Tutorial/guide to install?

Hi, i cant seem to find any guide on how to implement this on my server.
Thanks

Bump

Same

Use the jar from this repository as a substitute for your waterfall or bungee jar. Then add the jar from this repo: https://github.com/ArclightPowered/lightfall-client to the mod folder in Forge, then it should hopefully work

@SlyceDF


cookieStore

lib Update Request
The cookieStore API
Configuration Check

My compilation target is esnext and my lib is ["dom", "dom.iterable", "esnext"].
Missing / Incorrect Definition

cookieStore: https://developer.mozilla.org/en-US/docs/Web/API/CookieStore
Sample Code
From https://davidwalsh.name/cookiestore
await cookieStore.set({
  name: "dw-test",
  value: 1,
  domain: 'davidwalsh.name',
  // Very far in the future!
  expires: Date.now() + Date.now()
});

const testCookie = await cookieStore.get('dw-test');

Documentation Link
https://developer.mozilla.org/en-US/docs/Web/API/CookieStore

Note: I'm a little confused by DOM lib generator repo. Should I be creating that issue there? It also mentions that it needs to be implemented in two major engines, and maybe Chromium counts as one? I'd have thought it'd make sense to allow including it explicitly via lib somehow though.
FireFox implementation tracking issue
Safari implementation tracking issue

We don't include APIs that aren't in all major browsers yet


Fine tune BatchProtocol class that is sketched out on the batch-server branch of cmcantalupo

estimate 2

Discussion in architecture meeting lead to some proposed changes to the current sketch:
https://github.com/cmcantalupo/geopm/tree/batch-server

Base class for Protocol that has two derived classes, one for server and one for client
Clean up notes and comments put in place live during the architecture meeting.

Parent story: #1857

Moved working branch here:
https://github.com/cmcantalupo/geopm/tree/issue-1860


[PORT] BotFrameworkAdapter: Make CreateConversationAsync agnostic to the credential type

Port this change from botbuilder-dotnet/master branch:
https://github.com/microsoft/botbuilder-dotnet/pull/4332

Pending on decision around binary compat. This PR as-is breaks binary compat. If binary compat is to be maintained, then I'll swap to overloading instead of non-breaking modification.
Fixes https://github.com/microsoft/botbuilder-dotnet/issues/3962
Changed projects

Microsoft.Bot.Builder

Consider moving the API to service client credentials rather than just app credentials.

@johnataylor it seems like the Javascript BotFrameworkAdapter already uses the generic AppCredentials type for its internal credentials reference. Logic exists in the constructor to create the relevant concrete credentials instance.
There is a helper method that builds a MicrosoftAppCredentials instance but it appears to be specific to bot-to-bot communication.
The createConversation method itself does not accept a credentials reference, so I'm not sure what needs to be ported. Is this still relevant to the JS SDK? What else am I missing?

https://github.com/microsoft/botbuilder-js/issues/3533


Refactor freetds to only copy needed files

What does this PR do?
Avoid adding unnecessary files to agent build.
Only copying libtdsodbc.so and libtdsodbc.so.0.0.0 works:
Image: datadog/agent-dev:alex-clean-up-freetds-install-copy

  Running Checks
  ==============

    sqlserver (1.18.0)
    ------------------
      Instance ID: sqlserver:588d528f1739085e [OK]
      Configuration Source: file:/etc/datadog-agent/conf.d/sqlserver.d/sqlserver.yaml
      Total Runs: 1
      Metric Samples: Last Run: 17, Total: 17
      Events: Last Run: 0, Total: 0
      Service Checks: Last Run: 1, Total: 1
      Average Execution Time : 16ms
      Last Execution Date : 2020-07-01 13:03:20.000000 UTC
      Last Successful Execution Date : 2020-07-01 13:03:20.000000 UTC

Motivation
Avoid adding unnecessary files to agent build.
List of files here: https://github.com/DataDog/datadog-agent/pull/5864
Describe your test plan
e2e QA

Refactor of https://github.com/DataDog/datadog-agent/pull/5478


Fix trace init loop

Adding automatic initialization of the CMP logging facility in PR #9107, which uses the trace API, it turned out that an endless init loop is entered when an init function that uses the trace API is added, using RUN_ONCE, to OPENSSL_init_crypto().
I found that this is because set_trace_data() in trace.c dares to call OPENSSL_init_crypto(0, NULL) while it would be sufficient to make sure that the code in ossl_trace_init() is called once.
This PR does the respective fix, making sure that ossl_trace_init() is called once also in case  OPENSSL_init_crypto() is invoked beforehand.
When analyzing this issue I found in the doc of OPENSSL_init_crypto() that

OPENSSL_init_crypto() MUST be called by application code prior to any other OpenSSL function calls.

which is not the case in test/testutil/main.c.
At first I suspected that this might fix the above issue, but it does not. Still the test application should call the init function right away, which is achieved by the other commit in this PR.

OPENSSL_init_crypto() MUST be called by application code prior to any other OpenSSL function calls.

The first part of that sentence is critical. The full sentence is:

Therefore, in order to perform non-default initialisation,
OPENSSL_init_crypto() MUST be called by application code prior to
any other OpenSSL function calls.

i.e. if you are planning to non-default initialisation then it must be the first thing you do. If you're just doing default initialisation (which is the case most of the time), you don't have to do anything (i.e. you don't need to call it at all).

@mattcaswell, all requested changes done.
Shall I squash this?

Shall I squash this?

Yes please.
Tip: when creating fixup commits for earlier commits you can do this:
git commit --fixup XXX
Where XXX is the hash for the earlier commit you are fixing up.
This automatically creates the commit description for you and makes it clear to all reviewers that the intention is to squash the commit. Later when you come to do the squashing you can do this:
git rebase -i --autosquash HEAD~X
Where X is the number of commits that you need to go back in order to perform the squash. Any commits flagged as fixup commits will be automatically moved and flagged for squashing in the interactive rebase.

Thanks @mattcaswell for your hint regarding fixup commits!
Squashed.

I found some macros could be cleaned up, but that is not the scope of this PR...

Pushed to master as (cf0932cdd94f067ed18ce78bea038d919f69038f), thanks!


Site request: npodoc.nl

npodoc.nl is in some way part of npo.nl, so I expected it to be supported already. However, when I enter for instance http://www.npodoc.nl/live/vipdoc/laura-poitras.html it does not grab all present videos on that site. Videos on npodoc.nl are not available on npo.nl.
Would you like to add support for npodoc.nl?

That website is more like a summary of multiple videos. It's better to ask support for the only remaining video that's still available: http://www.npodoc.nl/documentaires/series/interviews/regisseur-aan-de-keukentafel/laura-poitras.html.
In the html-source look for the attribute "data-media-id". It's value in this case, WO_VPRO_714693, can then be used with the [NPO]-extractor.
You could've also found this video on npo.nl btw: http://www.npo.nl/regisseur-aan-de-keukentafel-internationaal/25-11-2014/WO_VPRO_714693.
The NPO Doc urls also come in the shape of http://www.npodoc.nl/speel.VPWON_1232735.html for example. The extraction process remains the same.


fix(content-docs): always sort autogenerated sidebar items by file/folder name by default

Motivation
Fix #6698
Have you read the Contributing Guidelines on pull requests?
Yes
Test Plan

Okay, this is not easy to design... What should happen if some items have positions but others don't? Should we use file names, or customized labels if they exist? Should we be future-proof and take HTML items or link items into account?

This causes slight behavior inconsistencies because the doc items are now sorted by file names instead of IDs—although we did promise to sort by file names in the docs. Therefore, it's considered a bug fix and not a breaking change. In addition, the sorting result is now deterministic, since before the tests randomly resolved in a different order (I don't know if any other contributor had experienced the same).

ok, that seems to work, comparing these 2 URLs I can see the change:

https://deploy-preview-6700--docusaurus-2.netlify.app/tests/docs/category-links-generated-index-slug/
https://docusaurus.io/tests/docs/category-links-generated-index-slug

Going to merge but 🤷♂  I don't know if this is really useful. Why not sort by sidebar item label (if any) instead of source.
Also it's preferable to add a new test case instead of modifying test+snapshot+impl. It's complicated for me to review if everything changes at once, and hard to notice possible regressions

Also it's preferable to add a new test case instead of modifying test+snapshot+impl.

Existing test cases are actually bad, because they have colliding sidebar positions. I merely fixed them so that the snapshots stay the same. The only changed one was the undeterministic one

Why not sort by sidebar item label (if any) instead of source.

If we are starting from scratch I'd agree with that, but this "alphabetical order by file/folder name" has always been the behavior and documented, so I'd prefer to leave it as-is 😄


Add ')' to fix broken link

Hello @FannyVieira,Thanks again for the PR! It's HACKTOBERFEST! We want to show our appreciation by sending                                              you some special Hacktoberfest swag. If you have not already, could you please fill out                                              this form so we can send it to you? Thanks!                                             Team SendGrid DX


Fix footer messages in starter pack wizard

At footer messages in starter pack wizard, when selected two feeds, first of selected items are displayed as 'You', not the feed's name. This PR fixes this problem.
This PR also contains companion Japanese message updates.

Can you pls separate the functional change and the translation into separate PRs? Also a screenshot of before/after would be very helpful. Thanks.

The problem with coupling a functional change to a translation change is that it's more difficult to tell how to modify other translations, and kind of leaves us in an inconsistent state. Ideally we'd just make the fix alone without invalidating translations if possible.

verified English, French, Japanese
https://github.com/bluesky-social/social-app/assets/810438/49e524ca-c282-4ccc-b3f5-8f8dfb09a44a

Ah sorry to mix functional changes and translation updates. Thanks.


Implement CI/CD for the Project

SUMMARY

Create CI/CD GitHub action
ISSUE TYPE

Feature Idea

COMPONENT NAME

GitHub Repository
ADDITIONAL INFORMATION

Create GitHub action to do:

Create a new Release with new features
Publish to PyPi

Added security scan

Added code coverage with codecov


Portaljs example dataset-frictionless not showing Explorer component

Acceptance

[x] New explorer component is displayed in the https://portal-js.vercel.app/ example page

This issue is caused by the build cache on Vercel. When automatic builds are started on push to this repository, Vercel uses cache packages. So the changes made to the Portaljs package are not picked up during site-building.
This can be solved by deploying Portaljs as an npm package with version tags.
For now, I solved this by manually redeploying the site on the Vercel dashboard and not using cache. See https://portal-js.vercel.app/


fix warn message

Pull Request Checklist
Is this in reference to an existing issue?
General

[ ] Update Changelog following the conventions laid out here

[ ] Update README with any necessary configuration snippets

[ ] Binstubs are created if needed

[ ] RuboCop passes

[ ] Existing tests pass

New Plugins

[ ] Tests

[ ] Add the plugin to the README

[ ] Does it have a complete header as outlined here

Purpose
Known Compatibility Issues

Superseded by #20


The target "pack" does not exist in the project. (GraphEngine.ServiceFabric)

Hi,
When I build GE on win10/VS2017, the error happens:

Any tips on how to solve it? Thanks!

btw, in "GraphEngine.ServiceFabric.sln", "Trinity.ServiceFabric.SampleApplication\Trinity.ServiceFabric.SampleApplication.sfproj" is a clerical error.

@bidiudiu hi! we're aware of this problem. If we use the new csproj format, we can specify <IsPackable>false</IsPackable> -- I will convert this project later.
As for the build, I think this won't be an issue, and will be ignored.

You'll have to install ServiceFabric SDK to build the SF packages ;)

I see, Thanks yatli!


Problem with TLS between Swarm <----> Docker hosts

After enabling TLS on my POC setup, I am experiencing an issue with some functionality. I have everything setup and working, but when I do a docker create it gives me ‘x509 certificate signed by unknown authority’. It creates (but not starts) the container and other commands such as ps, info, rm work as expected.
Additional info can be found here: https://gist.github.com/technolo-g/dbc1a1445f1c7215b6ae

@aluzzardi now that you merged TLS PR, can you take care of this one please ?
Thank you!

@technolo-g I think I figured it out, can you test #242 please ?

@vieux it seems something is still awry and the healthcheck code is not working the same as the rest. Sticking to file based discovery, given a config of
dockerhost01:2376
dockerhost02:2376
dockerhost03:2376
dockerhost04:2376
dockerhost05:2376

and a docker swarm start line of
/usr/local/bin/swarm manage \
    --tlsverify \
    --tlscacert=/etc/pki/tls/ca.pem \
    --tlscert=/etc/pki/tls/swarm-cert.pem \
    --tlskey=/etc/pki/tls/swarm-key.pem  \
    --discovery file:///etc/swarm_config \
    -H tcp://<IP_ADDRESS>:2376 \
    -strategy random

I get the following log entries:
INFO[0000] Listening for HTTP on tcp (<IP_ADDRESS>:2376)
ERRO[0025] Get dockerhost01:2376/v1.15/info: unsupported protocol scheme "dockerhost01"
ERRO[0025] Get dockerhost02:2376/v1.15/info: unsupported protocol scheme "dockerhost02"
ERRO[0025] Get dockerhost03:2376/v1.15/info: unsupported protocol scheme "dockerhost03"
ERRO[0025] Get dockerhost04:2376/v1.15/info: unsupported protocol scheme "dockerhost04"
ERRO[0025] Get dockerhost05:2376/v1.15/info: unsupported protocol scheme "dockerhost05"
INFO[0027] POST /v1.16/containers/create
ERRO[0027] No healthy node available in the cluster

When setting the scheme in the swarm config as so:
https://dockerhost01:2376
https://dockerhost02:2376
https://dockerhost03:2376
https://dockerhost04:2376
https://dockerhost05:2376

I am able to interact with swarm:
INFO[0000] Listening for HTTP on tcp (<IP_ADDRESS>:2376)
INFO[0002] GET /v1.16/info

But standing up a container is non-functional:
$ docker run --rm -i -t ubuntu:latest /bin/bash
FATA[0000] Error response from daemon: Post https://https://dockerhost04:2376/v1.16/containers/9076b888a3d63d091f71ddd5ac47187ba828ee4408fac19d2e0c84884199e9cf/start: dial tcp: too many colons in address https://dockerhost04:2376

@aluzzardi @vieux, This does still appear to be a problem.


Use "TARGET_ENV: velocity" for msi signing job

Without this var, the "signed" MSI artifact is corrupted/uninstallable.

Signing service has been updated. Not required, for now.


Inconsistent ids being generated by DefaultAuthenticationKeyGenerator

There is a bug on line 49 in org.springframework.security.oauth2.provider.token.DefaultAuthenticationKeyGenerator
values.put(SCOPE, OAuth2Utils.formatParameterList(authorizationRequest.getScope()));

authorizationRequest.getScope() returns a Set. This can (and likely) will be an un-ordered set of strings. Calling this multiple times can therefore return different values for the same set of scopes. This causes issues further down-stream where the same authentication can be given different ids.
The fix for this is to sort the scopes being fed into OAuth2Utils.formatParameterList.
e.g.
List<String> scopesList = new ArrayList<>();
scopesList.addAll(authorizationRequest.getScope());
Collections.sort(scopesList);
values.put(SCOPE, OAuth2Utils.formatParameterList(scopesList));

Agree there's probably a bug. It's low impact because the AuthorizationRequest actually sorts the scopes in the setScope() method, so mostly you will find they are sorted already.

Hi @alvinpb, I have looked into this and as @dsyer has mentioned, the scopes are sorted in the AuthorizationRequest.setScope() method (which delegates to super.setScope() of BaseRequest). The scopes will be naturally ordered (upon construction) using a TreeSet and will always preserve that same order when calling AuthorizationRequest.getScope().
I don't see a bug here so I'm going to close this issue. However, if you can provide a test reproducing the issue you are having than please re-open this issue and I will look into this further.
Also, you may want to look at our existing test for scope ordering at AuthorizationRequestTests.testScopeSortedOrder.

The issue came about when I was testing OAuth which Serializes/Deserializes the Authentation object. I have written a json serializer/deserializer which did this but then found that there were issues with scope  because it was always generating new keys.
Looking at BaseRequest - it looks to be using LinkedHashSet which would AFAIK use the original order of the collection being passed in - which is indeterminate.

@alvinpb If you're able to reproduce this issue with a test that you can provide me that would be very helpful.


demo site alignment is off

Hi
looks very promising, but the baseline on the demo site is not aligned with the background lines. Shouldn't that be the case?

v.1.0.1 released to align text baseline with grid_bg


Display dependency components list for selected products installed

Fix #1342

The design are verified by UX team. Currently the whole list of components will be displayed in the card, dependent on the product.
The height of the card changes according to the content size. If no dependent components are installed, a message is displayed. No dependent component installed.


Save theme customisations ?

Operating system
osx
Node.js version
0
Shopify CLI version
2.00
Browsers
Chrome
Version
4 (Current)
Modifications
No response
Details
How do you deploy a theme without losing the changes made in the theme customiser? I would like to be able to copy over the changes I make in the temporary editor when using  "npm run start"
Notice

[X] I read the notice

In addition to remote themes in your store, npm run shopify:pull returns your dev theme as an option. You can pull in your json changes there and commit to your repo

https://shopify.dev/themes/tools/cli/commands#dev
Add flag to package.json - --theme-editor-sync


Specify schema by reference

Hey!
It would be really nice to have an escape-hatch for situations where generating a JSON Schema for the type isn't trivial/possible. Is there a way to do that already, perhaps by inlining a JSON Schema?
What I have in mind, is a way to define a schema being "external" using the conventional relative references of OpenAPI + JSON Schema
For example if I have a route (in Axum, but not relevant):
#[utoipa::path(
    post,
    path = "/entities",
    request_body = CreateEntityRequest,
    responses(
      (status = 201, content_type = "application/json", description = "Entity created successfully", body = "./Entity.json"),
    ),
)]
async fn create_entity(
    body: Json<CreateEntityTypeRequest>
) -> Result<Json<Entity>, impl IntoResponse> { .. }

I would like for the body attribute to be the value of the JSON Schema $ref, resulting in
"responses": {
  "201": {
    "description": "Entity created successfully",
    "content": {
      "application/json": {
        "schema": { "$ref": "./Entity.json" }
      }
    }
  }
}

where the OpenAPI Spec consumer would have to visit the relative ./Entity.json path, expecting it to be retrievable.
Obviously this file could also be inlined in the spec at compile-time, but this seems like a reasonable middle-ground. Perhaps overloading body isn't ideal, but the general idea is that a path can be given in place of a concrete type.
Any thoughts? :)

Hi, unfortunately this is not supported at the moment. Although implementing support for this is somewhat simple. For example I could implement following syntax where ref(...) would translate above mentioned file reference syntax.
#[utoipa::path(
    post,
    path = "/entities",
    request_body = CreateEntityRequest,
    responses(
      (status = 201, description = "Entity created successfully",
           body = ref("./Entity.json")),
    ),
)]
async fn create_entity(
    body: Json<CreateEntityTypeRequest>
) -> Result<Json<Entity>, impl IntoResponse> { .. }

But this needs bit of planning thus it would be beneficial to add the support not just to response bodies but to request bodies and others. I'll add it to the projects kanban board for later work.

Obviously this file could also be inlined in the spec at compile-time

This would be cool ability but need to see whether this can be achieved in feasible manner. But at least $ref object can be created if nothing.
Thanks for suggestion :)

Cool, thanks for the insights and thoughts!
To share my workaround so far, I'm using an addon to replace any Ref component that starts with EXTERNAL_() with ./().json mutably. This works fine for my purposes :)

@thehabbos007 support for this is being added by the attached PR


Do not return Relations with templates

Linked to #1262
One exception:
Classification and Related for PLOGESTRB
Other relations with Templates are not valid. If Synonym / cloud-type, remove that template entity from the list.
No entity can have classification to a Template, but a Template can have a classification towards non-Template (= a Template may be on the first position, index 0)

I confirm this reasoning :-)


better CI that uses less resources

We could make use of composite actions that installs the environment once and then gets used by several other yml ci scripts

perhaps look into caching options


Migrate to dart-sass

node-sass is deprecated and doesn't support some newer language features.
This PR replaces it with sass, and updates unit tests to match the new error messages/syntax rules.

Thanks, but this package doesn't get much attention, and as per the name, was an early sample of wiring up node-sass. Probably better to try a new package if you're looking for dart-sass

Fair enough, makes sense. I just really liked the simplicity of this middleware for small projects, and wanted @use but couldn't find any similar alternatives using dart-sass.
Might end up publishing this fork, thanks for your work though :)

There is https://www.npmjs.com/package/dart-sass-middleware for express, that can be further extended.


Will there be any support of HDMI?

I tried connecting my monitor by HDMI on Ventura, and found it just didn't work.
Is there a way for me to connect a monitor through HDMI? Thank you so much.

I tried connecting my monitor by HDMI on Ventura, and found it just didn't work. Is there a way for me to connect a monitor through HDMI? Thank you so much.

Hello. You can try the new EFI.


feat : create a TO-DO extension

Create an extension for the TO-DO list, where users can add multiple tasks and view them, also can delete them. Also when there is no task to be done show "Add your first TO-DO"

[ ] Add tasks
[ ] Delete them
[ ] View them
[ ] When no task then "Add your first task"
[ ] A good UI
[ ] All codes in a folder and add a readme file with preview of extension and its working

Happy contributions 🎊

I would like to work on this issue under JWoC

sure @whiteHatpro assigning you
All the best 👍


Add expand/collapse all layer groups feature (#130)

Response to #130:

First off sorry it took me so long to review this pull request, I was planning to change the UI a little and wanted to make sure it wouldn't conflict (it doesn't).
The functionality of the expand/collapse looks good. Although I have a couple of comments about the UI.
The button is a toggle button. Toggle buttons usually represent the state, but here we actually have 3 states rather than 2.

All expanded
All collapsed
Some expanded / some collapsed (the missing one)

The button also feels like something you wouldn't use often, so should it be such a big part of the main UI?
An alternative would be to put a little menu kind of like the one shown here https://material.io/guidelines/components/menus.html#menus-usage with 2 options

Expand all
Collapse all

What do you think @gregorywolanski does this make sense and is it worth the extra effort?

Thanks for the detailed reply and I think it makes sense. My reason for wanting a context menu was additionally that I think there may be more options later down the road... but that's not the problem at hand so I probably shouldn't try to predict the future.
Lets stick with your solution.
Although there is a styling issue, expand should sit to the right with the layers button (as in your screenshot)

@orangemug I’ll fix it. What browser do you use?

What browser do you use, on which OS?
Latest chrome/firefox on the mac

Thanks, @orangemug. Silly mistake. Fixed. :)

Happy New Year, @orangemug! :)
I’m looking forward to reading about the changes in the UI you have planned.


Three numbers sort setup - needs help

@mrumiker I need help with this - I don't know how to initialize the function, but I should have all the tests setup. If you could check out the branch and add the right stub to the function this should be done.

Closed this one because I merged it with my own PR


[dagster-pipes-java] remove the --full argument

I don't think it's needed since most of the tests are being run with it anyway.

Closing in favor of #75


when depploying imagepullsecret expected on the pod level

What commit ID of Portieris did you experience the problem with?
0.5.1
What went wrong?
when deploying the portieries expects to ImagePullSecret on pod level
What should have happened differently?
ImagePullSecret can be on deployment or in the helm templates as well
How can it be reproduced?
kubectl run  --image=nginx
Any other relevant information
Output:
k apply -f deployment.yaml
Error from server (InternalError): error when creating "deployment.yaml": Internal error occurred: admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:
Deny "docker.io/nginx:1.7.9", no ImagePullSecret defined for docker.io
Policy:
piVersion: securityenforcement.admission.cloud.ibm.com/v1beta1
kind: ImagePolicy
metadata:
annotations:
helm.sh/hook: post-install
helm.sh/hook-weight: "1"
name: allow-signed-only
spec:
repositories:
- name: "docker.io/nginx"
policy:
trust:
enabled: true

Hi all, I have the same problem.
If I edit the portieris-default-cluster-image-policy in below way:
apiVersion: securityenforcement.admission.cloud.ibm.com/v1beta1
kind: ClusterImagePolicy
metadata:
  annotations:
    helm.sh/hook: post-install
    helm.sh/hook-weight: "1"
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"securityenforcement.admission.cloud.ibm.com/v1beta1","kind":"ClusterImagePolicy","metadata":{"annotations":{"helm.sh/hook":"post-install","helm.sh/hook-weight":"1"},"name":"portieris-default-cluster-image-policy","namespace":""},"spec":{"repositories":[{"name":"*","policy":{"trust":{"enabled":true}}}]}}
  creationTimestamp: "2019-02-01T17:34:15Z"
  generation: 1
  name: portieris-default-cluster-image-policy
  resourceVersion: "295269"
  selfLink: /apis/securityenforcement.admission.cloud.ibm.com/v1beta1/clusterimagepolicies/portieris-default-cluster-image-policy
  uid: 986a017e-2647-11e9-8839-d645fdfa8749
spec:
  repositories:
  - name: xxxreg.azurecr.io/*
    policy:
      trust:
        enabled: false

I'm able, correctly, to deploy new pods for xxxreg.azurecr.io registry. I have the below values configured as well:
kubectl get secrets

NAME                  TYPE                                  DATA   AGE
acr-auth              kubernetes.io/dockerconfigjson        1      10m
default-token-pvjrl   kubernetes.io/service-account-token   3      2d21h

kubectl get serviceaccounts default -o yaml

apiVersion: v1
imagePullSecrets:
- name: acr-auth
kind: ServiceAccount
metadata:
  creationTimestamp: "2019-02-01T16:58:20Z"
  name: default
  namespace: default
  resourceVersion: "290613"
  selfLink: /api/v1/namespaces/default/serviceaccounts/default
  uid: 93d4791f-2642-11e9-8839-d645fdfa8749
secrets:
- name: default-token-pvjrl

The secret was created with this command (I have obfuscated user/password)
kubectl create secret docker-registry acr-auth --docker-server=xxxreg.azurecr.io --docker-username=xxxxx-xxx-xxx-xxx-xxx --docker-password=xxxxxxxxxxx --docker-email<EMAIL_ADDRESS>
When I try to enforce policy changing enabled to true, I receive below error:
kubectl run nosig --generator=run-pod/v1 --image=xxxreg.azurecr.io/nginx:sig --namespace=default

Error from server (InternalError): Internal error occurred: admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:
Deny "xxxreg.azurecr.io/nginx:sig", no valid ImagePullSecret defined for xxxreg.azurecr.io

It's like Portieris doesn't find imagePullSecrets.
Could you help me please?

@simonesavi You've got the wrong error message due to a bug (#48), but we don't have a trust server for Azure Container Registry in our mapping.
I don't think ACR is multi-tenant on the same DNS name, hence your xxxreg.azurecr.io in your comments. You'll need to specify the trustServer parameter in your policy, see the Readme for an example.

@molepigeon I have cleaned portieris installation and I have re-loaded it starting from master in which you have submitted update.
After I have changed policy as follow:
If I edit the portieris-default-cluster-image-policy in below way:
# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: securityenforcement.admission.cloud.ibm.com/v1beta1
kind: ClusterImagePolicy
metadata:
  annotations:
    helm.sh/hook: post-install
    helm.sh/hook-weight: "1"
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"securityenforcement.admission.cloud.ibm.com/v1beta1","kind":"ClusterImagePolicy","metadata":{"annotations":{"helm.sh/hook":"post-install","helm.sh/hook-weight":"1"},"name":"portieris-default-cluster-image-policy","namespace":""},"spec":{"repositories":[{"name":"*","policy":{"trust":{"enabled":true}}}]}}
  creationTimestamp: "2019-02-04T16:39:24Z"
  generation: 1
  name: portieris-default-cluster-image-policy
  resourceVersion: "304957"
  selfLink: /apis/securityenforcement.admission.cloud.ibm.com/v1beta1/clusterimagepolicies/portieris-default-cluster-image-policy
  uid: 6e0affd7-289b-11e9-80e9-9e86b7719347
spec:
  repositories:
  - name: xxxreg.azurecr.io/*
    policy:
      trust:
        enabled: true
        trustServer: https://xxxreg.azurecr.io

But when I try to install a pod I receive always same error:
kubectl run nosig --generator=run-pod/v1 --image=xxxreg.azurecr/nginx:sig

Error from server (InternalError): Internal error occurred: admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:
Deny "xxxreg.azurecr/nginx:sig", no valid ImagePullSecret defined for xxxreg.azurecr

@simonesavi Your policy looks correct, but I hadn't gotten round to pushing new images and a new chart version that includes the changes. Try using the chart from master now.

@molepigeon I have cleaned kubernetes and I have executed a fresh new installation starting from a fresch master clone. Below the steps that I have used:
git clone https://github.com/IBM/portieris/
cd portieris/
./helm/portieris/gencerts
helm install -n portieris helm/portieris

but the result is always the same.

the issue is in the code not on deployment.
https://github.com/IBM/portieris/blob/master/pkg/controller/notary/controller.go#L123
it checks if you have defined any PullSecrets if not fails ...

@OrlinVasilev Yes, Portieris requires an ImagePullSecret to pull trust data. If anonymous pull is a requirement for you, we'll need to change the code that you've linked to, and the GetContentTrustToken and GetSecretToken functions to include support for anonymous auth with Notary.
Alternatively, you can create a free Docker Hub account and use that IPS.
@simonesavi Please can you turn trust enforcement off, then create your pod, then post the pod specification that appears in Kubernetes? Portieris should be able to extract an IPS from the serviceaccount that's used to spin up the pod, so I would expect it to be able to see your acr-auth secret.
Please can you also verify that your Portieris pods are running from image version 0.5.2. The Portieris pods are created in the ibm-system namespace by default.

@molepigeon below the list of operations I have executed.
kubectl edit ClusterImagePolicy portieris-default-cluster-image-policy
# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: securityenforcement.admission.cloud.ibm.com/v1beta1
kind: ClusterImagePolicy
metadata:
  annotations:
    helm.sh/hook: post-install
    helm.sh/hook-weight: "1"
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"securityenforcement.admission.cloud.ibm.com/v1beta1","kind":"ClusterImagePolicy","metadata":{"annotations":{"helm.sh/hook":"post-install","helm.sh/hook-weight":"1"},"name":"portieris-default-cluster-image-policy","namespace":""},"spec":{"repositories":[{"name":"*","policy":{"trust":{"enabled":true}}}]}}
  creationTimestamp: "2019-02-04T19:27:36Z"
  generation: 1
  name: portieris-default-cluster-image-policy
  resourceVersion: "317171"
  selfLink: /apis/securityenforcement.admission.cloud.ibm.com/v1beta1/clusterimagepolicies/portieris-default-cluster-image-policy
  uid: edb3a6ca-28b2-11e9-80e9-9e86b7719347
spec:
  repositories:
  - name: '*'
    policy:
      trust:
        enabled: false

After I have installed pod (I have obfuscated some values):
kubectl run nosig --generator=run-pod/v1 --image=xxxreg/nginx:sig

pod/nosig created

kubectl get pods

NAME    READY   STATUS             RESTARTS   AGE
nosig   0/1     ImagePullBackOff   0          51s

kubectl get pods -o json

{
    "apiVersion": "v1",
    "items": [
        {
            "apiVersion": "v1",
            "kind": "Pod",
            "metadata": {
                "creationTimestamp": "2019-02-05T15:12:33Z",
                "labels": {
                    "run": "nosig"
                },
                "name": "nosig",
                "namespace": "default",
                "resourceVersion": "400990",
                "selfLink": "/api/v1/namespaces/default/pods/nosig",
                "uid": "76c24f78-2958-11e9-80e9-9e86b771xxxx"
            },
            "spec": {
                "containers": [
                    {
                        "env": [
                            {
                                "name": "KUBERNETES_PORT_443_TCP_ADDR",
                                "value": "xxxrbac-2fcda9b6.hcp.westeurope.azmk8s.io"
                            },
                            {
                                "name": "KUBERNETES_PORT",
                                "value": "tcp://xxxrbac-2fcda9b6.hcp.westeurope.xxx.io:443"
                            },
                            {
                                "name": "KUBERNETES_PORT_443_TCP",
                                "value": "tcp://xxxrbac-2fcda9b6.hcp.westeurope.xxx.io:443"
                            },
                            {
                                "name": "KUBERNETES_SERVICE_HOST",
                                "value": "xxxrbac-2fcda9b6.hcp.westeurope.xxx.io"
                            }
                        ],
                        "image": "xxxreg/nginx:sig",
                        "imagePullPolicy": "IfNotPresent",
                        "name": "nosig",
                        "resources": {},
                        "terminationMessagePath": "/dev/termination-log",
                        "terminationMessagePolicy": "File",
                        "volumeMounts": [
                            {
                                "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
                                "name": "default-token-pvjrl",
                                "readOnly": true
                            }
                        ]
                    }
                ],
                "dnsPolicy": "ClusterFirst",
                "imagePullSecrets": [
                    {
                        "name": "acr-auth"
                    }
                ],
                "nodeName": "aks-agentpool-16481727-0",
                "priority": 0,
                "restartPolicy": "Always",
                "schedulerName": "default-scheduler",
                "securityContext": {},
                "serviceAccount": "default",
                "serviceAccountName": "default",
                "terminationGracePeriodSeconds": 30,
                "tolerations": [
                    {
                        "effect": "NoExecute",
                        "key": "node.kubernetes.io/not-ready",
                        "operator": "Exists",
                        "tolerationSeconds": 300
                    },
                    {
                        "effect": "NoExecute",
                        "key": "node.kubernetes.io/unreachable",
                        "operator": "Exists",
                        "tolerationSeconds": 300
                    }
                ],
                "volumes": [
                    {
                        "name": "default-token-pvjrl",
                        "secret": {
                            "defaultMode": 420,
                            "secretName": "default-token-pvjrl"
                        }
                    }
                ]
            },
            "status": {
                "conditions": [
                    {
                        "lastProbeTime": null,
                        "lastTransitionTime": "2019-02-05T15:12:33Z",
                        "status": "True",
                        "type": "Initialized"
                    },
                    {
                        "lastProbeTime": null,
                        "lastTransitionTime": "2019-02-05T15:12:33Z",
                        "message": "containers with unready status: [nosig]",
                        "reason": "ContainersNotReady",
                        "status": "False",
                        "type": "Ready"
                    },
                    {
                        "lastProbeTime": null,
                        "lastTransitionTime": "2019-02-05T15:12:33Z",
                        "message": "containers with unready status: [nosig]",
                        "reason": "ContainersNotReady",
                        "status": "False",
                        "type": "ContainersReady"
                    },
                    {
                        "lastProbeTime": null,
                        "lastTransitionTime": "2019-02-05T15:12:33Z",
                        "status": "True",
                        "type": "PodScheduled"
                    }
                ],
                "containerStatuses": [
                    {
                        "image": "xxxreg/nginx:sig",
                        "imageID": "",
                        "lastState": {},
                        "name": "nosig",
                        "ready": false,
                        "restartCount": 0,
                        "state": {
                            "waiting": {
                                "message": "Back-off pulling image \"xxxreg/nginx:sig\"",
                                "reason": "ImagePullBackOff"
                            }
                        }
                    }
                ],
                "hostIP": "<IP_ADDRESS>",
                "phase": "Pending",
                "podIP": "<IP_ADDRESS>",
                "qosClass": "BestEffort",
                "startTime": "2019-02-05T15:12:33Z"
            }
        }
    ],
    "kind": "List",
    "metadata": {
        "resourceVersion": "",
        "selfLink": ""
    }
}

kubectl get secrets

NAME                  TYPE                                  DATA   AGE
acr-auth              kubernetes.io/dockerconfigjson        1      25h
default-token-pvjrl   kubernetes.io/service-account-token   3      3d22h

kubectl get secret acr-auth -o yaml

apiVersion: v1
data:
  .dockerconfigjson: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
kind: Secret
metadata:
  creationTimestamp: "2019-02-04T14:21:23Z"
  name: acr-auth
  namespace: default
  resourceVersion: "294846"
  selfLink: /api/v1/namespaces/default/secrets/acr-auth
  uid: 267efd37-2888-11e9-80e9-9e86b7xxxxx
type: kubernetes.io/dockerconfigjson

Please keep in mind that AKS use two mechanisms to authenticate itself to Azure Container Registry. The first one is with Service Principal (here documentation), and the second one is "Access with Kubernetes secret" that is AKS native mechanism that generate imagePullSecrets.
In my configuration I have configured "Access with Kubernetes secret" only after I received the error, but in general, if you use Service Principal, this is not need.
Anyway, as you can see, imagePullSecrets is present in pod installation.

@molepigeon - the code is specifying that you have to have IPS on pod level which is not the case in most cases
normally you have IPS on the SA like default or anything that runs your pods ... or I'm mistaken?
and BTW what why not to have anonymous pull (for example nginx) but signed image?!

@simonesavi That pod hasn't started - I see that it's in ImagePullBackOff. Are you sure that the credentials in your ImagePullSecret are correct? Portieris gives you the "no valid ImagePullSecret" message if it finds a PullSecret in the spec but it can't successfully authenticate with the trust server by using the credentials inside it.
You can find more information about why Portieris wasn't able to use your ImagePullSecret by looking at the logs in the Portieris pods. If you have stern, you can run stern portieris -n ibm-system -f to stream logs from Portieris as it runs. If not, you can run kubectl logs -n ibm-system -l app=portieris --tail=30 to get the last 30 logs.

@OrlinVasilev Portieris runs before the kube built-in mutation that adds pullsecrets from the serviceaccount runs, so it has to do it itself. We extract the pod spec from the workload and set the pullsecrets. You can find that code here: https://github.com/IBM/portieris/blob/master/pkg/kubernetes/podspec.go#L52
As for why Portieris doesn't support anonymous pull, it was designed for use with private registries, specifically IBM Cloud Container Registry, where authentication is required for any pull. Given that the two public registries that Portieris supports (Quay.io and Docker Hub) both allow you to create a free account that you can use with Portieris, we haven't prioritised supporting getting trust data anonymously.

@molepigeon you are right but when I started to test software, I did not care to have a working pod.
Anyway to have a clean situation I have done below operation:

I have cleaned AKS installation, removing all pods, secretes etc.

I have created a new "hello world" docker and I have tested it locally with success

I have loaded "hello world" docker in ACS with two tags, one signed and another not

I have tried installation of "hello workd" docker in AKS and every work without problem

I have installed Portieris and I have tried installation

I received an error imagePullSecrets missing

I have created secret and I have changed the yaml of "hello world" docker to use secret

I tried again to install "hello world" and I received below error:
kubectl create -f hello.yaml

Error from server (InternalError): error when creating "hello.yaml": Internal error occurred: admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:
Trust Server/Image Configuration Error: no trust server could be found

I have changed policy as below:
  repositories:
  - name: xxxreg.azurecr.io/*
    policy:
      trust:
        enabled: true

and I received below error:
Error from server (InternalError): error when creating "hello.yaml": Internal error occurred: admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:
Trust Server/Image Configuration Error: no trust server could be found

I have changed policy as below:
  repositories:
  - name: xxxreg.azurecr.io/*
    policy:
      trust:
        enabled: true
        trustServer: https://xxxreg.azurecr.io

and I received below error (same for signed or not signed docker)
Error from server (InternalError): error when creating "hello.yaml": Internal error occurred: admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:
Deny "xxxreg.azurecr.io/hel:nosig", no valid ImagePullSecret defined for rd19aksreg.azurecr.io

If I inspect pods log with command shared by you, I can find:

I0206 15:47:31.311755       1 controller.go:65] Processing Trust Admission Request for CREATE on
I0206 15:47:31.312085       1 controller.go:109] Container Image: xxxreg.azurecr.io/hel:nosig   Namespace: default
I0206 15:47:31.334253       1 controller.go:119] Trust is enforced
E0206 15:47:31.363144       1 oauth.go:80] Received non-success status code 404
E0206 15:47:31.363251       1 controller.go:147] Request to OAuth failed with status code: 404 and body: Not found

Now I believe that the problem is with trustServer parameter (but the error message is not clear).
I have tried to look at code for trustServer here but is not clear to me what kind of URL Portieris wants. If you could provide to me other information about trustServer parameter I could investigate how to obtain a valid parameter for ACR.
Keep in mind that access to ACR require authentication (that I could provide).

@molepigeon I want to add an information that could be useful. I have tried to list the available signed tags in my registry using notary (here guide).
Executing below command (remember that I have obfuscated my registry name)
./notary-Linux-amd64 -s https://xxxreg.azurecr.io -d ~/.docker/trust list xxxreg.azurecr.io/hel
The output that I receive is:
WARN[0000] Error while downloading remote metadata, using cached timestamp - this might not be the latest version available remotely
NAME    DIGEST                                                              SIZE (BYTES)    ROLE
----    ------                                                              ------------    ----
sig     512a8348854163e320768953918xxxx774d54d59b45aa6b310xxxeeb8xxx720d    2214            targets/simo

@simonesavi you are getting 404 because the endpoint Protieris is looking to get the token is /oauth/token which is true for IBM registries but may/may not be true for others.
More details are here: https://github.com/IBM/portieris/issues/51

Hello, I am also trying to setup Portieris in an Azure environment with AKS. I cloned the fork from jerrins5 git, but I'm still getting the same error:

GC02TG22ZG8WLE:securedpoc a212359654$ helm install -n unsigned  . --debug
[debug] Created tunnel using local port: '63203'

[debug] SERVER: "<IP_ADDRESS>:63203"

[debug] Original chart version: ""
[debug] CHART PATH: /Users/a212359654/AV_Azure/ContainerSecurity/k8/helm/securedpoc

Error: release unsigned failed: Internal error occurred: admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:
Trust Server/Image Configuration Error: no trust server could be found

I just did helm --purge for the previous release and reinstalled the fork version as:
helm install -n portieris ../portieris-51/portieris/helm/portieris/ --set IBMContainerService=false --debug -n portieris-devops
Policies applied:
apiVersion: securityenforcement.admission.cloud.ibm.com/v1beta1
kind: ClusterImagePolicy
metadata:
  name: ibmcloud-default-cluster-image-policy
spec:
   repositories:
    # This enforces that all images deployed to this cluster pass trust and VA
    # To override, set an ImagePolicy for a specific Kubernetes namespace or modify this policy
    - name: "xxxx.azurecr.io/*"
      policy:
        trust:
          enabled: true
        va:
          enabled: false

Am I missing something?
Thanks and regards!

@arscek you need to specify the trust server for anything other than IBM, quay and docker ones.
so your ClusterImagePolicy would look something like this:
apiVersion: securityenforcement.admission.cloud.ibm.com/v1beta1
kind: ClusterImagePolicy
metadata:
name: portieris-default-cluster-image-policy
spec:
repositories:
- name: "xxxx.azurecr.io/*"
policy:
trust:
enabled: true
trustServer: "https://xxxx.azurecr.io"
Do let me know if this helped resolve your problem?

@arscek you need to specify the trust server for anything other than IBM, quay and docker ones.
so your ClusterImagePolicy would look something like this:

Do let me know if this helped resolve your problem?

@jerrinss5 Thanks for your reply,
I did a fresh install in a new cluster, however I have the same issues. I did need to add a pull secret, even when the service principal was setup (something mentioned above) otherwise I'd get:
Error: release unsigned failed: Internal error occurred: admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:  Deny "xxx.azurecr.io/secured-containers-poc:u1", no valid ImagePullSecret defined for xxx.azurecr.io
I patched the default service account, applied policy with trustServer defined, and got past secret issue, but still having the not found message:
Error: release unsigned failed: Internal error occurred: admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:  Trust Server/Image Configuration Error: no trust server could be found
Is it possible I am not installing properly the forked version or missing something?
apiVersion: securityenforcement.admission.cloud.ibm.com/v1beta1
kind: ClusterImagePolicy
metadata:
  name: ibmcloud-default-cluster-image-policy
spec:
   repositories:
    # This enforces that all images deployed to this cluster pass trust and VA
    # To override, set an ImagePolicy for a specific Kubernetes namespace or modify this policy
    - name: "xxx.azurecr.io/*"
      policy:
        trust:
          enabled: true
          trustServer: https://xxx.azurecr.io
        va:
          enabled: false

Install output:
RESOURCES:
==> v1/ClusterRole
NAME       AGE
portieris  15s

==> v1/ConfigMap
NAME                    DATA  AGE
admission-webhooks      1     15s
default-image-policies  1     15s
image-policy-crds       1     15s

==> v1/Deployment
NAME       READY  UP-TO-DATE  AVAILABLE  AGE
portieris  3/3    3           3          14s

==> v1/Pod(related)
NAME                        READY  STATUS   RESTARTS  AGE
portieris-56fb8c869b-4vpzm  1/1    Running  0         14s
portieris-56fb8c869b-bzhgf  1/1    Running  0         14s
portieris-56fb8c869b-n88j9  1/1    Running  0         14s

==> v1/Secret
NAME             TYPE    DATA  AGE
portieris-certs  Opaque  2     15s

==> v1/Service
NAME       TYPE       CLUSTER-IP    EXTERNAL-IP  PORT(S)  AGE
portieris  ClusterIP  <IP_ADDRESS>  <none>       443/TCP  14s

==> v1/ServiceAccount
NAME       SECRETS  AGE
portieris  1        15s

==> v1beta1/ClusterRoleBinding
NAME                         AGE
admission-portieris-webhook  15s

NOTES:
Portieris is installed in your cluster.

@arscek so what's happening is Portieris is pulling the docker image(which still has the old code) - docker.io/ibmcom/portieris:0.5.2 referenced here -  [https://github.com/IBM/portieris/blob/master/helm/portieris/values.yaml#L8]
I would suggest to build a docker image on your local using the docker file[https://github.com/jerrinss5/portieris/blob/master/Dockerfile] and reference that in the helm chart by replacing the values field.[https://github.com/jerrinss5/portieris/blob/master/helm/portieris/values.yaml#L9]
That should pull in the new code.
Do let me know if that helps.
I haven't sent a pull request to master branch yet as I need to finish up the test cases and updating some configurations in helm chart.

@jerrinss5 I am getting build errors due (I think) a missing function in oauth:
pkg/controller/notary/controller.go:156:22: undefined: oauth.ResponseChallenges
Is it possible I need to configure anything else besides running docker build . on the folder?
Thanks!

@arscek so if you look at helm>portieris>templates>secrets.yaml
You need to assign an actual value out here. Sorry I am in the process of finalizing the helm and was planning to add some default non existential value so that it doesn't fail the deployment.
You can use the following instructions to generate a secret for now.
. replace the docker config value with base64 encoded value of  /.docker/config.json > . in case you need to generate the docker config locally follow this command . kubectl create secret docker-registry regcred --docker-server=<your-registry-server> --docker-username=<your-name> --docker-password=<your-pword> --docker-email=<your-email> . copy the value of data > .dockerconfigjson by running kubectl get secrets regcred -o yaml
let know if you need help

@jerrinss5 thanks a lot
I was able to deploy portieris, it seems the secret worked since it pulled the image from my ACR (not sure if this enough to say it worked)
However it looks as if it had some IBM URL references, again I don't know if what I'm saying makes sense. I am getting this exception when I try to deploy an unsigned image:
GC02TG22ZG8WLE:poc a212359654$ helm install . -n unsigned
Error: release unsigned failed: Internal error occurred: failed calling webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com": Post https://portieris.ibm-system.svc:443/admit?timeout=30s: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)

@arscek this error usually pops up when there the webhook is not able to reach the Portieris pod!
are you able to deploy signed images?

I should've look into the pods before, it had an image pull error, I corrected the values and now it seems to be ok (I believe):
GC02TG22ZG8WLE:securedpoc a212359654$ helm install -n unsigned-test1 .
Error: release unsigned-test1 failed: Internal error occurred: admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:
Deny "securedpoc.azurecr.io/secured-containers-poc:u3", failed to get content trust information: No valid trust data for u3

Is this the message I should expect? It looks like signed images pass, but I will do some more tests

@arscek - yup that's the message that you get when you try to pull in unsigned images.

@molepigeon
I am using my local jfrog container registry (running on <IP_ADDRESS>:8082) and notary server (running on https://notary-server:4443). I am using this portieris-policy.yaml

apiVersion: securityenforcement.admission.cloud.ibm.com/v1beta1
kind: ImagePolicy
metadata:
name: allow-custom
spec:
repositories:
- name: "<IP_ADDRESS>:8082/*"
policy:
trust:
enabled: true
trustServer: https://notary-server:4443

I have already set up my registry secret as 'regcred' .
When I am going to deploy a pod I am getting this error:
Error from server: error when creating "my-private-reg-pod.yaml": admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:    trust: policy denied the request: Deny "<IP_ADDRESS>:8082/docker-local/distroless:latest", no valid ImagePullSecret defined for <IP_ADDRESS>:8082/docker-local/distroless:latest
My pod-definition file:

apiVersion: v1
kind: Pod
metadata:
name: distroless
spec:
containers:

name: distroless
image: <IP_ADDRESS>:8082/docker-local/distroless:latest
imagePullSecrets:
name: regcred

portieris pod logs:

I0620 07:21:31.171372       1 controller.go:65] Processing admission request for CREATE on distroless
I0620 07:21:31.172396       1 controller.go:111] Getting policy for container image: <IP_ADDRESS>:8082/docker-local/distroless:latest   namespace: default
E0620 07:21:31.191617       1 controller.go:174] Secret regcred not defined for registry: <IP_ADDRESS>
I0620 07:21:31.191660       1 controller.go:191] policy.Simple {[]  }
E0620 07:21:31.192293       1 responder.go:87] trust: policy denied the request: Deny "<IP_ADDRESS>:8082/docker-local/distroless:latest", no valid ImagePullSecret defined for <IP_ADDRESS>:8082/docker-local/distroless:latest
I0620 07:21:31.192342       1 controller.go:150] Deny

Although when I am disabling the trust, pod is getting created. ImagePolicy when I disable the trust:

apiVersion: securityenforcement.admission.cloud.ibm.com/v1beta1
kind: ImagePolicy
metadata:
name: allow-custom
spec:
repositories:
- name: "<IP_ADDRESS>:8082/*"
policy:
trust:
enabled: false
trustServer: https://notary-server:4443

Unable to understand why this is happening.

@subhammisra45 This is a known issue https://github.com/IBM/portieris/issues/51  and I have same.

Check whether the imagePullSecret is right (pull with policy disabled)
Take this commit https://github.com/IBM/portieris/commit/d94edf3c613729b3cd8ab54775e6ce7b5206c9fe
Then it might work with Jfrog


Audiracmichelle/issue10

Hey! @jckitch is going to be using yearly county files which are not yet populated in the LEGO folders. Let's use this opportunity to discuss in the coming weeks the approach we want to follow to attach datapaths to pipelines


fix: include archive status flag in application list query key

Description :sparkles:
This adds the archive status into the query key in the query hook for the application list in the applicant UI. Previously, lists that shared the other query values but not this one would share their state.
Before this fix, this happened with the processed applications list on the front page and the list on the archive page. If one navigated between the aforementioned pages by using the "show all applications" button, before the archived applications list finished loading, the view would show the list from the front page for a brief period (which was minimal in development environment) instead of a loader skeleton element as intended.

API branch is deployed to platta: https://helsinkilisa-pr3082.api.dev.hel.ninja/healthz :rocket::rocket::rocket:

APPLICANT branch is deployed to platta: https://helsinkilisa-ui-pr3082.dev.hel.ninja :rocket::rocket::rocket:

HANDLER branch is deployed to platta: https://helsinkilisa-ui-handler-pr3082.dev.hel.ninja :rocket::rocket::rocket:

TestCafe result is success for https://helsinkilisa-ui-pr3082.dev.hel.ninja :laughing::tada::tada::tada:

TestCafe handler result is failed for https://helsinkilisa-ui-handler-pr3082.dev.hel.ninja :crying_cat_face::anger::boom::boom:

TestCafe result is success for https://helsinkilisa-ui-handler-pr3082.dev.hel.ninja :laughing::tada::tada::tada:


changes endpoint with latest and no limit returns empty payload

datasets/people/changes?limit=100&latestOnly=true returns a context and continuation token and entities
datasets/people/changes?latestOnly=true returns a context and continuation token and NO entities
This appears in the case that the first entity is no the latest and trigger a break in the loop.
Propose only check for limit if it is set higher than 0.

fixed.


Fixes #99971 - Show activation events in Feature Contributions

This PR fixes #99971

Sorry that I did not look at this PR , since the changes are small I pushed the fix.


mirrord-layer deadlocks if accept is called when there's no data

Bug Description
When accept is called before a connection is read from the agent, it locks the connections struct and there's a deadlock.
Steps to Reproduce
Simulate a delay so that accept is called before a connection is read from the agent.
Backtrace
No response
Your operating system and version
MacOS
Your Node version (node --version)
N/A
Additional Info
No response

Closed via #44


fix dependency versions by using railties which doesn't include rails 5 beta

OK, so our gem is is https://rubygems.org/gems/twine-rails which takes any coffee-rails version > 0
coffee-rails will take https://rubygems.org/gems/coffee-rails/versions/4.1.1 any railties version railties < 5.1.x, >= 4.0.0
The issue is that railties lastest version which matches the 5 series takes actionpack and activesupport which is <IP_ADDRESS>beta which pulls in https://rubygems.org/gems/railties/versions/5.0.0.beta3
what we want is to stay on the 4.X series for now, which makes the current latest version https://rubygems.org/gems/railties
This changes the gemspec to make sure for railties we stay less than the 5 series, so we keep picking up 4.X stuff until we want to go Rails 5.
This also ensures that we are matching the 4.X versions we are using in Shopify core currently
@celsodantas @qq99 cc @Shopify/tnt

@rafaelfranca might be good person to take a look too

If we need it to be between 4 and 5, we should do ~> 4.0.

Urgh! The dependencies are missing. This gem depends on railtie and activesupport but it is not explicitly marking them as dependecy. If coffee-rails change its dependencies this gem will be broken. I'll fix it.


DataCoverageDefinition Evaluation Error

I am trying to create a Hybrid Table for PBI with a partition that is Import and one that is DirectQuery. I am trying to set the Data Coverage Definition on the Direct Query partition so that queries are not sent to the DQ source when querying the Imported data. I have followed the steps as outlined in the Microsoft documentation but am getting an Evaluation Error when setting the Data Coverage Definition. See the image of the error below, my definition is entered in the "Description" field. Is there something I am doing wrong here? Microsoft documentation indicated that you enter the definition as a simple DAX statement. I am using the most recent version of Tabular Editor 2.

Expected behavior
A clear and concise description of what you expected to happen.
Observed behavior
A clear and concise description of what happened. Include any error messages or stack traces if possible. Also, feel free to add screenshots or recordings showing the problem.
Application specifics

Tabular Editor 2.X version: [e.g. 2.12.0]
Semantic Engine used: [e.g. Power BI Desktop, Azure Analysis Services, SSAS 2019, etc.]
Model Compatibility Level: [e.g. 1400, 1500, 1520, etc.]

Additional context
Add any other context about the problem here.

The Description property is just a text field where you provide an (optional) human-readable description of what the DataCoverageDefinition does. You need to put the DAX expression in the Expression property.
You can assign the Expression property this through the Properties grid, or through the Expression Editor:

I have an issue with this as well. I put the expression on the data coverage definition (as shown in the first screenshot). When i saved and reopened the .bim file, I get the error message in the second screenshot. It's weird as my model is 1604 compatibility. This is with TE 2.23.0. Also btw, I wasn't able to find this property setting in TE3.

Hi @m-kovalsky Are you saving the model as .bim, TMDL or legacy save-to-folder?
TE3 doesn't support DataCoverageDefinition yet, but it's coming in our April release (due next week).

@m-kovalsky I'm not able to reproduce this issue with 2.24.0 - could you try that one? If it still doesn't work, maybe you can send me a repro privately? Thanks!

Ah, hadn't seen 2.24.0 was released. I can confirm this issue is resolved in 2.24.0. Thanks!

@otykier Just curious - are data coverage definitions captured in the DependsOn/ReferencedBy method? If not, it would be great to add this.


SQLSnap! Fileshare

An extension that allows for file storage online.

This extension needs some work to convert it better, formatting, translations, license, and whatnot. I'll handle it later today, this is a great port!

does anyone remember what the character limit is?

@Drago-Cuven Depends on the server, the SQLSnap_!_ server has a character limit of 10,000.

testmessage

@Drago-Cuven Depends on the server, the SQLSnap! server has a character limit of 10,000.

the server is down. is it done forever?

@Drago-Cuven the Discord server, pinned in the off topic channel, is the code to run the exact same server yourself, if you want. Devid will need to coordinate how we will handle information about the server


[suggestion] 1.16.5 port?

Huge fan of the work you've done here - wondering how viable would a 1.16.5 version be?
Current state of Oculus shaders & flywheel backend on closely resembles your pre-patching screenshots for reference

Would also love to see the 1.16 version. It would prove very useful in Create: Above and Beryond modpack.


undefined state on first render after dynamicially loading module in react-redux v6

This is an old issue and a fix was done for this.
https://github.com/microsoft/redux-dynamic-modules/pull/59
I faced this while working with react-redux v6
Steps to reproduce...Run the Counter example in packages with react-redux v6..On first render you get an undefined state.

@sanchitbansal10 I am facing the same issue.
Were you able to find a fix for this?

@abettadapur @navneet-g Any idea how to fix this?

@footyapps27 hey I had to upgrade my react-redux package.. I can try and raise a PR but no maintainer seems to be around

@sanchitbansal10 Which version of react-redux solved the issue for you?

v7

v7

That's weird. I am using v7 as well, but still getting undefined on the first load. :/

@footyapps27 You can try running this sample app
https://github.com/microsoft/redux-dynamic-modules/tree/master/packages/counter-example
with v6 and v7...It doesn't return undefined for v7
Maybe something else is wrong


Disable selection of 2011-2012 option

Related to #2775
Trello card
Motivation
Having entered 2016-2017 tax year there is little need for the older tax years.
This PR seeks to disable the selection of 2011-2012 option on the Estimate your penalty for late Self Assessment tax returns and payments Smart Answer.
Factcheck
Preview link
GOV.UK
Expected changes

2011-2012 option no longer available for selection

Before

After

now superded by #2783


ec2-net-utils deleting custom ip rules upon state change

OS: Debian 12.1
Version: 2.3.0
Any custom ip rules that I've created seem to get deleted whenever an interface or secondary IP is added/removed from the instance.
For example, I'm using the following rule to mark packets from a specific source IP so I can take action in iptables based on that mark.
ip rule add from <IP_ADDRESS> fwmark 10001 table 10001
Whenever there's a state change on the interfaces (additional interfaces added or removed, or additional IP addresses added or removed) it looks like all of the ip rules are deleted and rebuilt.
Is there a way to make the rule persist or at least be recreated when ec2-net-utils refreshes all the policies?

Is there a way to make the rule persist or at least be recreated when ec2-net-utils refreshes all the policies?

When something changes, net-utils will execute networkctl reload to get systemd-networkd to pick up the newly generated configuration.
If you want to install persistent configuration, I recommend storing it in systemd-networkd configuration in /etc/systemd/network/
So your policy routing rule would look something like:
[RoutingPolicyRule]
From=<IP_ADDRESS>
FirewallMark=10001
Table=10001

And could be stored in /etc/systemd/network/70-ens6.network.d/fwmark.conf or similar.
See the systemd.network docs for more on that.


Inclusion of InstanceLocation for required and additionalProperties errors

I've just come across this and it's working great :) However, one thing I've noticed that's a bit awkward is - any errors caused by a violation of a required or additionalProperties rule doesn't tell you where in the JSON the violation occurred.
For everything else I get an InstanceLocation that is the JSON Pointer to the property that was invalid. For these two I just get "", so I can't have my service indicate which property was either missing but required, or was unexpectedly present.
I do get this come through in the Message so the validator obviously knows which property it is, but it just doesn't actually return it to the client.
Cheers

i guess instanceLocation should point to some thing that is present in the input json document.
if a required property is missing, the instanceLocation pointing to that missing property when evaluated on input document it evaluates to nothing.

The instance location for required should be the object that's supposed to contain the required properties, rather than individual properties.  The actual missing properties would have to be listed in the message.
The instance location for additionalProperties should be the instance object that failed against the subschema.  At least I'm pretty sure of that — I'm not an expert on the output requirements.


Single DCS Instance

Is it possible to use only one DCS World Server instance and have multiple servers running only one installation and different SavedGames folders ?
When I starting configure multiple servers dcsserverbot.ini file - bot responds
DCSServerBot
БОТ
 — Сегодня, в 11:56
@DCS Admin Can't reach server "ICS Vortex Test" for more than 3 minutes. Creating minidump and killing ...
Latest dcs-<timestamp>.log can be pulled with .download
If the scheduler is configured for this server, it will relaunch it automatically.

and kills running DCS instance.

That usually happens, if you have a port conflict. DCSServerBot should warn you about the most common ones already in your log file.
Besides that, LotAtc is a good candidate.
So double check all ports. If unsure, join my discord and send me the dcs.log files of both servers.

Thanks. I will check logs and ports. I have no any 3rd Party plugins or mods installed. Clean DCS Server (modular) installation.

I reconfigured both servers to be on different ports and so on.
But now I am getting another issue.
When I try to .startup server  - I get error:

Logs from DCS instances.
1dcs.zip
2dcs.zip

Would you mind join my discord that would make it much easier for me and many more people are there to help

I see the DCSServerBot lua loaded in one of the servers. That means, the 2nd one isn't loading them, most likely due to a config issue.

Would you mind join my discord that would make it much easier for me and many more people are there to help

Yes, sure. Can you provide me a link ?


[BugFix] compatibility to new Composite dist log_prob/entropy APIs

Stack from ghstack (oldest at bottom):

-> #2435

Fixes related to https://github.com/pytorch/tensordict/pull/981


Update ai-build-capability-in-al.md

Added blank lines to AL code.

Thanks for your contribution, much appreciated.


Add security.md

added the SECURITY.md file https://github.com/infraspecdev/spellcheck-action/pull/15


⚠ Turnos 24x7 has degraded performance

In 0e4868d, Turnos 24x7 (https://reservas-dev.alternativasinteligentes.com/) experienced degraded performance:

HTTP code: 200
Response time: 983 ms

Resolved: Turnos 24x7 performance has improved in 6a879e7.


Use new fastboot guard

process.env.EMBER_CLI_FASTBOOT is soon going to be deprecated and eventually removed. Therefore, we should instead use updateFastBootManifest hook.

https://github.com/ember-fastboot/ember-cli-fastboot#loading-additional-assets-in-fastboot-environment

Hey @jakeleboeuf updateFastBootManifest should only be used for vendor files that you are importing in fastboot build. In your addon, you are only importing for browser build, therefore you should follow the guide here: https://gist.github.com/kratiahuja/d22de0fb1660cf0ef58f07a6bcbf1a1c#using-processenvember_cli_fastboot-to-run-import-in-browser-build
Another addon example: https://github.com/stefanpenner/ember-fetch/pull/29/files
Ping me on ember slack if you need help!

Thanks for the explanation @kratiahuja! Maybe I'm a dumb-dumb (I am), but those examples seem to suggest what I'm doing here is overly complex... Is there a simpler way to rewrite this?

I think if you write the funnel trees in variables, it becomes more readable :) .

Should be fixed by this commit https://github.com/FutoRicky/ember-cli-dropzonejs/commit/d9355e31e6ca4ca4a4f0a78f64d14dcfaa1a0b5c


added new config options

added new route settings to enable override the API prefix endpoint and
the middleware
old config structure is supported with default values
Thanks,

Sorry for the delay; looks good, I might tweak a few things before I push a new release though. Thank you!


Simplify registration of pairs with traits

It was mentioned that the contract can now be simplified.
What exactly?

that's the version in the trait branch I was referring to (https://github.com/psq/swapr/blob/trait/contracts/swapr.clar), which no longer requires a registry, and 1 single contract can support multiple pairs.  I'm still using a list to keep track of the available pairs so the UI can get a list, but once there are services that index this data (it doesn't necessarily belongs in the stacks node itself), that can be removed.  The list keeps the number of pairs limited because it will max out, unlike the map.


Run OpenWhisk on Kubernetes

This issue can be used to track the progress for running OpenWhisk on Kubernetes. For this issue, we plan on running a simple OpenWhisk deployment on Kube and learn what would be an easy way to achieve this goal.
Initial tasks that need to be accomplished:

[ ] Add a README to Document how to deploy OpenWhisk to Kubernetes and keep track of our thought process about the deployment strategy.
[ ] Deploy CouchDB within a Kubernets Pod
[ ] Deploy Consul within a Kubernets Pod
[ ] Deploy Controller within a Kubernets Pod
[ ] Deploy Kafka within a Kubernets Pod
[ ] Deploy Nginx within a Kubernets Pod
[ ] Deploy Invoker within a Kubernets Pod

Validation for OpenWhisk on Kube:
As we go along, it would be nice to validate these deployments using travis, but I do not have any experience with setting up Kubernets on Travis. This will require some investigation on how to set up.

[ ] Set up Kubernetes on Travis.

For each check box above, we will submit a PR or a number of PRs and keep track of the work needed.

OK, I would suggest that we use Kubernetes Deployments where possible. I'm reading through the Docker Compose work in openwhisk-devtools and will convert it to a basic Kubernetes manifest. This will allow us to at least begin experimenting with OW + K8S.

Thanks @baldwinSPC - once you are done please submit a PR.  As for the community call, I have added in slack channel, and would send the email around to make sure the folks are informed and can attend. Also at your end please invite otherS

@baldwinSPC you should probably have your folder names like 'docker-to-k8' just to distringuish it from what @DanLavine is doing. His work will be going under a folder names 'kubernetes'

hey @baldwinSPC I just submitted the first PR for this work here. What I'm thinking as a current deployment strategy is to essentially create a Kube Job that deploys OpenWhisk. This way we can try and reuse as much of the Ansible scripts or modify them for handling Kube specific setup.

Seeding consul/couchdb, etc we can leverage Kube-DNS for internal routing for things of this nature.
Seeding the invoker with the docker images we can use Kube's poststart hooks.
Generated Ansible Configs will be mapped to Kube ConfigMaps and get applied to the required containers.
Some things it might be easier to generate custom Docker images. For example, when setting up Nginx, it requires some custom code to exist at specific locations.

I was working on setting up a cluster with my colleague @kkbankol to see what it would take to have a decent deployment strategy and we were able to successfully deploy OpenWhisk on Kube. The only issues is that it was somewhat hacky and quit manual. We are currently taking what we learned and making more streamline for anyone to use. Also, solving some of the issues we didn't really care about along the way.

Out of curiosity: What are the plan to have the Invoker schedule its containers? Will that be through k8s APIs or by directly talking to the underlying docker host?

In the current PR its nor - but phase 2 will be through K8 apis

Right now its directly talking to docker host

@markusthoemmes is it you or @csantanapr who are responsible for merging in this repo?

Hi @animeshsingh
Any of our committers have the authority to merge PRd to any of the Apache OpenWhisk repos.
Merging a PR is the easiest part since it's a mechanical step as to clicking a button.
The part that it's not as easy it's finding the time to do code reviews and design discussions, that's why it can take from a day to a few days to get something reviewed and approved for merging.
To review a PR we usually try to ask for help to review the PRs to the SMEs on the topic, reviewers don't have to be committers and write access to the repo.
For invoker changes since it's one of the most critical components and sensitive to performance characteristics a few more folks would be interested to help out with design and reviews like @markusthoemmes @rabbah @jeremiaswerner and others.
In terms of deployment and orchestration @markusthoemmes is one the SMEs could also help with reviews

but phase 2 will be through K8 apis

@animeshsingh why would we be doing that, given it's going to be intrinsically slower than directly talking to the docker host?

@mbehrendt well - what`s the point of using orchestrator if we don't want to use it to orchestrate containers? talking to docker directly on host machine wont be any different to what the current distributed deployment mode we have..... Also generally you will be going on  a shared kubernetes cluster, and and at that point we cant assume we have direct access to host machines

That's quite specifically why we haven't yet looked at Kubes in terms of our standard deployment mechanism. The container orchestration points are undeniable and make sense. For us though, fast and predictable container management is crucial and probably differs from what Kubernetes is doing scheduling wise (to be verified, this is merely guessing).
I think it would be worthwhile to undermine this with numbers, i.e. what will the cold-start latency be for starting a new user-container of a certain kind and whether it's feasible to go down that route or if we need to find a different approach (for example talking directly with the underlying host).

In part, having a consistent benchmarking methodology will be necessary to make meaningful comparisons.

I think we may find that there will be different usecases at play and therefore different container management strategies.  For example, some may find that the asynchronous scheduling model of kubernetes works just fine for them, while others may need a direct management model where the invokers talk directly to the container management system.  I think it would be nice if we allowed for a variety of options.
However, in both cases I think the control plane can be hosted in Kube and that should be our main focus right now. I think it would be good to start to explore the options around talking directly to the container manager but I suspect that solution will be non-trivial and will take some time to get right.
Therefore, my suggested course of actions would be:
1 - get the control plane ported to Kube, leveraging invokers that are outside of the kube env
2 - port the invoker to Kube so it can leverage Kube's scheduler - my assumption is this will be the easier path
3 - add support for having the invoker talk directly to the container manager - or whatever solution we come up with to meet our performance requirements.
And, as @markusthoemmes said, using numbers to validate our decisions/plans.

For number #1, from an outside user`s perspective who wants to run OpenWhisk on K8, there is nothing for me. I have to identify extra machines outside of my K8 cluster to deploy OpenWhisk, I might just do the clean distributed deployment which is already there.
I as a user, would use the solution if I can run this on my K8 cluster completely.
So from an end user`s perspective, two outputs make sense

Everything on K8, and OpenWhisk treats some K8 slave machines as Invokers (Not ideal, but gets everything running on K8).

Everything on K8, and there is no Invoker 'machine' - K8 cluster is the 'giant invoker' where everything is dispatched.

Of course its going to be non trivial, performance will be issue - and those are something which need to be ironed out as we move along.
Also  we have a community call on every 2nd Friday with Dan, Matt and others - lets take some of this discussion there. Its Google hangouts, so please letme know if you would like to join and the email id you would like to use

just FYI, my #1 (while it could be a deliverable for some folks) was more of a stepping stone to the others. It just allows us to prove the control plane works ok on K8s (not there should be any reason why it doesn't).

Makes sense, and that`s already covered (though with still some manual hacks) in the PR which has come in. So lets move beyond that

With the last [PR}(https://github.com/apache/incubator-openwhisk-devtools/pull/31) merged, all of the initial ground work to deploy OpenWhisk on Kube has been completed. There are still a number of enhancements that can be worked on and I will submit another PR soon to document them on the README for kube.


WithParam: exeption when using already existing param name outputs "key" instead of param name

Hi Charlotte,
when using WithParam with parameter name that already exists in query, the following exeption is thrown:
if (QueryWriter.ContainsParameterWithKey(key))
    throw new ArgumentException("A parameter with the given key is already defined in the query.", nameof(key));

But using nameof(key) will always add "Parameter name: key" to the exception message which doesn't help.
This should just be key to add the name of the misused parameter and to help the developer to identify the problem.
I could fix this together with isse 458 if you agree.
Best,
Reiner

PR created: https://github.com/DotNet4Neo4j/Neo4jClient/pull/460

Hey Reiner,
This should be nameof(key) - as the property on the ArgumentException is ParameterName not ParameterValue.
You could totally change the message to include the name of the key, but the parameter itself should state which parameter is invalid.
This about it from the POV of a method with multiple parameters, if you just put the value in, you can't tell which of the parameters has actually caused the exception.
All the best
Charlotte

Hi Charlotte,
I commented in the PR 2 weeks ago that nameof(key) always is "key" and the value of key contains the used key, please check it there.
Best,
Reiner

Hi Reiner - sorry - I had not 'completed' the review so my comments were pending - I can only apologise for that oversight.
I still fundamentally disagree. The Argument that is wrong is the key one. The value of that key may be the reason it's wrong, but the value isn't the parameter.
If I had this method:
public void DoIt(string a, string b, string c) { /**/ }

And then threw ArgumentExceptions like this:
if( a IS WRONG) throw new ArgumentException("The value isn't valid", a);
if( b IS WRONG) throw new ArgumentException("The value isn't valid", b);
if( c IS WRONG) throw new ArgumentException("The value isn't valid", c);

I can't tell which parameter is wrong.
By changing the message to have the value, I can see that, but the ParameterName is a, b or c
if( a IS WRONG) throw new ArgumentException($"The value '{a}' isn't valid", nameof(a));
if( a IS WRONG) throw new ArgumentException($"The value '{b}' isn't valid", nameof(b));
if( a IS WRONG) throw new ArgumentException($"The value '{c}' isn't valid", nameof(c));

Yes, agree but in your example there is no cypher. As a user of Neo4jClient, I want a message that refers the paramter name that I used twice in the cypher or that has a wrong cyntax in the cypher. I don't care how this parameter is named in c#.
In your version, the message always outputs "wrong parameter name 'key'" - even if when my cypher-parameter was named "foo". I need the parameter name causes the problem in cypher and that name is the value of key.
It only works because you also named the cypher parameter "key" in your test. Please just rename it to "foo" in lines 62 and 63 and you'll see that your test will fail. But test should work with any parameter name used in cypher.

Also see that example with $uuid. When I use a parameter named "$uuid" it's not helpful when I get an error message "wrong parameter name 'key'" - it has to be "wrong parameter name '$uuid'"  - and $uuid is the value of key. I wouldn't have changed this if I had not stumbled across it.

The fact is that the key is incorrect it has been named incorrectly the value of the key is causing an exception, but the key is the parameter name - you can easily change the message to read:
The parameter named 'XXX' is invalid for these reasons...
But the fact is that the key is the ParameterName (which is the property on the exception) that is wrong.

You two are talking completely past each other ;-)
To summarize in clearer words what @Clooney24 wants:
If currently an error occurs in the parameter with the name key, then a constant error message is thrown with the string "key", not the nameof(key) value. Say, if the key parameter has the value "myKey" - since it was passed that way in the query - the unchanged string "key" is still written to the error message, but not the variable string "myKey":
new Exception("this is my exception in key parameter") <> new Exception("this is my exception in mykey parameter")
Therefore the variable nameof(key) should be passed to the string, not "key":
new Exception("this is my exception in 'key' parameter") <> new Exception($"this is my exception in '{nameof(mykey)}' parameter").
@cskardon is this more understandable now? The issue is that currently the same fixed string is always output and the name of the key parameter is not currently inserted dynamically.

This might only be helpful for someone just developing on the source code of Neo4jClient.
But for all users of the package, that message isn't helpful at all. Imagine I have a cypher containing 20 paramers and one of them causes trouble, wouldn't it be great when the exception tells me which of them is problematic instead of always telling me "parameter name key".
Can we agree to mention both? Like this:
throw new ArgumentException($"A parameter with the given key '{key}' is already defined in the query.", nameof(key));

@DarthSonic The name of the parameter to the method is used. What is actually being discussed is the fact that the exception doesn't have the name of the cypher parameter - it's nothing to do with the string content - as - if you look at the original code, you'll see that the ParameterName property is set to nameof(key)
@Clooney24 - I have suggested this here https://github.com/DotNet4Neo4j/Neo4jClient/issues/459#issuecomment-1415834465 and here https://github.com/DotNet4Neo4j/Neo4jClient/pull/460/files#r1084318553 I have no problem at all with the Message being updated, but the ParameterName property should be the parameter into the method, I think that's the perfect solution - hence writing it there and here.
This is how C# is supposed to be written when using ArgumentException - it is an agreed upon practice (like *Never throwing or catching  Exception) and in the C# guidelines: https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception.paramname?view=net-7.0#remarks

5.1.5 is in nuget now with the changes.


python310Packages.plexapi: 4.15.1 -> 4.15.2

Automatic update generated by nixpkgs-update tools. This update was made based on information from passthru.updateScript.
meta.description for python310Packages.plexapi is: Python bindings for the Plex API
meta.homepage for python310Packages.plexapi is: https://github.com/pkkid/python-plexapi
meta.changelog for python310Packages.plexapi is: https://github.com/pkkid/python-plexapi/releases/tag/4.15.0
Updates performed

Ran passthru.UpdateScript

To inspect upstream changes
Impact

Checks done (click to expand)

built on NixOS
The tests defined in passthru.tests, if any, passed
found 4.15.0 with grep in /nix/store/v5im3z3f0vyxmc4c7z7lmyf1m2ljzvk3-python3.10-plexapi-4.15.0
found 4.15.0 in filename of file in /nix/store/v5im3z3f0vyxmc4c7z7lmyf1m2ljzvk3-python3.10-plexapi-4.15.0

Rebuild report (if merged into master) (click to expand)

6 total rebuild path(s)

6 package rebuild(s)

First fifty rebuilds by attrpath
home-assistant-component-tests.cast
home-assistant-component-tests.plex
home-assistant-component-tests.sonos
python310Packages.plexapi
python311Packages.plexapi
tauon

Instructions to test this update (click to expand)

Either download from Cachix:
nix-store -r /nix/store/v5im3z3f0vyxmc4c7z7lmyf1m2ljzvk3-python3.10-plexapi-4.15.0 \
  --option binary-caches 'https://cache.nixos.org/ https://nix-community.cachix.org/' \
  --option trusted-public-keys '
  nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
  cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
  '

(The Cachix cache is only trusted for this store-path realization.)
For the Cachix download to work, your user must be in the trusted-users list or you can use sudo since root is effectively trusted.
Or, build yourself:
nix-build -A python310Packages.plexapi https://github.com/r-ryantm/nixpkgs/archive/aeda5d74018d272836195470050240aaebf18233.tar.gz

After you've downloaded or built it, look at the files and if there are any, run the binaries:
ls -la /nix/store/v5im3z3f0vyxmc4c7z7lmyf1m2ljzvk3-python3.10-plexapi-4.15.0
ls -la /nix/store/v5im3z3f0vyxmc4c7z7lmyf1m2ljzvk3-python3.10-plexapi-4.15.0/bin

Pre-merge build results
We have automatically built all packages that will get rebuilt due to
this change.
This gives evidence on whether the upgrade will break dependent packages.
Note sometimes packages show up as failed to build independent of the
change, simply because they are already broken on the target branch.
Result of nixpkgs-review run on x86_64-linux 1

1 package failed to build:

home-assistant-component-tests.plex

5 packages built:

home-assistant-component-tests.cast
home-assistant-component-tests.sonos
python310Packages.plexapi
python311Packages.plexapi
tauon

Maintainer pings
cc @colemickens for testing.

@ofborg build home-assistant-component-tests.plex

Automatic update generated by nixpkgs-update tools. This update was made based on information from passthru.updateScript.
meta.description for python310Packages.plexapi is: Python bindings for the Plex API
meta.homepage for python310Packages.plexapi is: https://github.com/pkkid/python-plexapi
meta.changelog for python310Packages.plexapi is: https://github.com/pkkid/python-plexapi/releases/tag/4.15.2
Updates performed

Ran passthru.UpdateScript

To inspect upstream changes
Impact

Checks done (click to expand)

built on NixOS
The tests defined in passthru.tests, if any, passed
found 4.15.2 with grep in /nix/store/6snkm1pdnsanbqajzpppx7mjffin5l5k-python3.10-plexapi-4.15.2
found 4.15.2 in filename of file in /nix/store/6snkm1pdnsanbqajzpppx7mjffin5l5k-python3.10-plexapi-4.15.2

Rebuild report (if merged into master) (click to expand)

3 total rebuild path(s)

3 package rebuild(s)

First fifty rebuilds by attrpath
python310Packages.plexapi
python311Packages.plexapi
tauon

Instructions to test this update (click to expand)

Either download from Cachix:
nix-store -r /nix/store/6snkm1pdnsanbqajzpppx7mjffin5l5k-python3.10-plexapi-4.15.2 \
  --option binary-caches 'https://cache.nixos.org/ https://nix-community.cachix.org/' \
  --option trusted-public-keys '
  nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
  cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
  '

(The Cachix cache is only trusted for this store-path realization.)
For the Cachix download to work, your user must be in the trusted-users list or you can use sudo since root is effectively trusted.
Or, build yourself:
nix-build -A python310Packages.plexapi https://github.com/r-ryantm/nixpkgs/archive/6ba369beead10f29fae6cc8be96b27b262d8abde.tar.gz

Or:
nix build github:r-ryantm/nixpkgs/6ba369beead10f29fae6cc8be96b27b262d8abde#python310Packages.plexapi

After you've downloaded or built it, look at the files and if there are any, run the binaries:
ls -la /nix/store/6snkm1pdnsanbqajzpppx7mjffin5l5k-python3.10-plexapi-4.15.2
ls -la /nix/store/6snkm1pdnsanbqajzpppx7mjffin5l5k-python3.10-plexapi-4.15.2/bin

Pre-merge build results
We have automatically built all packages that will get rebuilt due to
this change.
This gives evidence on whether the upgrade will break dependent packages.
Note sometimes packages show up as failed to build independent of the
change, simply because they are already broken on the target branch.
Result of nixpkgs-review run on x86_64-linux 1

3 packages built:

python310Packages.plexapi
python311Packages.plexapi
tauon

Maintainer pings
cc @colemickens for testing.


增加双向链接

Is your feature request related to a problem?
Flomo 的一大特色是可用双向链接， memos 能不能增加这个功能？
Describe the solution you'd like
已说明
Additional context
No response

Refer to #820 .


[kwokctl] Multiple clusters sharing one subnet

What would you like to be added?
Allow to create more clusters
Why is this needed?
Encounters a limit on the number of subnets.

/assign

/reopen
/remove-lifecycle rotten


withMainContext

What question should the reference manual answer?
One of the most common tactic bugs (seen at least a dozen times in examples on Zulip or in Mathlib PRs) is a missing withMainContext.  What is a context?  How is the context determined by default, and how does this change if a tactic is wrapped in withMainContext?
Maybe you could include an example of a small tactic with this error, showing the classic behaviour which signals this bug (tactic mysteriously ignores variables/hypotheses/goals which were not present at the start of the problem), and then a fixed version of the tactic.

Thanks, this is useful feedback! I don't plan to address the deep guts of tactic implementation until sometime next year, but this is a very good thing to keep in mind for it.


:book: Add information for pinning manfest lists

Signed-off-by: Appu Goundan<EMAIL_ADDRESS>What kind of change does this PR introduce?
doc fix/update on pinning multi-arch manifest lists for containers

[x] PR title follows the guidelines defined in our pull request documentation

Which issue(s) this PR fixes
Fixes #1773
Special notes for your reviewer
Does this PR introduce a user-facing change?
NONE

@laurentsimon fyi


Plugin cannot be released

I tried to publish 0.3.0 but ran into this issue: https://scans.gradle.com/s/mmguai3sgujlm/failure. It looks like creating the pluginUnderTestMetadata configuration messes with the archives configuration. The output directory of pluginUnderTestMetadata ends up being part of the archives configuration which causes the publish task to fail.

Reported this via https://github.com/gradle/gradle/issues/13980

Fixed via workaround in 5f49571ff9eee4e8ba20c6364bc612f0df552126


Add NoWhileAsForLoopFixer.

Expected
                <?php
                    while($a > 1) {
                        echo $a;
                    }

Input
                <?php
                    for(;$a > 1;) {
                        echo $a;
                    }

for (;;) is valid, but while () is not.

good catch :+1:
updated in https://github.com/SpacePossum/PHP-CS-Fixer/commit/cf9ed85437eac7c4215419e7b0d20f336018ea59
Expected
<?php
    while(true) {
        echo 1;
        break;
    }

Input
<?php
    for(;;) {
        echo 1;
        break;
    }

maybe to rare of case to the code base?

maybe to rare of case to the code base?

I wanted to add my ":+1:" just this moment. But maybe you're right.

And btw: thanks for all your work!!
But I think we should not add fixers with very rare use cases.

And btw: thanks for all your work!!

Thanks! :)
I'll create a new public MIT repo with some rare fixers, just in case someone finds a need for those one day (other than me ^-^).
Thanks for reviewing!


fix(core): optimize the package's dependencies

Summary
fix(core): optimize the package's dependencies to reduce the size of the packages.
Related Links

Checklist

[x] I have added changeset via pnpm run change.
[ ] I have updated the documentation.
[ ] I have added tests to cover my changes.

LGTM 👍


Add Joaquin Pignol to Contributors list

Thank you for this opportunity.

@joespi,  I'm quite elated about your PR. I wanna evolve this project to addresses various problems faced by first time contributors. I'd love to learn about your journey in open source community, the problems, pain points you had etc.
Could you explain how you felt when you went through the tutorial, made a PR and learned that I merged it?

Know that I'm more excited than you, that for sure !. It felts really nice through all the process. Clear instructions, the only problem that I had was when I try to push my request, but I searched it in stackoverflow and was a thing about my E-mail. Thank you again because it's a little thing but that means a lot for for us.

@joespi: It's great to know that. I'd urge you to continue contributing.
We also have a slack team to help people trying to contribute to open source. You can join us by going to https://firstcontributions.herokuapp.com
Cheers