Patrick Schratz

forgejo-codefloe Forgejo-mirror with tweaks for CodeFloe

#CodeFloe, a public #Forgejo-based #Github alternative, now has support for file icon sets (with 'devicon' being the default set).

The icon set can be switched on a per-user basis.

Showcase: codefloe.com/codefloe/for...

Meanwhile got some advice which includes

go version -m

and

govulncheck -mode=binary -show verbose <binary>

that perfectly verify and do what I was searching for.

Confirmed the findings of Trivy & MS Defender

Are trivy and MS Defender known for false-positives in such cases?

I am in a weird spot where multiple scanners flag (multiple) binaries, the company says "nothing there, error on your (scanner) side" and I need to report to the sec team with 2:1 scanners in favor of the vuln being present.

They are not willing to share their go.mod file to verify they are not using package version XY in them.

I am somewhat skeptical about this argument. What are my best chances to find a verifiable proof to this (other than attempting to exploit the vuln?)

#cve #security

I need advice in how to act in the following case:

A medium-big software vendor using #golang claims that the reported CVEs by #trivy and MS defender on their statically linked binaries are false-positives.
Only #snyk would give a "correct" result.

PSI: I stepped down as a #gitea helm chart maintainer: gitea.com/gitea/helm-g...

On top, there is no #arm64 image variant in 2025, and the related discussions around that (6+ years) have quite some popcorn potential.
Especially with the fact that the project is built with #golang and building multi-arch images there is super easy.

Deployed #harbor container registry lately.
While it has a lot of features and it is great to have a self-hostable alternative to the big SaaS options, the lack of love for details, especially in the UI, is somewhat insane.

Fellow coders, friends, #foss enthusiasts:

Are you in search of a #github alternative? Do you like #forgejo?

Then say hello to CodeFloe 👋️

👉️ codefloe.com
👉️ Docs: docs.codefloe.com

Read more about the motivation to create #codefloe here: pat-s.me/codefloe-lau...

Testers wanted: rpkgs.com now supports OS & arch agnostic repo definitions for #rstats package binaries:

rpkgs.com

options(repos = "cran.rpkgs.com")

(Also, support for Alpine 3.22 finally landed!)

Highlights ✨️:

- Non-admin users can now see all instance agents in a fully redesigned agent list view
- Docs now contain a feature comparison list to #woodpeckerci (www.crowci.dev/3.7/index.ht...)
- Scrolling to selected pipelines steps now works for shared links
- Support for dynamic page titles

Crow CI Crow CI is a Continuous Integration & Continuous Delivery (CI/CD) application. It is designed to be lightweight, simple to use and fast.

Version 3.7.0 of #crowci is released!

> Crow CI is a Continuous Integration & Continuous Delivery (CI/CD)1 application. It is designed to be lightweight, simple to use and fast.

crowci.dev

#foss #cicd #codeberg

Sure, everyone is welcome

#rstats and everyone interested in the R package binary project I recently talked about:

Let's have a community call where I'll provide project information and we can discuss the path forward and how to best incorporate community participation.

RSVP: app.rallly.co/invite/sl7uC...

Also to avoid confusion and point out some organizational differences, it might be better to have a distinct TLD.

Sometimes it is time for change. Maybe we arrived at such a moment ;)

The suffix is fixed anyhow by install.packages(), it is only about the TLD.

r-project.org is not in scope for the TLD as CRAN is not interested in the project (and probably sees it as competition?). I asked them some time ago to possibly collaborate, specifically for the Alpine binaries.

Great news: docs.r-package-binaries.devxy.io/index.html got funded by the R Consortium!

I want to make the binaries available under a new domain. Any suggestions, #rstats?
What would be your dream URL to download R pkg binaries from?

If you're interested in contributing, reach out!

Where DevOps and Data Science meet 🤝️ A guide to compiling HAProxy with WolfSSL for enhanced performance and HTTP/3 support, including detailed build instructions.

In case you're interested in running a bleeding edge #reverseproxy with an optimized #SSL library: read our blog post on "Compiling HAProxy with WolfSSL":

www.devxy.io/blog/haproxy...

#haproxy #wolfssl #openssl

pat-s (@pat_dev@social.linux.pizza) 3 Posts, 7 Following, 0 Followers · devops, sysadmin, golang, R. WoodpeckerCI dev Codeberg core Crow CI CodeFloe founder

Eventually also arrived in the #fediverse: social.linux.pizza/@pat_dev

#mastodon

Only public repos, no profit-related projects.

Due to some other (related) philosophies, such as not using any cloud service and self-hosting hardware, uptime and service availability has not always been great in the past.

And in general, it's always good having multiple alternatives ;)

Why #rstats? It should concern any language.

I personally have some projects on Codeberg.

I am also currently working on a public Forgejo-based platform, which will also be open for companies (as CBs ToS are very strict). Beta will be available soon.

Zen Browser Zen Browser is built for speed, security, and true privacy. Download now to enjoy a beautifully-designed, distraction-free web experience packed with features.

A few recently switched to Zen, which is also FF based.

zen-browser.app

If you ever struggled with versioning in #mkdocs when not using GitHub, this new blog post of mine might help: pat-s.me/mkdocs-mike/

Crow CI None

v3.4.0 of Crow CI, a self-hostable #CICD engine written in #golang, has been released yesterday.

codeberg.org/crowci/crow/...

www.crowci.dev

(Yes, the social preview card can be improved 😉️)

That being said: if one has a catchy name for a new #Git provider (like GH, GL) that is new yet reserved (and doesn't have 'git' in it), feel free to drop it here 😄

(when I'll use it, I'll surely buy you a ☕ - or two, or three...)

Trying for weeks to find a name for a new project incl. a com domain.

Almost impossible these days, many domains are parked without being used. Likely in the hope to be sold to some that start with a large budget 🫠

ICANN should enforce the use within time X or drop the ownership again, IMO.

Just submitted a proposal for the next RConsortium grant cycle: pat-s.github.io/ics-proposal...

Would be super cool to see/get "official" support for this project which aims to provide a full suite of #rstats package binaries for Linux in a transparent and open way!

www.devxy.io/blog/cran-r-...

renovate + trivy on top.

@mikemahoney218.com Maybe of interest for you given your recent LinkedIn post.

Yeah I see. Was wondering about this under middle/high load when reads might lag a bit behind and users try to reload a page where they just wrote something before.

OTOH I really want to keep async replication for performance. Let's see how it turns out in practice 😄