ApplicationInsights Integration

We should add another provider for our instrumentation so that we have a native integration with application insights.

@michaelstaib Do you have any suggestion on how you would do this without having this functionality built into Hot Chocolate?
I have implemented a solution that I think gets "close" to what I want. I am using the IDiagnosticObserver to instrument most things. Including:

HotChocolate.Execution.Query.Start
HotChocolate.Execution.Query.Stop
HotChocolate.Execution.Query.Error
HotChocolate.Execution.Validation.Error
HotChocolate.Execution.Resolver.Error

Which is almost everything I would want. I get a Dependency entry for every query and appropriate errors.
However, I don't get an "overall" entry for each request (which would include other things like authentication/authorization work). I was looking at using a AddQueryRequestInterceptor to add this, but then realized I would need a "begin" and "end". At this point I am not sure where to go or if I can/should do more.
Just to clarify, my ideal would be a structure similar to the following.

GraphQL Request: [Operation Name]

Other Work
GraphQL Query: [Operation Name]

SQL

Other Work

Other work being any other dependencies that might happen as part of a request.

we will add more events to this. We currently work on the new execution engine and have more events on the list.

@mdressel I've managed to get request logging working with AI. The trick is to create and start the request operation in the HotChocolate.Execution.Query.Start method, then STORE the operation in a dictionary so that you can fetch it later during the HotChocolate.Execution.Query.Stop phase.
The HttpContext has a handy TraceIdentifier property, which makes for a great key for the dictionary.
So you can imagine something like this:
private Dictionary<string, IOperationHolder<RequestTelemetry>> _inFlightOperations = new Dictionary<string, IOperationHolder<RequestTelemetry>>();

[DiagnosticName("HotChocolate.Execution.Query.Start")]
public void BeginQueryExecute(IQueryContext context)
{
    var httpContext = GetHttpContextFrom(context);

    if (httpContext == null) return;

    // Create a new request
    var requestTelemetry = new RequestTelemetry()
    {
        Name = $"{httpContext.Request.Method} {httpContext.Request.GetUri().GetLeftPart(UriPartial.Path)}",
        Url = new Uri(httpContext.Request.GetUri().AbsoluteUri)
    };

    requestTelemetry.Context.Operation.Id = GetOperationIdFrom(httpContext);
    requestTelemetry.Context.Operation.ParentId = GetOperationIdFrom(httpContext);
    requestTelemetry.Properties.Add("GraphQL Query", context.Request.Query.ToString());

    // Start the operation, and store it in the dictionary
    var operation = _telemetryClient.StartOperation(requestTelemetry);
    _inFlightOperations.Add(GetOperationIdFrom(httpContext), operation);
}

[DiagnosticName("HotChocolate.Execution.Query.Stop")]
public void EndQueryExecute(IQueryContext context, IExecutionResult result)
{
    var httpContext = GetHttpContextFrom(context);
    if (httpContext == null) return;

    if (_inFlightOperations.ContainsKey(GetOperationIdFrom(httpContext)))
    {
        var operation = _inFlightOperations[GetOperationIdFrom(httpContext)];
        _inFlightOperations.Remove(GetOperationIdFrom(httpContext));

        // handle any final request logging here (GraphQL query errors, success, etc)

        // Then stop the operation. This completes the request.
        _telemetryClient.StopOperation(operation);
    }

}

The two helper methods in that code simply fetch the httpcontext from the IQueryContext, and return the trace identifier:
private HttpContext GetHttpContextFrom(IQueryContext context)
{
    // This method is used to enable start/stop events for query.
    if (!context.ContextData.ContainsKey("HttpContext"))
        return null;

    return context.ContextData["HttpContext"] as HttpContext;
}

private string GetOperationIdFrom(HttpContext context)
{
    return context.TraceIdentifier;
}

I've included the query in the request metadata (custom properties), but you can extend it to include whatever you like. In my implementation I've appended the request URI to include the IQueryContext's QueryHash, which allows AI to separate the requests by query, rather than everything just being logged into the /graph endpoint.

We also simplified the whole story around this with the current 11 preview versions. For this, I will close this issue.

Excellent - I look forward to upgrading ;)

@michaelstaib can you clarify what was simplified and how?

Any update for v11?

@JohannSig @woeterman94
Here's the code I use. It basically logs into Serilog and from Serilog I decide where I want the logs to go, in my case I send to Seq when locally and to Application Insights on production.
public class GrowFlowDiagnosticEventListener : DiagnosticEventListener
    {
        public override IActivityScope ExecuteRequest(IRequestContext context)
        {
            Log.Information("{QueryName} starting \n {QueryContent}",
                context.Request.Query.GetQueryName(),
                context.Request.Query.ToString());

            return base.ExecuteRequest(context);
        }

        public override void ResolverError(IMiddlewareContext context, IError error)
        {
            LogHotChocolateError(error);
        }

        public override void RequestError(IRequestContext context, Exception exception)
        {
            base.RequestError(context, exception);
        }

        private void LogHotChocolateError(IError error)
        {
            string path = error.Path?.ToString() ?? "";

            if (error.Exception == null)
            {
                Log.Error("  {0}\r\n{1}", path, error.Message);
            }
            else
            {
                Log.Error(error.Exception,
                    "   {0}\r\n{1}", path, error.Message);
            }
        }
    }

To register the class:
services.AddGraphQLServer(schemaName: SchemaName)
                .ConfigureSchemaServices(s =>
                {
                    s.AddSingleton<IDiagnosticEventListener, GrowFlowDiagnosticEventListener>();
                });

Excellent solution @olitee , I am using schema first, so had to modify it slightly when generating the hash, the operation name will always be null unless the client passes in a query name and also when using Graphql play ground its creating too much noise in dev so blocked that out, apart from that more or less the same code.  The only change was in the ExecuteRequest
`public override IDisposable ExecuteRequest(IRequestContext context)
{
var httpContext = GetHttpContextFrom(context);
if (httpContext == null)
return EmptyScope;
        //During debugging every playground action will come here so we want this while debugging
        #if DEBUG
        if (context.Request.OperationName == "IntrospectionQuery")
            return EmptyScope;
        #endif

        //Create a new telemetry request
        var operationPath = $"{context.Request.OperationName ?? "UnknownOperation"} - {context.Request.QueryHash}";
        var requestTelemetry = new RequestTelemetry()
        {
            Name = $"/graphql{operationPath}",
            Url = new Uri(httpContext.Request.GetUri().AbsoluteUri + operationPath),
        };

        requestTelemetry.Context.Operation.Name = $"POST /graphql/{operationPath}";
        requestTelemetry.Context.Operation.Id = GetOperationIdFrom(httpContext);
        requestTelemetry.Context.Operation.ParentId = GetOperationIdFrom(httpContext);
        requestTelemetry.Context.User.AuthenticatedUserId = httpContext.User.Identity?.Name ?? "Not authenticated";

        if (context.Request.Query != null)
            requestTelemetry.Properties.Add("GraphQL Query", context.Request.Query.ToString());

        var operation = _telemetryClient.StartOperation(requestTelemetry);
        return new ScopeWithEndAction(() => OnEndRequest(context, operation));
    }`

Thanks @Ricky-G, that's great. I'd come to the same conclusion in production about noise. Thanks for posting your modifications - I might borrow those :)

@onionhammer The solution I posted does capture the Query as a custom property, so it's visible in App Insights. The parameter values are also logged as properties. If that was a concern for your solution - you could just omit those.
Or as you asking that is someone writes an unparameterised query, containing sensitive data, that you want to somehow redact those values?

@olitee Right now I don't have a UI, so I'm just using banana cake pop to test out queries, so perhaps its a non-issue once in production and variables are parameterized.


Scan our YAML config files with kubescape

Background and proposal
Context
kubescape is an open-source tool to perform security scans on k8s resources. Repo: https://github.com/armosec/kubescape It generates security reports using common security frameworks, including the NSA/CISA k8s hardening guidance which is one of the gold-standards in this area. (I recall it was recommended to us during our meeting with CUIT.)
Proposed solution
We should implement a scan function in the deployer to scan our YAML config files using kubescape (you can pass the output of helm template directly to kubescape) and run this function in our validation CI/CD (it's probably too verbose to also do it on deploy).
Value and who benefits:

The engineering team will become more aware of what risks there are in our infrastructure and where so we can take steps to address them
It may be useful in leads/partnerships to say something like "similar hubs to the type you'd like have a risk score of X against the Y framework", particularly when dealing with university IT departments who are responsible for security.

Implementation guide and constraints

We should implement a scan function the the deployer to scan our YAML files with kubescape (example in comments)
There is also the capability to scan the running cluster itself and submit results to a cloud service. We should NOT implement this until 1) we understand more about what that entails, and 2) we decide if it's useful for the team.

Updates and ongoing work
No response

Example command running kubescape on the YAML config describing the staging hub on the 2i2c cluster
[control: Access Kubernetes dashboard - https://hub.armo.cloud/docs/c-0014] passed 👍
Description: Attackers who gain access to the dashboard service account or have its RBAC permissions can use its network access to retrieve information about resources in the cluster or change them. This control checks if a subject that is not dashboard service account is bound to dashboard role/clusterrole, or - if anyone that is not the dashboard pod is associated with dashboard service account.
Summary - Passed:2   Excluded:0   Failed:0   Total:2

[control: Access container service account - https://hub.armo.cloud/docs/c-0053] failed 😥
Description: Attackers who obtain access to a pod can use its SA token to communicate with KubeAPI server. All PODs with SA token mounted (if such token has a Role or a ClusterRole binding) are considerred potentially dangerous.
Failed:
  ClusterRole - staging-user-scheduler
  ClusterRoleBinding - staging-user-scheduler
  Deployment - hub
  Deployment - user-scheduler
  Role - hub
  RoleBinding - hub
Summary - Passed:7   Excluded:0   Failed:6   Total:13
Remediation: Verify that RBAC is enabled. Follow the least privilege principle and ensure that only necessary PODs have SA token mounted into them.

[control: Access tiller endpoint - https://hub.armo.cloud/docs/c-0033] skipped 😕
Description: Attackers may run code on any container that is accessible to the tiller’s service and perform actions in the cluster, using the tiller’s service account, which often has high privileges. This control checks if unauthenticated version of the Tiller runs in the cluster.
[control: Allow privilege escalation - https://hub.armo.cloud/docs/c-0016] failed 😥
Description: Attackers may gain access to a container and uplift its privilege to enable excessive capabilities.
Failed:
  Deployment - docs-service
  Job - nfs-share-creator
Summary - Passed:4   Excluded:0   Failed:2   Total:6
Remediation: If your application does not need it, make sure the allowPrivilegeEscalation field of the securityContext is set to false.

[control: Allowed hostPath - https://hub.armo.cloud/docs/c-0006] passed 👍
Description: Mounting host directory to the container can be abused to get access to sensitive data and gain persistence on the host machine.
Summary - Passed:6   Excluded:0   Failed:0   Total:6

[control: Applications credentials in configuration files - https://hub.armo.cloud/docs/c-0012] failed 😥
Description: Attackers who have access to configuration files can steal the stored secrets and use them. This control checks if ConfigMaps or pod specifications have sensitive information in their configuration.
Failed:
  ConfigMap - hub
Summary - Passed:8   Excluded:0   Failed:1   Total:9
Remediation: Use Kubernetes secrets or Key Management Systems to store credentials.

[control: Audit logs enabled - https://hub.armo.cloud/docs/c-0067] skipped 😕
Description: Audit logging is an important security feature in Kubernetes, it enables the operator to track requests to the cluster. It is important to use it so the operator has a record of events happened in Kubernetes
[control: Automatic mapping of service account - https://hub.armo.cloud/docs/c-0034] passed 👍
Description: Potential attacker may gain access to a POD and steal its service account token. Therefore, it is recommended to disable automatic mapping of the service account tokens in service account configuration and enable it only for PODs that need to use them.
Summary - Passed:9   Excluded:0   Failed:0   Total:9

[control: CVE-2021-25741 - Using symlink for arbitrary host file system access. - https://hub.armo.cloud/docs/c-0058] skipped 😕
Description: A user may be able to create a container with subPath or subPathExpr volume mounts to access files & directories anywhere on the host filesystem. Following Kubernetes versions are affected: v1.22.0 - v1.22.1, v1.21.0 - v1.21.4, v1.20.0 - v1.20.10, version v1.19.14 and lower. This control checks the vulnerable versions and the actual usage of the subPath feature in all Pods in the cluster. If you want to learn more about the CVE, please refer to the CVE link: https://nvd.nist.gov/vuln/detail/CVE-2021-25741
[control: CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability - https://hub.armo.cloud/docs/c-0059] skipped 😕
Description: Security issue in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster (see more at https://github.com/kubernetes/ingress-nginx/issues/7837)
[control: CVE-2022-0185-linux-kernel-container-escape - https://hub.armo.cloud/docs/c-0079] skipped 😕
Description: CVE-2022-0185 is a kernel vulnerability enabling privilege escalation and it can lead attackers to escape containers and take control over nodes. This control alerts on vulnerable kernel versions of Kubernetes nodes
[control: CVE-2022-0492-cgroups-container-escape - https://hub.armo.cloud/docs/c-0086] failed 😥
Description: Linux Kernel vulnerability CVE-2022-0492 may allow malicious code running inside container to escape container isolation and gain root privileges on the entire node. When fixed Kernel version numbers will become available, this control will be modified to verify them and avoid false positive detections. This control identifies all the resources that don't deploy neither AppArmor nor SELinux, run as root or allow privige escalation or have corresponding dangerous capabilities.
Failed:
  Deployment - docs-service
  Job - nfs-share-creator
Summary - Passed:4   Excluded:0   Failed:2   Total:6
Remediation: Activate AppArmor or SELinux. Follow the least privilege principle and remove root privileges or privilege escalation option and CAP_DAC_OVERRIDE capability. Make sure you don't allow container images from potentially dangerous sources and that containers that must have high privileges are taken from protected repositories.

[control: CVE-2022-24348-argocddirtraversal - https://hub.armo.cloud/docs/c-0081] skipped 😕
Description: CVE-2022-24348 is a major software supply chain 0-day vulnerability in the popular open source CD platform Argo CD which can lead to privilege escalation and information disclosure.
[control: Cluster internal networking - https://hub.armo.cloud/docs/c-0054] skipped 😕
Description: If no network policy is defined, attackers who gain access to a container may use it to move laterally in the cluster. This control lists namespaces in which no network policy is defined.
[control: Cluster-admin binding - https://hub.armo.cloud/docs/c-0035] passed 👍
Description: Attackers who have cluster admin permissions (can perform any action on any resource), can take advantage of their privileges for malicious activities. This control determines which subjects have cluster admin permissions.
Summary - Passed:4   Excluded:0   Failed:0   Total:4

[control: Configured liveness probe - https://hub.armo.cloud/docs/c-0056] failed 😥
Description: Liveness probe is intended to ensure that workload remains healthy during its entire execution lifecycle, or otherwise restrat the container. It is highly recommended to define liveness probe for every worker container. This control finds all the PODs where the Liveness probe is not configured.
Failed:
  Deployment - docs-service
  StatefulSet - user-placeholder
Summary - Passed:3   Excluded:0   Failed:2   Total:5
Remediation: Ensure Liveness probes are configured wherever possible.

[control: Configured readiness probe - https://hub.armo.cloud/docs/c-0018] failed 😥
Description: Readiness probe is intended to ensure that workload is ready to process network traffic. It is highly recommended to define readiness probe for every worker container. This control finds all the PODs where the readiness probe is not configured.
Failed:
  Deployment - docs-service
  StatefulSet - user-placeholder
Summary - Passed:3   Excluded:0   Failed:2   Total:5
Remediation: Ensure Readiness probes are configured wherever possible.

[control: Container hostPort - https://hub.armo.cloud/docs/c-0044] passed 👍
Description: Configuring hostPort requires a particular port number. If two objects specify the same HostPort, they could not be deployed to the same node. It may prevent the second object from starting, even if Kubernetes will try reschedule it on another node, provided there are available nodes with sufficient amount of resources. Also, if the number of replicas of such workload is higher than the number of nodes, the deployment will consistently fail.
Summary - Passed:6   Excluded:0   Failed:0   Total:6

[control: Containers mounting Docker socket - https://hub.armo.cloud/docs/c-0074] passed 👍
Description: Mounting Docker socket (Unix socket) enables container to access Docker internals, retrieve sensitive information and execute Docker commands, if Docker runtime is available. This control identifies PODs that attempt to mount Docker socket for accessing Docker runtime.
Summary - Passed:6   Excluded:0   Failed:0   Total:6

[control: Control plane hardening - https://hub.armo.cloud/docs/c-0005] skipped 😕
Description: Kubernetes control plane API is running with non-secure port enabled which allows attackers to gain unprotected access to the cluster.
[control: CoreDNS poisoning - https://hub.armo.cloud/docs/c-0037] passed 👍
Description: If attackers have permissions to modify the coredns ConfigMap they can change the behavior of the cluster’s DNS, poison it, and override the network identity of other services. This control identifies all subjects allowed to update the 'coredns' configmap.
Summary - Passed:7   Excluded:0   Failed:0   Total:7

[control: Data Destruction - https://hub.armo.cloud/docs/c-0007] failed 😥
Description: Attackers may attempt to destroy data and resources in the cluster. This includes deleting deployments, configurations, storage, and compute resources. This control identifies all subjects that can delete resources.
Failed:
  ClusterRole - staging-user-scheduler
  ClusterRoleBinding - staging-user-scheduler
  Role - hub
  RoleBinding - hub
Summary - Passed:0   Excluded:0   Failed:5   Total:5
Remediation: You should follow the least privilege principle and minimize the number of subjects that can delete resources.

[control: Delete Kubernetes events - https://hub.armo.cloud/docs/c-0031] passed 👍
Description: Attackers may delete Kubernetes events to avoid detection of their activity in the cluster. This control identifies all the subjects that can delete Kubernetes events.
Summary - Passed:4   Excluded:0   Failed:0   Total:4

[control: Disable anonymous access to Kubelet service - https://hub.armo.cloud/docs/c-0069] skipped 😕
Description: By default, requests to the kubelet's HTTPS endpoint that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of system:anonymous and a group of system:unauthenticated.
[control: Enforce Kubelet client TLS authentication - https://hub.armo.cloud/docs/c-0070] skipped 😕
Description: Kubelets are the node level orchestrator in Kubernetes control plane. They are publishing service port 10250 where they accept commands from API server. Operator must make sure that only API server is allowed to submit commands to Kubelet. This is done through client certificate verification, must configure Kubelet with client CA file to use for this purpose.
[control: Exec into container - https://hub.armo.cloud/docs/c-0002] passed 👍
Description: Attackers with relevant permissions can run malicious commands in the context of legitimate containers in the cluster using “kubectl exec” command. This control determines which subjects have permissions to use this command.
Summary - Passed:4   Excluded:0   Failed:0   Total:4

[control: Exposed dashboard - https://hub.armo.cloud/docs/c-0047] passed 👍
Description: Kubernetes dashboard versions before v2.0.1 do not support user authentication. If exposed externally, it will allow unauthenticated remote management of the cluster. This control checks presence of the kubernetes-dashboard deployment and its version number.
Summary - Passed:9   Excluded:0   Failed:0   Total:9

[control: Exposed sensitive interfaces - https://hub.armo.cloud/docs/c-0021] passed 👍
Description: Exposing a sensitive interface to the internet poses a security risk. It might enable attackers to run malicious code or deploy containers in the cluster. This control checks if known components (e.g. Kubeflow, Argo Workflows, etc.) are deployed and exposed services externally.
Summary - Passed:11   Excluded:0   Failed:0   Total:11

[control: Forbidden Container Registries - https://hub.armo.cloud/docs/c-0001] failed 😥
Description: In cases where the Kubernetes cluster is provided by a CSP (e.g., AKS in Azure, GKE in GCP, or EKS in AWS), compromised cloud credential can lead to the cluster takeover. Attackers may abuse cloud account credentials or IAM mechanism to the cluster’s management layer.
Failed:
  Deployment - docs-service
  Deployment - hub
  Job - nfs-share-creator
Summary - Passed:3   Excluded:0   Failed:3   Total:6
Remediation: Limit the registries from which you pull container images from

[control: Host PID/IPC privileges - https://hub.armo.cloud/docs/c-0038] passed 👍
Description: Containers should be isolated from the host machine as much as possible. The hostPID and hostIPC fields in deployment yaml may allow cross-container influence and may expose the host itself to potentially malicious or destructive actions. This control identifies all PODs using hostPID or hostIPC privileges.
Summary - Passed:6   Excluded:0   Failed:0   Total:6

[control: HostNetwork access - https://hub.armo.cloud/docs/c-0041] passed 👍
Description: Potential attackers may gain access to a POD and inherit access to the entire host network. For example, in AWS case, they will have access to the entire VPC. This control identifies all the PODs with host network access enabled.
Summary - Passed:6   Excluded:0   Failed:0   Total:6

[control: HostPath mount - https://hub.armo.cloud/docs/c-0048] passed 👍
Description: Mounting host directory to the container can be used by attackers to get access to the underlying host. This control identifies all the PODs using hostPath mount.
Summary - Passed:6   Excluded:0   Failed:0   Total:6

[control: Image pull policy on latest tag - https://hub.armo.cloud/docs/c-0075] passed 👍
Description: While usage of the latest tag is not generally recommended, in some cases this is necessary. If it is, the ImagePullPolicy must be set to Always, otherwise Kubernetes may run an older image with the same name that happens to be present in the node cache. Note that using Always will not cause additional image downloads because Kubernetes will check the image hash of the local local against the registry and only pull the image if this hash has changed, which is exactly what users want when use the latest tag. This control will identify all PODs with latest tag that have ImagePullSecret not set to Always.
Summary - Passed:6   Excluded:0   Failed:0   Total:6

[control: Images from allowed registry - https://hub.armo.cloud/docs/c-0078] failed 😥
Description: This control is intended to ensure that all the used container images are taken from the authorized repositories. It allows user to list all the approved repositories and will fail all the images taken from any repository outside of this list.
Failed:
  Deployment - docs-service
  Deployment - hub
  Deployment - proxy
  Job - nfs-share-creator
Summary - Passed:2   Excluded:0   Failed:4   Total:6
Remediation: You should enable all trusted repositories in the parameters of this control.

[control: Immutable container filesystem - https://hub.armo.cloud/docs/c-0017] failed 😥
Description: Mutable container filesystem can be abused to inject malicious code or data into containers. Use immutable (read-only) filesystem to limit potential attacks.
Failed:
  Deployment - docs-service
  Deployment - hub
  Deployment - proxy
  Deployment - user-scheduler
  Job - nfs-share-creator
  StatefulSet - user-placeholder
Summary - Passed:0   Excluded:0   Failed:6   Total:6
Remediation: Set the filesystem of the container to read-only when possible (POD securityContext, readOnlyRootFilesystem: true). If containers application needs to write into the filesystem, it is recommended to mount secondary filesystems for specific directories where application require write access.

[control: Ingress and Egress blocked - https://hub.armo.cloud/docs/c-0030] failed 😥
Description: Disable Ingress and Egress traffic on all pods wherever possible. It is recommended to define restrictive network policy on all new PODs, and then enable sources/destinations that this POD must communicate with.
Failed:
  Deployment - docs-service
  Deployment - user-scheduler
  Job - nfs-share-creator
  StatefulSet - user-placeholder
Summary - Passed:5   Excluded:0   Failed:4   Total:9
Remediation: Define a network policy that restricts ingress and egress connections.

[control: Insecure capabilities - https://hub.armo.cloud/docs/c-0046] passed 👍
Description: Giving insecure or excsessive capabilities to a container can increase the impact of the container compromise. This control identifies all the PODs with dangerous capabilities (see documentation pages for details).
Summary - Passed:6   Excluded:0   Failed:0   Total:6

[control: K8s common labels usage - https://hub.armo.cloud/docs/c-0077] failed 😥
Description: Kubernetes common labels help manage and monitor Kubernetes cluster using different tools such as kubectl, dashboard and others in an interoperable way. Refer to https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/ for more information. This control helps you find objects that don't have any of these labels defined.
Failed:
  Deployment - docs-service
  Deployment - hub
  Deployment - proxy
  Deployment - user-scheduler
  Job - nfs-share-creator
  StatefulSet - user-placeholder
Summary - Passed:0   Excluded:0   Failed:6   Total:6
Remediation: Define applicable labels or use the exception mechanism to prevent further notifications.

[control: Kubernetes CronJob - https://hub.armo.cloud/docs/c-0026] skipped 😕
Description: Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a POD in the cluster. This control lists all the CronJobs that exist in the cluster for the user to approve.
[control: Label usage for resources - https://hub.armo.cloud/docs/c-0076] failed 😥
Description: It is recommended to set labels that identify semantic attributes of your application or deployment. For example, { app: myapp, tier: frontend, phase: test, deployment: v3 }. These labels can used to assign policies to logical groups of the deployments as well as for presentation and tracking purposes. This control helps you find deployments without any of the expected labels.
Failed:
  Deployment - docs-service
  Deployment - hub
  Deployment - proxy
  Deployment - user-scheduler
  Job - nfs-share-creator
  StatefulSet - user-placeholder
Summary - Passed:0   Excluded:0   Failed:6   Total:6
Remediation: Define labels that are most suitable to your needs of use the exceptions to prevent further notifications.

[control: Linux hardening - https://hub.armo.cloud/docs/c-0055] failed 😥
Description: Containers may be given more privileges than they actually need. This can increase the potential impact of a container compromise.
Failed:
  Deployment - docs-service
  Deployment - hub
  Deployment - proxy
  Deployment - user-scheduler
  Job - nfs-share-creator
  StatefulSet - user-placeholder
Summary - Passed:0   Excluded:0   Failed:6   Total:6
Remediation: You can use AppArmor, Seccomp, SELinux and Linux Capabilities mechanisms to restrict containers abilities to utilize unwanted privileges.

[control: List Kubernetes secrets - https://hub.armo.cloud/docs/c-0015] failed 😥
Description: Attackers who have permissions to access secrets can access sensitive information that might include credentials to various services. This control determines which user, group or service account can list/get secrets.
Failed:
  Role - hub
  RoleBinding - hub
Summary - Passed:2   Excluded:0   Failed:3   Total:5
Remediation: Monitor and approve list of users, groups and service accounts that can access secrets. Use exception mechanism to prevent repetitive the notifications.

[control: Malicious admission controller (mutating) - https://hub.armo.cloud/docs/c-0039] skipped 😕
Description: Attackers may use mutating webhooks to intercept and modify all the resources in the cluster. This control lists all mutating webhook configurations that must be verified.
[control: Malicious admission controller (validating) - https://hub.armo.cloud/docs/c-0036] skipped 😕
Description: Attackers can use validating webhooks to intercept and discover all the resources in the cluster. This control lists all the validating webhook configurations that must be verified.
[control: Mount service principal - https://hub.armo.cloud/docs/c-0020] passed 👍
Description: When a cluster is deployed in the cloud, in some cases attackers can leverage their access to a container in the cluster to gain cloud credentials. This control determines if any workload contains a hostPath volume.
Summary - Passed:6   Excluded:0   Failed:0   Total:6

[control: Naked PODs - https://hub.armo.cloud/docs/c-0073] skipped 😕
Description: It is not recommended to create PODs without parental Deployment, ReplicaSet, StatefulSet etc.Manual creation if PODs may lead to a configuration drifts and other untracked changes in the system. Such PODs won't be automatically rescheduled by Kubernetes in case of a crash or infrastructure failure. This control identifies every POD that does not have corresponding parental object.
[control: Namespace without service accounts - https://hub.armo.cloud/docs/c-0060] passed 👍
Description: It is recommended not to use default service account anywhere in production environment. This control identifies all namespaces without explicit non-default service account.
Summary - Passed:3   Excluded:0   Failed:0   Total:3

[control: Network mapping - https://hub.armo.cloud/docs/c-0049] skipped 😕
Description: If no network policy is defined, attackers who gain access to a single container may use it to probe the network. This control lists all namespaces in which no network policies are defined.
[control: No impersonation - https://hub.armo.cloud/docs/c-0065] passed 👍
Description: Impersonation is an explicit RBAC permission to use other roles rather than the one assigned to a user, group or service account. This is sometimes needed for testing purposes. However, it is highly recommended not to use this capability in the production environments for daily operations. This control identifies all subjects whose roles include impersonate verb.
Summary - Passed:4   Excluded:0   Failed:0   Total:4

[control: Non-root containers - https://hub.armo.cloud/docs/c-0013] failed 😥
Description: Potential attackers may gain access to a container and leverage its existing privileges to conduct an attack. Therefore, it is not recommended to deploy containers with root privileges unless it is absolutely necessary. This control identifies all the Pods running as root or can escalate to root.
Failed:
  Deployment - docs-service
  Job - nfs-share-creator
Summary - Passed:4   Excluded:0   Failed:2   Total:6
Remediation: If your application does not need root privileges, make sure to define the runAsUser or runAsGroup under the PodSecurityContext and use user ID 1000 or higher. Do not turn on allowPrivlegeEscalation bit and make sure runAsNonRoot is true.

[control: PSP enabled - https://hub.armo.cloud/docs/c-0068] skipped 😕
Description: PSP enable fine-grained authorization of pod creation and it is important to enable it
[control: Pods in default namespace - https://hub.armo.cloud/docs/c-0061] failed 😥
Description: It is recommended to avoid running PODs in cluster without explicit namespace assignment. This control identifies all the PODs running in the default namespace.
Failed:
  Deployment - docs-service
  Deployment - hub
  Deployment - proxy
  Deployment - user-scheduler
  Job - nfs-share-creator
  StatefulSet - user-placeholder
Summary - Passed:0   Excluded:0   Failed:6   Total:6
Remediation: Create necessary namespaces and move all the PODs from default namespace there.

[control: Portforwarding privileges - https://hub.armo.cloud/docs/c-0063] passed 👍
Description: Attackers with relevant RBAC permission can use “kubectl portforward” command to establish direct communication with PODs from within the cluster or even remotely. Such communication will most likely bypass existing security measures in the cluster. This control determines which subjects have permissions to use this command.
Summary - Passed:4   Excluded:0   Failed:0   Total:4

[control: Privileged container - https://hub.armo.cloud/docs/c-0057] passed 👍
Description: Potential attackers may gain access to privileged containers and inherit access to the host resources. Therefore, it is not recommended to deploy privileged containers unless it is absolutely necessary. This control identifies all the privileged Pods.
Summary - Passed:6   Excluded:0   Failed:0   Total:6

[control: Resource policies - https://hub.armo.cloud/docs/c-0009] failed 😥
Description: CPU and memory resources should have a limit set for every container or a namespace to prevent resource exhaustion. This control identifies all the Pods without resource limit definitions by checking their yaml definition file as well as their namespace LimitRange objects. It is also recommended to use ResourceQuota object to restrict overall namespace resources, but this is not verified by this control.
Failed:
  Deployment - docs-service
  Deployment - hub
  Deployment - proxy
  Deployment - user-scheduler
  Job - nfs-share-creator
  StatefulSet - user-placeholder
Summary - Passed:0   Excluded:0   Failed:6   Total:6
Remediation: Define LimitRange and Resource Limits in the namespace or in the deployment/POD yamls.

[control: Resources CPU limit and request - https://hub.armo.cloud/docs/c-0050] failed 😥
Description: This control identifies all Pods for which the CPU limit is not set.
Failed:
  Deployment - docs-service
  Deployment - hub
  Deployment - proxy
  Deployment - user-scheduler
  Job - nfs-share-creator
  StatefulSet - user-placeholder
Summary - Passed:0   Excluded:0   Failed:6   Total:6
Remediation: Set the CPU limit or use exception mechanism to avoid unnecessary notifications.

[control: Resources memory limit and request - https://hub.armo.cloud/docs/c-0004] failed 😥
Description: This control identifies all Pods for which the memory limit is not set.
Failed:
  Deployment - docs-service
  Job - nfs-share-creator
Summary - Passed:4   Excluded:0   Failed:2   Total:6
Remediation: Set the memory limit or use exception mechanism to avoid unnecessary notifications.

[control: SSH server running inside container - https://hub.armo.cloud/docs/c-0042] passed 👍
Description: An SSH server that is running inside a container may be used by attackers to get remote access to the container. This control checks if pods have an open SSH port (22/2222).
Summary - Passed:11   Excluded:0   Failed:0   Total:11

[control: Secret/ETCD encryption enabled - https://hub.armo.cloud/docs/c-0066] skipped 😕
Description: All Kubernetes Secrets are stored primarily in etcd therefore it is important to encrypt it.
[control: Sudo in container entrypoint - https://hub.armo.cloud/docs/c-0062] passed 👍
Description: Adding sudo to a container entry point command may escalate process privileges and allow access to forbidden resources. This control checks all the entry point commands in all containers in the POD to find those that have sudo command.
Summary - Passed:6   Excluded:0   Failed:0   Total:6

[control: Writable hostPath mount - https://hub.armo.cloud/docs/c-0045] passed 👍
Description: Mounting host directory to the container can be used by attackers to get access to the underlying host and gain persistence.
Summary - Passed:6   Excluded:0   Failed:0   Total:6

+-----------------------------------------------------------------------+------------------+--------------------+---------------+--------------+
|                             CONTROL NAME                              | FAILED RESOURCES | EXCLUDED RESOURCES | ALL RESOURCES | % RISK-SCORE |
+-----------------------------------------------------------------------+------------------+--------------------+---------------+--------------+
| Access Kubernetes dashboard                                           |        0         |         0          |       2       |      0%      |
| Access container service account                                      |        6         |         0          |      13       |     50%      |
| Access tiller endpoint                                                |        0         |         0          |       0       |   skipped    |
| Allow privilege escalation                                            |        2         |         0          |       6       |     27%      |
| Allowed hostPath                                                      |        0         |         0          |       6       |      0%      |
| Applications credentials in configuration files                       |        1         |         0          |       9       |      9%      |
| Audit logs enabled                                                    |        0         |         0          |       0       |   skipped    |
| Automatic mapping of service account                                  |        0         |         0          |       9       |      0%      |
| CVE-2021-25741 - Using symlink for arbitrary host file system access. |        0         |         0          |       0       |   skipped    |
| CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability         |        0         |         0          |       0       |   skipped    |
| CVE-2022-0185-linux-kernel-container-escape                           |        0         |         0          |       0       |   skipped    |
| CVE-2022-0492-cgroups-container-escape                                |        2         |         0          |       6       |     27%      |
| CVE-2022-24348-argocddirtraversal                                     |        0         |         0          |       0       |   skipped    |
| Cluster internal networking                                           |        0         |         0          |       0       |   skipped    |
| Cluster-admin binding                                                 |        0         |         0          |       4       |      0%      |
| Configured liveness probe                                             |        2         |         0          |       5       |     32%      |
| Configured readiness probe                                            |        2         |         0          |       5       |     32%      |
| Container hostPort                                                    |        0         |         0          |       6       |      0%      |
| Containers mounting Docker socket                                     |        0         |         0          |       6       |      0%      |
| Control plane hardening                                               |        0         |         0          |       0       |   skipped    |
| CoreDNS poisoning                                                     |        0         |         0          |       7       |      0%      |
| Data Destruction                                                      |        5         |         0          |       5       |     100%     |
| Delete Kubernetes events                                              |        0         |         0          |       4       |      0%      |
| Disable anonymous access to Kubelet service                           |        0         |         0          |       0       |   skipped    |
| Enforce Kubelet client TLS authentication                             |        0         |         0          |       0       |   skipped    |
| Exec into container                                                   |        0         |         0          |       4       |      0%      |
| Exposed dashboard                                                     |        0         |         0          |       9       |      0%      |
| Exposed sensitive interfaces                                          |        0         |         0          |      11       |      0%      |
| Forbidden Container Registries                                        |        3         |         0          |       6       |     41%      |
| Host PID/IPC privileges                                               |        0         |         0          |       6       |      0%      |
| HostNetwork access                                                    |        0         |         0          |       6       |      0%      |
| HostPath mount                                                        |        0         |         0          |       6       |      0%      |
| Image pull policy on latest tag                                       |        0         |         0          |       6       |      0%      |
| Images from allowed registry                                          |        4         |         0          |       6       |     55%      |
| Immutable container filesystem                                        |        6         |         0          |       6       |     99%      |
| Ingress and Egress blocked                                            |        4         |         0          |       9       |     50%      |
| Insecure capabilities                                                 |        0         |         0          |       6       |      0%      |
| K8s common labels usage                                               |        6         |         0          |       6       |     100%     |
| Kubernetes CronJob                                                    |        0         |         0          |       0       |   skipped    |
| Label usage for resources                                             |        6         |         0          |       6       |     100%     |
| Linux hardening                                                       |        6         |         0          |       6       |     100%     |
| List Kubernetes secrets                                               |        3         |         0          |       5       |     50%      |
| Malicious admission controller (mutating)                             |        0         |         0          |       0       |   skipped    |
| Malicious admission controller (validating)                           |        0         |         0          |       0       |   skipped    |
| Mount service principal                                               |        0         |         0          |       6       |      0%      |
| Naked PODs                                                            |        0         |         0          |       0       |   skipped    |
| Namespace without service accounts                                    |        0         |         0          |       3       |      0%      |
| Network mapping                                                       |        0         |         0          |       0       |   skipped    |
| No impersonation                                                      |        0         |         0          |       4       |      0%      |
| Non-root containers                                                   |        2         |         0          |       6       |     27%      |
| PSP enabled                                                           |        0         |         0          |       0       |   skipped    |
| Pods in default namespace                                             |        6         |         0          |       6       |     99%      |
| Portforwarding privileges                                             |        0         |         0          |       4       |      0%      |
| Privileged container                                                  |        0         |         0          |       6       |      0%      |
| Resource policies                                                     |        6         |         0          |       6       |     100%     |
| Resources CPU limit and request                                       |        6         |         0          |       6       |     100%     |
| Resources memory limit and request                                    |        2         |         0          |       6       |     27%      |
| SSH server running inside container                                   |        0         |         0          |      11       |      0%      |
| Secret/ETCD encryption enabled                                        |        0         |         0          |       0       |   skipped    |
| Sudo in container entrypoint                                          |        0         |         0          |       6       |      0%      |
| Writable hostPath mount                                               |        0         |         0          |       6       |      0%      |
+-----------------------------------------------------------------------+------------------+--------------------+---------------+--------------+
|                           RESOURCE SUMMARY                            |        12        |         0          |      25       |    23.54%    |
+-----------------------------------------------------------------------+------------------+--------------------+---------------+--------------+
FRAMEWORKS: DevOpsBest (risk: 45.61), MITRE (risk: 13.12), ArmoBest (risk: 21.08), NSA (risk: 18.40)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan results have not been submitted: Kubescape will submit scan results only when scanning a cluster (not YAML files)
Sign up for free: https://portal.armo.cloud/account/login
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This in general seems like a great idea to me, provided that we agree the tests they run are the "right tests" to run, and that the conclusion of those tests is reasonable. I agree with @sgibson91 that it would be compelling to be able to tell communities that we run XYZ standardize security checks on our infrastructure. We just want to make sure this doesn't commit us to super unsustainable security practices that have marginal benefit :-)

run this function in our validation CI/CD (it's probably too verbose to also do it on deploy).

I like the idea, although maybe running it in our validation CI/CD is too much frequency? WDYT about some cron-based maybe weekly/monthly cadence, @sgibson91?

We just want to make sure this doesn't commit us to super unsustainable security practices that have marginal benefit

Very good point, @choldgraf!

WDYT about some cron-based maybe weekly/monthly cadence, @sgibson91?

I think that would be fine, but I think running it in PRs that change our config (i.e., before deployment!) would be better practice. We want to catch security risks before they get into an environment where they could be harmful, right?

We want to catch security risks before they get into an environment where they could be harmful, right?

Yep, then my next question would be: are people going to read the long output for each PR?
And now another one coming to my mind, do we want to expose this information publicly without looking at it first?
Are not we expanding the attack surface area if we do that?

I'd assume you'd form an opinionated set of options to kubescape, fix all the errors it spits out first, and then treat any deviation as a failure.

@yuvipanda yes, you can customise frameworks to achieve that opinionated set of options https://www.youtube.com/watch?v=12Sanq_rEhs


Exception while trying to authenticate with email + password

When trying to provide credentials using username and password, the script fail with a stack trace.
ERROR    : Authentication failed: Incorrect authentication credentials.

Traceback (most recent call last):
  File "/home/ikus060/Downloads/mist_library/org_conf_backup.py", line 324, in <module>
    mist_session = mist_lib.Mist_Session(session_file)
  File "/home/ikus060/Downloads/mist_library/mlib/mist.py", line 96, in __init__
    self._login()
  File "/home/ikus060/Downloads/mist_library/mlib/mist.py", line 234, in _login
    self._set_login_password()
AttributeError: 'Mist_Session' object has no attribute '_set_login_password'

Indeed, _set_login_password is not a declared function ion the code.

Hi Patrik,
I'll check that this week.


Add "Screenshot" directory in RetroArch settings

Currently, 32/64 bit versions of RetroArch have the Directory for Screenshots set as "Content folder".
For me, it does not work when achievements is triggered, had to set it manually to ~ /home/ark/.config/retroarch/screenshots
It would be fine also to have it in /roms/_screenshots

Accommodated with today's update.


is there any way to get the cookie string

I have this code:
(async function () {
      const instance = await phantom.create();
      const page = await instance.createPage();
      const status = await page.open(`${codaDomain}/login`, 'POST', body);
      const content = await page.property('cookies');
      const cookies = await page.cookies();
      const cookieString = await page.evaluate(function() {
        return document.cookie;
      });

      console.log(cookies, cookieString);
      console.log(status, content);
      console.log(page.settings);
      con
      await instance.exit();
    })();

but the cookieString is empty
how can I get the cookie as string?

Have you tried the cookie() method? https://github.com/amir20/phantomjs-node/blob/f9249bb447619d9dba78c4e84329e29f6a42f181/src/tests/page.test.js#L160

yes man, is in my example

But await page.cookies(); its returning an object which describe the cookie
{
  page:'',
  httponly: true,
  name: '....',
  value: '........',
  //....... etc
}

My question is if I can get the cookie string without do the convertion manually:
cookies.map(cookie=>`${cookie.name}=${cookie.value}`).join('; ')

No, I don't think you can do that. page.evaluate wouldn't work either since the cookies are stored outside the of javascript. You would have to http://phantomjs.org/api/phantom/property/cookies.html as your best option and do what you did.


[WIP] #4933 + #5373

Jenkins, test this please.

Jenkins CI test (for commit 5f30f69f924e62d3a1058d219904cc79c640c630, target branch master) failed with status FAILURE.
(For contributors, please wait until the reviewer confirms the details of the error.)

Jenkins tested this with ideep<2...

Jenkins CI test (for commit 90c6fe0722f0801eee9bc4b852a09c0e97347132, target branch master) failed with status FAILURE.
(For contributors, please wait until the reviewer confirms the details of the error.)

Jenkins, test this please.

Jenkins CI test (for commit 90c6fe0722f0801eee9bc4b852a09c0e97347132, target branch master) failed with status FAILURE.
(For contributors, please wait until the reviewer confirms the details of the error.)

Jenkins CI test (for commit 9b29422c2a99ac260b4da5782c11bc1f4fa33c9c, target branch master) failed with status FAILURE.
(For contributors, please wait until the reviewer confirms the details of the error.)


Please invite me to the GitHub Community Organization

Name
Ito Kazuki
Discord Username (if applicable)
Toptal
Additional Context
I want to take part in your organization

Thanks very much!!!

thanks
On Sat, Jan 13, 2024 at 8:59 AM github-actions[bot] <
@.***> wrote:

Closed #974 https://github.com/Design-and-Code/support/issues/974 as
completed.
—
Reply to this email directly, view it on GitHub
https://github.com/Design-and-Code/support/issues/974#event-11477346117,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/BFGTVPRG5UTLLSR4CGB22S3YOJEHXAVCNFSM6AAAAABBZFSHWOVHI2DSMVQWIX3LMV45UABCJFZXG5LFIV3GK3TUJZXXI2LGNFRWC5DJN5XDWMJRGQ3TOMZUGYYTCNY
.
You are receiving this because you authored the thread.Message ID:
@.***>


Support for composite primary keys

Code changes to enable composite primary keys.
It was mentioned here. https://github.com/oysteinkrog/SQLite.Net-PCL/issues/72
I think it would be really good to have this supported. I was only able to run tests under Generic, Win32 and WindowsPhone8, others wouldn't build for some reason, I'll have to investigate.
Let me know what you think!
EDIT: I see AppVeyor build failed for some reason, but I don't think it's because of my code.

Would it be better to keep the current methods for if there is only one column of primary key. Also why have you only changed the delete methods to accept multiple primary keys a and missed out the get methods?

I'll gladly fix if I missed anything, could you point to exact methods?
Delete was the only one with changed signature as there is an overload which allows deleting based on the primary key. But maybe it would be worthwhile to keep the old one too, so if someone is using only single attribute keys they can keep using the old Delete call, without creating a dictionary every time.
Creating the table should behave the same if there's a single attribute key, allowing for autoincrement to be set.
Maybe I also should have left the name "PK" instead of changing it to "PKs" as technically there's always only one primary key (even if it spans over multiple columns).

There are two "Find" methods that you would need to change also a "Get" method all on SQLiteConnection

Good point. I changed those 2 methods, and also Delete method to take object again as parameter to not break any calls with only a single column primary key.

Also TableMapping is at the moment part of the publicAPI, so it may not be a good idea to remove a property like you have, maybe it would be better to provide both properties and have PK throw an exception if there is a composite primary key so that current users of the library can still use the Property if they are not using composite primary keys.

You mean, have both PK and PKs? Hmm.

Yeah that would probably be better than breaking the code of people who are using the library.

Yeah, both options are kind of bad, but breaking change is probably worse. :)
I'll do it that way then.

I pushed the changes we discussed.

This sounds nice, I'll review/merge when I've got the current prerelease/beta out the door.

Any news on this?

I'm sorry but I don't have any time to spend on this project at the moment.

Any word on this?  Just ran into a situation where Composite Keys would be really nice to have :)

It's already done here with latests paracleum updates: https://github.com/softlion/SQLite.Net-PCL
All test passed. + new tests for multiple keys and partial keys (select and delete).
This is my own implementation started 20 months ago and used in multiple commercial apps.
It breaks the Delete(primary key), as it conflicts with the Delete(object) and with Delete(primary keys[]).

Can we get an update?  Would love to have this.
softlion, do you have your nuget for your fork?  I couldn't find it.

Yes i have a private nuget server on internet. PM me your email and i grant you access.

Is this supported now?

Any news with this??
When it's going to be released?

Any news with this?? Is working in Xamarin Ios?


Applied fixes from StyleCI

This pull request applies code style fixes from an analysis carried out by StyleCI.

For more information, click here.

Try again when the tests are passing so I know things don't get broken.


[Refactor] Create new OpenIOUModal action instead of GetLocalCurrency

Details

Needs to be tested together with https://github.com/Expensify/Web-Expensify/pull/34248, it is currently in staging so HOLDing until in production.
In this PR, we are refactoring the GetLocalCurrency API call into a new one: OpenIOUModalPage.
Fixed Issues

$ https://github.com/Expensify/Expensify/issues/213421
Tests

[ ] Verify that no errors appear in the JS console

To test and QA this, you should ideally have some VPN.
You can see the tests in the video below.

Set your location using VPN to Czechia for example
Open some chat report and Request money modal
Make sure that the currency is CZK
Now, change your location to some country using EUR ie Austria
Open the request money modal again, the currency would be CZK still as we have just fetched the new currency on opening the modal (this is same behaviour as currently)
Close and open the modal again and make sure the currency shown is EUR
Make sure that there are no related errors in the console

https://user-images.githubusercontent.com/36083550/179560353-e419d46d-4089-4ba9-aab0-cb5c2a75548f.mov
PR Review Checklist

Contributor (PR Author) Checklist

[x] I linked the correct issue in the ### Fixed Issues section above
[x] I wrote clear testing steps that cover the changes made in this PR

[x] I added steps for local testing in the Tests section
[x] I added steps for Staging and/or Production testing in the QA steps section
[x] I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
[x] I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)

[x] I included screenshots or videos for tests on all platforms
[x] I ran the tests on all platforms & verified they passed on:

[x] iOS / native
[x] Android / native
[x] iOS / Safari
[x] Android / Chrome
[x] MacOS / Chrome
[x] MacOS / Desktop

[x] I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
[x] I followed proper code patterns (see Reviewing the code)

[x] I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick)
[x] I verified that comments were added to code that is not self explanatory
[x] I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
[x] I verified any copy / text shown in the product was added in all src/languages/* files
[x] I verified any copy / text that was added to the app is correct English and approved by marketing by tagging the marketing team on the original GH to get the correct copy.
[x] I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
[x] I verified the JSDocs style guidelines (in STYLE.md) were followed

[x] If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
[x] I followed the guidelines as stated in the Review Guidelines
[x] I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
[x] I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
[x] I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
[x] If a new component is created I verified that:

[x] A similar component doesn't exist in the codebase
[x] All props are defined accurately and each prop has a /** comment above it */
[x] Any functional components have the displayName property
[x] The file is named correctly
[x] The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
[x] The only data being stored in the state is data necessary for rendering and nothing else
[x] For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
[x] Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
[x] All JSX used for rendering exists in the render method
[x] The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions

[x] If a new CSS style is added I verified that:

[x] A similar style doesn't already exist
[x] The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(themeColors.componentBG)

[x] If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
[x] If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
[x] I have checked off every checkbox in the PR author checklist, including those that don't apply to this PR.

PR Reviewer Checklist
The Contributor+ will copy/paste it into a new comment and complete it after the author checklist is completed

[ ] I have verified the author checklist is complete (all boxes are checked off).
[ ] I verified the correct issue is linked in the ### Fixed Issues section above
[ ] I verified testing steps are clear and they cover the changes made in this PR

[ ] I verified the steps for local testing are in the Tests section
[ ] I verified the steps for Staging and/or Production testing are in the QA steps section
[ ] I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
[ ] I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)

[ ] I checked that screenshots or videos are included for tests on all platforms
[ ] I verified tests pass on all platforms & I tested again on:

[ ] iOS / native
[ ] Android / native
[ ] iOS / Safari
[ ] Android / Chrome
[ ] MacOS / Chrome
[ ] MacOS / Desktop

[ ] I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
[ ] I verified proper code patterns were followed (see Reviewing the code)

[ ] I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
[ ] I verified that comments were added to code that is not self explanatory
[ ] I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
[ ] I verified any copy / text shown in the product was added in all src/languages/* files
[ ] I verified any copy / text that was added to the app is correct English and approved by marketing by tagging the marketing team on the original GH to get the correct copy.
[ ] I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
[ ] I verified the JSDocs style guidelines (in STYLE.md) were followed

[ ] If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
[ ] I verified that this PR follows the guidelines as stated in the Review Guidelines
[ ] I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
[ ] I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
[ ] I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
[ ] If a new component is created I verified that:

[ ] A similar component doesn't exist in the codebase
[ ] All props are defined accurately and each prop has a /** comment above it */
[ ] Any functional components have the displayName property
[ ] The file is named correctly
[ ] The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
[ ] The only data being stored in the state is data necessary for rendering and nothing else
[ ] For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
[ ] Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
[ ] All JSX used for rendering exists in the render method
[ ] The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions

[ ] If a new CSS style is added I verified that:

[ ] A similar style doesn't already exist
[ ] The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(themeColors.componentBG)

[ ] If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
[ ] If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
[ ] I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

QA Steps

[ ] Verify that no errors appear in the JS console

See tests section
Screenshots

This change is only related to API hence testing on all the platforms is not necessary.
Refer to the video linked above.
Web

Mobile Web

Desktop

iOS

Android

https://github.com/Expensify/App/pull/9560 is merged!

This is ready for a review @luacmartins Thank you in advance 🙌

Web-E PR is in prod!

Merging then :shipit:

:hand: This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

🚀 Deployed to production by @luacmartins in version: 1.1.85-8 🚀

platform
result

🤖 android 🤖
success ✅

🖥 desktop 🖥
success ✅

🍎 iOS 🍎
success ✅

🕸 web 🕸
success ✅


FileTarget - KeepFileOpen = true by default to avoid loosing file handle

Resolves #2758. See also #4608
Applications will now fail with System.IO.IOException: The process cannot access the file when using File.OpenText or File.ReadAllText to read files created by NLog (Unless having explicitly configured KeepFileOpen="false"). But at the same time it will avoid failing application-logging caused by external application wrongly trying to use exclusive file-locking

Updated wiki: https://github.com/NLog/NLog/wiki/File-target about KeepFileOpen = true by default


Stack Image version update

This PR does the following:

Updated the stack image tag to be the OL version along with an update of the image tag format for Gradle images:

For example:

openliberty/application-stack:<IP_ADDRESS>
openliberty/application-stack:<IP_ADDRESS>-gradle

Allows the liberty version to be updated in the devfile by using a devfile variable.
Allows the customization of the stack/liberty version when building the outer loop image:

docker build -t namespace/application-deployment-outerloop:latest . --build-arg LIBERTY_VERSION=<IP_ADDRESS>

Thanks guys. Tests are all good. Merging.
Resolves #152


markdown/tabbed_sections: Raise exception for missing tab name.

As discovered in #19807, missing tab names are currently silently ignored by our tabbed_sections Markdown extension, this is not right. We should raise an exception somewhere so that missing tab names are caught before they make their way into production. This should hopefully be a quick fix! Ideally, we should do this in a manner such that something in zerver.tests.test_markdown or some other test file fails when a tab name is missing.
Thanks to @alya for reporting this bug!

I would expect test_docs to fail if an exception is thrown when rendering a page, since I believe we render all /help/ pages in those tests.

Hi, I'd like to work on this
@zulipbot claim


Add notes about the transaction era need to match

Updating documentation

Description of the change
I added notes about the transaction era must match. I was following the current documentation to learn the staking pool but since I am on the test-net the alonzo-era was giving an error when trying to submit the transaction build. I change the transaction build to use the --babbage-era and it was successful. So I just wanted to add notes in the documentation to help others as they take the stake pool course.

Quickfix

I am new here so sorry was not sure if I should change the code or not.
I was also thinking that all the material is old so maybe there was a
reason for that command to stay that way.
Should I go change the command?
On Sat, Jul 16, 2022, 7:09 PM Robert Phair @.***> wrote:

@.**** commented on this pull request.
some observations:

although this material is going away in favour of pages in the new
Stake Pool Guide (https://developers.cardano.org/docs/stake-pool-guide/)
I wouldn't have a problem adding a note like this to the old material.
I am assuming the statement in the note is true since transaction
build needs to connect to a live network and therefore it doesn't make
sense to specify the ledger era. We found this out the hard way over the
course of this discussion:
https://forum.cardano.org/t/please-use-cardano-cli-transaction-build-instead-of-cardano-cli-transaction-build-raw/94919/5
@rdlrt https://github.com/rdlrt (or other) - before adding such a
statement, do we have a way of verifying that it's strictly true under all
circumstances?
@jfruiz11375 https://github.com/jfruiz11375 - after adding this
note, why have you not also edited the command which follows to remove the
--alonzo-era option, if it's not necessary?

—
Reply to this email directly, view it on GitHub
https://github.com/cardano-foundation/developer-portal/pull/701#pullrequestreview-1041056589,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AKRKHRVCX2LGMQBPUXEEOJLVUNFMNANCNFSM53YSHKCQ
.
You are receiving this because you were mentioned.Message ID:
@.***
com>

although this material is going away in favour of pages in the new Stake Pool Guide

Personally I wouldn't be too big to update old guide pages, but put corresponding changes to updated page (for which it's easier if initial draft is ready , even if not fully ready quicker).

before adding such a statement, do we have a way of verifying that it's strictly true

It will be true with upcoming node versions (see here ), tho it may be a good idea to switch to build-raw instead - which would allow defining valid transactions in lower era, especially if a feature is not essential.

I've been in touch with the fellows who initiated https://github.com/cardano-foundation/developer-portal/issues/641 so I'll keep an eye out for it when those pages come out: both to use build-raw and to address the question of using a different ledger era (also cross referencing it now).

Great, thanks!
On Sat, Jul 16, 2022, 9:06 PM Robert Phair @.***> wrote:

I've been in touch with the fellows who initiated #641
https://github.com/cardano-foundation/developer-portal/issues/641 so
I'll keep an eye out for it when those pages come out: both to use
build-raw and to address the question of using a different ledger era
(also cross referencing it now).
—
Reply to this email directly, view it on GitHub
https://github.com/cardano-foundation/developer-portal/pull/701#issuecomment-1186373894,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AKRKHRXBM4YAZ7FMERFZRCDVUNTBFANCNFSM53YSHKCQ
.
You are receiving this because you were mentioned.Message ID:
@.***>

@jfruiz11375 are you therefore OK if we close this pull request... knowing it will be noted in the revised material coming out soon?

Yes, go ahead.
On Sat, Jul 16, 2022, 10:00 PM Robert Phair @.***>
wrote:

@jfruiz11375 https://github.com/jfruiz11375 are you therefore OK if we
close this pull request... knowing it will be noted in the revised material
coming out soon?
—
Reply to this email directly, view it on GitHub
https://github.com/cardano-foundation/developer-portal/pull/701#issuecomment-1186382346,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AKRKHRVC3MFJA5EBQ6VG37DVUNZLJANCNFSM53YSHKCQ
.
You are receiving this because you were mentioned.Message ID:
@.***>


transfer to the fernet organization

Seems like this should live under the @fernet organization. :)

The fernet organization doesn't look like it is intended to maintain all implementations of fernet; it merely controls and maintains the specification used to implement it. Thanks :-).


Error: Missing dependencies for SOCKS support.

Environment:

Umbrel with LND 0.14.1-beta commit=v0.14.1-beta
Installed via git-clone + pip3 install requirements, not DOCKER
Python3

cat umbrel/.env
TOR_PROXY_IP=<IP_ADDRESS>
TOR_PROXY_PORT=9050

cat lndlnurl.umbrel.conf
[lnd]
tlscertpath = /home/umbrel/.lnd/tls.cert
macaroonpath = /home/umbrel/.lnd/data/chain/bitcoin/mainnet/admin.macaroon
restserver = <IP_ADDRESS>:8080
rpcserver = <IP_ADDRESS>:10009

[tor]
active = true
socks = <IP_ADDRESS>:9050

Command
python3 main.py LNURL1DP68GURN8GHJ7MRWW3UXYMM59E3K7MF0D3H82UNV9ACXZ7FLW4EK2UNFVS7NXWPKXSURYYAF0CA -c lndlnurl.umbrel.conf
onnected with node HODLmeTight (LND 0.14.1-beta commit=v0.14.1-beta)
--------------------------------------------------------------------------------
Error: Missing dependencies for SOCKS support.

Any way to better identify what dependencies are missing?

That's quite weird, PySocks should work... Tested with Python 3.9 on Debian Buster and Alpine 3.14.
requests should support that since version 2.10, and in the requirements.txt it asks for version 2.26.
If you have an older version you could try requests[socks] but again, if you installed packages from requirements it should work.
What is the exact Python version you are using? I tested with 3.9.1 and 3.9.9. Docker image uses 3.9.9

I'm quite certain my python3 version was the culprit. I've updated last week or so, from 3.10 > 3.7.3 and now it's working fine
Connected with node HODLmeTight (LND 0.14.1-beta commit=v0.14.1-beta)
--------------------------------------------------------------------------------
Metadata: Fund @djurib account on t.me/lntxbot.
Pay Request - Min 100 / Max 1000000 satoshi
How much do you want to pay (in sats):

Thanks for looking into this.


Use pre-compile services from compiler to give feedback in the editor

The editor will eliminate all syntax errors. The next two most likely sources of error are:

Symbol errors - typically using an unrecognised symbol - identifier or Type -  (though see #109), or re-defining an existing symbol
Type mismatch -  returning the wrong type from an expression, attempting to pass the wrong type into a procedure/function

It should be possible to detect these from the symbol table i.e. using a pre-compilation stage.
We need to think about how this information is fed back to the user. In particular, we might want to integrate it with the traffic light system of field validation. But how to give the more specific feedback about the nature of the issue? (Possibly put a short error message (e.g. Type mismatch) where the help goes, with an easy option to show a bit more e.g. expression produces type String, but variable a expects an Int).

Superseded by new approach (editor as compiler)


[BUG] - Cannot "Save as..." with fontimage.bar in Image Viewer

OpenKH Build
Release 393
OpenKH Program
OpenKh.Tools.ImageViewer
Describe the Bug
Selecting "Save as..." with fontimage.bar either creates an IMZ file with IMGDs within instead of a BAR with raw bitmaps, or crashes the program.
To Reproduce
Steps to reproduce the behavior:

Open Image Viewer
Open fontimage.bar
Make changes
Click "Save as..."
Wonder with slight contempt and annoyance why IMZ is the only allowed file type to save as
Save anyway because you're persistent and hope for the best
Crash. Or don't. Regardless, you have a useless file

Expected behavior
Save fontimage.bar properly.
Screenshots
Snip
Additional context
The crash happens <1% of the time with testing and is probably related to this issue regardless.
This entire issue is related to #425.
The program needs support for raw bitmap basically. Pls give.

Extremely related to #425 to be considered a duplicate. Closing.


conservatorium, greegree

This pull request was generated by the 'mq' tool
[test]
flake rate: 0.4
logical conflict every: 100
sleep for: 300s
[pullrequest]
requests per hour: 30
deps=[c,g]

/trunk merge


diffoscope: disable failing test

broken since #130586
  Traceback (most recent call last):
    File "/build/diffoscope-178/diffoscope/comparators/utils/archive.py", line 47, in __del__
      self.close_archive()
    File "/build/diffoscope-178/diffoscope/comparators/pgp.py", line 75, in close_archive
      self._temp_dir.cleanup()
  AttributeError: 'PGPContainer' object has no attribute '_temp_dir'

    warnings.warn(pytest.PytestUnraisableExceptionWarning(msg))

Motivation for this change
Things done

[ ] Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
Built on platform(s)

[ ] NixOS
[ ] macOS
[ ] other Linux distributions

[ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[ ] Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
[ ] Tested execution of all binary files (usually in ./result/bin/)
21.11 Release Notes (or backporting 21.05 Relase notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module

[ ] Fits CONTRIBUTING.md.

Upstream issue https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/270


In specific circumstances TypeUtils.isOverride() can return a false-positive result

TypeUtils.isOverride() can return a false-positive true if a method declaration has these properties:

Method is not an overload of any superclass or interface method
Method is declared on a class which accepts type parameters
Method arguments include at least one type parameter
Method shares its name and number of arguments with a method that is an overload

So if you have an interface or superclass like this:
interface Interface <T, Y> {
        void foo(Y y, T t);
}

Then both "foo" methods on this class will be reported as an override by TypeUtils.isOverride(), when only one actually is:
class Clazz implements Interface<Integer, String> {

    void foo(Integer t, String y) { }

    @Override
    void foo(String y, Integer t) { }
}

The JavaType.Method for either foo() knows that it has type parameters T and Y . But JavaType.Parameterized records only the types of any type parameters, not the names of those type parameters. So there's no way for TypeUtils.isOverride() to know for sure if the type parameter name Y is supposed to correspond to String or to Integer.
To fix this, we have to adjust the parser and our type mapping to include type parameter names on JavaType.Class. Ideally in a backwards-compatible way so old ASTs don't become un-loadable.

I don't see a simple solution and am hoping Sam has an idea that will work. 🙏


DOCS: Fix typo in notebook.ipynb

Fix typo in notebook.ipynb ORIGNAL -> ORIGINAL

Hi @eltociear thank you for catching this! I updated the title and description in your PR, please let me know if you need any clarification


Can't end Raffle

Automatic end does not work, and when attempting manual Raffle, after hitting "Confirm" it shows Loading... and then nothing happens.

Yeah same here - seems really broken right now

Sad to hear guys. Refently I've tested giveaways with myself and everything was working, can you please provide an example? Write me in telegram t.me/y9san9

We did something wrong with environment, should be nice now. Sorry for troubling 😅


User lacking implementation of Data API integration

Currently, SpongeUser doesn't properly implement many of the Data API methods and thus throw exceptions and errors when trying to retrieve simple data from them. It'd be useful if User could construct the DataManipulators appropriately without having to delegate to using the DataProcessor system. @simon816 would probably be interested in this.

Fixed with the merging of #2250.


Update the Docker Version in the docker-role

Bring the Docker Version up to date.
This closes osism/issues#147

Signed-off-by: Ramona Rautenberg<EMAIL_ADDRESS>

This is to be done with per renovate. not manually.


fix of error: Can't resolve 'dns' in 'node_modules/isemail/lib'

With this changes, It will be resolved the issue of "Can't resolve 'dns' in 'node_modules/isemail/lib'"
Fixes #41

@talyssonoc now all tests have passed

I'll close this #PR once we don't have a better context to understand the problem or even a reproducible artefact.


Optimize a Subset of Variables

What is the cleanest way to fix some tensorpack layers' variables during training? Obviously, implementing a new Trainer would be an option...

https://github.com/ppwwyyxx/tensorpack/issues/87#issuecomment-270545291

Thanks! I am trying to port faster-rcnn implementation (https://github.com/endernewton/tf-faster-rcnn) to tensorpack. It seems they have fixed BatchNorm layers during training. Any suggestion for freezing their params?

https://github.com/ppwwyyxx/tensorpack/issues/296

Reading the documents for freezing several layers in FAQ. It seems that in cases we are also doing l2_regularization, just using stop_gradient may not be sufficient to freeze some layers. Is that right?

Method 2 and 3 works for regularization, because regularization is a loss.
Also you can choose what variables to regularize.


[CT-2748] [Bug] Structured Logging (for JSON) is splitting message into multiple lines

Is this a new bug in dbt-core?

[X] I believe this is a new bug in dbt-core
[X] I have searched the existing issues, and I could not find an existing issue for this bug

Current Behavior
I am not 100% sure if this can be considered a bug. I am filing it as a bug, as the end user and a system admin.
It appears that the structured logging (as JSON) feature is splitting error messages coming from the database into separate entries.
Here's an example of one database error being represented by 6 separate JSON events:

Expected Behavior
One database error should be packed into a single JSON event.
Steps To Reproduce

Use dbt-postgres
Set env DBT_LOG_FORMAT=json
Create a model that produces a database error (e.g. select 1/0)
Do a dbt run
Observe the log output

Relevant log output

Environment
- OS: Linux
- Python: 3.11
- dbt: 1.5.2

Which database adapter are you using with dbt?
postgres
Additional Context
N/A

I agree that this is not a desirable behavior. It is an artifact of the initial move to structured logging, which took the approach of converting each log line to its own independent message. We have since abandoned that approach, but it lingers in this issue. We should adopt the behavior @moltar suggests.

Thank you for raising this @moltar! And thanks for the insight @peterallenwebb 🧠
Per @gshank, here is the relevant section of code:
https://github.com/dbt-labs/dbt-core/blob/6a1e3a6db85f90c682ba5cd124ec28770ae9969a/core/dbt/task/printer.py#L120-L129
I'm going to re-categorize this as a feature in the meantime.

Note: This is a fix to improve Cloud's ingestion of the structured logging

Noting that the Experience team has raised concerns about our plan to back-port this, and would like time to work with an RC first. That shouldn't stop us from merging to main, however.


Create automated tests for the shared webjar

The webjar located in https://github.com/TimefoldAI/timefold-solver/tree/main/tools/webui needs to get automated test coverage to become a reliable component others depend on.
TODO: figure out how to introduce layered coverage (unit tests, component tests, if relevant) for the current mix of UI technologies.

The webjar is likely going to be removed instead.


TypeError: argument of type is not iterable

Problem with Python solver interfaces

Turned out that I literally just forgot to include self in the function definition


the git revert example may lead to conflict

in episode 5, "undoing things", the git revert example suggests doing two commits and reverting the former. This leads to a conflict if the same line is edited, e.g. if a new line is added in each of the commits at the end of one of the tracked files.
Not sure if it's best to warn about this (which might be confusing since conflicts haven't been covered yet), or to demonstrate a simpler git revert example

It would be better to have a "bulletproof" example which "cannot" conflict at this stage to not confuse too much.

yeah i agree, will change it

solved in 5ea1c53b99d06b8433200615dd2e3901ad07d43e


Feature request: Maven central

Is there any hope this library will make it to maven central any time soon?  All of our other dependencies are available there.  I'm getting pushback trying to import this library because it requires a lot of churn in our build system.
Thanks!

We decided to go with Bintray/JCenter instead of pushing to Maven Central awhile ago.  I wasn't that directly involved in that decision but unfortunately those who were have all left.  I'm not opposed to revisiting it, but I can't commit to if or when that would happen.
Do you have an approval process that prevents you from pulling it from JCenter?  In SBT it should just be as simple as adding Resolver.jcenterRepo to your resolvers.  But I do know lots of orgs have a requirement to pull everything through a company managed repo.

We're using Bazel, with https://github.com/johnynek/bazel-deps for our maven dependencies.  There's some bug with that project that doesn't handle multiple resolvers.  I'm working on a fix for that, but in the meantime if it's possible for you to just push a button to publish to maven central, that would be much preferable.  I'd be happy to do any work required for this if your team is amenable!


remove superflous pound

just strip # from URIs.

Codecov Report

Merging #28 into master will not change coverage.
The diff coverage is 100%.

@@           Coverage Diff           @@
##           master      #28   +/-   ##
=======================================
  Coverage   52.67%   52.67%
=======================================
  Files           3        3
  Lines         524      524
=======================================
  Hits          276      276
  Misses        248      248

Flag
Coverage Δ

#python
52.39% <100%> (ø)
:arrow_up:

Impacted Files
Coverage Δ

segstats_jsonld/fs_to_nidm.py
49.16% <ø> (ø)
:arrow_up:

segstats_jsonld/tests/test_fs_to_nidm.py
88.37% <100%> (ø)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1486072...1602b32. Read the comment docs.


SpotLight rotation not match on android device

Godot version: 3.1 alpha.calinou.09D0909

OS/device including version: Android Pie 64-bit GPU adreno 625 project setting using GLES3

Issue description:
this is on android :

this is i expexted :

Steps to reproduce:
add spotlight and rotate it, observe the different on desktop and android.

you are right, this is not bug. i switch it off and it worked. but fps going under 10 fps, any solution to make it look good while keep vertex shading on ?

we can close this now

I just avoid using spot, omni lights for mobile.
maybe asking it on community channels could help.


add tests for getDomain and getForkVersion

Wrote tests for getDomain() and getForkVersion()

Please confirm domain will fit in a regular int 👍

Not sure i get what you're saying?

@wemeetagain good catch, doing that in a bit

lgtm, other than linter issue flagged in travis build


Adding tests for core/ast_transforms/processor.py

The 99% coverage was bothering me more than it should, so I opted to add some tests for the processor file.
I plan on hitting some of the TODO's in AstProcessor in the future so will add more comprehensive testing then.

I don't think the failed travis build is my fault, it looks like it stalled on tests/optimize/root_finding/test_newton_raphson_hypo.py. Let me know if I've done something and screwed the build though.

Nice work, thanks!


Promote good accessibility practises in example code

I came across the following code block in the Vue docs, from https://vuejs.org/v2/guide/list.html#v-for-on-a-lt-template-gt:

  <template v-for="item in items">

{{ item.msg }}

  </template>

To help promote good accessibility practises, I think these examples could be updated to include any relevant aria attributes, roles, etc.:

  <template v-for="item in items">

{{ item.msg }}

  </template>

See https://www.w3.org/TR/wai-aria-1.1/#presentation.
Once the accessibility guide (https://github.com/vuejs/vuejs.org/pull/1002) is finished, references to such attributes can link to explanations in the guide.
This is one example, but I'm sure there are others, and I would like to get your thoughts on this :) I could go through the rest of the docs and get a PR put together.

This would be fantastic! Even if you wanted to do it a little at a time, I think we would all be super appreciative.
There is also an older PR in to create an accessibility section. The PR has become a bit cumbersome for the original author given his schedule and he's looking for someone to help pick it up again. That's another way to contribute if it interests you. Thanks!


Validate C++ and ObjC related args for Darwin toolchain

This commit  validates the following arguments to driver:

link-objc-runtime by checkin arc path,
experimentalCxxStdlib flag to limit it to libc++
-static-stdlib to flag that its not supported.

This commit is for SR-13255 https://bugs.swift.org/browse/SR-13255

@owenv

@swift-ci test

@swift-ci test


Fix "ERROR ITMS-90056"

Set current project version to fix “ERROR ITMS-90056”. [resolves #19]

@tkohout, review and merge this plz?

Thanks for the quick fix!


Updated Unit Tests for FileStream

These tests are updated to address pipeline failures when enabling FileStream feature.

Added method TryAdvancedTraceEvent for 7 parameters, it was throwing error for net 461.
IntegratedSecurity = true for connection string for temp database used by unit test to address file access issue
Added separate connection using statement for private methods for finally blocks rather than passing already opened connection to avoid parallel transaction and transaction context missing with command in execution.

These tests are updated to address pipeline failures when enabling FileStream feature.

Just to clarify, these tests weren't failing on the current pipelines, right? Only on the 1es pipelines?

These tests are updated to address pipeline failures when enabling FileStream feature.

Just to clarify, these tests weren't failing on the current pipelines, right? Only on the 1es pipelines?

Yes.

Skip the tests with Azure databases including Azure synapse.

Done.


Fix ERROR: permission denied for sequence (in unrelated schema) #4048

Impact

[X ] Bug fix (non-breaking change which fixes expected existing functionality)
[ ] Enhancement/New feature (adds functionality without impacting existing logic)
[ ] Breaking change (fix or feature that would cause existing functionality to change)

Description
https://github.com/liquibase/liquibase/issues/4048 description and discussion indicate that (at least in postgres) the search for the sequences referring to a specific column should be restricted to the schema the column resides in.
Things to be aware of
Injected the schema name from the column in the function. Renamed a private method that is used only here.
Things to worry about
Please note that this was not tested, as I am not an active java dev, and am only trying to help in advancing a possible solution for the simple issue.

Initial/Pre-Review Thoughts
Thanks for the start to the fix, @joaocc! It points out a good spot to fix, not just for this permission issue but also as a performance improvement in general.
I added a line comment that we should look at applying the extra where clause to the other schemas, but otherwise the fix seems good. If there are problems with the query or how the info gets read, we should catch it with the existing tests
Questions I have:

None

Potential risks:

Test that the case of the schema is correctly handled. I think it's coming from the snapshot so it should be cased as the database expects, but need to double check.

What could make the full review difficult:
(List what could trip us up and burn time during the review process)

Nothing

Hi, @joaocc! Could you please give write permissions to your repo? I was trying to push a code change extension from what you have already done here, and want to share this PR with some members of the team to make sure it works correctly too for MSSQL.

Hi, @joaocc! Could you please give write permissions to your repo? I was trying to push a code change extension from what you have already done here, and want to share this PR with some members of the team to make sure it works correctly too for MSSQL.

Sure. Added @MalloD12 already. Please let me know if anyone else needs access. Thx

Hi, @joaocc! Could you please give write permissions to your repo? I was trying to push a code change extension from what you have already done here, and want to share this PR with some members of the team to make sure it works correctly too for MSSQL.

Sure. Added @MalloD12 already. Please let me know if anyone else needs access. Thx

Thanks @joaocc!

Hey @XDelphiGrl,
As I modified also MSSQL query in the getQueryForDatabaseAndSchema() method. Would you mind testing in this DB as well this issue is not happening there. The steps I was using to reproduce this error were:
1. Create another schema
2. Create a test user
3. Create a table in the new schema created (one of the column should be serial/bigserial type)
4. Gran new user permissions to default schema (I was using `public` in  Postgres) in MSSQL.
  Then executed the changelog with two changesets (without specifying any schema on them) one for creating another simple table and one to perform a simple LoadData

For 5. I was deploying below change sets:
<changeSet id="1" author="mallod">
        <createTable tableName="products">
            <column name="id" type="int" autoIncrement="true" />
            <column name="name" type="varchar(250)" />
            <column name="price" type="number(8,2)" />
        </createTable>
    </changeSet>

    <changeSet id="2" author="mallod">
        <loadData tableName="products" file="changelog/test_data.csv"
                  encoding="UTF-8"
                  quotchar="""
                  relativeToChangelogFile="false"
                  usePreparedStatements="false">
            <column name="id" />
            <column name="name" />
            <column name="price" />
        </loadData>

Please let me know if something is not clear enough and I'll do my best to clarify it.
Thanks,
Daniel.

Thanks.
Not sure if we will be able to test in the next days, but we have a clearer understanding of what seems to happen.
We have a set of migration scripts that deploy several schemas into a single DB, each with access from a separate user.
If we deploy in a specific order, everything is ok.
If we deploy in a different order (s-1 using user-1 and then s-2 using user-2), one of the migrations on s-2 will do a query across all schemas, which will encounter a sequence in s-1, for which user-2 has no permission.
We solved this by giving user-2 permissions on s-1 to modify the sequence.
Of course, ideally this should not be needed, as per the rationale of the issue.
Hope this helps.

Hello @joaocc - hopefully we will be releasing until the end of the month 🤞