Fix Layout/ClassStructure public_class_methods ordering

The Layout/ClassStructure rule does not enforce the order of public_class_methods. Given the default ordering, I would expect public class methods to appear before the initializer.
Expected:
# person.rb
class Person
  def self.some_method; end
  def initialize; end
end

However, when in the incorrect order, it does not raise any offenses:
# person.rb
class Person
  def initialize; end
  def self.some_method; end
end

❯ rubocop person.rb --only Layout/ClassStructure
warning: parser/current is loading parser/ruby27, which recognizes
warning: 2.7.2-compliant syntax, but you are running 2.7.1.
warning: please see https://github.com/whitequark/parser#compatibility-with-ruby-mri.
Inspecting 1 file
.

1 file inspected, no offenses detected

❯ rubocop -V
warning: parser/current is loading parser/ruby27, which recognizes
warning: 2.7.2-compliant syntax, but you are running 2.7.1.
warning: please see https://github.com/whitequark/parser#compatibility-with-ruby-mri.
1.4.2 (using Parser <IP_ADDRESS>, rubocop-ast 1.2.0, running on ruby 2.7.1 x86_64-darwin19)

The problem is that Rubocop::Cop::Layout::ClassStructure#walk_over_nested_class_definition is ignoring class method nodes because #classify returns class_methods while the configuration's ExpectedOrder provides public_class_methods.
I thought it would be easier to update the value in HUMANIZED_NODE_TYPE instead of changing the configuration to match, as that would require users to update their ExpectedOrder configurations.
With that said, this now catches several Layout/ClassStructure offenses in the codebase. Here is the output from bundle exec rake default
Offenses:

lib/rubocop/config.rb:36:5: C: Layout/ClassStructure: public_class_methods is supposed to appear before initializer.
    def self.create(hash, path) ...
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^
lib/rubocop/cop/base.rb:95:7: C: Layout/ClassStructure: public_class_methods is supposed to appear before initializer.
      def self.joining_forces; end
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
lib/rubocop/cop/base.rb:330:7: C: Layout/ClassStructure: public_class_methods is supposed to appear before private_methods.
      def self.builtin? ...
      ^^^^^^^^^^^^^^^^^
lib/rubocop/cop/corrector.rb:71:7: C: Layout/ClassStructure: public_class_methods is supposed to appear before initializer.
      def self.source_buffer(source) ...
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
lib/rubocop/cop/metrics/utils/abc_size_calculator.rb:32:11: C: Layout/ClassStructure: constants is supposed to appear before public_class_methods.
          ARGUMENT_TYPES = %i[arg optarg restarg kwarg kwoptarg kwrestarg blockarg].freeze
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
lib/rubocop/cop/registry.rb:213:7: C: Layout/ClassStructure: public_class_methods is supposed to appear before initializer.
      def self.all ...
      ^^^^^^^^^^^^
lib/rubocop/cop/team.rb:28:7: C: Layout/ClassStructure: public_class_methods is supposed to appear before initializer.
      def self.new(cop_or_classes, config, options = {}) ...
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
lib/rubocop/target_ruby.rb:197:5: C: Layout/ClassStructure: constants is supposed to appear before public_class_methods.
    SOURCES = [RuboCopConfig, RubyVersionFile, BundlerLockFile, GemspecFile, Default].freeze
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
tasks/changelog.rb:122:3: C: Layout/ClassStructure: public_class_methods is supposed to appear before initializer.
  def self.pending? ...
  ^^^^^^^^^^^^^^^^^

1205 files inspected, 9 offenses detected, 9 offenses auto-correctable
RuboCop failed!

Some of these are easy changes, like tasks/changelog.rb:122:3
While others seem a little more complex, for instance lib/rubocop/cop/base.rb:330:7. This appears to be declaring a private class method, however, this node does not seem to know that it should be private. From my understanding, this rule does not provide guidance on where private class methods should be positioned in the class. So I did not want to make any further changes without a discussion of what the expected behavior should be.
Separately, I noticed that the ExpectedOrder in the .rubocop.yml file for this project lists instance_methods, which I don't think corresponds to anything and should be changed to public_methods to match the value in HUMANIZED_NODE_TYPE.

Before submitting the PR make sure the following are checked:

[x] The PR relates to only one subject with a clear title and description in grammatically correct, complete sentences.
[x] Wrote good commit messages.
[ ] Commit message starts with [Fix #issue-number] (if the related issue exists).
[x] Feature branch is up-to-date with master (if not - rebase it).
[x] Squashed related commits together.
[x] Added tests.
[x] Ran bundle exec rake default. It executes all tests and runs RuboCop on its own code.
[x] Added an entry (file) to the changelog folder named {change_type}_{change_description}.md if the new code introduces user-observable changes. See changelog entry format for details.

I thought it would be easier to update the value in HUMANIZED_NODE_TYPE instead of changing the configuration to match, as that would require users to update their ExpectedOrder configurations.

Yeah, this seems reasonable/less painful.

From my understanding, this rule does not provide guidance on where private class methods should be positioned in the class. So I did not want to make any further changes without a discussion of what the expected behavior should be.

I've rarely used private class methods, so I never thought much on the subject. Probably it makes sense for them to appear after public class methods. @rubocop-hq/rubocop-core Your input here would be appreciated.

where private class methods should appear

Are we talking about a style like private_class_method def self.foo ..., and not class << self; private def foo?
I don't personally agree that class methods should precede instance methods... Also, I think that RuboCop's codebase usually doesn't use many class methods, but currently they are often mixed in a more thematic way. For example Cop::Base has many class methods interspersed with instance methods.
So it looks like what we currently have is more like:
  ExpectedOrder:
      - module_inclusion
      - constants
      - initializer
      - [public_methods, public_class_methods]
      - protected_methods
      - private_methods

Should we support that type of config?

Are we talking about a style like private_class_method def self.foo ..., and not class << self; private def foo?

Honestly, I've never found myself writing a private class method, in either format. I suspected that given the public_class_methods value in this cop, there would be a private_ variation.
I don't have a strong argument for either, or for the ordering of them in the class itself. Allowing for mixed placement of instance and class methods does give more flexibility for people to tune this rule to work for their projects. I suppose the next step is to decide on the standard/default, be it either strict ordering or the suggested mixed option, so that this rule can be used effectively. I am interested in continuing to work on this rule to address the issue with class methods, however, I'd want to define the desired outcome before starting on any work.

Any maybe singleton_class could be distinguished from public_class_methods for those of us that like it (✋)

Is there an example of this in the Rubocop codebase? I believe I know what you're referring to, but it's something I don't often use.

I am doing a heavy refactor of Layout/ClassStructure in #9575, best not to work on this for now...

@marcandre given #9575 is open, would it be best to close this pull request? It seems like the issue is being tracked in #9738.

Yeah, I guess we can close this PR.


Don't use os.IsNotExist

os.IsNotExist documentation says:

This function predates errors.Is. It only supports errors returned by the os
package. New code should use errors.Is(err, fs.ErrNotExist).

Thanks!

@benbjohnson Could you create a new tag so that the Go toolchain can download it? Thanks.

@ypdn No problem, here's the new release: https://github.com/benbjohnson/hashfs/releases/tag/v0.2.2


Fix new clippy warnings in yew-functional crate

Description
With the new stable Rust release clippy generates a warning for the yew-functional crate.
The first commit (https://github.com/yewstack/yew/commit/d0632916cb7f127bbd76959d27a9c8c85b389f9b) provides a fix for that warning.
I'm very unsure whether my interpretation of the original intent is correct. It would be great if you could verify that everything is in order, @ZainlessBrombie.
While I was at it I also ran the code against the pedantic and nursery clippy sets to future-proof the code.
These changes are all part of the second commit and they don't change the semantics of the code.
Checklist:

[x] I have run ./ci/run_stable_checks.sh
[x] I have reviewed my own code
[ ] I have added tests

Checks are failing because of the version mismatch fixed by #1415 and that pull request in turn has failing checks because of the issue described here :cold_sweat:.

@ZainlessBrombie I took a look at the commit in question and it looked good to me fyi


Upgrade ESLint from v4 to v5

This upgrades ESLint to the next version.
At the moment, only 5.0.0-alpha.0 is released, so I will update this pull request with newer versions until a stable version is released.

Coverage remained the same at 99.31% when pulling 3f0810436feff8f93c5caba31561f673d744f1e0 on ehmicky:upgrade_eslint_v5 into a58a58d95d004271f06c4df31138b859fe73b619 on adametry:master.

Coverage remained the same at 99.31% when pulling 3f0810436feff8f93c5caba31561f673d744f1e0 on ehmicky:upgrade_eslint_v5 into a58a58d95d004271f06c4df31138b859fe73b619 on adametry:master.

Upgraded to 5.0.0-alpha.1.

Upgraded to 5.0.0-alpha.2

Upgraded to 5.0.0-alpha.3

Upgraded to 5.0.0-alpha.4

Upgraded to 5.0.0-rc.0

@ehmicky Can you finish this up?

@shinnn We should fix CI fail first: #229

I was in summer vacation. Great this got merged!


infinite loops, printing blank lines on correct telnet quit

steps to reproduce: cargo run, then connect over telnet, send ^] (control + ]), then press q in telnet.
prints blank lines as fast as your terminal can handle

Fixed with 1ed9f1b 🎉


[GHSA-h8c6-fw25-mvvx] Infinite loop in the F5 Ethernet Trailer protocol...

Updates

Affected products
References
Source code location
Summary

Comments
Add two patch links related to CVE-2022-3190.
Hello, I noticed that I have to select an Ecosystem for the submission, and as far as I know, Wireshark does not belong to any of the available options. Therefore, I chose "github action". How should this situation be handled?

Hello, I noticed that I have to select an Ecosystem for the submission, and as far as I know, Wireshark does not belong to any of the available options. Therefore, I chose "github action". How should this situation be handled?

We limit ourselves to our supported ecosystems. We cannot accept advisories outside of these.
https://github.com/github/advisory-database/?tab=readme-ov-file#supported-ecosystems


[FR] Linking between different pdfs

Describe your request
Hi,
thank you for your really great work! I really appreciate it.
I am sorry, if my question is already posed or even answered in another place. It is this:
Is is possible or can it be made possible in some way to allow linking between two different pdf files? My idea is this: I work a lot with scientific papers/books as pdfs and I would like to connect papers that cite each other. So, if in paper A there is a citation like (Author 1999, 23) and I have the related paper, let‘s call it paper B, I would like to add a link from '(Author 1999, 23)' in paper A to the corresponding page in paper B. If this link could be bidirectional it would be even better.
Any ideas? :)

I also think it's a great idea, and it will be a great help for books and papers.

@Loners-xq, as a workaround I will try to get along with this, maybe it is also an option for you:
You can highlight a reference in a paper and write the highlight directly into the pdf-file. In this case, you have the option to add a comment to your highlight, which can render markdown and therefore can also have markdown links as a content. So, you just add a link to the referenced page or passage as an annotation to the highlight, which you got from the referenced paper, that is in your vault.
For a kind of bidirectional link feeling, you could do basically the same the other way round, maybe highlight the page number with the corresponding link as an annotation.
If one chooses a specific color for this kind of reference linking, one could maybe have a consistent workaround.
I just discovered this option and have to see for myself how much I like it or not.  :)

@rauchert
Thank you very much for telling me about this method, in fact, I have also tried this and found that when the location of the linked file is moved, [] the link will not change in time and it will fail. And external links in a pdf cannot be displayed in the sidebar. All these problems hinder my use.
Until the developers make changes, there seems to be no other better way to replace it. But still hope that developers can implement this feature, let it get obsidian native link support!
Thanks again for the solution and have a nice day!

@Loners-xq, I see, maybe it is not ideal. But markdown links as an annotation like [[Author_Year_Title.pdf#page=10|10]] should not break, if you move the linked pdf-file to a different location inside  of your vault.


Compiler bug on recursive generics (without alias)

This is probably in relation to #13702 and #5155 , but without use of alias.
abstract class Base(T)
    abstract def mysize :  Array(Int32)
    def to_s
        if !(mysize.size>2)
        else
            raise("foo")
        end
        Array(Array(T)).new.map {|row| row.map {|el| el.to_s.size}.max}
    end
end

class Child(T) < Base(T)
    def mysize :  Array(Int32)
        [0]
    end
end

table = Child(Base(Int32)).new
table.to_s

Leads to...
BUG: `!(::raise("can't execute `().size` at /home/user/compiler-bug.cr:4:14: `` has no type"))` at /home/user/compiler-bug.cr:4:12 has no type (Exception)
  from /crystal/src/compiler/crystal/codegen/cond.cr:4 in 'codegen_cond'
  from /crystal/src/compiler/crystal/codegen/codegen.cr:909:7 in 'visit'
  from /crystal/src/compiler/crystal/syntax/visitor.cr:27:12 in 'accept'
[...]
  from /crystal/src/crystal/main.cr:129:5 in 'main'
  from src/env/__libc_start_main.c:95:2 in 'libc_start_main_stage2'
Error: you've found a bug in the Crystal compiler. Please open an issue, including source code that will allow us to reproduce the bug: https://github.com/crystal-lang/crystal/issues

I'm running
Crystal 1.9.2 [1908c816f] (2023-07-19)
LLVM: 15.0.7
Default target: x86_64-unknown-linux-gnu

on Ubuntu 18.04

This looks completely unrelated to recursive aliases.
I have managed to reduce the reproduction a bit further. The conditional with empty then branch is very conspicuous. The condition needs to include negation.
abstract class Base(T)
  abstract def mysize :  Array(Int32)
  def to_s
    if !mysize.size
    end

    Array(T).new.map {|el| el.to_s.size}
  end
end

class Child(T) < Base(T)
  def mysize :  Array(Int32)
    [0]
  end
end

table = Child(Base(Int32)).new
table.to_s

Changing the condition to !mysize results in a slightly different error: BUG: `` at  has no type. So it seems the root of the problem lies within the implementations of Base(T)#mysize.


Postcss

https://github.com/postcss/postcss
Use these plugins

https://github.com/jonathantneal/precss
https://github.com/postcss/autoprefixer

And the webpack loader
https://github.com/postcss/postcss-loader

@JoanaDalmeida on the read m there is a guide feel free to read it.

@JoanaDalmeida our primary goal is to get rid of node-sass which is really slow and a pain to install.
The other goal is to be able to use new CSS feature

https://github.com/KleeGroup/webpack-focus/blob/master/webpack.config.js#L119


Add Reclaim prayer books

Description:
In OSRS you can stack as many Prayer books as you want, once you complete the book.
This update allows you to /buy name: Reclaim Holy book once you have a completed one in your CL.

In OSRS, they're free, but to add a slight cost, I've set it to 5k/ea for mains, and 200/ea for Irons. (200gp is the wiki value)

Changes:

Adds the Prayer books to buyables as a reclaim once you complete the set, like in OSRS.

Other checks:

[x] I have tested all my changes thoroughly.

Doesn't make too much difference, but you could set the price as the perdu price, which is what I did with the achievement diary stuff. https://oldschool.runescape.wiki/w/Perdu
It's like 12k for half the books and 14k for the other half


NTR telodendria 3 terms

new: Teleodendria
Def: Telodendria are projections that originate from the photoreceptor pedicle and form gap junctions with other photoreceptors within the outer plexiform layer of the retina.
is a:  GO:0043005  neuron projection
new: cone teleodendria
Cone telodendria are projections that originate from the cone pedicle and form gap junctions with other photoreceptors within the outer plexiform layer of the retina.
originates from: GO:0044316  cone cell pedicle
PubMed: 29127712
is a:  Teleodendria
originates from  GO:0044316 cone cell pedicle
New:rod teleodendria
Rod telodendria are projections that originate from the rod pedicle and form gap junctions with other photoreceptors within the outer plexiform layer of the retina.
PMID:    14755521
is a:  Teleodendria

@cerivs - I think that these definitions are too specific by mentioning photoreceptors. Prompted by a quick look at this Wiki page: https://en.wikipedia.org/wiki/Axon
I searched in PubMed also, and there are papers that discuss telodendria in non-retinal cells, specifically a couple in muscle cells and also one about them in crab brain where they are mentioned as being present in Kenyon cells which are associated with mushroom bodies and thus olfaction (https://en.wikipedia.org/wiki/Kenyon_cell)
Can you propose definitions that are less specific.
thanks,
-Karen
Results from PubMed search that are either definitely not or possibly not retina:
1: Murphy MC, Fox EA. Mice deficient in brain-derived neurotrophic factor have
altered development of gastric vagal sensory innervation. J Comp Neurol. 2010 Aug
1;518(15):2934-51. doi: 10.1002/cne.22372. PMID:20533354
2: Fox EA, Phillips RJ, Martinson FA, Baronowsky EA, Powley TL. C-Kit mutant mice
have a selective loss of vagal intramuscular mechanoreceptors in the forestomach.
Anat Embryol (Berl). 2001 Jul;204(1):11-26. PMID:11506430
3: Fox EA, Phillips RJ, Martinson FA, Baronowsky EA, Powley TL. Vagal afferent
innervation of smooth muscle in the stomach and duodenum of the mouse: morphology
and topography. J Comp Neurol. 2000 Dec 18;428(3):558-76. PMID: 11074451
4: Tuckwell HC. Voltage clamp calculations for myelinated and demyelinated axons.
Eur Biophys J. 1993;22(1):71-7. PMID: 8390352
5: Tkacs NC, Wurster RD. Strength-duration and activity-dependent excitability
properties of frog afferent axons and their intraspinal projections. J
Neurophysiol. 1991 Mar;65(3):468-76. PMID:1646866
6: Fahrenbach WH. The brain of the horseshoe crab (Limulus polyphemus). III.
Cellular and synaptic organization of the corpora pedunculata. Tissue Cell.
1979;11(1):163-200. PMID:451992

new: telodendria
Def: Telodendria are projections that originate from the  axon pedicle and form gap junctions with other neurons.
is a: GO:0043005 neuron projection
new: cone telodendria
Cone telodendria are projections that originate from the cone pedicle and form gap junctions with other photoreceptors within the outer plexiform layer of the retina.
originates from: GO:0044316 cone cell pedicle
PubMed: 29127712
is a: teleodendria
originates from GO:0044316 cone cell pedicle
New: rod telodendria
Rod telodendria are projections that originate from the rod pedicle and form gap junctions with other photoreceptors within the outer plexiform layer of the retina.
PMID: 14755521
is a: telodendria

Most of the instances I see in PubMed are studies of retina (27/33).  I kept the 2 very specific terms to accommodate retina specific use cases where they are frequently studied.

@cerivs - Sorry so slow to respond to your update. I was on medical leave in October and am still catching up. Thanks for the update for the general term, and of course you're right that the two specific terms are fine.


Why require Logger was put outside module?

While going through the source code, I've noticed the required Logger was put outside the FileSystem.Backends.FSInotify module.
Just curious, is there a reason for doing so instead of putting it within the FileSystem.Backends.FSInotify itself?
require Logger

defmodule FileSystem.Backends.FSInotify do
@moduledoc """
...
"""

And not?
defmodule FileSystem.Backends.FSInotify do
@moduledoc """
...
"""

require Logger

I don't think there's any difference for this case, just the hobbit of coding 🙈

I don't think there's any difference for this case, just the hobbit of coding 🙈


feature(Analysis/Convex/Topology): convex closed hull

Define the convex closed hull and the absolutely convex closed hull and prove basic properties.
See e.g. Bourbaki, TVS II.13

@ADedecker would you like to review this one as well please?

bors r+


Possible Startup Improvements

This issue is aimed at listing and evaluating some speedups we could potentially employ on startup. The reported savings are somewhat suppositional, in that they may or may not represent the actual time we will end up saving.
Breaking Startup Down

What could we attack?

Operation
Cost
Potential Savings
Notes

JSON Parsing
50ms
30ms

Reading Less Cache
40ms
30ms

Resolving Modules
56ms (?)
50ms (?)
We suspect the require path takes much more than this, but it's hard to tell from the profiler.

Loading Grammars
150ms
100-120ms

Slow Reflows
150ms
100ms (?)
It's not clear whether Chrome needs to spend a fixed amount of time when it reflows stuff the first time.

Sync GitRepository
45ms
45ms

Electron Startup
180ms
100-120ms (?)
We may probably use the NativeCompileCache here as well, and speeding up the require path may help too.

-
-
-
-

Total:

450-480ms

Please, note that the speedups herein highlighted wouldn't revolutionize the way Atom handles the above operations. This means that there are probably other ways in which we could make things faster by, for example, introducing breaking changes: this is outside the scope of this issue, though, as we're currently looking for optimizations that are safe and compatible with how things work as of today.
Also, there may be other chances to make startup faster by employing some hack to simply show an hidden window instead of reloading the whole environment: this, however, should probably be the subject of another issue, as it is a completely distinct approach.
/cc: @atom/feedback @nathansobo

Love the breakdown :+1:

Does the JSON parsing operation counts CSON parsing as well?

Been a while, I'd be curious to see the graph again now.

@as-cii Does your new issue supplant this one?

Yes, this is superseded by #13253 and we will post updates on that issue as we make progress on reducing startup time.


DOC: Add "What is the difference between Anaconda, Miniconda, and con…

Addresses Issue #107
These points have been kept in mid while updating the FAQ section

Since most of the New-Comers have this as their first question in their mind (At least I did when I was starting out) I have tried to keep it above the other FAQ's. Upon discussing internally we can decide if this needs to be moved somewhere else.
I have also tried to be as descriptive as possible to leave no confusion amongst the three tooling. If we want to keep it concise, we can discuss on that too.

Here is a sample of how the page looks after the changes have been made -

Hi @bhavukkalra , thank you for your time and effort in creating this draft pull request. The connected issue is now referring to a new glossary format vs an FAQ, and there are still some details to iron out re: where that page will go, how the glossary items will appear, etc. Due to these changes, I am closing this PR.
Going forward, look out for any issues labeled "good first issue" and, most importantly, please ask to be assigned to one before creating a pull request.


UI changes - API Directory

Address the following:
User interface (buttons, links, and visual styling)
Interaction design
Labels, headlines, and written text
Navigation structures and content classification
Accessibility (contrast, visual focus indicators, text alternatives, etc.)

Referencing https://dpdd.atlassian.net/browse/APS-457?focusedCommentId=161167&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-161167


Use SSL Offload and auto certificate renewall

Change prod docker-compose file to use proxy to handle SSL Offload and auto SSL certificate renewal.
What is the purpose of this Pull Request?
Easy the certificate renewall and related operations
What was done to achieve this purpose?
Used jwilder/nginx-proxy and jrcs/letsencrypt-nginx-proxy-companion container images.
How to test if it really works?
docker-compose up -d && docker-compose logs -f --tail=10

Certificate shall be generated on start.
Who can help reviewing it?
cuducos
TODO

[ ] Should we support Swarm Mode? Bridge networks may not work as expected. Use overlay instead.
[ ] Should we avoid bind-mounting docker socket on the edge proxy? Use a separate container to generate nginx configuration instead.

Close #291

We can avoid bind-mounting docker socket on the edge proxy -- considereing it is exposed on the internet -- by using yet another container to generate the nginx templates. Please advise if that is required.

Hi @ltouro, many thanks for that!
I tried it out but got an error:
$ docker-compose -f docker-compose.yml -f docker-compose.prod.yml up
ERROR: yaml.parser.ParserError: while parsing a block mapping
  in "./docker-compose.prod.yml", line 1, column 1
expected <block end>, but found '<block mapping start>'
  in "./docker-compose.prod.yml", line 22, column 3

I think the proxy block is indented with 4 spaces and the rest of the services is indented with 2 spaces.
Other comments:

Should we support Swarm Mode? Not necessary right now. In the future that could be useful!
Is jwilder/nginx-proxy working with docker-compose.yml version 3? It used to require version 2.
As you edited docker-compose.prod.yml I guess the How to test it (opening message of the PR) part should be docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d, not only docker-compose up -d… is that right or am I missing something here?

Fixing the indentation issue I got:
ERROR: Named volume "proxy/certs:/etc/nginx/certs:rw" is used in service "proxy" but no declaration was found in the volumes section.

@cuducos Sorry about that. Misunderstood named volumes as I'm still using bind-mount on my case. It should work now.
About jwilder/nginx-proxy, I'm currently using it with compose v3 with no problem.
About testing, you are right. You should use both compose files as they are incremental (did not notice that previously)
I removed the "bridge" network setting in favor of the engine default (which changes to overlay if u are in Swarm mode, cool).

@caduvieira Thanks for the comments. All the content that goes on these named volumes are ephemeral and will be recreated in absence. Only the Diffie–Hellman key take couple minutes to create but I think that is okay.

It seams to be working now. Any way you'd recommend to test it locally (even without HTTPS) just to check before putting it in production servers? Maybe changing VIRTUAL_HOST and LETSENCRYPT_HOST to something I could edit in my /etc/hosts?
Otherwise I'll try setting up the DNS to new servers for a brief one of these days.

BTW my I suggest parametrizing these …_HOST environment vars so we can easily set up staging and production environments? Something along these lines.

@cuducos /etc/hosts will not working in this case because the process involves external servers that will check the existence of a specific file at domain.tld/.well-know. So you will need the DNS properly configured to test the certificate generation.

@cuducos Should we provide a default value for LETSENCRYPT_EMAIL? It is for expire notices from Let's Encrypt.
      LETSENCRYPT_HOST: ${VIRTUAL_HOST_WEB}
      VIRTUAL_HOST: ${VIRTUAL_HOST_WEB}
      LETSENCRYPT_EMAIL<EMAIL_ADDRESS>

/etc/hosts will not work in this case because the process involves external servers that will check the existence of a specific file at domain.tld/.well-know

It wouldn't work even with HTTP on port 80? Ok…

Should we provide a default value for LETSENCRYPT_EMAIL? It is for expire notices from Let's Encrypt.

Yep… it could be<EMAIL_ADDRESS>; )
Many thanks!

@cuducos I see what you mean. You could test HTTP using HTTPS_METHOD env with "noredirect" value (I parametrized that too). This way, you can still access the container on port 80. Otherwise, the edge-proxy will redirect you to HTTPs automatically.

Hi @ltouro, would you mind helping properly testing the PR?
Not sure if I am forgetting a step or something…

Added <IP_ADDRESS>    local.jarbas.serenatadeamor.org and <IP_ADDRESS>    local.jarbas.serenatadeamor.org to my /etc/hosts
Added VIRTUAL_HOST_WEB=local.jarbas.serenatadeamor.org and HTTPS_METHOD=noredirect to .env.prod
docker-compose  -f docker-compose.yml -f docker-compose.prod.yml up and waited several minutes (I know it takes a while to generate the proper hashes)
Still port 80 responds with 502 and 443 non-responsive:

$ curl -I local.jarbas.serenatadeamor.org:80
HTTP/1.1 502 Bad Gateway
Server: nginx/1.13.6
Date: Mon, 04 Dec 2017 15:44:24 GMT
Content-Type: text/html
Content-Length: 173
Connection: keep-alive

$ curl -I local.jarbas.serenatadeamor.org:443
curl: (52) Empty reply from server

Here are my containers:
$ docker-compose -f docker-compose.yml -f docker-compose.prod.yml ps
WARNING: Some services (proxy) use the 'deploy' key, which will be ignored. Compose does not support 'deploy' configuration - use `docker stack deploy` to deploy to a swarm.
        Name                      Command               State                     Ports
---------------------------------------------------------------------------------------------------------
jarbas_django_1        gunicorn jarbas.wsgi:appli ...   Up       8000/tcp
jarbas_elm_1           npm run assets                   Exit 0
jarbas_memcached_1     docker-entrypoint.sh memcached   Up       11211/tcp
jarbas_nginx_1         nginx -g daemon off;             Up       80/tcp
jarbas_postgres_1      docker-entrypoint.sh postgres    Up       5432/tcp
jarbas_proxy-certs_1   /bin/bash /app/entrypoint. ...   Up
jarbas_queue_1         docker-entrypoint.sh rabbi ...   Up       25672/tcp, 4369/tcp, 5671/tcp, 5672/tcp
jarbas_tasks_1         /bin/sh -c celery worker - ...   Up       8000/tcp
proxy                  /app/docker-entrypoint.sh  ...   Up       <IP_ADDRESS>:443->443/tcp, <IP_ADDRESS>:80->80/tcp```

And here are the logs:

elm_1          | npm info it worked if it ends with ok
elm_1          | npm info using<EMAIL_ADDRESS>elm_1          | npm info using<EMAIL_ADDRESS>postgres_1     | LOG:  database system was shut down at 2017-12-04 15:40:24 UTC
proxy-certs_1  | Reloading nginx proxy (proxy)...
postgres_1     | LOG:  MultiXact member wraparound protections are now enabled
proxy          | forego     | starting dockergen.1 on port 5000
elm_1          | npm info lifecycle @~preassets: @
proxy-certs_1  | 2017/12/04 15:42:10 Generated '/app/letsencrypt_service_data' from 4 containers
postgres_1     | LOG:  database system is ready to accept connections
elm_1          | npm info lifecycle @~assets: @
proxy-certs_1  | 2017/12/04 15:42:10 Running '/app/update_certs'
proxy          | forego     | starting nginx.1 on port 5100
postgres_1     | LOG:  autovacuum launcher started
elm_1          |
proxy-certs_1  | 2017/12/04 15:42:10 Watching docker events
elm_1          | > @ assets /code
elm_1          | > gulp elm
proxy-certs_1  | Sleep for 3600s
elm_1          |
django_1       | [2017-12-04 13:42:12 -0200] [1] [INFO] Starting gunicorn 19.7.1
proxy-certs_1  | Q2017/12/04 15:42:10 Generated '/etc/nginx/conf.d/default.conf' from 4 containers
proxy          | dockergen.1 | 2017/12/04 15:42:10 Generated '/etc/nginx/conf.d/default.conf' from 6 containers
django_1       | [2017-12-04 13:42:12 -0200] [1] [INFO] Listening at: http://<IP_ADDRESS>:8000 (1)
proxy-certs_1  | ;2017/12/04 15:42:10 [notice] 51#51: signal process started
elm_1          | [15:42:11] Using gulpfile /code/gulpfile.js
django_1       | [2017-12-04 13:42:12 -0200] [1] [INFO] Using worker: sync
proxy-certs_1  | 2017/12/04 15:42:11 Contents of /app/letsencrypt_service_data did not change. Skipping notification '/app/update_certs'
proxy-certs_1  | 2017/12/04 15:42:11 Received event start for container 2ed5a7ebcc92
elm_1          | [15:42:11] Starting 'elm'...
django_1       | [2017-12-04 13:42:12 -0200] [7] [INFO] Booting worker with pid: 7
proxy          | dockergen.1 | 2017/12/04 15:42:10 Running 'nginx -s reload'
django_1       | [2017-12-04 13:42:12 -0200] [9] [INFO] Booting worker with pid: 9
proxy-certs_1  | 2017/12/04 15:42:12 Received event start for container 90a1dc056e8a
proxy-certs_1  | 2017/12/04 15:42:13 Received event start for container b6f02214eb0f
proxy          | dockergen.1 | 2017/12/04 15:42:10 Watching docker events
proxy          | dockergen.1 | 2017/12/04 15:42:11 Contents of /etc/nginx/conf.d/default.conf did not change. Skipping notification 'nginx -s reload'
proxy          | dockergen.1 | 2017/12/04 15:42:12 Received event start for container 90a1dc056e8a
proxy          | dockergen.1 | 2017/12/04 15:42:12 Contents of /etc/nginx/conf.d/default.conf did not change. Skipping notification 'nginx -s reload'
proxy          | dockergen.1 | 2017/12/04 15:42:13 Received event start for container b6f02214eb0f
django_1       | [2017-12-04 13:42:13 -0200] [11] [INFO] Booting worker with pid: 11
django_1       | [2017-12-04 13:42:13 -0200] [13] [INFO] Booting worker with pid: 13
proxy          | dockergen.1 | 2017/12/04 15:42:13 Generated '/etc/nginx/conf.d/default.conf' from 9 containers
proxy          | dockergen.1 | 2017/12/04 15:42:13 Running 'nginx -s reload'
proxy          | dockergen.1 | 2017/12/04 15:42:13 Contents of /etc/nginx/conf.d/default.conf did not change. Skipping notification 'nginx -s reload'
tasks_1        | /usr/local/lib/python3.5/site-packages/celery/platforms.py:795: RuntimeWarning: You're running the worker with superuser privileges: this is
tasks_1        | absolutely not recommended!
tasks_1        |
tasks_1        | Please specify a different user using the -u option.
tasks_1        |
tasks_1        | User information: uid=0 euid=0 gid=0 egid=0
tasks_1        |
tasks_1        |   uid=uid, euid=euid, gid=gid, egid=egid,
tasks_1        |
tasks_1        |  -------------- celery@2ed5a7ebcc92 v4.1.0 (latentcall)
tasks_1        | ---- **** -----
tasks_1        | --- * ***  * -- Linux-4.9.49-moby-x86_64-with 2017-12-04 13:42:14
tasks_1        | -- * - **** ---
tasks_1        | - ** ---------- [config]
tasks_1        | - ** ---------- .> app:         jarbas:0x7f2cb2f90240
tasks_1        | - ** ---------- .> transport:   amqp://guest:**@queue:5672//
tasks_1        | - ** ---------- .> results:     disabled://
tasks_1        | - *** --- * --- .> concurrency: 3 (prefork)
tasks_1        | -- ******* ---- .> task events: OFF (enable -E to monitor tasks in this worker)
tasks_1        | --- ***** -----
tasks_1        |  -------------- [queues]
tasks_1        |                 .> celery           exchange=celery(direct) key=celery
tasks_1        |
tasks_1        |
tasks_1        | [2017-12-04 13:42:14,575: ERROR/MainProcess] consumer: Cannot connect to amqp://guest:**@queue:5672//: [Errno 111] Connection refused.
tasks_1        | Trying again in 2.00 seconds...
tasks_1        |
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:14 ===
queue_1        | Starting RabbitMQ 3.6.11 on Erlang 19.3
queue_1        | Copyright (C) 2007-2017 Pivotal Software, Inc.
queue_1        | Licensed under the MPL.  See http://www.rabbitmq.com/
queue_1        |
queue_1        |               RabbitMQ 3.6.11. Copyright (C) 2007-2017 Pivotal Software, Inc.
queue_1        |   ##  ##      Licensed under the MPL.  See http://www.rabbitmq.com/
queue_1        |   ##  ##
queue_1        |   ##########  Logs: tty
queue_1        |   ######  ##        tty
queue_1        |   ##########
queue_1        |               Starting broker...
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:14 ===
queue_1        | node           : rabbit@e31fd7358949
queue_1        | home dir       : /var/lib/rabbitmq
queue_1        | config file(s) : /etc/rabbitmq/rabbitmq.config
queue_1        | cookie hash    : w37r5jjlyGKvIuzj6jxWtA==
queue_1        | log            : tty
queue_1        | sasl log       : tty
queue_1        | database dir   : /var/lib/rabbitmq/mnesia/rabbit@e31fd7358949
tasks_1        | [2017-12-04 13:42:16,599: ERROR/MainProcess] consumer: Cannot connect to amqp://guest:**@queue:5672//: [Errno 111] Connection refused.
tasks_1        | Trying again in 4.00 seconds...
tasks_1        |
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | Memory high watermark set to 1979 MiB<PHONE_NUMBER> bytes) of 4949 MiB<PHONE_NUMBER> bytes) total
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | Enabling free disk space monitoring
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | Disk free limit set to 50MB
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | Limiting to approx 1048476 file handles (943626 sockets)
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | FHC read buffering:  OFF
queue_1        | FHC write buffering: ON
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | Waiting for Mnesia tables for 30000 ms, 9 retries left
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | Waiting for Mnesia tables for 30000 ms, 9 retries left
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | Priority queues enabled, real BQ is rabbit_variable_queue
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | Starting rabbit_node_monitor
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | msg_store_transient: using rabbit_msg_store_ets_index to provide index
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | msg_store_persistent: using rabbit_msg_store_ets_index to provide index
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | started TCP Listener on [::]:5672
queue_1        |  completed with 0 plugins.
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:18 ===
queue_1        | Server startup complete; 0 plugins started.
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:20 ===
queue_1        | accepting AMQP connection <0.290.0> (<IP_ADDRESS>:46830 -> <IP_ADDRESS>:5672)
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:21 ===
queue_1        | connection <0.290.0> (<IP_ADDRESS>:46830 -> <IP_ADDRESS>:5672): user 'guest' authenticated and granted access to vhost '/'
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:21 ===
queue_1        | accepting AMQP connection <0.298.0> (<IP_ADDRESS>:46832 -> <IP_ADDRESS>:5672)
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:21 ===
queue_1        | connection <0.298.0> (<IP_ADDRESS>:46832 -> <IP_ADDRESS>:5672): user 'guest' authenticated and granted access to vhost '/'
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:21 ===
queue_1        | accepting AMQP connection <0.317.0> (<IP_ADDRESS>:46834 -> <IP_ADDRESS>:5672)
queue_1        |
queue_1        | =INFO REPORT==== 4-Dec-2017::15:42:21 ===
queue_1        | connection <0.317.0> (<IP_ADDRESS>:46834 -> <IP_ADDRESS>:5672): user 'guest' authenticated and granted access to vhost '/'
proxy-certs_1  | 2017/12/04 15:42:28 Debounce minTimer fired
proxy-certs_1  | 2017/12/04 15:42:28 Generated '/app/letsencrypt_service_data' from 7 containers
proxy-certs_1  | 2017/12/04 15:42:28 Running '/app/update_certs'
proxy-certs_1  | Creating/renewal local.jarbas.serenatadeamor.org certificates... (local.jarbas.serenatadeamor.org)
proxy-certs_1  | 2017-12-04 15:42:29,352:INFO:simp_le:1213: Generating new account key
elm_1          | [15:42:35] Finished 'elm' after 24 s
elm_1          | npm info lifecycle @~postassets: @
elm_1          | npm info ok
proxy          | dockergen.1 | 2017/12/04 15:42:35 Received event die for container e8d50b151a8a
proxy-certs_1  | 2017/12/04 15:42:35 Received event die for container e8d50b151a8a
jarbas_elm_1 exited with code 0
proxy          | dockergen.1 | 2017/12/04 15:42:36 Contents of /etc/nginx/conf.d/default.conf did not change. Skipping notification 'nginx -s reload'
proxy-certs_1  | TOS hash mismatch. Found: cc88d8d9517f490191401e7b54e9ffd12a2b9082ec7a1d4cec6101f9f1647e7b.
proxy-certs_1  |
proxy-certs_1  | Debugging tips: -v improves output verbosity. Help is available under --help.
proxy-certs_1  | Sleep for 3600s
proxy-certs_1  | 2017/12/04 15:42:50 Debounce minTimer fired
proxy-certs_1  | 2017/12/04 15:42:50 Contents of /app/letsencrypt_service_data did not change. Skipping notification '/app/update_certs'
proxy          | nginx.1    | local.jarbas.serenatadeamor.org <IP_ADDRESS> - - [04/Dec/2017:15:44:24 +0000] "HEAD / HTTP/1.1" 502 0 "-" "curl/7.54.0"
nginx_1        | 2017/12/04 15:44:24 [error] 5#5: *1 django could not be resolved (3: Host not found), client: <IP_ADDRESS>, server: localhost, request: "HEAD / HTTP/1.1", host: "local.jarbas.serenatadeamor.org"
nginx_1        | <IP_ADDRESS> - - [04/Dec/2017:15:44:24 +0000] "HEAD / HTTP/1.1" 502 0 "-" "curl/7.54.0"

I see that nginx container logged django could not be resolved (3: Host not found) — so the proxy using django (name of the container) might not be working… Any idea about what I might be leaving behind?

@cuducos I think the error is related to not including the django container in the newly created network backend.
We need something like (docker-compose-prod.yml:32~44):
django:
    env_file:
      - .env
    environment:
       - DEBUG=False
    depends_on:
       - memcached
    expose:
      - "8000"
    volumes:
      - assets:/code/staticfiles
    entrypoint: ["gunicorn", "jarbas.wsgi:application", "--reload", "--bind", "<IP_ADDRESS>:8000", "--workers", "4"]
    networks:
      - backend

Should I update this PR or we follow on #294?

@cuducos I think the error is related to not including the django container in the newly created network backend. All HTTP-exposed containers should be added to this network.

Many thanks, I haven't had the chance to test it yet, but I'll test it soon!

Should I update this PR or we follow on #294?

Baby steps. First let's make sure this PR is merged, then we look at #294 ; ) Would you mind updating it here?

Yay! Now it works : ) Many many thanks for all the support @ltouro! 🎉
I did some minor additions to your branch. Would you mind cherry picking these changes to your PR? This is the branch with my suggestions. Namely:

Idea
Commit

Document new production variables
f8b6f32e1dec6ece93d5f3e37fd5730cf27ba793

Auto-set Django ALLOWED_HOSTS with the host name you added as a envvar
72c550e3c2e82485ce9173b43708b8a1e6e1b96a

I opted to keep .env with local/dev values and add a .env.prod for production
bd0d85ee81e7fb95c8b44ebe765872991b9ba72b

What do you think?

On other news: do you use Twitter? Probably gonna tweet a huge thank you, this contribution is very very important ; )

Picked up your suggestions. First time I cherry-pick, hope I got it right.
I don't use Twitter, but feel congratulated already! Thanks :dog:

Fix #291

I don't use Twitter, but feel congratulated already! Thanks 🐶

https://twitter.com/cuducos/status/938096112409415682


Remove LGTM integration in favor of Required Reviews

GitHub has recently added support for PR reviews:
https://help.github.com/articles/about-pull-request-reviews/
https://help.github.com/articles/about-required-reviews-for-pull-requests/
I think this new native feature solves what we are enforcing with lgtm but in a much better way. Shall we enable it and remove lgtm integration?

I haven't actually tried out the required review workflow yet on any project, but in principle the switch makes sense to me.

Hey @fommil could you do the switch please?

done!

Thanks!


Downgrade ComposeCompositionLocalUsage to warning

Showing an error is too strong for developers using a CompositionLocal. We could even downgrade this to
INFORMATIONAL, but warning is fine for now.

Since we offer an allow list, are you sure?

Yeah, CompositionLocals shouldn't be avoided at all costs. Yes, they create implicit dependencies, but they're also useful in certain situations. Keeping them as error is the wrong default imo.


addTagHelper directive and assembly name globbing

I recently implemented an ITagHelperTypeResolver explained in this post that basically allows you to use addTagHelper directives like this
@addTagHelper "*, Plugin.*"

That will import all TagHelper's from all assemblies matching the glob.
As you reference new assemblies matching that glob, (or load them at runtime) any taghelper's within them will automatically be imported into the view.
The default asp.net implementation doesn't allow you to do that, you have to specify each assembly, as it only does globbing on the typename portion:
@addTagHelper "*, Plugin.Another"
@addTagHelper "*, Plugin.YetAnother"

This is quite handy for my situation, but not sure if you would be insterested in a PR for this, let me know.

Absolutely!
On Jul 29, 2016 5:02 PM, "Darrell"<EMAIL_ADDRESS>wrote:

Let me know if you would be interested in the ITagHelperTypeResolver
explained in this post
http://darrelltunnell.net/blog/2016/07/25/aspnet-core-taghelper-s-a-better-addtaghelper-type-resolver/
and I'll happily contribute it. If not no biggie, just thought I'd check!
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/WebApiContrib/WebAPIContrib.Core/issues/52, or mute
the thread
https://github.com/notifications/unsubscribe-auth/ABoZIeBfrOiyBCnOmND4q4whnPnNi5E_ks5qahXxgaJpZM4JYRup
.

Ok - where would you want this to live? I was thinking of adding it to the WebAPiContrib.Core project, and then adding a method to:
  public static class ServiceCollectionExtensions
    {
        public static void EnableAddTagHelperAssemblyGlobbing(this IServiceCollection services)
        {
           services.AddSingleton<ITagHelperTypeResolver, AssemblyNameGlobbingTagHelperTypeResolver>();

        }
    }

Actually it might make sense putting this in WebApiContrib.Core.WebPages as that project has the dependency on Razor which I need.

On second thoughts, I think perhaps adding a new project WebApiContrib.Core.Razor is merited. I'll submit a PR based on that.

PR submitted

I have noticed that in the WebApiContrib.Core.Samples project, if you browse to /Markdown/Sample - the markdown sample doesn't seem to work.. has this always been broken? I think it might have because I can't see any addTagHelper directive for the markdown tag helper anywhere. Perhaps it needs to be fixed or removed?


Remove HttpUtlities from the public API surface

Contributes to #11312

@aspnet-hello triage https://dev.azure.com/dnceng/public/_build/results?buildId=237574

This comment was made automatically. If there is a problem contact<EMAIL_ADDRESS>I've triaged the above build. I've created/commented on the following issue(s)
https://github.com/aspnet/AspNetCore-Internal/issues/2609


Add price to TradeOrder

Currently we call discoverer.discover({ asset, amount: sats }) to get the best order, then we have to call MarketPrice to get the price preview. Instead TradeOrder could include the price.
@tiero @louisinger

nACK: price is not a "constant from the Daemon point of view". It means that a price at time t can be different than the price at time t+1. That's why we must call the preview price just before making the swap (in order to be sure we'll trade at the right price)

Since we are sending the payload asset and amount already and with bestPrice strategy we do NOT only need to call Balances endpoint, but also some info from client, we basically doing already the preview when picking a provider&market combo: I do think it's fine to return the price right away, if the user is making a trade just right after. If it fails for bad pricing, he then call again as normal

Afaik with bestPrice we already compute price for each order

Afaik with bestPrice we already compute price for each order

Right. But Discoverer is an abstraction of discovery functions. it must work with any Discovery, including the ones without marketPrice requests (like bestBalance only for instance). I really don't know how to handle this properly in Discoverer abstraction.
I think in case of only bestPrice is used, better to do not use Discoverer and write your own "abstraction" caching the marketPrice requests


Code review

There version in the classifier is not supported by the package

The mock library is not a dependency, mockito.mock is the one being used on the tests
https://github.com/KhaosResearch/kapylan/blob/b64da34dc82b629f9758f13d4e16732c17264e75/setup.cfg#L36-L39
No information is given on the README about running the tests

The link on the black badge is pointing to the old repository.
https://github.com/KhaosResearch/kapylan/blob/b64da34dc82b629f9758f13d4e16732c17264e75/README.md?plain=1#L3
Having a relative import going back three levels is not reproducible, usually you either assume the repostiory root is the current directory, or explicitly say it with either a comment or a env variable.
https://github.com/KhaosResearch/kapylan/blob/b64da34dc82b629f9758f13d4e16732c17264e75/README.md?plain=1#L89

Enviroment variable must not have spaces around the = sign
https://github.com/KhaosResearch/kapylan/blob/b64da34dc82b629f9758f13d4e16732c17264e75/.env.template#L1-L4
$ source .env.template
RDF_REPOSITORY_ENDPOINT: command not found
RDF_REPOSITORY_USERNAME: command not found
RDF_REPOSITORY_PASSWORD: command not found
RDF_REPOSITORY_DB: command not found

Some documentation about the annotation files would be helpful.
https://github.com/KhaosResearch/kapylan/blob/b64da34dc82b629f9758f13d4e16732c17264e75/README.md?plain=1#L84
The previous line seems to imply that the user needs to annotate their own components

Unused imports,
https://github.com/KhaosResearch/kapylan/blob/b64da34dc82b629f9758f13d4e16732c17264e75/src/kapylan/config.py#L2-L3

The typing in the functions is incosistent, and sometime missing
https://github.com/KhaosResearch/kapylan/blob/b64da34dc82b629f9758f13d4e16732c17264e75/src/kapylan/util/solution.py#L43
There are some missing documentation in functions, some of this functions are hard to understand without any documentation
https://github.com/KhaosResearch/kapylan/blob/b64da34dc82b629f9758f13d4e16732c17264e75/src/kapylan/annotation/decorator.py#L14
https://github.com/KhaosResearch/kapylan/blob/b64da34dc82b629f9758f13d4e16732c17264e75/src/kapylan/annotation/decorator.py#L49


Mixer Check Occurring Before Origin Authentication Security Policy

Describe the bug
With an Origin Authentication Policy (end-user policy) configured and a Mixer Check type adapter enabled (using the Open Policy Agent compiled-in adapter), Istio's Policy and Telemetry support checks the outcome of the adapter before the authentication policy.
Since the authorization check is dependent upon the principal (authenticated subject) of the request, the Mixer adapter depends on this value to make its decision. However, that property will not be available until the authentication policy has been evaluated and the request.auth properties have been generated.
Expected behavior
I expect the authentication policy to take precedence over the Mixer authorization check. A 401 should be returned due to a failure to meet the authentication policy, and a 403 should be returned if the subject met the authentication policy but did not meet the authorization constraints configured in Mixer.
Steps to reproduce the bug

Install Bookinfo application.
Configure OPA Mixer Adapter with a basic OPA Policy
Configure an Istio Origin Authentication Policy against the Product Page application.
Make an unauthenticated request to the Product Page application.
Observe a 403 occurs before a 401.

Version
Istio Version: 1.1.1
Kubernetes Version: 1.13
Installation
Installed using Helm chart with default values.
Environment
Ubuntu 18.04, Minikube

cc @diemtvu : do you know on top of your head if auth filter precedes mixer filter?

Yes. Should be.
On Wed, Apr 10, 2019 at 3:37 PM Kuat<EMAIL_ADDRESS>wrote:

cc @diemtvu https://github.com/diemtvu : do you know on top of your
head if auth filter precedes mixer filter?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/issues/13210#issuecomment-481891741, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AX99ce9Y-11d_Xk4DTAxFzjnAKEIAM8lks5vfmedgaJpZM4cn4Sr
.

--
Diem Vu | Software Engineer |<EMAIL_ADDRESS>| +1<PHONE_NUMBER>

@diemtvu This is everything I have:
apiVersion: "config.istio.io/v1alpha2"
kind: opa
metadata:
 name: opa-handler
 namespace: istio-system
spec:
 policy:
   - |+
    package mixerauthz

    default allow = false

    allow {
      input.subject.user =<EMAIL_ADDRESS>      input.action.method = "GET"
    }
 checkMethod: "data.mixerauthz.allow"
 failClose: true
---
apiVersion: "config.istio.io/v1alpha2"
kind: authorization
metadata:
 name: authz-instance
 namespace: istio-system
spec:
 action:
  method: request.method | ""
  namespace: destination.namespace | "default"
  path: request.path | "/"
  properties:
   version: destination.labels["version"] | ""
 subject:
   user: request.auth.claims["sub"] | ""
   groups: request.auth.claims["groups"] | ""
   properties:
    iss: request.auth.claims["iss"] | ""
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
 name: opa-rule
 namespace: istio-system
spec:
 actions:
 - handler: opa-handler.opa.istio-system
   instances:
   - authz-instance.authorization.istio-system
---
apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: "origin-auth"
  namespace: default
spec:
  targets:
  - name: productpage
  origins:
  - jwt:
      issuer: "<issuer-here>"
      jwksUri: "<jwks-uri-here>"
  principalBinding: USE_ORIGIN

This looks correct to me. I applied them to my setup and it works as expected.
Just to be sure, you have the productpage run in default namespace, right?
Can you run tools/dump_kubernetes.sh script and send us the dump for more investigation. Thanks.

@diemtvu Sure thing. I'll get back with you shortly with that.

@diemtvu Double checked everything... It's still behaving as I described above.
I get a 403 Forbidden before a 401 Unauthorized if a token is not provided. If I (by default) allow all requests in the OPA adapter, I get a 401 Unauthorized if I don't provide a token. So the behavior is still acting like the Mixer filter runs before the Authentication filter.
Here is the dump:
istio-dump.zip

Do you access the productpage via ingress (istio-ingressgateway)? If so, I think the 403 you see is because ingress rejecting it given the OPA policy. You may need to move the authn policy to ingress, or change the opa rules to be enforced on productpage only.

I am accessing it behind the istio-ingress, yeah. I'll try what you're suggesting.

@diemtvu Could you give me a sample configuration that achieves what I'm looking for? It sounds like you were able to do it?

I'm not quite familiar with OAP. Add @liminw who may help.
To set jwt on ingress, you can simply change the target. E.g
apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: "origin-auth"
  namespace: **istio-system**
spec:
  targets:
  - name: **istio-ingressgateway**
  origins:
  - jwt:
      issuer: "<issuer-here>"
      jwksUri: "<jwks-uri-here>"
  principalBinding: USE_ORIGIN

You can also combine with trigger_rules to include/exclude the path you care.
A related note, in your original authn policy that set for productpage, you set origins but at the same time, leave the peers section empty which will disable mTLS. If that's intentional, you may need to set a destination rule to disable it on client side as well
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: productpage
  namespace: default
spec:
  host: productpage.default.svc.cluster.local
  trafficPolicy:
    tls:
      mode: DISABLE

@liminw Looping you in ^^. I have the operator config above, but I'm not getting the authorization instance attributes generated. What am I doing wrong?

I'm not quite familiar with OPA. Add @liminw who may help.
To set jwt on ingress, you can simply change the target. E.g
apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: "origin-auth"
  namespace: **istio-system**
spec:
  targets:
  - name: **istio-ingressgateway**
  origins:
  - jwt:
      issuer: "<issuer-here>"
      jwksUri: "<jwks-uri-here>"
  principalBinding: USE_ORIGIN

You can also combine with trigger_rules to include/exclude the path you care.
A related note, in your original authn policy that set for productpage, you set origins but at the same time, leave the peers section empty which will disable mTLS. If that's intentional, you may need to set a destination rule to disable it on client side as well
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: productpage
  namespace: default
spec:
  host: productpage.default.svc.cluster.local
  trafficPolicy:
    tls:
      mode: DISABLE

@diemtvu I'm confused by this... Let me tell you what I'm hoping for, and please guide me in the right direction.
I would like an origin authentication policy (requiring end-user authentication) at the istio-ingressgateway layer. Between the istio-ingressgateway and any services in the default or other namespaces should be using mTLS. So essentially I want origin authentication on the public client side, and mTLS between all services within the Istio service mesh otherwise.
What is the best approach for this?

Quick answer: if you set JWT on ingress as the last email, then you're all
good. While waiting for answers on OPA , you can also try different
approach for authorization as described here
https://istio.io/docs/tasks/security/authz-http/.
TL;DR: The other problem I mentioned is just a head up, in case you want to
put the JWT authentication on productpage service again. Basically, you
need to be careful not changing mTLS setting by accident. The origin policy
sets JWT, and but also remove mTLS, which will make trouble as all other
services (including ingress-gateway) use mTLS to send traffic to
productpage, but mTLS is disabled on the productpage service itself. You
can read more about mTLS and this situation here
https://istio.io/docs/tasks/security/authn-policy/#service-specific-policy
and here https://istio.io/docs/tasks/security/mutual-tls/. Hope this
clear.
On Thu, Apr 11, 2019 at 3:57 PM Jonathan Whitaker<EMAIL_ADDRESS>wrote:

I'm not quite familiar with OPA. Add @liminw https://github.com/liminw
who may help.
To set jwt on ingress, you can simply change the target. E.g
apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
name: "origin-auth"
namespace: istio-system
spec:
targets:

name: istio-ingressgateway
origins:
jwt:
issuer: ""
jwksUri: ""
principalBinding: USE_ORIGIN

You can also combine with trigger_rules
https://istio.io/docs/tasks/security/authn-policy/#enable-end-user-authentication-for-specific-paths
to include/exclude the path you care.
A related note, in your original authn policy that set for productpage,
you set origins but at the same time, leave the peers section empty which
will disable mTLS. If that's intentional, you may need to set a destination
rule to disable it on client side as well
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: productpage
namespace: default
spec:
host: productpage.default.svc.cluster.local
trafficPolicy:
tls:
mode: DISABLE
@diemtvu https://github.com/diemtvu I'm confused by this... Let me tell
you what I'm hoping for, and please guide me in the right direction.
I would like an origin authentication policy (requiring end-user
authentication) at the istio-ingressgateway layer. Between the
istio-ingressgateway and any services in the default or other namespaces
should be using mTLS. So essentially I want origin authentication on the
public client side, and mTLS between all services within the Istio service
mesh otherwise.
What is the best approach for this?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/issues/13210#issuecomment-482357367, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AX99cX7Xohbr5ms4WTNVIksUZuhZ65Rcks5vf73qgaJpZM4cn4Sr
.

--
Diem Vu | Software Engineer |<EMAIL_ADDRESS>| +1<PHONE_NUMBER>

@jon-whit Regarding your question on why 'request.auth.claims["sub"]' is not populated, you may want to remove double quotes (") on "sub". That is, using 'request.auth.claims[sub]'.
If that does not work, you can try to look in mixer server (mixs) log to see the attribute values.
Same as @diemtvu 's recommendation, I would strongly recommend you to try out Istio authorization (https://istio.io/docs/concepts/security/#authorization and https://istio.io/docs/tasks/security/authz-http/) as it is evaluated on Envoy locally and hence has better performance.

@liminw I figured out the issue. The issue was that I had the OPA handler being invoked on every request coming into the service mesh. Because there existed only one Policy on the productpage service, the request was unauthorized at the istio-ingressgateway layer. I setup the opa-rule so that it matches only on requests coming into the istio-ingressgateway and that worked great.

@diemtvu I don't think your answer satisfied my question. I have configured the Origin (JWT) authentication on the istio-ingressgateway, and mutual TLS has not been setup. I would like to express an authentication policy where every service->service call within the service mesh occurs over mutual TLS, but clients outside the kubernetes cluster should present JWT authentication at the istio-ingressgateway layer.


Onboarding vCU after Offboarding the same vCU does not work

Describe the bug
After offboarding a given vCU it is not possible to onboard it again later on.
The onboarding response is just empty but console output states that everything worked.
To Reproduce

onboard any vCU
offboard the same vCU
onboard the same vCU again

Expected behavior
Expected result is an OnboardingResponse or Exception instead of nothing.
Desktop:

OS: Windows 10
Browser: chrome

Backend server:

OS: Ubuntu 16.04.6 LTS

Additional context
It seems that the vCU does not really get deleted on the Agrirouter side.
The console output shows some repsonse from AR after onboarding the offboarded vCU, but no OnboardingResponse object is delivered in Java. The returned list is empty.

Do you have an example implementation or could you post the response you get from agrirouter?

Steps which where executed before the screenshot was taken:

Onboarding account -> works fine (appears in Agrirouter "Kontrollzentrum")
Onboarding vCU (ExternalId e.g. urn:exatrek:adapter:12) -> works fine (vCU appears in Agrirouter "Kontrollzentrum")
Offboarding vCU -> works fine (vCU disappears in Agrirouter "Kontrollzentrum")
Onboarding vCU (with same ExternalId: urn:exatrek:adapter:12) -> can be seen on screenshot

The result is an empy list of OnboardingRespons items and no Exception.

Could you please post the output as text, so that I can base64-Decode it?

Here you go ;)
2019-08-22 10:31:35.106  INFO 30817 --- [nio-9090-exec-2] de.exatrek.portal.rest.AgrirouterRest    : Onboarding vCU...
2019-08-22 10:31:35.810  INFO 30817 --- [nio-9090-exec-2] o.g.jersey.logging.LoggingFeature        : 1 * Sending client request on thread ajp-nio-9090-exec-2
1 > POST https://dke-qa.eu10.cp.iot.sap/iot/gateway/rest/measures/28b9a81d-2ece-4c9f-b647-c97c63b9c921
1 > Accept: application/json,application/json
1 > Content-Type: application/json
{"sensorAlternateId":"bbd59e06-a5b1-4d41-83c0-5d30a0adfd91","capabilityAlternateId":"3701784d-58b8-4415-87a7-fb36badd41c6","measures":[{"message":"UQokNzNjMjY2MDUtYjg4YS00ZTAzLTk0OWItN2VkYTU0NjE0ZGY1EAEaG2RrZTpjbG91ZF9vbmJvYXJkX2VuZHBvaW50c0IKCIfe+eoFEMCEPV4KXAovYWdyaXJvdXRlci5jbG91ZC5yZWdpc3RyYXRpb24uT25ib2FyZGluZ1JlcXVlc3QSKQonChZ1cm46ZXhhdHJlazphZGFwdGVyOjUxEg1FWEEtVDJfMDAwMDAy","timestamp":"1566469895"}]}
2019-08-22 10:31:35.813  INFO 30817 --- [nio-9090-exec-2] o.g.jersey.logging.LoggingFeature        : 1 * Client response received on thread ajp-nio-9090-exec-2
1 < 200
1 < Content-Length: 0
1 < Date: Thu, 22 Aug 2019 10:31:35 GMT
1 < Server: Jetty(8.1.15.v20140411)
1 < Strict-Transport-Security: max-age=16000000; includeSubDomains; preload;
2019-08-22 10:31:36.008  INFO 30817 --- [nio-9090-exec-2] o.g.jersey.logging.LoggingFeature        : 1 * Sending client request on thread ajp-nio-9090-exec-2
1 > GET https://dke-qa.eu10.cp.iot.sap/iot/gateway/rest/commands/28b9a81d-2ece-4c9f-b647-c97c63b9c921
1 > Accept: application/json,application/json
2019-08-22 10:31:36.039  INFO 30817 --- [nio-9090-exec-2] o.g.jersey.logging.LoggingFeature        : 1 * Client response received on thread ajp-nio-9090-exec-2
1 < 200
1 < Connection: close
1 < Content-Type: application/json;charset=utf-8
1 < Date: Thu, 22 Aug 2019 10:31:36 GMT
1 < Server: Jetty(8.1.15.v20140411)
1 < Strict-Transport-Security: max-age=16000000; includeSubDomains; preload;
[]
2019-08-22 10:31:36.696  INFO 30817 --- [nio-9090-exec-2] o.g.jersey.logging.LoggingFeature        : 1 * Sending client request on thread ajp-nio-9090-exec-2
1 > GET https://dke-qa.eu10.cp.iot.sap/iot/gateway/rest/commands/28b9a81d-2ece-4c9f-b647-c97c63b9c921
1 > Accept: application/json,application/json
2019-08-22 10:31:36.734  INFO 30817 --- [nio-9090-exec-2] o.g.jersey.logging.LoggingFeature        : 1 * Client response received on thread ajp-nio-9090-exec-2
1 < 200
1 < Connection: close
1 < Content-Type: application/json;charset=utf-8
1 < Date: Thu, 22 Aug 2019 10:31:36 GMT
1 < Server: Jetty(8.1.15.v20140411)
1 < Strict-Transport-Security: max-age=16000000; includeSubDomains; preload;
[]
2019-08-22 10:31:37.380  INFO 30817 --- [nio-9090-exec-2] o.g.jersey.logging.LoggingFeature        : 1 * Sending client request on thread ajp-nio-9090-exec-2
1 > GET https://dke-qa.eu10.cp.iot.sap/iot/gateway/rest/commands/28b9a81d-2ece-4c9f-b647-c97c63b9c921
1 > Accept: application/json,application/json
2019-08-22 10:31:37.406  INFO 30817 --- [nio-9090-exec-2] o.g.jersey.logging.LoggingFeature        : 1 * Client response received on thread ajp-nio-9090-exec-2
1 < 200
1 < Connection: close
1 < Content-Type: application/json;charset=utf-8
1 < Date: Thu, 22 Aug 2019 10:31:37 GMT
1 < Server: Jetty(8.1.15.v20140411)
1 < Strict-Transport-Security: max-age=16000000; includeSubDomains; preload;
[{"sensorAlternateId":"bbd59e06-a5b1-4d41-83c0-5d30a0adfd91","capabilityAlternateId":"65963008-5919-45da-8557-4298e6a41152","command":{"message":"XgjJARALGiQ3M2MyNjYwNS1iODhhLTRlMDMtOTQ5Yi03ZWRhNTQ2MTRkZjUiJGVjMjkzNDBhLTZlOGMtNDUzNy05YTk5LThmYmMzNzAzNGE0NioLCIne+eoFEIDXzFqvAQqsAQpFdHlwZXMuYWdyaXJvdXRlci5jb20vYWdyaXJvdXRlci5jbG91ZC5yZWdpc3RyYXRpb24uT25ib2FyZGluZ1Jlc3BvbnNlEmMSYQoWdXJuOmV4YXRyZWs6YWRhcHRlcjo1MRJHCjlUaGVyZSBpcyBhbHJlYWR5IGFuIGV4aXN0aW5nIHZpcnR1YWwgQ1Ugd2l0aCBwcm92aWRlZCBpZC4SClZBTF8wMDAzMDY="}}]

The last message decoded says that the vCU already exists (was also my assumption) and it does not deleted properly in Agrirouter.
A workaround would be to use a different external id everytime this happens, but this will not solve the problem. It may also lead to multiple "zombie" vCUs in Agrirouter which are not connected (and somehow can not be reconnected) to an account.

I think I understand the problem; we only fetch the first message that is returned and that's an ACK_WITH_MESSAGES in this case.
I'll check how to fix that (maybe not backwards-compatible), in the meanwhile you can just add some additional fetchMessageService.fetch to your code in case, the onboard-Command returns an empty list.
Could you confirm, that this workaround helps and that you receive additional messages?

In that case I'ld say that our Java API is just the second level error and we would have to check agrirouter behavior about that. Could you please send a mail to the<EMAIL_ADDRESS>with a bug report?
Please include the OnboardingRequest, the Onboarding Result, The offboarding request and result and the second onboarding Request including Result. Also add the applicationId, certificationVersionId and the endpoint of the telemetry platform, from which you are trying to onboard the VCUs. Also describe the behavior of the UI (is the VCU removed from the UI after you sent the offboarding request?)
Thank you.

I contacted the agrirouter support. They said that offboarding does not delete the vCU directly (just deactivates it). There is a internal Job which deletes this deactivated vCUs after some time.
So just taking a new UUID would fix the onboarding problem after offboarding.
But it would be better to just get some sort of notification instead of just no OnboardingResponse when onboarding ;)
Instead auf a returned list auf OnboardingResponses it woudl be nice to have a list of results (OnboardingResponse or Error or similar) matching the list of given endpointIds to onboard.

Thanks for the feedback. We will check it and optimize it as soon as possible.


Support break and continue in for loops

Problem
Loops in Noir do not currently support break and continue which can lead to awkward boolean flags to try to get around this. These boolean flags are often less efficient since Noir is still performing each iteration and checking a boolean flag on each iteration instead of stopping early.
Happy Case
We add break and continue to Noir, following the semantics of break and continue in Rust.
Alternatives Considered
No response
Additional Context
This was somewhat inspired by https://github.com/noir-lang/noir/pull/4242 which uses a HashMap implementation where the get method is less efficient because of the lack of break.
Would you like to submit a PR for this Issue?
No
Support Needs
No response

where the get method is less efficient because of the lack of break.

I don't think implementing break will actually make this case more efficient unless the contents of the hash map are known at compile-time. If they aren't, break would have no way of breaking out of the loop early.

These could potentially be considered as an unconstrained-only feature.

This was discused offline a bit. One concern is that break may trick developers to e.g. think they're getting a performance boost because they're immediately exiting a loop -  which may in term lead them to use large array sizes without much thought.
Concensus however is to add this both to ACIR and Brillig. Noir's goal is to be easy to write and have a low barrier to entry. If someone wants to then optimize their circuit they can move away from something like break on their own.

I think this may be potentially tricky to implement since we want two completely different behaviors depending on the runtime:

For brillig we should get a normal continue/break which translate to jumps
For acir we should lower to this intermediate variable and if statement construct

Notably, acir functions can also be run in an unconstrained context, where they should presumably have the first behavior instead.
This means we'll probably need new, dedicated continue & break instructions in ssa, but these add complexity since they're new terminator instructions. Additionally, translating these to the intermediate variable and if statement over the loop body is non-trivial I think.

Would this easier if we restricted the usage of continue and break to unconstrained functions?

@TomAFrench yes, quite a bit I think.

Cool, I think that it would probably be a good initial step then. We'll get the benefits of smaller bytecode for the public VM in the short term and then we can revisit whether it makes sense to have this syntax in ACIR purely for DX later on.

on a related note, we could also allow usage of the return keyword in brillig it seems.

In that case I'd consider having a constrained break produce an error message with a link to some docs that explain why breaking in a circuit does not provide any performance gains.

Yep, we should do that.


Thrift parser assumes all required types are colocated in the same file

Issue workflow progress

Progress of the issue based on the
Contributor Workflow

[ ] 1. The issue provides a reproduction available on
Github,
Stackblitz
or
CodeSandbox

Make sure to fork this template and run yarn generate in the terminal.
Please make sure Mesh package versions under package.json matches yours.

[ ] 2. A failing test has been provided
[ ] 3. A local solution has been provided
[ ] 4. A pull request is pending review

Describe the bug

When running mesh dev against a Thrift source that imports types from other thrift IDL files, we fail to generate GraphQL schema: Failed to generate the schema Error: Expected undefined to be a GraphQL nullable type. This seems like it is because the code encounters Identifier Types defined in other files, can not resolve them in its type map and instead returns undefined.
To Reproduce Steps to reproduce the behavior:
calc.thrift:
include "calc_types.thrift"

struct AddRequest {
    1: required calc_types.digit left;
    2: required calc_types.digit right;
}

service Calculator {
  calc_types.digit add(1: AddRequest request)
  calc_types.digit subtract(1: calc_types.digit left, 2: calc_types.digit right)
}

calc_types.thrift:
typedef i32 digit

.meshrc.yaml
sources:
  - name: N/A
    handler:
      thrift:
        idl: ./calc.thrift
        hostName: N/A
        port: N/A
        path: N/A
        serviceName: N/A

Expected behavior
"includes" should be resolved first so that all identifier types can be resolved

Environment:

OS: Mac OS 13.1
"@graphql-mesh/cli": "0.82.25",
"@graphql-mesh/thrift": "^0.12.15",
NodeJS: 14.18

Additional context

Could you create a PR with a failing test here?
https://github.com/Urigo/graphql-mesh/tree/master/packages/handlers/thrift


[TECH ED] Flexbox Froggy

From Module-HTML-CSS created by SallyMcGrath: CodeYourFuture/Module-HTML-CSS#2
Link to the coursework
https://flexboxfroggy.com/
Why are we doing this?
Flexbox Froggy is a fun way to understand CSS Flexbox. You will use flexbox mainly to layout flexible lists in modern codebases, and you will encounter it a lot in legacy codebases as a professional developer.
So jump the froggy today!
Maximum time in hours
0
How to get help
Share your blockers in your class channel. Use the opportunity to refine your skill in Asking Questions like a developer.
How to submit
No submission step.


Build failure: pdfpc

Steps To Reproduce
nix build nixpkgs#pdfpc
Build log
@nix { "action": "setPhase", "phase": "buildPhase" }
building
build flags: -j4 SHELL=/nix/store/j80wcbm6bb1nsqsgmniq43rg980p27q9-bash-5.2-p15/bin/bash
[  2%] Generating classes/action/action_mapping.c, classes/action/link_action.c, classes/action/movie.c, classes/config_file_reader.c, classes/dbus_server.c, classes/drawings/drawing.c, classes/drawings/drawing_commands.c, classes/drawings/storage.c, classes/metadata/pdf.c, classes/metadata/xml.c, classes/options.c, classes/presentation_controller.c, classes/renderer/cache.c, classes/renderer/image.c, classes/renderer/markdown.c, classes/renderer/pdf.c, classes/rest_server.c, classes/timer.c, classes/view/behaviour/base.c, classes/view/behaviour/pdf_link.c, classes/view/markdown.c, classes/view/pdf.c, classes/view/transition_manager.c, classes/view/video.c, classes/window/fullscreen.c, classes/window/overview.c, classes/window/presentation.c, classes/window/presenter.c, classes/window/qrcode.c, interfaces/controllable.c, pdfpc.c
/build/source/src/classes/drawings/drawing_commands.vala:57.46-57.59: error: `pdfpc.DrawingCommand' is not a supported generic type argument, use `?' to box value types
   57 |             this.drawing_commands = new List<DrawingCommand>();
      |                                              ^~~~~~~~~~~~~~
/build/source/src/classes/drawings/drawing_commands.vala:58.43-58.56: error: `pdfpc.DrawingCommand' is not a supported generic type argument, use `?' to box value types
   58 |             this.redo_commands = new List<DrawingCommand>();
      |                                           ^~~~~~~~~~~~~~
/build/source/src/classes/drawings/drawing_commands.vala:73.43-73.56: error: `pdfpc.DrawingCommand' is not a supported generic type argument, use `?' to box value types
   73 |             this.redo_commands = new List<DrawingCommand>(); // clear
      |                                           ^~~~~~~~~~~~~~
Compilation failed: 3 error(s), 0 warning(s)
make[2]: *** [src/CMakeFiles/pdfpc.dir/build.make:108: src/classes/action/action_mapping.c] Error 1
make[1]: *** [CMakeFiles/Makefile2:169: src/CMakeFiles/pdfpc.dir/all] Error 2
make: *** [Makefile:136: all] Error 2

Additional context
none
Notify maintainers
@pSub
Metadata
Please run nix-shell -p nix-info --run "nix-info -m" and paste the result.
[user@system:~]$ nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 6.1.25, NixOS, 23.05 (Stoat), 23.05.20230430.da45bf6`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.13.3`
 - nixpkgs: `/nix/store/lyaypyw1xhd1h8ianv6siqm3j1wq51cg-source`

I started to bisect this with
git bisect start 72e8332e0c0f6a5f44545199261a6352efe55f0b da45bf6ec7bbcc5d1e14d3795c025199f28e0de0
git bisect run nix build .#pdfpc

at cc5ea7ea894d00f725ea182e7376d0ebda6f461f nix started to download ~4GB of derivations and I aborted the process. The git bisect log is
# bad: [72e8332e0c0f6a5f44545199261a6352efe55f0b] xemu: 0.7.85 -> 0.7.87
# good: [da45bf6ec7bbcc5d1e14d3795c025199f28e0de0] Merge pull request #229153 from KaiHa/pr-liier-remove-myself
git bisect start '72e8332e0c0f6a5f44545199261a6352efe55f0b' 'da45bf6ec7bbcc5d1e14d3795c025199f28e0de0'
# bad: [8663481786dc8edb406b9a75191b53fbc770dc03] Merge #228476: staging-next 2023-04-27
git bisect bad<PHONE_NUMBER>dc8edb406b9a75191b53fbc770dc03
# good: [8953f5bf6a31c1a5fd6c0f694f208f51008fb7a2] Merge pull request #229233 from mahmoudk1000/master
git bisect good 8953f5bf6a31c1a5fd6c0f694f208f51008fb7a2

@totoroot you are right, pdfpc/pdfpc@d38edfac63bec54173b4b31eae5c7fb46cd8f714 fixes this. I tried it with this patch on nixpkgs:
 diff --git a/pkgs/applications/misc/pdfpc/default.nix b/pkgs/applications/misc/pdfpc/default.nix
index 5678cef8e1b..cd4f1b6fa7a 100644
--- a/pkgs/applications/misc/pdfpc/default.nix
+++ b/pkgs/applications/misc/pdfpc/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, vala, gtk3, libgee
 , poppler, libpthreadstubs, gstreamer, gst-plugins-base, gst-plugins-good, gst-libav, gobject-introspection, wrapGAppsHook
-, qrencode, webkitgtk, discount, json-glib }:
+, qrencode, webkitgtk, discount, json-glib, fetchpatch }:

 stdenv.mkDerivation rec {
   pname = "pdfpc";
@@ -33,6 +33,13 @@ stdenv.mkDerivation rec {
     json-glib
   ];

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/pdfpc/pdfpc/commit/d38edfac63bec54173b4b31eae5c7fb46cd8f714.diff";
+      hash = "sha256-KC2oyzcwU2fUmxaed8qAsKcePwR5KcXgpVdstJg8KmU=";
+    })
+  ];
+
   cmakeFlags = lib.optional stdenv.isDarwin "-DMOVIES=OFF";

   meta = with lib; {


Invalidate the cloudfront cache on deploy

See: https://github.com/mozilla/thimble.webmaker.org/issues/1132

The DistributionId: ENS8DUD0WOHD9


Chance Favcon, Apple Touch Icon

This will be Good. So i Can use my own Logo

Duplicate of https://github.com/louislam/uptime-kuma/issues/483


refactor: refine code to fix cargo update break issues.

1. Does this PR affect any open issues?(Y/N) and add issue references (e.g. "fix #123", "re #123".):

[ ] N
[x] Y

fix #398

2. What is the scope of this PR (e.g. component or file name):

3. Provide a description of the PR(e.g. more details, effects, motivations or doc link):

[ ] Affects user behaviors
[ ] Contains syntax changes
[ ] Contains variable changes
[ ] Contains experimental features
[ ] Performance regression: Consumes more CPU
[ ] Performance regression: Consumes more Memory
[x] Other

4. Are there any breaking changes?(Y/N) and describe the breaking changes(e.g. more details, motivations or doc link):

[x] N
[ ] Y

5. Are there test cases for these changes?(Y/N) select and add more details, references or doc links:

[ ] Unit test
[x] Integration test
[ ] Benchmark (add benchmark stats below)
[ ] Manual test (add detailed scripts or steps below)
[ ] Other

All test cases.

6. Release note

Please refer to Release Notes Language Style Guide to write a quality release note.
None

Pull Request Test Coverage Report for Build<PHONE_NUMBER>

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 90.562%

Totals

Change from base Build<PHONE_NUMBER>:
0.0%

Covered Lines:
1612

Relevant Lines:
1780

💛  - Coveralls


Upgrade to .NET 7

Upgrade TFM to .NET 7
Upgrade NuGet package references
Code clean up
Organize into folders where appropriate
Evolve code such that it is closer to the blazor-workshop

This shall serve as the starting point for the corresponding revised Learn module:

https://github.com/MicrosoftDocs/learn-pr/pull/32283

Fixes #1, fixes #2, fixes #4, fixes #5, fixes #6, and fixes #7

LGTM


M3-5762: Resolve "try to delete in use disk" E2E test flakiness

Description
What does this PR do?
This reduces or eliminates the test flakiness found in the try to delete in use disk test within linode-storage.spec.ts.
This test is flaky because navigating to the Linode details page "Storage" tab too quickly after creating a Linode can cause the Linode's disk not to appear (presumably because it has not been created yet), and the disk will not appear until the page is refreshed.
These changes sidestep the issue by waiting for the Linode to boot before navigating to the "Storage" tab. See M3-5762 for more information.
How to test
What are the steps to reproduce the issue or verify the changes?
yarn cy:run -s "**/*/linode-storage.spec.ts"

Confirm that tests succeed.
Unfortunately, reproducing the issue is difficult and it only occurs once in a while, so it may take some time to confirm that the flakiness is truly resolved.

Wow I must be really unlucky because I got the bad behavior first try...

Wow I must be really unlucky because I got the bad behavior first try...
The test ran a second time and passed

Ha! That is lucky (or unlucky?). I had the test running on repeat for about 30 minutes on Friday with no sign of the issue!
I'll have to look into this again, but I guess the question is why would the disk not be shown in the "Storage" tab even once the Linode is booted?
I suppose I could modify this so that it waits for the Linode to boot, and then navigates to the "Storage" tab using cypress.visitWIthLogin() so that it performs a full page refresh, but we're starting to get into hacky territory with that.

Ok, hoping this really fixes it.
Turns out the data for the "Storage" tab loads as soon as you navigate to the Linode details page, not necessarily when you first navigate to the "Storage" tab itself.
Now I'm waiting for the Linode to boot from the landing page, and navigating to the storage tab after it's reported running. Because there's a full page load in between, and assuming my understanding of this issue is correct, the disk should now always appear in the list for the sake of this test.

When I run just this test locally, I end up with 4 linodes left on my account created by this one test. Can you confirm those 4 linodes get deleted at some point in the pipeline? I don't want our test accounts getting flooded with dangling Linodes.

Yep! We have hooks set up to clear all the test data before Cypress runs. I'm not certain why we do it this way instead of cleaning up after the tests, but I'm speculating that it's to help with debugging in case a test fails -- we can manually investigate any problematic Linodes/volumes/etc. without having to worry about Cypress deleting everything.
Any thoughts on this?


Nuxt Generate Fatal Error in Jenkins

I'm basically running npm run generate in jenkins build
This is my current configuration:
npm install

npm test

chmod +x node_modules/nuxt/bin/nuxt.js

node_modules/nuxt/bin/nuxt.js generate

// then upload dist/ to s3 for static hosting

I'm getting
  [20:29:26] [WARN] vendor has been deprecated due to webpack4 optimization
[20:29:46] [FATAL]

   ╭────────────────────────╮
   │                        │
   │   ✖ Nuxt Fatal Error   │
   │                        │
   │                        │
   │                        │
   ╰────────────────────────╯

Build step 'Execute shell' marked build as failure
Finished: FAILURE

But when I tried it on my local it manages to create a dist file

This question is available on Nuxt community (#c8782)

I have also the same problem
solve?

I solved it.
I built it manually on the server.
Encountered 2 questions.
sh: 1: node: Permission denied
npm config set user 0
npm config set unsafe-perm true

File case problem
mac window 不区分大小写文件，linux 区分


rules behind the limited number of electrods.tsv per session should be made more explicit

Unless I missed it, it seems that the rules limiting the number of eletrodes.tsv per session are not explicitly stated.
For example

electrodes (positions) and coordinates (in which they are expressed) are required to remain constant in a session. If not, then the data must be represented over multiple sessions (which can be on the same day). Also, if multiple EEG systems are being used in succession on the same subject (e.g. with dry electrodes), it should be represented in multiple sessions.

Linking to the original thread at the end of this post.
I may be wrong but this feels more then a simple "how to use bids" issue as it adds an extra constraints on the definition of session for EEG and iEEG (as mentioned in the original thread).
Another reason why this may needed is that currently the validator does not enforce this rule and allows many more entities than the spec permits (https://github.com/bids-standard/bids-validator/issues/1198).
This can otherwise lead to user confusion (see https://github.com/bids-standard/bids-matlab/issues/542#issuecomment-1529921282)

electrodes (positions) and coordinates (in which they are expressed) are required to remain constant in a session. If not, then the data must be represented over multiple sessions (which can be on the same day). Also, if multiple EEG systems are being used in succession on the same subject (e.g. with dry electrodes), it should be represented in multiple sessions.
Different sampling rates and/or filter settings of the amplifier can happen within a session, as (of course) multiple runs of the same task, or different tasks in different (EEG) files.
Electrode positions are (potentially noisy) measurements that can be done multiple times, hence the acq label. The coordinate system is a definition,  which only needs to be specified once.
I also do not recall why there is an optional run label for electrodes. I do not see the use case for it. Looking in the draft google doc, I also don't see it there.
Originally posted by @robertoostenveld in https://github.com/bids-standard/bids-specification/issues/416#issuecomment-587459530

Just to be clear, I am not trying to argue against the rationale, but more arguing for the rationale to be made more explicit, a bit like in the spirit of some other recent PRs that either clarify and make things more explicit:

https://github.com/bids-standard/bids-specification/pull/1392
https://github.com/bids-standard/bids-specification/pull/1444/files

I value clarifications!
I think it will be useful to look ahead at the animal ephys and at the NIBS BEPs. They both involve "something" (electrodes and/or stimulation coils) being placed relative to/in the brain. When planning/discussing EEG we considered teh 80/20 principle and wanted to align with the most common measurements (which don't move the EEG cap in a session) and avoid spending time discussing (at that time more experimental) dry and wearable electrode caps. Hence we defined the one-electrodelocation-per-session rule to limit the scope and be able to finalize the BEP. This also aligned with iEEG recordings, using chronic/static electrode positions
With future BEPs we may want to loosen that requirement and engage the discussion that we postponed back then.
Also for OPM MEG we will have to anticipate changes, although not in the electrodes.tsv, so perhaps not something to worry about here.

@Remi-Gau I think this was addressed by #1722?

yeah I think so: at least it is clearer to me now
if not we can reopen later or open a new issue


Coil 2.2.0 is Not compatible with RN 0.64.4

Due to this compatibility issue, if I install RNTP 4.0, all fetches in the app will fail and the app will crash.
If I go back to the previous version, 1.4.0, the problem will not occur.

I removed all code and fetched from RN.  It just crashes on all network communications.

If I were to guess from logcat, it seems to be a problem with the okhttp version.


fix: support for flow types

Before this patch, ctags would not recognize simple import type
statements such as:
import type impFlowType from "./ImportDefault";
import type { impFlowType } from "./ImportDefault";

I just noticed that somehow I did not have the most recent version of this :thinking:

Thank you for this, but direct imports/exports are not tagged, either for straight ES6 imports/exports or for Flow. Only named imports/exports are.
This is on purpose:

Foo is defined in Foo.js, exported without renaming, and imported without renaming. If we tagged direct imports and direct exports we would have three tags for the same symbol, only one of which being interesting. Since we only tag named imports and named exports, we only have one tag, for the definition.

Foo is defined in Foo.js, exported as Bar, and imported without renaming. If we tagged direct imports we would have one tag for Foo and two tags for Bar. Since we only tag named imports, we have two tags and we can follow the trail.

Foo is defined in Foo.js, exported as Bar, and imported as Baz. It is a silly practice but well… since we tag named imports and named exports it is still possible to follow the trail.


[Tooltip]: $tooltip-pip-offset not implemented

I see $tooltip-pip-offset in the documentation and see the variable defined in _tooltip.scss but it is not put to use.

Removed the variable in the 6.2 branch: 7541beffd5b163e1cd7522652edce27a5e794767
It doesn't make sense anyway, as the pip is always horizontally centered. If we ever add any hooks to re-position the pip on a per-tooltip basis, we'd maybe need a variable like this again.


Statistics summary RESTful api with start-time end-time parameters

@Morgan-Leon (Fixed)

get semesters by student id
get bookinshelf list that in bookshelf by student id with start-time end-time
get bookinshelf list that pass the exam by student id with start-time end-time

@zdp207 (Open)

get 阅读思维能力分析 by student id with start-time end-time

@zdp207
get 阅读思维能力分析 by student id with start-time end-time


[CI][Conda] Nightly CI jobs aren't maintained

Describe the bug, including details regarding any error messages, version, and platform.
Nightly CI jobs for Conda were fixed by @h-vetinari and @xhochy in GH-14102 but most nightly CI jobs are failing again this past month.
Can we maintain them? If we can't maintain them, can we remove them?
After that update the CI should run fine IMO, and it should be easy to update after that as well. The test failures and segfaults I mentioned IMO make running things in CI here worthwhile, as another angle through which to stresstest the code (before the PR linked above, the conda-forge feedstock didn't run the test suite; now it does).
However I can't speak for the jobs that also include R. Haven't looked at those, so far only @xhochy did AFAIU.

Thanks for sharing the current status.
Sorry for not replying to segfaults... I couldn't follow https://github.com/conda-forge/arrow-cpp-feedstock/pull/875 because it's too large for me.
If you find problems or have questions of Apache Arrow, how about creating an issue to apache/arrow for each problems/questions? It may bother you but it may be easier to resolve each problem/question.

If you find problems or have questions of Apache Arrow, how about creating an issue to apache/arrow for each problems/questions? It may bother you but it may be easier to resolve each problem/question.

It doesn't bother me at all. I didn't want to spam people with issues, and thought it would be easier to ask specific questions (e.g. about the LLVM usage), but if people prefer issues here that's not a problem for me.

While preparing a PR, I just saw that https://github.com/apache/arrow/commit/a3ef64b9583c3a92fac73e74e9e03e5d22a6d8f6 broadly undid several necessary infrastructure changes in tasks.yml (looks like it might have been an inattentive merge conflict resolution that undid most of #1402's changes) - it's unsurprising that builds have been failing since, because they're pointing to non-existent configs.
CC @assignUser, please be more careful next time

@h-vetinari Oh 😱 seems like I picked the wrong chunk and it slipped through the review. Sorry

Oh, sorry. I missed these changes on merging...


[Map] DM-Temple

This author is the same person as 	Pat-BadKarma-Fitzsimons

URL: https://unrealarchive.org/maps/unreal-tournament/deathmatch/T/dm-temple_4cb3cf45.html
Hash: 4cb3cf45ac6218a4d56a549804f9ebd4dd5d1c71
Current name: DM-Temple

Added aliases:
BadKarma
Pat-BadKarma-Fitzsimons
Patrick Fitzsimons


add isIdle, isBooted, isBooting and isFailed functions

Sometimes we don't need to get full report but just interested in a state of a bootable.
We need to introduce easy way to know if we are in a current state or just get the state by the means of library.
What is better approach here @Vacxe ?

just functions in Boots class
package level functions
both

Merged. Closing this task


Need a way to read Android /res assets from Flutter

Internal: b/117228933
Flutter app cannot access assets under res/** for Android (or an arbitrary bundle on iOS), unless the asset is copied to the Flutter managed bundle. This is not ideal; we should provide a way to reuse platform assets.
It is worth noting that we support the other way around: https://flutter.io/assets-and-images/#sharing-assets-with-the-underlying-platform
Ideally, we should leverage the platform's mechanism for picking the right asset too. For instance, instead of grabbing res/drawable-hhdpi/some_asset.png, we should access the asset via R.drawable.some_asset so that the right scaled version is picked.

It may make sense to track this as two separate bugs - but that said I'm not sure this has the same impact on iOS, as on that side you should be able to just open the asset as a regular file (you can't do that if it's a bundled APK asset though).

@mehmetf can you provide an example of where this might be used? What kind of assets do we expect Flutter app devs to include on the platform side? If an in-person convo is easier, let me know and I'll swing by.

The primary use case is for add2app. If I have an app with 100+ assets, I don't want to duplicate those assets to use them in my Dart code.

Hi what is the status now? Thanks!

The primary use case is for add2app. If I have an app with 100+ assets, I don't want to duplicate those assets to use them in my Dart code.

Also, this is a problem when you have multiple flavors for your app. You have to add all the asset files under Flutter assets for all the flavors. The generated apk/bundle for one flavor includes all the assets for the other flavors even though it does not need them. The apk size gets very large depending on the asset contents.

There are now some libraries which do this.
ios_platform_images (which is from the Flutter team) and drawable for Android

update on this ?

I have a lot of audio files in my android assets folder. (Android Play Store has a 200MB limit, so they are bundled via Play Asset Delivery https://developer.android.com/guide/playcore/asset-delivery)
Is there a way to access them from my flutter code?


Rationalize Context subclassing

This PR contains a few changes to how the Context model class and its subclasses are handled.

The CloudFoundryContext and KubernetesContext types now store their parsed values in the properties map from their base class instead of in fields in the subclass. This makes it possible to retrieve the values with type-specific getters or the generic Context.getProperty().
Builders were added for CloudFoundryContext and KubernetesContext to make it easier to write tests that mock requests from the platform. A PlatformContext subtype of Context was created with a Builder to support building contexts of a generic type. The core API of the project doesn't change, as request objects still contain a Context type.
The originating identity context parsed from requests will now be built with the correct subtype.

Fixes #101 and #102

@vivinjoseph9 @michaellihs The changes in this PR should address some issues with the Context classes, especially with creating objects in tests. A 2.0.1.BUILD-SNAPSHOT should be available in the Spring milestone repo if you have a chance to test the changes and provide feedback.

Hi @scottfrederick - only came back to this issue as of today - sorry for not providing an answer earlier. Thanks a lot for your replies. I will try to incorporate the latest changes into my code next week and provide feedback!

Hi @scottfrederick - I managed to update my project to 2.0.1.RELEASE today and I can now access spaceGuid via request.getContext().getProperty("spaceGuid").toString() - so my original request in #102 is fixed now. Thanks a lot for your comprehensive answer here!