text:
Pin dependencies causing CVEs.

Is your feature request related to a problem? Please provide an existing Issue # , or describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
Describe the solution you are proposing
A clear and concise description of what you want to happen.
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
Additional context
Add any other context or screenshots about the feature request here.
Check List

[ ] New functionality includes testing.

[ ] All tests pass

[ ] New functionality has been documented.

[ ] New functionality has javadoc added

[ ] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Codecov Report

Merging #345 (c0dc829) into 1.3 (c17cc51) will increase coverage by 0.02%.
The diff coverage is n/a.

:exclamation: Current head c0dc829 differs from pull request most recent head fcde22c. Consider uploading reports for the commit fcde22c to get more accurate results

:mega: This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more
@@             Coverage Diff              @@
##                1.3     #345      +/-   ##
============================================
+ Coverage     71.60%   71.62%   +0.02%
+ Complexity     2949     2941       -8
============================================
  Files           376      376
  Lines         18839    18839
  Branches       1466     1466
============================================
+ Hits          13489    13493       +4
+ Misses         4766     4762       -4
  Partials        584      584

see 2 files with indirect coverage changes
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

authors: Tjofil codecov-commenter


text:
Bump version to 1.3.1

Signed-off-by: Sayali Gaikawad gaiksaya@amazon.com
Is your feature request related to a problem? Please provide an existing Issue # , or describe.
Part of https://github.com/opensearch-project/opensearch-build/issues/1805
Check List

[ ] New functionality includes testing.

[ ] All tests pass

[ ] New functionality has been documented.

[ ] New functionality has javadoc added

[x] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Codecov Report

Merging #173 (0a320e8) into 1.3 (4e97584) will decrease coverage by 0.10%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##                1.3     #173      +/-   ##
============================================
- Coverage     72.29%   72.19%   -0.11%
+ Complexity      357      356       -1
============================================
  Files            44       44
  Lines          2516     2510       -6
  Branches        167      160       -7
============================================
- Hits           1819     1812       -7
- Misses          591      592       +1
  Partials        106      106

Impacted Files
Coverage Δ

...dler/PerformanceAnalyzerClusterSettingHandler.java
68.67% <0.00%> (-4.59%)
:arrow_down:

...manceanalyzer/collectors/NodeDetailsCollector.java
81.25% <0.00%> (-0.29%)
:arrow_down:

...on/config/PerformanceAnalyzerResourceProvider.java
36.84% <0.00%> (+0.75%)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4e97584...0a320e8. Read the comment docs.

source: gharchive/pull-request

authors: codecov-commenter gaiksaya

repo: opensearch-project/performance-analyzer

license_type: permissive

license_source: github-api


text:
Update FAQ to reflect now in beta

Description
Updates the FAQ to reflect the project is now in beta
By submitting this pull request, I confirm that my contribution is made under the terms of the BSD-3-Clause License.

Thanks @elfisher!

authors: elfisher stockholmux

repo: opensearch-project/project-website


text:
Necessary permissions for kibana to work ?

I ran into an issue here: https://github.com/opendistro-for-elasticsearch/security-kibana-plugin/issues/166
Basically the user does not get permissions to edit / update the corresponding indices which are referenced by the tenant, by having
  tenant_permissions:
  - tenant_patterns:
    - "Limited"
    allowed_actions:
    - "kibana_all_read"
    - "kibana_all_write"

I was under the impression, that for this tenant the user will have read and write permissions for all tenant indices, when using index_permissions it seems this is not the case.
Is this expected behaviour?
Shouldn't a tenant_permission add implicit permissions similar to the kibana_user role?
Do I have to add the kibana_user role to everyone? (which would negate the tenant permissions again)

@Thoro Just tested with opensearch 1.2.0 and I'm not able to reproduce the issue.
My role looks like this:
test_role:
  index_permissions:
  - index_patterns:
    - "opensearch_dashboards_sample_data_flights"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices_all"
  tenant_permissions:
    - tenant_patterns:
      - 'test'
      allowed_actions:
        - 'kibana_all_write'

The index permission is used to view the index and create index template in "test" tenant.
If you are still having this issue, can you provide steps to reproduce?

Sorry no, it's over a year ago, can't remember the issue and I don't think it's still relevant, will close then.

source: gharchive/issue

repo: opensearch-project/security


text:
Patch bump for scala dependency

Signed-off-by: Stephen Crawford steecraw@amazon.com
Description
Bump scala dependency to updated patch version.
Issues Resolved
Resolves issue #2137
Check List

[ ] ~New functionality includes testing~
[ ] ~New functionality has been documented~
[x] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Note that the failures are a result of the HTTP change by core not the dependency shift


text:
Optimize unit test

reduce time to run virtualization connector util test from ~2 mins to ~2 secs.
Currently the unit test seems to wait for a timeout from openstack to continue

@sudhirappaji please merge once you review

@arvindn05 , I see needs to update the branch. will merge as soon as this is done.

repo: opensecuritycontroller/osc-core

license_source: bigquery


text:
Add support for pods with multiple network interfaces

Please describe the Improvement and/or Feature Request
Support for pods with multiple network interfaces, where only the default network interfaces (eth0) should be subject to service mesh interception
In our use case, multi-network k8s cluster (multus) is used, which runs into some problems with OSM (since OSM programs some Linux kernel rules which impact the additional network interface / network namespaces, on which OSM is not intended to be running).
In particular, OSM should program the following rules:
iptables -t nat -I PROXY_OUTPUT ! -o eth0 -j RETURN
iptables -t nat -I PROXY_INBOUND ! -i eth0 -j RETURN
Scope (please mark with X where applicable)

New Functionality          [X]
Install                    [ ]
SMI Traffic Access Policy  [ ]
SMI Traffic Specs Policy   [ ]
SMI Traffic Split Policy   [ ]
Permissive Traffic Policy  [ ]
Ingress                    [ ]
Egress                     [ ]
Envoy Control Plane        [X]
CLI Tool                   [ ]
Metrics                    [ ]
Certificate Management     [ ]
Sidecar Injection          [ ]
Logging                    [ ]
Debugging                  [ ]
Tests                      [ ]
CI System                  [ ]
Demo                       [ ]
Project Release            [ ]

Possible use cases
Support high performance networking workloads, where there may be multiple independent networks in play, or where there may be additional network interfaces.

Thank you for opening up this issue! I have added it to our future planning milestone.

@richardwhiuk Adding those iptables commands does seem to work from the light testing I've done so far. I'm a bit concerned with that exact approach though of specifying eth0 there since I can see where that wouldn't necessarily be correct for all clusters, or even all nodes within the same cluster. I'll look into how we can determine what that should be from within the same init container where the iptables rules are set up. (If you have any hints please let me know!)
I think it may also make sense to invert the logic here where we instead expose a configurable a list of interfaces that should *not* have traffic redirected through Envoy. Would something like that be practical for your use case?

authors: nojnhuh richardwhiuk trstringer

repo: openservicemesh/osm


text:
Feature/uncertainty changes

Hi Kevin,
These are some fixes/changes I made while adding uncertainties to some of our constraints.
The changes to SlipRateInversionConstraint are a little odd in that they make the constructor work as its signature suggests, but at the same time this can create a constraint that behaves differently after deserialization. So not sure what you think of this.
For us, this is a convenient way to slip in a synthesized SectSlipRates module with our modified standard deviations. And we don't serialise constraints at the moment. What's the use case for constraint serialisation/deserialisation?

Looks good to me, @voj. The main use case for serialization is that I often configure inversions locally and the push the JSON files to the cluster for running, and also for reproducibility down the line. I made those modules transient to avoid duplicating the information, but it might we worth serializing at least the slip rates, which is similar to what we do in the MFD constraint. I'll think about that

authors: kevinmilner voj

repo: opensha/opensha


text:
add cleanup cron

We have tried to cleanup such objects with s3 lifecycle policies, but it didn't work.
The plan is to leave it as deactivated cron, and activated it when/if necessary.

/cc @osherdp

/hold


text:
[0.25] Patch subresource to unblock webhooks on 4.9 (#308)

Done for SRVKS-790 - See #308 for reference

Codecov Report

:exclamation: No coverage uploaded for pull request base (release-v0.25@e4cf342). Click here to learn what that means.
The diff coverage is n/a.

@@               Coverage Diff                @@
##             release-v0.25     #311   +/-   ##
================================================
  Coverage                 ?   75.48%
================================================
  Files                    ?      144
  Lines                    ?     6514
  Branches                 ?        0
================================================
  Hits                     ?     4917
  Misses                   ?     1376
  Partials                 ?      221

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e4cf342...3347409. Read the comment docs.

@aliok the CI for this branch is not even enabled, hence there is no job at all

/lgtm

authors: codecov-commenter devguyio matzew

repo: openshift-knative/eventing-kafka


text:
Remove tekton results migrator

the upstream uses gorm auto-migration now so a dedicated migrator is
not needed
merge after openshift-pipelines/tektoncd-results#60 and the results upgrade

Signed-off-by: Avinal Kumar avinal@redhat.com
rh-pre-commit.version: 2.1.0
rh-pre-commit.check-secrets: ENABLED

/test test-pipeline-service-deployment-ocp-414

/lgtm

@avinal need to rebase it seems.

/hold Pending OSP nightly to be deployed on all staging instances.

Is this okay to merge now?

OSP is now deployed on all staging instances. Merging.

repo: openshift-pipelines/pipeline-service


text:
kubernetes equivalent of oc commands

I see that you have the following commands to stop kubelets in oc environment:
oc debug node/" + node + " -- chroot /host systemctl stop kubelet
What will be the kubectl equivalent of that ?

kubectl does not have a "debug node" capability.   The equivalent in kubernetes would be ssh-ing into node to stop the kubelet.

ok thanks, got it!!

authors: infa-anisrini mffiedler

repo: openshift-scale/kraken


text:
NE-955: Add LoadBalancer AllowedSourceRanges API

Enhancement Proposal: https://github.com/openshift/enhancements/pull/1177

/test all

/test verify

/assign @gcs278

/assign @Miciah

No comments, looks good to me, but I'll wait for enhancement proposal to merge before lgtm.

Playground to test the CIDR range validation pattern: https://go.dev/play/p/kxt-x6LJknW

Rebased over latest master. Run make generate-with-container again and it added more generated files to the PR.

/lgtm

/approve

if you want to test your regex, @JoelSpeed created a way to provide a test manifest and expected result files.

/label qe-approved
/label docs-approved
/label px-approved

if you want to test your regex, @JoelSpeed created a way to provide a test manifest and expected result files.

Some examples of the most minimal tests can be found in #1305, from there we can add additional test cases to exercise various expected positive and negative validations, lmk if you want to try this out

repo: openshift/api


text:
OCPCLOUD-2573: Enables kubelet cloud credential providers

Enables the DisableKubeletCloudCredentialProviders feature gate
Cloud credential providers for AWS, GCP and Azure are now functional. We can disable the in tree kubelet providers.

/test e2e-gcp

GCP e2es are a bit sad at the moment, but it's being worked on :)
I don't think the failures are related to this PR! :D

Changes LGTM but I need to see a pass on GCP before we can merge this

GCP is failing due to a configuration error.
https://github.com/openshift/machine-config-operator/pull/4260 fixes that.

/test images

/retitle OCPCLOUD-2573: Enables kubelet cloud credential providers

/retest

So it looks the GCR image pull still fails :/
time="2024-03-20T12:15:42Z" level=info msg="resulting interval message" message="{Failed  Failed to pull image \"gcr.io/authenticated-image-pulling/alpine:3.7\": reading manifest 3.7 in gcr.io/authenticated-image-pulling/alpine: denied: Permission denied for \"3.7\" from request \"/v2/authenticated-image-pulling/alpine/manifests/3.7\".  map[reason:Failed]}"
time="2024-03-20T12:15:42Z" level=info msg="resulting interval message" message="{BackOff  Back-off pulling image \"gcr.io/authenticated-image-pulling/alpine:3.7\" map[interesting:true reason:BackOff]}"

Interestingly, the previously failing tests from the previous CI run:
: [sig-apps] ReplicaSet should serve a basic image on each replica with a private image [Suite:openshift/conformance/parallel] [Suite:k8s]
: [sig-apps] ReplicaSet should serve a basic image on each replica with a public image [Conformance] [Suite:openshift/conformance/parallel/minimal] [Suite:k8s]

Are now running and passing.
The Image failing to pull gcr.io/authenticated-image-pulling/alpine:3.7 should be failing: https://github.com/openshift/origin/blob/2cecd5f51c4f4b51b255bcadd294d208cbd00a9b/pkg/monitortests/node/legacynodemonitortests/kubelet.go#L527-L528

/test e2e-gcp

/test e2e-gcp

Both QE and I have tested this on GCP:
Manually exec'ing the binary:
[root@tbarberb-dev-4thxv-worker-a-59jj5 ~]# cat test.json
{
  "apiVersion": "kubelet.k8s.io/v1",
  "kind": "CredentialProviderRequest",
  "image": "gcr.io/openshift-gce-devel/hello-ecr"
}

[root@tbarberb-dev-4thxv-worker-a-59jj5 ~]# cat test.json | /usr/libexec/kubelet-image-credential-provider-plugins/gcr-credential-provider get-credentials --v 3
I0322 12:34:29.860294   18330 getcredentials.go:110] get-credentials (authFlow gcr)
{"kind":"CredentialProviderResponse","apiVersion":"credentialprovider.kubelet.k8s.io/v1","cacheKeyType":"Image","cacheDuration":"0s","auth":{"*.gcr.io":{"username":"_token","password":"..."},"*.pkg.dev":{"username":"_token","password":"..."},"container.cloud.google.com":{"username":"_token","password":"..."},"gcr.io":{"username":"_token","password":"..."}}}

After manually enabling the featureagate, and waiting for the MachineConfigPools to roll the image pull succeeds (     imagePullPolicy: Always)
~/projects/4.16 on ☁   tbarberb@redhat.com
❯ oc new-app --allow-missing-images --image gcr.io/openshift-gce-devel/hello-ecr:latest
~/projects/4.16 on ☁   tbarberb@redhat.com took 5s
❯ oc edit deployment hello-ecr
deployment.apps/hello-ecr edited

~/projects/4.16 on ☁   tbarberb@redhat.com took 4s
❯ oc get deployment
NAME        READY   UP-TO-DATE   AVAILABLE   AGE
hello-ecr   3/3     3            3           70m

Tested on gcp cluster and azure cluster, pull image from GCR and ACR succeed, run critical cases passed.
/label qe-approved

/label acknowledge-critical-fixes-only

/test e2e-gcp
Cluster failed to bootstrap

Private registry tests appear to be passing, among other inconsistent and spurious failures
/lgtm

/test e2e-azure

/test e2e-aws-serial

/unhold

authors: JoelSpeed damdo sunzhaohua2 theobarberbany


text:
NO-ISSUE: Download rpm packages in a different stage at the build of Dockerfile-build

NO-ISSUE: Download rpm packages in a different stage at the build of Dockerfile-build as golang image is based on centos 7 which cannot reach its repositories as it is EOL

/override ci/prow/edge-e2e-ai-operator-ztp ci/prow/edge-e2e-metal-assisted-deploy-nodes

/cherry-pick release-ocm-2.11

/cherry-pick release-ocm-2.10

/cherry-pick release-ocm-2.9

/cherry-pick release-ocm-2.8

/hold

/override ci/prow/edge-e2e-metal-assisted-deploy-nodes ci/prow/edge-e2e-ai-operator-ztp

/unhold

repo: openshift/assisted-image-service


text:
bug 1781793: bump revert s2i bump for 1758305

/assign @bparees
/assign @adambkaplan

/bugzilla refresh

/bugzilla refresh

/retitle bug 1781793: bump revert s2i bump for 1758305

install flakes
/retest

mco install flake
though based on the bugzillas noted in 4-dev-triage it might not be addressed yet
one more try just in case
/retest

MCO pr has merged
/retest

authors: bparees gabemontero

repo: openshift/builder


text:
Start using Buildah versus Docker for building container images

Signed-off-by: Daniel J Walsh dwalsh@redhat.com

/test e2e-aws-image-ecosystem

@nalind @bparees PTAL

Well buildah is not planned to be run on a MAC, but Podman is, should I change this to podman run?

@rhatdan podman as default works, too (also helps with inner-loop development, since you can go directly from podman build to podman run)

@adambkaplan it's your repo at this point so i'll let you sign off on this, but it looks ok to me.
/assign @adambkaplan

authors: adambkaplan bparees rhatdan


text:
Add appregistry delivery label to Dockerfile.rhel7

ART relies on the presence of com.redhat.delivery.appregistry label to identify it as an OLM operator.

ooops, that's wrong


text:
Bug 2028484: CSI driver's livenessprobe does not respect operator's loglevel

When log level is changed in clustercsidriver it needs to propagate to a liveness probe container as well through a value passed to --v argument.

/retest

/lgtm
/approve

authors: RomanBednar dobsonj

repo: openshift/gcp-pd-csi-driver-operator


text:
fix: enable rerun action only forpush builds

Fixes

https://issues.redhat.com/browse/KFLUXBUGS-1605
Description

Type of change

[ ] Feature
[ ] Bugfix
[ ] Code style update (formatting, renaming)
[ ] Refactoring (no functional changes, no api changes)
[ ] Build related changes
[ ] Documentation content changes
[ ] Other (please describe):

Screen shots / Gifs for design review

How to test or reproduce?

Browser conformance:

[ ] Chrome
[ ] Firefox
[ ] Safari
[ ] Edge

/retest

[test]

/retest

/retest

/retest

/retest

/retest

/retest

/retest

/retest

repo: openshift/hac-dev


text:
Refactor code while updating instaslice allocations

Move update of instaslice object with the new allocations to a utils package so that it can be leveraged both by the controller and the daemonset

/cc @asm582

/test unit
Failure unrelated to the code change

FYI, I am going to test this PR on real GPUs

Thank you for this PR @sairameshv, tested on real GPUs
/lgtm

@harche , Could you merge this?
The unit test failure isn't related to the code change and is something about CI infra

@harche , Could you merge this? The unit test failure isn't related to the code change and is something about CI infra

It isn't allowing me to merge it.

/test unit

/retest

/approve

/approve

repo: openshift/instaslice-operator


text:
Use syscalls conditionally only for linux

/assign @ardaguclu @deads2k

/lgtm
/hold
in case @deads2k would like to look at

/hold cancel

authors: ardaguclu deads2k soltysh

repo: openshift/library-go


text:
OCPBUGS-37844: fix: resource sync fail -> progressing

When the resource syncrhonization fails (e.g. because of an irrepairable error due to cluster state or due to the CSI node not being synchronized) we should move the status to progressing. That is because all of the resource sync problems are either resolvable automatically (after a certain time), or can be remediated by the user through changes in the cluster.
There is an edge that if we configure the pods wrong in the reconcile, then we have a permanent failure with state Progressing. However this is still technically correct since the Reconciler will keep trying to apply the resources (as opposed to perceived Failed which users would expect to not conclude with a retry)

Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 70.50%. Comparing base (1357036) to head (c2d8794).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #688      +/-   ##
==========================================
- Coverage   70.66%   70.50%   -0.16%
==========================================
  Files          47       47
  Lines        3245     3245
==========================================
- Hits         2293     2288       -5
- Misses        785      786       +1
- Partials      167      171       +4

Files
Coverage Δ

internal/controllers/lvmcluster/controller.go
67.53% <100.00%> (-2.60%)
:arrow_down:

internal/controllers/lvmcluster/status.go
92.98% <100.00%> (ø)

... and 1 file with indirect coverage changes

/lgtm

repo: openshift/lvm-operator


text:
Download and cache go modules in builder container

By copying in just the go.mod and go.sum files, and then running a go mod download, we cache the docker layer with the modules and don't need to redownload them each time the code changes. We'll only discard that layer if the go.mod/sum files actually change.

/assign @lisa

/retest
maybe apache is back up?
@cblecker if this apache issue persists should we resume with the proxy?

/retest

/test verify

@lisa Tests are passing now :)

/lgtm

authors: cblecker lisa

repo: openshift/managed-velero-operator


text:
cleanup: boilerplate update

What type of PR is this?
cleanup
What this PR does / why we need it?
Which Jira/Github issue(s) this PR fixes?
Fixes #
Special notes for your reviewer:
Pre-checks (if applicable):

[ ] Tested latest changes against a cluster
[ ] Ran make generate command locally to validate code changes
[ ] Included documentation changes with PR

make boilerplate-update
sed: config/config.go: No such file or directory
sed: config/config.go: No such file or directory
boilerplate/openshift/golang-osd-operator/standard.mk:113: Setting GOEXPERIMENT=strictfipsruntime,boringcrypto - this generally causes builds to fail unless building inside the provided Dockerfile. If building locally consider calling 'go build .'
go: unknown GOEXPERIMENT strictfipsruntime
Cloning into '/var/folders/4p/g_k9wmr15319wd7l3shxdywc0000gn/T/tmp.ivWbjH2RJY'...
remote: Enumerating objects: 3742, done.
remote: Counting objects: 100% (611/611), done.
remote: Compressing objects: 100% (201/201), done.
remote: Total 3742 (delta 431), reused 538 (delta 407), pack-reused 3131
Receiving objects: 100% (3742/3742), 933.95 KiB | 498.00 KiB/s, done.
Resolving deltas: 100% (1906/1906), done.
Updating the update script.
Copying utilities
Reinvoking...

***********************************************************************************
openshift/golang-osd-operator is configured in update.cfg.
-----------------------------------------------------------------------------------
syncing files from source.
executing /Users/feichashao/git/ocm-agent-operator/boilerplate/openshift/golang-osd-operator/update PRE
executing /Users/feichashao/git/ocm-agent-operator/boilerplate/openshift/golang-osd-operator/update POST
Copying .codecov.yml to your repository root.
Copying OWNERS_ALIASES to your repository root.
Copying dependabot.yml to .github/dependabot.yml
Copying Dockerfile.olm-registry to build/Dockerfile.olm-registry
Overwriting /Users/feichashao/git/ocm-agent-operator/build/Dockerfile's initial FROM with quay.io/app-sre/boilerplate:image-v5.0.0
Overwriting /Users/feichashao/git/ocm-agent-operator/build/Dockerfile's registry.access.redhat.com/ubi8/ubi-minimal:8.9-1161.1715068733 image to registry.access.redhat.com/ubi8/ubi-minimal:8.9-1161.1715068733
Overwriting /Users/feichashao/git/ocm-agent-operator/build/Dockerfile.olm-registry's registry.access.redhat.com/ubi8/ubi-minimal:latest image to registry.access.redhat.com/ubi8/ubi-minimal:8.9-1161.1715068733
Writing .ci-operator.yaml in your repository root with:
    namespace: openshift
    name: boilerplate
    tag: image-v5.0.0

=====================
THINGS YOU NEED TO DO
=====================
- Make sure the following line is in your base Makefile:

include boilerplate/generated-includes.mk

- Remove any other 'include' lines, unless they're for things truly
  unique to your repository. (Otherwise, consider proposing them to
  boilerplate.)

- Delete any obsolete files you're no longer including.

- Make sure you are properly integrated with codecov.io:
  https://github.com/openshift/ops-sop/blob/93d100347746ce04ad552591136818f82043c648/services/codecov.md#generate-the-codecovio-token

- Make sure your prow and app-sre pipeline configurations use the
  build_root configuration and standard targets described in the README.
=====================

adding makefile includes.
***********************************************************************************

***********************************************************************************
openshift/golang-osd-operator-osde2e is configured in update.cfg.
-----------------------------------------------------------------------------------
syncing files from source.
adding makefile includes.
***********************************************************************************

Processing .gitattributes
Registering commit hash...
Registering image tag...
Done

Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 68.80%. Comparing base (32b5ef0) to head (89074c1).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #130   +/-   ##
=======================================
  Coverage   68.80%   68.80%
=======================================
  Files          21       21
  Lines        1404     1404
=======================================
  Hits          966      966
  Misses        358      358
  Partials       80       80

closing to fix the issue in another PR

authors: codecov-commenter feichashao

repo: openshift/ocm-agent-operator


text:
odo service delete unable to delete provisioning service instance

[kind/bug]

What versions of software are you using?

Operating System: Supported platform
Output of odo version: master

How did you run odo exactly?
https://github.com/openshift/odo/issues/2019#issuecomment-521187529
$ odo service create dh-postgresql-apb --plan dev -p postgresql_user=luke -p postgresql_password=secret -p postgresql_database=my_data -p postgresql_version=9.6 --app app --project myproject

$ odo service list --app app --project myproject
NAME                  TYPE                  STATUS
dh-postgresql-apb     dh-postgresql-apb     Provisioning

$ odo delete -f dh-postgresql-apb --app app --project myproject
  ✗  Component dh-postgresql-apb does not exist in application app

Actual behavior
$ odo delete -f dh-postgresql-apb --app app --project myproject
  ✗  Component dh-postgresql-apb does not exist in application uphmxpo

Expected behavior
Deletion should be successful irrespective of service status
Any logs, error output, etc?

#2019 (comment)

repo: openshift/odo


text:
Validate comp cmd's child cmd to a valid container component

/kind bug

What versions of software are you using?
Operating System:
Output of odo version: master
Consider this devfile:
components:
  - container:
      name: runtime
      image: quay.io/eclipse/che-nodejs10-ubi:nightly
      memoryLimit: 1024Mi
      endpoints:
        - name: "3000/tcp"
          targetPort: 3000
      mountSources: true
  - container:
      name: "tools"
      image: quay.io/eclipse/che-nodejs10-ubi:nightly
      mountSources: true
      memoryLimit: 1024Mi
commands:
  - exec:
      id: myPostStart
      commandLine: echo I am a PostStart
      component: tools22
      workingDir: /
  - exec:
      id: secondPostStart
      commandLine: echo I am also a PostStart
      component: runtime
      workingDir: /
  - exec:
      id: devrun
      component: runtime
      commandLine: npm start
      workingDir: ${CHE_PROJECTS_ROOT}/nodejs-starter
      group:
        kind: run
        isDefault: true
  - composite:
         id: mycompevent
         label: a comp cmd
         commands:
           - myPostStart
           - secondPostStart
         parallel: true
         group:
          kind: build
          isDefault: true

the composite command mycompevent's  myPostStart maps to an invalid container component tools22 with o/p:
Executing devfile commands for component madridnode
 •  Executing mypoststart command "echo I am a PostStart"  ...
 •  Executing secondpoststart command "echo I am also a PostStart"  ...
 ✗
Unable to exec command [/bin/sh -c cd / && echo I am a PostStart]:

 ✗  Executing mypoststart command "echo I am a PostStart" [518ms]
 ✗  Failed to start component with name madridnode. Error: Failed to create the component: parallel command execution failed: unable to execute the build command: error while streaming command: container tools22 is not valid for pod madridnode-84bc5ff6f4-gr2sd

This should be validated. Also remember to check if this holds true for event validation with composite command(subject to https://github.com/openshift/odo/pull/3631 being merged before this is worked on)
/area devfile

/assign

Looks like we're not calling validateCommand on a composite command's child commands. Easy fix.

authors: johnmcollier maysunfaisal


text:
project_export.sh fails in Openshift v3.10

Hey,
the backup script porject_export.sh fails in Openshift v3.10 with following error:
error: the server doesn't have a resource type "podpreset"
In previous versions like v3.7  it doesnt throw in error just:
No resources found.
Greetings,
Daniel

Try the PR refactor_export. It supports older oc clients and non-admin users by exporting only what's reachable.

repo: openshift/openshift-ansible-contrib


text:
OCPBUGS-30219: bump otelgrpc to 0.46.0

Manual backport cherry-pick of https://github.com/openshift/operator-framework-olm/pull/712/commits/e2e482af7d8fbb9ec0ae8af49eb318120090d53e

/jira refresh

/label backport-risk-assessed

/label cherry-pick-approved

The otelgrpc is still 0.44.0: https://github.com/openshift/operator-framework-olm/pull/712/files#diff-a5e215633ff8e6a4eabb33ba5583967629ba72422d56e9881b3eee83aab1f212L206

/remove cherry-pick-approved

/hold

good spot, @emmajiafan.  Updated, pending ci.

/unhold

/retest

/cherry-pick release-4.14

authors: emmajiafan grokspawn kevinrizza

repo: openshift/operator-framework-olm


text:
WIP: bump Prometheus to v0.20.0-rc.0

This is only to test the first release candidate of v0.20.0 against the origin test suite and it shouldn't be merged.

/close
The tests pass and after a quick look at the memory/CPU metrics of Prometheus, no regression detected. We'll wait for the official v2.20.0.

repo: openshift/prometheus


text:
OCPQE-25165 refresh secalert and check alerts is empty

get secalert by refresh api
check if alerts object is empty

/lgtm

/approve

authors: rioliu-rh tomasdavidorg

repo: openshift/release-tests


text:
Added build time user to get the build running in OSBS

This PR makes sure the make command runs as root user.
By default the USER in OSBS is changed to USER 1001, which makes build to fail.

@otaviof any idea on why the CI is running for 3 days, here?

@adambkaplan @coreydaley could you please review and merge this?

CI looks good.

@bamachrn  Could you paste the failure logs from OSBS here if that's OK? I'm wondering why root is needed for building this image @otaviof ?

COPY . $GOPATH/src/github.com/openshift/source-to-image
RUN cd $GOPATH/src/github.com/openshift/source-to-image &&     make &&     install _output/local/bin/linux/${GOARCH}/s2i /usr/local/bin
hack/build-go.sh
mkdir: cannot create directory '/src/github.com/openshift/source-to-image/_output': Permission denied
make: *** [Makefile:24: all] Error 1
running 'cd $GOPATH/src/github.com/openshift/source-to-image &&     make &&     install _output/local/bin/linux/${GOARCH}/s2i /usr/local/bin' failed with exit code 2
ERROR - Build step plugin imagebuilder failed: image build failed (rc=1): running 'cd $GOPATH/src/github.com/openshift/source-to-image &&     make &&     install _output/local/bin/linux/${GOARCH}/s2i /usr/local/bin' failed with exit code 2

@bamachrn I would avoid the specification of root.
Could we have something like this ? @otaviof
FROM openshift/origin-release:golang-1.13 AS builder

ENV S2I_GIT_VERSION="" \
    S2I_GIT_MAJOR="" \
    S2I_GIT_MINOR=""

WORKDIR /tmp/source-to-image
COPY . .

ENV GOARCH="amd64"
RUN make

#
# Runner Image
#

FROM registry.access.redhat.com/ubi7/ubi-minimal

ENV GOARCH="amd64"

COPY --from=builder /tmp/source-to-image/_output/local/bin/linux/${GOARCH}/s2i  /usr/local/bin/s2i

USER 10001

ENTRYPOINT [ "/usr/local/bin/s2i" ]

Could we have something like this ?

I think we can, @sbose78! Would you please try to build it like that @bamachrn? Good suggestion to avoid root specified directly.

@adammhaile both the base images are changed in doozer build
openshift/origin-release:golang-1.13  ==> rhel8/go-toolset:1.13
registry.redhat.io/ubi8/ubi ==> ubi8:8-released

and
openshift/origin-release:golang-1.13
registry.redhat.io/ubi8/ubi

this images are not getting downloaded in brew build. I believe they are same image, but wanted to make sure we are running the builds on top of correct image. cc: @otaviof @sbose78

@sbose78 @otaviof
even if we are changing the build dir to /tmp in the above dockerfile. it is failing with same error.
hack/build-go.sh
mkdir: cannot create directory '/tmp/source-to-image/_output': Permission denied
make: *** [Makefile:24: all] Error 1
running 'make' failed with exit code 2
ERROR - Build step plugin imagebuilder failed: image build failed (rc=1): running 'make' failed with exit code 2

and in the brew build I see a pattern to user root user for running commands. (these are added by brew itself)
FROM sha256:c516d13c06ca29ef6953f8fad1a52914908640aa8a91552d42ade64cc6d65cb7 as builder
ADD atomic-reactor-repos/* '/etc/yum.repos.d/'
USER root
RUN mv -f /etc/yum.repos.d/ubi.repo /tmp || :
USER 1001

I understand, if that's the pattern let's go for it. However let's set the user ( as done in my suggestion ) for the runtime image in the second stage.

@otaviof @sbose78 what should be the base images in the Dockerfile? as brew is not able to pull both the images.

FROM openshift/origin-release:golang-1.13 AS builder

ENV SOURCE_GIT_COMMIT=c82d9ebcdedf29c17c4ff1bc4eb47fc0b7898d9a SOURCE_DATE_EPOCH=1576077064 BUILD_VERSION=v1.3.0 SOURCE_GIT_URL=https://github.com/openshift/source-to-image SOURCE_GIT_TAG=v1.2.0-25-gc82d9ebc BUILD_RELEASE=201912171309

ENV S2I_GIT_VERSION="" \
    S2I_GIT_MAJOR="" \
    S2I_GIT_MINOR=""

WORKDIR /tmp/source-to-image
COPY . .

ENV GOARCH="amd64"

USER root

RUN make

#
# Runner Image
#

FROM registry.redhat.io/ubi8/ubi

ENV SOURCE_GIT_COMMIT=c82d9ebcdedf29c17c4ff1bc4eb47fc0b7898d9a SOURCE_DATE_EPOCH=1576077064 BUILD_VERSION=v1.3.0 SOURCE_GIT_URL=https://github.com/openshift/source-to-image SOURCE_GIT_TAG=v1.2.0-25-gc82d9ebc BUILD_RELEASE=201912171309

ENV GOARCH="amd64"

COPY --from=builder /tmp/source-to-image/_output/local/bin/linux/${GOARCH}/s2i  /usr/local/bin/s2i

USER 1001

ENTRYPOINT [ "/usr/local/bin/s2i" ]

LABEL \
        io.k8s.description="source to image" \
        com.redhat.component="ocp-tools-1-tech-preview-source-to-image-rhel8-container" \
        name="ocp-tools-1-tech-preview/source-to-image-rhel8" \
        io.k8s.display-name="source to image" \
        io.openshift.build.source-location="https://github.com/openshift/source-to-image" \
        io.openshift.build.commit.url="https://github.com/openshift/source-to-image/commit/c82d9ebcdedf29c17c4ff1bc4eb47fc0b7898d9a" \
        version="v1.3.0" \
        io.openshift.build.commit.id="c82d9ebcdedf29c17c4ff1bc4eb47fc0b7898d9a" \
        release="201912171309"

Are we good to go with:
rhel8/go-toolset:1.13
ubi8:8-released

querying /v2/rh-osbs/openshift-origin-release/manifests/golang-1.13, headers: {u'Accept': 'application/vnd.docker.distribution.manifest.list.v2+json'}
 [401] https://registry-proxy.engineering.redhat.com/v2/rh-osbs/openshift-origin-release/manifests/golang-1.13
[404] https://registry-proxy.engineering.redhat.com/v2/rh-osbs/openshift-origin-release/manifests/golang-1.13
skipping version v2_list due to status code 404
Cannot resolve manifest digest for image 'registry-proxy.engineering.redhat.com/rh-osbs/openshift-origin-release:golang-1.13

ERROR - plugin 'pull_base_image' raised an exception: RuntimeError: Registry specified in dockerfile image doesn't match configured one. Dockerfile: 'registry.redhat.io/ubi8/ubi:latest';

FROM rhel8/go-toolset:1.13 AS builder

ENV SOURCE_GIT_COMMIT=c82d9ebcdedf29c17c4ff1bc4eb47fc0b7898d9a SOURCE_DATE_EPOCH=1576077064 BUILD_VERSION=v1.3.0 SOURCE_GIT_URL=https://github.com/openshift/source-to-image SOURCE_GIT_TAG=v1.2.0-25-gc82d9ebc BUILD_RELEASE=201912171309

ENV S2I_GIT_VERSION="" \
    S2I_GIT_MAJOR="" \
    S2I_GIT_MINOR=""

WORKDIR /tmp/source-to-image
COPY . .

ENV GOARCH="amd64"

USER root

RUN make

#
# Runner Image
#

FROM ubi8:8-released

ENV SOURCE_GIT_COMMIT=c82d9ebcdedf29c17c4ff1bc4eb47fc0b7898d9a SOURCE_DATE_EPOCH=1576077064 BUILD_VERSION=v1.3.0 SOURCE_GIT_URL=https://github.com/openshift/source-to-image SOURCE_GIT_TAG=v1.2.0-25-gc82d9ebc BUILD_RELEASE=201912171309

ENV GOARCH="amd64"

COPY --from=builder /tmp/source-to-image/_output/local/bin/linux/${GOARCH}/s2i  /usr/local/bin/s2i

USER 1001

ENTRYPOINT [ "/usr/local/bin/s2i" ]

LABEL \
        io.k8s.description="source to image" \
        com.redhat.component="ocp-tools-1-tech-preview-source-to-image-rhel8-container" \
        name="ocp-tools-1-tech-preview/source-to-image-rhel8" \
        io.k8s.display-name="source to image" \
        io.openshift.build.source-location="https://github.com/openshift/source-to-image" \
        io.openshift.build.commit.url="https://github.com/openshift/source-to-image/commit/c82d9ebcdedf29c17c4ff1bc4eb47fc0b7898d9a" \
        version="v1.3.0" \
        io.openshift.build.commit.id="c82d9ebcdedf29c17c4ff1bc4eb47fc0b7898d9a" \
        release="201912171309"

this builds successfully @otaviof @sbose78

@adammhaile both the base images are changed in doozer build
openshift/origin-release:golang-1.13  ==> rhel8/go-toolset:1.13
registry.redhat.io/ubi8/ubi ==> ubi8:8-released

and
openshift/origin-release:golang-1.13
registry.redhat.io/ubi8/ubi

this images are not getting downloaded in brew build. I believe they are same image, but wanted to make sure we are running the builds on top of correct image. cc: @otaviof @sbose78

@bamachrn Yes, go-toolset and ubi8 are the standard images for building internally. This change is intentional. Doozer does not build with anything from origin, only downstream openshift approved images.

I have updated the Dockerfile as per the discussion. please review and merge @otaviof @sbose78 @adammhaile

Looks good to me!

@bamachrn Nack on changing the base images in Dockerfile.
The general convention is to have Dockerfile use base images that have low barriers to consumption. Ex - images from docker.io, registry.redhat.io, or registry.svc.ci.openshift.org. Things that are tailored to our build systems should have a separate Dockerfile - (i.e. Dockerfile.rhel8).
@bamachrn @adammhaile I don't fully understand why the base images need to change - doesn't Doozer do the image substitution for us?

Ok, apparently I misread something before. Yes, doozer makes the change. I was asked why it was changed in distgit (I thought) and that's because doozer changes it. It does not need to change in the source dockerfile in github.

OK, my thought process is to keep it consistent. If we know that it will get substituted, why not use same to run the through out CI and build process. This will avoid build time surprises and will make sure we are running tests on the image, which is getting released.
I got the point of using images from low barrier registries, from the upstream point of view. And agree with it, we should use non productised images for upstream builds. But, we should make sure, we are testing the image after substitution. And we should always keep this in mind that the image gets replaced in build time environment.
@adammhaile @adambkaplan @otaviof @sbose78 thoughts on this?
I am ok with using the origin images in upstream, just wanted to make sure we are making a conscious decision here.

But, we should make sure, we are testing the image after substitution.

yes, agreed. This is something the devtools architects are discussing with QE since this affects productization of all projects.

I got the point of using images from low barrier registries, from the upstream point of view. And agree with it, we should use non productised images for upstream builds.

Let's keep the upstream dockerfile unchanged, also since that's the precedent.

done!

authors: adammhaile bamachrn otaviof sbose78

repo: openshift/source-to-image


text:
Get source context-dir from SourceInfo

@bparees PTAL

lgtm.
[merge]

authors: bparees jhadvig


text:
Add submodule commands

Adds submodule update and init commands. See issue in origin:
https://github.com/openshift/origin/issues/5910

cc @mfojtik

Ugh I need to implement tests. Give me a few.

can you want to update the s2i clone path to use this new functionality so it works here too?

@bparees I've done the change, have a look please. I'm not sure if it's the best way to do it. But it should work.

@bparees Test is failing because the last command is now the submodule update instead of the checkout. I can fix this a few different ways. I think I'll add another test for the submodule update.

@bparees I've updated the tests to not use Recursive for now. It shouldn't change anything in the context of the test but it might be wise to add more submodule-related tests for coverage later on.

lgtm, would like @mfojtik to take a look also.

made the 1 minor syntastic change suggested by @liggitt, otherwise commit is the same

[test]
lgtm as soon as the test pass

Thanks @paralin !

[merge]

authors: bparees mfojtik paralin


text:
Caracteres Especiais e Atualização nos materiais

Editei o nome das pastas por conta da incompatibilidade com o windows. (Ex: 1. Primeiros Passos ficou 1 - Primeiros Passos)
Atualizei o conteúdo do método Kanban e acredito que assim está mais direito ao ponto.
Proponho a separação dos métodos Kanban e Scrum para uma pasta de Metodologias Ágeis ao invés de Métodos de Estudo. Acredito que como estava não era o correto.

@odenirdev Depois dá uma olhada nessas modificações. Assim que possível farei novas contribuições para o projeto.

@fcoxico, muito obrigado pela contribuição, gostei da configuração de pasta que você fez, também da imagem com a identidade visual do projeto, achei incrível demais!

authors: fcoxico odenirdev

repo: opensource-courses/courses

license: MIT


text:
decode.sh is emtpy

I figured maybe decode.sh wasn't written, because the configuration wasn't completed. After choosing configuration options in the dialog that was triggered with ./configure.sh the script doesn't pass the screen with the text:
Const LM generation
Creating ConstLM for rescore, This may take a while
Creating ConstLM

Any ideas what went wrong?
Technical information:
OS: Red Hat Enterprise Linux Server release 7.2 (Maipo)
CPU: 4 x  Intel(R) Xeon(R) CPU E5-2650 v3 @ 2.30GHz (2 cpu cores)
MP3 plugin for Sox wasn't installed.
java version "1.8.0_111"
Java(TM) SE Runtime Environment (build 1.8.0_111-b14)
Java HotSpot(TM) 64-Bit Server VM (build 25.111-b14, mixed mode)
Memory: 32GB
Models chosen:
AM: NL/UTwente/HMI/AM/CGN_large/nnet3_online/tdnn_cleaned
LM: v1.0/KrantenTT.3gpr.kn.int.arpa.gz
Rescore LM: NL/UTwente/HMI/LM/KrantenTT & v1.0/KrantenTT.4gpr.kn.int.arpa.gz

This takes some hours to complete. If you open up a new console and type in "top" you can see that there is some activity going on.
Would be nice to have some information progress bar to know it is doing something in the background :)

I see that this dialog was started from local/configure_decode.sh and that this is one step before decode.sh creation is started.

I don't see a process in top. My configure.log gives this at the end of the file:
**Creating models/NL/UTwente/HMI/LM/KrantenTT/v1.0/LG_KrantenTT.3gpr.kn.int_UTwente_HMI_lexicon/lang/lexicon.txt from models/NL/UTwente/HMI/LM/KrantenTT/v1.0/LG_KrantenTT.3gpr.kn.int_UTwente_HMI_lexicon/lang/lexiconp.txt mkgraph.sh: expected models/NL/UTwente/HMI/LM/KrantenTT/v1.0/LG_KrantenTT.3gpr.kn.int_UTwente_HMI_lexicon/L.fst to exist mkgraph.sh: expected models/NL/UTwente/HMI/LM/KrantenTT/v1.0/LG_KrantenTT.3gpr.kn.int_UTwente_HMI_lexicon/L.fst to exist cat: models/NL/UTwente/HMI/LM/KrantenTT/v1.0/LG_KrantenTT.3gpr.kn.int_UTwente_HMI_lexicon/Const_UTwente_HMI_KrantenTT_v1.0_KrantenTT.4gpr.kn.int/oov.int: No such file or directory grep: models/NL/UTwente/HMI/LM/KrantenTT/v1.0/LG_KrantenTT.3gpr.kn.int_UTwente_HMI_lexicon/Const_UTwente_HMI_KrantenTT_v1.0_KrantenTT.4gpr.kn.int/words.txt: No such file or directory grep: models/NL/UTwente/HMI/LM/KrantenTT/v1.0/LG_KrantenTT.3gpr.kn.int_UTwente_HMI_lexicon/Const_UTwente_HMI_KrantenTT_v1.0_KrantenTT.4gpr.kn.int/words.txt: No such file or directory utils/build_const_arpa_lm.sh: <s> and </s> symbols are not in models/NL/UTwente/HMI/LM/KrantenTT/v1.0/LG_KrantenTT.3gpr.kn.int_UTwente_HMI_lexicon/Const_UTwente_HMI_KrantenTT_v1.0_KrantenTT.4gpr.kn.int/words.txt
Is this an indication that the whole process stopped?

Where did you find that log?
Installing a fresh Red Hat server at the moment and going for a re-install.

This is in the Kaldi_NL directory, same as where configure.sh lives.
My guess right now is that something went wrong with downloading the starterpack earlier, so I deleted my models directory and restarted configure.sh. Now it starts to download the models again. I have detached from my screen now because it says download will take one and a half hour. Will report later.

If I look at the Ubuntu (second server) configure.sh logfiles, then there are no errors and looks ok to me.
Laurens mentioned a few days ago to delete the models directory and let the configure script create the folder. Do not create it manually by hand or there could me something wrong with the rights on the folder.

So the model directory should only be set in de dialog, but not created using mkdir. Will try that. Thanks!

This time the decode.sh script is right!

authors: Michel-NL wmelder


text:
"traditional" PEM output isn't always so "traditional"

While making PEM_write_bio_PrivateKey_traditional() more strict (see #12728 and #12729), I discovered that our own (legacy in 3.0) backends do not always support traditional output, but since PEM_write_bio_PrivateKey_traditional() didn't check that too closely, some "traditional" output may be PKCS#8 after all.
DH is one example, I  haven't investigated others.
I just tested a little with the openssl installed a part of my system:
$ openssl version
OpenSSL 1.1.1g  21 Apr 2020
$ openssl genpkey -paramfile test/certs/dhp2048.pem > foo.pem
$ cat foo.pem
-----BEGIN PRIVATE KEY-----
MIICJgIBADCCARcGCSqGSIb3DQEDATCCAQgCggEBAKCNFeRygHLBuC5QJ1SYWJ55
dhKznHb8+1jeJ/i6EpGVZHz3DxMQBbl50+r9eq2H8QoGQzwf7UmGkYTsaSYGgBxg
PT638KazOMUJvRyyFrYnciBrZIMp0K67cWgnLpWzzjMXNaHe1dI8PP0o+KXSo4o5
nb2N1bL7kD7ui6O6lfeLt6WDflkj/REj3GNJbyFdLNHmMc1OSzlOxWUb+oKXuufM
sZ6WkH9dzN7BQanEBJ8PryIzcmgQSjZuI1RXigjd2iM/siS/MteBxJ1f7Z4bSK69
9zACb7BtahQWO4hb275cf4Cg1u6spFdP4jdrhJayWSBsQ9rjzGTVzvnXIvhK4jMC
AQIEggEEAoIBAEu33ABijTTUrr6+lmMRlfQdze+dncKSBwyHTHmCgISMdvpXWios
325Lb4LpmXSerfo/xU4Io3NvZ89dXsBLuYPCAgMtM5uQApI0t+IvWfOcVwdef0Ak
QdHZw2SQL6RXC9UACOEZIfjIUOfmW9WLKCtXdx7G4AI8Squu7cwNFbyjB3mrivym
2a6zpYNjML+o73Gs0epixV8eOIrzYl7dF8fB9nIykC5DLTyrAAzyyc1PKz+W/lI2
rb9OiHvQLdulDRXGuzilVAUeQta4CoUFitGBVfg1DFxMhZM68DJHeBPPRuTCzcqv
BWVYwob2cZFkw0YjKgPr8LhzG1gk6ywucvw=
-----END PRIVATE KEY-----
$ openssl pkcs8 -traditional -nocrypt -in foo.pem > bar.pem
$ cat bar.pem
-----BEGIN DH PRIVATE KEY-----
MIICJgIBADCCARcGCSqGSIb3DQEDATCCAQgCggEBAKCNFeRygHLBuC5QJ1SYWJ55
dhKznHb8+1jeJ/i6EpGVZHz3DxMQBbl50+r9eq2H8QoGQzwf7UmGkYTsaSYGgBxg
PT638KazOMUJvRyyFrYnciBrZIMp0K67cWgnLpWzzjMXNaHe1dI8PP0o+KXSo4o5
nb2N1bL7kD7ui6O6lfeLt6WDflkj/REj3GNJbyFdLNHmMc1OSzlOxWUb+oKXuufM
sZ6WkH9dzN7BQanEBJ8PryIzcmgQSjZuI1RXigjd2iM/siS/MteBxJ1f7Z4bSK69
9zACb7BtahQWO4hb275cf4Cg1u6spFdP4jdrhJayWSBsQ9rjzGTVzvnXIvhK4jMC
AQIEggEEAoIBAEu33ABijTTUrr6+lmMRlfQdze+dncKSBwyHTHmCgISMdvpXWios
325Lb4LpmXSerfo/xU4Io3NvZ89dXsBLuYPCAgMtM5uQApI0t+IvWfOcVwdef0Ak
QdHZw2SQL6RXC9UACOEZIfjIUOfmW9WLKCtXdx7G4AI8Squu7cwNFbyjB3mrivym
2a6zpYNjML+o73Gs0epixV8eOIrzYl7dF8fB9nIykC5DLTyrAAzyyc1PKz+W/lI2
rb9OiHvQLdulDRXGuzilVAUeQta4CoUFitGBVfg1DFxMhZM68DJHeBPPRuTCzcqv
BWVYwob2cZFkw0YjKgPr8LhzG1gk6ywucvw=
-----END DH PRIVATE KEY-----
$ openssl asn1parse -i -in bar.pem
    0:d=0  hl=4 l= 550 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim:  INTEGER           :00
    7:d=1  hl=4 l= 279 cons:  SEQUENCE
   11:d=2  hl=2 l=   9 prim:   OBJECT            :dhKeyAgreement
   22:d=2  hl=4 l= 264 cons:   SEQUENCE
   26:d=3  hl=4 l= 257 prim:    INTEGER           :A08D15E4728072C1B82E50275498589E797612B39C76FCFB58DE27F8BA129195647CF70F131005B979D3EAFD7AAD87F10A06433C1FED49869184EC692606801C603D3EB7F0A6B338C509BD1CB216B62772206B648329D0AEBB7168272E95B3CE331735A1DED5D23C3CFD28F8A5D2A38A399DBD8DD5B2FB903EEE8BA3BA95F78BB7A5837E5923FD1123DC63496F215D2CD1E631CD4E4B394EC5651BFA8297BAE7CCB19E96907F5DCCDEC141A9C4049F0FAF22337268104A366E2354578A08DDDA233FB224BF32D781C49D5FED9E1B48AEBDF730026FB06D6A14163B885BDBBE5C7F80A0D6EEACA4574FE2376B8496B259206C43DAE3CC64D5CEF9D722F84AE233
  287:d=3  hl=2 l=   1 prim:    INTEGER           :02
  290:d=1  hl=4 l= 260 prim:  OCTET STRING      [HEX DUMP]:028201004BB7DC00628D34D4AEBEBE96631195F41DCDEF9D9DC292070C874C798280848C76FA575A2A2CDF6E4B6F82E999749EADFA3FC54E08A3736F67CF5D5EC04BB983C202032D339B90029234B7E22F59F39C57075E7F402441D1D9C364902FA4570BD50008E11921F8C850E7E65BD58B282B57771EC6E0023C4AABAEEDCC0D15BCA30779AB8AFCA6D9AEB3A5836330BFA8EF71ACD1EA62C55F1E388AF3625EDD17C7C1F67232902E432D3CAB000CF2C9CD4F2B3F96FE5236ADBF4E887BD02DDBA50D15C6BB38A554051E42D6B80A85058AD18155F8350C5C4C85933AF032477813CF46E4C2CDCAAF056558C286F6719164C346232A03EBF0B8731B5824EB2C2E72FC

So basically, you end up getting a PEM file where the headers indicate "traditional", but the contents are PKCS#8 all the same.
Has anyone ever noticed?  I suspect that most people have switched to PKCS#8 anyway, so these kinds of bugs go unnoticed for quite a while.
The question is what to do with this.  Letting PEM_write_bio_PrivateKey_traditional() output things like the above don't seems right, and squarely contradict the documented intention (from man PEM_write_bio_PrivateKey_traditional):

PEM_write_bio_PrivateKey_traditional() writes out a private key in the "traditional" format with a simple private key marker and should only be used for compatibility with legacy programs.

I can see several possibilities:

Live with it.  That's not very appetizing, if not to say plain wrong.
Simply apply #12728 and #12729, and live with the fact that some attempts to output "traditional" PEM will give out errors.
In my opinion, this is better than to output PKCS#8 under false pretences.
Our tests will have to be adjusted accoordingly
Add missing support in our EVP_PKEY_ASN1_METHOD instances.  That would be an amendment to #12728 and #12729.

IMO we should do 2. for now, because 1. is clearly a bug. And if there is a fix available to provide 3. during beta phase I think it should be acceptable as a bug fix.

Can we actually read such files that claim to be traditional files
but aren't?

@kroeckx, I haven't really tested. Will do

Marking as inactive, to be closed at the end of 3.4 dev barring further input

authors: kroeckx levitte nhorman t8m

repo: openssl/openssl


text:
Problems building openssl-1.1.1-pre6 on Solaris 10 sparc

I have tried building openssl-1.1.1-pre6 on three different Solaris 10 sparc systems, using several different combinations or cc/gcc and ld/gld and have not been successful. Openssl-1.1.1-pre1 built fine on these systems.
Here is the link error I am getting (currently using /usr/ccs/bin/ld for linking and gcc5.5:
${LDCMD:-gcc} -pthread -Wall -O3 -L.
-o apps/openssl apps/asn1pars.o apps/ca.o apps/ciphers.o apps/cms.o apps/crl.o apps/crl2p7.o apps/dgst.o apps/dhparam.o apps/dsa.o apps/dsaparam.o apps/ec.o apps/ecparam.o apps/enc.o apps/engine.o apps/errstr.o apps/gendsa.o apps/genpkey.o apps/genrsa.o apps/nseq.o apps/ocsp.o apps/openssl.o apps/passwd.o apps/pkcs12.o apps/pkcs7.o apps/pkcs8.o apps/pkey.o apps/pkeyparam.o apps/pkeyutl.o apps/prime.o apps/rand.o apps/rehash.o apps/req.o apps/rsa.o apps/rsautl.o apps/s_client.o apps/s_server.o apps/s_time.o apps/sess_id.o apps/smime.o apps/speed.o apps/spkac.o apps/srp.o apps/storeutl.o apps/ts.o apps/verify.o apps/version.o apps/x509.o
apps/libapps.a -lssl -lcrypto -lsocket -lnsl -ldl -pthread
ld: warning: relocation warning: R_SPARC_COPY: file ./libcrypto.so: symbol PBE2PARAM_it: relocation bound to a symbol with STV_PROTECTED visibility
ld: warning: relocation warning: R_SPARC_COPY: file ./libcrypto.so: symbol PBEPARAM_it: relocation bound to a symbol with STV_PROTECTED visibility
ld: warning: relocation warning: R_SPARC_COPY: file ./libcrypto.so: symbol PBKDF2PARAM_it: relocation bound to a symbol with STV_PROTECTED visibility
ld: warning: relocation warning: R_SPARC_COPY: file ./libcrypto.so: symbol SCRYPT_PARAMS_it: relocation bound to a symbol with STV_PROTECTED visibility
Undefined                       first referenced
symbol                             in file
clock_gettime                       ./libcrypto.so
ld: fatal: symbol referencing errors. No output written to apps/openssl
make[1]: *** [Makefile:6385: apps/openssl] Error 1
make[1]: Leaving directory '/users/mpdscb/openssl-1.1.1-pre6'
make: *** [Makefile:171: all] Error 2

Would you mind trying to add -lrt to the configuration, i.e. if you configured like this:
./config

then do it like this instead
./config -lrt

I'm only asking you to try that as a test, to determine how we should change our config target

to determine how we should change our config target

It should be noted that -lrt is not required on contemporary Solaris versions. This asks for question whether or not it would be appropriate to impose additional library dependency on users who run later and don't need it. Maybe it would be more appropriate to not use the call on Solaris...

After adding -lrt to the Configure line, OpenSSL-1.1.1-pre6 built sucessfully on my Solaris 10 SPARC systems.  On my Solaris 11 sparc systems, it was not necessary to add -lrt, since those already had built without problems.

What about using the hrtimer call instead of clock_gettime, thus avoiding the extra library?
Solaris 10 is still in use in places.

I compiled successfully by modifying the Makefile after using the following Configure arg. lib rt has the
missing clock_gettime method
./Configure solaris64-sparcv9-gcc
Edit makefile. Change pthread to pthreads. Add -lrt
CNF_CFLAGS=-m64 -mcpu=ultrasparc -pthreads
CNF_EX_LIBS=-lsocket -lnsl -ldl -pthreads -lrt
make
make install

-pthreads surprised me...  but then, a look at the gcc manual:

           Solaris 2 Options -mclear-hwcap  -mno-clear-hwcap  -mimpure-text
           -mno-impure-text -pthreads

Yay consistency...

For completeness I also set the following environment variables to get the 64 bit version.
export LD_LIBRARY_PATH=/usr/lib/64:/usr/sfw/lib/64
export CFLAGS="-m64"
export LDFLAGS="-m64"
export PATH=/opt/csw/bin:/usr/bin:/bin:/usr/sfw/bin:/usr/ccs/bin:/opt/sfw/bin
/opt/csw/bin has perl version needed

Solaris 10 may be from 2005, but there are still quite a few sites actively using it, and this pthread vs pthreads & missing linking to librt is a real pain.

Note that I'm hitting this with Solaris 10 for x86 (vs sparc)

Also, I would note that Solaris 10 remains in support until 2024, so it should be expected for it to be around for another 4 years. Seems worthwhile for OpenSSL to take the time to ensure it compiles properly.

I compiled successfully by modifying the Makefile after using the following Configure arg. lib rt has the
missing clock_gettime method
./Configure solaris64-sparcv9-gcc
# Edit makefile. Change pthread to pthreads. Add -lrt
CNF_CFLAGS=-m64 -mcpu=ultrasparc -pthreads
CNF_EX_LIBS=-lsocket -lnsl -ldl -pthreads -lrt

make
make install

With these changes (-pthreads and -lrt) I could compile OpenSSL-1.1.1d even on an outdated Solaris 9 SPARC system, of course with perl 5.10.1 and gcc 4.6.4 fetched from OpenCSW project. @mephillips423: Thanks a lot for the hints.

authors: dark0dev dot-asm levitte mephillips423 mpdscb paulidale quanah


text:
[DNM] test

As a pull request owner and reviewers, I checked that:

[ ] Appropriate testing is done and actually running
[ ] Appropriate documentation exists and/or is up-to-date:

[ ] README in the role
[ ] Content of the docs/source is reflecting the changes

/hold


text:
apply finalizers to Secret for MariaDBAccount

when a controller is reconciling the delete of its own CR as well as its MariaDBAccount, the lookup for MariaDBDatabase/MariaDBAccount must succeed so that db.DeleteFinalizer can be called.    This uses
GetDatabaseByNameAndAccount which is required to locate all three of MariaDBDatabase, MariaDBAccount, and Secret, else notfound is returned.
therefore, prevent the Secret from being prematurely removed from the cluster by adding a calling CR finalizer to it, the same as it's added to the MariaDBAccount.
Prior to this change, the GetDatabaseByNameAndAccount can return a not-found even though the MariaDBAccount exists, causing
the calling controller to skip it and delete its own CR, leaving the MariaDBAccount and MariaDBDatabase dangling.
the issue can be reproduced by building up an openstack env with keystone / galera / memcached / rabbitmq, then deleting the namespace. k8s will delete the secrets more quickly than it can remove the CRs since they are reconciling the delete.
alternate version is to return a database/account even when secret is not found, see https://github.com/openstack-k8s-operators/mariadb-operator/pull/209

/approve

authors: dciabrin zzzeek


text:
added condition to wait for machine to be active

Added condition to wait , so machine come in active state before allocating IP . Other wise it was not able to allocate IP and whole test was getting failed .

Thank you for contributing to openstack/intel-nfv-ci-tests!
openstack/intel-nfv-ci-tests uses Gerrit for code review.
If you have never contributed to OpenStack before make sure you have read the
getting started documentation:
http://docs.openstack.org/infra/manual/developers.html#getting-started
Otherwise please visit
http://docs.openstack.org/infra/manual/developers.html#development-workflow
and follow the instructions there to upload your change to Gerrit.

repo: openstack/intel-nfv-ci-tests


text:
Add MAAS Metric for rabbit queue length

Adds metrics:

notification_messages
msgs_excl_notifications

Adds threshold and rate alarms for msgs_excl_notifications
Refactors the rabbitmq plugin to reduce duplicated code

Closes #633
Trello: https://trello.com/c/widYAV5F/35-add-new-monitor-rabbitmq-queue-length
Change-Id: Idafbbb150a761d62c8e1dc4c4900ee351993dd5e

+1 Would do business again. A+++++++++ SELLER!

authors: hughsaunders major

repo: openstack/openstack-ansible


text:
Update highway colors to match openstreetmap-carto

RE: gravitystorm/openstreetmap-carto#1736
Discussion seems pretty much settled.
Although the goals of iD and openstreetmap-carto are different, I think we should update our highway styling to match what they are doing.  Blue and green roads can be difficult to see on different backgrounds, and it would be weird for users of iD to see a drastically different road coloring than what is displayed on the main osm site.
That said, I think iD should retain some kind of color for highway=tertiary to make things less confusing for editing, so I'm planning to just pick something between the yellow highway=secondary and white highway=residential colors.

+1

Thanks @bhousel - some sort of clearer marking of tertiary in iD will help.

You may want to use https://github.com/matkoniecz/openstreetmap-carto/blob/gsoc/scripts/generate_road_colours.py
It allows you to distribute a set of road colours across a range of hues by classification, and compute both fill colours and casing colours.
Even if you end up using different colours, being able to distribute them is very useful, and saves a lot of experimentation.
To customize it, you might want to change road_classes, line_colour_infos["fill"], and line_colour_infos["casing"]

Note, https://github.com/gravitystorm/openstreetmap-carto/pull/1736 was merged and it will be included in the next release (nearest one, v.2.35 was released before this merge).

You may want to use https://github.com/matkoniecz/openstreetmap-carto/blob/gsoc/scripts/generate_road_colours.py

This script after merge resides at https://github.com/gravitystorm/openstreetmap-carto/blob/master/scripts/generate_road_colours.py

Even if you end up using different colours, being able to distribute them is very useful, and saves a lot of experimentation.

Yes, one of my biggest mistakes during developing road colours was not starting from writing this script.

Even if you end up using different colours, being able to distribute them is very useful, and saves a lot of experimentation.

Yes, one of my biggest mistakes during developing road colours was not starting from writing this script.

Can you elaborate?  I'm not clear on what it means to "distribute" colors.

Instead of manually selecting colour for every road type (motorway, trunk, primary, secondary in current script configuration) using this script it is possible to set hue, chroma and lightness range.
In script

road_classes = ["motorway", "trunk", "primary", "secondary"]

sets list of roads over which colours will be distributed
and for example

min_h = 10
max_h = 106

sets hue range

line_colour_infos["fill"] = ColourInfo(start_l = 70, end_l = 97, start_c = 35, end_c = 29)

will cause set of fill attributes to be generated .
In that case motorway will be lch(70, 35, 10) and secondary lch(97,29,106), with trunk and primary in the middle. Script also converts from lch to rgb. In that case it outputs.

@motorway-fill: #e892a2; // Lch(70,35,10), error 0.5
@trunk-fill: #f9b29c; // Lch(79,33,42), error 0.7
@primary-fill: #fcd6a4; // Lch(88,31,74), error 1.7
@secondary-fill: #f7fabf; // Lch(97,29,106), error 1.7

So "try everything more saturated" means changing start_c and end_c values, rather than manually tweaking four separate colours trying to keep them equally separated without changing lightness and hue (what is nearly impossible to do in RGB space and taking a long time with manually tweaking lch and converting each new value separately).
I attempted to rewrite script to move setting data to top and it may be slightly more readable: https://github.com/matkoniecz/openstreetmap-carto/blob/clean/scripts/generate_road_colours.py (I am not happy about it and shield generation is still at the bottom with a special case of tertiary).
It seems that this script may be improved by properly separating setting wanted values and processing them. Also, probably some readme should be added at beginning.

https://github.com/matkoniecz/openstreetmap-carto/blob/clean/scripts/generate_road_colours.py now has separation of setting data and processing it what hopefully should make more clear what is happening.

@matkoniecz, @pnorman  That sounds so complicated!
Because iD uses SVG for everything, I just adjust styles live in Chrome developer tools:

FYI, I've just tagged the release of openstreetmap-carto that contains these new colours, so I expect it to be rolled out on the OSMF servers at some point soon.
https://github.com/gravitystorm/openstreetmap-carto/releases/tag/v2.36.0 is the release version (2.36.0)
https://github.com/openstreetmap/chef/issues/38 is the ticket for the OSMF server rollout.

FYI, I've just tagged the release of openstreetmap-carto that contains these new colours, so I expect it to be rolled out on the OSMF servers at some point soon.

Awesome!  I'm finishing up styling our preset icons to match the new colors, and will tag an iD release within the next few days..

authors: M1dgard Stalfur bhousel gravitystorm matkoniecz pnorman

repo: openstreetmap/iD

license: ISC


text:
Consider exposing the coordinates of nodes for calibration

Description
https://github.com/openstreetmap/iD/issues/9983 revealed a use case of being able to know and type in the exact coordinates of nodes when dealing with turn restrictions over a long way:

Write down the coordinates of a node
Move the relevant nodes closer to shorten the segment, so the turn restrictions editor can render them
Apply turn restrictions
Type in the original coordinates of a node to restore its position
Finish and submit changes

Is this a good feature to have in the iD editor?
Screenshots
No response

Does the comment from https://github.com/openstreetmap/iD/issues/7887#issuecomment-748133757 solve your problem?

Sorry, but I am not sure where is the measurement pane in the iD editor...?

@Vectorial1024 you can enable it using ⌘ Control + ⇧ Shift + M

Ahh, ok that works.
Would suggest somehow documenting the ⌘ Control + ⇧ Shift + M thing, but otherwise, I guess the measurement pane is good enough for overall calibration.
Thanks for the quick answer!
(Can close this, unless you guys want to really implement a way to copy/paste coordinates)

authors: Vectorial1024 k-yle riQQ


text:
fix: missing zh-Hans translation

Types

[x] 🐛 Bug Fixes

Background or solution
Changelog

@bytemain 构建有点问题

/next

/next

/next

repo: opensumi/core


text:
Server stats change depending on the worker where it is executed

Please answer these questions before submitting your issue.

What did you do? If possible, provide a simple script for reproducing the error.

I created an endpoint that returns the result of $server->stats(). I was trying to use it to do some profiling of an app, focusing on the "top_classes" block.
However, it seems to return a different result depending on the worker handling the request.
It kind of makes sense at some extent, as the memory is not shared between workers, once the server is started. However, its usefulness is limited this way.
Maybe I'm doing something wrong, or not understanding how the stats are supposed to be used.

What did you expect to see?

A consistent response, specifically on the "top_classes" block, regardless of the worker handling the request.

What did you see instead?

A rotating response, that apparently depends on the worker handling the request.

What version of OpenSwoole are you using (show your php --ri openswoole)?

4.9.1

What is your machine environment used (show your uname -a & php -v & gcc -v) ?

Alpine.

It is supposed to be working like this due to the structure of server. In a busy running production server the response should be similar when requests are load balanced to each server.

I guess that makes sense.
Thanks for the clarification.

authors: acelaya doubaokun

repo: openswoole/swoole-src


text:
Optional mapLocale function added to parse() method.

parse() can now decode locales using either "_" or "-" as the delimiter.
pick() maps older Chinese locales to match script or region.
parse() - supports optional custom locale mapping function.
Unit tested.

Travis build failed so till investigate.

Broken will fix.

repo: opentable/accept-language-parser

license: mit


text:
Front-end changes: Study-locus page

[x] rsID for the page’s lead variant
[x] Link to variant page
[x] Link to locus page (with study, variant) selected
[x] We need a way to tell what the beta is for the lead variant of the page that we’re on. I don’t think there is currently an API call that will give this information specifically? It is available from the credible set information, or could be provided with a new API call to the sumstat table.

Both QTL and GWAS coloc tables:

[x] (table) H3 tooltip: “Posterior probability that the signals do not colocalise”
[x] (table) H4 tooltip: “Posterior probability that the signals colocalise”
[x] (table) log2(H4/H3) tooltip: “Log-likelihood that the signals colocalise”
[x] show right variant

QTL coloc section:

[x] (heatmap) Add “Source” for consistency
[x] (heatmap and table) “Phenotype” to be called “Molecular Trait”
[x] (table) QTL beta tooltip: “QTL effect with respect to the alternative allele of the page variant”

GWAS colocalisation section:

[x] No heatmap (for now)
[x] Do we want a link to jump to the Study-locus page for each (study, variant) pair?
[x] (table) Beta tooltip: “Effect with respect to the alternative allele of the page variant”

Credible Set Overlap visualisation:

[x] 95% toggle doesn’t seem to do anything
[x] Set default H4 to 0.95
[x] Change “all” to “PP > 0.1%”

Closing as done

repo: opentargets/genetics


text:
Request to a new repository to support Infineon platform

Hi,
Can you create a new repository to host the support of Infineon 802.15.4 Thread platforms?
The repo name will be "ot-ifx".
Thanks,
Todd

@ItoddchouFX, do you have any updates on the Infineon platform contribution?

@jwhui I will push Infineon platform support once the CLA review is completed.

@jwhui Can you enable the "Action" of openthread/ot-ifx?

@jwhui Can you enable the "Action" of openthread/ot-ifx?

@ItoddchouFX , you should be able to enable GitHub Actions in your own fork.

@jwhui  https://github.com/openthread/ot-ifx/workflows/Build/badge.svg?branch=main&event=push cannot be found. Can you help?

@jwhui  https://github.com/openthread/ot-ifx/workflows/Build/badge.svg?branch=main&event=push cannot be found. Can you help?
Here the error is.
https://github.com/ItoddchouFX/ot-ifx/runs/4733964202?check_suite_focus=true

@ItoddchouFX , that error is expected. The link points to the main branch result, for which there are none yet.

@jwhui  Please help review https://github.com/openthread/ot-ifx/pull/4

@jwhui Please help review openthread/ot-ifx#4 again.

Resolved by https://github.com/openthread/ot-ifx/pull/4.

authors: ItoddchouFX jwhui

repo: openthread/openthread


text:
[mle] test harness issue when joining after #8836

We found joining issue with Kirale leader with this PR.  During analysis we suspected aNeighbor.SetLastHeard(TimerMilli::GetNow()) which is now calling from InitNeighbor() from Handle parent request and response.
Do you think aNeighbor.SetLastHeard(TimerMilli::GetNow()) required to update during Handle parent request and response?
Before this PR, it was not updated in parent request and response. When we are not calling in parent request and response, we able to join the device.
can you elaborate please?
Originally posted by @Ashish-Vara in https://github.com/openthread/openthread/issues/8836#issuecomment-1551166072

@Ashish-Vara, are you able to post the Test Harness output (e.g. test report PDF, pcap, logs, etc.)?

I responded on the PR -> https://github.com/openthread/openthread/pull/8836#issuecomment-1551891608. Copying it here:

Hi @Ashish-Vara ,

Do you think aNeighbor.SetLastHeard(TimerMilli::GetNow()) required to update during Handle parent request and response?

Yes. We should set LastHeard time in these cases. Note that MleRouter::HandleParentRequest() was setting the "last heard" on child before this PR from this if() block:
https://github.com/openthread/openthread/blob/dae3ff2c50210cf2e098caee65c1b30f94c6fb40/src/core/thread/mle_router.cpp#L1437-L1441
(now InitNeighbor is also setting the same from earlier block of code witin same method)

When we are not calling in parent request and response, we able to join the device.

This is weird. Suggest investigating this further to figure out the root cause and what is happening (collect the logs on devices to see what is happening).

L_5_3_2_issue.zip
Please check the logs. It contains few debug logs also. Kirale is leader and DUT acting as a router. We see after sometimes link quality becomes zero.

@Ashish-Vara , I reviewed the packet trace and it appears that the Leader is not establishing a link with the Router.

In pkt13, you can see that the Router has a valid link to the Leader (in/out link quality are both 3).
In pkt23, you can see that the Leader does not have a valid link to the Router (in/out link quality are both 0).

At no time does the Leader attempt to send an MLE Link Request to establish a link with the neighboring router. The Leader should be doing this when it receives an MLE Advertisement from a router that it does not have an established link with.
I believe this is an issue with the Leader reference device. I suggest raising this issue with the Thread Group directly.

Thanks @jwhui,
I will raise with thread group.

authors: Ashish-Vara abtink jwhui


text:
Doc cleanup after openthread.io launch

Stripped down README so it's not a dupe of openthread.io landing page
Moved Windows Building/Installation instructions from Wiki to its README, removed the Architecture content (which is on openthread.io)
Revised Harness Automation README to point to guide on openthread.io and remove CLI help output, which shouldn't be listed
Removed Spinel Protocol file that only had broken links, content is in /doc
Applied Doxygen copyedits discovered during openthread.io publishing

@jwhui I removed the platform and "companies supporting OT" from the README.  I assumed having all that on openthread.io is sufficient, but wasn't sure if we're required to have it here too.  I'll add them back if so.


text:
react-component-gen

PR
PR Checklist
Please check if your PR fulfills the following requirements:

[ ] The commit message follows our Commit Message Guidelines
[x] Tests for the changes have been added (for bug fixes / features)
[ ] Docs have been added / updated (for bug fixes / features)

PR Type
What kind of change does this PR introduce?

[ ] Bugfix
[x] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Build related changes
[ ] CI related changes
[ ] Documentation content changes
[ ] Other... Please describe:

What is the current behavior?

Issue Number: N/A
What is the new behavior?
将 OpenTiny 前端 Web 应用开发挑战赛中的 react-component-gen 移植到主仓库中
Does this PR introduce a breaking change?

[ ] Yes
[x] No

Other information
整体设计：https://github.com/Yuyz0112/tiny-vue/blob/8aa487e6e586bc3c70e3c64edb980f1b1800a15d/packages/react-component-gen/README.md
这个 PR 还处于非常早期的 draft 阶段，包括

功能设计是否符合 TinyVue 长远规划
技术选型、实现风格是否都需要移植
commit message 调整等

@Yuyz0112 您好，这个mr应该合入到当时我们和您商量好的分支，而不是dev主分支哈

@Yuyz0112 这个mr应该合入到 atom-2024/001-ai-react 分支，麻烦抽空重新提交下，我先关闭了哈~

authors: Yuyz0112 kagol zzcr

repo: opentiny/tiny-vue


text:
Update the Travis script to allow publishing from v.0.0.0 branches.

Thing is, we cannot publish from 0.0.0-style branches as they are
excluded, based on the current global Travis configuration, thus
we try to publish from branches following a v.0.0.0 style, if any.

Hey Pavol,
Managed to get an actual patch after going through the slightly intricate workflow for publishing. Let me know if this patch makes sense to you.

@pavolloffay Going to merge then, and will issue a release- branch. Thanks!

do not forget to change the branch :P

authors: carlosalberto pavolloffay

repo: opentracing/opentracing-java


text:
🛑 [CN] OpenUPM API /packages/extra is down

In dabee30, [CN] OpenUPM API /packages/extra (https://api.openupm.cn/packages/extra) was down:

HTTP code: 0
Response time: 0 ms

Resolved: [CN] OpenUPM API /packages/extra is back up in a874d98 after 7 minutes.

repo: openupm/upptime-openupmcn


text:
🛑 [CN] OpenUPM Registry Fetch a Tarball is down

In 92b3708, [CN] OpenUPM Registry Fetch a Tarball (https://package.openupm.cn/com.littlebigfun.addressable-importer/-/com.littlebigfun.addressable-importer-0.9.3.tgz) was down:

HTTP code: 0
Response time: 0 ms

Resolved: [CN] OpenUPM Registry Fetch a Tarball is back up in 8d919f0 after 5 minutes.


text:
🛑 [CN] OpenUPM Website Docs is down

In 0c77d38, [CN] OpenUPM Website Docs (https://openupm.cn/docs/) was down:

HTTP code: 0
Response time: 0 ms

Resolved: [CN] OpenUPM Website Docs is back up in 3ad345d.

repo: openupm/upptime


text:
🛑 [CN] OpenUPM Registry /-/all is down

In c5613b5, [CN] OpenUPM Registry /-/all (https://package.openupm.cn/-/all) was down:

HTTP code: 0
Response time: 0 ms

Resolved: [CN] OpenUPM Registry /-/all is back up in 171ff48.


text:
🛑 [CN] OpenUPM Website Packages is down

In 070a522, [CN] OpenUPM Website Packages (https://openupm.cn/packages/) was down:

HTTP code: 0
Response time: 0 ms

Resolved: [CN] OpenUPM Website Packages is back up in 33faf94.


text:
Product-based filtering in vexctl

This ticket is something between a discussion item and a bug report, let me know if there is a better place for it.
vexctl can currently filter out entries from a SARIF file, but it doesn't seem to take into account the value of the products array when doing so.
My expected behaviour would be this:
If I vexctl filter a SARIF against a VEX, and for a given vulnerability ID, a value in the locations array in the SARIF matches a value in the products array of the VEX document, the vulnerability ID should be filtered for that particular result. If there is no match between the locations array in the SARIF and the products array, then the value should continue to be reported.
There are some complexities to this, based on the non-standard way in which the locations array is constructed by different scanners, but I think at a high level the locations field is generally where the product version is found in a SARIF (perhaps exactly which field to use should be a customisable option?).
However the current behaviour is:
If the vulnerability ID is found in the SARIF results array, then the vulnerability is removed, even if the product is not specifically listed in the VEX statement for the vulnerability.
For workflows where a single golden VEX file is used to maintain VEX statements relating to multiple products, this means that adding a VEX statement for any one product automatically removes vulnerability reporting for all of the products that are covered by the VEX document + vulnerability ID combination, even if other products may not have been assessed for that vulnerability ID.
Some samples to illustrate this behaviour – I would assume that running vexctl filter sample.sarif.json vex-sample.json should return 1 result due to the product/artifactLocation mismatch, but the vulnerability is removed.
sample.sarif.json:
{
  "version": "2.1.0",
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "scan-tool",
          "version": "2",
          "informationUri": null,
          "rules": [
            {
              "id": "CVE-2023-29405",
              "shortDescription": {
                "text": "CVE-2023-29405 in go (critical)"
              },
              "fullDescription": {
                "text": "Critical severity CVE-2023-29405 found in go version 1.20.4"
              },
              "help": {
                "text": "",
                "markdown": "| CVE | Severity | CVSS | Package | Version | Fix Status | Published | Discovered |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| [CVE-2023-29405]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29405) | critical | 9.8 | go | 1.20.4 | fixed in 1.20.5, 1.19.10 | 2023-06-08T21:15:00Z | 2023-08-15T16:01:30Z |"
              }
            }
          ]
        }
      },
      "results": [
          {
          "ruleId": "CVE-2023-29405",
          "level": "warning",
          "message": {
            "text": "Description"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "my-product:v1.0.0"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        }
      ]
    }
  ]
}

vex-sample.json:
{
  "@context": "https://openvex.dev/ns",
  "@id": "test",
  "author": "Feroz Salam",
  "role": "vendor",
  "timestamp": "2023-07-04T17:51:12.004221+01:00",
  "version": "1",
  "statements": [
    {
      "vulnerability": "CVE-2023-29405",
      "products": [
        "random"
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path"
    }
  ]
}

I agree @ferozsalam . The main problem is that there is no consistency in the data in the SARIF output of the scanners. I was just looking into the output and it varies wildly, The scanned image is in different places in each tool. For example:
Grype has these logicalLocations:
              "logicalLocations": [
                {
                  "name": "/usr/share/doc/libtiff6/copyright",
                  "fullyQualifiedName": "nginx@sha256:13d22ec63300e16014d4a42aed735207a8b33c223cff19627dd3042e5a10a3a0@sha256:4713cb24eeff341d0c36343149beba247572a5ff65c2be5b5d9baafb345c7393:/usr/share/doc/libtiff6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libtiff6:amd64.md5sums",
                  "fullyQualifiedName": "nginx@sha256:13d22ec63300e16014d4a42aed735207a8b33c223cff19627dd3042e5a10a3a0@sha256:4713cb24eeff341d0c36343149beba247572a5ff65c2be5b5d9baafb345c7393:/var/lib/dpkg/info/libtiff6:amd64.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "nginx@sha256:13d22ec63300e16014d4a42aed735207a8b33c223cff19627dd3042e5a10a3a0@sha256:4713cb24eeff341d0c36343149beba247572a5ff65c2be5b5d9baafb345c7393:/var/lib/dpkg/status"
                }

In Trivy, there is a properties section at the end:
      "properties": {
        "imageName": "nginx@sha256:13d22ec63300e16014d4a42aed735207a8b33c223cff19627dd3042e5a10a3a0",
        "repoDigests": [
          "nginx@sha256:13d22ec63300e16014d4a42aed735207a8b33c223cff19627dd3042e5a10a3a0"
        ],
        "repoTags": []
      }

Which flavor of SARIF are you using? Can you post a SARIF sample here? We may be able to support them with custom code for each tool.

Hey @puerco is this something that would be best as a user-configurable option?
On the SARIF question, in my example above I'm using the Prisma Cloud GitHub action, you can see how it inserts image version into the SARIF here. I've provided a sample SARIF in the issue description above, do you need more than that?

authors: ferozsalam puerco

repo: openvex/vexctl


text:
Graph incorrect alignment

TODO
Fix the graph alignment

Duplicate of #97

repo: openvitae-tech/blackboard-lms


text:
replace _design/subjects with _design/$DB_WHISK_AUTHS

On this line subjects is harcoded https://github.com/openwhisk/openwhisk/blob/master/tools/db/createImmortalDBs.sh#L85
# recreate the "full" index on the "auth" database
$CURL_ADMIN -X POST -H 'Content-Type: application/json' \
        -d '{
            "_id":"_design/subjects",
            "views": { "uuids": { "map": "function (doc) {\n  emit([doc.uuid], {secret: doc.key});\n}" } },
            "language":"javascript",
            "indexes": {}
         }' \
    $URL_BASE/$DB_WHISK_AUTHS;

It should be _design/$DB_WHISK_AUTHS

replaced by ansible playbook.

authors: csantanapr rabbah

repo: openwhisk/openwhisk


text:
add tool to delete activations older than the given days

Signed-off-by: Christian Bickel cbickel@de.ibm.com

PG4: #24

rebased with master branch && modified conflict files, local tests worked, starting PG3/513

LGTM

Thanks @cbickel for re-triggering the build, green build approved in PG2/1454

PG2#1554 is not the Playground with the final version. That one is not green yet.

PG2#1459 is green.

rebased and merged in 5ccb1dae1f7d315f53f1de4023d19b1455a89d5e

authors: cbickel jeremiaswerner xin-cai


text:
No VLAN for TP-Link TL-WR802N (may be issue in luci and/or core)

Is there an existing issue for this?

[X] I have searched the existing issues

screenshots or captures

Actual behaviour
Like suggested in this original issue, I'm creating also this issue here in the luci repository.
The TP-Link TL-WR802N seems to be supported, like listed here: https://openwrt.org/toh/tp-link/tl-wr802n_v4
But seems we can't make a VLAN setup. There is no check box to enable VLAN functionality and there are also wrong amount of ports, etc... see screenshots.
I would like to have different SSIDs, mapped to different VLANs.
Expected behaviour
Expecting the Switch menu to have the VLAN functionality checkbox, so I can setup my SSIDs mapped with different VLANs
Steps to reproduce
use a TP-Link TL-WR802N
go to the Switch menu, like in the screenshots
Additional Information
NAME="OpenWrt"
VERSION="23.05.4"
ID="openwrt"
ID_LIKE="lede openwrt"
PRETTY_NAME="OpenWrt 23.05.4"
VERSION_ID="23.05.4"
HOME_URL="https://openwrt.org/"
BUG_URL="https://bugs.openwrt.org/"
SUPPORT_URL="https://forum.openwrt.org/"
BUILD_ID="r24012-d8dd03c46f"
OPENWRT_BOARD="ramips/mt76x8"
OPENWRT_ARCH="mipsel_24kc"
OPENWRT_TAINTS=""
OPENWRT_DEVICE_MANUFACTURER="OpenWrt"
OPENWRT_DEVICE_MANUFACTURER_URL="https://openwrt.org/"
OPENWRT_DEVICE_PRODUCT="Generic"
OPENWRT_DEVICE_REVISION="v0"
OPENWRT_RELEASE="OpenWrt 23.05.4 r24012-d8dd03c46f"

What browsers do you see the problem on?
Firefox, Chrome, Safari, Microsoft Edge
Relevant log output
No response

AFAIK it's a unknown issue. luci assumes VLAN index equals VLAN ID. In some old hardware there are limited indices, and in your case, 0~15. So you have to assign a different VLAN ID to a VLAN index using an option vid.
https://openwrt.org/docs/guide-user/network/vlan/switch#vlanswitch_config

But why is there no VLAN checkbox in the UI?
And why is there that warning message with unknown topology?

BusyBox v1.36.1 (2024-07-15 22:14:18 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 23.05.4, r24012-d8dd03c46f
 -----------------------------------------------------
root@WLAN-Access-Point-OpenWrt:~# swconfig list
Found: switch0 - rt305x

It looks like the switch device name does not match the config in /etc/config/network. The config should be switch0 instead of eth0.
config switch
	option name 'switch0'
	option enable_vlan '1'

just renamed it and then /etc/init.d/network restart and now the device is not reachable anymore

It worked - but you didn't configure any VLANs so it drops all packets..

the port should be configured as untagged... so with vlan enabled, it should work, right?
Or can you share a network config file that you think should work?
I like the port not to be tagged by default, but only the packets should be tagged, based on the ssid...

You may create a default VLAN 1 for further configuration.
config switch
	option name 'switch0'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 3 4 6'

Wait a minute.. WR802N has a single ethernet port, right? Then you don't even need switch VLANs. Just create an interface and set the device to eth0.yourVlanID

Yes, there is only 1 eth port.
But it shows 7 in the UI.
Can you share the complete config, please?

config device
	option name 'br-guests'
	option type 'bridge'
	list ports 'yourVlanID'

config interface 'guests'
	option device 'br-guests'
	option proto 'static'
	option ipaddr 'yourIp'
	option netmask 'yourNetmask'

Seems to work... thank you 🙏
Now just the little issue regarding the switch menu with the 7 ports instead of 1.
Can this also be "fixed" via config?

The switch menu is useless now. You may consider removing it.
opkg remove swconfig

perfect, thank you

repo: openwrt/luci


text:
[RFC, WIP] luci-theme-bootstrap4: add new theme

As discussed in #3644. I'm making a new Bootstrap 4 theme.
This theme contains two parts, one is in luci, another is in my fork of bootstrap.
The part in luci is based on current bootstrap theme. In order to show changes in git diff, I modify original code directly, and I will make a copy after it's done.
The part in my fork of bootstrap is based on bootstrap v4.4.1, you can see changes here.
I'm not familiar with Web front-end development. In order to simplify the work, I mainly use Sass' @extend to make it works with luci. However this will increase the size of final css. If you have any idea please tell me.
Currently it looks like this:

Ping @jow- and @aparcar

Hi, thank you very much for looking into this! I think even the early stage looks already pretty good!
From my understanding Bootstrap changed the names of various classes which you map with the scss files, right? Wouldn't a treewide replace of such classes also do the trick?
I think part of the legacy nature of the current cascade.css its differ so much from upstream....

Wouldn't a treewide replace of such classes also do the trick?

Not really, it would just push the burden of matching the markup to other themes. Keep in mind that there is not only bootstrap based themes.

Wouldn't a treewide replace of such classes also do the trick?
No, for example, cbi-tabmenu class maps to navs with tab nav nav-tabs in bootstrap.

Not really, it would just push the burden of matching the markup to other themes. Keep in mind that there is not only bootstrap based themes.

Right, but if we also change their CSS files? I understand this is a bit of a mess once done future migration should be much simpler. I'd even claim that much more themes appear because boostrap CSS is so much more common.

No, for example, cbi-tabmenu class maps to navs with tab nav nav-tabs in bootstrap.

If you provide a map of such replacements I'll do the boring work of replace it within the code :)

@aparcar I think you are talking about replace in bootstrap source.

@aparcar I think you are talking about replace in bootstrap source.

No, replacing the LuCI bootstrap theme CSS and the other 3s. Keep the boostrap.min.css untouched.

I don't want to peg LuCI markup to bootstrap though, it should remain agnostic. Besides bootstrap lacks a lot of component markup which we need so custom CSS is required anyway.

No, replacing the LuCI bootstrap theme CSS and the other 3s. Keep the boostrap.min.css untouched.

But other theme may use a different class name, this will result in modifying

But other theme may use a different class name, this will result in modifying

Yes, so edit these other themes but not the original bootstrap file.

Besides bootstrap lacks a lot of component markup which we need so custom CSS is required anyway.

Can you please elaborate a bit on this. What compontents are missing in bootstrap?

Yes, so edit these other themes but not the original bootstrap file.

It's unfair to maintainers of other theme.

Can you please elaborate a bit on this. What compontents are missing in bootstrap?

Comboboxes
Rich dropdowns
Combo buttons
Rich tooltips

Another problem is bootstrap's reliance on JavaScript to implement more complex controls.

One further thought about unmodified bootstrap: it contains extreme amounts of whitespace, we would need to modify that as well.

It's unfair to maintainers of other theme.

I think this is an misunderstanding, I would replace things like cbi-button treewide to btn so no extra workload appear for the maintainers. As the class would be changed in their CSS files too, it'd still work.

Another problem is bootstrap's reliance on JavaScript to implement more complex controls.

Thanks for the quick response. I wonder if these elements are trivial to implement in JavaScript and could be an additional layer of CSS/JS on top of Bootstrap. Also if using Bootstrap JavaScript code would safe LuCis JS at other points.
Please don't misunderstand my comments as Bootstrap fandom, I barely used it before. I'm just fan of lowering the obstacles for new people to join in. Maybe it's a dead end.
After all Bootstrap seems to break compatibility between versions anyway 3 & 4

One further thought about unmodified bootstrap: it contains extreme amounts of whitespace, we would need to modify that as well.

The bootstrap.min.css file is minimized

I would replace things like cbi-button treewide to btn so no extra workload appear for the maintainers.

But maybe there are some complex components.

Also if using Bootstrap JavaScript code would safe LuCis JS at other points.

From a quick glance, there is little overlap.

The bootstrap.min.css file is minimized

I am talking about visual space as in margins and paddings, not white space in the CSS file.

@jow- We need a luci app which contains all luci components. It can be used for theme development and testing, and demonstrate what components are available and how to use them.

It's difficult for me to make the "Save & Apply" behave normal, maybe I have to change it's structure to make it work.
Current screenshot:

Moved #tabmenu to top and use a new style:

Added border shadow to .cbi-section:

Finished #topmenu and cbi section.

@jow- Can we use standard table tags instead of div with .table class? Because doing this I don't need to write css for table classes.

One further thought about unmodified bootstrap: it contains extreme amounts of whitespace, we would need to modify that as well.

Just to chime in on this. I just updated 17.x → 20.x and find the denser UI harder to parse and navigate. The more generous amounts of white space in previous releases helped to easily discern visual elements and aided intelligibility and navigation.

17.x on the left, 20.x on the right.  While the individual differences seem negligible, they do add up. Thus white space can be considered an accessibility feature, especially for users that do not know every nook and cranny of the UI.

@messismore This should be possible later on. I think for now it is mostly about making the current JavaScript framework work together with Bootstrap 4.
@ysc3839 Can you please share your modified bootstrap.css and add it to the current PR?

@jow- Can we use standard table tags instead of div with .table class?

That is not doable and would require tree-wide changes to a lot of components. For now just add the following lines to your CSS:
.table { display: table; }
.tr { display: table-row; }
.th, .td { display: table-cell; }

@aparcar Updated.

Close this pr since it requires a lot of work, and I have no time doing this.
I'm looking for a CSS utility framework to build our own theme, instead of out-of-box CSS framework like bootstrap.
Recently I found Tailwind CSS which may suit for making a theme.

authors: aparcar jow- messismore ysc3839