text:
OPartitionedDatabasePool.close does not close the underlying storage

When a plocal document db pool is created and closed, the underlying storage is not closed.
OPartitionedDatabasePoolFactory poolFactory = new OPartitionedDatabasePoolFactory();
OPartitionedDatabasePool pool = poolFactory.get("plocal:db_test", "testuser", "testuser");
pool.close();
Pool close stack trace.
OPartitionedDatabasePool.close()
OStorageAbstract.close();
OStorageAbstract.close(false, false);
OAbstractPaginatedStorage.doClose(force, onDelete)
if (!force && !onDelete) ;

Yes , that is normal, storage is closed during JVM shutdown. Database is treated as connection to the storage .

In case of applications that use multiple embedded plocal database instances and separate pools for each, JVM heap size of the application can grow quite big. By closing a pool (done with one database instance) if the storage also shuts down that would keep the memory usage low.
Meanwhile the application can still continue working with other pools/database instances.
Also having storage.close inside pool.close when actually it is not doing anything is a little confusing.

Hi,
Storage is working on direct memory area, not heap and uses direct memory cache shared across all storages. So if one storage needs more memory and this memory is hold by storage which was not used for a long time memory will be freed from "idle" storage and will be used by "active" storage. Do you  have facts which contradicts to this explanation ?

Hi,
I am working with 300+ database instances and 10-20 loaded at a time. And hits outofmemory quite often.
While profiling, noticed the database storages are not getting unloaded.Also WAL threads kept running. Tried force close of storage which actually brought the memory usage down and also WAL threads were closed. This showed some improvements while profiling.
Was not aware of idle and active storage, off-heap cache. Can you please help me find documentation about embedded plocal databases, storages, off-heap cache and how all these work?
I can test again with these new learning and let you know in case I find anything contradicts.

Hi,
Tried writing a sample program that creates multiple plocal databases in a loop.
Code inside the loop :
OPartitionedDatabasePool pool = poolFactory.get("plocal:db/" +
dbInstanceName, "admin", "admin");
pool.setAutoCreate(true);
ODatabaseDocumentTx db = pool.acquire();
            // Insert dummy data (1000 ODocument)
           db.close();
	pool.close();

The program continuously crashed with out of memory somewhere between 37 - 40th instance every time.
SEVERE: Error during WAL background flush
java.lang.OutOfMemoryError: Java heap space
at com.orientechnologies.common.directmemory.OUnsafeMemoryJava7.get(OUnsafeMemoryJava7.java:30)
at com.orientechnologies.common.directmemory.ODirectMemoryPointer.get(ODirectMemoryPointer.java:79)
at com.orientechnologies.orient.core.storage.impl.local.paginated.wal.ODiskWriteAheadLog$LogSegment$FlushTask.commit(ODiskWriteAheadLog.java:194)
at com.orientechnologies.orient.core.storage.impl.local.paginated.wal.ODiskWriteAheadLog$LogSegment$FlushTask.run(ODiskWriteAheadLog.java:131)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Later I added below code after pool.close(), and the same program was able to create upto 500 instances without OOM.
Collection storages = Orient.instance().getStorages();
for (OStorage storage : storages) {
if (!storage.isClosed() && storage.getName().equalsIgnoreCase(dbInstanceName)) {
storage.close(true, false);
}
}
As expected next run had to do storage data restore
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} segment file 'database.ocf' was not closed correctly last time
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} Storage inst0 was not closed properly. Will try to restore from write ahead log.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Looking for last checkpoint...
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Found FUZZY checkpoint.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Data restore procedure from FUZZY checkpoint is started.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} Record OFuzzyCheckpointStartRecord{lsn=OLogSequenceNumber{segment=0, position=2554430}} com.orientechnologies.orient.core.storage.impl.local.paginated.wal.OFuzzyCheckpointStartRecord{lsn=null, previousCheckpoint=OLogSequenceNumber{segment=0, position=1986465}} will be skipped during data restore.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} Record com.orientechnologies.orient.core.storage.impl.local.paginated.wal.OFuzzyCheckpointEndRecord{lsn=OLogSequenceNumber{segment=0, position=2554470}} will be skipped during data restore.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Storage data restore was completed
All tests were run with VM settings - -Xmx32m -XX:-UseGCOverheadLimit.
Am I missing some configurations? Is force storage close a good idea?

HI,
I have question is it correct that you allocated only 32 megabytes of heap,
recommended size is 512 megabytes.
Could you try tests with this option ?
On Sat, Aug 15, 2015 at 11:47 PM raees notifications@github.com wrote:

Hi,
Tried writing a sample program that creates multiple plocal databases in a
loop.
Code inside the loop :
OPartitionedDatabasePool pool = poolFactory.get("plocal:db/" +
dbInstanceName, "admin", "admin");
pool.setAutoCreate(true);
ODatabaseDocumentTx db = pool.acquire();
        // Insert dummy data (1000 ODocument)
       db.close();
pool.close();

The program continuously crashed with out of memory somewhere between 37 -
40th instance every time.
SEVERE: Error during WAL background flush
java.lang.OutOfMemoryError: Java heap space
at
com.orientechnologies.common.directmemory.OUnsafeMemoryJava7.get(OUnsafeMemoryJava7.java:30)
at
com.orientechnologies.common.directmemory.ODirectMemoryPointer.get(ODirectMemoryPointer.java:79)
at
com.orientechnologies.orient.core.storage.impl.local.paginated.wal.ODiskWriteAheadLog$LogSegment$FlushTask.commit(ODiskWriteAheadLog.java:194)
at
com.orientechnologies.orient.core.storage.impl.local.paginated.wal.ODiskWriteAheadLog$LogSegment$FlushTask.run(ODiskWriteAheadLog.java:131)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
at
java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
at
java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Later I added below code after pool.close(), and the same program was able
to create upto 500 instances without OOM.
Collection storages = Orient.instance().getStorages();
for (OStorage storage : storages) {
if (!storage.isClosed() &&
storage.getName().equalsIgnoreCase(dbInstanceName)) {
storage.close(true, false);
}
}
As expected next run had to do storage data restore
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} segment file 'database.ocf' was not closed correctly
last time
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} Storage inst0 was not closed properly. Will try to
restore from write ahead log.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Looking for last checkpoint...
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Found FUZZY checkpoint.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Data restore procedure from FUZZY checkpoint is started.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} Record
OFuzzyCheckpointStartRecord{lsn=OLogSequenceNumber{segment=0,
position=2554430}}
com.orientechnologies.orient.core.storage.impl.local.paginated.wal.OFuzzyCheckpointStartRecord{lsn=null,
previousCheckpoint=OLogSequenceNumber{segment=0, position=1986465}} will be
skipped during data restore.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} Record
com.orientechnologies.orient.core.storage.impl.local.paginated.wal.OFuzzyCheckpointEndRecord{lsn=OLogSequenceNumber{segment=0,
position=2554470}} will be skipped during data restore.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Storage data restore was completed
All tests were run with VM settings - -Xmx32m -XX:-UseGCOverheadLimit.
Am I missing some configurations? Is force storage close a good idea?
—
Reply to this email directly or view it on GitHub
https://github.com/orientechnologies/orientdb/issues/4765#issuecomment-131446909
.

And about your question, closing of storage leads to performance
degradation, also because database instance does not know that storage is
closed it may lead to errors.
On Mon, Aug 17, 2015 at 8:36 AM Andrey Lomakin lomakin.andrey@gmail.com
wrote:

HI,
I have question is it correct that you allocated only 32 megabytes of
heap, recommended size is 512 megabytes.
Could you try tests with this option ?
On Sat, Aug 15, 2015 at 11:47 PM raees notifications@github.com wrote:

Hi,
Tried writing a sample program that creates multiple plocal databases in
a loop.
Code inside the loop :
OPartitionedDatabasePool pool = poolFactory.get("plocal:db/" +
dbInstanceName, "admin", "admin");
pool.setAutoCreate(true);
ODatabaseDocumentTx db = pool.acquire();
        // Insert dummy data (1000 ODocument)
       db.close();
pool.close();

The program continuously crashed with out of memory somewhere between 37

40th instance every time.

SEVERE: Error during WAL background flush
java.lang.OutOfMemoryError: Java heap space
at
com.orientechnologies.common.directmemory.OUnsafeMemoryJava7.get(OUnsafeMemoryJava7.java:30)
at
com.orientechnologies.common.directmemory.ODirectMemoryPointer.get(ODirectMemoryPointer.java:79)
at
com.orientechnologies.orient.core.storage.impl.local.paginated.wal.ODiskWriteAheadLog$LogSegment$FlushTask.commit(ODiskWriteAheadLog.java:194)
at
com.orientechnologies.orient.core.storage.impl.local.paginated.wal.ODiskWriteAheadLog$LogSegment$FlushTask.run(ODiskWriteAheadLog.java:131)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
at
java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
at
java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Later I added below code after pool.close(), and the same program was
able to create upto 500 instances without OOM.
Collection storages = Orient.instance().getStorages();
for (OStorage storage : storages) {
if (!storage.isClosed() &&
storage.getName().equalsIgnoreCase(dbInstanceName)) {
storage.close(true, false);
}
}
As expected next run had to do storage data restore
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} segment file 'database.ocf' was not closed correctly
last time
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} Storage inst0 was not closed properly. Will try to
restore from write ahead log.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Looking for last checkpoint...
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Found FUZZY checkpoint.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Data restore procedure from FUZZY checkpoint is started.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} Record
OFuzzyCheckpointStartRecord{lsn=OLogSequenceNumber{segment=0,
position=2554430}}
com.orientechnologies.orient.core.storage.impl.local.paginated.wal.OFuzzyCheckpointStartRecord{lsn=null,
previousCheckpoint=OLogSequenceNumber{segment=0, position=1986465}} will be
skipped during data restore.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
WARNING: {db=inst0} Record
com.orientechnologies.orient.core.storage.impl.local.paginated.wal.OFuzzyCheckpointEndRecord{lsn=OLogSequenceNumber{segment=0,
position=2554470}} will be skipped during data restore.
Aug 16, 2015 1:38:43 AM com.orientechnologies.common.log.OLogManager log
INFO: {db=inst0} Storage data restore was completed
All tests were run with VM settings - -Xmx32m -XX:-UseGCOverheadLimit.
Am I missing some configurations? Is force storage close a good idea?
—
Reply to this email directly or view it on GitHub
https://github.com/orientechnologies/orientdb/issues/4765#issuecomment-131446909
.

I used low value (32MB) in the tests to get OOM early.
With the recommended 512 the tests are running much better and went up to 500 instances without OOM. I was getting OOM in the application which is running on 2GB heap. Could be some other issue.
Thank you very much I am closing this thread.
FYI - The test printed below logs.
Aug 18, 2015 4:39:03 PM com.orientechnologies.common.log.OLogManager log
INFO: -> Open server.sh (or server.bat on Windows) and change the following variables: 1)  MAXHEAP=-Xmx303M 2) MAXDISKCACHE=5839
Aug 18, 2015 4:39:03 PM com.orientechnologies.common.log.OLogManager log
INFO: Database 'inst190' uses 4,834MB/5,688MB of DISKCACHE memory, while Heap is not completely used (usedHeap=253MB maxHeap=455MB). To improve performance set maxHeap to 303MB and DISKCACHE to 5839MB
Aug 18, 2015 4:39:03 PM com.orientechnologies.common.log.OLogManager log
INFO: -> Open server.sh (or server.bat on Windows) and change the following variables: 1) MAXHEAP=-Xmx303M 2) MAXDISKCACHE=5839

The service we are developing is expected to run 24/7 and would create around 200-300 DB instances (plocal document) to store some data snapshots received everyday. The heap size is 2GB. Each DB would be around 200MB size. The DB instances are written once and less likely to get loaded back.
Any recommendations on using multiple DB instances and to keep the service running 24/7 without any OOM? Or should I look for different options like single DB that stores all data or remote mode?

With more data available. Can we reopen this issue?
https://groups.google.com/forum/#!topic/orient-database/SwGN5xAI1oM

No, this issue is incorrect. Pool behaves as expected.
On Mon, Aug 31, 2015 at 10:43 AM Raees N notifications@github.com wrote:

With more data available. Can we reopen this issue?
https://groups.google.com/forum/#!topic/orient-database/SwGN5xAI1oM
—
Reply to this email directly or view it on GitHub
https://github.com/orientechnologies/orientdb/issues/4765#issuecomment-136289480
.

The real concern was about storage not getting closed even after all connections and pool is closed. It is OK, I can raise another one.

We already have issue related to this problem
https://github.com/orientechnologies/orientdb/issues/3055 .
On Mon, Aug 31, 2015 at 2:04 PM Raees N notifications@github.com wrote:

The real concern was about storage not getting closed even after all
connections and pool is closed. It is OK, I can raise another one.
—
Reply to this email directly or view it on GitHub
https://github.com/orientechnologies/orientdb/issues/4765#issuecomment-136335908
.

authors: laa raeesn rayees

repo: orientechnologies/orientdb


text:
Run go mod tidy

Deps have gotten out of sync; I fixed it by running go mod tidy.

Test failure appears to be unrelated; Launchpad uses Bazaar, not Git, and it's not installed on the OSX image.

Oh! I see 😮
I’ll chack it later! Thx 🙏🏻

source: gharchive/pull-request

authors: SamWhited ortuman

repo: ortuman/jackal

license_type: permissive

license_source: github-api


text:
allow to choose behavior of geolocation whitelist

options for geolocation:
-disable/enable
-to everyone/to whitelist
-use pattern / respond everyone

Or not? rethink the idea. maybe its not worth modyfing

source: gharchive/issue

repo: orzechowskikamil/motoresponder

license: MIT


text:
Request credentials for an os-climate bucket

Requesting credentials for github user: [nomunzul-b]
Requesting credentials for the bucket: [os-climate-physrisk-hazard-indicators]
Email address to send a credential download link: [nomunzul@stanford.edu]
Request checklist:

[Y] User can establish connection with the bucket
[Y] User can read files from the bucket
[N] User can write files to the bucket

Begin forwarded message:
From: Matt Watkins mwatkins@linuxfoundation.org
Subject: Credentials for the bucket: [os-climate-physrisk-hazard-indicators]
Date: 27 August 2024 at 15:36:49 BST
To: nomunzul@stanford.edu
Hi,
We received your access request here:
https://github.com/os-climate/OS-Climate-Community-Hub/issues/160
Find attached a CSV file containing the requested credentials,
Thanks,

Matt Watkins

The Linux Foundation
Release Engineering Team
https://www.linuxfoundation.org/
mwatkins@linuxfoundation.org

authors: ModeSevenIndustrialSolutions nomunzul-b

repo: os-climate/OS-Climate-Community-Hub


text:
Cloud cleaner doesn't clean all the rogue instances

As seen with cloudability dashboards:

Some instances are not properly killed by the cloud cleaner script.

Let's wait until new ones appear to debug that.

repo: osbuild/cloud-cleaner


text:
Translation missing in export modal

In the export modal the word "Text" is not translated.

Czech translation of text is text :) Checked in other languages and it seems it is very similar to text often:
po/cs.po:msgid "Text"
po/cs.po-msgstr "Text"
--
po/es.po:msgid "Text"
po/es.po-msgstr "Texto"
--
po/fr.po:msgid "Text"
po/fr.po-msgstr "Texte"
--
po/pt_BR.po:msgid "Text"
po/pt_BR.po-msgstr "Texto"

po/ru.po:msgid "Text"
po/ru.po-msgstr "Текст"

po/uk.po:msgid "Text"
po/uk.po-msgstr "Текст"

Just no noticed, that slovak is not present anymore. I though I kept it updated, but seems it slipped through. 55ee2e5d

Ahaha I guess I should have translated it myself. Thanks.

authors: jkozol marusak

repo: osbuild/cockpit-composer


text:
tests: Prefer require over assert

Prefer require.Equal over assert.Equal b/c it has the added benefit of failing fast.
NOTES:

needs a linter rule so we can enforce this
needs updates to lots of code just to make it compliant
there may be situations where we don't want to use require but instead still use assert, e.g. parametrized tests, subtests, etc. These will need to have a comment telling the linter to ignore the error.
This spans across all of the repositories and is a rather big task with little benefit.

Failing fast isn't always best. The way I've been trying (ha) to use them is to require on things that will cause other tests to fail.
eg. require that the length of an array is above the minimum expected, then assert a result from an index into that array.
During development it can save quite a bit of time to see all of the failures at once instead of having to fix things one at a time.
So I don't think this should be enforced using rules, but should be something that patch reviewers should take into consideration.

I'm not sure about the value of this task. The only benefit is speed and that's questionable - unit tests are quite fast and Go also does a ton of test results caching. In the integration tests, I don't see much benefit either.

authors: atodorov bcl ondrejbudai

repo: osbuild/osbuild-composer


text:
Koji: Retrieve the Manifest for a compose job

Added an API endpoint that returns the manifest for a given osbuild-koji job.
The Koji API function assumes that the second dependency of the incoming job ID (which should match a Finalize Job) is the first (and perhaps only) Build Job. It retrieves the arguments of the Build Job to extract the Manifest.
The tests cover basic (non-failing) cases for now. More notable is that in all test cases the manifest is empty, which isn't very interesting.
Closes #996.

Very cool! Looks very good. One thing, since the manifest is different for each architecture, I think we want the manifest for all the builds; vermuch as with status and logs. :D

Thanks.  Should have realised that the manifests are different after being submitted (even though the same request is sent) since different archs have different hashes and maybe even packages after depsolve.

Very cool! Looks very good. One thing, since the manifest is different for each architecture, I think we want the manifest for all the builds; vermuch as with status and logs. :D

Thanks.  Should have realised that the manifests are different after being submitted (even though the same request is sent) since different archs have different hashes and maybe even packages after depsolve.

Addressed all your comments.  It's now also rebased on #1158 since that changes the fsjobqueue testing which this PR adds to.

Addressed all your comments.  It's now also rebased on #1158 since that changes the fsjobqueue testing which this PR adds to.


text:
Disable automatic local worker startup

Now that we deploy remote workers by default, there's no need for an
automatically-started local worker that listens on a socket. This also
alleviates the need to mask the osbuild-worker@.service unit when you
deploy remote workers.
Signed-off-by: Major Hayden major@redhat.com

I would love to only have one type of worker.
My only concern with this is how to make it "just work" out of the box for someone just installing cockpit-composer and interacting with it through the UI. In particular, we would need to provision SSL certificates for this to work, right?

Right. Let's skip this for now, then.

authors: major teg


text:
CI: Store RPMs by SHA

Store RPMs in object storage based on their SHA rather than the Jenkins
build ID. This allows tests to be re-run without repeating the mock
build step.
Signed-off-by: Major Hayden major@redhat.com

Download issues again on F31, but that's unrelated to this PR. Merging.


text:
Setting Key on Push

Is it possible to provide a key when pushing data without Firebase generating it's own?

When you use update instead of push, it doesn't add its own key.

@garyfoster can you gave us an example? question little bit confused me.

Sorry, the answer from @arcticleo solved my problem, closing. Thanks all!

authors: arcticleo garyfoster gugakatsi

repo: oscardelben/firebase-ruby

license: mit

license_source: bigquery


text:
Move to new React Query syntax

Using the object syntax in docs and examples.

Upgrade to v5 beta

Internally preped this.
Are tRPC going to update their syntax to align with the new syntax?

This is going to unnecessary when rspc moves to the proxy API.

repo: oscartbeaumont/rspc


text:
tauri with nextjs requires importing invoke from tauri-apps/api/tauri

Currently tauri-specta generates a binding.ts file with the following line:
         import { invoke as TAURI_INVOKE } from "@tauri-apps/api";
When building the app cargo tauri dev using the NextJS framework, prerendering the app pages gives the following error:
ReferenceError: window is not defined
If the import is manually changed to
import { invoke as TAURI_INVOKE } from "@tauri-apps/api/tauri";
Then building the app works fine.

Related: https://github.com/tauri-apps/tauri/issues/7488

Any update on this?

This is fixed on main, it can be releases in another rc release

This should be solved with Tauri v2 as the import is now @tauri-apps/api/core.
Will be releasing Tauri v2 support in the coming days once a few minor bugs are sorted out.

authors: Brendonovich SamHep0803 StoicDeveloper oscartbeaumont

repo: oscartbeaumont/tauri-specta


text:
Gratuitous ARPs stop after 2nd send

Love the container image but after two sends of the gratuitous arps for the VIPs, five seconds apart, they just stop, the arp table entries age out on routers and my virtual servers go down.
I have tried this on a Centos7 docker host, an Ubtunu 16:04 docker host and on my Debian Jessie workstation, as well as various run options ( using defaults, specifying options with ENV variables and using my own config file ).
Log file just stops after 2nd arp send:
Fri Aug 25 15:43:53 2017: Sending gratuitous ARP on eth0 for 192.168.122.201
Fri Aug 25 15:43:53 2017: VRRP_Instance(VI_1) Sending/queueing gratuitous ARPs on eth0 for 192.168.122.201
Fri Aug 25 15:43:53 2017: Sending gratuitous ARP on eth0 for 192.168.122.201
Fri Aug 25 15:43:53 2017: Sending gratuitous ARP on eth0 for 192.168.122.201
Fri Aug 25 15:43:53 2017: Sending gratuitous ARP on eth0 for 192.168.122.201
Fri Aug 25 15:43:53 2017: Sending gratuitous ARP on eth0 for 192.168.122.201
Fri Aug 25 15:43:58 2017: Sending gratuitous ARP on eth0 for 192.168.122.201
Fri Aug 25 15:43:58 2017: VRRP_Instance(VI_1) Sending/queueing gratuitous ARPs on eth0 for 192.168.122.201
Fri Aug 25 15:43:58 2017: Sending gratuitous ARP on eth0 for 192.168.122.201
Fri Aug 25 15:43:58 2017: Sending gratuitous ARP on eth0 for 192.168.122.201
Fri Aug 25 15:43:58 2017: Sending gratuitous ARP on eth0 for 192.168.122.201
Fri Aug 25 15:43:58 2017: Sending gratuitous ARP on eth0 for 192.168.122.201

I actually took down a real server just to make something appear in the log and confirm that keepalived was alive:
Fri Aug 25 15:46:59 2017: Error connecting server [192.168.122.224]:tcp:80.
Fri Aug 25 15:47:02 2017: Error connecting server [192.168.122.224]:tcp:80.
Fri Aug 25 15:47:05 2017: Error connecting server [192.168.122.224]:tcp:80.
Fri Aug 25 15:47:08 2017: Error connecting server [192.168.122.224]:tcp:80.
Fri Aug 25 15:47:08 2017: Check on service [192.168.122.224]:tcp:80 failed after 3 retry.
Fri Aug 25 15:47:08 2017: Removing service [192.168.122.224]:tcp:80 from VS [192.168.122.201]:tcp:80
Fri Aug 25 15:47:08 2017: Remote SMTP server [165.161.12.120]:25 connected.
Fri Aug 25 15:47:08 2017: Error processing RCPT cmd on SMTP server [165.161.12.120]:25. SMTP status code = 554
Fri Aug 25 15:47:08 2017: Can not read data from remote SMTP server [165.161.12.120]:25.

Seems really odd that nobody else is seeing this.
I have keepalived working fine in same environment outside of containers.

Just ignore this while I do a little more research. Need to go back and check the behavior of my non dockerized keepalived and make sure I have diagnosed the issue correctly.

Apologies - misdiagnosis on my part. My working keepalived also only sends GARPs twice. This must be something else.

repo: osixia/docker-keepalived


text:
Bootstrap volume

Hello,
It could be nice to add a bootstrap volume to allow to pre configure the openldap at first startup.
For instance, i would like to be able to put a bunch of ldif files into a volume and expect they are automaticaly imported at first startup.
Like it s done on mysql docker. (https://hub.docker.com/_/mysql/)

Hello,
this is already possible but more complex than with the mysql image:
For example if your ldif files are in /data/ldif on your host, mount this directory as a volume to any location in the container for example /tmp/ldif and copy them to /container/service/slapd/assets/config/bootstrap/ldif/
docker run -v /data/ldif:/tmp/ldif osixia/openldap --cmd "cp -a /tmp/ldif/. /container/service/slapd/assets/config/bootstrap/ldif/"

Note that you can't mount directly you ldif folder to /container/service/slapd/assets/config/bootstrap/ldif/ without breaking everything.
But let's make it more simple in a next version :)

To see all run options of this image:
docker run osixia/openldap --help

Hi,
To get this working I need --copy-service on the command line and to specify changetype: add to each entry. This make ldapmodify behave like ldapadd
Without this, i got:
ldap_1      | + ldapmodify -h localhost -p 389 -D cn=admin,dc=ldap,dc=ldap2pg,dc=docker -w integral -f /container/run/service/slapd/ass
ets/config/bootstrap/ldif/95-data.ldif
ldap_1      | + log-helper debug
ldap_1      | 596eee85 conn=1026 fd=16 ACCEPT from IP=127.0.0.1:57444 (IP=127.0.0.1:389)
ldap_1      | 596eee85 conn=1026 op=0 BIND dn="cn=admin,dc=ldap,dc=ldap2pg,dc=docker" method=128
ldap_1      | 596eee85 conn=1026 op=0 BIND dn="cn=admin,dc=ldap,dc=ldap2pg,dc=docker" mech=SIMPLE ssf=0
ldap_1      | 596eee85 conn=1026 op=0 RESULT tag=97 err=0 text=
ldap_1      | 596eee85 conn=1026 op=1 ADD dn="cn=slap,dc=ldap,dc=ldap2pg,dc=docker"
ldap_1      | 596eee85 conn=1026 op=1 RESULT tag=105 err=0 text=
ldap_1      | 596eee85 conn=1026 op=2 UNBIND
ldap_1      | 596eee85 conn=1026 fd=16 closed
ldap_1      | ldapmodify: modify operation type is missing at line 22, entry "ou=people,dc=ldap,dc=ldap2pg,dc=docker"

ldap_1      | *** /container/run/startup/slapd failed with status 247

Maybe we need a bit of documentation about seeding. That would be nice to accept ldapadd files.

@cgarnier README is updated. Please close the issue once you got it!

Version 1.1.9 allows you yo mount your ldif files to /container/service/slapd/assets/config/bootstrap/ldif/custom
closing this :)

Nice =), Ty

authors: bersace cgarnier osixia

repo: osixia/docker-openldap


text:
Javaanpr syntax.xml not working

I have changed syntax.xml according to my country's numberplate but its not working.
type name="pakistan"
char content="abcdefghijklmno0pqrstuvwxyz"
char content="abcdefghijklmno0pqrstuvwxyz"
char content="abcdefghijklmno0pqrstuvwxyz"
char content="o0123456789"
char content="o0123456789"
char content="o0123456789"
type
This is my syntax.xml therefore it should only read number plate like APR420 but it also read other text on number plate like SINDH and neglects APR420. Am I missing something please help?

Some ideas:

Are you sure you're using the correct syntax.xml file?
The algorithm doesn't work 100% (no such algorithm does, currently), you can't expect it to work 100% correctly :)
Take a look at this StackOverflow question and answer: http://stackoverflow.com/a/18689437/2713162

Waqar's email:
Hello
Your response to my query was very helpful as I was able to run syntax.xml file. But sorry for bothering you again there is another issue i.e
My syntax.xml file is
<?xml version="1.0" encoding="iso-8859-2"?>

<structure>

<type name="SINDH">
<char content="abcdefghijklmno0pqrstuvwxyz"/>
<char content="abcdefghijklmno0pqrstuvwxyz"/>
<char content="abcdefghijklmno0pqrstuvwxyz"/>
<char content="o0123456789"/>
<char content="o0123456789"/>
<char content="o0123456789"/>
<char content="o0123456789"/>
</type>

</structure>

Now issue is this that 3rd char content contains only alphabets but it reads third character sometimes as 8 while 8 is not listed in 3rd char content of syntax.xml. For example it reads ARB-420 number plate as AR8420 or sometimes reads it as ARF4Z0 while Z is not in 5th char context in syntax.xml. Kindly help
Regards,
Waqar Ahmed

The likely cause of this is the - character. Your syntax.xml file seems to contain 3 characters and then 4 digits, although your plates only have 3 characters, a dash and 3 digits.
Suggestions:

remove the first digit from your syntax.xml
replace it with a "dash", or nothing

You havn't understood my issue.
AFR420 should not be red as AFR4ZO as 5th char content doesnot contain Z it only contain numerical digits. I have done what you have said limited my syntax.xml to 6 char contents but results are same.

Hmm, that is weird. Are you sure you're loading the right syntax.xml? Mind posting a sample image, so I can try it out (and possibly fix it)?

This is sample image and syntax.xml is

Its reading it as AR8420 while it should not make 3rd char as 8 because 8 is not included in 3rd char content of syntax.xml. Kindly help me out

Kindly also tell me how to read number plates which are two lined i.e.

How will I modify my syntax.xml to read this. Please help

@waqar17october: If I remember correctly, number plates with two lines will not work in JavaANPR by design.
As to the syntax.xml problem, I'm looking into it.

@waqar17october regarding AFR420: I cannot seem to reproduce your problem. I'll try with your custom syntax.xml

Can't reproduce even with your own syntax xml. Are you sure you set the correct syntax xml in config.xml?
Proof:

Thanku for your so much interest.
Can we somehow edit JavaAnpr to read 2 lined number plates? If yes kindly tell me how?

@waqar17october it sure is possible, but I'm not really sure how right off the bat. If you try to do it on your own, use this for help: Original author's documentation

Ok

Closing as invalid.

repo: oskopek/javaanpr


text:
[Snyk] Security upgrade io.swagger.core.v3:swagger-jaxrs2 from 2.1.4 to 2.2.1

This PR was automatically created by Snyk using the credentials of a real user.Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.
Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

src/server-cm/pom.xml

Vulnerabilities that will be fixed
With an upgrade:

Severity
Priority Score (*)
Issue
Upgrade
Breaking Change
Exploit Maturity

589/1000  Why? Has a fix available, CVSS 7.5
Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244
io.swagger.core.v3:swagger-jaxrs2:  2.1.4 -> 2.2.1
No
No Known Exploit

(*) Note that the real score may have changed since the PR was raised.
Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
🛠 Adjust project settings
📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.

authors: CLAassistant berezovskyi

repo: oslc-op/refimpl


text:
Download update improvements

Issues reported:

MD5 is not correct for planet.mbtiles, after/during update
Update of the planet is not atomic (link on the website points to a file which is being uploaded) so people downloading in the same moment never get a correct file

# md5sum planet.mbtiles
9821f7be1100f730165c6b394327ae46  planet.mbtiles

Report:
On Fri, Jul 15, 2016 at 7:28 AM, ferns@backbonesystems.nl wrote:

Hi, Thanks for the wonderful OSM planet vector tile download you provide. Unfortunately, it seems the planet md5 on the download is not updated and it looks like the planet file download is not 'stable': I downloaded the planet file two times and I got different files with different checksums and the data in the western part of the Netherlands (around Amsterdam) in the deeper levers (around level 10) is not available...maybe because of corrupt data? I'm downloading the planet file now for a third time because it was updated (Thursday, 14 July 2016 at 18:57 UTC...maybe as I was downloading it?). Maybe you can look into a solution which makes the download more stable? But again, osm2vectortiles is a great site and it is perfect to set up vector tiles quickly. Great job! Cheers, Ferns

For what it's worth, I downloaded planet.mbtiles that day, am experiencing the same issue described in the email, 404s in northern Europe starting at zoom level >10. Interestingly, my checksum matches above ('9821f7be1100f730165c6b394327ae46').

Waiting on md5sum on the new download, but what I downloaded last night appears to the same as what I downloaded on the 14th (both files show same number of bytes and date modified matches upload date)
57184074752 Jul 14 14:57 planet.mbtiles

@brianshaler Could you please create a new ticket where you mentioned the exact ZXY tiles which are missing in the dump?

MD5 is not correct for planet.mbtiles, after/during update

Yeah always need to update the md5 in the future.

Update of the planet is not atomic (link on the website points to a file which is being uploaded) so people downloading in the same moment never get a correct file

Preserving old planets cost money but I think it is still worth the tradeoff.
Keep old versions of the planet around (but not of the extracts).
So process for the future (sadly already didn't follow this when I was reuploading the missing 500 z8 pyramids from #380 before):

Always give a distinct name of the planet file (add date?).
Calc md5 - add to web page
Regenerate extracts

Planet filename proposal
schema: planet-{date}-{md5-hash}.mbtiles
example: planet-270716-a426f297c4936f97f2a14fc5a386e3dd.mbtiles
This way a user which has downloaded the planet file knows how current the planetfile is (date) and directly has the md5 hash to verify the file. Secondly, we don't have to update the md5 hash on the website on every upload anymore, because we can extract the hash programmatically based on the filename 🎉
Is there a convention around using minus (-) or underline (_) as filename separator?- Thinking about harmonizing the filenames of the city and country extracts. Some of them have mixed filenames like the following: v2.0/extracts/mountain-view_california.mbtiles. I think we should decide on one.
@lukasmartinelli what do you think about this?- The create-extract.py script would probably need to be modified to take the planet filename as argument. Couldn't find the code which uploads the planet file and planet zoom levels, is this done manually right now?

This way a user which has downloaded the planet file knows how current the planetfile is (date) and directly has the md5 hash to verify the file. Secondly, we don't have to update the md5 hash on the website on every upload anymore, because we can extract the hash programmatically based on the filename 🎉

Good idea for the planet. Will start using this.

Is there a convention around using minus (-) or underline (_) as filename separator?- Thinking about harmonizing the filenames of the city and country extracts. Some of them use both (minus and underline) in their filename like the following: v2.0/extracts/mountain-view_california.mbtiles. I think we should decide on one.

- means space (mountain-view -> Mountain View).
_ is the separator that separates the city from the region/country (originating from Metro extracts)

@lukasmartinelli what do you think about this?- The create-extract.py script would probably need to be modified to take the planet filename as argument. So that it is possible to assign a different filename on each upload of the planet file.

I usually rename the file before doing it but adding a env var is easy.

Couldn't find the code which uploads the planet file and planet zoom levels, is this done manually right now?

Only planet is uploaded manually. Low zoom level extracts are automated (https://github.com/osm2vectortiles/osm2vectortiles/blob/master/src/create-extracts/create-extracts.sh).

Good idea for the planet. Will start using this.

Cool.

- means space (mountain-view -> Mountain View).
_ is the separator that separates the city from the region/country (originating from Metro extracts)

Alright, now I understand. We will let it how it is right now.

I usually rename the file before doing it but adding a env var is easy.

So no code changes need to be made, great.

Lot of improvements :)
My question about the new download schemas :

in the future ...  I would like to write a daily cron script  for detecting the new (Planet/Hungary/Budapest)  extract exists  or not
and if  the new version is exists -  I would like to automatically download ,  check the md5 and refresh my local copy.

What is the suggested method to implement this? This is a typical question we need to add to the FAQ.
other ..
We have 2 dates/timestamps

osm planet last modifications timestamp ( this is sometimes important for debugging, because the osm database is changing ,   for example  XXX POI is changed before or after ????  )
it is like "OSM Data from: 2016-07-27 00:58 UTC"
mbtiles generating date/timestamp ( =  Last modified )  when the generating process finished, so this is a technical info - but also important for debugging

Is it possible to add both timestamp somewhere ?

now only - I can see this on the download page ...
"Full Planet and extracts were last updated on Tuesday, 26 July 2016 at 19:24 UTC"

@ImreSamu The definition would be that when the planet file changes all extracts change as well. Cron script could actually detect the update date from the S3 bucket but that is not perfect.
I now use the new naming schema (and date and md5sum are derived from it) on http://osm2vectortiles.org/downloads/.

MD5 is not correct for planet.mbtiles, after/during update
Update of the planet is not atomic (link on the website points to a file which is being uploaded) so people downloading in the same moment never get a correct file

This is now solved since the link is atomic now.
Links to the planet and low zoom level extracts.
The low zoom level extracts always contain the md5sum of the planet file they were derived form.
s3://osm2vectortiles-downloads/v2.0/planet_2016-06-20_7088ce06a738dcb3104c769adc11ac2c_z0-z14.mbtiles
s3://osm2vectortiles-downloads/v2.0/planet_2016-06-20_7088ce06a738dcb3104c769adc11ac2c_z0-z5.mbtiles
s3://osm2vectortiles-downloads/v2.0/planet_2016-06-20_7088ce06a738dcb3104c769adc11ac2c_z0-z8.mbtiles

I also deleted the previous planet file that has no md5sum in it (I know this now breaks the link for people but otherwise they would always get the old version).

We have 2 dates/timestamps
osm planet last modifications timestamp ( this is sometimes important for debugging, because the osm database is changing , for example XXX POI is changed before or after ???? )
it is like "OSM Data from: 2016-07-27 00:58 UTC"
mbtiles generating date/timestamp ( = Last modified ) when the generating process finished, so this is a technical info - but also important for debugging

@ImreSamu We should open a separate issue for that. I think adding metadata to the MBTiles is a good solution (we could even embed the information from the osm_timestamp table)

authors: ImreSamu brianshaler klokan lukasmartinelli manuelroth


text:
CopyrightNotice for TilesOverlay is not shown

Issue Type
[x] Question
[x] Bug (?)
Description and/or steps/code to reproduce the problem
@monsieurtanuki
In my app, I show a basic map (MAPNIK) with a possible overlay (e.g. OPEN_SEAMAP). The copyright notice of MAPNIK ("© OpenStreetMap contributors") is shown, but the notice for OPEN_SEAMAP ("OpenSeaMap") is not. See screenshot below:

According to SampleWithTilesOverlay.java, I tried something like:
//Copyright overlay
String copyrightNotice = mMapView.getTileProvider().getTileSource().getCopyrightNotice();
CopyrightOverlay copyrightOverlay = new CopyrightOverlay(this);
copyrightOverlay.setCopyrightNotice(copyrightNotice + " / test with OpenSeaMap");
mMapView.getOverlays().add(copyrightOverlay);

But this didn't change anything, because the copyright notice is overwritten in the class "CopyrightOverlay" every time the map is updated.
private String mCopyrightNotice;

@Override
public void draw(Canvas canvas, MapView map, boolean shadow) {
    setCopyrightNotice(map.getTileProvider().getTileSource().getCopyrightNotice());
    draw(canvas, map.getProjection());
}

public void setCopyrightNotice(final String pCopyrightNotice) {
    mCopyrightNotice = pCopyrightNotice;
}

So how can I show the copyright notices from both MAPNIK and OPEN_SEAMAP side by side or on top of each other?
Environment
If it's a bug, version(s) of android this affects:
All
Version of osmdroid the issue relates to:
6.1.8

@mikebravoyes I guess you're right, it's a kind of bug.
The current CopyrightOverlay seems to be dedicated only to the main tile provider.
In your case, I would create something like SecondaryCopyrightOverlay that extends CopyrightOverlay, and just overrides this method:
@Override
public void draw(Canvas canvas, MapView map, boolean shadow) {
    // now we don't need that // setCopyrightNotice(map.getTileProvider().getTileSource().getCopyrightNotice());
    draw(canvas, map.getProjection());
}

Then, set the offsets accordingly with setOffset(x,y), et voilà!
If it works, feel free to create a PR.

@mikebravoyes I guess you're right, it's a kind of bug.
The current CopyrightOverlay seems to be dedicated only to the main tile provider.
In your case, I would create something like SecondaryCopyrightOverlay that extends CopyrightOverlay, and just overrides this method:
@Override
public void draw(Canvas canvas, MapView map, boolean shadow) {
    // now we don't need that // setCopyrightNotice(map.getTileProvider().getTileSource().getCopyrightNotice());
    draw(canvas, map.getProjection());
}

Then, set the offsets accordingly with setOffset(x,y), et voilà!
If it works, feel free to create a PR.

@monsieurtanuki
Thanks for the tip with overriding the original method draw(). After that, it was quite easy:
//Copyright overlay
String copyrightNotice = mMapView.getTileProvider().getTileSource().getCopyrightNotice();
String notice2 = mapTileSource.getTileSource(mapType).getCopyrightNotice();  // OPEN_SEAMAP, "OpenSeaMap"
CopyrightOverlay copyrightOverlay = new CopyrightOverlay(this);

// append the 2nd text to the 1st one
copyrightOverlay.setCopyrightNotice(copyrightNotice + " / " + notice2);
mMapView.getOverlays().add(copyrightOverlay);

The result looks like this:

By the way, the definitions in TileSourceFactory.java are somehow fragmentary. Where the copyright string was missing, I took the ITileSource.name() instead.
In some places, the copyright string exists, but the curly brackets are placed at a wrong position. For example:
public static final OnlineTileSourceBase ChartbundleENRH = new XYTileSource("ChartbundleENRH", 4, 12, 256, ".png?type=google",
    new String[]{"https://wms.chartbundle.com/tms/v1.0/enrh/", "chartbundle.com"});
//                                                           ^                  ^

This shall be:
public static final OnlineTileSourceBase ChartbundleENRH = new XYTileSource("ChartbundleENRH", 4, 12, 256, ".png?type=google",
    new String[]{"https://wms.chartbundle.com/tms/v1.0/enrh/"}, "chartbundle.com");
//                                                           ^                   ^

The same for ChartbundleENRL, but ChartbundleWAC is OK. I would recommend to revise the whole TileSourceFactory.java.

@monsieurtanuki
Thanks for the tip with overriding the original method draw(). After that, it was quite easy:
//Copyright overlay
String copyrightNotice = mMapView.getTileProvider().getTileSource().getCopyrightNotice();
String notice2 = mapTileSource.getTileSource(mapType).getCopyrightNotice();  // OPEN_SEAMAP, "OpenSeaMap"
CopyrightOverlay copyrightOverlay = new CopyrightOverlay(this);

// append the 2nd text to the 1st one
copyrightOverlay.setCopyrightNotice(copyrightNotice + " / " + notice2);
mMapView.getOverlays().add(copyrightOverlay);

The result looks like this:

By the way, the definitions in TileSourceFactory.java are somehow fragmentary. Where the copyright string was missing, I took the ITileSource.name() instead.
In some places, the copyright string exists, but the curly brackets are placed at a wrong position. For example:
public static final OnlineTileSourceBase ChartbundleENRH = new XYTileSource("ChartbundleENRH", 4, 12, 256, ".png?type=google",
    new String[]{"https://wms.chartbundle.com/tms/v1.0/enrh/", "chartbundle.com"});
//                                                           ^                  ^

This shall be:
public static final OnlineTileSourceBase ChartbundleENRH = new XYTileSource("ChartbundleENRH", 4, 12, 256, ".png?type=google",
    new String[]{"https://wms.chartbundle.com/tms/v1.0/enrh/"}, "chartbundle.com");
//                                                           ^                   ^

The same for ChartbundleENRL, but ChartbundleWAC is OK. I would recommend to revise the whole TileSourceFactory.java.

Thank you @mikebravoyes for the bug detection!
I had a look at TileSourceFactory and I agree with you:  ChartbundleENRH and ChartbundleENRL should be fixed the way you described. I scanned the rest of the class but did not see additional obvious typos.
Feel free to create a PR in order to fix TileSourceFactory.

Thank you @mikebravoyes for the bug detection!
I had a look at TileSourceFactory and I agree with you:  ChartbundleENRH and ChartbundleENRL should be fixed the way you described. I scanned the rest of the class but did not see additional obvious typos.
Feel free to create a PR in order to fix TileSourceFactory.

@monsieurtanuki
No obvious typos, but missing copyright strings for HIKEBIKEMAP and BASE_OVERLAY_NL.
PUBLIC_TRANSPORT, FIETS_OVERLAY_NL and ROADS_OVERLAY_NL have the same copyright as MAPNIK ("© OpenStreetMap contributors"), which is probably not wrong, but redundant.

@monsieurtanuki
No obvious typos, but missing copyright strings for HIKEBIKEMAP and BASE_OVERLAY_NL.
PUBLIC_TRANSPORT, FIETS_OVERLAY_NL and ROADS_OVERLAY_NL have the same copyright as MAPNIK ("© OpenStreetMap contributors"), which is probably not wrong, but redundant.

authors: mikebravoyes monsieurtanuki

repo: osmdroid/osmdroid


text:
Added asset list for tokens Sifchain Will be transferring via IBC.

List of Tokens:
"Sifchain ROWAN Token"
"Ethereum USDT Token"
"Ethereum USDC Token"
"Ethereum CRO Token"
"Ethereum WBTC Token"
"Ethereum ETH Token"
"Ethereum DAI Token"
"Ethereum YFI Token"
"Ethereum ZRX Token"
"Ethereum WSCRT Token"
"Ethereum WFIL Token"
"Ethereum UNI Token"
"Ethereum UMA Token"
"Ethereum TUSD Token"
"Ethereum SXP Token"
"Ethereum SUSHI Token"
"Ethereum SUSD Token"
"Ethereum SRM Token"
"Ethereum SNX Token"
"Ethereum SAND Token"
"Ethereum RUNE Token"
"Ethereum REEF Token"
"Ethereum OGN Token"
"Ethereum OCEAN Token"
"Ethereum MANA Token"
"Ethereum LRC Token"
"Ethereum LON Token"
"Ethereum LINK Token"
"Ethereum IOTX Token"
"Ethereum GRT Token"
"Ethereum FTM Token"
"Ethereum ESD Token"
"Ethereum ENJ Token"
"Ethereum CREAM Token"
"Ethereum COMP Token"
"Ethereum COCOS Token"
"Ethereum BOND Token"
"Ethereum BNT Token"
"Ethereum BAT Token"
"Ethereum BAND Token"
"Ethereum BAL Token"
"Ethereum ANT Token"
"Ethereum AAVE Token"
"Ethereum 1INCH Token"
"Ethereum LEASH Token"
"Ethereum SHIB Token"
"Ethereum TIDAL Token"
"Ethereum PAID Token"
"Ethereum RNDR Token"
"Ethereum CONV Token"
"Ethereum RFUEL Token"
"Ethereum AKRO Token"
"Ethereum B20 Token"
"Ethereum TSHP Token"
"Ethereum LINA Token"
"Ethereum DAOFI Token"
"Ethereum KEEP Token"
"Ethereum RLY Token"

Can we create a separate PR for ROWAN to get that merged asap, and then we can figure out how to deal with the bridged tokens separately?

Can we create a separate PR for ROWAN to get that merged asap, and then we can figure out how to deal with the bridged tokens separately?

https://github.com/osmosis-labs/assetlists/pull/27 updated Rowan Only

repo: osmosis-labs/assetlists


text:
Upgrade contracts to v0.4.0.alpha.1

🚧 WIP
After #45

Bump contracts

TODO:

[ ] claim rewards in e2e test

Great you started on this. Two notes (and please check with Mauro on slack to align e2e tests with contract design).

No ics20 channel is used. See https://github.com/osmosis-labs/mesh-security/blob/main/docs/ibc/Rewards.md#selected-implementation
Great to query that rewards show up on the provider side. When they are withdrawn, you must provide a consumer side address and the tokens will be released to that address (via the same control channel).

This is mean to handle accounting of the consumer rewards where the stakers are, but keep the rewards on their home chain, to encourage staking over selling

authors: alpe ethanfrey

repo: osmosis-labs/mesh-security-sdk


text:
feat: Hide External Boost APR with Build Feature Flag (#2762) (MASTER)

feat: hide external boost with feature flag

feat: allow using env vars to exclude boosted pools

improvement: remove console log

What is the purpose of the change

ClickUp Task
ClickUp Task URL
Brief Changelog

Testing and Verifying

Documentation and Release Note

Closing in favor of merging #2773 instead

repo: osmosis-labs/osmosis-frontend


text:
Got tree shaking working!

Got minimal tree shaking working, this dropped bundle size by 8%.
(I am a bit shocked by the low impact, I think I have to apply these package.json changes to every one of our packages)

Nice. 1.76 MB main JS bundle. Was 2.06+MB about a month ago (various PRs have reduced the bundle size)
Route (pages)                                       Size     First Load JS
│ ┌ ○ /                                               190 B          1.78 MB
│ ├   /_app                                           0 B            1.73 MB
│ ├ ○ /404                                            443 B          1.74 MB
│ ├ ○ /500                                            439 B          1.74 MB
│ ├ ƒ /api/active-gauges                              0 B            1.73 MB
│ ├ ƒ /api/broadcast-transaction                      0 B            1.73 MB
│ ├ ƒ /api/edge-trpc-assets/[trpc]                    0 B            1.73 MB
│ ├ ƒ /api/edge-trpc-main/[trpc]                      0 B            1.73 MB
│ ├ ƒ /api/edge-trpc-pools/[trpc]                     0 B            1.73 MB
│ ├ ƒ /api/estimate-gas-fee                           0 B            1.73 MB
│ ├ ƒ /api/pools                                      0 B            1.73 MB
│ ├ ƒ /api/pools/[id]                                 0 B            1.73 MB
│ ├ ƒ /api/skip-track-tx                              0 B            1.73 MB
│ ├ ƒ /api/skip-tx-status                             0 B            1.73 MB
│ ├ ƒ /api/transaction-scan                           0 B            1.73 MB
│ ├ ƒ /api/trpc/[trpc]                                0 B            1.73 MB
│ ├ ● /apps (ISR: 86400 Seconds) (404 ms)             181 B          1.73 MB
│ ├ ○ /assets (335 ms)                                7.2 kB         1.86 MB
│ ├ ● /assets/[denom] (ISR: 7200 Seconds) (28411 ms)  63.3 kB        2.02 MB
│ ├   ├ /assets/MBRN (1492 ms)
│ ├   ├ /assets/OSMO (1235 ms)
│ ├   ├ /assets/ION (1226 ms)
│ ├   ├ /assets/WBTC (1077 ms)
│ ├   ├ /assets/GLMR (1062 ms)
│ ├   ├ /assets/LVN (1060 ms)
│ ├   ├ /assets/rETH (1039 ms)
│ ├   └ [+43 more paths] (avg 470 ms)
│ ├ ƒ /components                                     21.7 kB        1.76 MB
│ ├ ○ /disclaimer                                     3.33 kB        1.74 MB
│ ├ ○ /earn                                           192 kB         1.94 MB
│ ├ ƒ /pool/[id]                                      16.2 kB         1.9 MB
│ ├ ○ /pools (353 ms)                                 14.4 kB         1.9 MB
│ ├ ○ /portfolio (352 ms)                             16.2 kB        1.95 MB
│ ├ ○ /stake                                          13.3 kB        1.76 MB
│ ├ ○ /transactions                                   14.9 kB        1.75 MB
│ └ ○ /wormhole                                       2.33 kB        1.74 MB
│ + First Load JS shared by all                       1.76 MB
│   ├ chunks/framework-654ff4903a483b26.js            66.8 kB
│   ├ chunks/main-d970aec2ef9fa8e3.js                 32.2 kB
│   ├ chunks/pages/_app-68524129734d26f1.js           1.63 MB
│   ├ css/d9ea23d49dc3be31.css                        24.2 kB
│   └ other shared chunks (total)                     3.25 kB

authors: ValarDragon jonator


text:
lint: limit max return values from a function to 4

Background
See an example of where this has grown out of control and was later fixed:
https://github.com/osmosis-labs/osmosis/pull/5983
To prevent so many return values causing decrease in readability, we should add a linter
Acceptance Criteria

add linter
document style guidelines in CONTRIBUTING.md
Use https://github.com/osmosis-labs/osmosis/pull/5983 as an example

These examples need fixing prior to adding the linter:
x/twap/client/cli/query.go:152:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 5 (revive)
func twapQueryParseArgs(args []string) (poolId uint64, baseDenom string, startTime time.Time, endTime time.Time, err error) {
^
simulation/executor/legacyconfig.go:118:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 5 (revive)
func SetupSimulation(dirPrefix, dbName string) (cfg Config, db dbm.DB, logger log.Logger, cleanup func(), err error) {
^
x/concentrated-liquidity/math/tick.go:16:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 5 (revive)
func TicksToSqrtPrice(lowerTick, upperTick int64) (sdk.Dec, sdk.Dec, sdk.Dec, sdk.Dec, error) {
^
x/concentrated-liquidity/position.go:396:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 5 (revive)
func (k Keeper) CreateFullRangePosition(ctx sdk.Context, poolId uint64, owner sdk.AccAddress, coins sdk.Coins) (positionId uint64, amount0, amount1 sdk.Int, liquidity sdk.Dec, err error) {
^
x/concentrated-liquidity/position.go:427:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 6 (revive)
func (k Keeper) CreateFullRangePositionLocked(ctx sdk.Context, clPoolId uint64, owner sdk.AccAddress, coins sdk.Coins, remainingLockDuration time.Duration) (positionId uint64, amount0, amount1 sdk.Int, liquidity sdk.Dec, concentratedLockID uint64, err error) {
^
x/concentrated-liquidity/position.go:447:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 6 (revive)
func (k Keeper) CreateFullRangePositionUnlocking(ctx sdk.Context, clPoolId uint64, owner sdk.AccAddress, coins sdk.Coins, remainingLockDuration time.Duration) (positionId uint64, amount0, amount1 sdk.Int, liquidity sdk.Dec, concentratedLockID uint64, err error) {
^
x/concentrated-liquidity/swaps.go:339:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 5 (revive)
func (k Keeper) computeOutAmtGivenIn(
        ctx sdk.Context,
        poolId uint64,
        tokenInMin sdk.Coin,
        tokenOutDenom string,
        spreadFactor sdk.Dec,
        priceLimit sdk.Dec,
) (tokenIn, tokenOut sdk.Coin, poolUpdates PoolUpdates, totalSpreadFactors sdk.Dec, err error) {
x/concentrated-liquidity/lp.go:35:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 7 (revive)
func (k Keeper) CreatePosition(ctx sdk.Context, poolId uint64, owner sdk.AccAddress, tokensProvided sdk.Coins, amount0Min, amount1Min sdk.Int, lowerTick, upperTick int64) (positionId uint64, actualAmount0 sdk.Int, actualAmount1 sdk.Int, liquidityDelta sdk.Dec, lowerTickResult int64, upperTickResult int64, err error) {
^
x/concentrated-liquidity/swaps.go:468:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 5 (revive)
func (k Keeper) computeInAmtGivenOut(
        ctx sdk.Context,
        desiredTokenOut sdk.Coin,
        tokenInDenom string,
        spreadFactor sdk.Dec,
        priceLimit sdk.Dec,
        poolId uint64,
) (tokenIn, tokenOut sdk.Coin, poolUpdates PoolUpdates, totalSpreadFactors sdk.Dec, err error) {
x/concentrated-liquidity/position.go:663:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 5 (revive)
func (k Keeper) validatePositionsAndGetTotalLiquidity(ctx sdk.Context, owner sdk.AccAddress, positionIds []uint64, fullyChargedDuration time.Duration) (uint64, int64, int64, sdk.Dec, error) {
^
x/concentrated-liquidity/lp.go:407:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 5 (revive)
func (k Keeper) UpdatePosition(ctx sdk.Context, poolId uint64, owner sdk.AccAddress, lowerTick, upperTick int64, liquidityDelta sdk.Dec, joinTime time.Time, positionId uint64) (sdk.Int, sdk.Int, bool, bool, error) {
^
x/concentrated-liquidity/simulation/sim_msgs.go:325:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 6 (revive)
func RandomPreparePoolFunc(sim *osmosimtypes.SimCtx, ctx sdk.Context, k clkeeper.Keeper) (sdk.AccAddress, sdk.Coin, sdk.Coin, uint64, sdk.Dec, error) {
^
x/concentrated-liquidity/simulation/sim_msgs.go:360:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 5 (revive)
func RandomPrepareCreatePositionFunc(sim *osmosimtypes.SimCtx, ctx sdk.Context, clPool cltypes.ConcentratedPoolExtension, poolDenoms []string) (sdk.AccAddress, sdk.Coins, int64, int64, error) {
^
x/gamm/keeper/migrate.go:20:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 7 (revive)
func (k Keeper) MigrateUnlockedPositionFromBalancerToConcentrated(ctx sdk.Context,
        sender sdk.AccAddress, sharesToMigrate sdk.Coin,
        tokenOutMins sdk.Coins,
) (positionId uint64, amount0, amount1 sdk.Int, liquidity sdk.Dec, poolIdLeaving, poolIdEntering uint64, err error) {
x/gamm/simulation/sim_msgs.go:417:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 7 (revive)
func getRandPool(k keeper.Keeper, sim *simtypes.SimCtx, ctx sdk.Context) (uint64, types.CFMMPoolI, sdk.Coin, sdk.Coin, []string, string, error) {
^
x/superfluid/keeper/migrate.go:49:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 8 (revive)
func (k Keeper) RouteLockedBalancerToConcentratedMigration(ctx sdk.Context, sender sdk.AccAddress, providedLockId int64, sharesToMigrate sdk.Coin, tokenOutMins sdk.Coins) (positionId uint64, amount0, amount1 sdk.Int, liquidity sdk.Dec, poolIdLeaving, poolIdEntering, concentratedLockId uint64, err error) {
^
x/superfluid/keeper/migrate.go:79:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 8 (revive)
func (k Keeper) migrateSuperfluidBondedBalancerToConcentrated(ctx sdk.Context,
        sender sdk.AccAddress,
        originalLockId uint64,
        sharesToMigrate sdk.Coin,
        synthDenomBeforeMigration string,
        tokenOutMins sdk.Coins,
) (positionId uint64, amount0, amount1 sdk.Int, liquidity sdk.Dec, concentratedLockId, poolIdLeaving, poolIdEntering uint64, err error) {
x/superfluid/keeper/migrate.go:134:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 8 (revive)
func (k Keeper) migrateSuperfluidUnbondingBalancerToConcentrated(ctx sdk.Context,
        sender sdk.AccAddress,
        lockId uint64,
        sharesToMigrate sdk.Coin,
        synthDenomBeforeMigration string,
        tokenOutMins sdk.Coins,
) (positionId uint64, amount0, amount1 sdk.Int, liquidity sdk.Dec, concentratedLockId, poolIdLeaving, poolIdEntering uint64, err error) {
x/superfluid/keeper/concentrated_liquidity.go:32:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 6 (revive)
func (k Keeper) addToConcentratedLiquiditySuperfluidPosition(ctx sdk.Context, sender sdk.AccAddress, positionId uint64, amount0ToAdd, amount1ToAdd sdk.Int) (uint64, sdk.Int, sdk.Int, sdk.Dec, uint64, error) {
^
x/superfluid/keeper/migrate.go:190:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 8 (revive)
func (k Keeper) migrateNonSuperfluidLockBalancerToConcentrated(ctx sdk.Context,
        sender sdk.AccAddress,
        lockId uint64,
        sharesToMigrate sdk.Coin,
        tokenOutMins sdk.Coins,
) (positionId uint64, amount0, amount1 sdk.Int, liquidity sdk.Dec, concentratedLockId, poolIdLeaving, poolIdEntering uint64, err error) {
x/superfluid/keeper/migrate.go:263:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 5 (revive)
func (k Keeper) validateMigration(ctx sdk.Context, sender sdk.AccAddress, lockId uint64, sharesToMigrate sdk.Coin) (poolIdLeaving, poolIdEntering uint64, preMigrationLock *lockuptypes.PeriodLock, remainingLockTime time.Duration, err error) {
^
tests/e2e/configurer/chain/queries.go:446:1: function-result-limit: maximum number of return results per function exceeded; max 4 but got 5 (revive)
func (n *NodeConfig) QueryPropTally(proposalNumber int) (sdk.Int, sdk.Int, sdk.Int, sdk.Int, error) {

Started adding linter on this branch: https://github.com/osmosis-labs/osmosis/tree/roman/max-return-linter

Can revive automatically fix these out of curiosity?

I was unable to find such an option. I think it would require some more complex edge case handling, something AST-like.
From doing this manually, I think it's hard to construct a deterministic set of rules that would apply to every usage of the function being refactored.

repo: osmosis-labs/osmosis


text:
Extend Sonatype Lift with ORT

Awesome to see ORT using Sonatype Lift!
Lift is a way to deploy tools across multiple repositories without having to configure that tool for each repo and it also supports custom tools. You could experiment with adding ORT to Lift if you’re interested https://help.sonatype.com/lift/extending-lift. That might be a low-friction way to roll ORT out to GitHub users (i.e. install Lift + add ORT configuration).
Let us know if you need any help!

Thanks for the idea! That could be a sneaky way to get GitHub integration for free 😉

Ha yea. That's one of the reasons we designed Lift to be extensible. It allows projects to install one thing to get multiple analyses rather than having to install and maintain multiple tools.

Closing, as Lift was sunsetting on August 12, 2023.

repo: oss-review-toolkit/ort


text:
Analyzer: Add support for Poetry package manager

Added a package manager class Poetry to handle Python's projects that use Poetry and functional tests
Fixes #1699

Just a general remark @qequ: Please address review comments in the actual commit the review comment refers to by fixing up the commit and force-pushing a new version of your branch, instead of adding new commits that address review comments separately.

@mnonnenmacher I will squash everything in a single commit

@mnonnenmacher I will squash everything in a single commit

Please fixup the commit message, it now has your sign-off statement several times and all the messages from the squashed commits which are now irrelevant after squashing. While at it, you could align the title with the title of this PR and make sure that all sentences end with a dot.

@mnonnenmacher fixed commit message and title

Fixes #1699.

One more nit: This should actually go into the commit message, not the PR discussion, to make the issue close automatically once the PR is merged.

@sschuberth I saw your comment too late, but at least the issue was still closed automatically.

but at least the issue was still closed automatically.

Yeah, good to know it also works if the reference is just in the PR discussion.

authors: mnonnenmacher qequ sschuberth


text:
ai과목 공식명칭으로 변경

띄어쓰기를 수정했습니다.

#203


text:
Ensure that distro advisories and aliasing work well together

Raised @luhring in https://github.com/google/osv.dev/issues/2374 and capturing here:

It looks like the aliases documentation line in question was updated in https://github.com/ossf/osv-schema/pull/193 — that was a great read. I share the concern expressed in that PR: There seems to be a "hole" in the OSV spec when it comes to distros' ability to participate. By moving to related, we're missing out on the opportunity to have strong, automation-usable links to the same vulnerability as described by our advisories. It seems like there should be a new field that's similar to aliases, but for strong "asymmetric" references, to help OSV better support vulnerability workflows beyond language ecosystems and into the world of distros. I can open an issue to capture this, and hopefully we'll have a good dialog there about potential improvements to the spec.

Thanks for opening this!
As #193 points out, related isn't suitable for automation use cases, because the array items aren't guaranteed to have any particular relationship to the OSV record's vulnerability or its affected package(s).
With Linux distributions, we're consuming upstream software components and packaging them into our own distinct downstream software components.
So if Linux distributions provide OSV records to describe the affect of the vulnerability on their own packages, they cannot use aliases. This is because it's not guaranteed that the consumer of the upstream software component is also consuming that distribution's downstream component, and thus the upstream OSV record (e.g. a CVE or GHSA record) would be relevant to them while the distribution's OSV record (e.g. a DSA or CGA record) would not.
So there's no good option for linux distributions to use to store machine-discoverable links to upstream vulnerabilities.
I suggest adding a new field that's a stronger link than implied in related: similar to aliases, but for asymmetric relationships rather than symmetric. I don't know the best name for such a field, but perhaps inherits, consumes, upstream, or something.
To illustrate how this would work, imagine an OSV record from a Linux distribution like this:
{
  "modified": "2024-03-12T08:12:10Z",
  "id": "CGA-pc4f-g53c-c4gq",
  "upstream": [
    "GHSA-rr6r-cfgf-gc6h"
  ],
  // ...

This would have the following ideal outcomes:

Processors of OSV data would not consider CGA-pc4f-g53c-c4gq and GHSA-rr6r-cfgf-gc6h to be the same thing.
Automation systems wanting more information about CGA-pc4f-g53c-c4gq could now consider vulnerability data identified as GHSA-rr6r-cfgf-gc6h as directly applicable, albeit not the final say for the impact on the distro package.
Multiple distros could use the same IDs in their OSV records' upstream field (like GHSA-rr6r-cfgf-gc6h), and while that would let consumers discover more information about the vulnerability's source, it would not link the distros' OSV records to one another in any way.

My initial reactive thought was includes or incorporates or even aggregates (which, to be fair, was my understanding of (at least one of) the intentions behind related).

Thank you for the feedback! One of the reasons we went with a more catch-all "related" was it was hard to encapsulate all the different use cases/relationships between vulnerability records. Additionally, having all of these very similar but subtly different fields may complicate and make the schema difficult to understand.
That said, if there is a clear, machine-automation use case for a field such as upstream, I think this is something we should add.  Is the primary use case for automation systems here simply to answer the question: "Am I affected by CVE X in my distro?" And with the current related field, this would just give a "maybe" as an answer if it does live in any of the matched OSV records?

My initial reactive thought was includes or incorporates or even aggregates (which, to be fair, was my understanding of (at least one of) the intentions behind related).

👍 These names all sound good to me. And FWIW, I think related could work, but it'd require a substantial tightening of the definition of the field, which I would guess would be breaking and confusing for existing producers/consumers of that field.

One of the reasons we went with a more catch-all "related" was it was hard to encapsulate all the different use cases/relationships between vulnerability records. Additionally, having all of these very similar but subtly different fields may complicate and make the schema difficult to understand.

This definitely makes sense. I wouldn't want to open the door to N more relationship types each getting their own field, and then it becomes impossible to give guidance on which type is the exact right one for each scenario. One of my favorite traits of the OSV schema is its simplicity, and I hesitate to suggest adding a new field; but I'm just not sure how else to solve this for participants outside of the "language ecosystems" category.

Is the primary use case for automation systems here simply to answer the question: "Am I affected by CVE X in my distro?" And with the current related field, this would just give a "maybe" as an answer if it does live in any of the matched OSV records?

Exactly this! OSV's aliases field is really cool for consumers like vulnerability scanners and other security solutions, because it's a simple but powerful way to get more perspective on a vulnerability. By "JOIN"-ing to other aliased records, it's trivial to lookup what the Go team has to say about affected symbols for a package matched to a GHSA record, just as an example. This also means that it's not necessary for every OSV record in the "alias set" to copy each other's data into their own record. The "JOIN"-ability lets each ecosystem state what it knows best about that vulnerability.
So, Linux distributions want to be a part of that! ...without causing disruptions to the alias set itself. Speaking on behalf of Wolfi, it would be great for us to be able to weigh on on how a given vulnerability — expressed as another OSV record like GHSA-..., PSF-..., etc. — affects packages in the ecosystem we control, where the affected ranges are different (because the packages are different) and we can add other ecosystem-specific data of our own to the overall story.
This enables security tools to use the distro OSV data for matching, and then other OSV records to do other useful things, like provide users with more context about the vulnerability itself and cross-check the distro's findings with upstream findings. Zooming out, this also makes it easier for general consumers of the OSV database to see how different distros have handled a given vulnerability (it gets very interesting to compare notes like this during triaging!).

This has come up again in another context, so I think we should prioritise addressing this given that we're getting indications this is a real problem faced by various users of the OSV schema.
Perhaps something like the following:

Upstream
{
  "upstream": [ string ],
}

Theupstream field gives a list of IDs of upstream vulnerabilities that are bundled by the vulnerability.
For example, a downstream package ecosystem (such as a Linux distribution) may issue its own advisories that include (possibly multiple) upstream vulnerabilities.
upstream relationships are transitive but not symmetric. For example, if B is an upstream vulnerability for A, and C is an upstream vulnerability for B, then C is also an upstream vulnerability for A.

I do like upstream as the name for this since it captures the use case very clearly.
We would also remove the "A similar OSV entry that bundles multiple distinct vulnerabilities in the same entry." part from the related definition, and modify the corresponding recommendation to use related in the aliases description.
What do people think?

CCing some Linux distro folks here for feedback on https://github.com/ossf/osv-schema/issues/249#issuecomment-2425629271
The TL;DR is that we're proposing to add another field called upstream that tracks a list of upstream vulnerability IDs that are bundled as part of a distro advisory. e.g.
{
  "id": "DISTRO-1337",
  "upstream": [
    "CVE-2024-1337",
    "CVE-2024-1338",
   ]
}

Previously, we recommended using related for this, but related was a little underspecified and unsuitable for the use case of answering the question: "Am I affected by CVE X in my distro image based on the distro advisory DB?"

@Roo4L (AlmaLinux)
@luhring (Chainguard/Wolfi)
@mstg (Rocky Linux)
@jasinner (Red Hat)
@msmeissn (SUSE)
@dodys (Ubuntu)

Would appreciate your thoughts/feedback!

Seems like a valid proposal to me.

I honestly don't like the name upstream in this context.
Not all vulnerabilities is targeted to upstream projects. We do have vulnerabilities that are reported in specific ecosystems and specific package versions in that ecosystem. For example, let's say there was a vulnerability found only in Ubuntu 22.04 for package foo and it received the id CVE-XXXX-YYYY, it would look like this:
{
  "id": "UBUNTU-CVE-XXXX-YYYY",
  "upstream": [
    "CVE-XXXX-YYYY",
   ]
}

We would be upstream and downstream in this case, and it might not be clear to the users in any way.
My understanding of  upstream in this context is more like the vulnerability database, or catalog. Just where you first registered the vulnerability and got an ID, and then the "downstream/advisory ID" is just a specific view of such entry for a specific ecosystem.

In that example, I think that's what aliases is for, if I'm understanding correctly, where the CVE and the Ubuntu advisory affect the same set of software.
From here:

Two vulnerabilities can be described as aliases if they affect any given software component the same way: either both vulnerabilities affect the software component or neither do. A subsequent patch addresses both of the vulnerabilities (and no others), and vice versa.

The idea for upstream is that it's only to be used when the relationship between the advisories is asymmetric. Such as when the CVE affects more than just what the Ubuntu advisory covers, in which case it'd be invalid to use aliases to link the records involved.

Sounds good to me. upstream seems clearer in what kind of relationship there is between the advisory and the linked resource.

In that example, I think that's what aliases is for, if I'm understanding correctly, where the CVE and the Ubuntu advisory affect the same set of software.
From here:

Two vulnerabilities can be described as aliases if they affect any given software component the same way: either both vulnerabilities affect the software component or neither do. A subsequent patch addresses both of the vulnerabilities (and no others), and vice versa.

The idea for upstream is that it's only to be used when the relationship between the advisories is asymmetric. Such as when the CVE affects more than just what the Ubuntu advisory covers, in which case it'd be invalid to use aliases to link the records involved.

+1 to all of this! Indeed if a CVE is issued by Ubuntu directly for something that's Ubuntu-specific, it should be in aliases.
@dodys do you have any other concerns here?

In that example, I think that's what aliases is for, if I'm understanding correctly, where the CVE and the Ubuntu advisory affect the same set of software.
From here:

Two vulnerabilities can be described as aliases if they affect any given software component the same way: either both vulnerabilities affect the software component or neither do. A subsequent patch addresses both of the vulnerabilities (and no others), and vice versa.

The idea for upstream is that it's only to be used when the relationship between the advisories is asymmetric. Such as when the CVE affects more than just what the Ubuntu advisory covers, in which case it'd be invalid to use aliases to link the records involved.

+1 to all of this! Indeed if a CVE is issued by Ubuntu directly for something that's Ubuntu-specific, it should be in aliases.
@dodys do you have any other concerns here?

If I can be honest, I don't think we will use aliases any time soon. To make it work with the automation, that would require a change in our tracking to make a note when a "upstream" CVE is a direct 1-1 relation to a "downstream" advisory (and here I only mean the UBUNTU-CVE-... advisories). Therefore we will continue using the  related or upstream field only for the time being.

Thanks for the feedback all! I've opened a PR here to add this: https://github.com/ossf/osv-schema/pull/312. Please leave any feedback you may have.

authors: andrewpollock dodys jasinner luhring mstg oliverchang

repo: ossf/osv-schema


text:
ssl client cert

add restrictions for a ssl client side cer for /var/ww/html/secure/

Im trying to use your code to have a test container for Mutual SSL, hope I aint messing with your stuff


text:
srsplayer 问题

在本地打开srs_player.html， 点击播放按钮，弹出模式对话框，然后点击关闭，无法关闭，查看console，发现错误如下：
Uncaught TypeError: this.callbackObj.ref.__stop is not a function
请问这是什么问题

难道必须部署在服务器上才行，本地运行不行？明天部署到服务器上试试

放在web服务器下面就可以。

确实如此，谢谢

authors: winlinvip zhangfh

repo: ossrs/srs


text:
添加官方docker镜像？

docker hub上貌似有一个官方账号，但是镜像已经n年没更新了，能否继续支持docker？

欢迎提交PR到：https://github.com/ossrs/srs-docker

Dup to #1595

authors: higher-sy winlinvip


text:
Reducer

closes #10

:tada: This PR is included in version 1.4.0 :tada:
The release is available on:

npm package (@latest dist-tag)
GitHub release

Your semantic-release bot :package::rocket:

repo: ostashkin/redux-smart-creators


text:
Crane and v13 update

Updates to use ACE 13.0.1 and Crane for container image builds.

As discussed out-of-band: latest changes should fix the namespacing issue for cp4i containers.


text:
Add test for ESLint v8

If eslint v8 is released early, we will change this PR to without draft.
However, if the eslint v8 support PR for typescript-eslint and vscode-eslint is released early, I will consider closing this PR and opening a PR that modifies devDependencies.

@RunDevelopment Are you using VS Code for your editor? Or are you using another editor?
If you are using any other editor, we will need to consider changes to support this repository for ESLint v8.
I opened PR to vscode-eslint.
https://github.com/microsoft/vscode-eslint/pull/1317

I am using VSCode but thank you for the warning.
However, it's interesting that v8 makes such substantial changes to even break editor integration. Let's hope that this kind of thing doesn't happen too often in the future.

Move to #340.

authors: RunDevelopment ota-meshi

repo: ota-meshi/eslint-plugin-regexp


text:
Markdown Rendering for Commit Messages

It would be nice to allow for markdown in our commit messages to be rendered.

Please roll this back or make it a preference. It is extremely disconcerting for my plaintext commit messages to be misinterpreted as Markdown (or whatever it's doing) and reformatted. That means when I run git log locally, it does not match what I see on github.com. It makes your product feel buggy.
Specifically, my recent commit was:
Add missing @Test annotation.
github displays this as:
Add missing @test annotation.
which makes me look like I don't know what annotations look like in Java.
Also, I have the Email service hook enabled. This is the only commit on my project for which I did not receive an email, so I there might be a bug in that logic flow when rewriting happens (or it's just an unfortunate coincidence).

And of course, it appears that this applies to bug reports as well, so now my bug report has been reformatted so it cannot be understood. Unbelievable.

Hello, @bolinfest!
It appears that your frustration is misdirected.  You seem to be having issues with GitHub itself.  I regret to inform you that this issue is for the "WebGit .NET" project, not GitHub.com.  Or project is similar to GitHub (in that it is a Git hosting solution), but we do not handle their support requests.
Therefore, I would suggest that you take your issue up with the creators of GitHub, by using the "Contact & Support" link at the bottom on this page.
Thank you!

Yes, sorry, I realized it after the fact. I came upon your bug when
Googling for "github markdown commit messages" or something like that.
I'm having an exchange with GitHub over email now (I don't think they have
a public bug tracker), or unfortunately I can't link to it, nor can others
participate in my rant...
Thanks for the redirect!
Michael
On Thu, Dec 8, 2011 at 4:41 PM, John Gietzen <
reply@reply.github.com

wrote:

Hello, @bolinfest!
It appears that your frustration is misdirected.  You seem to be having
issues with GitHub itself.  I regret to inform you that this issue is for
the "WebGit .NET" project, not GitHub.com.  Or project is similar to GitHub
(in that it is a Git hosting solution), but we do not handle their support
requests.
Therefore, I would suggest that you take your issue up with the creators
of GitHub, by using the "Contact & Support" link at the bottom on this page.
Thank you!

Reply to this email directly or view it on GitHub:
https://github.com/otac0n/WebGitNet/issues/19#issuecomment-3070459

authors: bolinfest drwelden otac0n

license: Zlib


text:
Testing

...

Seeing how this works.

repo: otedolaishola/write-github-script


text:
No detection for these sites

I love the idea behind this add-on, but it does not appear to be working on these sites:

https://www.finanzen.net/: Overlay banner, but (as far as I've understood from looking at the HTML) it's realised as an iframe so as to impede shenanigans like the one we're trying to pull off. If you block the iframe via your adblocker, the site will still not work because it lacks scroll bars. Truly annoying.

https://youtube.com: Redirect banner, redirects to empty page.

That the banner is not recognized at finanzen.net surprises me a bit, actually it should be recognized. The scrolling should (if recognized) normally also work again (in the head they simply use a: overflow: hidden, which I overwrite).
The problem with YouTube or with the new cookie banner from Google I have also noticed. But there I have no idea how to implement this without a blocklist. I have already played around a bit with the banner and as soon as youtube.com the cookie CONSENT=YES+ is present, is no longer forwarded.

That the banner is not recognized at finanzen.net surprises me a bit, actually it should be recognized.

Does that mean you have checked and it works on your end? That'd be really weird...

The problem with YouTube or with the new cookie banner from Google I have also noticed. But there I have no idea how to implement this without a blocklist. I have already played around a bit with the banner and as soon as youtube.com the cookie CONSENT=YES+ is present, is no longer forwarded.

Yeah, I imagined the Google banner would be a much tougher nut to crack. I'm sorry I won't be any help with this one since I don't have a clue what's happening "behind the scenes".

Does that mean you have checked and it works on your end? That'd be really weird...

No, the banner was not blocked at me too, I was just wondering, because actually it should be recognized. I have now also found the actual error. The banner is invisible at the beginning (display: none), why it is first ignored. After a few seconds it becomes visible (display: block). But that is a change of the attribute, and they are ignored after a change:
observer.observe(document.body, { attributes: false, childList: true, subtree: true })

With the Google banner I still have to think about something, that is also recognized, but Google can not be tricked as easily as the other pages with the wrong UserAgent trick :D

repo: otsmr/cookie-banner-blocker


text:
Changing Perspective

Great tool, Really! Thanks a million.
I couldn't  change perspectives objects (for example I wanted to add a measure to a perspective), is there any way to do this in TabularEditor?
If not, Do you have any plan to enable users to change perspective objects in TabularEditor?
Thank you in advance,
Arman

Hi Arman,
Glad you like the tool! You can change which perspectives an object is visible in, by selecting the object in the explorer tree (you can also multi-select by holding down CTRL or SHIFT), and then expand the "Shown in Perspective"-property in the property grid:

Alternatively, you can right-click the object and choose "Show in Perspectives" or "Hide in Perspectives":

This works for tables, columns, measures and hierarchies. If you have any further questions, don't hesitate to ask :-)

Perfect! Thanks for your detailed respond
I was looking for a tool just like yours, I am glad that find TabularEditor.
Thanks again :)

authors: ArmanFalah otykier

repo: otykier/TabularEditor


text:
Selected language visibility in navigation drawer

The selected language is too dark to be visible in the navigation drawer.

Ahh I just noticed this in #151.
It's not just in the languages, it's on the other parts of the toolbar as well, including Home

@theyokohamalife @ann-kilzer I made a PR for this - I could not run the linter on my terminal though so there might be some formatting issues

authors: RossellaFer ann-kilzer theyokohamalife

repo: ourjapanlife/findadoc-frontend


text:
Root composer.json requires outl1ne/nova-menu-builder ^7.1 -> satisfiable by outl1ne/nova-menu-builder[7.1.0].

- Root composer.json requires outl1ne/nova-menu-builder ^7.1 -> satisfiable by outl1ne/nova-menu-builder[7.1.0].
- outl1ne/nova-menu-builder 7.1.0 requires laravel/nova ^4.0 -> could not be found in any version, there may be a typo in the package name.

running "laravel/nova": "^4.0",
"minimum-stability": "dev",

Does this problem still persist for you?

authors: KasparRosin jeremiahsherrill


text:
Rename ORM to Mapper and move to dedicated package

Closes #89

Pull Request Test Coverage Report for Build 853935803

87 of 101 (86.14%)  changed or added relevant lines in 6 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-1.5%) to 73.455%

Changes Missing Coverage
Covered Lines
Changed/Added Lines
%

internal/mapper/info.go
20
25
80.0%

internal/mapper/mapper.go
38
47
80.85%

Totals

Change from base Build 853859837:
-1.5%

Covered Lines:
1652

Relevant Lines:
2249

💛  - Coveralls

@amorenoz rebased, updated docs and also moved the client.Model to mapper.Model
I originally didn't do this so library users would only ever need the client package. However, when playing around with the mapper in #116 I realised that importing client.Model from the server code was a bit odd.

I agree importing client.Model from server is odd. On the other hand, I don't think any part of orm (now mapper) actually uses Model. It uses interface{} and that is intentional because Model was just the way of interacting with users, and having certain degree of flexibility on that front. For know Model is actually the same as interface{}, but I'm wondering whether we will end up adding some functionality to Model in the future that will be client/server specific. Difficult to say... I'm not even sure myself but, what do you think about having an independent package for it so both client and server use model.Model?

If server is going to use Model, would it also use certain types such as current client.Mutation and client.Condition that should potentially have to move away from client as well?

@amorenoz done. i've created a model package that contains the model and dbmodel types.

If server is going to use Model, would it also use certain types such as current client.Mutation and client.Condition that should potentially have to move away from client as well?

I'm not 100% sure whether they'll be used or not, but thinking about the API wouldn't it make sense for these to live in model too? model.Condition is a model-based condition, model.Mutation is a model-based mutation. mapper then turns these in to ovsdb.Condition or (once the notation has merged, ovsdb.Mutation too).

@amorenoz comments addressed

When rebased on top of #132 and CI passes, I think we can merge this.

LGTM

authors: amorenoz coveralls dave-tucker

repo: ovn-org/libovsdb


text:
Compatibility check and testing for node.js 22

Notification from ioBroker Check and Service Bot
Dear Adapter developer,
Node.js 22 will become the official node.js LTS release October 2024 - see node-releases
So please check your adapter with Node.js 22.
Please add node.js 22 to the adapter testing matrix which is executed on commits. This check is normally controlled by workflow located at .github/workflows/test-and-release.yml. The recommended testmatrix is [18.x, 20.x, 22.x] now. It's ok to test node.js 20.x and 22.x only if there are any technical reasons (i.e. requirements caused by dependencies) to do so.
In any case please set the 'engines' clause in package.json according to the minimum node version used at testing. Please also do this if the adapter is not able to work with certain Node.js versions, so that ioBroker can prevent users from installing the adapter if not compatible. If you detect any incompatibility with node.js 22 please try to fix it and / or let us know if the problem seems to be located at core components.
Please close the issue after you checked it.
Feel free to contact me (@iobroker-bot) if you have any questions.
And THANKS A LOT for maintaining this adapter from me and all users.
Let's work together for the best user experience.
your
ioBroker Check and Service Bot
@mcm1957 for evidence
Note: If you added node 22 tests already, simply close this issue.

this is a vis-2 widgets only adapter

authors: ioBroker-Bot oweitman


text:
Stock card flashes on favourite select

There is an ugly flash of stock-card when selecting favorites. This makes it look not bullet proof!

fixed by #136

authors: bjedrzejewski owennw


text:
BMP外字符判定不一致

下方字符为U+10000，BMP外的字符。

上方字符为𪻐（U+2AED0），当跟打区为BMP内字符时，上方出现分开的UTF-16代理对。

所有的BMP外的字符判定都有问题。比如“𪻐”字，会显示“共2字”。不应该使用UTF-16字符串的长度判定字数。

就是打文时有时打了个超集字，还以为打了个二字词，就回删，删多了。

这是一个已知问题，js默认判断字符的长度不包含超字集
暂时还没有时间去处理

以及文章中凡是有BMP外的字，乱序都出问题。比如来𪻐 -> �来�，那两个方框替代字符就是被拆开来的代理对。解决这个问题只需使用Array.from(text)或[...text]的方式，而不是.split('')来拆分。

https://stackoverflow.com/questions/21397316/split-javascript-string-into-array-of-codepoints-taking-into-account-surrogat


text:
walkthrough: Meadow step is not generated properly

One-liner
When I run walkthrough meadow it generates the wrong snapshot step in the dag and in the meadow code (the extension is missing).
Environment

python -V: Python 3.11.1
Operating system: macOS Ventura 13.3.1
Working with local, staging or live: None (or local)

Context & details
Discussed in Slack. The snapshot step needed in the dag and in the code lacks the extension (in this case, csv). If it is added manually things run back to normal. https://github.com/owid/etl/pull/1000

@paarriagadap
Any chance you forgot to enter the extension in the extension field? By default, it shows "csv" (greyed out), but you actually need to type it.

@lucasrodes No, it was saved on the snapshot

I just ran it again in the create-equaldex-dataset branch and I had the same thing:

This has now been resolved after chatting with Pablo.
walkthrough meadow needs the user to input the extension of the snapshot file. Even if the Snapshot dvc file has a field specifying the extension, it is not enough.
Note that we may have the case where there are multiple snapshot dvc files, with the same name, but different extensions. Therefore, we need to specify the extension in Meadow.

authors: lucasrodes paarriagadap

repo: owid/etl


text:
enhance(walkthrough,snapshot): add option for manual dataset import

Sometimes we have to import a dataset into Snapshot manually. This is when the raw dataset file can't be automatically downloaded but needs to be obtained manually. Then we would run something like:
python snapshots/<namespace>/<version>/<short_name>.py ーpath-to-file <path-to-local-file>

This PR adds a checkbox option in walkthrough for this specific scenario, as the base script changes a bit depending on whether the dataset is manually imported.

Hi @lucasrodes, I was thinking of changing the default snapshot script so that by default it ingests a list of files, instead of a single file. The same would apply to files manually ingested (in which case, instead of path_to_file, the argument would be a list of files). Do you think it's a good idea, and would you like to implement it on this PR? Otherwise I'll do a separate one after you are done with this.

@pabloarosado  thanks for your feedabck.

Instead of hardcoding the snapshot version in the generated script, I'd define at the beginning SNAPSHOT_VERSION = Path(__file__).parent.name.

I don't see why this would be preferred over using cookiecutter's parameters.

I was thinking of changing the default snapshot script so that by default it ingests a list of files, instead of a single file. The same would apply to files manually ingested (in which case, instead of path_to_file, the argument would be a list of files).

That looks cool. I would leave this for another PR, so we can merge this one and keep improving. I may not have the bandwidth to work on this specific enhancement. I think we would need to re-think how the walkthrough snapshot step works, too (e.g. we should allow the user to input several file info).

@pabloarosado thanks for your feedabck.

Instead of hardcoding the snapshot version in the generated script, I'd define at the beginning SNAPSHOT_VERSION = Path(__file__).parent.name.

I don't see why this would be preferred over using cookiecutter's parameters.

If the version is hardcoded and you want to create a new step from an existing one (without using walkthrough) you would need to copy/paste the existing step, and then manually change the version. But don't worry, we can do this in a different PR.

I was thinking of changing the default snapshot script so that by default it ingests a list of files, instead of a single file. The same would apply to files manually ingested (in which case, instead of path_to_file, the argument would be a list of files).

That looks cool. I would leave this for another PR, so we can merge this and keep improving. I may not have the capacity to work on this specific enhancement. For the improvements that you propose, besides changing the template, we would need to re-think how the walkthrough snapshot step works, too, as we should allow the user to input several file info (at the moment we only allow one file).

OK!

@Marigold thanks for your comment. It does not bother me at all. I do think though that we could reduce the number of lines in the future, so we have something like:
add_snapshots(snapshots=snapshot, upload=csv, local_file=local_file)

However, I would first wait until we improve how we support multiple snapshot files (as @pabloarosado mentioned)

authors: lucasrodes pabloarosado