Security: Do we need to keep .credentials_rsaparams file?

Agent version and platform
2.103.0

Linux Centos 7

VSTS type and version
VisualStudio.com
What's not working?

However, when I queue a build, I get errors in the agent and the build does not work:
2016-07-15 18:40:40Z: Agent connect error: RSA key file /home/vsoagent/.credentials_rsaparams was not found. Retrying every 15 seconds until reconnected.
An error occurred: Unexpected character encountered while parsing number: y. Path '', line 1, position 1.

This is different from the behaviour in the preview 2.101.1 where things were kept in .Credentials file -- I could remove the file and everything would keep running just fine.
Why I delete credential files
Using chmod 600 on files with sensitive information does not provide any real security if the file is owned by the same user which runs the build jobs. The reason is I can easily create a build task with shell command cat .credentials. Because the build task executes under same user id which owns the sensitive files -- I get all those file contents in my build log.
This is obviously highly undesirable.
The solution I employed in the past is to delete these files once the agent connects to VSO.
Of course now we have .credentials_rsaparams files which seems to be required every time we queue the build so the solution no longer works.
Questions

What is the content of the .credentials_rsaparams file used for?

Do we need to read from it every time we queue the build? Isn't it enough to read once at agent startup keep all that in memory?

If we do need to keep the file around -- is it safe to do so?

## **Agent and Worker's diag log**
The exception trace:
[2016-07-15 18:40:40Z ERR  MessageListener] Catch exception during get next message.
[2016-07-15 18:40:40Z ERR  MessageListener] System.Security.Cryptography.CryptographicException: RSA key file /home/vsoagent/.credentials_rsaparams was not found
   at Microsoft.VisualStudio.Services.Agent.Listener.Configuration.RSAFileKeyManager.GetKey()
   at Microsoft.VisualStudio.Services.Agent.Listener.MessageListener.GetMessageDecryptor(Aes aes, TaskAgentMessage message)
   at Microsoft.VisualStudio.Services.Agent.Listener.MessageListener.DecryptMessage(TaskAgentMessage message)
   at Microsoft.VisualStudio.Services.Agent.Listener.MessageListener.<GetNextMessageAsync>d__13.MoveNext()
[2016-07-15 18:40:40Z INFO MessageListener] Retriable exception: RSA key file /home/vsoagent/.credentials_rsaparams was not found
[2016-07-15 18:40:40Z ERR  Terminal] WRITE ERROR: 2016-07-15 18:40:40Z: Agent connect error: RSA key file /home/vsoagent/.credentials_rsaparams was not found. Retrying every 15 seconds until reconnected.
[2016-07-15 18:40:40Z INFO MessageListener] Sleeping for 15 seconds before retrying.
[2016-07-15 18:40:56Z INFO JobDispatcher] Shutting down JobDispather. Make sure all WorkerDispatcher has finished.
[2016-07-15 18:40:56Z ERR  Terminal] WRITE ERROR: An error occurred: Unexpected character encountered while parsing number: y. Path '', line 1, position 1.
[2016-07-15 18:40:56Z ERR  AgentProcess] Newtonsoft.Json.JsonReaderException: Unexpected character encountered while parsing number: y. Path '', line 1, position 1.
   at Newtonsoft.Json.JsonTextReader.ReadNumberIntoBuffer()
   at Newtonsoft.Json.JsonTextReader.ParseNumber(ReadType readType)
   at Newtonsoft.Json.JsonTextReader.ParseValue()
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.ReadForType(JsonReader reader, JsonContract contract, Boolean hasConverter)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.Deserialize(JsonReader reader, Type objectType, Boolean checkAdditionalContent)
   at Newtonsoft.Json.JsonSerializer.DeserializeInternal(JsonReader reader, Type objectType)
   at Newtonsoft.Json.JsonSerializer.Deserialize[T](JsonReader reader)
   at Microsoft.TeamFoundation.DistributedTask.WebApi.JsonUtility.FromString[T](String toDeserialize)
   at Microsoft.VisualStudio.Services.Agent.Listener.Agent.<RunAsync>d__12.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.VisualStudio.Services.Agent.Listener.Agent.<RunAsync>d__12.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.VisualStudio.Services.Agent.Listener.Agent.<RunAsync>d__12.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Agent.Listener.Agent.<ExecuteCommand>d__9.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Agent.Listener.Program.<MainAsync>d__1.MoveNext()

@ppanyukov
What is the content of the .credentials_rsaparams file used for?
It's a RSA private key for OAuth token exchange between agent and server. server hold the public key, every 50 mins server will send a new token to agent encrypted by the public key.
Do we need to read from it every time we queue the build? Isn't it enough to read once at agent startup keep all that in memory?
We can do it, but your agent will exit due to auto upgrade, so you still can't delete that file after agent startup
If we do need to keep the file around -- is it safe to do so?
it's not 100% safe, worst case someone who has permission to queue build against the agent can steal it from server. the solution should be let the worker and agent run as different user.

Yes you need to keep it around or we wouldn't write it.  It's to make the agent much, much more secure than it was in previous releases.
We ask for you for your elevated admin permissions when you register the agent.  To avoid storing that powerful credential, when the agent is registered, we acquire a signed JWT token (OAuth exchange) from the server which only has permissions to listen to the queue.
Then when the build runs, we generate another per build token with limited scope (defined on the general tab of the definition) which is time bombed for the life of the build (when build ends or timeout also defined on definition).
Further that per build token is not accessible via ad hoc scripts or untrusted code - only to the build agent and task/plugins.  For example when unit tests are run, they run and send a command back to the agent to write results back.  This prevents something like a unit test to elevate and do something that developer would otherwise have permissions to do.
So, these make this agent more secure than the previous agents and an order of magnitude more secure than previous xaml and other build server generations.
As Ting noted, in the future we are considering running even the worker as another identity for even another layer of security.

Looks quite a comprehensive setup.  Also answers the question of #403.
It would be super nice if all this were put into docs at some point -- these are normally the questions that bother our ops people a lot.

Yes.  I do plan to write something documenting how security works.  Thanks!


Add Changelog

The introduction of Attributes in Images and Links in version 1.16 should be documented in Changelog.

Will do.  Note that 1.16 is not released.  There will likely
be further changes.
+++ Jakob Voß [Nov 21 15 07:35 ]:

The introduction of Attributes in Images and Links in version 1.16
should be documented in Changelog.
—
Reply to this email directly or [1]view it on GitHub.
References

https://github.com/jgm/pandoc-types/issues/17


Disarm alarm activate private life option on somfy outdoor camera

Hello,
When I launch the following service  :
service: alarm_control_panel.alarm_disarm target:   entity_id: alarm_control_panel.cuisine
("cusine" is my Somfy one device)
the "virtual" shutter of my Somfy outdoor camera is activate.
I don't know if it's a bug or a API issue on Somfy side.
Here the information for the virtual shutter on my Somfy outdoor camera :
core:CloudDeviceStatusState: online friendly_name: Allée supported_features: 3 device_class: shutter
In my Somfy app, I have the option which allow me to keep the virtual shutter open when I disarm the alarm.
Maybe this option is applied only when the alarm is disarm through the app.

Hub: Somfy TaHoma
ha-tahoma version: 2.4.9
Home Assistant version:  2021.4.6

Could you execute it via the Somfy app, and than open Home Assistant -> Services, run tahoma.get_execution_history. It will print the executed commands in your log.
If you can copy the specific command here, we can have a look if we can support it.

Hello,
I have the following logs when I execute your command :
2021-04-29 12:44:32 ERROR (MainThread) [homeassistant.helpers.script.websocket_api_script] websocket_api script: Error executing script. Unexpected error for call_service at pos 1: 'DAWN_TRIGGER' is not a valid ExecutionSubType Traceback (most recent call last):   File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 359, in _async_step     await getattr(self, handler)()   File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 559, in _async_call_service_step     await service_task   File "/usr/src/homeassistant/homeassistant/core.py", line 1480, in async_call     task.result()   File "/usr/src/homeassistant/homeassistant/core.py", line 1515, in _execute_service     await handler.job.target(service_call)   File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 719, in admin_handler     await result   File "/config/custom_components/tahoma/__init__.py", line 252, in handle_get_execution_history     await write_execution_history_to_log(tahoma_coordinator.client)   File "/config/custom_components/tahoma/__init__.py", line 306, in write_execution_history_to_log     history = await client.get_execution_history()   File "/usr/local/lib/python3.8/site-packages/backoff/_async.py", line 133, in retry     ret = await target(*args, **kwargs)   File "/usr/local/lib/python3.8/site-packages/pyhoma/client.py", line 152, in get_execution_history     execution_history = [HistoryExecution(**h) for h in humps.decamelize(response)]   File "/usr/local/lib/python3.8/site-packages/pyhoma/client.py", line 152, in <listcomp>     execution_history = [HistoryExecution(**h) for h in humps.decamelize(response)]   File "/usr/local/lib/python3.8/site-packages/pyhoma/models.py", line 484, in __init__     self.execution_sub_type = ExecutionSubType(execution_sub_type)   File "/usr/local/lib/python3.8/enum.py", line 339, in __call__     return cls.__new__(cls, value)   File "/usr/local/lib/python3.8/enum.py", line 662, in __new__     raise ve_exc ValueError: 'DAWN_TRIGGER' is not a valid ExecutionSubType 2021-04-29 12:44:32 ERROR (MainThread) [homeassistant.components.websocket_api.http.connection] [281473283613216] Error handling message: Unknown error Traceback (most recent call last):   File "/usr/src/homeassistant/homeassistant/components/websocket_api/decorators.py", line 18, in _handle_async_response     await func(hass, connection, msg)   File "/usr/src/homeassistant/homeassistant/components/websocket_api/commands.py", line 439, in handle_execute_script     await script_obj.async_run(context=context)   File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 1200, in async_run     await asyncio.shield(run.async_run())   File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 341, in async_run     await self._async_step(log_exceptions=False)   File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 359, in _async_step     await getattr(self, handler)()   File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 559, in _async_call_service_step     await service_task   File "/usr/src/homeassistant/homeassistant/core.py", line 1480, in async_call     task.result()   File "/usr/src/homeassistant/homeassistant/core.py", line 1515, in _execute_service     await handler.job.target(service_call)   File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 719, in admin_handler     await result   File "/config/custom_components/tahoma/__init__.py", line 252, in handle_get_execution_history     await write_execution_history_to_log(tahoma_coordinator.client)   File "/config/custom_components/tahoma/__init__.py", line 306, in write_execution_history_to_log     history = await client.get_execution_history()   File "/usr/local/lib/python3.8/site-packages/backoff/_async.py", line 133, in retry     ret = await target(*args, **kwargs)   File "/usr/local/lib/python3.8/site-packages/pyhoma/client.py", line 152, in get_execution_history     execution_history = [HistoryExecution(**h) for h in humps.decamelize(response)]   File "/usr/local/lib/python3.8/site-packages/pyhoma/client.py", line 152, in <listcomp>     execution_history = [HistoryExecution(**h) for h in humps.decamelize(response)]   File "/usr/local/lib/python3.8/site-packages/pyhoma/models.py", line 484, in __init__     self.execution_sub_type = ExecutionSubType(execution_sub_type)   File "/usr/local/lib/python3.8/enum.py", line 339, in __call__     return cls.__new__(cls, value)   File "/usr/local/lib/python3.8/enum.py", line 662, in __new__     raise ve_exc ValueError: 'DAWN_TRIGGER' is not a valid ExecutionSubType

Hi, thanks for the report, can you edit your post and paste again using a code bloc? past your bloc and add 3 back quotes (```) before and after.

Traceback (most recent call last):
  File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 359, in _async_step
    await getattr(self, handler)()
  File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 559, in _async_call_service_step
    await service_task
  File "/usr/src/homeassistant/homeassistant/core.py", line 1480, in async_call
    task.result()
  File "/usr/src/homeassistant/homeassistant/core.py", line 1515, in _execute_service
    await handler.job.target(service_call)
  File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 719, in admin_handler
    await result
  File "/config/custom_components/tahoma/__init__.py", line 252, in handle_get_execution_history
    await write_execution_history_to_log(tahoma_coordinator.client)
  File "/config/custom_components/tahoma/__init__.py", line 306, in write_execution_history_to_log
    history = await client.get_execution_history()
  File "/usr/local/lib/python3.8/site-packages/backoff/_async.py", line 133, in retry
    ret = await target(*args, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/pyhoma/client.py", line 152, in get_execution_history
    execution_history = [HistoryExecution(**h) for h in humps.decamelize(response)]
  File "/usr/local/lib/python3.8/site-packages/pyhoma/client.py", line 152, in <listcomp>
    execution_history = [HistoryExecution(**h) for h in humps.decamelize(response)]
  File "/usr/local/lib/python3.8/site-packages/pyhoma/models.py", line 484, in __init__
    self.execution_sub_type = ExecutionSubType(execution_sub_type)
  File "/usr/local/lib/python3.8/enum.py", line 339, in __call__
    return cls.__new__(cls, value)
  File "/usr/local/lib/python3.8/enum.py", line 662, in __new__
    raise ve_exc
ValueError: 'DAWN_TRIGGER' is not a valid ExecutionSubType
2021-04-29 12:44:32 ERROR (MainThread) [homeassistant.components.websocket_api.http.connection] [281473283613216] Error handling message: Unknown error
Traceback (most recent call last):
  File "/usr/src/homeassistant/homeassistant/components/websocket_api/decorators.py", line 18, in _handle_async_response
    await func(hass, connection, msg)
  File "/usr/src/homeassistant/homeassistant/components/websocket_api/commands.py", line 439, in handle_execute_script
    await script_obj.async_run(context=context)
  File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 1200, in async_run
    await asyncio.shield(run.async_run())
  File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 341, in async_run
    await self._async_step(log_exceptions=False)
  File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 359, in _async_step
    await getattr(self, handler)()
  File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 559, in _async_call_service_step
    await service_task
  File "/usr/src/homeassistant/homeassistant/core.py", line 1480, in async_call
    task.result()
  File "/usr/src/homeassistant/homeassistant/core.py", line 1515, in _execute_service
    await handler.job.target(service_call)
  File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 719, in admin_handler
    await result
  File "/config/custom_components/tahoma/__init__.py", line 252, in handle_get_execution_history
    await write_execution_history_to_log(tahoma_coordinator.client)
  File "/config/custom_components/tahoma/__init__.py", line 306, in write_execution_history_to_log
    history = await client.get_execution_history()
  File "/usr/local/lib/python3.8/site-packages/backoff/_async.py", line 133, in retry
    ret = await target(*args, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/pyhoma/client.py", line 152, in get_execution_history
    execution_history = [HistoryExecution(**h) for h in humps.decamelize(response)]
  File "/usr/local/lib/python3.8/site-packages/pyhoma/client.py", line 152, in <listcomp>
    execution_history = [HistoryExecution(**h) for h in humps.decamelize(response)]
  File "/usr/local/lib/python3.8/site-packages/pyhoma/models.py", line 484, in __init__
    self.execution_sub_type = ExecutionSubType(execution_sub_type)
  File "/usr/local/lib/python3.8/enum.py", line 339, in __call__
    return cls.__new__(cls, value)
  File "/usr/local/lib/python3.8/enum.py", line 662, in __new__
    raise ve_exc
ValueError: 'DAWN_TRIGGER' is not a valid ExecutionSubType```

This requires a change in our underlying library... Unfortunately it doesn't show your commands currently.

How can you provide you the commands if the "tahoma.get_execution_history" is not working ?

@tetienne could you perhaps update pyhoma to https://github.com/iMicknl/python-tahoma-api/releases/tag/v0.5.13 if you have time some day? Otherwise, I will pick this up when I am back.

Hello,
I fixed the issue yesterday : the private life option is activate when the alarm is disactivated two time (through API or Somfy mobile app or token). But the private life option status is not retrieve actually. Is the v0.5.13 can correct that ?
When I try to install is through HACS, it tells me : Repostitory structure for v0.5.13 is not compliant

But the private life option status is not retrieve actually. Is the v0.5.13 can correct that ?
When I try to install is through HACS, it tells me : Repostitory structure for v0.5.13 is not compliant

5.0.13 of our underlying pyhoma library will only fix the tahoma.get_execution_history for you. It is now part of the latest master version of this integration, thus you could install that one to give it a try.

How can I install the 5.0.13 ?

How can I install the 5.0.13 ?

You cannot just install our underlying library, but as mentioned above it is part of our 'master' branch. https://github.com/iMicknl/ha-tahoma/archive/refs/heads/master.zip? Extract this file and place custom_components/tahoma in your custom_components folder.

Hello,
The status of the virtual shutter (private life) is still in a unknow state after the update :


improve disable introspection with conditional

Currently the disable introspection plugin didn't allow any customization / conditionals, for example, to only disable introspection if "X" authorization header is not present/allowed
I had to use Parameters<NonNullable<Plugin['onValidate']>>[0]['params'] because the params type was inlined, maybe it could be worth it to refactor all the plugins options types into their own interfaces

I had to use Parameters<NonNullable<Plugin['onValidate']>>[0]['params'] because the params type was inlined, maybe it could be worth it to refactor all the plugins options types into their own interfaces

Yeah, planned for next week :)


ut

Coverage increased (+2.5%) to 44.806% when pulling 311ae88fd550442826428e53dc799dd09e7be129 on lepdou:ut into 299049abefb83ba57539594845375de18af1505d on ctripcorp:master.

[Current coverage][cc-pull] is 42.31%
[][cc-pull]

No coverage report found for master at 299049a.

Powered by Codecov. Last updated by [299049a...cb16550][cc-compare]
[cc-base-branch]: https://codecov.io/gh/ctripcorp/apollo/branch/master?src=pr
[cc-compare]: https://codecov.io/gh/ctripcorp/apollo/compare/299049abefb83ba57539594845375de18af1505d...cb16550782f9bf604b570b6b6fbc6081e5287a2c?src=pr
[cc-pull]: https://codecov.io/gh/ctripcorp/apollo/pull/326?src=pr

Coverage increased (+2.5%) to 44.806% when pulling 311ae88fd550442826428e53dc799dd09e7be129 on lepdou:ut into 299049abefb83ba57539594845375de18af1505d on ctripcorp:master.

Coverage increased (+2.7%) to 44.939% when pulling 835fdcbbdb1a49309bbbf8ec09464f71b4ac291b on lepdou:ut into 9f15c41d096e093febae9a0f6d0bba7a8ab155b9 on ctripcorp:master.


Is there recovery for NFT / tokens pallet?

Something similar to social recovery pallet?

social recovery pallet should already works with NFT and tokens

Close as answered


Order Class

Hi,
I can't see the the .order-# class in bootstrap 4v0.0.6. I download the css file and use it directly
Please advice
Thanks,

Where did you get that css file from? What is 4v0.0.6? If that's v4.0.0-alpha.6 then it indeed does not contain it. You need at least the 4.0.0 release.

Thanks @alecpl downloaded wrong version


Kotlin: "invalid path argument"

Hi Rob,
I was using the newest libraries (avaje-http-javalin-generator:1.0, avaje-inject-generator:2.0 ) for a small new service that I wanted to build in Kotlin but it seams not to work.
My code is:
@Controller
@Path("/zipcode")
class ZipCodeController {
@Get("/zipcode/{zipcode}")
@Throws(NotFoundException::class)
fun getAddress(zipcode: String): ZipCodeResponse {
val zipCodeResult = QZipCode().zipCode.eq(zipcode).findOne() ?: throw NotFoundException("Zipcode not found")
    return ZipCodeResponse(
        zipCodeResult.zipCode,
        zipCodeResult.streetName,
        zipCodeResult.placeOfResidence
    )
}

}
Which then generates into a route file:
@Override
public void registerRoutes() {
ApiBuilder.get("/zipcode/zipcode/:zipcode", ctx -> {
  ctx.status(200);
  String zipcode = ctx.pathParam("zipcode");
  ctx.json(controller.getAddress(zipcode));
});

}
Then i go to the webpage and i get the "invalid path argument".
If I build the same in Java it works.
Also when I use a Get without parameters it also works in kotlin.
Now I am not sure if this is a issue with this libary or with Javalin itself.
Hopefully you know where the issue lies or can point where to look futher,
Tijs

Do you have a stack trace?
We could / should add a kotlin + javalin test module - that would be good.

Hmm... something weird happend I did not change anything except move from post back to get with the same settings as above and now it works.
I have no idea why but maybe because my computer was off for a few days. no idea....

Hmm... i see some other weird things which seem to disappear when restarting my computer / all intellij editors so maybe it is some weird caching issue...

Ok, closing for now.


feat: Coqui TTS and stage name cleanup

I added 2 things in this PR. Could make 2 but was too lazy:

added support for Coqui TTS https://github.com/idiap/coqui-ai-TTS which is free, offline(once downloaded) and gives far better result than pico2wav
clean up of stage names. I develop a mobile app to play studio stories. I do show stage names in many places. So it is better to have clean stage names

why the RE \d{13} ? I change to ^\d* *-? * used in https://github.com/jersou/studio-pack-generator/blob/main/generate/gen_missing_items.ts#L18

@jersou oh i did not know there was already such a regexp! thanks


White Background

OS version and name: Subgraph Aaron (based upon Debian Stretch
Hyper.app version: 2.0.0
Link of a Gist with the contents of your .hyper.js: https://gist.github.com/hThoreau/30cc4d9b171a6872e55badf36a4ddbb0

Issue
Hello there. Ever since 2.0.0-canary-12, My terminal displays white text over a white background.
And that's that.

So, this was because of a plugin, hyperterm-transparent-bg. And that wasn't listed in the gist I linked in my OP. So I'm sorry for that, I'm closing the Issue.

I was pretty sure that a plugin was responsible but perplexed by your gist 😄
Thank you for your last feedback! 🙏


ci: Automate generation and update of docs-builder image

The docs-builder image is used for the CI wofkflow for testing documentation. Each time we change the list of requirements (Sphinx dependencies etc.) or the Dockerfile for that image, we have to generate a new image to use in the CI workflow.
So far these images have been generated and pushed to Docker manually (thanks Joe!). But this is not fun or practical [citation needed]. This commit introduces a new CI workflow to generate and push a new image when relevant, and to update the documentation workflow with the new tag and digest.
For Pull Requests from branches of the cilium/cilium repository, we can add a new commit directly to update the image. For branches from external forks, we require an additional step from the PR author to update the image reference.
Fixes: #24019
Status: Currently a draft, because we're missing scripts and docs regarding the update for PRs with branches on external forks. Also, nothing has been tested yet.

Failed to log into dockerhub. I'm not sure whether we're going to be able to get the level of flexibility around bot write access to docker repos with DockerHub. Probably the next steps are then to switch to Quay.io instead:

[ ] Initialize a docs-builder repo on quay.io/cilium
[ ] Create new bot credentials for accessing that repo
[ ] Create a new environment with these credentials
[ ] Update this PR to change references for docs-builder to the new repo location
[ ] Update this PR to reference the new environment + credential names

(cc @aanm)

I've created https://quay.io/repository/cilium/docs-builder. If you configure the environment for the workflow for docs-builder and use the credentials from QUAY_DOCS_BUILDER_USERNAME and QUAY_DOCS_BUILDER_PASSWORD, it should be possible to push docs-builder images into that repository from here (via the environment, which requires @cilium/docs-structure approval to run the workflow).

Incremental diff
diff --git a/.github/workflows/build-images-docs-builder.yaml b/.github/workflows/build-images-docs-builder.yaml
index 01d1a7525dc5..bab24db224af 100644
--- a/.github/workflows/build-images-docs-builder.yaml
+++ b/.github/workflows/build-images-docs-builder.yaml
@@ -23,11 +23,11 @@ concurrency:
 jobs:
   build-and-push:
     timeout-minutes: 45
-    environment: release-base-images # To get access to AUTO_COMMITTER_*
+    environment: docs-builder
     runs-on: ubuntu-20.04
     steps:
-      - name: Checkout master branch to access local actions
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - name: Checkout main branch to access local actions
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
@@ -35,11 +35,11 @@ jobs:
       - name: Set environment variables
         uses: ./.github/actions/set-env-variables

-      - name: Set up docker buildx
-        uses: docker/setup-buildx-action@f03ac48505955848960e80bbb68046aa35c7b9e7 # v2.4.1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1

       - name: Checkout source code
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
@@ -58,22 +58,23 @@ jobs:
         id: docs-builder-tag-in-repositories
         shell: bash
         run: |
-          if docker buildx imagetools inspect docker://${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ steps.docs-builder-tag.outputs.tag }} &>/dev/null; then
+          if docker buildx imagetools inspect quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ steps.docs-builder-tag.outputs.tag }} &>/dev/null; then
             echo exists="true" >> $GITHUB_OUTPUT
           else
             echo exists="false" >> $GITHUB_OUTPUT
           fi

-      - name: Login to DockerHub
+      - name: Login to quay.io
         if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
+        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
         with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+          registry: quay.io
+          username: ${{ secrets.QUAY_DOCS_BUILDER_USERNAME }}
+          password: ${{ secrets.QUAY_DOCS_BUILDER_PASSWORD }}

       - name: Build docs-builder image
         if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v4.0.0
+        uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1
         id: docker_build_docs_builder
         with:
           provenance: false
@@ -81,7 +82,7 @@ jobs:
           file: ./Documentation/Dockerfile
           push: true
           tags: |
-            docker://${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ steps.docs-builder-tag.outputs.tag }}
+            quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ steps.docs-builder-tag.outputs.tag }}

       - name: Retrieve image digest
         if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
@@ -90,7 +91,7 @@ jobs:
           mkdir -p image-digest/
           echo "## docs-builder" > image-digest/docs-builder.txt
           echo "" >> image-digest/docs-builder.txt
-          echo "\`docker://${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ steps.docs-builder-tag.outputs.tag }}@${{ steps.docker_build_docs_builder.outputs.digest }}\`" >> image-digest/docs-builder.txt
+          echo "\`quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ steps.docs-builder-tag.outputs.tag }}@${{ steps.docker_build_docs_builder.outputs.digest }}\`" >> image-digest/docs-builder.txt
           echo "" >> image-digest/docs-builder.txt

       - name: Upload artifact digests
@@ -104,22 +105,24 @@ jobs:
       - name: Update docs-builder image reference in CI workflow
         if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
         run: |
-          Documentation/update-docs-builder-image.sh "docker://${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ steps.docs-builder-tag.outputs.tag }}@${{ steps.docker_build_docs_builder.outputs.digest }}"
+          Documentation/update-docs-builder-image.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ steps.docs-builder-tag.outputs.tag }}@${{ steps.docker_build_docs_builder.outputs.digest }}"
           git commit -sam "ci: update docs-builder"

       - name: Get token
         if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
         id: get_token
-        uses: cilium/actions-app-token@350a14155dd9be79227f081310f4d77fdf792e76 # v0.21.0
+        uses: cilium/actions-app-token@61a6271ce92ba02f49bf81c755685d59fb25a59a # v0.21.1
         with:
           APP_PEM: ${{ secrets.AUTO_COMMITTER_PEM }}
           APP_ID: ${{ secrets.AUTO_COMMITTER_APP_ID }}

       - name: Push changes into PR
+        env:
+          REF: ${{ github.event.pull_request.head.ref }}
         if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
         run: |
           git diff HEAD^
-          git push https://x-access-token:${{ steps.get_token.outputs.app_token<EMAIL_ADDRESS>env.QUAY_ORGANIZATION }}/cilium.git HEAD:${{ github.event.pull_request.head.ref }}
+          git push https://x-access-token:${{ steps.get_token.outputs.app_token<EMAIL_ADDRESS>env.QUAY_ORGANIZATION }}/cilium.git HEAD:"$REF"

   image-digests:
     name: Display digests

Looks like I've got something wrong

@joestringer Can you take a look, please? I can't find any obvious mistake in my YAML. Maybe I've got something wrong anyway, or maybe it has to do with the setup on either GH or quay.io? Let me know if there's any way I can help.

I updated the username and password again, maybe last time I got them around the wrong way or something. After re-triggering the workflow it appears to log in this time :tada:

Thanks a lot!
The update script failed to find the image in the workflow, because we still reference the Docker image in the documentation workflow description. I pushed a preparatory commit to change that.
Now the deployment is stuck on the PR update:

@joestringer Am I right in supposing that secrets.AUTO_COMMITTER_PEM and secrets.AUTO_COMMITTER_APP_ID are not available yet from the docs-builder environment?

That's right. @aanm are we able to add those credentials to the docs-builder environment as well?

Looks good this time! The auto-committer bot added a new commit to update the image, including the recent requirements changed from Dependabot (such robot team work).

The new commit re-triggered a deployment request and I accepted it to make sure it doesn't re-update (which didn't happen, so all good).
I'm going to remove the temporary commit I added to test the workflow on pull_request.

Rebasing to make CI happy

/test

OK so I got it working at last - sorry for the wall of logs on this page.

Successful deployment
Follow-up deployment with jobs skipped, given that we did not need to regenerate the image on top of auto-committer's commit.

Changes include:

We now have 4 jobs instead of 1. The drawback is that we need to approve the deployment twice, given that two of these jobs, running in a succession, use the docs-builder environment.

I also run the script in the Docker image that we have just generated (because it has both bash and git). This Docker image is modified by the PR author, but then so can be the script in the first place, and my understanding is that whatever the image contains, it still cannot access the environment from inside the container.

Incremental diff
diff --git a/.github/workflows/build-images-docs-builder.yaml b/.github/workflows/build-images-docs-builder.yaml
index 191f9d4c9657..b4157a621f0d 100644
--- a/.github/workflows/build-images-docs-builder.yaml
+++ b/.github/workflows/build-images-docs-builder.yaml
@@ -2,12 +2,13 @@ name: Docs-builder Image Build

 # Any change in triggers needs to be reflected in the concurrency group.
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - synchronize
       - reopened
     paths:
+      - .github/workflows/build-images-docs-builder.yaml
       - Documentation/Dockerfile
       - Documentation/requirements.txt

@@ -21,9 +22,13 @@ concurrency:

 jobs:
   build-and-push:
-    timeout-minutes: 45
-    environment: docs-builder
+    name: Build and push image
     runs-on: ubuntu-20.04
+    timeout-minutes: 30
+    environment: docs-builder
+    outputs:
+      tag: ${{ steps.docs-builder-tag.outputs.tag }}
+      digest: ${{ steps.docker-build-docs-builder.outputs.digest }}
     steps:
       - name: Checkout default branch (trusted)
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
@@ -45,11 +50,6 @@ jobs:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}

-      - name: Set up git
-        run: |
-          git config user.name "Cilium Imagebot"
-          git config user.email<EMAIL_ADDRESS>-
       - name: Generate image tag for docs-builder
         id: docs-builder-tag
         run: |
@@ -72,11 +72,12 @@ jobs:
           registry: quay.io
           username: ${{ secrets.QUAY_DOCS_BUILDER_USERNAME }}
           password: ${{ secrets.QUAY_DOCS_BUILDER_PASSWORD }}
+          logout: true

       - name: Build docs-builder image
         if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
         uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1
-        id: docker_build_docs_builder
+        id: docker-build-docs-builder
         with:
           provenance: false
           context: ./Documentation
@@ -85,32 +86,48 @@ jobs:
           tags: |
             quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ steps.docs-builder-tag.outputs.tag }}

-      - name: Retrieve image digest
-        if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
-        shell: bash
+  # Use a separate job for the steps below, to ensure we're no longer logged
+  # into Quay.io.
+  update-pr:
+    name: Update Pull Request with new image reference
+    needs: build-and-push
+    if: needs.build-and-push.outputs.digest
+    runs-on: ubuntu-20.04
+    timeout-minutes: 10
+    environment: docs-builder
+    steps:
+      - name: Checkout default branch (trusted)
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+
+      - name: Set environment variables
+        uses: ./.github/actions/set-env-variables
+
+      # Warning: since this is a privileged workflow, subsequent workflow job
+      # steps must take care not to execute untrusted code.
+      - name: Checkout pull request branch (NOT TRUSTED)
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up git
         run: |
-          mkdir -p image-digest/
-          echo "## docs-builder" > image-digest/docs-builder.txt
-          echo "" >> image-digest/docs-builder.txt
-          echo "\`quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ steps.docs-builder-tag.outputs.tag }}@${{ steps.docker_build_docs_builder.outputs.digest }}\`" >> image-digest/docs-builder.txt
-          echo "" >> image-digest/docs-builder.txt
-
-      - name: Upload artifact digests
-        if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
-        with:
-          name: image-digest docs-builder
-          path: image-digest
-          retention-days: 1
+          git config user.name "Cilium Imagebot"
+          git config user.email<EMAIL_ADDRESS>
       - name: Update docs-builder image reference in CI workflow
-        if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
         run: |
-          Documentation/update-docs-builder-image.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ steps.docs-builder-tag.outputs.tag }}@${{ steps.docker_build_docs_builder.outputs.digest }}"
+          NEW_IMAGE="quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ needs.build-and-push.outputs.tag }}@${{ needs.build-and-push.outputs.digest }}"
+          # Run in Docker to prevent the script from accessing the environment.
+          docker run --rm -v $PWD:/cilium -w /cilium "${NEW_IMAGE}" \
+              bash -c "git config --global --add safe.directory /cilium && \
+                       /cilium/Documentation/update-docs-builder-image.sh ${NEW_IMAGE}"
           git commit -sam "ci: update docs-builder"

       - name: Get token
-        if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
         id: get_token
         uses: cilium/actions-app-token@61a6271ce92ba02f49bf81c755685d59fb25a59a # v0.21.1
         with:
@@ -120,15 +137,47 @@ jobs:
       - name: Push changes into PR
         env:
           REF: ${{ github.event.pull_request.head.ref }}
-        if: ${{ steps.docs-builder-tag-in-repositories.outputs.exists == 'false' }}
         run: |
           git diff HEAD^
           git push https://x-access-token:${{ steps.get_token.outputs.app_token<EMAIL_ADDRESS>env.QUAY_ORGANIZATION }}/cilium.git HEAD:"$REF"

+  retrieve-digest:
+    name: Retrieve and upload image digest
+    needs: build-and-push
+    if: needs.build-and-push.outputs.digest
+    runs-on: ubuntu-20.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout default branch (trusted)
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+
+      - name: Set environment variables
+        uses: ./.github/actions/set-env-variables
+
+      - name: Retrieve image digest
+        shell: bash
+        run: |
+          NEW_IMAGE="quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/docs-builder:${{ needs.build-and-push.outputs.tag }}@${{ needs.build-and-push.outputs.digest }}"
+          mkdir -p image-digest/
+          echo "## docs-builder" > image-digest/docs-builder.txt
+          echo "" >> image-digest/docs-builder.txt
+          echo "\`${NEW_IMAGE}\`" >> image-digest/docs-builder.txt
+          echo "" >> image-digest/docs-builder.txt
+
+      - name: Upload artifact digests
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        with:
+          name: image-digest docs-builder
+          path: image-digest
+          retention-days: 1
+
   image-digests:
     name: Display digests
+    needs: retrieve-digest
     runs-on: ubuntu-20.04
-    needs: build-and-push
     steps:
       - name: Create image digest directory
         shell: bash

Given that we've come this far, it would probably make sense to split the docs-builder environment into two distinct ones, the first with the Quay.io login secrets, the other one with the auto-committer credentials, and to pass only the necessary secrets to each job. Cc @aanm

/test


Update dependencies to latest major versions

It's time to update to SVGO 1.x

Here my PR #58

Thanks!


Early stopping round = 0 doesn't disable early stop as described in the documentation

How you are using LightGBM?

Python package

LightGBM component: 2.3.1
Environment info

Operating System: Ubuntu
CPU/GPU model:
C++ compiler version:
CMake version:
Java version:
Python version: 3.7

LightGBM version or commit hash: 2.3.1
Error message and / or logs

In the Parameters documentation about early_stopping_round, it states "<= 0 means disable". However, when using the python API and passing early_stopping_round=0 in the params argument for train, the model actually stop at the first iteration that get worse instead of disabling the early stop.
In the source code for the python API, we can see that it only accepts None to disable early stop but not 0.
https://github.com/microsoft/LightGBM/blob/master/python-package/lightgbm/engine.py#L214-L215
Reproducible example(s)

import lightgbm as lgb
df = pd.DataFrame([[1, 1]]*100 + [[2, 2]]*100, columns=['x', 'y'])
lgb_train = lgb.Dataset(df[['x']], df['y'])
lgb_val = lgb.Dataset(df[['x']], -1*df['y'])
params = {'early_stopping_round': 0, 'metric': 'mse'}
lgb.train(params, lgb_train, valid_sets=[lgb_val])

You get
[1]	valid_0's l2: 9.3025
Training until validation scores don't improve for 0 rounds
Early stopping, best iteration is:
[1]	valid_0's l2: 9.3025

Suggestion
Either fix the documentation or fix the python api to disable early stop when early_stopping_round <= 0.

Thanks!


LoadData is crashing sometimes. Implement multithreading in LoadData also.

LoadData is crashing sometimes thus implement multithreading to it

Please refer to commit number 4c0a535d6fcb388eb2428645e65344231fd6f174.


Can state not be an object?

Sorry if I missed it in docs.
<!doctype html>
<html>
<head>
</head>
<body>
<script type="module">
import * as van from 'https://vanjs.org/code/van-0.11.0.js'

const { button, span } = van.tags

class Counter {
  constructor() {
    this.state = van.state({
      amount: 0
    })
  }

  onIncrementButtonClickFactory(self) {
    return (event) => {
      console.log(event)
      self.state.amount += 1
    }
  }

  onDecrementButtonClickFactory(self) {
    return (event) => {
      console.log(event)
      self.state.amount -= 1
    }
  }

  render() {
    const incrementButtonOnClick = this.onIncrementButtonClickFactory(this)
    const derementButtonOnClick = this.onDecrementButtonClickFactory(this)
    const incrementButton = button({ onclick: incrementButtonOnClick }, "👍")
    const decrementButton = button({ onclick: derementButtonOnClick }, "👎")
    return span(`❤ ${this.state.amount} `, incrementButton, decrementButton)
  }
}

window.addEventListener('load', function () {
  const node = document.body
  const counter = new Counter()
  van.add(node, counter.render())
})
</script>
</body>
</html>

I was trying to teach my friend who doesn't know programming how to use a really cool lightweight library like this while showing him basic concepts of HTML/JavaScript/ES6/frontend development. I couldn't discern from the docs how to make this work. this.state.amount is undefined(this.state.val.amount isn't but that feels wrong) and none of the events work.

Hi,
Thanks for reaching out! I am happy to answer your question. Are you able to post this question to our Discussions page? This way your question and my answer can be more discoverable by other VanJS users.


Submit Queue should show size of PRs

Both http://submit-queue.k8s.io/#/queue and http://submit-queue.k8s.io/#/prs should probably include size info (lines added/deleted).
This can be useful for build cop to get an idea of which ones might be good candidates for manual merges when the queue is struggling.

What do you think about just showing the label (size/M, for instance), instead of additions/deletions?

I think that'd work if easier.  Currently the cut off for XS is 10 lines, so that'd probably capture all the "trivial to merge" ones.

Done :)


Formula Bar while sorting should deal with symbols (suggestions) wrapped with single quote.

-Sorting of suggestion does not take into account that it can be wrapped in IdentifierDelimiter ' (i.e. 'AAD User' table)
-Since in lexicographic sort ' comes before any alphabet, all the suggestions starting with alphabet are buried at the end.
See below behavior in PowerApps

This is more of grief in Fx, since we add all the tables in a single org policy, which means the Accounts table gets buried after 100s of the table...

NOTE: The legacy bar did take into account that there can be symbols wrapped in a single quote ' and sorted it accordingly.

Would temporarily take care of this at the UFB level

Issue filed for UFB team, https://msazure.visualstudio.com/OneAgile/_workitems/edit/24935881

@jas-valgotar is this fixed now?

Fixed via https://github.com/microsoft/Power-Fx/pull/1854 and https://github.com/microsoft/Power-Fx/pull/1884


Pod is invalid when executing the updated YAML file

I followed the guide up until the "Deploy you Kubernetes Resources" section. I downloaded the deployment yaml file and made sure that the secretProviderClass was correct, "azure-kvname" as it has been when the SecretProviderClass was made. Below is what I was trying to run:

When I ran the "kubextl apply -f updateDeployment.yaml": I got these errors below:

I expected the application to be deployed so I can then see what the mounted secret is.
I'm confused as to why the Pod is invalid. Also, I'm using a Service Principal.
Environment:

Secrets Store CSI Driver version: latest:
Azure Key Vault provider version: latest:
Kubernetes version:

Client Version: v1.18.0
Server Version: v1.1510

Cluster type: AKS

Can you please validate the driver is running as expected, run the following command:
kubectl get pods -l app=csi-secrets-store

oh just noticed you are on k8s v1.15.10. As mentioned in the readme:
Recommended Kubernetes version:

For Linux - v1.16.0+
For Windows - v1.18.0+

@taytran0 Looks like you are using kubernetes version 1.15.10. The recommended kubernetes version is 1.16+ for this solution(https://github.com/Azure/secrets-store-csi-driver-provider-azure#install-the-secrets-store-csi-driver-and-the-azure-keyvault-provider).
The CSIInlineVolume feature gate is not enabled by default for 1.15 cluster and currently there is no way in AKS to enable feature gates.
So please try it out with 1.16+ kubernetes cluster.

Hello, thank you so much for pointing that out. How do I get the latest version for the server side. I have the client one for v1.18 but no matter what I do to update. The server version stays at v1.15. Please advise.

Disregard the last statement. I went into the Azure Portal to change it myself. I couldn't find a way to change it from CLI. I'm going to go through the whole set-up again to make sure this issue is closed for good. Thank you again!

Yes! The issue is now closed. Also, I didn't know this before but even though you may have updated your kubernetes cluster to 1.16+, the node pool will still be on the version you created it with so you have to go in and manually change that as well.


Settings Menu

Adds a settings menu to change some of the settings in the scoresaber config, available from a settings button on the PanelView.
Also adds the /around-region endpoint

manually merged due to the reverts, closing


Fuzz fosite config struct

We need a way to track if the fosite config grows new knobs for us to tweak.  The simplest approach to me would be to deterministically fuzz it and then encode it into JSON for diffing similar to:
https://github.com/vmware-tanzu/pinniped/blob/86865d155a4dff3a76b43b46deb9e16283290c3d/internal/fosite/authorizationcode/authorizationcode_test.go#L204

Decided not to pursue this implementation


mini.comment: support for block comments

Contributing guidelines

[X] I have read CONTRIBUTING.md
[X] I have read CODE_OF_CONDUCT.md

Module(s)
mini.comment
Description
Hi there! Would it be possible to implement block commenting, please?
I mean, for now, when you select some lines in visual mode, and press gc, all of them goes sommented by single line commentstring on each of that line.
But, for example, in https://github.com/numToStr/Comment.nvim you can type gb and comment the whole block with block comments, if it is supported (say, --[[...]] for Lua, and /*...*/ for C++, and so on).
// By the way, interesting thing: I tried to look in commentstring and comments while tested both mini.commentstring and Comment on Lua files, and there was only -- mentioned there, but somehow Comment anyway supports block commentaries syntax :shrug:

Hi there!

Hello! Thanks for your interest in 'mini.comment'!

Would it be possible to implement block commenting, please? I mean, for now, when you select some lines in visual mode, and press gc, all of them goes sommented by single line commentstring on each of that line.
But, for example, in https://github.com/numToStr/Comment.nvim you can type gb and comment the whole block with block comments, if it is supported (say, --[[...]] for Lua, and /*...*/ for C++, and so on).

Sorry, no. For at least these reasons:

There is no Neovim's built-in option which would provide information about appropriate block comment structure. Like 'commentstring' is for per-line comments.
Whole code base of 'mini.comment' is designed for per-line commenting. Adding block comment would mean its complete rewrite, which I don't find necessary yet.

// By the way, interesting thing: I tried to look in commentstring and comments while tested both mini.commentstring and Comment on Lua files, and there was only -- mentioned there, but somehow it anyway supports block commentaries syntax shrug

This is because 'numToStr/Comment.nvim' manually stores comment structure for supported filetypes and exactly what is out of scope for 'mini.comment'.

Thanks for reply, but:

There is no Neovim's built-in option which would provide information about appropriate block comment structure. Like 'commentstring' is for per-line comments.

Isn't https://neovim.io/doc/user/options.html#'comments' is a thing for providing such info?
Although, I'm not sure what mechanisms are filling it :shrug:

Isn't https://neovim.io/doc/user/options.html#'comments' is a thing for providing such info?
Although, I'm not sure what mechanisms are filling it shrug

Not exactly. 'comments' is not a definitive source of block comment format, more like a collection of line parts that need to adjust formatting in already present comments. Besides, it doesn't always provide single multiline format, which might be confusing.


SPIKE: Evaluate TF Plans for high risk changes and update review processes

User Story
As a MP Engineer
I want to add more unit testing for TF Plans using Conftest or similar technology
So that I can either block changes, warn PR reviewers, or request additional reviewers before changes are merged to main
Value / Purpose
Building upon the work in https://github.com/ministryofjustice/modernisation-platform/pull/6281 , this issue would take it further to start evaluating the output of Terraform plans and writing policies/tests that would either prevent or warn reviewers of high risk changes to specific resources.

Deleting certain threshold of TF resources
Deleting a specific type of resource
Updating a major version of a module

The result of these tests could block a change, add more detailed warnings for reviewers or even request another level of review.
It could also look at low risk changes and make it quicker for these kinds of changes to be merged.
One idea could be that we default to changes requiring 2 reviewers but if the changes are deemed low risk then the CI pipeline reduces required reviews to 1.
Useful Contacts
@richgreen-moj
Additional Information
No response
Proposal / Unknowns
No response
Definition of Done

[x] Agree timescale for SPIKE - limit to 3 days
[x] Experiment with writing policies that look for high risk changes to TF resources
[ ] Work with team to consider whether a new branch protection rule would be appropriate for high risk change
[ ] User docs have been updated
[ ] Another team member has reviewed

Some options to consider:
1 - Create a script that is added to all workflows running terraform which evaluates the plan and adds comments to the PR with warnings if sensitive resources are due to be deleted or a high number of destructive changes are due to be made (e.g. over X amount of resources will be deleted). The possibilities of what to warn for are endless and could be added to over time.  This would be easy to implement and low impact on workflow (i.e. it's just a warning).
2 - Simulate the TF Plan Evaluator script and logic used in the MP Environments repo which won't allow you to apply TF changes that are highlighted in the script unless a second GH team has reviewed the PR (i.e. MP team). This works on the basis that the plan and apply steps are linked in a workflow reusable_terraform_plan_apply.yml and the job 'fails' at the plan stage until a specified extra reviewer group has approved the PR. Once the extra review is done the 'apply' phase will run on a subsequent re-running of the workflow.
To do this on MP we would need to create a new GH team (maybe called "MP Reviewers") with either all the existing MP members (or a select few if desired e.g. architects/leads?) which would need to approve certain PRs if the changes were deemed risky by the evaluator script. Essentially it would up the required reviewers to 2.
(In theory you could have a script that would temporarily change the number of required reviewers in the repository settings but as we have so many workflows that can be running concurrently I don't think it is a suitable strategy).
There's not really an easy way currently to dynamically change the amount of reviewers required to merge a PR. You can use a CODEOWNERS file and reference multiple reviewers but that's still tied to the overall number of required reviewers (currently set to 1 in our repo)

I ran a session with the team today to show what I had done for the spike. I demoed the OPA tests I'd written that query the json output of TF plans and error if;

a threshold of resources are marked for delation (e.g. > 50)
a list of sepcidied resources are marked for deletion or
resources that match a particular tag are marked for deletion

We then discussed the two options listed in the previous comment;
1 - People seemed to think that warning messages in PRs would be good and also potentially the ability to output a TF plan into the PR message would be useful as it saves you having to dive into logs.
2 - I described the potential for us copying the process in MP Envs where certain changes are evaluated and require an extra review and whether we should do similar. This was not popular as it could be hard to decide on what kinds of changes require extra reviews, potentially all the changes we make can have quite an impact so it might just be too disruptive to the workflow.
I also briefly explained a bug which I think means that currently members can merge in changes we want MP to review as the workflow only warns and raises a comment it doesn't change the threshold of required reviews in branch protection rules. We agreed that it should be fixed especially if it is as simple as adding a required status check.
We also agreed that a reusable TF plan/apply job like the one in MP Envs repo might be worth applying to our MP workflows just so it is easier to maintain and build in extra steps e.g. the ability to post plans to the PR or other warnings.
Outcomes:

Write story for creating a re-usable terraform plan/apply job for use across the various MP Terraform workflows

it should have ability to post plan output to PRs
it could have an extra warning message on PR if certain resources are being deleted

Raise a bug to fix potential issue in MP Envs repo where members can merge PRs to main without MP approval


[Device Support Request] _TZE200_c2fmom5z", "TS0601

This new Tuya Air Box seems to be similar to the existing TuyaCO2SensorGPP class(ts0601_air_quality.py), I could get the sensor up and working just by adding the new model info entry.
    MODELS_INFO: [
        ("_TZE200_ryfmq5rl", "TS0601"),
        ("_TZE200_yvx5lh6k", "TS0601"),
        ("_TZE200_dwcarsat", "TS0601"),
        ("_TZE200_c2fmom5z", "TS0601"),
    ],

However it seems that the VOC and HCHO sensor values position are swapped? Unless the VOC sensor excludes HCHO values in the calculation, I get impossible HCHO to VOC ratio.
For example
VOC: 8 µg/m³
HCHO: 19ppm (assuming unit is wrong and should be ppb, 19 ppb of HCHO is 0.023 mg/m3 which is way above the 0.008 mg/m3

You should post the device signature so that people can better help.

"node_descriptor": "NodeDescriptor(logical_type=<LogicalType.Router: 1>, complex_descriptor_available=0, user_descriptor_available=0, reserved=0, aps_flags=0, frequency_band=<FrequencyBand.Freq2400MHz: 8>, mac_capability_flags=<MACCapabilityFlags.AllocateAddress|RxOnWhenIdle|MainsPowered|FullFunctionDevice: 142>, manufacturer_code=4417, maximum_buffer_size=66, maximum_incoming_transfer_size=66, server_mask=10752, maximum_outgoing_transfer_size=66, descriptor_capability_field=<DescriptorCapability.NONE: 0>, *allocate_address=True, *is_alternate_pan_coordinator=False, *is_coordinator=False, *is_end_device=False, *is_full_function_device=True, *is_mains_powered=True, *is_receiver_on_when_idle=True, *is_router=True, *is_security_capable=False)",
"endpoints": {
"1": {
"profile_id": 260,
"device_type": "0x0051",
"in_clusters": [
"0x0000",
"0x0004",
"0x0005",
"0xef00"
],
"out_clusters": [
"0x000a",
"0x0019"
]
},
"242": {
"profile_id": 41440,
"device_type": "0x0061",
"in_clusters": [],
"out_clusters": [
"0x0021"
]
}
},
"manufacturer": "_TZE200_c2fmom5z",
"model": "TS0601",
"class": "zigpy.device.Device"
}

I also have this device, device signatures seem to match
{
  "node_descriptor": "NodeDescriptor(logical_type=<LogicalType.Router: 1>, complex_descriptor_available=0, user_descriptor_available=0, reserved=0, aps_flags=0, frequency_band=<FrequencyBand.Freq2400MHz: 8>, mac_capability_flags=<MACCapabilityFlags.AllocateAddress|RxOnWhenIdle|MainsPowered|FullFunctionDevice: 142>, manufacturer_code=4417, maximum_buffer_size=66, maximum_incoming_transfer_size=66, server_mask=10752, maximum_outgoing_transfer_size=66, descriptor_capability_field=<DescriptorCapability.NONE: 0>, *allocate_address=True, *is_alternate_pan_coordinator=False, *is_coordinator=False, *is_end_device=False, *is_full_function_device=True, *is_mains_powered=True, *is_receiver_on_when_idle=True, *is_router=True, *is_security_capable=False)",
  "endpoints": {
    "1": {
      "profile_id": 260,
      "device_type": "0x0051",
      "in_clusters": [
        "0x0000",
        "0x0004",
        "0x0005",
        "0xef00"
      ],
      "out_clusters": [
        "0x000a",
        "0x0019"
      ]
    },
    "242": {
      "profile_id": 41440,
      "device_type": "0x0061",
      "in_clusters": [],
      "out_clusters": [
        "0x0021"
      ]
    }
  },
  "manufacturer": "_TZE200_c2fmom5z",
  "model": "TS0601",
  "class": "zigpy.device.Device"
}

What other information would you need to get this added?

New to HA and also have this device. I have an identical signature to that which @egelmex provided. The device is detected and added but of course shows no useful sensor information from HA's perspective.
Please let me know if there's any additional steps I should take or information I could provide. :-)

Looks like this was fixed in #2073


Burger icon not hidden when menu is opened

Unlike the demo page the burger icon isn't hidden when the menu is opened (the  tag doesn't get a burger-hidden class). Is this added as a custom feature on the demo page? If so could this be added as an option?

Hi there @jsArgus!
This addon doesnt actually handle how you you show / hide your menu icon. That is totally up to you but it does provide you all the information you need. Feel free to checkout the demo code to see exactly how it was done.
Below is the handlebars code used:

And this is the SASS:
.hamburger {
  opacity: 1;
  transition: opacity 0.3s;
  -webkit-transition: opacity 0.3s;

  &.burger-hidden {
    opacity: 0;
  }
}

Pretty simple 😄

Great, thanks! It was a bit unclear to me what the addon is supposed to take of.


Update the Vienna database with the new Vienna URL

The simplest solution was incrementing the db schema by 1 and adding a new migration case to db version 19.
The new migration case finds an existing Vienna Developer's blog entry in rss_folders
and updates both the feed_url and the home_page columns with the correct vienna-rss.com based urls.
Closes #808

I just see this error:
Warning: there is at least one open result set around after performing [FMDatabaseQueue inDatabase:]

Is that related/expected?

Oh I didn't see that. Add a [db close] after and see if it goes away?

Then I get this:
The FMDatabase <FMDatabase: 0x600000094050> is not open.
__27-[Database initFolderArray]_block_invoke: executeQuery error: out of memory

Oh sorry it should be [results close]; and put it before [db setUserVersion:(uint32_t)19];

Yep, no more warnings/errors.

@Eitot, please push the correction to your db-url-update branch.

@barijaona you can rebase directly from the GitHub UI

Cool it works 😁 (when there are no conflicts anyway...)

The correction should be cherry-picked to your legacy-db-url-update branch too.


Add twelsah2011's file

I have created a branch, created a file and made a commit, and opened a pull request

ok

ok


Fix CDIForwardTest

This test in isolation is fine. You can run it in a loop endlessly and it will never ever fail.
In the current setup it fails because a ton of different tests and artefacts are put on the same class path.
There's two solutions:

Isolate them all into individual modules
Delete them and run https://github.com/javaee-samples/javaee7-samples/tree/master/jaspic

What if we change the default beans.xml from Piranha Micro? Currently, we use an empty to indicate an explicit bean archive. However, I was thinking to change to a "Trimmed Bean Archive". I think this solves this issue and will enable some applications, like Jenkins to not have any exception from wrong injections and startup correctly.
For example:
<beans>
    <trim/>
</beans>

I'm just not sure what the specs say about using it by default.

We need to make it so both the ServletExtension and Tomcat9Extension will not enable CDI unless someone adds a CDI runtime themselves. The MicroServletExtension which is forwarding looking (assuming CDI will be enabled by default in a future Servlet specification) will have CDI enabled.

Tests removed


Fix fixie deploy/fixie serve --venv when using relative paths

subprocess.run changes the directory before running the executable, so we need to make sure the executable path is made absolute.

(This is why fixie deploy agents/x --validate is failing in the fixie-examples repo.)


Add the note about IP address to the README

When you connect to the app and then attempt to retrieve credentials via get_devices.py, if you are on different networks (i.e. your phone is on mobile), you will get "Unable to authenticate user" error.
Once you login on the same network, it will work as expected.

This should be resolved by the latest release! Marking as closed, but I'll still monitor for replies and reopen if needed!


Revisit requirement that inputs to real, imag, and conj be complex-valued

gh-427 summarizes the rationale for requiring that inputs to real, imag, and conj be complex-valued:

This PR chooses to be more restrictive based on the premise that consumers should be explicit when performing a complex number operation (e.g., if real-valued inputs are allowed, was calling real(x) intentional when providing a real-valued x or was this an unintended bug where x should have been complex valued?). Given potential ambiguity between intended versus unintended behavior, this PR places the onus on consumers to resolve this ambiguity.

https://github.com/data-apis/array-api/pull/446#discussion_r991577991 states that this is open to being revisited.
If the concern is ambiguity between intended and unintended use, was there a similar discussion for functions that are no-ops for integers, such as round and isinf? It looks like the initial commit that added rounding functions already included the special case for integers, but I couldn't find a discussion about it.
Perhaps it didn't come up because it is common for code paths that work on floating point dtypes to also be used for integer dtypes. In the same way, I'd suggest that code for complex dtypes can also be valid for real dtypes. If it is not easy to tell whether unintended or intended uses of these functions on real data is more common in the wild, perhaps the precedent set by NumPy and other libraries (e.g. CuPy, JAX, PyTorch, Dask Array, Tensorflow) is not wrong, and these functions can allow real input.

Has this come up in real-world code? I can definitely see wanting to write functions that work on both real and complex dtypes. But I also am curious how often a complex implementation can be directly reused for a real implementation.

Yes. I have a complex number that is the logarithm of a negative number. I take the real component to get the magnitude.

Wouldn't real(log(x)) return nan if x is a negative real?

It would if x has a real dtype. Let's expand the definition of "real" to include complex dtype with zero imaginary component.

There must be a misunderstanding here. real is already supposed to work on any array with a complex64 or complex128 dtype, regardless of what the value of the imaginary component is. The above discussion was specifically about whether it should work on float32 and float64 arrays.

Another example is the norm of a real or complex vector implemented in terms of the dot product of the vector and its conjugate.

This is a better example I think. x @ conj(y) would just work and give the right thing for real x and y if conj(y) was a no-op.

There must be a misunderstanding here.

It seems so. But all that's important is that in my application, there are real and complex dtypes going through the same code, and real is needed for the complex dtypes, so it would be convenient for real to work on both real and complex dtypes. So it is relevant to this discussion.

This is a better example I think.

Sure, it's simpler. The other example suggests that there may be other more exotic - but also valid - use cases out there.

It definitely make sense to me for conj. I guess you could argue real and imag should probably just work the same.
Your example real(log(x)) doesn't make sense to me, because you would have to either do real(log(astype(x, complex128))) or else branch like
if isdtype(x.dtype, 'real floating'):
    return log(abs(x))
else:
    return real(log(x))

but maybe there are better examples for real and imag. If you're using any function that maps real numbers to non-real numbers (like log, sqrt, etc.), then you have to do something like this, because on floats they will just return nan, but if you aren't, then real numbers should just pass through fine.

For real, imag, and conj, I am not sure the real benefit apart from saving some character strokes. If your code needs to support real and complex dtypes, one can explicitly cast by doing
re = xp.real(xp.astype(x, dtype='complex128', copy=False))

where copy=False ensures that if the dtype matches, the operation is a no-op. Graph-based libraries would also be able to determine whether real(astype(<real>)) is necessary. Only eagerly executed libraries such as NumPy may perform an extra copy by casting real to complex.
It would be useful to see an explicit use case beyond a toy example of where sharing the same code path for real and complex is necessary and performance critical.

I think the conjugating dot product is a legitimate enough use-case. You can have an expression that's exactly the same for complex and real inputs except for the conjugation, which is actually a no-op on real numbers. So you'd have to have something like
if isdtype(x.dtype, 'complex floating'):
    <expression with conj>
else:
    <same expression without conj>

Or do some trick like conj = positive. But if conj(x) just returned x for non-complex dtypes you could just use the single expression without the branching.
Also note that casting to complex is the wrong solution here. That does have a real performance impact. Not only do complex arrays take up more memory, but a complex algorithm on an array with 0 imaginary part will be much slower than a real algorithm on an equivalent float array. For example:
In [1]: import numpy as np

In [2]: a = np.linspace(0, 10, 1000)

In [3]: b = a + 0j

In [4]: %timeit np.sqrt(a)
450 ns ± 2.88 ns per loop (mean ± std. dev. of 7 runs, 1,000,000 loops each)

In [5]: %timeit np.sqrt(b)
3.88 µs ± 8.78 ns per loop (mean ± std. dev. of 7 runs, 100,000 loops each)

This is only the correct thing to do in cases where you don't get the same expression for real inputs, like the log example (and even for that example, branching and doing log(abs(x)) instead is probably better).

Thanks @asmeurer.
I think another thing that worth mentioning is that a lot of array API standard code is translation from existing code, and in these cases it may be preferable to translate than to rewrite the code at will. For instance, I brought this up when translating a file (with working - but possibly sub-optimal) NumPy code that has 11 uses of np.real or <array>.real. In at least some of those cases, the dtype can be real or complex, and apparently the code works. So when I am making hundreds of other adjustments for the array API standard, I don't really want to:

reconsider whether the existing structure is optimal and refactor accordingly,
investigate all uses of .real individally to determine which ones can potentially have real input, or
add ternaries for all 11 uses of .real. (I can - and did - wrap real so that it behaves as I'm suggesting.)

All the little changes can add up to a lot of time, so I thought revisiting this might save others time in the future. (It could indeed be the other way - that by being stricter than the existing array libraries, this prevents bugs - but I don't have data about that.)

Another thing to consider is that astype() is explicitly disallowed from casting complex inputs to real inputs (see note 2 at https://data-apis.org/array-api/latest/API_specification/generated/array_api.astype.html#astype). So real() should be considered the canonical way to get the real part of a complex array. One could then argue that, like astype, it should function as a no-op for arrays that are already real.
There is also a question of imag(). imag on a real array would just be an array of zeros, which would make it not completely cheap (I suppose it could be done as a broadcasted scalar, but that would lead to unexpected behavior under mutation). On the other hand, I think it makes more sense to keep imag consistent with real and conj.
By the way, just so we're clear, are you also suggesting that these functions should operate on integer arrays, or only on real floating-point arrays?

I have also encountered the usability issue with conj() a few times already (also x @ conj(y.T indeed) - being able to write generic code across real and complex dtypes is nicer indeed, we should make this change in my opinion.
For real() I also agree with the arguments given - it's easier to write generic code, and it saves developer time. It's possible that the user wrote code that isn't supposed to work with real inputs, but I haven't seen evidence of this and I don't consider it a risk high enough that it should be prevented by design.
imag() is more tricky. The usages I looked at so far at were either handling only complex code, or were doing not-so-useful things for real inputs (e.g., explicitly comparing x.imag with an array of zeros in tests), or were better rewritten with an explicit if isdtype(x.dtype, 'complex floating'): ... else: ....

There is also a question of imag(). imag on a real array would just be an array of zeros, which would make it not completely cheap (I suppose it could be done as a broadcasted scalar, but that would lead to unexpected behavior under mutation).

This is the problem indeed. It's bad API for a function like np.imag to return a view on existing data for complex inputs, and create a new array for real dtypes. It's both a non-obvious performance footgun and a potential issue with the semantics. When you're dealing with large arrays, having something go from O(1) performance to allocating a lot of memory is not good. In the majority of cases, you want to skip the computation completely for real input, or do the relevant computations with a size-1 array or Python scalar instead.
In the (relatively rare I think) cases where this is the desired semantics:
if isdtype(x.dtype, 'complex floating'):
    imag_component = x.imag
else:
    imag_component = xp.zeros_like(x)

it seems better to let the user write that out explicitly.
For completeness, performance:
>>> x = np.random.default_rng().standard_normal(10_000_000)
>>> x.dtype
dtype('float64')
>>> xc = x.astype(np.complex128)

>>> %timeit xc.imag
50.3 ns ± 0.154 ns per loop (mean ± std. dev. of 7 runs, 10,000,000 loops each)
>>> %timeit x.imag
4.43 ms ± 74 µs per loop (mean ± std. dev. of 7 runs, 100 loops each)

and create a new array for real dtypes

Would it have to, or could it be implemented view of a single element? Surely it would not be writeable.

Would it have to, or could it be implemented as a view of a single zero element?

In principle it could be aliased memory from broadcasting a size-1 array indeed. However, (a) NumPy isn't going to make that change I think, and (b) that still has mismatching semantics where imag(x_real) would not be writeable or have incorrect semantics under mutation for libraries that don't have read-only arrays, while imag(x_complex) is writeable. Switching semantics based on the dtype of the input array is also not good.

It should not be writeable anyway, since the original array would still be of real dtypes, so the imaginary part could not be anything other than zero.

Currently the returned array is writeable, so there'd be a backwards compat concern for NumPy et al. too.

The latest version of torch does allow real and conj but not imag on real arrays:
>>> torch.real(torch.tensor([1.]))
tensor([1.])
>>> torch.conj(torch.tensor([1.]))
tensor([1.])
>>> torch.imag(torch.tensor([1.]))
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
RuntimeError: imag is not implemented for tensors with non-complex dtypes.

We agreed at the meeting today that it makes sense to allow real dtype inputs to real and conj, but to leave imag as only specified for complex inputs.

FWIW generally agree and am sympathetic to the arguments Matt makes here. Also agree with Ralf that real and conj make the most sense

and create a new array for real dtypes

Would it have to, or could it be implemented as a view of a single zero element? It should not be writeable anyway, since the original array would still be of real dtypes, so the imaginary part could not be anything other than zero.

While this is possible, have seen NumPy's masked array also take this approach. As a past user of it, have found some of the resulting code around this to be surprising. When does it choose to expand that value? What happens when working with views/slices of the data? Not always consistent and clear to the user. So would caution this approach


Fixed #32490 -- Added base36 URL path converter

Added base36 to the list of default URL path converters, based on
django.utils.http.base36_to_int. It allows shorter URLs for integer
values that are easier to type (easier to keep one's place than in a
longer string of only numbers).

Closing as per comment on ticket-32490.


Allow to edit recipients

Allow to edit the recipient emails in the team page

Apart from some minor comments I would use the typed recipients API instead of the untyped one, I created a PR here to modify the code to do so. If you agree you can just merge that PR into this one.


[Feature Request] Add dynamic thresholding extension settings to image generation data

Hello, first thank you for the extension
As it is now if you were to copy the generation data contained in the image and run it in a different instance that don't have it enabled with the exact same settings of the original , the resulting image would be different
It would be helpful if the images generated while the extension is enabled contained all the settings of the extensions .
thank you.

Yep, good point! Added.


Cyclic dependency detection

The detection of cyclic dependencies still is an issue. The connection of the nodes shown in the image should work but is refused by the current cycle detection.

I think the condition to check could be summarized like this:
A cyclic dependency should be detected if any OutputSocket of a Node has a indirect/direct path to any of its InputSockets. The path leads through OutputSockets only.
Does this cover all cases?

This should do the job... hopefully :)
Maybe there are more elegant or faster solutions.
`		public bool HasCycle() {
foreach (var node in _nodes)
{
StartVisitRun(); // resets visit counter
bool foundCicle = IsConnectedToItself(node);
EndVisitRun();
if (foundCicle) return true;
}
return false;
}
	/// <summary>
	/// This method returns true is a node is connected to itself along the output path.
	/// Reset the 'VisitCount' counter of each node before calling! Call this
	/// method ignoring the optional parameter. This is used internaly for recursion.
	/// <param name="searchForNode">The node you want to check</param>
	/// <param name="recursionNode">Do not use this parameter or assign null</param>
	/// </summary>
	private bool IsConnectedToItself(Node searchForNode, Node recursionNode = null)
	{
		bool firstRun = recursionNode == null;
		if (firstRun) recursionNode = searchForNode;
		if (!firstRun && recursionNode == searchForNode) return true; // visited the first node after recursion
		if (recursionNode.VisitCount > 0) return false; // already checked
		recursionNode.VisitCount++;

		foreach (var socket in recursionNode.Sockets) // follow the OutputSockets of the node
		{
			if (socket.IsOutput() && socket.IsConnected())
			{
				OutputSocket outputSocket = (OutputSocket) socket;
				foreach (var edge in outputSocket.Edges) // check every edge
				{
					if (edge.Input.Parent != null && IsConnectedToItself(searchForNode, edge.Input.Parent)) return true;
				}
			}
		}
		return false;
	}

`


log4j vulnerability

Hello,
This image is concerned by the log4j vulerability
docker scan secoresearch/fuseki | grep log4j

  Upgrade<EMAIL_ADDRESS>to<EMAIL_ADDRESS>to fix
  ✗ Arbitrary Code Execution (new) [Critical Severity][https://snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720] in<EMAIL_ADDRESS>    introduced by<EMAIL_ADDRESS>
Can you upgrade the fuseki version to 4.3.1. This version fix the issue (upgrade log4j to 2.15)

Thanks for the update !
Could you also re-build the dockerhub image ? https://hub.docker.com/r/secoresearch/fuseki/tags
thanks !

Docker Hub images have now been rebuilt!
https://hub.docker.com/r/secoresearch/fuseki/tags


remove ONS link from DOS4 framework

This removes the ONS link as per https://trello.com/c/6b806g3r/40-remove-map-pdf-from-dos-brief-where-supplier-will-work
(I also removed it from the supplier questions, as it is assumed we would not want these links either in future iterations of the framework)

🔥I love deleting things.
This will need the version number updating so we can pull it into the apps - for this repo it's in package.json.


2023 Time display showing result scores

Tasks to be addressed in this issue:

Fix the time display to the correct times from before
Find a way to display the actual results as well?

Modifications are to be made in ScheduleReader.js


module not found error when trying to use icons from lucide-react library

I have a next.js app that i am building but for some reason when i try to use the icons from lucide-react i get this module not found error when i try to run the app.
import { Button } from "@/components/ui/button";
import { Menu } from 'lucide-react';

const Navbar = () => {

    return (

        <header className="flex items-center p-4" >
            <Button variant="ghost" size="icon" className="md:hidden" >
                <Menu />
            </Button>
        </header>
    )
}

export default Navbar;

and i am using  the latest version of lucide-react which was installed when i configured the shadcn "library" in my project

found a solution in a discord server that i was in, they suggested to downgrade to a previous version of  lucide-react.
"lucide-react": "^0.263.0",

Something wrong with the latest version of the compatibility with the next.js
"next": "13.4.13",


Added comment for INTERNET permission in Android manifest

Fixes https://github.com/flutter/flutter/issues/6834
@eseidelGoogle @Hixie

We should say more, e.g. that the flutter tool uses it to communicate with the running application to provide hot reload, etc.

Sure, want me to put just that, or do we have an official list features requiring this permission?

If this patch is good to go. Can we land this?

Really cool, thanks for the patch!


cannot move viewport container with tilemap

Godot version:
3.1.1
OS/device including version:
Windows 10
Hello,
If you have a tilemap inside a viewport container you cannot move the container. It just moves everything. I have to take the map out, move the container, then put it back. As per screenshot below. To recreate, simply do as the picture and try to move the container.
To be honest, it might be that it's because the tilemap is inside the viewport container as per the screenshot and I shouldn't be doing that. I've been at this a week now simply trying to make my tilemap only display in a portion of the screen (with another viewport above it showing score, etc) and went round and round in circles trying to figure it out. There are no examples or templates, no valid samples on youtube now things have changed, no details on how containers/viewports/cameras are meant to be set up (e.g. I found out just yesterday that a viewport will only display to the screen when inside a viewport container and that is not documented). When you look at the documentation there really is nothing: This is the entire sum of the documentation for viewportcontainer: "A Container node that holds a Viewport, automatically setting its size.", nothing else!
I tried reddit, then facebook then the internet and literally nobody had an answer on how to use viewports in 3.1.
As an aside, please do something with the documentation on viewports, viewport containers and creating multiple viewports...

Does it work if you create a TextureRect node and assign a ViewportTexture to it?

I have no idea, I'm just struggling to figure out having multiple viewports and individually sized viewports. Every single sample, every demo, every game I see all people do is create a single viewport taking up the whole screen.
The only sample I found was on 'kids can code', but all that code does not work now as it's out of date.

I think this is an issue of understanding what a Viewport is and how it works rather than being a bug.
I have started a draft on using multiple Viewports. The draft has been sitting on my computer for a few weeks now, but I plan to have it finished before the release of 3.2.

Thanks. This will be appreciated by many :)
The main issue I had is it's very particular in that I had to create a vertical/horizontal container, inside those put a viewport container, then put in that a viewport, then in that a tilemap and a camera, then set up for every level the right anchor and sizing. Then repeat for my second viewport. Missing a single thing or doing it slightly wrong results in completely nothing, or in my case a giant grey rectangle on the screen you cannot get rid of and is very difficult to diagnose.
Apart from making this simpler (after all that is what Godot tries to excel at, e.g. higher level viewport nodes) and I expect this has been suggested before, what is needed is a 'scene generator'. I'm not talking about prefabs, and not a 'godot template', but more a way inside the IDE (e.g. an extra tab beside Scene tab) to select from a list of curated scene templates that produce and insert into the current project a scene complete with nodes, e.g. 'fire shader', '2d platform controller'.
Imagine that :)

In terms of documentation, this shows correct usage of sub-viewports: https://docs.godotengine.org/en/stable/tutorials/rendering/viewports.html#viewport-container
Closing.


How to prompt for passphrase on Trezor T

Trezor T users seems to enter the pin before the device it can get enumerated.
However, I would like them to enter the passphrase after I can enumerate it. How do I prompt them to enter the password on the device?

Doing a getxpub (or getmasterxpub) will prompt the Trezor T to ask for the passphrase.

thanks a lot!

This seems to be broken in 2.0.0. I think it might be a firmware issue as well.

@stevenroose Are you on the latest firmware? If not, update and try again. If yes, please report the version number.

There was something probably broken in trezor, but I don't think that's related to hwi 2.0
https://github.com/btcpayserver/BTCPayServer.Vault/issues/29

This seems to be broken in 2.0.0. I think it might be a firmware issue as well.

Fix probably in https://github.com/bitcoin-core/HWI/pull/495

Yeah I can confirm that #495 fixes this.


[RPC] getaddressbalance returns staked value

Adds count of staked coins for the output of getaddressbalance

gitian build bot not working on this one?

Might still be running: https://build.nav.community/binaries/getaddressbalance-staked/
Looks like some of the builds are done, but not all

A new build of f5aa5898e136cf5cc1cbd072f3ab976f9c15af3b has completed succesfully!
Binaries available at https://build.nav.community/binaries/getaddressbalance-staked


[bug] campfort set altitude to 8

launch bot as
python pokecli.py -af configs/auth.json -cf configs/config.json -cf configs/config.json.campfort.example
bot set altitude 8 m
instead if use
python pokecli.py -af configs/auth.json -cf configs/config.json
bot start with altitude as configured in config

i duplicated the configfiles
close issude due to new app version will ban all here :-D


Develop and Run SAP Fiori Application With SAP Business Application Studio

Tutorials: https://developers.sap.com/tutorials/abap-environment-deploy-cf-production.html
In step 8 there is no
Service Type: OData IWSG
available.
What can I choose instead?
It seems to be the OData V2 (deprecated) service.
Many thanks

Hi @klickerlebnis ,
thank you for your feedback.
The screenshot has changed. OData V2 (deprecated) should be the one.
We will update this as soon as possible.
Best regards,
Merve

Hi @MichaelCzcz  ,
I created following pull request: #6834. Can you merge my pull request?
Thank you in advance.
Best regards,
Merve


Importing data.dump

I'm having issues trying to import data.dump into pgadmin4. I've also tried loading it to MySQL workbench with no success. Any chance that this file comes in .csv or in a different file format?

Greetings,
Could you also tell me what operating system you are on, and what the exact error you're getting when you try to upload the data?

I'm working on macOS Catalina (10.15.3).
Error I get:
Gabes-MBP:~ postgres$ psql <data.dump -bash: data.dump: No such file or directory
Tried to calling the directory, then calling psql. Also tried with psql logged in and then calling the directory and got same result. Also tried through pgadmin4 via the "Restore" command which didn't seem to load the tables.

Any ideas or other solutions to importing the file or getting different file formats?

@GGarrido28, that error indicates your not in the same folder as the file data.dump. Change directory to where that file is and try again.

As I mentioned before, I had already tried that. The instructions in the book seem to be missing a few steps as I was able to figure out how to load the file after searching for other sources. For future users, these are the steps I took:

Created a new user with admin access in pgAdmin4
Created the sqlda database within pgAdmin4
Ran this terminal command within the folder that had the dataset
 PATH=/Library/PostgreSQL/12/bin:$PATH
Then I ran this
Gabes-MBP:Datasets gabe$ psql -U gabe sqlda < data.dump
To which then prompted me for my password. Then it finally created all the necessary tables.

I did get some role errors after executing the import:
ERROR:  role "sqldaadmin" does not exist
ERROR:  role "rdsadmin" does not exist
Not sure the importance of them and whether they are needed to follow along with the book, but it appears that everything that is needed was created.


hide 'trade with' from player menu options

like how you can remove the report/lookup menu options... so only 'follow' would appear when right clicking?

not that i am aware of sir

Would be immersive for Ironmen btw.

Hiding menu entries is listed here, so closing as wontfix: https://github.com/runelite/runelite/wiki/Rejected-or-Rolled-Back-Features


indium conflicts with journey map

Confirmation

[ ] I have tested the bug without Sodium and Indium.
[X] I have kept all my mods up to date.

Bug Description
i use Sodium btw.  If i dont use indium when a gravity block falls my game craches  when i try to load the game with indium and  journey map it crashes..   i dont know why they are conflicting
Steps to Reproduce
No response
Mod Version
-1.0.33+mc1.21.jar
Minecraft Version
1.21
Attach latest.log
No response
Attach Crash Report
Incompatible mods found!
net.fabricmc.loader.impl.FormattedException: Some of your mods are incompatible with the game or each other!
A potential solution has been determined, this may resolve your problem:
- Replace mod 'Sodium' (sodium) 0.5.11+mc1.21 with version 0.5.9.
More details:
- Mod 'Indium' (indium) 1.0.33+mc1.21 requires version 0.5.9 of mod 'Sodium' (sodium), but only the wrong version is present: 0.5.11+mc1.21!
at net.fabricmc.loader.impl.FormattedException.ofLocalized(FormattedException.java:51)
at net.fabricmc.loader.impl.FabricLoaderImpl.load(FabricLoaderImpl.java:195)
at net.fabricmc.loader.impl.launch.knot.Knot.init(Knot.java:146)
at net.fabricmc.loader.impl.launch.knot.Knot.launch(Knot.java:68)
at net.fabricmc.loader.impl.launch.knot.KnotClient.main(KnotClient.java:23)
Additional Information

This crash is unrelated to JourneyMap. Indium has not been updated to work with the latest version of Sodium. Downgrade Sodium to 0.5.9 until Indium updates.

Use Indium 1.0.34!