text:
Decompilation failed with fatal error "[1:1]: Unable to find a template property named $schema." Bicep

Bicep version
Bicep CLI version 0.4.1008 (223b8d227a)
Describe the bug
I am trying to decompile this .json builtIn policy definition Kubernetes clusters should be accessible only over HTTPS But i get this error when doing it:
Decompilation failed with fatal error "[1:1]: Unable to find a template property named $schema."
To Reproduce
I run az bicep decompile --file kub.json   in The Terminal.
Additional context
{
  "properties": {
    "displayName": "Kubernetes clusters should be accessible only over HTTPS",
    "policyType": "BuiltIn",
    "mode": "Microsoft.Kubernetes.Data",
    "description": "Use of HTTPS ensures authentication and protects data in transit from network layer eavesdropping attacks. This capability is currently generally available for Kubernetes Service (AKS), and in preview for AKS Engine and Azure Arc enabled Kubernetes. For more info, visit https://aka.ms/kubepolicydoc",
    "metadata": {
      "version": "6.0.0",
      "category": "Kubernetes"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "'Audit' allows a non-compliant resource to be created, but flags it as non-compliant. 'Deny' blocks the resource creation. 'Disable' turns off the policy."
        },
        "allowedValues": [
          "audit",
          "deny",
          "disabled"
        ],
        "defaultValue": "audit"
      },
      "excludedNamespaces": {
        "type": "Array",
        "metadata": {
          "displayName": "Namespace exclusions",
          "description": "List of Kubernetes namespaces to exclude from policy evaluation."
        },
        "defaultValue": [
          "kube-system",
          "gatekeeper-system",
          "azure-arc"
        ]
      },
      "namespaces": {
        "type": "Array",
        "metadata": {
          "displayName": "Namespace inclusions",
          "description": "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
        },
        "defaultValue": []
      },
      "labelSelector": {
        "type": "Object",
        "metadata": {
          "displayName": "Kubernetes label selector",
          "description": "Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources."
        },
        "defaultValue": {},
        "schema": {
          "description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all resources.",
          "type": "object",
          "properties": {
            "matchLabels": {
              "description": "matchLabels is a map of {key,value} pairs.",
              "type": "object",
              "additionalProperties": {
                "type": "string"
              },
              "minProperties": 1
            },
            "matchExpressions": {
              "description": "matchExpressions is a list of values, a key, and an operator.",
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "key": {
                    "description": "key is the label key that the selector applies to.",
                    "type": "string"
                  },
                  "operator": {
                    "description": "operator represents a key's relationship to a set of values.",
                    "type": "string",
                    "enum": [
                      "In",
                      "NotIn",
                      "Exists",
                      "DoesNotExist"
                    ]
                  },
                  "values": {
                    "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.",
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  }
                },
                "required": [
                  "key",
                  "operator"
                ],
                "additionalProperties": false
              },
              "minItems": 1
            }
          },
          "additionalProperties": false
        }
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "in": [
          "AKS Engine",
          "Microsoft.Kubernetes/connectedClusters",
          "Microsoft.ContainerService/managedClusters"
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "constraintTemplate": "https://store.policy.core.windows.net/kubernetes/ingress-https-only/v1/template.yaml",
          "constraint": "https://store.policy.core.windows.net/kubernetes/ingress-https-only/v1/constraint.yaml",
          "excludedNamespaces": "[parameters('excludedNamespaces')]",
          "namespaces": "[parameters('namespaces')]",
          "labelSelector": "[parameters('labelSelector')]"
        }
      }
    }
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d"
}

This is not a complete ARM template, it is only the resource object within a larger template. By adding this to a larger template, I can then decompile it. I also have to "escape" the first expression character in the policy expressions, so they are not parsed as ARM template expressions. This gives me something like the below.
modified template:
{
  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.4.967.27204",
      "templateHash": "1441011619457232103"
    }
  },
  "functions": [],
  "resources": [
    {
      "type": "Microsoft.Authorization/policyDefinitions",
      "apiVersion": "2021-06-01",
      // don't need this -- "id": "/providers/Microsoft.Authorization/policyDefinitions/1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d",
      "name": "policy",
      "properties": {
        "displayName": "Kubernetes clusters should be accessible only over HTTPS",
        "policyType": "BuiltIn",
        "mode": "Microsoft.Kubernetes.Data",
        "description": "Use of HTTPS ensures authentication and protects data in transit from network layer eavesdropping attacks. This capability is currently generally available for Kubernetes Service (AKS), and in preview for AKS Engine and Azure Arc enabled Kubernetes. For more info, visit https://aka.ms/kubepolicydoc",
        "metadata": {
          "version": "6.0.0",
          "category": "Kubernetes"
        },
        "parameters": {
          "effect": {
            "type": "String",
            "metadata": {
              "displayName": "Effect",
              "description": "'Audit' allows a non-compliant resource to be created, but flags it as non-compliant. 'Deny' blocks the resource creation. 'Disable' turns off the policy."
            },
            "allowedValues": [
              "audit",
              "deny",
              "disabled"
            ],
            "defaultValue": "audit"
          },
          "excludedNamespaces": {
            "type": "Array",
            "metadata": {
              "displayName": "Namespace exclusions",
              "description": "List of Kubernetes namespaces to exclude from policy evaluation."
            },
            "defaultValue": [
              "kube-system",
              "gatekeeper-system",
              "azure-arc"
            ]
          },
          "namespaces": {
            "type": "Array",
            "metadata": {
              "displayName": "Namespace inclusions",
              "description": "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
            },
            "defaultValue": []
          },
          "labelSelector": {
            "type": "Object",
            "metadata": {
              "displayName": "Kubernetes label selector",
              "description": "Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources."
            },
            "defaultValue": {},
            "schema": {
              "description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all resources.",
              "type": "object",
              "properties": {
                "matchLabels": {
                  "description": "matchLabels is a map of {key,value} pairs.",
                  "type": "object",
                  "additionalProperties": {
                    "type": "string"
                  },
                  "minProperties": 1
                },
                "matchExpressions": {
                  "description": "matchExpressions is a list of values, a key, and an operator.",
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "key": {
                        "description": "key is the label key that the selector applies to.",
                        "type": "string"
                      },
                      "operator": {
                        "description": "operator represents a key's relationship to a set of values.",
                        "type": "string",
                        "enum": [
                          "In",
                          "NotIn",
                          "Exists",
                          "DoesNotExist"
                        ]
                      },
                      "values": {
                        "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.",
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      }
                    },
                    "required": [
                      "key",
                      "operator"
                    ],
                    "additionalProperties": false
                  },
                  "minItems": 1
                }
              },
              "additionalProperties": false
            }
          }
        },
        "policyRule": {
          "if": {
            "field": "type",
            "in": [
              "AKS Engine",
              "Microsoft.Kubernetes/connectedClusters",
              "Microsoft.ContainerService/managedClusters"
            ]
          },
          "then": {
            "effect": "[[parameters('effect')]",
            "details": {
              "constraintTemplate": "https://store.policy.core.windows.net/kubernetes/ingress-https-only/v1/template.yaml",
              "constraint": "https://store.policy.core.windows.net/kubernetes/ingress-https-only/v1/constraint.yaml",
              "excludedNamespaces": "[[parameters('excludedNamespaces')]",
              "namespaces": "[[parameters('namespaces')]",
              "labelSelector": "[[parameters('labelSelector')]"
            }
          }
        }
      }
    }
  ]
}

which decompiles to:
targetScope = 'subscription'
resource policy 'Microsoft.Authorization/policyDefinitions@2021-06-01' = {
  name: 'policy'
  properties: {
    displayName: 'Kubernetes clusters should be accessible only over HTTPS'
    policyType: 'BuiltIn'
    mode: 'Microsoft.Kubernetes.Data'
    description: 'Use of HTTPS ensures authentication and protects data in transit from network layer eavesdropping attacks. This capability is currently generally available for Kubernetes Service (AKS), and in preview for AKS Engine and Azure Arc enabled Kubernetes. For more info, visit https://aka.ms/kubepolicydoc'
    metadata: {
      version: '6.0.0'
      category: 'Kubernetes'
    }
    parameters: {
      effect: {
        type: 'String'
        metadata: {
          displayName: 'Effect'
          description: '\'Audit\' allows a non-compliant resource to be created, but flags it as non-compliant. \'Deny\' blocks the resource creation. \'Disable\' turns off the policy.'
        }
        allowedValues: [
          'audit'
          'deny'
          'disabled'
        ]
        defaultValue: 'audit'
      }
      excludedNamespaces: {
        type: 'Array'
        metadata: {
          displayName: 'Namespace exclusions'
          description: 'List of Kubernetes namespaces to exclude from policy evaluation.'
        }
        defaultValue: [
          'kube-system'
          'gatekeeper-system'
          'azure-arc'
        ]
      }
      namespaces: {
        type: 'Array'
        metadata: {
          displayName: 'Namespace inclusions'
          description: 'List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces.'
        }
        defaultValue: []
      }
      labelSelector: {
        type: 'Object'
        metadata: {
          displayName: 'Kubernetes label selector'
          description: 'Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources.'
        }
        defaultValue: {}
        schema: {
          description: 'A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all resources.'
          type: 'object'
          properties: {
            matchLabels: {
              description: 'matchLabels is a map of {key,value} pairs.'
              type: 'object'
              additionalProperties: {
                type: 'string'
              }
              minProperties: 1
            }
            matchExpressions: {
              description: 'matchExpressions is a list of values, a key, and an operator.'
              type: 'array'
              items: {
                type: 'object'
                properties: {
                  key: {
                    description: 'key is the label key that the selector applies to.'
                    type: 'string'
                  }
                  operator: {
                    description: 'operator represents a key\'s relationship to a set of values.'
                    type: 'string'
                    enum: [
                      'In'
                      'NotIn'
                      'Exists'
                      'DoesNotExist'
                    ]
                  }
                  values: {
                    description: 'values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.'
                    type: 'array'
                    items: {
                      type: 'string'
                    }
                  }
                }
                required: [
                  'key'
                  'operator'
                ]
                additionalProperties: false
              }
              minItems: 1
            }
          }
          additionalProperties: false
        }
      }
    }
    policyRule: {
      if: {
        field: 'type'
        in: [
          'AKS Engine'
          'Microsoft.Kubernetes/connectedClusters'
          'Microsoft.ContainerService/managedClusters'
        ]
      }
      then: {
        effect: '[parameters(\'effect\')]'
        details: {
          constraintTemplate: 'https://store.policy.core.windows.net/kubernetes/ingress-https-only/v1/template.yaml'
          constraint: 'https://store.policy.core.windows.net/kubernetes/ingress-https-only/v1/constraint.yaml'
          excludedNamespaces: '[parameters(\'excludedNamespaces\')]'
          namespaces: '[parameters(\'namespaces\')]'
          labelSelector: '[parameters(\'labelSelector\')]'
        }
      }
    }
  }
}

For future googlers,  in Azure portal UI,  select Export Template down the left-hand panel menu (instead of JSON view).

For future googlers, in Azure portal UI, select Export Template down the left-hand panel menu (instead of JSON view).
someone give @kucerarichard a prize!

authors: alex-frankel kucerarichard muddihejjo rmjoia

repo: Azure/bicep


text:
BICEP BCP079: This expression is referencing its own declaration, which is not allowed.

Bicep version
Bicep CLI version 0.4.1008 (223b8d227a)
Describe the bug
When decompiling an ARM template, I see a number of warnings in output.
BICEP BCP079: This expression is referencing its own declaration, which is not allowed.
This warning is confusing and not sure how to act on it other than deleting the description.
I would expect that Bicep understands the @description metadata tag or has some way of creating a custom attribute for this.
To Reproduce
Each line has a description.
    "parameters": {
        "workspaceName": {
            "type": "string",
            "metadata": {
                "description": "Specifies the name of the Azure Machine Learning service workspace."
            }
        },

@description('Specifies the name of the Azure Machine Learning service workspace.')
param workspaceName string

Additional context
#1665 may relate.

I don't believe the code you are sharing is the source of the error. Can you share the full ARM template?

Can't share the full template.  I'll try and create a minimal template.   Will close this one until I can create a minimal repro.

The issue was just that "description" was used as a parameter name.  Once it is identified as a parameter name, it conflicts with the built-in description attribute.
The  error message wasn't so clear initially since it affected every @description('mydesc') line.  I would suggest that a list of reserved words or mention that description is a reserved word and cannot be used as a parameter could be shown or provide support for both a description parameter and description attribute.
I would think name and description should be allowed parameter names and there should be no constraints as to what a parameter is called?

There is only one global namespace, so identifiers can only be declared once. I agree the error message could be clearer. You can disambiguate by using the sys namespace like so:
param description string

@sys.description('foo')
param foo string

We also show you this in completions where it is relevant. Notice we don't show description in the list since it is not valid because of the description param:

I'm also have the same issue when I decompile the below ARM template....
{   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",   "contentVersion": "1.0.0.0",   "parameters": {     "azureFirewalls_afw_we_adev_play_name": {       "defaultValue": "afw-we-adev-play",       "type": "String"     },     "publicIPAddresses_pip_we_adev_afw_externalid": {       "defaultValue": "/subscriptions/bb33c192-ceb7/resourceGroups/rg-manju-play/providers/Microsoft.Network/publicIPAddresses/pip-we-adev-afw",       "type": "String"     },     "virtualNetworks_vneweadev1play_externalid": {       "defaultValue": "/subscriptions/bb33c192-ceb7/resourceGroups/rg-manju-play/providers/Microsoft.Network/virtualNetworks/vneweadev1play",       "type": "String"     }   },   "resources": [     {       "apiVersion": "2022-05-01",       "location": "westeurope",       "name": "[parameters('azureFirewalls_afw_we_adev_play_name')]",       "properties": {         "additionalProperties": {},         "applicationRuleCollections": [],         "ipConfigurations": [           {             "id": "[concat(resourceId('Microsoft.Network/azureFirewalls', parameters('azureFirewalls_afw_we_adev_play_name')), '/azureFirewallIpConfigurations/pip-we-adev-afw')]",             "name": "pip-we-adev-afw",             "properties": {               "publicIPAddress": {                 "id": "[parameters('publicIPAddresses_pip_we_adev_afw_externalid')]"               },               "subnet": {                 "id": "[concat(parameters('virtualNetworks_vneweadev1play_externalid'), '/subnets/AzureFirewallSubnet')]"               }             }           }         ],         "natRuleCollections": [],         "networkRuleCollections": [],         "sku": {           "name": "AZFW_VNet",           "tier": "Standard"         },         "threatIntelMode": "Alert"       },       "type": "Microsoft.Network/azureFirewalls"     }   ],   "variables": {} }

source: gharchive/issue

authors: alex-frankel asears mav108

license: MIT

license_type: permissive

license_source: github-api


text:
Complex parameter handling

Is your feature request related to a problem? Please describe.
Parameters currently are either a simple type like Boolean, String or Integer or an arbitrary Object type. The object types are often needed for more complex or nested parameters, but cannot be type/content checked internally.
Decorators like @description and @allowed are only available on the root object, not on the keys and @allowed can't validate for keys afaik:
@allowed([
  { test: 123 }
])
@description('Optional. Nested parameters')
param testParam object = { abc: 234 } // Still valid

There is also no intellisense for nested object parameters, which is a real downgrade for the end user when comparing modules vs resources in bicep.
Resources natively provide intellisense and type checking for multiple layers of nested parameters, which we should enable for modules/parameters as well.
Here is an example for a type, where it would make sense to implement the sku options with a sku parameter. Unfortunately, the specifics and limitations for the subfields are so complex that you don't want to provide the user just with a sku object, but with some guidance and type checking. The only way to do it currently is to create a parameter for each subfield and provide the respective @allowed and @description decorators.
@allowed([
  'Basic'
  'GeneralPurpose'
  'MemoryOptimized'
])
@description('Optional. The tier of the particular SKU, e.g. Basic.')
param skuTier string = 'GeneralPurpose'

@allowed([
  2
  4
  8
  16
  32
  64
])
@description('Optional. The scale up/out capacity, representing server\'s compute units.')
param capacity int = 4

@allowed([
  'Gen5'
])
@description('Optional. The family of hardware.')
param skuFamily string = 'Gen5'

@description('Optional. The size code, to be interpreted by resource as appropriate.')
param skuSize string

// Create a sku object from the parameters:

var skuName = '${skuTier == 'Basic' ? 'B' : skuTier == 'GeneralPurpose' ? 'GP' : 'MO'}_${skuFamily}_${capacity}'
var sku: {
    capacity: capacity
    family: skuFamily
    name: skuName
    size: skuSize
    tier: skuTier
  }

resource server 'Microsoft.DBforPostgreSQL/servers@2017-12-01' = {
  name: name
  location: location
  tags: tags
  sku: sku
...

Describe the solution you'd like
I can see multiple ways to do this.

Use the same way as the resource, probably a JSON or Bicep schema file, although even for resources the description or types are often different between ARM/Bicep intellisense and the MS Docs.
Provide some way to nest parameters with decorators for objects. Here with a new key parameter type:

@allowed([
  @allowed([
    2
    4
    8
    16
    32
    64
  ])
  @description('Optional. The scale up/out capacity, representing server\'s compute units.')
  key capacity int = 4

  @allowed([
    'Gen5'
  ])
  @description('Optional. The family of hardware.')
  key skuFamily string = 'Gen5'
])
@description('Optional. The SKU (pricing tier) of the server.')
param sku object = {}

Provide the ability to construct complex parameter objects instead of directly nesting them:

@allowed([
  2
  4
  8
  16
  32
  64
])
@description('Optional. The scale up/out capacity, representing server\'s compute units.')
key/subparam capacity int = 4

@allowed([
  'Gen5'
])
@description('Optional. The family of hardware.')
key/subparam skuFamily string = 'Gen5'

@allowed([
  capacity
  skuFamily
])
@description('Optional. The SKU (pricing tier) of the server.')
param sku object = {}

These are just some options that came to my mind. You probably thought about this already and I would love to hear your ideas on how to handle these.
My motivation comes mainly from building a lot of custom and CARML modules over the last months and the missing validation for nested parameters was one of the main causes for validation issues and unhandled errors.

Closing as dup of #4158. Definitely strong interest in getting this done before v1.0. cc @jeskew as FYI

Closing as dup of #4158. Definitely strong interest in getting this done before v1.0. cc @jeskew as FYI

Thanks for closing the dup, I searched for something similar but didn't find this one issue :)

authors: alex-frankel itpropro


text:
Feature Request: Support a global Bicep config file (under ~/.bicep/bicepconfig.json)

Is your feature request related to a problem? Please describe.
Whenever I use the Bicep VSCode / VS extension on a scratch file (or a temporary file) I would like to configure a default behavior for the VSCode extension language server. As of now I am forced to create a bicepconfig.json in the directory where my scratch file is found so that the language server recognizes the features of the language I am using.
For example, notice the file  below, (found in ~/tmp/foo.bicep)

The linter complains that it doesn't know about imports. I want to be able to specify ~/.bicep/bicepconfig.json as follows
{
    "experimentalFeaturesEnabled": {
        "imports": true,
        "extensibility": true
    }
}

And have the language server pick this up in the absence of a bicepconfig.json inside ~/tmp.
== NOTE: If a bicepconfig.json is specified in the folder structure it should take precedece ==
For example: if the file below was specified under ~/tmp/ then I would expect the behavior of the language server to be the same as shown above (with the red squigglys)
~/tmp/bicepconfig.json
{
    "experimentalFeaturesEnabled": {
        "imports": false,
        "extensibility": false
    }
}

Additional Info
In the case of an unsaved file, the error message doesn't guide the user about what to do. It only says that EXPERIMENTAL is needed but doesn't describe how to enable it.

Hey folks, I feel like my memory is already deceiving me and I may forgot what the conclusion was with relation to the topic of the bicepconfig.json. I will try to summarize my notes and please feel free to reply with anything I missed or misunderstood.
So the initial proposal was motivated by the need for a defined behavior in the case of a user authoring an unsaved file.
Alan ('A' user :)) has heard about Bicep and he is interested in exploring a new Bicep experimental feature called 'kubernetes extensibility'. Alan reads about this feature in some blog.
Alan installs the Bicep extension for VSCode and creates a new unsaved (scratch) file to go along with the content written in the blog. The blog says that he needs to setup his bicepconfig.json however Alan skips reading this because he is an eager user and moves on.
He proceeds to paste the following content into his scratch file:
@secure()
param kubeConfig string

import 'kubernetes@1.0.0' with {
  namespace: 'default'
  kubeConfig: kubeConfig
}

resource aks 'Microsoft.ContainerService/managedClusters@2022-05-02-preview' existing = {
  name: 'demoAKSCluster'
}

module kubernetes './kubernetes.bicep' = {
  name: 'buildbicep-deploy'
  params: {
    kubeConfig: aks.listClusterAdminCredential().kubeconfigs[0].value
  }
}

Alan notices the IDE is complaining about the code he just pasted (see image below).

-- Silly Alan --, he forgot to setup the bicepconfig.json so he goes to the link in the blog that tells him how to set these up, (the hyperlink in the picture below -> bicepconfig.json)

Now Alan follows the instructions to create his bicepconfig.json, he uses Ctrl+P to use the extension contextual action to create one

The IDE prompts him with a question: "Where would you like to save the Bicep configuration file?" ... Alan is faced with a question he can't really answer because the current behavior is not documented.

The current behavior per our investigation is that the extension will look (in the windows case) in the C:\ directory for a bicepconfig.json however Alan does not know this. Instead, he decides to use the default location provided by the extension: the $HOME folder (C:\users\alan) and proceeds with the documented guidance.
However, he notices that he is still in a weird state, his IDE hasn't picked up on his newly created bicepconfig.json (see image below)

It turns out that Alan had a trailing comma in the bicepconfig.json and that was causing all the problems... so he removes the trailing comma

However, because the file is unsaved, the changes aren't picked  up by the IDE...

Alan now tired from this experience, tries to cut and paste the contents of his scratch file to refresh the state of the extension:
Yay! finally Alan is able to follow the tutorial ->

Except... seems like the tutorial is missing an alias for the kubernetes provider and is causing a naming collision between the provider and the resource (both named kubernetes) so he renames the resource kubernetes -> k8s and now hes done.

Meeting minutes from bicep discussion held 03/08/23
Notable comments

@majastrz - As a design principle we want to maintain consistency in the behavior of the bicep cli and the bicep extensions.
@StephenWeatherford - The current behavior will traverse the directory structure starting with the location of the saved file and inspecting each parent directory for a bicepconfig.json file. If it finds one it will use its settings, if it cannot find one or it doesn't have permissions to list the contents of the parent directory it will stop traversing and will use a default set of configurations.
@asilverman - The default set is not documented in https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/bicep-config and we should create an issue to address this.
Using a ~/.bicep/bicepconfig.json file as a default configuration may cause 'doesn't work on my machine' phenomena, this can be mitigated if users adhere to having a bicepconfig.json specified in their bicep project folder structure when sharing.
When the file is not saved, the language server is inspecting %USERPROFILE% or $HOME (depending on the OS) for a bicepconfig.json but this results in multiple locations for Bicep configuration settings since ~/.bicep is used to store registry configuration. We should consider unifying all Bicep configuration settings under the same location (potentially $HOME/.bicep is a good candidate)
We want the bicep lint rule to be more informative and specify not only that the feature is experimental but also link to some place where it explains how to enable the experimental feature. This is currently missing.
We also want the extension output to allow for a verbose output that describes in more detail what actions the extension is taking, what are the directories its inspecting and using as execution current directory and any other relevant verbose output to assist in troubleshooting its behavior. This would also be useful for the CLI executable. Consider adding a VSCODE/VS setting to enable verbose output and a flag in the CLI to enable verbose.

Issues to resolve

[ ] Document what are the default values being used when no bicepconfig.json is found.
[ ] Consider unifying all Bicep configuration under ~/.bicep
[ ] Improve language server error for experimental features to include a link to guidance about how to enable the experimental features
[ ] Enable verbose output in VSCode/VS extensions and --verbose flag in Bicep CLI

@asilverman
Some thoughts:

Document what are the default values being used when no bicepconfig.json is found.
I hesitate on this because it's misleading if the docs get out of date.  I'm thinking it would be sufficient if we simply had a way to display the current effective values, which is useful on its own.  I know we discussed this in an issue recently but can't find it.  Feel free to open a new one.

Consider unifying all Bicep configuration under ~/.bicep
I personally feel this is more complexity than it's worth right now.

Improve language server error for experimental features to include a link to guidance about how to enable the experimental features
Makes sense. Would probably need to be added to each help message manually.  Needs new issue.

Enable verbose output in VSCode/VS extensions and --verbose flag in Bicep CLI
I guess my suggestion above is subsumed by this.

The extension settings (settings.json) are lacking documentation, this makes it hard for people to discover they exist and also what are they used for. Consider adding documentation in the extension homepage/overview in the marketplace to describe the functionality
Don't have a strong opinion, but it's more docs to keep up to date. Do people really have trouble finding them?

Probably makes sense to open separate bugs for the open issues and consider closing this one.

Created some issues as a result of this conversation and will handle those on a case by case basis

authors: StephenWeatherford asilverman


text:
('Cannot connect to proxy.', NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f8e632dfdd8>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution',))

Having issues logging into Azure via the Azure CLI on a linux machine. No issues from my Windows Machine on the same network.
I am behind a Corp Proxy and same Env settings work for windows machine but not Linux.
****Error ****
('Cannot connect to proxy.', NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f8e632dfdd8
When I use: az login --use-device-code I get the device code back from the terminal but once I enter it into the web page I get the error above
When I login by Service Principal I get the error straight away.
Steps Taken Already

We have set the http_proxy and https_proxy environment variables as shown in the Working behind a proxy section of the Azure CLI documentation:  Use Azure CLI effectively | Microsoft Docs.

Proxy Settings:
http_proxy=http://HKG\username:@ourproxy:8080>
https_proxy=https://HKG\username:@ourproxy:8080>
no_proxy=.microsoftonline.com,.microsoft.com,.windows.net,.azmk8s.io,.azurecr.io

I also appended our MHSA CA and Proxy Cert to the cacert file used by the Azure CLI as instructed in the docs if we encounter any issues with connectivity.

/usr/lib/python3.6/site-packages/pip/_vendor/certifi/cacert.pem
/usr/lib/python3.6/site-packages/pip/_vendor/requests/cacert.pem
/usr/lib64/az/lib/python3.6/site-packages/certifi/cacert.pem
/usr/lib64/az/lib/python3.6/site-packages/pip/_vendor/certifi/cacert.pem
/usr/lib64/az/lib/python3.6/site-packages/websocket/cacert.pem
/usr/local/lib/python3.6/site-packages/certifi/cacert.pem
/usr/local/lib/python3.6/site-packages/websocket/cacert.pem

Confirmed curl to webpages is okay and also confirmed no issue with nslookups to proxy server or internet destinations

System Versions
az version:
{
"azure-cli": "2.23.0",
"azure-cli-core": "2.23.0",
"azure-cli-telemetry": "1.0.6",
"extensions": {}
}
OS Version:  Red Hat Enterprise Linux Server release 7.9 (Maipo)
Suspected Root Cause
It appears that the Python under the hood of Azure CLI is not picking up the proxy env variables when it needs to. The no_proxy variables do not seem to have an issue as when they included added I am able to launch the device login page. Without these settings I am not able to launch the device login instead I get slightly different error:
Please ensure you have network connection. Error detail: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /common/oauth2/devicecode?api-version=1.0 (Caused by ProxyError('Cannot connect to proxy.', NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f452ae3ff60>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution',)))
But the no_proxy settings are standard for my environment as this is what I use on my windows machine and I connect via device login or service principal without issue.
Azure CLI Install Method
https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-linux?pivots=dnf
Followed the instructions to build from source as I do not have the dnf package manager i.e.:
curl -sL https://azurecliprod.blob.core.windows.net/rhel7_6_install.sh | sudo bash

Hey @neil-n-brown  can you confirm if the DNS being used is correctly configured ?

Hi @t-dedah sorry for the reply time. DNS configured correctly. Bit of a strange one. I was able to get it working my adding the proxy variables in both lower case and upper case.
Proxy Settings:
http_proxy=http://HKG\username:@ourproxy:8080>
https_proxy=https://HKG\username:@ourproxy:8080>
no_proxy=.microsoftonline.com,.microsoft.com,.windows.net,.azmk8s.io,.azurecr.io
HTTP_PROXY=http://HKG\username:@ourproxy:8080>
HTTPS_PROXY=https://HKG\username:@ourproxy:8080>
NO_PROXY=.microsoftonline.com,.microsoft.com,.windows.net,.azmk8s.io,.azurecr.io

issue resolved by adding upper and lower case proxy settings.

authors: neil-n-brown t-dedah

repo: Azure/cli


text:
Updated Readme for Azure CLI actions

Updated Readme for Azure CLI actions

Thanks for the contribution @zainuvk

Thanks for the contribution @zainuvk

source: gharchive/pull-request


text:
[Storybook Update] Add simplified Try ChatComposite story to use fakeAdapter

What

Add 'Try Chat Composite' story that uses fakeAdapter instead of needing token from AzureCommunication Token
Updated bot messages to make more sense for the example context
Make Show ParticipantsPane working for Basic Example
Minor typo fix for aria label for Participant Pane

Why

Currently it's a bit complex for Contoso to get started requiring tokens to see the ChatComposite in action, changing basic example to use FakeAdapter to remove this friction
https://skype.visualstudio.com/SPOOL/_workitems/edit/2626713
How Tested

Tested on Mac Chrome and Safari
Process & policy checklist

[ ] I have updated the project documentation to reflect my changes if necessary.
[ ] I have read the CONTRIBUTING documentation.

Is this a breaking change?

[ ] This change causes current functionality to break.

This is a fairly old topic, I like that we use fake adapter to make playground easier to try out, but this playground is also a good place to allow user to take their first step to see how everything works together, otherwise it would be hard to demonstrate relationship between tokens to an active session
And also lots of people use this as a validation app to connect back to their own app, removing this option would force developers to implement a whole app to try the real ACS services.
So the idea here is to keep both option - if someone wants to have a quick try, they could use fake adapter, but we will still allow them to connect to our service directly
BTW, if I remember it correct, this work items was targeting on removing the need of connection string, we've resolved it by asking for a token, so we are almost good on this one already - but I think it would be nice we can add fake adapter as an addition to the playground

Sorry wasn't aware of the history for this ticket, updated the PR to be a separate page

Just tried it out and this is awesome!
I wonder, instead of its own story, how do folks feel about this being in the primary doc instead of the static image?

We could prepopulate it with some fun messages and avatar images like in the static screenshot

Just tried it out and this is awesome!
I wonder, instead of its own story, how do folks feel about this being in the primary doc instead of the static image?
We could prepopulate it with some fun messages and avatar images like in the static screenshot

I like that Idea! And maybe the message could include some aka.ms links and message with image screenshot to walk developer through how to do certain things, but I think that can be a new feature task to revamp existing storybook pages (maybe working with PM for that)

Just tried it out and this is awesome!
I wonder, instead of its own story, how do folks feel about this being in the primary doc instead of the static image?
We could prepopulate it with some fun messages and avatar images like in the static screenshot

this is a GREAT idea!!

LGTM! Can you get a sign off from PM on this PR as it changes the doc? I'd like their opinion whether this new page differs enough from basic sample to be clear to users

@ddematheu2 can you sign off on this?

LGTM! Can you get a sign off from PM on this PR as it changes the doc? I'd like their opinion whether this new page differs enough from basic sample to be clear to users

Confirmed with David, he is good to go with these changes

repo: Azure/communication-ui-library


text:
Add HA support

Wait for secondary hostname to be reported to CC before adding to slurm.conf Handle setting the hostname of scheduler-ha nodes
add installlib.append_file to safely append files with commented out hashes

Looks good!

repo: Azure/cyclecloud-slurm


text:
[Improvement] Return DataAPIbuilder version in the response headers

It would be useful to get the Data API builder engine number returned as part of the response headers so the end user can easily see what version of DAB is running

I think it'd be the kind of thing that would be better put into the GraphQL schema file we generate and the OpenAPI spec file (#916 is tracking that) rather than as a header response.
This would mean that it's something you can have locked down to protect privacy/security as deemed for your instance, but still have it available without needing to dig into the deployed service.
It'd also be worth looking at other services out there do it too - what does the CosmosDB REST endpoint show? I know that App Service doesn't return anything about the runtime (.NET/Node/etc.) version, nor does SWA.

Instead of providing the version in the response header, how about the client application request a minimum version in their request?
If the requested version is compatible with the running DAB instance, it would respond with the expected result - not revealing the exact version the DAB instance is running with.
If the requested version is not compatible, the DAB instance would treat it as a "Bad Request".

@JerryNixon @yorek what is your current opinion on this prior to 1.0/1.1 milestones?

authors: Aniruddh25 aaronpowell seantleonard yorek

repo: Azure/data-api-builder


text:
Draft doesn't support RBAC-enabled clusters

Tried to use Draft on a cluster with RBAC and experienced an error during draft up.  Given how common RBAC is becoming (it's now a requirement for service catalog), we should add a dedicated serviceaccount with some roles and rolebindings to the draftd chart.
$ draft create
--> Draft detected the primary language as Python with 41.346154% certainty.
--> Ready to sail
$ draft up
Draft Up Started: 'oldfashioned-elephant'
oldfashioned-elephant: Building Docker Image: SUCCESS ⚓  (64.0801s)
oldfashioned-elephant: Pushing Docker Image: SUCCESS ⚓  (30.0109s)
oldfashioned-elephant: Releasing Application: FAIL ❌  (0.0390s)
oldfashioned-elephant: Build ID: 01BTRV9DAZ1V80V6VK68PXYQBP

Draftd logs:
$ ks logs draftd-1472552117-8tk6p draftd -f
time="2017-09-24T02:26:03Z" level=info msg="server is now listening at 0.0.0.0:44135"
Step 1/4 : FROM python:onbuild
...
ec71859e4a96: Layer already exists
18f9b4e2e1bc: Layer already exists
d70ce8b0dad6: Layer already exists
16108db0233483ebe9186a38c4af48d3a6b1223d: digest: sha256:6d8ba19d3bd32fa0cbcb5ab30a00c57acaf6ec2b3add741c1b98617f1bdc4d9d size: 2841
buildApp: release error: User "system:serviceaccount:kube-system:default" cannot get namespaces in the namespace "default". (get namespaces default)

Version info:
$ draft version
Client: &version.Version{SemVer:"v0.7.0", GitCommit:"0054537f5fe2561f8dc0fe3cca0fc5970f62562d", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v0.7.0", GitCommit:"0054537f5fe2561f8dc0fe3cca0fc5970f62562d", GitTreeState:"clean"}
$ helm version
Client: &version.Version{SemVer:"v2.6.1", GitCommit:"bbc1f71dc03afc5f00c6ac84b9308f8ecb4f39ac", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.6.1", GitCommit:"bbc1f71dc03afc5f00c6ac84b9308f8ecb4f39ac", GitTreeState:"clean"}
$ kubectl version
Client Version: version.Info{Major:"1", Minor:"7", GitVersion:"v1.7.5", GitCommit:"17d7182a7ccbb167074be7a87f0a68bd00d58d97", GitTreeState:"clean", BuildDate:"2017-08-31T09:14:02Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"7", GitVersion:"v1.7.5", GitCommit:"17d7182a7ccbb167074be7a87f0a68bd00d58d97", GitTreeState:"clean", BuildDate:"2017-08-31T08:56:23Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}

So the error here indicates that tiller was not configured with RBAC properly, as tiller is the instance that installs the final release into the configured namespace.
It sounds like we'll need to link to the documentation on how to configure tiller with RBAC in the install docs.

My helm installation is RBAC enabled, but my CI system (gitlab-ci) is running in a different namespace (testing) so draft is trying to use system:serviceaccount:testing:default this SA is only allowed to create new pods in same namespace.
It is possible to configure draft to use an specific serviceAccount?

At the present time, it isn't possible through the CLI. However, draft init is essentially a wrapper around helm install. It's entirely possible to modify the draftd chart to suit your needs for the time being until we come around to this.

thanks @bacongobbler, must this be a separate issue?

@jalberto quick and dirty workaround:
$ kubectl create sa -n testing draftd
$ kubectl create clusterrolebinding system:draftd --clusterrole=cluster-admin --serviceaccount=testing:draftd
$ kubectl -n testing patch deployment draftd -p '{"spec":{"template":{"spec":{"serviceAccount":"draftd"}}}}}'

This will give "root access" to cluster to draftd deployment via testing:draftd serviceaccount.

authors: Bregor bacongobbler gabrtv jalberto

repo: Azure/draft


text:
Remove imagestatus CR

ImageStatus adds a lot of overhead to running eraser for mostly low-value information.
The intention of this was to have a sort of audit trail as to what happened. It doesn't exactly work that way because details get overwritten and other things related to the implementation, but the intention is to know exactly what happened during a run.
Instead we can change our job deletion strategy with the intention of keeping pods for jobs around longer to ensure pod logs are kept around for a period of time for debugging purposes.
Additionally we should make sure that we log everything an eraser pod does to stdout.
Related #96

[ ] remove CR imagestatus and imagelist.status
[ ] output logs (success/error for image removal) from eraser pods
[ ] configurable deletion timestamp for jobs

repo: Azure/eraser


text:
#10103093 LocationDropDown stopped normalizing after accessibility pu…

…sh CR: alshaker, gurua, nadira, eriwong, lustan
I only changed portal-create.md, everything else was  generated

@rowong @amitgetgit please review

repo: Azure/portaldocs


text:
Rout containing dot '.' returns 404

I have a Blazor WASM project that I am trying to hosting with an Azure Static Web App. Any routes with a dot in the name are failing with a 404. Here is an example of a failing route
foo.azurestaticapps.net/_content/Bar.UXLibrary/css/common.css

There are some others reporting this behavior in #72

repo: Azure/static-web-apps


text:
[Bug] Staging environment is not reliably closed when multiple PRs are closed at the same time

When multiple pull requests are closed at the same time, SWA frequently fails to close the current staging environment to free up that slot.
This became a much bigger problem when we started using dependabot on all of our projects and we are limited to only a single staging environment.  If we have a handful of dependabot PR requests and we do a push to main which fixes them all, dependabot will go and close out all of the PRs that are now no longer applicable.  However, if one of those PRs had successfully deployed to the staging environment on SWA, it commonly fails to be deleted.  The only recourse is to go into the azure portal and manually delete that environment.  It does not happen every single time, but commonly enough that it became quite bothersome.
We have now started using the suggestion in issue #122 to stop dependabot PRs from being deployed to a staging environment. at all and this has resolved the issue for us  However, this does hint at a potentially larger problem which could occur anytime multiple PRs are closed at roughly the same time.
In the GHA logs, the PR which did not get deleted appears to have been first updated by dependabot (thus triggering a new build), then very shortly after closed (thus triggering the close event).  In the GHA log, it looks like the deployment event fails after upload (it states: "Finished Upload.. Polling on deployment." then polls, then states that the deployment failed because the build was cancelled).  Then, when the "close" job occurs, it declares that "The content server has rejected the request with: BadRequest Reason: No matching static site environment was found.".  This prevents the staging environment from being deleted even though it clearly shows up in portal.azure and is still usable.
Is it possible that the post-deployment action which publishes the URL as a comment also sets up something which is then used later during tear-down?  If the build is cancelled during the "polling on deployment" and then the PR is immediately closed, that seems to trigger the problem (relatively) reliably.

Hey @mwaddell thanks for reporting this! I'll create a backlog item for us to investigate this.

@miwebst - I was just able to trigger this again even without dependabot enabled.  If you have a PR that is outdated but can be automatically merged, click "Update Branch" within the PR and then as soon as the "Merge" button becomes enabled again, click it.  This closes the PR but the original deployment hasn't completed yet.
In the logs, it shows that the "Build and Deploy" job started after the "Close Pull Request" job, but that the "Close Pull Request" job finished first.  Both jobs succeed, but in the Azure portal, the environment was torn down but then a few minutes later brought back up.  Then, because the PR request is already closed, there's no way to get rid of that environment without doing it manually.

I have all the logs if you would like them - just let me know where I can safely submit them for your review.

I experienced same issue, the close pull request job action failed after successfully merging the staging branch with the main one.

This problem occurs regularly for us. Any update on the fix ETA?

This also happens to us quite often
I've also 👍 to show my support and mostly commenting here for anyone in the future curious if it's still an issue.

I have the same issue in Nov 2021

raising another hand here that this is quite annoying!

The fix for me was adding in the following code to the my workflow yaml file. Works every single time now, for the last several months.

 finish_pull_request_job:
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
    name: Close Pull Request Job
    steps:
      - name: Finish Pull Request
        id: closepullrequest
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_blah_blah }}
          action: "close"

@mhmo91 can you clarify the scenario you are seeing this in? Is it the same scenario where you have a GitHub Action running because of an update to a PR and you close that PR concurrently?

@miwebst just noticed that the azure build is failing on pull requests due to environments exceeding max of 10. all the pull requests are closed yet the environment is still there taking up the space.

Can you check the Azure Portal and try to remove those environments there?

@miwebst  that's what i did now, i'll let u know if the issue persisted, thanks, much appreciated your prompt response :)

The fix for me was adding in the following code to the my workflow yaml file. Works every single time now, for the last several months.
 finish_pull_request_job:
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
    name: Close Pull Request Job
    steps:
      - name: Finish Pull Request
        id: closepullrequest
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_blah_blah }}
          action: "close"

This were  a default configuration that are created by the Azure static deployment plugin, and yet the issue happened, we moved to Azure cdn about a month ago!

@mhmo91 The issue is that the finish_pull_request_job completes before the build_and_deploy_job completes.  If you look in your PR, you'll see something like this:

I tried adding a "cleanup" job to that same workflow which would execute after the build_and_deploy_job finishes and trigger the finish_pull_request_job if the PR had been closed.  However, since the entire workflow executes in the same context, the PR is still "open" from the perspective of that executing workflow.
The only solution I can think of is to create a separate workflow which is triggered when the Azure Static Web Apps CI/CD workflow completes and which would then check (in a separate context) whether the PR had been closed.  However, the workflow_run event doesn't support pull_requests yet.
What I would like to do is add a second workflow with the following:
name: Azure Static Web Apps Cleanup

on:
  workflow_run:
    workflows: ["Azure Static Web Apps CI/CD"]
    types: [completed]

jobs:
  close_pull_request_job:
    if: github.event.pull_request.state == 'closed'
    runs-on: ubuntu-latest
    name: Close Pull Request Job
    steps:
      - name: Finish Pull Request
        id: closepullrequest
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_blah_blah }}
          action: "close"

However, the above will NOT work because workflow_run events are only ever triggered on your default branch.

For now, I'm using the concurrency option as follows:
name: Azure Static Web Apps CI/CD
concurrency: azure-${{ github.ref }}
on:
  push:
    branches:
      - master
  pull_request:
    types: [opened, synchronize, reopened, closed]
    branches:
      - master

etc...

This prevents multiple instances of the workflow from running at the same time on the same PR, so the "close" action will always wait until the previous "deployment" action finishes before it begins, thus preventing this bug.
The downside to this approach is that if you push multiple commits to the same branch, only the last one will get executed and deployed, so if it fails due to an issue you introduced in one of the previous commits, you have no idea which commit caused the issue and have to manually revert each one until you find it.
All the other ones will either show up as cancelled or failed:

Hey any word on this issue? Its still a problem a year and a half later...

@miwebst can you share any status on this?

authors: James-Firth david-ps mhmo91 mikeholczer miwebst mwaddell olakusibe pilotkid tr3ysmith


text:
[tcgc] remove none visibility property for model

fix: https://github.com/Azure/typespec-azure/issues/1916

All changed packages have been documented.

:white_check_mark: @azure-tools/typespec-client-generator-core

Show changes
@azure-tools/typespec-client-generator-core - feature ✏

remove none visibility property for model

You can try these changes here

🛝 Playground
🌐 Website
📚 Next docs

authors: azure-sdk tadelesh

repo: Azure/typespec-azure


text:
[tcgc] add doc for client api version customization

separated from https://github.com/Azure/typespec-azure/pull/1978

No changes needing a change description found.

You can try these changes here

🛝 Playground
🌐 Website
📚 Next docs


text:
Run Inspektor Gadget commands from webview

The outcome of discussion #203.
Replaces all the previous Inspektor Gadget commands in the nested context menu with a single 'Show Inspektor Gadget' command, which launches a webview providing all the functionality previously supplied by the individual commands.
Example view:

❤🙏 thank you so much for this, bunch of very cool changes, specially the new look and feel.
for archiving sake, we chatted regularly and I see the changes are pretty good to land in terms of telemetry instead of fine grained we will achieve more cumulative approach which is great because there was no advantage we have previously to actually finegrain. ☕🎉 let’s get all this tested.

authors: Tatsinnit peterbom

repo: Azure/vscode-aks-tools


text:
Debugging with Kubernetes Extension does not work due to volume mount issue

I am unable to properly mount volumes within Kubernetes and WSL 2 using HostPath. This is probably a WSL 2 issue, but considering that I am trying to do debugging within a local Kubernetes cluster in Docker, I figured I would put the issue here. Here are the steps:

Deploy debug build to Kubernetes for my app.
Attach Visual Studio Code using the Kubernetes extension
Navigate to the project folder for my application that was attached using the volume mount <= Problem Right Here

When you go and look at the volume mount nothing is there.
C:\Windows\System32>wsl -l -v
NAME                   STATE           VERSION

Ubuntu                 Running         2
docker-desktop-data    Running         2
docker-desktop         Running         2

Docker Desktop v2.3.0.3
Kubernetes v1.16.5
Visual Studio Code v1.46.1

====================================================================
Dockerfile
====================================================================
#
# Base image for deploying and running based on Ubuntu
#
# Support ASP.NET and does not include .NET SDK or NodeJs
#
FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-bionic AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443
#
# Base image for building .NET based on Ubuntu
#
# 1. Uses .NET SDK image as the starting point
# 2. Restore NuGet packages
# 3. Build the ASP.NET Core application
#
# Destination is /app/build which is copied to /app later on
#
FROM mcr.microsoft.com/dotnet/core/sdk:3.1-bionic AS build
WORKDIR /src
COPY ["myapp.csproj", "./"]
RUN dotnet restore "./myapp.csproj"
COPY . .
WORKDIR "/src/."
RUN dotnet build "myapp.csproj" -c Release -o /app

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-bionic AS debug
RUN curl --silent --location https://deb.nodesource.com/setup_12.x | bash -
RUN apt-get install --yes nodejs
ENTRYPOINT [ "sleep", "infinity" ]

#
# Base image for building React based on Node/Ubuntu
#
# Destination is /app/ClientApp/build which is copied to /clientapp later
#
# NOTE: npm run build puts the output in the build directory
#
FROM node:12.18-buster-slim AS clientbuild
WORKDIR /src
COPY ./ClientApp /app/ClientApp
WORKDIR "/app/ClientApp"
RUN npm install
RUN npm run build
#
# Copy clientbuild:/app/ClientApp to /app/ClientApp
#
# Copy build:/app to /app
#
FROM base as final
WORKDIR /app/ClientApp
COPY --from=clientbuild /app/ClientApp .
WORKDIR /app
COPY --from=build /app .
ENTRYPOINT ["dotnet", "myapp.dll"]

====================================================================
Kubernetes Manifest
====================================================================
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  selector:
    matchLabels:
      app: myapp
  replicas: 1
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: localhost:6000/myapp
        ports:
        - containerPort: 5001
        securityContext:
          privileged: true
        volumeMounts:
        - mountPath: /local
          name: local
        resources: {}
      volumes:
      - name: local
        hostPath:
          path: /C/dev/myapp
          type: DirectoryOrCreate
      hostname: myapp
      restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  type: LoadBalancer
  ports:
  - name: http
    protocol: TCP
    port: 5001
    targetPort: 5001
  selector:
    app: myapp

Probably too late to be useful to you, I fear, but I think the WSL2 path would be /mnt/c/dev/myapp?

Probably too late to be useful to you, I fear, but I think the WSL2 path would be /mnt/c/dev/myapp?

authors: ChiefInnovator itowlson

repo: Azure/vscode-kubernetes-tools


text:
Consider reducing the size of the generated nonce

Currently we generate a nonce by base64 encoding two concatenated Guids, wich produces a rather large value.
We could generate a smaller nonce using the RandomNumberGenerator from System.Security.Cryptography to generate a value with the same security characteristics but with a shorter length.
This affects the sizes of multiple cookies in ASP.NET and the size of the id tokens that we generate and should be easy to implement

@javiercn you can override GenerateNonce, so I marked this as P2.
https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/master/src/Microsoft.IdentityModel.Protocols.OpenIdConnect/OpenIdConnectProtocolValidator.cs#L108
Also, you can filter out any claims you wish by setting the following.
https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/master/src/System.IdentityModel.Tokens.Jwt/JwtSecurityTokenHandler.cs#L77

@javiercn you can control this yourself. Please feel free to reopen if you are unable.

@brentschmaltz keep in mind that guid generation on non-windows does not carry the same entropy guarantee that it does on windows. you should use a CRNG.

@brockallen that's one reason GenerateNonce is virtual. I'll consider your suggestion.

authors: brentschmaltz brockallen javiercn


text:
Add application identifier to access token

Adding an application identifier field (string) to the access token cache record.
The application identifier is a combination of package name of the application and signature of the application
This is only required for use by the android auth broker as this is the only shared cache on Android
Addition of this field distinguishes legitimate applications which use the same client id from one another where were we need to know if particular policies have been applied locally in a physical application

From a scenario perspective this change is required to address a True MAM scenario around legacy recommendations to applications for Single Sign On... when they were encouraged to use the same client id.
Please review the token cache documentation in the MSAL repo prior to reviewing.

@shoatman  would you mind describing in detail the reason/scenario that drives this change? I think it'll be helpful for reviewers, and as a future reference.

@shoatman would you mind describing in detail

the reason/scenario that drives this change?
How to navigate through the flow affected by the change (IMHO, the cache layer is pretty convoluted).

I think it'll be helpful for reviewers, and as a future reference.

I added additional information to the description.

authors: rpdome shoatman


text:
Silent logout, login without cache token

Core Library
MSAL.js v2 (@azure/msal-browser)
Core Library Version
2.20.0
Wrapper Library
MSAL Angular (@azure/msal-angular)
Wrapper Library Version
2.0.6
Description
Hi guys,
i have a little special use case: I have a signed in user in my application, but the app requires also an four eyes principle. So I have to aquire a token(which will be checked in backend) for a second user with prompt login.
This is where my problems start:
If i aquire the token for the second user, the second user stays logged in and i have to show the logout page where the second user must interactivate again.
Currently this is a security issue, because if logout is not properly executed it is possible to sign in to all microsoft services via SSO
So i look for a solution to aquire a token without being cached or an option to logout silent. Can you help me please?
MSAL Configuration
auth: {
    clientId: 'XXX',
    authority: 'https://login.microsoftonline.com/XXX/',
    redirectUri: '/',
    postLogoutRedirectUri: '/logout'
  },

  cache: {
    cacheLocation: BrowserCacheLocation.SessionStorage,
    storeAuthStateInCookie: false
  }

Relevant Code Snippets
this.msalSvc.acquireTokenPopup({ loginHint: user.userPrincipal, prompt: 'login', scopes: ['api://XXX/sign']} as PopupRequest).subscribe({
...
this.msalSvc.instance.logoutPopup({ account: response.account, postLogoutRedirectUri: null});

Identity Provider
Azure AD / MSA
Source
External (Customer)

@bumbel42so We are currently working on a feature to improve the logout experience, and will have documentation when it is ready. In the meantime, you can try setting the browser cache location to BrowserCacheLocation.MemoryStorage so tokens are not persisted across page loads.

@jo-arroyo I tried it with cacheLocation: BrowserCacheLocation.MemoryStorage and  storeAuthStateInCookie: true but the SSO problem that i can login via SSO on other sides remains. Any other ideas for a workaround?
Do you have a timeline for the improved logout experience?

Assigning to @hectormmg, who will be working on this.

authors: bumbel42so jasonnutter jo-arroyo


text:
1.21 support!

Let's make some fancy pictures or renders for your mod, but in exchange you'll make a 1.21 support 😅

I'm currently working on updating my other mod "You're in Grave Danger", but when I have some time at hand to work on this too, I will make sure it receives updates too

The other mod is done, and now I've published version 1.3.0 for Short Grass!
It will work on all versions between 1.20.4 and 1.21


text:
Have you tried dbscan?

Great job, have you tried dbscan? Which one do you think is better using kmeans or dbscan? I think it can be encapsulated into a general data processing program

We haven't tried dbscan.
For the pruning of LAION-2B, we conduct a method of semantically de-duplicating, based on cosine similarity of image embeddings. We think the idea of our method is like dbscan to some degree. We use k-means to help to reduce computing time, that we believe two embeddings belonging to different clusters are hardly semantical duplicates.
Due to the huge scale of LAION-2B, we store it as 232320 tars. It's hard to encapsulate the code into a plug-and-play program. We supply our code.
For more information and the code, please refer to here.

Close the issue for now if there's no further discussions. Feel free to reopen it if there's any other questions.

authors: Isaachhh carry-xz

repo: BAAI-DCAI/Bunny


text:
Problem about ITRdataset

Hello,
Thanks for your excellent work. I am trying to reproduce the results of  Image-Text Retrieval, but I can't find the test file /M3D_Cap_npy/M3D_Cap_eh.json. Can you provide the test data? Thanks a lot！

Hi,
I'm sorry for the late reply.
You can find test sets of different sizes here (https://huggingface.co/datasets/GoodBaiBai88/M3D-Cap/blob/main/M3D_Cap/M3D_Cap.json).
M3D_Cap_eh.json is removed and merged to M3D_Cap.json.


text:
What is VQA yes or no datasets ?

in train.py ,
vqa_yn_data_train_path: str = field(default=None, metadata={"help": "Path to training VQA Yes or No data."})
could anyone tell me about VQA Yes or No data?  or how to generate it ?the VQA link only shows train/validation/test dataset.

Thank you for your question. The VQA-YN dataset refers to a Yes/No question dataset generated using M3D-Cap. Since this dataset hasn't been thoroughly reviewed, I haven't publicly released detailed information about the VQA-YN data, nor have I validated its performance on test tasks. However, if you need it, I can provide you with the VQA-YN dataset here.

ok,thanks

authors: baifanxxx zhouhoo


text:
U180 Pulse Not Defined

The SPAM sequence is trying to use a U180 pulse here which is not defined and fails this test.
Can the U180 be replaced with a Utheta?

We could define a U180 by replacing 'pi2amp' with 'piamp' in the U90 code.  @caryan @blakejohnson, would this add unnecessary bulk to the code base?

I think U180 should just be replaced with U.

authors: bcdonovan blakejohnson matthewware

repo: BBN-Q/PyQLab

license_source: bigquery


text:
QRegister fails to ensure qubit uniqueness

The QRegister constructor tries to ensure any qubit appears at most once in a given QRegister. This seems to have bugs. Note that a given qubit likely will appear in multiple registers, but should only appear once in a given register.
See related issues #31, #32, #33, #34. (Particularly #32)

Duplicates are now removed.


text:
How to calculate SRI for nonlinear models?

@mtsokol
https://github.com/BCG-X-Official/facet/issues/374 related.
Thank you. I have modified your code and considered non-linear models such as KernelRidge.
However, KernelRidge is naturally not compatible with TreeExplainerFactory, so I considered using KernelExplainerFactory or ExactExplainerFactory. However, since ExactExplainerFactory is not usable depending on the size of the dataset, I adopted KernelExplainerFactory(shap_interaction=True).
In this case, a RuntimeError occurs.
RuntimeError: SHAP interaction values have not been calculated. Create an inspector with parameter 'shap_interaction=True' to enable calculations involving SHAP interaction values.
Checking your implementation, it seems that KernelExplainerFactory does not compute shap_interaction.
https://github.com/BCG-X-Official/facet/blob/66bea1574e7a05e8db13cc25b5f071a260d0f66b/src/facet/explanation/_explanation.py#L377
https://github.com/BCG-X-Official/facet/blob/66bea1574e7a05e8db13cc25b5f071a260d0f66b/src/facet/inspection/_learner_inspector.py#L139
I have two questions.
1.
For non-linear models, is it necessary to use ExactExplainerFactory and perform inspector.fit()? What should I do if the data size is large?
2.
The specification that KernelExplainerFactory internally converts shap_interaction=True to False is confusing. Would it be better to throw an error if shap_interaction=True is specified, or change it so that the shap_interaction argument cannot be specified at all?
import pandas as pd
from sklearn.model_selection import RepeatedKFold, GridSearchCV

# some helpful imports from sklearndf
from sklearndf.pipeline import RegressorPipelineDF
from sklearndf.regression import RandomForestRegressorDF

# relevant FACET imports
from facet.data import Sample
from facet.selection import LearnerSelector, ParameterSpace

from sklearn.datasets import load_diabetes
X,y = load_diabetes(return_X_y=True)
data = load_diabetes()

X = pd.DataFrame(X)
X.columns  = data["feature_names"]
y = pd.DataFrame(y)
y.columns = ["target"]
diabetes_df = pd.concat([X,y], axis=1)

# create FACET sample object
diabetes_sample = Sample(observations=diabetes_df, target_name="target")

# create a (trivial) pipeline for a random forest regressor

from sklearn.kernel_ridge import KernelRidge
model = KernelRidge()
model.fit(X,y)

# fit the model inspector
from facet.inspection import NativeLearnerInspector
inspector = NativeLearnerInspector(
    model=model,
    explainer_factory=KernelExplainerFactory(),
    n_jobs=-3,
    shap_interaction=True

)
inspector.fit(diabetes_sample)

# visualise synergy as a matrix
from pytools.viz.matrix import MatrixDrawer
synergy_matrix = inspector.feature_synergy_matrix()

# visualise redundancy as a matrix
redundancy_matrix = inspector.feature_redundancy_matrix()
# visualise redundancy using a dendrogram
import matplotlib
from pytools.viz.dendrogram import DendrogramDrawer
redundancy = inspector.feature_redundancy_linkage()

Sorry @jckkvs  this slipped through
Re (1) totally agree an exception would be better - we will make that change
Re (2) FACET relies on the shap package for all SHAP calculations. I agree it would be great to see support for interaction values for a broader set of models - probably best to raise that to the shap maintainers. Alternatively we may consider adding our own interaction explainer to a future version of FACET (in our own work, we find that ensemble models work great so we're fine using the TreeExplainer)

That's right, for SHAP interaction values I believe you are mostly limited to tree based models.

authors: j-ittner jckkvs mtsokol

repo: BCG-X-Official/facet


text:
Feature/best matching

Fixes best matching problems by using a completely new method for finding matches. The new algorithm introduces a new class, the BestCluster which implements necessary functionality and allows for more or less a readable algorithm. It performs slightly faster than the old algorithm in case of using "grid_fee" for disputed values.  Using "bid_price" is not optimized yet and therefore can take much longer. The biggest advantage towards the old algorithm is, that the produced matches follow, from my perspective, the mandatory condition of being at least local optima for each ask. This means a single ask could not be placed differently to achieve a higher profit for the ask_actor.  This leads to the side condition of clearing prices which are at an equilibrium between clusters, with an offset of the grid fee in between, and some differences due to the discrete nature of single orders and prices.
The basic steps of the algorithm are

Local Matching without restrictions
Single Loop Needle Work through all asks
Iterative profit optimized matching

Local Matching without restrictions
For each known cluster a BestCluster is generated. A BestCluster consists of all Bids of this cluster, e.g. the bids are unique. During local matching without restrictions all asks are used to match these local bids. From this a clearing price and an amount of matched energy arise. If the matched energy at this point is zero, the cluster can be discarded, since coming restrictions wont make it easier to match in this cluster.
Single Loop Needle Work through all asks
The algorithm iterates over the clusters and takes the lowest ask of this cluster. This ask is found in every other clusters and profits as well as the disputed value is used to determine the best cluster for the ask to stay in. the ask is deleted from the other clusters, e.g. cluster which are not the best cluster. this continues until every cluster checked its lowest ask. After that a new loop starts with the second lowest ask and so on. Each cluster checks its own asks once or less. Less in the case that another cluster determined the ask should be deleted from this cluster. 2 clusters might check the same ask in case of the first cluster not being the best cluster, therefore deleting the ask from its own cluster, and then the best cluster checking the ask again to determine, the ask should remain in the current cluster. A previous bottleneck of deleting the asks from the panda dataframe was negated by using a cluster dependent index instead. therefore, the dataframe has to be mutated only once at the end.
The following picture describes how the algorithm works

Iterative profit optimized matching
The last step of the algorithm is iterative and takes care of changed clearing price conditions during the single loop. During the above loop each asks stays in at the moment, optimal cluster. This might not be the optimal cluster at the end of the loop. Therefore, the cheapest asks per cluster get the possibility of changing clusters to a more optimal / profitable cluster. This leads to changes in other clusters which can cascade during runtime, with no upper bound. This means that badly defined dispute values or other problems might lead to a not exit-able while loop. A check for convergence might make sense at this point. The loop exits when no ask can change clusters with making a profit. This happens when connected clusters are closest to an equilibrium-price.
Further Task before merge
Coding

[ ] handle market maker
[ ] Clear up Tests
[ ] Reduce tests to necessary amount
[ ] remove time_it fixtures when computation speeds are met

Misc

[ ] Review
[ ] Docstring
[ ] Read The Docs

The code was optimized for the case of using "grid_fee" as disputed value, e.g. in case of the same profit, the cluster is chosen which has the lower grid fee. the bid_price dispute might be further optimized and is by far the most time-consuming step. To determine which function is dominant for computational time, the time_it fixture is used. Removing it would make sense before merging.
An optimally solved market can be seen here. The grid fees between cluster are minimal with 0.01. Every Cluster consists of unique prices. Prices are chosen to be identical with the actor name e.g. the actor 0.8 has an order price of 0.8
Cluster 0 has asks prices ending on 0.8 and bid prices ending on .666
Cluster 0has the lowest bids and the highest asks of all clusters
Cluster 1 has asks ending on 0.4 and bids ending on .333
Cluster 2 has the lowest asks and the highest bids. The result is that cluster 0 matches 11 energy units, cluster 1 matches 12 and cluster 2 matches 14 energy units. The clearing prices are as similar as the discrete bidding prices allowed with 10.8, 10.6, and 11.4. The asks are not entirly matched in their own cluster

This scenario can be compared with heavy grid fees of 15 between clusters. The result is less matched energy with 10, 12 and 13 for cluster 0, 1 and 2 and clearing prices of  9.8, 10.6, 11.4

handle market maker
Right now the market maker is not handled by the best algorithm. My proposal would be
Check orders if MarketMaker orders exists.
If MarketMaker orders exists, filter orders which dont meet MarketMaker requirements, e.g. buys which are less expensive than the market maker buy, will not be matched. Other way around for sells (Actors won't buy energy from another actor, if the marketmaker sells the energy for a lower price)
Reduce MarketMaker amounts to the the amounts of all other orders
MarketMaker ask amount is high enough to meet all bids of actors
MarketMaker bid amount is high enough to meet all asks of actors.
Match orders the same way as described above.
slow bid_price disputes
Right now the bid_price dispute is solved lazily, which made it less error prone but also slow. Right now the ask is inserted into the asks, the asks are sorted, the position of the ask is found, read, and returned to look up the corresponding bid_price. Since the insertion should not be permanent, the work is done on a copy. A much more efficient way of doing that would involve.

Look Up if Value is inside the dataframe, if so get the iloc / index of this position
If the ask was not found, look where the ask would be inserted, eg. location where next ask has a higher adjusted price or previous ask had a lower adjusted_price
Use one of the previous locations to deduce the corresponing bid_price.
I suspect a speed up with a factor in the hundreds.

Additional test cherry picked in test/best_matching (while rebasing this branch deleting 73f3084..beb8ea6 )

authors: PaulScheerRLI j-ti

repo: BESTenergytrade/simply


text:
Extinction conditions

I believe that exctinction conditions not predefined in CrystalParameters.py are not dealt with correctly. Note that I added my own material with space group 191 (its PrNi5 for full reference) and crashed at generating trainig data via GUI.
Since group 191 has not predefined data, in CrystalParameters.py -> ApplyExtinctionrules (line 62 onwards) it satisfies Extinc.isdecimal() and so calls wyckpos_lauetools.py -> testhklcond_generalrules_array (line 428 onwards).
1st issue is that there gp[2] (defined by sorting appropriate wp entry at around 448) is None. But in the condition at 452 it is not 'n/a', so the cond gives true. But None does not seem to be valid argument for hklcond_group.findall (reported as #2).
Assuming there should have been and instead of or the return True statement seems weird, as the expected output of the function is smth like 2dim array. I tried to bypass this by outputting np.array(((True,),)), but it than crashes at utils_lauenn.py -> get_material_data -> dstar_square_2 = np.diag(np.inner(np.inner(H2, metrics), H2)) (line 912), since H2 is only 1x1 array (which I believe is connected to the fact that ApplyExtinctionrules got only one True instead of expected hkl triplet as described in this paragraph).
Hope I did not misinterpreted the code completely, I am mostly guessing. But all in all a material with space group 191 is not processed correctly and I tried to suggest the reason why it might be so.

Dear @xxPLxx ,
Thank you for pointing out the bug in the code. This is indeed overlooked while porting the functions from single hkl to array of hkl.
So the space group 191 has no general reflection condition, i.e. it should allow all hkls to be present. and indeed as you pointed out the return True is wrong and is not adapted well in case of no general reflection condition exists. Instead of returning True we should be returning all the hkl in the function arguments.  A fix would be to add return hkl instead of return True in the wyckpos_lauetools.py -> testhklcond_generalrules_array. Or to avoid entering in to this loop, the other way would be to define your material with 'no' extinction as condition.
I have fixed this in the code and you should be able to install the new version from PYPI (pip install lauetoolsnn --upgrade).
Thanks,
Regards,
Ravi


text:
RenderTargetTexture with blur has interference pattern

Bugs
Repro playground: https://playground.babylonjs.com/#X6P873#2
Repro steps:

Open up the above playground.
Click the "Teleport!" button. This moves the camera, PhotoDome, and acrylic plane 10000 m away on the X axis
Note the plane with the "acrylic" style blur.

Expected:
The acrylic plane should look exactly the same.
Result:
The acrylic plane has a distracting pattern of discoloration, resembling interference.

If you decrease the teleportDistance variable, the effect lessens and eventually disappears. If you increase the value, it gets worse.

Unfortunately this pattern comes a precision issue in the "refract" shader instruction.
The size of the world is too large (10000) and thus refraction computation is less and less precise.
There is not a lot we can do about it. I will instead highly suggest to keep the camera closes to 0 (and then move everything else around)

authors: deltakosh nbduke


text:
Bugfix/morph targets

Fixes broken morph targets both from C++ side as well as by updating to BabylonJS version 5.0.0-beta.10 that contains the fixes in the JS side. Also added proper morph targets validation testes to make sure we don't break them again.

Fixes #923
Updates BabylonJS npm package to version 5.0.0-beta.10
Added validation test "GLTF Serializer Morph Target Animation Group"

Can you link to the corresponding JS change?

Babylon JS PR #12000,
https://github.com/BabylonJS/Babylon.js/pull/12000

authors: SergioRZMasson bghgary

repo: BabylonJS/BabylonNative


text:
Support multiple ports for a single type

Resolves: https://github.com/BackSlasher/chef-selinuxpolicy/issues/11

This is the problematic part. I'm repeating my previous issue:
Your version has port 1024 matching a context named mytcp1024blabla.
We need to modify the regex so it won't. Maybe allow spaces and later numbers and seperators, like \\s+[\d\\-,]?
Please write provide some examples here so we can test some regexes (I don't have my servers at the moment)

mytcp1024blabla can never exist, because the output is determined by semanage port -l which  always looks like this:
[root@selinux_policy-berkshelf vagrant]# semanage port -l|grep http
http_cache_port_t              tcp      3128, 8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t            tcp      5988
pegasus_https_port_t           tcp      5989
What the regex does not and cannot take into account is the 10001-10010 above.

(Use ``` for multiple lines of code)
Imagine this:
$ semanage port -l
...
poorly_tcp_written_1024_descriptor tcp 52
...

Now note that echo 'poorly_tcp_written_1024_descriptor tcp 52' | grep -P 'tcp.*1024' works
You're right about ranges, too
If you want to give it a more robust treatment, I can see 2 options:

Move this not_if logic to a ruby block, parsing the output in a more sophisticated manner (like splitting by space, treating arr[1] as the protocol, arr[2..-1] as different port ranges etc.
Use Python (it has to be installed, since semanage is written in python) and test everything there

The following patch is slightly better because it fixes partial matches (the current behavior and the pull request both have an issue in that they'll mistakenly match an assignment for e.g. port 8080 when checking if a an assignment exists for port 80).
It still doesn't address matching ports that are within ranges.
diff --git a/selinux_policy/providers/port.rb b/selinux_policy/providers/port.rb
--- a/selinux_policy/providers/port.rb
+++ b/selinux_policy/providers/port.rb
@@ -9,7 +9,7 @@
 action :add do
   execute "selinux-port-#{new_resource.port}-add" do
     command "/usr/sbin/semanage port -a -t #{new_resource.secontext} -p #{new_resource.protocol} #{new_resource.port}"
-    not_if "/usr/sbin/semanage port -l | grep -P '#{new_resource.protocol}\\s+#{new_resource.port}'>/dev/null"
+    not_if "/usr/sbin/semanage port -l | grep -P '#{new_resource.protocol}\\s+([0-9-]+,\\s+)*#{new_resource.port}(,\\s+[0-9-]+)*$'>/dev/null"
     only_if {use_selinux}
   end
 end
@@ -18,7 +18,7 @@
 action :delete do
   execute "selinux-port-#{new_resource.port}-delete" do
     command "/usr/sbin/semanage port -d -p #{new_resource.protocol} #{new_resource.port}"
-    only_if "/usr/sbin/semanage port -l | grep -P '#{new_resource.protocol}\\s+#{new_resource.port}'>/dev/null"
+    only_if "/usr/sbin/semanage port -l | grep -P '#{new_resource.protocol}\\s+([0-9-]+,\\s+)*#{new_resource.port}(,\\s+[0-9-]+)*$'>/dev/null"
     only_if {use_selinux}
   end
 end
@@ -33,13 +33,13 @@
 action :addormodify do
   execute "selinux-port-#{new_resource.port}-addormodify" do
     command <<-EOT
-    if /usr/sbin/semanage port -l | grep -P '#{new_resource.protocol}\\s+#{new_resource.port}'>/dev/null; then
+    if /usr/sbin/semanage port -l | grep -P '#{new_resource.protocol}\\s+([0-9-]+,\\s+)*#{new_resource.port}(,\\s+[0-9-]+)*$'>/dev/null; then
       /usr/sbin/semanage port -m -t #{new_resource.secontext} -p #{new_resource.protocol} #{new_resource.port}
     else
       /usr/sbin/semanage port -a -t #{new_resource.secontext} -p #{new_resource.protocol} #{new_resource.port}
     fi
     EOT
-    not_if "/usr/sbin/semanage port -l | grep -P '#{new_resource.secontext}\\s+#{new_resource.protocol}\\s+#{new_resource.port}'>/dev/null"
+    not_if "/usr/sbin/semanage port -l | grep -P '#{new_resource.secontext}\\s+#{new_resource.protocol}\\s+([0-9-]+,\\s+)*#{new_resource.port}(,\\s+[0-9-]+)*$'>/dev/null"
     only_if {use_selinux}
   end
 end

See #30 - I prefer moving away from grepping

authors: BackSlasher Sauraus datallah

repo: BackSlasher/chef-selinuxpolicy


text:
Mark homework 1, exercise 1,2  of Peigen Zhou

Homework1
The SHA is 659e3596f5271fbf4772eeb35b982b3225488e74
The homework fold hw1 is inside the stat679work repo.
Exercise 1-3
Inside HW1, I already wrote all the things I have done into readme.md file check here, which contains:

Scripts purpose
Command I used
Full code snapshots
Summary table

Professor @cecileane, I also add a makefile to execute all commands in hw1.
Best,
Peigen

Hi Peigen,
Great work! You even have a makefile, this is fantastic. And for this, you added an "undoNormalizeFileNames" script to clean the project. Fantastic! Are you sure that you will be learning something from this course? You could add a target called "all" so that we can type make to do it all. I had to change the name of your filename from makeFile to makefile, and I had to do make clean first, but after that it worked beautifully.
It's all super well documented.
You also have a license for your repository, great choice, I highly approve.
Your script to normalize (or un-normalize) file names is elegant in its design. It would have been better, however, to use timetest${i}_snaq.log instead of timetest$i\_snaq.log. Generally, it is good practice to access shell variables with ${i} instead of $i.
Unfortunately, you didn't fully use this exercise to practice with grep. It was one of the main goals of this homework. None of your commands used extended regular expressions. It is great that you used parameter expansion and a clever use of cut with various delimiters, but learning to use extended regular expressions would be useful for all other languages, not just the shell.
Last small thing: in a csv file, there should be not spaces before/after the commas that delimit the columns. Well, another small thing: I didn't have it in my list, but "hahahaha" is not a good message for a git commit...
Please close this issue, or assign it to me and I can close it.

Hi, Professor @cecileane
Thanks for all your comment for this home work, my new commit is here 199c88cba05b4b9eded4d9ed49c742d5f8c76193
I took the Professor Karl Broman's course before, which is a fantastic course as yours too. So that I try to acquire this habits to make a makefile of our my projects.
For the makeFile that is a mistake, I forgot the do git rm --cached makeFile.....
And I change all the summary to use extended regular expressions, here is the Code
Thanks for your effort!

authors: BaconZhou cecileane

license: mit


text:
Integration with Github as issue tracker

Hi is it possible to integrate with Github instead of bitbucket?

Is there anymore on this? Seems disjointed that the repo is hosted on Github yet there's no integration with Github.
If there's no plans, can you let us know as we'll look at another solution.

We use it with bitbucket (it is where we have our private repos) so we are not planing on adding it,
however feel free to submit a PR, it should be really easy as it is ready to use any Issue Tracker

authors: AugmentBLU BadChoice adoptavia

repo: BadChoice/handesk


text:
chore: add controller <> strategy lookup support

summary

update naming on sett => vault
add support for controller + strategy contracts
add initial snippet for controller <> strategy look up from vault

:tada: This PR is included in version 1.0.0 :tada:
The release is available on:

npm package (@latest dist-tag)
GitHub release

Your semantic-release bot :package::rocket:

repo: Badger-Finance/badger-sdk


text:
Something added

增加了 local.baka.zone 解析失败的解决方法，完善了登录页面卡住的解决方法的描述

嘻

repo: BakaXL-Support/BakaXL-QA-docs


text:
constraints to center? iPad display is topLeft..

hey, wondering if anyone already has tweaks setup to constrain display to show properly on an iPad.

Hey @wdcurry, can you describe your problem in more details please?

Sure..i have standard (and well done, thanks!) WhatsNew setup for my iPhone devices. My app is essentially iPhone only but experience has taught me to drop up iPad images as well to get past reviewers. The WhatsNew displays, using the built-in viewcontroller, with no constraints and no adjustments to sizing. I can live without the dynamic font size constraints but having the off-center and iPhone sized display in the upper left is challenging to submit. I may leave as-is and just see how it goes.. unless of course i have missed a simple .setForIPad flag etc ;)

Hey @wdcurry. If you project is Universal, the WhatsNewViewController will display something like as follows:

You are always free to set bigger font dimensions to fit the bigger screen, but I think support for iPad is already built in since the layout looks good on all devices.

On iPad, I use whatsNew.modalPresentationStyle = .formSheet.

authors: BalestraPatrick jdanthinne wdcurry

repo: BalestraPatrick/WhatsNew


text:
Add minTime parameter for query

This should be useful for tables which are smaller. We could display full number of records in the same way it is done in DD.

merged

repo: BalticAmadeus/ProBro


text:
Readme.md is not updated

Readme.md is not updated with the latest home page of your site, I will add the screenshot of the latest image

Thank you for creating this issue! 🎉 We'll look into it as soon as possible. In the meantime, please make sure to provide all the necessary details and context. If you have any questions or additional information, feel free to add them here. Your contributions are highly appreciated! 😊
You can also check our CONTRIBUTING.md for guidelines on contributing to this project.

@BamaCharanChhandogi I had a doubt, where did u host your backend?? was it free??

@BamaCharanChhandogi I had a doubt, where did you host your backend?? was it free??

It is render, there are multiple plans. there is a free version also.

repo: BamaCharanChhandogi/Diabetes-Prediction


text:
Ingen kode

Et helt tomt repo. Det er triste saker når jeg er så spent! Står ikke noe i readme.md om hva en kan vente seg heller.

Repo'et er ikke tomt :) branch/master er tom for øyeblikket, men se gjerne under snapshot-branch.

authors: heikkih ramvi


text:
Update README.md

The readme is out of date and should be updated and beautified.

This is key, the mod looks dead until you look at the issues and code, I'm sure most people don't go that far.
Besides right now new people just don't know what features are available!

I would like to change the README.md, on first sight as @kikoncuo mentioned, it is not really encoureging looking at the GitHub page. It really looks dead, until you try to look at the milestones.
For me to be able to fill in the right informations, i would like your help, i have created the fork already {Fork](https://github.com/Kamyabnz/BannerlordCoop). What features are already implemented ?

Resolved

authors: Kamyabnz garrettluskey kikoncuo

repo: Bannerlord-Coop-Team/BannerlordCoop


text:
🛑 NWT Housing Corporation is down

In ad601f5, NWT Housing Corporation (https://www.nwthc.gov.nt.ca) was down:

HTTP code: 503
Response time: 10099 ms

Resolved: NWT Housing Corporation is back up in b8d6530 after 5 minutes.

repo: Barctic/gnwt-monitor


text:
🛑 Legislative Assembly is down

In 2cd6357, Legislative Assembly (https://www.ntassembly.ca) was down:

HTTP code: 403
Response time: 392 ms

Resolved: Legislative Assembly is back up in 776509b.


text:
🛑 Infrastructure is down

In 7cf887a, Infrastructure (https://www.inf.gov.nt.ca) was down:

HTTP code: 500
Response time: 503 ms

Resolved: Infrastructure is back up in 1b53c62.


text:
🛑 Health and Social Services is down

In b47fc48, Health and Social Services (https://www.hss.gov.nt.ca) was down:

HTTP code: 504
Response time: 323 ms

Resolved: Health and Social Services is back up in 74416d0.


text:
🛑 Justice is down

In b176249, Justice (https://www.justice.gov.nt.ca) was down:

HTTP code: 0
Response time: 0 ms

Resolved: Justice is back up in 0938062 after 6 minutes.


text:
🛑 Executive and Indigenous Affairs is down

In 090794f, Executive and Indigenous Affairs (https://www.eia.gov.nt.ca) was down:

HTTP code: 504
Response time: 338 ms

Resolved: Executive and Indigenous Affairs is back up in 03bf4fc after 10 minutes.


text:
🛑 Lands is down

In d83c27f, Lands (https://www.lands.gov.nt.ca) was down:

HTTP code: 503
Response time: 5294 ms

Resolved: Lands is back up in 097780c after 7 minutes.


text:
🛑 QBitTorrent webUI is down

In 4dacb83, QBitTorrent webUI (https://qbittorrent.local.jonthan.xyz) was down:

HTTP code: 404
Response time: 769 ms

Resolved: QBitTorrent webUI is back up in d666f3f after 6 minutes.

repo: Baronhez/upptime


text:
🛑 Dashboard Server is down

In 2aa6aee, Dashboard Server (https://flame.jonthan.xyz) was down:

HTTP code: 404
Response time: 602 ms

Resolved: Dashboard Server is back up in ec7a40a after 13 minutes.


text:
🛑 QBitTorrent webUI is down

In b44a8d7, QBitTorrent webUI (https://qbittorrent.jonthan.xyz) was down:

HTTP code: 404
Response time: 539 ms

Resolved: QBitTorrent webUI is back up in ebc9686 after 6 minutes.


text:
🛑 QBitTorrent webUI is down

In ebf52b6, QBitTorrent webUI (https://qbittorrent.local.jonthan.xyz) was down:

HTTP code: 404
Response time: 623 ms

Resolved: QBitTorrent webUI is back up in c157568 after 7 minutes.


text:
🛑 QBitTorrent webUI is down

In 2c79b8d, QBitTorrent webUI (https://qbittorrent.local.jonthan.xyz) was down:

HTTP code: 404
Response time: 731 ms

Resolved: QBitTorrent webUI is back up in 08781a5 after 6 minutes.


text:
geocoding: Placemark behaves differently on iOS and Android

🐛 Bug Report
placemarkFromCoordinates behavior differs between iOS and Android.
Placemark name on Android has the street number, while on iOS it contains both the street number and the street name.
iOS
Placemark name: Ulica Stojana Protica 29
Placemark thoroughfare: Ulica Stojana Protica
Placemark locality: Belgrade
Android
Placemark name: 1
Placemark thoroughfare: Stojana Protica
Placemark locality: Belgrade
Expected behavior
Expected both platforms to return data in the same format.
Reproduction steps
List placemark = await Geolocator().placemarkFromCoordinates(geo.latitude, geo.longitude);
for (var pm in placemark) {
locationString += pm.name + '|' + pm.thoroughfare + '|'+pm.locality;
}
Configuration
Version: 5.3.1
Platform:

[X] :iphone: iOS
[X] :robot: Android

@nincode this behaviour is because we use the local geocoding API of the platform. This means that on iOS the Apple Maps services are used (through the CLGeocoder API) and on Android devices the Google Maps services are used (using the Geocoder API).
Unfortunately the details per service differ a bit which explains the diferences you might experience when comparing output cross platform.

authors: mvanbeusekom nincode

repo: Baseflow/flutter-geolocator


text:
Create new file jquery.mmenu.setmenu.js

Set menu in function of URLs

Could you please explain what this add-on is supposed to do?
Is it trying to find the anchor that links to the current page and set the LI as selected?

Hi,
This add-on must selected the menu based on the current url, so  set the LI

I like the idea, but I'm not sure setMenu is an appropriate name. Also, why is nbRecursion set to 3 by default? Shouldn't the loop simply continue till the start of url?

I've added this add-on in the latest version, named it "currentItem" though :)
http://mmenu.frebsite.nl/documentation/addons/current-item.html

authors: FrDH anthHugo