[WIP] Unskip authz tests for multi-cluster

[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[x] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Pull Request Attributes
Please check any characteristics that apply to this pull request.
[ ] Does not have any changes that may affect Istio users.

@JimmyCYJ: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-multicluster-tests_istio
4818819e1775374f647482107aa21edb12352776
link
/test integ-security-multicluster-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@JimmyCYJ: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-telemetry-k8s-tests_istio
effdde80b30711e0828672d0f76e282261b9f6ba
link
/test integ-telemetry-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@JimmyCYJ: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-telemetry-k8s-tests_istio
effdde80b30711e0828672d0f76e282261b9f6ba
link
/test integ-telemetry-k8s-tests_istio

integ-telemetry-mc-k8s-tests_istio
effdde80b30711e0828672d0f76e282261b9f6ba
link
/test integ-telemetry-mc-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test integ-telemetry-k8s-tests_istio
/test integ-telemetry-mc-k8s-tests_istio

@JimmyCYJ: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-telemetry-mc-k8s-tests_istio
effdde80b30711e0828672d0f76e282261b9f6ba
link
/test integ-telemetry-mc-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test integ-telemetry-mc-k8s-tests_istio

In response to a cherrypick label: #31620 failed to apply on top of branch "release-1.9":
Applying: unskip authz tests for multi-cluster
Using index info to reconstruct a base tree...
M	tests/integration/security/authorization_test.go
Falling back to patching base and 3-way merge...
Auto-merging tests/integration/security/authorization_test.go
CONFLICT (content): Merge conflict in tests/integration/security/authorization_test.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 unskip authz tests for multi-cluster
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to a cherrypick label: new issue created for failed cherrypick: #31657


[Question] makeMarkdown to strip non-formatting tags

Hi,
I'm trying to use makeMarkdown() to create "clean" markdown. More specifically to strip any tags that don't have markdown equivalents. Similar to PHPLeague's HTML-to-Markdown options 'strip_tags' and 'hard_break'.
I've looked through the wiki and getOptions() functions but couldn't find anything similar.
Is this possible through an extension/flavor with showdownjs?

Did you find a solution? Thanks.

I had luck with https://github.com/domchristie/turndown


horizon changes for routergrid fix

Reviewer: @kjiang @xinwu
DONOT MERGE
this is just for reference and review as of now. once all changes are final, i will post a comment.

this is now part os horizon plugin. safe to remove.


Alternative chassis design RFC

I'm working on a metal chassis design

Basically, I'd like to make it low-cost, durable and mountable. The current design consists of two parts, each can be produced with sheetmetal (304, 6061 etc.)
Potential problems:

The screw tap hole "ears" are less than optimal. May consider bend the whole edge instead of cutting those 6 ears.
Screen height?
No power switch hole...

Back:

Close-in of one of the ears (which might be a problem, cuts finger, etc.):

Some by-product that might be useful:

Woah. Cool. That 3D model is excellent.
The base of the screen pcb should be approximately 6mm above the height of the mainboard pcb (ignoring any components).

Adjusting the design -- should be 1mm taller 😅
Could I upload the board 3D model to this repo?

Forgot to say. https://github.com/jmamma/MegaCommand_Design is the hardware repo.
Any hardware related designs should be uploaded there.

Wilco!


Babel 7 Support

This plugin still depends on babel-core 6.23. Any possibility of updating to @babel/core instead?

@dangodev please wait new release (will be in near future)

@evilebottnawi any news?

I'm not so sure this is stable with babel 7.2.2 and webpack 4.29... Using the above workaround I get:
    ERROR in Cannot read property 'isPure' of null

If I add to the plugin options removeUndefined: false it works around that, but then something else fails:
    ERROR in Cannot read property 'getBinding' of null

Sorry, don't have time on this right now, my todo list is very big :disappointed:

I'm seeing:
ERROR in Couldn't find intersection

ERROR in Couldn't find intersection

ERROR in Couldn't find intersection

ERROR in Couldn't find intersection

ERROR in Couldn't find intersection

ERROR in Couldn't find intersection

ERROR in Couldn't find intersection

ERROR in don't know how to turn this value into a node

config:
new MinifyPlugin({}, {
  babel: require("@babel/core"),
  minifyPreset: require("babel-preset-minify")
})

I've tried a variation, copying @wangqs1990 suggestion, same result:
new MinifyPlugin({
  builtIns: false,
  mangle: { topLevel: true }
}, {
  babel: require("@babel/core"),
  minifyPreset: require("babel-preset-minify")
})

Hi @gknapp,
I am experiencing the exact same isssues as you with Webpack 4.29.6 and Babel 7.
Have you found any fixes or any ways to bypass those errors messages ?

@jsauca I aborted switching to this plugin for minification and returned to uglifyjs-webpack-plugin.
I read this plugin produced better minified code but couldn't get it to work. Chrome inspector's coverage reports drove me to try and seek smaller build sizes - it appears to be somewhat common for reactjs based web app to only have ~50% code coverage / usage.
I've read including node_modules in production build configs could eliminate a lot of dead / unused code.

Looks like I have kind of similar issue as @gknapp has, breaks on adding @babel/core as custom 'babel' field value.

ERROR in Cannot read property 'isPure' of null
ERROR in Cannot read property 'isProgram' of null
"webpack": "^4.29.6" , "@babel/core": "^7.4.3"

I tried this and other various tweaks to try and eliminate any unused code. I already had webpack in production mode, I found no difference in bundle size by including node_modules.

I've read including node_modules in production build configs could eliminate a lot of dead / unused code.

I would like to re-enable this plugin, but whenever I do, and try to build, the build process just gets stuck in limbo without any output. Is this issue being worked on?


Reindex error: Error: Request Timeout after 30000ms (elasticsearch 6.0.1)

I need help !  I'm using elasticsearch 6.0.1 and I'm trying to run this command:
elasticsearch-reindex -f http://****-****-****:9200/datapatient/patient -t http://localhost:9200/datapatientnew/patient
But I get an error: Reindex error: Error: Request Timeout after 30000ms
I also tried to run the following command from head plugin of my local machine:
_ reindex

{
  "source": {
    "remote": {
      "host": "http://****-****-****:9200",
    },
    "index": "datapatient",
    "type": "patient"
  },
  "dest": {
    "index": "datapatientnew"
  }
}

And i got an error too:

{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "Remote responded with a chunk that was too large. Use a smaller batch size."
}
],
"type": "illegal_argument_exception",
"reason": "Remote responded with a chunk that was too large. Use a smaller batch size.",
"caused_by": {
"type": "content_too_long_exception",
"reason": "entity content is too long [523680994] for the configured buffer limit [104857600]"
}
},
"status": 400
}

But when trying the same command with an index containing fewer documents, it works well
There is any way to increase timeout value ?

Hello.
I have a similar issue trying to reindex from a 1.7 ES to a 6.3.1 ES. My index is very large (a lot of of GB) but I tried to separate it in a easy to use way (separate it in dates), more or less with a 15.000.000 documents per script execution.
After a few hours the Reindex error: Error: Request Timeout after 30000ms error occurs.
Kind regards,
Miguel.

As you can see here https://github.com/garbin/elasticsearch-reindex/blob/master/bin/elasticsearch-reindex.js#L46 you can use -o TIMEOUTVALUE or --request_timeout TIMEOUTVALUE to increase the limit.

I solved this problem by set the size to 100
https://github.com/elastic/elasticsearch/issues/21185
This memory limit really needs to be configurable. The limit that's currently in place makes remote reindexing a nightmare. I have one of two options:
Option 1:
Reindex all the indexes with a size of 1 to ensure I don't hit this limit. This will take an immense amount of time because of how slow it will be.
Option 2:
Run the reindex with size of 3000. If it fails, try again with 1000. If that fails, try again with 500. If that fails, try again with 100. If that fails, try again with 50. If that fails, try again with 25......... (the numbers here don't matter but the point is -- with an index dozens of gigabytes, I can't be sure what the maximum size that I can use is without actually running the reindex).
If the limit can't be changed due to other issues that it would cause, then is it possible to add the ability to resume a reindex instead of having to start over every time? Thank you!


.Net 3.1 image security update about [DSA 5111-1] zlib security update

Description
We are using mcr.microsoft.com/dotnet/aspnet:3.1 image as our base image. Recently, we always get the report from S360 that the image need security update of https://lists.debian.org/debian-security-announce/2022/msg00079.html.
We want to confirm that whether the latest image contains the update. if not, will it be contained later?
Configuration

Regression?

Other information

@MichaelSimons @mthalman could you please take a look at this one?

Yes, the latest version of the image contains the fixed version:
$ docker pull mcr.microsoft.com/dotnet/aspnet:3.1
3.1: Pulling from dotnet/aspnet
Digest: sha256:1687e296970d9123b1d67d79ca01b871024f66d851defc50d207346e01c68096
Status: Image is up to date for mcr.microsoft.com/dotnet/aspnet:3.1
mcr.microsoft.com/dotnet/aspnet:3.1

$ docker run --rm mcr.microsoft.com/dotnet/aspnet:3.1 apt list zlib1g

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Listing...
zlib1g/now 1:1.2.11.dfsg-1+deb10u1 amd64 [installed,local]

According to https://security-tracker.debian.org/tracker/CVE-2018-25032, 1:1.2.11.dfsg-1+deb10u1 is the fixed version:

thanks @mthalman, closing this for now as the original question was answered. @LianwMS feel free to reopen if you have any follow up questions.

Late to the party, but zlib didn't fix the vuln until version 1.2.12: https://github.com/madler/zlib/blob/master/ChangeLog#L59
Is zlib1g a fork of the zlib project or something?


Requiring 'le' file when adding gem.

Requiring 'le' file when adding gem. Le isn't autoloaded without this, leading to an error.

Hi @hlmerscher, good one. What do you think of changing the package name to r7insight instead? That way we won't need require le

That would be even better @stopal-r7.

I don't believe this is relevant anymore, but if it is feel free to open another PR :)


Allow players to pin messages

Is your feature request related to a problem? Please describe.
Sometimes players want to pin their messages so that others can reference them easier on their turns. It seems that's not possible now and only GM can pin the messages.
Describe the solution you'd like
Player can right click a message and pin it, same as GM.

I don't think this is possible without adding the socketlib library. Foundry doesn't allow manipulation of the chat data unless you are an assistant or GM, and the configuration of those permissions aren't available. I don't think I want to add socketlib just for this one feature... Perhaps if another use case arises, I'll consider it again.


BibIndex: tag.recjsonvalue NOT NULL

Complements upgrade recipe invenio_2014_08_13_tag_recjsonvalue by
adding the further property NOT NULL to the tag.recjsonvalue column
definition.
(closes #1947)

Signed-off-by: Samuele Kaplun<EMAIL_ADDRESS>

FYI I'm changing milestone to v1.2.0, since most people upgrading from v1.1.5 would be bitten by this...

Thanks, amended as discussed, and merged as e128e971e980a4e98637953909a27415701f00db.


[ASK] Is it possible to change an Author?

Good day. I've found that my recent commit's email address is "magic12#"(Unknown)
It's my mistake. In fact, this is my password and I've changed it immediately.
So, if allowed, I would like to change the author email address of previous commit to my original address. But I'm not sure can be alowed of such type of PR.
Could I ask to review it? Of course, If it does not permitted, I will close this PR
Sorry for confusing

Given the warning here:
https://help.github.com/articles/changing-author-info/
I'm not sure we should change the commit author for the two commits that have this issue.
I'm also not sure what this pull request does since it shows diffs that have already been applied, so unclear to me the affect it would have on the repo history. What git commands were used to generate it?

@Cazen It's great to have you active in the community, as you hopefully become more active you should consider filing an Individual Contributor License Agreement  (ICLA) with Apache Software Foundation, if you haven't already. I looked a while ago and didn't see one listed for you. The ICLA would be required for a committer.
See: http://quarks.incubator.apache.org/docs/community
FYI  - your existing commits have the e-mail listed as<EMAIL_ADDRESS>rather than the e-mail displayed for the @Cazen account, which is also different to the e-mail used to post to the list.

Good Day @ddebrunner I've already seen that pages you mentioned and generated this PR under that command.
I also read WARNING phrase. So I think it's better that do not allow the change author operation unless anyone have previous experience like this situation. Since it is the first time to me involved in a large-scale opensource project using git, I was wondering if this type of operation is permitted.
And thank you for your consideration. My email address both<EMAIL_ADDRESS>and<EMAIL_ADDRESS>are linked with github. I will fill the ICLA form and submit soon.


Add badges

Please, add GitHub badges (like, build passing, code coverage, ...).

Duplicate of #

No, badges are a security concern. We are planning to purge the markdown in the README completely.


"OS class" vs "resource profile" - What schema?

Great to see the scope of the common templates being replicated.
While I do wonder if we have any diff between the common templates and common instanceTypes, this epic is about how to structure the instance types.
In common-templats server, desktop, and highperformance were used as workload profiles.
This classification was done in order to reflect the different requirements of these workloads.
However, I wonder - I'd even argue - that server and desktop are not the /real/ workload types. The /real/ workload types are instaed a database, an AI/ML tool, an office app, whatever. And these workloads can be run on a server os just as they can be run on a desktop os.
If we agree that the instance type (and domain pref) is a key element to provide the right resources for a workload, then the instance types should not include the "os class" (server, desktop) but rather the env requirements (or resource profile): memory intensive, cpu intensive, accelerated (gpu) - and some (TBD) combinations of those.
AWS has structured their instance types similarly.
Thus examples (!) into such a direction with "resoure profiles" would be

_g_eneric
_c_compute (includes guaranteed cpus)
_m_emory (include hugepages?)
_a_ccelerated (includes some gpu?)

Which can then be used to construct the instance type names:

g.small
c.large
c.tiny
m.large
a.xxlarge

Yup agreed, the current types and preferences are just a 0.00001 version seeking parity with the current common templates. I've made a few tweaks (like dropping desktop and the tiny highpreformance type) but ultimately something like what you've suggested here should be our goal.
I can hack together a PR introducing these types but I think we should continue to provide the original common templates based types and preferences for compatibility. Thoughts?

And your work is great! I think it is important that we understand if instanceTypes+domPrefs can provide the same VM "template" as common templates can.

Thoughts?

+1 on having instances types mimicing the original common templates
At the same time I'd explore/POC the resource profile based ones.
In the end we need to decide if we want to provide the common template inspired ones as part of a release (ship them), or just in this repo (unreleased) as a fallback - and at the same time fully move over to the resource profile based ones.
My preference would be to provide the common template instancetypes for reference, but not ship them, and only ship the resource profile based ones.
Here we will need to decide if we can introduce them into kubevirt/kubevirt to make them part of stock releases (with the goal of having users to quickly adopt them).

My preference would be to provide the common template instancetypes for reference, but not ship them, and only ship the resource profile based ones.

Why not ship them for the initial release and them deprecate them in favour of the newer approach? Once revisions are taken we don't need the resources in the cluster anymore so it's perfectly valid to deprecate and remove types over time.

Here we will need to decide if we can introduce them into kubevirt/kubevirt to make them part of stock releases (with the goal of having users to quickly adopt them).

I wouldn't carry these types and preferences directly in kubevirt/kubevirt but have them installed by the virt-operator (or SSP etc) from a separate versioned repo as we currently do with kubevirt/common-templates.


adding groups is different, and for me, fails...

for me, If I got to organization settings, there is no explicit security page, just a title with two entries, policies and permissions.  Seemed permissions was the right one, so I went in, picked an existing group (valid users), went to that group's members, clicked on + add members, typed in my AD group (which was a specific team which has users in it), which showed up. when I click save, I see 'the selected member is not active. please check the member status before trying again'.  Uh, I'm adding a group, not a user.  AFAIK, a group won't have a basic/stakeholder/msdn, it's just a group of developers, each of which would have basic/stakeholder/msdn.  but it doesn't save the group.  I can only see azure devops groups, not AD groups.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 39c81ce4-7085-f5cd-e29a-e434074d449a
Version Independent ID: e9bbaf41-404e-d1b7-5e39-33b68ffe7ef0
Content: Manage access with Azure Active Directory groups - Azure DevOps Services
Content Source: docs/organizations/accounts/manage-azure-active-directory-groups.md
Product: devops
Technology: devops-accounts
GitHub Login: @chcomley
Microsoft Alias: chcomley

Hi @marct22, I'm sorry you're experiencing difficulties. Can you please tell me what version you're using? This article is for Azure DevOps Services. Also, can you please confirm that you've met the prerequisites? Looking forward to your reply. Have a nice weekend.

We are using azure AD.  I am org owner.  How can i tell what version I'm using?  I am not using an on-premises version, it's in the cloud.  This isn't TFS, it's azure devops...

Hi @marct22, We believe that either your Azure AD group you're trying to add is inactive for some reason, or there may be a bug. Please create a support ticket and those great folks will be happy to help you get this figured out.

Also, since you're in the cloud, I'd consider your "version" Azure DevOps Services, so please disregard that previous question. Thank you!


Adding child prefixes, why does it auto populate "available". Can this be toggled off?

Hi,
Adding child prefixes to a /16 prefix, a number of 'available' subnets appear.
Why is this? Can this behaviour be disabled? It makes the presentation of the child prefixes messy, IMO.

The "available" lines show unused space. This makes it easier to find gaps between child prefixes. It cannot be toggled off.

OK.. Thanks.  My next question was about 'expanding' the prefix but I see that tick box.


Neither "ionic platform update ios" nor "ionic build ios" updates plugins in the "platforms/ios" directory

Example:
macbook-pro-2:ionic-app mil$ diff plugins/ionic-plugin-deploy/src/ios/IonicDeploy.m platforms/ios/UAV\ Forecast/Plugins/ionic-plugin-deploy/IonicDeploy.m
242d241
<             [self updateVersionLabel:NOTHING_TO_IGNORE];

macbook-pro-2:ionic-app mil$ ionic platform update ios
...
macbook-pro-2:ionic-app mil$ ionic build ios
...

macbook-pro-2:ionic-app mil$ diff plugins/ionic-plugin-deploy/src/ios/IonicDeploy.m platforms/ios/UAV\ Forecast/Plugins/ionic-plugin-deploy/IonicDeploy.m
242d241
<             [self updateVersionLabel:NOTHING_TO_IGNORE];

The line added to the file in the plugins/ directory was added in v0.4.1, to fix a bug which broke deploys on iOS.

Greetings @matthewlloyd!
My sensors indicate that you need to update your issue through our custom issue form. We are now requiring all issues to be submitted this way, to ensure that we have all of the information necessary to fix them as quickly as possible.
Click Here To Update Your Issue
I will have no choice but to close this issue if it is not resubmitted through the form. Please fill out the rest of the form, so that I may use my friendly robot powers to assist you.
Thank you!

Hey @matthewlloyd, I'm trying to figure out exactly where to route this one, if you think it's a CLI or possibly Cordova command issue (i.e. does the same issue happen with cordova build instead of ionic build?) then mind filing over here? https://github.com/driftyco/ionic-cli/issues
Going to close since it's not a framework issue specifically. Almost looks like it could be related to the deploy service? https://github.com/driftyco/ionic-platform-web-client


[Q] Download an artifact without the API/CLI

Hello,
I have a simple question, but I couldn't figure out a simple way to do that.
I want users to be able to download artifacts without installing wandb. In particular, I want to implement a function that will download a file model.ckpt given a certain artifact name, without using wandb.Api().artifact. There is a public link on the UI, but it seems to use some hashing internally, and therefore I can't guess the URL of this link using the artifact name.
TL;DR: how to get the URL to download a file of an artifact, knowing only the artifact name?
Thanks!

Hi @fmamberti-wandb!
I'm saving pytorch-lightning checkpoints as artifacts, which is super convenient to load for me (I download the checkpoint using the wandb API and then use the load_from_checkpoint method from pytorch-lightning to load the model).
But, ideally, I would prefer to keep wandb as an extra dependency, because users of my package will only need to load pretrained models, without re-training. In brief, I would use wandb for model training, and the package users would simply download the model.ckpt file and use the rest of the package without wandb.
I can of course add wandb as a main dependency, but since it's only one file that need to be downloaded, I think it could be avoided.
This is an example of a file I want to load automatically:

Thanks for the additional details @quentinblampey. I've now raised this as a feature request for our product team to review.

Thanks @fmamberti-wandb 👍

Hello @fmamberti-wandb, just for your information, I'm now using huggingface_hub to share the checkpoints
This way I can keep wandb as an optional dependency
I'm not closing it, in case you think it's still something you want to work on, but else you can close it!


There is some way to debug without compiling?

Let's say I already have an executable compiled in debug mode. There is some way I can just run it with nvim-dap-go skipping the compiling step?
The compilation nvim-dap-go try to do seems to only work correctly with single file programs. If the program has more than one file, the compilation will fail, as it only take the current file.
My config is just
require('dap-go').setup()

And then running DapContiue.

You can test it by trying to debug this multi-file hello world program:
main.go
// main.go

package main

import "fmt"

func main() {
    msg := getMessage() // Calling the function from "helper.go"
    fmt.Println(msg)
}

helpter.go
// helper.go

package main

func getMessage() string {
    return "Hello, World!"
}

Ok after further research this is my solution:
      -- Go
      -- Requires:
      -- * The system dependency 'dlv'
      -- * Change the line "command = '/usr/bin/dlv'" to your actual dlv path.
      -- * You to :cd your project before running :DapContinue
      -- * Your project has been initialized with 'go mod init module_name'
      -- note that no mason package is required.
      dap.adapters.delve = {
        type = 'server',
        port = '${port}',
        executable = {
          command = '/usr/bin/dlv',
          args = {'dap', '-l', '<IP_ADDRESS>:${port}'},
        }
      }
      dap.configurations.go = {
        {
          type = "delve",
          name = "Compile module and debug this file",
          request = "launch",
          program = "./${relativeFileDirname}",
        },
        {
          type = "delve",
          name = "Compile module and debug this test file",
          request = "launch",
          mode = "test",
          program = "${file}"
        },
        {
          type = "delve",
          name = "Compile module and debug this test go.mod",
          request = "launch",
          mode = "test",
          program = "./${relativeFileDirname}"
        }
      }

As described here dlv has a dlv exec mode, but one can only use it manually. And in order to use dlv with DAP one must run it as dlv dap.
In other words, there is no way to avoid compiling the module when running a test.
The solution I've posted is the equivalent of running debug package when using lua require('dap-go').setup().

Let's say I already have an executable compiled in debug mode. There is some way I can just run it with nvim-dap-go skipping the compiling step?

Yes. However I don't understand what you mean by executable compiled in debug mode. Compiling is one thing and debugging a running process is a different thing. You can run your executable and attach a debug session to the running process. In this case there is no additional compilation involved.

The compilation nvim-dap-go try to do seems to only work correctly with single file programs. If the program has more than one file, the compilation will fail, as it only take the current file.

I am able to debug programs with thousand of files. The error that you are having is not related to having multiple files in your application's source.
Feel free to reopen the issue if your problem remains.


Update change-the-default-language-for-greetings-and-emails.md

Issue #2346 - Users can't change the language but they can change the greeting. So note has been modified accordingly.

@nenonix @JohanFreelancer9 Copy editing is needed for this PR. Thanks.

@dstrome changes look correct. Could you please confirm and merge? Thanks!

The content is correct. Users can change their own voicemail prompt language by following the link below the note. Closing PR without merging and will post a reply to the issue as well.


Update Upkie description to v1.5.0

Pull Request Test Coverage Report for Build<PHONE_NUMBER>
Details

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 98.544%

Totals

Change from base Build<PHONE_NUMBER>:
0.0%

Covered Lines:
880

Relevant Lines:
893

💛  - Coveralls


[KARAF-5949] Upgrade to Felix Framework 6.0.2

retest this please

retest this please

Superseded by #995


SetUserData and GetUserData

Our current code is using TinyXML1 and we are in the process of moving to TinyXML2. There are places where the functions SetUserData and GetUserData are used in the current code where we dump some STL data structure into the xml file and get it back later. But with TinyXML2 I don't see any functions for XMLElement that takes a void* and returns a void*.
Tried to see if as a workaround if I can use SetText and GetText and cast the char* as required but it didn't work. Guessing probably because of the NULL chars user data gets messed up.
Any help will be appreciated, thanks.

Implemented. Will push to master in a few moments.


Add Kuadrant repositories

List the direct Git links to be added to our Augur database
https://github.com/kuadrant
https://github.com/Kuadrant/limitador
https://github.com/Kuadrant/authorino
https://github.com/Kuadrant/architecture
https://github.com/Kuadrant/kuadrant-operator
https://github.com/Kuadrant/wasm-shim
https://github.com/Kuadrant/multicluster-gateway-controller

closed as collection is complete


Multisig overview is not fully initialized

Description
The overflow diagram on the help page is rendered with the correct amount of signatorys and multisigs / pures but not populated with any address or identicon data
Prerequisites
Connect as a signatory that is already part of a multisig
Steps To Reproduce
Add clear steps on how to reproduce the bug

Go to Multix at 'https://multix.chainsafe.io/'
Click on "help"

Expected Behaviour
The overflow diagram should be populated with the addresses and identicon shown
Screenshots / Video

**Test Host Specifics: **

OS: macOS 13,
Browser Firefox
Version 113

Oh that's unfortunate, thanks for spoting it. This most probably has something to do with either the styled component import, or the AccountDisplay changes we've made recently to add the balance.

I had a flash, it comes from the removal of nodeTypes in a recent PR. I didn't check carefully the consequences and just accepted the pr, it'll be a quick fix.


listen 'exit' event instead of 'close' as spawnSync does

I think spawnSync and "spawn-async"(as Promise-based interface for spawn) should act in a similar way.
As shown by experiment(below) spawnSync returns when the 'exit' event is triggered.
The documentation currently says:

The 'close' event is emitted when the stdio streams of a child process have been closed. This is distinct from the 'exit' event, since multiple processes might share the same stdio streams.

This experiment inspired by this discussion(stackoverflow). Pipe program with lots of output to another, kill first program:
With spawnSync
var cpPrev = require('child_process').spawn('bash', ['-c', 'mkfifo tmppipe && yes > tmppipe']);
setTimeout(function() {
	cpPrev.kill();
	console.log('cpPrev.kill()');
	require('child_process').spawnSync('bash', ['-c', 'rm tmppipe']);
}, 1000);

require('child_process').spawnSync('bash', ['-c', 'cat < tmppipe'], {timeout: 500});
console.log('spawnSync complete');

It outputs:
spawnSync complete
cpPrev.kill()

spawnSync completes before second command is killed.
Next with async spawn
var cpPrev = require('child_process').spawn('bash', ['-c', 'mkfifo tmppipe && yes > tmppipe']);

var cp = require('child_process').spawn('bash', ['-c', 'cat < tmppipe']);
cp.once('exit', console.log.bind(console, 'exited'));
cp.once('close', console.log.bind(console, 'closed'));

setTimeout(function() {
	cp.kill();
	console.log('cp.kill()');
	setTimeout(function() {
		cp.stdout.destroy();
		cpPrev.kill();
		console.log('cpPrev.kill()');
		require('child_process').spawnSync('bash', ['-c', 'rm tmppipe']);
	}, 500);
}, 500);

It outputs:
cp.kill()
exited null SIGTERM
cpPrev.kill()
closed null SIGTERM

'exit' event is trigged after cp is killed(as spawnSync). 'close' event is trigged after cp.stdout.destroy.
So, i think "spawn-async" should listen 'exit' event or add appropriate option.

Hi--
This might make sense. I think there was a reason that I made it listen to close instead of exit originally, but I can't remember what that was now.
If you submit a PR and it passes all the tests, we could potentially release a new major version that listens to exit instead.

I spent a moderate amount of time looking into this and believe we need to listen to the "close" event to read stdout/stderr correctly. One of the tests that runs "echo hi" failed just once when I tried listening to "exit" instead of "close" and the test failure showed that spawnAsync didn't read stdout. I couldn't reproduce this test failure -- a bit worrisome since it'd be easy to accidentally introduce this regression -- but it makes sense since the subprocess could exit before stdout fully flushes and the parent reads it.
My understanding of the issue is that there are two different use cases: (1) to invoke a program and get its output and (2) to invoke a program and care only that it finishes. We've optimized for (1) today. If we were to add an option for (2), I think the correct thing to do is to skip collecting stdout/stderr since they'll return the correct data nearly all of the time but sometimes inexplicably be missing data and be extremely hard to debug.


Issue 141 System Test Pull Request

Added a new system test class that demonstrates the bug described in issue #141 and causes one of the included tests to fail (obviously causing the build to break as well).

Closing this pull request because Aeron had breaking changes to the API and this system test will be submitted in another pull request.


trigger a shortcutSubmit event when pressing ctrl + enter in taptip

Thank you!

@Combo819 Somehow when I formatted the code with cli tool (see Makefile), I got a different format. Let's try to keep in sync with the cli version.

@izgzhen I used the vscode prettier extension.  Should we add a format npm script?

@Combo819 I just moved the commands from Makefile to package.json. You can use yarn run format to format the files, and use yarn run check to check the format. Please run yarn install as well since I just explicitly added the prettier local dependency.

@izgzhen Ok. Thanks


Property that open sets are totally ordered by set inclusion

As the title says, I think it would be useful to have a property that for any two open sets $U,V$, either $U\subseteq V$ or $V\subseteq U$, i.e. $(\mathcal T_X,\subseteq)$ is a total order. While this suggestion is spurred by the recent additions of S199 and S200, this had been on my mind as it had come up in the book Spectral Spaces where it had been characterized as the specialization preorder being total. The property can also be seen as something like "hereditarily connected", i.e. every subspace is connected. It's the sort of property that won't have received much study in its own right, but it's straightforward and underpins several spaces such that I think it warrants inclusion, similar to P185 Partition topology.
Some consequences of the property:

P39 Hyperconnected
P14 Completely normal
P174 Well-based
P57 Countable ⇒ P27 Second countable
P93 Locally countable ⇒ Cardinality $\leq\aleph_1$
P16 Compact ∧ P86 Homogeneous ⇒ P129 Indiscrete (compact implies there is a second-largest open set)

Yeah, I was thinking about it too.
Before I give comments, could you take a look at the pending #706?  I made one last change and it's just waiting for you to take a look to finalize this.
After that's done, I can make a suggested edit for the pending #746.  Unless you prefer to handle the pending comments yourself?  It would be good to finalize that.

I thought about this as a utility property. I think I see immediately that this property implies "hereditarily connected"; is the reverse true as well? Waving hands it makes sense: given every two points, they are either topologically indistinguishable, or a copy of the Sierpenski space, providing the specialization total ordering. If so, I think "hereditarily connected" sounds quite natural (as natural as "locally pseudometrizable") and could be added.

I agree, "Has a totally ordered topology" and "Hereditarily connected" seem two good names for it.

See https://www.acadsci.fi/mathematica/Vol03/vol03pp185-205.pdf, section 12 (theorems 22, 23, 24).
(https://zbmath.org/0396.54009)

I think I see immediately that this property implies "hereditarily connected"; is the reverse true as well?

Explicitly, if there exist two open sets where neither is a superset of the other, then their symmetric difference is disconnected.

See https://www.acadsci.fi/mathematica/Vol03/vol03pp185-205.pdf, section 12 (theorems 22, 23, 24). (https://zbmath.org/0396.54009)

That is an excellent source. I was wondering if hyperconnected + completely normal were sufficient conditions but hadn't thought of a proof, so I'm glad to see it confirmed by Theorem 23. I'm also amused by the fact that they mention the exact space I had thought of to show that hyperconnected + normal/ultraconnected is not sufficient. I suppose it would be a good space to add to the database as well. (If we need a name, it's something like the meet of an included point space and an excluded point space, as long as the included and excluded points are different points.)

See https://www.acadsci.fi/mathematica/Vol03/vol03pp185-205.pdf, section 12 (theorems 22, 23, 24). (https://zbmath.org/0396.54009)

This makes the properly clearly appropriate for pi-Base, excellent.


Enhance and Fix The "Terms and Conditions" Bugs and Issues

Hey @thestarsahil

The terms and conditions page is not properly aligned
it has dummy texts
The navbar is of after login page (you can see profile navlink and log out link even tho it is already logged out!)
Improper Alignments

Its already been done

Then i will enhance dummy text and alignments to look more professional and legal compliance @thestarsahil


SecurityOptions not applying

I'm receiving the following error when the SecurityOptions Resource in the <IP_ADDRESS> version of the SecurityPolicyDsc module is used:
Error Message is PowerShell DSC resource MSFT_SecurityOption  failed to execute Set-TargetResource functionality with error message: Failed to update security option Accounts_Rename_guest_account,Audit_Audit_the_use_of_Backup_and_Restore_privilege,Audit_Force_audit_policy_subcategory_settings_Windows_Vista_or_later_to_override_audit_policy_category_settings,Devices_Allow_undock_without_having_to_log_on,Devices_Allowed_to_format_and_eject_removable_media,Devices_Restrict_CD_ROM_access_to_locally_logged_on_user_only,Devices_Restrict_floppy_access_to_locally_logged_on_user_only,Domain_controller_Allow_server_operators_to_schedule_tasks,Domain_controller_Refuse_machine_account_password_changes,Domain_member_Digitally_encrypt_or_sign_secure_channel_data_always,Interactive_logon_Do_not_display_last_user_name,Interactive_logon_Message_text_for_users_attempting_to_log_on,Interactive_logon_Message_title_for_users_attempting_to_log_on,Network_access_Do_not_allow_anonymous_enumeration_of_SAM_accounts_and_shares,Network_access_Do_not_allow_storage_of_passwords_and_credentials_for_network_authentication,Network_access_Remotely_accessible_registry_paths,Network_access_Remotely_accessible_registry_paths_and_subpaths,Network_security_Allow_Local_System_to_use_computer_identity_for_NTLM,Network_security_Allow_LocalSystem_NULL_session_fallback,Network_security_Do_not_store_LAN_Manager_hash_value_on_next_password_change,Network_security_LAN_Manager_authentication_level. Refer to %windir%\security\logs\scesrv.log for details.

SCESRV.LOG has the following error:
Error 11: An attempt was made to load a program with an incorrect format.
 	Error converting section Registry Values.

What additional information do you need from me to help resolve this issue?
The SecurityOption portion of my DSC script:
SecurityOption 'SecurityOptions' {
            Name                                                                                = 'SecurityOptions'
            Accounts_Administrator_account_status                                                                           = 'Enabled'
            Accounts_Guest_account_status                                                                                = 'Disabled'
            Accounts_Rename_administrator_account                                                                           = 'ccadmin'
            Accounts_Rename_guest_account                                                                                = 'interloper'
            Audit_Force_audit_policy_subcategory_settings_Windows_Vista_or_later_to_override_audit_policy_category_settings = 'Enabled'
            Audit_Audit_the_use_of_Backup_and_Restore_privilege                                                             = 'Enabled'
            Devices_Allow_undock_without_having_to_log_on                                                                   = 'Disabled'
            Devices_Allowed_to_format_and_eject_removable_media                                                             = 'Administrators'
            Devices_Restrict_CD_ROM_access_to_locally_logged_on_user_only                                                   = 'Disabled'
            Devices_Restrict_floppy_access_to_locally_logged_on_user_only                                                   = 'Disabled'
            Domain_controller_Allow_server_operators_to_schedule_tasks                                                      = 'Enabled'
            Domain_controller_Refuse_machine_account_password_changes                                                       = 'Disabled'
            Domain_member_Digitally_encrypt_or_sign_secure_channel_data_always                                              = 'Disabled'
            Interactive_logon_Do_not_display_last_user_name                                                                 = 'Enabled'
            Interactive_logon_Message_text_for_users_attempting_to_log_on                                                   = $LegalNoticeText
            Interactive_logon_Message_title_for_users_attempting_to_log_on                                                  = 'WARNING - Private Computer System'
            Interactive_logon_Number_of_previous_logons_to_cache_in_case_domain_controller_is_not_available                 = '10'
            Network_access_Allow_anonymous_SID_Name_translation                                                             = 'Disabled'
            Network_access_Do_not_allow_anonymous_enumeration_of_SAM_accounts                                               = 'Enabled'
            Network_access_Do_not_allow_anonymous_enumeration_of_SAM_accounts_and_shares                                    = 'Enabled'
            Network_access_Do_not_allow_storage_of_passwords_and_credentials_for_network_authentication                     = 'Enabled'
            Network_access_Let_Everyone_permissions_apply_to_anonymous_users                                                = 'Disabled'
            Network_access_Named_Pipes_that_can_be_accessed_anonymously                                                     = ([System.String]::Empty)
            Network_access_Remotely_accessible_registry_paths                                                               = ([System.String]::Empty)
            Network_access_Remotely_accessible_registry_paths_and_subpaths                                                  = ([System.String]::Empty)
            Network_access_Restrict_anonymous_access_to_Named_Pipes_and_Shares                                              = 'Enabled'
            Network_access_Shares_that_can_be_accessed_anonymously                                                          = ([System.String]::Empty)
            Network_access_Sharing_and_security_model_for_local_accounts                                                    = 'Classic - Local users authenticate as themselves'
            Network_security_Allow_Local_System_to_use_computer_identity_for_NTLM                                           = 'Enabled'
            Network_security_Allow_LocalSystem_NULL_session_fallback                                                        = 'Disabled'
            Network_security_Do_not_store_LAN_Manager_hash_value_on_next_password_change                                    = 'Disabled'
            Network_security_LAN_Manager_authentication_level                                                               = 'Send NTLM responses only'
        }

@aydeisen I literally spun up a VM and copy/paste your configuration and it ran without error.  The only thing that I could not replicate is what you have in  $LegalNoticeText.  Can you confirm that the error is occurring while setting 'Interactive_logon_Message_text_for_users_attempting_to_log_on' ?

@jcwalker I'm not sure why it's not reproducing.  This is the full script (with the contents of the $LegalNoticeText  variable), and it's being hosted on Azure Automation DSC in East US, if that makes a difference:
#Based on the 2012 hardening script: hardening2012
Configuration Hardening {
    Import-DscResource -ModuleName 'SecurityPolicyDsc'
    Import-DscResource -ModuleName 'AuditPolicyDsc'
    Import-DscResource -ModuleName 'PSDScResources'
    Import-DscResource -ModuleName 'xAzureTempDrive'
    Import-DscResource -ModuleName 'xNetworking'
    Import-DscResource -ModuleName 'xRemoteDesktopAdmin'
    Import-DscResource -ModuleName 'xTimeZone'
    Import-DscResource -ModuleName 'xPSDesiredStateConfiguration' -Name 'xRemoteFile', 'xPackage'
    $LegalNoticeText = @'
UNAUTHORIZED ACCESS - Unauthorized access to this system will expose you to criminal prosecution and civil proceedings.
AUTHORIZED ACCESS - Authorized users must use company computer assets and services, including hardware, software, and services provided by company or company contractors, in accordance with applicable law and company policies. Any other use is prohibited and will expose the user to criminal penalties, civil proceedings, and company disciplinary action, including immediate termination, to the fullest extent not expressly prohibited by applicable law.
EXPECTATIONS OF PRIVACY - Except as otherwise provided by contract or applicable law, all information and data sent or received through, or contained in company computers, computer systems, or networks, including electronic mail and Internet usage logs, is the property of the company and is not the property, nor the private information, of the user. Subject to applicable law, the company reserves the right to access, filter, delete, monitor, intercept, inspect and disclose all information sent or received through or stored in company computer assets, at any time without prior notice, for any purpose, including compliance with law enforcement requests and applicable laws, protection of company assets, or to reduce demands on company E-Mail systems and storage capabilities.
'@
    Node localhost {
        #region software
        xRemoteFile DownloadMcAfee {
            DestinationPath = 'C:\Utility\FramePkg_5_0_4_283.exe'
            Uri             = 'http://<IP_ADDRESS>/FramePkg_5_0_4_283.exe'
            MatchSource     = $True
        }
        xPackage InstallMcAfee {
            Ensure    = 'Present'
            Name      = 'McAfee Agent'
            Path      = 'C:\Utility\FramePkg_5_0_4_283.exe'
            ProductId = '2B4B02CD-CA9E-4024-9B9B-2EA9950EEC11'
            Arguments = '/Silent'
            DependsOn = '[xRemoteFile]DownloadMcAfee'
        }
        <#
        Package InstallVSE {
            Ensure = 'Present'
            Name = 'McAfee Agent'
            Path = 'http://http://<IP_ADDRESS>/VSE880MLRP9.ZIP'
            ProductId = '2B4B02CD-CA9E-4024-9B9B-2EA9950EEC11'
            Arguments = '/Silent'
        }
        #>
        #endregion
        #region TempDrive
        xAzureTempDrive AzureTempDrive <#ResourceName#> {
            DriveLetter = 'X'
        }
        #endregion
        #region Service
        Service "EnableWinRM" {
            Name        = 'winrm'
            StartupType = 'Automatic'
            State       = 'Running'
            Ensure      = 'Present'
        }
        <#
    Script "WSMANListener" {
        GetScript = {@{Result = (Get-Item -LiteralPath 'WSMAN:\localhost\Listener').Name}}
        SetScript = {Enable-PSRemoting -Force}
        TestScript = {((Get-Item -LiteralPath 'WSMAN:\localhost\Listener' | Measure-Object).count -gt 0)}
        DependsOn = "[Service]EnableWinRM"
    }
    Script "DisableWinFirewallDomain" {
        GetScript = {@{Results = (Get-NetFirewallProfile -Name "Domain" | Write-Output "$($_.Name): $($_.Enabled)")}}
        TestScript = {((Get-NetFirewallProfile -Name "Domain").Enabled -ne $True)}
        SetScript = {Set-NetFirewallProfile -Name "Domain" -Enabled $False}
    }
    Script "DisableWinFirewallPrivate" {
        GetScript = {@{Results = (Get-NetFirewallProfile -Name "Private" | Write-Output "$($_.Name): $($_.Enabled)")}}
        TestScript = {((Get-NetFirewallProfile -Name "Private").Enabled -ne $True)}
        SetScript = {Set-NetFirewallProfile -Name "Private" -Enabled $False}
    }
    Script "DisableWinFirewallPublic" {
        GetScript = {@{Results = (Get-NetFirewallProfile -Name "Public" | Write-Output "$($_.Name): $($_.Enabled)")}}
        TestScript = {((Get-NetFirewallProfile -Name "Public").Enabled -ne $True)}
        SetScript = {Set-NetFirewallProfile -Name "Public" -Enabled $False}
    }
    #>
        #endregion
        <#
    #region WSMANConfig
    WSManServiceConfig ServiceConfig
        {
        MaxConnections                   = 100
        EnableCompatibilityHttpListener  = $True
        EnableCompatibilityHttpsListener = $True
        }
    #endregion
    #>
        #region Registry
        Registry WSManClient {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Client"
            ValueName = "Client"
            ValueData = "*"
            ValueType = "String"
        }
        Registry AutoReboot {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl"
            ValueName = "AutoReboot"
            ValueData = "1"
            ValueType = "DWord"
        }
        Registry CrashDumpEnabled {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl"
            ValueName = "CrashDumpEnabled"
            ValueData = "3"
            ValueType = "DWord"
        }
        Registry Overwrite {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl"
            ValueName = "Overwrite"
            ValueData = "1"
            ValueType = "DWord"
        }
        Registry LogEvent {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl"
            ValueName = "LogEvent"
            ValueData = "1"
            ValueType = "DWord"
        }
        Registry MinidumpsCount {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl"
            ValueName = "MinidumpsCount"
            ValueData = "50"
            ValueType = "DWord"
        }
        Registry DumpFile {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl"
            ValueName = "DumpFile"
            ValueData = "%SystemRoot%\Minidump-Type"
            ValueType = "ExpandString"
        }
        Registry MinidumpDir {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl"
            ValueName = "MinidumpDir"
            ValueData = "%SystemRoot%\Minidump"
            ValueType = "ExpandString"
        }
        Registry SendAlert {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl"
            ValueName = "SendAlert"
            ValueData = "0"
            ValueType = "DWord"
        }
        Registry KernelDumpOnly {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl"
            ValueName = "KernelDumpOnly"
            ValueData = "0"
            ValueType = "DWord"
        }
        Registry RDSAlwaysPromptPW {
            Force = $True
            Ensure = 'Present'
            Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
            ValueName = 'fPromptForPassword'
            ValueData = '1'
            ValueType = 'DWord'
        }
        Registry RDSDisconnectedTimeout {
            Force = $True
            Ensure = 'Present'
            Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
            ValueName = 'MaxDisconnectionTime'
            ValueData = '1800000'
            ValueType = 'DWord'
        }
        Registry RDSIdleTimeout {
            Force = $True
            Ensure = 'Present'
            Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
            ValueName = 'MaxIdleTime'
            ValueData = '10800000'
            ValueType = 'DWord'
        }
        Registry RDSNoActiveTimeout {
            Force = $True
            Ensure = 'Present'
            Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
            ValueName = 'MaxConnectionTime'
            ValueData = '0'
            ValueType = 'DWord'
        }
        Registry RDSTerminateTimedOutSession {
            Force = $True
            Ensure = 'Present'
            Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
            ValueName = 'fResetBroken'
            ValueData = '1'
            ValueType = 'DWord'
        }
        Registry RDSNoRemoteControl {
            Force = $True
            Ensure = 'Present'
            Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
            ValueName = 'Shadow'
            ValueData = '0'
            ValueType = 'DWord'
        }
        Registry RDSNoDriveRedirect {
            Force = $True
            Ensure = 'Present'
            Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
            ValueName = 'fDisableCdm'
            ValueData = '0'
            ValueType = 'DWord'
        }
        Registry RDSNoLPTRedirect {
            Force = $True
            Ensure = 'Present'
            Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
            ValueName = 'fDisableLPT'
            ValueData = '0'
            ValueType = 'DWord'
        }
        Registry RDSNoCOMRedirect {
            Force = $True
            Ensure = 'Present'
            Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
            ValueName = 'fDisableCcm'
            ValueData = '0'
            ValueType = 'DWord'
        }
        Registry RDSNoPnPRedirect {
            Force = $True
            Ensure = 'Present'
            Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
            ValueName = 'fDisablePNPRedir'
            ValueData = '0'
            ValueType = 'DWord'
        }
        Registry RDSNoPrintRedirect {
            Force = $True
            Ensure = 'Present'
            Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
            ValueName = 'fDisableCpm'
            ValueData = '0'
            ValueType = 'DWord'
        }
        Registry ElevateNonAdmins {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
            ValueName = "ElevateNonAdmins"
            ValueData = "0"
            ValueType = "dword"
        }
        Registry WUServer {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
            ValueName = "WUServer"
            ValueData = "http://<IP_ADDRESS>:8530/"
            ValueType = "string"
        }
        Registry WUStatusServer {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
            ValueName = "WUStatusServer"
            ValueData = "http://<IP_ADDRESS>:8530/"
            ValueType = "string"
        }
        Registry TargetGroupEnabled {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
            ValueName = "TargetGroupEnabled"
            ValueData = "1"
            ValueType = "dword"
        }
        Registry TargetGroup {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
            ValueName = "TargetGroup"
            ValueData = "Azure"
            ValueType = "string"
        }
        Registry NoAutoRebootWithLoggedOnUsers {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "NoAutoRebootWithLoggedOnUsers"
            ValueData = "1"
            ValueType = "dword"
        }
        Registry AutoInstallMinorUpdates {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "AutoInstallMinorUpdates"
            ValueData = "0"
            ValueType = "dword"
        }
        Registry NoAUShutdownOption {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "NoAUShutdownOption"
            ValueData = "1"
            ValueType = "dword"
        }
        Registry NoAUAsDefaultShutdownOption {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "NoAUAsDefaultShutdownOption"
            ValueData = "1"
            ValueType = "dword"
        }
        Registry RescheduleWaitTimeEnabled {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "RescheduleWaitTimeEnabled"
            ValueData = "0"
            ValueType = "dword"
        }
        Registry RebootWarningTimeoutEnabled {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "RebootWarningTimeoutEnabled"
            ValueData = "0"
            ValueType = "dword"
        }
        Registry RebootRelaunchTimeoutEnabled {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "RebootRelaunchTimeoutEnabled"
            ValueData = "1"
            ValueType = "dword"
        }
        Registry RebootRelaunchTimeout {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "RebootRelaunchTimeout"
            ValueData = "15"
            ValueType = "dword"
        }
        Registry DetectionFrequencyEnabled {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "DetectionFrequencyEnabled"
            ValueData = "1"
            ValueType = "dword"
        }
        Registry DetectionFrequency {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "DetectionFrequency"
            ValueData = "22"
            ValueType = "dword"
        }
        Registry NoAutoUpdate {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "NoAutoUpdate"
            ValueData = "0"
            ValueType = "dword"
        }
        Registry AUOptions {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "AUOptions"
            ValueData = "3"
            ValueType = "dword"
        }
        Registry ScheduledInstallDay {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "ScheduledInstallDay"
            ValueData = "0"
            ValueType = "dword"
        }
        Registry ScheduledInstallTime {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "ScheduledInstallTime"
            ValueData = "3"
            ValueType = "dword"
        }
        Registry UseWUServer {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
            ValueName = "UseWUServer"
            ValueData = "1"
            ValueType = "dword"
        }
        Registry DisableIPv6 {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters"
            ValueName = "DisabledComponents"
            ValueData = "255"
            ValueType = "DWord"
        }
        Registry AppMaxSize {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application"
            ValueName = "MaxSize"
            ValueData = "20971520"
            ValueType = "dword"
        }
        Registry AppRetention {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application"
            ValueName = "Retention"
            ValueData = "0"
            ValueType = "dword"
        }
        Registry AppRestrictGuestAccess {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application"
            ValueName = "RestrictGuestAccess"
            ValueData = "1"
            ValueType = "dword"
        }
        Registry SecMaxSize {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security"
            ValueName = "MaxSize"
            ValueData = "20971520"
            ValueType = "dword"
        }
        Registry SecRetention {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security"
            ValueName = "Retention"
            ValueData = "0"
            ValueType = "dword"
        }
        Registry SecRestrictGuestAccess {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security"
            ValueName = "RestrictGuestAccess"
            ValueData = "1"
            ValueType = "dword"
        }
        Registry SysMaxSize {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System"
            ValueName = "MaxSize"
            ValueData = "20971520"
            ValueType = "dword"
        }
        Registry SysRetention {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System"
            ValueName = "Retention"
            ValueData = "0"
            ValueType = "dword"
        }
        Registry SysRestrictGuestAccess {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System"
            ValueName = "RestrictGuestAccess"
            ValueData = "1"
            ValueType = "dword"
        }
        Registry CDRomRemoval {
            Force     = $True
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdrom"
            ValueName = "Start"
            ValueData = "4"
            ValueType = "dword"
        }
        Registry MaxInstanceCount {
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
            ValueName = "MaxInstanceCount"
            Hex       = $True
            Force     = $True
            ValueData = "ffffffff"
            ValueType = "dword"
        }
        #endregion
        #region SecurityPolicy
        AccountPolicy AccountPolicies {
            Name                                                 = 'PasswordPolicies'
            Account_lockout_duration                             = ([System.UInt32]::Parse('1440'))
            Account_lockout_threshold                            = ([System.UInt32]::Parse('4'))
            Enforce_password_history                             = ([System.UInt32]::Parse('10'))
            Enfore_user_logon_restrictions                       = 'Disabled'
            Maximum_lifetime_for_service_ticket                  = ([System.UInt32]::Parse('600'))
            Maximum_lifetime_for_user_ticket                     = ([System.UInt32]::Parse('10'))
            Maximum_lifetime_for_user_ticket_renewal             = ([System.UInt32]::Parse('7'))
            Maximum_Password_Age                                 = ([System.UInt32]::Parse('90'))
            Maximum_tolerance_for_computer_clock_synchronization = ([System.UInt32]::Parse('5'))
            Minimum_Password_Age                                 = ([System.UInt32]::Parse('0'))
            Minimum_Password_Length                              = ([System.UInt32]::Parse('6'))
            Password_must_meet_complexity_requirements           = 'Enabled'
            Reset_account_lockout_counter_after                  = ([System.UInt32]::Parse('60'))
            Store_passwords_using_reversible_encryption          = 'Disabled'
        }
        SecurityOption 'SecurityOptions' {
            Name                                                                                = 'SecurityOptions'
            Accounts_Administrator_account_status                                                                           = 'Enabled'
            Accounts_Guest_account_status                                                                                = 'Disabled'
            Accounts_Rename_administrator_account                                                                           = 'Administrator'
            Accounts_Rename_guest_account                                                                                = 'interloper'
            Audit_Force_audit_policy_subcategory_settings_Windows_Vista_or_later_to_override_audit_policy_category_settings = 'Enabled'
            Audit_Audit_the_use_of_Backup_and_Restore_privilege                                                             = 'Enabled'
            Devices_Allow_undock_without_having_to_log_on                                                                   = 'Disabled'
            Devices_Allowed_to_format_and_eject_removable_media                                                             = 'Administrators'
            Devices_Restrict_CD_ROM_access_to_locally_logged_on_user_only                                                   = 'Disabled'
            Devices_Restrict_floppy_access_to_locally_logged_on_user_only                                                   = 'Disabled'
            Domain_controller_Allow_server_operators_to_schedule_tasks                                                      = 'Enabled'
            Domain_controller_Refuse_machine_account_password_changes                                                       = 'Disabled'
            Domain_member_Digitally_encrypt_or_sign_secure_channel_data_always                                              = 'Disabled'
            Interactive_logon_Do_not_display_last_user_name                                                                 = 'Enabled'
            Interactive_logon_Message_text_for_users_attempting_to_log_on                                                   = $LegalNoticeText
            Interactive_logon_Message_title_for_users_attempting_to_log_on                                                  = 'WARNING - Private Computer System'
            Interactive_logon_Number_of_previous_logons_to_cache_in_case_domain_controller_is_not_available                 = '10'
            Network_access_Allow_anonymous_SID_Name_translation                                                             = 'Disabled'
            Network_access_Do_not_allow_anonymous_enumeration_of_SAM_accounts                                               = 'Enabled'
            Network_access_Do_not_allow_anonymous_enumeration_of_SAM_accounts_and_shares                                    = 'Enabled'
            Network_access_Do_not_allow_storage_of_passwords_and_credentials_for_network_authentication                     = 'Enabled'
            Network_access_Let_Everyone_permissions_apply_to_anonymous_users                                                = 'Disabled'
            Network_access_Named_Pipes_that_can_be_accessed_anonymously                                                     = ([System.String]::Empty)
            Network_access_Remotely_accessible_registry_paths                                                               = ([System.String]::Empty)
            Network_access_Remotely_accessible_registry_paths_and_subpaths                                                  = ([System.String]::Empty)
            Network_access_Restrict_anonymous_access_to_Named_Pipes_and_Shares                                              = 'Enabled'
            Network_access_Shares_that_can_be_accessed_anonymously                                                          = ([System.String]::Empty)
            Network_access_Sharing_and_security_model_for_local_accounts                                                    = 'Classic - Local users authenticate as themselves'
            Network_security_Allow_Local_System_to_use_computer_identity_for_NTLM                                           = 'Enabled'
            Network_security_Allow_LocalSystem_NULL_session_fallback                                                        = 'Disabled'
            Network_security_Do_not_store_LAN_Manager_hash_value_on_next_password_change                                    = 'Disabled'
            Network_security_LAN_Manager_authentication_level                                                               = 'Send NTLM responses only'
        }
        #endregion
        #region AuditPolicy
        AuditPolicySubcategory LogonSuccess {
            Name      = "Logon"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory LogonFailure {
            Name      = "Logon"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory LogoffSuccess {
            Name      = "Logoff"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory LogoffFailure {
            Name      = "Logoff"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory AccountLockoutSuccess {
            Name      = "Account Lockout"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory AccountLockoutFailure {
            Name      = "Account Lockout"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory SystemIntegritySuccess {
            Name      = "System Integrity"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory SystemIntegrityFailure {
            Name      = "System Integrity"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory SecurityStateChangeSuccess {
            Name      = "Security State Change"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory SecurityStateChangeFailure {
            Name      = "Security State Change"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory SpecialLogonSuccess {
            Name      = "Special Logon"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory SpecialLogonFailure {
            Name      = "Special Logon"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory OtherLogonLogoffEventsSuccess {
            Name      = "Other Logon/Logoff Events"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory OtherLogonLogoffEventsFailure {
            Name      = "Other Logon/Logoff Events"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory NetworkPolicyServerSuccess {
            Name      = "Network Policy Server"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory NetworkPolicyServerFailure {
            Name      = "Network Policy Server"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory CertificationServicesSuccess {
            Name      = "Certification Services"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory CertificationServicesFailure {
            Name      = "Certification Services"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory ApplicationGeneratedSuccess {
            Name      = "Application Generated"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory ApplicationGeneratedFailure {
            Name      = "Application Generated"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory OtherPrivilegeUseEventsSuccess {
            Name      = "Other Privilege Use Events"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory OtherPrivilegeUseEventsFailure {
            Name      = "Other Privilege Use Events"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory SensitivePrivilegeUseSuccess {
            Name      = "Sensitive Privilege Use"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory SensitivePrivilegeUseFailure {
            Name      = "Sensitive Privilege Use"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory AuthenticationPolicyChangeSuccess {
            Name      = "Authentication Policy Change"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory AuthenticationPolicyChangeFailure {
            Name      = "Authentication Policy Change"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory AuthorizationPolicyChangeSuccess {
            Name      = "Authorization Policy Change"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory AuthorizationPolicyChangeFailure {
            Name      = "Authorization Policy Change"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory OtherPolicyChangeEventsSuccess {
            Name      = "Other Policy Change Events"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory OtherPolicyChangeEventsFailure {
            Name      = "Other Policy Change Events"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory AuditPolicyChangeSuccess {
            Name      = "Audit Policy Change"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory AuditPolicyChangeFailure {
            Name      = "Audit Policy Change"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory ComputerAccountManagementSuccess {
            Name      = "Computer Account Management"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory ComputerAccountManagementFailure {
            Name      = "Computer Account Management"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory SecurityGroupManagementSuccess {
            Name      = "Security Group Management"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory SecurityGroupManagementFailure {
            Name      = "Security Group Management"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory DistributionGroupManagementSuccess {
            Name      = "Distribution Group Management"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory DistributionGroupManagementFailure {
            Name      = "Distribution Group Management"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory ApplicationGroupManagementSuccess {
            Name      = "Application Group Management"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory ApplicationGroupManagementFailure {
            Name      = "Application Group Management"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory OtherAccountManagementEventsSuccess {
            Name      = "Other Account Management Events"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory OtherAccountManagementEventsFailure {
            Name      = "Other Account Management Events"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory KerberosServiceTicketOperationsSuccess {
            Name      = "Kerberos Service Ticket Operations"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory KerberosServiceTicketOperationsFailure {
            Name      = "Kerberos Service Ticket Operations"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory OtherAccountLogonEventsSuccess {
            Name      = "Other Account Logon Events"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory OtherAccountLogonEventsFailure {
            Name      = "Other Account Logon Events"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory KerberosAuthenticationServiceSuccess {
            Name      = "Kerberos Authentication Service"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory KerberosAuthenticationServiceFailure {
            Name      = "Kerberos Authentication Service"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        AuditPolicySubcategory CredentialValidationSuccess {
            Name      = "Credential Validation"
            AuditFlag = "Success"
            Ensure    = "Present"
        }
        AuditPolicySubcategory CredentialValidationFailure {
            Name      = "Credential Validation"
            AuditFlag = "Failure"
            Ensure    = "Present"
        }
        #endregion
        #region UserRightsAssignment
        UserRightsAssignment Access_this_computer_from_the_network {
            Identity = '*S-1-5-32-551', '*S-1-5-32-544', '*S-1-5-11'
            Policy   = 'Access_this_computer_from_the_network'
            Ensure   = 'Present'
        }
        UserRightsAssignment Adjust_memory_quotas_for_a_process {
            Identity = '*S-1-5-32-544', '*S-1-5-20', '*S-1-5-19'
            Policy   = 'Adjust_memory_quotas_for_a_process'
            Ensure   = 'Present'
        }
        UserRightsAssignment Allow_log_on_locally {
            Identity = '*S-1-5-32-551', '*S-1-5-32-547', '*S-1-5-32-544'
            Policy   = 'Allow_log_on_locally'
            Ensure   = 'Present'
        }
        UserRightsAssignment Allow_log_on_through_Remote_Desktop_Services {
            Identity = '*S-1-5-32-555', '*S-1-5-32-544'
            Policy   = 'Allow_log_on_through_Remote_Desktop_Services'
            Ensure   = 'Present'
        }
        UserRightsAssignment Back_up_files_and_directories {
            Identity = '*S-1-5-32-551', '*S-1-5-32-544'
            Policy   = 'Back_up_files_and_directories'
            Ensure   = 'Present'
        }
        UserRightsAssignment Bypass_traverse_checking {
            Identity = '*S-1-5-32-551', '*S-1-5-32-545', '*S-1-5-32-544', '*S-1-5-20', '*S-1-5-19', '*S-1-1-0'
            Policy   = 'Bypass_traverse_checking'
            Ensure   = 'Present'
        }
        UserRightsAssignment Change_the_system_time {
            Identity = '*S-1-5-32-544', '*S-1-5-19'
            Policy   = 'Change_the_system_time'
            Ensure   = 'Present'
        }
        UserRightsAssignment Change_the_time_zone {
            Identity = '*S-1-5-32-544', '*S-1-5-19'
            Policy   = 'Change_the_time_zone'
            Ensure   = 'Present'
        }
        UserRightsAssignment Create_a_pagefile {
            Identity = '*S-1-5-32-544'
            Policy   = 'Create_a_pagefile'
            Ensure   = 'Present'
        }
        UserRightsAssignment Create_global_objects {
            Identity = '*S-1-5-6', '*S-1-5-32-544', '*S-1-5-20', '*S-1-5-19'
            Policy   = 'Create_global_objects'
            Ensure   = 'Present'
        }
        UserRightsAssignment Create_symbolic_links {
            Identity = '*S-1-5-32-544'
            Policy   = 'Create_symbolic_links'
            Ensure   = 'Present'
        }
        UserRightsAssignment Debug_programs {
            Identity = '*S-1-5-32-544'
            Policy   = 'Debug_programs'
            Ensure   = 'Present'
        }
        UserRightsAssignment Deny_access_to_this_computer_from_the_network {
            Identity = '*S-1-5-7'
            Policy   = 'Deny_access_to_this_computer_from_the_network'
            Ensure   = 'Present'
        }
        UserRightsAssignment Deny_log_on_through_Remote_Desktop_Services {
            Identity = '*S-1-5-32-546'
            Policy   = 'Deny_log_on_through_Remote_Desktop_Services'
            Ensure   = 'Present'
        }
        UserRightsAssignment Force_shutdown_from_a_remote_system {
            Identity = '*S-1-5-32-544'
            Policy   = 'Force_shutdown_from_a_remote_system'
            Ensure   = 'Present'
        }
        UserRightsAssignment Generate_security_audits {
            Identity = '*S-1-5-20', '*S-1-5-19'
            Policy   = 'Generate_security_audits'
            Ensure   = 'Present'
        }
        UserRightsAssignment Impersonate_a_client_after_authentication {
            Identity = '*S-1-5-6', '*S-1-5-32-544', '*S-1-5-20', '*S-1-5-19'
            Policy   = 'Impersonate_a_client_after_authentication'
            Ensure   = 'Present'
        }
        UserRightsAssignment Increase_a_process_working_set {
            Identity = '*S-1-5-32-545'
            Policy   = 'Increase_a_process_working_set'
            Ensure   = 'Present'
        }
        UserRightsAssignment Increase_scheduling_priority {
            Identity = '*S-1-5-32-544'
            Policy   = 'Increase_scheduling_priority'
            Ensure   = 'Present'
        }
        UserRightsAssignment Load_and_unload_device_drivers {
            Identity = '*S-1-5-32-544'
            Policy   = 'Load_and_unload_device_drivers'
            Ensure   = 'Present'
        }
        UserRightsAssignment Log_on_as_a_batch_job {
            Identity = '*S-1-5-32-559', '*S-1-5-32-551', '*S-1-5-32-544'
            Policy   = 'Log_on_as_a_batch_job'
            Ensure   = 'Present'
        }
        UserRightsAssignment Log_on_as_a_service {
            Identity = '*S-1-5-80-0'
            Policy   = 'Log_on_as_a_service'
            Ensure   = 'Present'
        }
        UserRightsAssignment Manage_auditing_and_security_log {
            Identity = '*S-1-5-32-544'
            Policy   = 'Manage_auditing_and_security_log'
            Ensure   = 'Present'
        }
        UserRightsAssignment Modify_firmware_environment_values {
            Identity = '*S-1-5-32-544'
            Policy   = 'Modify_firmware_environment_values'
            Ensure   = 'Present'
        }
        UserRightsAssignment Perform_volume_maintenance_tasks {
            Identity = '*S-1-5-32-544'
            Policy   = 'Perform_volume_maintenance_tasks'
            Ensure   = 'Present'
        }
        UserRightsAssignment Profile_single_process {
            Identity = '*S-1-5-32-544'
            Policy   = 'Profile_single_process'
            Ensure   = 'Present'
        }
        UserRightsAssignment Profile_system_performance {
            Identity = '*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420', '*S-1-5-32-544'
            Policy   = 'Profile_system_performance'
            Ensure   = 'Present'
        }
        UserRightsAssignment Remove_computer_from_docking_station {
            Identity = '*S-1-5-32-544'
            Policy   = 'Remove_computer_from_docking_station'
            Ensure   = 'Present'
        }
        UserRightsAssignment Replace_a_process_level_token {
            Identity = '*S-1-5-20', '*S-1-5-19'
            Policy   = 'Replace_a_process_level_token'
            Ensure   = 'Present'
        }
        UserRightsAssignment Restore_files_and_directories {
            Identity = '*S-1-5-32-551', '*S-1-5-32-544'
            Policy   = 'Restore_files_and_directories'
            Ensure   = 'Present'
        }
        UserRightsAssignment Shut_down_the_system {
            Identity = '*S-1-5-32-551', '*S-1-5-32-544'
            Policy   = 'Shut_down_the_system'
            Ensure   = 'Present'
        }
        UserRightsAssignment Take_ownership_of_files_or_other_objects {
            Identity = '*S-1-5-32-544'
            Policy   = 'Take_ownership_of_files_or_other_objects'
            Ensure   = 'Present'
        }
        #endregion
        #region xRemoteDesktopAdmin
        xRemoteDesktopAdmin EnableRemoteDesktop {
            Ensure             = 'Present'
            UserAuthentication = 'Secure'
        }
        #endregion
        #region xTimeZone
        xTimeZone SetUTC {
            IsSingleInstance = 'Yes'
            TimeZone         = 'UTC'
        }
        #endregion
    }#Node
}

The issue is definitely with the Interactive_logon_Message_text_for_users_attempting_to_log_on  policy.  I get a repo with the exact error when I use your text for the logon message.

@aydeisen A couple of things are going on with this issue.  First off the SecurityPolicyDsc is a wrapper around secedit.exe.  Secedit.exe uses an INI file with security policies and their associated values (key value pair).  The value to a policy must be on one line.  If the message is a multiple line message a comma is used for the line break and if a comma is intended for grammar it must be surrounded with double quotes.
For example the string:
'Line 1 - Message for line 1.,Line 2 - Message for line 2"," words"," separated"," with"," commas.,Line 3 - Message for line 3.'
With result with the formatted message:
Line 1 - Message for line 1.
Line 2 - Message for line 2, words, separated, with, commas.
Line 3 - Message for line 3.
An example of this is in - https://github.com/PowerShell/SecurityPolicyDsc/blob/dev/Examples/SecurityOption_LogonMessage_Example.ps1
For you to get your configuration to succeed you will need to get the code from the dev branch and update your $LegalNoticeText  to:
'UNAUTHORIZED ACCESS - Unauthorized access to this system will expose you to criminal prosecution and civil proceedings.,AUTHORIZED ACCESS - Authorized users must use company computer assets and services"," including hardware"," software"," and services provided by company or company contractors"," in accordance with applicable law and company policies. Any other use is prohibited and will expose the user to criminal penalties"," civil proceedings"," and company disciplinary action"," including immediate termination"," to the fullest extent not expressly prohibited by applicable law.,EXPECTATIONS OF PRIVACY - Except as otherwise provided by contract or applicable law"," all information and data sent or received through"," or contained in company computers"," computer systems"," or networks"," including electronic mail and Internet usage logs"," is the property of the company and is not the property"," nor the private information"," of the user. Subject to applicable law"," the company reserves the right to access"," filter"," delete"," monitor"," intercept"," inspect and disclose all information sent or received through or stored in company computer assets"," at any time without prior notice"," for any purpose"," including compliance with law enforcement requests and applicable laws"," protection of company assets"," or to reduce demands on company E-Mail systems and storage capabilities.'

@jcwalker: The changes in the Dev branch worked to resolve the issue with the legal text, and I'm no longer receiving an error for those settings.  However, I'd prefer to wait for those changes to be packaged in a release before I push them to my environment.


error: no kind "ClusterIssuer" is registered for version "certmanager.k8s.io/v1alpha1

/kind bug
What happened:
After creating ClusterIssuer, looking at the logs shows:

error: no kind "ClusterIssuer" is registered for version "certmanager.k8s.io/v1alpha1"

Environment:

Kubernetes version (use kubectl version): 1.9.2
Cloud provider or hardware configuration**: Azure AKS
Install tools: cert-manager-v0.3.1

It sounds like you've not properly installed the CRDs for cert-manager. How did you install it? via Helm?

@munnerz Yes, here the command i used, am i missing something:
helm install --name cert-manager -f cert-manager-values.yaml --namespace=default stable/cert-manager --set rbac.create=false

Can you provide the output of kubectl get customresourcedefinitions and helm list?

kubectl get customresourcedefinitions:

certificates.certmanager.k8s.io     7h
clusterissuers.certmanager.k8s.io   7h
issuers.certmanager.k8s.io          7h

helm list

NAME            REVISION        UPDATED                         STATUS          CHART                   NAMESPACE
cert-manager    1               Tue Jun  5 18:27:39 2018        DEPLOYED        cert-manager-v0.3.1     default
nginx-ingress   1               Sat Jun  2 23:09:48 2018        DEPLOYED        nginx-ingress-0.20.1    default

And can you provide the full logs from cert-manager? Have those error messages stopped being printed now?
Sometimes this message can be printed when cert-manager is running before the CRD has been installed (i.e. when it first starts).

Yes, the messages are printed now, i tried to reinstall  it, but i always get the same issue, here are the logs from cert-manager:

I0606 05:39:27.877587       1 controller.go:177] certificates controller: syncing item 'default/ff-sample-crt'
I0606 05:39:27.877894       1 sync.go:65] Issuer letsencrypt-staging not ready
E0606 05:39:27.877960       1 controller.go:186] certificates controller: Re-queuing item "default/ff-sample-crt" due to error processing: Issuer letsencrypt-staging not
ready
I0606 05:40:27.878183       1 controller.go:177] certificates controller: syncing item 'default/ff-sample-crt'
I0606 05:40:27.878284       1 sync.go:65] Issuer letsencrypt-staging not ready
E0606 05:40:27.878498       1 controller.go:186] certificates controller: Re-queuing item "default/ff-sample-crt" due to error processing: Issuer letsencrypt-staging not
ready
I0606 05:41:27.878659       1 controller.go:177] certificates controller: syncing item 'default/ff-sample-crt'
I0606 05:41:27.878712       1 sync.go:65] Issuer letsencrypt-staging not ready
E0606 05:41:27.878768       1 controller.go:186] certificates controller: Re-queuing item "default/ff-sample-crt" due to error processing: Issuer letsencrypt-staging not
ready
I0606 05:42:27.878956       1 controller.go:177] certificates controller: syncing item 'default/ff-sample-crt'
I0606 05:42:27.878998       1 sync.go:65] Issuer letsencrypt-staging not ready
E0606 05:42:27.879032       1 controller.go:186] certificates controller: Re-queuing item "default/ff-sample-crt" due to error processing: Issuer letsencrypt-staging not
ready

Did you ever end up figuring this out by chance?

@ivalexa @munnerz get the same issue, any path to follow to resolve it? Thanks

@nicolls1 @sneko @ivalexa I have had this issue as well with the letsencrypt-staging issuer as well. The fix was to update the ACME server URL in your issuer:
https://acme-staging-v02.api.letsencrypt.org/directory
instead of
https://acme-staging.api.letsencrypt.org/directory

Thanks @KimGressens ! It solves the error message I had.
Note that for prod Issuer you need to specify:
https://acme-v02.api.letsencrypt.org/directory

@duzy please keep issues on topic; but to answer your question, see "static manifests" in https://cert-manager.readthedocs.io/en/latest/getting-started/2-installing.html

@djmitche Yes, thank you. I'm working with the static manifests and fighting against other issues, I appreciated your link.

Hi there,
I've been facing the same problem here, have tried to change the url but it had no effect in my scenario:
apiVersion: certmananger.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email<EMAIL_ADDRESS>    privateKeySecretRef:
      name: letsencrypt-prod
    dns01:
      providers:
      - name: cf-dns
        cloudflare:
          email<EMAIL_ADDRESS>          apiKeySecretRef:
            name: cloudflare-dns
            key: api-key

I'm trying to follow the steps in this tutorial, but I'm still getting the message:
error: unable to recognize "issuer.yaml": no matches for kind "ClusterIssuer" in version "certmananger.k8s.io/v1alpha1"

Any of u had a different outcome?

certmananger -> certmanager?

I'm facing the same issue and changing the server URL did not help me.  I'm following this guide but got stuck on creating the ClusterIssuer.

@markhorrocks what version of cert manager are you using?
I have the same issue which is on version cert-manager-v0.5.0  . I have updated the acme url aswell.
apiVersion: certmanager.k8s.io/v1alpha1 kind: ClusterIssuer metadata:   name: letsencrypt-staging spec:   acme:     email: <Email>     http01: {}     privateKeySecretRef:       name: letsencrypt-staging     server: https://acme-staging-v02.api.letsencrypt.org/directory

@markhorrocks did you try apiVersion: cert-manager.io/v1alpha2?

@markhorrocks did you try apiVersion: cert-manager.io/v1alpha2?

This worked cert-manager v0.11.0

Same issue,
reading this post, I figured certmanager.k8s.io/v1alpha1 -> cert-manager.io/v1alpha2
thank you
more details here: https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/
now.. I am getting this validation error
error: error validating "letsencrypt-clusterissuer-staging.yaml": error validating data: ValidationError(ClusterIssuer.spec.acme): unknown field "http01" in io.cert-manager.v1alpha2.ClusterIssuer.spec.acme; if you choose to ignore these errors, turn validation off with --validate=false

removed the http01, seems to work but not sure about the consequences. Getting off topic. I will stop here.