Activator request proxying is incompatible with Istio ClusterRbac

/area networking
While working through
https://cloud.google.com/solutions/authorizing-access-to-cloud-run-on-gke-services-using-istio#deploying_a_sample_service
A few issues came up:
JWT authorization needs to be disabled on some paths for the system to work (controller being able to ping the service, for example).
With the updated policy:
apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: default
  namespace: tutorial
spec:
  origins:
  - jwt:
      issuer: https://accounts.google.com
      audiences:
      - http://example.com
      jwksUri: https://www.googleapis.com/oauth2/v3/certs
      triggerRules:
      - includedPaths:
        - prefix: /
      - excludedPaths:
        - exact: /_internal/knative/activator/probe
        - exact: /healthz
        - exact: /probe
        - exact: /metrics
  principalBinding: USE_ORIGIN

Things mostly work, with one large gap.
It was discovered that this example only works when the Activator is not proxying requests. This is pretty clearly non-ideal, and appears to be related to an inability of the Activator to query the health of the (Revision pod and/or ClusterIP).
We should determine how to make Istio JWT authz work properly with Activator proxying in order for users to be able to have scale to zero and burst protection at the same time as locking down Service access via JWT.

/label area-networking
/cc @tcnghia @ZhiminXiang @nak3

I guess in net-istio it's all networking :D

/cc @mattmoor
for visibility

It also probably prohibits Autoscaler to scrape the metrics from the pods, limiting all possible scaling decisions.
I think ideally either specific deployments or everything in knative-serving should be whitelisted for these specific paths.

I guess in net-istio it's all networking :D

:)

It also probably prohibits Autoscaler to scrape the metrics from the pods, limiting all possible scaling decisions.

I can take a look, but IIRC controller -> pod and autoscaler -> pod traffic seemed alright.

Controller does not talk to pods, though. Only Autoscaler and Activator do.

As we confirmed Autoscaler can't talk either.

I have tested @Cynocracy's setting and the issue seemed replicable on my env.
Then the issue was fixed if I removed the includedPaths from the policy.
To be removed:
      - includedPaths:
        - prefix: /

Actually our CI tests the policy without includedPaths.
With said, in my understanding, having prefix: / and the empty list should be same meaning. The Istio docs explains it as:
https://archive.istio.io/v1.4/docs/reference/config/security/istio.authentication.v1alpha1/#Jwt-TriggerRule

List of paths that the request must include. If the list is not empty, the rule is satisfied if request path matches at least one of the path in the list. If the list is empty, the rule is ignored, in other words the rule is always satisfied.

Anyway could you please verify if removing includedPaths solve the issue on your env too?

I tried removing includePaths, things works.
Looks like in the Policy yaml in in https://github.com/knative/net-istio/issues/95#issue-615052497, the rule includedPaths: prefix: / will still be triggered even for the requests with excluded paths (e.g. /_internal/knative/activator/probe).
I guess Istio tries to match includedPaths first. If any path matches, the rule will be triggered. If no paths matches, then it checks excludedPaths, which could explain why removing includedPaths could make things work.

Huh, thanks folks! That was a simpler fix than I had imagined.
I'll test out the change and if all's clear I can close this out.

Unfortunately I'm not able to confirm :(
I'm setting up a cluster with the Policy
  spec:
    origins:
    - jwt:
        audiences:
        - http://example.com
        issuer: https://accounts.google.com
        jwksUri: https://www.googleapis.com/oauth2/v3/certs
        triggerRules:
        - excludedPaths:
          - prefix: /_internal/knative
          - exact: /healthz
          - exact: /probe
          - exact: /metrics
    principalBinding: USE_ORIGIN

I'm still only able to hit the Service when the Activator isn't in the request path. In addition, when it's not in the request path, hitting /healthz returns
RBAC: access denied
which is different than the error seen when hitting a protected endpoint:
Origin authentication failed.
@nak3 @ZhiminXiang any ideas what could be different about our setups? Are there any resources you create other than the Policy/ClusterRbacConfig/ServiceRole/ServiceRoleBinding?

Checking @ZhiminXiang 's example (thanks for sharing!) I see a few differences.
Later Knative version is being used
and the 'Invoker' ClusterRbac etc is missing.
I'll try those out and see if I have any luck :) The main issue there is that those are necessary to enforce
request.auth.claims[email]:
But if those end up being problematic... I can shift to playing around with the settings there.

Yup, I think those are actually the issue.

apiVersion: rbac.istio.io/v1alpha1
kind: ClusterRbacConfig
metadata:
  name: default
spec:
  mode: ON_WITH_INCLUSION
  inclusion:
    namespaces:
    - tutorial
---
apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRole
metadata:
  name: invoker
  namespace: tutorial
spec:
  rules:
  - services:
    - '*'
    paths:
    - '*'
    methods:
    - '*'
---
apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRoleBinding
metadata:
  name: invoker-binding
  namespace: tutorial
spec:
  subjects:
  - properties:
      request.auth.claims[email]<EMAIL_ADDRESS>  roleRef:
    kind: ServiceRole
    name: invoker

So now to figure out how to enforce these without making activator -> pod traffic unhappy.

apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRoleBinding
metadata:
  name: invoker-binding
  namespace: tutorial
spec:
  subjects:
  - properties:
      request.auth.claims[email]<EMAIL_ADDRESS>  - properties:
      source.namespace: "knative-serving"
  roleRef:
    kind: ServiceRole
    name: invoker

May do the trick, trying it out now :)

No luck (so far). Continuing to prototype.

@Cynocracy our tests also enable sidecar on Activator, so may be that's another thing to try.

Interesting, would labeling the namespace do the trick, or would that be overkill?

{"level":"error","ts":"2020-05-15T19:48:46.398Z","logger":"activator","caller":"net/revision_backends.go:293","msg":"Failed to probe clusterIP <IP_ADDRESS>:80","knative.dev/controller":"activator","knative.dev/pod":"activator-8678df44f9-bz2kj","knative.dev/key":"tutorial/my-service-00001-cix","error":"unexpected body: want \"queue\", got \"RBAC: access denied\"","stacktrace":"gke-internal/knative/cloudrun/vendor/knative.dev/serving/pkg/activator/net.(*revisionWatcher).checkDests\n\tgke-internal/knative/cloudrun/vendor/knative.dev/serving/pkg/activator/net/revision_backends.go:293\ngke-internal/knative/cloudrun/vendor/knative.dev/serving/pkg/activator/net.(*revisionWatcher).run\n\tgke-internal/knative/cloudrun/vendor/knative.dev/serving/pkg/activator/net/revision_backends.go:335"}

:( I'm starting to suspect my "allow traffic from namespace X" bit is failing.

OK, after much head desking it turns out the trick is to just completely ignore the deprecated ClusterRbacConfig feature and do it entirely using Authn/AuthzPolicies
apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: default
  namespace: tutorial
spec:
  origins:
  - jwt:
      issuer: https://accounts.google.com
      audiences:
      - http://example.com
      jwksUri: https://www.googleapis.com/oauth2/v3/certs
      triggerRules:
      - excludedPaths:
        - exact: /_internal/knative/activator/probe
        - exact: /healthz
        - exact: /probe
        - exact: /metrics
  principalBinding: USE_ORIGIN
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: allow-knative-serving
 namespace: tutorial
spec:
 rules:
 - from:
   - source:
       namespaces: ["knative-serving"]
   to:
   - operation:
       methods: ["GET"]
       paths: ["/_internal/knative/*","/healthz", "/probe", "/metrics"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: allow-jwt
 namespace: tutorial
spec:
 action: ALLOW
 rules:
 - when:
   - key: request.auth.principal
     values<EMAIL_ADDRESS>   - key: request.auth.audiences
     values: ["example.com"]
   - key: request.auth.claims[iss]
     values: ["https://accounts.google.com"]

@Cynocracy can this be closed?

Article is updated, just waiting for a small PR to be merged to the sample code repo: https://github.com/GoogleCloudPlatform/cloud-run-samples/pull/24
Had to use request.auth.claims[email] in the authz policy instead of request.auth.principal. The latter maps to the sub claim from the JWT, and this contains the unique user ID rather than the IAM service account email address.

PR has been merged.

The guide has been updated, so we can close this issue.

Thank you @halvards
Closing.


Trivial: Replace calls to new(). (#243)

Reviewers: @vinniefalco @nbougalis

This is likely broken: PeerFinder::Logic uses beast::SharedPtr but also relies on beast::SharedObject functionality for Source. Until we can remove that dependency, beast::SharedPtr can't be simply replaced with std::shared_ptr.

Oh, really!  So that reveals something - we have no tests for this facility!
I'll probably revert that part but let me see what I can do.

(I reverted all those pending better understanding of beast::SharedPtr.)

:+1:

Incorporated as d5193a776e9972db334892f7036888d2cbd6c9fd


Specify a formatting style.

Specify a style to be used for formatting C and Python files. Inconsistent styles lead to excessive or unnecessary changes in diffs (especially when using IDEs with autoformatters), and lead to poor readability.
Many IDEs support autoformatting with standard styles.
Suggestion: yapf for Python, Google clang-format for C.

@pdietl you made some progress on this?

Python formatting was added with commit 88852fb8977e80d636247fc0be6f3753fd392cc2
and C formatting was added with #92

Ok sounds like this is fixed then, but please reopen and/or new issue if still needs attention


Update uninstall instructions to use apt-get

The apt interface in 20.04 does not support wildcards. Trying to uninstall with this command yields
E: Unable to locate package ros-foxy-rviz-*

@Mergifyio backport rolling galactic


@enmempin requests

Hi @zapaz :slight_smile: how are you guys doing? I'm wondering whether you have any idea about whether/when I can expect two features I would really like to see

use my own smartcontract (import, for instance from Cargo or Mintable, or create as instance from yours, if the latter it would be important to be able to set resale commissions)
get more (custom) metadata into the IPFS metadata file when archiving media to IPFS, e.g. using custom fields I can define / configure across all my media and hopefully then also display automatically on the front end)

Any chance (something like) these might be coming soon?
Thanks!

done in v0.17


raftstore, metrics: add metrics for the number of peers in flashback state

What is changed and how it works?

Issue Number: ref #14748.
What's Changed:

Add metrics for the number of peers in the flashback state.

Check List
Tests

Unit test
Integration test
Manual test (add detailed scripts or steps below)

Release note
None.

/cc @HuSharp @Connor1996 @overvenus

/review default

@Connor1996 PTAL, thx.

/merge

/test


Is the Project directory still required?

Creating a new project requires a project directory (i.e. $PROJ_DIR in example 01) as part of the inputs of the client. As far as I've seen, this directory is empty and nothing appears to get written there. Can we deprecate it?
See:
(fractal-client-v1-a6) bash-4.4$ fractal project new --help
DEBUG:asyncio:Using selector: EpollSelector
usage: fractal project new [-h] [-d DATASET] name path

positional arguments:
  name                  Name of new project
  path                  Project directory of new project. New datasets will be written here.

optional arguments:
  -h, --help            show this help message and exit
  -d DATASET, --dataset DATASET
                        Name of new dataset to create. By default, the dataset `default` is created.

As part of #475, this directory will host the user-side working directories for job execution, and thus will be clearly useful.
Note that there is an open issue about how to cleanup the server-side and user-side folders: https://github.com/fractal-analytics-platform/fractal-server/issues/474.
The only task left is to document the new folder structure - see https://github.com/fractal-analytics-platform/fractal-server/issues/483.


Use separate test repository for Github migration tests

We should create a test repo that is never touched or modified and use that for github migration tests. As seen in #8893, tests were broke from re-opening an old issue that then changed the modification time of a milestone.
Would be better not to test things that might be updated or change randomly.

Right. I think maybe git repository is better since it has been archived.

Why not fork any of those under go-gitea and use the fork?

Forking doesn't copy most any of the things actually tested. Just need a set of milestones, issues, releases, etc...
@lunny we should use a new repo because you might want to add future tests and that could be hard with an archived repository that you can't modify. Also it might as well be very intentional that the repo only exists to be tested

@mrsdizzie but you also have to archive it to avoid someone create issues accidentally?

@lunny it is ok to create new issues (new issues are created on go-gitea/gitea all the time and that is what we test now).
We should just have a test repo so there is no reason for anybody to ever modify old issues/milestones/etc...
Having a test repo is just like the unit and integration tests we have where it is clear that the information is only there to be tested and you should be cautions if making any additions.

OK. Here we go. https://github.com/go-gitea/test_repo

@lunny ok great when I have some time will look into replacing the current tests/data ty!

@lunny if possible to give me permission to create milestones, release, etc.. if not you should create anything we need to test in that repo then we can update the current tests

@mrsdizzie Thanks! Done. Now you have permissions to create issues/milestones/releases, etc... on that repository.

Thx @lunny ill do in a few days when back


With reference to - Module Upload Error #544

OData Version
OData V2
Draft
Yes
Scenario
Facing error after deployment at build workzone
Environment
Build Workzone
UI5 Spreadsheet Component
No response
What happened?
Hi Marian
From BAS we are able to deploy the application and we can see the preview of the application all good. But at the Build Workzone the application is not available. when we synced we got the below error regarding spreadsheet.
It was working good but when we did the redeployment we were facing this issue. Kindly respond as early as possible.
"AppId_cc.spreadsheetimporter.v0_33_4": {
"error": [
"Replication failed for HTML5 app 'zmacreditdebitrequest' and manifest 'thirdparty/customControl/spreadsheetImporter/v0_33_4/manifest.json'",
"Service name 'spreadsheetimporter_v0_33_4' and public setting 'true' in embedded manifest.json have to be equal to service name 'ManualAdjustment' and public setting 'true' of root manifest.json"
],
"warning": []
}

Thank you.

Relevant log output
We are facing error attached screen shot at SAP build workzone and when we try to sync to see the deployed application. Application is not available then we clicked on Report it has given this JSON log file attached.

Spreadsheet Component Init
We are facing error attached screen shot at SAP build workzone and when we try to sync to see the deployed application. Application is not available then we clicked on Report it has given this JSON log file attached.

Manifest
No response

Hi Marian, can you please check and let us know as soon as possible. Thank you.

Hi,
as i already said in https://github.com/spreadsheetimporter/ui5-cc-spreadsheetimporter/issues/544#issuecomment-2139310466 that you should deploy the component not in the app but standalone as described in: https://docs.spreadsheet-importer.com/pages/CentralDeployment/
If you still like to deploy that inapp please create a ticket with SAP and kindly report back what SAP responds.


multiple browser.waitForAngularEnabled in a method not working

Hi there!

Node Version: 10.15.0
Protractor Version: 6.0.0-beta
Angular Version: 4.3.0
Browser(s): chrome
Operating System and Version Windows 10

I have methods I call where I was previously ran using multiple ignoreSynchronization but I switch to waitForAngularEnabled from within my test and I get the following output based on the same function below.
[2019-02-07T11:18:44.618] [INFO] VClientActions.login - a1: true
[2019-02-07T11:18:44.622] [INFO] VClientActions.login - a2: true
I would assume a2 would equal false after browser.waitForAngularEnabled(false); is called.
`login(): void {
// Get the page
browser.waitForAngularEnabled().then((a1: any) => {
logger.info('a1: ' + a1);
  browser.waitForAngularEnabled(false);
  browser.waitForAngularEnabled().then((a2: any) => {
    logger.info('a2: ' + a2);
  });
});`

Subsequently: in 5.4 if I run
log (browser.ignoreSynchronization);
browser.ignoreSynchronization = true;
log (browser.ignoreSynchronization);
I get 'false' followed by 'true'

You've called waitForAngularEnabled() 3 times. You're setting it to true, then false, then back to true. But you're never printing the middle false.
Try this:
login(): void {
  // Get the page
  browser.waitForAngularEnabled().then((a1: any) => {
    logger.info('a1: ' + a1);
    browser.waitForAngularEnabled(false).then((a2: any) => {
      logger.info('a2: ' + a2);
    });
  });
}

@GitSage Thanks for the reply.
My understanding from the method doc is calling browser.waitForAngularEnabled() with no arguments is that it will just return the current setting. So my intention was to get the current setting, set it to true by passing false and then getting the value again to verify it changes

@tfaron ahh you're right, my mistake. In this case I suspect your issue is an asynchronous one. You didn't wait for your middle promise to complete before moving on to the third one.
Try this:
login(): void {
  // Get the page
  browser.waitForAngularEnabled().then((a1: any) => {
    logger.info('a1: ' + a1);
    browser.waitForAngularEnabled(false).then(() => {
      browser.waitForAngularEnabled(false).then((a2: any) => {
        logger.info('a2: ' + a2);
      });
    });
  });
}

Alternatively, if you're using Node 8+, you can accomplish the same thing using async/await:
async login(): void {
  // Get the page
  const a1 = await browser.waitForAngularEnabled();
  logger.info('a1: ' + a1);
  await browser.waitForAngularEnabled(false);
  const a2 = await browser.waitForAngularEnabled();
  logger.info('a2: ' + a2);
}

Thanks I'll give it a try, appreciate the help.

It looks like I can close this. waitForAngularEnabled when getting and setting should be awaited. If this is still an issue please feel free to open. @GitSage thank you for your responses.


Fix ControlNeXtSDVModel -> ControlNeXtSVDModel in SVD-related Codes

Hi @Randolph-zeng ,
Thanks for the great work! I found that there are typos in SVD-related codes. Specifically, the ControlNeXtSVDModel is defined as ControlNeXtSDVModel.
In this PR, all ControlNeXtSDVModel are fixed to ControlNeXtSVDModel.

hi, thanks for the PR, but you probably tagged the wrong person accidentally. I have suggested the author to review your code, hope that helps thx !

hi, thanks for the PR, but you probably tagged the wrong person accidentally. I have suggested the author to review your code, hope that helps thx !

Thanks for replying!


fix adapter string config

allows push adapter to be properly configured via string config

Could you add a test that exemplify that behavior?

There is the test:win command that is specifically designed for windows.

Also, if you're using the CLi, you'll note that the parser is an objectParser not a moduleParser (unlike emailAdapter options). I suggest you open an issue first, with the proper error you encounter.


Some read-only git commands are triggering unnecessary refreshes

Run the following;
git ls-files --others --exclude-standard

And observe the following activity;
TRACE: watcher event "change" "/home/coder/___/.git/sharedindex.1b16556fb0a738b262418bb89e4a46bcd8b50371"
PID_252142 [stream] > git status -z -uno
TRACE: watcher event "change" "/home/coder/___/.git/sharedindex.1b16556fb0a738b262418bb89e4a46bcd8b50371"
PID_252180 [buffer] > git ls-files --others --exclude-standard
PID_252185 [buffer] > git for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track) refs/heads/aaa refs/remotes/aaa
PID_252185 [buffer] < "refs/heads/aaa\u0000origin/aaa\u000060bc52ec0cbad714fe374f5a09de453fd" (26 chars hidden)
PID_252186 [buffer] > git for-each-ref --sort -committerdate --format %(refname) %(objectname) %(*objectname)
PID_252186 [buffer] < "refs/heads/aaa 60bc52ec0cbad714fe374f5a09de453fdd29ca99 \nrefs/remotes/origin/bbb 652acfc021640357e5c470b1b" (2480784 chars hidden)
TRACE: watcher event "change" "/home/coder/___/.git/sharedindex.1b16556fb0a738b262418bb89e4a46bcd8b50371"
PID_252180 [buffer] < [ERR] "/nix/store/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)\n"
PID_252180 [buffer] < ""
PID_252225 [buffer] > git config --get commit.template
PID_252225 [buffer] < ""

git ls-files --others --exclude-standard is run by the extension itself but no cyclic refresh occurs due to builtin locking mechanisms (which may be timing sensitive as it appears sometimes cycles do occur).

Confirmed issue can trigger time-sensitive loops.


Compatibility with React Native 0.40

I upgraded RN to v0.40 and my project can't build anymore on iOS.
Would this be linked to the breaking changes of the version 0.40 ? https://github.com/facebook/react-native/releases/tag/v0.40.0
I precise that it worked well on RN v0.37.
However, it finds me 9 issues on the build in the RTCBackgroundGeolocation library.
Problem #1
/node_modules/react-native/React/Base/RCTBridge.h:65:1: Duplicate interface definition for class 'RCTBridge'
Problem #2
/node_modules/react-native/React/Base/RCTBridge.h:154:55: Property has a previous declaration
/node_modules/react-native/React/Base/RCTBridge.h:159:48: Property has a previous declaration
/node_modules/react-native/React/Base/RCTBridge.h:165:37: Property has a previous declaration
/node_modules/react-native/React/Base/RCTBridge.h:170:61: Property has a previous declaration
/node_modules/react-native/React/Base/RCTBridge.h:175:53: Property has a previous declaration
/node_modules/react-native/React/Base/RCTBridge.h:180:56: Property has a previous declaration
/node_modules/react-native/React/Base/RCTBridge.h:185:54: Property has a previous declaration
/node_modules/react-native/React/Base/RCTBridge.h:190:63: Property has a previous declaration

@Okipa I have put in a pull request to fix this https://github.com/mauron85/react-native-background-geolocation/pull/35
Until this is merged you can use my fork of the repo https://github.com/mitch104/react-native-background-geolocation

should be fixed in 0.2.0-alpha.6


delete branch

if branch to delete does not exist, is it possible to not failed ?

There is no such option for this Action, but you can make use of this: https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepscontinue-on-error

Ok thanks


Decompilers + brainfuck

Let's add brainfuck and machine code to the central connected component.

The data in this file is actually sourced from the mohd-akram/compilers repository. Please submit your change to the compilers.coffee file there, and the update should be imported here shortly afterwards.

Ok i'll maybe do that later, closing here anyway.


feat(junit): allow to forward port of local pods

Closes #1060

I think this would be good to have, escpecially since it creates the port forwards before the operator starts. What can already help with some error in logs.

Merging this PR because I need this to debug things locally. We can address the port issue at some later point.


More Efficient Ordering of Shard Upload Execution

Backport of https://github.com/elastic/elasticsearch/pull/42791
Precursor for further optimisations.
It also includes some additional cleanups and optimisations for restore snapshots as separate commits because they are depend on each other. It is easier to review this pr by commits one-by-one.
Summary of the changes / Why this improves CrateDB
Checklist

[x] Added an entry in CHANGES.txt for user facing changes
[x] Updated documentation & sql_features table for user facing changes
[x] Touched code is covered by tests
[x] CLA is signed
[x] This does not contain breaking changes, or if it does:

It is released within a major release
It is recorded in CHANGES.txt
It was marked as deprecated in an earlier release if possible
You've thought about the consequences and other components are adapted
(E.g. AdminUI)

The last commit 62f36eb looks like it is a partly backport of elastic/elasticsearch#36038. Why isn't it mentioned and why is it only applied partly? Looks a bit broken to me.

The motivation of this commit came from cleaning up the BlobStoreRepository. It is not based on elastic/elasticsearch#36038.


Dropdown does not capture event fully on mobile

The dropdown allows the touch event to pass through it to elements below
Reported by @Jokauppi

Related: https://github.com/shadcn-ui/ui/issues/486


analogRead

Hello, I would like to use analogRead to read out my Temperature Sensor (LM35) and integrate it into Homekit. Unfortunately, I could not find a way to use analogRead, so I'll ask here

sdk_system_adc_read()


Yeganeh: task_[249-252]_CosE_STARC

@yeganehkordi, wondering if you can help review this PR.

@mayank18garg, can you address reviewer comments so that I can evaluate?

@swarooprm I'm sorry, I'll address all the issues by end of the day, have classes. I hope that's fine!
Thanks!

@swarooprm I'm sorry, I'll address all the issues by end of the day, have classes. I hope that's fine!
Thanks!

Did you address @mayank18garg ? I need to evaluate soon.

I have made changes to all the comments by @yeganehkordi.
Thanks!

@yeganehkordi, check if you are happy or have any other feedback?

Sorry for the delay! Thanks for the updates! Some minor comments:
Task 249:

Change the source field to "CosE v1.0 (https://huggingface.co/datasets/cos_e)" in tasks 249, 250, and 252.
Replace multiple closet with multiple closets and one can find multiple closets in house. with one can find multiple closets in the house..

Task 250:

Replace At what place you use computer while gaining knowledge with At what place you use the computer while gaining knowledge and answer is \"happiness\" with the answer is \"happiness\"(add an article).
Replace christmas with Christmas.
Please change the category to "Text generation".
Please separate questions and answers in each instance with a <sep> token.

Task 251:

Each element in the output list should be a correct answer. In this task, if we want the users to generate three questions, all of them should be concatenated as one element of the list. I suggest changing the definition to the generate a question, in this case, you don't need to modify the instances. We can have many correct answers per instance.
Change the source to "STARC (https://arxiv.org/pdf/2004.14797.pdf)".
Replace You need to generate the three questions from passage with You need to generate three questions from the passage or You need to generate a question from the passage. (Based on your decision according to the first comment)
Replace All the question with All the questions in the explanations.
Replace the explanation of the first negative example with The first question is out of context and could not be answered clearly from the paragraph. While the second question is asking \" why Hannah's job is easy?\", but according to the paragraph her job becomes difficult..
Replace Second question with the Second question and out of context and  with out of context, and   in the explanation of the second negative example.

Task 252:

Change the definition to You're given a question, three answer options, and a sentence. Predict the correct answer based on the sentence. The sentence is the abstractive explanation based on Commonsense reasoning. (Some articles and punctuation have been modified).
Replace the first explanation with Question is \"In the morning you go to work, and in the evening what?\". The fact clearly states that \" when the day is over, then it's time to leave the work\." Hence, The answer would be leaving work which is the 2nd option among the three choices. (We need an article before "morning", "evening", and "three", also "would be leaving" seems to be correct here).
Change the explanation of the first negative example to: The fact tells us about camping and tent, and the question is where one can find the football. Among the choices, the most appropriate option would be sporting goods store. But since that's not based on the input sentence. Hence, it's not acceptable.
Change the second negative explanation to: The sentence tells us that students do revision and study of material they learned over the course before the exam. The question asked about what one could do before final exams. In the choices, one option is Study, and another option is revision. Both could be the answer, and there is ambiguity in selecting the choices.
Please drop the brackets around the choices.

@mayank18garg, can you address reviewer comments and revise your tasks?

I'm on it.

Thanks! Looks good to me!
Just one point, in task 251, although you don't need to modify the instances, the output of examples shouldn't be a list. So, please choose a single question for each example and update the explanations accordingly.

@yeganehkordi Thanks for the update!
So Do I need to remove the two questions from the instance's output?

Yes, it should be something like this:
{
"input": "",
"output": "Where does Clay Cockrell hold his popular therapy sessions?",
"explanation": " "
}

@yeganehkordi yeah got it, I'll update the positive & negative examples part. But I want to know about the instances. Each instance has three questions, is that format fine?

Yeah, the format of instances is fine.

Grading completed @mayank18garg


Pin Alpine version to 3.11.6

If you run the docker build . -t nice/hound, you will see the following information
OK: 12750 distinct packages available
  bzr (missing):
ERROR: unsatisfiable constraints:
    required by: world[bzr]
The command '/bin/sh -c apk update 	&& apk add go git subversion libc-dev mercurial bzr openssh 	&& go install github.com/hound-search/hound/cmds/houndd 	&& apk del go 	&& rm -f /var/cache/apk/* 	&& rm -rf /go/src /go/pkg' returned a non-zero code: 1

This is because bzr has become unmaintained due to its Python2 upstream: https://gitlab.alpinelinux.org/alpine/aports/-/tree/3.12-stable/unmaintained%2Fbzr
This PR pins the Alpine's version to 3.11.6 to avoid this issue. The latest is 3.12.
A minor improvement:
I also removed the redundant COPY because it won't be used at all. When the user runs the docker command, it always redirects the $(pwd) in the host system to /data volumn for houndd command.
One more question for the future:
Should we keep supporting Bazaar? I heard that it is almost dead. https://www.reddit.com/r/Ubuntu/comments/2ywrif/has_bazaar_been_deprecated/
If we keep supporting Bazaar, we should consider breezy as a successor of bzr.

I have one question, but I confirmed that the alpine upgrade works as expected locally.

Actually that's a downgrade in the perspective of Dockerfile itself 😄 . With the current Alpine (no version argument), it will automatically pick the latest Alpine image, which does not contain bzr any more.

Actually that's a downgrade in the perspective of Dockerfile itself
Yup! That makes total sense. That's what I get for reviewing PRs at 1am -_-

Thank you for this contribution! We're trying to get regular docker deploys going again, and this will certainly help.


Add Jexus

The Jexus is very awesome and it has been used in production, you can read more about it at https://jexus.codeplex.com and https://en.wikipedia.org/wiki/Jexus
cc @quozd @devkhan @vladen


docs: rephrase readme

What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
What is the current behaviour?
You can also link to an open issue here.
What is the new behaviour?
...
Does this PR introduce a breaking change?
What changes might users need to make in their application due to this PR?
Other information:
Please check if the PR fulfills these requirements:

[ ] Tests for the changes have been added
[ ] Docs have been added / updated
[ ] Relevant Changeset has been added

coverage: 100.0%. remained the same
when pulling 0ce226b5ab49c9e5ab6c23cd41fb021fc4142247 on rephrase-readme
into 18fe624573cec6f07720c1fe28128519d57fc104 on master.


Make latest the default tag

The images that we build are tagged with latest, not main.

Addresses #62

/lgtm


Increased text size of "Select the form to open" from 14sp to 21sp.

The header text for the form list in ODK Survey "Select the form to open" was quite small and hard to notice. I have increased its text size from 14 sp to 21 sp.
closes #1374

runtests

Thanks for the merge, @linl33  :)

#closes 1374


Cleanup: Remove unused code

This PR removes some of the unused/dead code from the project.
It delete:

src/astro/ml dir as they just use dataframe decorator currently. When in future we add additional functionalities, we can add those back
create_table_name, get_table_name & create_sql_engine & others functions were just unused

closes https://github.com/astro-projects/astro/issues/277

@kaxil it's looking great! Another strong candidate to be removed is: astro/src/__init__.py. This src shouldn't be a package.

@kaxil it's looking great! Another strong candidate to be removed is: astro/src/__init__.py. This src shouldn't be a package.

Oh yes, good callout


CCC: sidebar highlighting doesn't change with scrolling

The section that is highlighted in the sidebar does not change as you scroll. "get started" is always highlighted

closed via #403


Rollback travis build tools version

Wanted to keep android o but seems travis is not yet ready for it


Check for window.turbolinksHistory first and then use window.history if not exist

Corresponding Issue: #150

Thanks for the pull request. Can you please point me to a page demonstrating the problem this solves? I’m skeptical that Turbolinks and react-router will ever be compatible.

Also, let’s please avoid hostile or aggressive commit messages. Thanks.

I won't be able to include a link to a page, but I can post our relevant js:
var _ = require("lodash");
var ReactRouter = require("react-router");

var removeDomainAndProtocol = function(url) {
  return url.replace(/^.*\/\/[^\/]+/, "");
}

// API Adapter to handle turbolinks & react-router.
var turbolinksHistory = _.extend({}, ReactRouter.browserHistory);

turbolinksHistory.pushState = function(_turbolinks, _null, urls) {
  turbolinksHistory.push(removeDomainAndProtocol(urls.requestURL));
}
turbolinksHistory.replaceState = function(_turbolinks, _null, urls) {
  turbolinksHistory.replace(removeDomainAndProtocol(urls.requestURL));
}

module.exports = window.turbolinksHistory = turbolinksHistory;

// Router uses turbolinksHistory
var turbolinksHistory = require("./turbolinksHistory");
<Router history={turbolinksHistory}>
  {Routes}
</Router>

Bugs were discovered with the approach. We did get react-router and turbolinks functioning together though. For the record, future developer who has stumbled upon this, you have to unmount and then re-mount your react-router on every turbolinks navigation. You can not use react-router Link components, etc, nor can you use any react-router navigation functions.
You also must create a new history object on every page load, kind of like this:
// On every turbolinks:before-visit
var onTurbolinksPageVisit = function () {
  var createHistory = require("history").createHistory;
  // We have to create a new history every page navigation because of turbolinks.
  // You see, turbolinks makes calls to the window.history directly, and react-router
  // history has no way of knowing about it. If you don't create a new history object
  // every time, the history object in memory will contain cached data that makes
  // react-router believe that it is still on the previous page.
  var history = useRouterHistory(createHistory)({});
  var routerComponent = (
    <Router history={history}>
      {Routes}
    </Router>
  );
  // ... Handle the mounting of routerComponent
}


Car speed can be adjusted remotely

User story
As a user driving the car, I want to be able to adjust the speed of the car according to meditation level, so that I can control the speed on my own will.
Acceptable critera
The speed of the car shall be adjustable remotely, and the speed that the car can reach will change with meditation level from a percentage between 0-100.

This issue has been in "to do" in the project board for a while. What is the status of it?

We can just move the car when meditation value changes, but still work on on which way can make the car accelerate.


Gene (and others) Ontology

Comparing different networks
We already have the COB.compare_degree method to give us a gut check on whether or not two networks are different or not, but this does not give us a check on which network is "better". When we construct a network, there are a couple of key things that we always want to check to make sure that the network is "good", aka getting a bead on the functional information that either is or isn't in the network. Sure we can compare degrees,  but what does this really tell us in terms of things functionally? (what we ultimately care about)
Thank jibbers for gold standards
If there is functional information contained in a network, then we should see that reflected in the gold standard. We can use this as a gut check for whether or not making subtle changes in the network changes whatever functional information is encoded in it.
The goal
Whenever we build a network, one of the first things we should do is cross reference whether or not it captures gold standard functional information.
Tasks

Build ontology classes from Gene ontology OBO data and GO term assignments from maize sequence ftp site.

Add method to Ontology class which accepts a COB class and iterates through its terms, returning the appropriate COB.density measure for each term.

Add needed kwargs to make this generalizable, i.e. min and max sizes for term for inclusion in density measure (large gene sets load a large part of network and take a lot of resources)
Make reasonable choices for mapping term loci to COB.refgen loci

Add Ontology for MapMan terms see [this] paper(http://journals.plos.org/plosone/article?id=10.1371/journal.pone.0099193) for more info on MapMan gold standard and where to download it.

Once you have a solution for building GO Ontologies, we should use the the ontology you built to do a cross reference against a (any) network. You are right asking about building a 'separate' network from the ontology terms, but the way we do it is sort of round about.
You can think of an Ontology term as a sort of pre-built network, nodes are genes and edges are binary and represent whether or not two genes are within the same term (they are co-annotated) and this is done on a term by term basis (treating terms independently being a good idea is another question we might get into later...). So a set of three genes within a single Term are each fully connected to one another and not connected to anything else. The question is are these genes also strongly connected in the COB object?
We talked a bit on hangouts on whether we should approach this using the ontology term as an anchor or to use the COB term as an anchor, but now that I think about it, maybe we should just start a new class so we don't require either class to rely on the other.
Create a new class that is created from a COB object and an Ontology object. Then add a method that calculates concordance between the two objects by iterating over the class and calculating density for each term. We can add statistics after that, as I said before, the COB class has internal access to its RefGen which has a random_gene() method which you can use to quickly get density between a random set of genes the same size as the genes in the term.
Tasks

Create a new class that compares COBs and Ontologies
Add a method that calculates density and p-values between genes within terms.

Hey Joe,
I have some scripts in the bin dir which kind of outline this sort of "report" style class I have in my head. I don't really have all the details hammered out yet, hence why they are one off scripts and not classes.
You can decide what you think is best first pass, but I think am thinking something of an API that looks kind of like:
from camoco import Config as cf

class Report(Object):
    # I dont know if we want to inherit from Camoco or not
    # It does have convenience methods for temp files and the such

    def __init__(self,cob,ontology):
        pass

    ''' Private Methods '''
    def _generate(self):
        pass

    ''' Output methods '''
    def to_md(self):
        pass
    def to_pdf(self):
        pass
    def to_html(self):
        pass

Just thinking

So would this become more or less the primary command line interface with the camoco library?

Closing this due to recent pull requests. #13  and #14


[TF API] Make dataset generic and enable map test

Thanks to various deabstraction fixes, dataset APIs can finally be generic and have mutating methods!

Awesome, cheers!


Eclipse version incorrect

I'm experiencing an issue with the stand alone scripts. When I start it in Visual Studio, the following message pops up:
VMS.TPS.Common.Model.TpsNetInitializationException: The application Eclipse Client is running an incorrect version (16.1.3). The system is configured to run version 16.1.4 of this application family. It is not possible to start older versions of the application. Please contact Varian Customer Support to have this issue resolved. The application will now exit.
at VMS.TPS.Common.Model.ApplicationInitGuard.End()
at VMS.TPS.Common.Model.ApplicationInitGuard.InitializeApplicationImpl(Delegate initDelegate, Object[] args)
at VMS.TPS.Common.Model.ApplicationNonAppFrame.Initialize(IStartupParameters startupParameters, IApplicationContextInfo applicationContextInfo)
at VMS.TPS.Common.Model.API.Application.CreateApplicationCommon(String scriptName, Func`2 createExecutionGuardFunc)
Any suggestion will be appreciated.
Thank you.

Interesting, I have not seen this error before. I'm guessing your Eclipse version (and hence ESAPI version) are newer than the version the scripts were built in (16.1.3). Do you also get this error when running the plugin script?
A potential fix, open the standalone script solution in visual studio-->expand the references in the project in the solution explorer-->delete the two VMS.TPS references->right click on References->Add Reference->Add the VMS.TPS references installed LOCALLY on your computer (not the dlls provided with the code). These typically reside somewhere on the C: drive (something like C:\Program Files (x86)\Varian) The VMS.TPS dll files installed locally on your computer should be specific to your version of Aria/Eclipse.

Thank you very much for replying.
The plug in script works fine, this error only shows up in the stand alone script. Replacing the local dll files is the first thing I tried, but it doesn't help.

No problem. Interesting, does visual studio throw this error with any stand-alone application?
Ahh that would do it. You'll need to ask Varian to provide the appropriate dll files for your specific version of Eclipse.
Let me know if that fixes the issue

Yay!! No Problem!


[Code quality] Hardcoded strings

We should remove hardcoded strings in some classes e.g. MainActivity ;lines: 299 - 312
branch: new_version

Hi @danielblokus, sorry i didn't see you opened this already and I opened a new Issue for all the hardcoded resources. I fixed the titles of the tabs so they can be translated but many dimensions, colors and some strings are still hardcoded in the files.
Thank you for spotting this!


Static Variable Initializers don't support LINQ

In the case where:
public class Type {
    public String Name {get;set;}
    public Boolean IsPositive {get;set;}
    public static Type TypeA = new Type("A", false);
    public static Type TypeB = new Type("B");
    ...
    ...
    // Works
    public static readonly Type[] AllTypes = {
        TypeA,
        TypeB,
        ...
    };

    // Does not work -> Throws Build ERROR
    public static readonly Type[] PositiveTypes = AllTypes.Where(type=>type.IsPositive).ToArray();
}

A workaround at the moment is to use
public class Type {
    ...
    ...
    private static Type[] _positiveTypes;
    public static Type[] PositiveTypes
    {
        get
        {
            return _positiveTypes ??
                (_positiveTypes = AllTypes.Where(type=>type.IsPositive).ToArray());
        }
    }
    ...
    ...
}

Hello Battosai! :)
Thank you for sharing your problem with Bridge.NET. We'll try our best to help you!
For the sample you provided I couldn't make your last line work on an ordinary C# program as well.
I've created a plain C# ClassLibrary and pasted your class, completing with the needed constructor, so that I have this code on the file:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace ClassLibrary3
{
    public class Class1
    {
    }

    public class Type
    {
        public String Name { get; set; }
        public Boolean IsPositive { get; set; }
        public static Type TypeA = new Type("A", false);
        public static Type TypeB = new Type("B");

        public Type(String character, Boolean trueState = true)
        {
            Name = character;
            IsPositive = trueState;
        }

        // Works
        public static readonly Type[] AllTypes = {
            TypeA,
            TypeB
        };

        // Does not work -> Throws Build ERROR
        public static readonly Type[] PositiveTypes = AllTypes.Where(type => type.IsPositive);
    }
}

What I get (even before trying to build) is in the screenshot below:

Again, this is in an ordinary C# program, not Bridge. This result suggests this construct is not supported by linq at all.

.ToArray() at the end.

Alright, I didn't notice the change.

Alright, I have confidence that this issue is now fixed on our git repository. The fix will go live in version 1.5. Thanks again for reporting it!


Add Bounty Hunter exemption

Add Claw Shot City quest type
Add bounty hunter reject test case
Add stage exemption for Bounty Hunter catch

Straightforward. If Bounty Hunter is caught without a map and causes a stage transition: allow it.
By commit:
Wrote quest type first.
Next, a test to assure rejection.
Then wrote the exemption so the test needed to changed to accept it.


Removed 'round' block for Edison.

The 'round' block in the math category of Edison has been removed.
This is a fix for #550

Merged with ab5b12503a69258e67947a05c44c2d9448a3da63.


Add permalinks for announcements

Issue Reference
This PR addresses the Issue : Fixes #1017
Summarize
Add permalinks for announcements
Sample URL : https://keralarescue.in/announcements/2 https://keralarescue.in/announcements/4

Why not a separate view file like announcement-view.html or announcements/view.html ?

@sreenadh Because it's easier to manage the announcemen cardt view in one page itself.
There's an additional proposal to add sharing buttons too.

Share buttons can be put in separate view file and include both in both views. In future we might need more feature separately for view and announcements then announcements.html will get bloated with if else conditions.

@sreenadh you're right. This was just a quick hack. In case there is more differences between the two, it should be separated.

fix the conflicts please

@tomahawk-pilot done


[Haxe][CodeGenerator] Improvements for code generator, fixed runtime error. fixes #1743

#1743

Will check this one soon.

I fail to see the benefit of those var text = Sci.GetLine(line); declarations. I don't think it makes the code more readable or clear and although the existing code makes getting the current line for cases where it's not needed, this change makes getting the line more than once on some exceptional cases (the second and third text cases don't always return and they can happen at the same time from what I tested).
So if this is some attempt to optimize I'm not sure it's good, plus there are also several other Sci.GetLine( and some Sci.CurrentLine and all those ones would be the same as text and line from what I see?
Also, would be nice to cover this with some tests.
Anyway, if @Meychi decides so this can be merged.

@Neverbirth I think that most of the code of this method will be refactoed in the near future

If the code is going to be refactored then tests would be even more helpful to catch possible errors during the work, but this would require tons of tests that should be already there and not just the ones here.

I'm working on tests at the moment.


Kerning resolution

Matches Glyphs for kerning resolution.
Part of https://github.com/googlei18n/glyphsLib/issues/24, https://github.com/googlei18n/fontmake/issues/83

Thanks!


Precise draw order control

Implement proper layer system.

Any ETA on that feature? xD

No ETA yet, but the dev team discussed the need for 3 new engine features after completing a recent project. This was one of them, so it's bubbling closer to the top of the priority list.

See Layers


Finance.js IRR function problem.

Hi, Essam.
I am Jacky from Taiwan.
Few day ago, my friend has a project use Finance.js, IRR function.
But, function was not enough precision than Excel IRR function.
So, my friend ask for my help
I look your program, and find 2 issues.

dynamic guess variable isn't exist, and decimal is not enough.
recursive call will happen stack error.

First, i tell to my friend to modify your program at some const variable.
That will fix issues 1, but at same time it will happen issues 2.
Because i use more decimal and more precision guess, it mean time complexity will grow, in recursive call it also mean more stack.
So, i write a do-while version to calculate, but performance still limit by browser.
Then, i write a burst-guess to speed-up, when VPN too huge.
e.g : Math.log(VPN).
My code is over here.
https://github.com/eastmoon/Tutorial-JavaScript/blob/master/Issues-FinanceIRR/Index.html
Hope it would be helpful for you

@eastmoon Tested your linked code. looks like it is still not correct.

@jasonfungsing What's wrong has happened ?
Could you give me data and result ?
It will help me know how to fix it.


write IPFS CIDs of outputs into io.json - relative paths to a IPFS directory are sufficient for now

### Tasks
- [ ] include additional metadata of the bacalhau run to the stdout and stderr - could be "metadata.txt"

Being addressed by https://github.com/labdao/plex/issues/216


Update intro.md by changing phrase "scaling up" to "scaling out".

Scaling up refers to increasing the hardware resources for a single system. This is obviously possible for any app design. I think it should say scale out i.e. scaling to more instances.

I concur. @2start maybe you should rework the PR title to make it more meaningful.

Just saw this this is still open and changed the PR title as well as making the description a little bit more clear.


Radix breaks type validation in our project with Cannot find name 'ResizeObserverEntry'

Bug report
Current Behavior
When I run type validation (tsc --noEmit) in a project where I'm using the Radix checkbox, the following error is thrown:
node_modules/@radix-ui/utils/dist/index.d.ts:16:60 - error TS2304: Cannot find name 'ResizeObserverEntry'.

16 export function getResizeObserverEntryBorderBoxSize(entry: ResizeObserverEntry): ResizeObserverSize;
                                                              ~~~~~~~~~~~~~~~~~~~

node_modules/@radix-ui/utils/dist/index.d.ts:16:82 - error TS2304: Cannot find name 'ResizeObserverSize'.

16 export function getResizeObserverEntryBorderBoxSize(entry: ResizeObserverEntry): ResizeObserverSize;
                                                                                ~~~~~~~~~~~~~~~~~~

Expected behavior
No error to be thrown.
Reproducible example
You can run yarn validate:types in the main branch of this project: https://github.com/Atom-Learning/components
Suggested solution
I am no TypeScript expert, so maybe this isn't the issue at all, but the only place I can see ResizeObserverEntry in the source code is in the file where the error is being thrown. I can't see it being defined anywhere. Maybe it's defined globally in some related package but an import of the type has been removed along the way?
Additional context
N/A
Your environment

Software
Name(s)
Version

Radix Package(s)
@radix-ui/react-checkbox
0.0.4

@radix-ui/react-icons
1.0.1

React
n/a
17.0.1

Browser
n/a
n/a

Assistive tech
n/a
n/a

Node
n/a
14.4.0

npm/yarn
yarn
1.22.5

Operating System
macOS BigSur
11.1

Thanks in advance for any help, and for the great library!

This problem was solved by adding /// <reference types="resize-observer-browser" /> to our global.d.ts. This feels like a workaround, though — presumably we should be getting the type with the Radix component, if it's required?

Yes, we have the same thing internally, it seems we need to somehow bundle these types in our types but we haven't yet figured out how to do that.


VS Code theme style is added to text copied to the clipboard as rich text instead of plain text.

Issue Type: Bug

Copy text, paste into Word or GMail or any other rich-text editor.
Result: White on Black text in the font of VS Code's interface. (Or whatever the current theme is)

Expected: plain text pasted only.
Also opened before by @alex-jitbit
https://github.com/Microsoft/vscode/issues/63154
Reported as a "feature" that can be turned off by @rebornix, and indeed it can be turned off with "Editor: Copy With Syntax Highlighting"
HOWEVER, I believe that this should NOT be default behavior, and at the least believe that the "text background" should NOT be copied along with it, and the un-highlighted text be turned to black when copied as rich-text in the clipboard.
Platform: Windows
VS Code version: Code 1.30.2 (61122f88f0bf01e2ac16bdb9e1bc4571755f5bd8, 2019-01-07T22:54:13.295Z)
OS version: Windows_NT x64 10.0.17134

System Info

Item
Value

CPUs
Intel(R) Core(TM) i7-6650U CPU @ 2.20GHz (4 x 2208)

GPU Status
2d_canvas: enabledchecker_imaging: disabled_offflash_3d: enabledflash_stage3d: enabledflash_stage3d_baseline: enabledgpu_compositing: enabledmultiple_raster_threads: enabled_onnative_gpu_memory_buffers: disabled_softwarerasterization: enabledvideo_decode: enabledvideo_encode: enabledwebgl: enabledwebgl2: enabled

Memory (System)
15.93GB (6.61GB free)

Process Argv

Screen Reader
no

VM
0%

Extensions (1)

Extension
Author (truncated)
Version

vscode-autohotkey
sle
0.2.2

Most programs copy and paste rich text where possible, and some of the nice ones (Chrome, Office) offer a paste-as-plain-text functionality on the assumption that what's in the clipboard has both rich and non-rich versions. I think the current setting is a sensible default.

You can turn this feature off by editor.copyWithSyntaxHighlighting.

Most programs copy and paste rich text where possible, and some of the nice ones (Chrome, Office) offer a paste-as-plain-text functionality on the assumption that what's in the clipboard has both rich and non-rich versions. I think the current setting is a sensible default.

Most programs are not code editors.
I can think of many reasons how this "feature" is a bug, but no reasons why this is useful.
VS Code Version: 1.38.1
OS: MacOS 10.14.6

Take a look at:

#3518

"Copy with syntax highlighting" got hundreds of thumbs up in 2016. (That issue was locked in 2017.)
But your "Copy as plain text" only gets three now. (It's three years since 2019.)
Which side wins? "Copy with syntax highlighting" should be the default. Indeed, VS Code writes both plain text and HTML into clipboard, and it's the target application that decides which format to paste. (https://github.com/microsoft/vscode/issues/57577#issuecomment-421397605)

@Lemmingh thumbs-driven development, huh...
I guess most people who don't need the black background when pasting stuff to Gmail, are not familiar with github and issue-trackers.

One more point: this is not the default behavior in the "full" Visual Studio (non-code). The behavior should be consistent across products.

what are some things we could do to make this more visible, aside from tweeting about it?

As far as I'm aware, this issue is eventually about the default value of the editor.copyWithSyntaxHighlighting setting (#54155), and can become an argument about preference.

thumbs-driven development

Let the data speak. This is reasonable under limited resource constraints. VS Code's wiki also conveys such idea.
Given that VS Code can even encourage users to join GitHub, I think the thumbs here should be sufficient.
I searched for similar issues. It appears roughly 100 for false and 200 for true, so the default value should still be true (With syntax highlighting).

The default behavior of copying the entire display theme as-is, including the background seems inappropriate when copying code for even on-screen consumption that have the opposite light (or dark) background

This has been discussed many times:

https://github.com/microsoft/vscode/issues/3518#issuecomment-280731653
https://github.com/microsoft/vscode/issues/20837#issuecomment-281456616

Well, let's take a glance at how clipboard transfers data again.
A clipboard can hold multiple objects of different formats (called "MIME type" on web platforms). When writing to the clipboard (copy), an application is expected to put the data in many possible types. When reading from the clipboard (paste), an application selects the one it prefers.
When copying in VS Code, a few objects are written into the clipboard, usually plain text (text/plain) and custom metadata (vscode-editor-data). HTML (text/html) is also appended when "Copy With Syntax Highlighting" is enabled or requested.

Here are a few guidelines about interacting with the clipboard.
Microsoft (Win32):

A window can place more than one clipboard object on the clipboard, each representing the same information in a different clipboard format. When placing information on the clipboard, the window should provide data in as many formats as possible.

Microsoft (Xamarin.Mac):

To maximize the potential for sharing, the pasteboard can hold multiple representations of a given item (using a standard set of common data types), this allow the consuming app to pick the version that is best suited for its needs.

Apple (UIKit):

You can provide flexibility for data sharing by providing multiple representation types for a pasteboard item during a Copy or Cut operation. Various contexts within your app or other apps can then make use of an appropriate representation type.

Apple (AppKit):

You can create one or more pasteboard items, set data or data providers for types, and write to them pasteboard.
You can retrieve pasteboard items from the pasteboard then read the data for types you’re interested in.

the "full" Visual Studio

I'm afraid this is a misnomer. Visual Studio and Visual Studio Code are totally different products, just like Java and JavaScript are totally different languages. I'd suggest avoiding expressions like "full / slim Visual Studio".

Here are Visual Studio's options.

in Microsoft Word, it's an extra menu step to select Keep Text Only

You can change the default in Options > Advanced.

@Lemmingh

Visual Studio and Visual Studio Code are totally different products, just like Java and JavaScript are totally different languages. I'd suggest avoiding expressions like "full / slim Visual Studio".

"Java and JavaScript" is a fine example of poor naming and a branding disaster.
Just like "Visual Studio and Visual Studio Code". So yeah, most people call it "full" Visual Studio. MS is getting what it deserves.


Allow full text search

Skribe won't be especially useful if you can't search documents by their content. Need to at least provide integrations with Elasticsearch. Might integrate with more if necessary

Closing this in favor of #31 and #32


Updated Quick Start Guide with correct URL in sample code and docs

PR has important changes in the quick start guide, the URL for the server was obsolete and docs were missing information on how to find one's sub-domain information. I've updated both of those in this code change.

@CoCraig done, btw curious why don't we have Java code snippets in our docs?

@CoCraig done, btw curious why don't we have Java code snippets in our docs?

No one with the Java background to build it.  Do you have the ability to code Java? If so, it'd be great if you could build it.


Assigning topic crashes the editor

When I add a gambit to a newly created topic, it crashes the node and give me the following error. I could reproduce the same multiple types.
/Users/siddharthgupta/git/superscript-editor/node_modules/superscript/lib/topics/sort.js:108
        var kind_sorted = Object.keys(track[ip][kind]).sort(function(a,b) { re
                                               ^
TypeError: Cannot read property 'qtype' of undefined
    at Object.exports.sortTriggerSet (/Users/siddharthgupta/git/superscript-editor/node_modules/superscript/lib/topics/sort.js:108:48)
    at /Users/siddharthgupta/git/superscript-editor/node_modules/superscript/lib/topics/topic.js:70:26
    at /Users/siddharthgupta/git/superscript-editor/node_modules/superscript/node_modules/async/lib/async.js:240:13
    at async.each (/Users/siddharthgupta/git/superscript-editor/node_modules/superscript/node_modules/async/lib/async.js:114:20)
    at _asyncMap (/Users/siddharthgupta/git/superscript-editor/node_modules/superscript/node_modules/async/lib/async.js:234:9)
    at Object.map (/Users/siddharthgupta/git/superscript-editor/node_modules/superscript/node_modules/async/lib/async.js:212:23)
    at model.topicSchema.methods.sortGambits (/Users/siddharthgupta/git/superscript-editor/node_modules/superscript/lib/topics/topic.js:69:11)
    at Immediate.<anonymous> (/Users/siddharthgupta/git/superscript-editor/controllers/gambits.js:140:25)
    at Immediate._onImmediate (/Users/siddharthgupta/git/superscript-editor/node_modules/mongoose/node_modules/mquery/lib/utils.js:137:16)
    at processImmediate [as _immediateCallback] (timers.js:367:17)

Im having a hard time reproducing this. I can see the problem is related to sorting gambits within a topic, are you sorting them by dragging and dropping them or clicking the sort button.
Are you adding the gambit though the normal form or the chat / quick add form?

Editor crashing when sorting happened to me previously, too, but only after
deleting some gambits in the topic.

I am adding this gambit through the home page of the editor, that just happens once I add a new gambit to a newly created topic, anything I should try to fix this thing?

Did you delete ANY gambit? 2. In case you did, try clearing the whole database, and try to create a new
gambit or more, then see if the above problem still happens.

On Sat, Jul 18, 2015 at 6:06 AM, silentrob/superscript-editor
<EMAIL_ADDRESS>wrote:
I am adding this gambit through the home page of the editor, that just happens
once I add a new gambit to a newly created topic, anything I should try to fix
this thing?
—
Reply to this email directly or view it on GitHub
[https://github.com/silentrob/superscript-editor/issues/29#issuecomment-122480321] .[https://github.com/notifications/beacon/AA07PSCit0eSckkaocCaXu3H6skZpzKnks5oechRgaJpZM4FaqRw.gif]


Update DNS entry to reflect new naming scheme

🗣 Description
Add CNAME entry for the Software Attestation team to point to new Landing Zone ALB.
💭 Motivation and context

Due to an External Affairs requirement, the original name can not be used.  This updates both the CNAME record and the target.
🧪 Testing

DNS resolution will be verified after the record is created.

✅ Pre-approval checklist

[X] This PR has an informative and human-readable title.
[X] Changes are limited to a single goal - eschew scope creep!
[x] All relevant type-of-change labels have been added.
[X] I have read the CONTRIBUTING document.
[X] These code changes follow cisagov code standards.
[x] All relevant repo and/or project documentation has been updated
to reflect the changes in this PR.
[x] All new and existing tests pass.

To test this, I applied it and it looks good to me.  @jmorrowomni can you please confirm?  Once you do, I will merge this PR.

To test this, I applied it and it looks good to me. @jmorrowomni can you please confirm? Once you do, I will merge this PR.

Looks good!


Fixes #104: Case sensitivity was off by default

This hardcodes case sensitivity and fixes #104 for git tfs clone - however, it may be good to allow other git tfs commands to be configurable with respect to case sensitivity in the future for better usability for some circumstances.

I'm willing to give this a try.

Sorry it was hardcoded, it's been working great for me since though. I didn't know enough about the git-tfs code to extend a configuration parameter - but I'm not sure people would want it off anyways.


Extra error handling in savehar.py to reduce impact from "EOFError: Compressed file ended before the end-of-stream marker was reached"

Problem Description
I am running a mitmdump  with the hardump option set. These are 2 hour-long web sessions, and at the very end of a hardump run with when exporting the HAR file (when typing CTRL+C) I sporadically get an error. This error (EOFError when decoding b'\x1f\x8b with 'gzip') prevents any HAR data from being written to disk. You can see the full error message at the bottom of this issue.
My suspicion is that the error is caused by a server connection still being open at the time that I press CTRL+C on the teminal with mitmdump, so that's why the gzip stream is not "wrapped up" properly.
Proposal
I recommend adding extra error handling "try - except" block to the "save_har" function in the core savehar.py module. This will prevent the HAR export from totally failing, and will only fail to save the 1 problematic URL in the session. I also recommend that the error should call out the URL that caused the gzip issue, it gives users a chance to change things/troubleshoot intelligently.
Alternatives
I'm on Windows and not confident in modifying mitmproxy, so I rolled my own version of savehar.py as an addon that I include with the  "-s" option to mitmdump. It solves the issue. I'm importing the "traceback" module and adding an extra "try-except" block to "make_har" like this:
 def make_har(self, flows: Sequence[flow.Flow]) -> dict:
        entries = []
        skipped = 0
        # A list of server seen till now is maintained so we can avoid
        # using 'connect' time for entries that use an existing connection.
        servers_seen: set[Server] = set()

        for f in flows:
            if isinstance(f, http.HTTPFlow):
                try:
                    entries.append(self.flow_entry(f, servers_seen))
                except Exception as e:
                    e.add_note(
                        "Error saving compressed stream. The problem url is: {}".format(
                            f.request.pretty_url
                            )
                    )
                    print(traceback.format_exc())

            else:
                skipped += 1

Additional context
--- start of error message ---
[16:32:44.523] Addon error: EOFError when decoding b'\x1f\x8b with 'gzip': EOFError('Compressed file ended before the end-of-stream marker was reached')
Traceback (most recent call last):
  File "C:\Users\Jacob\AppData\Roaming\Python\Python310\site-packages\mitmproxy\net\encoding.py", line 62, in decode
    decoded = custom_decode[encoding](encoded)
  File "C:\Users\Jacob\AppData\Roaming\Python\Python310\site-packages\mitmproxy\net\encoding.py", line 151, in decode_gzip
    return gfile.read()
  File "C:\Program Files\Python310\lib\gzip.py", line 301, in read
    return self._buffer.read(size)
  File "C:\Program Files\Python310\lib\_compression.py", line 118, in readall
    while data := self.read(sys.maxsize):
  File "C:\Program Files\Python310\lib\gzip.py", line 507, in read
    raise EOFError("Compressed file ended before the "
EOFError: Compressed file ended before the end-of-stream marker was reached

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\Jacob\AppData\Roaming\Python\Python310\site-packages\mitmproxy\addons\savehar.py", line 128, in done
    self.export_har(self.flows, ctx.options.hardump)
  File "C:\Users\Jacob\AppData\Roaming\Python\Python310\site-packages\mitmproxy\command.py", line 322, in wrapper
    return function(*args, **kwargs)
  File "C:\Users\Jacob\AppData\Roaming\Python\Python310\site-packages\mitmproxy\addons\savehar.py", line 39, in export_har
    har = json.dumps(self.make_har(flows), indent=4).encode()
  File "C:\Users\Jacob\AppData\Roaming\Python\Python310\site-packages\mitmproxy\addons\savehar.py", line 58, in make_har
    entries.append(self.flow_entry(f, servers_seen))
  File "C:\Users\Jacob\AppData\Roaming\Python\Python310\site-packages\mitmproxy\addons\savehar.py", line 185, in flow_entry
    len(flow.response.content) if flow.response.content else 0
  File "C:\Users\Jacob\AppData\Roaming\Python\Python310\site-packages\mitmproxy\http.py", line 337, in content
    return self.get_content()
  File "C:\Users\Jacob\AppData\Roaming\Python\Python310\site-packages\mitmproxy\http.py", line 393, in get_content
    content = encoding.decode(self.raw_content, ce)
  File "C:\Users\Jacob\AppData\Roaming\Python\Python310\site-packages\mitmproxy\net\encoding.py", line 71, in decode
    raise ValueError(
ValueError: EOFError when decoding b'\x1f\x8b with 'gzip': EOFError('Compressed file ended before the end-of-stream marker was reached')
--- end of error message ---

Here is an example URL where this error occurs:
https://voila.ca/products?sortBy=nameAscending&sublocationId=d54cf92c-52f4-4321-8fff-66285455932d

Thank you for the detailed report, @raccoonix! 🍰
The root cause here is that we unconditionally access .content in the hardump addon, but .content may raise if servers send us malformed stuff. So we should

Add a test with an invalid gzipped response body and verify that it fails.
Fix the savehar addon to handle these cases gracefully. No particular opinion on how other than that we shouldn't just discard these flows.
Make sure test passes now. :)

If the server is sending unexpected data (e.g. uncompressed data when gzip is set), does mitmproxy mark this as an error?
We probably should revert to raw body (whatever the server sent us) if decoding fails.

I would like to assign this issue I am still able to reproduce and will fix it soon.

If the server is sending unexpected data (e.g. uncompressed data when gzip is set), does mitmproxy mark this as an error?

It does and switches to raw view in contentviews(ui) functionality but not in savehar addon.


Fix the wrong position of WebView View in a different way. #110450

Fix the wrong position of WebView View by passing the offset to layoutWebviewOverElement. This PR fixes #110450 in a different way from #112426.
The magic number 79 is the sum of the title bar's height + the div.composite.title 's height + the pane-header 's height.
https://github.com/tamuratak/vscode/blob/79e9f33cd64f7e5a41957a6c1a9c42fc940831bd/src/vs/workbench/contrib/webview/browser/dynamicWebviewEditorOverlay.ts#L128

Adding some other people for feedback on the view changes
One way webview views can be shown in the wrong position is when the list of views becomes too long. When this happens, we try to make the list of views scrollable. However webview views need to exist outside of the normal editor dom so they are not scrolled along with the rest of the views and instead remain in a static position
I don't think this PR addresses that yet but I think we should look into it as well

@tamuratak the magic number solution won't work across platforms. Windows by default has a specified titlebar height, while macOS 10 has another, and macOS 11 has another. Linux has none by default. The solution should figure this out programmatically if possible. @mjbvz do you have access to the layoutService where that can be passed?

@sbatten We don't use the layout service today but I believe we could. Currently layout is handled by:

Calls to layoutBody
A resize observer that is registered on the view container


Add Release Link for check

Summary
When checking, and if a dependency can be updated, add a link to stdout to the release notes.
Should be relatively easy as the logic that gets the latest version uses a URL to their releases, for example: github.com/.../releases/latest - it should just be a matter of saving this url and adding it to the module object as a releaseURL property or something. Then log these out.
It might require some formatting to make the output look clean, for example:
Now:
...
fs can be updated from [version] to [version]
...

Adding formatting:
...

- fs
  Can be updated from [version] to [version]
  [release link]
...

Acceptance Criteria

[ ] Add a release link to each module that should be displayed on check
[ ] Update/fix tests
[ ] Update README (if needed)

Pseudo-code for Implementation
// src/interfaces/module.ts

// Add: latestReleaseLink?: string|boolean

// src/services/module_service.ts

// Inside the for loop for `constructModulesDataFromDeps`:
const latestReleaseLink = importedVersion !== latestRelease ?
    gitHubUrl + "/releases/latest"
    :
    false

...

modules.push({
    ...
    latestReleaseLink
})

// src/commands/check.ts
modules.forEach((module) => {
    if (module.importedVersion !== module.latestRelease) {
      depsCanBeUpdated = true;
      listOfModuleNamesToBeUpdated.push(module.name);
      console.info(
        colours.yellow(
+         "- " + module.name + "\n" +
+        "    Can be updated from " + module.importedVersion + " to " + module.latestRelease + "\n" +
+        "    " + module.latestReleaseLink
        ),
      );
    }
  });

Taking on this issue? Read this before you get started.
If you take on this issue and the acceptance criteria does not make sense, post comments on this issue with your questions. Also, you can always hop in the Discord channel at https://discord.gg/c5R3sYuR to get help quickly.
Please read the Contributing Guidelines before starting this issue.

I like this convenience

closing because this wil be removed in #117


Document usage of files and supported artifacts that are part of SeLion-Grid

This issue focusses on documenting the steps to host the SeLion-grid on different platform.
Provide meaningful description of the usage of files.

@sundaramrajendran had already provided documentation for the SeLion stand alone jar.
@mach6 What needs to addressed here w.r.t to "Document usage of files"?


Added presumed missing #defines for Brewie model

I admit, this one is a bit trivial, but without it the ifndef seems out of place. You may also want to to check if the respective variable for the other model was defined to bail out with an error.

Yeah, I started trying to make it B20 compatible, but realized so much more needs to change to make it work. I'll let this go through, but much more needs to be done to make the process of changing versions better.


ERROR:superset.sql_lab:Query 14: <class 'UnicodeDecodeError'>

A clear and concise description of what the bug is.
Expected results
show content correctly in preview tab under SQL lab
Actual results
clickhouse error: 'utf-8' codec can't decode byte 0xcc in position 69: invalid continuation byte
Screenshots
If applicable, add screenshots to help explain your problem.
How to reproduce the bug

add a SQLAlchemy URI of clickhouse in databases list with format mentioned in document 'clickhouse://default@XXXXXXXX:8124/tutorial'
2.choose a table with utf-8 character
Preview tab show error 'clickhouse error: 'utf-8' codec can't decode byte 0xcc in position 69: invalid continuation byte'

Environment
(please complete the following information):
deploy with docker

superset version: 0.37.2
python version: 3.7.9
node.js version: v4.2.6

Checklist
Make sure to follow these steps before submitting your issue - thank you!

[x] I have checked the superset logs for python stacktraces and included it here as text if there are any.
[x] I have reproduced the issue with at least the latest released version of superset.
[x] I have checked the issue tracker for the same issue and I haven't found one similar.

Additional context
Add any other context about the problem here.
Log in container
Triggering query_id: 17
INFO:superset.views.core:Triggering query_id: 17
timeout can't be used in the current context
WARNING:superset.utils.core:timeout can't be used in the current context
signal only works in main thread
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/superset/utils/core.py", line 624, in enter
signal.signal(signal.SIGALRM, self.handle_timeout)
File "/usr/local/lib/python3.6/signal.py", line 47, in signal
handler = _signal.signal(_enum_to_int(signalnum), _enum_to_int(handler))
ValueError: signal only works in main thread
ERROR:superset.utils.core:signal only works in main thread
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/superset/utils/core.py", line 624, in enter
signal.signal(signal.SIGALRM, self.handle_timeout)
File "/usr/local/lib/python3.6/signal.py", line 47, in signal
handler = _signal.signal(_enum_to_int(signalnum), _enum_to_int(handler))
ValueError: signal only works in main thread
SQLite Database support for metadata databases will be removed             in a future version of Superset.
WARNING:superset.sql_lab:SQLite Database support for metadata databases will be removed             in a future version of Superset.
Query 17: Executing 1 statement(s)
INFO:superset.sql_lab:Query 17: Executing 1 statement(s)
Query 17: Set query to 'running'
INFO:superset.sql_lab:Query 17: Set query to 'running'
DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): <IP_ADDRESS>:8124
DEBUG:urllib3.connectionpool:http://<IP_ADDRESS>:8124 "POST /?user=default HTTP/1.1" 200 None
DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): <IP_ADDRESS>:8124
DEBUG:urllib3.connectionpool:http://<IP_ADDRESS>:8124 "POST /?database=tutorial&user=default HTTP/1.1" 200 None
DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): <IP_ADDRESS>:8124
DEBUG:urllib3.connectionpool:http://<IP_ADDRESS>:8124 "POST /?database=tutorial&user=default HTTP/1.1" 200 None
Query 17: Running statement 1 out of 1
INFO:superset.sql_lab:Query 17: Running statement 1 out of 1
DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): <IP_ADDRESS>:8124
DEBUG:urllib3.connectionpool:http://<IP_ADDRESS>:8124 "POST /?query_id=47f0c45e-2e2a-11eb-a7a5-0242ac110002&database=tutorial&user=default HTTP/1.1" 200 None
Query 17: <class 'UnicodeDecodeError'>
ERROR:superset.sql_lab:Query 17: <class 'UnicodeDecodeError'>

Which clickhouse dialect do you use
On Tue, Nov 24, 2020 at 3:54 PM issue-label-bot[bot] <
<EMAIL_ADDRESS>wrote:

Issue-Label Bot is automatically applying the label #bug to this issue,
with a confidence of 0.81. Please mark this comment with 👍 or 👎 to give
our bot feedback!
Links: app homepage https://github.com/marketplace/issue-label-bot,
dashboard https://mlbot.net/data/apache/incubator-superset and code
https://github.com/hamelsmu/MLapp for this bot.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/apache/incubator-superset/issues/11796#issuecomment-732721884,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAPMKUTYLYXG27GBFUJUDNTSRNRDZANCNFSM4UAQSFEA
.

Which clickhouse dialect do you use
…
On Tue, Nov 24, 2020 at 3:54 PM issue-label-bot[bot] < @.***> wrote: Issue-Label Bot is automatically applying the label #bug to this issue, with a confidence of 0.81. Please mark this comment with 👍 or 👎 to give our bot feedback! Links: app homepage https://github.com/marketplace/issue-label-bot, dashboard https://mlbot.net/data/apache/incubator-superset and code https://github.com/hamelsmu/MLapp for this bot. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#11796 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAPMKUTYLYXG27GBFUJUDNTSRNRDZANCNFSM4UAQSFEA .

sqlalchemy-clickhouse

@yahwang  try setting engine_params to UTF-8
DATA -> DATABASES -> select clickhouse instance. editing Extra
{
    "metadata_params": {},
    "engine_params": {"encoding": "UTF-8"},
    "metadata_cache_timeout": {},
    "schemas_allowed_for_csv_upload": []
}

create_engine('clickhouse://default:@localhost/test', encoding='utf-8', echo=True)

@yahwang try setting engine_params to UTF-8
DATA -> DATABASES -> select clickhouse instance. editing Extra
{
    "metadata_params": {},
    "engine_params": {"encoding": "UTF-8"},
    "metadata_cache_timeout": {},
    "schemas_allowed_for_csv_upload": []
}

not work, nothing changed

Try to use this script in the same environment to check whether if you can display UTF-8 table name
from sqlalchemy import create_engine, inspect

engine = create_engine("clickhouse://<DBURI>")
inspector = inspect(engine)
inspector.get_table_names()

Try to use this script in the same environment to check whether if you can display UTF-8 table name
from sqlalchemy import create_engine, inspect

engine = create_engine("clickhouse://<DBURI>")
inspector = inspect(engine)
inspector.get_table_names()

from sqlalchemy import create_engine, inspect
engine = create_engine("clickhouse://default@<IP_ADDRESS>:8124/tutorial")
inspector = inspect(engine)
inspector.get_table_names()
['hits_v1', 'hits_v1_nre', 'visits_v1']

@yahwang
which table contains UTF-8 column? fetch the columns by the SQLAlchemy inspector. Is it raise an exception?
inspector.get_columns('<TABLE NAME>')


Permissions issue setting up OneFuzz on Azure

I'm working on setting up OneFuzz on my company's Azure subscription and I'm facing permissions issue with the deployment script. I have satisfied all the prerequisites needed before running the deployment script
The Getting Started guide currently doesn't capture all the permissions needed to deploy OneFuzz. According to this PR discussion, AppRoleAssignment.ReadWrite.All permission is required to deploy OneFuzz. My deployment script currently fails with the error, Insufficient privileges to complete the operation, at the Application Registration step. Here's the stack trace of the error:
INFO:deploy:checking if RBAC already exists
INFO:deploy:creating Application registration
Traceback (most recent call last):
  File ".\deploy.py", line 1049, in <module>
    main()
  File ".\deploy.py", line 1043, in main
    state[1](client)
  File ".\deploy.py", line 320, in setup_rbac
    app = client.applications.create(params)
  File "C:\Python38\lib\site-packages\azure\graphrbac\operations\applications_operations.py", line 86, in create
    raise models.GraphErrorException(self._deserialize, response)
azure.graphrbac.models.graph_error_py3.GraphErrorException: Insufficient privileges to complete the operation.

Looks like the deployment script is trying to create a "Client App" under Azure Active Directory and currently my AD account doesn't have permissions to create a new registration. Our AD team is reluctant to add the AppRoleAssignment.ReadWrite.All permission as it is too permissive. Is there a least privilege approach that we can take here to satisfy the requirement for client app registration and proceed with the deployment? If you can provide additional guidance on how to deploy OneFuzz in a corporate setting where full permissions can't be assumed by the deployer, that would be great.
Let me know if you need more information from me? Thanks!

Unfortunately, AppRoleAssignment.ReadWrite.All is already the least privileged permission required to be able assign an App Role.
Would it be possible to have a admin deploy the application ? Or use the Privileged Identity Management to temporarily elevate your permissions in order to deploy the application.

Also the script seem to be failing when creating the application registration itself so the missing permission for that operation is likely Application.ReadWrite.All which is also the least privileged permission required here.

@chkeita Ok, the Application.ReadWrite.All permission still seems to have a lot of permissions since it would still allow a principal with these permissions to create, read, update, delete not the just the client app needed for the deployment but any other app that is in the Azure AD which might not be ok with my AD team. Let me confirm this with them.
Regarding the possibility of an admin deploying the application, unfortunately that is not possible as I'm part of the Security team and would like to have the capability to deploy, update OneFuzz whenever needed since our team would be maintaining the service.
Regarding Privileged Identity Management, let me talk to my AD team about it and see if this is something they would be interested in.
In the meantime, are there any workarounds that we can take here to go ahead with the deployment? This comment seems to suggest that the Application.ReadWrite.All permission is only needed for deployment is not needed after, even for upgrades. Is that right? If so, can I have my AD team manually register the application and add me as the "Owner" of the app as described in the Known Issues page (2nd sub-bullet in the 5th point)? I'm assuming the "Owner" permissions here are tied to the specific app needed for OneFuzz and not all the apps in Azure AD. Can you confirm?
Also, on a side note, can you explain what is the purpose of the Client App OneFuzz is trying to create and how is it used during and after deployment in the OneFuzz service? Didn't find any documentation on this hence my question. Thanks.

This comment seems to suggest that the Application.ReadWrite.All permission is only needed for deployment is not needed after

Yes it is true as long as the update does not modify the the application registration (which are the majority of updates).

can I have my AD team manually register the application and add me as the "Owner"

Yes that is possible and having the admin call the deployment script will help for that. The deployment script will create the application registration and the admin is free to assign it to you.
The script does not just create the registration. It also configure the roles and the backing service principal so the manual creation is not a trivial operation.

I'm assuming the "Owner" permissions here are tied to the specific app needed for OneFuzz and not all the apps in Azure AD. Can you confirm

yes making you the owner of the application registration will only affect OneFuzz

can you explain what is the purpose of the Client App OneFuzz is trying to create and how is it used during and after deployment in the OneFuzz service?

The client app registration is used by the cli to connect to the Onefuzz service. The deployment creates two registration. One for the service itself and the this one for the cli client.

Ok, thanks for the responses. I'll discuss these answers with my AD team and will get back to you.

@chkeita I'm still working on implementing the workaround suggested above with our AD team. In the mean time, can you answer Ryan's question here about delegated vs application permission for AppRoleAssignment.ReadWrite.All? Ryan is from my AD team and an answer to his question would help prioritize my deployment work. Thank you.

@chkeita Our AD team is still a bit reluctant in running the deployment script with the above permissions before reviewing the deploy.py code to understand what it is doing. While we work on reviewing deploy.py script can you please also share the steps that an admin needs to take to deploy OneFuzz manually? We would probably take this approach, if it is feasible, over asking an admin to run the deployment script. Appreciate your help. Thank you.

@shambho
The deployment script is the only supported way to register the application. We do not support the manual creation.
You are welcome to translate the deployment code to manual steps or wait for the audit of the deployment script.

@chkeita Ok, thanks. I'd like to keep this issue still open until we do the deployment so that we can reach out to you with questions that may come up in the deployment process, if that is ok with you?

@chkeita Closing this issue as Ryan from my AD team created the app registrations manually and assigned the respective roles etc. I was able to deploy OneFuzz after that and I'm able to use OneFuzz CLI now. Ryan's other issue, #875, once addressed should help other enterprises in the future who would like to take the same route as us in manually registering the applications and setup roles rather than the AD admin running the deployment script. Thank you.


show every finding in new page

how can i create report with every finding in new page

You have to use word's <CTRL>+<ENTER> functionality.
When creating your template:
{findings}
<CTRL>+<ENTER>
{#description}
...
{/findings}

It's important to have the first {findings} on the prior page, because, if I remember correctly, in a case where you don't have an entry in {findings}, this can result in a blank page, which is not wanted. But I am not sure about this one.

I did the same but I use + at the end of the findings section and it works just fine too