Generating Kyverno policies dynamically using KubeArmor

Generating Kyverno policies dynamically using KubeArmor
The aim of the project is to integerate Kyverno and KubeArmor by generating Kyverno policies thorugh the runtime data that KubeArmor can provide.
Policy Idea List
1. Detecting unused ServiceAccount token mounted onto pods.
The idea is to detect whether any read accesses have been made to the service account token or not (using KubeArmor). If not, then turn automountServiceAccountToken to false.
Policy:
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-automount-sa-token
  annotations:
    policies.kyverno.io/title: Restrict Auto-Mount of Service Account Tokens
    policies.kyverno.io/severity: medium
    policies.kyverno.io/minversion: 1.6.0
    policies.kyverno.io/description: >-
      If the Service Account Token is not used by a pod, then it should not be
      automounted.
spec:
  validationFailureAction: audit
  background: true
  rules:
  - name: validate-automountServiceAccountToken
    match:
      any:
      - resources:
          kinds:
          - Pod
    validate:
      message: "Auto-mounting of Service Account tokens is not allowed."
      pattern:
        spec:
          automountServiceAccountToken: "false"

[ ] Can be implemented with current version of KubeArmor
[ ] Enhancement required in KubeAmor (mention "how" to do that enhancement too)
[ ] Not Possible

2. Specifying the exact securityContext.capabilities for a container.
The idea is to detect which capabilities a pod requires with the help of KubeArmor and then create a policy pointing user to have only those capabilities in the pod manifest.
Policy:
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-capabilities
  annotations:
    policies.kyverno.io/title: Disallow Capabilities
    policies.kyverno.io/severity: medium
    kyverno.io/kyverno-version: 1.6.0
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kubernetes-version: "1.22-1.23"
    policies.kyverno.io/description: >-
            Adding capabilities beyond those listed in the policy must be disallowed.
spec:
  validationFailureAction: audit
  background: true
  rules:
    - name: require-drop-all
      match:
        any:
        - resources:
            kinds:
              - Pod
      validate:
        message: >-
                    Containers must drop `ALL` capabilities.
        foreach:
          - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
            deny:
              conditions:
                all:
                - key: ALL
                  operator: AnyNotIn
                  value: "{{ element.securityContext.capabilities.drop[] || `[]` }}"
    - name: adding-capabilities
      match:
        any:
        - resources:
            kinds:
              - Pod
      validate:
        message: >-
          Any capabilities added beyond what the containers uses are disallowed.
        deny:
          conditions:
            all:
            - key: "{{ request.object.spec.[ephemeralContainers, initContainers, containers][].securityContext.capabilities.add[] }}"
              operator: AnyNotIn
              value:
              - <DATA_FROM_KUBEARMOR>

[ ] Can be implemented with current version of KubeArmor
[ ] Enhancement required in KubeAmor (mention "how" to do that enhancement too)
[ ] Not Possible

3. Disallowed syscalls.
The idea is to get all the syscalls that a pod requires, create a seccomp policy with data from KubeArmor, store it at some place, and create a policy enforcing usage of that seccomp profile.
seccomp-policy.json (generated by information from KubeArmor)
{
    "defaultAction": "SCMP_ACT_ERRNO",
    "architectures": [
        "SCMP_ARCH_X86_64",
        "SCMP_ARCH_X86",
        "SCMP_ARCH_X32"
    ],
    "syscalls": [
        {
            "names": [
                "accept4",
                "epoll_wait"
                "pselect6",
                "futex",
                "set_tid_address",
                "setitimer",
                "writev"
            ],
            "action": "SCMP_ACT_ALLOW"
        }
    ]
}

Policy basic:
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-seccomp
  annotations:
    policies.kyverno.io/title: Restrict Seccomp
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: 1.6.0
    kyverno.io/kubernetes-version: "1.22-1.23"
    policies.kyverno.io/description: >-
      This policy, requiring Kubernetes v1.19 or later, ensures that seccomp is
      set to `Localhost` with localhostProfile to the one generated by KubeArmor.
spec:
  background: true
  validationFailureAction: audit
  rules:
    - name: check-seccomp
      match:
        any:
        - resources:
            kinds:
              - Pod
      validate:
        message: >-
          The fields spec.containers[*].securityContext.seccompProfile.type,
          must be set to `Localhost` with `localhostProfile` to the
          one generated by KubeArmor.
        pattern:
          spec:
            containers:
            - securityContext:
                seccompProfile:
                  type: "Localhost"
                  localhostProfile: profile/generated-by-kubearmor.json

[ ] Can be implemented with current version of KubeArmor
[ ] Enhancement required in KubeAmor (mention "how" to do that enhancement too)
[ ] Not Possible

4. Read-Only Root Filesystem
The idea is to generate a policy based on whether the processes in the container just read from the root filesystem or write to it too.
Policy:
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-ro-rootfs
  annotations:
    policies.kyverno.io/title: Require Read-Only Root Filesystem
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/minversion: 1.6.0
    policies.kyverno.io/description: >-
      A read-only root file system helps to enforce an immutable infrastructure strategy;
      the container only needs to write on the mounted volume that persists the state.
      An immutable root filesystem can also prevent malicious binaries from writing to the
      host system. This policy validates that containers define a securityContext
      with `readOnlyRootFilesystem: true`.
spec:
  validationFailureAction: audit
  background: true
  rules:
  - name: validate-readOnlyRootFilesystem
    match:
      any:
      - resources:
          kinds:
          - Pod
    validate:
      message: "Root filesystem must be read-only."
      pattern:
        spec:
          containers:
          - securityContext:
              readOnlyRootFilesystem: true

[ ] Can be implemented with current version of KubeArmor
[ ] Enhancement required in KubeAmor (mention "how" to do that enhancement too)
[ ] Not Possible

5. Already in use list of hostPort
The idea is to generate a policy based on spec.containers[*].ports[*].hostPort. The policy will include a list of host ports that are already in use (not including 30000-32767). The policy can be generated statically from pod manifests and don't require runtime information from KubeArmor. This would prevent two different administrators from using same hostPort by mistake.
Pod:
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: nginx
  name: nginx
spec:
  containers:
  - image: nginx
    name: nginx
    ports:
      - containerPort: 80
        hostPort: 8081

Policy basic:
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-host-ports
  annotations:
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: 1.6.0
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kubernetes-version: "1.22-1.23"
    policies.kyverno.io/description: >-
      Access to host ports allows potential snooping of network traffic and should not be
      allowed, or at minimum restricted to a known list. This policy ensures the `hostPort`
      field is set to one in the designated list.
spec:
  validationFailureAction: audit
  background: true
  rules:
    - name: host-port
      match:
        any:
        - resources:
            kinds:
              - Pod
      validate:
        message: >-
                    The host port is already in use by another pod.
        deny:
          conditions:
            all:
            - key: "{{ request.object.spec.[ephemeralContainers, initContainers, containers][].ports[].hostPort }}"
              operator: AnyIn
              value: [8081]

Another way to create this policy would be to create a ConfigMap of of used ports and the policy can in turn read the ConfigMap for validation.

[ ] Can be implemented with current version of KubeArmor
[ ] Enhancement required in KubeAmor (mention "how" to do that enhancement too)
[ ] Not Possible

6. Limit hostPath Volumes to Specific Directories
From https://kyverno.io/policies/other/limit-hostpath-vols/limit-hostpath-vols/
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: limit-hostpath-vols
  annotations:
    policies.kyverno.io/title: Limit hostPath Volumes to Specific Directories
    policies.kyverno.io/category: Other
    policies.kyverno.io/severity: medium
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kyverno-version: 1.6.2
    kyverno.io/kubernetes-version: "1.23"
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
      hostPath volumes consume the underlying node's file system. If hostPath volumes
      are not to be universally disabled, they should be restricted to only certain
      host paths so as not to allow access to sensitive information. This policy ensures
      the only directory that can be mounted as a hostPath volume is /data. It is strongly
      recommended to pair this policy with a second to ensure readOnly
      access is enforced preventing directory escape.
spec:
  background: false
  validationFailureAction: audit
  rules:
  - name: limit-hostpath-to-slash-data
    match:
      any:
      - resources:
          kinds:
          - Pod
    preconditions:
      all:
      - key: "{{ request.object.spec.volumes[?hostPath] | length(@) }}"
        operator: GreaterThanOrEquals
        value: 1
      - key: "{{request.operation || 'BACKGROUND'}}"
        operator: AnyIn
        value:
        - CREATE
        - UPDATE
    validate:
      message: hostPath volumes are confined to /data.
      foreach:
      - list: "request.object.spec.volumes[?hostPath].hostPath"
        deny:
          conditions:
            any:
            - key: "{{ element.path  | to_string(@) | split(@, '/') | [1] }}"
              operator: NotEquals
              value: data

Similar to point 5, this can also be generated statically from the pod manifest.

[ ] Can be implemented with current version of KubeArmor
[ ] Enhancement required in KubeAmor (mention "how" to do that enhancement too)
[ ] Not Possible

Ideas dropped after 10/02/2023 meeting
1. Specifying exact securityContext.seLinuxOptions for a pod
The idea is to specify the exact level for seLinuxOptions from data provided by KubeArmor.
...
securityContext:
  seLinuxOptions:
    level: "s0:c123,c456"

[ ] Can still be implemented?

2. Specifying exact securityContext.sysctls for a pod
The idea is to specify the exact kernel parameters for a pod from data provided by KuberAmor.
apiVersion: v1
kind: Pod
metadata:
  name: sysctl-example
spec:
  securityContext:
    sysctls:
    - name: kernel.shm_rmid_forced
      value: "0"
    - name: net.core.somaxconn
      value: "1024"
    - name: kernel.msgmax
      value: "65536"
  ...

[ ] Can still be implemented?

cc @nyrahul @achrefbensaad @Ankurk99

Please help filling:
Can be implemented with current version of KubeArmor
Enhancement required in KubeAmor (mention "how" to do that enhancement too)
Not Possible

Detecting unused ServiceAccount token mounted onto pods: The current implementation of KubeArmor can help discover policies which mentions if a serviceaccount is being used or not. This in turn can help us discover a policy denying any unused tokens (or atleast audit those events).
Specifying the exact securityContext.capabilities for a container: As discussed in the meeting, KubeArmor currently has a very limited knowledge of used capabilities. To generate capabilities based policies, the supported capacities should be extended first
Disallowed syscalls: Why do we want to generate seccomp profiles?
For points Specifying exact securityContext.seLinuxOptions for a pod and Specifying exact securityContext.sysctls for a pod I don't how they can be done, will need some form of design requirements.


HAWKULAR-582 - Updated hawtio-oauth and related dependencies.

@mtho11 , could you please review this one? The changes in the other dependencies might affect also other parts of Hawkular, but are required to get the OAuth plugin to work. So, if you have anything against those dependencies, let me know and I can try to figure something out with the hawtio folks.

Merged #430


Adding applications to the "File associations" pane appears to be broken on Windows due to unescaped backslashes in paths

Description
What steps will reproduce the problem?

From a clean config, open the File Associations tab of the Files prefs pane
Add any extension (e.g. .txt) to enable the "add" option for external programs
Click the add button, and the resulting error appears

I haven't investigated the relevant code thoroughly, but it appears to be due to unescaped backslashes in Windows file paths combined with use of eval. I'd suggest simply using standard forward slashes instead (using replace to convert them before parsing if necessary) since they are equally accepted on Windows as backslashes.
Traceback
  File "C:\Miniconda3\envs\spyder-4\lib\site-packages\spyder\plugins\explorer\widgets\fileassociations.py", line 496, in add_application
    self._dlg_applications = ApplicationsDialog(self)
  File "C:\Miniconda3\envs\spyder-4\lib\site-packages\spyder\plugins\explorer\widgets\fileassociations.py", line 145, in __init__
    self.setup()
  File "C:\Miniconda3\envs\spyder-4\lib\site-packages\spyder\plugins\explorer\widgets\fileassociations.py", line 152, in setup
    apps = get_installed_applications()
  File "C:\Miniconda3\envs\spyder-4\lib\site-packages\spyder\utils\programs.py", line 493, in get_installed_applications
    apps = _get_win_applications()
  File "C:\Miniconda3\envs\spyder-4\lib\site-packages\spyder\utils\programs.py", line 362, in _get_win_applications
    expanded_fpath = literal_eval(expanded_fpath)
  File "C:\Miniconda3\envs\spyder-4\lib\ast.py", line 46, in literal_eval
    node_or_string = parse(node_or_string, mode='eval')
  File "C:\Miniconda3\envs\spyder-4\lib\ast.py", line 35, in parse
    return compile(source, filename, mode, PyCF_ONLY_AST)
  File "<unknown>", line 1
    c:\program files (x86)\malwarebytes' anti-malware\mbam.exe
     ^
SyntaxError: invalid syntax

Versions

Spyder version: 4.0.0rc1
Python version: 3.7.5
Qt version: 5.9.6
PyQt5 version: 5.9.2
Operating System: Windows 8.1

Dependencies
cloudpickle >=0.5.0          :  0.7.0 (OK)
pygments >=2.0               :  2.3.1 (OK)
qtconsole >=4.5.5            :  4.5.5 (OK)
nbconvert >=4.0              :  5.4.0 (OK)
sphinx >=0.6.6               :  1.8.4 (OK)
pylint >=0.25                :  2.2.2 (OK)
psutil >=0.3                 :  5.6.3 (OK)
qtawesome >=0.5.7            :  0.6.0 (OK)
qtpy >=1.5.0                 :  1.9.0 (OK)
pickleshare >=0.4            :  0.7.5 (OK)
zmq >=17                     :  17.1.2 (OK)
chardet >=2.0.0              :  3.0.4 (OK)
numpydoc >=0.6.0             :  0.8.0 (OK)
spyder_kernels >=1.7.0;<2.0.0:  1.7.0 (OK)
qdarkstyle >=2.7             :  2.7 (OK)
atomicwrites >=1.2.0         :  1.3.0 (OK)
diff_match_patch >=20181111  :  20181111 (OK)
watchdog                     :  None (OK)
keyring                      :  None (OK)
pexpect >=4.4.0              :  4.7.0 (OK)
pympler                      :  None (OK)
sympy >=0.7.3                :  1.3 (OK)
cython >=0.21                :  0.29.4 (OK)
IPython >=4.0                :  7.2.0 (OK)
matplotlib >=2.0.0           :  3.0.2 (OK)
pandas >=0.13.1              :  0.24.2 (OK)
numpy >=1.7                  :  1.15.4 (OK)
scipy >=0.17.0               :  1.2.0 (OK)
pyls >=0.29.3;<0.30.0        :  0.29.3 (OK)
rtree >=0.8.3                :  0.8.3 (OK)

Also, not sure what's up with the dependency report but conda list confirms I have all three of watchdog, keyring and pympler installed in my Spyder 4 env and Spyder even used keyring to remember my Github token to submit this report.

@goanpeca, please take a look at this one.

Also, not sure what's up with the dependency report but conda list confirms I have all three of watchdog, keyring and pympler installed in my Spyder 4 env and Spyder even used keyring to remember my Github token to submit this report.

Please read carefully: they don't have available versions to report (because the packages themselves don't declare them), but they are marked as OK.

@ccordoba12 I see, but it wasn't at all clear that the None was referring to the version as opposed to the installation status, and OK to the installation status as opposed to whether lack of that package was a critical problem (i.e. if it was optional). Now I know that isn't the case, but its not necessarily intuitively obvious to the average observer.

@ccordoba12 I see, but it isn't clear simply from the context that the None was referring to the version as opposed to the installation status, and OK to the installation status as opposed to whether lack of that package was a critical problem (i.e. if it was optional).
By the way, even if the package doesn't declare __version__ or similar, its easy to get the version using Setuptools' pkg_resources, since all those packages still have one. Here's a snippit adapted directly from my own production code:
import pip._vendor.pkg_resources as pkg_resources  # Or just `import pkg_resources` if you know you'll have setuptools available, like with conda, linux distros, etc
for package in pkg_resources.working_set:
    if package.project_name.lower() == "PACKAGENAME":
        package_version = package.version
        break

If you found a fix, please submit a pull request for that, along with tests. If not, we'll try to fix that when more important things are solved.

@ccordoba12 Sure, I'll add it to my list. As you say its not at all critical and it should be a quick fix and test for me to do so I'll try to get to it perhaps after the Spyder 4.0 release. Thanks.


Native window controls (close, minimize, maximize) not showing on macOS

Before I upgraded to the latest version the controls looked something like this, which is what I would expect:

After I upgraded they looked like this:

Is this a bug or is this intentional? I see some commits related to custom/title bar but I can’t find any commit messages explaining the changes so I don’t know if this was supposed to happen or not, and why?

Hey @brandonweiss I had the same issue. Try View > Toggle Full Screen.
I do agree the + should open it in fullscreen.

Should be fixed by https://github.com/railsware/upterm/pull/1306

Unfortunately didn't fix it for me

@itssimon did you check master branch? This fix was not published with some version.

Yes, I tried on the master branch. The fullscreen mode works though.

I was expected, that this PR fix this problem https://github.com/railsware/upterm/pull/1306

I think we might be talking about different things? It seems like the commit you’re talking about changes the behavior of the controls, but what I’m talking about is how the controls look.
On macOS they should be red, yellow, and green dots. But on the latest version they’re shown as a white “X“, “-”, and “+”.

The problem is it breaks the conventions and patterns used in macOS applications. macOS applications all use the same native window controls, and in the case of non-native applications, like an Electron app, they replicate the native controls. They do this both because it’s aesthetically pleasing but also because users follow the conventions and patterns in order to understand how the application they’re using works.
Or put another way, what’s the value of changing the controls to look different from every other macOS application?

Ok, now I understand a problem. Thanks. Will check, how will look native toolbar not only on Mac OS.

Reverted by https://github.com/railsware/upterm/commit/dbcb73cdfa014c84f3ad2718faed6bff423ab95e

@le0pard Thank you! 🙌 ❤

in 0.4.4 problem still exists.


Site: fix vue-router warn

Please makes sure these boxes are checked before submitting your PR, thank you!

[ ] Make sure you follow Element's Contributing Guide.
[ ] Make sure you are merging your commits to dev branch.
[ ] Rebase before creating a PR to keep commit history clear.
[ ] Add some descriptions and refer relative issues for you PR.

这样的话需要改一下 title.json，相关代码在这里。


Improve testing, add a new test, fix some things

This really nice!
I test that the (bimodal!) transition density
in a non-linear, non-homogenous, non-constant diffusivity model,
estimated by forward simulation
agrees with the density obtained from the linearisation
reweighted with importance weights using guided proposals. Clearly, not even wrong by a factor:

Here some bridges from the forward simulation (color doesn't have a meaning):

Very cool, so if I understand it correctly, you first estimate the transition density p_T(0,v) for T = round(f*4*pi, digits=2) of the non-linear diffusion P by forward-simulating paths and then taking an empirical, marginal distribution at time T. Then, you compare to an alternative estimation method, where for each value of v (where vs are simulated at random) you compute the stochastic importance weight by simulating proposal bridge and then assigning weight that corrects for the discrepancy between the proposal and the target and because you are doing it multiple times, the contribution from the path is averaged out and only the contribution from the transition density from the starting point to end-point v is left and it also comes from the correct law, because of the importance correction step.

Yes. :-)
It is essentially the formula for the transition density you get when taking expectations on both sides of formula (2.5) in the Bernoulli paper.

So what is left for the next time is to extend the test for a second observation at the starting point.


"Attempting to select choice that does not exist" error when value is JSON

Hi,
I'm getting the error "Attempting to select choice that does not exist" when I'm loading JSON objects as the value and trying to select an item using setValueByChoice. I assume we need to implement another way or testing for equality for complex objects than what is in the setValueByChoice?
var foundChoice = selectOptions.find((choice) => {
// Check 'value' property exists and the choice isn't already selected
return choice.value === value;
});
Are there any recommendations on how best to fix it?
cheers
Mark

Standardize your obiect before setting your choice. I wrote this mapper for that sobyou can declare the label, value and customProperties. Your object must be flat.
/**

Generate a standardized list object - requires a data map refer to CreateDataMap

@param {array} objArr - an array of objects with data

@param {instance} mappedKeysObj - a data key map instance. Refer to CreateDataMap

@returns {promise} returns a promise with a newly created array of list objects
*/
globalObj.generateListObject = (objArr, mappedKeysObj) => {
let i = objArr.length
,listObjArr = []
,hasOwn = Object.prototype.hasOwnProperty
,prop;
const valueKeyName   = mappedKeysObj.value;
const labelKeyName   = mappedKeysObj.label;
const customDataKeys = mappedKeysObj.customProperties;
// After building our list objects return a promise
return new Promise((resolve, reject) => {
while (i--) {
let listObj = {}
,customProperties = listObj['customProperties'] = {};
for ( prop in objArr[i] ) {

  if ( hasOwn.call(objArr[i], prop ) ) {

    if ( prop === valueKeyName ) {
      listObj.value = objArr[i][prop];
    }

    if ( prop === labelKeyName ) {
      listObj.label = objArr[i][prop];
    }

    if ( customDataKeys.indexOf(prop) !== -1 ) {
      customProperties[prop] = objArr[i][prop];
    }
  }
}

listObjArr.push(listObj);

}
resolve(listObjArr);
});
};

I created a mapping util just for this purpose:
https://jsfiddle.net/fsquaredmedia/61vnLz3k/


adding readme file explaining cocktailshakersort adding cocktailshake…

Hi I added CocktailShakerSort Algorithm its like Bubble Sort Algorithm but it can be bidirectional in some cases it can achieve better than BubbleSort with less time Complexity on average and worst case its O(n^2) on best case its O(n) it take constant amount from Memory so its memory complexity is O(1) I Wrote A java script file for it following your pattern in writing these algorithm like extending class from Sort,etc Also make a test file CocktailShake.test.js to test it Also I added a Readme file that explaining it with references for further information Please Accept my PR.

@trekhleb is that PR awaiting review or just I need to fix this test to pass please help thanks


Section list support

This PR adds support for SectionList. It's almost identical to #200, so let me know if you or @wuhenzhizao prefer this to be a PR to that repo instead.
It fixes indentation with tabs, and delete in the SectionList example.

lets get it merged! :)

@thomas-brx This is great! Really appreciate the effort. I'm going to make a few notes to the README and get this released in a new version


base_commit for gitlab wrong in certain workflows

Report
What did you do?
Run danger on a branch when its merge request has been updated with a merge from the target branch (rather than rebasing)
What did you expect to happen?
Similar to bitbucket or github, ideally the base_commit should have been updated to the tip of the target branch at the time of merge request being updated.
What happened instead?
The base_commit was unchanged, and now the modified files list in danger includes changes that have gone into master.
Your Environment

Which CI are you running on?

GitLab CI

Are you running the latest version of Danger?

yes

What is your Dangerfile?

https://gitlab.com/charts/gitlab/blob/master/scripts/support/changelog/Dangerfile

This appears to be an issue with the data not being available in the gitlab merge request api. Instead the plugin just looks at the commit before the first commit in the MR. Which would work for a rebase workflow, but not if you are merging master into your branch.
GitLab should have this data somewhere, as it is used to update the diff. We should find if it's stored somewhere we can access from the api, or propose adding it if it is not.
cc\ @rymai

I'm not sure why we don't only use the MR diff: https://github.com/danger/danger/blob/master/lib/danger/request_sources/gitlab.rb#L84-L89

Danger Ruby was built entirely with using the local filesystem to figure out all of the diff I'm afraid, which should be coordinated by the API calls for the MR. Maybe we change the gitlab support to use the API instead? It'd probably be quite a drastic refactor though.

Maybe we could use this API to get the base_sha: https://docs.gitlab.com/ee/api/merge_requests.html#get-mr-diff-versions similarly to what's done for GitHub https://github.com/danger/danger/blob/1687f6d9d89b318900a488a8ea31cac78153e0e1/lib/danger/danger_core/plugins/dangerfile_github_plugin.rb#L167?


Add iperf example

This PR adds the iperf example.
It provides a Makefile that clones and builds the latest stable version (3.16) of iperf as of now.
Note that it places the iperf3 executable and the libiperf shared library in the created install directory.
It further includes the Gramine manifest template and a top level README that provides instructions on how to compile and run the iperf server (both natively and in Gramine --- with and without SGX) and the iperf client (natively) to get the desired measurements.

This change is

Reviewable status: all files reviewed, 3 unresolved discussions, not enough approvals from maintainers (2 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @dimstav23)

a discussion (no related file): Add the explicit BSD-3 license, see #90

Added the BSD-3 licence.

Reviewable status: all files reviewed, 2 unresolved discussions, not enough approvals from maintainers (2 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @dimakuv and @dimstav23)

iperf/Makefile line 21 at r3 (raw file):
Previously, woju (Wojtek Porczyk) wrote…
I will take care of this now.
But I want to do it via "download from GitHub Releases page". I think it's much better to have a specific version of the tool, instead of the unknown distro package version.

I also tried to adapt it to use the Ubuntu 22.04.3 LTS package binary.
However I hit on this error.
Note: tested with gramine-direct using gramine v1.6


[master] Merge pull request #8 from dereknola/pr_launchpad (#8)

Backports the following commits to master:

Merge pull request #8 from dereknola/pr_launchpad (#8)
Origial PR below:
Signed-off-by: dereknola<EMAIL_ADDRESS>

Proposed Changes

Types of Changes

Verification

Linked Issues

User-Facing Change

Further Comments

Close as failure


Exhaust full HNSW NeighborQueue to get top results

@phact do we need this PR/branch still?

We no longer need this. The fix has already been merged to vsearch.


Prevent POSTOrderComplete from being called if no fulfillment in cont…

…ract

Coverage decreased (-0.007%) to 32.881% when pulling c3dd901eb2d262009a3670c7459cf919256cd3e0 on order_completion into 8e3325d4330271d688795ed96b0381d1515a4d52 on master.


Why cannot open "admin/*/create" page ?

I installed laravel-admin in Laravel 5.5
I confirmed that I can "view", "edit", "delete" actions and show list.
but, "create" is not working.
When I click the "Add New" button, I see a message like this
"Sorry, the page you are looking for could not be found."
404 not found error ?

This is a bug in Laravel 5.5.
Thanks.

@minoryorg Okay,
I was trying to reproduce but everything seems fine here.


Provide better error messages for ambiguous for-less links

This sequence of four commits (most of which refactor things) provides more verbose error messages for ambiguous for-less links (but also doesn't give the element twice).  It uses the reference syntax to report what the ambiguous references are.
I concede that my new function names may not be that great, nor perhaps is the way of passing a bunch of parameters to some of these.  Let me know if there's something you want me to fix about those.
I don't see any tests of error reporting in bikeshed, so it's not clear to me how to add a test for this.  Maybe I'm missing something, though.

As an example, this patch changes the error that I just fixed from reporting the message:
LINK ERROR: Ambiguous for-less link, please see <https://tabatkins.github.io/bikeshed/#ambi-for> for instructions:
dpi
dpi

to reporting the message:
LINK ERROR: Ambiguous for-less link for 'dpi', please see <https://tabatkins.github.io/bikeshed/#ambi-for> for instructions:
Local references:
spec:css-values-4; type:value; for:<resolution>; text:dpi
for-less references:
spec:css-images-3; type:value; for:/; text:dpi
dpi

Er, there's a bug in one of the refactoring commits that I just noticed -- I'll need to fix that up.


navbar: Migrate to handlebars.

Added a commit to migrate the navbar.html Django template to handlebars by creating a new file within ./static/templates as navbar.hbs which is then rendered using ui_init module.
Fixes part of #18792.
Edit: Will later rebase once #19048 is completed :)

Rebased and merged, with the same little changes I did for the left/right sidebar PR.
Thanks @aryanshridhar!


ConnectionRefusedError: [WinError 10061] No connection could be made because the target machine actively refused it

I'm trying to access the map matching utility and keep getting this error.
import osrm
points = [(-33.45017046193167,-70.65281867980957),           (-33.45239047269638,-70.65300107002258),           (-33.453867464504555,-70.65277576446533)]
client = osrm.Client()
response = client.match(coordinates=points)
I'm a little skeptical since there is no parameter to use the API key for OSRM. Could that be the issue?
ConnectionError: HTTPConnectionPool(host='localhost', port=5000): Max retries exceeded with url: /match/v1/driving/-33.45017046193167,-70.65281867980957;-33.45239047269638,-70.65300107002258;-33.453867464504555,-70.65277576446533?steps=false&annotations=false&geometries=geojson&overview=simplified&gaps=split (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x0000029A76AA6E48>: Failed to establish a new connection: [WinError 10061] No connection could be made because the target machine actively refused it'))
Any help will be appreciated.
Alternatively, a suggestion for another package for map matching in python.

I have the same issue. Any help will be appreciated


Fix for events unit tests failing in CI

We were seeing events unit tests failing in CI and on debugging we found that to be test implementation issue as tests use too many parallel tests when not supported by the runtime. The current set of changes minimizes the required procs to be able to run CI.

It appears there are still few tests failing on events_test due to same issue. I'm looking more into that.

https://travis-ci.org/armPelionEdge/maestro/builds/547370122 passed in the first run.
Restarted a second time to see if anything different happens.
This needs a rebase since another PR came in, fixing newline inconsistencies.

Pushed new commits rebased to master, also squashed few commits..


Create reference API documentation

Reference API documentation is currently at https://zechiax.github.io/Modrinth.Net/api/index.html


Add option to generate bitflip visualisations

This PR adds support for generating visual representation of error lists by adding --plot switch when calling rowhammer.py or hw_rowhammer.py
At the moment two representations are generated:

2D Histogram

JSON files used with Symbiflow DB Visualiser

To view results using DB Visualiser you need to:

Clone and build the visualiser with

git clone https://github.com/antmicro/symbiflow-database-visualizer
cd symbiflow-database-visualizer
npm run build

Run rowhammer.py or hw_rowhammer.py with --plot
Copy generated JSON files from vis directory to /path/to/symbiflow-database-visualizer/dist/production/
Start a simple HTTP server inside the production directory: python -m http.server 8080

I updated the docs with instructions on how to use the plotting functionality. As now the slowdown happens only when using the --plot argument, we can merge this PR. In the future we can try to speed things up, possibly with the defaultdict-based approach.

Superseded by #121. Closing.


Use description to show full path to the ConfigurationProfile

In provisioning dialogs, the full path to the ConfigurationProfile
is much more useful in the drop-down selection.
https://bugzilla.redhat.com/show_bug.cgi?id=1328823

@miq-bot add_label bug

@miq-bot add_label providers/foreman

@gmcculloug Please review.


Create about me page and article page

Need a page as home page, we could use about me page as home page right now.
Need a page for all article with one certain type tag, like a page full of tech posts, and a page full of personal posts
Also need a update on name of the webapp

#16


Update terminology for Event Store Cloud

@lukehoban - this will update those docs for now, but the next time event store cloud publishes a release from the upstream, it will update to match the docs with what is in the upstream repo.
The change will also need to be made there in the upstream in order for this not to happen: https://github.com/EventStore/pulumi-eventstorecloud/blob/main/docs/_index.md

The change will also need to be made there in the upstream in order for this not to happen: https://github.com/EventStore/pulumi-eventstorecloud/blob/main/docs/_index.md

Aha - yeah - good point.  I'll open a PR to that repo, but looks like we'll need to work with the partner on getting that merged.


📚[DOC]: corrdiff- what is the meaning of cwb dataset?

How would you describe the priority of this documentation request
Critical (currently preventing usage)
Is this for new documentation, or an update to existing docs?
New
Describe the incorrect/future/missing documentation
what is the full name of cwb? i know the mean of cwa by reading the paper, but what is the meaning of cwb..py in the code? is it the code processing of the corrdiff cwa dataset?

i download the dataset from https://catalog.ngc.nvidia.com/orgs/nvidia/teams/modulus/resources/modulus_datasets_cwa
i need to unzip it to cwa_dataset.zarr folder to use it, right?  What's more, why the file in cwa_dataset.zarr is .0 / .1 , not the .nc file

cwa_dateset is a type of .zarr file, and its open  by dataloader in dataset.py and cwb.py (line 68), the mini dataset (hrrr_mini) is a type of .nc file, because its size small (~ 2G), .zarr is a better choice of large dataset

cwa_dateset is a type of .zarr file, and its open by dataloader in dataset.py and cwb.py (line 68), the mini_dataset (hrrr_mini) is a type of .nc file, because its size small (~ 2G), .zarr is a better choice of large dataset

thanks for your work. I have an another question. i have to unzip the cwa_dateset.zip to cwa_dataset.zarr to use it, right? What's the size of the dataset?

thanks for your work. I have an another question. i have to unzip the cwa_dateset.zip to cwa_dataset.zarr to use it, right? What's the size of the dataset? I have tried to extract the data, but the disk is full. I wonder how big the entire dataset will be after extraction, so I can reserve disk space accordingly.

看了一下解压后的文件，大概1.1T左右，如果需要预留硬盘空间的话，还需要加上原始压缩文件的大小，大概2T左右。Nearly 1.1T after extract, before unzip the data, 2T for free in disk may better

thanks for your work. I have an another question. i have to unzip the cwa_dateset.zip to cwa_dataset.zarr to use it, right? What's the size of the dataset? I have tried to extract the data, but the disk is full. I wonder how big the entire dataset will be after extraction, so I can reserve disk space accordingly.

看了一下解压后的文件，大概1.1T左右，如果需要预留硬盘空间的话，还需要加上原始压缩文件的大小，大概2T左右。Nearly 1.1T after extract, before unzip the data, 2T for free in disk may better

十分感谢！


Failed to build $auth service on Windows 10

Failing to install this on windows 10 with angular 1.
2017-04-19T19_21_08_399Z-debug.txt
While loading package<EMAIL_ADDRESS>error: Command failed:
C:\Users\jstenkvi\AppData\Local.meteor\packages\meteor-tool\1.4.4_1\mt-os.windows.x86_32\dev_bundle\bin\npm.cmd
rebuild --update-binary
node-pre-gyp ERR! Tried to download(404):
https://fsevents-binaries.s3-us-west-2.amazonaws.com/v1.0.14/fse-v1.0.14-node-v46-win32-ia32.tar.gz
node-pre-gyp ERR! Pre-built binaries not found for<EMAIL_ADDRESS>and<EMAIL_ADDRESS>(node-v46
ABI) (falling back to source compile with node-gyp)
Traceback (most recent call last):
File
"C:\Users\jstenkvi\AppData\Local.meteor\packages\meteor-tool\1.4.4_1\mt-os.windows.x86_32\dev_bundle\lib\node_modules\node-gyp\gyp\gyp_main.py",
line 16, in
sys.exit(gyp.script_main())
File
"C:\Users\jstenkvi\AppData\Local.meteor\packages\meteor-tool\1.4.4_1\mt-os.windows.x86_32\dev_bundle\lib\node_modules\node-gyp\gyp\pylib\gyp_init_.py",
line 545, in script_main
return main(sys.argv[1:])
File
"C:\Users\jstenkvi\AppData\Local.meteor\packages\meteor-tool\1.4.4_1\mt-os.windows.x86_32\dev_bundle\lib\node_modules\node-gyp\gyp\pylib\gyp_init_.py",
line 538, in main
return gyp_main(args)
File
"C:\Users\jstenkvi\AppData\Local.meteor\packages\meteor-tool\1.4.4_1\mt-os.windows.x86_32\dev_bundle\lib\node_modules\node-gyp\gyp\pylib\gyp_init_.py",
line 523, in gyp_main
generator.GenerateOutput(flat_list, targets, data, params)
File
"C:\Users\jstenkvi\AppData\Local.meteor\packages\meteor-tool\1.4.4_1\mt-os.windows.x86_32\dev_bundle\lib\node_modules\node-gyp\gyp\pylib\gyp\generator\msvs.py",
line 2021, in GenerateOutput
sln_projects, project_objects, flat=msvs_version.FlatSolution())
File
"C:\Users\jstenkvi\AppData\Local.meteor\packages\meteor-tool\1.4.4_1\mt-os.windows.x86_32\dev_bundle\lib\node_modules\node-gyp\gyp\pylib\gyp\generator\msvs.py",
line 1780, in _GatherSolutionFolders
return _DictsToFolders('', root, flat)
....
npm ERR! errno 1
npm ERR<EMAIL_ADDRESS>install: node-pre-gyp install --fallback-to-build
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the<EMAIL_ADDRESS>install script 'node-pre-gyp install
--fallback-to-build'.
npm ERR! Make sure you have the latest version of node.js and npm installed.
npm ERR! If you do, this is most likely a problem with the fsevents package,
npm ERR! not with npm itself.
npm ERR! Tell the author that this fails on your system:
npm ERR!     node-pre-gyp install --fallback-to-build
npm ERR! You can get information on how to open an issue for this project with:
npm ERR!     npm bugs fsevents
npm ERR! Or if that isn't available, you can get their info via:
npm ERR!     npm owner ls fsevents
npm ERR! There is likely additional logging output above.
Full log is attached.

i have the same problem

I have found that this solution is deprecated, and probably not worth fixing or using.
Better to just call Meteor.user methods straight away, wrappers like this $auth service are unnecessary.
Meteor Users and Accounts
With ES6, you can just do something like:
import { Meteor } from 'meteor/meteor';
...
$scope.ctrl.login = function() {
   Meteor.loginWithFacebook({
     requestPermissions: ['user_friends', 'public_profile', 'email']
   }, (err) => {
     if (err) {
       // handle error
     } else {
       // successful login!
     }
   });
}


Remove instruction to use form-inline class

This PR changes the console output that is shown when the installer is invoked with the --bootstrap option
rails generate simple_form:install --bootstrap

The previous instruction was a bit confusing, as form-inline is only one of the many possible classes that can be used. It’s also (probably) not the one that is most often used, so mentioning it in the installation output implies that it’s more significant than it actually is.
The sentence was also imperative:
Inside your views, use the 'simple_form_for' with the Bootstrap form class, ‘.form-inline’

BEFORE
===============================================================================

  Be sure to have a copy of the Bootstrap stylesheet available on your
  application, you can get it on http://getbootstrap.com/.

  Inside your views, use the 'simple_form_for' with the Bootstrap form
  class, '.form-inline', as the following:

    = simple_form_for(@user, html: { class: 'form-inline' }) do |form|

===============================================================================

AFTER
===============================================================================

  Be sure to have a copy of the Bootstrap stylesheet available on your
  application, you can get it on http://getbootstrap.com/.

  For usage examples and documentation, see:

    http://simple-form-bootstrap.plataformatec.com.br/

===============================================================================

Closes #1687

Thanks ❤ 💙 💚


feature/true-zero-copy-7

Pull request type
Please check the type of change your PR introduces:

[X] Feature

What is the current behavior?
eCAL's current zero copy mode is realizing zero copy on the receiving side only. The sending (publishing) side still makes a single memory copy to provide a generic concept for all transport layers (zero copy and none zero copy capable ones).
What is the new behavior?
The new approach applies true zero copy for local publish/subscribe connections. It enables the direct modification of the memory file content without any additional copy action (zero copy).
The pictures shows two applications ecal_sample_latency_snd -z and ecal_sample_latency_rec running on Ubuntu 22.04, exchanging 32MB payloads in 3 µs.

Does this introduce a breaking change?

[X] Yes

New CPublisher API functions added using the new eCAL::payload class.
Sample Usage
#include <ecal/ecal.h>
#include <ecal/ecal_publisher.h>

// binary payload writer class to allow zero copy memory operations
//
// the `Write`and `Update` calls may operate on the target memory file directly (zero copy mode)
class CBinaryPayloadWriter : public eCAL::CPayloadWriter
{
public:
  CBinaryPayloadWriter(size_t size_) : m_size(size_) {}

  // the provisioned memory is uninitialized ->
  // perform a full write operation
  bool Write(void* buffer_, size_t size_) override
  {
    memset(buffer_, 42, size_);
    return true;
  };

  // the provisioned memory is initialized and contains the data from the last write operation ->
  // perform a partial write operation or just modify a few bytes here
  bool Update(void* buffer_, size_t size_) override
  {
    size_t const write_idx((m_clock % 1024) % size_);
    char   const write_chr(m_clock % 10 + 48);
    static_cast<char*>(buffer_)[write_idx] = write_chr;
    m_clock++;
    return true;
  };

  // provide the size of the required memory (eCAL needs to allocate for you).
  size_t GetSize() override { return m_size; };

private:
  size_t m_size = 0;
  int    m_clock = 0;
};

// main entry
int main(int argc, char** argv)
{
  // initialize eCAL API
  eCAL::Initialize(argc, argv, "zero_copy_snd");

  // create payload
  CBinaryPayloadWriter binary_payload_writer(8 * 1024 * 1024);

  // create publisher
  eCAL::CPublisher pub("zero_copy_pub");

  // enable zero copy mode
  pub.ShmEnableZeroCopy(true);

  // enable handshake mode
  pub.ShmSetAcknowledgeTimeout(50 /* ms */);

  // send updates
  while (eCAL::Ok())
  {
    // send content
    pub.Send(binary_payload_writer);
  }

  // destroy publisher
  pub.Destroy();

  // finalize eCAL API
  eCAL::Finalize();

  return(0);
}

Very interesting development! Two questions:

Will this be included in the next version release?
Can it be already used with serialization layer, such as protobuf message or capnproto message. The example here shows only binary data

@chengguizi the zero-copy message transport feature will be part of the next 5.12 release.
The message protocols google protobuf and capnproto will be supported as well, flatbuffers currently not.
For these serialization formats the zero-copy feature would change the behavior that way that the message content is serialized in the opened memory file directly without creating an intermediate buffer. This new behavior may also have some overall performance drawbacks if your serialization call takes a long time and is so blocking the file for connected subscribers. But the good news is you can switch on/off this feature for every single publisher.

Pretty much look forward, can't wait for 5.12 release!


react native > 0. 51 demo blank

onLayout={this.saveBlockPositions(key)} leads to this problem,In the process of checking

Same issue

same issue


Make Cloudflare work in PHP 8 and PHPUnit 9

This PR is the minimal amount of work to ensure this library works with PHP 7.4 through PHP 8.0. PHPUnit was updated to PHPUnit 9.x.
Changes:

update composer.json, and composer.lock (updated dependencies)
added return types to be consistent with phpunit 9's base classes where necessary
removed constructor from interface, this is so mocking in the test classes works properly (also, constructor is not necessary in the interface)

EDIT: please see https://github.com/cloudflare/cloudflare-php/pull/171 as it is a more extensive and more complete PR to achieve modernization and roll up many of the PR's many have submitted before.

🎤 tap tap - is this thing on? 🎤

Closing as it appears this project is abandoned.


[feature request] multiple hash_keys

i'm constantly using up my 1000rpm hash key. since it's not possible to upgrade them, it would be great if we could add another one. it's cheaper too then buying bigger ones.

I think this should rather be done in the API, but I don't know if they would like such a PR

there's a good enough solution in the faq


Add support for int, float, bool in UP018

Summary
This pull request add supports for int, float and bool types in UP018
rule to convert empty call to the default value of the type or remove the call
if a value of the same type is provided as an argument.
Test Plan
Added tests for int, float and bool types.
Partially resolves #5988

Current dependencies on/for this PR:

main

PR #6013   👈

This comment was auto-generated by Graphite.


When user clicks "Linked Data Editor" or goes directly to sinopia.io/editor, take them to the "Resource Templates" tab

in order to catalog, user has to first select a template, which is done on the Resource Templates tab, so take the user to this tab, not to Editor tab, as is current behavior.
see also #479

Fixed by #484

just realized that the "Resource Templates" tab requires you to log in before you can do anything,
but our plan before was to allow  people to be able to go to the Browse tab and look at stuff without having to log in, and to go to the Editor tab and explore templates without having to log in.
so now that we've made "Resource Templates" be the default when someone clicks "Linked Data Editor", there is now no way to get to the Browse tab or the Editor tab without being forced to log in first.
can we revert to the Linked Data Editor taking user to Editor tab, like it was originally?

Hi @michelleif, non-authenicated users can go to the editor tab directly by typing this url https://development.sinopia.io/editor/, if they click on the Resource Templates tab, they will then be required to login as we would expect.

@michelleif I created issue #495 to follow on PR #491. This solution (when finished) will open up the editor to anyone to choose existing resource templates (previously uploaded by authenticated users), work with those RTs and preview the RDF, but will prevent them from uploading their own resource templates (or save RDF when we get to that point).
Let me know if you think this solution will work. I created a tentative storytime topic to discuss this if need be.


Tang Operator Controller Manager reports a kube-rbac-proxy warning

Background
The Tang Operator Controller Manager reports a warning.
oc logs pod/tang-operator-controller-manager-7c8b6bf748-gsnq4 -n nbde
W0229 18:07:54.932304       1 kube-rbac-proxy.go:155]
==== Deprecation Warning ======================

Insecure listen address will be removed.
Using --insecure-listen-address won't be possible!

The ability to run kube-rbac-proxy without TLS certificates will be removed.
Not using --tls-cert-file and --tls-private-key-file won't be possible!

For more information, please go to https://github.com/brancz/kube-rbac-proxy/issues/187

===============================================

It could be caused by https://github.com/search?q=repo%3Alatchset%2Ftang-operator+http%3A%2F%2F<IP_ADDRESS>%3A8080%2F&type=code
and source is https://github.com/brancz/kube-rbac-proxy/blob/master/cmd/kube-rbac-proxy/app/options/options.go#L163
I hope this helps
Thanks,
Paul

Hello. I tried starting kube-rbac-proxy in https address, by setting this change:
+++ b/config/default/manager_auth_proxy_patch.yaml
@@ -14,7 +14,7 @@ spec:
         image: gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0
         args:
         - "--secure-listen-address=<IP_ADDRESS>:8443"
-        - "--upstream=http://<IP_ADDRESS>:8080/"
+        - "--upstream=https://<IP_ADDRESS>:8080/"
         - "--logtostderr=true"
         - "--v=10"
         - "--http2-disable"

However, it seems issue is still there. I need to continue investigating how to fix this ...

Sorry, forget my previous comment. I guess certificates must be provided for the warning to disappear. We will keep this open and review operator-sdk provided solution


Using not deprecated method to import through strings

Coverage decreased (-0.75%) to 89.53% when pulling 46019ea781534cc7ea245265dc24890977dc2066 on michael-borisov:patch-1 into 8ee9d3d81d6667f31bf4cb3a88de98dd46503a98 on moccu:master.

Awesome, thanks a lot for the pull request!


performance benchmark

Hi, have you benchmarked fa2 with jax? How much speedup can you get?

I did a small comparison benchmark with fa2, naive mha and the pallas mha included with jax 0.4.28. On my desktop with a 3090 and float16:
B     T    H    C    TFlop/s (flash)    TFlop/s (naive)    TFlop/s (pallas)
---  ----  ---  ---  -----------------  -----------------  ------------------
 32  1024    4   32            53.8639            8.24277             51.5742
 32  1024    4   64            57.5379           14.9229              53.5826
 32  1024    4  128            58.8711           26.7008              54.7979
 32  1024    8   32            61.1098            8.6376              51.487
 32  1024    8   64            64.0922           15.6025              52.9087
 32  1024    8  128            65.6265           27.115               51.4726
 32  1024   16   32            63.9256            8.74247             52.2687
 32  1024   16   64            63.1579           15.7274              55.8753
 32  1024   16  128            65.6789           27.7762              57.1428
 32  1024   32   32            63.1234            8.63395             52.5392
 32  1024   32   64            66.5244           15.4328              56.243
 32  1024   32  128            65.5683           28.3536              59.0203

Hi @nshepperd Could you please share the benchmarking code?

I did a small comparison benchmark with fa2, naive mha and the pallas mha included with jax 0.4.28. On my desktop with a 3090 and float16:
B     T    H    C    TFlop/s (flash)    TFlop/s (naive)    TFlop/s (pallas)
---  ----  ---  ---  -----------------  -----------------  ------------------
 32  1024    4   32            53.8639            8.24277             51.5742
 32  1024    4   64            57.5379           14.9229              53.5826
 32  1024    4  128            58.8711           26.7008              54.7979
 32  1024    8   32            61.1098            8.6376              51.487
 32  1024    8   64            64.0922           15.6025              52.9087
 32  1024    8  128            65.6265           27.115               51.4726
 32  1024   16   32            63.9256            8.74247             52.2687
 32  1024   16   64            63.1579           15.7274              55.8753
 32  1024   16  128            65.6789           27.7762              57.1428
 32  1024   32   32            63.1234            8.63395             52.5392
 32  1024   32   64            66.5244           15.4328              56.243
 32  1024   32  128            65.5683           28.3536              59.0203

any VRAM figures as well?


add some initial introspection support.

This is really great work, love how you leveraged you're github.com/chirino/graphql library here for introspection. I'm starting to think of other places we could use your strongly typed parser, like to verify the allow.list etc.  Really great work this opens up options to add all kinds of really useful features to the web UI.


fix openstack instanceReadyPeriod/Timeout

What this PR does / why we need it:
Fix the defaulting logic for Openstack instanceReadyPeriod/Timeout.
Optional Release Note:
None

/retest

/retest


Comment out last multiAZ flag assert

Issue #, if available:
Description of changes:
After merge in latest code and
fix multi az tag related e2e tests, not do second multi az flag change.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

/test rds-kind-e2e


Increased number of records in visherintroductie

Between version 14.0 and 14.1 the number of records increased from 3,387 to 3,594 (207 difference). @DimEvil, any idea why?

Oops... wrong repository. Was supposed to be here: https://github.com/LifeWatchINBO/data-publication/issues/65


systemd: systemd.pc: fix systemdsystemunitpath and systemduserunitpath

The paths in the generated systemd.pc were flipped, fix this:
systemdsystemunitpath: /nix/var/nix/profiles/default/lib/systemd/{user => system}
systemduserunitpath: /nix/var/nix/profiles/default/lib/systemd/{system => user}
The paths actually used in the code (further below in that patch) were
correct, so keep them there.
Motivation for this change
Fixes #59473.
Things done

[ ] Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
Built on platform(s)

[ ] NixOS
[ ] macOS
[ ] other Linux distributions

[ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[ ] Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
[ ] Tested execution of all binary files (usually in ./result/bin/)
[ ] Determined the impact on package closure size (by running nix path-info -S before and after)
[ ] Ensured that relevant documentation is up to date
[ ] Fits CONTRIBUTING.md.

@GrahamcOfBorg test systemd


OnMessageReceived Does not use parameter "receivedMessage" in switch statement

The definition of OnMessageReceived() has a parameter of type String called receivedMessage, The function should use this parameter for the switch statement, but instead uses m_ReceivedMessage,
Furthermore, OnMessageReceived() is only used once in the code, and it sends m_ReceivedMessage as the parameter anyways, making the parameter in the function definition redundant and unnecesary.
The code works as it is. but it would not work correctly if somebody, for example, was to simulate an incoming message by calling  OnMessageReceived() directly  ( I.E: OnMessageReceived("Close") will not close the client )

Good catch @emveor , you're completly right.
This project is like 2 years old and without updates ^^' I'll update it including your observation when I've enough time, thanks anyway!

Fixed with the latest update #d62613d8e5faa4e3598ef188e443b175deaa93b6


Add crds gate component

Related to: https://github.com/canonical/bundle-kubeflow/issues/951
This component will block the charm until the given CRDs are presented in the cluster.

Rejecting .. please check issue for more info


Playground: remove duplicate import

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.


Expand userlist support for other queries

Expand the support for an input list of usernames for scraping favorites, following, and followers of the listed usernames.
Without this patch, Twint with the following set of switches would fail:
python3 Twint.py --userlist list_of_users --followers

There are SyntaxError, please review


[helm create] Annotations

What this PR does / why we need it:
Eases the addition of annotations (e.g. prometheus.io/scrape: "true" or  "cluster-autoscaler.kubernetes.io/safe-to-evict": "true") for end user creating a chart.

cc @unguiculus @scottrigby you might be best placed to review this.

I agree with @unguiculus these make sense. However what about syntax… in some places we wrap these keys {{- with .Values.KEY }} (ingress.annotations, imagePullSecrets, nodeSelector, affinity, tolerations), but in other places we don't (resources). Should we be consistent about this while we're at it?

PS slightly related to some other keys in #5110

Good point @scottrigby , although wrapping with {{- with .Values.KEY }} is more popular, I like the approach used in resources because its 2 lines less.
But I'm open to whichever, please advise.

I'd suggest use with for consistency. Additional benefit is the key won't be part of the rendered template unless a user passes custom values.

Sounds good, should this be done for resources as well?

I'm not asking you to increase the scope of this small PR, but if you want to do that I'm a fan of consistency, especially when it's easy.

Sure @scottrigby not a problem, but while on the topic of consistency:
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
    {{- end }}

Should the {{- with align with the key or 2 spaces before it?
Also is everyone else on board with wrapping any  toYaml type thing with {{- with ? This will include resources,  securityContexts as well as the hereby added annotations?
@scottrigby just  playing devil's advocate: even if the rendered templates contain empty keys if values not et for the non {{-with-wrapped, when posted to the k8s api server the resulting objects will be the same. And going with the non-wrapped approach (as resources is e.g.) will result in way less lines and slightly more readable template imho.

bump

bump and OK I've wrapped all toYaml type stuff with with ...

This failed test seems unrelated

Merged master into this branch in hopes to pass the failed test.

Feel free to merge. :)

docs?

@bacongobbler Could we get these into helm 3 as well?

We're only porting changes that were merged into Helm 2 into Helm 3 at this time. Feature additions that weren't merged into Helm 2 will have to wait until Helm 3 is released; we're trying to avoid delaying the release of helm 3 by getting bogged down in features.

Hi, @naseemkullah - Thanks again for your work on this! To clarify, We're going to be cutting the last feature release for v2 soon, and this PR won't be in v2, so this one should be targeted to the dev v3 branch: https://github.com/helm/helm/tree/dev-v3. You probably also want to keep working with the charts maintainers. Thanks!

Thanks for clarifying @bridgetkromhout
Oh @bacongobbler was it not possible to change base branch  to dev-v3?

@naseemkullah Unfortunately no. You have to restart from the dev-v3 branch.

Ok no problem, thanks


No usage examples for NotParameterizedAttribute

In the Remarks section of the NotParameterizedAttribute doc page there is a link to Querying data with EF Core with a promise that usage examples may be found there.
However, the linked page does not even mention NotParameterizedAttribute. I've not been able to find examples anywhere else either.

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: 6ad641e7-eaa6-aab5-12f0-4de14dfc9f16
Version Independent ID: b55e8adf-f36e-65b5-e203-763be5895f5a
Content: NotParameterizedAttribute Class (Microsoft.EntityFrameworkCore.Query)
Content Source: dotnet/xml/Microsoft.EntityFrameworkCore.Query/NotParameterizedAttribute.xml
Product: ef-core-api
GitHub Login: @dotnet-bot
Microsoft Alias: avickers

[NotParameterized] is a low-level mechanism mostly intended for EF provider writers, it's very rarely needed by users; we unfortunately don't have the capacity to create usage examples for every feature, and concentrate on user-facing ones.

[NotParameterized] is a low-level mechanism mostly intended for EF provider writers, it's very rarely needed by users; we unfortunately don't have the capacity to create usage examples for every feature, and concentrate on user-facing ones.

That's understandable.
But in that case, could you remove the link from the Remarks section so as not to raise false hopes?!

The link in the remarks is a general link to the corresponding EF sections which we have in many API docs. It's true that we'd ideally document [NotParamerized] in that section of the docs, but the link is generally meant to make people aware that conceptual docs exist as a generally better alternative for understanding how things work at the high level. We've seen quite a few people stuck trying to understanding general query concepts by looking at API docs - these links are meant to help with that.


Schema hasn't been registered for model

I have two models Item and Order.
Since I need to use Order model find method inside Item model method I try to load the order model.
Now I get Schema hasn't been registered for model "Order".

Can you provide an example code snippet of what you're trying to accomplish? Understanding your requirement a bit more would be helpful.
The reason for the "Schema hasn't been registered" error, is that when the server-side configuration is loading the Mongoose models, it is done in alphabetical order. So at the time that Item is loading, Order hasn't been loaded into Mongoose.
There's probably a better way for you to accomplish what you're trying to do. If all you need is for the Order to be loaded with the Item document, then you could be able to simply use the .populate() method on your Item model queries (assuming you have a referenced field for Order).


[Bug] dbt clone sends errors to stderr instead of stdout

Is this a new bug in dbt-core?

[X] I believe this is a new bug in dbt-core
[X] I have searched the existing issues, and I could not find an existing issue for this bug

Current Behavior
Any errors that occur while running dbt clone are written to stderr instead of stdout.
Expected Behavior
Any errors that occur while running dbt clone are written to stdout, which is the case for other dbt commands.
Steps To Reproduce

Modify a project so that an error occurs. In my case I added a non-existent doc ref for a column in a model so that a parsing error occurs
Run dbt parse 1>out.txt 2>err.txt. The out.txt file contains the whole output including the error while err.txt is empty
Run dbt clone 1>out.txt 2>err.txt. The out.txt file contains the non-error dbt output and err.txt contains the error and stacktrace

Relevant log output
No response
Environment
- OS: MacOS Sonoma 14.4.1, Debian 10
- Python: 3.11.9
- dbt: 1.7.1

Which database adapter are you using with dbt?
No response
Additional Context
Possibly related: errors during dbt clone are not written to the dbt.log file.

Thanks for reporting this @jp-dbt !
Root cause
It appears that the root cause is dbt clone failing to capture the underlying exception and redirect it to the logs. Rather, the  exception is being raised directly to the user via standard error (stderr).
See below for the details of an extremely simple reproducible example.

Reprex

Replace postgres below with the name of your dbt connection profile. The last line is invalid, and it will raise an error for most dbt commands.
dbt_project.yml
name: "my_project"
profile: "postgres"

give_me: an_error

Run these commands:
dbt parse 1>parse-out.txt 2>parse-err.txt
dbt clone 1>clone-out.txt 2>clone-err.txt

Expected output
Here's what the contents of *-out.txt should be for nearly every command:
[0m15:36:22  Running with dbt=1.8.0
[0m15:36:22  Encountered an error:
Runtime Error
  at path []: Additional properties are not allowed ('give_me' was unexpected)

Error encountered in /path/to/dbt/project/dbt_project.yml

But dbt clone has a big Python stacktrace in *-err.txt instead:
Traceback (most recent call last):
  File "/Users/dbeatty/projects/environments/dbt_1.8/bin/dbt", line 8, in <module>
    sys.exit(cli())
...
  File "/Users/dbeatty/projects/environments/dbt_1.8/lib/python3.10/site-packages/dbt/config/project.py", line 390, in create_project
    raise ProjectContractError(e) from e
dbt.exceptions.ProjectContractError: Runtime Error
  at path []: Additional properties are not allowed ('give_me' was unexpected)

Error encountered in /path/to/dbt/project/dbt_project.yml

Checking other dbt commands
Here's the script that I used to test a large range of dbt commands (pretty much everything but dbt init, I think:

check_stdout_and_stderr.sh

#!/bin/bash

# Define an array of dbt commands
commands=(
    "build"
    "clean"
    "clone"
    "compile"
    "debug"
    "deps"
    "list"
    "parse"
    "retry"
    "run"
    "run-operation"
    "seed"
    "show"
    "snapshot"
    "test"
    "docs generate"
    "docs serve"
    "source freshness"
    "source snapshot-freshness"
)

# Loop through each command in the array
for cmd in "${commands[@]}"; do
    echo "Running dbt $cmd..."

    # Replace spaces with hyphens for file names
    filename=$(echo "$cmd" | tr ' ' '-')

    # Execute dbt with the current command, redirect stdout and stderr to files
    dbt $cmd 1>${filename}-out.txt 2>${filename}-err.txt

    # Use wc to count lines, words, and characters in output and error files
    wc ${filename}-out.txt
    wc ${filename}-err.txt
done

Run these commands:
chmod +x check_stdout_and_stderr.sh
./check_stdout_and_stderr.sh

Output

Running dbt build...
       6      25     267 build-out.txt
       0       0       0 build-err.txt
Running dbt clean...
       6      25     267 clean-out.txt
       0       0       0 clean-err.txt
Running dbt clone...
       1       4      41 clone-out.txt
     600    1584   47342 clone-err.txt
Running dbt compile...
       6      25     267 compile-out.txt
       0       0       0 compile-err.txt
Running dbt debug...
      43     154    1803 debug-out.txt
       0       0       0 debug-err.txt
Running dbt deps...
       6      25     267 deps-out.txt
       0       0       0 deps-err.txt
Running dbt list...
       6      25     267 list-out.txt
       0       0       0 list-err.txt
Running dbt parse...
       6      25     267 parse-out.txt
       0       0       0 parse-err.txt
Running dbt retry...
       6      25     267 retry-out.txt
       0       0       0 retry-err.txt
Running dbt run...
       6      25     267 run-out.txt
       0       0       0 run-err.txt
Running dbt run-operation...
       0       0       0 run-operation-out.txt
       4      15     112 run-operation-err.txt
Running dbt seed...
       6      25     267 seed-out.txt
       0       0       0 seed-err.txt
Running dbt show...
       6      25     267 show-out.txt
       0       0       0 show-err.txt
Running dbt snapshot...
       6      25     267 snapshot-out.txt
       0       0       0 snapshot-err.txt
Running dbt test...
       6      25     267 test-out.txt
       0       0       0 test-err.txt
Running dbt docs generate...
       6      25     267 docs-generate-out.txt
       0       0       0 docs-generate-err.txt
Running dbt docs serve...
       6      25     267 docs-serve-out.txt
       0       0       0 docs-serve-err.txt
Running dbt source freshness...
       6      25     267 source-freshness-out.txt
       0       0       0 source-freshness-err.txt
Running dbt source snapshot-freshness...
       6      25     267 source-snapshot-freshness-out.txt
       0       0       0 source-snapshot-freshness-err.txt


RedirectHTTP: return after calling http.Error

No one should be using this library anymore.
https://godoc.org/rsc.io/letsencrypt#hdr-Warning


change task background to red

With this pull request we're going to change the Task.js background to red

合并加入


Targets with identical names in multiple remote repositories conflict

I get an error like this:
$ bazel build ...
ERROR: file '_middlemen/_Ctarget' is generated by these conflicting actions:
Label: @b_repository//:target, @a_repository//:target
RuleClass: filegroup rule
Configuration: 23de93dc7bcaa286623e318ca2a05cd2
Mnemonic: Middleman
Progress message: (null)
MandatoryInputs: attempted action contains artifacts not in previous action and previous action contains artifacts not in attempted action: [Artifact:[/home/brian/.cache/bazel/_bazel_brian/442c1c4afe824394ccb4e9b66b2e2d84[source]]external/b_repository/file.c], [Artifact:[/home/brian/.cache/bazel/_bazel_brian/442c1c4afe824394ccb4e9b66b2e2d84[source]]external/a_repository/file.c]
Outputs: are equal
.
ERROR: Analysis of target '@b_repository//:target' failed; build aborted.
INFO: Elapsed time: 0.189s

My minimal test case which produced the above error has 3 files in the workspace and a zip file with 1 file in it. Here's the contents of all the files in the workspace:
WORKSPACE:
new_http_archive(
  name = 'a_repository',
  url = 'file:///tmp/test.zip',
  sha256 = '749be30519952a2d0397e11219b992a45cb4d7f51f9dccf16d512bdafac9191c',
  build_file = 'BUILD.repository',
)

new_http_archive(
  name = 'b_repository',
  url = 'file:///tmp/test.zip',
  sha256 = '749be30519952a2d0397e11219b992a45cb4d7f51f9dccf16d512bdafac9191c',
  build_file = 'BUILD.repository',
)

bind(
  name = 'a_remote',
  actual = '@a_repository//:target',
)

bind(
  name = 'b_remote',
  actual = '@b_repository//:target',
)

BUILD:
cc_library(
  name = 'output',
  srcs = [
    '//external:a_remote',
    '//external:b_remote',
  ],
)

BUILD.repository:
package(default_visibility = ['//visibility:public'])
filegroup(
  name = 'target',
  srcs = [ 'file.c' ],
)

/tmp/test.zip contains only an empty file named file.c at the top level.
I'm not succeeding at reproducing the issue using binds from local targets in the WORKSPACE file, but I might be missing something.

Reproduced with http_file()...

Blocking me so I will fix it.

oops wrong bug number in description


Fixes #794 go to definition (F12) on sympy

Fixes #794 go to definition (F12) on sympy
Adds special handling for non-variables to enable go-to-definition and relevant tooltips when they are module names.

👍


az ssh vm fails with "parent_window_handle is required" error, only on some Windows VMs

Describe the bug
I'm having an odd error with az ssh vm failing on only some of my VMs.
On a few VMs, call them srv-1 and srv-2, when I run az ssh vm -g <group> -n <name> after a successful az login, it fails with the following error, complaining that "". It happens for any remote target VM I try to connect to, and I think has been happening for the entire lifetime of the affected VMs. It doesn't occur on my other VMs, and I have not been able to reproduce it on other VMs. Both VMs where it fails are running Windows 11 Enterprise Multi-Session 23H2, and were built from the "win11-23h2-avd-m365" VM image.
C:\>az ssh vm --prefer-private-ip -g my-group -n lx-1
(pii). Status: Response_Status.Status_InteractionRequired, Error code:<PHONE_NUMBER>, Tag: 558133255

The default web browser has been opened at https://login.microsoftonline.com/aa04c913-a37b-4cfb-9516-7fc58bd3b82c/oauth2/v2.0/authorize for scope 'https://pas.windows.net/CheckMyAccess/Linux/.default'. Please continue the login in the web browser.
The command failed with an unexpected error. Here is the traceback:
parent_window_handle is required when you opted into using broker. You need to provide the window handle of your GUI application, or use msal.PublicClientApplication.CONSOLE_WINDOW_HANDLE when and only when your application is a console app.
Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/msal_credentials.py", line 68, in get_token
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 149, in check_result
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 53, in aad_error_handler
azure.cli.core.azclierror.AuthenticationError: (pii). Status: Response_Status.Status_InteractionRequired, Error code:<PHONE_NUMBER>, Tag: 558133255

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 666, in execute
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 733, in _run_jobs_serially
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 703, in _run_job
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 336, in __call__
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
  File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 65, in ssh_vm
    _do_ssh_op(cmd, ssh_session, op_call)
  File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 178, in _do_ssh_op
    op_info.cert_file, op_info.local_user = _get_and_write_certificate(cmd, op_info.public_key_file,
                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 232, in _get_and_write_certificate
    certificatedata = credential.get_token(*scopes, data=data)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/credential_adaptor.py", line 66, in get_token
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/credential_adaptor.py", line 38, in _get_token
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/msal_credentials.py", line 84, in get_token
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\msal/application.py", line 2112, in acquire_token_interactive
ValueError: parent_window_handle is required when you opted into using broker. You need to provide the window handle of your GUI application, or use msal.PublicClientApplication.CONSOLE_WINDOW_HANDLE when and only when your application is a console app.
To check existing issues, please visit: https://github.com/Azure/azure-cli/issues

RG and server names here have been replaced with placeholders, to avoid exposing private info.
This is with az CLI version 2.65.0 and ssh extension 2.0.6. It also happened with azure-cli 2.65.0 and (I think) ssh extension 2.0.5, and on older versions too. The affected VM has been in existence since June, and as far as I can remember, az ssh vm run on that VM has been failing the whole time.
I have only seen this occur on Windows 11 Multi-Session 23H2. But I haven't been able to reproduce it on a freshly-created Win 11 Multi-Sesh 23H2 VM, so I don't know if the OS version is important. The error isn't happening on other VMs I've tested in this Azure tenant, running Windows 11 (non-multi-sesh) 24H2, Win 11 Multi-Sesh 24H2, Windows Server 2025. All these VMs are domain-joined to our Entra DS AD domain. All the VMs are kept up to date with Windows Update.
I've tried upgrading azure-cli and the ssh extension, uninstalling and reinstalling the ssh extension, and fully uninstalling and reinstalling azure-cli.
The error is also not happening for some other users on the affected srv-1 VM. I've tested with other Windows users using other Azure user accounts, and other Windows users using the same Azure user account as my main user it happens for. Neither of them encountered the error.
There are several programs installed on the affected VMs, including both Microsoft and third-party applications, and Anaconda (Miniforge, actually).
Related command
az ssh vm
Errors
I've replaced the RG, VM name, and user name with placeholders here, for privacy.
C:\>az ssh vm --prefer-private-ip -g my-group -n lx-1
(pii). Status: Response_Status.Status_InteractionRequired, Error code:<PHONE_NUMBER>, Tag: 558133255

The default web browser has been opened at https://login.microsoftonline.com/aa04c913-a37b-4cfb-9516-7fc58bd3b82c/oauth2/v2.0/authorize for scope 'https://pas.windows.net/CheckMyAccess/Linux/.default'. Please continue the login in the web browser.
The command failed with an unexpected error. Here is the traceback:
parent_window_handle is required when you opted into using broker. You need to provide the window handle of your GUI application, or use msal.PublicClientApplication.CONSOLE_WINDOW_HANDLE when and only when your application is a console app.
Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/msal_credentials.py", line 68, in get_token
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 149, in check_result
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 53, in aad_error_handler
azure.cli.core.azclierror.AuthenticationError: (pii). Status: Response_Status.Status_InteractionRequired, Error code:<PHONE_NUMBER>, Tag: 558133255

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 666, in execute
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 733, in _run_jobs_serially
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 703, in _run_job
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 336, in __call__
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
  File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 65, in ssh_vm
    _do_ssh_op(cmd, ssh_session, op_call)
  File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 178, in _do_ssh_op
    op_info.cert_file, op_info.local_user = _get_and_write_certificate(cmd, op_info.public_key_file,
                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 232, in _get_and_write_certificate
    certificatedata = credential.get_token(*scopes, data=data)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/credential_adaptor.py", line 66, in get_token
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/credential_adaptor.py", line 38, in _get_token
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/msal_credentials.py", line 84, in get_token
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\msal/application.py", line 2112, in acquire_token_interactive
ValueError: parent_window_handle is required when you opted into using broker. You need to provide the window handle of your GUI application, or use msal.PublicClientApplication.CONSOLE_WINDOW_HANDLE when and only when your application is a console app.
To check existing issues, please visit: https://github.com/Azure/azure-cli/issues

Issue script & Debug output
I'm not sure how to remove all of the sensitive information from debugs here. There seem to be a lot of account and user identifiers, and I don't know what all might be sensitive.
Expected behavior
An SSH connection to the remote machine is opened.
Environment Summary
C:>az --version
azure-cli                         2.67.0
core                              2.67.0
telemetry                          1.1.0
Extensions:
ssh                                2.0.6
Dependencies:
msal                              1.31.0
azure-mgmt-resource               23.1.1
Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\John.Doe.azure\cliextensions'
Python (Windows) 3.12.7 (tags/v3.12.7:0b05ead, Oct  1 2024, 03:06:41) [MSC v.1941 64 bit (AMD64)]
Legal docs and information: aka.ms/AzureCliLegal
Your CLI is up-to-date.
Additional context
No response

Thank you for opening this issue, we will look into it.


Demos do not work on newest Google Chrome

Newest google chrome only work on single characters

Thank you for reporting. The Google Chrome v 59.x issue is resolved.

I can confirm that. Well done :)


Added Problem C of Round G and Round F

Great work @anj20 please give this repo a star if it really helped you to complete your PR.
Also follow me for follow back if you want to get connected with me for any such open source contribution program. Thank you 😊


Proposed corrections

3 proposed corrections

There are 3 links at the end of the following section that offer suggestions on how to clean up finance and operations data:

https://docs.microsoft.com/en-us/power-platform/admin/finance-operations-storage-capacity#actions-to-take-for-a-finance-and-operations-capacity-deficit
Of the 3 suggestions listed, Archive Inventory transactions will not free up storage space. This particular process moves data from one table (InventTrans) to another table (InventTransArchive) in the same database. While this results in performance improvement of reports or processes that access the InventTrans table, it does not result in storage reduction. Suggest that this link be removed.

This question in FAQ:

https://docs.microsoft.com/en-us/power-platform/admin/finance-operations-storage-capacity#how-are-my-usage-and-entitlement-calculated
Suggested response:
Finance and operations includes default capacity entitlement plus accrued capacity entitlement based on each operations base enterprise and activity license. Refer to the Capacity Licenses section of the Dynamics 365 License Guide for more details. https://www.microsoft.com/en-us/licensing/product-licensing/dynamics365

This question in FAQ:

https://docs.microsoft.com/en-us/power-platform/admin/finance-operations-storage-capacity#is-the-multiple-lifecycle-services-lcs-projects-multiple-production-in-one-tenant-scenario-considered-in-all-the-aspects-of-storage-calculation-and-reporting-sometimes-we-have-many-projects-with-multiple-lcs-in-one-tenant
Suggest that question be rephrased as follows:
We have multiple LCS Projects on our Tenant with each having its own production and sandbox environment. How does storage reporting work in this case?
With suggested answer:
Storage reporting reports usage at the tenant and environment level. All environments in all LCS Projects on the tenant will be included in storage reporting.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 01b9ac04-1944-45c2-2137-d609a9e1199f
Version Independent ID: 01b9ac04-1944-45c2-2137-d609a9e1199f
Content: Finance and operations storage capacity - Power Platform
Content Source: power-platform/admin/finance-operations-storage-capacity.md
Service: power-platform
Sub-service: admin
GitHub Login: @jimholtz
Microsoft Alias: jimholtz

Taking to internal thread.


fix:(plugin): all store state $subscribe watch callback fire when def…

fix: every store state $subscribe watch callback execute when run defineStore to  setup a new store
The situation now:

for example:

there was store-A, store-B
run defineStore to setup store-C
$subscribe callback execute , store-A, store-B change too

  import { createPinia, PiniaPluginContext } from 'pinia'

  const plugin = (context: PiniaPluginContext) => {
    context.store.$subscribe(
      (mutation, state) => {
        //
      }
    )
  }

  const pinia = createPinia()
  pinia.use(plugin)

What to Expect

there was store-A, store-B
run defineStore to setup store-C
$subscribe callback execute , but store-A, store-B  not change, only store-C change

Can you provide a repro or failing tests?

Closing due to inactivity. Please open a new issue with a reference to this one if you can follow up with more information.


gRPC for Microservice communication

Very very draft PR
Is this the right type of content we want?
It's meant to be a multi-part series of articles about gRPC at Sidekicker.
I'm trying to write these so that they appeal to the type of person who wants to deep dive into how all this stuff works on technical level.... basically by just asking "what if..." questions. I figure the blog is for getting new engineers... and those are the type of engineers we want, right.
It still needs a lot of polishing regardless (especially double checking that the technical stuff I wrote is even correct).
Also most of this is just me writing out my interepretation of protobuf docs.
Part 1 is for someone who knows about REST APIs... but nothing of gRPC. I suppose it's how I would of liked it explained to me when I started.
Part 2 targeted to a junior that's got some basic code knowledge (maybe a bootcamp or just some frontend HTML/CSS/JS experience)... but no CS background.
Part 3 I will get to eventually ... but maybe Wesley would like to do part 4.

@tristankenney @jltxwesley @Toofifty at your leisure, could I get some feedback on whether I'm heading in the right direction with this.


Minigraph is misleading as it is not an acute representation of the trends.

The minigraph shown on the page is misleading since it shows a change in the number of active cases (or any other parameter), but the slope of the graph at that point should depend on the total number of people tested.
If the motive of minigraph is to show trends, then the current metrics are not the true representation of the trends and just show the change in data from the previous day.
The metrics can be improvised, here is a case study where the graph is performing poorly on showing a correct trend, considering the live data from the webpage:
For example on 09 June 2020, the graph shows a decline in the number of active cases and also confirmed cases:
Comparing the change from previous day:
On 8th June, the ratio of No. of people tested to the no. of confirmed cases is 13.05
On 9th June, the ratio of No. of people tested to the no. of confirmed cases is 12.79
This is misleading for a trend because for every 12.79 people tested we see that there is 1 confirmed case found, this means the graph should go upwards relatively, as a trend because earlier it was 1 confirmed case for every 13.05 people tested, the relative change is, in fact, greater.
Also, on 8th June, the ratio of no. of confirmed cases to the no. of active cases is 2.04,
and on 9th June, the ratio of confirmed cases to the no. of active cases is 2.88.
Although this change is not dramatic, the minigraph shows a sharp decline in the trend of active cases.
A possible fix would be to make the data relative accordingly or change the evaluation metrics.

In the first part, what you're essentially saying is that instead of using the daily confirmed count as the basis for the confirmed minigraph (trends), we should instead use the Test positivity rate (TPR), since, in theory, it should be a better indicator of how much the virus is spreading.
While I agree with the intention, I'm not a fan of adding more complexity to the way any metric/graph is calculated on the website. Even with a relatively simple thing like Active cases, we've already had a tough time explaining what they actually represent. Any heuristic-based normalization of the charts which is difficult to interpret on face-value will just add to the confusion.
As an example, normalizing based on total tests only makes sense for the Confirmed count. For active/recovered/deceased, we would rather have to normalize based on either their previous values or the Confirmed count at that time. This makes the calculations asymmetric, adding to the complexity again. I'll be happy to make a change if there's an elegant way to get around this.


K8SPXC-133 - Add template for PITR backup/restore

 ❨?❩

Test name
Status

big-data
passed

haproxy
passed

recreate
passed

storage
passed

upgrade-haproxy
passed

scaling
passed

self-healing
passed

init-deploy
passed

scaling-proxysql
passed

restore-to-encrypted-cluster
passed

security-context
passed

upgrade-proxysql
passed

limits
passed

self-healing-advanced
passed

monitoring-2-0
passed

demand-backup
passed

operator-self-healing
passed

smart-update
passed

affinity
passed

one-pod
passed

auto-tuning
passed

proxysql-sidecar-res-limits
failed

scheduled-backup
failed

users
passed

upgrade-consistency
passed

tls-issue-self
passed

tls-issue-cert-manager
passed

tls-issue-cert-manager-ref
passed

validation-hook
passed

demand-backup-encrypted-with-tls
failed

Test name
Status

big-data
passed

haproxy
passed

recreate
passed

storage
passed

upgrade-haproxy
passed

scaling
passed

self-healing
passed

init-deploy
passed

scaling-proxysql
passed

restore-to-encrypted-cluster
passed

security-context
passed

upgrade-proxysql
passed

limits
passed

self-healing-advanced
passed

monitoring-2-0
passed

demand-backup
passed

operator-self-healing
passed

smart-update
passed

affinity
passed

one-pod
passed

auto-tuning
passed

proxysql-sidecar-res-limits
failed

scheduled-backup
failed

users
passed

upgrade-consistency
passed

tls-issue-self
passed

tls-issue-cert-manager
passed

tls-issue-cert-manager-ref
passed

validation-hook
passed

demand-backup-encrypted-with-tls
failed


_index.md will now be displayed on "/" if present

I wanted to change the root page. I saw that creating a page content/_index.md did not render.
Now if a content/_index.md exists it gets rendered. Else the old behavior is rendered

Hi @jpolack,
Thanks for taking the time to go through and make the additions. I think that these changes make sense to exist as template overrides (theme overrides) instead of included directly into the theme.  I'd like to keep the base as generic as possible with the intent that users can fork and override any specific portions.


(Linux) Implement GetProcessUsedMemory().

In progress.

Issue is closed automatically by CI. Commit: 9d60d1e897bce4c72f07d74ac60f48a32e3259c2


Open OrbStack with Error 9 .

Describe the bug
I can't open the orbstack after I update it. It show me error 9.

Screenshots

Logs
Attach log files by opening OrbStack's Help menu and clicking “Show Logs”, or email them for privacy.
PLEASE ATTACH THE ENTIRE LOG FILE WITHOUT REMOVING ANY LINES. There is usually important context earlier in the log.
Info report

➜  ~ orb report
OrbStack info:
  Version: 0.13.0 (130000)
  Commit: ba57f21d6c60d45e0469196f4a67c79ec9911eea (v0.13.0)

System info:
  macOS: 13.4.1 (22F82)
  CPU: arm64, 10 cores
  CPU model: Apple M1 Max

---------------- [ cut here ] ----------------

Please copy and paste the above information into your bug report.
Open an issue here: https://github.com/orbstack/orbstack/issues/new/choose

Additional context
I remove the software and reinstall it. Also install it from brew. All failed.

Does it work if you start it from the command line with the orb command?

Does it work if you start it from the command line with the orb command?

Yes, that's the solution. It prompts out the accessing requirement window, and I enter the password, and it works. Thank you very much.

That's odd. Can you stop it and try starting it from the app again? The error shouldn't have happened in the first place.

That's odd. Can you stop it and try starting it from the app again? The error shouldn't have happened in the first place.

Yes. It's OK now,  starting from app with no error.


Fix invalid address configured for STUN server in netbird management service

There is a misconfiguration in the netbird management service in the test environment and the local deployment environment.
Code location:

Local deployment
Test environment

Impact:
Peer connections may not be established when a direct connection is not possible and the relay server (coturn) is to be used.
References:

STUN - Session Traversal Utilities for NAT
TURN - Traversal Using Relays around NAT
Coturn - coturn is a free open source implementation of TURN and STUN Server. The TURN Server is a VoIP media traffic NAT traversal server and gateway.
Netbird infrastructure templates

Turnserver
Management configuration

[ ] Add new config parameters