Iptable

Hello
Any document file for iptable?
how to enable and configure in a good manner and checking that successfully configured?
Thanks and really appreciate you. Your support is awesome brother!

There is no need to use iptables to make Postal work. You should configure it to protect your server though but that's not really a Postal thing.

Okay thanks you so much @adamcooke
could you please guide me where I am wrong. I have installed it and restarted postal I can see that Restarted web.1
Restarted fast.1 -> fast.2
Restarted cron.1 -> cron.2
Restarted smtp.1
Restarted requeuer.1 -> requeuer.2
is that work because i noticed that web.1 and smtp.1 is same way.
another question as per postal help i can see postal smtp details but when i configure SMTP it's show's Connection could not be established with host 144.217.XXX.XXX [Connection refused #111] (code: 0)
so could please tell me the correct way of SMTP configuration username and password?
Really appreciated you!

The fact they stay the same is fine. They are restarted differently to the other processes.
For the other thing, make sure the port is correct. It sounds like it isn't because you're getting a connection refused.

see connection is perfect
nmap -PN <IP_ADDRESS>
Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-11 14:43 EEST
Nmap scan report for mail.mailleaders.com (<IP_ADDRESS>)
Host is up (0.00073s latency).
Not shown: 995 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
110/tcp open  pop3
143/tcp open  imap
993/tcp open  imaps
995/tcp open  pop3s
Nmap done: 1 IP address (1 host up) scanned in 5.02 seconds
could you please tell me how to generate or create smtp username n password ?
On May 11, 2017 6:15 PM, "Adam Cooke"<EMAIL_ADDRESS>wrote:

The fact they stay the same is fine. They are restarted differently to the
other processes.
For the other thing, make sure the port is correct. It sounds like it
isn't because you're getting a connection refused.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/atech/postal/issues/129#issuecomment-300777888, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AbC1m-tduQkavQUCV43yqFcUdJFxWMuaks5r4wMBgaJpZM4NXhiy
.

There is no SMTP server listening in that list.
You can create a new mail server through the web interface then create a credential.

if I am not misunderstanding then I have to create a credential from postal web interface am I right?
if I am right then I already created but not working and got that above connection error.
Thanks for your awesome support.

As I said, there doesn't appear to be an SMTP server listening. None of those ports looks like an SMTP server to me. In fact, one is IMAP and POP3 which suggests you're running some other mail server on the same host which isn't a good idea.

okay..i am totally new in technology. could you please tell me how to remove IMAP and POP3 and install SMTP ? and how to create SMTP username and password
Appreciated your effort and support

hey adam,
Check SMTP 25 is open now and IMAP & POP3 are diable
Starting Nmap 7.01 ( https://nmap.org ) at 2017-05-12 02:36 EDT
Nmap scan report for vps129193.vps.ovh.ca (<IP_ADDRESS>)
Host is up (0.0000040s latency).
Not shown: 996 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
25/tcp  open  smtp
80/tcp  open  http
443/tcp open  https
But still, i am struggling to send email and now able to configure email.
I already create SMTP credential from postal web interface
Please ch below images
POSTAL HELP AREA
POSTAL CREDENTIAL AREA

Please guide me where I am wrong
Thanks for your support

Hello
if I am testing postal test-app-smtp<EMAIL_ADDRESS>then I got an email...
but if I configure so sent the email I got a connection time out like
Connection could not be established with host <IP_ADDRESS> [Connection timed out #110]
do u have any idea where I am wrong?

What port is it trying to connect to? Check the smtp section of your config.

I tried both 25 and 2525


Streaming support

Utilize retrofit2.http.Streaming and retrofit2.Call in additional OpenAIApi methods to enable a streamable ResponseBody.
Utilize retrofit2.Callback to get the streamable ResponseBody, parse Server Sent Events (SSE) and emit them using io.reactivex.FlowableEmitter.
Enable:

Streaming of raw bytes
Streaming of Java objects
Shutdown of OkHttp ExecutorService

Fixes: #51, #83, #182, #184

Looking forward to release.

有办法保证向前端推流的稳定性吗，向前端推流的过程总是有卡顿感

@Ruanandxian
Hello, unfortunately I don't understand Chinese, but Google Translate gives me the following:

"Is there a way to ensure the stability of pushing the stream to the front end, the process of pushing the stream to the front end always has a sense of lag ."

I'm not sure if I understand you correctly, but it may be that you don't flush the OutputStream. Note that ServletOutputStreams and the like buffer bytes written to it and don't write them out immediately. To write the received data immediately you must flush the output stream after each write call.
Something like this could help:
service
   .streamChatCompletionBytes(request)
   .doOnError(e -> {
       e.printStackTrace();
    })
    .blockingForEach(bytes -> {
       response.write(bytes);
       response.flush(); //flush to write out immediately
    });

Otherwise please provide some more information. Some code examples could help to understand what exactly you would like to achieve.

Thank you for providing the code that allows me to output results in stream mode in the project

Thank you for providing the code that allows me to output results in stream mode in the project

You're welcome! I'm glad to hear that the code I provided was useful for you in your project.

I use spring-boot-starter-webflux to recieve the stream,  then to extract the response text and use Flux to renturn for Interface caller，but I feel the response is not async。 Is some thing wrong?

Hey @Mrblw,
I haven't worked with webflux yet but I am pretty sure
.bodyValue(body)
.retrieve()
.bodyToFlux(String.class)

will read the whole response body at once into a single String instance. If I am wrong with my assumption and you get multiple chunks of the response body as Strings it could be, that you do not flush each chunk after retrieval as @cryptoapebot has already stated.

Could someone please provide an example of how to utilize this?

I haven't tried it yet, but you can find here some examples of how to normally handle streaming responses (Going to test when the version gets released): https://www.baeldung.com/spring-mvc-sse-streams
Hope this helps :-)
And thanks for the PR! 👍 🥇

@phazei
Another way to use this in spring looks like this:
@GetMapping("/")
@Streaming
public ResponseEntity<StreamingResponseBody> stream() {
  StreamingResponseBody responseBody = response -> {
	ChatCompletionRequest request = ChatCompletionRequest.builder()
		.messages(messages)
		.stream(true)
		.model("gpt-3.5-turbo")
		.maxTokens(MAX_TOKENS)
		.temperature(1.0)
		.frequencyPenalty(0.3)
		.presencePenalty(0.3)
		.build();

	service
		.streamChatCompletionBytes(request)
		.doOnError(e -> {
			e.printStackTrace();
		})
		.doOnComplete(new Action() {
			@Override
			public void run() throws Exception {
				//do something on completion
			}
		})
		.blockingForEach(bytes -> {
			response.write(bytes);
			response.flush(); //immediately write out buffered bytes
		});
  };

  return ResponseEntity.ok()
           .contentType(MediaType.TEXT_EVENT_STREAM)
           .body(responseBody);
}

@phazei Another way to use this in spring looks like this:
@GetMapping("/")
@Streaming
public ResponseEntity<StreamingResponseBody> stream() {
  StreamingResponseBody responseBody = response -> {
	ChatCompletionRequest request = ChatCompletionRequest.builder()
		.messages(messages)
		.stream(true)
		.model("gpt-3.5-turbo")
		.maxTokens(MAX_TOKENS)
		.temperature(1.0)
		.frequencyPenalty(0.3)
		.presencePenalty(0.3)
		.build();

	service
		.streamChatCompletionBytes(request)
		.doOnError(e -> {
			e.printStackTrace();
		})
		.doOnComplete(new Action() {
			@Override
			public void run() throws Exception {
				//do something on completion
			}
		})
		.blockingForEach(bytes -> {
			response.write(bytes);
			response.flush(); //immediately write out buffered bytes
		});
  };

  return ResponseEntity.ok()
           .contentType(MediaType.TEXT_EVENT_STREAM)
           .body(responseBody);
}

@n3bul4 hi, I used this code, but there is a difference compared to directly calling OpenAI. The first data response time from OpenAI is about 3 seconds, while using the above code, the first response time is about 17 seconds. I am confused about why there is such a difference.

My point is to use the OpenAI example -> 3. How much time is saved by streaming a chat completionLink
An example of using the Python library requests is as follows:
Message received 2.10 seconds after request: {
  "role": "assistant"
}
Message received 2.10 seconds after request: {
  "content": "\n\n"
}
Message received 2.10 seconds after request: {
  "content": "1"
}
Message received 2.11 seconds after request: {
  "content": ","
}
....

Update openai.api_base to point to the local endpoint.
result：
Message received 10.10 seconds after request: {
  "role": "assistant"
}
Message received 10.10 seconds after request: {
  "content": "\n\n"
}
Message received 10.10 seconds after request: {
  "content": "1"
}
Message received 10.11 seconds after request: {
  "content": ","
}
....

@n3bul4 I noticed that your code uses @GetMapping("/"), should I be using Post instead?
Thank you for your reply.

My point is to use the OpenAI example -> 3. How much time is saved by streaming a chat completion(Link) An example of using the Python library requests is as follows:
Message received 2.10 seconds after request: {
  "role": "assistant"
}
Message received 2.10 seconds after request: {
  "content": "\n\n"
}
Message received 2.10 seconds after request: {
  "content": "1"
}
Message received 2.11 seconds after request: {
  "content": ","
}
....

Modify openai.api_base=http://<IP_ADDRESS>:10008/stream to point to the Java server endpoint. result：
Message received 10.10 seconds after request: {
  "role": "assistant"
}
Message received 10.10 seconds after request: {
  "content": "\n\n"
}
Message received 10.10 seconds after request: {
  "content": "1"
}
Message received 10.11 seconds after request: {
  "content": ","
}
....

@n3bul4 I noticed that your code uses @GetMapping("/"), should I be using Post instead? Thank you for your reply.

@an9xyz The example code I provided is using GetMapping annotation, because the EventSource Browser API only supports GET requests and I am using the servlet endpoint with javascript EventSource.
You actually must not use POST for the example servlet, because the servlet is annotated as GetMapping. What I find a bit strange is, that you should actually see a spring error if you are POSTing to a GetMapping as far as there is no PostMapping annotation for the same path (i.e. "/").
What is happening if you just simply enter the URL (http://<IP_ADDRESS>:10008/stream) into the browser? Do you experience any delays? This test would at least perform an HTTP GET request.
I think the problem here is, that you are POSTing to a GET mapping (openai-python uses POST)  although I wonder why spring is not complaining about it.
I am not sure what exactly you would like to achieve. If you want to use an EventSource with javascript to read the response than the code I provided is one way to go. In this case you should not test the servlet with the openai-python library, because it is using POST.
I you don't have to use EventSource with javascript you can change the GetMapping annotation to PostMapping. I would try it out and look at the results.
I hope this helps.

@an9xyz you can use the example code to achieve streaming. EventSource is the javascript way of handling content-type text/event-stream and it requires GET to work. It is basically up to you which HTTP method you use or which content-type you choose. I would say it depends on the use case.
If your goal is something like ChatGPT use the code I provided, as ChatGPT is using EventSource.
Otherwise please try to describe what you would like to achieve. Where should the data of the stream go? If you just want to put it somewhere into a database or file I wouldn't use streaming at all.

@n3bul4 what I want to achieve is to encapsulate the OpenAI interface and provide a public service internally. Your example code works well for local debugging with streaming response, but when I deploy it to the test environment, the request is blocked and there is no streaming response effect, and the result is like returning all data as with a regular API request. I don't know where the blocking occurs. We are not considering ChatGPT Web here, only the server-side.
UPDATE: It is likely a configuration problem with Nginx, and I am still trying to solve it.

I encountered the same issue, suspecting it was caused by Nginx buffering. I changed the configuration according to For Server-Sent Events (SSE) what Nginx proxy configuration is appropriate?, but the problem still persists. May I ask how you resolved it?


Bugfix when chaining expressions using OR

Wraps expressions in brackets when using more than one expression
so this
/Employees/$count?$filter=%28ID%20eq%2023%20and%20NickName%20eq%20%27Steve%27%29%20or%20%28ID%20eq%2025%20and%20NickName%20eq%20%27Tim%27%29

(ID eq 23 and NickName eq 'Steve') or (ID eq 25 and NickName eq 'Tim')
becomes
/Employees/$count?$filter=%28%28ID%20eq%2023%29%20and%20%28NickName%20eq%20%27Steve%27%29%29%20or%20%28%28ID%20eq%2025%29%20and%20%28NickName%20eq%20%27Tim%27%29%29
((ID eq 23) and (NickName eq 'Steve')) or ((ID eq 25) and (NickName eq 'Tim'))

adds a test
fixes existing tests
addresses issue https://github.com/SAP/python-pyodata/issues/280

Example 2:
consider this example, it demonstrates a bit better
startswith(NameFirst, 'Steve') eq true and ID eq 23 or ID eq 25 or ID eq 28 becomes  (startswith(NameFirst, 'Steve') eq true) and (ID eq 23 or ID eq 25 or ID eq 28)

Hi,
couple of notes
I couldn't get pylint to work, i get error:
AttributeError: module 'collections' has no attribute 'MutableMapping'
Must be some version mismatch but I couldn't (yet) track it down.
I added a test and fixed a few existing ones but i think these tests aren't the best. These basically just verify the constructed URL is correct and not actually test the remote service.
There could be a better way for this using pytest-vcr which does exactly that. Test remote services and their responses. But this would require a bit more effort to implement, if you all want to go this route.
Anyway, i probably forgot other things, let me know what you guys think.

Hi @developer992
Thanks for all your work. Greatly appreciated.
I will look at this more deeply soon.

The linter was probably local problem, even that the version is fixed in the dev-requirements.txt, but it could be affected by other things (python version if nothing else). It passed in the PR actions build, so no worries.

For this PR, new test code works, but I would like to return to the point 4 from my comment in the original issue - https://github.com/SAP/python-pyodata/issues/280#issuecomment-2276607288. It is basically the same problem that the test is passing, because the fix matches the hardcoded URL in the new test.. but is this one URL the only valid for the chained expression in the python code?

from the issue comment:
filter1 eq 'foo' and ( filter2 eq true or filter3 eq 'bar' )
or
(filter1 eq 'foo' and  filter2 eq true) or filter3 eq 'bar'

both should most probably return different set of data in the response.
You responded in the middle with the but we'll know more after running the tests :) But there is just one quite simple test added.
I am not sure if you are covering all possible groupings or pre-selected one grouping only for the ORM style - and any other complex filter query would have to be written directly in the standard pyodata way.
This is potentially breaking change, so if you are using the fixed version from your fork for several weeks, may I ask to add few more tests for these more complex chained expression that would use the experience you gained? This is moving in the right direction overall and I would love to merge it and release it - I have planned it for the next bugfix release. So this is not comment discarding the PR, on the contrary - request for improving a bit more.

You may also consider improving the documentation (this PR or perhaps second one, after this is merged) with your experience, not just tests. As you already know, the PR #113 is a community feature and not what was considered "good enough minimum " pyodata in the start, so if you see benefit in writing queries this ORM way, you can "clean the path" for anybody following you.
https://github.com/SAP/python-pyodata/blob/master/docs/usage/querying.rst#get-entities-matching-a-complex-filter-in-orm-style

Last but not least.. update CHANGELOG.md with your fix and your name under https://github.com/SAP/python-pyodata/blob/master/CHANGELOG.md. It is your fix after all.

i am not sure howto handle this
it works for us, so i'll keep it but if it depends on remote service, then i'm lost on how to continue
thanks anyway tho, you may delete the PR


nth-check vulnerability found in<EMAIL_ADDRESS>

Hi,
I have a dashboard developed in reactjs and from last few days my github has started to display a vulnerability issue in<EMAIL_ADDRESS>for nth-check dependency.
<EMAIL_ADDRESS>uses nth-check v1.0.2 where as to resolve the vulnerability issue the recommended version is 2.1.0 or higher.
Remediation
Upgrade nth-check to version 2.0.1 or later. For example:

"dependencies": {
  "nth-check": ">=2.0.1"
}
or…
"devDependencies": {
  "nth-check": ">=2.0.1"
}

CVE-2021-3803
moderate severity
Vulnerable versions: < 2.0.1
Patched version: 2.0.1
nth-check is vulnerable to Inefficient Regular Expression Complexity

Dependabot cannot update nth-check to a non-vulnerable version
The latest possible version that can be installed is 1.0.2 because of the following conflicting dependency:

<EMAIL_ADDRESS>requires<EMAIL_ADDRESS>via a transitive dependency on<EMAIL_ADDRESS>The earliest fixed version is 2.0.1.

Thanks and Regards,
Sandeep

Security vulnerability is reported in react-scripts 5.0.0 version also.
Audit report -
Moderate        Inefficient Regular Expression Complexity in nth-check
Package         nth-check
Patched in      >=2.0.1
Dependency of   react-scripts [dev]
Path            react-scripts > @svgr/webpack > @svgr/plugin-svgo > svgo >
css-select > nth-check
More info       https://github.com/advisories/GHSA-rp65-9cf3-cjxr

Could this be looked into as well? most of other vulnerabilities were fixed in react-scripts 5.0.0 except this one

It would be greatly appreciated if this was resolved in the next release.

Agreed. This vulnerability is being flagged by dependabot in my repo with react-scripts 5.0.0. Seems @svgr/webpack just needs to be updated to the latest version, and it will be fixed.

Agreed. This vulnerability is being flagged by dependabot in my repo with<EMAIL_ADDRESS>Seems @svgr/webpack just needs to be updated to the latest version, and it will be fixed.
Someone already has a PR up #11780

It's been stuck in limbo for months waiting for approval.

We are waiting for this vulnerability to be fixed, since long long time. Can someone please provide us an ETA on this one ?

is it possible to temporarily resolve this using yarn resolutions?

I got this:
`# npm audit report
nth-check  <2.0.1
Severity: high
Inefficient Regular Expression Complexity in nth-check - https://github.com/advisories/GHSA-rp65-9cf3-cjxr
fix available via npm audit fix --force
Will install<EMAIL_ADDRESS>which is a breaking change
node_modules/svgo/node_modules/nth-check
css-select  <=3.1.0
Depends on vulnerable versions of nth-check
node_modules/svgo/node_modules/css-select
svgo  1.0.0 - 1.3.2
Depends on vulnerable versions of css-select
node_modules/svgo
@svgr/plugin-svgo  <=5.5.0
Depends on vulnerable versions of svgo
node_modules/@svgr/plugin-svgo
@svgr/webpack  4.0.0 - 5.5.0
Depends on vulnerable versions of @svgr/plugin-svgo
node_modules/@svgr/webpack
react-scripts  >=2.1.4
Depends on vulnerable versions of @svgr/webpack
node_modules/react-scripts
6 high severity vulnerabilities`

@coronelauth, I'll assume that you still have the error because of this dependency chain:

<EMAIL_ADDRESS>depends on<EMAIL_ADDRESS>which means greater then 5.5.0 but still 5.x.x. And the 5.5.0 is the latest version in 5.x.x. You can check it on npm semver calculator
<EMAIL_ADDRESS>depends on<EMAIL_ADDRESS>again the highest ^5.5.0 version is 5.5.0 itself;
<EMAIL_ADDRESS>depends on<EMAIL_ADDRESS>according to npm semver calculator it means 1.2.2, 1.3.0, 1.3.1, or 1.3.2 version;
<EMAIL_ADDRESS>depends on<EMAIL_ADDRESS>which means 2.0.0, 2.0.2, or 2.1.0;
<EMAIL_ADDRESS>on<EMAIL_ADDRESS>according to npm semver calculator it means exactly 1.0.2, which has Inefficient Regular Expression Complexity vulnerability.

Despite the fact you strictly require "nth-check": "2.1.1" and "css-select": "4.3.0" in your project dependencies<EMAIL_ADDRESS>and<EMAIL_ADDRESS>still require vulnerable<EMAIL_ADDRESS>package transitively.
So react-scripts package still needs to get updated dependencies in itself.

Unwinding this tangle back:

The vulnerability was patched in<EMAIL_ADDRESS>The minimum version of css-select depends on<EMAIL_ADDRESS>or higher is 4.2.0, if I found it correctly.
The minimum version of svgo that may cause installation of<EMAIL_ADDRESS>or higher is 2.3.1 - it depends on<EMAIL_ADDRESS>which may install<EMAIL_ADDRESS>The minimum version of @svgr/plugin-svgo that may cause installation of<EMAIL_ADDRESS>or higher is 6.0.0: it depends on<EMAIL_ADDRESS>As we found earlier version 5.5.0 depends on<EMAIL_ADDRESS>which is insufficient.
The minimum version of @svgr/webpack that depends on<EMAIL_ADDRESS>is 6.0.0 too.

So the solution of this problem is to upgrade @svgr/webpack in react-scripts at least up to 6.0.0. Which @TrySound did at #11780.

And also we have some duplicates of this issue:

#11491
#11990
#11993
#12055
#12132

And here is the issue where @gaearon explains that it’s not a problem: #11174

As often, it's not a real vulnerability. If you read the description, it explains that the attack vector is via network, but this is a build-time dependency that doesn't exist in built apps (the only dependency of a CRA app after build is React itself). As explained in #11174 we will not be addressing fake vulnerabilities.
If this is frustrating to you, please express it to npm, who are responsible for this security theater. Some npm support channels:

https://github.com/npm/cli/issues
https://github.com/npm/rfcs/discussions
https://www.npmjs.com/support


collection/keylogger catches keystrokes out of order, displays to user in semi-broken, partially unreadable manner

Empire Version
Newest master branch (8/22/16)
here's a really horrible example, and yes, I'm a child  :)

You can see that when the user hits 'backspace', in the log, it actually also hits backspace in addition to typing out [Backspace], so if someone were to say, type..
passwrdord
the logger would produce passw[Backspace[Backspaceord, and when these circumstances happen quickly, they overlap eachother which makes the log harder and harder to read - especially if it's a password you're after and its not easily visible that its typoed, or backwards, or the characters came in in the wrong order.
You can also see that the first instance of the word 'password', the logger captured an extra 'o' character.

Potentially related to #49

Yep, duplicate. The async interval is as low as can go at this point. There's new KeyLogging code in PowerSploit but it only logs out to a file, so it hasn't been integrated. If we are able to adapt that dev code to output to the console, we will integrate it in Empire.


Codelab references firechat-flutter repository that no longer exists

Steps to Reproduce

Follow codelab
See reference to https://github.com/flutter/firechat-flutter.git on page 3
Try to clone or browse to repo
Get repository doesn't exist or 404 error

/cc @qchong

@aikinai Thanks for your interest in our codelab. Please note that the codelab has been pulled due to dependencies on an out-of-date version of the Flutter SDK and Flutter Atom plugin. We hope to republish a new version of the codelab soon. In the meantime, please refer to the developer docs on flutter.io and the Github examples code.


uv install python on Windows fails during archive extraction

If I call uv python install 3.12  on W11 with uv 0.3.0, I get:
Searching for Python versions matching: Python 3.12
cpython-3.12.5-windows-x86_64-none ------------------------------ 4.47 MB/23.57 MB
error: Failed to install cpython-3.12.5-windows-x86_64-none: Failed to extract archive: cpython-3.12.5%2B20240814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz

I tried it multiple times and every time I get the same issue. However when I add -vv to make it verbose, I will install without issues.
I could reproduce it for Python 3.11 also.

After the retry, it works

It might be antivirus, it can do weird things interrupting large zip files. cc @charliermarsh

Running: uv python install 3.8.5
I get error:
Searching for Python versions matching: Python 3.8.5
cpython-3.8.5-windows-x86_64-none ------------------------------ 20.97 MB/32.45 MB                                                                               error: Failed to install cpython-3.8.5-windows-x86_64-none
  Caused by: Failed to extract archive: cpython-3.8.5-x86_64-pc-windows-msvc-shared-pgo-20200830T2254.tar.zst

I am using: uv 0.3.5 (6c62d9fbf 2024-08-27)
On Windows 10.
I re-ran the same command: uv python install 3.8.5
a second time and it worked with no other changes.

I can confirm that this could be 'fixed' by just running multiple times. Third time was the charm in my case.
Seems very believable to me that it was caused by some kind of corporate snake oil. Never saw the error on my private machines.

We now retry these -- which may help? I'll close, but we can re-open if we get more reports.


Job pod failed to start on GKE Autopilot with container hooks (kubernetes mode)

Checks

[X] I've already read https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/troubleshooting-actions-runner-controller-errors and I'm sure my issue is not covered in the troubleshooting guide.
[X] I am using charts that are officially provided

Controller Version
0.8.3
Deployment Method
Helm
Checks

[X] This isn't a question or user support case (For Q&A and community support, go to Discussions).
[X] I've read the Changelog before submitting this issue and I'm sure it's not due to any recently-introduced backward-incompatible changes

To Reproduce
runner-scale-set-values.yaml
githubConfigUrl: "https://github.com/my/repo"
githubConfigSecret: github-token
runnerScaleSetName: "gke-autopilot"
maxRunners: 2
minRunners: 0
template:
  spec:
    securityContext:
      fsGroup: 1001
    serviceAccountName: gke-autopilot-gha-rs-kube-mode
    volumes:
      - name: work
        ephemeral:
          volumeClaimTemplate:
            spec:
              accessModes:
                - ReadWriteOnce
              resources:
                requests:
                  storage: 4Gi
      - name: pod-templates
        configMap:
          name: pod-templates
    containers:
      - name: runner
        image: ghcr.io/actions/actions-runner:latest
        command:
          - /home/runner/run.sh
        env:
          - name: ACTIONS_RUNNER_CONTAINER_HOOKS
            value: /home/runner/k8s/index.js
          - name: ACTIONS_RUNNER_POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: ACTIONS_RUNNER_CONTAINER_HOOK_TEMPLATE
             value: /home/runner/pod-templates/default.yaml
          - name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
            value: "true"
          - name: GITHUB_ACTIONS_RUNNER_EXTRA_USER_AGENT
            value: actions-runner-controller/0.8.3
        resources:
          requests:
            cpu: 250m
            memory: 1Gi
        volumeMounts:
          - name: work
            mountPath: /home/runner/_work
          - name: pod-templates
            mountPath: /home/runner/pod-templates
            readOnly: true

pod-template.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: pod-templates
data:
  default.yaml: |
    ---
    apiVersion: v1
    kind: PodTemplate
    metadata:
      annotations:
        annotated-by: "extension"
      labels:
        labeled-by: "extension"
    spec:
      serviceAccountName: gke-autopilot-gha-rs-kube-mode
      securityContext:
        fsGroup: 1001
      containers:
        - name: $job # overwrites job container
          resources:
            requests:
              cpu: "3800m"
              memory: "4500"

rbac,yaml
---
# Source: gha-runner-scale-set/templates/kube_mode_serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gke-autopilot-gha-rs-kube-mode
  namespace: actions

# Source: gha-runner-scale-set/templates/kube_mode_role.yaml
# default permission for runner pod service account in kubernetes mode (container hook)
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: gke-autopilot-gha-rs-kube-mode
  namespace: actions
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "create", "delete"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["get", "create"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["get", "list", "create", "delete"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "create", "delete"]
---
# Source: gha-runner-scale-set/templates/kube_mode_role_binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: gke-autopilot-gha-rs-kube-mode
  namespace: actions
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: gke-autopilot-gha-rs-kube-mode
subjects:
  - kind: ServiceAccount
    name: gke-autopilot-gha-rs-kube-mode
    namespace: actions
---

Describe the bug
I can see that a runner pod is created but it failed to create the job pod with the message Error: pod failed to come online with error: Error: Pod gke-autopilot-4vvrh-runner-74czb-workflow is unhealthy with phase status Failed"
Describe the expected behavior
I expected it to create a job pod.
Additional Context
It works if I don't try to customize the job pod ie if I use a config like below. But I want to give more resources to the actual pod that's running the job so I need to use pod-templates to customize it.

githubConfigUrl: "https://github.com/my/org"
githubConfigSecret: github-token
runnerScaleSetName: "gke-autopilot"
maxRunners: 2
minRunners: 0
containerMode:
  type: "kubernetes"
  kubernetesModeWorkVolumeClaim:
    accessModes: ["ReadWriteOnce"]
    resources:
      requests:
        storage: 4Gi
template:
  spec:
    securityContext:
      fsGroup: 1001
    containers:
      - name: runner
        image: ghcr.io/actions/actions-runner:latest
        command: ["/home/runner/run.sh"]

controllerServiceAccount:
  namespace: actions
  name: gha-runner-scale-set-controller-gha-rs-controller

Controller Logs
No errors, just regular logs. I can provide it if required.

Runner Pod Logs
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext] Publish step telemetry for current step {
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   "action": "Pre Job Hook",
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   "type": "runner",
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   "stage": "Pre",
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   "stepId": "06f9adc3-e79d-405b-91eb-a7f72f1e56c4",
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   "stepContextName": "06f9adc3e79d405b91eba7f72f1e56c4",
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   "result": "failed",
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   "errorMessages": [
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]     "Error: pod failed to come online with error: Error: Pod gke-autopilot-4vvrh-runner-74czb-workflow is unhealthy with phase status Failed",
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]     "Process completed with exit code 1.",
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]     "Executing the custom container implementation failed. Please contact your self hosted runner administrator."
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   ],
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   "executionTimeInSeconds": 42,
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   "startTime": "2024-03-27T15:18:57.1056563Z",
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   "finishTime": "2024-03-27T15:19:38.206926Z",
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext]   "containerHookData": "{\"hookScriptPath\":\"/home/runner/k8s/index.js\"}"
[WORKER 2024-03-27 15:19:38Z INFO ExecutionContext] }.
[WORKER 2024-03-27 15:19:38Z INFO StepsRunner] Update job result with current step result 'Failed'.

I also tried the same config with GKE standard cluster and I'm running into https://github.com/actions/actions-runner-controller/issues/3132.

Hey @knkarthik,
I'm not sure that you are using the right service account. You should not use the service account of the controller, but rather the service account for the service account with the permissions you posted.

Thanks for the reply and sorry to confuse you @nikola-jokic.
I'm indeed using gke-autopilot-gha-rs-kube-mode which has the necessary permissions as the service account, afaik.
The following is actually commented out in my values file but in my post it was not. I've removed it from my original post now to make it clear.
controllerServiceAccount:
  namespace: actions
  name: gha-runner-scale-set-controller-gha-rs-controller

Can you please monitor the cluster and run kubectl describe when the workflow pod is created?

@nikola-jokic I did some digging and unfortunately, the pod appears for < 1s and I'm not able to describe it. However, when I run kubectl events, I get OutOfcpu warning for the -workflow pod. So this seems to be the same issue as https://github.com/actions/actions-runner-controller/discussions/2527 and https://github.com/kubernetes/kubernetes/issues/115325.
> kubectl get events -n actions

LAST SEEN   TYPE      REASON                   OBJECT                                                        MESSAGE
9m4s        Normal    WaitForPodScheduled      persistentvolumeclaim/gke-autopilot-c4pk8-runner-hqz89-work   waiting for pod gke-autopilot-c4pk8-runner-hqz89 to be scheduled
9m3s        Normal    WaitForFirstConsumer     persistentvolumeclaim/gke-autopilot-c4pk8-runner-hqz89-work   waiting for first consumer to be created before binding
9m4s        Warning   FailedScheduling         pod/gke-autopilot-c4pk8-runner-hqz89                          0/2 nodes are available: waiting for ephemeral volume controller to create the persistentvolumeclaim "gke-autopilot-c4pk8-runner-hqz89-work". preemption: 0/2 nodes are available: 2 Preemption is not helpful for scheduling..
12m         Normal    WaitForPodScheduled      persistentvolumeclaim/gke-autopilot-c4pk8-runner-lxzqj-work   waiting for pod gke-autopilot-c4pk8-runner-lxzqj to be scheduled
11m         Normal    ExternalProvisioning     persistentvolumeclaim/gke-autopilot-c4pk8-runner-lxzqj-work   waiting for a volume to be created, either by external provisioner "pd.csi.storage.gke.io" or manually created by system administrator
12m         Normal    Provisioning             persistentvolumeclaim/gke-autopilot-c4pk8-runner-lxzqj-work   External provisioner is provisioning volume for claim "actions/gke-autopilot-c4pk8-runner-lxzqj-work"
11m         Normal    Provisioning             persistentvolumeclaim/gke-autopilot-c4pk8-runner-lxzqj-work   External provisioner is provisioning volume for claim "actions/gke-autopilot-c4pk8-runner-lxzqj-work"
11m         Normal    Provisioning             persistentvolumeclaim/gke-autopilot-c4pk8-runner-lxzqj-work   External provisioner is provisioning volume for claim "actions/gke-autopilot-c4pk8-runner-lxzqj-work"
11m         Normal    Provisioning             persistentvolumeclaim/gke-autopilot-c4pk8-runner-lxzqj-work   External provisioner is provisioning volume for claim "actions/gke-autopilot-c4pk8-runner-lxzqj-work"
11m         Normal    ProvisioningSucceeded    persistentvolumeclaim/gke-autopilot-c4pk8-runner-lxzqj-work   Successfully provisioned volume pvc-91216e22-4299-422f-977b-51f3fcb219e1
9m15s       Warning   OutOfcpu                 pod/gke-autopilot-c4pk8-runner-lxzqj-workflow                 Node didn't have enough resource: cpu, requested: 4000, used: 1849, capacity: 1930
11m         Normal    Scheduled                pod/gke-autopilot-c4pk8-runner-lxzqj                          Successfully assigned actions/gke-autopilot-c4pk8-runner-lxzqj to gk3-autopilot-pov-pool-2-3bb9a724-7q2p
10m         Warning   FailedMount              pod/gke-autopilot-c4pk8-runner-lxzqj                          MountVolume.SetUp failed for volume "pod-templates" : configmap "pod-templates" not found
11m         Normal    SuccessfulAttachVolume   pod/gke-autopilot-c4pk8-runner-lxzqj                          AttachVolume.Attach succeeded for volume "pvc-91216e22-4299-422f-977b-51f3fcb219e1"
10m         Normal    Pulling                  pod/gke-autopilot-c4pk8-runner-lxzqj                          Pulling image "ghcr.io/actions/actions-runner:latest"
10m         Normal    Pulled                   pod/gke-autopilot-c4pk8-runner-lxzqj                          Successfully pulled image "ghcr.io/actions/actions-runner:latest" in 238.11642ms (238.134258ms including waiting)
10m         Normal    Created                  pod/gke-autopilot-c4pk8-runner-lxzqj                          Created container runner
10m         Normal    Started                  pod/gke-autopilot-c4pk8-runner-lxzqj                          Started container runner

@knkarthik, not sure if it is just that, but i managed to pass in resources for a gpu job with a confimap very similar to yours, just removing the comments on the $job name line..  i don't know if you added that just here, but might be worth trying without it..
mine looks like this.
apiVersion: v1
kind: ConfigMap
metadata:
  name: pod-templates
data:
  default.yaml: |
    ---
    apiVersion: v1
    kind: PodTemplate
    metadata:
      annotations:
        annotated-by: "extension"
      labels:
        labeled-by: "extension"
    spec:
      containers:
        - name: $job
          resources:
            limits:
              nvidia.com/gpu: "1"
      tolerations:
      - key: nvidia.com/gpu
        operator: Exists
        effect: NoSchedule
      nodeSelector:
        cloud.google.com/gke-accelerator: nvidia-l4


feat: Creates design doc for enabling access to hts token evm address

Description:

Creates a design doc for new change to trasnaction receipt format, related to hts token address
Reference: https://github.com/hashgraph/hedera-smart-contracts/issues/901
Related issue(s):
Fixes #3257

This design handles the direct precompile call flow well.
There might be a case where we create an HTS token within the contract's constructor. What will we return in that case? Is the newly created contract's address or the HTS token address?
In terms of the Ethereum equivalence, we always must return the contract's address. Maybe we should add a section in the readme with something like "In case of HTS token creation within the constructor, the user should manually emit an event and handle the token address exposure on the contract's side"?
@Nana-EC actually, are we thinking of handling an HTS token creation within a contract and populating the contractAddress field with the newly created token address on the top-level transaction's receipt?

Hmmm, I don't think we need to handle in contract calls as there it is the responsibility of the developer to handle the functions response. And yeah if they want they can emit an event to externalize the token address.


Adding python quiz question

Checklist:

[x ] I have read freeCodeCamp's contribution guidelines.
[x ] My pull request has a descriptive title (not a vague title like Update index.md)

Closes #15

This is a standard message notifying you that we've reviewed your pull request and have decided not to merge it.
We do not accept submissions from external quiz sites like these
https://www.sarthaks.com/2438992/which-of-the-following-is-true-for-variable-names-in-python
Please come up with your own quiz questions and answers 👍


Multi select from react-select with redux form not working as intended

So iam using multi select from react-select with redux-form with the onBlur hack(?) which is working fine behind the curtain because when i submit it I have the selected data in values
BUT after visiting any multi select field (even if i dont select anything) I end up with no values at all (nothing is displayed but this

))
const options = [
    { value: 'one', label: 'One' },
    { value: 'two', label: 'Two' }
];

<Select
            value="one"
            options={options}
            multi={true}
            {...input}
            onBlur={() => {
              input.onBlur({...input.value})
            }
          }
        />

So i end up with values in the redux state but I cant see any values in the field. Anyone know why is this happening?

 And turns out I had to send in an Array into the onBlur event rather then an Object 💃 😋 So this...
onBlur={() => {
              input.onBlur({...input.value})
            }

Becomes
onBlur={() => {
              input.onBlur([...input.value])
            }

And it works!! Hope it helps someone in the future 😆

I found that in addition to the above I also had to map the collection of value/label array pairs, back to values alone, or else the form would update with with value/pair objects when all I need are the values.
e.g
<Select
    {...props.input}
    value={props.input.value}
    onChange={(value) => {return props.input.onChange(value.map(p => p.value))}}
    onBlur={() => props.input.onBlur([...props.input.value])}
    options={props.options}
    multi={true}
  />


Video memory has been exhausted with single .ply

When i enter the play mode, Unreal keep remind " Video memory has been exhausted", anyone same?
My computer is with 3080ti 24G, and there is only a 7000 interaction .ply model in the scene.

I am having a similar issue in the editor. Also I can t even see the model.


show-rating=false does not work

This is what i have:
<rating class="rating-stars"
             rating="2"
             increment="0.25"
             read-only="true"
             active-color="#dc2234"
             inactive-color="#676767"
             star-size="20"
             show-rating="false"/>

This is what i get:

So the show-rating="false" does not work

haha never mind, show-rating="false"  had to be :show-rating="false"


Move all Python executables to a bin module

Completed in the following commits ( 41723a7d59a126ac066451c06e66aa4823b70397 ) and ( 03f53fedbd82d1330ca36885b83fadf62548c824 ).


Stop scanning after retrieving scan in SweepJS example

This is a temporary fix to the problems described in issue #69. See issue for details.

I don't think the stop scanning call here is correct - you're placing it inside the scan callback, which means after the first full scan we shut down. I really don't want to advertise the stop scanning function in the Js examples as it's super easy to get this wrong wrt. async. functions: if you place the stop scanning call at the end, it will be called immediately because the scan function is async.

Hmmm. This was only meant to be a temporary fix, as the sweepjs example is currently broken for me. But you are right that including the stop_scanning in the callback is rather poor practice, and could lead to issues in certain setups. I'm not sure why the application was hanging in its absence or how to properly remedy the behavior. Any ideas?

Closing this for now, as it is not the appropriate fix. Will try to test the issue again next week and see if I can't find a better solution.


Configuration Manager, UpdateURL and Schedule Tasks

Hi there,
Great documentation.  However, would like to find out :

How "Office Automatic Update" schedule task is going to affect this?
Will "Manage Office 365 Client" Client Policy in SCCM achieve the same thing here?
If there were "UpdateURL" specified previously, will a manual triggered update still use the content in the URL?

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 44a78111-ae98-5b26-b349-3e62960f02c4
Version Independent ID: 23052a9d-431b-1367-791f-ef2f137d4c47
Content: Manage updates to Office 365 ProPlus with System Center Configuration Manager
Content Source: DeployOffice/manage-updates-to-office-365-proplus-with-system-center-configuration-manager.md
Service: o365-proplus-itpro
GitHub Login: @jwhit-MSFT
Microsoft Alias: jwhit

Hi! Please see your answers below:

When the Office COM Object is enabled, the schedule task still runs but it does not perform update searches as that is managed by ConfigMgr. However we still always recommend to leave the scheduled task running as it performs other events outside of updates

Yes there are three ways to enable the Office COM object - the client policy setting in ConfigMgr you referenced, Group Policy Object, and through the configuration XML file via Office Deployment Tool

Correct - if the UpdateURL address points to a location, a manual trigger of the Office update mechanism (officec2rclient.exe) will reference this UpdateURL. However when using ConfigMgr to manage updates the UpdateURL value is ignored, and in recent Office builds when the Office COM Object is enabled the "Update Now" button featured in the Office apps is disabled preventing end users from calling the update mechanism themselves. This means only an elevated user could call it via command line, not via the Office UI, keeping all users being managed by ConfigMgr and not the UpdateURL


Automated cherry pick of #10073: fix(host-deployer): remove escape character on windows passwd

Cherry pick of #10073 on release/3.7.
#10073: fix(host-deployer): remove escape character on windows passwd

Codecov Report

Merging #10074 (645cf64) into release/3.7 (0ff3997) will increase coverage by 2.06%.
The diff coverage is 0.00%.

@@               Coverage Diff                @@
##           release/3.7   #10074       +/-   ##
================================================
+ Coverage         5.98%    8.05%    +2.06%
================================================
  Files              848      107      -741
  Lines           131795    13000   -118795
================================================
- Hits              7887     1047     -6840
+ Misses          123206    11833   -111373
+ Partials           702      120      -582

Flag
Coverage Δ

aFlag
8.05% <0.00%> (+2.06%)
:arrow_up:

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files
Coverage Δ

pkg/apigateway/handler/auth.go
0.00% <0.00%> (ø)

pkg/apigateway/handler/auth_totp.go
0.00% <0.00%> (ø)

pkg/apigateway/handler/idp.go
1.84% <0.00%> (ø)

pkg/apigateway/handler/misc.go
0.00% <0.00%> (ø)

pkg/apigateway/handler/resource.go
0.00% <0.00%> (ø)

pkg/hostman/diskutils/nbd/driver.go
0.74% <0.00%> (-0.01%)
:arrow_down:

pkg/hostman/diskutils/nbd/lvmutils.go
4.70% <0.00%> (-0.24%)
:arrow_down:

pkg/monitor/alerting/eval_context.go
34.25% <0.00%> (-2.75%)
:arrow_down:

pkg/cloudcommon/db/keystonecache.go

pkg/cloudcommon/db/standalone_anon.go

... and 661 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f5f02b5...645cf64. Read the comment docs.

Codecov Report

Merging #10074 (645cf64) into release/3.7 (0ff3997) will increase coverage by 2.06%.
The diff coverage is 0.00%.

@@               Coverage Diff                @@
##           release/3.7   #10074       +/-   ##
================================================
+ Coverage         5.98%    8.05%    +2.06%
================================================
  Files              848      107      -741
  Lines           131795    13000   -118795
================================================
- Hits              7887     1047     -6840
+ Misses          123206    11833   -111373
+ Partials           702      120      -582

Flag
Coverage Δ

aFlag
8.05% <0.00%> (+2.06%)
:arrow_up:

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files
Coverage Δ

pkg/apigateway/handler/auth.go
0.00% <0.00%> (ø)

pkg/apigateway/handler/auth_totp.go
0.00% <0.00%> (ø)

pkg/apigateway/handler/idp.go
1.84% <0.00%> (ø)

pkg/apigateway/handler/misc.go
0.00% <0.00%> (ø)

pkg/apigateway/handler/resource.go
0.00% <0.00%> (ø)

pkg/hostman/diskutils/nbd/driver.go
0.74% <0.00%> (-0.01%)
:arrow_down:

pkg/hostman/diskutils/nbd/lvmutils.go
4.70% <0.00%> (-0.24%)
:arrow_down:

pkg/monitor/alerting/eval_context.go
34.25% <0.00%> (-2.75%)
:arrow_down:

pkg/cloudcommon/db/keystonecache.go

pkg/cloudcommon/db/standalone_anon.go

... and 661 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f5f02b5...645cf64. Read the comment docs.


Vim Quoteplus Register on BashOnWindows

Vim's way to access the system clipboard doesn't seem to work at the moment. :h quoteplus when doing a visual selection and then trying to access the quoteplus register to yank it, I get a system sound.
Steps to reproduce:

Select some text ( using V )
Press "+y
Nothing happens.

Is there something that I'm missing?
I'm using OS Build 14342.1002

Ah, I just noticed this version of vim has :echo has('clipboard') returning 0. My bad. Closing.


Make documentation optional

Fix #34
@blink1073 I have started to address the linked issue here. You can see the places where more sphinx configuration will be necessary.

i just reran ci to see if that fixes things!  it's failing on windows python 3.9 and 3.12

Hmm, need to look into that.
Error: error: invalid path 'template/{% if documentation != "" %}.readthedocs.yaml{% endif %}.jinja'

Ah, found it 🙂 https://copier.readthedocs.io/en/stable/configuring/#conditional-files-and-directories

On Windows, double-quotes are not valid characters in file and directory paths. This is why we used single-quotes in the example above.