Local Control

What is the status of being able to use the local control api?

Not yet.  I have some free time this week so I'll dig into it.

Great, thanks!
On Wed, Mar 9, 2016 at 4:36 PM Brad Johnson<EMAIL_ADDRESS>wrote:

Not yet. I have some free time this week so I'll dig into it.
—
Reply to this email directly or view it on GitHub
https://github.com/bradsk88/python-wink/issues/22#issuecomment-194516720
.

I'm waiting to get a response from Wink themselves.  I see the device on LAN but it won't accept commands so there must be an additional layer to get through.
They're usually pretty open about how their stuff works ... so fingers crossed.

It's looking for a bearer token to be set and I want to say it runs on port
8888.
It's great Wink has been so open.
On Fri, Mar 11, 2016 at 3:23 PM Brad Johnson<EMAIL_ADDRESS>wrote:

I'm waiting to get a response from Wink themselves. I see the device on
LAN but it won't accept commands so there must be an additional layer to
get through.
They're usually pretty open about how their stuff works ... so fingers
crossed.
—
Reply to this email directly or view it on GitHub
https://github.com/bradsk88/python-wink/issues/22#issuecomment-195533492
.

Yeah, I hit it with a bearer token.
I'm somewhat concerned that the API endpoints on the device might not match the ones on api.wink.com

Yeah, you're right. I've poked at the local api and can get a list of
devices. I have root access but I can't figure it out. Hopefully they can
shed some light.
On Fri, Mar 11, 2016 at 4:16 PM Brad Johnson<EMAIL_ADDRESS>wrote:

Yeah, I hit it with a bearer token.
I'm somewhat concerned that the API endpoints on the device might not
match the ones on api.wink.com
—
Reply to this email directly or view it on GitHub
https://github.com/bradsk88/python-wink/issues/22#issuecomment-195556749
.

At this time, we have not opened up local control for use by developers

:(

I would love to see local control access. Getting the token is possible if you root the device OR get one via the V2 API with your credentials (supposedly, I'm still waiting for Wink to give me credentials to test this method).
In the meantime they did send me info on the v2 API and I have a token because my device is rooted: http://docs.winkapiv2.apiary.io/
curl -k –include -H "Authorization: Bearer TOKEN_HERER" -H "Content-type: 'application/json'" https://winkhub:8888/light_bulbs/1

HTTP/1.1 200 OK
content-type: application/json
content-length: 285
Date: Sat, 02 Jul 2016 00:44:25 GMT
Connection: keep-alive

{"data":{"hub_device_id":"1","object_type":"hub_device","discovered_at":1466484777.436,"last_reading":{"connection":true,"powered":false},"desired_state":{},"local_id":1,"created_at":1466484776.77,"name":"New HA Dimmable Light","updated_at":1467352807.649},"errors":[],"pagination":{}}

+1 for this.
At this time it would only work for Rooted winks hubs, but would be great.

@mannkind How were you able to get this to work? I'm on the newest firmware and I cannot for the life of me get it to respond. I just get an error 35 from curl about an unknown SSL protocol error??
I'm entering the curl command exactly as you've entered it (well save for the authorization token. I've also tried the examples from the README.md (which isn't there anymore on the newest version??) and I get the same curl error.
Did you (or anyone else) run into this problem? And if so, how did you solve it? I've wasted a couple hours on this and I've gotten nowhere.
Also In the config.json, I already have an access token, but the permissions are blank. What should get put into the permission field?
Sorry for bugging you guys, but I figured no harm in asking.

The curl commands I was using is posted over here. https://community.home-assistant.io/t/rooted-wink-local-control/4733/8
Are you ignoring ssl errors since the wink hub uses an invalid certificate?

I think so. I rarely use curl, so I might have the syntax wrong but from what I understand, shouldn't -k or --insecure do that? I've tried both and I've put them in every place possible, but still get that error lol. I'll try the commands from the HA site when I'm back home in a bit. I'm wondering if it has something to do with the machine I'm using? I was remoting in to a pi, so maybe there is something wrong with the SSL on it?
Would I get this problem if my bearer token is wrong? I know I manually modified it at one point.
In my config.json the client_permissions value is blank. Is yours as well? If not, what should it be set at?
Are you able to bulk issue state changed through the local control? As of right now I'm using wink-mqtt, but I have like 15 lights in my house, so I send 15 separate mqtt messages and it takes quite a while to process them all.
This is working on the latest firmware, correct? 2.66?
EDIT: Just tried it from a different computer. Still error 35.
Thanks!

@bazhip - Yup, it's the exact command I use from my RPi (maybe it's not perfect, but it works).
Here is some info on my tools used on my RPi.
uname -a
Linux themis 4.4.13-v7+ #894 SMP Mon Jun 13 13:13:27 BST 2016 armv7l GNU/Linux

bash --version
GNU bash, version 4.3.30(1)-release (arm-unknown-linux-gnueabihf)
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

curl --version
curl 7.38.0 (arm-unknown-linux-gnueabihf) libcurl/7.38.0 OpenSSL/1.0.1t zlib/1.2.8 libidn/1.29 libssh2/1.4.3 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API SPNEGO NTLM NTLM_WB SSL libz TLS-SRP

The only thing I changed in my config.js file was the created_at and updated_at values to<PHONE_NUMBER>.892 because I didn't want to deal with refreshing tokens. The client_permissions value is blank, even when the token was generated by the wink app.
The wink app says v2.66.0

I got it working!!
To anyone in the future with a similar problem:
I noticed the SHA-256 field was empty in config.json. I ended up regenerating the cert with the script in /opt/local_control and copying the new files over to /database/local_control/data. After that, I backed up config.json and deleted it. I restarted the localcontrol service and it generated a new config.json file which also contained the SHA-256. This still left the authorization token blank for some reason (didn't get regenerated). So, I copied the authorization token from the backup into the new one and restarted the service one more time and this time it was good to go!
Thanks for bearing with me!

I think so. I rarely use curl, so I might have the syntax wrong but from
what I understand, shouldn't -k or --insecure do that? I've tried both and
I've put them in every place possible, but still get that error lol. I'll
try the commands from the HA site when I'm back home in a bit. I'm
wondering if it has something to do with the machine I'm using? I was
remoting in to a pi, so maybe there is something wrong with the SSL on it?
Oh one other thing: are you able to bulk issue state changed through the
local control? As of right now I'm using wink-mqtt, but I have like 15
lights in my house, so I send 15 separate mqtt messages and it takes quite
a while to process them all.
Lastly, this is working on the latest firmware, correct? 2.66?
Thanks!
On Oct 20, 2016 4:37 PM, "rbflurry"<EMAIL_ADDRESS>wrote:
The curl commands I was using is posted over here. https://community.home-
assistant.io/t/rooted-wink-local-control/4733/8
Are you ignoring ssl errors since the wink hub uses an invalid certificate?
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/python-wink/python-wink/issues/22#issuecomment-255235670,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AJ3vbdw3hrrsQjuMya3mU-68cxe3f5sCks5q198wgaJpZM4HtIq4
.

curl -i -k -X GET "https://<IP_ADDRESS>:8888/devices"
-H "Authorization: Bearer $token"
replace $token with token. Works for me on 2.68
Have you guys figured out a way to control or get information of devices?

I was able to get a valid response with this using python as well.
url = host + "devices"
requests.packages.urllib3.disable_warnings()
response = requests.get(url, headers={'Authorization' : 'Bearer ' + token}, verify=False)
print (response.status_code)
print (response.headers['content-type'])
print (response.json())
No luck with changing state though.
This gets a 200 response but does not do anything to the thermostat. Unfortunately I do not have a bulb to test.
url = host + "thermostats" + "/1"
requests.packages.urllib3.disable_warnings()
response = requests.put(url, headers={'Authorization': 'Bearer ' + token, 'Content-Type':  application/json'}, data=json.dumps({"desired_state":{"fan_mode": on}}), verify=False)
print (response.status_code)
print (response.headers['content-type'])
print (response.json())

You should be able to use the same API found here - http://docs.winkapiv2.apiary.io/
At least it worked for me when controlling my lights.

That's what I have been trying but no luck yet with thermostat.
I am trying to get "last_reading" states to show current temp on HASS but I
keep getting a syntax error or no such property error.
On Oct 25, 2016 18:39, "Dustin"<EMAIL_ADDRESS>wrote:

You should be able to use the same API found here -
http://docs.winkapiv2.apiary.io/
At least it worked for me when controlling my lights.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/python-wink/python-wink/issues/22#issuecomment-256198872,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AFPiQ3JFIeQ3LhwTAAc6M2663ScAWMdhks5q3oU3gaJpZM4HtIq4
.

@asapkota I believe local control is only for lights and switches.

 I thought they exposed the local control api for all
devices.
Is there a way to run a aprond command directly from HASS?
On Oct 25, 2016 19:09, "rbflurry"<EMAIL_ADDRESS>wrote:

@asapkota https://github.com/asapkota I believe local control is only
for lights and switches.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/python-wink/python-wink/issues/22#issuecomment-256205244,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AFPiQ0zIHSNNS7oemfN88jHzJP-ch3Dvks5q3owkgaJpZM4HtIq4
.

Can someone who has a rooted hub send me a dump of the data? My email address is in my bio or github.  Trying to figure out how the the local access bearer pin is encrypted. I have found the API call to get the hash, but I don't know how to decrypt. And I want to make sure the hash is actually the bearer token as it isn't exactly said, what the hash is used for other than "local public hash".

@bazhip Do you still have a rooted hub that you could send me a dump of? The php code? Look at my above comment if you need more info.

The latest firmware? There's no more PHP. It's all node. If you want one
with PHP, it's not going to have the local control API on there.
On Feb 18, 2017 6:09 PM, "AppleTechy"<EMAIL_ADDRESS>wrote:

@bazhip https://github.com/bazhip Do you still have a rooted hub that
you could send me a dump of? The php code? Look at my above comment if you
need more info.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/python-wink/python-wink/issues/22#issuecomment-280884866,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AJ3vbWBE77t7_lnw3TVTpnm2DBVKkN-Jks5rd4gqgaJpZM4HtIq4
.

@bazhip Do you have access to the node dump? That would be extremely helpful. Trying to figure out its naming scheme since the API rarely has the name assigned to it in their App. So I am trying to find out how it's assigning names to numbers...

Also has anyone figured out how Wink is generating nonces?

@asapkota I did some testing using aprond over SSH to my wink hub (its rooted)
But the time it took to setup a SSH session with every command was not the quickest or most reliable.

Added in #76


PINPOINT V3 user and user groups insert properly but not display in UI

hi all,
I have deployed and configured pinpoint V3 with separate KAFKA cluster, PINOT cluster, MYSQL cluster and Redis. All functions are working perfectly other than User and User Group. I’m able to create users and user groups and MYSQL database also updated properly. But I’m not able to see user, user group over web UI. I can Insert through web UI but not display. Also, no user and user group mapping available. I’ve described property files and start command in below. Please help me to resolve this issue.
### collector
collector-starter-application.yml
pinpoint:
zookeeper:
address: localhost
metric:
kafka:
bootstrap:
servers: <IP_ADDRESS>:9092
spring:
pinot-datasource:
pinot:
jdbc-url: jdbc:pinot://<IP_ADDRESS>:9001
username: admin
password: admin
Collector start using
java -jar -Dspring.redis.username=default -Dspring.redis.password='' -Dspring.config.additional-location=collector-starter-application.yml pinpoint-collector-starter-3.0.0-exec.jar
### web
web-starter-application.yml
pinpoint:
modules:
webhook:
web:
webhook: true
zookeeper:
address: localhost
spring:
pinot-datasource:
pinot:
jdbc-url: jdbc:pinot://<IP_ADDRESS>:9001
username: admin
password: admin
tenantId: pinpoint
broker:
addresses:
- <IP_ADDRESS>:7001
- <IP_ADDRESS>:7002
web start using
java -jar -Dpinpoint.modules.webhook.web.webhook=true -Dspring.config.additional-location=web-starter-application.yml pinpoint-web-starter-3.0.1-SNAPSHOT-exec.jar
### batch
batch-starter-application.yml
pinpoint:
zookeeper:
address: localhost
metric:
kafka:
bootstrap:
servers: <IP_ADDRESS>:9092
spring:
pinot-datasource:
pinot:
jdbc-url: jdbc:pinot://<IP_ADDRESS>:9001
username: admin
password: admin
jdbc.properties
spring.datasource.hikari.jdbc-url=jdbc:mysql://localhost:3306/pinpoint
spring.datasource.hikari.username=admin
spring.datasource.hikari.password=C0lumnStore!
spring.datasource.hikari.pool-name=HikariPool-main-dataSource-local
spring.datasource.hikari.minimum-idle=3
spring.meta-datasource.hikari.minimum-idle=3
batch start using
java -jar -Dpinpoint.zookeeper.address=localhost -javaagent:/opt/agent/pinpoint-bootstrap.jar -Dspring.config.additional-location=batch-starter-application.yml pinpoint-batch-3.0.1-SNAPSHOT-exec.jar

thanks,
Pradeep

@pradeepgunsgmail
To summarize your question, I understand that you are asking because you have data, but the web UI does not output the data.

Please check the logs output by the web server first to see if there is anything unusual.
Also check the UI console logs to make sure there are no error logs.


jtool /bootstrap/usr/local/bin/ signing error. barfing.

jtool /bootstrap/usr/local/bin/ signing error. barfing.

wangfeideiPhone:~/bfinject root# bash bfinject -p 550 -L cycript
[+] Electra detected.
bfinject: line 172: md5sum: command not found
bfinject: line 173: md5sum: command not found
cp: '/electra/usr/local/bin/bfinject4realz' and '/electra/usr/local/bin/bfinject4realz' are the same file
bfinject: line 184: tail: command not found
bfinject: line 184: cut: command not found
[+] Injecting into ''
[+] Getting Team ID from target application...
bfinject: line 199: tail: command not found
bfinject: line 199: cut: command not found
bfinject: line 199: cut: command not found
[+] WARNING: No Team ID found. Continuing regardless, but expect weird stuff to happen.
[+] Thinning dylib into non-fat arm64 image
[+] Signing injectable .dylib with Team ID  and platform entitlements...
jtool /electra/usr/local/bin/ signing error. barfing.


Panther (X1) failed to start team building

The system cannot be started after Panther (X1) is flashed into the fleet. I have tested other versions of pi4 and can start the system, but it also prompts an error and cannot be used. It cannot be used with Panther x1. How can I solve it?

You need to share more details. Error messages etc.


Failed db login exception on db creation

Bug Report / Support Request Template
If you are opening a feature request, you can ignore this template. Bug reports and requests for assistance usually require the same basic information described below. This will help us more quickly reproduce and investigate the problem you're reporting. (If you are using Serilog.Sinks.MSSqlServerCore, that package is deprecated, please switch to Serilog.Sinks.MSSqlServer before reporting an issue.)

Please clearly describe what the SQL Sink is doing incorrectly:
When trying to create the mssql db using package manager console executing a update-database, the mssql sink generates a login exception.

Please clearly describe the expected behavior:

List the names and versions of all Serilog packages used in the project:

Serilog: 8.0.1 (Serilog.AspNetCore)
Serilog.Sinks.MSSqlServer:  This happens when using a version higher than 6.3.0.
(configuration, etc.)

Target framework and operating system:

[x] .NET 8
OS: Running on top of WSL and dotnet/aspnet image

Provide a simple reproduction of your Serilog configuration code:
"Serilog": {
"Using": [ "Serilog.Sinks.Console" ],
"EnableUi": true,
"MinimumLevel": "Information",
"WriteTo": [
{
"Name": "Console",
"Args": {
"outputTemplate": "[{Timestamp:u} {Level:u3}] {Message:lj}{NewLine}{Exception}"
}
},
{
"Name": "MSSqlServer",
"Args": {
"connectionString": "DefaultConnection",
"sinkOptionsSection": {
"tableName": "ServiceLogs",
"schemaName": "dbo",
"autoCreateSqlTable": true
},
"restrictedToMinimumLevel": "Information"
}
}
]
},

Provide a simple reproduction of your Serilog configuration file, if any:

Provide a simple reproduction of your application code:
Line throwing the exception:
builder.Host.UseSerilog((ctx, lc) =>
{
lc.ReadFrom.Configuration(ctx.Configuration);
});

I noticed that since mssqk sink version 6.4.0, the sql executor is re-throwing the exception (see here):
https://github.com/serilog-mssql/serilog-sinks-mssqlserver/commit/bf1f5e67baaa3231d91ca6d05e7fba51c1441e8f
https://github.com/serilog-mssql/serilog-sinks-mssqlserver/commit/bf1f5e67baaa3231d91ca6d05e7fba51c1441e8f#diff-f8c67af6a71f2771abeac7d9eb21caee190c7f6530085394bd37f24c60c9e65a
Not sure why the change, but this sink should not be trying to connect to database on a db migration execution (e.g. update-database).
When I downgrade to 6.3.0, everything works as expected (db creation is successful).

Same for me with Serilog.Sinks.MSSqlServer version 6.6.0
A downgrade to 6.3.0 helped

Hi @alexsrdev and @C-Coretex!
I'll take a look at this as soon as I can. Thanks for letting us know.
Christian

This issue also impacted me. It was particularly tricky to track down because in our environment the database is only missing during certain test stages via docker-compose (spins up new/fresh/empty sql server and spins up the API who's efcore migrations then create the database).
A lot of effort to track this down. And only tracked down by detailed examination of the stack trace and noticing that Serilog was in the middle of it.
Three workarounds:

Do not upgrade past 6.3.0
Add the sink option "autoCreateSqlDatabase": true
Change where you call EFCore migrations from to happen before the "builder.Build()" call

Note that the autoCreateSqlDatabase flag may require access to the "master" database, regardless of whether or not the logging database exists or not. This fails on Azure SQL (the master database is not user accessible).
So... not much of a work around if your app/api actual deployment uses Azure SQL,

Hi!
Thank you for reporting this. Please be aware that the auto create log table and log database features were intended for convenient local testing and development purposes. Those features are not recommended for production deployments. I think we should state this clearly in the documentation.
The rethrow of exceptions in SQL executor class was added because when using the audit sink (AuditTo()) the calling code needs to have a way of knowing when a log attempt failed and be able to handle this situation. The batched sink (WriteTo()) does not rethrow such exceptions because it writes log events delayed in the background and not syncronously like audit.
Regarding the access to master db in Azure SQL, I think you are just lacking the correct permissions for the identity which the SQL sink is running with. According to this documentation, access to master db is possible in Azure SQL https://learn.microsoft.com/en-us/azure/azure-sql/database/logins-create-manage?view=azuresql#create-additional-logins-and-users-having-administrative-permissions.
Since some of you might experience this issue, can someone please share a complete but simple sample application which we can use to reproduce the problem (using a local SQL instance)?
Thank you.
Christian

I will close this issue soon due to inactivity and since we could not reproduce it yet.

@ckadluba : This happens when you ask the mssql sink to create the log table if doesn't exist and the db hasn't being created yet.
E.g (appsettings approach):
"Serilog": {     "Using":  [ "Serilog.Sinks.Console", "Serilog.Sinks.MSSqlServer" ],     "MinimumLevel": "Debug",     "WriteTo": [       { "Name": "Console" },       {          "Name": "MSSqlServer",         "Args": {           "connectionString": "Server=localhost,1433;Database=myDataBase;User=sa;Password=Password1234;TrustServerCertificate=true",           "tableName": "Logs",           "autoCreateSqlTable": true         }       }     ]   }
If I execute this "dotnet ef database update" command using the terminal, the console receive the error, but it continues and creates the db. Now, when I try to use Visual Studio Package Manager console, the error halt the command execution and it doesn't creates the db.
This is the behavior starting at 6.4.0 and later from any type of project so you can tried from your own.

I have no sample with EF core and MSSQL sink and also no bandwidth to create one right now. If you want to help us to investigating this, please send a complete and simple sample program that we can run to duplicate your issue. It should be easy for you to provide that.

Sure, no problem.  serilog.mssqlsink.test


Add the possibility to mount Custom volumes to Scan Jobs

What steps did you take and what happened:
I deployed the operator with the helm chart
  serviceMonitor:
    enabled: true
    interval: 60s
    # -- The namespace where Prometheus expects to find service monitors
  #namespace: ~
  excludeNamespaces: "openshift,kube-system,infra-trivy-system,openshift-*"
  ## ,infra-backup-projects

  operator:
    replicas: 2
    scanJobsConcurrentLimit: 3
    # keep scanjob during x time before deleting it
    scanJobTTL: "10m"

  trivy:
    command: image
    ignoreUnfixed: true
#   # -- httpProxy is the HTTP proxy used by Trivy to download the vulnerabilities database from GitHub.
#   httpProxy: ~
#   # -- httpsProxy is the HTTPS proxy used by Trivy to download the vulnerabilities database from GitHub.
#   httpsProxy: ~
#   # -- noProxy is a comma separated list of IPs and domain names that are not subject to proxy settings.
#   noProxy: ~

## in oder to test fs option
  trivyOperator:
      scanJobAutomountServiceAccountToken: true
      scanJobPodTemplateContainerSecurityContext:
          # For filesystem scanning, Trivy needs to run as the root user
          # https://aquasecurity.github.io/trivy-operator/v0.16.1/tutorials/private-registries/
          runAsUser: 0
          privileged: true
          allowPrivilegeEscalation: true
          readOnlyRootFilesystem: true

Trivy is not able to scan image from private registry even if the image is already available on the cluster(openshift)  node
{"level":"error","ts":"2024-03-08T10:45:16Z","logger":"reconciler.scan job","msg":"Scan job container","job":"infra-trivy-system/scan-vulnerabilityreport-79db7ff9bb","container":"backup","status.reason":"Error","status.message":"2024-03-08T10:45:25.304Z\t\u001b[31mFATAL\u001b[0m\t
image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: 4 errors occurred:\n\t* docker error: unable to inspect the image (registry.redhat.io/openshift4/ose-cli:v4.11):
 Cannot connect to the Docker daemon at unix:///var/run/docker.sock.
 Is the docker daemon running?\n\t*
containerd error: containerd socket not found: /run/containerd/containerd.sock\n\t*
 podman error: unable to initialize Podman client:
 no podman socket found: stat podman/podman.sock: no such file or directory\n\t*
remote error: GET https://registry.redhat.io/auth/realms/rhcc/protocol/redhat-docker-v2/auth?scope=repository%3Aopenshift4%2Fose-cli%3Apull&service=docker-registry: UNAUTHORIZED:
Please login to the Red Hat Registry using your Customer Portal credentials. Further instructions can be found here: https://access.redhat.com/RegistryAuthentication\n\n\n

What did you expect to happen:
I enabled the podman on clusters nodes as documented here: https://aquasecurity.github.io/trivy/v0.49/docs/target/container_image/#podman
systemctl --user enable --now podman.socket
So, the podman sock is available on nodes on following path:

/run/podman/podman.sock
/run/user/1000/podman/podman.sock

But trivy scan jobs is still failing, it cannot find it :  podman error: unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory\n\t* remote error: GET
It is like, trivy is looging in root path: / , /podman/podman.sock  instead of the appropriate folder for sock: /run/....
If there was option to add extraEnvs, the path could be fixed with XDG_RUNTIME_DIR  but it is not the case.
ANd even if the path is fixed, it will still need the extra/custom volumeMounts
I manually created a job with the operator job template where I mounted the podman.sock with cmd overrided with sleep
and I manually run trivy image --slow 'registry.redhat.io/openshift4/ose-cli:v4.11' --scanners vuln --image-config-scanners secret   --skip-db-update   --cache-dir  /tmp/trivy/.cache --quiet --list-all-pkgs --format json
it works fine  if the pod is scheduled on node where the image is available and visible in the output of podman images
      containers:
      - args:
        - -c
        - sleep 900
        command:
        - /bin/sh

## add podman.sock in volumes
      volumes:
      - name: sock
        hostPath:
          path: /run/podman/podman.sock
      - emptyDir: {}
        name: tmp
      - emptyDir: {}
        name: scanresult

        volumeMounts:
        - name: sock
          mountPath: /run/podman/podman.sock
        - name: sock
          mountPath: podman/podman.sock
        - mountPath: /tmp
          name: tmp
        - mountPath: /tmp/scan
          name: scanresult

After my manual test, I wanted to add the podman.sock volumeMount in the Operator Chart so it could be mounted by trivy-operator  automatically
The current available option "volume, volumeMounts" , only mounts them in the trivy-operator pod and not in the scan jobs pods
So adding extraEnvs and extraVolumeMounts for the scan jobs/pods will be nice !
Environment:

Trivy-Operator version (use trivy-operator version): 0.20.6
Kubernetes version (use kubectl version): v1.26.9+  | openshift 4.13.x
OS (macOS 10.15, Windows 10, Ubuntu 19.10 etc):

@cdtzabra contributions are welcome


Incorporate serializer into GitHub CI

@dylan-sa observed that if someone accepts a suggestion in a PR review, it gets committed without going through the serializer. We need to include it in the CI in order to flag syntax errors in the ontology. Errors are not likely in the case of simple annotation changes, but if there are changes to axioms this could be a problem.
In fact, we should be running a reasoner in the CI as well in order to catch logic errors.
Maybe there's a better way to do this. This approach of course doesn't prevent syntax or logic errors from being committed and pushed, but only flags them. Not everyone even looks at the build report.

Yup, I was already thinking about adding this so I've assigned it to me.


fix: test directory path was missing the dir prefix

You can see from the Actions output that no test is being executed since adding the bogus if directory check:
Compare the "Running all control policy tests" section of the latest:
https://github.com/kubescape/cel-admission-library/actions/runs/6380302477/job/17314432072
and the last "real" run:
https://github.com/kubescape/cel-admission-library/actions/runs/6239124590/job/16936381023

Thanks @Tyrael , I don't know how this went under the radar before 😮
(koszi a segitseget 😉 )


No function named CheckkkkIn was found to execute

Looks like someone had a sticky keyboard while they were committing ProgressiveRewards.cs. ;)

:) updated.


1 add integration tests with postgres

Looks like CI is not properly set for Actions. Will have to look into this. Ignore it for now.

pystring.py cannot be found by the runner. That's more important.


Create group

Few ideas on how to extend this one:

allow specification of --path and --name to allow naming the group directly

both as templated fields expanded from CSV columns
if  --name is missing, it is taken from --path (--path is required)
this would be really nice to have :-)

automatically create parent group(s) if they do not exist

running as --from parent --path 'a/{name}' would first create parent/a group and inside that one the group {name} as specified in the CSV column name
this might be nice but is not required :-)

So, this recent commit should take care of it.
There is now an option to specify --name and diffefentiate the actual group name
from --path, which, in contrast, is required.

All of the comments were helpful and made sense to me.
They are now implemented in the last commit. :)


Help request - configured with s3, issue in the server log

Hi there, we're trying to setup a remote cache using AWS S3 and can see the following error in the log relating to the line of code below. Note using k8s, this image - ducktors/turborepo-remote-cache:1.14.1.
{"severity":"WARNING","level":40,"time":1684164667390,"pid":7,"hostname":"turborepo-cache-57d6c996db-m8ktx","reqId":"WmEucNymQiefEGn9CLNAYw-0","data":null,"isBoom":true,"isServer":false,"output":{"statusCode":400,"payload":{"statusCode":400,"error":"Bad Request","message":"Missing Authorization header"},"headers":{}},"stack":"Error: Missing Authorization header\n    at Object.<anonymous> (/home/app/node/src/plugins/remote-cache/index.ts:56:27)\n    at hookIterator (/home/app/node/node_modules/.pnpm/fastify@4.12.0/node_modules/fastify/lib/hooks.js:246:10)\n    at next (/home/app/node/node_modules/.pnpm/fastify@4.12.0/node_modules/fastify/lib/hooks.js:174:16)\n    at hookRunner (/home/app/node/node_modules/.pnpm/fastify@4.12.0/node_modules/fastify/lib/hooks.js:196:3)\n    at Object.routeHandler [as handler] (/home/app/node/node_modules/.pnpm/fastify@4.12.0/node_modules/fastify/lib/route.js:469:7)\n    at Router.callHandler (/home/app/node/node_modules/.pnpm/find-my-way@7.6.0/node_modules/find-my-way/index.js:398:14)\n    at Router.lookup (/home/app/node/node_modules/.pnpm/find-my-way@7.6.0/node_modules/find-my-way/index.js:376:17)\n    at Server.preRouting (/home/app/node/node_modules/.pnpm/fastify@4.12.0/node_modules/fastify/fastify.js:773:14)\n    at Server.emit (node:events:513:28)\n    at Server.emit (node:domain:489:12)","type":"Error","message":"Missing Authorization header"}

https://github.com/ducktors/turborepo-remote-cache/blob/main/src/plugins/remote-cache/index.ts#L56
The following env vars are set, key and secret via ~/.aws.
STORAGE_PROVIDER - s3
STORAGE_PATH - something
AWS_REGION - eu-west-2
S3_ENDPOINT - https://XXX.s3.eu-west-2.amazonaws.com

This is a result of trying to run a command against this server, local command being
turbo run ci:lint -vvv --remote-only

with .turbo/config.json of
{
  "teamId": "team_myteam",
  "apiUrl": "XXXXX",
  "token": "XXXXX"
}

Won't lie, not too sure what aspect of this is unhappy but expect it's something to do with our config :) any help would be appreciated please!

Hey. The project config file doesn’t support passing the token. This is a turbo limitation. You should use one of the 3 methods described here https://ducktors.github.io/turborepo-remote-cache/custom-remote-caching#config-file

Hey @fox1t , thanks for the reply!
We tried using only ENV vars listed here and had the same result - https://ducktors.github.io/turborepo-remote-cache/custom-remote-caching#local-environment-variables

Hey @fox1t, is there any solution for this issue please ?

I had some time to work on it again. It turns out that the TURBO_TOKEN was causing problems due to a special character.
It works perfectly now.
Thanks for your work !


Build a more complete vignette for the R CORE package

I'd be interested in working on a broader (or separate) vignette for the R package.  Currently this is raised as an issue within the R package repository.

Hi @SimonGoring how are you doing? Let me know if you need any help with this.

I've started & am just going to get the most recent commit up.  I don't have much background on CORE & what it does n the vignette, that might be helpful.  I'll ref. this issue when it's pushed.


CRI: improve image pulling performance

Background:
With current design, the content backend uses key-lock for long-lived
write transaction. If the content reference has been marked for write
transaction, the other requestes on the same reference will fail fast with
unavailable error. Since the metadata plugin is based on boltbd which
only supports single-writer, the content backend can't block or handle
the request too long. It requires the client to handle retry by itself,
like OpenWriter - backoff retry helper. But the maximum retry interval
can be up to 2 seconds. If there are several concurrent requestes fo the
same image, the waiters maybe wakeup at the same time and there is only
one waiter can continue. A lot of waiters will get into sleep and we will
take long time to finish all the pulling jobs and be worse if the image
has many more layers, which mentioned in issue #4937.
After fetching, containerd.Pull API allows several hanlers to commit
same ChainID snapshotter but only one can be done successfully. Since
unpack tar.gz is time-consuming job, it can impact the performance on
unpacking for same ChainID snapshotter in parallel.
For instance, the Request 2 doesn't need to prepare and commit, it
should just wait for Request 1 finish, which mentioned in pull
request #6318.
	Request 1	Request 2

	Prepare
	   |
	   |
	   |
	   |		Prepare
	Commit		   |
			   |
			   |
			   |
			Commit(failed on exist)

Both content backoff retry and unnecessary unpack impacts the performance.
Solution:
Introduced the duplicate suppression in fetch and unpack context. The
deplicate suppression uses key-mutex and single-waiter-notify to support
singleflight. The caller can use the duplicate suppression in different
PullImage handlers so that we can avoid unnecessary unpack and spin-lock
in OpenWriter.
 The image is hold in local registry
service by docker run -d -p 5000:5000 --name registry registry:2.

image_name="${1}"
pull_times="${2:-10}"

cleanup() {
  ctr image rmi "${image_name}"
  ctr -n k8s.io image rmi "${image_name}"
  crictl rmi "${image_name}"
  docker rmi "${image_name}"
  sleep 2
}

crictl_testing() {
  for idx in $(seq 1 ${pull_times}); do
    crictl pull "${image_name}" > /dev/null 2>&1 &
  done
  wait
}

docker_testing() {
  for idx in $(seq 1 ${pull_times}); do
    docker pull "${image_name}" > /dev/null 2>&1 &
  done
  wait
}

cleanup > /dev/null 2>&1

echo 3 > /proc/sys/vm/drop_caches
sleep 3
echo "crictl pull $image_name (x${pull_times}) takes ..."
time crictl_testing
echo

echo 3 > /proc/sys/vm/drop_caches
sleep 3
echo "docker pull $image_name (x${pull_times}) takes ..."
time docker_testing

Fixes: #4937
Close: #4985
Close: #6318
Signed-off-by: Wei Fu<EMAIL_ADDRESS>

ping @dmcgowan @dcantah @mikebrow @cpuguy83 @kzys ~

@AkihiroSuda Updated. PTAL

@kzys thanks for the review. Updated and PTAL

Forgot to post but did some testing on this branch for Windows and things look great :)
Main:
$a=1..1 | %{start-job {C:\Users\dcanter\ctrd\crictl.exe --runtime-endpoint=npipe://.//pipe//containerd-containerd pull mcr.microsoft.com/windows/nanoserver:1809}}; $a |
 wait-job | receive-job; $a | %{$_.psendtime-$_.psbegintime} | % totalseconds
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
17.8983766

$a=1..15 | %{start-job {C:\Users\dcanter\ctrd\crictl.exe --runtime-endpoint=npipe://.//pipe//containerd-containerd pull mcr.microsoft.com/windows/nanoserver:1809}}; $a | wait-job | receive-job; $a | %{$_.psendtime-$_.psbegintime} | % totalseconds
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
51.5162342
51.3809107
51.2559466
51.1992656
51.064453
50.9273102
51.626007
51.4810574
51.3681143
51.2113417
51.1533046
51.0257826
50.926644
50.7750941
50.7296746

This branch:
$a=1..1 | %{start-job {C:\Users\dcanter\ctrd\crictl.exe --runtime-endpoint=npipe://.//pipe//containerd-containerd pull mcr.microsoft.com/windows/nanoserver:1809}}; $a | wait-job | receive-job; $a | %{$_.psendtime-$_.psbegintime} | % totalseconds
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
16.2531684

$a=1..15 | %{start-job {C:\Users\dcanter\ctrd\crictl.exe --runtime-endpoint=npipe://.//pipe//containerd-containerd pull mcr.microsoft.com/windows/nanoserver:1809}}; $a | wait-job | receive-job; $a | %{$_.psendtime-$_.psbegintime} | % totalseconds
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
Image is up to date for sha256:addc7e20f5aeaffbf1c4e5abef3d3074feb602202a016f1de4e1dd17d48b07bd
17.4858726
17.4024589
17.2860111
17.1856655
17.065584
16.950047
16.820578
16.6865264
16.5449806
16.3833394
16.1996733
16.0105434
15.7886565
15.5474459
15.3423657

This is awesome @fuweid! Thank you

@dcantah @kzys @cpuguy83 @AkihiroSuda @dmcgowan @mikebrow would you have time to take a look and move it forward? Thanks 🙏

I'll need to give this one more pass over (sorry was out for a little) but something that comes to mind here, how do we plan to test this e2e? The whole flow/options are setup on the cri client but the only unit tests are for the kmutex functionality. Ideally we'd have something to validate/benchmark that pulling multiple of the same image through cri has an acceptable delta between just pulling the image once (or an image that shares many of the same layers)

@dcantah Is it ok to add tools in contrib package to do verify?
I added the test case at the beginning but it is hard to measure the performance, just measure the functionality.
I can do it in the followup if it is acceptable.

I added the test case at the beginning but it is hard to measure the performance, just measure the functionality.

Right, this my struggle with my change as well

I can do it in the follow up if it is acceptable.

I'd be fine with this, but I'd like others to chime in

This looks like it makes sense for CRI, however other clients may use multiple namespaces. In this case if the content is not shared across namespaces (either via content_sharing_policy or in a shared namespace), then ns B will block until ns A finishes its pull, even though ns B still has to do its own content pull afterwards. In this case we will actually have worse performance than today, I think.
However it is hard for the client code to judge whether the content will be re-used or not. We basically need the client to know the result of this check ahead of time. I don't know if there is a good way to do this.

however other clients may use multiple namespaces. In this case if the content is not shared across namespaces (either via content_sharing_policy or in a shared namespace), then ns B will block until ns A finishes its pull, even though ns B still has to do its own content pull afterwards. In this case we will actually have worse performance than today, I think.

Currently, containerd content backend use ${namespace}/1/${ref} as key during fetching into ingest, which means that it doesn't cause conflict.
It think it isn't worse but it will bring IO pressure. I use the following code to test in my local. Hope it can help ~
# Terminal 1
➜  testing go build .
➜  testing sudo ./testing # pulling golang:latest in my local
take 7.692565639s

# Terminal 2
➜  ~ sudo find /var/lib/containerd/io.containerd.content.v1.content/ingest/ -name ref | xargs -n 1 -I {} bash -c "echo {} && cat {} && echo"
/var/lib/containerd/io.containerd.content.v1.content/ingest/999909aafa7c383cdc77a773efd1220ff2c2b7f8d46b48ccb8b96a57531b97f4/ref
ns-2/1/layer-sha256:12de8c754e45686ace9e25d11bee372b070eed5b5ab20aa3b4fab8c936496d02

/var/lib/containerd/io.containerd.content.v1.content/ingest/4d6d7181af063a6923ea2e554638b9a145dd87327fec9463c07fb24a3dce5723/ref
ns-1/1/layer-sha256:8c86ff77a3175ed4d7958578d141a96b5da005855d60ea24067de33cd62e4c36

/var/lib/containerd/io.containerd.content.v1.content/ingest/7c3fb6fa54ae2d364193cb36cbd63a88beed443d514e2c27945b8e0e4c5e4a97/ref
ns-2/1/layer-sha256:8c86ff77a3175ed4d7958578d141a96b5da005855d60ea24067de33cd62e4c36

/var/lib/containerd/io.containerd.content.v1.content/ingest/ff6a1752b9ae6d472ac32cb78c808bb2263527ee68d7ff999b87bf3450059f9e/ref
ns-2/1/layer-sha256:e4d61adff2077d048c6372d73c41b0bd68f525ad41f5530af05098a876683055

/var/lib/containerd/io.containerd.content.v1.content/ingest/ace6e7c9ec041b47295769b0599c1186e7ce345ea1cd4d38db8e64fe3c4a5e1c/ref
ns-1/1/layer-sha256:12de8c754e45686ace9e25d11bee372b070eed5b5ab20aa3b4fab8c936496d02

➜  ~ sudo containerd config dump | grep content_sharing_policy
    content_sharing_policy = "isolated"

The original change shared map between different interfaces and introduced unnecessary new interface, which is not good.
And @kevpar also shares idea about this change. I has updated it and keep the change scope in unpacker.go.
@kevpar @dcantah @kzys @dmcgowan PTAL. Thanks

CI is green!


[Bug]: Summary of the empty description list

Do you need to file an issue?

[ ] I have searched the existing issues and this bug is not already filed.
[ ] My model is hosted on OpenAI or Azure. If not, please look at the "model providers" issue and don't file a new one here.
[ ] I believe this is a legitimate bug, not just a question. If this is a question, please use the Discussions area.

Describe the bug
graphrag/index/graph/extractors/summarize/description_summary_extractor.py
line 68~73 It seems to summarize the empty description list.
Steps to reproduce
No response
Expected Behavior
No response
GraphRAG Config Used
# Paste your config here

Logs and screenshots
No response
Additional Information

GraphRAG Version:
Operating System:
Python Version:
Related Issues:

I think what you've identified is that line 70 should be an elif, otherwise a length 0 description list would end up in the empty string result being reassigned to a summary.
The logic should be:

If there is no description, the result is an empty string. This means that downstream summarization, such as the community reports, will not include information about the entity.
If the list of descriptions only contains one item, we just use that as the final description.
If the list is actually a list, we ask the LLM to summarize them so we have a single final description.


ReferenceError: device is not defined

i'm getting following issue

a little busy today >.< will look into it as soon as possible

The exception is throwed from this line:  https://github.com/BenBBear/ionic-cache-src/blob/master/ionic-cache-src.js#L206
device.platform

The device object is only available when the "deviceready" event is fired.  But I thought it should be fine, so didn't wrap that part code inside $ionicPlatform.ready.  My bad... sorry
It's an easy one and I will fix it.
Also check your project, have you installed the cordova-plugin-device? If not
cordova plugin add cordova-plugin-device

Oh, wait a minute.
Actually, I wrap the code....  The exception is from L239, see following
  $ionicPlatform  // the wrap
    .ready()
    .then(function() {
        var ext = '.' + attrs.cacheSrc.split('.').pop();
        var fileName = id() + ext;
        $cordovaFileTransfer
            .download(attrs.cacheSrc, getCacheDir() + fileName, {}, true)  //line 239
            .then(function() {
                cache[attrs.cacheSrc] = fileName;
                scope.uiOnFinish(scope, element, $compile, uiData);
                addSrc(getCacheDir() + fileName);
            }, scope.onError, function(progress) {
                uiData.progress = (progress.loaded / progress.total) * 100;
                scope.uiOnProgress(scope, element, $compile, uiData);
                scope.onProgress(uiData.progress);
            });
    });

So probably the problem is that you haven't installed the cordova-plugin-device plugin, so install it and try again. If problem keeps still, then let me know :)

wow thanks bro now it fixed :-)


WIP: Reimplement Firebase storage using CRDT

variable uses LWW (client always wins)
collection synchronizes the set of membership keys for each entry

Still need to:

[ ] clean up and comment FirebaseCollection
[ ] disable the version increment check in stoage-proxy
[ ] write more tests


How do I make my own dataset

In the dataset you gave for the tanksandtemples, how the individual files were made. I now have a video recorded by HD camera, how do I process his background and get his rgb/pose folder and bbox/intrinsics/test_traj.txt

Hi,
The tanks and temples dataset was provided by Point-NeRF. To make your own dataset, we would recommend the following:

For getting the camera poses and intrinsics from video: you can use colmap and run this script provided by Instant-NGP.
To segment the main object from the background: you can use tools such as SAM-Track, or photoshop.

Hope this helps!

Thank you,my bro


test/boot: use -chardev file over -chardev stdio

This changes -chardev stdio to -chardev file and uses a temporary
file to communicate with QEMU.
This fixes an issue where -chardev stdio hangs if STDIN is not a
TTY. I could not figure out how to make it work without a TTY, and it
does not print any meaningful diagnostics. Problem is, in CI and other
automated runners, we do not necessarily have a TTY as STDIN.
This just switches to a temporary file, which seems to work under all
circumstances.

(rebased on master)


It's possible to export duplicate names

Using:
  resolve: {
    alias: {
      jquery: __dirname + '/src/client/shim/jquery.js',
    }
  }

And shim/jquery being:
/*global $ */

// If this is a server side build then we just run with the Fruit Loops instance.
if ($serverSide) {
  module.exports = $;
} else {
  // Or hackily resolve the bower jquery library for clients
  module.exports = require('../../../bower_components/jquery');
}

We have multiple modules of the same name:
  "modules": {
    "1": {
      "chunk": 0,
      "name": "jquery"
    },
    "2": {
      "chunk": 0,
      "name": "handlebars/runtime"
    },
    "3": {
      "chunk": 0,
      "name": "thorax"
    },
    "5": {
      "chunk": 0,
      "name": "jquery"
    },
    "6": {
      "chunk": 0,
      "name": "underscore"
    },

This is due to the alias and the package main both resolving to jquery for their external name. We should give priority to alias entries and avoid exporting on the same name if an alias already exists.

Released in 2.0.0


unable to produce plan using module

│ Error: Invalid for_each argument
│
│   on .terraform/modules/metrics-project/main.tf line 108, in resource "rancher2_app_v2" "apps":
│  108:   for_each      = try({ for k, v in local.app_list : v.name => v }, {})
│     ├────────────────
│     │ local.app_list is tuple with 1 element
│
│ The "for_each" value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many
│ instances will be created. To work around this, use the -target argument to first apply only the resources that the for_each
│ depends on.
╵

TF code is here:
https://github.com/paraglade/rancher-it-infra/tree/EIO-592-setup-livestock-metrics-project
use of the try function might result in impure results that is documented here:
https://www.terraform.io/docs/language/meta-arguments/for_each.html#:~:text=for_each keys cannot be the result (or rely on the result of) of impure functions%2C including uuid%2C bcrypt%2C or timestamp%2C as their evaluation is deferred during the main evaluation step
the try function states that: access to data that isn't known until runtime as noted here:
https://www.terraform.io/docs/language/functions/try.html#:~:text=The try function can only catch and handle dynamic errors resulting from access to data that isn't known until runtime. It will not catch errors relating to expressions that can be proven to be invalid for any input%2C such as a malformed resource reference
I have an idea on how to fix this that I will test and if it works I will put in a PR.

Guessing the issue is caused by these assignments, https://github.com/paraglade/rancher-it-infra/blob/EIO-592-setup-livestock-metrics-project/cattleman/clusters/livestock/projects/metrics/project-metrics.tf#L86-L87

use of the try function might result in impure results that is documented here:
https://www.terraform.io/docs/language/meta-arguments/for_each.html#:~:text=for_each keys cannot be the result (or rely on the result of) of impure functions%2C including uuid%2C bcrypt%2C or timestamp%2C as their evaluation is deferred during the main evaluation step

for_each keys cannot be the result (or rely on the result of) of impure functions, including uuid, bcrypt, or timestamp, as their evaluation is deferred during the main evaluation step.
I don't see where is talking about the try function in that case.

the try function states that: access to data that isn't known until runtime as noted here:
https://www.terraform.io/docs/language/functions/try.html#:~:text=The try function can only catch and handle dynamic errors resulting from access to data that isn't known until runtime. It will not catch errors relating to expressions that can be proven to be invalid for any input%2C such as a malformed resource reference

Yes, this is the error that the terraform apply is stating.  Access to data that isn't known until runtime can't be accessed on the app.value field. The data should be injected like is done here, https://github.com/paraglade/rancher-it-infra/blob/EIO-592-setup-livestock-metrics-project/cattleman/clusters/livestock/projects/grafana/config/grafana/grafana-values.yaml#L27, using the private variable.


Add sccache to PATH after installation

This action installs sccache under $USERPROFILE/.cargo/bin. GitHub runner images already have $USERPROFILE/.cargo/bin in the PATH, but self-hosted runners may not. This PR makes this action update the user's PATH to include the installation directory. This allows self-hosted runners to find sccache and prevents breakages in the unlikely event that a different installation directory is chosen in the future.
Note: I recently closed a duplicate PR with the intention of merging from a different fork but it is easier to merge from kendalharland:main

Hi @hendrikmuhs, friendly reminder to PTAL when you can.

Thanks @kendalharland !
I can not really judge as I am not using this functionality. I wonder if changing the PATH in this action helps finding the binary in following actions in a github workflow. Normally that's not the case. But I guess you have tested it and can confirm?

@hendrikmuhs yes, that is the case - it helps find the executable. This would only apply for the job in which the extension is used as each job itself resets the environment.

Thank you!


Home Assistant is annoying with these errors

Logger: homeassistant.components.climate
Source: components/climate/init.py:354
Integration: Klima (documentation, issues)
First occurred: 08:23:00 (9 occurrences)
Last logged: 08:23:00
Entity None (<class 'custom_components.tuya_local.climate.TuyaLocalClimate'>) does not set ClimateEntityFeature.TURN_OFF but implements the turn_off method. Please create a bug report at https://github.com/make-all/tuya-local/issues
Entity None (<class 'custom_components.tuya_local.climate.TuyaLocalClimate'>) does not set ClimateEntityFeature.TURN_ON but implements the turn_on method. Please create a bug report at https://github.com/make-all/tuya-local/issues
Entity None (<class 'custom_components.tuya_local.climate.TuyaLocalClimate'>) implements HVACMode(s): off, heat, auto and therefore implicitly supports the turn_on/turn_off methods without setting the proper ClimateEntityFeature. Please create a bug report at https://github.com/make-all/tuya-local/issues
What do these errors mean?
Greetings George

Duplicate of #1597
It is not my policy to pick up new features of Home Assistant within days of release, as it leaves other users behind and as a volunteer I do not have enough free time to react that quickly.
If you want to complain about the log messages being annoying it would be better aimed at the HA developers for jumping straight to outputting deprecation warnings pointing at the integrations as the source of the "problem" rather than giving them a couple of months to adapt first.


Question: Why use two apps?

Hi Kamil,
I'm trying out your little tool here. So far promising. But why do you have the test codeunits in a separate extension?
In my mind, then its just get more complicated and takes more time, if you have it in a dependent extension. In a large extension, then maybe, but generally I would not like to use a separate extension.
There is no requirement from MS in regards to having it separate for AppSource either?

Hi Erik, if I am right, it is AppSource requirement to have tests in separate app...

From: Erik P. Ernst<EMAIL_ADDRESS>Sent: Saturday, September 22, 2018 5:52:43 PM
To: kine/MSDyn365BC_AppTemplate
Cc: Subscribed
Subject: [kine/MSDyn365BC_AppTemplate] Question: Why use two apps? (#1)
Hi Kamil,
I'm trying out your little tool here. So far promising. But why do you have the test codeunits in a separate extension?
In my mind, then its just get more complicated and takes more time, if you have it in a dependent extension. In a large extension, then maybe, but generally I would not like to use a separate extension.
There is no requirement from MS in regards to having it separate for AppSource either?
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHubhttps://github.com/kine/MSDyn365BC_AppTemplate/issues/1, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AAGujUCqufpPagxR0DphZr57eqhL9AtMks5udlzLgaJpZM4W1Uu_.


Update for 2.1.2 with module name

2.1.2 makes integrating via CocoaPods super simple, so I'm updating this example.

:+1:


Solution for what

Please document which problem cargo-temp solves.
Longer version:

What does cargo-temp do?
What does it better as cargo-generate?

The first paragraph of the readme states what's the difference and the purpose of that project, but maybe not so clear. So, it aims in making scratches like you would usually do at the Rust playground, but completely on your local machine.  Before the process ends (which can happen when one closes an IDE as an example) it prunes anything the user has done.
In short, it's mkdir temp_dir;$EDITOR temp_dir;rm -r temp_dir on steroids.

Thanks @YohDeadfall
The purpose of cargo-temp is briefly explained in the README, it helps you to create temporary project with given dependencies that will be deleted when you exit the shell created for this project.
About cargo-generate, it is not the same thing: cargo-generate create non-temporary Rust project from a template. If you use the generate feature of cargo-temp is basically the same but the created project is temporary and will be deleted like any other project generated by cargo-temp. So cargo-temp use cargo-generate but don't do anything "better".


Development Roadmap

Here is the development roadmap. Contributions and feedback are welcome.
Project Roadmap
1. Dynamic Vector Length Support

[ ] Implement variable vector length (not fixed at 128).

2. Value Prediction

[ ] Loop iterators.
[ ] vl prediction.
[ ] Generic value prediction.

3. Speculative Memory Bypassing

[ ] Table-less implementation.
[ ] Dynamic bypassing.

4. Top-down Analysis Framework

[ ] Further breakdown of details in top-down approach.
[ ] Detailed documentation for top-down methodology.
[ ] TIP/TEA integration.

5. Front-End Optimizations

[ ] 8-wide instruction issue
[ ] Two-taken branch predictor
[ ] uBTB: Expand for improved timing guarantees.
[ ] TAGE:

[ ] Increase from 5-table to 10-table cascaded comparison for better timing and reduced MPKI.
[ ] Compare increasing the number of levels versus increasing the number of entries.

[ ] Fetch Pipeline:

[ ] Refactor for two-taken + two-fetch mechanism.
[ ] Enable single-cycle access to multiple cache lines.
[ ] Clean up fetch and cache pipeline code.

6. Calibration

[ ] Detailed load/store pipeline: challenging, important, but not urgent.
[ ] Calibrate functional unit (FU).
[ ] Calibrate Memory speculation.
[ ] Calibrate prefetchers.

7.Hypervisor (H) Extension Improvements

[ ] OpenSBI + kernel support.
[ ] MMU & prefetch optimizations

8.Cliff - Microbenchmark for Calibration

[ ] Cliff for frontend testing.
[ ] Cliff for prefetcher evaluation.

How to Contribute to This Roadmap

To add a new task, use the following format:
- [ ] Task description

To mark a task as completed, change [ ] to [x]:
- [x] Completed task

To link to an issue or pull request, use the # symbol followed by the issue/PR number:
- [ ] Implement feature X (#123)

[ ] Implement feature X (#123)

Feel free to add comments or additional information using HTML comment syntax:<!-- This is a comment that won't be visible in the rendered markdown -->

I am excited to see the RoadMap, and the toolchain provided by Xiangshan has significantly improved the execution speed of gem5 and shortened the debugging time.
I'm a current master's student in computer architecture, and my current work is focused on value prediction, but I'm also interested in top-down analysis methods. I'd be happy to contribute to xs-gem5, but considering that xs-gem5 is in the internal development phase, I am unsure whether it is open to contributions from ordinary developers in the open-source community.
If so, could I send an email to the appropriate people? I'll describe my background, what I can do, and what I'd like to do in the email.
@jensen-yan

I am excited to see the RoadMap, and the toolchain provided by Xiangshan has significantly improved the execution speed of gem5 and shortened the debugging time.
I'm a current master's student in computer architecture, and my current work is focused on value prediction, but I'm also interested in top-down analysis methods. I'd be happy to contribute to xs-gem5, but considering that xs-gem5 is in the internal development phase, I am unsure whether it is open to contributions from ordinary developers in the open-source community.
If so, could I send an email to the appropriate people? I'll describe my background, what I can do, and what I'd like to do in the email.
@jensen-yan

xs-gem5 has ended internal development phase, and is now open to contributions!
On contributing to topdown/value prediction, we can open another issue to discuss. And you can also e-mail me<EMAIL_ADDRESS>or<EMAIL_ADDRESS>and @jensen-yan


[Bug] Linux installer doesn't run out of the box on Ubuntu 24.04

Before Reporting

[X] I found no existing issues matching my bug
[X] My issue is not caused by a plugin or theme

Describe the Bug
The Linux AppImage installer fails to run on a base amd64 installation of Ubuntu Linux 24.04 LTS. Here is the error message:
$ ./BetterDiscord-Linux.AppImage
dlopen(): error loading libfuse.so.2

AppImages require FUSE to run.
You might still be able to extract the contents of this AppImage
if you run it with the --appimage-extract option.
See https://github.com/AppImage/AppImageKit/wiki/FUSE
for more information

This is because by default Ubuntu 22.04 comes with libfuse3.so.3 instead, from the libfuse3-3 package.
For now, the missing shared library can still be installed using sudo apt install libfuse2t64. It might be helpful to document this extra step.
Also, I haven't checked whether this is specific to Ubuntu, or it came from upstream Debian. It might also affect recent versions of other distros.
Expected Behavior
AppImage binary should work out of the box.
Steps To Reproduce

Download the installer from the official project website
Mark it as executable with chmod +x
Try to execute it.

Operating System
Linux
Discord Version
Stable
BetterDiscord Version
N/A
Anything else?
No response

Oh, turns out, installing the libfuse2t64 package still doesn't fix the problem :joy:
Now the error message goes like:
$ ./BetterDiscord-Linux.AppImage
[90380:0604/170300.295693:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_BetterQQY0SY/chrome-sandbox is owned by root and has mode 4755.
Trace/breakpoint trap (core dumped)

afaik that's another Debian issue. I assume you've found it, but you should be able to just run the AppImage with the --no-sandbox flag


feat(acvm): expose black box solvers

Description
Problem*

Resolves #300
Summary*
This PR exposes the hash and ecdsa black box function solvers
Additional Context

PR Checklist*

[x] I have tested the changes locally.
[x] I have formatted the changes with Prettier and/or cargo fmt on default settings.

Superceded by #431


wanted: libcpr/cpr

Module location
https://github.com/libcpr/cpr
Link to bzlmod issue in the module's repository
No response
Any other context to provide?
No response
Fund our work

[ ] Sponsor our community's open source work by donating a feature bounty

Heads that we built https://github.com/hedronvision/bazel-make-cc-https-easy (which people use from the WORKSPACE and libcpr recommends), to make it easy to use libcpr from Bazel. As dependencies, it also builds curl, a backport of std::filesystem to make things work well across platforms, and boringssl.
Would be happy to work with folks to bring it over to bzlmod, but I think (Google) boringssl's lack of bzlmod support would be a blocking dependency currently. It would also be super nice if we could set up automation to auto-release on dependency auto-update. (I want to make sure we're keeping networked stuff up to date for security.)
[Crossref: https://github.com/hedronvision/bazel-make-cc-https-easy/issues/1]


Resume book generation

Upload resume on user profile semesterly, then generate one big PDF for companies

Single PDF is probably wonky to deal with on the receiving end. A ZIP file would be more useful.

For detecting images https://stackoverflow.com/a/32988533

Per @ryanstrat in Slack, this should export one PDF for a given search criteria (major and graduation semester). Ensure the resumes are one page each and ideally verify they're black and white and have no images.


creation of components in any pages  but No components display after refreshing any pages in nextjs

hey,
when i create  a page with these destack components, in nextjs then i refresh this page, the components disappear: there is a blank page. However, if i set up the index page with the components, in nextjs, then i will refresh the index page, it will contain all the previous components placed, in the index page.
Let's imagine, i create a page named "souffixe.js" in nextjs. Then i run it in the browser like 'http://localhost:3001/souffixe'. Then i place  the destack component like blog, in this page, then i refresh this page, all the components disappear. And i see "souffixe.json", in the files explorer, in the "data" folder.
How could you fix it? Or help me, fix it, please?

I confirm the same issue happening for me.

I missed this at the time. If someone encounters the same problem again, feel free to re-open the issue.


Bootstrap loading breaks in 1.12.12

We get a "Bootstrap class not found" exception after updating to 1.12.12. It seems that there's one require_once() call that should remain active on line 333 of Zend_Application.
    if (!class_exists($class, false)) {
        // require_once $path;
        if (!class_exists($class, false)) {
             throw new Zend_Application_Exception(
                'Bootstrap class not found'
             );
        }
    }

Disabling this require_once() call makes Zend_Application unable to load the Bootstrap class specified by the bootstrap.class and bootstrap.path config options. To the best of my knowledge the autoloader isn't intended to handle the bootstrap class.

Happy to create a pull request if you prefer.

:+1:

Any update on this? The bombayworks package is completely unusable until this is fixed.

+1

This can also be fixed by changing one of the class_exists() statements to if (!class_exists($class, true)) {
(to ensure the autoloader is hit)

Sorry for the delay, this should now be fixed in 1.12.12 and 1.12.13.

@deadbeef84 are you sure the original bug "class not found" error is solved?

I'm pretty sure. However, since I updated the existing broken releases, you may need to run composer clear-cache to avoid getting old packages.

Also, the issues in zf1/zend-application (https://github.com/zf1/zend-application/pull/2) still remains, but it needs a different fix - will try too look into this later this week.


Uncaught TypeError: Cannot read property 'concat' of undefined

Cannot figure out why this is happening for the life of me.
Here's my package JSON.
{
  "name": "flux-gulp",
  "version": "0.0.0",
  "description": "",
  "author": "",
  "license": "ISC",
  "scripts": {
    "start": "gulp"
  },
  "devDependencies": {
    "browser-sync": "^2.2.1",
    "browserify": "^9.0.3",
    "connect-history-api-fallback": "0.0.5",
    "es6ify": "^1.6.0",
    "flux": "^2.0.1",
    "gulp": "^3.8.11",
    "gulp-concat": "^2.5.2",
    "gulp-ruby-sass": "^1.0.0-alpha.3",
    "gulp-sourcemaps": "^1.3.0",
    "gulp-util": "^3.0.3",
    "keymirror": "^0.1.1",
    "object-assign": "^2.0.0",
    "react": "^0.12.2",
    "react-async": "^2.0.1",
    "react-router": "^0.12.0",
    "reactify": "^1.0.0",
    "rx": "^2.4.0",
    "vinyl-buffer": "^1.0.0",
    "vinyl-source-stream": "^1.0.0",
    "watchify": "^2.4.0",
    "webpack": "^1.5.3",
    "webpack-dev-server": "^1.7.0"
  },
  "browserify": {
    "transform": [
      [
        "reactify",
        {
          "harmony": true
        }
      ]
    ]
  }
}

Can you show us what your routes config looks like?


Why does generate_content against a tuned model require transport='grpc'

Description of the bug:
When Accessing a tuned model i need to configure grcp.
genai.configure(api_key=os.getenv("API_KEY"))
genai.configure(transport='grpc')

Why is this needed
Actual vs expected behavior:
I am really just curious its more of a question then a bug.
full error stacktrace

Traceback (most recent call last):
File "C:\Development\Gemini\python\gemini_samples_python\GeminiSamples\tuning\access_tuned_model.py", line 30, in
tuned_models = list_my_tuned_models()
^^^^^^^^^^^^^^^^^^^^^^
File "C:\Development\Gemini\python\gemini_samples_python\GeminiSamples\tuning\access_tuned_model.py", line 23, in list_my_tuned_models
for m in genai.list_tuned_models():
File "C:\Development\Gemini\python\GeminiAnalyitcs\google-analytics-gemini\venv\Lib\site-packages\google\generativeai\models.py", line 237, in list_tuned_models
for model in client.list_tuned_models(
^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Development\Gemini\python\GeminiAnalyitcs\google-analytics-gemini\venv\Lib\site-packages\google\ai\generativelanguage_v1beta\services\model_service\client.py", line 1144, in list_tuned_models
response = rpc(
^^^^
File "C:\Development\Gemini\python\GeminiAnalyitcs\google-analytics-gemini\venv\Lib\site-packages\google\api_core\gapic_v1\method.py", line 131, in call
return wrapped_func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Development\Gemini\python\GeminiAnalyitcs\google-analytics-gemini\venv\Lib\site-packages\google\api_core\retry\retry_unary.py", line 293, in retry_wrapped_func
return retry_target(
^^^^^^^^^^^^^
File "C:\Development\Gemini\python\GeminiAnalyitcs\google-analytics-gemini\venv\Lib\site-packages\google\api_core\retry\retry_unary.py", line 153, in retry_target
_retry_error_helper(
File "C:\Development\Gemini\python\GeminiAnalyitcs\google-analytics-gemini\venv\Lib\site-packages\google\api_core\retry\retry_base.py", line 212, in _retry_error_helper
raise final_exc from source_exc
File "C:\Development\Gemini\python\GeminiAnalyitcs\google-analytics-gemini\venv\Lib\site-packages\google\api_core\retry\retry_unary.py", line 144, in retry_target
result = target()
^^^^^^^^
File "C:\Development\Gemini\python\GeminiAnalyitcs\google-analytics-gemini\venv\Lib\site-packages\google\api_core\timeout.py", line 120, in func_with_timeout
return func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "C:\Development\Gemini\python\GeminiAnalyitcs\google-analytics-gemini\venv\Lib\site-packages\google\api_core\grpc_helpers.py", line 78, in error_remapped_callable
raise exceptions.from_grpc_error(exc) from exc
google.api_core.exceptions.Unauthenticated: 401 API keys are not supported by this API. Expected OAuth2 access token or other authentication credentials that assert a principal. See https://cloud.google.com/docs/authentication [reason: "CREDENTIALS_MISSING"
domain: "googleapis.com"
metadata {
key: "service"
value: "generativelanguage.googleapis.com"
}
metadata {
key: "method"
value: "google.ai.generativelanguage.v1beta.ModelService.ListTunedModels"
}
]

Any other information you'd like to share?
My full sample

from dotenv import load_dotenv
import os
import google.generativeai as genai

load_dotenv()

genai.configure(api_key=os.getenv("API_KEY"))
genai.configure(transport='grpc')   # comment this out and it will break

def get_response(use_tuned_model, text):
    try:
        print(f"Making request: {text} against Model: {use_tuned_model}")
        model = genai.GenerativeModel(model_name=use_tuned_model)
        response = model.generate_content(text)
        print(response)
    except Exception as e:
        print("Error: ", e)

def list_my_tuned_models():
    models = []
    for m in genai.list_tuned_models():
        print(f"Name: {m.name} Description: {m.description} Created: {m.create_time} Base Model: {m.base_model}")
        models.append(m.name)
    return models

if __name__ == "__main__":
    tuned_models = list_my_tuned_models()

    for tuned_model in tuned_models:
        get_response(tuned_model, "55")

Thanks for the report Linda.

I see you're not in Colab, so this has nothing to do with Colab's default being transport='rest'.

I'm working on a replication, but I didn't have a tuned model and tuning is hung for me at the moment.

Hmmm....
genai.configure(api_key=os.getenv("API_KEY"))
genai.configure(transport='grpc')

I'm not sure about most of these steps, but it's possible that:

[ ] You have the oauth credentials in the default location (gcloud auth application-default ...), from when you tuned the model.
[ ] Setting api_key= overrides the application-default-credentials.
[ ] Tuned models require the oauth credentials.
[X] .configure doesn't edit the configuration. It replaces the configuration.

So  if the previous points are true, .configure(transport='grpc') throws out the api-key, and puts you on the application-default credentials. .configure() or configure(transport='rest') might have the same effect.

While I wait for tuning to wake up could you confirm any of those other points?

[ ] Its the same project which has GOOGLE_APPLICATION_CREDENTIALS set in the .env var.
[ ] Why would setting apikey overwrite application default credetinals and why would it work again adding grpc?
[ ] Yes tuned models require service account auth hence the GOOGLE_APPLICATION_CREDENTIALS setting
[ ] So what setting API key forces it to be transport rest?

I think this all fits my interpretation of what's going wrong here.

GOOGLE_APPLICATION_CREDENTIALS set in the .env var.

That sets the ADC as the default credentials.

Why would setting apikey overwrite application default credentials

Because the API can't take both the ADC and an API key at the same time. It has to choose one or the other.

and why would it work again adding grpc?

ADC works for Tuned Models, API key doesn't.
When you call genai.configure(api_key="...") it stores  configuration= {'api_key': ...}.

now tuned models are broken  because the api_key takes precedence.

When you call genai.configure(transport="grpc") it stores configuration={'transport': 'grpc'}, and forgets the api_key.

now tuned models work because it falls back to using the ADC.

It doesn't have anything to do with actually switching between rest and grpc, just clearing the api-key from the config:
Steps to reproduce: https://colab.research.google.com/drive/1C8nKL6cKjrwGom_Ye3ssB2iqw7gQyB4T?usp=sharing


SFB-100: create domain for concept & concept-scheme + migrations for the schemes

ID
SFB-100
Description
The concept schemes are fetched with a direct sparql query in the frontend. To make this possible through ember-data we need to create a domain in the backend so this is possible. Next to creating the domains we are adding all the concept-schemes with their concepts to the application graph so they can be fetched. by the ember-data models.
Type of change

[ ] Bug fix
[x] New feature
[x] Breaking change
[ ] Other

How to test
Check the possible concept-schemes that are available right now in the form builder application (for example check it with codelijsten on dev) against the concept-schemes that are available in this PR.
Links to other PR's

https://github.com/lblod/frontend-form-builder/pull/66

Todo:

check the missing concept schemes between before migration and after
options_of_uri-selector_before_migrations_length_48.json
options_of_uri-selector_after_migrations_length_43.json
Update the naming of the migrations to start with the unix time + date

These are missing:
[
    "http://lblod.data.gift/concept-schemes/06bad311-e964-48a4-9b6b-f765819e76e0 : Loket leidinggevenden export",
    "http://lblod.data.gift/concept-schemes/0887b850-b810-40d4-be0f-cafd01d3259b : Loket mandatarissen export",
    "http://lblod.data.gift/concept-schemes/2c0ec673-a430-4cd3-861d-8666991b790f : concept-scheme defining priority-levels",
    "http://lblod.data.gift/concept-schemes/3037c4f4-1c63-43ac-bfc4-b41d098b15a6 : Tax Type",
    "http://lblod.data.gift/concept-schemes/3037c4f4-1c63-43ac-bfc4-b41d098b15a6 : Type belasting",
    "http://lblod.data.gift/concept-schemes/71e6455e-1204-46a6-abf4-87319f58eaa5 : Type dossier inzending voor toezicht",
    "http://lblod.data.gift/concept-schemes/c93ccd41-aee7-488f-86d3-038de890d05a : Reglementtype inzending voor toezicht",
    "http://lblod.data.gift/concept-schemes/dd44f316-7a30-45ab-b0f3-5dd642e0b6c7 : pre-defined additional-contact-tracing-measures users can pick while filing the contact and source tracing subsidy-form",
    "https://data.vlaanderen.be/id/conceptscheme/BesluitDocumentType : besluit document type",
    "https://data.vlaanderen.be/id/conceptscheme/BesluitType : besluit type"
]

We are keeping the options concept schemes that are added with the migrations. When something is missing/wrong we will create a new migration that will add all the information necessary.
cc: @aatauil


Vite + Vue multi app: Dev server always serves /index.html instead of nested index.html

Describe the bug
Following this in the docs:
https://vitejs.dev/guide/build.html#multi-page-app
With vue plugin works on build but not on dev.
Dev server seems to always serve <root>/index.html. Even on localhost:3000/nested
Reproduction
Repo:
https://github.com/vdespeisse/vite-vue-multi
Just clone repo, npm install and npm run dev
Go to localhost:3000/nested you will get Main app file instead of the one in nested/
npm run build works as expected. So maybe an issue with dev server with vue plugin ?
More info in repo readme: relevant directory structure, specific vite config ...
Similar issue
This issue: https://github.com/vitejs/vite/issues/627
Looks very similar, however:

It's not exactly the issue I'm experiencing
It's closed so should be fixed
The hack mentioned does not change anything

System Info

vite version: ^2.0.0-beta.50
Operating System: macOS Catalina
Node version: v12.12.0
Package manager (npm/yarn/pnpm) and version: npm 6.11.3

Only nested/ with an ending slash will be considered a implicit index. Without the slash it's an SPA fallback.

Only nested/ with an ending slash will be considered a implicit index. Without the slash it's an SPA fallback.


Added logic to set exhibition format type in hardcopy subheadings

What does this change?
This adds logic to allow the hardcopy in Exhibiton.tsx to render the correct exhibition format type in its subheadings. Permanent exhibitions are treated the same as exhibitions (who have no format type) and will render 'E/exhibition' where it is called.
This change comes from #10985, where there is a need to display "display" instead of "exhibition" where appropriate in the page text.
How to test
Many of the other types (with exception to Installation, which has its own page component - Installation.tsx) do not (yet) refer to the hardcopy subheadings as in a standard temporary exhibition page. A way to test is to add the code to the hardcoded 'Visit us' with the logic:
title={`Visit us - THIS is a ${exhibitionFormat}!`}

which should render this (depending on the page type you test this on):

How can we measure success?
When options are added in Prismic - their hardcopy will reflect in the page type correctly.
Have we considered potential risks?
I am presuming no Prismic conflicts as these are hardcopy changes. Do correct / save the site otherwise!
Note
.toLowerCase is required to ensure the subheading remains grammatically correct in that instance.

Question for @LaurenFBaily - I am presuming we don't want this content to change to the format type as a sort of brand of product 'exhibition guide'? Just checking as it's also hardcopy.

Nope, don't worry about that  - we have plans to update that bit very soon anyway (plus we need to do something different for Kola Nut as it doesn't have an exhibition guide but does have exhibition text)


OSError: [WinError 10049] The requested address is not valid in its context.

https://github.com/logan-markewich/llama_index_starter_pack
run python ./flask_demo.py & and get error:
OSError: [WinError 10049] The requested address is not valid in its context.

@Luffffffy see my response on the starter_pack github :)


Move transient/temporary file out of /opt

We use /var/opt/piavpn-manual to store most of the files except the pid file which is stored in /var/run as most of daemon script always do.
We use /var/run instead of /run because of FreeBSD.
/var/opt and:

not /run because it is mounted with noexec on some distro
not /tmp because an admin could mount it too with noexec

we use a umask of 0077 to disable read of any other user than root
along the way, fix tiny bugs:

where pia-manual directory was used instead of piavpn-manual
use -N for curl |head to avoid a 'Failed writing body' error message
move a line to avoid an unnecessary error when openvpn connection fails

close #23

On which distributions did you test this? Is it safe to merge this to master?

I tested this on archlinux-arm.
The wireguard stuff works fine, but it is unaffected by the change I think.
For openvpn, I don't know.

So I found the bug in the changes I introduce.
On ubuntu, /run is mounted with noexec, so the openvpnup/down script can't be run.
So I move them to /var/lib instead of /var/run. It's becoming a little too much with files in /var/run and /var/lib. But o we have the choice ?
I still get that error:
cat : route_info not found

@solsticedhiver the distributions that should be tested are: Arch or Manjaro, Debian or Ubuntu, Fedora.
Did you try using /tmp/piavpn-manual?

No, I did not try /tmp/piavpn-manual.
Do you mean change /var/run and /var/lib to /tmp ? Yes. that could do it.
Do you prefer /tmp/piavpn-manual I am not a fan of that. But that's a matter of preference I guess.
But then I would have to advice not to use chmod 600 on credentials but use a umask 0077 instead.
this would avoid any user reading the file in /tmp/piavpn-manual

Do you prefer /tmp/piavpn-manual I am not a fan of that. But that's a matter of preference I guess.

If it works on all distributions, we can use that.

But then I would have to advice not to use chmod 600 on credentials but use a umask 0077 instead.

This has to be tested the same way as everything else to make sure we don't break any of the existing functionality.

I kept /var/run for the pid file as it is usually kept there.
The rest is in /tmp/piavpn-manual now.
I woudl like to test it more, but I have still the other bug. Should I open a new bug for that one ?

@solsticedhiver try looking at the ovpn log, it's usually pretty descriptive.

@iPherian
well there is not much to look there:
Mon Nov 16 20:29:08 2020 OpenVPN 2.4.9 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Aug 18 2020
Mon Nov 16 20:29:08 2020 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Mon Nov 16 20:29:08 2020 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Nov 16 20:29:08 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]<IP_ADDRESS>:501
Mon Nov 16 20:29:08 2020 UDP link local: (not bound)
Mon Nov 16 20:29:08 2020 UDP link remote: [AF_INET]<IP_ADDRESS>:501
Mon Nov 16 20:29:19 2020 event_wait : Interrupted system call (code=4)
Mon Nov 16 20:29:19 2020 SIGTERM[hard,] received, process exiting

I don't know what is going on.
Why is there is no tun interface ? Is it the server not responding ?

@solsticedhiver 501 is a TCP port. How did you land on that port via UDP?

@g00nix you tell me ?
Something is very wrong:
./connect_to_openvpn_with_token.sh is expecting a CONNECTION_SETTINGS back from the server in the form of: protocol encryption
but what I got is: openvpn !
the script is expecting someting like "tcp/udp standard/strong". so the script is bugging because of this
the script is reading CONNECTION_SETTINGS; it got protocol="" and encryption=""
and this ends with pia.opvn having the last line like
remote <IP_ADDRESS> 501

I am given back the paris server (paris402, paris 40x, ...)
Has anyone tested that script ? Is it only that server that is wrong ?

Seeing that /tmp could be mounted with noexec too by some admin, I changed the directory again, this time  to /var/opt, which is supposed to hold variable data for /opt package (where this is supposed to be installed) and where scripts vould be executables.

Seeing that /tmp could be mounted with noexec too by some admin

I think it's important to know if it gets mouted by default as noexec or not, not by the admin.
I think we can keep the scripts in /opt/piavpn-manual and the sensitive data in /tmp/ or /var/run/

I don't think I can check every distro to see if /tmp is mounted wiht noexec. And most likely, very few must do that.
But I don't like to use /tmp for those file because this is a place where everyone has write-access. And this allow a symlink attack to take place. See https://en.wikipedia.org/wiki/Symlink_race
But we could use a temp dir with random string with mktemp. It just complicate things a little. But if you really want to use /tmp, I could do it.
May be, I am too security aware/sensible ?

May be, I am too security aware/sensible ?

Yes, but you are not the first one to be against the use of /opt/. There just wasn't anybody to invest the required time to find a better solution that actually works for all distros.

As the repo changed a lot with the release of v2.0.0, I think we should close this PR and open a new one. The issue still stays opened till we clarify this situation.

As the repo changed a lot with the release of v2.0.0, I think we should close this PR and open a new one. The issue still stays opened till we clarify this situation.

Any idea on this ? moving files to a configurable folder which may have as default value /tmp/piavpn (or anything else in /tmp)
I think it will be highly valuable change for a lot of thing
(And in the same time remove the needs of beeing root on some of the scripts (not all but some) who wants to write into /opt)

Any idea on this ? moving files to a configurable folder which may have as default value /tmp/piavpn (or anything else in /tmp)
I think it will be highly valuable change for a lot of thing
(And in the same time remove the needs of beeing root on some of the scripts (not all but some) who wants to write into /opt)

I think nobody spent the time to move data to other folders and test on all distros. I think everybody agrees this should be done at a certain point, but nobody dedicated the time to ensure compatibility. @StudioEtrange you are very active and also have some advanced technical skills, but the if you tackle this issue please make sure all comments are well written and that the code is easy to to understand also for people new to scripting. The repo has to stay accessible.
I am super happy with v2.0.0. It covers a lot of things that we wanted to release since September. I think we can build on top of this.

I think nobody spent the time to move data to other folders and test on all distros. I think everybody agrees this should be done at a certain point, but nobody dedicated the time to ensure compatibility. @StudioEtrange you are very active and also have some advanced technical skills, but the if you tackle this issue please make sure all comments are well written and that the code is easy to to understand also for people new to scripting. The repo has to stay accessible.
I am super happy with v2.0.0. It covers a lot of things that we wanted to release since September. I think we can build on top of this.


Initializing package with contents terra-framework repo

The terra-application repository is being bootstrapped with the contents of the terra-application package within the terra-framework monorepo.

Does this still need UX review?

Neil looked the APIs over but didn't feel the need to do a formal UX review at this point.


Avoid Changing Password of User

What we would like to do is manage SFTPGo user accounts with Terraform but not change the password of the user at all. Is this possible?
Steps

Create new user account with Terraform
Either an administrator or the user modifies the password
Make other changes to the user account with Terraform but leave the password whatever value it currently is

If I don't specify the password in the sftpgo_user resource then it seems as though the password is removed from the user.

Did you try some lifecycle properties to ignore changes?
https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes

@MaxWinterstein yes, that does prevent Terraform from detecting that the password has changed, however if I want to modify a property of the user after it has been created, for example change the permissions value, then the password ends up being changed. I believe it gets removed.
I believe it's because of this code:
https://github.com/drakkan/terraform-provider-sftpgo/blob/eb34266776e40a18db110884d4331a3a6cb51905/sftpgo/client/users.go#L30-L33

@drakkan I know your time is limited for issues like this. If we became a paying customer is this something that in theory could be looked into as a feature request?

@jjathman  thanks for considering supporting SFTPGo, but I think your motivation is wrong: you should support the open source software you use for ongoing maintenance, not just to add a new feature you need for your specific use case. If you are using or considering using SFTPGo now, it is because a lot of work has been done to provide you with a production-ready file transfer solution, and a lot more work is required to maintain and evolve it. If no one supports open source projects, they will no longer be maintained :smile:
Providing support for an open source project is a matter of mutual trust, there is no expiring license that you are obligated to renew.
We do not provide one-time support, upon request, we expect our customers to sign up for a long-term support plan, we don't provide support to companies that subscribe/unsubscribe each time they have a question/issue.
We have limited time and energy and prefer to dedicate it to users/companies who recognize our commitment to creating and maintaining SFTPGo.
That said, we do of course give higher priority to requests from paying customers, but that doesn't mean we'll add everything a paying customer ask for. Feature requests must fit the scope of the SFTPGo open source project. We sometimes provide custom plugins for very specific use cases to our Enterprise subscribers.
The Terraform provider was added because useful to one of our Enterprise plan subscriber. To be honest, I have never used Terraform before writing this provider so I may miss something here, for what I know the password is stored in the Terraform state. It looks like you are trying to use Terraform as a PATCH style REST API.
Please provide more details about your use case, for example the steps you are using to create and update your users. I may not reply here, but I will consider it.
Of course feel free to contact us to our the dedicated email address if you want discuss about a support plan. Thank you

@drakkan  thank you for the thoughtful response and I do agree with everything you said.
Little more context is that we just started using your product a week ago and while it seems very promising I think we are at more of an evaluation stage. One of the features we value highly is automation with our tools so the terraform provider was exciting to see!
Our use case is where we would like to use automation to create and maintain users (and all other settings) but ideally we would allow end users the ability to change their passwords if they so choose. However I think the current version of the terraform provider would not allow that since it would change the password back each time terraform was run. Does that make sense?
Sorry for implying we wanted to pay for support for a one time issue. We are definitely interested in a long term plan. I was just unsure if this is the kind of change that is something you’d even consider making.
Thank you again. You’ve created a wonderful product!

Users can also change public keys, email address etc., not just password. Anyway, please read the following posts
https://www.reddit.com/r/Terraform/comments/17jtxcd/can_import_add_new_properties_to_a_resource/
https://stackoverflow.com/questions/43950097/how-to-import-manual-changes-into-terraform-remote-state

Thanks, and those are good points about all the other user editable fields. I hadn’t considered them but you are right they would have the same problem.
As that Reddit post talks about terraform assumes it is in control of any properties and resources it knows about and will always try to get them back to the state it wants them to be in. One can import resources initially if they were created outside of terraform, however from that point on TF will want to manage them.
In this case maybe a potential solution would be to create separate resources that split off the user editable information from the details controlled by an administrator. So in my case I want to manage the GCS setup and permissions but not the email or password or public keys. But as it currently is implemented these are all one TF resource so they all have to be controlled or none controlled by TF.


MM-10136: Not allowing to edit others posts in the interface

Summary
Not allowing to edit others posts in the interface
Ticket Link
MM-10136
Checklist

[x] Added or updated unit tests (required for all new features)

are you aware it needs a fix on server side too ?

@koxen, @jespino and I discussed this above (inline). It turns out that the ability for an admin to edit posts was always in place, but the UI was incorrectly exposed (as it's not likely to be a common use-case). Going forward, my understanding is that advanced permissions is precisely about constraining such abilities as individual use cases demand.


Open folder in new window

This is a feature request
I use a lot the "Open folder" option and it is annoying when you want to open a folder in a new window you have to open a new window, wait until it is open, and then open the folder in that window. In Sublime Text every folder is opened in a new window. It would be nice to have this option too in VSCode, or better to have a dialog to chose between "open folder in current window" and "open folder in a new window" how it is in WebStorm.
Thank you :)

https://github.com/Microsoft/vscode/issues/371