[Snyk] Security upgrade golang from 1.16.4-alpine to 1.21.11-alpine

This PR was automatically created by Snyk using the credentials of a real user.![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123)
Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project.
Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.
Snyk changed the following file(s):

scenarios/ecs_takeover/terraform/website/Dockerfile

We recommend upgrading to golang:1.21.11-alpine, as this image has only 3 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.
Vulnerabilities that will be fixed with an upgrade:

Issue
Score

Out-of-bounds Read SNYK-ALPINE313-APKTOOLS-1533754
  714

Buffer Overflow SNYK-ALPINE313-OPENSSL-1569448
  714

Buffer Overflow SNYK-ALPINE313-OPENSSL-1569448
  714

Out-of-bounds Write SNYK-ALPINE313-ZLIB-2976175
  714

Loop with Unreachable Exit Condition ('Infinite Loop') SNYK-ALPINE313-OPENSSL-2426334
  614

[!IMPORTANT]

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.
[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"golang","from":"1.16.4-alpine","to":"1.21.11-alpine"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE313-OPENSSL-1569448","priority_score":714,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"critical","score":500},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Buffer Overflow"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE313-OPENSSL-1569448","priority_score":714,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"critical","score":500},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Buffer Overflow"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE313-ZLIB-2976175","priority_score":714,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"critical","score":500},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Out-of-bounds Write"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE313-APKTOOLS-1533754","priority_score":714,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"critical","score":500},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Out-of-bounds Read"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE313-OPENSSL-2426334","priority_score":614,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"severity","label":"high","score":400},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Loop with Unreachable Exit Condition ('Infinite Loop')"}],"prId":"41454e88-90c7-4755-8e63-abae9658c24d","prPublicId":"41454e88-90c7-4755-8e63-abae9658c24d","packageManager":"dockerfile","priorityScoreList":[714,714,714,614],"projectPublicId":"43d5f72d-4c28-4b3e-ba6c-7ea26d39b797","projectUrl":"https://app.snyk.io/org/secrets_test/project/43d5f72d-4c28-4b3e-ba6c-7ea26d39b797?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","priorityScore"],"type":"auto","upgrade":["SNYK-ALPINE313-APKTOOLS-1533754","SNYK-ALPINE313-OPENSSL-1569448","SNYK-ALPINE313-OPENSSL-1569448","SNYK-ALPINE313-OPENSSL-2426334","SNYK-ALPINE313-ZLIB-2976175"],"vulns":["SNYK-ALPINE313-OPENSSL-1569448","SNYK-ALPINE313-ZLIB-2976175","SNYK-ALPINE313-APKTOOLS-1533754","SNYK-ALPINE313-OPENSSL-2426334"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'

Checkmarx One – Scan Summary & Details – fc859012-9aec-4812-a52c-0265219718a8
New Issues

Severity
Issue
Source File / Package
Checkmarx Insight

ALB Listening on HTTP
/lb.tf: [74](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/lb.tf# L74)
AWS Application Load Balancer (alb) should not listen on HTTP

AWS_Credentials_Leak
/scenarios/cicd/terraform/test/scenario_test.go: [260](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/test/scenario_test.go# L260)
Attack Vector

Authentication Without MFA
/initial_iam_user.tf: [8](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/initial_iam_user.tf# L8)
Users should authenticate with MFA (Multi-factor Authentication) to ensure an extra layer of protection when authenticating

Authentication Without MFA
/dev_machine.tf: [78](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/dev_machine.tf# L78)
Users should authenticate with MFA (Multi-factor Authentication) to ensure an extra layer of protection when authenticating

Authentication Without MFA
/iam.tf: [21](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_lambda/terraform/iam.tf# L21)
Users should authenticate with MFA (Multi-factor Authentication) to ensure an extra layer of protection when authenticating

Authentication Without MFA
/rw_iam_user.tf: [8](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/rw_iam_user.tf# L8)
Users should authenticate with MFA (Multi-factor Authentication) to ensure an extra layer of protection when authenticating

CVE-2023-39325
Go-golang.org/x/net-v0.0.0-20211015210444-4f30a5c0130f
Vulnerable Package

CVE-2023-44487
Go-k8s.io/apimachinery-v0.20.6
Vulnerable Package

CVE-2023-44487
Go-k8s.io/apiserver-v0.20.6
Vulnerable Package

CVE-2023-44487
Go-google.golang.org/grpc-v1.38.0
Vulnerable Package

CVE-2023-45133
<EMAIL_ADDRESS>Vulnerable Package

CVE-2023-45288
Go-golang.org/x/net-v0.0.0-20211015210444-4f30a5c0130f
Vulnerable Package

CVE-2023-45311
Npm-fsevents-1.2.9
Vulnerable Package

CVE-2023-49568
Go-github.com/go-git/go-git/v5-v5.4.2
Vulnerable Package

CVE-2023-49569
Go-github.com/go-git/go-git/v5-v5.4.2
Vulnerable Package

CVE-2024-21626
Go-github.com/opencontainers/runc-v1.0.0-rc93
Vulnerable Package

CVE-2024-24786
Go-google.golang.org/protobuf-v1.26.0
Vulnerable Package

CVE-2024-3817
Go-github.com/hashicorp/go-getter-v1.5.9
Vulnerable Package

CVE-2024-4068
Npm-braces-2.3.2
Vulnerable Package

CloudTrail Log Files S3 Bucket with Logging Disabled
/cloudtrail.tf: [49](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudtrail.tf# L49)
CloudTrail Log Files S3 Bucket should have 'logging' enabled

CloudWatch Console Sign-in Without MFA Alarm Missing
/cloudwatch.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L1)
Ensure a log metric filter and alarm exist for management console sign-in without MFA

CloudWatch IAM Policy Changes Alarm Missing
/cloudwatch.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L1)
Ensure a log metric filter and alarm exist for IAM policy changes

CloudWatch Root Account Use Missing
/cloudwatch.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L1)
Ensure a log metric filter and alarm exist for root acount usage

CloudWatch Unauthorized Access Alarm Missing
/cloudwatch.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L1)
Ensure a log metric filter and alarm exist for unauthorized API calls

Command_Injection
/core/python/commands.py: [601](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//core/python/commands.py# L601)
Attack Vector

Command_Injection
/core/python/commands.py: [506](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//core/python/commands.py# L506)
Attack Vector

Command_Injection
/core/python/commands.py: [467](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//core/python/commands.py# L467)
Attack Vector

Command_Injection
/core/python/commands.py: [286](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//core/python/commands.py# L286)
Attack Vector

Command_Injection
/core/python/commands.py: [275](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//core/python/commands.py# L275)
Attack Vector

Command_Injection
/core/python/commands.py: [242](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//core/python/commands.py# L242)
Attack Vector

Command_Injection
/core/python/commands.py: [238](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//core/python/commands.py# L238)
Attack Vector

Command_Injection
/core/python/commands.py: [212](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//core/python/commands.py# L212)
Attack Vector

Command_Injection
/core/python/commands.py: [203](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//core/python/commands.py# L203)
Attack Vector

Command_Injection
/core/python/commands.py: [188](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//core/python/commands.py# L188)
Attack Vector

Command_Injection
/cloudgoat.py: [74](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//cloudgoat.py# L74)
Attack Vector

Command_Injection
/cloudgoat.py: [80](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//cloudgoat.py# L80)
Attack Vector

Command_Injection
/cloudgoat.py: [80](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//cloudgoat.py# L80)
Attack Vector

Command_Injection
/cloudgoat.py: [74](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//cloudgoat.py# L74)
Attack Vector

Cx477c10a4-5717
Go-go.etcd.io/etcd-v0.5.0-alpha.5.0.20200910180754-dd1b699fc489
Vulnerable Package

Cx9c51b693-b977
Go-github.com/containerd/containerd-v1.5.2
Vulnerable Package

Cxb421a484-d05a
Go-github.com/cyphar/filepath-securejoin-v0.2.2
Vulnerable Package

Cxb6dee8d5-b814
Go-gopkg.in/square/go-jose.v2-v2.5.1
Vulnerable Package

DB Instance Storage Not Encrypted
/rds.tf: [46](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/rds.tf# L46)
AWS DB Instance should have its storage encrypted by setting the parameter to 'true'. The storage_encrypted default value is 'false'.

DB Instance Storage Not Encrypted
/rds.tf: [50](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/codebuild_secrets/terraform/rds.tf# L50)
AWS DB Instance should have its storage encrypted by setting the parameter to 'true'. The storage_encrypted default value is 'false'.

EC2 Instance Has Public IP
/ec2.tf: [137](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_efs_attack/terraform/ec2.tf# L137)
EC2 Instance should not have a public IP address.

EC2 Instance Has Public IP
/ec2.tf: [183](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_efs_attack/terraform/ec2.tf# L183)
EC2 Instance should not have a public IP address.

EC2 Instance Has Public IP
/ec2.tf: [122](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/ec2.tf# L122)
EC2 Instance should not have a public IP address.

EC2 Instance Has Public IP
/dev_machine.tf: [52](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/dev_machine.tf# L52)
EC2 Instance should not have a public IP address.

EC2 Instance Has Public IP
/ec2.tf: [96](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/codebuild_secrets/terraform/ec2.tf# L96)
EC2 Instance should not have a public IP address.

EC2 Instance Has Public IP
/ec2.tf: [43](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_takeover/terraform/ec2.tf# L43)
EC2 Instance should not have a public IP address.

EC2 Instance Has Public IP
/ec2.tf: [61](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/iam_privesc_by_attachment/terraform/ec2.tf# L61)
EC2 Instance should not have a public IP address.

EC2 Instance Has Public IP
/ec2.tf: [25](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/ec2.tf# L25)
EC2 Instance should not have a public IP address.

EC2 Instance Has Public IP
/ec2.tf: [6](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/ec2.tf# L6)
EC2 Instance should not have a public IP address.

EC2 Instance Has Public IP
/ec2.tf: [119](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ec2_ssrf/terraform/ec2.tf# L119)
EC2 Instance should not have a public IP address.

EC2 Instance Has Public IP
/ec2.tf: [29](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_takeover/terraform/ec2.tf# L29)
EC2 Instance should not have a public IP address.

EC2 Instance Has Public IP
/ec2.tf: [98](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cloud_breach_s3/terraform/ec2.tf# L98)
EC2 Instance should not have a public IP address.

ECS Task Definition Network Mode Not Recommended
/ecs.tf: [45](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_takeover/terraform/ecs.tf# L45)
Network_Mode should be 'awsvpc' in ecs_task_definition. AWS VPCs provides the controls to facilitate a formal process for approving and testing all...

ECS Task Definition Volume Not Encrypted
/ecs.tf: [71](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_takeover/terraform/ecs.tf# L71)
Amazon ECS Task Definition does not have encryption for data at transit enabled. To prevent such a scenario, enable the attribute 'transit_encryption'

EFS Not Encrypted
/efs.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_efs_attack/terraform/efs.tf# L1)
Elastic File System (EFS) must be encrypted

EFS Without KMS
/efs.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_efs_attack/terraform/efs.tf# L1)
Amazon Elastic Filesystem should have filesystem encryption enabled using KMS CMK customer-managed keys instead of AWS managed-keys

IAM Database Auth Not Enabled
/rds.tf: [46](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/rds.tf# L46)
IAM Database Auth Enabled should be configured to true when using compatible engine and version

IAM Database Auth Not Enabled
/rds.tf: [50](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/codebuild_secrets/terraform/rds.tf# L50)
IAM Database Auth Enabled should be configured to true when using compatible engine and version

IAM Policies With Full Privileges
/iam.tf: [108](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/iam_privesc_by_attachment/terraform/iam.tf# L108)
IAM policies shouldn't allow full administrative privileges (for all resources)

IAM Policy Grants Full Permissions
/iam.tf: [108](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/iam_privesc_by_attachment/terraform/iam.tf# L108)
IAM policy should not grant full permissions to resources from the get-go, instead of granting permissions gradually as necessary.

Missing User Instruction
/Dockerfile: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/assets/src/Dockerfile# L1)
A user should be specified in the dockerfile, otherwise the image will run as root

Missing User Instruction
/Dockerfile: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//Dockerfile# L1)
A user should be specified in the dockerfile, otherwise the image will run as root

Missing User Instruction
/Dockerfile: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_takeover/terraform/website/Dockerfile# L1)
A user should be specified in the dockerfile, otherwise the image will run as root

Passwords And Secrets - Generic Token
/cognito.tf: [86](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/cognito.tf# L86)
Query to find passwords and secrets in infrastructure code.

Passwords And Secrets - Generic Token
/cognito.tf: [84](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/cognito.tf# L84)
Query to find passwords and secrets in infrastructure code.

Passwords And Secrets - Generic Token
/cognito.tf: [85](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/cognito.tf# L85)
Query to find passwords and secrets in infrastructure code.

S3 Bucket Object Not Encrypted
/s3.tf: [49](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cloud_breach_s3/terraform/s3.tf# L49)
S3 Bucket Object should have server-side encryption enabled

S3 Bucket Object Not Encrypted
/s3.tf: [29](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cloud_breach_s3/terraform/s3.tf# L29)
S3 Bucket Object should have server-side encryption enabled

S3 Bucket Object Not Encrypted
/s3.tf: [63](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/s3.tf# L63)
S3 Bucket Object should have server-side encryption enabled

S3 Bucket Object Not Encrypted
/s3.tf: [19](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cloud_breach_s3/terraform/s3.tf# L19)
S3 Bucket Object should have server-side encryption enabled

S3 Bucket Object Not Encrypted
/s3.tf: [81](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/s3.tf# L81)
S3 Bucket Object should have server-side encryption enabled

S3 Bucket Object Not Encrypted
/s3.tf: [61](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/s3.tf# L61)
S3 Bucket Object should have server-side encryption enabled

S3 Bucket Object Not Encrypted
/s3.tf: [51](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/s3.tf# L51)
S3 Bucket Object should have server-side encryption enabled

S3 Bucket Object Not Encrypted
/s3.tf: [71](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/s3.tf# L71)
S3 Bucket Object should have server-side encryption enabled

S3 Bucket Object Not Encrypted
/s3.tf: [91](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/s3.tf# L91)
S3 Bucket Object should have server-side encryption enabled

S3 Bucket Object Not Encrypted
/s3.tf: [39](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cloud_breach_s3/terraform/s3.tf# L39)
S3 Bucket Object should have server-side encryption enabled

Sensitive Port Is Exposed To Entire Network
/ec2.tf: [102](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_efs_attack/terraform/ec2.tf# L102)
A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol

Sensitive Port Is Exposed To Entire Network
/ec2.tf: [53](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/ec2.tf# L53)
A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol

Sensitive Port Is Exposed To Entire Network
/ec2.tf: [77](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/ec2.tf# L77)
A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol

Unknown Port Exposed To Internet
/ec2.tf: [78](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_efs_attack/terraform/ec2.tf# L78)
AWS Security Group should not have an unknown port exposed to the entire Internet

Unrestricted Security Group Ingress
/ec2.tf: [106](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_efs_attack/terraform/ec2.tf# L106)
Security groups allow ingress from <IP_ADDRESS>:0 and/or ::/0

Unrestricted Security Group Ingress
/ec2.tf: [82](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/ec2.tf# L82)
Security groups allow ingress from <IP_ADDRESS>:0 and/or ::/0

Unrestricted Security Group Ingress
/ec2.tf: [58](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/ec2.tf# L58)
Security groups allow ingress from <IP_ADDRESS>:0 and/or ::/0

Unrestricted Security Group Ingress
/ec2.tf: [78](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_efs_attack/terraform/ec2.tf# L78)
Security groups allow ingress from <IP_ADDRESS>:0 and/or ::/0

ALB Is Not Integrated With WAF
/lb.tf: [27](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/lb.tf# L27)
All Application Load Balancers (ALB) must be protected with Web Application Firewall (WAF) service

ALB Not Dropping Invalid Headers
/lb.tf: [27](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/lb.tf# L27)
It's considered a best practice when using Application Load Balancers to drop invalid header fields

API Gateway Access Logging Disabled
/apigateway.tf: [38](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/apigateway.tf# L38)
API Gateway Stage should have Access Logging Settings defined

API Gateway Access Logging Disabled
/apigateway.tf: [38](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/apigateway.tf# L38)
API Gateway should have Access Log Settings defined

API Gateway Access Logging Disabled
/apig.tf: [316](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L316)
API Gateway Stage should have Access Logging Settings defined

API Gateway Access Logging Disabled
/apig.tf: [316](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L316)
API Gateway should have Access Log Settings defined

API Gateway Deployment Without Access Log Setting
/apig.tf: [309](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L309)
API Gateway Deployment should have access log setting defined when connected to an API Gateway Stage.

API Gateway Method Does Not Contains An API Key
/apig.tf: [82](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L82)
An API Key should be required on a method request.

API Gateway Method Does Not Contains An API Key
/apig.tf: [99](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L99)
An API Key should be required on a method request.

API Gateway Method Does Not Contains An API Key
/apig.tf: [89](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L89)
An API Key should be required on a method request.

API Gateway With CloudWatch Logging Disabled
/apig.tf: [316](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L316)
AWS CloudWatch Logs for APIs should be enabled and using the naming convention described in documentation

API Gateway With Invalid Compression
/apig.tf: [65](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L65)
API Gateway should have valid compression, which means attribute 'minimum_compression_size' should be set and its value should be greater than -1 a...

API Gateway With Open Access
/apig.tf: [92](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L92)
API Gateway Method should restrict the authorization type, except for the HTTP OPTIONS method.

API Gateway With Open Access
/apig.tf: [85](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L85)
API Gateway Method should restrict the authorization type, except for the HTTP OPTIONS method.

API Gateway With Open Access
/apig.tf: [102](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L102)
API Gateway Method should restrict the authorization type, except for the HTTP OPTIONS method.

API Gateway Without Configured Authorizer
/apig.tf: [65](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L65)
API Gateway REST API should have an API Gateway Authorizer

API Gateway Without SSL Certificate
/apig.tf: [316](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L316)
SSL Client Certificate should be enabled

API Gateway X-Ray Disabled
/apig.tf: [316](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L316)
API Gateway should have X-Ray Tracing enabled

API Gateway without WAF
/apig.tf: [316](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/apig.tf# L316)
API Gateway should have WAF (Web Application Firewall) enabled

CVE-2023-3978
Go-golang.org/x/net-v0.0.0-20211015210444-4f30a5c0130f
Vulnerable Package

CVE-2023-48795
Go-golang.org/x/crypto-v0.0.0-20210513164829-c07d793c2f9a
Vulnerable Package

CVE-2024-28863
Npm-tar-4.4.8
Vulnerable Package

CVE-2024-28863
Npm-tar-4.4.19
Vulnerable Package

CVE-2024-29018
Go-github.com/docker/docker-v20.10.7
Vulnerable Package

CVE-2024-35195
Python-requests-2.26.0
Vulnerable Package

CVE-2024-4067
Npm-micromatch-3.1.10
Vulnerable Package

CloudTrail SNS Topic Name Undefined
/cloudtrail.tf: [34](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudtrail.tf# L34)
Check if SNS topic name is set for CloudTrail

CloudWatch AWS Organizations Changes Missing Alarm
/cloudwatch.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L1)
Ensure a log metric filter and alarm exist for AWS organizations changes

CloudWatch Disabling Or Scheduled Deletion Of Customer Created CMK Alarm Missing
/cloudwatch.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L1)
Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMK

CloudWatch Log Group Without KMS
/cloudwatch.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L1)
AWS CloudWatch Log groups should be encrypted using KMS

CloudWatch Management Console Auth Failed Alarm Missing
/cloudwatch.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L1)
Ensure a log metric filter and alarm exist for AWS Management Console authentication failures

CloudWatch S3 policy Change Alarm Missing
/cloudwatch.tf: [43](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L43)
Ensure a log metric filter and alarm exist for S3 bucket policy changes

CloudWatch S3 policy Change Alarm Missing
/cloudwatch.tf: [11](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L11)
Ensure a log metric filter and alarm exist for S3 bucket policy changes

CloudWatch Without Retention Period Specified
/cloudwatch.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L1)
AWS CloudWatch Log groups should have retention days specified

Cloudwatch Cloudtrail Configuration Changes Alarm Missing
/cloudwatch.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L1)
Ensure a log metric filter and alarm exist for CloudTrail configuration changes

Cloudwatch Security Group Changes Alarm Missing
/cloudwatch.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudwatch.tf# L1)
Ensure a log metric filter and alarm exist for security group changes

Cognito UserPool Without MFA
/cognito.tf: [1](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_cognito/terraform/cognito.tf# L1)
AWS Cognito UserPool should have MFA (Multi-Factor Authentication) defined to users

Cx47e4310e-3167
Go-go.etcd.io/etcd-v0.5.0-alpha.5.0.20200910180754-dd1b699fc489
Vulnerable Package

Cx68162182-3f7b
Go-github.com/containerd/containerd-v1.5.2
Vulnerable Package

ECR Image Tag Not Immutable
/sdlc.tf: [58](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/sdlc.tf# L58)
ECR should have an image tag be immutable. This prevents image tags from being overwritten.

Healthcheck Not Set
/docker_stack.yml: [4](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//docker_stack.yml# L4)
Check containers periodically to see if they are running properly.

IAM Policies Attached To User
/dev_machine.tf: [76](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/dev_machine.tf# L76)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/rw_iam_user.tf: [6](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/rw_iam_user.tf# L6)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/iam.tf: [106](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ec2_ssrf/terraform/iam.tf# L106)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/iam.tf: [24](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/iam_privesc_by_rollback/terraform/iam.tf# L24)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/iam.tf: [19](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_lambda/terraform/iam.tf# L19)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/iam.tf: [55](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/iam_privesc_by_attachment/terraform/iam.tf# L55)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/iam.tf: [119](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/iam.tf# L119)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/iam.tf: [98](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ec2_ssrf/terraform/iam.tf# L98)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/initial_iam_user.tf: [6](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/initial_iam_user.tf# L6)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/iam.tf: [89](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/codebuild_secrets/terraform/iam.tf# L89)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/iam.tf: [120](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/lambda_privesc/terraform/iam.tf# L120)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/iam.tf: [115](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/rce_web_app/terraform/iam.tf# L115)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/iam.tf: [85](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/codebuild_secrets/terraform/iam.tf# L85)
IAM policies should be attached only to groups or roles

IAM Policies Attached To User
/iam.tf: [102](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ec2_ssrf/terraform/iam.tf# L102)
IAM policies should be attached only to groups or roles

Instance With No VPC
/dev_machine.tf: [52](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/dev_machine.tf# L52)
EC2 Instances should be configured under a VPC network. AWS VPCs provide the controls to facilitate a formal process for approving and testing all ...

Memory Not Limited
/docker_stack.yml: [4](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//docker_stack.yml# L4)
Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...

Missing_HSTS_Header
/scenarios/ecs_takeover/terraform/website/main.go: [51](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/ecs_takeover/terraform/website/main.go# L51)
Attack Vector

Path_Traversal
/cloudgoat.py: [80](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//cloudgoat.py# L80)
Attack Vector

Path_Traversal
/cloudgoat.py: [80](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//cloudgoat.py# L80)
Attack Vector

Path_Traversal
/cloudgoat.py: [80](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//cloudgoat.py# L80)
Attack Vector

Path_Traversal
/scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda1_src/click/core.py: [1046](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda1_src/click/core.py# L1046)
Attack Vector

Path_Traversal
/scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda2_src/click/core.py: [1046](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda2_src/click/core.py# L1046)
Attack Vector

Path_Traversal
/scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda2_src/click/utils.py: [510](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda2_src/click/utils.py# L510)
Attack Vector

Path_Traversal
/scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda1_src/click/utils.py: [510](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda1_src/click/utils.py# L510)
Attack Vector

Path_Traversal
/scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda1_src/click/utils.py: [510](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda1_src/click/utils.py# L510)
Attack Vector

Path_Traversal
/scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda2_src/click/utils.py: [510](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_lambda/terraform/lambda_source_code/policy_applier_lambda2_src/click/utils.py# L510)
Attack Vector

Pip install Keeping Cached Packages
/Dockerfile: [4](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/assets/src/Dockerfile# L4)
When installing packages with pip, the '--no-cache-dir' flag should be set to make Docker images smaller

Pip install Keeping Cached Packages
/Dockerfile: [9](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//Dockerfile# L9)
When installing packages with pip, the '--no-cache-dir' flag should be set to make Docker images smaller

Pip install Keeping Cached Packages
/Dockerfile: [18](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//Dockerfile# L18)
When installing packages with pip, the '--no-cache-dir' flag should be set to make Docker images smaller

Policy Without Principal
/cloudtrail.tf: [30](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/detection_evasion/terraform/cloudtrail.tf# L30)
All policies, except IAM identity-based policies, should have the 'Principal' element defined

Policy Without Principal
/iam.tf: [53](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_lambda/terraform/iam.tf# L53)
All policies, except IAM identity-based policies, should have the 'Principal' element defined

Policy Without Principal
/lambda.tf: [8](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/vulnerable_lambda/terraform/lambda.tf# L8)
All policies, except IAM identity-based policies, should have the 'Principal' element defined

Privacy_Violation
/scenarios/cicd/terraform/test/scenario_test.go: [258](https://github.com/PearsonAppsec/cloudgoat/blob/snyk-fix-7abe259a311e778efcd7159b8b273b20//scenarios/cicd/terraform/test/scenario_test.go# L258)

More results are available on AST platform


Helm

/test check multicloud-operators-subscription

/test check multicloud-operators-subscription

the check job failed due to lack of resource in prow server.
will do check locally and ignore the check job status on prow for now.

/lgtm


net/haproxy: change server state on-the-fly

split from #165:
And another thing in this context is the possibility to set a server in drain mode.
Existing connections keeps on their backend server. But new connections goes to "ready" server only.
http://cbonte.github.io/haproxy-dconv/1.8/management.html#9.3-set server
We should probably start by supporting the following features:
set server <backend>/<server> state [ ready | drain | maint ]
set server <backend>/<server> weight <weight>[%]

I think this feature would be even more useful when it would allow to send any available command to any server. For this to work we probably need a new page, similar to the stats page, that shows all servers and their current/live state. A new button would allow to send commands to a server. Additionally it might be useful to be able to send a command to multiple servers at once.
This probably obsoletes the need to reload/restart HAProxy in many situations.

implemented in #2213


Add OpenID Connect authentication

See actualbudget/actual#1164

Implemented the database migration now, let me know if anything else needs to be done

It looks like you have have a few lint and build errors — can you fix those?

I've started writing the tests but am struggling to find a good way to verify the migrations work correctly. I can think of a few approaches but none of them are really satisfactory.

Check for binary equality of the migrated database using db.serialize(). This seems too restrictive as it depends on innocuous changes, e.g. VACCUM commands.
Check that the runMigrations function succeeds. Doesn't actually verify that the migration leaves us with a database in the correct state, just that the sql didn't error out.
Something in the middle, like checking that the tables have the correct schema (not sure how to do this but should be possible).

Maybe something along the lines of setting up a database in the desired state, running the migration function, then ensuring the various functions that touch the database (primarily login) work as expected?

I think that would basically require a test suite for the whole server, which we could then in turn run with the database initialized to the three states that you mentioned above. Honestly this is probably a bit too much work, what I was envisioning was closed to unit tests for the runMigrations function.
I've settled on checking the basics, i.e. in each of the three scenarios, the final database has the correct tables and applied migrations. Additionally, in the more important case of actually migrating, check that the old password data is correctly transferred to the new database format.

That seems like a good middle ground!

https://github.com/actualbudget/actual/pull/1164#issuecomment-1677958886


feat(sol-types): make Encodable actually work

Renamed existing Encodable to SolTypeEncodable and make it clear that it should not be implemented manually
Add a new Encodable trait with the useful methods from SolType, but instead of rust : &Self::RustType they take receiver self
Encodable is implemented for all ABI Rust types and just delegates everything to SolTypeEncodable when Self: SolTypeEncodable
Moved implementations of previous &Self::RustType methods to SolTypeEncodable so they can be used in Encodable

Also is there a better name than Encodable? This trait is a helper for everything SolType does, not just encoding


Ensure pip install and "About this notebook" cells are consistent within notebooks

Long term it maybe nice to add a CI job to check for these, but for now, we just need to check manually that each notebook has a cell at the top with a commented out pip install line listing its dependencies, and also contain a last cell with author/update/irsahelp information.

[x] install cell
[x] author
[x] update
[x] irsahelp, it should be a working link not just normal text

Thanks for this checklist. Do we have more things like this that we want to keep consistent across notebooks? I think there's some formatting things like making sure markdown header levels always increase/decrease by one and that section titles are not numbered. Would it be helpful to open a more general issue with a checklist of these things?

I think there's some formatting things like making sure markdown header levels always increase/decrease by one and that section titles are not numbered. Would it be helpful to open a more general issue with a checklist of these things?

Extreme markdown header level inconsistencies will break the build, so I think that first point works without explicit templating.

For the right hand side TOC, I best like your cloud notebooks. They have short headings, and numbering too. I suppose we can auto generate the numbering, but doing it by hand would work, too. Would be nice to template it as right now we have at least 3 different approaches we do.

yep, a separate issue would be good, or a template PR, maybe in the ipac-sp repo?


Enhance the HDMI CEC Test to support an emulator.

HAL Emulator for HDMI CEC

The HDMI CEC HAL interface test shall be enhanced to support an emulator that can be used as a Virtual device.
Currently, rdk-halif-test-hdmi_cec supports a skeleton (stubbed out) implementation of the interface defined in rdk-halif-hdmi_cec. This shall be enhanced to support an emulator that mimics operations of a real device.
The Emulator implementation shall replace the Skeleton implementation as the default.
A Common emulator interface with Intitialize and Deinitialize methods shall be defined.
Emulator shall be built as a separate binary (shared lib).

Set goals for the MVP required:

assume that the MVP is a TV
load a configuration file start the module
send cec commands to the caller
accept a control plane command to perform an action, trigger active source
what would be the min requirements for supporting emulation?
need to think about this and generate a list in this ticket?
generate a mind map of thoughts with dependancies, mermaid mindmap?


Can Bert be fine-tuned on unlabeled data?

Elmo can fine tune on unlabeled data, so we might need less domain labeled data to do training.  So is it possible on Bert?  Do you think it's a useful way to make model focus on domain data?

If I understand you correctly, this is the answer...This tuning process is called "pre-training" in Bert...
https://github.com/google-research/bert#pre-training-with-bert

@pren1  Yes that's what I want.  Thank u so much.

@Wanjun0511 @pren1
I did a pre training process for the model and I got a checkpoint, graph.phtxt and series of model.ckpt checkpoint files, so everything was fine for the pre training proccess.
And the next step, I am now trying to fine tune the self pre training model but I am encountering some error messages (the main part of the error messages shown below):
2 root error(s) found.
(0) Not found: Key output_bias not found in checkpoint
[[node save/RestoreV2 (defined at run_classifier.py:953) ]]
[[save/RestoreV2/_301]]
(1) Not found: Key output_bias not found in checkpoint
[[node save/RestoreV2 (defined at run_classifier.py:953) ]]
0 successful operations.
0 derived errors ignored.
Original stack trace for 'save/RestoreV2':
File "run_classifier.py", line 1054, in
tf.app.run()
Have you met the situation like this? I have no idea how to fix it.
I will be grateful for any help you can provide.


Fixed several rather minor issues (mainly typos)

This pull request covers several rather minor issues (mainly typos):

the overtaking-signs had switched colours, the left vehicle should be red, not the right one
added signs
danger_animals
danger_snow
prohibitory_vehicle_weight_limit
prohibitory_no_pedestrians_and_bicycles
fixed signs that were not displayed due to syntax-errors or duplicate ID or similar
mandatory_go_left_or_straight
danger_bend_left
danger_bend_first_left
danger_road_narrows_left
danger_road_narrows_right
prohibitory_no_motorcycles
warning_winding_road_left
warning_winding_road_right
regulatory_no_hitch_hiking
Fixed ordering of traffic lights (and renamed to top/middle/bottom instead of r/y/g), see #2
Made the round signs truly circular (before they were more like superellipses/squircles)
Vertically centered variable sign contents (speed/weight/height)
Added .fit-class to some us-signs to fit them into the diamond-shaped signs
Removed unused icons stoplights-r.svg, stoplights-y.svg and stoplights-g.svg

I found some more typos, including the one reported in #2.

Thank you!


Odd pin access code in detailed router.

https://github.com/The-OpenROAD-Project/OpenROAD/blob/719c6dc617d4b8d6896500bb41cdf057864f9e09/src/drt/src/dr/FlexDR_maze.cpp#L1940-L1968
The pin access code above is phrased a bit weird. It seems to select only the first pin access point in the list rather than iterating through the whole thing. Is this intentional? The rest of the code seems to accommodate selecting multiple pin access points.

I uncommented the line to see if things would break, but it looks like it improves the slack on designs like AES.
From
---------------------------------------------------------------------------
                              7.663   data required time
                             -9.087   data arrival time
---------------------------------------------------------------------------
                             -1.424   slack (VIOLATED)

To
---------------------------------------------------------------------------
                              7.916   data required time
                             -9.549   data arrival time
---------------------------------------------------------------------------
                             -1.633   slack (VIOLATED)

@osamahammad21 @maliberty Should we remove the break statement?

The first AP is the preferred AP so I think this is intentional.  We would need to run a full suite of designs to consider changing this.

If that's the case why is dividing by toApCnt in the lines following this loop? It seems at some point there was some kind of averaging algorithm that now is basically dead.

@osamahammad21
Can you check this pin access code?

I don't think removing the break would be correct. Moving it to the outer for loop could be correct. Here is why:
uConnPins is a vector of all the pins that are to be connected for the current net. We pass this vector to routeNet_setSrc(), where we are calculating the centerPt and the srcPin.  It's worth mentioning that the distance to the centerPt  is used in the maze search as a second preference for sorting the waveFrontGrid points after the cost (it is the tie breaker of 2 waveFronts with the same cost).
Now that this is explained, I think the code is meant to do the following:

Get the centerPt of the first pin's access points.
Set the src pin as the furthest away pin from that first pin we chose.

This makes the search start from that src pin and keep on advancing towards the centerPt which is "final destination" for that net. I am considering the centerPt as the theoritical final destination because in mazeSearch we start at the src pin and keep on going to the nearest pin to that src pin. since the centerPt is the furthest away from the initial src pin, it should theoretically be the final pin chosen as destination in the maze search of the net.
If we remove the break entirely, then we are setting the centerPt as the center of all access points which directs the maze search to advance more to that center. So if we have a net of 2 pins on the opposing boundaries, the centerPt would be exactly at the center of the worker (either vertically or horizontally). This doesn't seem correct.
Also it's worth mentioning that I don't think we rely heavily on the centerPt as the cost takes into consideration the distance to the current destination node.
That said, I didn't write the code so I am not sure if that was the initial intention. But it seems to me that this is the most logical explanation.


Adding a dataset acquired from Zed camera

I was wondering about the parameters should be added/modified to allow the visualizer to visualize the data acquired from zed camera

In principle, Kimera-VIO will display the 3D reconstruction and camera pose estimation given the images and IMU data, it will not do raw sensor measurements (images/imu) visualization.


E2E testing

e2e testing to resolve #55

@font thanks for your review! I'd like to be able to work on this through completion. I'll start working on your suggestions as well as rebase to bring in updated changes

@font addressed comments. Also synced upstream v3.2.2 e2e test. Reenabled ginko tests as well

@font should be good

@font addressed comments


Fix some clippy warnings

This PR fixes some clippy warnings.

Hmm. I've already applied cargo fmt, but CI causes error on cargo fmt --all -- --check.

@pksunkara Feel free to merge such PR's in the future :wink:

Yeah, CI was still pending when I reviewed 😄


to has too low a precedence

Description:
It seems as if "to" has too low a precedence:

I think it gets parsed as:

I feel like it should have a much higher precedence than any algebraic operation. I would be expecting this to be parsed as

I assume this is a parser thing? @umuro @quinn-dougherty


react-router-dom yarn install issue

my package.json file has
"react-router-dom": "4.2.0"

and the node_modules/react-router-dom/package.json has
 "dependencies": {
   "history": "^4.7.2",
   "invariant": "^2.2.2",
   "loose-envify": "^1.3.1",
   "prop-types": "^15.5.4",
   "react-router": "^4.2.0"
  }

two days ago react-router upgraded their version to 4.4.0, because of the ^ symbol the latest version 4.4.0 is installed and the application crashes as the react-router-dom itself not updated for react-router.

Dupe of #6630


thumbnail generation, file not found error

What I'm trying to achieve
I'm writing helm charts for saleor and I'm on the last major component - the worker.
There seems to be some sort of directory mismatch or something like that when the worker starts trying to generate the images.
Here is the error output in this gist.
Maybe it has something to do with the permission levels that celery worker runs with.
The app deployment runs as user saleor. Also, I have an init container which sets the directory
permissions to saleor:saleor on init.
Basically, the issue seems to be that it expected a file or directory that does not exist.
No such file or directory: '/app/media/products/saleor/static/placeholders/books/book-05_DWRi802.jpg'

System information
Operating system: kubernetes
Browser: firefox

Looks like it's an issue with populatedb. Versatile is looking into /app/media/products/saleor/static/placeholders/coffee/ instead of /app/media/products/.
Try applying this patch on an empty db:
Index: saleor/core/utils/random_data.py
<+>UTF-8
===================================================================
--- saleor/core/utils/random_data.py	(revision 8c6b91012b3db67b8a54d4fb6517500a962a1cc1)
+++ saleor/core/utils/random_data.py	(date<PHONE_NUMBER>000)
@@ -661,4 +661,4 @@

 def get_image(image_dir, image_name):
     img_path = os.path.join(image_dir, image_name)
-    return File(open(img_path, 'rb'))
+    return File(open(img_path, 'rb'), name=image_name)

In the DB, this is the url: products/saleor/static/placeholders/t-shirts/6.jpg

@NyanKiyoshi
I think I've figured it out now. You gave me a clue in the right direction. The populatedb script was running in a pod with incorrect permissions to /app/media.
I had the volume mount permissions set correctly for the deployments manifests but not for the job manifests. The job manifests run the migration script and populate script.
I'm currently changing it but I think that will work because when I manually ran the populatedb script in the deployment it was working.

@stephenmoloney have you finally created the helm charts?
Can you share them?
Thank you

@jdivins I have taken that effort offline in a private repo for now. I have made substantial progress, basically it works. I'm busy for the next few days. I'll update the PR within the next 10 days.
I'll let you know. It would be great to get feedback when I update the PR.
#2702

Ok! Thank you very much! I haven't seen the PR.

Yea, I'd encourage you to wait until I've updated the PR though. I've made some decent progress and improvements beyond what's there now. I just don't have time to update it at the moment.

@stephenmoloney have you updated something? Can I pick #2702 commits as start point?
Thank you very much for your help

Hi @jdivins,
This is my top priority now. Gonna get back to you soon. I just started adding stable/sentry to requirements.yaml and I'm having to make additions to a fork of that chart to completely automate the setup. I hope to make a PR back to that repo. I still have lots of docs to write, and various other changes to cleanup.
As an intermediate measure, I can create a separate repo with intermediate work.
It's going to change a lot. I'm only going to update the PR at the end of the process.
I'll post the link to a repo soon.

Hi @stephenmoloney,
Have you got news about this issue?
Thank you very much! As you can see I am really interested in this solution

i still have an issue with this with latest disto-- the image thumbnail is showing up with 300x300 in the file name in s3 bucket yet site is linking to 255x255


restructure my file

I am going to merge but take note of the following

Work on a branch other than the main branch and make a pull request from there.
Always pull main before you create a new branch to work from.
 Task/create_directory


HADOOP-18946. TestErrorTranslation failure

Remove invalid assertion
How was this patch tested?
Rerun of failing test suite.
Not. bothered with rest of tests
For code changes:

[X] Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
[ ] Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
[ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
[ ] If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

I want to throw that nested exception, as it is clearly something bad
just my IDE's "test" macro adds it always. and it means if we add more lines, no need to change the signature. matters more with subclasses


pGina Service Status: Disconnected

We have pGina partially installed in one of our computer labs.  I noticed, last night, that there were two machines that said "pGina Service:  Disconnected" at the login screen.  I logged into both machines to turn the service back on and then rebooted the machines, but noticed the same message again, which lasted longer than 15-20 seconds.  I had to log back into the machines with a local account to restart the service.  This doesn't happen on all the machines that pGina 3.0 is installed on.  It seems to be a random event, but has occurred on at least 4 machines.

Is the service set to autostart?
Sounds like the service is crashing after time, not sure why it didn't start after reboot though.  Can you provide (email<EMAIL_ADDRESS>or paste to a comment here) the service log (in c:\Program Files\pGina3)?

Also, note for devs - we should add an unexpected exception handler that writes a dump and/or stack out to file (avoiding the log4net stack) so we can log crash call stacks and/or do postmortem debugging.  Marking this bug as required for release milestone.

From the logs cshelp sent there are definetly large gaps without specific cause, followed by startup.  I think the service is crashing.
cshelp - if you have a machine this occurs on frequently that you can take out of service for a period of time, could you grab the ProcDump tool here: http://technet.microsoft.com/en-us/sysinternals/dd996900 then:

Login as a local administrator
Verify that the pGina service is running (if not, start it)
From a cmd line, run ProcDump ala:

procdump.exe -e -ma -n 1 pGina.Service.ServiceHost.exe
This will monitor the service executable that is running over time, if/when it crashes, it will write a .dmp file.  Please compress and send this if at all possible (if it is too large after compressing, we can workout another form of transfer, just drop me an email).

Nathan,
I've been running that procdump utility since last Thursday evening and a
*.dmp file has not been created.  The machine has been logged in with the
admin account.  I checked the pGina Configuration window and the process is
still running.  Should I continue to run this program for a while longer?
On Wed, Dec 7, 2011 at 4:26 PM, Jesse Eckstrom<EMAIL_ADDRESS>wrote:

I'll have to do this tomorrow evening, as there are labs in that room
during the day tomorrow.
On Wed, Dec 7, 2011 at 3:34 PM, Nate Yocom <
<EMAIL_ADDRESS>
wrote:

From the logs cshelp sent there are definetly large gaps without specific
cause, followed by startup.  I think the service is crashing.
cshelp - if you have a machine this occurs on frequently that you can
take out of service for a period of time, could you grab the ProcDump tool
here: http://technet.microsoft.com/en-us/sysinternals/dd996900 then:

Login as a local administrator
Verify that the pGina service is running (if not, start it)
From a cmd line, run ProcDump ala:

procdump.exe -e -ma -n 1 pGina.Service.ServiceHost.exe
This will monitor the service executable that is running over time,
if/when it crashes, it will write a .dmp file.  Please compress and send
this if at all possible (if it is too large after compressing, we can
workout another form of transfer, just drop me an email).

Reply to this email directly or view it on GitHub:
https://github.com/pgina/pgina/issues/77#issuecomment-3055441

--
Jesse Eckstrom
MCLT 223
Ph.<PHONE_NUMBER>
<EMAIL_ADDRESS><EMAIL_ADDRESS>
--
Jesse Eckstrom
MCLT 223
Ph.<PHONE_NUMBER>
<EMAIL_ADDRESS><EMAIL_ADDRESS>

Sounds like its a problem with one of the plugins then (and/or the process
of logging in and out).  Can you leave it running, but don't logoff (just
disconnect) the admin account? You should be able to "Switch users" and
leave the procdump tool running, then use the machine like normal.   Next
time you see it go disconnected, see if there is a dmp file?
Thanks!

Another option would be to use the config ui's ability to test against the
running service.  Do this and virtually login a few times and see if the
service crashes?
Thanks again for your help,
Nate
On Mon, Dec 12, 2011 at 5:08 PM, Nate Yocom<EMAIL_ADDRESS>wrote:

Sounds like its a problem with one of the plugins then (and/or the process
of logging in and out).  Can you leave it running, but don't logoff (just
disconnect) the admin account? You should be able to "Switch users" and
leave the procdump tool running, then use the machine like normal.   Next
time you see it go disconnected, see if there is a dmp file?
Thanks!

once a build with https://github.com/pgina/pgina/commit/c889c36f1ea84480d4841bdc71254c3adf965011 has been created, could you please re-test with it? It should (hopefully) log crashes a little better (so the pGina.Service.ServiceHost_log.txt should be a lot more informative).  Thanks!

rafbec: this does look like a different problem, in that it dies right away for you.  Does the previous version run for you? I'll remove the explicit app exit in the unhandled exception handler just in case that's getting in the way.  Could you please indicate what version of windows you're running on?

actually, I'm going to capture this issue in a new issue rafbec - please follow here: https://github.com/pgina/pgina/issues/79

We discovered a disconnected service today, and even after multiple reboots, the service did not come up on its own.   In the following trace, there were two reboot attempts.  It looks like the service died each time silently at or near the time that it is starting up.  (This is with pGina <IP_ADDRESS>)
The first service "death", apparently just after "SessionLogoff".
2012-01-05 09:51:02,232 [4636|6|INFO ] pGina.Service.Impl: SessionChange: 2 -> SessionLogoff
2012-01-05 11:30:25,838 [1936|1|INFO ] Startup: Starting up, log4net configured from: C:\Program Files\pGina\log4net.config
2012-01-05 11:30:27,959 [1936|1|DEBUG] PluginLoader: Initializing

We should be seeing a "ConsoleDisconnect" and a "ConsoleConnect" immediately after the "SessionLogoff", but nothing.  It appears that the service crashed silently.
When restarting the service seems to die around the time that we get the COMException seen in the stack trace below.  There is also a login process going on at the same time.  There is a login attempt, an exception, and it appears that the service dies just after the entry at 11:30:37,569.
...
2012-01-05 11:30:29,800 [1936|21|DEBUG] Abstractions: Setting PipeAccess FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:30:29,800 [1936|11|DEBUG] Abstractions: Setting PipeAccess FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:30:29,800 [1936|20|DEBUG] Abstractions: Setting PipeAccess FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:30:29,800 [1936|17|DEBUG] Abstractions: Setting PipeAccess FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:30:30,268 [1936|8|DEBUG] LocalMachine: IterateCleanupUsers Eligible users: **removed**
2012-01-05 11:30:30,268 [1936|8|DEBUG] LocalMachine: IterateCleanupUsers loggedOnUsers:
2012-01-05 11:30:31,469 [1936|27|DEBUG] RemoteLog[NativeLib]: [Provider.cpp:244] Provider::UnAdvise() - provider events callback reference released
2012-01-05 11:30:31,469 [1936|21|DEBUG] RemoteLog[NativeLib]: [Provider.cpp:116] Provider::SetUsageScenario(1, 0x00000000)
2012-01-05 11:30:31,485 [1936|26|DEBUG] RemoteLog[NativeLib]: [Provider.cpp:233] Provider::Advise(00000000017F16B0,<PHONE_NUMBER>7F15B0) - provider events callback reference added
2012-01-05 11:30:31,532 [1936|11|DEBUG] RemoteLog[NativeLib]: [Provider.cpp:389] SerializedCredsAppearComplete: No serialized creds set
2012-01-05 11:30:31,750 [1936|8|ERROR] pGina.Service.Exception: CurrentDomain_UnhandledException: System.Runtime.InteropServices.COMException (0x80070842): The Server service is not started.

   at System.DirectoryServices.DirectoryEntry.RefreshCache()
   at System.DirectoryServices.AccountManagement.PrincipalContext.DoMachineInit()
   at System.DirectoryServices.AccountManagement.PrincipalContext.Initialize()
   at System.DirectoryServices.AccountManagement.PrincipalContext.get_QueryCtx()
   at System.DirectoryServices.AccountManagement.PrincipalSearcher.SetDefaultPageSizeForContext()
   at pGina.Plugin.LocalMachine.LocalAccount.GetUserPrincipal(String username)
   at pGina.Plugin.LocalMachine.PluginImpl.IterateCleanupUsers()
   at pGina.Plugin.LocalMachine.PluginImpl.BackgroundTaskCallback(Object state)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean ignoreSyncCtx)
   at System.Threading._TimerCallback.PerformTimerCallback(Object state)
2012-01-05 11:30:35,229 [1936|33|DEBUG] RemoteLog[NativeLib]: [Credential.cpp:258] Credential::GetSerialization: Processing login for ***removed***
2012-01-05 11:30:35,790 [1936|31|DEBUG] PluginDriver:df67b67e-8ce5-462f-998b-86d12bd886ff: New PluginDriver created
2012-01-05 11:30:35,806 [1936|31|DEBUG] pGina.Service.Impl: Processing LoginRequest for: **removed** in session: 1 reason: Login
2012-01-05 11:30:35,806 [1936|31|DEBUG] PluginDriver:df67b67e-8ce5-462f-998b-86d12bd886ff: Performing login process
2012-01-05 11:30:35,806 [1936|31|DEBUG] PluginDriver:df67b67e-8ce5-462f-998b-86d12bd886ff: Authenticating user **removed**, 2 plugins available
2012-01-05 11:30:35,806 [1936|31|DEBUG] PluginDriver:df67b67e-8ce5-462f-998b-86d12bd886ff: Calling 0f52390b-c781-43ae-bd62-553c77fa4cf7
2012-01-05 11:30:35,868 [1936|31|DEBUG] LdapPlugin: AuthenticateUser(df67b67e-8ce5-462f-998b-86d12bd886ff)
2012-01-05 11:30:35,868 [1936|31|DEBUG] LdapPlugin: Received username: **removed**
2012-01-05 11:30:35,900 [1936|31|DEBUG] LdapPlugin: Attempting authentication for **removed**
2012-01-05 11:30:37,070 [1936|31|DEBUG] LdapServer: Initializing LdapServer host(s): [***], port: 636, useSSL = True, verifyCert = True
2012-01-05 11:30:37,491 [1936|31|DEBUG] LdapServer: Timeout set to 10 seconds.
2012-01-05 11:30:37,538 [1936|31|DEBUG] LdapAuthenticator: Attempting to bind with DN **removed**
2012-01-05 11:30:37,569 [1936|31|DEBUG] LdapServer: Attempting bind as **removed**
2012-01-05 11:33:08,549 [1988|1|INFO ] Startup: Starting up, log4net configured from: C:\Program Files\pGina\log4net.config
2012-01-05 11:33:10,468 [1988|1|DEBUG] PluginLoader: Initializing

This is the second crash again, quite close to the COMException.
2012-01-05 11:33:12,246 [1988|27|DEBUG] Abstractions: Setting PipeAccess FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:33:12,246 [1988|23|DEBUG] Abstractions: Setting PipeAccess FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:33:12,620 [1988|8|DEBUG] LocalMachine: IterateCleanupUsers Eligible users: **removed**
2012-01-05 11:33:12,667 [1988|8|DEBUG] LocalMachine: IterateCleanupUsers loggedOnUsers:
2012-01-05 11:33:13,104 [1988|8|ERROR] pGina.Service.Exception: CurrentDomain_UnhandledException: System.Runtime.InteropServices.COMException (0x80070842): The Server service is not started.

   at System.DirectoryServices.DirectoryEntry.RefreshCache()
   at System.DirectoryServices.AccountManagement.PrincipalContext.DoMachineInit()
   at System.DirectoryServices.AccountManagement.PrincipalContext.Initialize()
   at System.DirectoryServices.AccountManagement.PrincipalContext.get_QueryCtx()
   at System.DirectoryServices.AccountManagement.PrincipalSearcher.SetDefaultPageSizeForContext()
   at pGina.Plugin.LocalMachine.LocalAccount.GetUserPrincipal(String username)
   at pGina.Plugin.LocalMachine.PluginImpl.IterateCleanupUsers()
   at pGina.Plugin.LocalMachine.PluginImpl.BackgroundTaskCallback(Object state)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean ignoreSyncCtx)
   at System.Threading._TimerCallback.PerformTimerCallback(Object state)
2012-01-05 11:33:14,586 [1988|27|DEBUG] RemoteLog[NativeLib]: [Provider.cpp:389] SerializedCredsAppearComplete: No serialized creds set
2012-01-05 11:41:33,244 [2004|1|INFO ] Startup: Starting up, log4net configured from: C:\Program Files\pGina\log4net.config
2012-01-05 11:41:34,851 [2004|1|DEBUG] PluginLoader: Initializing

I'll do some research on the COMException and see what I can come up with.

The silent death is concerning.  However, we should be able to either fix
or work around the GetUserPrincipal issue.
If nothing else, a big try {} catch {} around the GetUserPrincipal call
might be recommended... or around the IterateCleanupUsers() call.
Nate
On Thu, Jan 5, 2012 at 3:48 PM, David Wolff <
<EMAIL_ADDRESS>
wrote:

We discovered a disconnected service today, and even after multiple
reboots, the service did not come up on its own.   In the following trace,
there were two reboot attempts.  It looks like the service died each time
silently at or near the time that it is starting up.  (This is with pGina
<IP_ADDRESS>)
The first service "death", apparently just after "SessionLogoff".
2012-01-05 09:51:02,232 [4636|6|INFO ] pGina.Service.Impl: SessionChange:
2 -> SessionLogoff
2012-01-05 11:30:25,838 [1936|1|INFO ] Startup: Starting up, log4net
configured from: C:\Program Files\pGina\log4net.config
2012-01-05 11:30:27,959 [1936|1|DEBUG] PluginLoader: Initializing

We should be seeing a "ConsoleDisconnect" and a "ConsoleConnect"
immediately after the "SessionLogoff", but nothing.  It appears that the
service crashed silently.
When restarting the service seems to die around the time that we get the
COMException seen in the stack trace below.  There is also a login process
going on at the same time.  There is a login attempt, an exception, and it
appears that the service dies just after the entry at 11:30:37,569.
...
2012-01-05 11:30:29,800 [1936|21|DEBUG] Abstractions: Setting PipeAccess
FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:30:29,800 [1936|11|DEBUG] Abstractions: Setting PipeAccess
FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:30:29,800 [1936|20|DEBUG] Abstractions: Setting PipeAccess
FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:30:29,800 [1936|17|DEBUG] Abstractions: Setting PipeAccess
FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:30:30,268 [1936|8|DEBUG] LocalMachine: IterateCleanupUsers
Eligible users: **removed**
2012-01-05 11:30:30,268 [1936|8|DEBUG] LocalMachine: IterateCleanupUsers
loggedOnUsers:
2012-01-05 11:30:31,469 [1936|27|DEBUG] RemoteLog[NativeLib]:
[Provider.cpp:244] Provider::UnAdvise() - provider events callback
reference released
2012-01-05 11:30:31,469 [1936|21|DEBUG] RemoteLog[NativeLib]:
[Provider.cpp:116] Provider::SetUsageScenario(1, 0x00000000)
2012-01-05 11:30:31,485 [1936|26|DEBUG] RemoteLog[NativeLib]:
[Provider.cpp:233] Provider::Advise(00000000017F16B0,<PHONE_NUMBER>7F15B0) -
provider events callback reference added
2012-01-05 11:30:31,532 [1936|11|DEBUG] RemoteLog[NativeLib]:
[Provider.cpp:389] SerializedCredsAppearComplete: No serialized creds set
2012-01-05 11:30:31,750 [1936|8|ERROR] pGina.Service.Exception:
CurrentDomain_UnhandledException:
System.Runtime.InteropServices.COMException (0x80070842): The Server
service is not started.

  at System.DirectoryServices.DirectoryEntry.RefreshCache()
  at
System.DirectoryServices.AccountManagement.PrincipalContext.DoMachineInit()
  at
System.DirectoryServices.AccountManagement.PrincipalContext.Initialize()
  at
System.DirectoryServices.AccountManagement.PrincipalContext.get_QueryCtx()
  at
System.DirectoryServices.AccountManagement.PrincipalSearcher.SetDefaultPageSizeForContext()
  at pGina.Plugin.LocalMachine.LocalAccount.GetUserPrincipal(String
username)
  at pGina.Plugin.LocalMachine.PluginImpl.IterateCleanupUsers()
  at pGina.Plugin.LocalMachine.PluginImpl.BackgroundTaskCallback(Object
state)
  at System.Threading.ExecutionContext.Run(ExecutionContext
executionContext, ContextCallback callback, Object state, Boolean
ignoreSyncCtx)
  at System.Threading._TimerCallback.PerformTimerCallback(Object state)
2012-01-05 11:30:35,229 [1936|33|DEBUG] RemoteLog[NativeLib]:
[Credential.cpp:258] Credential::GetSerialization: Processing login for
***removed***
2012-01-05 11:30:35,790 [1936|31|DEBUG]
PluginDriver:df67b67e-8ce5-462f-998b-86d12bd886ff: New PluginDriver created
2012-01-05 11:30:35,806 [1936|31|DEBUG] pGina.Service.Impl: Processing
LoginRequest for: **removed** in session: 1 reason: Login
2012-01-05 11:30:35,806 [1936|31|DEBUG]
PluginDriver:df67b67e-8ce5-462f-998b-86d12bd886ff: Performing login process
2012-01-05 11:30:35,806 [1936|31|DEBUG]
PluginDriver:df67b67e-8ce5-462f-998b-86d12bd886ff: Authenticating user
**removed**, 2 plugins available
2012-01-05 11:30:35,806 [1936|31|DEBUG]
PluginDriver:df67b67e-8ce5-462f-998b-86d12bd886ff: Calling
0f52390b-c781-43ae-bd62-553c77fa4cf7
2012-01-05 11:30:35,868 [1936|31|DEBUG] LdapPlugin:
AuthenticateUser(df67b67e-8ce5-462f-998b-86d12bd886ff)
2012-01-05 11:30:35,868 [1936|31|DEBUG] LdapPlugin: Received username:
**removed**
2012-01-05 11:30:35,900 [1936|31|DEBUG] LdapPlugin: Attempting
authentication for **removed**
2012-01-05 11:30:37,070 [1936|31|DEBUG] LdapServer: Initializing
LdapServer host(s): [***], port: 636, useSSL = True, verifyCert = True
2012-01-05 11:30:37,491 [1936|31|DEBUG] LdapServer: Timeout set to 10
seconds.
2012-01-05 11:30:37,538 [1936|31|DEBUG] LdapAuthenticator: Attempting to
bind with DN **removed**
2012-01-05 11:30:37,569 [1936|31|DEBUG] LdapServer: Attempting bind as
**removed**
2012-01-05 11:33:08,549 [1988|1|INFO ] Startup: Starting up, log4net
configured from: C:\Program Files\pGina\log4net.config
2012-01-05 11:33:10,468 [1988|1|DEBUG] PluginLoader: Initializing

This is the second crash again, quite close to the COMException.
2012-01-05 11:33:12,246 [1988|27|DEBUG] Abstractions: Setting PipeAccess
FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:33:12,246 [1988|23|DEBUG] Abstractions: Setting PipeAccess
FullControl for myself: NT AUTHORITY\SYSTEM
2012-01-05 11:33:12,620 [1988|8|DEBUG] LocalMachine: IterateCleanupUsers
Eligible users: **removed**
2012-01-05 11:33:12,667 [1988|8|DEBUG] LocalMachine: IterateCleanupUsers
loggedOnUsers:
2012-01-05 11:33:13,104 [1988|8|ERROR] pGina.Service.Exception:
CurrentDomain_UnhandledException:
System.Runtime.InteropServices.COMException (0x80070842): The Server
service is not started.

  at System.DirectoryServices.DirectoryEntry.RefreshCache()
  at
System.DirectoryServices.AccountManagement.PrincipalContext.DoMachineInit()
  at
System.DirectoryServices.AccountManagement.PrincipalContext.Initialize()
  at
System.DirectoryServices.AccountManagement.PrincipalContext.get_QueryCtx()
  at
System.DirectoryServices.AccountManagement.PrincipalSearcher.SetDefaultPageSizeForContext()
  at pGina.Plugin.LocalMachine.LocalAccount.GetUserPrincipal(String
username)
  at pGina.Plugin.LocalMachine.PluginImpl.IterateCleanupUsers()
  at pGina.Plugin.LocalMachine.PluginImpl.BackgroundTaskCallback(Object
state)
  at System.Threading.ExecutionContext.Run(ExecutionContext
executionContext, ContextCallback callback, Object state, Boolean
ignoreSyncCtx)
  at System.Threading._TimerCallback.PerformTimerCallback(Object state)
2012-01-05 11:33:14,586 [1988|27|DEBUG] RemoteLog[NativeLib]:
[Provider.cpp:389] SerializedCredsAppearComplete: No serialized creds set
2012-01-05 11:41:33,244 [2004|1|INFO ] Startup: Starting up, log4net
configured from: C:\Program Files\pGina\log4net.config
2012-01-05 11:41:34,851 [2004|1|DEBUG] PluginLoader: Initializing

I'll do some research on the COMException and see what I can come up with.

Reply to this email directly or view it on GitHub:
https://github.com/pgina/pgina/issues/77#issuecomment-3378618

My guess is that the GetUserPrincipal issue is due to the fact that IterateCleanupUsers is running too close to boot time, and it hasn't had time for the needed services to start so that PrincipalSearcher can do its job.  I agree with adding the try {} catch {}, I'd also recommend placing a delay in the start of the IterateCleanupUsers thread.
Regarding the "silent death," it seems to happen at logout, so at least that is a place to start investigating.

I've been able to reproduce this on a test VM only once, and haven't been able to reproduce it again.  The only time that I saw it happen was when I was logging out of the machine and no other users were logged on at the time.  Since then, I have tried many times to reproduce with no luck.  However, it has always been the case that I've had a user logged in (in order to keep the procdump exe running.)  Does anyone know how to get a procdump to run in the background and survive a logoff?
I'm thinking that it must be related to a pInvoke in the IterateCleanupUsers, but I could be wrong.

I mentioned this out-of-band, but for the interwebs at wide, I think you can run procdump in the background by putting it in session 0.  Grab the psexec tool (also from sysinternals.com) then use it to run procdump as a service in session 0:
psexec -s -i 0 procdump.exe [args]

Today we had several machines in our lab present this issue.  We had the administrator account running with procdump at the time, yet no dump files!  This leads me to the following theory:

A user logs on with pGina (set to remove profiles at log off).
The user chooses "Shutdown" or "Restart" instead of "log off"
During the shutdown process, something causes the pGina service to fail.  Perhaps the user cleanup thread is busy at the time the service is killed?
Upon reboot, the service immediately tries to clean up the user and fails with the COMException demonstrated in the logs above, thus causing the service to crash again.  (This has been fixed in <IP_ADDRESS>.)

This theory fits all of our data so far.  I've even been able to reproduce the COMExceptions when testing out this scenario.
The only reason that I included item 3 above is that the system logs show that the service was terminated unexpectedly.  I still haven't been able to reproduce that yet however.  How likely is it that the pGina service could crash during shut down?

This sounds like a good theory.. it's entirely possible that the service is being killed externally - this is something the service manager will do during shutdown if the service does not stop within a short period after being signaled to do so. If we aren't already, we should add some log output to our service start/stop handlers so that the stop event is recorded in the logs at least.

I will be putting <IP_ADDRESS> on our machines this afternoon.
Sent fromoury Samsung Epic™ 4G Touch
-------- Original message --------
Subject: Re: [pgina] pGina Service Status: Disconnected (#77)
From: Nate Yocom<EMAIL_ADDRESS>To: cshelp<EMAIL_ADDRESS>CC:
This sounds like a good theory.. it's entirely possible that the service is being killed externally - this is something the service manager will do during shutdown if the service does not stop within a short period after being signaled to do so. If we aren't already, we should add some log output to our service start/stop handlers so that the stop event is recorded in the logs at least.

Reply to this email directly or view it on GitHub:
https://github.com/pgina/pgina/issues/77#issuecomment-3464899

@nate-yocom Yes, my tests show that <IP_ADDRESS> will catch the COMException and continue.  The exception goes away on the next iteration of the cleanup thread.
I successfully reproduced item 3 in my above scenario on a test VM.  The system logs show the pGina process terminating unexpectedly during a normal shutdown.
I'd say that this issue is fixed!  :)

agreed with fixed.  though we should open a new issue (not milestone
critical) to look at unexpected shutdown.  might be we just take too long
right now.
On Thu, Jan 12, 2012 at 11:48 AM, David Wolff <
<EMAIL_ADDRESS>
wrote:

@nate-yocom Yes, my tests show that <IP_ADDRESS> will catch the COMException
and continue.  The exception goes away on the next iteration of the cleanup
thread.
I successfully reproduced item 3 in my above scenario on a test VM.  The
system logs show the pGina process terminating unexpectedly during a normal
shutdown.
I'd say that this issue is fixed!  :)

Reply to this email directly or view it on GitHub:
https://github.com/pgina/pgina/issues/77#issuecomment-3469285


🐛 [firebase_core] Subscribers not Receiving Notifications

My subscribers aren't receiving notifications although I didn't change my code since Spring 2021. The flutter dependencies I rely on are:
firebase_messaging: ^10.0.4
firebase_core: ^1.4.0

No implementation found for method Messaging#requestPermission on channel plugins.flutter.io/firebase_messaging

Please don't open multiple issues for same reason. Let's follow-up in https://github.com/firebase/flutterfire/issues/9675


Publish to maven central

Hi! Thanks for the excellent library. Just wondering if there are any plans to publish this?

It has been on Maven Central for a few months now: https://mvnrepository.com/artifact/net.jqwik/jqwik-vavr.
This should be clear from https://github.com/jqwik-team/jqwik-vavr/blob/master/README.md. Is it not?

Ah sorry, my mistake! When I searched mvnrepository it didn't appear on the first page of results, and then I found the packages page on github which refers to what I guess are old coordinates (de.befrish.jqwik) which I also couldn't find on maven, I didn't make it to the end of the README unfortunately 😁


Is there a way to use object_store with google cloud storage / gcs local emulators or custom gcs endpoint?

Which part is this question about
object_store, gcs interface
Describe your question
Does object_store support the STORAGE_EMULATOR_HOST environment variable for google cloud (or any other way of setting the google cloud endpoint for emulation support)?
Additional context
I am using object_store within the polars library and would like to use the google cloud storage emulator endpoint so that I can run tests on our code.
I am using fake-gcs-server for testing applications that use gcs and utilizing https://github.com/fsouza/fake-gcs-server. However, I can't find a way to use it with object_store.
I was previously using pythons fsspec (https://filesystem-spec.readthedocs.io/en/latest/) and the gcs client directly which support this. Now that polars is using object_store exclusively as it's cloud access layer this is no longer possible.
Is there any recommended solution for this? Or is this just missing functionality in object_store?
The previous workflow is to run:
docker run -d --name fake-gcs-server -p <IP_ADDRESS>:9090:9090 -v ${PWD}/examples/data:/data fsouza/fake-gcs-server -scheme http -port 9090 -external-url http://<IP_ADDRESS>:9090
and then either set the environment variable STORAGE_EMULATOR_HOST or just configure the python fsspec client to use this emulator url.
Here is the related polars issue where it was suggested I come here: https://github.com/pola-rs/polars/issues/13085#issue-2045150511

The Github CI contains an example of using an emulator, we are running a fork of fake-gcs-server that supports the XML APIs, it is then just a case of overriding the endpoint URL

Thanks, the override of the endpoint URL works well, but the emulator gives me a 404 any time I try to read it.
These are the requests that I do (this is the write from fsspec):
<IP_ADDRESS>.09090: {"name": "test.parquet"}
<IP_ADDRESS>.09090-<IP_ADDRESS>.34408: HTTP/1.1 200 OK
Content-Type: application/json
Location: http://<IP_ADDRESS>:9090/upload/storage/v1/b/bla/o?uploadType=resumable&name=test.parquet&upload_id=386b51ebd4daca9eb150216d11ba7811
Date: Thu, 11 Jan 2024 11:26:43 GMT
Content-Length: 233

<IP_ADDRESS>.09090: PAR1...4...Polars.+...PAR1
HTTP/1.1 200 OK
Content-Type: application/json
Range: bytes=0-476
Date: Thu, 11 Jan 2024 11:26:43 GMT
Content-Length: 470

{"kind":"storage#object","name":"test.parquet","id":"bla/test.parquet","bucket":"bla","size":"477","contentType":"application/octet-stream","crc32c":"RrP1+Q==","acl":[{"bucket":"bla","entity":"projectOwner-test-project","object":"test.parquet","projectTeam":{},"role":"OWNER"}],"md5Hash":"8JNyEbW3APYXEj7Aine/3g==","etag":"\"8JNyEbW3APYXEj7Aine/3g==\"","timeCreated":"2024-01-11T11:26:43.876526Z","updated":"2024-01-11T11:26:43.876531Z","generation":"1704972403876533"}

Reading directly with fsspec works fine as well:
GET /download/storage/v1/b/bla/o/test.parquet?alt=media HTTP/1.1
Host: <IP_ADDRESS>:9090
User-Agent: python-gcsfs/2023.10.0
Accept: */*
Accept-Encoding: gzip, deflate

HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 477
Content-Type: application/octet-stream
Last-Modified: Thu, 11 Jan 2024 11:26:43 GMT
X-Goog-Generation:<PHONE_NUMBER>876533
X-Goog-Stored-Content-Encoding: identity
Date: Thu, 11 Jan 2024 11:31:19 GMT

PAR1...4.>....PAR1

But the "read" using object_store/polars gives me a 404, (it uses the HEAD as we want to do more using object_store/polars, whereas fsspec obviously just downloads it directly), but I don't understand why this is failing either:
<IP_ADDRESS>.09090: HEAD /bla/test%2Eparquet HTTP/1.1
accept: */*
user-agent: object_store/0.8.0
host: <IP_ADDRESS>:9090

<IP_ADDRESS>.09090-<IP_ADDRESS>.54214: HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Thu, 11 Jan 2024 11:26:47 GMT
Content-Length: 10

You need to run a container with the changes in https://github.com/fsouza/fake-gcs-server/pull/1164, for example tustvold/fake-gcs-server. We make use of the XML APIs, as certain functionality is missing from the GCS JSON API (#4207) but fake-gcs-server currently doesn't have support for this.

Yes thank you, I am using the image with the changes:
    image: tustvold/fake-gcs-server
    command: "-scheme http -port 9090 -external-url http://<IP_ADDRESS>:9090"
    ports:
      - <IP_ADDRESS>:9090:9090

The URLs in your requests differ
o/test.parquet
/bla/test%2Eparquet

It could be a red-herring depending on what the logging is actually printing, but is it possible you are constructing the object store path in such a way that it is url-encoding the dot twice?

I tried it with just "test" as well (after reuploading the file as "test" of course), unfortunately with the same result
HEAD /bla/test HTTP/1.1
accept: */*
user-agent: object_store/0.8.0
host: <IP_ADDRESS>:9090

404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Thu, 11 Jan 2024 12:14:39 GMT
Content-Length: 10

Can you run curl -v --head http://localhost:9090/bla/test and curl -v http://localhost:9090/bla/test and post the output here

❯ curl -v --head http://<IP_ADDRESS>:9090/bla/test
*   Trying <IP_ADDRESS>:9090...
* Connected to <IP_ADDRESS> (<IP_ADDRESS>) port 9090 (#0)
> HEAD /bla/test HTTP/1.1
> Host: <IP_ADDRESS>:9090
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
< Content-Type: text/plain; charset=utf-8
Content-Type: text/plain; charset=utf-8
< X-Content-Type-Options: nosniff
X-Content-Type-Options: nosniff
< Date: Thu, 11 Jan 2024 13:07:45 GMT
Date: Thu, 11 Jan 2024 13:07:45 GMT
< Content-Length: 10
Content-Length: 10

<
* Connection #0 to host <IP_ADDRESS> left intact

❯ curl -v http://<IP_ADDRESS>:9090/bla/test
*   Trying <IP_ADDRESS>:9090...
* Connected to <IP_ADDRESS> (<IP_ADDRESS>) port 9090 (#0)
> GET /bla/test HTTP/1.1
> Host: <IP_ADDRESS>:9090
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 404 Not Found
< Content-Type: text/plain; charset=utf-8
< X-Content-Type-Options: nosniff
< Date: Thu, 11 Jan 2024 13:07:54 GMT
< Content-Length: 10
<
Not Found
* Connection #0 to host <IP_ADDRESS> left intact

Within the container I get: INFO[0028] <IP_ADDRESS> - - [11/Jan/2024:13:10:12 +0000] "HEAD /bla/test HTTP/1.1" 404 10

The image I'm using is just the one I got from:
docker pull tustvold/fake-gcs-server && docker run --rm -it -p <IP_ADDRESS>:9090:9090 tustvold/fake-gcs-server -scheme http -port 9090 -external-url http://<IP_ADDRESS>:9090 -backend memory

Based on my experience with fake-gcs-server, the bucket is not created automatically. You will need to mount a subpath into the container.
For example, I test with fake-gcs-server via this docker-compose file:
  fake-gcs-server:
    image: fsouza/fake-gcs-server:${FAKE_GCS_SERVER_VERSION:-1.47.7}
    container_name: fake-gcs-server
    ports:
      - "${MAP_HOST_FAKE_GCS_SERVER:-<IP_ADDRESS>}:4443:4443"
    profiles:
      - all
      - fake-gcs-server
    volumes:
      - fake_gcs_server_data:/data/sample-bucket    <------------ look here!
    command: -scheme http

volumes:
  fake_gcs_server_data:

My only guess is that the bucket doesn't exist, the CI does this via a curl request, but mounting a path may also work.
I don't know why fsspec would work, but possibly it buffers to the local filesystem or something.

Perhaps I'm somehow still not using the right image... Naivly trying, I can't really get any of the XML API endpoints to work.

Could you perhaps provide the logs of the container, another option is the requests are actually going to a different instance of fake-gcs-server

Can you instead stat the server with this command, same as in the CI configuration
docker run -d -p 4443:4443 tustvold/fake-gcs-server -scheme http -backend memory -public-host localhost:4443

And communicate with it over 4443 within your application.
When I run the image using the arguments you provide, they do not appear to be having the intended effect

It's working now!! For anyone else that might be having this problem:
The -public-host argument did the trick, I did not properly see the difference between this and the -external-url argument.
For anyone who is doing this using polars and fsspec: the -external-url is also still needed for some of the other requests that are being sent (uploading files get a 405 response otherwise).
Thank you for the patience and time in particular on this issue but also for your work on arrow-rs in general!


Squirrel.framework 0.3.1 contains ShipIt binary 0.3.0

How to reproduce:

download and extract latest Squirrel.framework 0.3.1 from https://github.com/Squirrel/Squirrel.Mac/releases/tag/0.3.1
run in terminal:
./Squirrel.framework/Resources/ShipIt

Expected output:
(according to https://github.com/Squirrel/Squirrel.Mac/blob/5396dcd1f94bfa66eebd091d331427654918ed4d/Squirrel/ShipIt-main.m#L149 or https://github.com/Squirrel/Squirrel.Mac/archive/0.3.1.zip)
"Missing launchd >>>job label or state path<<< for ShipIt"
Actual output:
2017-08-18 09:58:56.277 ShipIt[86751:6657135] Missing launchd >>>job label<<< for ShipIt

Which means Squirrel.framework 0.3.1 contains ShipIt binary 0.3.0, or even older . Or there is some other mismatch in build/pack/release process. Same for latest Electron 1.7.6 and its copy of Squirrel.framework.
Not sure, whether there is some compatibility issue caused by older ShipIt or not. On first glance it should still work, just #207 fix is not applied.
I found this while trying 0.3.1 and its #207 fix in our Electron app.

@joshaber

Wow, I'm not sure how that happened. Great catch @jiri-nohavec!

0.3.2 created and an PR to update Electron opened.
Thanks again @jiri-nohavec!


[BUG] show_tags lists template files

Please confirm

[x] I am running the latest version of this plugin

Describe the bug
Not actually sure if this is a "bug" or intended, but show_tags lists tags in template files.
For instance, I have a template at templates/new_note.md that includes the following line to make it easier to add tags to new notes.
<!-- tags: #untagged -->

:Telekasten show_tags lists this file and #untagged.
To Reproduce
Steps to reproduce the behavior:

Create a template with a tag inside of it (eg templates/new_note.md)
Start nvim
Run :Telekasten show_tags
Observe the tag being included in the list

Expected behavior
I personally expected that the template document and its tags would not be listed here.
Screenshots

Operating system (please complete the following information):

OS: mac, linux

Side-note: it's possible to do this with .ripgreprc, so if this is intended behavior, you can close this up. It would, however, prevent any directory with the word "templates" in it from being searched - rather than just the telekasten-configured templates directory.
.ripgreprc
--glob=!**/templates/*.md

I agree with you, we should exclude templates from the tag list.
I tried playing around a bit with --glob. I can't seem to make it work using a full path. Ideally we would retrieve the path set by the user for the template directory and pass it to rg --glob, but I am not sure if that works with a full path.

 My guess is that the plugin would need to figure out if config.templates is relative to config.home and chop it to use in the glob. I'll poke around when I have some time tonight.

I think this is the fix yes.
There are basically two cases:

Template dir is outside of ZK home. In that case, templates are never included in the rg search as we explicitly ask ripgrep to look for tags inside the ZK home directory.
Template dir is a subdir of ZK home. Then we can indeed take the relative path between the template dir and the home and use that as the glob. Fairly simple to do with Pleanry's Path functions. I will work on fixing that whenever I find 10 minutes to spare.

@lambtho12 thank you! very much appreciated :-)


Fix how the walker starting positions are picked randomly over a boundary.

Describe the bug
I have no idea why I did it the original way but I made it so that the parameter space bounds were multiplied by 100 and then I choose random integer values (why do I want to make everything an integer!?) within the new scaled bounds. This is obviously not right and so I propose a fix that should provide random walker starting positions in a sensible way,
The new way is done  as L+(U_L)*R, where L and R are the lower and upper bounds for the parameter space and R is a random value between 0 and 1.
To Reproduce
import sunpy
sunpy.map.Map(...)
etc
Screenshots
No response
System Details
No response
Installation method
No response

Fix applied in PR#89 so closing.