upload-pack: add deepen-since to cut shallow repos based on time
[git/git.git] / Documentation / technical / pack-protocol.txt
CommitLineData
b31222cf
SC
1Packfile transfer protocols
2===========================
3
055c7e9f 4Git supports transferring data in packfiles over the ssh://, git://, http:// and
b31222cf
SC
5file:// transports. There exist two sets of protocols, one for pushing
6data from a client to a server and another for fetching data from a
055c7e9f
SB
7server to a client. The three transports (ssh, git, file) use the same
8protocol to transfer data. http is documented in http-protocol.txt.
b31222cf
SC
9
10The processes invoked in the canonical Git implementation are 'upload-pack'
11on the server side and 'fetch-pack' on the client side for fetching data;
12then 'receive-pack' on the server and 'send-pack' on the client for pushing
13data. The protocol functions to have a server tell a client what is
14currently on the server, then for the two to negotiate the smallest amount
15of data to send in order to fully update one or the other.
16
1c9b659d
JK
17pkt-line Format
18---------------
19
20The descriptions below build on the pkt-line format described in
21protocol-common.txt. When the grammar indicate `PKT-LINE(...)`, unless
22otherwise noted the usual pkt-line LF rules apply: the sender SHOULD
23include a LF, but the receiver MUST NOT complain if it is not present.
24
b31222cf
SC
25Transports
26----------
27There are three transports over which the packfile protocol is
28initiated. The Git transport is a simple, unauthenticated server that
29takes the command (almost always 'upload-pack', though Git
30servers can be configured to be globally writable, in which 'receive-
31pack' initiation is also allowed) with which the client wishes to
32communicate and executes it and connects it to the requesting
33process.
34
35In the SSH transport, the client just runs the 'upload-pack'
36or 'receive-pack' process on the server over the SSH protocol and then
37communicates with that invoked process over the SSH connection.
38
39The file:// transport runs the 'upload-pack' or 'receive-pack'
40process locally and communicates with it over a pipe.
41
42Git Transport
43-------------
44
45The Git transport starts off by sending the command and repository
46on the wire using the pkt-line format, followed by a NUL byte and a
8e50175d 47hostname parameter, terminated by a NUL byte.
b31222cf
SC
48
49 0032git-upload-pack /project.git\0host=myserver.com\0
50
51--
52 git-proto-request = request-command SP pathname NUL [ host-parameter NUL ]
53 request-command = "git-upload-pack" / "git-receive-pack" /
54 "git-upload-archive" ; case sensitive
55 pathname = *( %x01-ff ) ; exclude NUL
56 host-parameter = "host=" hostname [ ":" port ]
57--
58
59Only host-parameter is allowed in the git-proto-request. Clients
60MUST NOT attempt to send additional parameters. It is used for the
61git-daemon name based virtual hosting. See --interpolated-path
62option to git daemon, with the %H/%CH format characters.
63
64Basically what the Git client is doing to connect to an 'upload-pack'
65process on the server side over the Git protocol is this:
66
67 $ echo -e -n \
68 "0039git-upload-pack /schacon/gitbook.git\0host=example.com\0" |
69 nc -v example.com 9418
70
d78e5aec
NTND
71If the server refuses the request for some reasons, it could abort
72gracefully with an error message.
73
74----
75 error-line = PKT-LINE("ERR" SP explanation-text)
76----
77
b31222cf
SC
78
79SSH Transport
80-------------
81
82Initiating the upload-pack or receive-pack processes over SSH is
83executing the binary on the server via SSH remote execution.
84It is basically equivalent to running this:
85
86 $ ssh git.example.com "git-upload-pack '/project.git'"
87
88For a server to support Git pushing and pulling for a given user over
89SSH, that user needs to be able to execute one or both of those
90commands via the SSH shell that they are provided on login. On some
91systems, that shell access is limited to only being able to run those
92two commands, or even just one of them.
93
94In an ssh:// format URI, it's absolute in the URI, so the '/' after
95the host name (or port number) is sent as an argument, which is then
96read by the remote git-upload-pack exactly as is, so it's effectively
97an absolute path in the remote filesystem.
98
99 git clone ssh://user@example.com/project.git
100 |
101 v
102 ssh user@example.com "git-upload-pack '/project.git'"
103
104In a "user@host:path" format URI, its relative to the user's home
105directory, because the Git client will run:
106
107 git clone user@example.com:project.git
108 |
109 v
110 ssh user@example.com "git-upload-pack 'project.git'"
111
112The exception is if a '~' is used, in which case
113we execute it without the leading '/'.
114
115 ssh://user@example.com/~alice/project.git,
116 |
117 v
118 ssh user@example.com "git-upload-pack '~alice/project.git'"
119
120A few things to remember here:
121
122- The "command name" is spelled with dash (e.g. git-upload-pack), but
123 this can be overridden by the client;
124
125- The repository path is always quoted with single quotes.
126
127Fetching Data From a Server
5316c8e9 128---------------------------
b31222cf
SC
129
130When one Git repository wants to get data that a second repository
131has, the first can 'fetch' from the second. This operation determines
132what data the server has that the client does not then streams that
133data down to the client in packfile format.
134
135
136Reference Discovery
137-------------------
138
139When the client initially connects the server will immediately respond
140with a listing of each reference it has (all branches and tags) along
141with the object name that each reference currently points to.
142
143 $ echo -e -n "0039git-upload-pack /schacon/gitbook.git\0host=example.com\0" |
144 nc -v example.com 9418
5316c8e9
TA
145 00887217a7c7e582c46cec22a130adf4b9d7d950fba0 HEAD\0multi_ack thin-pack
146 side-band side-band-64k ofs-delta shallow no-progress include-tag
b31222cf
SC
147 00441d3fcd5ced445d1abc402225c0b8a1299641f497 refs/heads/integration
148 003f7217a7c7e582c46cec22a130adf4b9d7d950fba0 refs/heads/master
149 003cb88d2441cac0977faf98efc80305012112238d9d refs/tags/v0.9
150 003c525128480b96c89e6418b1e40909bf6c5b2d580f refs/tags/v1.0
151 003fe92df48743b7bc7d26bcaabfddde0a1e20cae47c refs/tags/v1.0^{}
152 0000
153
b31222cf
SC
154The returned response is a pkt-line stream describing each ref and
155its current value. The stream MUST be sorted by name according to
156the C locale ordering.
157
158If HEAD is a valid ref, HEAD MUST appear as the first advertised
159ref. If HEAD is not a valid ref, HEAD MUST NOT appear in the
160advertisement list at all, but other refs may still appear.
161
162The stream MUST include capability declarations behind a NUL on the
163first ref. The peeled value of a ref (that is "ref^{}") MUST be
164immediately after the ref itself, if presented. A conforming server
6a5d0b0a 165MUST peel the ref if it's an annotated tag.
b31222cf
SC
166
167----
168 advertised-refs = (no-refs / list-of-refs)
ad491366 169 *shallow
b31222cf
SC
170 flush-pkt
171
172 no-refs = PKT-LINE(zero-id SP "capabilities^{}"
1c9b659d 173 NUL capability-list)
b31222cf
SC
174
175 list-of-refs = first-ref *other-ref
176 first-ref = PKT-LINE(obj-id SP refname
1c9b659d 177 NUL capability-list)
b31222cf
SC
178
179 other-ref = PKT-LINE(other-tip / other-peeled)
1c9b659d
JK
180 other-tip = obj-id SP refname
181 other-peeled = obj-id SP refname "^{}"
b31222cf 182
ad491366
NTND
183 shallow = PKT-LINE("shallow" SP obj-id)
184
b31222cf
SC
185 capability-list = capability *(SP capability)
186 capability = 1*(LC_ALPHA / DIGIT / "-" / "_")
187 LC_ALPHA = %x61-7A
188----
189
190Server and client MUST use lowercase for obj-id, both MUST treat obj-id
191as case-insensitive.
192
193See protocol-capabilities.txt for a list of allowed server capabilities
194and descriptions.
195
196Packfile Negotiation
197--------------------
a1e90b23
AN
198After reference and capabilities discovery, the client can decide to
199terminate the connection by sending a flush-pkt, telling the server it can
200now gracefully terminate, and disconnect, when it does not need any pack
201data. This can happen with the ls-remote command, and also can happen when
202the client already is up-to-date.
203
204Otherwise, it enters the negotiation phase, where the client and
205server determine what the minimal packfile necessary for transport is,
4a1c2695
AN
206by telling the server what objects it wants, its shallow objects
207(if any), and the maximum commit depth it wants (if any). The client
208will also send a list of the capabilities it wants to be in effect,
209out of what the server said it could do with the first 'want' line.
b31222cf
SC
210
211----
212 upload-request = want-list
4a1c2695
AN
213 *shallow-line
214 *1depth-request
215 flush-pkt
b31222cf
SC
216
217 want-list = first-want
218 *additional-want
4a1c2695 219
e543b3f6 220 shallow-line = PKT-LINE("shallow" SP obj-id)
4a1c2695 221
569e554b
NTND
222 depth-request = PKT-LINE("deepen" SP depth) /
223 PKT-LINE("deepen-since" SP timestamp)
b31222cf 224
1c9b659d
JK
225 first-want = PKT-LINE("want" SP obj-id SP capability-list)
226 additional-want = PKT-LINE("want" SP obj-id)
b31222cf 227
4a1c2695 228 depth = 1*DIGIT
b31222cf
SC
229----
230
231Clients MUST send all the obj-ids it wants from the reference
232discovery phase as 'want' lines. Clients MUST send at least one
233'want' command in the request body. Clients MUST NOT mention an
234obj-id in a 'want' command which did not appear in the response
235obtained through ref discovery.
236
4a1c2695
AN
237The client MUST write all obj-ids which it only has shallow copies
238of (meaning that it does not have the parents of a commit) as
239'shallow' lines so that the server is aware of the limitations of
af04fa2a 240the client's history.
4a1c2695
AN
241
242The client now sends the maximum commit history depth it wants for
243this transaction, which is the number of commits it wants from the
244tip of the history, if any, as a 'deepen' line. A depth of 0 is the
245same as not making a depth request. The client does not want to receive
a58088ab
JL
246any commits beyond this depth, nor does it want objects needed only to
247complete those commits. Commits whose parents are not received as a
248result are defined as shallow and marked as such in the server. This
249information is sent back to the client in the next step.
4a1c2695
AN
250
251Once all the 'want's and 'shallow's (and optional 'deepen') are
252transferred, clients MUST send a flush-pkt, to tell the server side
253that it is done sending the list.
254
255Otherwise, if the client sent a positive depth request, the server
256will determine which commits will and will not be shallow and
257send this information to the client. If the client did not request
258a positive depth, this step is skipped.
b31222cf 259
4a1c2695
AN
260----
261 shallow-update = *shallow-line
262 *unshallow-line
263 flush-pkt
b31222cf 264
4a1c2695
AN
265 shallow-line = PKT-LINE("shallow" SP obj-id)
266
267 unshallow-line = PKT-LINE("unshallow" SP obj-id)
268----
269
270If the client has requested a positive depth, the server will compute
01f7d7f1
PO
271the set of commits which are no deeper than the desired depth. The set
272of commits start at the client's wants.
273
274The server writes 'shallow' lines for each
4a1c2695
AN
275commit whose parents will not be sent as a result. The server writes
276an 'unshallow' line for each commit which the client has indicated is
277shallow, but is no longer shallow at the currently requested depth
278(that is, its parents will now be sent). The server MUST NOT mark
279as unshallow anything which the client has not indicated was shallow.
b31222cf
SC
280
281Now the client will send a list of the obj-ids it has using 'have'
4a1c2695
AN
282lines, so the server can make a packfile that only contains the objects
283that the client needs. In multi_ack mode, the canonical implementation
284will send up to 32 of these at a time, then will send a flush-pkt. The
285canonical implementation will skip ahead and send the next 32 immediately,
286so that there is always a block of 32 "in-flight on the wire" at a time.
287
288----
289 upload-haves = have-list
290 compute-end
291
292 have-list = *have-line
1c9b659d 293 have-line = PKT-LINE("have" SP obj-id)
4a1c2695
AN
294 compute-end = flush-pkt / PKT-LINE("done")
295----
b31222cf
SC
296
297If the server reads 'have' lines, it then will respond by ACKing any
298of the obj-ids the client said it had that the server also has. The
299server will ACK obj-ids differently depending on which ack mode is
300chosen by the client.
301
302In multi_ack mode:
303
304 * the server will respond with 'ACK obj-id continue' for any common
305 commits.
306
307 * once the server has found an acceptable common base commit and is
308 ready to make a packfile, it will blindly ACK all 'have' obj-ids
309 back to the client.
310
311 * the server will then send a 'NACK' and then wait for another response
312 from the client - either a 'done' or another list of 'have' lines.
313
314In multi_ack_detailed mode:
315
316 * the server will differentiate the ACKs where it is signaling
317 that it is ready to send data with 'ACK obj-id ready' lines, and
318 signals the identified common commits with 'ACK obj-id common' lines.
319
320Without either multi_ack or multi_ack_detailed:
321
322 * upload-pack sends "ACK obj-id" on the first common object it finds.
323 After that it says nothing until the client gives it a "done".
324
325 * upload-pack sends "NAK" on a flush-pkt if no common object
326 has been found yet. If one has been found, and thus an ACK
6a5d0b0a 327 was already sent, it's silent on the flush-pkt.
b31222cf
SC
328
329After the client has gotten enough ACK responses that it can determine
330that the server has enough information to send an efficient packfile
331(in the canonical implementation, this is determined when it has received
332enough ACKs that it can color everything left in the --date-order queue
333as common with the server, or the --date-order queue is empty), or the
334client determines that it wants to give up (in the canonical implementation,
335this is determined when the client sends 256 'have' lines without getting
336any of them ACKed by the server - meaning there is nothing in common and
6a5d0b0a 337the server should just send all of its objects), then the client will send
b31222cf 338a 'done' command. The 'done' command signals to the server that the client
6a5d0b0a 339is ready to receive its packfile data.
b31222cf
SC
340
341However, the 256 limit *only* turns on in the canonical client
342implementation if we have received at least one "ACK %s continue"
343during a prior round. This helps to ensure that at least one common
344ancestor is found before we give up entirely.
345
346Once the 'done' line is read from the client, the server will either
32752e96
NTND
347send a final 'ACK obj-id' or it will send a 'NAK'. 'obj-id' is the object
348name of the last commit determined to be common. The server only sends
b31222cf
SC
349ACK after 'done' if there is at least one common base and multi_ack or
350multi_ack_detailed is enabled. The server always sends NAK after 'done'
351if there is no common base found.
352
6a5d0b0a 353Then the server will start sending its packfile data.
b31222cf
SC
354
355----
356 server-response = *ack_multi ack / nak
1c9b659d 357 ack_multi = PKT-LINE("ACK" SP obj-id ack_status)
b31222cf 358 ack_status = "continue" / "common" / "ready"
1c9b659d
JK
359 ack = PKT-LINE("ACK" SP obj-id)
360 nak = PKT-LINE("NAK")
b31222cf
SC
361----
362
363A simple clone may look like this (with no 'have' lines):
364
365----
79135e4c 366 C: 0054want 74730d410fcb6603ace96f1dc55ea6196122532d multi_ack \
b31222cf
SC
367 side-band-64k ofs-delta\n
368 C: 0032want 7d1665144a3a975c05f1f43902ddaf084e784dbe\n
369 C: 0032want 5a3f6be755bbb7deae50065988cbfa1ffa9ab68a\n
370 C: 0032want 7e47fe2bd8d01d481f44d7af0531bd93d3b21c01\n
371 C: 0032want 74730d410fcb6603ace96f1dc55ea6196122532d\n
372 C: 0000
373 C: 0009done\n
374
375 S: 0008NAK\n
376 S: [PACKFILE]
377----
378
379An incremental update (fetch) response might look like this:
380
381----
79135e4c 382 C: 0054want 74730d410fcb6603ace96f1dc55ea6196122532d multi_ack \
b31222cf
SC
383 side-band-64k ofs-delta\n
384 C: 0032want 7d1665144a3a975c05f1f43902ddaf084e784dbe\n
385 C: 0032want 5a3f6be755bbb7deae50065988cbfa1ffa9ab68a\n
386 C: 0000
387 C: 0032have 7e47fe2bd8d01d481f44d7af0531bd93d3b21c01\n
388 C: [30 more have lines]
389 C: 0032have 74730d410fcb6603ace96f1dc55ea6196122532d\n
390 C: 0000
391
392 S: 003aACK 7e47fe2bd8d01d481f44d7af0531bd93d3b21c01 continue\n
393 S: 003aACK 74730d410fcb6603ace96f1dc55ea6196122532d continue\n
394 S: 0008NAK\n
395
396 C: 0009done\n
397
c8a97906 398 S: 0031ACK 74730d410fcb6603ace96f1dc55ea6196122532d\n
b31222cf
SC
399 S: [PACKFILE]
400----
401
402
403Packfile Data
404-------------
405
406Now that the client and server have finished negotiation about what
407the minimal amount of data that needs to be sent to the client is, the server
408will construct and send the required data in packfile format.
409
410See pack-format.txt for what the packfile itself actually looks like.
411
412If 'side-band' or 'side-band-64k' capabilities have been specified by
413the client, the server will send the packfile data multiplexed.
414
415Each packet starting with the packet-line length of the amount of data
416that follows, followed by a single byte specifying the sideband the
417following data is coming in on.
418
419In 'side-band' mode, it will send up to 999 data bytes plus 1 control
420code, for a total of up to 1000 bytes in a pkt-line. In 'side-band-64k'
421mode it will send up to 65519 data bytes plus 1 control code, for a
422total of up to 65520 bytes in a pkt-line.
423
424The sideband byte will be a '1', '2' or a '3'. Sideband '1' will contain
425packfile data, sideband '2' will be used for progress information that the
426client will generally print to stderr and sideband '3' is used for error
427information.
428
429If no 'side-band' capability was specified, the server will stream the
430entire packfile without multiplexing.
431
432
433Pushing Data To a Server
5316c8e9 434------------------------
b31222cf
SC
435
436Pushing data to a server will invoke the 'receive-pack' process on the
437server, which will allow the client to tell it which references it should
438update and then send all the data the server will need for those new
439references to be complete. Once all the data is received and validated,
440the server will then update its references to what the client specified.
441
442Authentication
443--------------
444
445The protocol itself contains no authentication mechanisms. That is to be
446handled by the transport, such as SSH, before the 'receive-pack' process is
447invoked. If 'receive-pack' is configured over the Git transport, those
448repositories will be writable by anyone who can access that port (9418) as
449that transport is unauthenticated.
450
451Reference Discovery
452-------------------
453
454The reference discovery phase is done nearly the same way as it is in the
455fetching protocol. Each reference obj-id and name on the server is sent
456in packet-line format to the client, followed by a flush-pkt. The only
457real difference is that the capability listing is different - the only
458possible values are 'report-status', 'delete-refs' and 'ofs-delta'.
459
460Reference Update Request and Packfile Transfer
461----------------------------------------------
462
463Once the client knows what references the server is at, it can send a
464list of reference update requests. For each reference on the server
465that it wants to update, it sends a line listing the obj-id currently on
466the server, the obj-id the client would like to update it to and the name
467of the reference.
468
469This list is followed by a flush-pkt and then the packfile that should
470contain all the objects that the server will need to complete the new
471references.
472
473----
bbf431c9 474 update-request = *shallow ( command-list | push-cert ) [packfile]
5dbd7676 475
1c9b659d 476 shallow = PKT-LINE("shallow" SP obj-id)
b31222cf 477
1c9b659d
JK
478 command-list = PKT-LINE(command NUL capability-list)
479 *PKT-LINE(command)
b31222cf
SC
480 flush-pkt
481
482 command = create / delete / update
483 create = zero-id SP new-id SP name
484 delete = old-id SP zero-id SP name
485 update = old-id SP new-id SP name
486
487 old-id = obj-id
488 new-id = obj-id
489
4adf569d
JH
490 push-cert = PKT-LINE("push-cert" NUL capability-list LF)
491 PKT-LINE("certificate version 0.1" LF)
492 PKT-LINE("pusher" SP ident LF)
9be89160 493 PKT-LINE("pushee" SP url LF)
b89363e4 494 PKT-LINE("nonce" SP nonce LF)
4adf569d
JH
495 PKT-LINE(LF)
496 *PKT-LINE(command LF)
497 *PKT-LINE(gpg-signature-lines LF)
498 PKT-LINE("push-cert-end" LF)
499
bbf431c9 500 packfile = "PACK" 28*(OCTET)
b31222cf
SC
501----
502
503If the receiving end does not support delete-refs, the sending end MUST
504NOT ask for delete command.
505
4adf569d
JH
506If the receiving end does not support push-cert, the sending end
507MUST NOT send a push-cert command. When a push-cert command is
508sent, command-list MUST NOT be sent; the commands recorded in the
509push certificate is used instead.
510
3890dae9 511The packfile MUST NOT be sent if the only command used is 'delete'.
b31222cf 512
3890dae9 513A packfile MUST be sent if either create or update command is used,
b31222cf 514even if the server already has all the necessary objects. In this
3890dae9 515case the client MUST send an empty packfile. The only time this
b31222cf
SC
516is likely to happen is if the client is creating
517a new branch or a tag that points to an existing obj-id.
518
519The server will receive the packfile, unpack it, then validate each
520reference that is being updated that it hasn't changed while the request
521was being processed (the obj-id is still the same as the old-id), and
522it will run any update hooks to make sure that the update is acceptable.
523If all of that is fine, the server will then update the references.
524
4adf569d
JH
525Push Certificate
526----------------
527
528A push certificate begins with a set of header lines. After the
529header and an empty line, the protocol commands follow, one per
1c9b659d
JK
530line. Note that the the trailing LF in push-cert PKT-LINEs is _not_
531optional; it must be present.
4adf569d
JH
532
533Currently, the following header fields are defined:
534
535`pusher` ident::
536 Identify the GPG key in "Human Readable Name <email@address>"
537 format.
538
9be89160
JH
539`pushee` url::
540 The repository URL (anonymized, if the URL contains
541 authentication material) the user who ran `git push`
542 intended to push into.
543
b89363e4
JH
544`nonce` nonce::
545 The 'nonce' string the receiving repository asked the
546 pushing user to include in the certificate, to prevent
547 replay attacks.
548
4adf569d
JH
549The GPG signature lines are a detached signature for the contents
550recorded in the push certificate before the signature block begins.
551The detached signature is used to certify that the commands were
552given by the pusher, who must be the signer.
553
b31222cf
SC
554Report Status
555-------------
556
557After receiving the pack data from the sender, the receiver sends a
558report if 'report-status' capability is in effect.
559It is a short listing of what happened in that update. It will first
560list the status of the packfile unpacking as either 'unpack ok' or
561'unpack [error]'. Then it will list the status for each of the references
562that it tried to update. Each line is either 'ok [refname]' if the
563update was successful, or 'ng [refname] [error]' if the update was not.
564
565----
566 report-status = unpack-status
567 1*(command-status)
568 flush-pkt
569
1c9b659d 570 unpack-status = PKT-LINE("unpack" SP unpack-result)
b31222cf
SC
571 unpack-result = "ok" / error-msg
572
573 command-status = command-ok / command-fail
1c9b659d
JK
574 command-ok = PKT-LINE("ok" SP refname)
575 command-fail = PKT-LINE("ng" SP refname SP error-msg)
b31222cf
SC
576
577 error-msg = 1*(OCTECT) ; where not "ok"
578----
579
580Updates can be unsuccessful for a number of reasons. The reference can have
581changed since the reference discovery phase was originally sent, meaning
582someone pushed in the meantime. The reference being pushed could be a
583non-fast-forward reference and the update hooks or configuration could be
584set to not allow that, etc. Also, some references can be updated while others
585can be rejected.
586
587An example client/server communication might look like this:
588
589----
590 S: 007c74730d410fcb6603ace96f1dc55ea6196122532d refs/heads/local\0report-status delete-refs ofs-delta\n
591 S: 003e7d1665144a3a975c05f1f43902ddaf084e784dbe refs/heads/debug\n
592 S: 003f74730d410fcb6603ace96f1dc55ea6196122532d refs/heads/master\n
593 S: 003f74730d410fcb6603ace96f1dc55ea6196122532d refs/heads/team\n
594 S: 0000
595
596 C: 003e7d1665144a3a975c05f1f43902ddaf084e784dbe 74730d410fcb6603ace96f1dc55ea6196122532d refs/heads/debug\n
597 C: 003e74730d410fcb6603ace96f1dc55ea6196122532d 5a3f6be755bbb7deae50065988cbfa1ffa9ab68a refs/heads/master\n
598 C: 0000
599 C: [PACKDATA]
600
c8a97906
TRC
601 S: 000eunpack ok\n
602 S: 0018ok refs/heads/debug\n
603 S: 002ang refs/heads/master non-fast-forward\n
b31222cf 604----