Notice Error When Enabling at Website or Store View

The following "Notice" error is returned if attempting to "Enable" Amazon payments for a specific "Store View" or "Website":-
An error occurred while saving this configuration: Notice: Undefined index: value in app/code/community/Amazon/Payments/Model/System/Config/Backend/Enabled.php on line 23
This only occurs when the "Credentials" are set at "Default Config" scope but enablement is attempted at a "Store View" or "Website" scope.
As a work around, setting "Credentials" at the same scope you want to enable the payment method at, allows Enable Yes to be selected at that scope.
This appears to be due to "_getCredentials" not returning default scope values for "Store View" or "Website".

Thanks @Flipmediaco - we'll take a look!


Deploying Rook or Longhorn doesn't work

I can't get Rook and Longhorn working. Is there some kind of limitation or setting? Here's what I did:
Rook

Installed cluster with ./dind-cluster-v1.10.sh up
Followed the quickstart here https://rook.io/docs/rook/master/quickstart.html
Then setup for block storage here: https://rook.io/docs/rook/master/block.html

All the Rook pods are running. The pvc's are all bound but they won't mount into wordpress and mysql. kubectl describe pod wordpress-mysql-5bbddff49c-4kpd8 gives me the following error:
Events:
  Type     Reason                 Age                From                  Message
  ----     ------                 ----               ----                  -------
  Warning  FailedScheduling       47s (x3 over 48s)  default-scheduler     pod has unbound PersistentVolumeClaims (repeated 2 times)
  Normal   Scheduled              44s                default-scheduler     Successfully assigned wordpress-mysql-5bbddff49c-tznng to kube-node-2
  Normal   SuccessfulMountVolume  44s                kubelet, kube-node-2  MountVolume.SetUp succeeded for volume "default-token-4dcxm"
  Warning  FailedMount            9s (x7 over 43s)   kubelet, kube-node-2  MountVolume.SetUp failed for volume "pvc-7b402bd8-79f3-11e8-b9df-226c1abfe04a" : mount command failed, status: Failure, reason: Rook: Mount volume failed: failed to attach volume replicapool/pvc-7b402bd8-79f3-11e8-b9df-226c1abfe04a: failed to map image replicapool/pvc-7b402bd8-79f3-11e8-b9df-226c1abfe04a cluster rook-ceph. failed to map image replicapool/pvc-7b402bd8-79f3-11e8-b9df-226c1abfe04a: Failed to complete 'rbd': exit status 2. . output: modinfo: ERROR: Module rbd not found.
modprobe: FATAL: Module rbd not found.
rbd: failed to load rbd kernel module (1)
rbd: sysfs write failed
In some cases useful info is found in syslog - try "dmesg | tail".
rbd: map failed: (2) No such file or directory

Longhorn

Installed cluster with ./dind-cluster-v1.10.sh up
Ran the following command into kube-master, kube-node-1 and kube-node-2

apt update && apt install -y open-iscsi

Setup Longhorn according to instructions here: https://github.com/rancher/longhorn
Longhorn pods are running
Then when following the section "Storage class" the example pod won't start. The PV is bound and kubectl describe pod volume-test gives the following error:

Events:
  Type     Reason                 Age   From                  Message
  ----     ------                 ----  ----                  -------
  Normal   Scheduled              2m    default-scheduler     Successfully assigned volume-test to kube-node-2
  Normal   SuccessfulMountVolume  2m    kubelet, kube-node-2  MountVolume.SetUp succeeded for volume "default-token-4dcxm"
  Warning  FailedMount            0s    kubelet, kube-node-2  Unable to mount volumes for pod "volume-test_default(a9292745-79f5-11e8-a9ef-7abe5c4845cd)": timeout expired waiting for volumes to attach or mount for pod "default"/"volume-test". list of unmounted volumes=[volv]. list of unattached volumes=[volv default-token-4dcxm]

Any idea what could be wrong here?

@Richie765  I think I got to the root of the issues you faced.  See the associated GitHub issues above for details.  Please let me know if you get this working!


[FEA] Strongly filtered CAGRA

CAGRA has been observed to yield low recall when filtering is enabled, especially when the ratio of filtered-out values is high. This can be related in part to #208 and #472 , but there also may be fundamental reasons for the lower recall.
This feature request tracks the progress and suggestions to enable high-recall strongly filtered CAGRA.
As an experiment, I suggest to try the following tweaks, enabled by a boolean search parameter:

Disable the maximum search iterations limit to allow longer search
Replace the hashmap with a dataset-long bitset. It's used to track the visited nodes. By replacing a small hashmap with the bitset we will eliminate hash collisions (thus, false-positives) and prevent CAGRA from early-stopping.

BFKNN  as a strongly-filtered CAGRA replacement: https://github.com/rapidsai/cuvs/issues/252

In general, in order to achieve a good recall when the filtering rate is high, it is necessary to traverse more nodes. For example, if the the filtering rate is very high at 99%, it will be difficult to achieve a recall similar to that without filtering unless you traverse roughly 100 times as many nodes. To do this, the size of the hash table would also need to be increased by a factor of 100, but this is not very practical.
We have just submitted a PR for a new multi-CTA algorithm that can reduce the size of the hash table by a factor of 1/32 to 1/64, so I think it would be good to use this new multi-CTA algorithm to address this issue.

@anaruse what would you think about using a dataset-long bitset in place of the hashmap here as an experiment? The bitset I guess will have to stay in global memory; do you think the performance will be unreasonably bad?


add-reference with snaks not working?

wikibase-cli version: 15.10.1
OS version: macOS 11.1 ( Big Sur )

I thought this was very close to the example:
$ cat ./reference.js
// reference.js: a JS file exporting an object
module.exports = function (guid, bioid) {
  const today = new Date().toISOString().split('T')[0]
  return {
    guid,
    snaks: {
      P248: "Q1150348",
      P1157: bioid,
      P813: today
    }
  }
}
$ wd ar ./reference.js 'Q1556541$5230DF22-DF64-4DC8-B651-E1715816C01B' S001191
invalid property id { propertyId: 'Q1556541$5230DF22-DF64-4DC8-B651-E1715816C01B' }
$ wd --version
15.10.1
$  node --version
v12.20.0
$

The following worked, but not with the - delimited guid.
$ cat reference2.js
// reference.js: a JS file exporting an object
// Q1650417-87A6706C-74E9-416D-A29B-C7B0220F12FF I000027
module.exports = {
    guid: 'Q1650417$87A6706C-74E9-416D-A29B-C7B0220F12FF',
    snaks: {
      P248: "Q1150348",
      P1157: 'I000027',
      P813: '2021-01-28'
  }
}
$ wd ar ./reference2.js
{"pageinfo":{"lastrevid":1349783068},"success":1,"reference":{"hash":"1f6dcc9371d2c1042f2cd2b228aec381848beaa9","snaks":{"P248":[{"snaktype":"value","property":"P248","hash":"c0e4d74d538fcf20633b6587ef2f345ded63abc3","datavalue":{"value":{"entity-type":"item","numeric-id":1150348,"id":"Q1150348"},"type":"wikibase-entityid"},"datatype":"wikibase-item"}],"P1157":[{"snaktype":"value","property":"P1157","hash":"9fcf9ac962ee72a07b2f1b992b6c8e34f534efad","datavalue":{"value":"I000027","type":"string"},"datatype":"external-id"}],"P813":[{"snaktype":"value","property":"P813","hash":"c86a671b50b0f3f6bb9776680e9ffd2db39c1bc1","datavalue":{"value":{"time":"+2021-01-28T00:00:00Z","timezone":0,"before":0,"after":0,"precision":11,"calendarmodel":"http://www.wikidata.org/entity/Q1985727"},"type":"time"},"datatype":"time"}]},"snaks-order":["P248","P1157","P813"]}}
$

Any advice would be appreciated.
Regards,

FWIW, I tried putting a console.log() line to better understand what was happening, but I couldn't get any output, even with --verbose.

FWIW, I tried putting a console.log() line to better understand what was happening, but I couldn't get any output, even with --verbose.

oups, that feature wasn't properly tested, sorry for that: fixed in b3c34b3 and published in v15.10.2

oups, that feature wasn't properly tested, sorry for that: fixed in b3c34b3 and published in v15.10.2

No worries.  I updated and it works now.  Thanks very much for the quick turnaround!

No worries.  I updated and it works now.  Thanks very much for the quick turnaround!

FWIW, it still requires the $.  Should it also accept the - version?

FWIW, it still requires the $.  Should it also accept the - version?

patched in f585c34, should be fixed in v15.10.3

patched in f585c34, should be fixed in v15.10.3


error: no suitable constructor exists to convert from "unsigned short" to "__half"

kfusion/CMakeFiles/kfusion.dir/build.make:379: recipe for target 'kfusion/CMakeFiles/kfusion.dir/src/cuda/kfusion_generated_proj_icp.cu.o' failed
make[2]: *** [kfusion/CMakeFiles/kfusion.dir/src/cuda/kfusion_generated_proj_icp.cu.o] Error 1
/home/gcw/kinfu_remake-master/kfusion/src/cuda/device.hpp(76): error: no suitable constructor exists to convert from "unsigned short" to "__half"
/home/gcw/kinfu_remake-master/kfusion/src/cuda/device.hpp(79): error: no suitable constructor exists to convert from "unsigned short" to "__half"
2 errors detected in the compilation of "/tmp/tmpxft_0000189b_00000000-14_tsdf_volume.compute_20.cpp1.ii".
CMake Error at kfusion_generated_tsdf_volume.cu.o.cmake:266 (message):
Error generating file
/home/gcw/kinfu_remake-master/build/kfusion/CMakeFiles/kfusion.dir/src/cuda/./kfusion_generated_tsdf_volume.cu.o
how to solve it?  please help me

I have the same problem. Have you solved it, please?
/home/zhoujie/fusion/kinfu_remake/kfusion/src/cuda/imgproc.cu(268): error: no operator "=" matches these operands
            operand types are: __half = unsigned short

1 error detected in the compilation of "/tmp/tmpxft_000031f3_00000000-13_imgproc.compute_50.cpp1.ii".
CMake Error at kfusion_generated_imgproc.cu.o.cmake:266 (message):
  Error generating file
  /home/zhoujie/fusion/kinfu_remake/build/kfusion/CMakeFiles/kfusion.dir/src/cuda/./kfusion_generated_imgproc.cu.o

I have the same problem. Have you solved it, please?
/home/zhoujie/fusion/kinfu_remake/kfusion/src/cuda/imgproc.cu(268): error: no operator "=" matches these operands
            operand types are: __half = unsigned short

1 error detected in the compilation of "/tmp/tmpxft_000031f3_00000000-13_imgproc.compute_50.cpp1.ii".
CMake Error at kfusion_generated_imgproc.cu.o.cmake:266 (message):
  Error generating file
  /home/zhoujie/fusion/kinfu_remake/build/kfusion/CMakeFiles/kfusion.dir/src/cuda/./kfusion_generated_imgproc.cu.o

i  guess you are chinese    give me   your  wechat

jdns87v5

have the same problem here.
Is there any hint to fix it? thanks a lot!

same problem ，how do u sovle it

i have faced same problem too. Have you solve it? Thanks

I solve this problem by using a old version of kinfu_remake which not supporting cuda9 or higher.

I solve this problem by using a old version of kinfu_remake which not supporting cuda9 or higher.


Unable pair device with Moonlight

I use anche rg503 with latest version of ark OS.
I try to connect the device with moonlight but no way, every time it gives me the same error: unable to pair check name of PC ecc ecc.
I try with my chrome book on the same network and it works.

Did you connect your rg503 to your wireless network and confirm it communicates?

It gives me connected on menu. I don't have internet connection (i use hot spot mobile when i need) on this Lan because I use it only for local game streaming.

Can you ssh into the device?

Enable Remote services from the options section and try to ssh into it.

I don't Know how to ssh. This is what apend

Ok I make everything you write in question "How do I SSH into ArkOS?"
Now what can I do?

Can you access the device from your computer on the network?  If so, than the device is not the issue.  I have a new moonlight update coming soon that may fix this issue for you.

True Ark Browser? Yes It works!

Moonlight has been updated to the latest version.  Please reinstall it from PortMaster and try it again.  Let me know if it resolves the issue for you or not.

I installed it now. Same issue. My pc name is "casa". I've only need to put "casa" as name?

that should work if that's truly the name.  If not, try putting in the ip address of your pc.

How can I find the ip adress?  It Is a lan without internet connection

So it works on stock? hmmm...

So it works on stock? hmmm...

Yes. I don't Know why. Any suggest?

Yesterday I made a test also with Jelos and it finds the server pc and it pairs, but doesn't download the list of games.
With anbernic works fine.
Jelos and Anbernic doesn't ask the name or ip of the server pc.
Ark Os no way to pair. Before I had e different name of pc (dektop-xxx). Now I change it  in to a little bit short and easy (casa) and I doesn's work anyway. How can I know the IP adress? I want to try with it. The server pc and router are not connected to internet (when I need it I use tethering).
(sorry for my very terrible english)

Assuming you're using a Windows PC, see here: https://support.microsoft.com/en-us/windows/find-your-ip-address-in-windows-f21a9bbc-c582-55cd-35e0-73431160a1b9#Category=Windows_10

yea something is not right somewhere as I don't have any of these struggles on my end.

Maybe moonlight works only with 5ghz connection?
My router is 2.4 GHz, but I don't think is this the problem (my chrome book connected with no problems). I usually use moonlight trought powerline Lan cabel and a steamlink with no problems.
So the issue is rg503+wi fi. Probably a ip conflict because ge force experience doesn't work without internet connection. Probably my smartphone connected by USB tethering create same ip conflict

There was a ip conflict.  With another router works

Great.  Enjoy!


[curl] Update to 8.4.0.

This fixes a HIGH severity vulnerability: https://daniel.haxx.se/blog/2023/10/11/curl-8-4-0/
See also: https://daniel.haxx.se/blog/2023/10/11/how-i-made-a-heap-overflow-in-curl/
Resolves: https://github.com/microsoft/vcpkg/issues/34281

[x] Changes comply with the maintainer guide
[x] SHA512s are updated for each updated download
[x] The "supports" clause reflects platforms that may be fixed by this new version
[x] Any fixed CI baseline entries are removed from that file.
[x] Any patches that are no longer applied are deleted from the port's directory.
[x] The version database is fixed by rerunning ./vcpkg x-add-version --all and committing the result.
[x] Only one version is added to each modified port's versions file.

/cc @dg0yt since you touched this port recently

Is there something missing before we merge this pull request? 🤔


set up logging

From standard out for now.
With time stamps to help see what is a computational bottleneck.

@DavidHerreros do you want to take a crack at this?


Version 1.2.0 available?

C:\myproject>npm outdated
Package        Current     Wanted     Latest
ng2-bootstrap  1.1.16-11  1.1.16-11   1.2.0

But there's nothing in changelog. Am I missing something?

Not you, change log generation failed for no good reason


AAM Example: Minor Corrections

This looks fine.  I do think we may want to reduce the number of hyperlinks as you progress down a page for readability.  Think of how wikipedia does things, you don't make hyperrefs at every point that something is mentioned. Just a thought as I looked at the source and rendered output side-by-side.

[like]  Engelmann, Christian reacted to your message:

From: Thomas Naughton @.>
Sent: Thursday, October 3, 2024 3:42:11 PM
To: ORNL/intersect-architecture @.>
Cc: Engelmann, Christian @.>; Author @.>
Subject: [EXTERNAL] Re: [ORNL/intersect-architecture] AAM Example: Minor Corrections (PR #28)
This looks fine. I do think we may want to reduce the number of hyperlinks as you progress down a page for readability. Think of how wikipedia does things, you don't make hyperrefs at every point that something is mentioned. Just a thought as I looked at the source and rendered output side-by-side.
—
Reply to this email directly, view it on GitHubhttps://urldefense.us/v2/url?u=https-3A__github.com_ORNL_intersect-2Darchitecture_pull_28-23issuecomment-2D2391744521&d=DwMFaQ&c=v4IIwRuZAmwupIjowmMWUmLasxPEgYsgNI-O7C4ViYc&r=8a4olSL6oWWAikeAfRHE1IvXPpcc0eCVGKgvswDDTUU&m=QaUsnFSPBoxEULelV2HiK-qYqdpFILATYvrByFSsgPLVginbwvmiJ08_3BishwpX&s=ojUOGLMQrdwotixf2VUvcfFVO9CoHx9f9Y9Og_9mZBA&e=, or unsubscribehttps://urldefense.us/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AEO7NKUZFIPNUTEASIUH3N3ZZVQVHAVCNFSM6AAAAABPIQ7HB2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGOJRG42DINJSGE&d=DwMFaQ&c=v4IIwRuZAmwupIjowmMWUmLasxPEgYsgNI-O7C4ViYc&r=8a4olSL6oWWAikeAfRHE1IvXPpcc0eCVGKgvswDDTUU&m=QaUsnFSPBoxEULelV2HiK-qYqdpFILATYvrByFSsgPLVginbwvmiJ08_3BishwpX&s=N2_eXMCeDPBxk4DN5p47-evVTTE5T67zeYhj2HIYrl0&e=.
You are receiving this because you authored the thread.Message ID: @.***>

Yes, we need to develop some contribution guidelines like this.


testacc and termination protection

Spent a lot of time searching for a way to test termination_protection accurately, but TF testing framework does not provide a way to interrupt or replace delete plan cycle. Therefore only test plan for use case when termination_protection is enabled.

The descriptions are still lacking the bit of mentioning this is client side functionality only. Current description may lead to someone mistakenly thinking the databases / topics cannot be deleted from console or via API either.

Docs were updated clearly stating TF client-side nature of termination_protection fields.


fix(action): use root instead of cwd

In #101, cwd in action.yml was renamed to root
It looks like action/index.js needs to be changed as well

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.

Fixed at b465ba12984b9c553f804a8024283a2a849cd70b!


CQ-4351074 & CQ-4351274 - Value commit script tests for fields

Description
Tests for set value and clear value for the following fields in core components:

Textinput
NumberInput
dropdown
checkbox
radiobutton
datepicker

Clear value for Radio button wasn't working(CQ-4351274), so fixed that as well in this PR.
Also included a few validation exp. tests that were missed.

Related Issue
https://jira.corp.adobe.com/browse/CQ-4351074
https://jira.corp.adobe.com/browse/CQ-4351274

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):
Types of changes

[ ] Bug fix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

[ ] I have signed the Adobe Open Source CLA.
[ ] My change requires a change to the documentation.
[ ] I have updated the documentation accordingly.
[ ] I have read the CONTRIBUTING document.
[ ] I have added tests to cover my changes and the overall coverage did not decrease.
[ ] All unit tests pass on CircleCi.
[ ] I ran all tests locally and they pass.

Incorporate comments, closing the PR


added a way to disable cache

Be careful, I updated Readme.md and bower.json in this commit to be able to install the fork with bower. Revert those changes as you wish!

Cool! I'll merge it sometime this weekend. :smile:


✨ Use crane to add hash suggestion to unpinned Docker images

What kind of change does this PR introduce?
This PR attempts to address an enhancement in #967

[x] PR title follows the guidelines defined in our pull request documentation

What is the current behavior?
A warning is generated when a Docker dependency is not pinned.

Warn: containerImage not pinned by hash: Dockerfile:1

What is the new behavior (if this is a feature change)?**
A hash is now provided, as determined by crane

Warn: containerImage not pinned by hash. Fix by updating golang:1.17 to golang:1.17@sha256:e4d220556e80a686fad8874b40ccfa2f3172dfe5c6ca7f36f8ee79d594a9c959: Dockerfile:1

[ ] Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes
Fixes #967
Special notes for your reviewer
NONE
Does this PR introduce a user-facing change?
For user-facing changes, please add a concise, human-readable release note to
the release-note
(In particular, describe what changes users might need to make in their
application as a result of this pull request.)
Hash suggestions are now made for unpinned images in Dockerfiles

I was aware of the crane options, but wasn't sure how to determine things on the scorecard side of things. From what I can tell, the same unpinned Dockerfile can be used on different platforms and work accordingly. We also can't make assumptions based on the platform where scorecard is running as it may differ from where the Dockerfile is deployed. So I was thinking we need some sort of option or metadata added. Is there anything already existing?

On that note, we should have standard comment blocks for these remediations.
We would need some standard prefix for our recommendations so that customers can grep for it.

+1
I think #1874 would cover this

On that note, we should have standard comment blocks for these remediations.
We would need some standard prefix for our recommendations so that customers can grep for it.

+1 I think #1874 would cover this

+1, the JSON should do that for free. /cc @raghavkaul

And to address @naveensrinivasan 's earlier point:

Is this PR going to provide only SHA for Linux/amd64?
Crane provides an option ...

crane's default should be good for multi-arch support. more detail in #967


nimble install doesn't produce capnpc-nim

$ nimble install capnp
$ capnp compile -onim filename.capnp > filename.nim
nim: no such plugin (executable should be 'capnpc-nim')
nim: plugin failed: exit code 1

I have checked capnpc-nim in $HOME/.nimble directory. It is not exist there.


pagespeed off causes 100% cpu usage

I have followed the steps here:
https://developers.google.com/speed/pagespeed/module/downstream-caching
To configure proxy caching with pagespeed, but I found that when adding "pagespeed off" in the proxy_cache server configuration file then the cpu usage will be 100% and the site does not load, and when i remove it, it works fine.
The configuration file is here: https://gist.github.com/bml13/505e5bf840a9d09143d3
What could be wrong?

@bml13 I tried to reproduce based on your configuration with static content instead of wordpress, no luck yet. I'll try some more, but meantime I have a few questions:

Could you post more details of your system, like the OS and pagespeed version?
Is there anything noteworthy logged to nginx's error.log when nginx is in a state where it is taking 100% cpu (or before entering that state?).
Does the problem show up immediately after starting nginx, or after you request one or more pages?

Sorry i forget to post them.
I am using Ubuntu 14.04.2 LTS, nginx 1.6.3, ngx_pagespeed <IP_ADDRESS>-4448
The problem is that when I added "pagespeed off" and started nginx, then the nginx error log file gets full quickly with these lines that are repeated hundreds of times:
2015/04/20 11:02:09 [alert] 11704#0: [ngx_pagespeed <IP_ADDRESS>-4448] [0420/110209:FATAL:system_cache_path.cc(209)] Check failed: path.starts_with("/").
nginx: master process /usr/sbin/nginx() [0x51de19]
nginx: master process /usr/sbin/nginx() [0x51ae32]
nginx: master process /usr/sbin/nginx() [0xa0ab39]
nginx: master process /usr/sbin/nginx() [0x661983]
nginx: master process /usr/sbin/nginx() [0x66b678]
nginx: master process /usr/sbin/nginx() [0x4da6fd]
nginx: master process /usr/sbin/nginx() [0x4452a6]
nginx: master process /usr/sbin/nginx() [0x446062]
nginx: master process /usr/sbin/nginx(ngx_spawn_process+0x170) [0x444310]
nginx: master process /usr/sbin/nginx() [0x445c7d]
nginx: master process /usr/sbin/nginx(ngx_master_process_cycle+0x1e6) [0x446846]
nginx: master process /usr/sbin/nginx(main+0x77f) [0x424e4f]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f7bedd3eec5]
nginx: master process /usr/sbin/nginx() [0x4253cf]
nginx: master process /usr/sbin/nginx() [0x51de19]
nginx: master process /usr/sbin/nginx() [0x4d51f0]
nginx: master process /usr/sbin/nginx() [0x51af14]
nginx: master process /usr/sbin/nginx() [0xa0ab39]
nginx: master process /usr/sbin/nginx() [0x661983]
nginx: master process /usr/sbin/nginx() [0x66b678]
nginx: master process /usr/sbin/nginx() [0x4da6fd]
nginx: master process /usr/sbin/nginx() [0x4452a6]
nginx: master process /usr/sbin/nginx() [0x446062]
nginx: master process /usr/sbin/nginx(ngx_spawn_process+0x170) [0x444310]
nginx: master process /usr/sbin/nginx() [0x445c7d]
nginx: master process /usr/sbin/nginx(ngx_master_process_cycle+0x1e6) [0x446846]
nginx: master process /usr/sbin/nginx(main+0x77f) [0x424e4f]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f7bedd3eec5]
nginx: master process /usr/sbin/nginx() [0x4253cf]

Great thanks. I think I know what happens.
You should be able to disable pagespeed without having a valid FileCachePath configured,
but currently a check fails.
I suspect a workaround to this is moving this line into the http{} block:
pagespeed FileCachePath /var/run/ngx_pagespeed_cache;

Brilliant, It is solved.
Many thanks

Let's leave this open for now.  The corresponding error in Apache I think would prevent Apache from starting up and give clean error message to stdout, rather than spinning the CPU and logging hex stack traces to the error log.
We should get the nginx failure-mode here to be a little easier to diagnose.

@crowell is looking at this

currently testing a fix that will go into mod_pagespeed, I'll reference this bug when it goes in.

fixed in mod_pagespeed commit https://github.com/pagespeed/mod_pagespeed/commit/b4a2ed85d8187097b42e9b0cd820ee3cb389693a

how can I fix this in my ngx_pagespeed ? I am using master branch and <IP_ADDRESS>.tar.gz psol

@mital see https://github.com/pagespeed/ngx_pagespeed/issues/956#issuecomment-94415335

@oschaaf  thanks, I have tried that .. the cpu usage is still high and the nginx actually stops working (does not serve any page)
I am on centos 7 and compiling nginx 1.8.0-1 with pagespeed.  Which version / os you have tried this on and working ?

@mital Are there any messages in error.log when the cpu is high and/or nginx stops working?
My system runs ubuntu 14.04 + nginx 1.7.9

Yes Following are the errors I am getting
[alert] 3037#0: [ngx_pagespeed <IP_ADDRESS>-4448] [0512/044807:FATAL:ngx_rewrite_driver_factory.cc(208)] Check failed: ok.
Following is the selinux policy I have to modify
module nginx_pagespeed 1.0;

require {
        type httpd_t;
        class process execmem;
}

#============= httpd_t ==============

#!!!! This avc can be allowed using the boolean 'httpd_execmem'
allow httpd_t self:process execmem;

thanks for pointing this to me.. this solved my issue !

is there a reason why this bug was reopened? the fix is in https://github.com/pagespeed/mod_pagespeed/commit/b4a2ed85d8187097b42e9b0cd820ee3cb389693a which will be included in the next release.

The bug looks closed to me?

ah, just saw it was a "referenced issue" that was open still, my mistake.


Package request: Haskell package attoparsec-aeson

Project description
The Hackage package attoparsec-aeson: https://hackage.haskell.org/package/attoparsec-aeson
It is not found in NixPkgs: https://search.nixos.org/packages?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=attoparsec-aeson
It is in a sub-directory of haskell/aeson: https://github.com/haskell/aeson/tree/master/attoparsec-aeson
Other similar packages such as attoparsec-iso8601 are in NixPkgs: https://search.nixos.org/packages?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=attoparsec-iso
Thank you
Metadata

homepage URL: https://hackage.haskell.org/package/attoparsec-aeson
source URL: https://github.com/haskell/aeson/tree/master/attoparsec-aeson
license: BSD-3
platforms: unix, linux, darwin

found on the haskell-updates branch


Enabling indent-blankline.nvim disables CursorHold autocmd's from spawning diagnostic hover window.

I have been using nvim-lspconfig; and specifically this page to hook diagnostic hover windows on cursor on a symbol with LSP warning.
Even when the relevant autocmd is set, and confirmed to set, (hooks to CursorHold) if indent-blankline.nvim is loaded the autocmd won't activate.
The only problem is with the autocmd triggering; as giving a command to launch diagnostic info on hover menu works just fine.
I confirmed with disabling all my other plugins and enabling them one by one; and this is purely a indent-blankline.nvim issue.

I can't reproduce this.
Can you share the exact code you are using?

I'll try to reproduce using a minimal init.lua; and return back with my report. My configuration is here (relevant config for indent-blankline and nvim-cmp) but it is very fragmented.

This is incredibly weird; but I tried replicating with a minimal config but failed. Also; re-enabling indentline in my config, I have no issues anymore with diagnostic popups so I have no idea what went wrong. I'll close this issue; sorry for rising a false flag.


Using the "Back" browser functionality takes the user out of the publish flow

Describe the bug
Using the “back” browser functionality in step 2 of the Asset publishing goes back to the list of assets, instead of going back to the 1st step

this is not a bug, but would be indeed a good enhancement to include the publish steps in the browser history


Site is down

the website is down

There was a deployment issue. Now fixed with a new release (https://github.com/ayltai/BrewMyMac/releases/tag/release%2Fv1.0.8)


Cachiman

@Cachiman: Thank you for submitting a pull request! Before we can merge it, you'll need to sign the Apollo Contributor License Agreement here: https://contribute.apollographql.com/


Advanced Search Result Component

Summary of changes 🔍

This is building upon the initial PR made here . In this PR, I cleaned up the detailslist stylings, and enabled the icon button to do a callout that show the property inspector once a user clicks on it. Apart from the main component, AdvancedSearchResultDetailsList, I also created a new component called PropertyInspectorCallout. This standalone component handles the rendering of the entryview icon and upon clicking, shows property inspector for the given twin.

Testing 🧪

You can view the work i did in 3 different stories, the AdvancedSearchResultDetailsList as a standalone component is viewable under the SearchResults folder in the AdvanceSearch folder. You can view the experience of the results table under the parent component, in the Base story of  AdvancedSearch. And lastly, you can view PropertyInspectorCallout by itself under the Property Inspector folder.

https://msazure.visualstudio.com/One/_workitems/edit/15105160/
Chromatic link: https://601c6b2fcd385c002100f14c-cvwnldyhwo.chromatic.com/?path=/story/components-advancedsearch-searchresults--base
Checklist ✔

[ ] Linked associated issue (if present)
[ ] Added relevant labels
[ ] Requested developer reviews
[ ] Request UI review from design / PM
[ ] Verify all code checks are passing

are we supposed to be able to sort the list by clicking the column headers? Can be a different PR but I think that was expected to work. @darsney thoughts?

let's default sort the list by the twinId just to have some kind of consistency in the ordering.


Make angularjs-dropdown-multiselect work with NPM.

We use NPM for dependency management on the project I'm working on. Had to make a couple changes to get angularjs-dropdown-multiselect working. Thought I'd share them with you all. :smile:

component is currently published on npm


Unable to reproduce the preference prediction accuracy results

Hey, thanks so much for your great work and for releasing all your resources publicly.
I was interested in reproducing table 6 in your paper:

To reproduce the CLIP-ViT-H-14 and PickScore model results, I modified your evaluation script slightly to use the following script:
# adopted from: https://github.com/tgxs002/HPSv2/blob/master/hpsv2/evaluation.py

import os
import json
import numpy as np
from tqdm import tqdm
from argparse import ArgumentParser
from PIL import Image
from tqdm import tqdm
import huggingface_hub

import torch
from torch.utils.data import Dataset, DataLoader

from open_clip import create_model_and_transforms, get_tokenizer
from hpsv2.utils import root_path, hps_version_map
from transformers import AutoModel, AutoProcessor

### copied from: https://github.com/tgxs002/HPSv2/blob/866735ecaae999fa714bd9edfa05aa2672669ee3/hpsv2/src/training/train.py#L358
def inversion_score(p1, p2):
    assert len(p1) == len(p2), f'{len(p1)}, {len(p2)}'
    n = len(p1)
    cnt = 0
    for i in range(n-1):
        for j in range(i+1, n):
            if p1[i] > p1[j] and p2[i] < p2[j]:
                cnt += 1
            elif p1[i] < p1[j] and p2[i] > p2[j]:
                cnt += 1
    return 1 - cnt / (n * (n - 1) / 2)

class RankingDataset(Dataset):
    def __init__(self, meta_file, image_folder, transforms, tokenizer):
        self.transforms = transforms
        self.image_folder = image_folder
        self.open_image = Image.open
        self.tokenizer = tokenizer

        with open(meta_file, 'r') as f:
            self.test_dict = json.load(f)

    def __len__(self):
        return len(self.test_dict)

    def __getitem__(self, idx):
        try:
            dict_ = self.test_dict[idx]
            if self.transforms is not None:
                images = [self.transforms(self.open_image(os.path.join(self.image_folder, file_names))) for file_names in dict_['image_path']]
            else:
                images = [self.open_image(os.path.join(self.image_folder, file_names)) for file_names in dict_['image_path']]

            paths = [os.path.join(self.image_folder, file_names) for file_names in dict_['image_path']]
            label = dict_['rank']
            if self.tokenizer is None:
                caption = dict_['prompt']
            else:
                caption = self.tokenizer(dict_['prompt'])
            return images, paths, label, caption
        except Exception as e:
            raise e
            # return self.__getitem__((idx + 1) % len(self))

def evaluate_rank(data_path, image_folder, model, batch_size, preprocess_val, tokenizer, device):
    meta_file = data_path + '/hpdv2_test.json' # this is taken from: https://huggingface.co/datasets/ymhao/HPDv2/tree/main
    dataset = RankingDataset(meta_file, image_folder, preprocess_val, None)

    score = 0
    total = len(dataset)
    all_rankings = []
    with torch.inference_mode(), torch.cuda.amp.autocast():
        for sample in tqdm(dataset, total=len(dataset), ascii=True):
            images, paths, labels, caption = sample

            processed_images = tokenizer(
                images=images,
                padding=True,
                truncation=True,
                max_length=77,
                return_tensors="pt",
            ).to(device)
            image_tensor = model.get_image_features(**processed_images)

            c1 = tokenizer(
                text=caption,
                padding=True,
                truncation=True,
                max_length=77,
                return_tensors="pt",
            ).to(device)
            caption_tensor = model.get_text_features(**c1)

            image_tensor /= image_tensor.norm(dim=-1, keepdim=True)
            caption_tensor /= caption_tensor.norm(dim=-1, keepdim=True)

            num_images = image_tensor.shape[0]

            logits_per_image = model.logit_scale.exp() * image_tensor @ caption_tensor.T
            logits_per_image = logits_per_image.squeeze(-1)

            predicted = list(torch.argsort(-logits_per_image).cpu().numpy())

            score += inversion_score(predicted, labels)

    print('ranking_acc:', score/total)

def initialize_model():

    device = "cuda"
    processor_name_or_path = "laion/CLIP-ViT-H-14-laion2B-s32B-b79K"
    model_pretrained_name_or_path = "yuvalkirstain/PickScore_v1" # for pickscore
    # model_pretrained_name_or_path = "laion/CLIP-ViT-H-14-laion2B-s32B-b79K" # for clip model
    processor = AutoProcessor.from_pretrained(processor_name_or_path)
    model = AutoModel.from_pretrained(model_pretrained_name_or_path).eval().to(device)

    return model, processor

def evaluate(mode: str, root_dir: str, data_path: str = os.path.join(root_path,'datasets/benchmark'), checkpoint_path: str = None, batch_size: int = 20, hps_version: str = "v2.1") -> None:

    model, processor = initialize_model()

    evaluate_rank(data_path, root_dir, model, batch_size, None, processor, device='cuda')

if __name__ == '__main__':
    # Parse arguments
    parser = ArgumentParser()
    parser.add_argument('--data-type', type=str, required=True, choices=['benchmark', 'benchmark_all', 'test', 'ImageReward', 'drawbench'])
    # this is the path to the folder where the test json is located
    parser.add_argument('--data-path', type=str, required=True, help='path to dataset')
    # this is the path to the folder where the test images are located
    parser.add_argument('--image-path', type=str, required=True, help='path to image files')
    parser.add_argument('--checkpoint', type=str, default=os.path.join(root_path,'HPS_v2_compressed.pt'), help='path to checkpoint')
    parser.add_argument('--batch-size', type=int, default=20)
    args = parser.parse_args()

    evaluate(mode=args.data_type, data_path=args.data_path, root_dir=args.image_path, checkpoint_path=args.checkpoint, batch_size=args.batch_size)

When I run this script with both CLIP and PickScore on the HPDv2 test set, I get the following results:

Model
Results from paper
Reproduced results with the above script

CLIP ViT-H-14
65.10
50.50

PickScore
79.80
48.84

Could you please check and verify this script and the numbers to see if there was any issue from my side in reproducing the numbers? I am unable to figure out any other reasons for why I cannot reproduce the numbers from table 6. Thanks!

Hey @tgxs002, bumping this up slightly, could you please verify this? Thanks!


Added method to close a single box

#696

Just realized you can get the box with the name, and call close on the box.


Masking password input with backchannel event

If you send the following event to WebChat through the backchannel, the input box will become a password input until you send a message.
Event:
{
    name: 'inputTypeChange',
    type: 'event',
    value: 'password'
}

Demo:

Generally we encourage bot developers not to use bots for passwords, PII, and other secure data. Although Web Chat and Direct Line are secure, sending things like passwords through the same channel as the rest of the text tends to lead to bad situations. You wouldn't want passwords in LUIS utterances, for example, which are often made available widely to people in an organization.
But in this PR is a hint of a way forward. Just as you send a special type of activity from the server to initiate a password, you could also send one to the server with the password. This would allow you to create a secure pathway separate from the normal text pathway. This would have to follow all the best practices for passwords.
Do other channels have special affordances for passwords?
I would think of the server->client activity as an extension of Message indicating that the current message is requesting a password. But on the way back I'd either use a new 'password' Activity type or an 'event' Activity with name password.
(I'd want an actual security expert to look at this and chime in.)
Some notes about your implementation:

Instead of a broad notion of "input types" I'd just make this about passwords. If it needs to be generalized later, we'll do it later.
Instead of hacking sendMessage I'd add a sendPassword method.
In terms of UX state I'd follow the lead of Suggested Actions, they're both similarly modal

@compulim @vishwacsena I think this idea is worth considering.

(Also, it’s better to raise an issue than go straight to a PR.)

I understand the need to send secret over. A few things on UX:

How about sending secrets thru an Adaptive Card (or similar UI)?
Separate UI make the user feel more secure than the send box
We could hide/delete the UI after the secrets is sent
The user should be notified, before typing, that what they send will be masked
How about if the last message was activated by speech? The microphone icon will be pushed by default, need to handle that

We could use jsencrypt and use a public/private key to encrypt the data, just in case if they are not secure enough

The feature did not go into Direct Line as a standard event.
Until we get this event into Direct Line, I prefer it to be done as a sample so people can "opt-in".
You can look at one of the samples that customize activity. And implementing a new activity that render a password box.
Since the new sample would be very different from this PR, I am closing this one.
Please feel free to submit another PR for this work.

This is the tracking issue for the sample, https://github.com/Microsoft/BotFramework-WebChat/issues/1413.


[cosigned] Cosigned does not use the provided imagePullSecret for GCR when running in GCP

Description
I have private images in Google Container Registry (GCR) that are signed and want to verify them from k8s clusters running in Google Cloud Platform. The cluster and the images are running in different GCP projects and there is no permissions allowing service account from the one project to access GCR resources in the other. So, I have deployed (following the instructions here) cosigned in the k8s clusters and both - defaulting and validations are failing with
UNAUTHORIZED: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication: spec.containers[0].image

If I disable the webhook, kubelet successfully pulls the image and starts the container, therefore I am sure the credentials provided in the image pull secret are correct.
I have followed exactly the same steps with kind and AWS clusters with exactly the same image and image pull secret - cosigned is working fine and successfully resolve tags to digests, as well as retrieves the signature.
I found some pointers in different issues in this repo, and the most prominent pointer seems to be https://github.com/sigstore/sigstore/issues/138#issuecomment-970570459. Additionally, with https://github.com/sigstore/cosign/pull/804 exactly k8schain is used. I don't have much experience with this module, but it looks like it discovers the GCP service account on the k8s node and prefer it over the provided image pull secret which looks wrong to me - I would expect the image pull secrets to have higher priority.
Special notes:
My observations are limited only to AWS|kind|GCP + GCR. I have not tried different OCI registry provider, but I guess it might fail on AWS+ECR and Azure+ACR.
/cc @mattmoor @imjasonh

I wonder whether something changed with the recent keychain work? 🤔
cc @imjasonh

I found some pointers in different issues in this repo, and the most prominent pointer seems to be sigstore/sigstore#138 (comment). Additionally, with #804 exactly k8schain is used. I don't have much experience with this module, but it looks like it discovers the GCP service account on the k8s node and prefer it over the provided image pull secret which looks wrong to me - I would expect the image pull secrets to have higher priority.

k8schain should take configured imagePullSecrets over implicit GCP SA auth. See https://github.com/google/go-containerregistry/blob/b7619f2a53b1/pkg/authn/k8schain/k8schain.go#L49 -- this list is consulted in order, so first it will use the k8s client to find pull secrets, then if none match it will use DefaultKeychain (looking for ~/.config/docker.json if present), then fallback to implicit GCP, AWS, Azure auth.

One subtle thing about the k8s keychain is that it will ignore secrets that don't literally have type: dockerconfigjson (or the other one), so if it's a generic secret it won't work.  This caused me some frustration once upon a time.

Thank you for the quick feedback!
I think I am doing it just you like you suggest, though it still fails. Here are the exact steps that I follow on a freshly created GKE cluster:
kubectl create namespace cosign-system
kubectl create secret generic mysecret -n cosign-system --from-file=cosign.pub=cosigned/cosign.pub
helm repo add sigstore https://sigstore.github.io/helm-charts
helm repo update
helm install cosigned -n cosign-system sigstore/cosigned --devel --set cosign.secretKeyRef.name=mysecret --set webhook.image.version=v1.8.0
kubectl create namespace test-private-images
kubectl label namespace test-private-images cosigned.sigstore.dev/include=true
sleep 20 # need to wait some time until the cosigned is running and webhooks are updated
cat <<EOF | kubectl -n test-private-images apply -f -
---
apiVersion: v1
data:
  .dockerconfigjson: <credentials | base64 >
kind: Secret
metadata:
  name: ro-gcr
type: kubernetes.io/dockerconfigjson
---
apiVersion: v1
kind: Pod
metadata:
  name: test-private-image
spec:
  containers:
  - name: test
    image: <private-image-name>@<private-image-digest>
  imagePullSecrets:
  - name: ro-gcr
EOF

And the pod creation fails with
Error from server (BadRequest): error when creating "STDIN": admission webhook "cosigned.sigstore.dev" denied the request: validation failed: GET https://eu.gcr.io/v2/<private-image-uri>/manifests/<private-image-digest>: DENIED: Permission denied for "<private-image-digest>" from request "/v2/<private-image-uri>/manifests/<private-image-digest>". : spec.containers[0].image
<private-image-name>@<private-image-digest>

I might be overlooking something, but if you find anything suspicious, please let me know.
To rule out any network or permissions issues, I have executed similar request with curl from a container deployed in the same cluster
kubectl run --image alpine:3.15.4 alpine -- sleep 3600
kubectl exec -it alpine -- sh
apk add curl
curl https://eu.gcr.io/v2/<privata-image-uri>/manifests/<private-image-digest> -u oauth2accesstoken:<credentials>
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
   "config": {
      "mediaType": "application/vnd.docker.container.image.v1+json",
      "size": 2424,
      "digest": "sha256:abcd"
   },
   "layers": [
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 2818413,
         "digest": "sha256:123"
      },
...
   ]

So, this is what made me think it should be something in the authentication used by cosigned.

@vpnachev The secret must live in the same namespace as cosigned. We do not want to have rights to read all the secrets in all the namespaces. I realize this was never documented (I'm fixing right now... Sorry!!!)
So, try creating that secret in cosign-system namespace

Sorry, are you using the ClusterImagePolicy by any chance? Sorry for possibly confusing the issue :)

The secret must live in the same namespace as cosigned

If this was true, then I should have seen failures with kind/aws k8s clusters, but they are working perfectly fine. I also should have seen errors in the logs that cosigned tries to read the non-existing ro-gcr secret from the cosign-system namespace, but there are no such errors.
In general, cosigned cannot and should not expect that each and every image pull secret will be replicated from the application namespace to the cosign system namespace.

We do not want to have rights to read all the secrets in all the namespaces.

Looking in the chart templates, actually it has the read permissions for all secrets in all namespaces, ref

Sorry, are you using the ClusterImagePolicy by any chance? Sorry for possibly confusing the issue :)

I am not deploying any ClusterImagePolicies, but I guess there is a default one in the chart that should be configured, ref

Next week I will try to disable the service accounts on the GCP nodes, also will try with different OCI registries.

@vpnachev You could use that example to create your own ClusterImagePolicy but it is not enabled by default. You could follow the documentation in https://docs.sigstore.dev/cosign/kubernetes/ to create a new one.

Looking in the chart templates, actually it has the read permissions for all secrets in all namespaces, ref

Yes, as you certainly found in ref, we are relying on the same logic used by the PodSpec when getting the credentials to pull images from a registry. In addition to that, you could also specify the credentials to be used in case the registry with the signatures lives in a different location.
Let us know if you are still facing problems.

In addition to that, you could also specify the credentials to be used in case the registry with the signatures lives in a different location.

@hectorj2f I am aware about this option, but have not evaluated it because I think cosigned still needs access to the registry with the image to resolve the tag to digest.

Let us know if you are still facing problems.

Yes, I am still facing the problem. More details below

I will try to disable the service accounts on the GCP nodes

It turns out that I cannot do this, so I cannot prove this way that the service account available on the GCP nodes is the culprit.
However, I was able to

also will try with different OCI registries

In cluster running on GCP I am successfully using private image from AWS ECR without changing anything in how cosigned is installed in the cluster, also no additional configurations are applied. Pretty much I am following again the steps from https://github.com/sigstore/cosign/issues/1878#issuecomment-1126513203, I am just creating another namespace now with AWS specific image pull secret and replicated alpine image in my private registry (also signed with my cosign private key)
kubectl create namespace test-private-images-aws
kubectl label namespace test-private-images-aws cosigned.sigstore.dev/include=true
kubectl -n test-private-images-aws create secret docker-registry aws-ro --docker-server <account-id>.dkr.ecr.eu-central-1.amazonaws.com --docker-username AWS --docker-password=$(aws ecr get-login-password)
cat <<EOF | kubectl -n test-private-images-aws apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: test-private-image
spec:
  containers:
  - name: test
    image: <aws-account>.dkr.ecr.eu-central-1.amazonaws.com/alpine:3.15.4
    command:
    - sh
    - -c
    - "sleep 3600"
  imagePullSecrets:
  - name: aws-ro
EOF
kubectl -n test-private-images-aws get pod test-private-image -o<EMAIL_ADDRESS><aws-account>.dkr.ecr.eu-central-1.amazonaws.com/alpine@sha256:a777c9c66ba177ccfea23f2a216ff6721e78a662cd17019488c417135299cd89

So, the image is successfully resolved from tag to digest and also validated against the signature in the same registry.
Just for completeness, I will do again the same with GCR
kubectl create namespace test-private-images-gcp
kubectl label namespace test-private-images-gcp cosigned.sigstore.dev/include=true
cat <<EOF | kubectl -n test-private-images-gcp apply -f -
---
apiVersion: v1
data:
  .dockerconfigjson: <credentials>
kind: Secret
metadata:
  name: gcr-ro
type: kubernetes.io/dockerconfigjson
---
apiVersion: v1
kind: Pod
metadata:
  name: test-private-image
spec:
  containers:
  - name: test
    image: eu.gcr.io/<gcp-project>/alpine:3.15.4
    command:
    - sh
    - -c
    - "sleep 3600"
  imagePullSecrets:
  - name: gcr-ro
EOF

And here I again get the error
Error from server (BadRequest): error when creating "STDIN": admission webhook "cosigned.sigstore.dev" denied the request: validation failed:
invalid value: eu.gcr.io/<gcp-project>/alpine:3.15.4 must be an image digest: spec.containers[0].image

If I disable the validation for the test-private-images-gcp namespace, kubelet successfully manage to pull the image
kubectl label namespace test-private-images-gcp cosigned.sigstore.dev/include=false --overwrite
cat <<EOF | kubectl -n test-private-images-gcp apply -f -
---
apiVersion: v1
data:
  .dockerconfigjson: <credentials>
kind: Secret
metadata:
  name: gcr-ro
type: kubernetes.io/dockerconfigjson
---
apiVersion: v1
kind: Pod
metadata:
  name: test-private-image
spec:
  containers:
  - name: test
    image: eu.gcr.io/<gcp-project>/alpine:3.15.4
    command:
    - sh
    - -c
    - "sleep 3600"
  imagePullSecrets:
  - name: gcr-ro
EOF

kubectl -n test-private-images-gcp get pod
NAME                 READY   STATUS    RESTARTS   AGE
test-private-image   1/1     Running   0          119s
kubectl -n test-private-images-gcp get events --field-selector involvedObject.name=test-private-image | grep Pulled
2m17s       Normal   Pulled      pod/test-private-image   Successfully pulled image "eu.gcr.io/<gcp-project>/alpine:3.15.4" in 462.97357ms

I've also tested AWS k8s cluster with GCR and ECR, the cosigned installation is exactly the same as the one for the GCP cluster.
kubectl create namespace test-private-images-aws
kubectl label namespace test-private-images-aws cosigned.sigstore.dev/include=true
kubectl -n test-private-images-aws create secret docker-registry aws-ro --docker-server <aws-account>.dkr.ecr.eu-central-1.amazonaws.com --docker-username AWS --docker-password=$(aws ecr get-login-password)
cat <<EOF | kubectl -n test-private-images-aws apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: test-private-image
spec:
  containers:
  - name: test
    image: <aws-account>.dkr.ecr.eu-central-1.amazonaws.com/alpine:3.15.4
    command:
    - sh
    - -c
    - "sleep 3600"
  imagePullSecrets:
  - name: aws-ro
EOF
kubectl -n test-private-images-aws get pod test-private-image -o<EMAIL_ADDRESS><aws-account>.dkr.ecr.eu-central-1.amazonaws.com/alpine@sha256:a777c9c66ba177ccfea23f2a216ff6721e78a662cd17019488c417135299cd89

I was expecting AWS cluster to fail with ECR registry, though it succeeded. But it also succeeded with GCR registry
kubectl create namespace test-private-images-gcp
kubectl label namespace test-private-images-gcp cosigned.sigstore.dev/include=true
cat <<EOF | kubectl -n test-private-images-gcp apply -f -
---
apiVersion: v1
data:
  .dockerconfigjson: <credentials>
kind: Secret
metadata:
  name: gcr-ro
type: kubernetes.io/dockerconfigjson
---
apiVersion: v1
kind: Pod
metadata:
  name: test-private-image
spec:
  containers:
  - name: test
    image: eu.gcr.io/<gcp-project>/alpine:3.15.4
    command:
    - sh
    - -c
    - "sleep 3600"
  imagePullSecrets:
  - name: gcr-ro
EOF
kubectl -n test-private-images-gcp get pod test-private-image -o<EMAIL_ADDRESS>eu.gcr.io/<gcp-project>/alpine@sha256:a777c9c66ba177ccfea23f2a216ff6721e78a662cd17019488c417135299cd89

I will try to dig deeper into the authentication code, but any help will be appreciated. Also, if anyone else can try to follow my steps to reproduce on GCP nodes with GCR, just make sure the service account associated with the nodes is not authorized to read the image.

I found some pointers in different issues in this repo, and the most prominent pointer seems to be sigstore/sigstore#138 (comment). Additionally, with #804 exactly k8schain is used. I don't have much experience with this module, but it looks like it discovers the GCP service account on the k8s node and prefer it over the provided image pull secret which looks wrong to me - I would expect the image pull secrets to have higher priority.

k8schain should take configured imagePullSecrets over implicit GCP SA auth. See https://github.com/google/go-containerregistry/blob/b7619f2a53b1/pkg/authn/k8schain/k8schain.go#L49 -- this list is consulted in order, so first it will use the k8s client to find pull secrets, then if none match it will use DefaultKeychain (looking for ~/.config/docker.json if present), then fallback to implicit GCP, AWS, Azure auth.

I think this is the issue that I am facing (thanks @imjasonh for the pointer). Simply, the cosigned is using version of github.com/google/go-containerregistry that does not include https://github.com/google/go-containerregistry/pull/1346.
https://github.com/sigstore/cosign/blob/v1.8.0/go.mod#L72 -> https://github.com/google/go-containerregistry/blob/f1fa40b162a1601a863364e8a2f63bbb9e4ff36e/pkg/authn/k8schain/k8schain.go#L48-L53 and here the k8s keyChain is the last in the list, therefore the GCP service account is used.
The solution should be relatively easy - just revendor newer version of github.com/google/go-containerregistry/pkg/authn/k8schain, I will try to validate this tomorrow and if it works, I will open a PR.

D'oh! That possibility didn't even occur to me. 🤦♂
I agree it sounds like that should be the fix, thanks for thinking of it, and let me know if you send a PR. Or if you don't, I can. 👍

I managed to vendor k8schain where the issue is fixed and now I can confirm that I can use private images from GCR in GCP k8s clusters :tada:


Add property "select artboard"  from a rive file

to rivescene or rivemodel
This will  avoid duplication of riv files with multiple artboards.

Fixed in https://github.com/defold/extension-rive/releases/tag/2.0.0


cldoc: init at 1.9

This is my first Python package - please review carefully.

Hmm. At runtime I am getting this:
Fatal: Failed to locate libclang library. cldoc depends on libclang for parsing sources, please make sure you have libclang installed.
libclang.so: cannot open shared object file: No such file or directory. To provide a path to libclang use Config.set_library_path() or Config.set_library_file().

What package provides libclang.so?

OK so clang does provide libclang.so. But this package has python bindings and it's looking for libclang.so at runtime and not finding it. I'm not sure how to resolve this problem.

Thanks to help from @benley this is now working by patching away the python code to detect libclang.so path and just hard coding the answer when we create the nix package.

OK so I tried using cldoc for a while and discovered that the quality of the software is lower than I thought. So I'm not actually interested in using it or maintaining a nixpkg for it. Sorry for any time wasted.


Add safejax in "Featured Projects"

What's in this PR?
As of @julien-c's recent tweet at https://twitter.com/julien_c/status/1663239984772526085, I've decided to include https://github.com/alvarobartt/safejax in the "Featured Projects" section of the safetensors documentation.
Thanks, and, again, great work @Narsil!

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint.

Very nice Thanks !
And thanks for safejax !


fix: totalDifficultyFaced calculation issue

solves #19

Hi @clauBv23! Thanks for your contribution, we will check it out ASAP!


Typing error on getPaymasterAndData

The TypeScript definition for getPaymasterAndData only takes one argument, but the actual function takes two.
To get it to work I have to do:
const { paymasterAndData } = await (
  account.paymaster.getPaymasterAndData as (
    op: Partial<UserOperation>,
    service: SponsorUserOperationDto,
  ) => Promise<PaymasterAndDataResponse>
)(partialUserOp, paymasterServiceData)

The TypeScript definition for getPaymasterAndData only takes one argument, but the actual function takes two.
To get it to work I have to do:
const { paymasterAndData } = await (
  account.paymaster.getPaymasterAndData as (
    op: Partial<UserOperation>,
    service: SponsorUserOperationDto,
  ) => Promise<PaymasterAndDataResponse>
)(partialUserOp, paymasterServiceData)

the actual function from BiconomyPaymaster class which implements IHybridPaymaster which in turn implements IPaymaster.
so it depends on the type of paymaster supplied to account during initialisation.


Introduce a skip_validation flag in yaml reader

Description of Problem:
Currently yaml_story_reader::read_from_string always validates it's input.
This makes reading strings from the database (that were already validated) very slow, which e.g. happens in requests to GET /domainWarnings in rasa-x.
Overview of the Solution:
To speed up reading strings from the database we introduce a skip_validation flag in yaml_story_reader::read_from_string and yaml_story_reader::read_from_file
Examples (if relevant):
Blockers (if relevant):
Definition of Done:

rasa-x issue for context


Crashing rendering pages for certain votes!

I now get a 500 error of this vote:
https://voteview.polisci.ucla.edu/rollcall/RS0930167
and many others.  Yikes.

This is still the wikipedia error, @aaronrudkin. You fixed this but I think something is not keeping that change sent to the production server.

Okay, this error was because when 'wikipedia' was added to the orgMapping on views/search_result.tpl it wasn't added to orgMapping on views/vote.tpl. This probably shouldn't be split across both pages so I'll leave this open until that is resolved. Can't fix that right now but the main issue is resolved.

@lukesonnet Important to also add a check in views/vote.tpl to check if the label is there before rendering it (i.e. if vote["key_flags"][0] in orgMappings or similar).


Android Kotlin: 05.12 UI RESOURCES

Description :scroll:
*UI Resources
Drawable
String
Styles

Documentation

Domain of Contribution :bar_chart:

[x] Android Dev (Kotlin)

References :

Please Read it Carefully Before Contributing

Changes should be made in Android_Development_With_Kotlin/ directory under Android_Development_With_Kotlin branch.
Inside Android_Development_With_Kotlin/ directory creates a directory and names it according to the topic ( for this issue 09. Dynamic User Interface)
Inside 09. Dynamic User Interface/ directory add your task with subtopic number and name and make changes accordingly.
You have to push your PR to the Android_Development_With_Kotlin branch only.
You can take help to the references but don't simply try to copy it. Just explain in your own word.
This issue is for GWOC'21 contributors only.
You need to push in a single commit. If there exists more than one commit then you need to squash your commits into one commit.
Will assign you on a first come first serve basis.
Please try to complete your assigned task within 7 days. If you need some more time then, please inform mentors and supervisors.
If you have two previously assigned issues on Android-Kotlin pending then please first complete them.

Supervisor @rahulsain

Happy Contributing. Best of Luck.:sparkling_heart:

/assign

Check this guide before contributing.


Warn users and give opportunity to revert when using non standard SSO group and/or SSO policy names

The non-standard names will make it harder to import (and perhaps other functions) in the future.

Work for this issue will begin begin on branch work-liquid-labs/cloudsite/219.


DIDs

User identity should not be tied to a specific handle.
Right now we use a @username:homeserver format. If the user wants to change username, or more importantly server, they have to essentially start fresh with a new identity.
A better solution would be to use DIDs, with handles just pointing to the underlying DID.

Going to just focus on DIDs for this issue, handles can be a separate feature built on top of them.

Well we do use this now, not really defined in this repo anywhere but I guess this is completed?


chore: update the changelog properly and sync files for packit

chore: set packit to sync changelog as well

chore: sync fedora spec to upstream to maintain changelog history for fedora

chore: Generate proper changelog from commit history when releasing

When releasing the package mrack.spec was not enriched
by the history of changes compared to previous release
this is enhancing the workflow to have proper changelog

LGTM


aptly publish update to S3 updates the entire repo

Hi there,
I'm starting to use aptly to publish repos from our source control system directly into S3, however, it appears that the publish update command results in a repo refresh rather than just an update. As we publish to many regions, this tends to make things rather lengthy.
I'm using 0.9.6 and the command is similar to the following:
aptly publish update -config=aptly.conf -gpg-key=BLAHBLAH trusty s3:my-big-bucket:

We have plusWorkaround set to true.
Any ideas?

Worked around this issue so feel free to ignore.


Nodegit not compatible with recent node version

I am using node version 7.6.0 on Mac OS X. I installed the latest version of nodegit: v.0.18.0 but I get an error.
The error states that my version of node is not compatible with this module. Here is the message:
Error: The module '/Users/tinocaer/Pipeline/node_modules/nodegit/build/Release/nodegit.node' was compiled against a different Node.js version using NODE_MODULE_VERSION 51. This version of Node.js requires NODE_MODULE_VERSION 53. Please try re-compiling or re-installing the module (for instance, using npm rebuild ornpm install).
How can I fix this?
Thanks

I don't know why your version of node 7.6.0 is not 51 because it very much should be.
johnhosx :: ~ » node --version                                                                                1 ↵
v7.6.0
johnhosx :: ~ » node
> process.versions.modules
'51'
>

Are you compiling against electron or something else?

I am using electron.

Electron says it uses version 53. I typed what you type into the console and I got the same results, so its definitely electron.

Ahh ok cool, that makes a lot more sense. What are you using to rebuild native node modules?

I'm just using the npm rebuild... I haven't come into this issue before.

You can add a .npmrc to the root of your electron project that will force native node modules to build against a specific platform.
.npmrc Ex:
runtime = electron
target = 1.6.2
target_arch = x64
disturl = https://atom.io/download/atom-shell

It worked! Thanks!


Scroll to top button added

issue no #92
Here I added Scroll to Top Button with same color as navbar.

Working Video of that
https://www.loom.com/share/2653c4306c064a9689ca3d6d407f85ed

hey @mdazfar2 can you please check it and merge. Can you provide this to level3 ?

Hi @zalabhavy the Scroll to Top Button is not showing what did you do?

@mdazfar2 it's ok. Thank You !! I will create new issues in this repo. Really u are a best and active PA I had seen in Gssoc'24.

Sure @zalabhavy Create new issue which really need on our web.


BUG: Testimonial section not responsive in mobile

Is there an existing issue for this?

[X] I have searched the existing issues

What happened?
the testimonial rection is not responsive in the mobile format
the testimonials are not in proper place as they should be
Add ScreenShots

What browser are you seeing the problem on?
Chrome
Record

[X] I agree to follow this project's Code of Conduct
[ ] I'm a GSSOC'23 contributor
[X] I want to work on this issue

can i please work on this  i want to contribute in GSSOC'23
i am confident in this


doc: updated my personal folder and the README.md with task checklist

This is a pull request that contains the checklists required for a contributor with Wagtail

Added my name to the list of participants in 2023/README.md.
Created a new folder inside 2023/ with my name as the folder name.
Inside that folder, I added a README.md file with my personal introductory message.
Added the task section
Added contributor's checklist
Added Research section

Perfect @Chinex-Boroja!

Thank you @thibaudcolas


Regarding the custom dataset CSV, there are data format issues in the train-loader for classification tasks.

Thank you to the author for their open source work. In the classification task, they loaded their own dataset, and there are three types of data in the train-loader. But there were problems during training. What is the data format of the trainloader?

this is my  bug log：

I hope the author can provide a significant data format for train-loader。

Sorry, this data loader design works well for our scripts. Are you trying to use your own data? You can read this file for the data organization (https://github.com/thuml/Time-Series-Library/blob/main/data_provider/data_loader.py#L616-L748 ).

Sorry, this data loader design works well for our scripts. Are you trying to use your own data? You can read this file for the data organization (https://github.com/thuml/Time-Series-Library/blob/main/data_provider/data_loader.py#L616-L748 ).

I created my classification dataset in TS format and encountered a bug during training, which is a dimension mismatch issue. In the source code, there is a for loop that needs to subtract 1, which is to subtract the label. Why does subtracting 1 from the first iteration result in a mismatch in dimensions when the dimensions are the same in the first iteration? I hope the blogger can dispel doubts.