[CNI] CNI binary for 1.19.6 crashes if sh is not on the host

Is this the right place to submit this?

[X] This is not a security vulnerability or a crashing bug
[X] This is not a question about how to use Istio

Bug Description
We're running into an issue when we try to use Istio 1.19.6 on our EKS clusters. 1.19.5 works. We think it's because of this patch https://github.com/istio/istio/pull/48422. We're running on bottlerocket, which doesn't include a shell - that change means that exec.Command("sh" ...) is called on both code paths, while previously it was only run for older versions of iptables. This blocks us from upgrading to 1.19.6 (and presumably 1.20.2 which includes that logic).
The error we get (kubelet logs):
Warning   FailedCreatePodSandBox   Pod/httpbin-1-94bf7fddd-5m4zh     Failed to create pod sandbox: rpc error: code = Unknown
desc = failed to setup network for sandbox "809561b2f41924b90f7299a5b26c67189fa6c4527dcc7ab0cb7f59c5266a933b": plugin
type="istio-cni" name="istio-cni" failed (add): exec: "sh": executable file not found in $PATH

Not sure on the best fix if this is the issue. One (slightly hacky) option would be for the CNI binary to call itself to set up the mini-container environment, since that way we know the binary exists and can run.
Version
$ istioctl version --context sandbox20 (sandbox 20 is a testing cluster)
client version: 1.17.2
control plane version: 1.19.6
data plane version: 1.18.5 (6 proxies), 1.19.6 (2 proxies)

-> the mix of proxies is because 2 1.19.6 proxies were able to run since they run in excluded namespaces and don't reach the issue in the CNI logic.

Additional Information
No response

@Smeb any chance you can try out https://github.com/istio/istio/pull/48757?
TAG=test-sh HUB=localhost:5000
CGO_ENABLED=0 BUILD_WITH_CONTAINER=0 BUILD_ALL=false DOCKER_TARGETS=docker.install-cni make dockerx.pushx
kubectl -n istio-system set image daemonset/istio-cni-node install-cni=${HUB}/install-cni:${TAG}

can do it (replace hub, probably)

Awesome turnaround! Can do tomorrow (GMT). Will get back to you when I've had a chance to try it.

Runs into a permission issue when changing just the image and nothing else:
Warning  FailedCreatePodSandBox  4m45s    kubelet  Failed to create pod sandbox: rpc error: code = Unknown
desc = failed to setup network for sandbox "250d4f5b075fbbbe9c8f29c67abd1073417782508dd0bded96c97aea6d787619":
plugin type="istio-cni" name="istio-cni" failed (add): fork/exec /opt/cni/bin/istio-cni: permission denied

Here are some logs from running on the node (just to show the binary is there, running the patched version, and executable):
bash-5.1# /opt/cni/bin/istio-cni
CNI plugin istio-cni 1.21-dev
CNI protocol versions supported: 0.1.0, 0.2.0, 0.3.0, 0.3.1, 0.4.0, 1.0.0
bash-5.1# /opt/cni/bin/istio-cni unshare
usage: unshare --lock-file=file -- <command> [args...]
bash-5.1# /opt/cni/bin/istio-cni unshare ls
bin  boot  dev  etc  home  lib  lib64  local  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var  x86_64-bottlerocket-linux-gnu

Something else I saw is that in the case where we get an error, the logging doesn't work. If I use the patch but just force it to work for our environment (by not doing the mount), then the logging works. I think this might be the fix.

For reference, this also occurs on 1.20.2. We're running on BottleRocket nodes. Thanks for reporting this so quickly.

Which looking in the kubelet logs is a result of

So this is SELinux blocking any mount calls, right? Do you have custom SELinux rules or is this default on bottlerocket?

We don't have any custom SELinux rules set, so it's the default (we're using aws-k8s-1.28/x86_64/latest). The policies are here. I do see some CNI related rules here and one exception where they allow writes to /etc/resolve.conf here - so maybe a change would be possible. I guess that might look something like (cni_exec_t etc_t (files (mount))) (though there is also a rule that prevents writing dynamic files explicitly).
I can try to take a look at the configuration today. One other option might be using chroot for the sandbox, because I think it should be possible to mount the files iptables needs in another context.

Small follow up - we also escalated this with AWS who are investigating. Might be they have a solution for the AWS Bottlerocket case that works for everyone.
I'm a little concerned that we don't have a solution (yet). Is this a behaviour we could gate behind a flag? Obviously the ideal would be to find something that we know works for all environments, but I'm a little concerned that might be tricky given the diversity of environments out there.

Regarding this error:
AVC avc:  denied  { mounton } for  pid=2545767 comm="istio-cni" path="/" dev="dm-0" ino=2 scontext=system_u:system_r:container_t:s0 tcontext=system_u:object_r:os_t:s0 tclass=dir permissive=0

This is saying that istio-cni is not allowed to mount something directly on the host's /. (dm-0 refers to the dm-verity root filesystem which has the os_t label in most places.) I don't think that's actually what you're trying to accomplish so this particular denial may not be worth exploring.
However, if you did try to mount over /etc/nsswitch.conf, I expect you'd see a failure like this:
# made up example
AVC avc:  denied  { mounton } for  pid=??? comm="istio-cni" path="nsswitch.conf" dev="tmpfs" ino=??? scontext=system_u:system_r:container_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0

From a security policy standpoint, it doesn't make sense to allow a process from an unprivileged container (the container_t bit in this output indicates unprivileged) to overmount a sensitive host file like /etc/nsswitch.conf. Bottlerocket could transition to a more privileged label when executing CNI plugins but that creates a different set of security concerns.
If the mount attempt were treated as optional, that would work for Bottlerocket, which has a very generic /etc/nsswitch.conf that won't trigger network calls for UID lookups. Otherwise, ideally you'd be able to point glibc to a specific NSS config via environment variable or something, but I'm not aware of a way to do that except via LD_PRELOAD which carries its own set of drawbacks.

From a security policy standpoint, it doesn't make sense to allow a process from an unprivileged container

Ignoring selinux, is this true given we are unsharing the mount namespace? With this, the mount shouldn't impact other processes?
Even if thats true, selinux still may not take that into consideration, though.

Otherwise, ideally you'd be able to point glibc to a specific NSS config via environment variable or something, but I'm not aware of a way to do that except via LD_PRELOAD which carries its own set of drawbacks.

This is my top preference but I couldn't find a great solution (LD_PRELOAD didn't seem great).

Here is my current options in preference order:

Come up with a way to make the mount work universally. It seems plausible this isn't going to happen
Come up with a way to detect if we need the mount, and only use it if so. This seems fairly straightforward, "just" parse nsswitch.conf and see if its doing anything weird?
Explicit user configuration to control whether we need to mess with nsswitch.conf as well. This is my least favorite option because it will mean bottlerocket (or similar) users are broken and will need to follow some document to configure things manually, which is a pain.

I'll explore these a bit, but input from others welcome as well. I am trying to setup a bottlerocket env so I can reliably test each of these as well (if someone knows a way to run bottlerocket in docker like kind -- let me know!).
In the meantime, I would recommend users on bottlerocket do not upgrade to 1.19.6/1.20.2. While I cannot make promises, I am confident we will implement at least option 3 by the next patch release (so you shouldn't need to worry about being stuck on an old version and some security patch comes out that is incompatible, for instance).

I got a bottlerocket setup and can reproduce

However, if you did try to mount over /etc/nsswitch.conf, I expect you'd see a failure like this:

type=1400 audit(1705537456.860:6): avc:  denied  { mounton } for  pid=30072 comm="istio-cni" path="/etc/nsswitch.conf" dev="tmpfs" ino=117 scontext=system_u:system_r:container_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0 is the real log we end up seeing.

Parsing nsswitch.conf seems like the type of thing that might be error prone, so we could change "Come up with a way to detect if we need the mount, and only use it if so" to "Try to overwrite it, but do not exit on error". The downside is we will get these audit messages though

One big question I had was why can we not unshare(CLONE_NEWNS); mount ... -- this is what containers do, and obviously containers run on bottlerocket.
I believe here we restrict CNI plugins: https://github.com/bottlerocket-os/bottlerocket/blob/7452c37e0b1abf19797a23bb7ab4d70bb0aef1cf/packages/selinux-policy/rules.cil#L90-L93 while the container runtime runs as another group (runtime_t) which has more access (maybe a bit off, first time dealing with SELinux rules...). So the CNI plugins essentially have less privilege than the container runtime?

One big question I had was why can we not unshare(CLONE_NEWNS); mount ... -- this is what containers do, and obviously containers run on bottlerocket. ... So the CNI plugins essentially have less privilege than the container runtime?

Yes, the container runtime is relatively privileged - it needs to be able to change the label of processes it launches, which is a bit like sudo for mandatory access control mechanisms.
The answer to your first question is that SELinux is not namespace-aware, so it doesn't have a way to take the namespace into account when answering the question "does subject  have permission to perform action  on target ?" For this case, we might want to say "yes, as long as that action doesn't happen in the initial mount namespace" but there's no way to express that constraint.

"just" parse nsswitch.conf and see if its doing anything weird?

Go does this for "hosts" to determine which DNS resolver it should use; if it finds a mechanism it doesn't understand, it switches to the cgo resolver so that the system library is used instead.
In practice I expect you'll find that most Linux distros include an entry more complex than Bottlerocket's passwd: files. On my Fedora development machine, it's passwd: files sss systemd where sss could trigger network-based lookups and systemd wouldn't. There's no way to tell just from the name, so you'd need to maintain a list of known problematic cases that should trigger the overmount.

"Try to overwrite it, but do not exit on error". The downside is we will get these audit messages though

I wouldn't worry about the audit message very much if it's just one AVC denial when the pod starts up. That is pretty common in my experience, and relatively harmless if the software has a fallback path.

New iteration pushed up to https://github.com/istio/istio/pull/48757. This seems to work on GKE and Bottlerocket (where I have tested so far). Basically if we cannot setup the mounts we just continue anyways

Thanks for all the follow up work. I just ran the latest version in our environment and can confirm it works. We get a lot of audit messages (as expected), but otherwise everything looks good.

One warning to folks - between the regression in 1.18 and the fix, 1.18 is now EOL https://istio.io/latest/news/support/announcing-1.18-eol-final/. As such, this fix (and any other bugs or CVEs in Istio) will only be applied to 1.19+. 1.19 and 1.20 will be fixed in the next patch release (couple of weeks)

Hi, can you link in which patch release versions does this fix exist?
I did try with istio v1.20.4 and still have the same issue

@howardjohn

One warning to folks - between the regression in 1.18 and the fix, 1.18 is now EOL https://istio.io/latest/news/support/announcing-1.18-eol-final/. As such, this fix (and any other bugs or CVEs in Istio) will only be applied to 1.19+. 1.19 and 1.20 will be fixed in the next patch release (couple of weeks)

Hi, can you link in which patch release versions does this fix exist? I did try with istio v1.20.4 and with 1.21.0 and still have the same issue
2024-04-04T13:13:49.120967Z	warn	cni	failed to setup execution environment, attempting to continue anyways: failed to remount /: permission denied
2024-04-04T13:13:49.120970Z	info	cni	Running ip6tables-restore with the following input:
2024-04-04T13:13:49.120973Z	info	cni	Running command (without lock by env and nss): ip6tables-restore --noflush
2024-04-04T13:13:49.120976Z	warn	cni	failed to setup execution environment, attempting to continue anyways: failed to remount /: permission denied
2024-04-04T13:13:49.120978Z	info	cni	Running command (without nss): iptables-save
2024-04-04T13:13:49.120981Z	warn	cni	failed to setup execution environment, attempting to continue anyways: failed to remount /: permission denied
2024-04-04T13:13:49.120985Z	info	cni	Command output:
# Generated by iptables-save v1.8.9 on Thu Apr  4 13:13:49 2024
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:ISTIO_INBOUND - [0:0]
:ISTIO_IN_REDIRECT - [0:0]
:ISTIO_OUTPUT - [0:0]
:ISTIO_REDIRECT - [0:0]
-A PREROUTING -p tcp -j ISTIO_INBOUND
-A OUTPUT -p tcp -j ISTIO_OUTPUT
-A ISTIO_INBOUND -p tcp -m tcp --dport 15008 -j RETURN
-A ISTIO_INBOUND -p tcp -m tcp --dport 15020 -j RETURN
-A ISTIO_INBOUND -p tcp -m tcp --dport 15021 -j RETURN
-A ISTIO_INBOUND -p tcp -m tcp --dport 15090 -j RETURN
-A ISTIO_INBOUND -p tcp -j ISTIO_IN_REDIRECT
-A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006

@howardjohn Is there a release with the fix? I see there are quite a few releases in the last weeks.

https://github.com/istio/istio/pull/48757
fixed in 1.21.3


Use Alamofire to upload image to FTP Server?

Hi,
I was wondering how to send a image in swift 3 to a local ftp server.Here is the server I'm using:https://github.com/benelog/one-ftpserver

Hi @J4awesome,
I'd recommend opening a question on Stack Overflow for questions like this. We use our GitHub project for bug reports and feature requests.
Best of luck! 🍻

From our Contribution Guidelines
Asking Questions
We don't use GitHub as a support forum. For any usage questions that are not specific to the project itself, please ask on Stack Overflow instead. By doing so, you'll be more likely to quickly solve your problem, and you'll allow anyone else with the same question to find the answer. This also allows maintainers to focus on improving the project for others.


Add histogram

add a histogram to the bottom of each stage, sitting under the existing circles
this will display the number of leads per day prior to the current date.
date range to be arguments (not necessarily max/min of provided values)
each item in the histogram will be a stacked bar, colour coded to match the sources. For example - http://bl.ocks.org/sbrudz/8ac4f4102f787d0fcea5

Looks good! This will normally be used with date ranges of between 1 and 12 months, ie 30 to 365 days. Does the layout work with that?

But looks as though you havent actually pushed yet. There's not commits other then mine

I've added more data points to the json, and you can see they run into each other

What we need is sensible display of dates, like what nvd3 does:
http://nvd3.org/examples/linePlusBar.html

Also, can you please limit the histogram height to no more then 25% of the height of the stage

I have fixed these two issues. Now the date display will automatically arranged by the width of the chart.

Looks great :)
Reduced the font size for dates and added data points.


net: sockets: Fix sendmsg() user mode param checks

If we are calling sendmsg() for a connected socket, then msg_namelen
is 0 and msg_name is NULL. Check these allowed values properly.
Also modify unit tests so that we test this scenario.
Fixes #25925
Signed-off-by: Jukka Rissanen<EMAIL_ADDRESS>

What about msg_control  filed ? is it also optional ?
If not optional then tests/net/socket/socketpair/ should be updated to set this field, otherwise test will still be failed.
If optional the same behaviour than msg_name  should be applied to msg_control .

What about msg_control  filed ? is it also optional ?

Yes, it is optional, just forgot to add the checks.


if I don't want animate header how to do that

I want to stop header animate or change animation how can I do. Thanks

In the iziModal.css file.
Line 392 to 412.


Update touch-interactions.md

Remove triplicate entries and fix some content

@nukeulis,
Thanks for your contribution.
To ensure that the project team has proper rights to use your work, please complete the Contribution License Agreement at https://cla.microsoft.com.
It will cover your contributions to all Microsoft-managed open source projects.
Thanks,
Microsoft Pull Request Bot

Thanks for your contribution! The changes you’ve made look good. To allow us to merge them with our documentation, we just need you to complete the Contribution License Agreement (CLA) at the link provided in the comment above (from msftclas, the Microsoft Pull Request Bot).

@nukeulis
Checking in once more to ask that you complete the Contribution License Agreement (CLA) so we can go ahead and merge the changes you proposed. Thanks!

I think I did this already... can you send me a link?

From: Mike Matteson<EMAIL_ADDRESS>Sent: Wednesday, April 19, 2017 4:35 PM
To: MicrosoftDocs/windows-uwp
Cc: nukeulis; Mention
Subject: Re: [MicrosoftDocs/windows-uwp] Update touch-interactions.md (#22)
@nukeulishttps://github.com/nukeulis
Checking in once more to ask that you complete the Contribution License Agreement (CLA) so we can go ahead and merge the changes you proposed. Thanks!
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/MicrosoftDocs/windows-uwp/pull/22#issuecomment-295429317, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AFfVdemmBtvHzGvyufblw3VoBw0SoKUCks5rxm_1gaJpZM4MfUS6.

@nukeulis,
Thanks for having already signed the Contribution License Agreement. Your agreement was validated by Microsoft. We will now review your pull request.
Thanks,
Microsoft Pull Request Bot

@nukeulis
You did indeed sign it already; apologies for all the back-and-forth on this. I had to close and reopen the PR to get it to show the updated status--obviously a glitch somewhere on our side. We really appreciate both your contribution and your patience, and we'll get your changes on their way today.

@Karl-Bridge-Microsoft: All set! Please review and merge.

Thanks Mike,
No worries.

From: Mike Matteson<EMAIL_ADDRESS>Sent: Thursday, April 20, 2017 11:47 AM
To: MicrosoftDocs/windows-uwp
Cc: nukeulis; Mention
Subject: Re: [MicrosoftDocs/windows-uwp] Update touch-interactions.md (#22)
@nukeulishttps://github.com/nukeulis
You did indeed sign it already; apologies for all the back-and-forth on this. I had to close and reopen the PR to get it to show the updated status--obviously a glitch somewhere on our side. We really appreciate both your contribution and your patience, and we'll get your changes on their way today.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/MicrosoftDocs/windows-uwp/pull/22#issuecomment-295787029, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AFfVdZaDmvGCiBtSsRGoeda05z7eej7Vks5rx338gaJpZM4MfUS6.


Can ArgEnum be both more general and performant?

 Issue by epage
Friday Oct 01, 2021 at 13:46 GMT
Originally opened as https://github.com/clap-rs/clap/issues/2799

#2762 initially had common API calls for ArgValue allocating a Vec.  We instead dropped that at the cost of adding the Clone super trait.
Can we do better?

 Comment by ModProg
Friday Oct 01, 2021 at 14:32 GMT

One possible soluion would be returning an array using const generics and using the 2021 edition into_iter to be able to return the actual value of the array without a need to clone.
At least in theorie.

 Comment by ModProg
Friday Oct 01, 2021 at 14:31 GMT

not ArgValue but ArgEnum.

 Comment by epage
Friday Oct 01, 2021 at 15:24 GMT

@pksunkara posted the following snippet as one idea
trait ArgEnum<const COUNT: usize>: Sized {
    fn variants() -> [Self; COUNT];
}

enum E {
    One,
    Two,
}

impl ArgEnum<2> for E {
    fn variants() -> [Self; 2] {
        [Self::One, Self::Two]
    }
}

fn main() {}

https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=8ccbfd753fb15dab675ba0491c7f48a3

 Comment by epage
Friday Oct 01, 2021 at 15:29 GMT

@ModProg are you referring to using trait ArgEnum<const COUNT:usize>?
I see this is a trade off of making the trait harder to use vs requiring Clone.
Personally, I feel the Clone requirement is fairly minimal.  Probably 99% of ArgEnums will be able to be Copy.  On some occasions, someone will have a hidden variant.  Among those using a hidden variant, what is the likelihood the type won't be Clone?  My guess is fairly small.    This is a niche of a niche that doesn't seem worth supporting.  Releasing as-is, we can see what feedback we end up getting and re-examine this for clap4.
I recommend we close this, creating a new issue based on specific user feedback if it comes in.

 Comment by ModProg
Friday Oct 01, 2021 at 15:52 GMT

@ModProg are you referring to using trait ArgEnum<const COUNT:usize>?

yes.

I see this is a trade off of making the trait harder to use vs requiring Clone.

The only thing about this that makes me consider it is, that most people will only derive but never implement it, so this only affects a small number of people. And while the Clone is only a minor inconvenience it affects a lot more, who probably don't even use most of the features provided by my new implementation.
But I also see another implementation that just moves the to_string implementation back to the derive macro, that way we don't need either the Clone nor const generics.

 Comment by ModProg
Friday Oct 01, 2021 at 16:22 GMT

This was the way it was done before, it was changed here:
https://github.com/clap-rs/clap/pull/2762/commits/480035ac9c36490c4cccbf09e71b0ae84a6d527b#diff-1ea1dfdc52ed49bd532e4bd309c902a621e3bf02709b1fea86466c47fc7df7d9L118-L122

 Comment by pksunkara
Friday Oct 01, 2021 at 16:06 GMT

I agree with @ModProg regarding the estimates of how many use what kind of implementation.

But I also see another implementation that just moves the to_string implementation back to the derive macro, that way we don't need either the Clone nor const generics.

Do we have a clear example on how to achieve this?

 Comment by epage
Friday Oct 01, 2021 at 16:23 GMT

To clarify, I'm not concerned about the implementer. With that said, I have a PR out for one hand-written ArgEnum and expect to create another,.  I also see more being written by crates that provide re-usable clap logic.  Updating a length as code changes feels like busy work and is a breaking change for those crates.  One the other hand, the cost of adding a #[derive(Clone)] is small, especially since people will most likely use it anyways.
However, creating a trait that can only be used in very specific ways because of the way the generic parameter is defined, severely limits our ability to evolve clap.

 Comment by ModProg
Friday Oct 01, 2021 at 16:31 GMT

@ModProg, I thought the inherent from_str was a side benefit to us having to already make this change so that arg_values wouldn't return a Vec.

It is, but it more enables the inherent from_str than requiring it.
The problem with the "generated" form is that we have to create the ArgValue for each call. tho I don't know if there is some optimazation happening because it technicly is a constant value even tho due to alias being a Vec we cannot declare it as const.
Another though is, we could also create the actual ArgValue during deriving, call get_name_and_aliases on it and put that value in the derived implementation. So it really is a constant array/slice for every variant.

 Comment by epage
Friday Oct 01, 2021 at 16:26 GMT

@ModProg, I thought the inherent from_str was a side benefit to us having to already make this change so that arg_values wouldn't return a Vec.

 Comment by ModProg
Friday Oct 01, 2021 at 16:33 GMT

The advantage to using the matches on ArgValue is, that it makes sure we use the same implementation in both the derived and build.

 Comment by kbknapp
Tuesday Oct 05, 2021 at 01:01 GMT

I've only skimmed this issue, but in general I don't believe adding a const generic type argument to ArgEnum is worth the performance gain by not allocating a small Vec. My reasoning is clap still allocates, so it's not like we're removing all allocations. Additionally, Enum::values() would most likely only be called when either generating the help message, or other "generating" operation such as completion script, etc. I.e. it should not be allocating in the happy path of standard parsing. And even if it does we're still only talking a small Vec since allocation.
The cost however is a generic argument that's not entirely clear at first glance what it's for: Enum<3> doesn't mean a whole ton when the enum's variants are Foo, Bar, and Baz and it turns out that generic argument just so we can return an array size hint.
I would like to see improvement around ArgEnum for sure, but I think this is one of those issues that we can place on the back burner and garner some good ideas as v3 fleshes.

 Comment by epage
Tuesday Oct 05, 2021 at 14:06 GMT

For comparison purposes
Original
pub trait ArgEnum: Sized {
    const VARIANTS: &'static [&'static str];
    fn from_str(input: &str, case_insensitive: bool) -> Result<Self, String>;
    fn as_arg(&self) -> Option<&'static str>;
}

Wanted to add ArgValue support for native alias, hidden support, etc

Current Solution
pub trait ArgEnum: Sized + Clone {
    fn value_variants<'a>() -> &'a [Self];
    fn from_str(input: &str, case_insensitive: bool) -> Result<Self, String>;
    fn to_arg_value<'a>(&self) -> Option<ArgValue<'a>>;
}

Forces Clone

Most arg enums would work as Copy
A few use hidden, and of those, they mostly likely support Clone, making the impact very small

Vec Solution
pub trait ArgEnum: Sized {
    fn variants() -> Vec<ArgValue<'static>>;
    fn from_str(input: &str, case_insensitive: bool) -> Result<Self, String>;
    fn as_arg(&self) -> Option<ArgValue<'static>>;
}

Arg::new("foo").possible_values(arg_enum.variants()) does a throw-away allocation when building
An inherent implementation for from_str would cause an allocation for parsing as well, since it'd call variants

const Solution
trait ArgEnum<const COUNT: usize>: Sized {
    fn variants() -> [Self; COUNT];
    fn from_str(input: &str, case_insensitive: bool) -> Result<Self, String>;
    fn as_arg(&self) -> Option<ArgValue<'static>>;
}

 Comment by pksunkara
Saturday Oct 09, 2021 at 01:48 GMT

I am happy with where it is for 3.0, but we can keep this open for future. Removing the milestone.


redirect()->to() is changing value of the base64 parameter

I made a small test and found out that sth bad happen in resolveRelativeURI() method of URI class.
Before return in that method I put:
d($uri, $relative->getQuery(), $transformed->getQuery());
and in some conditions it doesnt work as expected:
$uri string (43) "/login?url=L3BhY2thZ2UvOC1kYXlzLXBhY2thZ2U="   (correct redirection path and fragmenr)
$relative->getQuery() string (38) "url=L3BhY2thZ2UvOC1kYXlzLXBhY2thZ2U%3D"  (from (new URI()->setURI($uri))
$transformed->getQuery() string (40) "url=L3BhY2thZ2UvOC1kYXlzLXBhY2thZ2U%253D" (after: $transformed->setQuery($relative->getQuery()))

If first conversion is ok cuz = is not safe char for uris that second one ($transformated) is at least strange.

Basically, you're forcing it double-encode it, which the system has no way of knowing is going on. That's up to the developer. If you're expecting a base64-encoded query var, you must take care to decode it when you need it, and before you put it into another situation where it will be encoded again.

Please not it happen in URI class resolveRelativeURI().
I.e. my uri (path+query) string is:
'/login?url=L3BhY2thZ2UvOC1kYXlzLXBhY2thZ2U%3D'
and when i pass this uri to   redirect()->to('/login?url=L3BhY2thZ2UvOC1kYXlzLXBhY2thZ2U%3D')
it changes two times and this redirecting me to: /loginurl=L3BhY2thZ2UvOC1kYXlzLXBhY2thZ2U%25253D which is not what I expected.


Earn: Link to local orderbook

Raised by @Richie-BTC-Rich in #14:

On the earn tab a link to the [orderbook] would be a helpful resource to determine fees before starting the service.

Local orderbook instance should be accessible via http://localhost:62601/

Hmm.. imho, we should try to implement https://github.com/joinmarket-webui/joinmarket-webui/issues/14 instead (or in addition).
It is basically done and at least the styling can be controlled and subsequently beautified. What do you think?

Nice! That's even better! 💖

See https://github.com/joinmarket-webui/jam/issues/14.


fix: textbox clear button flickering on first load

GitHub Issue: #
PR Type
What kind of change does this PR introduce?

[x] Bugfix
Feature
Code style update (formatting)
Refactoring (no functional changes, no api changes)
Build or CI related changes
Documentation content changes
Other... Please describe:

Description
In this pr, I removed this

Because the fact that the KeyFrame 0 starts with Opacity="1" makes the clear button appear when first loading a page with a textbox then disapears when it's opacity is set to 0 200 milliseconds after. By removing it we keep the desired behaviour of disapearing after 200 milliseconds when the focus is lost but without the flickering when first loading the page. I remove the lines from MaterialOutlinedTextBoxStyle and MaterialFilledTextBoxStyle since both had the same animation.

PR Checklist
Please check if your PR fulfills the following requirements:

Commits must be following the Conventional Commits specification
[x] Tested UWP
[ ] Tested iOS
[x] Tested Android
[ ] Tested WASM
[ ] Tested MacOS
[x] Contains No breaking changes

If the pull request contains breaking changes, commit message must contain a detailed description of the action to take for the consumer of this library. As explained by the Conventional Commits specification

before (delay exagerated to visualize the bug better) :

after:

Other information

Internal Issue (If applicable):

@jeromelaban @kazo0 There seems to be a problem with the CI

@kazo0 I was wondering what is gonna happen since it merged does the change apply instantly or will it be part of a new uno version or perhaps a pre release ?

@Lee31416 it should be available as of the 2.7.0-dev.5 nuget package. Do you need it backported to the 2.6.x stable packages?

yes

@Mergifyio backport release/stable/2.6

@Lee31416 it should be available as a 2.6.1 package whenever the generated NuGet Package is pushed to production, hopefully tomorrow


[themes] Dark+ theme can possibly have different colors for properties and variables

Reported by @emzero in Microsoft/TypeScript-TmLanguage#282
VS Code
Version 1.5.3
Commit 5be4091987a98e3870d89d630eb87be6d9bafd27
Date 2016-09-22T08:50:42.185Z
Shell 0.37.6
Renderer 49.0.2623.75
Node 5.10.0
Latest TypeScript and Javascript Grammar 0.0.2
Windows 7 SP1 x64
Is it possible to have different colors for local variables and object properties?
Using the Latest TypeScript and Javascript Grammar it seems that some themes are able to do this but not the default ones. Not sure if it's something related to the themes or to the TmLanguage.
Default Dark+

Monokai Dimmed

and methods, and functions too!!!

The current 'philosophy' of the Default Dark+ theme is to only highlight variable declarations, not references.

@aeschli Do you think the variable declarations be scoped differently than the references? Also what about function/method declarations and references. Having looked at few javascript grammars, none scope these differently.

@aeschli Ok, but in the screenshot I posted there is a variable person that's not being properly colored as it's the same color as its properties.

@sheetalkamat It would be great if we could add an additional scope to it so we can differentiate between declarations and references.

We currently only have a singe color for variables. The colors originally come from the default VS themes.

We have no plans to add this. Custom themes can add such coloring or users can add it in the settings:
"editor.tokenColorCustomizations": {
        "textMateRules": [
            {
                "scope": "meta.object-literal.key",
                "settings": {
                    "foreground": "#FF0000"
                }
            }
        ]
    }


[Silabs][Hotfix]Remove spi_multiplex include for 917 soc

the spi_mutiplex.h include doesn't exist for the 917 wifi soc platform. It is only used for ef32 + wifi ncp combos.
Fix the #idef condition

closing, duplicated work :)


tests: Add test_git_stash_workspace_reinstate_index

Forgot to include the test in #182

Codecov Report
Base: 80.74% // Head: 80.01% // Decreases project coverage by -0.74% :warning:

Coverage data is based on head (e53de78) compared to base (0309191).
Patch coverage: 100.00% of modified lines in pull request are covered.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #184      +/-   ##
==========================================
- Coverage   80.74%   80.01%   -0.74%
==========================================
  Files          25       25
  Lines        3470     3483      +13
  Branches      602      603       +1
==========================================
- Hits         2802     2787      -15
- Misses        578      597      +19
- Partials       90       99       +9

Impacted Files
Coverage Δ

tests/test_stash.py
100.00% <100.00%> (ø)

tests/conftest.py
69.00% <0.00%> (-4.00%)
:arrow_down:

src/scmrepo/utils.py
83.87% <0.00%> (-3.23%)
:arrow_down:

tests/test_git.py
95.67% <0.00%> (-1.40%)
:arrow_down:

src/scmrepo/git/backend/gitpython.py
63.17% <0.00%> (-1.35%)
:arrow_down:

src/scmrepo/git/backend/pygit2.py
76.73% <0.00%> (-1.31%)
:arrow_down:

src/scmrepo/git/backend/dulwich/__init__.py
79.67% <0.00%> (-0.71%)
:arrow_down:

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

:umbrella: View full report at Codecov.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.


Add Resource-based policy to allow Pinpoint invoke lambda function

Amplify CLI Version
10.5.2
Question
Hey Guys,
I try to connect a Pinpoint Journey with my Lambda function to invoke lambda based on a analytics event.
So this is working when I use the Console to add a Resource-based policy:
{
      "Sid": "custom-test",
      "Effect": "Allow",
      "Principal": {
        "Service": "pinpoint.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:eu-central-1:XXX:function:pinpointEventsHandler-develop",
      "Condition": {
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:mobiletargeting:eu-central-1:XXX:apps/*"
        }
      }
    }

I can't find this part in the template at the console from cloudformation.
With the Amplify CLI I can add this how?
With the custom policy flow it is not working:
{
    "Action": ["lambda:InvokeFunction"],
    "Resource": ["arn:aws:mobiletargeting:eu-central-1:XXX:apps/*"]
  }

Any Idea?
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html

Update: (I thought it was working, but at the moment I get this error when I add the permissions in console too)
Activity validation failed, jvbixqMWXk: Amazon Pinpoint couldn’t invoke the Lambda function that you specified for custom delivery. Verify that a function policy is assigned to the function and that Amazon Pinpoint is authorized to invoke the function.

Hey @biller-aivy, 👋 thank you for reaching out. Support for Lambda resource policies is currently tracked on https://github.com/aws-amplify/amplify-cli/issues/9093.
If you could add a 👍 on the issue, this would help us prioritize the feature request.

Closing in favor of tracking #9093


Base wrapper

Investigate a base wrapper to improve DRY in the components

Can you elaborate on this? What would be DRY-ed up?
This is almost a year old, is this going to be actioned?

Can you elaborate on this? What would be DRY-ed up? This is almost a year old, is this going to be actioned?

6? Definitely 6.
In all seriouness I believe this may have been in reference to dry-ing up the different inputs, but given the composables is no longer needed.


Publishers want an evergreen link to their public collection to embed in their own publication pages

Story
Publishers want an evergreen link to their public collection and their CXG to embed in their own publication pages and allow the data to be explored in cellxgene.
This should be available in the collections page.

Note: During the September 3 Strategy call, we made a decision to continue support for evergreen links to CXG(s). We will need to consider designs for cellxgene to advertise the portal to visitors navigating from an external site that links to a CZI hosted CXG.

Closing -the curator can copy and paste the links for their public collection and public CXG(s) from the browser address bar. The portal guarantees that the links are permanent.


face_recognition_demo: add options to override the FD input size

background: original face detection model have 300x300 input, it could not detect small faces in some use case(e.g, smart classroom).  we need add function to reshape fd-input-shape in demo app to detect more smaller faces.  This commit used to fulfill this requirement

Jenkins please retry a build

Thanks Wovchena's good suggestions. I committed all my changes per your comments.

Jenkins please retry a build

You have made face_detector.py executable. Please revert that; it is not a script, so it should not be executable.

sorry for the mistake. I will correct it.


Bring back Donald Trump sticker

the Donal Trump sticker has been removed. I would like to be brought back

It's still there, not sure what you are seeing. Maybe try refreshing the page


Can it be built with GCC, without LLVM?

LLVM is broken for some platforms. Is it required, or SML# can be bootstrapped with GCC?

No you can't bootstrap using gcc.
make will unpack precompiled.ll.xz and compile precompiled.ll using llc.
The compiled artifact will compile stage2 compiler.
Therefore we need llvm 14 or earlier.

make will unpack precompiled/x86_64.ll.xz and compile precompiled/x86_64.ll using llc.

This is even worse than I thought. If so, even fixing LLVM won’t help, it is essentially hardcoded for Intel.


Add note about using keep_local_envs_in_vcs

Description
Add a note that the keep_local_envs_in_vcs only makes sense when using Docker or Heroku.
Rationale
As a newbie, I wasn't sure about keep_local_envs_in_vcs, so I said yes, and when CC was building, it gave me the message:
"[INFO]: .env(s) are only utilized when Docker Compose and/or Heroku support is enabled so keeping them does not make sense given your current setup."
Seems like it could go in this documentation, and make things easier for newbies.
Use case(s) / visualization(s)

@purplediane thank you! As this is the first time you contribute to us would you mind adding yourself to CONTRIBUTORS?

Thank you! I added myself to the CONTRIBUTORS.rst file.


pyranges slow on many chromosomes. Use chromsweep algorithm?

This slowness is due to the groupby that splits on chromosome and handles each df individually.
I should try implemeting the chromsweep algorithm in rust. We can sort the entire dataframes with radix sort and do a quick chromsweep pass. This would incur no penalty for multiple chromosomes.

I think I have succeeded 🥳 This is something we should polish and include in the paper @marco-mariotti. These are insane speedups.
There is nothing revolutionary in my algorithm, it is just very optimized. The nice thing about my algorithm is that it is just as easy to use with polars as with pandas. See https://github.com/endrebak/ruranges for a beginning.
Previous records, 10 mill reads, hg38, max read length 1000:
pyranges: 18.22
genomicranges: 27.85
bioframe: 60.19
bedtools: 95.08
New record, ruranges (this includes getting the data from python to rust, doing the operation, getting the result back to python):
2.48 seconds
Previous records, 10 mill reads, proteome (11k chroms!), max read length 100:
genomicranges: 36.70
pyranges: 95.45
bedtools: 274.37
bioframe: 320.50
New record, ruranges (this includes getting the data from python to rust, doing the operation, getting the result back to python):
7.8 seconds.

Note that ruranges is a supporting library I'll use with pyranges, but it should be made available to use directly from rust (and R?) too.

The memory usage is the exact same as before.

Thanks Endre! Let's do a zoom soon after the Christmas break so you catch
me up and we plan the paper.
Ciao!
Marco Mariotti
On Wed, Dec 25, 2024, 12:28 endrebak.ada @.***> wrote:

The memory usage is the exact same as before.
—
Reply to this email directly, view it on GitHub
https://github.com/pyranges/pyranges_1.x/issues/44#issuecomment-2561848372,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ACTXRIHKUGG77HWYLRSW46D2HKJFTAVCNFSM6AAAAABUFMLNUKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNRRHA2DQMZXGI
.
You are receiving this because you were mentioned.Message ID:
@.***>

Yes, let's do so.
Sorting is now 4 times faster than the old pyranges for 20 mill intervals - 3 vs 13 seconds
Closest is 6 times faster than bioframe for 20 mill intervals (k=2, include overlaps) - 7 vs 42 seconds.
The two hardest algorithms are now implemented (overlaps and k-nearest). I think the only other binary algorithms missing are subtract and complement. The rest can be implemented using these.


Multiple share buttons with different urls

There is any way to have multiple sharebuttons in a page with different urls? (use case: a page with multiple articles and you want to provide a share buttons for every single article)
It would be nice if it would be possible to add a data attribute to the  tag that overrides the default url defined in the configuration.

I having the same question

I've combined sharing buttons this with infinite scroll on one of my Shopify projects.
Here's how it looks like:
$('.wrapper').infinitescroll({
    navSelector: ".nextNav",
    nextSelector: "a.next",
    itemSelector: ".article",
    loading: {
        finishedMsg: "You've reached the end of the Internet.",
        speed: 'fast',
    }
}, function(infiniteSharingButtons) {
    new Share(".share-button", {
        ui: {
            flyout: "bottom left",
            button_font: false,
            button_text: 'Share'
        },
        networks: {
            facebook: {
                before: function(element) {
                    this.url = element.getAttribute("data-url");
                },
                load_sdk: false
            }
        }
    });
});

and in html it looks like this:

Hi, we also need this, it seems that @aproxis solution does not work as expected in our case because :

If you have for example 5 buttons on the same page then their will be 5 click bindings, after that if we click on one button it seems the click callbacks are called 5 times for a button ;
In consequence this opens the sharing windows several times by clicking on a button, for exemple in our cas the Twitter sharing dialog is opened 2 times.

Is their any workaround do display several share buttons on the same page ?

+1

+1, it would be extremely useful


Weird performance issues while dragging app's window

Hi there.
First of all, thank you for tackling on the issue of translucent windows in desktop apps.
As stated in the title, I get really poor and weird performance when dragging my window:  it is very laggy and depending on the effect, it behaves erratically.
I have tested Windows only for now.
Using the following effects:

Transparent: no issue, perfectly smooth
Areo: quite laggy (definitely around 30 FPS, possily less)
Acrylic: somewhat not that laggy, but slow as hell and erratic. When I drag the window, it lags behind my mouse. There is an after-effect where the mouse is stuck in the app. When I release my mouse, it re-appears and a few seconds later the app's window arrives at final position.
Mica: cannot test (not using Windows 11).

Obviously I tried in profile & release mode but there is no effect. My computer is now slow:

i don't get the same behavior with other Windows apps
It sports a 7th Gen i7 Intel Core and a RTX 2070.

Does anyone get that issue ?

Same! With acrylic, moving the window just lags enormously, and the mouse cursor also lags behind, as you said.
As for aero, I don't have this issue; it works just fine.
On version 1.1.0+1

This is a bug in Windows 10. See related issue: #6


[FEAT] Assign CUDA_VISIBLE_DEVICES to actor pools in PyRunner

This PR assigns each actor that is spun up by the Python ActorPoolProject access to only certain GPUs, based on its rank.
TODO: We should handle chains of model inference as well by passing-through an offset of which device to start on.

Closing in favor of #3002


Carmodyquinn traefik

Updates include everything for User Story 22394
Changes include:

Fix broken flux implementation to work with this repo rather than old one
Update k8s version to 1.23.8
Update machine profile to Standard_DS3_v2, the last machines could barely support core component requests
Create workflow that allows user to create AKS Cluster only rather than entire hub/spoke arch and stack
Create workflow to create ingress certs and import into AKV
Create workflow that will import traefik into ACR and deploy appropriate traefik files into directories so that flux can then deploy to the cluster.
Have tested all features and compared to main

@carmodyquinnms  - should this file have been put into the workflows directory ".CreateIngressCert.yml.swp" - looks odd.

@Gordon @.***> sorry - that should not have been added.  That is my vi swap file and I need to delete it (and update .ignore with *.swp)
[Icon  Description automatically generated]
Carmody Quinn
Microsoft Consulting Services
Azure Cloud & AI Delivery
Mobile:  +1<PHONE_NUMBER>
Email<EMAIL_ADDRESS>https://www.linkedin.com/in/carmodyquinn/
From: Gordon Byers @.>
Sent: Friday, August 5, 2022 8:42 AM
To: Azure/aks-baseline-automation @.>
Cc: Carmody Quinn @.>; Mention @.>
Subject: Re: [Azure/aks-baseline-automation] Carmodyquinn traefik (PR #54)
@carmodyquinnmshttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcarmodyquinnms&data=05|01|carmody.quinn%40microsoft.com|ea811a0dd1ae486f004608da76e83988|72f988bf86f141af91ab2d7cd011db47|1|0|637953037020962656|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=wzxwID2S3MjQpLd6ZumQCfjdJ7ZnuwDgor0jeAHhFCI%3D&reserved=0 - should this file have been put into the workflows directory ".CreateIngressCert.yml.swphttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2Faks-baseline-automation%2Fpull%2F54%2Ffiles%23diff-7c26827e9cf8e964f69b3efae295b19349d4fdf4b1930656848269b50785b10a&data=05|01|carmody.quinn%40microsoft.com|ea811a0dd1ae486f004608da76e83988|72f988bf86f141af91ab2d7cd011db47|1|0|637953037020962656|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=TDEa3%2FaXtC2Nuh65M7pmeFWC55J8myvgiL3T58IiuWs%3D&reserved=0" - looks odd.

Reply to this email directly, view it on GitHubhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2Faks-baseline-automation%2Fpull%2F54%23issuecomment-1206472706&data=05|01|carmody.quinn%40microsoft.com|ea811a0dd1ae486f004608da76e83988|72f988bf86f141af91ab2d7cd011db47|1|0|637953037020962656|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=5DSANUCnAqZhVA1s0tTiQ1hNaxL8FWsA0C0zzUMBaBc%3D&reserved=0, or unsubscribehttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAX2XLEQCEAG5VLQKNMVESKTVXUKZHANCNFSM55L2DFKQ&data=05|01|carmody.quinn%40microsoft.com|ea811a0dd1ae486f004608da76e83988|72f988bf86f141af91ab2d7cd011db47|1|0|637953037020962656|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=oDn8bWaZS%2FQYzqePxKDLDS3g4R5k3IFhEv5MuHjf7jc%3D&reserved=0.
 @MattLeach25 !!!!! 😉

Good!! So long as I can blame someone else – LOL!! Yeah I think where @Matthew @.***> mess up was by trusting me 😉
[Icon  Description automatically generated]
Carmody Quinn
Microsoft Consulting Services
Azure Cloud & AI Delivery
Mobile:  +1<PHONE_NUMBER>
Email<EMAIL_ADDRESS>https://www.linkedin.com/in/carmodyquinn/
From: Gordon Byers @.>
Sent: Friday, August 5, 2022 10:59 AM
To: Azure/aks-baseline-automation @.>
Cc: Carmody Quinn @.>; Mention @.>
Subject: Re: [Azure/aks-baseline-automation] Carmodyquinn traefik (PR #54)
Don't worry, i don't blame you @carmodyquinnmshttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcarmodyquinnms&data=05|01|carmody.quinn%40microsoft.com|6bfd389458184febd75f08da76fb5ea6|72f988bf86f141af91ab2d7cd011db47|1|0|637953119241358018|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=3q8%2Bglt4cq3G0rQJzP2kQBKP8l4y%2B%2FHUHb2eFexEPeo%3D&reserved=0 - it's all the approvers fault.... @MattLeach25https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMattLeach25&data=05|01|carmody.quinn%40microsoft.com|6bfd389458184febd75f08da76fb5ea6|72f988bf86f141af91ab2d7cd011db47|1|0|637953119241358018|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=ndOUaAPfXOLgQnqP2uP7L6nu5Md5QFFzXYtWWIJ%2FaNY%3D&reserved=0 !!!!! 😉
—
Reply to this email directly, view it on GitHubhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2Faks-baseline-automation%2Fpull%2F54%23issuecomment-1206610350&data=05|01|carmody.quinn%40microsoft.com|6bfd389458184febd75f08da76fb5ea6|72f988bf86f141af91ab2d7cd011db47|1|0|637953119241358018|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=D%2F3ZqLn4M%2Fo1sHtEa6r3uB6pe9LV3v3sWNDnVXyxUhg%3D&reserved=0, or unsubscribehttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAX2XLEW3ZEYZULKOTS7OQTDVXU23DANCNFSM55L2DFKQ&data=05|01|carmody.quinn%40microsoft.com|6bfd389458184febd75f08da76fb5ea6|72f988bf86f141af91ab2d7cd011db47|1|0|637953119241358018|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=hg1cWVK0POXol41Dtl0%2BHqCmbqiQrj8H0Q200K5MDV0%3D&reserved=0.
You are receiving this because you were mentioned.Message ID: @.***>


Switch to GitHub Action native docker cache

GitHub Action cache with docker doesn't seem to work so abandoning for now.


curriculum: Change pre and code to blockquote in Advanced Node and Express challenges

[x] I have read freeCodeCamp's contribution guidelines.
[x] My pull request has a descriptive title (not a vague title like Update index.md)
[x] My pull request targets the master branch of freeCodeCamp.
[x] None of my changes are plagiarized from another source without proper attribution.
[x] All the files I changed are in the same world language (for example: only English changes, or only Chinese changes, etc.)
[x] My changes do not use shortened URLs or affiliate links.

Refer #35697 #35709

About the Registration of new users, I'm fine either way I guess, don't really see how it'll affect anything. What do you think?

About the Registration of new users, I'm fine either way I guess, don't really see how it'll affect anything. What do you think?

I like the two space indention that I recommended above for the Registration of New Users challenge.

Sorry to ask this so late in the process, but should we be making them into <blockquote>s?  These are code blocks, so the semantic markup is to wrap <code> with <pre>.

@RandellDawson How does it look now?

@RandellDawson My bad, how does it look now?

@RandellDawson Yeah, you're quite right - this wasn't the place to talk about it.  I've created issue #35913 to address it.

@thecodingaviator Thanks for making those change.  LGTM

@thecodingaviator Thank you for your contribution to the page! :+1:
We're happy to accept these changes, and look forward to future contributions. :memo:


Prevent the xrootd server readv_iov_max limit from being exceeded

Fixes #253
This change just prevents the length of any sublist in all_request_ranges from exceeding the readv_iov_max limit.

The CI failure is caused by a HTTP 500 error from a remote server in one of the tests https://github.com/scikit-hep/uproot4/pull/254/checks?check_run_id=1777200916#step:9:441

The CI failure is caused by a HTTP 500 error from a remote server in one of the tests https://github.com/scikit-hep/uproot4/pull/254/checks?check_run_id=1777200916#step:9:441

That HTTP issue was unrelated to the XRootD thing you fixed, so I restarted the jobs.

That HTTP issue was unrelated to the XRootD thing you fixed, so I restarted the jobs.

Now it's failing because pip is using syntax that's not legal in Python 3.5: "sys.stderr.write(f"ERROR: {exc}")". I wonder why it's pulling in a version of pip that's incompatible with the Python that's running.

Now it's failing because pip is using syntax that's not legal in Python 3.5: "sys.stderr.write(f"ERROR: {exc}")". I wonder why it's pulling in a version of pip that's incompatible with the Python that's running.

Thanks! Yes, I saw that, odd. Something wrong with conda-incubator/setup-miniconda ?

Thanks! Yes, I saw that, odd. Something wrong with conda-incubator/setup-miniconda ?

Python 3.5 hasn't been supported by conda in a long time. Normally I'd say this sounds like SLC6; pip install -U pip from an old pip that doesn't know about the Requires-Python metadata slot will upgrade to pip 21.0 and break.

Python 3.5 hasn't been supported by conda in a long time. Normally I'd say this sounds like SLC6; pip install -U pip from an old pip that doesn't know about the Requires-Python metadata slot will upgrade to pip 21.0 and break.

Ahh, I think the problem is pip on conda is a no-arch package, meaning it's not tied to Python version. It's listed as >=3, not >=3.6. If I can manage to get anyone to care about 3.5, I might be able to get it fixed. But not sure I can get anyone to care.

Ahh, I think the problem is pip on conda is a no-arch package, meaning it's not tied to Python version. It's listed as >=3, not >=3.6. If I can manage to get anyone to care about 3.5, I might be able to get it fixed. But not sure I can get anyone to care.

I don't know if it's conda, but maybe. I know that a lot of things have been dropping Python 3.5 support.
Uproot technically works in Python 3.5, just as it works in Python 2.7 (and even Python 2.6 in some tests I performed personally), but we can't claim support if it's not regularly tested in CI, and it's hard to run CI on old platforms.
I have less of an attachment to Python 3.5 than 2.7 because use-cases are more likely to be stuck in Python 2.7 than 3.5—any system on a Python 3 branch can update rather easily, but Python 2 has locked in some code with large, messy codebases. So, having given up on trying to keep Python 2.7 in CI, I might as well give up on 3.5.

I don't know if it's conda, but maybe. I know that a lot of things have been dropping Python 3.5 support.
Uproot technically works in Python 3.5, just as it works in Python 2.7 (and even Python 2.6 in some tests I performed personally), but we can't claim support if it's not regularly tested in CI, and it's hard to run CI on old platforms.
I have less of an attachment to Python 3.5 than 2.7 because use-cases are more likely to be stuck in Python 2.7 than 3.5—any system on a Python 3 branch can update rather easily, but Python 2 has locked in some code with large, messy codebases. So, having given up on trying to keep Python 2.7 in CI, I might as well give up on 3.5.

Hi, @henryiii! Our messages crossed. I agree that it's hard to care about Python 3.5: if you're already on Python 3, you might as well upgrade already. (Also, its non-deterministic dict order has been a pain for me. I don't mind seeing it go.)
@ryuwd, if you don't have any other changes, give me a thumbs-up and I'll squash-and-merge. Thanks!

Hi, @henryiii! Our messages crossed. I agree that it's hard to care about Python 3.5: if you're already on Python 3, you might as well upgrade already. (Also, its non-deterministic dict order has been a pain for me. I don't mind seeing it go.)
@ryuwd, if you don't have any other changes, give me a thumbs-up and I'll squash-and-merge. Thanks!

@all-contributors please add @ryuwd for code

@all-contributors please add @ryuwd for code

Thanks @jpivarski !

Thanks @jpivarski !

I've opened a PR to fix the issue you saw with pip: https://github.com/conda-forge/pip-feedstock/pull/68

I've opened a PR to fix the issue you saw with pip: https://github.com/conda-forge/pip-feedstock/pull/68

@chrisburr Thanks! I didn't think there would be this interest in Python 3.5. (Although now that I think about it, the failure should at least be prevented because it can be hard to understand the error message: "f-strings are not correct syntax.")

@chrisburr Thanks! I didn't think there would be this interest in Python 3.5. (Although now that I think about it, the failure should at least be prevented because it can be hard to understand the error message: "f-strings are not correct syntax.")


Add Aarch64 test

This PR adds an aarch64 artifact of the hermit application (for use with the github workflow) that will exit once it reaches the point up to which the kernel currently works. Expected Output is something like:
$ qemu-system-aarch64 -display none -smp 4 -m 1G -serial stdio -kernel target/aarch64-unknown-hermit-loader/debug/rusty-loader  -machine raspi3 -semihosting
[LOADER] Enter startup code
[LOADER] Loader: [0x80000 - 0x131a010]
[LOADER] Allocating 0x268 bytes at 0x11190C0, index 0
[LOADER] Allocating 0x870 bytes at 0x1119340, index 640
[LOADER] Allocating 0xC0 bytes at 0x1119BC0, index 2816
[LOADER] Allocating 0xE0 bytes at 0x1119CC0, index 3072
[LOADER] This is a supported HermitCore Application
[LOADER] Found entry point: 0x500f4
[LOADER] File Size: 488897 Bytes
[LOADER] Mem Size:  522008 Bytes
[LOADER] start 0x9a2cc, size 0x7f718
[LOADER] Load HermitCore Application at 0x1200000
[LOADER] Found TLS starts at 0x1250200 (size 88 Bytes)
[LOADER] Jumping to HermitCore Application Entry Point at 0x12500f4
Welcome to hermit kernel.
[0][INFO] Welcome to HermitCore-rs 0.3.45
[0][INFO] Kernel starts at 0x0
[0][INFO] BSS starts at 0x12775c8
[0][INFO] TLS starts at 0x0 (size 0 Bytes)
[0][INFO] The current hermit-kernel is only implemented up to this point on aarch64.
[0][INFO] Attempting to exit via QEMU.
[0][INFO] This requires that you passed the `-semihosting` option to QEMU.

This test compiles the rusty-loader with an application artifact compiled from
https://github.com/jschwe/libhermit-rs/commit/f5faa6d059f29e6a4d28a8872acf639c64d3a6ae
The artifact is technically the rusty_demo artifact, since the hello_world artifact
didn't work for me.
This is most likely due to the loader still being brittle.
I suspect that the copying process is buggy, since (un)commenting simple things
such as log messages in rusty-loader will break or fix entry into the kernel.
Until this is fixed this workflow will probably fail sometimes.
Update: Commit ae3308c changes the way the Stack pointer is set and this seems to fix the issues I'd been having.

bors r+


Readme link to CONTRIBUTING.md is dead

Points to the old CONTRIBUTION.md instead.

Done in https://github.com/EtixLabs/cameradar/commit/1583d6944d97fb5dfac11ca55acbba1839e6310a


Prevent CVE-2024-3094

Description
Prevent CVE-2024-3094
Checklist

[x] I have read the policy contribution guidelines.
[] I have added test manifests and resources covering both positive and negative tests that prove this policy works as intended.
[x] I have added the artifacthub-pkg.yml file and have verified it is complete and correct.

No so that would be kinda unethical, pointing people to known vulnerable images doesn’t pass muster.

We wouldn't be "pointing people" to it; it would only be used for test purposes, inside an isolated CI/CD environment, not as part of the policy definition itself.

The test cases are public correct? I would have to include a pointer to the image in them? Along with the ci/cd run itself is public?

Yes. We have a number of images we use which fall into the same category. Their presence doesn't serve as an endorsement for others, only inputs for policy validation.

I do not believe that makes the practice ok. I am welcome to have other maintainers chime in, but providing traces of vulnerable code, no matter the intent, is a security no no, and considering the project falls under the security umbrella I do not see this as a good practice.

I get your intentions but I generally disagree. Regardless, how do we verify your policy works as intended? We obviously need an image with an SBOM with the affected packages at least forged in the SBOM. We do not accept policies in the library which cannot be independently verified, even if they are not or cannot be tested during CI.

Typically we have tests covered for policies with new functionalities, which should be tested thoroughly in kyverno/kyverno. And I agree that the sample policies provided in the Kyverno official pool should have tests covered for all scenarios.  However this makes a contribution become complex.
Is it a good idea to create another pool to include example policies contributed by Kyverno users? While Kyverno offers an unofficial policies pool, it does not assure that all created policies will function as intended, they are used only as references, and users should thoroughly test and evaluate their policies.

Supplying automated tests along with a policy is not a hard requirement, it is just strongly encouraged. But what is a hard requirement is that someone (a project maintainer) other than the policy author be able to verify the policy does what it claims to do.

I do not think this is the correct avenue for the discussion. However, I will say that I simply used the following already merged and accepted policy as the basis for this one: https://kyverno.io/policies/other/verify-image-cve-2022-42889/verify-image-cve-2022-42889/. Its codebase is in the repo here: https://github.com/kyverno/policies/tree/main/other/verify-image-cve-2022-42889. I do not see associated test cases with it.

That policy was created two years ago when we did not have any CI tests in place, but the policy was tested (by me) to ensure that it worked as written. Whether the reviewer (Jim) tested it himself I do not know.


Some Snippets functions for Javascript

I have added javascript snippets functions for-

Comprehensive Email validation with temp mail checker
Deep Clone an Object
Detect Device Type
Build a Query String from an Object
Get Multiple URL Query Parameters
Get single URL Parameters

DOM manipulation-
1.Show Loading Spinner
2.Add Class to an Element
3.Remove Class from an Element
4.Set Text Content of an Element

Hi, @cpatra11. Thank your for the contributions. I see that it's still a draft pull request. Once you've finished, I will merge it.

Done reviews, merge it now. More snippets coming...

Done reviews, merge it now. More snippets coming...

@cpatra11 Thank you for the all code snippets. 🙌 And, there's a Show/Hide Loading Spinner(with CSS) in DOM Manipulation category. Since, it contained mostly CSS, it might be better to move it to CSS language instead of JavaScript, and call it Loading Spinner. I would appreciate your review on that.

Also, categorizing them into their correct place would be more helpful for developers to find. I saw that there are 3 code snippets that deal with URL in Function Utilities category. Perhaps, we can make a separate category for them. Same scenario is happening with Objects as well.

Most of the URL related stuff are waayy too over complicated, for example query params can just be retrieved using the URL object and it's searchParams value...
And for the validating of email, I don't think fetching some extern source of disposable email provider fits the theme of snippets, I find it way too big, and it relies on something external to this project that can fail at any moment...


Loaded VRM models don't have the head bone displayed as being the head bone

When loading in a .vrm model, the head bone field is not populated. The model still tracks as expected.

Fixed by 7cfbbbe5f5a56172a670093816a7c5f46d10b73b


License XML editor assumes fork is named license-list-XML

When using the "License XML Editor" "Submit Changes" feature, if the user's fork of the license-list-XML repo is not named precisely license-list-XML, the submission will fail with a very generic error message.
The problem is in the makePullRequest code.

Hi @goneall I would like to work on this issue if it is still open, it would be really helpful if you could help me in getting started with it, like how to replicate the error and what is the intended output for the same

I think this might fall into the "better toast messages" category??


Define a process for resolving disagreements among stakeholders for the RFC process

Over in #1, @joshtriplett highlighted that we haven't yet defined a process for resolving conflicts that might otherwise leave RFCs in limbo indefinitely. We shouldn't put this off for too long, and instead aim to have it in place before the first such case occurs.

Concrete proposal, based on some discussions in the Rust project:
Any one stakeholder may register an objection to a proposal. There is minimum discussion period associated with such an objection, to give people time to discuss and consider. After that discussion period, to continue to maintain the objection, at least one other stakeholder must second the objection; seconding does not imply agreement with the objection itself, only that the objection has some merit and that there's value in continuing to hear it out. (Seconding objections that you don't necessarily agree with is encouraged; declining to second an objection means you believe that it both has been fully heard and discussed, that nothing would be gained by further discussion, and that no resolution seems likely to be possible.) If an objection is not seconded, the objector is encouraged to write a "dissenting opinion", which should be incorporated into RFCs or similar in an appropriate section (e.g. "alternatives" or "open questions"), but is asked to "disagree and commit" to the team consensus. (This does not preclude them from raising other issues in good faith, or from raising related issues if new information comes to light; this should not be used to silence subsequent discussion, only used to allow the process to move forward without repetition.)
In other words, if a stakeholder wishes to block something beyond a reasonable initial period, they need to convince at least one other stakeholder that there's an issue that has not yet been fully heard or discussed or understood. If they can convince at least one other stakeholder, that objection can stand indefinitely; that seems reasonable, as we should strongly aim for full consensus and not override objections lightly. If they cannot convince a single other stakeholder that there's any more to hear out, and everyone believes that there's no consensus to be had, it's possible to move forward.
I'm proposing this based on having experience in all three roles: as the person with the sole objection, as a person arguing that someone else's objection should be heard further, and as a person who has seen objections that did not have any support from the rest of the team.
I would also encourage something like the following, to help people reach consensus:
Before resorting to this process to override an objection, try to reach a consensus if at all possible. In particular, note that many seemingly intractable discussions stop once they reach questions that one or more stakeholders consider related to their values or similarly core considerations. Rather than treating this as the end of a discussion, however, this can be the start of the most critical part of the discussion. Many interesting questions come down to evaluations of such values and the tradeoffs between them.


Remove normalization of component names when mapping to DOM elements.

Assume that DOM elements are always lower cased. Fixes #46

Coverage remained the same at 95.993% when pulling 8d3b5f819d4204ef14feeb302786034b83227a3f on normalize into 523478932aa0ea400a23a82afd48188c7327a2f8 on master.


Add download tests for remaining datasets

This adds the remaining download tests for

KMNIST
EMNIST
QMNIST
Omniglot
Phototour
SBDataset
SBU
SEMEION
STL10
SVHN
USPS
CelebA
WIDERFace

and fixes the test for CIFAR100.

The three failing URLs

http://matthewalunbrown.com/patchdata/notredame_harris.zip
http://matthewalunbrown.com/patchdata/yosemite_harris.zip
http://matthewalunbrown.com/patchdata/liberty_harris.zip

are working fine. Either re-run the download tests or accept them as fluke an merge this :wink:

@pmeier There are still a few failures. I think it's important to see them passing and address any flakiness before merging. Let me know what you think.

@datumbox The failing URLs reported in the test are the ones from my last comment. They are working and I've not touched Places365. IMO this was just a fluke. Lets see what the new CI run brings.

So, I was wrong. The request indeed timed out. I've added some logic to better capture timeouts. As for the reason why these tests times out: I'm not sure yet. I cannot produce the timeout locally.


Add: Welcome message for newcomers

Add an event listener which listens for new member joins. When a new member joins, the bot should send a message welcoming them with a message (tagging the user) and an image

@z404
Please assign me this one

Sure, assigned!

@z404 I would like to work on this issue. Please assign it to me.

Assigned!

Hi @z404
I have a doubt. If the server has multiple channels, should we send the welcome message to all of them or just a specific channel - for example, the general channel

One channel is enough I think. Sending a message on the general channel should do the job

Sure, thanks


Allow single step execution on get_next_dialogue_line via flag

This PR adds a new flag single_step on function get_next_dialogue_line() (it is disabled by default to maintain compatibility). If enabled, the engine will not run until it finds a printable line, instead it will stop after running one line only. Documentation has been updated accordingly. This has two benefits:

users can have more control on the execution flow
engine is more stateless than before, since in executing multiple steps there we keep some state implicitly within the function stack inside get_next_dialogue_line()

The PR also fixes two minor issues, a typo and a fix for handling numbers (which the engine was attempting to convert to variables previously).

If you're looking for more granular control then you can use get_line which steps one actual line at a time and doesn't execute mutations by default. If you remove the single step stuff out of this PR and just include the other fixes I'll merge it.

I believe that get_next_dialogue_line has some additional logic which would need to be implemented anyways if I were to use get_line (and run mutations too). The use case for me is to allow a mutation to stop executing any further lines, not to skip mutations entirely.
For the fixes I'll make a separate PR and remove them from this one, so you can approve it.

I meant that you can use get_line in your game code to implement custom dialogue behaviour. I'm hesitant to add more complexity/parameters to get_next_dialogue_line for something that is game specific.


Oracle - table size - consider LOB data

For Oracle database, the table size information gathered by the application shows incorrect values for tables that have LOB data.

Describe alternatives you've considered
There is no alternative to show this information.
Additional context
Here is a situation:

This is the real size of the table:

Thanks for te request and investigation


Generating a TF checkpoint file

I'm intending to use the generated *.pb file into Lucid. However, aside of this file, is also necessary to have a TF model checkponit file (*.ckpt). I would like to know how to obtain that from my Keras model (if possible).

Solved with @fchollet snippet.


Claim a bounty on Pomelo Bounties

The goal of the bounty is to claim a bounty to get a feel for the process. The applicant must be named Zack.

B