# voxpupuli
- a
Alex Fisher
02/14/2023, 5:13 PMor maybe it will... I've just finished cherry-picking the first commit, but maybe it all gets better again with the second! - v
VoxBot
02/14/2023, 5:14 PMsecond is aimed at making that part better - a
Alex Fisher
02/14/2023, 5:14 PMlet me see if I can finish it off and see what it then looks like - a
Alex Fisher
02/14/2023, 5:26 PMDone. Maybe... - a
Alex Fisher
02/14/2023, 5:30 PM@Craig Gumbley Could you kick the build on https://github.com/puppetlabs/puppet-lint/pull/79 off for me please? - b
bastelfreak
02/14/2023, 5:30 PM@Alex Fisher done - c
Craig Gumbley
02/14/2023, 5:31 PMnice! - a
Alex Fisher
02/14/2023, 5:31 PMThanks. - a
Alex Fisher
02/14/2023, 5:32 PMBoo! It failed. (but why is it passing for me locally...) - a
Alex Fisher
02/14/2023, 5:43 PM@bastelfreak Do you really need to approve the workflow each time I make a change?? - a
Alex Fisher
02/14/2023, 5:44 PMI thought it was just a one off thing to stop bad guys using builds to mine bitcoins. - b
bastelfreak
02/14/2023, 5:44 PMuntil one if your changes are merged, yes :( - b
bastelfreak
02/14/2023, 5:44 PMthere are differnt config options available. Puppet uses the strict one - a
Alex Fisher
02/14/2023, 5:47 PM - a
Alex Fisher
02/14/2023, 5:47 PMwell that's annoying... - a
Alex Fisher
02/14/2023, 5:51 PMah... the first 2 bytes of a Marshal'ed object contain the ruby version... - a
Alex Fisher
02/14/2023, 5:52 PMmaybe I should use something else instead. - v
VoxBot
02/14/2023, 5:53 PMperhaps serialize it to JSON and hash that? - a
Alex Fisher
02/14/2023, 5:55 PMyeah, I was trying that out now. - a
Alex Fisher
02/14/2023, 5:55 PMIs there anything that can't be serialised to json? - p
Pat Riehecky
02/14/2023, 5:56 PMaccording to my puppet runs, yes...Unable to serialize catalog to json, retrying with pson - a
Alex Fisher
02/14/2023, 5:58 PMsome plugins include puppet-lint token objects in message. So I thought I was 'safer' using Marshal. - a
Alex Fisher
02/14/2023, 6:03 PMbut maybe that's not it. Maybe there's something else in message that is actually different when I run it on github compared to locally. - v
VoxBot
02/14/2023, 6:04 PMmarshall could very well be Ruby version dependent - a
Alex Fisher
02/14/2023, 6:06 PM@bastelfreak Sorry, could you kick my build again - v
VoxBot
02/14/2023, 6:10 PMthere is a setting on GH actions where you can choose to allow people who have non-recent accounts as well, even if they haven't contributed before - v
VoxBot
02/14/2023, 6:11 PMgo to settings → Actions → General → "Fork pull request workflows from outside collaborators" → first option - v
VoxBot
02/14/2023, 6:31 PMewoud: this is intentional said binford2k - v
VoxBot
02/14/2023, 6:33 PMyes. It's more than just bitcoin mining. A gh action can do other nefarious things like exfiltrate secrets... such as the token used to publish to the forge - v
VoxBot
02/14/2023, 6:35 PMno it can't