text:
search count message not get updated after remap n/N key

nvim 0.7.0
macos

Describe the bug
Personally I'd like keep search count message at bottom-right, so in my vimrc I have set shortmess-=S. After enable hlslens, those count message do not get updated anymore after hit n/N, I found this is because map the n/N key with the example in README:
vim.api.nvim_set_keymap('n', 'n',
    [[<Cmd>execute('normal! ' . v:count1 . 'n')<CR><Cmd>lua require('hlslens').start()<CR>]],
    kopts)
vim.api.nvim_set_keymap('n', 'N',
    [[<Cmd>execute('normal! ' . v:count1 . 'N')<CR><Cmd>lua require('hlslens').start()<CR>]],
    kopts)

To Reproduce using nvim -u mini.lua
vim.cmd[[ set shortmess-=S ]]
-- packer
use {'kevinhwang91/nvim-hlslens'}

local kopts = {noremap = true, silent = true}

vim.api.nvim_set_keymap('n', 'n',
    [[<Cmd>execute('normal! ' . v:count1 . 'n')<CR><Cmd>lua require('hlslens').start()<CR>]],
    kopts)
vim.api.nvim_set_keymap('n', 'N',
    [[<Cmd>execute('normal! ' . v:count1 . 'N')<CR><Cmd>lua require('hlslens').start()<CR>]],
    kopts)
vim.api.nvim_set_keymap('n', '*', [[*<Cmd>lua require('hlslens').start()<CR>]], kopts)
vim.api.nvim_set_keymap('n', '#', [[#<Cmd>lua require('hlslens').start()<CR>]], kopts)
vim.api.nvim_set_keymap('n', 'g*', [[g*<Cmd>lua require('hlslens').start()<CR>]], kopts)
vim.api.nvim_set_keymap('n', 'g#', [[g#<Cmd>lua require('hlslens').start()<CR>]], kopts)

Steps to reproduce the behavior:

/ search something
hit n/N
check if search count message get updated

Expected behavior
A clear and concise description of what you expected to happen.
Screenshots
If applicable, add screenshots to help explain your problem.
Additional context
Add any other context about the problem here.

can't reproduce, try below config and cmd.
vim.cmd('pa nvim-hlslens')
vim.cmd[[ set shortmess-=S ]]

local kopts = {noremap = true, silent = true}

vim.api.nvim_set_keymap('n', 'n',
    [[<Cmd>execute('normal! ' . v:count1 . 'n')<CR><Cmd>lua require('hlslens').start()<CR>]],
    kopts)
vim.api.nvim_set_keymap('n', 'N',
    [[<Cmd>execute('normal! ' . v:count1 . 'N')<CR><Cmd>lua require('hlslens').start()<CR>]],
    kopts)
vim.api.nvim_set_keymap('n', '*', [[*<Cmd>lua require('hlslens').start()<CR>]], kopts)
vim.api.nvim_set_keymap('n', '#', [[#<Cmd>lua require('hlslens').start()<CR>]], kopts)
vim.api.nvim_set_keymap('n', 'g*', [[g*<Cmd>lua require('hlslens').start()<CR>]], kopts)
vim.api.nvim_set_keymap('n', 'g#', [[g#<Cmd>lua require('hlslens').start()<CR>]], kopts)

nvim -u mini.lua --noplugin

thanks for the reply.
I rechecked, the problem happens when lazyredraw is on. just like this:
vim.cmd [[
set lazyredraw
set shortmess-=S
packadd nvim-hlslens
]]
local kopts = {noremap = true, silent = true}

vim.api.nvim_set_keymap('n', 'n',
    [[<Cmd>execute('normal! ' . v:count1 . 'n')<CR><Cmd>lua require('hlslens').start()<CR>]],
    kopts)
vim.api.nvim_set_keymap('n', 'N',
    [[<Cmd>execute('normal! ' . v:count1 . 'N')<CR><Cmd>lua require('hlslens').start()<CR>]],
    kopts)
vim.api.nvim_set_keymap('n', '*', [[*<Cmd>lua require('hlslens').start()<CR>]], kopts)
vim.api.nvim_set_keymap('n', '#', [[#<Cmd>lua require('hlslens').start()<CR>]], kopts)
vim.api.nvim_set_keymap('n', 'g*', [[g*<Cmd>lua require('hlslens').start()<CR>]], kopts)
vim.api.nvim_set_keymap('n', 'g#', [[g#<Cmd>lua require('hlslens').start()<CR>]], kopts)

if lazyredraw is off or hlslens is not load, the search count message got updated after n/N

It's not an issue of hlslens.
set lazyredraw
set shortmess-=S
nnoremap n <Cmd>execute('normal! ' . v:count1 . 'n')<CR>

can't update the info, you should post this remapping issue to vim instead of neovim or hlslens.


text:
Node transpile function is not maintaining put bodies

I'm building an api that is using a postman schema as the base. We transpile it to openapi spec to allow for an autogenerated webpage. I noticed that in the transpilation. That the Update routes have no bodies in them
There are bodies in the postman

Which don't seem to make it after the transpile.

Compared to the post routes that seem to fill out the schema after the transpiling.

My current solution is to just take the transpiled code and placing the parameters from the post route into the put routes. It's working now. So I won't really be worried about this for now.

@ScriptAlchemist For the request in Postman, make sure you're selecting "JSON" as the type, save it, and try again. Also, make sure the request doesn't have an example with an empty request body.  I don't remember if I implemented request body schema merging in that scenario.

@kevinswiber So I had one example where it was sending an empty object. On purpose because it's supposed to have it fail based on validation.
So adding in a json object seems to make it work. Thanks.
I'm not sure if that's the better solution though. Cause inside of the postman doc that I give others. It's going to have a technically incorrect example. So maybe I'll just programmatically delete it after

source: gharchive/issue

authors: ScriptAlchemist kevinswiber

license_type: permissive

license_source: github-api


text:
🛑 FX corretor (kty) is down

In 1eb7aa4, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in 5644b71 after 6 minutes.

repo: keviocastro/upptime

license: MIT


text:
🛑 FX corretor (kty) is down

In 8fb8e97, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in ebe6913 after 6 minutes.


text:
🛑 FX blog (kty) is down

In 9a1c919, FX blog (kty) (https://foxter-blogeditor.konecty.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX blog (kty) is back up in 3736103 after 18 minutes.


text:
🛑 FX corretor (kty) is down

In 819ccc8, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in f69204a after 7 minutes.


text:
🛑 FX blog (kty) is down

In 3cc5dd0, FX blog (kty) (https://foxter-blogeditor.konecty.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX blog (kty) is back up in bf99687 after 6 minutes.


text:
🛑 FX blog (kty) is down

In da244aa, FX blog (kty) (https://foxter-blogeditor.konecty.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX blog (kty) is back up in ec0d82f after 11 minutes.


text:
🛑 FX corretor (kty) is down

In e58551b, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in 9593c55 after 31 minutes.


text:
⚠ AVS (kty) has degraded performance

In 2c62de6, AVS (kty) (https://avus.com.br) experienced degraded performance:

HTTP code: 200
Response time: 8027 ms

Resolved: AVS (kty) performance has improved in c1060e2.


text:
🛑 FX blog (kty) is down

In 0352ff0, FX blog (kty) (https://foxter-blogeditor.konecty.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX blog (kty) is back up in 749ab42 after 10 minutes.


text:
🛑 FX blog (kty) is down

In 943c17b, FX blog (kty) (https://foxter-blogeditor.konecty.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX blog (kty) is back up in e12ba15 after 6 minutes.


text:
🛑 FX corretor (kty) is down

In 6186c32, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in d3534f6 after 6 minutes.


text:
🛑 FX corretor (kty) is down

In 8ac1835, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in 5afc792 after 13 minutes.


text:
🛑 FX corretor (kty) is down

In ed87c2a, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in 6e3715f after 8 minutes.


text:
🛑 FX corretor (kty) is down

In 4aee11f, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in 5a9d0f9 after 12 minutes.


text:
🛑 FX blog (kty) is down

In 856ec07, FX blog (kty) (https://foxter-blogeditor.konecty.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX blog (kty) is back up in 9464925 after 10 minutes.


text:
🛑 FX corretor (kty) is down

In f2aea14, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in b75bd2b after 45 minutes.


text:
🛑 FX corretor (kty) is down

In b15a2ec, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in ef68ccf after 9 minutes.


text:
🛑 FX corretor (kty) is down

In d92b9a7, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in 875a673 after 40 minutes.


text:
🛑 FX blog (kty) is down

In 3b412c4, FX blog (kty) (https://foxter-blogeditor.konecty.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX blog (kty) is back up in d9ba691 after 6 minutes.


text:
🛑 FX blog (kty) is down

In a6c1121, FX blog (kty) (https://foxter-blogeditor.konecty.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX blog (kty) is back up in b7ef236 after 36 minutes.


text:
🛑 FX corretor (kty) is down

In c224d9b, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in dc1746b after 14 minutes.


text:
🛑 FX corretor (kty) is down

In 5351bbb, FX corretor (kty) (https://corretores.foxterciaimobiliaria.com.br) was down:

HTTP code: 0
Response time: 0 ms

Resolved: FX corretor (kty) is back up in e2bec65 after 15 minutes.


text:
Update hendrikharlichs.de

This PR is:

[ ] Adding a new domain
[x] Updating existing domain size
[ ] Changing domain name
[ ] Removing existing domain from list
[ ] Website code changes (512kb.club site)
[ ] Other not listed

[x] I used the uncompressed size of the site
[x] I have included a link to the GTMetrix report
[x] The domain is in the correct alphabetical order
[x] This site is not an ultra lightweight site
[x] The following information is filled identical to the data file

I confirm that I have read the FAQ section, particularly the two red items around minimal pages and inappropriate content and I attest that this site is neither of these things.

[x] Check to confirm

- domain: hendrikharlichs.de
  url: https://hendrikharlichs.de/
  size: 168
  last_checked: 2023-11-26

GTMetrix Report: https://gtmetrix.com/reports/hendrikharlichs.de/a1e4xPWU/

Thanks Hendrik!

source: gharchive/pull-request

authors: garritfra hendrikmitk


text:
Allow progress ?

is there a way to get the progress events or something so we can show users its progress visually?
or even the current extracted size vs the size it will be uncompressed ?

#35  +1

repo: kevva/decompress

license: mit

license_source: bigquery


text:
Stolen Bitcoin and Lost Crypto Retrieval Hacker

There has been a lot of scamming online when it comes to Bitcoin investment in an online platform. I was a victim of an online  Bitcoin investment where I had a investment worth $79,000 btc in total. I couldn’t allow all my effort to waste when I discovered I was being scammed. For weeks I was depressed and was thinking of what I should not. Then I did some research on how i can recover my Bitcoin and then I came across Cyber Asset Recovery, a cybercrime investigator and a recovery expert firm. As a result of being able to explain my issues to Cyber Asset Recovery, everything I lost to these Bitcoin scam company was recovered in few days of working with them. Thanks to Cyber Asset Recovery. Their team of experts are pro at what they do. Send a message to them and get the assistance you require.
email.  Cyberassetrecovery@ protonmail. com
Telegram Username.   @CyberAssetRecovery
Website.       cyberassetrecovery. pro/

PRO ADVANCED RECOVERY is a private investigative, financial regulation, and funds recovery company. Cryptocurrency-related scenarios, phony investment
schemes, recovery scams, and ethical hacking are among our specialties. We look into the things that impact your score because we are experts in
credit restoration as well. All the software needed to do RECOVERIES from start to finish is available. Please be aware that the tools that are being
supplied are not eligible for CREDIT FIX. Be wary of fraudulent online reviews and testimonials. Together, the authors and Criminals form a syndicate.
Please use the email address below to contact our team as soon as possible to arrange a mail meeting with an ethical hacker.
EMAIL:proadvancedrecovery@webname.com
TELEGRAM:@proadvancedrecovery
WHATSAPP:+1(657)5436038

Are you one of the unfortunate individuals who has fallen victim to a crypto theft? Do not despair, as there are solutions out there to help you recover your stolen funds. I will share my journey of recovering my stolen crypto of 160,000 USD with the help of Wizard Web Recovery. Cryptocurrency theft is an all too common occurrence in the digital age. With the rise of decentralized finance and the increasing popularity of cryptocurrencies, hackers and scammers are constantly on the lookout for opportunities to steal funds from unsuspecting individuals. I was one of those individuals who fell prey to crypto theft, losing a significant amount of money in the process. Feeling completely powerless and disoriented after having my crypto stolen, I scoured everywhere for a solution. Unfortunately, most recovery services seemed sketchy and undependable. Then, like a stroke of luck, I discovered Wizard Web Recovery. Their website exuded professionalism, their services were transparently laid out, and, crucially, they had a solid history of successfully recovering stolen crypto. I bravely decided to contact them for help. When I contacted Wizard Web Recovery, I knew I was in good hands. They were responsive, transparent, and empathetic to my situation. They explained their recovery process in detail and kept me updated every step of the way. Their experts worked tirelessly to track down the perpetrators and recover my stolen funds. After weeks of hard work and dedication, I received the news I had been hoping for - my crypto of 160,000 USD had been successfully recovered. Receiving my recovered crypto was an unparalleled experience. I was overwhelmed with relief, finally putting an end to the nightmare of being a theft victim. Wizard Web Recovery's unmatched expertise and dedication made it all possible. Their professionalism, efficiency, and effectiveness in reclaiming stolen crypto distinguish them from the competition. If you ever face the unfortunate situation of having your cryptocurrency stolen, don't lose hope! There are trustworthy recovery services like Wizard Web Recovery available to help you get your funds back. I successfully recovered my stolen 160,000 crypto with the expert assistance of Wizard Web Recovery. Remember, with the right help, reclaiming what is rightfully yours is entirely possible. Don't hesitate to seek assistance from professionals like Wizard Web Recovery – you won't regret it. Their contact info is written below.
WEBSITE - wizardwebrecovery.net
TELEGRAM - wizardwebrecoveryteam
EMAIL - wizardwebrecovery@ programmer (.)  net

authors: AMBROESS XanderOliver1 annaliseraquel

repo: keybase/client


text:
Keybase stuck on loading scr.  MacOS X Sierra

Keybase GUI Version: 1.0.18-20170209165653+17b641d

Same problem here.
Log ID: 6030e1fba884d97644894d1c

Same, keeps saying that needs to install helper, when given the password cycles back to the prompt about the need to install the helper. my log id: 6efe7aa69ada3f7f70f68d1c

authors: Cooller13 lightcap pira


text:
Adding PGP signature verification for Arch Linux packaging scripts (PKGBUILD)

This is a continuation of discussions on Arch Linux User Repository (AUR). /cc @oconnor663 as requested.
In the current Arch Linux packaging script (PKGBUILD), detached signatures of Debian packages are not verified. If I want to check whether the downloaded file is really from Keybase, I need to download https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_1.0.36-20171122003226.f68b10ef8_amd64.deb.sig and https://keybase.io/docs/server_security/code_signing_key.asc manually. I propose to apply emlun's patch
diff --git a/PKGBUILD b/PKGBUILD
index 5fda4e1..56a3da9 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -18,10 +18,13 @@ depends=(fuse gconf libxss gtk2) # don't change this without changing the SRCINF
 conflicts=(keybase keybase-release keybase-git)
 source_i686=(
   "https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${deb_pkgver}_i386.deb"
+  "https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${deb_pkgver}_i386.deb.sig"
 )
 source_x86_64=(
   "https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${deb_pkgver}_amd64.deb"
+  "https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${deb_pkgver}_amd64.deb.sig"
 )
+validpgpkeys=(222B85B0F90BE2D24CFEB93F47484E50656D16C7)
 install=keybase.install

 package() {
@@ -43,5 +46,5 @@ package() {
 rm -rf "$pkgdir/etc/cron.daily"
 }

-sha256sums_i686=(994998f8093474330a1249e75963cacc948b8011ef5dff6e2e98085fa58448ba)
-sha256sums_x86_64=(35bd09c324828c125ecb68e83b3c54a36f8c48d61b09352593a62d64476f2802)
+sha256sums_i686=(994998f8093474330a1249e75963cacc948b8011ef5dff6e2e98085fa58448ba 'SKIP')
+sha256sums_x86_64=(35bd09c324828c125ecb68e83b3c54a36f8c48d61b09352593a62d64476f2802 'SKIP')

So that makepkg (Arch Linux's default package builder) can do pgp signature verification automatically.
Some existing arguments for not adding this check:

Verifying SHA256 checksums is enough

First, integrity != authenticity. Second, technically I can't verify that the checksum is correct. For example, the checksum for the x86_64 package version 1.0.36-20171122003226.f68b10ef8 35bd09c324828c125ecb68e83b3c54a36f8c48d61b09352593a62d64476f2802 does not appear anywhere other than the AUR package according to Google and DuckDuckGo. As a result, I need to trust several things before trusting the checksum
(1) The machine that runs update_aur_packages.sh
(2) The AUR server aur.archlinux.org
On the other hand, trusting the PGP signature is much simpler. I can get the public key from https://keybase.io/docs/server_security/our_code_signing_key or public key servers (MIT, Ubuntu, ...), and there are many evidences that  222B 85B0 F90B E2D2 4CFE B93F 4748 4E50 656D 16C7 is related to Keybase.io. Unless all of them are compromised, I'm safe.
Other related arguments:

Would an evil PKGBUILD include the right Keybase PGP fingerprint

A user should always verify the fingerprint listed validpgpkeys before building a package.

do we expect those targeted users to realize that a verification step should have been there?

Users of the keybase client (or any security-related software in general) should know how trust of software packages is established. They are in danger if they don't know it. Actually, it's shocking for me that the keybase-bin package does not include validpgpkeys - I was expecting a nice error message from makepkg to tell me which key I should fetch and verify for this package.

It will bother users to force the pgp verification check

As more and more security-related and general softwares on AUR come with the validpgpkeys directive, I believe AUR users are quite familiar with them.

I appreciated usability for the keybase client as one of the core spirits honored by the team. I'd like to thank you all for greatly improved UI in comparison to existing security-softwares. In this case, usability of newcomers conflicts with convenience of know-how users. I think keybase should give nice instructions for newcomers to protect themselves, such as detailed instructions as comments or printed with echo in PKGBUILD, pinned comments on AUR, and so on.
As a fallback option, if you really hesitate on adding signature verification, please provide SHA256 sums of Debian packages somewhere on the website. https://keybase.io/docs/the_app/install_linux appears to be a good place.

Thanks for the thoughtful comments. Tell me what you think of the following: It's true that the hash by itself doesn't authenticate the .deb file. However, the HTTPS connection you're downloading it over does authenticate it. In order to compromise a specific user with malicious bits, Keybase (or at least Amazon) would need to host them and aur.archlinux.org would need to tweak/delete the SHA256 checksum from the PKGBUILD for that one user.
As you pointed out, PGP signature checking inside the PKGBUILD could help solve that problem, but only if the user is extremely disciplined in auditing the PKGBUILD file every time they install or update. Here's an example attack: The AUR replaces the .sig file extension with .sig (containing "CYRILLIC SMALL LETTER BYELORUSSIAN-UKRAINIAN I" instead of "i"). Amazon arranges to re-host the signature file by that modified name. Then when makepkg downloads it and checks the extension, it doesn't believe it's a signature file at all, and it silently skips the signature checking step. The only indication that something was amiss would be that the "Verifying source file signatures with gpg..." line was missing from the makepkg output, and even that could be fudged if some part of the build script used fancy ANSI control codes to rewrite the terminal output above it.
I think a much more realistic solution would be to have a PGP signature around the PKGBUILD file, to prove that it's the one we wrote. I don't think that would integrate very well with pacaur or similar helpers, but maybe someone who knows the tools better than I do could suggest an ergonomic way to do it.

Apologies for how utterly undocumented this is, but you can find SHA512 checksums for our package files if you look in the Debian repo metadata:
curl https://prerelease.keybase.io/deb/dists/stable/main/binary-amd64/Packages

TLS protocol authenticates a host instead of hosted contents. It only proves that the relevant host has the private key for the interested domain name. Also, it's possible that an evil/compromised CA issued a valid certificate for s3.amazonaws.com and perform MITM attack, just like previous incidents of WoSign. Before Certificate Transparency becomes the new standard, HTTPS is not so trustworthy.
Not sure how S3 works. I guess a malicious party can also create another S3 account (e.g., prerelease.keybаse.io, where 'а' is U+0430) and change the link in PKGBUILD as long as AUR is compromised.
So, you're correct - adding *.sig files and validpgpkeys is not enough. Signing the whole PKGBUILD can make things better, while there's a hole - keybase.install is not authenticated. Another idea comes to my mind: as each AUR package itself is a git repository, how about signing all commits? Then it's possible to verify that all packaging-related files, including PKGBUILD and keybase.install, are really from the Keybase team. This can be implemented as an optional feature in AUR helpers, so newcomers won't be bothered with makepkg errors, either.
I remember AUR doesn't allow git push --force. Signing from the next commit is fine as git SHA1 IDs depends on all previous commits IIRC.

curl https://prerelease.keybase.io/deb/dists/stable/main/binary-amd64/Packages

Many thanks for this link! It would be great to add a comment and mention this link in PKGBUILD.

Added a comment like you suggested: https://github.com/keybase/client/commit/f970d7daf99332f2512e03111b6f663ceabc5bb5

Thanks! Now signed files/commits is less important. Still looking forward to it as an easier approach for software verification.

I too would like PGP signature verification, and as I said in the AUR comments, "Anyway, at the end of the day I tend to err on the side of more capable users..."
That being said, the sha256sums are provided by the presumably-trusted build server, and the PGP signatures are I believe also provided by the trusted build server.
Anyone who can hack the build server to push malicious updates everywhere, would also have the signing key.
...
On the topic of modifying the PKGBUILD with unicode names, it should be noted that that will be obvious in git log -p in a way that updating the pkgver and sha256sums will not be. Same with modifying the install file, or doing fancy ANSI control codes.
The protections offered by PGP neither help nor hinder users who don't read the PKGBUILD at all before running it, and users who do read the PKGBUILD will notice sudden new code introduced to the PKGBUILD and install script.

Yes, in practice if you get your hands on our AUR account SSH key, you probably also have our code signing key, so there isn't really anything we can do to save ourselves in that scenario. I do think it's interesting to ask how much damage a rogue AUR admin could do, if they decided to mess with our package. Of course for users who don't audit the PKGBUILD carefully, they can do whatever they want, so the question is rather how much can they get away with even against paranoid expert users. I think the answer is still "murder" :) Here are some possible attacks against someone who's auditing the git history:

The attacker might make a unicode-similar-character change in the middle of a larger refactoring, so that the relevant lines are already showing up in the diff for another innocuous-looking reason. (Unless the user runs everything through a fishy-unicode-detecting lint.)
They might hide arbitrary changes in a merge commit, which git log doesn't display. (Unless the user manually inspects merges with git show -m ... or similar.)
They could insert corrupt blob objects into the repo, to make changes without changing the commit history at all. (Unless the user overrides the fsckObjects defaults in their git config.)

These attacks just get fancier and fancier. I think it's super interesting to think about how you can mitigate each one, but pretty unrealistic to expect real users (even paranoid real users) to actually do these things. That's why I'm hesitant to add any extra steps to the install that everyone has to go through. Still, I'm happy to make these sorts of things possible for expert users, if they want to take more steps.

A relevant article that came out today: https://www.twistlock.com/2017/12/13/hiding-content-git-escape-sequence-twistlock-labs-experiment

Oh git is too complex to be used safely. How about maintaining a binary package repository just like core/extra/community? The whole pkg.tar.xz file is signed, so it's unlikely there's an evil bit. My package_builder.py may help.

@yan12125 the Debian repo metadata I mentioned above does get signed over by our PGP key, and that includes the hashes of our binary packages. Take a look at:
curl prerelease.keybase.io/deb/dists/stable/InRelease

Following all the hashes that are signed over there is a little bit annoying, as it's designed for Debian tooling more than for doing anything by hand. But the upside is that it should be pretty stable, if you want to script it. Our repo is laid out with the reprepro tool.

Also if you take a look at https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/index.html, you'll find per-binary signature files.

Or did you mean some kind of signed repo that pacman understands?

Yes!

I guess we could edit /etc/pacman.conf or something like that? That would be basically the same as what we do for .deb and .rpm. But the AUR is so much simpler than all that :(

The AUR is so much simpler, than saying "in addition, you can add this snippet to pacman.conf to add our custom repo, and forever after just pacman -Syu"?

@eli-schwartz is so fast in replying. Let me add some more details for the same argument.
To use binary repos, users has to modify their /etc/pacman.conf and import the public package signing key, and the Keybase team needs to maintain a folder on the server, just like the case for Debian packages. The good news is, Arch Linux packaging is much simpler. A minimal binary repo contains only 1 database file (e.g., keybase.db) and 1 package file (e.g., keybase-1.2.3.pkg.tar.xz), along with signature files.
An advantage besides security is that there's no need for users to run the build step in PKGBUILD. Upgrading of keybase-bin occurs with usual system upgrades (e.g., pacman -Syu). Considering the update frequency of keybase-bin, switching to binary repo would save quite some time for users.
AUR is simpler for package maintainers yet complex for users. Git, PKGBUILD auditing, ... Those are all burdens and difficult to do it correct IMO.

Note that making a pacman-compatible package does imply having pacman installed so you can use makepkg. I know that Gentoo has a pacman package (which uses --with-root-dir="${EPREFIX}/var/chroot/archlinux" for obvious reasons), not sure how that would work in a Debian build container though.
You could use the following instead of makepkg I guess: https://gist.github.com/Earnestly/bebad057f40a662b5cc3
And repo-add is a standalone script so you could use it as-is.


text:
Fix disclaimer promises

@keybase/react-hackers
We had another bug here -- there were nested .then() calls, and we'd only perform one of them depending on whether WalletsGen.createWalletDisclaimerReceived({accepted}) or NavigateTo() fired first.  This led to people in the linkExisting flow getting stuck with us thinking they hadn't accepted the disclaimer.
Here's a rewrite to stop trying to do more than one thing per saga, which is what I should've done to start with.

does this need to be merged to master too?

authors: akalin-keybase cjb


text:
Add CloneWithAddedDepth() function to Logger

This is so closures that log can use a better
log line than the closure line.

👍

authors: akalin-keybase maxtaco


text:
Updates react to 154, electron to 147

Some issues with this upgrade

[x] React needs react-tap-event-plugin to be updated, but the older version of material-ui has a peer dependency on the older version. I don't want to touch material-ui at this point so instead i have a postinstall script which removes the peer deps from the installed material-ui. This doesn't affect anything other than running shrinkwrap, else it'll give you a warning and error out
[x] Added some flow ignores to some node_modules/tests which have issues
[x] Fixes some small lint issues w/ new eslint

@keybase/react-hackers this is ready

The commits 4022693e454e...61cd827b2f85 introduce visual changes on linux. :mag_right: 10 removed

Removed: Settings_Nav-Normal_Good_Banner (view original)
Removed: Settings_Nav-Normal_Bad_Banner (view original)
Removed: Settings_Nav-Normal (view original)
Removed: Search-Searching (view original)
Removed: Search-Group_non_user_Out_of_invites (view original)
Removed: Search-Group_non_user_No_Avatar (view original)
Removed: Search-Group_non_user_Has_Invite (view original)
Removed: Search-Group_non_user (view original)
Removed: Search-Group (view original)
Removed: Search-Chat_enabled (view original)

The commits 4022693e454e...61cd827b2f85 introduce visual changes on linux. :mag_right: 10 removed

Removed: Settings_Nav-Normal_Good_Banner (view original)
Removed: Settings_Nav-Normal_Bad_Banner (view original)
Removed: Settings_Nav-Normal (view original)
Removed: Search-Searching (view original)
Removed: Search-Group_non_user_Out_of_invites (view original)
Removed: Search-Group_non_user_No_Avatar (view original)
Removed: Search-Group_non_user_Has_Invite (view original)
Removed: Search-Group_non_user (view original)
Removed: Search-Group (view original)
Removed: Search-Chat_enabled (view original)

@keybase/react-hackers this updates the deps again to include electron 1.4.8

authors: chrisnojima keybase-ci-visdiff


text:
Indicator for QR code scan

If QR code was scanned puts an activity indicator in its place.

@keybase/react-hackers

The commits f9b194de6a6d...c6f2c0ba8ebf introduce visual changes on linux. :mag_right: 1 new

Added: Code_Page-Scanned_Code_Mobile

The commits 1d50a4e5a077...5f40d2617818 introduce visual changes on linux. :mag_right: 1 new

Added: Code_Page-Scanned_Code_Mobile

The commits 1d50a4e5a077...38ff2ac1d635 introduce visual changes on linux. :mag_right: 1 new

Added: Code_Page-Scanned_Code_Mobile

The commits 8f0c4dbac823...a696770fc025 introduce visual changes on linux. :mag_right: 1 new

Added: Code_Page-Scanned_Code_Mobile

The commits 8f0c4dbac823...4f1f0fc270c9 introduce visual changes on linux. :mag_right: 1 new

Added: Code_Page-Scanned_Code_Mobile

If my device is existing iPhone will show message:
"You should follow the instructions on the other device to continue."

The commits 8f0c4dbac823...2f0beb3b7605 introduce visual changes on linux. :mag_right: 1 new

Added: Code_Page-Scanned_Code_Mobile

The commits 404ff4ec4b57...eb67b38f45c6 introduce visual changes on linux. :mag_right: 1 new

Added: Code_Page-Scanned_Code_Mobile

authors: gabriel keybase-ci-visdiff


text:
[KEYCLOAK-4865] keycloak-connect stuck in redirect loop when access token is invalid

In order to see the fix you need: https://github.com/keycloak/keycloak-nodejs-connect/pull/79

Coverage increased (+0.6%) to 91.449% when pulling 4c85c88654723c01e9451573f2741b5b3f52f027 on abstractj:KEYCLOAK-4865 into de71997451c4c203352671438e34dd43ddd83c0d on keycloak:master.

Coverage increased (+0.6%) to 91.449% when pulling 4c85c88654723c01e9451573f2741b5b3f52f027 on abstractj:KEYCLOAK-4865 into de71997451c4c203352671438e34dd43ddd83c0d on keycloak:master.

:+1:

Seems fine to me.
However, imho it would be a good idea to have a true (non-mocked) HTTPS test as we have with Java adapters. What do you think? Should we create a JIRA for this so we don't forget?
The complication is it would require some configuration of Keycloak as well, i.e. changes in start-server.sh.

@vmuzikar would like to have specific tests for HTTPS scenarios? If yes, correct if I'm wrong, but I don't think this is related with this change. But yes, +1 for testing such scenarios, we should support the same scenarios present into the Java adapter.

@abstractj Yes, that's just something for future development. Agree, it's not much related to this change - it just came to my mind when I saw that you are adding a HTTPS test with this PR. So, it is a bit related to this change after all. ;)
Should we create a JIRA for future HTTPS tests?

@vmuzikar  +1000

authors: abstractj coveralls sebastienblanc vmuzikar

repo: keycloak/keycloak-nodejs-auth-utils


text:
Ref/regex parse

ldn refactoring

refactored parser functions
refactored test functions / added new test
refactored and added sample files for testing
refactored large-issue-parser js
refactored module import/export
refactored folder structure
added uuid (parser and also test for it)

when shipping this , we should be sure that we adjust the ldn => https://github.com/keyko-io/filecoin-large-clients-onboarding-bot/issues/127

discussion : Datacap Request Trigger comment
example link : https://github.com/filecoin-project/filecoin-plus-large-datasets/issues/1476#issuecomment-1360221436
here when you click the link you will see the template Simon's use , he uses "" (star symbol) which is different than in the verifiers tools repo samples because we use "#" instead "".
! before shipping this we should fix this problem.
if it should be "*" , then i need to change the logic and regex inside function.

@huseyincansoylu we should say Simon to use the version with "#"
after the doc with all the comment template is done, we can reference it to them

@huseyincansoylu we should say Simon to use the version with "#" after the doc with all the comment template is done, we can reference it to them

okay i sent message in the slack channel.

when we ship regex-ref then afterwards we should merge this  => https://github.com/keyko-io/filecoin-large-clients-onboarding-bot/pull/133

repo: keyko-io/filecoin-verifier-tools


text:
Fix a pretty serious bug in sort inference + better debugging info

This is the first of many smaller PRs that I am making because the work I've done on parametric productions turned out to be quite invasive and I'm trying to break it into smaller diffs.
Basically this fixes a bug where we were not correctly computing the full range of possible sorts for variables in nested ambiguities and thus triggering inference incorrectly to the wrong sort.

Just to make sure. This bug appeared since you added parametric productions?

This is more like two bugs and an improved error report, but yes, both of the two bugs were discovered due to the code changes I made for dealing with polymorphic productions. They could theoretically have surfaced at any time though with the right definition, because they're orthogonal to the changes I made, those changes just happened to uncover the right set of circumstances to trigger them.

Can you explain the circumstances then?

well, the else cases I added where we call TermCons.with were fixing a bug where if you had an inferred variable as an immediate child of a polymorphic production, it would not correctly add the correctly sorted cast to the parse tree, thus leading to incorrectly inferred sorts of variables at runtime.
The changes made to the Set<Multimap<>> code fixed a bug where we would incorrectly fail to split the state of inference into two cases when we reached an ambiguity, thus causing the sorts of variables on both sides of the ambiguity to be lumped together into a single possible solution to the inference problem.

authors: dwightguth radumereuta

repo: kframework/k


text:
#R2RMLTC0016c: timezone of docker instance UTC

Docker instance for mysql stores values as UTC. Retrieving the values takes into account the timezone difference resulting in the actual output be a number of hours of. One can change this by appending the following information for the database connection. E.g., by appending ?useLegacyDatetimeCode=false&serverTimezone=Europe/Brussels (for me, that is) in the JDBC connection URL. Shouldn't we document this on the README? Another option is the ensure that the docker instance uses the host's timezone, but I haven't found a way to do that yet.

IMO this is a problem of the connection between the engine and the database and should be solved in the configuration of the first one. We could add a note in the README.

Done. This can be closed if the note looks good (enough).

authors: chrdebru dachafra


text:
Setting Versatile Damage causes certain inputs to disappear

While setting up a weapon, it seems setting the Versatile formula causes the Versatile input and damage formula to disappear.

Closing as fixed.


text:
Add Dockerfile

Add Dockerfile to allow use inside Docker.
An example of the built container can be seen here:
https://hub.docker.com/r/kulinacs/evilginx2/

Thank you very much for this contribution!
I have currently no means of checking this, but it looks good and since you posted a built working container, I trust that it works :)
Thanks again!

authors: kgretzky kulinacs


text:
Instillation Problem

I attempted to use the compact instillation command presented, and Termux encountered a couple problems it seems. I only know the most basic parts of programming as of currently, so I'm just gonna share a screenshot rather than try to explain.

I would like to have this great YouTube downloader work again. It's been too long since I had to download it and make it work.

https://www.learntermux.tech/2022/01/Download-Termux-Latest-Version.html This is not a issue with tool, you just have to install the termux from different and not from the playstore.


text:
ComicSans

Нужно поменять шрифт на Comic Sans Mono

Отличный выбор
Le mar. 31 mai 2022 à 15:39, jegorpopow @.***> a écrit :

Нужно поменять шрифт на Comic Sans Mono
—
Reply to this email directly, view it on GitHub
https://github.com/khbminus/fastTyping/issues/56, or unsubscribe
https://github.com/notifications/unsubscribe-auth/AKEGZB4V2MSUOPPWNMUVD3LVMX25JANCNFSM5XNIJVXQ
.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

authors: Glebanister jegorpopow

repo: khbminus/fastTyping


text:
Auto select Leaf details on tree preparation

onglet Tree preparation »
quand on sélectionne une feuille dans le panneau « Selection details », elle ne s’affiche pas dans la fenêtre « Decision tree » (cela reste fixé sur la première feuille du groupe)

@fclerot pour être certain de bien comprendre, ce que tu souhaites, c'est que la fenêtre de gauche 'Decision tree' se scrolle automatiquement pour afficher la feuille sélectionnée dans 'Selection details' ?
c'est bien ça ?

oui !
De : Stéphane Bouget @.>
Envoyé : jeudi 5 mai 2022 10:09
À : khiopsrelease/kv-release @.>
Cc : CLEROT Fabrice INNOV/IT-S @.>; Mention @.>
Objet : Re: [khiopsrelease/kv-release] Auto select Leaf details on tree preparation (Issue #59)
@fclerothttps://github.com/fclerot pour être certain de bien comprendre, ce que tu souhaites, c'est que la fenêtre de gauche 'Decision tree' se scrolle automatiquement pour afficher la feuille sélectionnée dans 'Selection details' ?
c'est bien ça ?

Reply to this email directly, view it on GitHubhttps://github.com/khiopsrelease/kv-release/issues/59#issuecomment-1118281557, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AUQ66DIQH2KKEX4Z2PB5NBTVIN6ZBANCNFSM5U3GCRHA.
You are receiving this because you were mentioned.Message ID: @.@.>>
Orange Restricted

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

authors: fclerot khiopsrelease stephanebouget

repo: khiopsrelease/kv-release


text:
Not working for react >18 version

Is there any way to install it in the newer react version?
I want this feature but my react is latest version and most of the features already rely on this version so, there is no option to downgrade it.
Can you suggest me a way to add it in my project?

Do you figure out? It should be usable without special fallback

authors: khmyznikov rjlaasish

repo: khmyznikov/pwa-install


text:
Adding login and signup to your website

I want to implement login and signup functionality so that your website can be used by others dynamically . please assign me this project under GSSOC'24

@GarimaSingh0109 You raise your issuses

I can add an excellent login and sign up page which is validated additionally I can add some other the required features like forget password page

Hey @pranav-666 raise your own issue it is my issue


text:
[BUG]: Account selected auto transforming to "account" while exiting child table.

The account marked in yellow is transformed to "account"  and i am unable to select an expense account.

@forteqt  Hey bro..
Thank you for reporting this bug and sorry for the late reply..
Because of your post, I have made a lot if changes to the module and it is working without any problem, unless I have missed something..
So please give it another try and let me know if you face any problem..
Best regards..


text:
KOGITO-6766: [SWF Editor] Create a new serverless-workflow-diagram-editor package containing a new stream for Stunner development inside

PLEASE DO NOT SQUASH!!!
OTHERWISE WE WILL LOSE THE HISTORY OF THE NEW PACKAGE.
Hey @romartin @tiagobento, please,  could you review this PR?
JIRA: KOGITO-6766
Thanks

Hey @handreyrc
Great work! The filter-out of modules looks good, also I can't see any generated files (like /target or errai stuff) on the commit, so good. Also checked all groupIds and finally did a build, all good!
Approving. Thanks!

authors: handreyrc romartin

repo: kiegroup/kie-tools