command: |
+#            GPG=gpg2 make test
+#            make packages-deb
+#            make packages-rpm
+#
+#  ubuntu:
+#    docker:
+#      - image: ubuntu:16.04
+#    steps:
+#      - checkout
+#      - run:
+#          name: 'Installing'
+#          command: |
+#            apt-get update -y
+#            apt-get install -y build-essential expect git gnupg2 pinentry-tty procps rpm ruby-dev libffi-dev
+#            gem install fpm
+#      - run:
+#          name: 'Cleaning'
+#          command: |
+#            rm -rf ~/.gpnupg
+#            make clean
+#      - run:
+#          name: 'Testing'
+#          command: |
+#            GPG=gpg2 make test
+#            make packages-deb
+#            make packages-rpm
--- a/.gitignore
+++ b/.gitignore
@@ -57,3 +57,6 @@ docs/_build/
 bbintegration
 .*.swp
 /integrationTest/.blackbox
+
+# golang
+/vendor/
--- a/README.md
+++ b/README.md
@@ -1,12 +1,24 @@
 BlackBox [![CircleCI](https://circleci.com/gh/StackExchange/blackbox.svg?style=shield)](https://circleci.com/gh/StackExchange/workflows/blackbox) [![Build Status](https://github.com/StackExchange/blackbox/workflows/build/badge.svg)](https://github.com/StackExchange/blackbox/actions?query=workflow%3Abuild+branch%3Amaster)
 ========

+THIS PROJECT IS ABANDONED. DO NOT USE. DO NOT SUBMIT BUG REPORTS OR PRs.
+
+There are plenty of other, better, projects. A partial list is listed under "Alternatives" below.
+
+========
+
 Safely store secrets in a VCS repo (i.e. Git, Mercurial, Subversion or Perforce). These commands make it easy for you to Gnu Privacy Guard (GPG) encrypt specific files in a repo so they are "encrypted at rest" in your repository. However, the scripts make it easy to decrypt them when you need to view or edit them, and decrypt them for use in production. Originally written for Puppet, BlackBox now works with any Git or Mercurial repository.

-A slide presentation about an older release [is on SlideShare](http://www.slideshare.net/TomLimoncelli/the-blackbox-project-sfae).
+
+WARNING: The goal of this project is to be a simple wrapper around `gpg` so you and your coworkers don't have to remember its all those inscrutable and confusing flags.  It is *not* intended to be a sophisticated encryption system that solves all problems or supports a large numbers of files.  The ideal use-case is to keep secrets in a secure service such as Conjur, AWS KMS, Azure Key Vault or GCP KMS; then use Blackbox for safely storing the API keys needed to access that system. That way you are encrypting a single, tiny, file. Feature-requests for anything more will be rejected; do not expect or even request "enterprise features". If this disappoints you, please consider a competiting project such as https://www.agwa.name/projects/git-crypt
+
+A slide presentation (about an older release) [is on SlideShare](http://www.slideshare.net/TomLimoncelli/the-blackbox-project-sfae).

 Join our mailing list: [https://groups.google.com/d/forum/blackbox-project](https://groups.google.com/d/forum/blackbox-project)

+## What blackbox is NOT:
+
+
 Table of Contents
 =================

@@ -30,6 +42,7 @@ Table of Contents
 - User Management
  - [How to indoctrinate a new user into the system?](#how-to-indoctrinate-a-new-user-into-the-system)
  - [How to remove a user from the system?](#how-to-remove-a-user-from-the-system)
+  - [Note to the Web Of Trust](#note-to-the-web-of-trust)
 - Repo Management
  - [Enabling BlackBox For a Repo](#enabling-blackbox-for-a-repo)
 - [Set up automated users or &ldquo;role accounts&rdquo;](#set-up-automated-users-or-role-accounts)
@@ -153,7 +166,7 @@ To add or fix support for a new operating system, look for the case statements i
 Using BlackBox on Windows
 =========================

-BlackBox can be used with Cygwin or MinGW.
+BlackBox can be used with Cygwin, MinGW or WSL2.

 ### Protect the line endings

@@ -201,6 +214,15 @@ Development:

 - unknown (if you develop Blackbox under MinGW, please let us know if any additional packages are required to run `make test`)

+### WSL2
+
+If you get the following error in WSL2, you can try to setup your environment with the following instructions (Tested with Ubuntu 22.04 on WSL2):
+
+- Install [Gpg4win](https://www.gpg4win.org/) (Tested with version 4.1.0)
+- Import your private key in Gpg4win (you can use Kleopatra on your Windows host if you wish).
+- Edit the file `~/.gnupg/gpg-agent.conf` on WSL and add the following line: `pinentry-program "/mnt/c/Program Files (x86)/GnuPG/bin/pinentry-basic.exe"`
+- Restart gpg agent on your linux system: `gpg-connect-agent reloadagent /bye`
+
 How is the encryption done?
 ===========================

@@ -467,6 +489,19 @@ The key ring only has public keys. There are no secret keys to delete.

 Remember that this person did have access to all the secrets at one time. They could have made a copy. Therefore, to be completely secure, you should change all passwords, generate new SSL keys, and so on just like when anyone that had privileged access leaves an organization.

+Note to the Web Of Trust
+========================
+
+Validating the trustworthiness of keys is a task that can't be accomplished by Blackbox; this is a completely external topic that has to be dealt with manually (the same way as generating/managing your key is, for example) or by a dedicated mechanism (a company CA with corresponding workflows e.g.). Aside from the "common" benefits of a Web Of Trust (see [here](https://www.gnupg.org/gph/en/manual/x334.html) or [here](https://www.gnupg.org/gph/en/manual/x547.html) e.g.), it prevents several errors as well.
+
+Historically Blackbox was using and enforcing a "trust every key" model but this has changed! Now the decision of whether and how to use the PGP/GPG trust models is left up to the user by configuration (or by the PGP/GPG defaults).  
+When updating Blackbox people might run into functional problems if they haven't yet dealt with the trustability of the keys they're using. It's the right time to do so and built up your Web Of Trust now!
+
+If you have an external workflow in place that ensures the integrity of the keys Blackbox uses you might want to disable the PGP/GPG trust models and rely on this workflow.  
+This can be achieved by declaring "trust model always", either by passing the command line parameter `--trust-model=always` to your PGP/GPG binary when using Blackbox (by defining an alias or using the environment variable (e.g. `GPG="gpg2 --trust-model=always"`) or a combination of both) or by setting `trust-model always` in your `gpg.conf` (note that this disables the Web Of Trust everywhere, not just for Blackbox).
+
+WARNING: It is strongly disadvised to not use any key validation at all! This opens up various ways to bypass the confidentiality of your encrypted secrets!
+
 Where is the configuration stored? .blackbox vs. keyrings/live
 ==============================================================

--- a/bin/_blackbox_common.sh
+++ b/bin/_blackbox_common.sh
@@ -15,6 +15,11 @@ source "${0%/*}"/_stack_lib.sh
 # Where are we?
 : "${BLACKBOX_HOME:="$(cd "${0%/*}" ; pwd)"}" ;

+# Make grep and sort work like it did in the 1970s:
+# Without this, blackbox fails to match filenames in blackbox-files.txt
+export LC_ALL='C'
+export LANG='en_US.UTF-8'
+
 # What are the candidates for the blackbox data directory?
 #
 # The order of candidates matter. The first entry of the array
@@ -248,7 +253,7 @@ function encrypt_file() {
  encrypted="$2"

  echo "========== Encrypting: $unencrypted" >&2
-  $GPG --use-agent --yes --trust-model=always --encrypt -o "$encrypted"  $(awk '{ print "-r" $1 }' < "$BB_ADMINS") "$unencrypted" >&2
+  $GPG --use-agent --yes --encrypt -o "$encrypted"  $(awk '{ print "-r" $1 }' < "$BB_ADMINS") "$unencrypted" >&2
  echo '========== Encrypting: DONE' >&2
 }

--- a/cmd/blackbox/cli.go
+++ b/cmd/blackbox/cli.go
@@ -89,7 +89,7 @@ func flags() *cli.App {
 			Aliases: []string{"en", "end"},
 			Usage:   "Encrypts file(s)",
 			Flags: []cli.Flag{
-				&cli.BoolFlag{Name: "shred", Usage: "Remove plaintext afterwords"},
+				&cli.BoolFlag{Name: "shred", Usage: "Remove plaintext afterwards"},
 			},
 			Action: func(c *cli.Context) error { return cmdEncrypt(c) },
 		},
--- a/go.mod
+++ b/go.mod
@@ -6,6 +6,6 @@ require (
 	github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883
 	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/olekukonko/tablewriter v0.0.4
-	github.com/sergi/go-diff v1.1.0 // indirect
+	github.com/sergi/go-diff v1.2.0 // indirect
 	github.com/urfave/cli/v2 v2.2.0
 )
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,4 @@
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/StackExchange/blackbox v0.0.0-20200527125317-e049c02655d2 h1:iihTTtoGPPfol75KUvwzSe+dlrVlAA78Ky2r+PA/tI0=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
@@ -12,7 +11,6 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/mattn/go-runewidth v0.0.7 h1:Ei8KR0497xHyKJPAv59M1dkC+rOZCMBJ+t3fZ+twI54=
 github.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
@@ -22,8 +20,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
-github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
+github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
--- a/integrationTest/ithelpers.go
+++ b/integrationTest/ithelpers.go
@@ -421,13 +421,8 @@ Expire-Date: 0

 func hasQuick(t *testing.T) bool {
 	testing.Init()
-	fmt.Println("========== Do we have --quick-generate-key?")
-	err := bbutil.RunBash("gpg2",
-		"--dry-run",
-		"--quick-generate-key",
-		"--batch",
-		"--passphrase", "",
-		"foo", "rsa", "encr")
+	fmt.Println("========== Do we run gpg2?")
+	err := bbutil.RunBash("gpg2", "--version")
 	fmt.Println("========== Done")
 	if err == nil {
 		return true
--- a/pkg/bbutil/umask_posix.go
+++ b/pkg/bbutil/umask_posix.go
@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows

 package bbutil
--- a/pkg/bbutil/umask_windows.go
+++ b/pkg/bbutil/umask_windows.go
@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows

 package bbutil
--- a/pkg/crypters/gnupg/gnupg.go
+++ b/pkg/crypters/gnupg/gnupg.go
@@ -106,7 +106,6 @@ func (crypt CrypterHandle) Encrypt(filename string, umask int, receivers []strin
 	a := []string{
 		"--use-agent",
 		"--yes",
-		"--trust-model=always",
 		"--encrypt",
 		"-o", encrypted,
 	}
--- a/tools/mk_deb_fpmdir.stack_blackbox.txt
+++ b/tools/mk_deb_fpmdir.stack_blackbox.txt
@@ -3,6 +3,7 @@ exec /usr/bin/_stack_lib.sh             ../bin/_stack_lib.sh
 exec /usr/bin/blackbox_addadmin         ../bin/blackbox_addadmin
 exec /usr/bin/blackbox_cat              ../bin/blackbox_cat
 exec /usr/bin/blackbox_decrypt_all_files  ../bin/blackbox_decrypt_all_files
+exec /usr/bin/blackbox_decrypt_file     ../bin/blackbox_decrypt_file
 exec /usr/bin/blackbox_deregister_file  ../bin/blackbox_deregister_file
 exec /usr/bin/blackbox_diff             ../bin/blackbox_diff
 exec /usr/bin/blackbox_edit             ../bin/blackbox_edit
@@ -13,8 +14,10 @@ exec /usr/bin/blackbox_listadmins       ../bin/blackbox_listadmins
 exec /usr/bin/blackbox_list_files       ../bin/blackbox_list_files
 exec /usr/bin/blackbox_list_admins      ../bin/blackbox_list_admins
 exec /usr/bin/blackbox_postdeploy       ../bin/blackbox_postdeploy
+exec /usr/bin/blackbox_recurse          ../bin/blackbox_recurse
 exec /usr/bin/blackbox_register_new_file ../bin/blackbox_register_new_file
 exec /usr/bin/blackbox_removeadmin      ../bin/blackbox_removeadmin
 exec /usr/bin/blackbox_shred_all_files  ../bin/blackbox_shred_all_files
 exec /usr/bin/blackbox_update_all_files ../bin/blackbox_update_all_files
+exec /usr/bin/blackbox_view             ../bin/blackbox_view
 exec /usr/bin/blackbox_whatsnew         ../bin/blackbox_whatsnew
--- a/tools/mk_macports.vcs_blackbox.txt
+++ b/tools/mk_macports.vcs_blackbox.txt
@@ -3,6 +3,7 @@ exec bin/_stack_lib.sh             ../bin/_stack_lib.sh
 exec bin/blackbox_addadmin         ../bin/blackbox_addadmin
 exec bin/blackbox_cat              ../bin/blackbox_cat
 exec bin/blackbox_decrypt_all_files  ../bin/blackbox_decrypt_all_files
+exec bin/blackbox_decrypt_file     ../bin/blackbox_decrypt_file
 exec bin/blackbox_deregister_file  ../bin/blackbox_deregister_file
 exec bin/blackbox_diff             ../bin/blackbox_diff
 exec bin/blackbox_edit             ../bin/blackbox_edit
@@ -13,8 +14,10 @@ exec bin/blackbox_listadmins       ../bin/blackbox_listadmins
 exec bin/blackbox_list_files       ../bin/blackbox_list_files
 exec bin/blackbox_list_admins      ../bin/blackbox_list_admins
 exec bin/blackbox_postdeploy       ../bin/blackbox_postdeploy
+exec bin/blackbox_recurse          ../bin/blackbox_recurse
 exec bin/blackbox_register_new_file ../bin/blackbox_register_new_file
 exec bin/blackbox_removeadmin      ../bin/blackbox_removeadmin
 exec bin/blackbox_shred_all_files  ../bin/blackbox_shred_all_files
 exec bin/blackbox_update_all_files ../bin/blackbox_update_all_files
+exec bin/blackbox_view             ../bin/blackbox_view
 exec bin/blackbox_whatsnew         ../bin/blackbox_whatsnew
--- a/tools/mk_rpm_fpmdir.stack_blackbox.txt
+++ b/tools/mk_rpm_fpmdir.stack_blackbox.txt
@@ -5,6 +5,7 @@ exec /usr/blackbox/bin/_stack_lib.sh             ../bin/_stack_lib.sh
 exec /usr/blackbox/bin/blackbox_addadmin         ../bin/blackbox_addadmin
 exec /usr/blackbox/bin/blackbox_cat              ../bin/blackbox_cat
 exec /usr/blackbox/bin/blackbox_decrypt_all_files  ../bin/blackbox_decrypt_all_files
+exec /usr/blackbox/bin/blackbox_decrypt_file     ../bin/blackbox_decrypt_file
 exec /usr/blackbox/bin/blackbox_deregister_file  ../bin/blackbox_deregister_file
 exec /usr/blackbox/bin/blackbox_diff             ../bin/blackbox_diff
 exec /usr/blackbox/bin/blackbox_edit             ../bin/blackbox_edit
@@ -15,8 +16,10 @@ exec /usr/blackbox/bin/blackbox_listadmins       ../bin/blackbox_listadmins
 exec /usr/blackbox/bin/blackbox_list_files       ../bin/blackbox_list_files
 exec /usr/blackbox/bin/blackbox_list_admins      ../bin/blackbox_list_admins
 exec /usr/blackbox/bin/blackbox_postdeploy       ../bin/blackbox_postdeploy
+exec /usr/blackbox/bin/blackbox_recurse          ../bin/blackbox_recurse
 exec /usr/blackbox/bin/blackbox_register_new_file ../bin/blackbox_register_new_file
 exec /usr/blackbox/bin/blackbox_removeadmin      ../bin/blackbox_removeadmin
 exec /usr/blackbox/bin/blackbox_shred_all_files  ../bin/blackbox_shred_all_files
 exec /usr/blackbox/bin/blackbox_update_all_files ../bin/blackbox_update_all_files
+exec /usr/blackbox/bin/blackbox_view             ../bin/blackbox_view
 exec /usr/blackbox/bin/blackbox_whatsnew         ../bin/blackbox_whatsnew
Author	SHA1	Message	Date
Tom Limoncelli	41e4234108	feat(all) abandon all hope ye who enter here (#390 ) * feat(all) abandon all hope ye who enter here * remove circleci	2025-11-05 10:44:20 -05:00
Tom Limoncelli	867fe52b1d	Merge pull request #387 from cuishuang/master Formatting code with gofmt	2024-09-25 14:30:02 -04:00
cuishuang	4cb3808914	Formatting code with gofmt Signed-off-by: cuishuang <imcusg@gmail.com>	2024-09-25 16:21:34 +08:00
Lightning	3a137a4a17	don't bypass the web of trust (#378 ) (#379 ) * don't bypass the web of trust (#378) the choice whether to use a web of trust and on which trust level is up to the user of PGP/GPG and must not be overriden by tools that are set on top users can decide to ignore this safety net by setting their gpg.conf adequately, defining an alias for `gpg --trust-model=always` or passing the env GPG to blackbox in this way but we should not override their preferences hardcoded * update README add note about the web of trust * fix broken test assume that we have `--quick-generate-key` if we run gpg2 instead of doing a dry run for that (which has side effects that break the test)	2024-01-17 08:23:09 -05:00
Tom Limoncelli	0e602cf18c	Merge pull request #374 from efficks/patch-1 Instruction for WSL	2023-07-13 11:11:35 -04:00
efficks	49f422021a	Instruction for WSL Add instruction to make it works on WSL2 and Ubuntu 22.04	2023-07-07 10:08:08 -04:00
Tom Limoncelli	70260bdbcf	FOUND-649: random validation problems (#373 )	2023-05-19 11:04:16 -04:00
Tom Limoncelli	32fbb23bd0	Clarify README	2022-11-30 09:14:46 -05:00
Tom Limoncelli	c6ea0dc870	Set expectations about the project in README.md	2022-08-25 13:36:54 -04:00
Ben Iofel	6517bfd21d	Package missing bins for deb, rpm, and macports (#360 )	2022-08-06 09:35:32 -04:00
6543	abb3bbe275	Update golang deps (#359 ) * git ignore golang vendor folder * update golang deps	2022-07-25 10:01:41 -04:00
Ali Azam	221010228e	edit (#358 ) Fix typo: 'afterwards'.	2022-07-05 12:17:30 -04:00