tig: 2.3.0 -> 2.3.2

Motivation for this change
Update tig to the last version
Bug fixes:

Fix busy loop detection to handle large repos.

https://github.com/jonas/tig/releases/tag/tig-2.3.2
Things done

[X] Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
Built on platform(s)

[X] NixOS
[ ] macOS
[ ] other Linux distributions

[ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[ ] Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
[X] Tested execution of all binary files (usually in ./result/bin/)
[X] Fits CONTRIBUTING.md.

Applied to master (99c5976a1a1789de32c9ae6eac8fb9310b32b21b) and release-17.09 (8ea46716d195402c3a1b0c18255b69bb5f9ecdfa). Thanks!


KMS check does not take into account KMS specific conditionals

Running the AWS perimeter mod control aws_perimeter.control.kms_key_policy_prohibit_public_access reports alerts against an AWS generated KMS policy. AWS documentation calls out the default kms policy created for CloudTrail trails. AWS creates a condition based policy that leverages a condition that uses kms:CallerAccount. The perimeter mod check only takes into account aws:SourceOwner, aws:SourceAccount, aws:PrincipalOrgID, aws:PrincipalAccount, aws:PrincipalArn and aws:SourceArn.
Should kms:CallerAccount not be a candidate for the where clause when analysing KMS resources?

Thanks for raising the question @rbracewell 👍 .
Adding the relevant slack thread for additional details - https://steampipe.slack.com/archives/C01UECB59A7/p1673974501135479

Going through the documentation provided by AWS, I think we should add a condition to check for kms:CallerAccount since setting this parameter to * can result in the key becoming public.
@khushboo9024 @rajlearner17 could you please provide some more insight on this issue?

Hey @rbracewell, sorry for the delayed response.
The kms:CallerAccount condition is often used to enforce access control and limit the usage of KMS keys to specific AWS accounts. By including this condition in a key policy, we can ensure that only authorized AWS accounts can perform operations on the KMS key, such as encrypting or decrypting data. I have created a KMS key in CloudTrail, and the below policies are created by default. I have updated the kms:CallerAccount value to '*' in one of the below policies.
-- alias/test-key
select jsonb_pretty(policy) from aws_kms_key where id = '01d1934c-af89-4cf9-8ed7-b6b49c0a85e3'
+---------------------------------------------------------------------------------------------------------------+
| jsonb_pretty                                                                                |
+---------------------------------------------------------------------------------------------------------------+
| {                                                                                |
|     "Id": "Key policy created by CloudTrail",                                                                 |
|     "Version": "2012-10-17",                                                                                |
|     "Statement": [                                                                                |
|         {                                                                                |
|             "Sid": "Enable IAM User Permissions",                                                             |
|             "Action": "kms:*",                                                                                |
|             "Effect": "Allow",                                                                                |
|             "Resource": "*",                                                                                |
|             "Principal": {                                                                                |
|                 "AWS": [                                                                                |
|<EMAIL_ADDRESS>|
|                     "arn:aws:iam::123456789:root"                                                          |
|                 ]                                                                                |
|             }                                                                                |
|         },                                                                                |
|         {                                                                                |
|             "Sid": "Allow CloudTrail to encrypt logs",                                                        |
|             "Action": "kms:GenerateDataKey*",                                                                 |
|             "Effect": "Allow",                                                                                |
|             "Resource": "*",                                                                                |
|             "Condition": {                                                                                |
|                 "StringLike": {                                                                               |
|                     "kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:123456789:trail/*"   |
|                 },                                                                                |
|                 "StringEquals": {                                                                             |
|                     "AWS:SourceArn": "arn:aws:cloudtrail:us-east-1:123456789:trail/test-trail"             |
|                 }                                                                                |
|             },                                                                                |
|             "Principal": {                                                                                |
|                 "Service": "cloudtrail.amazonaws.com"                                                         |
|             }                                                                                |
|         },                                                                                |
|         {                                                                                |
|             "Sid": "Allow CloudTrail to describe key",                                                        |
|             "Action": "kms:DescribeKey",                                                                      |
|             "Effect": "Allow",                                                                                |
|             "Resource": "*",                                                                                |
|             "Principal": {                                                                                |
|                 "Service": "cloudtrail.amazonaws.com"                                                         |
|             }                                                                                |
|         },                                                                                |
|         {                                                                                |
|             "Sid": "Allow principals in the account to decrypt log files",                                    |
|             "Action": [                                                                                |
|                 "kms:Decrypt",                                                                                |
|                 "kms:ReEncryptFrom"                                                                           |
|             ],                                                                                |
|             "Effect": "Allow",                                                                                |
|             "Resource": "*",                                                                                |
|             "Condition": {                                                                                |
|                 "StringLike": {                                                                               |
|                     "kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:123456789:trail/*"
                      "kms:CallerAccount": "*"  // I have edited the policy here |
|                 },                                                                                |
|                 "StringEquals": {                                                                               |
|                     "kms:CallerAccount": "123456789"                                                                 |
|                 }                                                                                |
|             },                                                                                |
|             "Principal": {                                                                                |
|                 "AWS": "*"                                                                                |
|             }                                                                                |
|         },                                                                                |
|         {                                                                                |
|             "Sid": "Allow alias creation during setup",                                                       |
|             "Action": "kms:CreateAlias",                                                                      |
|             "Effect": "Allow",                                                                                |
|             "Resource": "*",                                                                                |
|             "Condition": {                                                                                |
|                 "StringEquals": {                                                                             |
|                     "kms:ViaService": "ec2.us-east-1.amazonaws.com",                                          |
|                     "kms:CallerAccount": "123456789"                                                       |
|                 }                                                                                |
|             },                                                                                |
|             "Principal": {                                                                                |
|                 "AWS": "*"                                                                                |
|             }                                                                                |
|         },                                                                                |
|         {                                                                                |
|             "Sid": "Enable cross account log decryption",                                                     |
|             "Action": [                                                                                |
|                 "kms:Decrypt",                                                                                |
|                 "kms:ReEncryptFrom"                                                                           |
|             ],                                                                                |
|             "Effect": "Allow",                                                                                |
|             "Resource": "*",                                                                                |
|             "Condition": {                                                                                |
|                 "StringLike": {                                                                               |
|                     "kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:123456789:trail/*"   |
|                 },                                                                                |
|                 "StringEquals": {                                                                             |
|                     "kms:CallerAccount": "123456789"                                                       |
|                 }                                                                                |
|             },                                                                                |
|             "Principal": {                                                                                |
|                 "AWS": "*"                                                                                |
|             }                                                                                |
|         }                                                                                |
|     ]                                                                                |
| }                                                                                |
+---------------------------------------------------------------------------------------------------------------+

Here is the updated the mod control query  - (got the expected output)
 with wildcard_action_policies as (
      select
        arn,
        count(*) as statements_num
      from
        aws_kms_key,
        jsonb_array_elements(policy_std -> 'Statement') as s
      where
        s ->> 'Effect' = 'Allow'
        -- kms:CallerAccount.   // check for  CallerAccount
        and s -> 'Condition' -> 'StringLike' -> 'kms:calleraccount' ? '*'
        -- aws:SourceOwner
        and s -> 'Condition' -> 'StringEquals' -> 'aws:sourceowner' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:sourceowner' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:sourceowner' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:sourceowner' ? '*'
        )
        -- aws:SourceAccount
        and s -> 'Condition' -> 'StringEquals' -> 'aws:sourceaccount' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:sourceaccount' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:sourceaccount' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:sourceaccount' ? '*'
        )
        -- aws:PrincipalOrgID
        and s -> 'Condition' -> 'StringEquals' -> 'aws:principalorgid' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:principalorgid' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:principalorgid' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:principalorgid' ? '*'
        )
        -- aws:PrincipalAccount
        and s -> 'Condition' -> 'StringEquals' -> 'aws:principalaccount' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:principalaccount' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:principalaccount' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:principalaccount' ? '*'
        )
        -- aws:PrincipalArn
        and s -> 'Condition' -> 'StringEquals' -> 'aws:principalarn' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:principalarn' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:principalarn' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:principalarn' ? '*'
        )
        and (
          s -> 'Condition' -> 'ArnEquals' -> 'aws:principalarn' is null
          or s -> 'Condition' -> 'ArnEquals' -> 'aws:principalarn' ? '*'
        )
        and (
          s -> 'Condition' -> 'ArnLike' -> 'aws:principalarn' is null
          or s -> 'Condition' -> 'ArnLike' -> 'aws:principalarn' ? '*'
        )
        -- aws:SourceArn
        and s -> 'Condition' -> 'StringEquals' -> 'aws:sourcearn' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:sourcearn' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:sourcearn' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:sourcearn' ? '*'
        )
        and (
          s -> 'Condition' -> 'ArnEquals' -> 'aws:sourcearn' is null
          or s -> 'Condition' -> 'ArnEquals' -> 'aws:sourcearn' ? '*'
        )
        and (
          s -> 'Condition' -> 'ArnLike' -> 'aws:sourcearn' is null
          or s -> 'Condition' -> 'ArnLike' -> 'aws:sourcearn' ? '*'
        )
        and (
          s -> 'Principal' -> 'AWS' = '["*"]'
          or s ->> 'Principal' = '*'
        )
      group by
        arn
    )
    select
      r.arn as resource,
      case
        when p.arn is null then 'ok'
        else 'alarm'
      end as status,
      case
        when p.arn is null then title || ' policy does not allow public access.'
        else title || ' policy contains ' || coalesce(p.statements_num, 0) ||
        ' statement(s) that allow public access.'
      end as reason
    from
      aws_kms_key as r
      left join wildcard_action_policies as p on p.arn = r.arn
    where
      key_manager = 'CUSTOMER';
+------------------------------------------------------------------------------+--------+---------------------------------------------------------------------------+
| resource                                                                     | status | reason                                                                    |
+------------------------------------------------------------------------------+--------+---------------------------------------------------------------------------+
| arn:aws:kms:ap-south-1:123456789:key/e6ce31c8-5f6f-45ce-bec4-ee7354a4757d | ok     | alias/intg-test policy does not allow public access.                      |
| arn:aws:kms:us-east-1:123456789:key/01d1934c-af89-4cf9-8ed7-b6b49c0a85e3  | alarm  | alias/test-key policy contains 1 statement(s) that allow public access.   |
| arn:aws:kms:ap-south-1:123456789:key/a1dbc718-e60a-416e-8ab5-3a935043eeae | ok     | alias/test2 policy does not allow public access.                          |
+------------------------------------------------------------------------------+--------+---------------------------------------------------------------------------+

Could you please check the above query and let us know if it solves the problem?
@misraved @rajlearner17 Please share your views regarding the updated query.

When running the existing query from the documentation I get the following results
ok: 192
alarm: 8
Running the revised query from above I get the following results
ok: 200
alarm: 0
This is not what I expected. Of those 8 in alarm only one of them uses CallerAccount so I would still have expected the alarm count to be 7 with the new query.

Hey @rbracewell, thanks for the quick check. Could you please try the below one? I hope this will work as it was expected. If not, please share the policy structure (without sensitive info).
 with wildcard_action_policies as (
      select
        arn,
        count(*) as statements_num
      from
        aws_kms_key,
        jsonb_array_elements(policy_std -> 'Statement') as s
      where
        s ->> 'Effect' = 'Allow'
        -- kms:CallerAccount.   // check for  CallerAccount
       and s -> 'Condition' -> 'StringEquals' -> 'kms:calleraccount' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'kms:calleraccount' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'kms:calleraccount' is null
          or s -> 'Condition' -> 'StringLike' -> 'kms:calleraccount' ? '*'
        )
        -- aws:SourceOwner
        and s -> 'Condition' -> 'StringEquals' -> 'aws:sourceowner' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:sourceowner' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:sourceowner' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:sourceowner' ? '*'
        )
        -- aws:SourceAccount
        and s -> 'Condition' -> 'StringEquals' -> 'aws:sourceaccount' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:sourceaccount' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:sourceaccount' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:sourceaccount' ? '*'
        )
        -- aws:PrincipalOrgID
        and s -> 'Condition' -> 'StringEquals' -> 'aws:principalorgid' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:principalorgid' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:principalorgid' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:principalorgid' ? '*'
        )
        -- aws:PrincipalAccount
        and s -> 'Condition' -> 'StringEquals' -> 'aws:principalaccount' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:principalaccount' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:principalaccount' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:principalaccount' ? '*'
        )
        -- aws:PrincipalArn
        and s -> 'Condition' -> 'StringEquals' -> 'aws:principalarn' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:principalarn' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:principalarn' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:principalarn' ? '*'
        )
        and (
          s -> 'Condition' -> 'ArnEquals' -> 'aws:principalarn' is null
          or s -> 'Condition' -> 'ArnEquals' -> 'aws:principalarn' ? '*'
        )
        and (
          s -> 'Condition' -> 'ArnLike' -> 'aws:principalarn' is null
          or s -> 'Condition' -> 'ArnLike' -> 'aws:principalarn' ? '*'
        )
        -- aws:SourceArn
        and s -> 'Condition' -> 'StringEquals' -> 'aws:sourcearn' is null
        and s -> 'Condition' -> 'StringEqualsIgnoreCase' -> 'aws:sourcearn' is null
        and (
          s -> 'Condition' -> 'StringLike' -> 'aws:sourcearn' is null
          or s -> 'Condition' -> 'StringLike' -> 'aws:sourcearn' ? '*'
        )
        and (
          s -> 'Condition' -> 'ArnEquals' -> 'aws:sourcearn' is null
          or s -> 'Condition' -> 'ArnEquals' -> 'aws:sourcearn' ? '*'
        )
        and (
          s -> 'Condition' -> 'ArnLike' -> 'aws:sourcearn' is null
          or s -> 'Condition' -> 'ArnLike' -> 'aws:sourcearn' ? '*'
        )
        and (
          s -> 'Principal' -> 'AWS' = '["*"]'
          or s ->> 'Principal' = '*'
        )
      group by
        arn
    )
    select
      r.arn as resource,
      case
        when p.arn is null then 'ok'
        else 'alarm'
      end as status,
      case
        when p.arn is null then title || ' policy does not allow public access.'
        else title || ' policy contains ' || coalesce(p.statements_num, 0) ||
        ' statement(s) that allow public access.'
      end as reason
    from
      aws_kms_key as r
      left join wildcard_action_policies as p on p.arn = r.arn
    where
      key_manager = 'CUSTOMER';

The revised query returned the expected results this time.
The policy correctly detected kms:CallerAccount and marked as ok rather than alarm

Thanks @rbracewell for testing the updated query suggested by @bigdatasourav 👍.
The feedback has been extremely helpful in nailing down the query output 🎉 .


[SPARK-31248][CORE][TEST] Fix flaky ExecutorAllocationManagerSuite.interleaving add and remove

What changes were proposed in this pull request?

This PR (SPARK-31248) uses ManualClock to disable ExecutorAllocationManager.schedule()  in order to avoid unexpected update of target executors.
Why are the changes needed?

ExecutorAllocationManager will call schedule periodically, which may update target executors before we checking https://github.com/apache/spark/blob/496f6ac86001d284cbfb7488a63dd3a168919c0f/core/src/test/scala/org/apache/spark/ExecutorAllocationManagerSuite.scala#L864
And fail the check:
sbt.ForkMain$ForkError: org.scalatest.exceptions.TestFailedException: 12 did not equal 8
	at org.scalatest.Assertions.newAssertionFailedException(Assertions.scala:530)
	at org.scalatest.Assertions.newAssertionFailedException$(Assertions.scala:529)
	at org.scalatest.FunSuite.newAssertionFailedException(FunSuite.scala:1560)
	at org.scalatest.Assertions$AssertionsHelper.macroAssert(Assertions.scala:503)
	at org.apache.spark.ExecutorAllocationManagerSuite.$anonfun$new$51(ExecutorAllocationManagerSuite.scala:864)
	at org.scalatest.OutcomeOf.outcomeOf(OutcomeOf.scala:85)
	at org.scalatest.OutcomeOf.outcomeOf$(OutcomeOf.scala:83)
	at org.scalatest.OutcomeOf$.outcomeOf(OutcomeOf.scala:104)
	at org.scalatest.Transformer.apply(Transformer.scala:22)
	at org.scalatest.Transformer.apply(Transformer.scala:20)
	at org.scalatest.FunSuiteLike$$anon$1.apply(FunSuiteLike.scala:186)
	at org.apache.spark.SparkFunSuite.withFixture(SparkFunSuite.scala:151)
	at org.scalatest.FunSuiteLike.invokeWithFixture$1(FunSuiteLike.scala:184)

Does this PR introduce any user-facing change?

No.
How was this patch tested?

Update test.

ping @tgravescs @vanzin @HyukjinKwon Please take a look thanks!

Test build #120648 has started for PR 28084 at commit 7dcd604.

Merged build finished. Test PASSed.

Test PASSed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder-K8s/25349/
Test PASSed.

Test build #120648 has finished for PR 28084 at commit 7dcd604.

This patch fails Spark unit tests.
This patch merges cleanly.
This patch adds no public classes.

Merged build finished. Test FAILed.

Test FAILed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/120648/
Test FAILed.

Retest this please.

Test build #120649 has started for PR 28084 at commit 7dcd604.

Merged build finished. Test PASSed.

Test PASSed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder-K8s/25350/
Test PASSed.

Test build #120649 has finished for PR 28084 at commit 7dcd604.

This patch passes all tests.
This patch merges cleanly.
This patch adds no public classes.

Merged build finished. Test PASSed.

Test PASSed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/120649/
Test PASSed.

Since there is a conflict, please make a backporting PR if needed.

Thanks all! And the fix code under main will be released in future release so we don't need to backport.


fix: updates theme and moves to yarn

This PR bumps the theme to the most current version and also switches to Yarn over NPM.

It looks like there is more work to do on the pr.yml file as it uses NPM in a lot of places.

npm ERR! cipm can only install packages with an existing package-lock.json or npm-shrinkwrap.json with lockfileVersion >= 1. Run an install with npm@5 or later to generate it, then try again.```

I think we just need to replace this with the yarn equivalent.

https://stackoverflow.com/questions/58482655/what-is-the-closest-to-npm-ci-in-yarn

Closing in favor of #689
We'll need to do a bit more before we can move to yarn as a lot of the GitHub actions use npm right now. Let's do that separately from the theme update.

@jerelmiller I found that out when I did this work. 😓  but was definitely interested in taking it on.


xo config overrides in package.json are ignored

When specifying an overrides section in the xo config in package.json, any file globbing patterns or paths will never match.
When xo runs, it is setting the cwd to be the parent directory of the file being linted, rather than the parent directory of the package.json file that it found the xo config in so when optionsManager.findApplicableOverrides( ... ) is called, it will never return anything.
I did note that one can apparently set the chdir setting in SublimeLinter itself to be the project's root ("chdir": "${project}") however that hasn't made any difference to my problem.
Could it be that the xo linter is ignoring the chdir setting?

Hey @squarefeet 🙂  I was having a similar issue and came across this! Just a heads up, the optionsManager.findApplicableOverrides you mentioned is part of the xo project here: https://github.com/sindresorhus/xo/blob/5209ec86412cdbbee6a2bcae860faf40fbfb51a9/index.js#L19 - if it's a bug in xo core, it could be suitable over there


Sync changes from internal dev branch.

Disable getUsableChannel() op mode check.
Add BeToCQ-specific resources wrapper API.
Use Mobly's native apk_utils to install APKs
Add multi-payload test parameters and optimize multi-payload transfer test.
Lower MCC Hotspot speed target.
Disable payload ID sequence check for STREAM mode.
Skip setting bluetooth HCI logs on unrooted devices.
Add connection_medium into transfer_info and start to calculate medium_upgrade_latency after onBandwidthChanged callback for connection_medium.
Enable Instant Connection on the sender.
Update the triage tips for the WLAN upgrade failure.
Fix a bug in Aware iperf test and add unit test.
Unit test to validate utilities for running iperf on the devices
Move BeToCQ to hermetic overrides.

LGTM.


new PG, saved it without meta and then there is no way to save the meta afterwards without reloading the page

https://github.com/BabylonJS/Babylon.js/pull/2039


TypeError: unsupported operand type(s) for +: 'int' and 'NoneType'

When I use vllm to evaluate a model on dataset "ceval-valid", at the final stage of the program's execution, this error occurred.

I suspect it's because the logprob_dict.get() function is returning NoneType. However, I'm unsure how to modify the code to correctly avoid this issue. Moreover, when using vllm to evaluate other models and datasets, I encounter this error with some, while others execute correctly and produce evaluation results.

I tried this with pythia-410m on ceval-valid but couldn't reproduce this. Might be a tokenizer issue? What model are you using? I think something like
        try:
            continuation_logprobs = sum(
                logprob_dict.get(token)
                for token, logprob_dict in zip(
                    tokens[ctxlen:], continuation_logprobs_dicts[ctxlen:]
                )
            )
        except TypeError:
            print(f"ctxlen: {ctxlen}")
            print(f"Tokens: {tokens}")
            print(f"logprob_dict: {continuation_logprobs_dicts}")

would be an easy way to debug.

I tried this with pythia-410m on ceval-valid but couldn't reproduce this. Might be a tokenizer issue? What model are you using? Looks like the token is either being truncated when we index out the answer or there might be a bug with how we index the log-probabilities. I think something like
        try:
            continuation_logprobs = sum(
                logprob_dict.get(token)
                for token, logprob_dict in zip(
                    tokens[ctxlen:], continuation_logprobs_dicts[ctxlen:]
                )
            )
        except TypeError:
            print(f"ctxlen: {ctxlen}")
            print(f"Tokens: {tokens}")
            print(f"outputs: {outputs}")

would be an easy way to debug.

I use the model meta-llama/Llama-2-13b-hf, can you get it? And the model wenge-research/yayi-13b-llama2 also get the same problem on ceval-valid.


feat: multiple openers for a single rule

issue: #145

Thank you!
Seems like it could break the existing user config, as they would need to switch to arrays. Is it possible to support both arrays and strings, similar to the keymap rules:
https://github.com/sxyazi/yazi/blob/9c6b3c9d1d1763074341042ef0f74ab45bb56da1/config/preset/keymap.toml#L31-L32
Here is the implementation code:
https://github.com/sxyazi/yazi/blob/9c6b3c9d1d1763074341042ef0f74ab45bb56da1/config/src/keymap/exec.rs#L53-L88

Thank you, I made some simplifying. Merged!


Quick question re: blog

Just checking that the best way to add a blog is to run another Hugo instance in a subdir/subdomain (thinking of using Detox theme for the moment) and add an external link?
If there's another way to add posts, I'm all ears.
Thanks for the theme, it's great.

Hello @luxpir,
there was a similar question in the forum. Maybe the approaches described there work for you.
The config file allows you to add custom links easily.

hi,
I'm gonna echo what a lot of others have asked for - which is blog support. I also see the support for block templates in issue #41 .
I'm wondering how do you guys go about combining two different themes in hugo ? ultimately, I'm gonna be hosting on github pages. so I want one codebase that I can generate html files from and upload to github pages.
abc.github.io -> main site (agency theme)
abc.github.io/blog -> blog site
how do I do this - does anyone have an example ?

As hugo-agency-theme is mostly in maintainance mode and no new features will be added.
We created Syna as a more flexible iteration of this theme.
Syna can create a native blog integration (currently without an rss feed for now) with the combination of the list and content fragments


Question: how to cache GraphQL responses

We've been using Spring GraphQL since the early betas, and now we're at a point that we want to cache some responses.
Spring Cache using @Cacheable works for single methods, and saves the return value of the method. But we want to cache the full object tree, so also all the data returned from child controllers, and the dataloaders they might use.
Is there a solution for this where we don't need to collect the full object tree in a single method beforehand?
To give an example scenario where we want to use this: we return a product list to the client that is composed of a "product list", containing sections and nodes, where each node has a product, products have variants and options, and product variants have options them self too. We can efficiently generate a reliable cache key for the product list, so we want to cache the product list as a whole, and we don't really care about caching individual entities below it.

We've been using Spring GraphQL since the early betas

Yes, we know and thanks for all the feedback and contributions so far!
The full object tree depends also on the selection set. Is this what you mean by generating a reliable cache key? Generally, a WebGraphQlInterceptor is in the best position to intercept the full response. At the controller method / DataFetcher you don't have that visibility.
It's also a broader question, if GraphQL Java provides any hooks that may be of use, or where we might be able to help, like a longer lived DataLoader, or perhaps something related to persisted queries? Some clients provide caching too.

The full object tree depends also on the selection set.

This is something I did realize a bit later indeed. For now we went with building a full data object upfront, because the dependencies weren't efficiently resolvable using dataloaders (we had to use some sequential dataloaders with manual dispatch).
Still the question of caching a response and using the selection set as cache key sounds like an interesting approach, and I think that should indeed be doable using an interceptor.
If we ever try it out I'll report back here.

Okay, thanks. Closing for now.

If anyone still faces they can use batch mapping for this purpose. We faced the exact same issue and solved it using Batch Mapping. More details - https://blog.stackademic.com/caching-problem-with-graphql-in-spring-boot-8021fe6089d7


test: put test into unnamed namespace as much as possible

Description:
There is no reason tests are not in unnamed namespace unless needed by FRIEND_TEST, they don't need external linkage. It also saves about 10% of compiling / linking time for the test.cc and binary based on my quick experiment with GCC.

Description:
There is no reason tests are not in unnamed namespace unless needed by FRIEND_TEST, they don't need external linkage. It also saves about 10% of compiling / linking time for the test.cc and binary based on my quick experiment with GCC.

@lizan i'm interested with the issue, could you guide me through?

@Sai-Adarsh Thanks, I have some sample here, basically just put the whole test into a namespace { and } across all test files (and remove global static if there are), try build and test.

Seeing it inactive for a couple of weeks have opened a supporting PR for this issue.


feat:add total task time to callback param

tableData in cb doesn't include the total time, which is inconvenient to figure out the total build time.
Or are we suggesting sum up every task time in tableData?

@dickeylth I checked out your branch and did a test run but I still don't see the total time showing up. Can you provide an example of how to use your change?

Sorry, this project is deprecated because Grunt is no longer actively maintained, so it doesn't make sense for me to maintain this either.


Feat(eos_cli_config_gen): Add port-channel esi and rt deprecation warnings

Change Summary
Depends on #2369
Adds deprecation warnings for old port-channel esi and rt vars which are replaced by ethernet_segment.identifier and ethernet_segment.route_target.
Related Issue(s)
Fixes #1297
Component(s) name
arista.avd.eos_cli_config_gen
How to test
Tested with molecule.
Checklist
Repository Checklist

[x] My code has been rebased from devel before I start
[x] I have read the CONTRIBUTING document.
[x] My change requires a change to the documentation and documentation have been updated accordingly.
[x] I have updated molecule CI testing accordingly. (check the box if not applicable)

@emilarista please rebase this one and make sure you get deprecation warning when running with the old keys


ClickOnce Dev env crashes

When I try to open the code view for a table, the finsql.exe is crashing with the following event:
Application: finsql.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.IO.FileNotFoundException    at <Module>.SetTypeInfoService(Void*)    at <Module>._WinMainCRTStartup()
Faulting application name: finsql.exe, version: 11.0.18246.0, time stamp: 0x59a4aefc Faulting module name: KERNELBASE.dll, version: 10.0.15063.502, time stamp: 0xc3955624 Exception code: 0xe0434352 Fault offset: 0x000eb802 Faulting process id: 0xe88 Faulting application start time: 0x01d32669db16c286 Faulting application path: C:\Temp\RoleTailored Client\finsql.exe Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll Report Id: eba8c9b5-3d3b-4c26-8575-add07c7c455f Faulting package full name:  Faulting package-relative application ID:
Is this an issue with the ClickOnce deploy or something in the docker image? Had no time to actually research it in more detail.

Please,
I would recommend to include some details about the image you use (at least this would be very helpful).
You can use:
docker inspect --format "{{ index .Config.Labels }}" [your_container_name_or_id]

Sorry, September preview W1:
map[tag:<IP_ADDRESS> version:11.0.18246.0 country:W1 created:201708312002 cu:september legal:http://go.microsoft.com/fwlink/?LinkId=837447 maintainer:Freddy Kristiansen nav:devpreview]

Just to confirm - I am running NAV 2017 CU 9 image tagged with <IP_ADDRESS> and everything works fine (I can open standard C/SIDE editor, change objects, sync table schemas and even run RTC directly from C/SIDE).

Looks like wrong assemblies? Do you use an old clickonce installation of C/Side
I use the dev-preview container and this version works well.

I can see one strange thing: Faulting application path: C:\Temp\RoleTailored Client\finsql.exe. This path does not look like a ClickOnce folder.

Yes, I noticed that as well, the folder doesn't even exist. So after rebooting it seems to work right now, but I don't understand where this would be coming from. ClickOnce was removed before and also wouldn't be included in Temp or anything. I guess, i'll close this for now and I'll open it again when it doesn't work again.


Can't build 0.8-preview and there is no build information at all

I want to write some patch for Polymer, but looks like it is better to do against 0.8-preview branch, there is much more activity there lastly.
But
npm install
grunt

Doesn't work, and there is no information why. Any suggestions?

Found build.bat, built with:
vulcanize polymer.html --csp  --strip -output dist/polymer.html

Really awesome approach)


fix init process  exited event lost

@laurazard after this commit https://github.com/containerd/containerd/commit/892dc54bd26f6e8b9aea4672208b1ba2158d8a1b
we find init exited events sometimes will be dropped.
fix:https://github.com/containerd/containerd/issues/10589
@imo-ininder

I add some sleep can reproduce it
func (s *service) preStart(c *runc.Container) (handleStarted func(*runc.Container, process.Process), cleanup func()) {
	exits := make(map[int][]runcC.Exit)
	s.exitSubscribers[&exits] = struct{}{}

	if c != nil {
		// Remove container init process from s.running so it will once again be
		// treated as an early exit if it exits before handleStarted is called.
		pid := c.Pid()
		var newRunning []containerProcess
		for _, cp := range s.running[pid] {
			if cp.Container != c {
				newRunning = append(newRunning, cp)
			}
		}
		if len(newRunning) > 0 {
			s.running[pid] = newRunning
		} else {
			delete(s.running, pid)
		}
	}

	handleStarted = func(c *runc.Container, p process.Process) {
		var pid int
		if p != nil {
			pid = p.Pid()
		}

		_, init := p.(*process.Init)
		if !init {
			time.Sleep(time.Second * 30)
		}
		s.lifecycleMu.Lock()

		var initExits []runcC.Exit
		var initCps []containerProcess
		if !init {
			time.Sleep(time.Second * 30)

/ok-to-test

/ok-to-test

done! thank you.

@ningmingxiao can you explain why the exits are being lost/how this fixes it?
The original code skips exit events for init processes for as long as there is a pending exec for that container, and stores those skipped events in s.running for that pid.
This is because exits for the init process shouldn't be sent while there are still unresolved pending execs.
Those skipped events should then be processed after the pending execs are resolved.
Simple emitting those exit events where this change does (before the pending execs have been resolved) doesn't look correct (but I need to take a better look).

I also don't really understand your repro instructions: you're adding a time.Sleep, for the !init case, twice, once before the lifecycleMu.Lock() and once after. What does this demonstrate?
Trying to reproduce this, after killing the init process, the container correctly shows as stopped –
$  sudo ctr run -d docker.io/library/alpine:latest test sh -c "while true; do sleep 1; done"
$ sudo ctr t exec -d --exec-id 1 test sleep 120
[this hangs because of the introduced sleep]

[on another terminal]
$ ps aux | grep sleep
root       46277  0.0  0.0   1720   896 ?        Ss   12:44   0:00 sh -c while true; do sleep 1; done
root       46381  0.0  0.0  14060  4224 pts/10   S+   12:44   0:00 sudo ctr t exec -d --exec-id 1 borkeee sleep 120
root       46383  0.0  0.0  14060  1572 pts/9    Ss   12:44   0:00 sudo ctr t exec -d --exec-id 1 borkeee sleep 120
root       46384  0.0  0.2 1987836 23040 pts/9   Sl+  12:44   0:00 ctr t exec -d --exec-id 1 borkeee sleep 120
root       46404  0.0  0.0   1704   768 ?        Ss   12:44   0:00 sleep 120

$ kill -9 46277
$ sudo ctr t ls
TASK       PID      STATUS
test    46277    STOPPED

 root@LIN-FB738BFD367 pods]# cat pod.json
{
    "metadata": {
       "name": "sandbox-01027951850",
        "namespace": "default",
        "attempt": 1,
        "uid": "hdishd83djaidwnduwk28bcsb"
    },
    "log_directory": "/tmp",
    "linux": {
    }
}

[root@LIN-FB738BFD367 pods]# cat container.json
{
        "metadata": {
                "name": "gpu"
        },
        "image": {
                "image": "docker.io/library/busybox:1.28"
        },
        "command": [
                "top"
        ],
        "tty":true

}

[root@LIN-FB738BFD367 pods]#  crictl  run --no-pull container.json  pod.json
1e5aec477334f2616131c2d3f710af349aca0224c2261f6b5052d98667091767
[root@LIN-FB738BFD367 pods]#  crictl  run --no-pull container.json  pod.json
5f6c4461e154f2399ec4fa473fac931a68df67bc59be46fe16936f0d2d3113d9
[root@LIN-FB738BFD367 pods]# crictl ps
CONTAINER           IMAGE                            CREATED             STATE               NAME                ATTEMPT             POD ID              POD
5f6c4461e154f       docker.io/library/busybox:1.28   2 seconds ago       Running             gpu                 0                   e2181ce0e5c30       unknown

# ps -auxf
root     1839998  0.0  0.0 1241592 14860 pts/9   Sl   20:40   0:00 /usr/bin/containerd-shim-runc-v2 -namespace k8s.io -id e2181ce0e5c3023358273e43
root     1840031  0.0  0.0   1024     4 ?        Ss   20:40   0:00  \_ /pause
root     1840091  0.0  0.0   1240     4 pts/0    Ss+  20:40   0:00  \_ top

[root@LIN-FB738BFD367 pods]# crictl exec -it 5f6 sh
open another terminlal
#
[root@LIN-FB738BFD367 ~]# kill -9 1840091
[root@LIN-FB738BFD367 ~]# crictl ps
CONTAINER           IMAGE                            CREATED             STATE               NAME                ATTEMPT             POD ID              POD
5f6c4461e154f       docker.io/library/busybox:1.28   38 seconds ago      Running             gpu                 0                   e2181ce0e5c30       unknown
# ps -auxf
root     1839998  0.0  0.0 1241592 14988 pts/9   Sl   20:40   0:00 /usr/bin/containerd-shim-runc-v2 -namespace k8s.io -id e2181ce0e5c3023358273e43
root     1840031  0.0  0.0   1024     4 ?        Ss   20:40   0:00  \_ /pause
root     1842880  0.0  0.0   1244     4 pts/1    Ss+  20:41   0:00  \_ sh

[root@LIN-FB738BFD367 ~]# kill -9 1842880
[root@LIN-FB738BFD367 ~]# crictl  ps
CONTAINER           IMAGE                            CREATED              STATE               NAME                ATTEMPT             POD ID              POD
5f6c4461e154f       docker.io/library/busybox:1.28   About a minute ago   Running             gpu                 0                   e2181ce0e5c30       unknown

after long time
crictl ps will show container is runing.
root@LIN-FB738BFD367 ~]# crictl ps
CONTAINER           IMAGE                            CREATED             STATE               NAME                ATTEMPT             POD ID              POD
5f6c4461e154f       docker.io/library/busybox:1.28   8 minutes ago       Running             gpu                 0                   e2181ce0e5c30       unknown

@laurazard

@ningmingxiao so this happens if you kill the main process while the exec is starting/preStart hasn't run yet for the exec? There might be a missing lock/unlock/deadlock issue there, I'm unsure. Can you explain what you think the issue is/how your change fixes it?
Since you introduced a sleep, by the time you try to start the exec/lock gets released it might be in a weird state. It could happen that the init exit gets skipped but since the exec fails somewhere unexpected it's also not appended/never gets processed.

I add some log find  init exit event will add in skipped
for _, initPidCp := range s.running[initPid] {
	if initPidCp.Container == c {
		initCps = append(initCps, initPidCp)
	} else {
		skipped = append(skipped, initPidCp)
	}
}

and   handleProcessExit never run. exited is nil
		if pid == 0 || exited {
			s.lifecycleMu.Unlock()
			for _, ee := range ees {
				s.handleProcessExit(ee, c, p)
			}
			for _, eee := range initExits {
				for _, cp := range initCps {
					s.handleProcessExit(eee, cp.Container, cp.Process)
				}
			}
		}

Where are the logs for the exec started in https://github.com/containerd/containerd/pull/10603#issuecomment-2293504209?

anotter way reproduce  don't add sleep
 root@LIN-FB738BFD367 pods]# cat pod.json
{
    "metadata": {
       "name": "sandbox-01027951850",
        "namespace": "default",
        "attempt": 1,
        "uid": "hdishd83djaidwnduwk28bcsb"
    },
    "log_directory": "/tmp",
    "linux": {
    }
}

[root@LIN-FB738BFD367 pods]# cat container.json
{
        "metadata": {
                "name": "gpu"
        },
        "image": {
                "image": "docker.io/library/busybox:1.28"
        },
        "command": [
                "top"
        ],
        "tty":true

}

[root@LIN-FB738BFD367 pods]#  crictl  run --no-pull container.json  pod.json
1e5aec477334f2616131c2d3f710af349aca0224c2261f6b5052d98667091767

package main

import (
	"fmt"
	"os/exec"
	"sync"
	"time"
)

func main() {
	go func ()  {
		time.Sleep(time.Second*2)
		runCmd("kill -9 `pidof top`")
	}()
	test()
	fmt.Println("done")
}

func runCmd(command string) {
	cmd := exec.Command("bash", "-c", command)
	err := cmd.Run()
	if err != nil {
		fmt.Println(err)
	}
}

func test() {
	var wg sync.WaitGroup
	const numContainers = 500
	for i := 1; i <= numContainers; i++ {
		wg.Add(1)
		go func(i int) {
			defer wg.Done()
			runCmd("crictl exec 1e5aec477 date")
		}(i)
	}
	wg.Wait()
}

crictl ps show container still running.

Does this only happen to you when using crictl/pods? Can you reproduce this just creating a container (using ctr)?
Such as:

ctr run -d docker.io/library/alpine:latest test2 top

and
package main

import (
	"fmt"
	"os/exec"
	"sync"
	"time"
)

func main() {
	go func() {
		time.Sleep(time.Second * 2)
		runCmd("kill -9 `pidof top`")
	}()
	test()
	fmt.Println("done")
}

func runCmd(command string) {
	cmd := exec.Command("bash", "-c", command)
	err := cmd.Run()
	if err != nil {
		fmt.Println(err)
	}
}

func test() {
	var wg sync.WaitGroup
	const numContainers = 500
	for i := 1; i <= numContainers; i++ {
		wg.Add(1)
		go func(i int) {
			defer wg.Done()
			runCmd(fmt.Sprintf("ctr t exec --exec-id %d test date", i))
		}(i)
	}
	wg.Wait()
}

?

It's important to try to remove variables to nail down where the issue is. If this isn't reproducible without creating a pod, then it's likely that the issue isn't in the shim itself, or at least it gives us hints as where to start looking at.

/cc

https://github.com/containerd/containerd/pull/10560 should help get the state of the task within the shim.  This is only on main right now, but if you're querying a 1.7 shim you'll want to include --api-version 2 to talk to the older shim.  If the shim still thinks the task is running, we'll know whether the bug is in the shim; if the shim doesn't think the task is running, the bug is likely within the main containerd daemon.

I adapted @ningmingxiao  repro a bit  -- https://gist.github.com/bobbypage/6075c9b04e0b0e26696248dc8424bcc4 and was able to reproduce as well.
Ran on a node with contaienrd 1.7.15
# containerd --version
containerd github.com/containerd/containerd 1.7.15 926c9586fe4a6236699318391cd44976a98e31f1

Process tree output:
# ps -faux
root       25138  0.9  0.3 1239020 14396 ?       Sl   23:16   0:03 /usr/bin/containerd-shim-runc-v2 -namespace k8s.io -id db419f8da4869b5ebb78be6fce42211608d2a4ca3a4da4a6128f3724787146fb -address /run/containerd/containerd.sock
65535      25158  0.0  0.0   1028     4 ?        Ss   23:16   0:00  \_ /pause

Container appears to be running (but the process is not anymore...)
gke-dp-stuck-2-repro-default-pool-460b00b1-ndm1 ~ # crictl ps -name repro
CONTAINER           IMAGE                            CREATED             STATE               NAME                ATTEMPT             POD ID              POD
ea588a30362e3       docker.io/library/busybox:1.28   9 minutes ago       Running             repro-container     0                   db419f8da4869       unknown

Using @samuelkarp shim state change of https://github.com/containerd/containerd/pull/10560, I obtained the status:
# ./ctr -n k8s.io shim --id db419f8da4869b5ebb78be6fce42211608d2a4ca3a4da4a6128f3724787146fb state -t ea588a30362e31ebfc0e88ca3cb6f5b8a067f95ab1a116f9ab05c7cd867a15e2 --api-version 2
{
    "id": "ea588a30362e31ebfc0e88ca3cb6f5b8a067f95ab1a116f9ab05c7cd867a15e2",
    "bundle": "/run/containerd/io.containerd.runtime.v2.task/k8s.io/ea588a30362e31ebfc0e88ca3cb6f5b8a067f95ab1a116f9ab05c7cd867a15e2",
    "pid": 25191,
    "status": 2,
    "stdout": "/run/containerd/io.containerd.grpc.v1.cri/containers/ea588a30362e31ebfc0e88ca3cb6f5b8a067f95ab1a116f9ab05c7cd867a15e2/io/2604110301/ea588a30362e31ebfc0e88ca3cb6f5b8a067f95ab1a116f9ab05c7cd867a15e2-stdout",
    "stderr": "/run/containerd/io.containerd.grpc.v1.cri/containers/ea588a30362e31ebfc0e88ca3cb6f5b8a067f95ab1a116f9ab05c7cd867a15e2/io/2604110301/ea588a30362e31ebfc0e88ca3cb6f5b8a067f95ab1a116f9ab05c7cd867a15e2-stderr",
    "terminal": true,
    "exited_at": {
        "seconds": -62135596800
    }
}

for pause
 # ./ctr -n k8s.io shim --id db419f8da4869b5ebb78be6fce42211608d2a4ca3a4da4a6128f3724787146fb state -t db419f8da4869b5ebb78be6fce42211608d2a4ca3a4da4a6128f3724787146fb --api-version 2
{
    "id": "db419f8da4869b5ebb78be6fce42211608d2a4ca3a4da4a6128f3724787146fb",
    "bundle": "/run/containerd/io.containerd.runtime.v2.task/k8s.io/db419f8da4869b5ebb78be6fce42211608d2a4ca3a4da4a6128f3724787146fb",
    "pid": 25158,
    "status": 2,
    "exited_at": {
        "seconds": -62135596800
    }
}

Thanks! Appreciate the digging in. I'll take a better look at this with more time tomorrow/next week!
I think there's definitely an issue, I just don't think this is the correct solution. I'm wondering if this only reproduces when the container is sharing a pid namespace with another container.

I see. In that case, there must be some faulty logic in the current implementation.
Supposedly, if we get an exit event for the init process while there are pending execs for that container, we skip emitting it at that time so that we can emit it after we process the pending execs. This is done by not emitting it in processExits: https://github.com/containerd/containerd/blob/a68f9b7c56d9ef2bf519f5bdeee04bf472225d8e/cmd/containerd-shim-runc-v2/task/service.go#L683-L693
and instead adding it to s.running keyed by it's pid, and then emitting it (after emitting the exec's own exit event) in the handleStarted closure for the pending exec: https://github.com/containerd/containerd/blob/a68f9b7c56d9ef2bf519f5bdeee04bf472225d8e/cmd/containerd-shim-runc-v2/task/service.go#L187-L226
All the accesses to s.running and s.pendingExecs should be guarded by s.lifecycleMu, but I suppose there might be some condition where we drop the init exit without emitting it.
This functionality also assumes that we'll always receive the exec exits before we do the init events – otherwise, if there are pending execs, we'll skip the init event exit expecting that it'll get processed by the handleStarted closure for the exec, but by the time we call handleStarted for the relavant exec, we might not have received it's exit yet, which would cause us to not emit the exit for the init process.
We discussed this more in https://github.com/containerd/containerd/issues/9719#issuecomment-1930147054

we should delete s.pendingExecs[c] == 0  and s.pendingExecs[c]-- is too early I create another pr https://github.com/containerd/containerd/pull/10606/files
I'm not very familiar with these code  @laurazard

That s.pendingExecs[c] == 0 is there to ensure that we only send the exit event after the last exec for the container has been processed. Otherwise that would happen on the first one.

That s.pendingExecs[c] == 0 is there to ensure that we only send the exit event after the last exec for the container has been processed. Otherwise that would happen on the first one. We should not attempt to run that entire block of code unless the exec we're processing the exit for is the last pending exec in the container.
Your other PR will attempt to send the exit event for the init process for the first resolved pending exec, even if there are hundreds (such as in your repro). Let's think about why the fence is there in the first place before attempting to remove it.

how about new pr ? if init pid exited, we will not  run new exec. I make some test, it can solve the problem.

Unfortunately I can't reproduce this :(
 ⭑ containerd --version
containerd github.com/containerd/containerd v1.7.15.m 926c9586fe4a6236699318391cd44976a98e31f1.m

After running @bobbypage's repro –
⭑ crictl ps -a
CONTAINER           IMAGE                              CREATED             STATE               NAME                ATTEMPT             POD ID              POD
d3c513f4e8793       docker.io/library/busybox:stable  56 seconds ago      Exited              repro-container     0                   1fea61cf272ea       unknown

Logs here.

Asides from that, I've been thinking about this over the weekend and while I haven't been able to repro the issue/can't confirm this, it looks to me like this block: https://github.com/containerd/containerd/blob/0ecaec4dde2c80dd784a0027d523628b4c33da5b/cmd/containerd-shim-runc-v2/task/service.go#L712-L720
is likely causing issues.
This block checks if the process we're processing the init of is the init process, and if runc.ShouldKillAllOnExit is true, attempts to do so. Pre-exit event handling changes, this would be called as soon as we received an exit for the init process. However, since we're now delaying processing that exit, and this block is inside handleProcessExit, it won't get called until we're actually processing the exits for it's pending execs – meaning we won't kill them on (init process) exit, meaning we might not have their exits to resolve the pending execs.

@fuweid  @samuelkarp   @laurazard   please review my new pr, thank you.

@bobbypage could you post some containerd debug logs from running your repro? If possible with some extra logs such as with 511ed30
maybe because SIGCHLD is unreliable signal. (if user container doesn't share pause pid ns). add some log is necessary.

I don't think the issue is SIGCHLD's reliability, but I do wonder if the issue has something to do with us dropping exits in the reaper when there are too many. If we drop an exit in the reaper, that might cause the handleStarted closure to not be aware that the pending exec failed, and as such not try to send it's init's exit.
This should have been there from the start, but I made some changes in https://github.com/containerd/containerd/pull/10608 to make sure we send the pending init exit regardless of whether there was an early exit for the pending exec or not.

I ran @bobbypage's repro and reproduced the problem fairly easily on a build of 1.7.15.  I've modified the shim with extra logging per https://github.com/containerd/containerd/commit/511ed30d386fa8fe600959f307b7eb1dccdf3fc1 (https://github.com/containerd/containerd/commit/82c426fa07e80ea5988379f29e278247bde1265c).
samuelkarp@gke-rapid-default-pool-91865e43-9wka ~ $ sudo ctr -n k8s.io t ls
WARN[0000] DEPRECATION: The `mirrors` property of `[plugins."io.containerd.grpc.v1.cri".registry]` is deprecated since containerd v1.5 and will be removed in containerd v2.0. Use `config_path` instead.
TASK                                                                PID        STATUS
3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29    2087476    RUNNING
3d0fc72c273228bbc2ecaaed3453c3ad824f3c8bf45f7ddbdda473b8746b1033    2087445    RUNNING
samuelkarp@gke-rapid-default-pool-91865e43-9wka ~ $ ps 2087476
    PID TTY      STAT   TIME COMMAND
samuelkarp@gke-rapid-default-pool-91865e43-9wka ~ $ ps 2087445
    PID TTY      STAT   TIME COMMAND
2087445 ?        Ss     0:00 /pause
samuelkarp@gke-rapid-default-pool-91865e43-9wka ~ $ sudo /home/kubernetes/bin/ctr -n k8s.io shim --id 3d0fc72c273228bbc2ecaaed3453c3ad824f3c8bf45f7ddbdda473b8746b1033 state -t 3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29 --api-version 2
3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29
{
    "id": "3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29",
    "bundle": "/run/containerd/io.containerd.runtime.v2.task/k8s.io/3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29",
    "pid": 2087476,
    "status": 2,
    "stdout": "/run/containerd/io.containerd.grpc.v1.cri/containers/3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29/io/961715579/3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29-stdout",
    "stderr": "/run/containerd/io.containerd.grpc.v1.cri/containers/3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29/io/961715579/3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29-stderr",
    "terminal": true,
    "exited_at": {
        "seconds": -62135596800
    }
}

Log file: containerd.log
This looks like the earliest failure:
Aug 19 22:37:24 gke-rapid-default-pool-91865e43-9wka containerd[2080407]: E0819 22:37:24.787898 2080407 exec.go:87] error executing command in container: failed to exec in container: failed to start exec "96ab9daa87d439e6daa5697fd263dabb5453add8f9b7f8dcb97b6d1313946a9b": OCI runtime exec failed: exec failed: unable to start container process: error executing setns process: exit status 1: unknown

This is super useful, thanks!
I see the init exit being skipped due to pending execs:
Aug 19 22:37:24 gke-rapid-default-pool-91865e43-9wka containerd[2080407]: time="2024-08-19T22:37:24.729373934Z" level=debug msg="processExits: skipping exit" container=3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29 pid=2087476 runtime=io.containerd.runc.v2

But there are no logs for the last pending exec – such as from:https://github.com/containerd/containerd/blob/511ed30d386fa8fe600959f307b7eb1dccdf3fc1/cmd/containerd-shim-runc-v2/task/service.go#L189
This is likely due to the fact that we continue seeing a lot of https://github.com/containerd/containerd/blob/511ed30d386fa8fe600959f307b7eb1dccdf3fc1/cmd/containerd-shim-runc-v2/task/service.go#L314
Which means s.pendingExecs for the container keeps being incremented and we never get a chance to process the exit. Even if this eventually happens, by the time it does, the exec being processed was likely started long after the init process exit has been processed, and so subscribed to the exits after the exit had been broadcast to the subscribers, and as such won't have it to emit. Something like this:

I'm assuming this doesn't happen in the "init container process is the pid namespace init process" because in that case, as soon as that process exits all processes in the container are killed.
We can either skip exit event ordering when the container init process != pid namespace init process, or do something like prevent new execs from being added while we're waiting to emit the init exit.
It is noteworthy that, after the init process ends, we start seeing early exits for the execs:
Aug 19 22:37:24 gke-rapid-default-pool-91865e43-9wka containerd[2080407]: time="2024-08-19T22:37:24.729373934Z" level=debug msg="processExits: skipping exit" container=3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29 pid=2087476 runtime=io.containerd.runc.v2
[...]
Aug 19 22:37:24 gke-rapid-default-pool-91865e43-9wka containerd[2080407]: E0819 22:37:24.825387 2080407 exec.go:87] error executing command in container: failed to exec in container: failed to start exec "3ea22f119bb80ad1dec5e7ac79d67c6a8e316f412d30b7500a7ad9bbced66413": OCI runtime exec failed: exec failed: unable to start container process: error adding pid 2088539 to cgroups: failed to write 2088539: openat2 /sys/fs/cgroup/test.slice/cri-containerd-3a2e74cdcf4c3abf290475aed85b0907be8eeb0b598f0a05ea178f748cbf3e29.scope/cgroup.procs: no such file or directory: unknown
[...]
Aug 19 22:37:24 gke-rapid-default-pool-91865e43-9wka containerd[2080407]: E0819 22:37:24.847976 2080407 exec.go:87] error executing command in container: failed to exec in container: failed to start exec "52c0b707fab4f458073ea0b3dacbfbb22a7ca6b09ab691655ce92f4251e5b8a8": OCI runtime exec failed: exec failed: cannot exec in a stopped container: unknown

And as such preventing new incoming execs might not be a terrible idea either.

so prevent unnecessary exec (if init process is exited) is necessary,I test my pr. It works well.

I'm assuming this doesn't happen in the "init container process is the pid namespace init process" because in that case, as soon as the init process exits, all subsequent execs immediately fail, so the shim gets a chance to process the init exit.

The init container process is the pid namespace init process in this case; the container has its own private pid namespace (not shared with the pod or with the host).

It is noteworthy that, after the init process ends, we start seeing early exits for the execs

Yes, because the pid namespace has been torn down by that point (pid 1 exited), so no further processes can start.  The very first failing exec process has this line:
OCI runtime exec failed: exec failed: unable to start container process: error executing setns process: exit status 1: unknown

This seems to indicate that the pid namespace is already gone.  Subsequent exec early exits have this message:
OCI runtime exec failed: exec failed: cannot exec in a stopped container: unknown

This one seems to indicate that runc has (correctly) recorded that the container is stopped, but containerd does not know that.

I am adding a containerd integration test to repro this issue, ptal at https://github.com/containerd/containerd/pull/10620

Yes, because the pid namespace has been torn down by that point (pid 1 exited), so no further processes can start. The very first failing exec process has this line:

This makes sense, I just got confused since @ningmingxiao had said that the repro required a shared pid namespace.
It's likely still the same cause I pointed out though, from looking through the logs.
In this case, at least in the container init == pid namespace init, the subsequent execs are going to fail anyway, we might as well stop accepting new execs (for that container). However, we should figure out what to do in the shared pid namespace scenario.

another way to fix https://github.com/containerd/containerd/pull/10625

/cc

@ningmingxiao Would you be open to amending your PR to only prevent new execs from being started after the init process has exited, without the rest of the changes?

@ningmingxiao Would you be open to amending your PR to only prevent new execs from being started after the init process has exited, without the rest of the changes?

done

@bobbypage, could you test @ningmingxiao's latest changes (in this PR)?

@bobbypage, could you test @ningmingxiao's latest changes (in this PR)?

issue still exist
[root@LIN-FB738BFD367 pods]# crictl  run --no-pull container.json  pod.json
fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0
[root@LIN-FB738BFD367 pods]# crictl  inspect fce|grep -i pid
"pid": 627351,
"path": "/proc/627316/ns/pid",
"type": "pid"
[root@LIN-FB738BFD367 pods]# go run main.go
crictl exec fce217 sleep 6
crictl exec fce217 sleep 16
crictl exec fce217 sleep 19
crictl exec fce217 sleep 2
crictl exec fce217 sleep 3
crictl exec fce217 sleep 12
crictl exec fce217 sleep 16
crictl exec fce217 sleep 20
crictl exec fce217 sleep 17
crictl exec fce217 sleep 9
exit status 1
exit status 1
exit status 1
exit status 1
exit status 1
exit status 1
exit status 1
exit status 1
done
[root@LIN-FB738BFD367 pods]# crictl  ps
CONTAINER           IMAGE               CREATED             STATE               NAME                ATTEMPT             POD ID              POD
[root@LIN-FB738BFD367 pods]#
INFO[2024-08-23T18:03:41.695200570+08:00] RunPodSandbox for &PodSandboxMetadata{Name:sandbox-01027951966,Uid:hdishd83djaidwnduwk28bcsb,Namespace:default,Attempt:1,}
INFO[2024-08-23T18:03:41.892811340+08:00] connecting to shim e88d2ef850660c793dc5c44599a2e5edb3858439f2abb3c5627721eec29c1ba3  address="unix:///run/containerd/s/3851055a471c357447e61ca1956848ddc02c8051336b93c26aa2447f51540646" namespace=k8s.io protocol=ttrpc version=3
INFO[2024-08-23T18:03:42.040129563+08:00] RunPodSandbox for &PodSandboxMetadata{Name:sandbox-01027951966,Uid:hdishd83djaidwnduwk28bcsb,Namespace:default,Attempt:1,} returns sandbox id "e88d2ef850660c793dc5c44599a2e5edb3858439f2abb3c5627721eec29c1ba3"
INFO[2024-08-23T18:03:42.042273774+08:00] CreateContainer within sandbox "e88d2ef850660c793dc5c44599a2e5edb3858439f2abb3c5627721eec29c1ba3" for container &ContainerMetadata{Name:gpu,Attempt:0,}
INFO[2024-08-23T18:03:42.042740949+08:00] Logging will be disabled due to empty log paths for sandbox ("/tmp") or container ("")
INFO[2024-08-23T18:03:42.068982986+08:00] CreateContainer within sandbox "e88d2ef850660c793dc5c44599a2e5edb3858439f2abb3c5627721eec29c1ba3" for &ContainerMetadata{Name:gpu,Attempt:0,} returns container id "fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"
INFO[2024-08-23T18:03:42.069910140+08:00] StartContainer for "fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"
INFO[2024-08-23T18:03:42.070927404+08:00] connecting to shim fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0  address="unix:///run/containerd/s/3851055a471c357447e61ca1956848ddc02c8051336b93c26aa2447f51540646" protocol=ttrpc version=3
INFO[2024-08-23T18:03:42.174665952+08:00] StartContainer for "fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0" returns successfully
WARN[2024-08-23T18:03:47.848810223+08:00] container event discarded                     container=8bc154a72362e2b22a1a43ef37d1ea9212dca9d33a8e3af54b400fc4c080eb8e type=CONTAINER_CREATED_EVENT
WARN[2024-08-23T18:03:47.848918274+08:00] container event discarded                     container=8bc154a72362e2b22a1a43ef37d1ea9212dca9d33a8e3af54b400fc4c080eb8e type=CONTAINER_STARTED_EVENT
WARN[2024-08-23T18:03:47.884291605+08:00] container event discarded                     container=bf05d5da4b50196ef116abeaa18b722be474fbbfc1b250b8f6a94c621b494d16 type=CONTAINER_CREATED_EVENT
WARN[2024-08-23T18:03:47.995734841+08:00] container event discarded                     container=bf05d5da4b50196ef116abeaa18b722be474fbbfc1b250b8f6a94c621b494d16 type=CONTAINER_STARTED_EVENT
WARN[2024-08-23T18:05:05.706558055+08:00] container event discarded                     container=8bc154a72362e2b22a1a43ef37d1ea9212dca9d33a8e3af54b400fc4c080eb8e type=CONTAINER_STOPPED_EVENT
WARN[2024-08-23T18:05:07.215687270+08:00] container event discarded                     container=bf05d5da4b50196ef116abeaa18b722be474fbbfc1b250b8f6a94c621b494d16 type=CONTAINER_STOPPED_EVENT
time="2024-08-23T18:05:26.005301412+08:00" level=info msg="exec pid is 631568"
time="2024-08-23T18:05:26.028950955+08:00" level=info msg="exec pid is 631583"
time="2024-08-23T18:05:26.066564737+08:00" level=info msg="exec pid is 631628"
time="2024-08-23T18:05:26.067044703+08:00" level=info msg="exec pid is 631605"
time="2024-08-23T18:05:26.067648244+08:00" level=info msg="exec pid is 631617"
time="2024-08-23T18:05:26.075595696+08:00" level=info msg="exec pid is 631666"
time="2024-08-23T18:05:26.079793881+08:00" level=info msg="exec pid is 631688"
time="2024-08-23T18:05:26.085256244+08:00" level=info msg="exec pid is 631683"
time="2024-08-23T18:05:26.085500650+08:00" level=info msg="exec pid is 631707"
time="2024-08-23T18:05:26.102152592+08:00" level=info msg="exec pid is 631713"
time="2024-08-23T18:05:28.022841631+08:00" level=info msg="send pid 631568"
INFO[2024-08-23T18:05:28.023685318+08:00] TaskExit event in podsandbox handler container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"4c6ade742294f1748afcc00d008b4be35f15f243a5b766260d65131fa927b2d0"  pid:631568  exited_at:{seconds:1724407528  nanos:22806886}
time="2024-08-23T18:05:29.030372608+08:00" level=info msg="send pid 631583"
INFO[2024-08-23T18:05:29.030811037+08:00] TaskExit event in podsandbox handler container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"55897871733d085d7d59c38280cc0c28d60b9795e1aa1486085fc462807bc848"  pid:631583  exited_at:{seconds:1724407529  nanos:30357234}
time="2024-08-23T18:05:29.889889835+08:00" level=info msg="send pid 627351"
time="2024-08-23T18:05:29.889937375+08:00" level=info msg="send pid 631628"
time="2024-08-23T18:05:29.889948036+08:00" level=info msg="send pid 631605"
time="2024-08-23T18:05:29.889956219+08:00" level=info msg="send pid 631617"
time="2024-08-23T18:05:29.889970747+08:00" level=info msg="send pid 631666"
time="2024-08-23T18:05:29.889982210+08:00" level=info msg="send pid 631683"
time="2024-08-23T18:05:29.889989693+08:00" level=info msg="send pid 631707"
time="2024-08-23T18:05:29.889997077+08:00" level=info msg="send pid 631713"
INFO[2024-08-23T18:05:29.890473249+08:00] TaskExit event in podsandbox handler container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  pid:627351  exit_status:137  exited_at:{seconds:1724407529  nanos:889854119}
INFO[2024-08-23T18:05:29.890575716+08:00] TaskExit event in podsandbox handler container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"4afc311996784af79ba0f55db6b873beb9ef99e5ecdf4a5dc86bd9be5a01e204"  pid:631628  exit_status:137  exited_at:{seconds:1724407529  nanos:889932660}
INFO[2024-08-23T18:05:29.890685708+08:00] received exit event container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  pid:627351  exit_status:137  exited_at:{seconds:1724407529  nanos:889854119}
INFO[2024-08-23T18:05:29.891055339+08:00] TaskExit event in podsandbox handler container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"379e6707cd8995a706f824ddfa8cc3b3f1490536020aa63812ede4258c035a86"  pid:631605  exit_status:137  exited_at:{seconds:1724407529  nanos:889945868}
INFO[2024-08-23T18:05:29.891543360+08:00] TaskExit event in podsandbox handler container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"fd63aa3185d41d75a905287b0cdf93eec20e4b44a6920d6c1ebf9a229b40b804"  pid:631617  exit_status:137  exited_at:{seconds:1724407529  nanos:889954233}
INFO[2024-08-23T18:05:29.891789444+08:00] TaskExit event in podsandbox handler container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"0c1e168c91679f0461316ea5be0ed12c8a04fecedb14a06c05ddd30131b8c441"  pid:631666  exit_status:137  exited_at:{seconds:1724407529  nanos:889968436}
INFO[2024-08-23T18:05:29.893886195+08:00] TaskExit event in podsandbox handler container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"522afadde3a35122136030684ffb9c24d97254865f7c55a5891254cacae70745"  pid:631683  exit_status:137  exited_at:{seconds:1724407529  nanos:889976574}
INFO[2024-08-23T18:05:29.895882207+08:00] TaskExit event in podsandbox handler container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"52751dbbef19b6252436b7ecabddac2cce6a201688704a8befdcd86d4f2023eb"  pid:631707  exit_status:137  exited_at:{seconds:1724407529  nanos:889987738}
time="2024-08-23T18:05:29.895811513+08:00" level=info msg="send pid 622066"
INFO[2024-08-23T18:05:29.896263416+08:00] TaskExit event in podsandbox handler container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"f1fdf896627cf073f5be93f9c3e7b0466e82b3d3bba5c82a46b8897c4dc6ea3c"  pid:631713  exit_status:137  exited_at:{seconds:1724407529  nanos:889995560}
INFO[2024-08-23T18:05:29.896282753+08:00] received exit event container_id:"b2cd66b943f7f08735c01049a589cd96c1be516a2b3e9ce74cdb00c2ebe8683f"  id:"b2cd66b943f7f08735c01049a589cd96c1be516a2b3e9ce74cdb00c2ebe8683f"  pid:622066  exit_status:137  exited_at:{seconds:1724407529  nanos:895772145}
INFO[2024-08-23T18:05:29.896314736+08:00] TaskExit event in podsandbox handler container_id:"b2cd66b943f7f08735c01049a589cd96c1be516a2b3e9ce74cdb00c2ebe8683f"  id:"b2cd66b943f7f08735c01049a589cd96c1be516a2b3e9ce74cdb00c2ebe8683f"  pid:622066  exit_status:137  exited_at:{seconds:1724407529  nanos:895772145}
time="2024-08-23T18:05:29.897713099+08:00" level=info msg="send pid 631688"
INFO[2024-08-23T18:05:29.898127444+08:00] TaskExit event in podsandbox handler container_id:"fce217561d9543b1f6b19f4c5415bbcd68e0dea49e72d7f174910ce3deba7eb0"  id:"6e8ca7bdf72ce6dd4dc4d343908c141b8f708fdcdc5555af2913c11c18325f06"  pid:631688  exit_status:137  exited_at:{seconds:1724407529  nanos:897692508}
add some debug
	default:
		logrus.Infof("exec pid is %d",p.Pid())
		s.send(&eventstypes.TaskExecStarted{
			ContainerID: container.ID,
			ExecID:      r.ExecID,
			Pid:         uint32(p.Pid()),
		})
	}

and
func (s *service) handleProcessExit(e runcC.Exit, c *runc.Container, p process.Process) {
	if ip, ok := p.(*process.Init); ok {
		// Ensure all children are killed
		if runc.ShouldKillAllOnExit(s.context, c.Bundle) {
			if err := ip.KillAll(s.context); err != nil {
				log.G(s.context).WithError(err).WithField("id", ip.ID()).
					Error("failed to kill init's children")
			}
		}
	}

	p.SetExited(e.Status)
	logrus.Infof("send pid %d", e.Pid)
	s.send(&eventstypes.TaskExit{
		ContainerID: c.ID,
		ID:          p.ID(),
		Pid:         uint32(e.Pid),
		ExitStatus:  uint32(e.Status),
		ExitedAt:    protobuf.ToTimestamp(p.ExitedAt()),
	})

[root@LIN-FB738BFD367 pods]# cat main.go
package main

import (
        "fmt"
        "math/rand"
        "os/exec"
        "sync"
        "time"
)

func main() {
        go func() {
                time.Sleep(time.Second * 4)
                runCmd("kill -9 `pidof top`")
        }()
        test()
        fmt.Println("done")
}

func runCmd(command string) {
        cmd := exec.Command("bash", "-c", command)
        err := cmd.Run()
        if err != nil {
                fmt.Println(err)
        }
}

func test() {
        var wg sync.WaitGroup
        const numContainers = 10
        for i := 1; i <= numContainers; i++ {
                wg.Add(1)
                go func(i int) {
                        rand.Seed(time.Now().UnixNano())
                        randomNumber := rand.Intn(20) + 1
                        cmdcri := "crictl exec fce217 sleep " + fmt.Sprintf("%d", randomNumber)
                        fmt.Println(cmdcri)
                        defer wg.Done()
                        runCmd(cmdcri)
                }(i)
        }
        wg.Wait()
}

pid 627351  event is not last sent

...
time="2024-08-23T18:05:29.889889835+08:00" level=info msg="send pid 627351"
...

It looks like it was sent.
Also, your

[root@LIN-FB738BFD367 pods]# crictl  ps
CONTAINER           IMAGE               CREATED             STATE               NAME                ATTEMPT             POD ID              POD

Does not show the container still running. Am I missing something @ningmingxiao?

If you're running under a shared pid namespace, then killing the init process of the container will not ensure all other processes have exited. That's not an issue. The issue with the missing init exit is fixed though, right?

/cc @corhere

I don't think the task service is the right place to block execs from starting after the init process exits. Note how currently execs are blocked from being created after the init process has exited, despite the task service not checking. That precondition is handled lower down, in the process package. I think that, for consistency with container.Exec() returning an error when the init process has exited, container.Start() should also return an error when attempting to start an exec for an exited init process.

kill init children process when receive init process is exited.  and send event later. @corhere @laurazard

Closing in favor of https://github.com/containerd/containerd/pull/10650 and https://github.com/containerd/containerd/pull/10651 since work has moved there.


Automatic installation github.com/atom-community/linter

After installation I deleted github.com/atom-community/linter package
But, after restarting the editor it has again install!
Maybe you should make a checkbox in the settings?

Maybe you should make a checkbox in the settings?

We feel that linter is critical to a good experience :rose: You need to use both or none, sorry about that, you have the right to disagree and I definitely understand your point of view.


✨ Line highlight should appear behind ruler

The highlight should extend into the ruler rather than start after it ends.

Left: Xcode | Right: CodeEdit
This may or may not require #127.

Note: this may need to be a separate background behind the line number that lines up with the background behind the code on the right of it.

I would like to work on this issue


Details are ugly

Currently the detail page is quite ugly (in this one the tooltips are enabled, but it doesn't look much better without them):

I think it would be better if each criteria would inherit half the width (2 columns).

Fix with css-grid update


Ambient audio tracks, (any specific file or folder with the audio files?)

Hi can someone help me with this
},
"task_config": {
"ambient_noise_track": "office-ambience",
"hangup_after_LLMCall": false,
"hangup_after_silence": 10.0,
"ambient_noise": false,
"interruption_backoff_period": 0.0,
"backchanneling": false,
"backchanneling_start_delay": 5.0,
"optimize_latency": true,
"incremental_delay": 100.0,
"call_cancellation_prompt": null,
"number_of_words_for_interruption": 3.0,
"backchanneling_message_gap": 5.0,
"use_fillers": false
The ambient sound has a track
I wanna know where is that track coming from? Do we need to add our own audio file to some folder or is it using some cdn in some other file?

thanks for reporting this @abdulrahmanmajid . have merged the missing files now.


Fixes to make work with hubot 5.x

These updates helped me get hubot-test-helper working with the current 5.0.7 version of hubot.

👍 i'd love to see this merged as v2.0.0


Curly Hair emoji

Curly hair, afro, other hair styles, cuts, lengths and colors
Petitions

change.org

The candidate emojis for Unicode 11 include a Curly Hair emoji as U+1F9B1.
http://www.unicode.org/L2/L2017/17284-emoji-recs.pdf


[SPARK-15173][SQL] DataFrameWriter.insertInto should work with datasource table stored in hive

What changes were proposed in this pull request?
When we parse CREATE TABLE USING, we should build a CreateTableUsing plan with the managedIfNoPath set to true. Then we will add default table path to options when write it to hive.
How was this patch tested?
new test in SQLQuerySuite

cc @yhuai

Test build #57966 has started for PR 12949 at commit d831109.

Test build #57966 has finished for PR 12949 at commit d831109.

This patch fails Spark unit tests.
This patch merges cleanly.
This patch adds no public classes.

Merged build finished. Test FAILed.

Test FAILed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/57966/
Test FAILed.

Test build #57970 has started for PR 12949 at commit 338ae1d.

Test build #57970 has finished for PR 12949 at commit 338ae1d.

This patch fails Spark unit tests.
This patch merges cleanly.
This patch adds no public classes.

Merged build finished. Test FAILed.

Test FAILed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/57970/
Test FAILed.

Test build #58001 has started for PR 12949 at commit 167a7d6.

Test build #58003 has started for PR 12949 at commit 8f5b688.

Test build #58001 has finished for PR 12949 at commit 167a7d6.

This patch passes all tests.
This patch merges cleanly.
This patch adds no public classes.

Merged build finished. Test PASSed.

Test PASSed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/58001/
Test PASSed.

Test build #58003 has finished for PR 12949 at commit 8f5b688.

This patch passes all tests.
This patch merges cleanly.
This patch adds no public classes.

Merged build finished. Test PASSed.

Test PASSed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/58003/
Test PASSed.

Thanks! Merging to master and branch 2.0.


Return array on get followers and get following

getFollowers and getFollowing returned Promise<void> and wrote the output to a json file.
This merge request will return the users that are written to the file from getFollowers and getFollowing and will still write the out to the json file.

Thank you!

Thank you!


AAD policy check 3.7 is missing support for user exclusions

🐛 Summary
The Rego code for AAD policy check 3.7 is missing support for user/group exclusions. All of the policies related to conditional access should support exclusions for consistency.
To reproduce
Take a look at the source code for AAD policy 3.7 and you will see that it is missing the exclusion code block (taken from 3.8) in the screenshot below.

Expected behavior
I expected the policy to support exclusions so that it is consistent with all other policies related to conditional access.

@tkol2022 Julian and I are working on this issue, and we believe that AAD policy check 3.3 is also missing the user exclusions. Could you please take a look and confirm this?

@tkol2022 Julian and I are working on this issue, and we believe that AAD policy check 3.3 is also missing the user exclusions. Could you please take a look and confirm this?

Yes, that is be design. Although you can technically exclude users from showing login context information during MFA for authenticator, there probably wouldn't be any good reason for an organization to turn that off for any users.


Why is str happening?

I tried this command on my compute, with the same script.
I'm guessing there might be something wrong on your side of script? It might be caused by anti virus (if you have one)
If you restarted the bot and it's still showing you the same error, then you should make a bug report and tell me the steps you have done to get that error.

If @rockdude129 doesn't respond in 3 days I am closing this issue.

Yea I restarted, maybe update your code if you changed it just to be sure. Well I am on mac, using vs code and I copied the code in and stuff. Please try updating the code so I can see if it works.

Hmm I don't have a Mac computer, but I will not be able to fix this(bug) if I can't reproduce the bug.

Oh ok. Can you try using like a mac vm?

@rockdude129  Mac dosnt distribute there os sorry we cant

Oh ok

There are Mac OS iso images. I'm not going to say I have it in here (probably illegal). It's going to run at 5 FPS on my computer.


[enhancement] Tie text rendering to model position

Maybe extend the model definition to allow custom models to define the rotation and offset of text rendering in each hand?
At the very least, make it so this changes based on the offset of the books so they can be moved out of the way if desired.

This would also likely resolve #120


Update Nvidia plugin to use latest version

Nvidia switched from master to main. We are currently using an outdated version of the plugin.

Pending completion of PR for EKS plugin: https://github.com/dataiku/dss-plugin-eks-clusters/pull/58

Integration tests were run on EKS with the previous version of the driver successfully: https://qa-jenkins.dku.sh/job/dip-on-demand/1655 (Note the two tests that fail due to a timeout)
And the tests were run again with the version on master and we get similar results:

Integration tests were run on EKS with the previous version of the driver successfully: https://qa-jenkins.dku.sh/job/dip-on-demand/1655 (Note the two tests that fail due to a timeout)
And the tests were run again with the version on master and we get similar results:


SyntaxError: Unexpected end of JSON input

When try to start server npm start  throw error:

@MaxJadav I was unable to reproduce this issue when trying just now, and we haven't had any other reports of it, so it may be something specific to your configuration. Some suggestions for troubleshooting:

Blow away your local repo and re-clone the project from scratch, then make sure you set it up following all the instructions in the readme
Check your Plaid dashboard activity log (https://dashboard.plaid.com/activity/logs) to see if any errors are present there
Ensure you are using the latest version of node


While deploy Azure Function from VSCode to Azure

While deploying a Azure Function to Azure from VSCode I get an error Message - but overall the function ist deployed...
Repro steps:
Have a  function in VSCode (https-trigger, javescript) and click deploy
Action: azureFunctions.deploy
Error type: Error
Error Message: An error has occurred.
Version: 0.10.2
OS: win32

Thanks for filing - there may have been an outage in Azure Functions. In any case, closing as a duplicate of https://github.com/Microsoft/vscode-azurefunctions/issues/645 for further investigation


Gradle 7

Upgrade to gradle 7

Dependency upgrade

Reverted breaking changes, set closure compiler to compatible version.
New issue: https://github.com/gradle-webtools/gradle-minify-plugin/issues/19


[Feature request] lxc run

I think some command like lxc run $image $command would be useful. The idea is that it would be equivalent to lxc launch $image && lxc exec $command, where command if unset would default to bash.

Hmm, I'm not convinced it's worth the effort, maintenance cost and potential user confusion to introduce a separate command for that. It'd also be very difficult to adequately mix the options of launch and exec in the same tool without eventually getting into argument conflicts.
So I'm going to reject that feature request, though the approach discussed in #3233 would let you do that locally if it truly makes a huge difference for you.


chore: fixed fine-tuning link.

Fixed the first link I clicked in this repo! ;)

Looks at the refs to this file, maybe we should just rename the file?

Thanks for the fix @hemanth!


Cannot return string from tf.data map function

System information

Have I written custom code (as opposed to using a stock example script provided in TensorFlow): yes
OS Platform and Distribution (e.g., Linux Ubuntu 16.04): Linux Ubuntu 16.04
TensorFlow installed from (source or binary): binary
TensorFlow version (use command below): 1.6.0
Python version: 2.7.12
Bazel version (if compiling from source):
GCC/Compiler version (if compiling from source):
CUDA/cuDNN version: N/A
GPU model and memory: N/A
Exact command to reproduce: see below

Describe the problem
The map method of tf.data does not allow returning a string because no implicit conversion to a tensor is made. Instead, an error AttributeError: 'str' object has no attribute 'get_shape' is raised.
According to @mrry this is a bug introduced in TF 1.5. For a reference, see the comments at: https://stackoverflow.com/questions/49668252/returning-strings-in-tf-data-dataset-map-method this is also the Q&A that originally noted this problem.
Source code / logs
To reproduce:
import tensorflow as tf

def map_fn(x):
    return x*2, 'foo'

dataset = tf.data.Dataset.range(5)
dataset = dataset.map(map_fn)

Error trace:
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/username/tensorflow-remote/local/lib/python2.7/site-packages/tensorflow/python/data/ops/dataset_ops.py", line 790, in map
    return MapDataset(self, map_func)
  File "/home/username/tensorflow-remote/local/lib/python2.7/site-packages/tensorflow/python/data/ops/dataset_ops.py", line 1597, in __init__
    self._map_func.add_to_graph(ops.get_default_graph())
  File "/home/username/tensorflow-remote/local/lib/python2.7/site-packages/tensorflow/python/framework/function.py", line 486, in add_to_graph
    self._create_definition_if_needed()
  File "/home/username/tensorflow-remote/local/lib/python2.7/site-packages/tensorflow/python/framework/function.py", line 321, in _create_definition_if_needed
    self._create_definition_if_needed_impl()
  File "/home/username/tensorflow-remote/local/lib/python2.7/site-packages/tensorflow/python/framework/function.py", line 338, in _create_definition_if_needed_impl
    outputs = self._func(*inputs)
  File "/home/username/tensorflow-remote/local/lib/python2.7/site-packages/tensorflow/python/data/ops/dataset_ops.py", line 1585, in tf_map_func
    ret, [t.get_shape() for t in nest.flatten(ret)])
AttributeError: 'str' object has no attribute 'get_shape'

@jsimsa I think this regression crept in at 82fa1e1ae5b2f8af642979fafb1cab455db1882f, which added SparseTensor support, because the new logic assumes that all return values from a map function are either tf.Tensor or tf.SparseTensor, whereas the old logic had a conversion pass. Perhaps some variant of convert_to_tensor_or_sparse_tensor() is needed here?

Nagging Assignee @jsimsa: It has been 14 days with no activity and this issue has an assignee. Please update the label and/or status accordingly.

This has been fixed in https://github.com/tensorflow/tensorflow/commit/5a53c9b54d8781032ebf2cf26f93da3b2a33d1e4


Extend cases for minmax replacement

Check for test containing:
{person(a);person(b)}.
{
skill(a, ("some",1), 3);
skill(a, ("thing",1), 5);
skill(a, ("programming",1..10), 10);
skill(a, ("knitting",1..10), 100);
skill(b, t("cooking",1..10), 10);
skill(b, t("knitting",1..10), 1)
}.
max(P, X) :- X = #max {V, ID : skill(P, ID, V)}, person(P).

mysum(X) :- X = #sum {V : max(P, V)}, person(_).

in test_minmax_aggregates.py
max/2 is not replaced by chaining literals in the sum construct as P is not used in the tuple of the #sum.
Is this really a necessary restriction ?

Same for optimize statements.

I think yes. Given
max(a, 100).
max(b, 10).
max(c, 10).

this sum will result in X=110, counting b and c as one. This can't be done with chaining, as I can't linearly add costs to the maximum, as the decision if it is counted or not is made purely by the maximum value, which is not explicit in the chaining case.


BRAOfficeDocumentPackage.open performance is very slow

BRAOfficeDocumentPackage.open performance is not great.  It takes a long time to open the file.   and the file is of jjust 50kb.  Is there any other alternative ?

Same as problem as #21


h3js index find all children using index values

Hello,
Suppose we are storing h3 indexes in a database column. To perform a parent/child query I was thinking of using h3 indexes. Lets say we have this index 832834fffffffff. This cell's children are[  '8428341ffffffff',  '8428343ffffffff',  '8428345ffffffff',  '8428347ffffffff',  '8428349ffffffff',  '842834bffffffff',  '842834dffffffff'].  What is the logic to tell if an h3index id is a child of another id. Is there any way that we can find a range of indexies that are child of the specific id.
I already found https://github.com/uber/h3/issues/320 and https://stackoverflow.com/questions/53911322/is-the-h3index-ordered but could not find my answer.
Thanks

So the following snippet ought to work:
function isChildOf(possibleParent, possibleChild) {
  return possibleParent === h3.h3ToParent(possibleChild, h3.h3GetResolution(possibleParent));
}

Since the parent-child relationship is a simple tree structure in H3, there can be only one parent for any H3 index at any given resolution coarser (smaller) than its own resolution.

Oh, and the second piece "find a range of indexes that are all children of a specified id" is just h3.h3ToChildren(index, childResolution)

@dfellis thanks for the reply. But since we don't have access to the h3 library in the database is there any equations or logic to calculate the output of h3.h3ToChildren(index, childResolution) in database?

So, yes, the underlying C implementation of h3ToParent and h3ToChildren is relatively straitghtforward (parent is much easier than children, though).
h3ToParent is some sanity checking up front, and then some bit masking to replace the resolution with the new parent resolution and write 1s to all of the bits for the resolutions that are larger than that.
h3ToChildren has to allocate memory for the maximum number of children possible at that child level, then it loops through the possible children with special logic to detect and handle "missing children" if one of the indexes is actually a pentagon, and writes them into the allocated memory. This one would be hard to replicate in a database, but not impossible.

@dfellis Thanks, I am looking into the functions. it seems they are the exact functions I am looking for


Support 1.15.11, 1.16.8, 1.16.9, 1.17.4, 1.17.5

Add 1.15.11, 1.16.8, 1.16.9, 1.17.4, 1.17.5 kubelet/kubectl and hyperkube

/lgtm
only thing to check is the check-in run in case the disk is full, once that is done we can merge it

==> azure-arm: + '[' -s /dev/sda1 30309352 29850516 442452 99% / ']'
==> azure-arm: /home/packer/install-dependencies.sh: line 472: [: too many arguments
==> azure-arm: + echo 'WARNING: 75% of /dev/sda1 is used'
==> azure-arm: ++ df -P
==> azure-arm: ++ grep /dev/sda1
==> azure-arm: ++ awk '0+$5 >= 95 {print}'
==> azure-arm: + '[' -s /dev/sda1 30309352 29850516 442452 99% / ']'
==> azure-arm: /home/packer/install-dependencies.sh: line 474: [: too many arguments
==> azure-arm: + exit 1
it seems it's too much

let's get rid of the unsupported version and see if we can fit the data on the disk
1.12.8_v0.0.5
1.13.10_v0.0.5	1.13.10_v0.0.5
1.13.11_v0.0.5	1.13.11_v0.0.5
1.13.12_f0.0.2	1.13.12_f0.0.2


a line of each last node is pale or hidden

Hi, I found one more important issue while testing.

Each last line of nodes was pale or hidden, so I couldn't see it clearly.
I guess there is a line but overwrited by node object's outline.
Maybe we should increase the height of each node will solve it.

it's a known situation, but i don't have any solution for now.

Appreciates for your confirmation ! I will try to handle it if I can.

Ah could you point me out where is the code to draw the line ? Faster access for me ;)

https://github.com/ssshooter/mind-elixir-core/blob/08c8b2cb47f4ae06f428e5c9a5542d090f84e146/src/linkDiv.ts#L205


/docs/usage/options wrong descriptions of presets and plugins

plugins and presets descriptions should be switched from one to another
presets 	[] 	List of plugins to load and use.
plugins 	[] 	List of presets to load and use.

presets 	[] 	List of presets 	to load and use.
plugins 	[] 	List of plugins to load and use.

also - it's not clear from the description how they are different

Flipped them in #492.

I'd describe that presets are a set of plugins, possibly giving link to http://babeljs.io/docs/plugins/

@zowers made a PR https://github.com/babel/babel.github.io/issues/521 - good for you?

great, thanks!

Is more clear, thanks to all.


sf::Time constexpr constructor and methods

It will be just cool to be able to use sf::Time as C++11 constexpr instead of static const.

SFML won't support C++11 until v3.

We are looking forward to using C++11 (and beyond?) in the future as well. As of right now we want SFML 2.x to be fully compatible to C++03/98 and thus can't use constexpr.
For future reports, please make sure to take a look at our contributions guidelines. :wink: