text:
ignore selinux errors from ksmtuned

Signed-off-by: Patrick Donnelly pdonnell@redhat.com

i ran into this issue as well: https://pulpito.ceph.com/kchai-2020-07-18_13:35:09-rados-wip-kefu-testing-2020-07-18-1927-distro-basic-smithi/5237529/

https://tracker.ceph.com/issues/46300

authors: badone batrick tchaikov

repo: ceph/teuthology


text:
[terra-slide-panel] side content z-index

Bug Report
Description
While scrolling down the  slide panel in powerchart ,  the title header provided from workflow component is overlapped by the side content of slide panel so using powerchart debugger tools we can see the zIndex of the side content of slide panel is greater than workflow title header . I have tried decreasing the zIndex of the side content using query selector , it works only in gaia server .
Steps to Reproduce

Open Powerchart in deveng domain
Search for the graph, overview  patient
Select the Pregnancy Workflow tab in the toolbar
Look for Add pregnancy cloud component
click on the slide panel

Additional Context / Screenshots
Expected Behavior

Side content of slide panel should not overlap the title header
Possible Solution

lowering  the z-index of side content
Environment

Component Name and Version: Add Pregnancy Cloud Component
Browser Name and Version:
Node/npm Version: node 8.9.2
Webpack Version:
Operating System and version (desktop or mobile): desktop

@ Mentions

This is an internal issue. Closing and will log something internally.

source: gharchive/issue

authors: ezargar ryanthemanuel

repo: cerner/terra-framework

license_type: permissive

license_source: github-api


text:
Critical points not rendered when using the Timeline component

Bug Report
Description

When using criticality in a dataset with the Timeline component, the critical highlight is not rendered.
Graphs affected

[ ]  Bar graph
[ ]  Bubble graph
[ ]  Gantt chart
[ ]  Line graph
[ ]  Paired result
[ ]  Pie chart
[ ]  Scatter plot
[x]  Timeline

Steps to Reproduce

Create a timeline graph using the React component
Add criticality to the datasets
the critical highlight svg is not renderd

Link to CodeSandbox
Use this template to reproduce the behavior.
Additional Context / Screenshots

Expected Behavior

Possible Solution

Environment

Component Name and Version:
Browser Name and Version:
Node/npm Version: [e.g. Node 8/npm 5]
Webpack Version:
Operating System and version (desktop or mobile):

@ Mentions

Closing this and moving to #137

repo: cerner/terra-graphs


text:
venafi: cabundle field example

We can't get a venafi issuer to connect to venafi because the ca bundle is not parsed correclty.
We have the certificate in pem format, it looks like:
----- BEGIN CERTIFICATE ---
...
...
---- END CERTIFICATE ---

how do we pass this to the venafi issuer?
Can we get an example, may be added to the doc?
The doc seems to suggest that we have to encode this pem file with base64 and pass the result as a single line array of bytes. We tried that (removing the \n) and it didn't work.
We tried passing the already base64 encoded content of the pem file (the content between BEGIN and END) as a single line array (removing the \n) and it didn't work.
We tried passing the entire file, as a single line and it didn't work.
/kind bug

we keep getting this error: Failed to parse PEM trust bundle, which seems to be coming from here: https://github.com/Venafi/vcert/blob/756b43677ddb75cca676b33d8504db2aa3578dd6/client.go#L41

I'm also stuck on this.
Does it want the actual plain-text contents? For example,
caBundle: |
-----BEGIN blah blah-----
adgasdfsaf
------END blah blah------
Does it want it as a single line?
caBundle: -----BEGIN blah blah ------xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx------END blah blah-----
Does it want the whole thing encoded again?
caBundle: AB7239C3029BCE12387
It's unclear and I can't get anything to work..

I'm also stuck on this.
Does it want the actual plain-text contents? For example,
caBundle: |
-----BEGIN blah blah-----
adgasdfsaf
------END blah blah------
Does it want it as a single line?
caBundle: -----BEGIN blah blah ------xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx------END blah blah-----
Does it want the whole thing encoded again?
caBundle: AB7239C3029BCE12387
It's unclear and I can't get anything to work..

Figured I'd post as this did come back up on slack.
You want it on one line in base64 format. Eg this is from k explain issuer.spec.venafi.tpp
  caBundle	<string>
    Base64-encoded bundle of PEM CAs which will be used to validate the
    certificate
    chain presented by the TPP server. Only used if using HTTPS; ignored for
    HTTP.
    If undefined, the certificate bundle in the cert-manager controller
    container
    is used to validate the chain.

So you want to take your CA cert:
cat myca.crt | base64

Take that output and put it in your issuer:
spec:
  venafi:
    caBundle: <String from above>

Please note to ensure you encode it with 1 line output. On linux I think that's base64 -w0 but on mac it does this by default.

authors: hawksight raffaelespazzoli techgnosis

repo: cert-manager/cert-manager

license_source: bigquery


text:
Use a temporary go.work file when running go-licenses

Without a go.work file, go-licenses is unable to discover the LICENSE file and dependencies of github.com/cert-manager/cert-manager when it is pointed at ./cmd/controller, for example.
It does not follow the replace statements in the go.mod file of each of the binaries.
Adding a go.work file allows it to work,  and presumably a go.work file was present when the current LICENSES files were generated and committed to the repository...or they were generated and committed before the introduction of the per-binary go.mod files.
The make verify-licenses target has been succeeding in CI thus far because the _bin/scratch/LATEST-LICENSES* files -- against which it compares the checked in LICENSES files -- are also cached in CI and are only updated when the respective go.mod or go.sum file changes. These must have been generated in the presence of a go.work file...presumably before it was removed in #5935.
In #5962 I made a change to cmd/controller/go.mod which resulted in the regeneration of _bin/scratch/LATEST-LICENSES-controller in the absence of a go.work file and make verify-licenses then failed.
So since we have decided not to commit a go.work file to the repository, I've made a change here to create a go.work file in a non-standard temporary location and use it only when running go-licenses.
An example of this working:

https://prow.build-infra.jetstack.net/view/gs/jetstack-logs/pr-logs/pull/cert-manager_cert-manager/5962/pull-cert-manager-master-license/1649054110504194048 after I rebased #5962 on top of this PR
https://prow.build-infra.jetstack.net/view/gs/jetstack-logs/pr-logs/pull/cert-manager_cert-manager/5969/pull-cert-manager-master-license/1649056433360080896 in #5969 which is based on this PR

Fixes: #5964

#5964

/kind bug
NONE

/test pull-cert-manager-master-license

source: gharchive/pull-request


text:
using Vault Issuer

The demo works using a self-signed issuer on istio 1.8.2, when I attempt to use a vault issuer (using helm values to target the vault issuer) I can see that the cert is signed successfully:
❯ kubectl get cert -n istio-system
NAME     READY   SECRET       AGE
istiod   True    istiod-tls   9m32s

The istio-ca-root-cert configmap is also populated correctly and propagated to all the namespaces , so far so good, no errors reported on istiod nor istio-csr.
I then deploy two fresh workloads  httpbin and sleep with PeerAuthentication set to STRICT to enforce mTLS. The workloads come up fine; however when trying to curl between the workloads, I'm getting the following error:
❯ kubectl exec -it sleep-f8cbf5b76-7drgg -c sleep -- curl httpbin:8000/headers
upstream connect error or disconnect/reset before headers. reset reason: connection failure, transport failure reason: TLS error: 268435581:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED

Not sure if this setup is supported: I currently have a private root CA hosted in AWS (acm-pca) and the intermediate CA in the chain deployed via Vault's pki engine.
The intent is to ensure that the intermediate CA and associated key never leaves vault.
any suggestions?
Thanks

Hey @adnankobir, apologies this isn't working right quite yet.
Would you be able to verify a couple things?

The propagated root CA is the same CA you are expecting (the root CA). You can set this manually with certificate.rootCA
Istiod has picked up and mounted its cert from the secret, and it also has its CA Server disabled. There should be some indication in the istiod logs of what its CA is.
Checking the envoy logs that they too are using the same CA that you are expecting, and they are  requesting certs from istio-csr
Check the logs in istio-csr, to make sure it is receiving requests from envoys in the cluster

thanks for the prompt response @JoshVanL
I've verified the following (sensitive and unnecessary info redacted):

The propagated root CA is the same CA you are expecting

The propagated root CA (intermediate CA in Vault) looks correct:
(I'm uncertain if we require the root-ca from ACM-PCA here or both/full chain)
kubectl get cm istio-ca-root-cert -o jsonpath="{.data['root-cert\.pem']}" | step certificate inspect -

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 68566204885263584472517345669233231743 (0x33955ee740f4bafe9f963b7b151bc77f)
    Signature Algorithm: SHA512-RSA
        Issuer: O=redacted Inc.,ST=New York,CN=redacted.works,L=New York
        Validity
            Not Before: Feb 1 15:55:15 2021 UTC
            Not After : Feb 1 16:55:15 2026 UTC
        Subject: ST=New York,L=New York,O=redacted.,CN=v7-test-use1.redacted.works
        Subject Public Key Info:
            Public Key Algorithm: RSA
                Public-Key: (2048 bit)
                Modulus:
                    ...
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:v7-test-use1.redacted.works, DNS:vault-v7-test-use1, DNS:vault-v7-test-use1.vault, DNS:vault-v7-test-use1.vault.svc
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            ...
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            ...

Istiod has picked up and mounted its cert from the secret, and it also has its CA Server disabled

Istiod has in-fact picked up the correct cert from istiod-tls secret and we can see the cert and its chain to Intermediate CA in Vault:
2021-02-02T13:37:46.234341Z     info    Istiod certificates are reloaded
2021-02-02T13:37:46.234785Z     info    x509 cert [0] - Issuer: "CN=v7-test-use1.redacted.works,O=redacted,L=New York,ST=New York", Subject: "", SN: 3af9313443a2a2de75c177625d5918287ef72716, NotBefore: "2021-02-02T13:36:38Z", NotAfter: "2021-02-03T13:37:08Z"

2021-02-02T13:37:46.234929Z     info    x509 cert [1] - Issuer: "CN=redacted.works,O=redacted,L=New York,ST=New York", Subject: "CN=v7-test-use1.redacted.works,O=redacted,L=New York,ST=New York", SN: 33955ee740f4bafe9f963b7b151bc77f, NotBefore: "2021-02-01T15:55:15Z", NotAfter: "2026-02-01T16:55:15Z"

The CA server is disabled in istiod:
        - name: ENABLE_CA_SERVER
          value: "false"

Whats interesting of note here is that istio-operator overlay for ca-root-cert defines secretName: istiod-tls here is ignored/is invalid and we are left with:
     - configMap:
          defaultMode: 420
          name: istio-ca-root-cert
        name: ca-root-cert

Checking the envoy logs that they too are using the same CA that you are expecting, and they are requesting certs from istio-csr

The envoy proxy on the sleep container does appear to be requesting certs from istio-csr and the CA serial matches the intermediate CA in vault:
2021-02-02T18:44:52.902086Z	info	citadelclient	Citadel client using custom root: cert-manager-istio-csr.cert-manager.svc:443

The CA serial matches that of root-cert.pem in cm istio-ca-root-cert:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 68566204885263584472517345669233231743 (0x33955ee740f4bafe9f963b7b151bc77f)
    Signature Algorithm: SHA512-RSA
        Issuer: O=redacted,ST=New York,CN=redacted.works,L=New York
        Validity
            Not Before: Feb 1 15:55:15 2021 UTC
            Not After : Feb 1 16:55:15 2026 UTC
        Subject: ST=New York,L=New York,O=redacted.,CN=v7-test-use1.redacted.works
        ...
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:v7-test-use1.redacted.works, DNS:vault-v7-test-use1, DNS:vault-v7-test-use1.vault, DNS:vault-v7-test-use1.vault.svc

            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign

Check the logs in istio-csr, to make sure it is receiving requests from envoys in the cluster

There doesn't seem to be any logs indicating that it is serving requests from envoys in the cluster (i've tested this by deleting the sleep pod and tailing the logs), I've got the following logs from the container:
I0202 01:37:12.356930       1 controller.go:206] ca-root-controller/controller/namespace "msg"="Starting workers" "configmap-name"="istio-ca-root-cert" "reconciler group"="" "reconciler kind"="Namespace" "worker count"=1
I0202 17:37:12.182980       1 tls.go:116] serving_certificate "msg"="renewing serving certificate"
I0202 17:37:12.597222       1 tls.go:230] serving_certificate "msg"="created serving CertificateRequest" "name"="cert-manager-istio-csr-22hq7" "namespace"="istio-system"
I0202 17:37:13.113882       1 tls.go:238] serving_certificate "msg"="serving CertificateRequest ready" "name"="cert-manager-istio-csr-22hq7" "namespace"="istio-system"
I0202 17:37:13.115853       1 tls.go:148] serving_certificate "msg"="fetched new serving certificate"
I0202 17:37:13.115890       1 tls.go:102] serving_certificate "msg"="renewing serving certificate"  "renewal-time"=57600000000000
2021-02-02T17:37:13.114573Z	info	spiffe	Added 1 certs to trust domain cluster.local in peer cert verifier
I0202 17:37:13.168318       1 tls.go:248] serving_certificate "msg"="deleted serving CertificateRequest" "name"="cert-manager-istio-csr-22hq7" "namespace"="istio-system"

Finally to add a bit more context I performed an openssl s_client connect to httpbin from sleep:
❯ kubectl exec -it sleep-f8cbf5b76-gtn4s -c istio-proxy -- openssl s_client -showcerts -connect httpbin:8000
CONNECTED(00000005)
depth=1 ST = New York, L = New York, O = redacted, CN = v7-test-use1.redacted.works
verify error:num=20:unable to get local issuer certificate
---
Certificate chain
 0 s:
   i:ST = New York, L = New York, O = redacted, CN = v7-test-use1.redacted.works
-----BEGIN CERTIFICATE-----
redacted
-----END CERTIFICATE-----
 1 s:ST = New York, L = New York, O = redacted, CN = v7-test-use1.redacted.works
   i:O = redacted, ST = New York, CN = redacted.works, L = New York
-----BEGIN CERTIFICATE-----
redacted
-----END CERTIFICATE-----
 2 s:ST = New York, L = New York, O = redacted., CN = v7-test-use1.redacted.works
   i:O = redacted, ST = New York, CN = redacted.works, L = New York
-----BEGIN CERTIFICATE-----
redacted
-----END CERTIFICATE-----
---
Server certificate
subject=

issuer=ST = New York, L = New York, O = redacted, CN = v7-test-use1.redacted.works

---
Acceptable client certificate CA names
ST = New York, L = New York, O = redacted, CN = v7-test-use1.redacted.works
Requested Signature Algorithms: ECDSA+SHA256:RSA-PSS+SHA256:RSA+SHA256:ECDSA+SHA384:RSA-PSS+SHA384:RSA+SHA384:RSA-PSS+SHA512:RSA+SHA512:RSA+SHA1
Shared Requested Signature Algorithms: ECDSA+SHA256:RSA-PSS+SHA256:RSA+SHA256:ECDSA+SHA384:RSA-PSS+SHA384:RSA+SHA384:RSA-PSS+SHA512:RSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 4721 bytes and written 419 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 20 (unable to get local issuer certificate)
---
139814336737728:error:1409445C:SSL routines:ssl3_read_bytes:tlsv13 alert certificate required:../ssl/record/rec_layer_s3.c:1528:SSL alert number 116
command terminated with exit code 1

Note here that I'm unsure of: cert 1 and 2 are identical
My hunch is that there is an issue with the cert chain or the KeyUsage fields
Thanks again!

Thanks for all the detailed info @adnankobir !
I agree that it looks suspicious that it is duplicating the certificate chain here, and could be causing the issue.

(I'm uncertain if we require the root-ca from ACM-PCA here or both/full chain)

Ideally it should be the root certificate that should be populated here, and the intermediate is kept in the chain when making connections. I wonder if overriding the propagating certificate to the root CA would solve the issue- we likely won't have this duplication in the chain I believe.
If you can increase the log level of istio-csr it should give you some more info about what it is signing (agent.logLevel --v=3). You can also set the flag so that CertificateRequests are preserved, which should give us a bit more info on what is actually getting signed and passed to envoys (certificate.preserveCertificateRequests: true --preserve-certificate-requests=true). The CertificateRequest resources will also have a label that matches which identity the CR is for.

I believe this issue is related to https://github.com/jetstack/cert-manager/issues/2166. I've gone ahead and passed both the root and intermediate to istio-csr via certificate. rootCA but upon inspection of the CertificateRequest for the workloads, I can see in the status field that there is only a single CA, at this point I'm not sure if this is feasible until the vault-issuer can successfully return both the root and intermediate in ca.crt

now just patiently waiting for a stable cert-manager v1.2.0

authors: JoshVanL adnankobir

repo: cert-manager/istio-csr


text:
Fix #31: Překlady projektů do angličtiny

Přidané překlady projektů do angličtiny

@zzen jasně ověřím ...

Nebylo by dobrý nechat názvy projektů česky? Za mě určitě.

OK, dořeším ty názvy projektů později. Díky za příspěvek!

repo: cesko-digital/web


text:
Add functionality to create Items

Create the minimum viable implementation for creating a new item:

[x] create form to input data
[x] create id from uuID
[x] safeMint nft on chain with safeMint(activeAcc, uuId)
[x] create qr code with URL to viewpassport page

Functionality added as described above. The uuID is actually a random generated 256 integer.

repo: cetceeve/ItemBlocks


text:
Update dependencies

Update dependencies

update QT to 5.9.6
update ZeroMQ to v4.2.5

add additionaly a patch to disable pthread_set_name_np

update native mac alias to v2.0.7
update biplist* to v1.0.3
update miniupnpc to v2.0.20180203
update expat to v2.2.5

This pull request is now managed with CodeReviewHub. Refresh.

repo: cevap/ion

license: mit


text:
ceylon.collection.HashSet.add() adds duplicate element into HashSet

In some rare cases, ceylon.collection.HashSet.add() adds duplicate element into HashSet
To reproduce the problem:
module hashSetAddProblem "1.0.0" {import ceylon.collection "1.1.0";}
...
import ceylon.collection {HashSet}

shared void hashSetAddProblem() {

    print("Ceylon ``language.version``");
    print(runtime);
    print(operatingSystem);

    value hashSet = HashSet { "lo", "op", "pm", "mu", "ue", "ei", "is", "sv", "va", "aw", "wb", "bd", "ds" };
    print("hashSet before : ``hashSet``");

    // add("sv") should return false and refuse to add "sv" as it already exists in hashSet
    Boolean result = hashSet.add("sv");

    // but add("sv") returns true and adds "sv" string as duplicate into hashSet
    print("hashSet.add(sv) returns: ``result``");

    // hashSet now contains two "sv" strings
    print("hashSet after  : ``hashSet``");
}

The above program gives this output:
Ceylon 1.1.0
runtime [jvm / 1.7]
operating system [linux / 3.13.0-44-generic]
hashSet before : { lo, op, pm, mu, ue, ei, is, sv, va, aw, wb, bd, ds }
hashSet.add(sv) returns: true
hashSet after  : { lo, op, pm, mu, ue, ei, is, sv, va, aw, wb, bd, ds, sv }

The same happens on HotSpot Java 8 on Windows 8.1

So this is the output I get in 1.1.1:
Ceylon 1.1.1
runtime [jvm / 1.8]
operating system [mac / 10.10.1]
hashSet before : { lo, op, pm, mu, ue, ei, is, sv, va, aw, wb, bd, ds }
hashSet.add(sv) returns: false
hashSet after  : { lo, op, pm, mu, ue, ei, is, sv, va, aw, wb, bd, ds }

Yes, after swapping the imported version of ceylon.collection to 1.1.0, I could reproduce. So apparently this is a fixed bug.

authors: gavinking macgoran

repo: ceylon/ceylon-sdk


text:
ceylon.net.http.server equals() matcher appears broken

The equals() matcher from ceylon.net appears broken. It uses in instead of == for comparision.
Example code with equals & dependants copy-pasted from ceylon.net-1.2.1:
// <copy-pasted>
shared abstract class Matcher() {
    shared formal Boolean matches(String path);
    // ...
}

class Equals(String path)
    extends Matcher() {
    matches(String path)
        => path in this.path;
}

shared Matcher equals(String path) => Equals(path);
// </copy-pasted>

shared void run() {
    for (i in ["/", "/somepath", "/somepath/lol"]) {
        print("``i`` -> ``equals("/somepath").matches(i)``");
    }
}

Prints out:
/ -> true
/somepath -> true
/somepath/lol -> false

.. while expecting only the middle one to be true.

@matejonnet ?

Yup, bug.

authors: FroMage matejonnet xkr47


text:
Don’t access dynamic values with getters

Implements part of #6001. I’ll merge this in a few days unless someone objects.

Can one of the admins verify this patch? (see README)

authors: CeylonBuildBot lucaswerkmeister

repo: ceylon/ceylon


text:
Clarification that text-valued variables and attributes can be Unicode string or UTF-8 char arrays

See issue #141 for discussion of these changes.
Release checklist

[NA] Authors updated in cf-conventions.adoc? Add in two places: on line 3 and under .Additional Authors in About the authors.
[NA] Next version in cf-conventions.adoc up to date? Versioning inspired by SemVer.
[Y] history.adoc up to date?
[NA] Conformance document up to date?

This is a challenge! I did a bit more (unsatisfying" research into netcdf, string, and Unicode.
See my comment on #141, but I don't think this is ready to merge :-(

superseded by https://github.com/cf-convention/cf-conventions/pull/556

authors: ChrisBarker-NOAA JonathanGregory

repo: cf-convention/cf-conventions


text:
Extend Swarm job/deployment to include a broker and become operational

Purpose
Extend Swarm job/deployment to include a broker and become operational with CF.
Motivation
The current Swarm setup is basically only a Swarm without a broker and can't be used/integrated as such into CF, i.e. there are no means out-of-the-box to scale this bosh release horizontally by adding more Docker nodes (orchestrated by Swarm).
Proposal
Add broker support so that the swarm job/deployments can be used with CF.
Changes

Added broker and its configuration to the Swarm bosh-lite example (only)
Extensions and new properties to override defaults that need different values with Swarm
Split Docker nodes from Swarm/broker node; put Swarm and broker together on one node
Have 2 Docker nodes for demonstration purposes
Support usage of elastic IPs
Changes in monit returning only when started (broker, i.e. Unicorn and Swarm)

Note of caution
Changes were done, tested, and put to production only with our own cloud infrastructure which is neither of the supported ones. However, the bosh-lite setup was used to develop the changes and tested. If interested, details can be discussed offline about how e.g. the AWS deployment example could be tweaked. In other words, only the bosh-lite Swarm deployment example includes a broker.
CC
@frodenas @holgerkoser

Thanks @vlerenc! Instead of modifying the actual swarm examples, I have create a new ones targeted specifically to the swam+broker combo, as some users will still prefer to deploy a swarm cluster without the broker.
Commits that override this PR are https://github.com/cf-platform-eng/docker-boshrelease/commit/e1df1e60388b8cc85c0cca98c7969cd3e870cf56 & https://github.com/cf-platform-eng/docker-boshrelease/commit/14cd165c76e9c6f61d85925feeef9fa199141844.

authors: frodenas vlerenc

repo: cf-platform-eng/docker-boshrelease


text:
Remove all CFPB branding from Capital Framework codebase

Goal 1 of #155.

[x] Capital Framework should have sensible, non-CFPB defaults for color and font variables.
[x] All CFPB branding should be applied to a Capital Framework project by overriding the default variables using Less or CSS. (See cf-theme-overrides.)

CFPB's color palette has already been removed from CF, only the fonts remain.

Option 1: Simply delete this @import statement. The font mixins will then default to Arial if AvenirNextLTW01 isn't present.
Option 2: Remove both the @import statement AND AvenirNextLTW01 from the mixins. This solution is a little cleaner because non-CFPB people will never need AvenirNextLTW01.

The simpler option 1 is fine by me but if anyone prefers option 2 (or another solution), do speak up.

Agreed that the @import removal should definitely happen, so people aren't making four requests that will be blocked on every page load. We'll have to make sure our projects manually add this in to their cf-overrides.less file, though.
There's a tertiary goal of making it easier for people to use other typefaces, too. This is probably as simple as creating variables for serif and sans-serif font stacks (at different weights), and putting those variables in the mixins. This way, people can just change the font-stack variables and have it propagate everywhere.

Great change. This puts us closer to making CF more extensible for non-CFPB branded projects. :boom: :rocket:

Nice work @KimberlyMunoz! Do you think we're ready to check off the first checkbox above?
@Scotchester How important is the tertiary goal you mention above? Do you view it as a 1.0 requirement?

I just have to tag new releases. I hope to get those in today!

:+1:

@contolini Nah, I wouldn't say it's a 1.0 requirement.

Quick PRs to update:
https://github.com/cfpb/cf-component-demo/pull/39
https://github.com/cfpb/generator-cf/pull/79
https://github.com/cfpb/cf-core/pull/38

https://github.com/cfpb/generator-cf/pull/79 is merged so it looks like we're done here. :smiley:

authors: KimberlyMunoz Scotchester ascott1 contolini

repo: cfpb/capital-framework


text:
Higher table title character count?

There appears to be a 20-character limit on table titles, which I don't think is enough. Maybe 100?
Please see the Your Money, Your Goals page in Wagtail.

To Laura's point, I'm kind of for removing character limits altogether for tables. Here's a table I'm trying to input into wagtail. http://www.consumerfinance.gov/guidance/petitions-to-modify-or-set-aside/. The first cell character limits are too low for text and for hyperlinks.

I'm trying to see the bug in wagtail itself, but I can't find the table in Your Money, Your Goals. I think the BEWDs can easily increase the character limit on table titles for now though!

There are no longer tables on Your Money, Your Goals because we made a content/ux decision to convert the information to browse pages instead of putting it all into tables on this sublanding page.
As for the character limits in tables, is this linked to #1355?

No, that's a different front-end issue.
On Fri, Jan 29, 2016, 11:22 AM Jessica Schafer notifications@github.com
wrote:

There are no longer tables on Your Money, Your Goals because we made a
content/ux decision to convert the information to browse pages instead of
putting it all into tables on this sublanding page.
As for the character limits in tables, is this linked to #1355
https://github.com/cfpb/cfgov-refresh/issues/1355?
—
Reply to this email directly or view it on GitHub
https://github.com/cfpb/cfgov-refresh/issues/1354#issuecomment-176843763
.

ok cool, thanks for the carification @KimberlyMunoz.
@kave this is a higher priority issue now as content has been running into it in a couple of places. One example of a more recent page where they've run into the problem at the bottom of /policy-compliance/small-business-review-panels/, but you can also look at the content board on Jira, where they've flagged all the pages where they've run into problems.

@schaferjh created a fix for this to be reviewed on the next push to refresh this afternoon
https://github.com/cfpb/cfgov-refresh/pull/1418

authors: KimberlyMunoz Schlachtmeyer kave schaferjh tnferrell

repo: cfpb/cfgov-refresh


text:
Migrate custom features to AnswerPage answer field rich text editor

Migrate existing customizations (tip formatter, HTML editor) from the answer rich text field on the Answer model to the analogous field on the AnswerPage.
Changes

Remove URL check from ask_cfpb_tips and html_editor plugins
Register tip formatter and html editor plugins as features
Apply tip formatter and html editor features to answer rich text editor on AnswerPage
Migrate help text from Answer field to AnswerPage field

Testing

Check out branch
Run migration
Verify that tip formatting and HTML edit view are available on AnswerPage answer field rich text editor and work as expected

Screenshots

Notes

This should be a short-term fix to allow editors to edit tips and view answer content's HTML. In the longer term, we hope to remove the HTML edit view and handle tip creation via an answer StreamField.

Checklist

[ ] PR has an informative and human-readable title
[ ] Changes are limited to a single goal (no scope creep)
[ ] Code can be automatically merged (no conflicts)
[ ] Code follows the standards laid out in the CFPB development guidelines
[ ] Passes all existing automated tests
[ ] Any change in functionality is tested
[ ] New functions are documented (with a description, list of inputs, and expected output)
[ ] Placeholder code is flagged / future todos are captured in comments
[ ] Visually tested in supported browsers and devices (see checklist below :point_down:)
[ ] Project documentation has been updated
[ ] Reviewers requested with the Reviewers tool :arrow_right:

Testing checklist
Browsers

[ ] Chrome on desktop
[ ] Firefox
[ ] Safari on macOS
[ ] Edge
[ ] Internet Explorer 9, 10, and 11
[ ] Safari on iOS
[ ] Chrome on Android

Accessibility

[ ] Keyboard friendly
[ ] Screen reader friendly

Other

[ ] Is useable without CSS
[ ] Is useable without JS
[ ] Flexible from small to large screens
[ ] No linting errors or warnings
[ ] JavaScript tests are passing

This works for me locally and is a great near-term solution for editors.
I noticed one glitch in functionality, at least in Chrome and Firefox. After styling a tip, and following the help_text advice of clicking pencil again to remove it, the <aside> tags are not removed. Instead, they double up.
To avoid becoming a blocker for editing, if tip removal code is troublesome, I'd vote to push this PR out for the interim, perhaps with new help_text to advise removing the  tags with the Edit HTML button.

@higginsw Thanks for catching the tip removal issue! I updated the removal code and it seems to be working for me again. I also updated the help text to reflect that the content needs to be re-selected before removal.


text:
Path to 1.0 for this guide

Talking to @virtix, he asked me to consider what "1.0" looks like for this guide. Honestly, I think we're pretty close, but here's what I'd like to see:

A testing guide @imuchnik and @contolini have been doing  a lot of work to guide us towards a culture of testing. @anselmbradford has done a lot of research in visual/CSS testing. Let's document that!
Revisit the CSS/Less guide as it's basically my fork of another guide. What are we missing? Does it represent how we work?
Some recommended libraries This might be treading in dangerous waters, but it also might be nice to say "in general we use _ for charts" etc.

What else could or should be included here?

I'd like to complete the Schema guide, but I don't know when I'll have the time so that can definitely wait till later if no one objects.

I'll draft something up for the testing section in the next couple days.

@vitrix recommended that we document project structure. generator-cf spits that out, so it may be as simple as writing that down.

What is there to document about the project structure? The directories and files it generates?

Yeah, I think that's what he meant

My thought is that articulating the convention of the structure would be helpful; e.g.:
|-- app/
|----- assets/
|----------- img/
|----------- css/
|----------- js/
|---- libs/
|---- dist/
|---- test/
|------- fixtures/
|--------------- data.json

Thanks for clarifying @virtix!
For transparency, the team met earlier in the week and discussed the following:

@Scotchester is going to do a once over of the CSS style guide
We created issue #46 to catalog the individual libraries we use

I think that gets us close to 1.0 and as a team we can focus on moving CF along.

Since this is a leaving, breathing document, do we need to concern ourselves with 1.0? If so, do you think it's there yet? If not, what else should we accomplish first?

We've tagged this as 1.0 and I think it hits the initial goals we were aiming for. We're going to review this all with @virtix today for feedback, but we can safely close this issue.

authors: ascott1 contolini jimmynotjim virtix

repo: cfpb/front-end


text:
Tech preview

adds in faq and tech preview pages
updates for-filers pages with new links
updates pdfs to be the Filing Instruction Guide (FIG)

@wpears - can you take a look?

Looks good overall. Can you add a line-height: 1.375em to p and li elements in the for-filers, faq, and tech-preview pages?
As an aside, navigation doesn't really function since links generally point to pretty urls like <root>/for-filers and the connect server doesn't auto-route this to <base dir>/for-filers.html. This could be easily done with middleware, but I was wondering if there is a preexisting solution that I missed? Not germane to this PR, but thought I'd mention it ^^;

Should be good to go.
Yeah, the nav has been that way, just don't think anyone ever got around to doing anything about it. 😉

@awolfe76 Merge away

repo: cfpb/hmda-explorer


text:
Breadcrumbs

This PR updates cf-icons and updates the breadcrumbs to the pattern used in CF with the content and content_wrapper classes. This takes care of most of the pages except for the journey pages and loan-options type pages.
Preview this PR without the whitespace changes
/explore-rates/

Can you review @virginiacc?

👍 Yay!!

authors: KimberlyMunoz stephanieosan

repo: cfpb/owning-a-home


text:
Add SBL Beta Platform details to Registration & Submission Programs & SBL Database page

As a user, I want a way to access the beta platform via the CFPB website, so that I can browse the CFPB website for beta platform link and beta platform instructions.
We'll need to update these pages with the link to the beta platform:
https://www.consumerfinance.gov/data-research/small-business-lending/
https://www.consumerfinance.gov/compliance/registration-and-submission-programs/

@chynnakeys, for https://www.consumerfinance.gov/compliance/registration-and-submission-programs/, I propose the following language. @natalia-fitzgerald, please let me know your thoughts.  Not sure, where in the page it should go since the page sorta follows alphabetical order, but not entirely.
The beta for the Small Business Lending Data Filing Platform
The CFPB is pleased to announce the availability of the beta platform for the small business lending data collection rule pursuant to section 1071 of the Dodd-Frank Act. We invite the participation of financial institutions and their technology partners to test the beta platform and share feedback with the CFPB on their experience.
Getting started with the beta platform

Access the beta platform

@angelcardoz
For this one: https://www.consumerfinance.gov/compliance/registration-and-submission-programs/ do you think the heading should be more generic, something like:

Small business lending
Small business lending data collection
Or the name of the rule

For the link it could be:

Getting started with the beta platform
Access the beta for the Small Business Lending Filing Platform

@natalia-fitzgerald, great! Here's where we landed.
Small Business Lending
The CFPB’s rule on small business lending data requires covered financial institutions and voluntary reporters to maintain, report, and publicly disclose information about small business lending.
The CFPB is pleased to announce the availability of the beta platform for the small business lending data collection rule pursuant to section 1071 of the Dodd-Frank Act. We invite the participation of financial institutions and their technology partners to test the beta platform and share feedback with the CFPB on their experience.
Getting started with the beta platform

Access the beta for the Small Business Lending Filing Platform

@natalia-fitzgerald, for https://www.consumerfinance.gov/data-research/small-business-lending/, I propose similar language, except for the header. For the header I propose, "Test the beta platform".  Also, we wouldn't include the first paragraph since that's describe at the top of the page. Thoughts?
Test the beta platform
The CFPB is pleased to announce the availability of the beta platform for the small business lending data collection rule pursuant to section 1071 of the Dodd-Frank Act. We invite the participation of financial institutions and their technology partners to test the beta platform and share feedback with the CFPB on their experience.
Getting started with the beta platform
Access the beta for the Small Business Lending Filing Platform

@chynnakeys, for https://www.consumerfinance.gov/data-research/small-business-lending/, let's do the following. Space was more limited so we are proposing abbreviated content.
Test the beta platform
We invite the participation of financial institutions and their technology partners to test the beta platform and share feedback with the CFPB on their experience.
Learn to access the beta platform
Access the beta platform
For placement, I'm thinking it should go where "Resources for filers" currently lives or where " Download the data" is. Maybe we should talk about it.

@angelcardoz
I reviewed the two sets of content and I have some additional recommendations to bring them into further consistency with one another and with the other content on the specific pages:

If you want to add the "pursuant to section 1071 of the Dodd-Frank Act" language I think it fits better in the first paragraph. That way we can spell out the name of the beta platform in the second paragraph and then simplify the link text to be consistent with what we are doing on the other page.

I think the revised language here reads a lot more clearly

@angelcardoz
As mentioned a little earlier, I am concerned about linking to the PDF for instructions on using the beta platform.
Instead of linking to the "Getting started with the beta platform" PDF (ideally we wouldn't link to a PDF of a Word document from the site) can we instead link to the beta platform and the test files repo?
The "Getting started" PDF contains the following information:

How to get an LEI

This is content that we include on the first page of the platform. It will be important for our testing to see whether this content is helpful for a user and gives them the information they need to get an LEI.
There is some additional info related to LEI and the beta platform versus the production release but if this is important/essential maybe it should live on the homepage of the beta platform

Test files for beta testing

The PDF includes a link to the test files repository on GitHub. I have heard that non-developers are not familiar with GitHub but currently this is where users must go to access these files. If this is the case perhaps it would be better to link to it directly from the website?   https://github.com/cfpb/RegTech-test-files/tree/main/sbl/demo_files

Here's a way we could do this:

@chynnakeys @angelcardoz
Another thing to follow up on with the stakeholder for this page: https://www.consumerfinance.gov/compliance/registration-and-submission-programs/
What should the ordering be for the page - alphabetical or something else? In the absence of any logical ordering I would recommend alphabetical for the sake of our users.
Current ordering:

Alphabetical ordering:

If "Download test files" confuses users that land here: https://github.com/cfpb/RegTech-test-files/tree/main/sbl/demo_files we could instead word it as "Access test files"

If users are just going to another page, I think "Access test files" is better. "Download test files" suggests clicking the link initiates a download.

We are pleased to announce the availability of the beta Small Business Lending Data Filing Platform. Financial institutions and their technology partners are invited to test the beta platform and share feedback on their experience.

Could we change the first sentence to "The Small Business Lending Data Filing Platform is now available."? That reads a lot better than the current phrasing and brings the sentence structure in line with the second sentence.

@angelcardoz
Can we make one more content adjustment?
Current text: We are pleased to announce the availability of the beta Small Business Lending Data Filing Platform.
Suggested change (both "open" and "availability" have been cleared):

The beta for the Small Business Lending Data Filing Platform is now open.
The beta for the Small Business Lending Data Filing Platform is now available.

@angelcardoz @chynnakeys
Have we completed this story? I show that both pages are now live on cf.gov.

https://www.consumerfinance.gov/compliance/registration-and-submission-programs/

https://www.consumerfinance.gov/data-research/small-business-lending/

authors: angelcardoz chynnakeys dan-padgett natalia-fitzgerald

repo: cfpb/sbl-project


text:
Update CFPB logo and references to BCFP

Sometime next week, we're anticipating the request to update the website to reflect our name change. Here's a PR for the necessary updates in this repo.
Changes

Logo and text references from CFPB to BCFP

Testing

Pull this branch
Ensure you're running on the latest master of cfgov-refresh, where the new logos have been added this afternoon
Click through the TDP pages locally and ensure that you're seeing the new logo and updated text everywhere

Checklist

[x] Changes are limited to a single goal (no scope creep)
[x] Code can be automatically merged (no conflicts)
[x] Code follows the standards laid out in the front end playbook
[ ] Passes all existing automated tests
[x] New functions include new tests
[x] New functions are documented (with a description, list of inputs, and expected output)
[x] Placeholder code is flagged
[x] Visually tested in supported browsers and devices
[x] Project documentation has been updated (including the "Unreleased" section of the CHANGELOG)

This can be merged, but not released until we get the word. Once we do get the word, it would be good if we can release within an hour or two.

repo: cfpb/teachers-digital-platform


text:
Fixed not using hidden_activation param

self.hidden_activation was not  properly being set to hidden_activation

Thank you for this and my apologies for overlooking it until now!

authors: AnthonyPerez cgpotts


text:
Update quickstart guide to include swift package manager command

I noticed that quickstart guide does not mention that users need to run swift package resolveprior to running bazel mod tidy.

@adincebic Thanks for the PR. Can you run bazel run //:tidy on the repo? It will update the markdown TOC and ensure everything is up-to-date.

@adincebic Thanks for the PR. Can you run bazel run //:tidy on the repo? It will update the markdown TOC and ensure everything is up-to-date.

Done.

authors: adincebic cgrindel


text:
🛑 homepage is down

In ec6d376, homepage (https://ch7aki.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: homepage is back up in 2022449 after 6 minutes.

license: MIT


text:
🛑 Enchanted Vacations is down

In c584e12, Enchanted Vacations (https://yourenchantingvacation.com) was down:

HTTP code: 521
Response time: 174 ms

Resolved: Enchanted Vacations is back up in 5e2f9a0 after 16 minutes.

repo: chadburrus/upptime


text:
🛑 Personal is down

In f4c4571, Personal (https://chadburrus.com) was down:

HTTP code: 521
Response time: 167 ms

Resolved: Personal is back up in 8e25682 after 17 minutes.


text:
Redudant declaration in cached_layer.py

In chafan_core/app/cached_layer.py, the variable 'SUBMISSIONS_FOR_USER_CACHE_KEY' is declared twice at line 45 and 50.
It should be safe to delete one of them

Feel free to open a PR to delete :)

Fixed this issue in PR #2

authors: izgzhen xiaolzha

repo: chafan-dev/chafan-core


text:
typo: str should be s

Description
type: str should be s
Designs
Notes to reviewers

thx


text:
doc: Add experimental warning in docstring

Currently, users cannot tell if a feature is experimental until they use it.

Question:
L.LayerNormalization emits experimental warning, but F.layer_normalization does not. Shouldn't it emit, too?

Is it possible to check if experimental features have this warning?

I think it's difficult.
To check whether experimental warning is emitted, we need to actually run the code (thus using unit test).
But there's no way to automatically check docstrings from unittest.

OK, LGTM

authors: niboshi unnonouno

repo: chainer/chainer


text:
Simplify F.where test

Simplifies test_where using testing.FunctionTestCase
Solves part of issue #6071

LGTM. Jenkins, test this please.

Jenkins CI test (for commit a8822ebed37b7dbf8634dfa45ebbf8753784e854, target branch master) failed with status FAILURE.

Jenkins, test this please.

Jenkins CI test (for commit 4e4f46c47fdb9045f758f1a81d838e19ec12bb21, target branch master) failed with status FAILURE.

Jenkins issue unrelated. Merging.

authors: Crissman chainer-ci ishanrai05


text:
Revert "Add chainerx.fmod"

Reverts chainer/chainer#7624

pfnCI, test this please.

Jenkins CI test (for commit 5ffdf5474b8b55c0864e97a073bd3c32605da63a, target branch master) failed with status FAILURE.

authors: asi1024 chainer-ci take-cheeze


text:
fix: support build.arch in var transforms

Previously this failed with
applying variable substitutions: variable build.arch not defined

This wasn't necessary after all: https://github.com/wolfi-dev/os/pull/23225

repo: chainguard-dev/melange


text:
kubectl image bug with bash: applet not found

Which image/versions are related to this issue/feature request?
image version: latest@sha256:2e570b2d17bdcc9e21f4ab791f3e6085af29df479e49a200ea7104899d339434
Issue/Feature description
the command to test
docker run -it --rm --entrypoint bash cgr.dev/chainguard/kubectl:latest@sha256:2e570b2d17bdcc9e21f4ab791f3e6085af29df479e49a200ea7104899d339434

got the following error
bash: applet not found

sh works fine though.

@tuananh this is WAI by the looks of the config.  Do you think the busybox shell is not enough for the likely usecases?

In my case, sh is enough but why was a bash symlink was created in the first place?

@kaniini

@dlorenc was this fixed by the busybox-full package now being available? Should we switch to use that so bash is provided?

No, but @deitch is working on another fix here to only create the correct symlinks

This merged in 3 days ago via this. However, it only works if busybox is of a version that includes /etc/busybox-paths.d/.
The issue highlighted here is two-fold:

it is trying to execute bash, which does not exist on the image
It should get "no such file", as /bin/bash should not exist.

busybox does not appear to include bash. So executing bash never should work. However, if that is the case, then the symlink should not exist, rather than having the applet: not found error. That, specifically, is what the fix linked to above addresses.

It sounds like this is working as intended; busybox does not provide bash.
There are improvements we can make to the error message but fundamentally this shouldn't work. Is that right?

authors: deitch dlorenc imjasonh patflynn tuananh

repo: chainguard-images/images


text:
xUnkown not found in logs

When running the PoC the external class loaded (xUnknown.class) from the http server (that the ldap server gives a reference to) doesn't show up as [MODIFIED] or [NOT WHITELISTED] in the logs.
Maybe something to do with "factory"-something something in ldap reference.

@LogFlames
Run the following commands to create the index

JDK: java -jar ~/Desktop/chains/sbom.exe/classfile-fingerprint/target/classfile-fingerprint-0.12.1-SNAPSHOT.jar jdk -o /home/aman/Desktop/chains/log4shell-poc/client/src/main/resources/log4shell.jsonl
Supply chain java -jar ~/Desktop/chains/sbom.exe/classfile-fingerprint/target/classfile-fingerprint-0.12.1-SNAPSHOT.jar supply-chain -i /home/aman/Desktop/chains/log4shell-poc/client/src/main/resources/log4shell.jsonl -s src/main/resources/bom.json

Then to monitor

java -javaagent:/home/aman/Desktop/chains/sbom.exe/watchdog-agent/target/watchdog-agent-0.12.1-SNAPSHOT.jar=sbom=/home/aman/Desktop/chains/log4shell-poc/client/src/main/resources/log4shell.jsonl,skipShutdown=true -jar target/log4shell-poc-1.0-SNAPSHOT.jar &> log.txt

We somehow fixed it.


text:
Breakpoint inconsistency

Description
I am styling a sidebar to make it responsive. On small screens, I want to hide the navigation, position the sidebar on the top of the screen and display a hamburguer button. I faced some inconsistencies in the way panda handles the breakpoints

Notice how on 1023px the sidebar is located in the top of the screen and the navigation is hidden. On 1024px the sidebar is located in the left and the navigation is still hidden. The navigation only appears again on 1025px.
I presume the inconsistency lies in the way panda handles lg: {} and hideBelow: "lg"
Link to Reproduction
https://github.com/FilipePfluck/Bookwise
Steps to reproduce

Clone the repository
Run npm run dev
Check the breakpoints
See the inconsistency

JS Framework
React (TS)
Panda CSS Version
0.15.1
Browser
No response
Operating System

[ ] macOS
[ ] Windows
[X] Linux

Additional Information
No response

related https://github.com/chakra-ui/panda/discussions/1523

+1 to this issue. I am facing the same issue.

authors: FilipePfluck Princesso astahmer

repo: chakra-ui/panda


text:
Checkbox setChecked method is not working

🐛 Bug report

I'm trying to set a checkbox checked via the api method setChecked, and nothing happens.
Checkbox works fine, if clicked normally, but i cannot do it programmatically.
💥 Steps to reproduce
Click on the test button to call the setChecked method
💻 Link to reproduction
CodeSandbox reproduction: https://codesandbox.io/s/condescending-moser-6g2hqy?file=/src/components/checkbox.vue
🧐 Expected behavior
I expected the checkbox to be checked when clicking the test button
🧭 Possible Solution

🌍 System information

Software
Version(s)

Zag Version
0.11.1

Browser
Chrome

Operating System
Fedora

📝 Additional information

Still an issue in 0.11.2. I have updated the codesandbox to reflect this.

I seem to have found the issue!
In this file, on line 31, it calls the DISPATCH.CHANGE where it should CHECKED.SET
https://github.com/chakra-ui/zag/blob/main/packages/machines/checkbox/src/checkbox.connect.ts
If i manually call CHECKED.SET in my component in Vue.js, the state changes as expected!

repo: chakra-ui/zag


text:
fix: ensure clicks outside of dialogs/tours are not passed on to components outside of active focus trap

Fixes https://github.com/chakra-ui/zag/issues/1720
📝 Description
Trying my hand at fixing this, as it's currently blocking our migration to ark dialogs.
⛳ Current behavior (updates)
allowOutsideClick: true tells focus-trap that clicks on valid elements outside of the focus trap is permitted. If you have a button or link directly underneath a dialog close trigger, both the close trigger and the underlying element would be clicked.
🚀 New behavior
Elements outside of the dialog/trigger are no longer triggered if a dialog/tour is open.
💣 Is this a breaking change (Yes/No):
I don't think so? I'm not really familiar with focus-trap, nor with the way zag uses it.
📝 Additional Information
I tried looking at the git history for both files, but there's not really any information as to why this was set in the first place.
Also: This option is still set for popovers. I'm not really sure if you'd want popovers to ignore all outside clicks. Maybe the modal prop should alter it?

I appreciate the attempt @Jonas-C.
I will take a look at this over the weekend. It might have to do with using pointerdown over click for interaction outside events.
A quick fix that comes to mind is to add onTouchEnd: e => e.preventDefault to the content element

Is there anything stopping us from simply doing preventDefault and stopPropagation for onTouchEnd? See https://github.com/chakra-ui/zag/commit/c7141e8b458c5ac95b39b38a3cd6dbd2987403c8

A quick fix that comes to mind is to add onTouchEnd: e => e.preventDefault to the content element

I don't think this solves the problem. I've tried adding it to Content, Positioner and Backdrop to no avail.

Got it. I pushed a fix for this in the main branch. This had to do with the event timings between pointerup and click on touch devices.
This issue should be gone now.

authors: Jonas-C segunadebayo


text:
Changelog

Please add an explicit CHANGELOG file, rather than relying on notes in the GitHub Releases page.
See: http://keepachangelog.com/

All of the breaking and functional changes made to Chalk are available via the Releases page on Github.

Exactly – I did mention that! ;-) The point of a changelog file, though, is that it is a standard location where this information can be found, and that it is independent from the Github website so that, for example, I can see the changes in a checked out copy of the repo on my computer or in a package I have npm installed.

We wouldn't include it in NPM anyway since it's not required for using the module. As well, the only official repository for Chalk is here on Github, which is clearly defined in the package.json. I am strongly against changelogs as they are way too easily desynchronized from the actual content of the repository and thus (to me) completely useless.
And not to mention annoying to maintain.

If you have a strong opinion I probably wont be able to change your mind, but I'll try... ;-)
Your point about being annoying to maintain and (as a result) too easily desynchronized from the actual content of the repository is exactly why a changelog file is better than the Github Releases page. The releases page is only updated once with each release. The changelog file is kept up top date with every commit, adding changes to the "Unreleased" section at the top which is then renamed to the current version number when a release is cut.
Even if it doesn't change your mind, I strongly encourage you to have a look at the information at http://keepachangelog.com/ which makes a very compelling case for keeping a changelog and explains clearly why it is important.

@caesar We diff the previous tag with the current tag to generate changes and document them appropriately. As well, we employ semantic versioning and we keep modules small to reduce broad-stroking changes to the code base. None of these things are really remedied by a changelog file.

Alright, you have clearly made up your mind, so I won't waste more of both of our time by trying to convince you otherwise.
While I'm here: thanks for this awesome project! 👍

https://github.com/zeit/release

authors: Qix- caesar leo

repo: chalk/chalk


text:
ref #39: url alias correct generating search source url (relative and…

… absolute urls)

Q
A

Branch
6.2.x

Bug fix?
yes

New feature?
no

BC breaks?
no

Deprecations?
no

Tests pass?
yes

Fixed issues
chameleon-system/chameleon-system#39

License
MIT

Thanks @pSpeck

authors: pSpeck umulmrum

repo: chameleon-system/chameleon-base


text:
Technical Documentation Improvments

Problems to solve for:
Examples:

Kyle from CZ Biohub: He really likes the MUI has coded examples and understanding what is leading to a component rendering. Component recipes could be very helpful here and enable engineers to copy and paste, play with the code, and then run it in their own local.
Sydney: Keeping the API for components the same as MUI, especially when it comes to data input formats, would alleviate a lot of headaches. Those APIs have been developed and tested by hundreds of people, and a lot of devs on our team already know them well.
If it is necessary to change the API, please please please provide full working code vignettes for each use case, instead of just . Showing the full import path, how the different components are meant to fit together, etc., in a block that I can copy and paste like in the MUI docs would be a HUGE HUGE HUGE speedup.

What to do:
Right now there is a delay between when the code is updated and zeroheight is updated. Should we create a release checklist to have updated zeroheight links?

[ ] #407
[ ] #409
[ ] #408
[ ] #411
[ ] #410

Must have to launch:

if we deviate from MUI API design make sure there is a statement that it is deviated and why

Must have to have finished documentation:

Feedback on things to think about, I know we are covering these but adding this here in case there are things to add on:

[Lower lift, big impact] - An API reference for each component that lists out which props are available and what they do, along with which CSS classes are available and what they do. These are most important for complex components.
[Bigger lift, huuuge impact] - “Full source” code examples of each component variation in use, such as the attached image from MUI.
One other piece of feedback that might be specific to me as I’m a newbie — I wanted to update the docs for the dropdown, but am confused as to how the “storybook” thing works and didn’t have time to figure it out. It’s also what’s blocking me from putting in a PR with the PanelBasic component. A lower lift docs option might make this easier? I don’t care much about being able to “configure” the component on the docs page, I just care that all the options are clearly listed out. (edited)

Thanks for logging this, @cathystoli ! One other note -- I care a lot less about having a code sandbox than just having a complete plain text example and a clearly defined API. I never use the sandbox option for MUI, semantic UI, etc. I just need the reference.

authors: cathystoli sidneymbell

repo: chanzuckerberg/sci-components


text:
feat: Add survey bottom banner without hubspot

Reason for Change

#7313

Changes

add BottomBanner with new Airtable Survey link to Cell Guide, Differential Expression, & Gene Expression
remove references to Hubspot  - their cookie policy does not work with our privacy policy
remove Newsletter sign up on landing page
modify BottomBanner component to conditionally allow Newsletter Signup in case we need to activate that functionality in the future - no Banners are currently using that functionality though.

Bottom Banner Visible and Clickable

No Newsletter signup on Landing page Footer

Testing steps

Check Cell Guide, Differential Expression, & Gene Expression and see bottom banner
Click survey link to take you to correct airtable survey
Click x button to dismiss banner - it will not return for 30 days after you do this (except in incognito browser)
Check bottom banner on mobile screens as will as large.

Checklist 🛎

[x] Add product, design, and eng as reviewers for rdev review
[x] For UI changes, add screenshots/videos, so the reviewers know what you expect them to see
[x] For UI changes, add e2e tests to prevent regressions
[x] For UI changes, verify impacted analytics events still work

Force merging this PR, since the failing e2e tests are already not passing in other existing PRs. Already created a ticket to resolve the failing PR e2e tests that User Apps Team will look into next week!

authors: rainandbare tihuan

repo: chanzuckerberg/single-cell-data-portal


text:
Surface impact measures that allows the team to understand our progress towards our mission

Target date: 12/22/23
Risk: Dependent on Sci-core extracting impact indicators (e.g. bibliometrics) and gaining alignment among the team

This is blocked and won't be completed by the end of the year as Sci-core and RST haven't set up pipelines to surface these metrics which this work was dependent on.

repo: chanzuckerberg/single-cell


text:
Docs and image build fixes

cerberus image build fails on a couple of dependencies needed for pillow python libraries.
Also fixing instruction docs to refer to the correct repo.

Thanks for the PR and the fix @harshil-codes!

authors: chaitanyaenr harshil-codes

repo: chaos-kubox/cerberus


text:
ignore process not found while recovering the stress

Signed-off-by: YangKeao yangkeao@chunibyo.icu
If the process is not found, we can assume that it's already been recovered (or killed by other processes, like oom killer).

/merge

/merge

/merge

authors: WangXiangUSTC YangKeao iguoyr

repo: chaos-mesh/chaosd


text:
🛑 de (dr460nf1r3) is down

In cecd203, de (dr460nf1r3) (https://de-mirror.chaotic.cx/no-failover/chaotic-aur/lastupdate) was down:

HTTP code: 503
Response time: 118 ms

Resolved: de (dr460nf1r3) is back up in c02046d.

repo: chaotic-aur/chaotic-uptimes


text:
🛑 de (dr460nf1r3) is down

In f9b4d58, de (dr460nf1r3) (https://de-mirror.chaotic.cx/no-failover/chaotic-aur/lastupdate) was down:

HTTP code: 503
Response time: 47 ms

Resolved: de (dr460nf1r3) is back up in a3d40aa.


text:
🛑 Silky.Network - kr-2 is down

In 820a64c, Silky.Network - kr-2 (https://kr-2-mirror.chaotic.cx/no-failover/chaotic-aur/lastupdate) was down:

HTTP code: 503
Response time: 65 ms

Resolved: Silky.Network - kr-2 is back up in 346328b.


text:
🛑 us-ut (Ash) is down

In 38c4a8c, us-ut (Ash) (https://us-ut-mirror.chaotic.cx/no-failover/chaotic-aur/lastupdate) was down:

HTTP code: 503
Response time: 117 ms

Resolved: us-ut (Ash) is back up in 1ecd1f4.


text:
🛑 Silky.Network - us-ca is down

In 8a8a140, Silky.Network - us-ca (https://sjc-us-mirror.silky.network) was down:

HTTP code: 0
Response time: 0 ms

Resolved: Silky.Network - us-ca is back up in 307e4e6 after 50 minutes.


text:
memory outage issue

Hi Team,
Recently we ran 30 samples through bcbio pipeline. Of these 2 fail with memory issue. I am running these on 100GB node even
bcbio.stderr.txt
though it does not require that much. More over these are SNP(20 sites) samples. Not sure if its indeed a memory issue. Can you guys help.
Thanks,

Diya;
It looks like GATK itself needs more memory allocated to complete processing on your input files. It is current using ~3g which it looks like may be scaled from a higher setting. If you adjust jvm_opts for gatk to have a higher maximum memory usage (-Xmx10g) hopefully that will let your analysis finish cleanly:
http://bcbio-nextgen.readthedocs.io/en/latest/contents/configuration.html#resources
Hope this helps

authors: DiyaVaka chapmanb

repo: chapmanb/bcbio-nextgen


text:
How bcbio scale jobs to cluster?

I am quite confused to the memory usage and job assignment to the cluster. In the bcbio_system.yaml file I configured the cores 16G and memory  3G. According to the bcbio document it means that each core will use 3G memory. Meanwhile, does this configuration also specify that each job will use 16 cores? If so, I use the parameter -n 16 bcbio will only run one job even if I have adequate cores and memory in my cluster?  is my understand right?

Thanks for the question, the interaction between the bcbio_system specification and -n is documented here:
http://bcbio-nextgen.readthedocs.io/en/latest/contents/parallel.html#tuning-core-and-memory-usage
In short, the bcbio_system cores and memory specify how many resources to ask for on each machine in the cluster, and -n specifies the total cores to try and allocate. So you're exactly right, if you specify 16 cores in bcbio_system and -n 16 you'll get one job allocated. If you specify -n 32 it'll get two jobs with 16 cores, and so on. Hope this helps.


text:
Add my first file

I have created a branch, created a file, and made a commit!

Merge request!

repo: charasi/introduction-to-github


text:
tokenizer训练OOM 。内存60G

调用 train_my_huggingface_wiki_tokenizer 方法时，OOM 。 超过了 60G 的内存

试试用Windows训练，把硬盘当作内存用。另外，可以对数据集进行随机采样，没必要用全部的数据训练tokenizer。

authors: charent musexiaoluo

repo: charent/ChatLM-mini-Chinese


text:
Components are broken after updating dependencies

Describe the bug
Some of the components are breaking after updating dependencies.
To Reproduce
Steps to reproduce the behavior:

npm i && npm run storybook
Click through the different components and see they are broken.

Expected behavior
They should not be broken.

Fixed in 8a1d98d. It was broken due to storybook breaking when there are default values

repo: charkour/react-reactions


text:
operate on files with certain hashbang

ruff seems only to search for files with .py (maybe also `.pyi) file extensions?!
it would be good to detect some certain hashbangs like:
!#/usr/bin/python
!#/usr/bin/python3
!#/usr/bin/python -b
!#/usr/bin/env python3
and it would be nice to be able to put further definitions in the config files, we e.g. have definitions like:
#!/usr/share/test/runner python3
#!/usr/share/test/runner py.test-3

Rather than looking for a specific shebang, maybe a configuration could be added to include certain files based on paths?

Yeah, I'm extremely hesitant to check every file for a shebang.
If you pass a file to Ruff directly, it will check it, even if it's not a .py or .pyi file (like ruff /path/to/file). That's what most users have done in the past. Though I'd be open to some kind of opt-in list.

I wouldn't use a configurable list of files as files are too often just changing by too many people. The files are tracked in git and all of them might be relevant.
What's wrong with checking hashbangs? I am using it currently and it is not really making a performance issue.

I guess they all have no extension. simple scripts.

We could consider checking non-extension files for hashbangs.

That would be great. we have 462 python files without file extensions and 4 python files with (accidental) file extensions (.in, .conf, .3, .0-dev)

Another simple workaround would be to find the files separately and pass those explicitly to ruff, e.g. (with ripgrep):
rg -l -0 '\A#!/usr/bin/env python' | xargs -0 ruff

yes, this is kind of my current workaround.

This workaround would also be needed in a pre-commit hook, where I did not yet find out how to achieve it.

ok, pre-commit already supports it: it first searches for files with .py[i] extension and then for executable files with common python hashbangs.

This could also be solved by https://github.com/charliermarsh/ruff/issues/3410, sort of, though you'd have to enumerate them explicitly.

hm,  #3914 closed it but this allows only files with a specific extension. our files/scripts don't have any file extension.

Ah yeah, the reasoning was that this now provides a manual workaround, analogous to Black's own configuration (whereby you can specify the script names in the extend-include vector). I'm open to re-opening this, although I don't yet have a solution that I'm happy with for supporting arbitrary scripts via shebangs, so I can't commit to improving it further.

authors: charliermarsh sciyoshi spaceone

repo: charliermarsh/ruff


text:
Make the mccabe checker ignore the case of a single top-level elif chain or match statement

This is a somewhat common edge case where there shouldn't be a need to use noqa comments. Non-looping functions with a nesting depth of 1 should be excluded from the mccabe checker, or there should be a separate error code for this particular kind of pattern if you want to lint or ignore it separately, such as "elif chain exceeds mccabe complexity".
Incidentally, while discussing code complexity KPIs, being able to set a maximum allowed nesting depth would be nice.

I'd like to work on this.

Confirming my understanding: are you describing something akin to a top-level switch statement? Like:
if foo == "bar":
  return 1
elif foo == "baz:
  return 2:
else ...

Yes, exactly. There is a clear difference in complexity between a switch statement with 10 cases, and a piece of code that has 3 nested for loops with if-clauses randomly distributed inside.

@saolof I agree, and I think it can sometimes be detrimental to try and break apart code like this. The result isn't likely to be easier for a human to reason about, and is likely to lower coherence. Single-level structures are the exception to the rule, because they are already easy to reason about and follow.

Sorry, I haven't had much time to spend on this. I might get to it at some point, but if someone else is keen to work on this, please go ahead.

authors: antonagestam charliermarsh saolof


text:
Remove dependency on ruff_rowan

This PR removes the dependency on ruff_rowan (i.e., Rome's fork of rust-analyzer's rowan), and in turn, trims out a lot of code in ruff_formatter that isn't necessary (or isn't yet necessary) to power the autoformatter.
We may end up pulling some of this back in -- TBD. For example, the autoformatter has its own comment representation right now, but we may eventually want to use the comments.rs data structures defined in rome_formatter.

\cc @MichaReiser


text:
Allow linking to individual rules

Adds an id to each rule to allow linking directly to the rule.
Closes #3420

You could also link the individual rules mentioned elsewhere to the links you created.
In task-tags setting, ERA and E501 are mentioned and could link back to the links you added in this PR.
They all seem to follow the regex \(`[A-Z]{1,3}[0-9]{0,4}`\).

You could also link the individual rules mentioned elsewhere to the links you created. In task-tags setting, ERA and E501 are mentioned and could link back to the links you added in this PR. They all seem to follow the regex \(`[A-Z]{1,3}[0-9]{0,4}`\).

Thanks for the suggestion @JonathanPlasse. I wonder if doing this automatically might lead to quite a few false positives and, therefore, if it might be better to do this manually in the specific documentation sections.
An example of a false positive could be if V101 in the external settings section was linked to https://beta.ruff.rs/docs/rules/#V101, which is currently not valid a valid rule section. Another example that matches your provided regex is "(key)" in the invalid-envvar-value (PLE1507) rules; this would direct users to https://beta.ruff.rs/docs/rules/#key, which is also not currently a valid rule section.

You could also link the individual rules mentioned elsewhere to the links you created. In task-tags setting, ERA and E501 are mentioned and could link back to the links you added in this PR. They all seem to follow the regex \(`[A-Z]{1,3}[0-9]{0,4}`\).

Thanks for the suggestion @JonathanPlasse. I wonder if doing this automatically might lead to quite a few false positives and, therefore, if it might be better to do this manually in the specific documentation sections.
An example of a false positive could be if V101 in the external settings section was linked to https://beta.ruff.rs/docs/rules/#V101, which is currently not valid a valid rule section. Another example that matches your provided regex is "(key)" in the invalid-envvar-value (PLE1507) rules; this would direct users to https://beta.ruff.rs/docs/rules/#key, which is also not currently a valid rule section.

To avoid false positives like V101 we could check if the rule exists.
(`key`) should not match the regex as it uses lower cases.

Checking the rule exists seems reasonable.
To be honest, this might be beyond my Rust skills. @JonathanPlasse, would you consider working on this, or should I open an issue as a feature request?

You can open an issue.
I may work on it if I have some time.

Tests are failing due to not being able to install "black[d]"'s dependencies. Would it be possible to rerun to check that this is not just a random error?

Tests are failing due to not being able to install "black[d]"'s dependencies. Would it be possible to rerun to check that this is not just a random error?

I triggered a re-run of the failing tests.

Should we include some kind of visual indicator, e.g., make it a link? (Is that even possible?) I'm also wondering if we should use the human-readable rule name for the URL, rather than the code, but then it becomes kind of duplicative with the standalone rule pages, like:

I'm also wondering if we should use the human-readable rule name for the URL, rather than the code, but then it becomes kind of duplicative with the standalone rule pages, like:

I consider this a workaround for the time being until we have standalone rule pages for every rule.

authors: JonathanPlasse MichaReiser calumy charliermarsh


text:
Enhancement: look for config.yml in $HOME/.ssh

Case:

I initiate ssh connections to other machines from a variety of working directories.
My $HOME/.ssh/config file contains a mix of regular SSH connections and git repositories, which are only used by git
In order to consistently use a default config.yml (and therefore have a connection list that excludes git repositories), I need to always pass wishlist the path to my config.yml

Suggestion: Add $HOME/.ssh/config.[yml|yaml] or perhaps $HOME/.ssh/wishlist/config.[yml|yaml] to the list of places wishlist automatically looks for configs, ahead of $HOME/.ssh/config and /etc/ssh/ssh_config.

I don't think it's a good idea to start polluting config paths of other software. If you really have to, you can store it there and symlink to it.

The change in 74 works for me. Putting in $HOME/.ssh was just a suggestion. I was mainly looking for a static config location that gets checked before $HOME/.ssh/config.
Thank you!

authors: Cordelya muesli

repo: charmbracelet/wishlist


text:
Get Difference of two points in line chart

(https://user-images.githubusercontent.com/24644623/34041382-e2f16b3c-e1bd-11e7-8d43-9cc8f09e180d.PNG)
In Image if  see first point is in red and second point is in green ,Lets say my First point is -62 and second is 282 so the graph raised by 220 pts so my profit is 220 , now third point , lets say 210 i.e in negative so (220-210) is 10 so loss is of 10  and so on . How to calculate this

@PriyankaBondarde you can do this before creating the chart
const dataValues = [10, 20, 15,...];
const pointColor = dataValues.map((v, i) => {
  const prev = i > 0 ? dataValues[i - 1] : Number.PositiveInfinity;
  return v > prev ? 'green' : 'red';
});

const data = {
  datasets: [{
    data: dataValues,
    pointBackgroundColor: pointColor,
  }]
};

i just want to get difference between two points

authors: PriyankaBondarde etimberg


text:
从向量库移除

请问我从向量库移除文件后在对话中还能检索到这个文件的知识是怎么回事

更新到0.2.8 （dev）修了这个bug，包括知识库删除后文件还在等一系列问题

repo: chatchat-space/Langchain-Chatchat


text:
在web页面点击上传文件出现AxiosError: Network Error

您好，请问一下，我现在按步骤部署了整个项目，然后我再页面选择文件对话，点击上传文件，出现AxiosError: Network Error
包括在知识库管理点击上传也同样是这样的问题，问答的话可以正常，目前就是上传文件出现问题，请帮忙看一下，感谢~

方便给个详细报错复现吗？

我也遇到过 刷新下页面又正常了

你好，后台没有相关错误的日志输出呢，具体的前端我给您截图看一下

在文件对话和知识库管理都会出现这个问题，我看这个调用的是files_upload接口，请问一下这个的具体端口号是多少呢

在7860端口可以看到所有的接口

你好，我再7861端口下看到上传知识库调用的是/knowledge_base/upload_docs，但是在前端页面这里直接点击上传的话，调用的是ip:8501/_stcore/upload_file/，请问一下，这里本来就是不一致的吗，还是需要修改哪里，我现在从7861那里上传可以成功，但是从前端页面直接上传的话就一直出现上面所说的错误。感谢~

我现在也出现这种问题了，现在有解决方法吗

这个我最好排查是跨域的问题，你在本地部署就不会
发自我的iPhone

在 2024年3月20日，下午2:37，cca12138 @.***> 写道：

我现在也出现这种问题了，现在有解决方法吗
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you authored the thread.

authors: cca12138 chenwenfeng mayidu zRzRzRzRzRzRzR


text:
[docker-fluentd]bump version

bump fluentd
bump some gems

@cw-sakamoto
https://rubygems.org/gems/fluent-plugin-datadog だけ、最新 (0.12.1) じゃないようですが、最新だと何か問題あったんですか？

authors: cw-hagiwara cw-sakamoto

repo: chatwork/dockerfiles


text:
[gratan] Add chatwork/gratan

I prepared a Dockerfile of codenize-tools/gratan to be used for database user manegement.
https://github.com/codenize-tools/gratan

@ada-u
Please teach me ruby.
I think I should add gem: --no-rdoc --no-ri to .gemrc to reduce the image size, is this not necessary?

@ada-u
https://github.com/chatwork/dockerfiles/blob/1785e2c30d7cfe723df37806173ffab5d131eda0/fluentd/Dockerfile#L39-L40
I think I should delete the temporary gem files, isn't this necessary?

authors: ada-u cw-ozaki


text:
Search and Filter Favorites

Search and Filter Favorites

As a User:
I want to search and filter my favorited URLs.
Objective:
To quickly find specific favorites based on title, URL, category, tags and timestamp.
Expectations:

The system should provide a search functionality that allows users to enter keywords. - The system should enable filtering by category, tags, or a combination of both.
Search and filter results should be displayed in a user-friendly manner with pagination.

Search function
Filter by category and tags
Fields to retrieve the information
title, URL, category, tags and timestamp
Idea 1: use query API.
Input keywords match to fields title,URL, category, tags.
Filter narrow down search. Only limit to category or tag.
Idea 2: use search library that support invert document indexes.
Prototype implementation, just to start.

query is keywords
output is paginated

See this tutorial for how to use PostgreSQL and do full-text search.
https://paulonteri.com/thoughts/full-text-search-django
Steps

Simple search API
Use postgres
SearchVector that use many fields in a search

repo: chayapan/favlinks


text:
Testing: Update README.md

Replaced broken CI workflow link in README.md with a working one.

Issue: https://github.com/chaynHQ/bloom-frontend/issues/599

repo: chaynHQ/bloom-frontend


text:
Need to update podspec file

@nicolas-maalouf-cko  I have found an issue in podspec file,
s.source_files = 'CheckoutKit/**/*.{swift,h,m}' should be replaced with s.source_files = 'CheckoutKit/CheckoutKit/*.{swift,h,m}'
Reason being when pod is installed, pod folder contains "AppDelegate" file which is of no use for the project which is integrating CheckoutKit as a dependency. This AppDelegate is only being used by the Example project.
In my project is causing an error, refer to the screenshot below:

Xcode: 9.2
CheckoutKit installed folder screenshot:

It is working fine when I removed this AppDelegate file explicitly.
I will submitting a PR against this issue, if this seems ok to you...

This is still an issue. Any chance this could be fixed?

I am still facing a linker command fail problem when trying to bind this pod as a static library in our code base. Please resolve this issue. Either change pod spec file or change the name of the app delegate class.

repo: checkout/checkoutkit-ios


text:
Multi-table support

When each file is read from rebuild-iptables, the first line is checked for a  table name (such as *nat).   If a name is found the rules in the file are added to that table.

Hi. I am an automated pull request bot named Curry. There are commits in this pull request whose authors are not yet authorized to contribute to Chef Software, Inc. projects or are using a non-GitHub verified email address. To become authorized to contribute, you will need to sign the Contributor License Agreement (CLA) as an individual or on behalf of your company. You can read more on Chef's blog.
Non-GitHub Verified Committers
There are 1 commit author(s) whose commits are authored by a non-GitHub verified email address. Chef will have to manually verify that they are authorized to contribute.
Please sign the CLA here.

Since the CLA hasn't been signed in over 6 month for this PR I'm going to close it out at this point.  If the author would like to sign the CLA feel free to open up the PR again.

authors: chef-supermarket jdblack tas50

repo: chef-cookbooks/iptables


text:
prevent project deletion until zero ingest rules and up-to-date

Overview
Prevent project deletion until zero ingest rules and up-to-date.
Design Details
ui
When a user tries to delete a project that has more than zero ingest rules or is not up-to-date display text in the modal indicating they need to delete their ingest rules and update projects before they can delete.
api
Respond with an error that says the user needs to delete their ingest rules and update projects before they can delete.

Some design thoughts:

Simultaneous project deletions

OK for simultaneous deletions for different projects
Cereal is configured to apply mutex for multiple deletions on the same project.

Attempt to add rules simultaneous with a project deletion

Modify the project purger so that it initiates a DB transaction to lock the rules table(s) then, does its purging to prevent race conditions. If it cannot get a lock--meaning someone is in the process of updating the rules table, then the cereal workflow should abort.

The case above "For the Attempt to add rules simultaneous with a project deletion". This is the case where we have two users modifying the same project at the same time. One user "A" is deleting a project and the other user "B" is adding a rule to the same project. We found that this will not be a large concern because either user "B" will get an error that the project was deleted when they add the rule or no error but the project will be removed the next time they refresh the page. In the second case, if user "B" applies rules the project deleted will not be recreated. User "B" will have some confusion, but this is expected because user "A" deleted the project.

authors: lancewf msorens susanev

repo: chef/automate


text:
[protoc-gen-policy] oneof type is not properly generates policy hepler

Describe the bug

proto3 oneof type not fully supported by the protoc-gen-policy tool.
seems it is calling oneof message attributes directly instead it should get inverted to the interface.

To Reproduce
Steps to reproduce the behavior:

Add oneof message types in sample requests.
eg.

message UpdateOrg {
    string id = 1;
    oneof test {
        string name = 2;
        string admin_key = 3;
    };
    string admin_user = 4;
    string server_id = 5;
    repeated string projects = 6;
}

hit compile_go_protobuf_component api.
wired & implement all request gateway functions.
try rebuild components/automate-gateway
it raises any error:

# github.com/chef/automate/api/external/infra_proxy
/src/api/external/infra_proxy/infra_proxy.pb.policy.go:166:14: m.Name undefined (type *request.UpdateOrg has no field or method Name)
/src/api/external/infra_proxy/infra_proxy.pb.policy.go:168:14: m.AdminKey undefined (type *request.UpdateOrg has no field or method AdminKey)
   automate-gateway: Build time: 0m3s
   automate-gateway: Exiting on error

Expected behavior

it should simply rebuild the automate-gateway.

Versions (please complete the following information):

OS: ubuntu
Automate: latest master

Additional context
Add any other context about the problem here.

policy code generated for this type:

policy.MapMethodTo("/chef.automate.api.infra_proxy.InfraProxy/UpdateOrg", "infra:infraServers:{server_id}:orgs:{id}", "infra:infraServers:update", "PUT", "/api/v0/infra/servers/{server_id}/orgs/{id}", func(unexpandedResource string, input interface{}) string {
		if m, ok := input.(*request.UpdateOrg); ok {
			return policy.ExpandParameterizedResource(unexpandedResource, func(want string) string {
				switch want {
				case "id":
					return m.Id
				case "name":
					return m.Name
				case "admin_key":
					return m.AdminKey
				case "admin_user":
					return m.AdminUser
				case "server_id":
					return m.ServerId
				default:
					return ""
				}
			})
		}
		return ""

it should be something like
policy.MapMethodTo("/chef.automate.api.infra_proxy.InfraProxy/UpdateOrg", "infra:infraServers:{server_id}:orgs:{id}", "infra:infraServers:update", "PUT", "/api/v0/infra/servers/{server_id}/orgs/{id}", func(unexpandedResource string, input interface{}) string {
		if m, ok := input.(*request.UpdateOrg); ok {
			return policy.ExpandParameterizedResource(unexpandedResource, func(want string) string {
				switch want {
				case "id":
					return m.Id
				case "name":
					return m.GetTest().(*request.UpdateOrg_Name).Name
				case "admin_key":
					return m.GetTest().(*request.UpdateOrg_AdminKey).AdminKey
				case "admin_user":
					return m.AdminUser
				case "server_id":
					return m.ServerId
				default:
					return ""
				}
			})
		}
		return ""
	})

From discussion in slack, this isn't blocking anything right now. But it is a genuine bug we should look into.
I believe that since we don't know which oneof field will be set (it wouldn't be in a oneof if we did), they cannot be used for action/resource mapping anyways. So, ignoring them would be the easy way out here.

authors: srenatus vsingh-msys


text:
Add missing S to the example!

Don't want anyone losing an hour of life as I did...

:+1:

Would be nice to see this merged. Can confirm that block_device_mappings is correct.

👍

authors: eheydrick joaogbcravo keen99 miguelcnf

repo: chef/chef-provisioning-aws


text:
cannot use chef-server-ctl for any activities using pivotal account

brand new install on 12.0.7 on ubuntu 12.0.4, all the services are running but when i try to create, edit, or show a user i get....
ERROR: Failed to authenticate to https://127.0.0.1:443 as pivotal with key /etc/opscode/pivotal.pem
Response:  Invalid signature for user or client 'pivotal'

crude way to get around it is to use the webui keys as the pivotal keys.  Used private-server-ctl to set the public key of the pivotal user, then replaced the private key of pivotal with the private key of webui in the /etc/opscode directory

Hi @forkthis404,
can you please share us the steps what you followed to fix this issue?

Sorry for the delay in responding to this issue. At this time there is  not enough information for us to be able to duplicate this issue. Please feel free to reopen if the issue persists.

repo: chef/chef-server


text:
c-s-c chef12-upgrade-download command has two -d options

The chef12-upgrade-download command has two options that have a short option of -d. I believe in this case the last one will win, but they should have unique short options. The work around for now is to just use the long option names.
See https://github.com/opscode/opscode-omnibus/blob/master/files/private-chef-ctl-commands/chef12_upgrade_download.rb#L27 and https://github.com/opscode/opscode-omnibus/blob/master/files/private-chef-ctl-commands/chef12_upgrade_download.rb#L53

Fixed in 12.0.3

authors: mmzyk stevendanna


text:
Chef-server Nginx does not implement HSTS

Chef HTTPS server is not enforcing HTTP Strict Transport Security (HSTS).
It represents an unnecessary risk to the overall security posture.
Concretely, there is no ['nginx']['sts_max_age'] variable to set the “Strict-Transport-Security” header
( add_header Strict-Transport-Security "max-age=" XXX ) for nginx on /etc/opscode/chef-server.rb
References
HSTS on Wikipedia: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
HSTS for Nginx: https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
Nginx cookbook mentions it: https://supermarket.chef.io/cookbooks/nginx

Work around:
Add the header in nginx addons:
cat /opt/var/opscode/nginx/etc/addon.d/10_external.conf
add_header Strict-Transport-Security "max-age=31536000" always;

Restart Nginx:
/opt/opscode/embedded/bin/sv restart nginx
Verify that you get HSTS:
curl  https://127.0.0.1 -k -v | grep Strict


text:
Utiliser react-window pour améliorer les perf de l'affichage en liste

https://github.com/bvaughn/react-window
Optimise l'affichage des longues listes, en ne rendant que la partie visible de la liste

Suite à appel de @Mathieu-CdlT, je mets cette issue en priorité.
Si ça ne marche pas, on verra pour activer la pagination, au moins côté frontend.
Ping @GuillaumeAV

repo: chemins-de-la-transition/semapps