Webapp:Retrieve webapp publishing profile as XML

Describe the bug
Cannot retrieve webapp publishing profile as XML.
To Reproduce
Running the following
az webapp deployment list-publishing-profiles `
  --name <webapp-name> `
  --resource-group <webapp-resource-group>

generates a JSON file, not XML.
Expected behavior
To be able to generate XML file, similar to what's generated in the portal when the Get publish profile button it used.
Environment summary
Cloud shell
{
  "azure-cli": "2.5.1",
  "azure-cli-command-modules-nspkg": "2.0.3",
  "azure-cli-core": "2.5.1",
  "azure-cli-nspkg": "3.0.4",
  "azure-cli-telemetry": "1.0.4",
  "extensions": {}
}

webapp

@SeanFeldman any specific reason for xml response request - CLI returns the object that the API returns which is json here. Thanks!

@SeanFeldman any specific reason for xml response request - CLI returns the object that the API returns which is json here. Thanks!

Indeed. When a publishing profile file downloaded from the portal, it's an XML file, not JSON. This file is used to perform the ZIP deployment of a webjob/webapp. Specifically, I use GitHub action<EMAIL_ADDRESS>for that purpose. The publish profile is expected to be an XML file.

Also, Visual Studio based deployment relies on the this file to be an XML file.

Additionally, the official Azure App Service github actions expects the publishing profile for deploying and if you are creating the app service webapp as part of the Github Workflow its close to impossible to automate the deployment, because the az cli is not able to produce the expected xml file.
https://github.com/marketplace/actions/azure-webapp#dependencies-on-other-github-actions

@panchagnula any updates on this?

@SeanFeldman  we will take a look at this - no ETA yet to share.

we will take a look at this - no ETA yet to share.

I was hoping this would be already in a validation state as it was reported a week ago...

Looking at our code CLI seems to be explicitly converting this to JSON - API returns XML since this will be a breaking change we need to handle this correctly - we might need to add a property to allow XML, so give me sometime to run this by cli folks to handle breaking changes

Too bad --output doesn't support XML. It would solve the problem.

BTW, it feels like the proper response should be XML. And if --output would be json only then the conversion would take place.

@panchagnula, any updates?

@SeanFeldman sorry no updates yet - I will keep this updated though  - the milestone flag should be a good indicator of our tentative ETA for now. Thanks!

@yonzhan i want to understand some details here before making change to support this.
The current command returns XML to JSON since i believe CLI doesn't support XML as output - is my assumption correct is there a suggestion on how to support the request here? Thanks!

Hi @panchagnula, CLI is never designed or tested with XML. Even for storage data-plane API, the XML response body is converted to JSON.
I can think of 2 solutions:

Make Knack compatible with XML, but this will of course take some development efforts.
Wrap the response in JSON when --xml parameter is specified, so that we don't introduce breaking change. For example:{
    "value": "XML Content Here"
}

+ PM @achandmsft @chenlomis

Checked the source code of az webapp deployment list-publishing-profiles, the response body from the underlying SDK is already  XML. It is actually appservice command module that is doing the XML -> Python object conversion.
https://github.com/Azure/azure-cli/blob/3cd3b456dc5f18bca38700431cf3b8ca477d820d/src/azure-cli/azure/cli/command_modules/appservice/custom.py#L1874
To return the raw XML, method list_publish_profiles can simply return full_xml and tell the user to append --output tsv:
> az webapp deployment list-publishing-profiles --ids /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/test/providers/Microsoft.Web/sites/test --output tsv
<publishData><publishProfile profileName="..." ...>...</publishProfile>...</publishData>

Checked the source code of az webapp deployment list-publishing-profiles, the response body from the underlying SDK is already XML. It is actually appservice command module that is doing the XML -> Python object conversion.
https://github.com/Azure/azure-cli/blob/3cd3b456dc5f18bca38700431cf3b8ca477d820d/src/azure-cli/azure/cli/command_modules/appservice/custom.py#L1874
To return the raw XML, method list_publish_profiles can simply return full_xml and tell the user to append --output tsv:
> az webapp deployment list-publishing-profiles --ids /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/test/providers/Microsoft.Web/sites/test --output tsv
<publishData><publishProfile profileName="..." ...>...</publishProfile>...</publishData>

@jiasli that is correct - this command was infact authored by the core-cli team this way a long time back & assume it was done this way was because the command if run without the xml to JSON conversion minus the  --output tsv would lead to errors - hence my question here is is there a way to make the output tsv the default output type for just this command instead of asking the customers to add that at the end of the command. Thanks!

Is there a way to make the output tsv the default output type for just this command instead of asking the customers to add that at the end of the command.

Fortunately, yes! But it is a little bit hacky. I have drafted a PR in my own repo https://github.com/jiasli/azure-cli/pull/8 and you may follow the same pattern to submit an official PR and fix related test cases.
Perhaps we can avoid introducing breaking change by specifying --xml. 😉

Perhaps we can avoid introducing breaking change by specifying --xml.

That'd be ideal.

@panchagnula looking at the documentation, it doesn't reflect the added --xml option.
Is there a documentation PR or how to know that the fix has been deployed? I've looked at the S173 milestone but it's still opened. Thank you.

I'm using azure CLI v2.11.1. I added the --xml option. However, it returns escaped string. Do we need to handle those escaped characters by ourselves?

It's "slightly" confusing.
You have to combine --xml with --output tsv to get a useable format.

That's far better than what I do:
az functionapp deployment list-publishing-profiles -g <resource_group> -n <functionapp_name> --xml | sed -e 's|\"<|<|g' | sed -e 's|>\"|>|g' | sed -e 's|\\"|"|g' | sed -e 's|\\\\|\\|g'

It's "slightly" confusing.
You have to combine --xml with --output tsv to get a useable format (at least that's what we do ....)

@Kotasudhakarreddy is this true? I thought your change took care of the hack to not needing the --output tsv. Can you take a look or update the help document as well accordingly? Thanks!

@panchagnula This is what I ran:
az webapp deployment list-publishing-profiles -g <resource_group_name> -n <webapp_name> --xml

This is what I get:
"<publishData><publishProfile profileName=\"<webapp_name> - Web Deploy\" publishMethod=\"MSDeploy\" publishUrl=\"<webapp_name>.scm.azurewebsites.net:443\" msdeploySite=\"<webapp_name>\" userName=\"$<webapp_name>\" userPWD=\"<password>\" destinationAppUrl=\"https://<webapp_name>.azurewebsites.net\" SQLServerDBConnectionString=\"\" mySQLDBConnectionString=\"\" hostingProviderForumLink=\"\" controlPanelLink=\"http://windows.azure.com\" webSystem=\"WebSites\"><databases /></publishProfile><publishProfile profileName=\"<webapp_name> - FTP\" publishMethod=\"FTP\" publishUrl=\"ftp://waws-prod-se1-001.ftp.azurewebsites.windows.net/site/wwwroot\" ftpPassiveMode=\"True\" userName=\"<webapp_name>\\$<webapp_name>\" userPWD=\"<password>\" destinationAppUrl=\"https://<webapp_name>.azurewebsites.net\" SQLServerDBConnectionString=\"\" mySQLDBConnectionString=\"\" hostingProviderForumLink=\"\" controlPanelLink=\"http://windows.azure.com\" webSystem=\"WebSites\"><databases /></publishProfile><publishProfile profileName=\"<webapp_name> - ReadOnly - FTP\" publishMethod=\"FTP\" publishUrl=\"ftp://waws-prod-se1-001dr.ftp.azurewebsites.windows.net/site/wwwroot\" ftpPassiveMode=\"True\" userName=\"<webapp_name>\\$<webapp_name>\" userPWD=\"<password>\" destinationAppUrl=\"https://<webapp_name>.azurewebsites.net\" SQLServerDBConnectionString=\"\" mySQLDBConnectionString=\"\" hostingProviderForumLink=\"\" controlPanelLink=\"http://windows.azure.com\" webSystem=\"WebSites\"><databases /></publishProfile></publishData>"

As you can see, I've got all double quotes escaped, and leading and trailing double quotes. I suspect that the original XML string is JSON serialised with that ---xml option.

@panchagnula This is what I ran:
az webapp deployment list-publishing-profiles -g <resource_group_name> -n <webapp_name> --xml

This is what I get:
"<publishData><publishProfile profileName=\"<webapp_name> - Web Deploy\" publishMethod=\"MSDeploy\" publishUrl=\"<webapp_name>.scm.azurewebsites.net:443\" msdeploySite=\"<webapp_name>\" userName=\"$<webapp_name>\" userPWD=\"<password>\" destinationAppUrl=\"https://<webapp_name>.azurewebsites.net\" SQLServerDBConnectionString=\"\" mySQLDBConnectionString=\"\" hostingProviderForumLink=\"\" controlPanelLink=\"http://windows.azure.com\" webSystem=\"WebSites\"><databases /></publishProfile><publishProfile profileName=\"<webapp_name> - FTP\" publishMethod=\"FTP\" publishUrl=\"ftp://waws-prod-se1-001.ftp.azurewebsites.windows.net/site/wwwroot\" ftpPassiveMode=\"True\" userName=\"<webapp_name>\\$<webapp_name>\" userPWD=\"<password>\" destinationAppUrl=\"https://<webapp_name>.azurewebsites.net\" SQLServerDBConnectionString=\"\" mySQLDBConnectionString=\"\" hostingProviderForumLink=\"\" controlPanelLink=\"http://windows.azure.com\" webSystem=\"WebSites\"><databases /></publishProfile><publishProfile profileName=\"<webapp_name> - ReadOnly - FTP\" publishMethod=\"FTP\" publishUrl=\"ftp://waws-prod-se1-001dr.ftp.azurewebsites.windows.net/site/wwwroot\" ftpPassiveMode=\"True\" userName=\"<webapp_name>\\$<webapp_name>\" userPWD=\"<password>\" destinationAppUrl=\"https://<webapp_name>.azurewebsites.net\" SQLServerDBConnectionString=\"\" mySQLDBConnectionString=\"\" hostingProviderForumLink=\"\" controlPanelLink=\"http://windows.azure.com\" webSystem=\"WebSites\"><databases /></publishProfile></publishData>"

As you can see, I've got all double quotes escaped, and leading and trailing double quotes. I suspect that the original XML string is JSON serialised with that ---xml option.

Thanks @justinyoo to confirm if you run the same command with --output tsv at the end the return object is formatted as true XML?

@panchagnula If I put the --output tsv at the end, then the escaping goes away.

Additionally, the official Azure App Service github actions expects the publishing profile for deploying and if you are creating the app service webapp as part of the Github Workflow its close to impossible to automate the deployment, because the az cli is not able to produce the expected xml file.
https://github.com/marketplace/actions/azure-webapp#dependencies-on-other-github-actions

I ended up using the Service Principal approach instead of the recommended publish profile approach to avoid these issues.

I ended up using the Service Principal approach instead of the recommended publish profile approach to avoid these issues.

@jonas-lomholdt You might want to take a look at this GitHub Action: https://github.com/marketplace/actions/azure-app-service-publish-profile

@justinyoo If you are using a SP to az login to get the publish profile. What are the benefits of using the publish profile over just the SP? I mean, If I already have the SP with access to the profiles, what benefits will it give? Couldn't find much about that in the documentation.

For those ending up here looking for action srijken/azure-zip-deploy, it no longer appears to exist. It should be quite easily replaceable with azure/webapps-deploy as detailed here: https://github.com/Azure/webapps-deploy/issues/3

This worked for me:
az webapp deployment list-publishing-profiles --name $apiAppName --resource-group $resourceGroup --xml --output tsv
Added: --xml and --output tsv


Won't blur image

Hello, I have the following issue.
When I try to set an image as lockscreen background, it sets it and everything works, except for the blur effect, or dim. It doesn't blur/dim the image at all. If I provide an already blurred/dimmed image, it "unblures" it. I use the following line to set image x:
betterlockscreen -u ~/Pictures/wallhaven-618958.jpg -r 1920x1080 -b 0.5
I tried different factors of blur, but it doesn't change at all. Any suggestions?
Martin

betterlockscreen --lock
I tried with betterlockscreen -l, but it's the same.

Ah, as it says in the documentation:
Lock screen
betterlockscreen -l | --lock [modifier]
Modifiers:
dim
blur
dimblur
If you just use -l like you did there is obviously no blur used.
If you want a blurred image you should use the modifier "blur" or "dimblur" like this:
betterlockscreen -l blur
or
betterlockscreen -l dimblur

Ah, yeah! Sorry for that... thanks again!

sure, no problem

Dear All If i lock my screen with betterlock. The lock screen is transparent. Kindly check attached

I think the help text should be updated, it says you need to use double hyphens:
Effects arguments:

  --dim <N>
      Dim image N percent (0-100)

  --blur <N>
      Blur image N amount (0.0-1.0)

  --pixel <N,N>
      Pixelate image with N shrink and N grow (unsupported)

  --color <HEX>
      Solid color background with HEX

But it doesn't work if you use them that way, you have to use just blur on its own ..

Yeah, we/@jeffmhubbard had similar experience with that arguments - I'm also unsure how to use them properly, If I have some time left-over I would look deeper into this. If someone would like to/have time I would encourage to join us :)

@ckp95
You have the syntax wrong. betterlockscreen -u image.jpg --fx blur --blur 0.9

@jeffmhubbard Thanks for pointing out!
@ckp95 Does this fix it for you? Then I would close the issue for you :)

Still no response on this - so I'm going to close this issue - please open a new one if you still/in future experience any issue as the code has change almost completely :)


Better info logging in restore

Restore does not log INFO messages after starting.  Need a stop message at the least.

Fixed in 1ac4b781fd304fcc6aa663afc324cdb2d1fdcb06.


feat: integration of AWS IAM Roles for ServiceAccounts (IRSA)

Summary of Changes:

BUG: Add functionality to use an existing service account - Same as https://github.com/godaddy/kubernetes-external-secrets/issues/170 &  https://github.com/godaddy/kubernetes-external-secrets/pull/169
TESTED with:

helm --tiller-namespace ops --namespace ops upgrade um-kubernetes-external-secret --set serviceAccount.name=um-farshad-test --set env.AWS_REGION=us-east-1 --set serviceAccount.create=false  --debug -i ./charts/kubernetes-external-secrets

BEFORE change incorrect serviceAccountName in rendered yaml:
...
# Source: kubernetes-external-secrets/templates/deployment.yaml
...
    spec:
      serviceAccountName: um-kubernetes-external-secret-kubernetes-external-secrets

AFTER change correct serviceAccountName in rendered yaml:
...
# Source: kubernetes-external-secrets/templates/deployment.yaml
...
    spec:
      serviceAccountName: um-farshad-test

Also TESTED with (for regression purposes):
helm --tiller-namespace ops --namespace ops upgrade um-kubernetes-external-secret  --set env.AWS_REGION=us-east-1  --debug -i ./charts/kubernetes-external-secrets

BUG: Latest 1.5.0 version requires GET on namespace which the current chart was not providing.

FEATURE: Optionally Parameterize securityContext(needed for IRSA support see reference issue) and saAnnotations(needed for IRSA) and imagePullSecrets(needed if someone wants to build their own image and deploy from a private repo)
TESTED with:

    helm --tiller-namespace ops --namespace ops upgrade um-kubernetes-external-secret --set env.AWS_REGION=us-east-1 --set securityContext.fsGroup=65534  --debug -i ./charts/kubernetes-external-secrets
    helm --tiller-namespace ops --namespace ops upgrade um-kubernetes-external-secret --set env.AWS_REGION=us-east-1 --set securityContext.fsGroup=65534 --set image.imagePullSecrets=TEST --debug -i ./charts/kubernetes-external-secrets
    helm --tiller-namespace ops --namespace ops upgrade um-kubernetes-external-secret --set env.AWS_REGION=us-east-1 --set securityContext.fsGroup=65534 --set image.imagePullSecrets=TEST --set saAnnotations."eks\.amazonaws\.com/role-arn"='arn:aws:iam::111111111111:role/ROLENAME'  --debug -i ./charts/kubernetes-external-secrets

UPGRADE: aws-sdk-js from 2.433.0 to v2.547.0

IRSA CODE UPDATE:

Using the new IRSA feature or the existing assumeRole feature are mutually exclusive. Only one can work at a time based on if a roleArn is passed as an annotation to externalSecret object(AssumeRole functionality) or if IRSA environment variable is set to true. Note that this mutual exclusiveness if irsa and assumeRole is due to the issue-2 pointed out in https://github.com/godaddy/kubernetes-external-secrets/issues/174. Addressing https://github.com/godaddy/kubernetes-external-secrets/issues/174 (issue-2) is a desired re-factor from architectural perspective
Tested IRSA functionality with:

helm --tiller-namespace ops --namespace ops upgrade um-irsa-kubernetes-external-secret --set env.AWS_REGION=us-east-1 --set env.AWS_IRSA=true --set securityContext.fsGroup=65534 --set image.repository=<REDACTED> --set image.tag=feature-irsa-integration-7147b26 --set image.imagePullSecrets=<REDACTED> --set saAnnotations."eks\.amazonaws\.com/role-arn"='arn:aws:iam::111111111111:role/<REDACTED>'  --debug -i ./charts/kubernetes-external-secrets

Hey @farshad-hobsons let me know if there's anything I can do to help move this along. Really looking forward to integrating this project into my cluster, but I need the IRSA support!

@farshad-hobsons This is important for me as well, but we need someone has the write access to solve all the conflicts. Wondering when will be the next release, as IRSA is essential for this plugin.

Looking at https://github.com/aws/aws-sdk-js/issues/2848#issuecomment-540119013, do we still need the AWS_IRSA flag and depend on the default credentials chain?

Closing this as #200 was merged, please rebase and reopen if you think we need to add the additional things that were in here


Password Obscuring, Verification and some other small bug fixes

Description
This PR introduces password obscuring and validation to ensure secure user authentication. It also includes a fix for minor issues with the FloatingActionButton and the addition of flutterInitialized for initialization purposes.
Type of Change

Added password obscuring in the text field to hide the password input.
Implemented password validation with checks for:
Minimum length (8 characters)
At least one uppercase letter
At least one lowercase letter
At least one number
At least one special character
Fixed small issues related to the FloatingActionButton ids.
Added flutterInitialized to ensure proper initialization.

Please delete options that are not relevant.

[x] Bug fix (non-breaking change which fixes an issue)
[x] New feature (non-breaking change which adds functionality)
[x] Breaking change (fix or feature that would cause existing functionality to not work as expected)
[ ] This change requires a documentation update
[ ] Other (please specify):

Checklist:

[x] My code follows the style guidelines of this project
[x] I have performed a self-review of my own code
[x] I have commented my code, particularly in hard-to-understand areas
[x] I have made corresponding changes to the documentation
[x] My changes generate no new warnings
[x] New and existing unit tests pass locally with my changes

Screenshots (if applicable)
Image 1
Image 2
Image 3
Image 4
Additional Information

Name:
Email:
Roll No:
Branch:

Hey @joharkhan99, your code looks clean and well-organized. However, we noticed that the password verification feature is only implemented on the profile page. Please extend the same to sign-in and sign-up pages for consistent security across the app.
Consider consolidating the verification logic into a reusable function/module to improve maintainability.
We'll review and merge your PR once this is addressed. Great job!

@Bijayanee ok I will add it to rest of the screens as well.

@Bijayanee  I’ve made the requested changes. Please review the latest commit.

@joharkhan99, I've reviewed your code and see that confirm password verification is still missing. Please update and resubmit.

I might have forgot about it. I will update this as well.


bump to new fedot ind version

bump to new fedot ind version

Hello @valer1435! Thanks for opening this PR. We checked the lines you've touched for PEP 8 issues, and found:

In the file gamlet/components/meta_features_extractors/time_series/time_series_meta_features_extractor.py:

Line 5:1: F401 'fedot.core.pipelines.pipeline.Pipeline' imported but unused
Line 14:1: F401 'gamlet.data_preparation.file_system.get_project_root' imported but unused


Unexpected moving of dropdown menu

Windows Terminal version (or Windows build number)
10.0.19042.1110, 1.8.1521.0
Other Software
none
Steps to reproduce
Open settings
Click on a drop down menu without selecting anything
scroll down with the mouse
Expected Behavior
the dropdown menu should close or the scrolling should be prohibited
Actual Behavior
the dropdown menu moves up/down from the terminal, also the dropdown menu can exit the window of the terminal

/dup #9320 i close the issue


Android seekTo playback error

Hello,
When I try to call TrackPlayer.seekTo(currentPosition + 10), the registerEventHandler fire a callback with this object:
{
  type: "playback-state",
  state: 6
}

and soon after it starts to fire these callbacks non-stop until the track finishes:
{
  type: "playback-error",
  error: "Unknown error"
}

This only happens in android, currently testing on a Nexus 5 emulator,
In iOS works normally, and these events are never called after I call seekTo there.
Thanks in advance,
Cheers

Which Android version are you testing on?
Are you using ExoPlayer?

Android 7.0 API 24,
I don't know if i'm using ExoPlayer, how can I check that in my project?

If you didn't went through the process of configuring this module, you're not using it.
The native Android player is really buggy, I plan to remove it in a future version.
You should try ExoPlayer instead, it's way faster and more consistent than the native player.
https://github.com/react-native-kit/react-native-track-player/wiki/Build-Preferences

Nice, it worked, thanks for the quick help!
Although, now when I call seekTo with any position the track go back to the beginning...
But this is another issue.
Thanks again,
Cheers!


Do not break CoreOS when deprecating kubernetes-ro

CoreOS does not have an equivalent to "kube-addons.sh", and so there are not system secrets created when the cluster is created.   So, when some of our CoreOS users run things like the Hazelcast example, or the elasticsearch example, they currently rely on kubernetes-ro to reach the apiserver.  When kuberenetes-ro support is removed (#8155), these examples will still work on GCE, because they can use the kubeconfig in their associated secret.  But, on CoreOS, it seems they will break.
Possible fix alternatives:

Change #8155 to not remove support for the --readonly_port feature, but default it to off for GCE.
Change all known examples to include instructions on how to generate a secret when setting up the example.
Extend CoreOS cluster setup to include the kube-addons.sh secret-creation functionality.
@lavalamp has a plan that uses a proxy in a sidecar.

Option 1 is nice because it allows us to defer fixing the problem until after 1.0 freeze.

@pires

My preferred solution is #9076.

Under this solution, we would update the docs for hazelcast, elasticsearch, etc, to show how to create a service account for the pods, and tweak the code in the clients to look for the token in the right place.

@erictune I'm ok with current elasticsearch example approach where we create a service account. Thing is we need a token that's supposedly available in the output of kubectl config view, but in my/our case this is empty. So no token, no service account, no fun.
I'm open to any of the proposed solutions but favor #9076 as well, as it feels more secure than just leaving a read-only port accessible.

Pods get a default service account, so you don't have to do anything special to get that.
You do have to either start using the auth info from the service account (preferred solution), or if you have a legacy container that you can't modify, run kubectl in a side-car container and use its proxy feature to get a local proxy of apiserver that doesn't need auth for your legacy application. #8155 adds support for this, and I'll soon have an example of how easy it is.

Pods get a default service account, so you don't have to do anything special to get that.

@brendandburns said the same exact thing, but this is what happens when I try to run hazelcast example with @brendandburns patch.
2015-06-01 11:56:34.641  INFO 12 --- [           main] c.g.p.h.HazelcastDiscoveryController     : Asking k8s registry at https://kubernetes.default.cluster.local..
2015-06-01 11:56:34.688  WARN 12 --- [           main] c.g.p.h.HazelcastDiscoveryController     : Request to Kubernetes API failed

java.nio.file.NoSuchFileException: /var/run/secrets/kubernetes.io/serviceaccount/token
	at sun.nio.fs.UnixException.translateToIOException(UnixException.java:86)
	at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
	at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
	at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:214)
	at java.nio.file.Files.newByteChannel(Files.java:361)
	at java.nio.file.Files.newByteChannel(Files.java:407)
	at java.nio.file.Files.readAllBytes(Files.java:3152)
	at com.github.pires.hazelcast.HazelcastDiscoveryController.getServiceAccountToken(HazelcastDiscoveryController.java:73)

That secret does not exist. I am not using kube-up or salt or whatever mechanisms you rely on to automate these things. I would like to replicate this in my Vagrant + CoreOS + Kubernetes binaries solution, and for that I need instructions on how does this work.

what does the following show?
kubectl get serviceaccounts --namespace=yournamespace
kubectl get secrets --namespace=yournamespace

Service accounts and token are provisioned using controllers running in the kube-controller-manager. You can start them by passing --service_account_private_key_file="<private rsa key file>" to that command.

$ kubectl get namespaces
NAME      LABELS    STATUS
default   <none>    Active
$ kubectl get serviceaccounts --namespace=default
Error: no resource "serviceaccounts" has been defined
$ kubectl get secrets --namespace=default
NAME      DATA

Do I need to replicate the steps from https://github.com/GoogleCloudPlatform/kubernetes/blob/master/hack/local-up-cluster.sh#L149 down, namely:

Generate SSL key
Start kube-apiserver with

--admission_control=NamespaceLifecycle,NamespaceAutoProvision,Li...
--service_account_key_file=GENERATED_SSL_FILE

Start kube-controller-manager with

--service_account_private_key_file=GENERATED_SSL_FILE

And it's done?

yes, that would enable service account creation, token generation, and token automounting

@liggitt you are the man.
2015-06-02 20:56:40.626  INFO 12 --- [           main] com.github.pires.hazelcast.Application   : Starting Application v0.3.1 on hazelcast-ir7ca with PID 12 (/bootstrapper.jar started by root in /)
2015-06-02 20:56:40.689  INFO 12 --- [           main] s.c.a.AnnotationConfigApplicationContext : Refreshing org.springframework.context.annotation.AnnotationConfigApplicationContext@5424f110: startup date [Tue Jun 02 20:56:40 GMT 2015]; root of context hierarchy
2015-06-02 20:56:41.965  INFO 12 --- [           main] o.s.j.e.a.AnnotationMBeanExporter        : Registering beans for JMX exposure on startup
2015-06-02 20:56:41.989  INFO 12 --- [           main] c.g.p.h.HazelcastDiscoveryController     : Asking k8s registry at https://kubernetes.default.cluster.local..
2015-06-02 20:56:53.215  INFO 12 --- [           main] c.g.p.h.HazelcastDiscoveryController     : Found 2 pods running Hazelcast.
2015-06-02 20:56:53.350  INFO 12 --- [           main] c.h.instance.DefaultAddressPicker        : [LOCAL] [someGroup] [3.4.2] Interfaces is disabled, trying to pick one address from TCP-IP config addresses: [<IP_ADDRESS>, <IP_ADDRESS>]
2015-06-02 20:56:53.350  INFO 12 --- [           main] c.h.instance.DefaultAddressPicker        : [LOCAL] [someGroup] [3.4.2] Prefer IPv4 stack is true.
2015-06-02 20:56:53.369  INFO 12 --- [           main] c.h.instance.DefaultAddressPicker        : [LOCAL] [someGroup] [3.4.2] Picked Address[<IP_ADDRESS>]:5701, using socket ServerSocket[addr=/0:0:0:0:0:0:0:0,localport=5701], bind any local is true
2015-06-02 20:56:53.773  INFO 12 --- [           main] com.hazelcast.spi.OperationService       : [<IP_ADDRESS>]:5701 [someGroup] [3.4.2] Backpressure is disabled
2015-06-02 20:56:53.778  INFO 12 --- [           main] c.h.spi.impl.BasicOperationScheduler     : [<IP_ADDRESS>]:5701 [someGroup] [3.4.2] Starting with 2 generic operation threads and 2 partition operation threads.
2015-06-02 20:56:53.974  INFO 12 --- [           main] com.hazelcast.system                     : [<IP_ADDRESS>]:5701 [someGroup] [3.4.2] Hazelcast 3.4.2 (20150326 - f6349a4) starting at Address[<IP_ADDRESS>]:5701
2015-06-02 20:56:53.975  INFO 12 --- [           main] com.hazelcast.system                     : [<IP_ADDRESS>]:5701 [someGroup] [3.4.2] Copyright (C) 2008-2014 Hazelcast.com
2015-06-02 20:56:53.976  INFO 12 --- [           main] com.hazelcast.instance.Node              : [<IP_ADDRESS>]:5701 [someGroup] [3.4.2] Creating TcpIpJoiner
2015-06-02 20:56:53.977  INFO 12 --- [           main] com.hazelcast.core.LifecycleService      : [<IP_ADDRESS>]:5701 [someGroup] [3.4.2] Address[<IP_ADDRESS>]:5701 is STARTING
2015-06-02 20:56:54.102  INFO 12 --- [cached.thread-2] com.hazelcast.nio.tcp.SocketConnector    : [<IP_ADDRESS>]:5701 [someGroup] [3.4.2] Connecting to /<IP_ADDRESS>:5701, timeout: 0, bind-any: true
2015-06-02 20:56:54.169  INFO 12 --- [cached.thread-2] c.h.nio.tcp.TcpIpConnectionManager       : [<IP_ADDRESS>]:5701 [someGroup] [3.4.2] Established socket connection between /<IP_ADDRESS>:53817 and <IP_ADDRESS>/<IP_ADDRESS>:5701
2015-06-02 20:57:01.133  INFO 12 --- [ration.thread-0] com.hazelcast.cluster.ClusterService     : [<IP_ADDRESS>]:5701 [someGroup] [3.4.2]

Members [2] {
	Member [<IP_ADDRESS>]:5701
	Member [<IP_ADDRESS>]:5701 this
}

2015-06-02 20:57:03.156  INFO 12 --- [           main] com.hazelcast.core.LifecycleService      : [<IP_ADDRESS>]:5701 [someGroup] [3.4.2] Address[<IP_ADDRESS>]:5701 is STARTED
2015-06-02 20:57:03.156  INFO 12 --- [           main] com.github.pires.hazelcast.Application   : Started Application in 22.92 seconds (JVM running for 23.765)

Going to make a PR for the new version of the hazelcast example.

I will also need to update the CoreOS docs.

@kelseyhightower @pires Please take a look at this ASAP.  I don't really want to go to 1.0  with CoreOS support broken.

@thockin I am updating it as we speak.

@thockin @erictune @AntonioMeireles I have questions.

Care if I remove single-node instructions? I don't think this makes sense anymore, unless someone is going to use hyperkube.

master.yaml needs instructions to generate service-account private key file, so it will depend on openssl. Any objections?

We should add DNS integration as many examples depend on it. Objections?

I'm moving aws folder from getting-started-guides folder, to getting-started-guides/coreos, in order to match how we did azure.
Speaking of which @errordeveloper @squillace @chanezon @crossorigin do you agree with questions 1, 2 and 3? Also, can we sync effort to get it homogeneous on all different CoreOS approaches?

no objections on my part.

Status on this?

I believe I will have the PR ready later today.

Due to increased workload, I have to postpone this to next week.

cc @yifan-gu

Are there still actions items open on this?

Yes, just need to implement a way in the master.yaml to generate SSL key to use and we're done.

See also https://github.com/GoogleCloudPlatform/kubernetes/pull/10264 in progress to include the root CA. You'll likely want to provide a CA for inclusion as well

I am not aware of this root CA and tbh I've had enough breaking changes in the last couple weeks. It's amazing to see Kubernetes getting there, but troublesome to keep up in the CoreOS world.
As for me, my kubernetes-vagrant-coreos-cluster works right now by just providing the SSL key file, generated with openssl genrsa -out kube-serviceaccount.key 2048 2>/dev/null, to my master VM and run:
kube-apiserver \
  --service_account_key_file=/tmp/kube-serviceaccount.key \
  --service_account_lookup=false \
  --admission_control=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota \
  --...

kube-controller-manager \
  --service_account_private_key_file=/tmp/kube-serviceaccount.key \
  --...

If this works @liggitt @thockin I'm happy to push the PR tomorrow morning (GMT). Otherwise, and mostly due to the lack of energy to do it, I can't deliver anytime soon.

There are basically three levels of security talking to the API:

http, read only. This is what is going away
https, authenticated via token, client don't verify server's certificate. This is what you get by providing the service account key
https with server cert verification. This is enabled by providing the root CA bundle for clients inside pods to use to verify the server's cert

Enabling service account tokens is still worthwhile even if the CA part doesn't happen yet

@liggitt yes, service-accounts are mandatory. I will push the PR tomorrow. Thanks for clarifying.

Status on this?  I want to get it off the books...

@thockin for real? #10344

Excellent!  Is this issue resolved now?

@thockin the PR was up for a week but it got lost in the pipe. 0.19.3 with service-account support is done for CoreOS (tested on Vagrant, AWS and GCE).

I will wait for v1 to come out before updating again. I want to add root CA and whatever may be needed then.


python312Packages.aiortm: 0.8.13 -> 0.8.14

Diff: https://github.com/MartinHjelmare/aiortm/compare/refs/tags/v0.8.13...v0.8.14
Changelog: https://github.com/MartinHjelmare/aiortm/blob/v0.8.14/CHANGELOG.md
Description of changes

Things done

Built on platform(s)

[ ] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[ ] aarch64-darwin

For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)

[ ] sandbox = relaxed
[ ] sandbox = true

[ ] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[ ] Tested basic functionality of all binary files (usually in ./result/bin/)
24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module

[ ] Fits CONTRIBUTING.md.

Add a :+1: reaction to pull requests you find important.

Result of nixpkgs-review pr 320443 run on x86_64-linux 1

4 packages built:

python311Packages.aiortm
python311Packages.aiortm.dist
python312Packages.aiortm
python312Packages.aiortm.dist


notify providers when reference has been received

Context
Providers now need to be informed when the candidate has received a requested reference – previously this was never a consideration since the provider always had the references once the candidate applied for the course.
Changes proposed in this pull request
Adds a new ProviderMailer, called by app/services/submit_reference.rb
Guidance to review
Traversing from a Reference to the relevant ProviderUsers was/is a little unclear to me. Double check my thinking in app/services/submit_reference.rb within the notify_provider_users method (from line 27)
Link to Trello card
https://trello.com/c/Yt4vBpQ0/429-references-mailer-reference-has-been-received
Things to check

[x] If the code removes any existing feature flags, a data migration has also been added to delete the entry from the database
[x] This code does not rely on migrations in the same Pull Request
[x] If this code includes a migration adding or changing columns, it also backfills existing records for consistency
[x] If this code adds a column to the DB, decide whether it needs to be in analytics yml file or analytics blocklist
[x] API release notes have been updated if necessary
[x] Required environment variables have been updated added to the Azure KeyVault

 References: Mailer - reference has been received


DCS-1033 Hook up new availabilty check

Still need to add a last check before creating the appointment as now removed check middleware.
And also show the list of alternatives.
Having to keep the old implementation for when the toggle is not applied and for amending bookings

the use of V1 and V2 for naming availabilityCheckService is confusing as it isn't easily obvious as to why 2 versions of the same service exists.

the use of V1 and V2 for naming availabilityCheckService is confusing as it isn't easily obvious as to why 2 versions of the same service exists. Can the two be combined?

As discussed - need to have 2 versions as we have 2 different implementations


Use command line arguments programmatically

Output of helm version: 3.1.2
Output of kubectl version: 1.15.5
Cloud Provider/Platform (AKS, GKE, Minikube etc.): local
Hello,
I'm trying to convert a bash deployment script into golang. To do that I'm using the helm library.
I managed to install a chart but I know want to add arguments to my installation. (password for postgresql).
What I'm trying to is this :
userVals := map[string]interface{}{ 		"postgresql-password": "test", 	} 	rel, err := iCli.Run(chart, userVals)
With the chart being a postgresql chart. How can I specify the postgresql-password when installing the chart ?
TL,DR : how to get this line helm --namespace mynamespace
install pg stable/postgresql
--set postgresqlPassword=mypassword
--wait programmatically.
I'm still relatively new to helm so I might have missed something important.
Thanks and feel free to ask for anything I might have forget that could help me fix this issue.

@finaldzn It is set in the cli here
and passed to the library code here

Let me know if that helps

Oh okay, so you advice me to use cmd rather than pkg to use helm programmatically ?

No, I am just showing you how the cli passes the values to the library. You can use some of this pattern to do the same.

Okay so following up,
Instead of using the flags I went like this :
userVals := map[string]interface{}{ 		"global": map[string]interface{}{ 			"postgresql": map[string]interface{}{ 				"postgresqlPassword": "test", 			}, 		}, 	} 	rel, err := iCli.Run(chart, userVals)
It does the same but I bypass the flag system completly because I couldnt figure out how to use the flags without using cobra.
Hopefully it can help someone, thanks for your help anyway @hickeyma


Samsung devices

Description
Black window instead of panorama image (https://ibb.co/9Hshmdx). This issue is on samsung smartphones only (in all browsers).
Errors in console -- https://ibb.co/Sf24Km6
Project
Nuxt3 + "@egjs/vue3-view360": "^4.0.0-beta.4"

Nvmr. Fixed by reducing size of image from 4096x2048 for 2048x1024

i have the same issue , but for me it seems that all smartphones get black window instead of panorama image. Do we have any fix for this ?

@nguyenph194812
Does the issue you commented on occur with all panorama images?
If not, can we check the panorama image that reproduces your issue?

@malangfox yes, i do resize my image from 81924092 to 20481024 and it shows the image, but the original one is black. Here's my image
https://drive.google.com/file/d/1PA8rMR1bskrTIWHqRQv5JUMXoPQqGAiO/view?usp=drive_link

Also i wonder does your lib use Multiresolution like krpano, marzipano ?

@malangfox hei, does the bug fixed yet. i use android and it always shows black


Add ability to focus the

[x] I have reviewed the documentation
[x] I have searched existing issues
[x] I am using the latest React Native version

Environment
Environment:
OS: macOS High Sierra 10.13.2
Node: 8.10.0
Yarn: 1.3.2
npm: 5.8.0
Watchman: 4.9.0
Xcode: Xcode 9.2 Build version 9C40b
Android Studio: 3.1 AI-173.4697961
Packages: (wanted => installed)
react: ~16.2.0 => 16.2.0
react-native: ~0.54.2 => 0.54.2
Expected Behavior
The https://facebook.github.io/react-native/docs/webview.html WebView component should have a way to autofocus itself. Once the autofocus is triggered, the HTML elements that have autofocus attributes will be focused in the loaded
Actual Behavior
No API available at this time

@react-native-bot sure buddy, here you go:
Environment:
  OS: macOS High Sierra 10.13.2
  Node: 8.10.0
  Yarn: 1.3.2
  npm: 5.8.0
  Watchman: 4.9.0
  Xcode: Xcode 9.2 Build version 9C40b
  Android Studio: 3.1 AI-173.4697961

Packages: (wanted => installed)
  react: ~16.2.0 => 16.2.0
  react-native: ~0.54.2 => 0.54.2

Also filed under https://stackoverflow.com/questions/50024656/how-to-focus-a-webview-in-react-native

@vladikoff I think you should try changing react-native versions in issue description for the bot to understand you :)

@vladikoff I'm also facing issue and wonder if you've found any solution.

@ocyedwin One solution i found was recompiling react-native from source and tweaking the WebView code so it requests focus

@vladikoff Nice! Any intention sharing the tweak or even doing a PR?

@ocyedwin posted a solution in https://stackoverflow.com/a/50635924/216672 Let me know if you need help

@vladikoff There is a solution in react-native-enhance-webview，you can know it if you need

@TryImpossible nice! thank you


Where is /templates/dashboard/ demo source?

please share the routing example for
https://material-ui.com/getting-started/templates/dashboard/

How did you find this URL?
In https://material-ui.com/getting-started/templates/#react-templates, I think that it would be interesting to create a dedicated page for each template, as https://startbootstrap.com/ does. cc @mbrookes.

please share the routing example for

You can find the source in
https://github.com/mui-org/material-ui/tree/master/docs/src/pages/getting-started/templates/dashboard

I think that it would be interesting to create a dedicated page for each template

That might be overkill for such simple templates.

I think that it would be interesting to create a dedicated page for each template

That might be overkill for such simple templates.

Thanks team , I  integrated the react  router for this template and changed to customize theme as per my requirement , https://e7ys8.csb.app


Error running flynn install

When running flynn install on OSX I get the following error.
I'm using flynn v20150610.0.
$ flynn install
panic: CREATE INDEX: column ID already has an index: xID [recovered]
	panic: CREATE INDEX: column ID already has an index: xID

goroutine 1 [running]:
github.com/flynn/flynn/pkg/shutdown.(*handler).exit(0x208fceed0, 0x0, 0x0, 0x0, 0x7351e0, 0x209058e70)
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/pkg/shutdown/handler.go:65 +0x12e
github.com/flynn/flynn/pkg/shutdown.Exit()
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/pkg/shutdown/handler.go:40 +0x73
github.com/flynn/flynn/installer.NewInstaller(0x2208fa70c8, 0x2090703c0, 0x0)
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/installer/installer.go:38 +0x1da
github.com/flynn/flynn/installer.ServeHTTP(0x0, 0x0)
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/installer/http.go:49 +0x85
main.runInstaller(0x2090703a0, 0x0, 0x0)
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/cli/install.go:21 +0x31
main.runCommand(0x7fff5fbff9ee, 0x7, 0xe62528, 0x0, 0x0, 0x0, 0x0)
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/cli/main.go:180 +0xb7d
main.main()
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/cli/main.go:117 +0xd1a

goroutine 5 [syscall]:
os/signal.loop()
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/util/_toolchain/go/src/os/signal/signal_unix.go:21 +0x1f
created by os/signal.init·1
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/util/_toolchain/go/src/os/signal/signal_unix.go:27 +0x35

goroutine 6 [chan receive]:
github.com/flynn/flynn/pkg/shutdown.(*handler).wait(0x208fceed0)
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/pkg/shutdown/handler.go:54 +0x158
created by github.com/flynn/flynn/pkg/shutdown.newHandler
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/pkg/shutdown/handler.go:25 +0xa8

goroutine 11 [chan receive]:
database/sql.(*DB).connectionOpener(0x208ffbf40)
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/util/_toolchain/go/src/database/sql/sql.go:589 +0x4c
created by database/sql.Open
	/tmp/tmp.yHkfsRARoz/src/github.com/flynn/flynn/util/_toolchain/go/src/database/sql/sql.go:452 +0x31c

Is this your first time running flynn install on this machine? If you don't mind loosing data from previous installs, you could delete ~/.flynn/installer/data.db which should get the installer into a working state. I able unable to reproduce the issue.

Yes, this is a first time install. I deleted ~/.flynn and reran flynn install and encountered the same error. After only removing ~/.flynn/installer/data.db and rerunning, the installer is up and running. :clap: Thank you!

I'm glad it's working for you now! It's not clear what could have caused this, I'll close the issue for now and it can be reopened if it reoccurs.

FYI I experienced the same issue and fixed/worked around it with the same action.

Same issue, deleted entire ~/.flynn folder and it worked.
First time installing on system, v20150724.0


Delete itpable chains as soon as service is deleted

In the new implementation of Globalnet, as soon as a service is deleted, we
are initially deleting the corresponding GlobalIngressIP Object and in the
respective controller.OnDelete method, we are flushing out the iptable rules.
This is causing some delay and in the meantime when kubeproxy is trying to
remove the corresponding service related iptable chains, its erroring out
as there are still some references to the chain. Kubeproxy continues to
retry the delete operation. This PR modifies the behavior to delete
the itpable chains as soon as the service is deleted.
Signed-Off-by: Sridhar Gaddam<EMAIL_ADDRESS>

@tpantelis @vthapar While debugging some flaky errors seen in CI, noticed some error logs in kubeproxy. This should help in reducing the errors. I'm marking it as draft as its too late in the release cycle.

@sridhargaddam this seems useful to me, what’s the plan for it?

@sridhargaddam this seems useful to me, what’s the plan for it?

Yes @skitt. I'll have to revisit this.


New option ignore for selector-no-union-class-name allow specific

I want to use the selector-no-union-class-name but allow to use union-class-name for specific classes which match a pattern.
In my use case the pattern would allow using for BEM modifiers union class name but would disallow them for BEM elements.
Regex: ^--(.*)$
Example configuration:
"selector-no-union-class-name": [
    "always",
    {
        "ignore": [ "/^--(.*)$/" ]
    }
],

The following patterns are considered warnings:
.block {
    &--modifier {

    }
}

The following patterns are not considered warnings:
.block {
    &__element {

    }
}

Sound good!


[1.10.2] Missing texture on Flux Core

Flux Networks version: v1.2.9

I believe its pointing to fluxCore.png

I'm seeing/not seeing same thing

Same here
Forge Version: <IP_ADDRESS>1(Optifine 1.10.2 HD U E7)
Flux Networks Version: 1.10.2-1.2.9
SonarCore Version: 3.3.1

Can confirm I am having a similar issue here. crafting still works (tho I have an unrelated crafting issue).
Forge version: <IP_ADDRESS>1
Optifine Version: 1.10.2 HD U E7
Flux Networks Version: 1.10.2-1.2.9
SonarCore Version: 1.10.2-3.3.1

Same here
Latest Sky Factory 3 pack and manually updated Flux Networks/SonarCore versions.

Also have this, after manually updating.

This appears to be an issue with an incorrectly named texture. In the pack the texture for the flux core is listed as fluxcore.png but it should be fluxCore.png. Renaming the file fixed the problem for me.
Anyone who wants to resolve this themselves, you can open the folder fluxnetworks-1.10.2-1.2.9.jar\assets\fluxnetworks\textures\items using a zip file opener like winrar.
Rename the file and job's a good un.

After looking in the zip folder under fluxnetworks-1.10.2-1.2.9.jar\assets\fluxnetworks\textures\model. There is no such model for the FluxCore to change. I tried what the poster above said. Renaming from fluxcore to fluxCore, This brought up an error saying 18 blocks were missing. That is what made me want to check if the model was even there. It's missing.

I tried renaming the file. It did NOT work. In fact upon opening my save it said 18 blocks were  missing. When I went to check to make sure the mod was still there. It wasn't. Therefore Renaming that file doesn't help.

went back to Flux networks v 1.2.8 and the texture works. Easy to change if you are using the Curse/Twitch launcher. If already installed, make sure you are out the game. Delete the mod. Find the mod in the launcher.  Click on the mod, NOT install. Select VERSIONS. Go to Flux-Networks-1.10.2-1.2.8 and Click the Download button on the far Right. Problem solved.

The Mod will delete if you try to edit it within the zip programme, if you extract it first you won't have that issue.  My bad for not going into how to use the zip programme properly.
Step1: extract the mod to another location, a new folder somewhere for example.
Step2: Modify the file name wof fluccore within the items folder.
Step3: Rezip the folder, making sure to save it as a zip file and change the extension to .jar

Closing: 1.10.2 is no longer supported.

Lmao


Recursive import issue with Pythran when building SciPy

We're hitting a recursive import error when building SciPy twice with pip install -e . --no-build-isolation. The error happens only for editable installs of SciPy, however the recursion is also there with normal builds. The SciPy build has to do:
import pythran
pythran.get_include()

in its build script to obtain Pythran's include directory. However, that import statement basically pulls in all of the Pythran code base, and this errors out at:
pythran/tables.py", line 4565, in save_arguments
    themodule = import_module(".".join(module_name))

What is happening there is that that code fails when module_name equals 'scipy.special', creating an import loop.
Full traceback (from https://github.com/scipy/scipy/issues/18900):

Traceback (most recent call last):
  File "<string>", line 3, in <module>
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/site-packages/pythran/__init__.py", line 50, in <module>
    from pythran.toolchain import (generate_cxx, compile_cxxfile, compile_cxxcode,
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/site-packages/pythran/toolchain.py", line 6, in <module>
    from pythran.backend import Cxx, Python
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/site-packages/pythran/backend.py", line 7, in <module>
    from pythran.analyses import LocalNodeDeclarations, GlobalDeclarations, Scope
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/site-packages/pythran/analyses/__init__.py", line 12, in <module>
    from .aliases import Aliases, StrictAliases
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/site-packages/pythran/analyses/aliases.py", line 6, in <module>
    from pythran.tables import functions, methods, MODULES
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/site-packages/pythran/tables.py", line 4598, in <module>
    save_arguments((), MODULES)
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/site-packages/pythran/tables.py", line 4561, in save_arguments
    save_arguments(module_name + (elem,), signature)
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/site-packages/pythran/tables.py", line 4561, in save_arguments
    save_arguments(module_name + (elem,), signature)
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/site-packages/pythran/tables.py", line 4565, in save_arguments
    themodule = import_module(".".join(module_name))
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/importlib/__init__.py", line 126, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
  File "<frozen importlib._bootstrap>", line 1050, in _gcd_import
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1002, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 945, in _find_spec
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/site-packages/_scipy_editable_loader.py", line 268, in find_spec
    tree = self.rebuild()
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/site-packages/_scipy_editable_loader.py", line 309, in rebuild
    subprocess.run(self._build_cmd, cwd=self._build_path, env=env, stdout=stdout, check=True)
  File "/home/rgommers/mambaforge/envs/scipy-dev/lib/python3.10/subprocess.py", line 526, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['/home/rgommers/mambaforge/envs/scipy-dev/bin/ninja']' returned non-zero exit status 1.

../../scipy/meson.build:92:21: ERROR: Command `/home/rgommers/mambaforge/envs/scipy-dev/bin/python3.10 -c 'import os
os.chdir(os.path.join("..", "tools"))
import pythran
try:
  incdir = os.path.relpath(pythran.get_include())
except Exception:
  incdir = pythran.get_include()
print(incdir)
'` failed with status 1.

To make matters worse, it's not so easy to work around it, because disabling pythran in the scipy build is not helping - Cython contains an import pythan statement too in a try-except loop.
My suggested solution here is to make the imports in pythran/__init__.py lazy via the use of __getattr__. That will solve both of the above issues at once, and I suspect it may also help with robustness for Cython in general (it only accesses pythran.__version__ if --np-pythran isn't explicitly used). If that sounds fine to you @serge-sans-paille, then I'd be happy to submit a PR.

Pythran should behave correctly is scipy is not importable - that's a bug. We should just skip trying to model scipy.special builtins if they are not importable.

Mmmh looks like we already have a try-except catch here, but it doesn't catch the expected exception...

oh, thanks for explaining. I'm convinced and as you offered to provide a PR for lazy loading, I cannot say no ;-)

Thanks! I'll work on this soon.

@rgommers : the definition of soon as expired :-) Do you want me to give it a try?

Sorry, it took me way longer than expected to finally finish the build system stuff for Python 3.12 - we only got a numpy beta release out yesterday.
I should still be able to do this, but probably not this week - if you're in a hurry maybe you want to give it a try?

I'm definitively in a hurry, and if you're not either, let's take our time :-)

@rgommers I'll do a release once you've fixed this one, that should help with main numpy / scipy builds

Thanks. I'll have a go at this today.


HTTPS in Development

A workaround has been commented below, see: https://github.com/facebook/create-react-app/issues/6126#issuecomment-570763433

Right now there's just the general acceptance that the SSL Certificate will cause some friction.

Note that the server will use a self-signed certificate, so your web browser will almost definitely display a warning upon accessing the page.
Source: Create React App Website

React's website (and the development world really) has been gifted with Gatsby, and I think they got it right.
When you run a gatsby website in development mode with the --https flag, it will leverage the package devcert-san. It's (near) frictionless, handles trusting the CA and gets you a proper lock on the browser bar.
I don't think it's really a high priority but wanted to bring it up.

Just to follow up, I also found this but haven't worked with it (yet).
https://github.com/FiloSottile/mkcert

EDIT:

a PR implementing this feature has been open for a long time now: #5845

Have you tried it in all browsers lately? I like devcert-san but the last time I tried it (over a year ago) the Firefox and Safari experience was still less than ideal.

idk, is this stale?

It would at least be good to allow specifying a path to load the certificates from.
That way you can use mkcert and have a trusted certificate.

The simple steps below worked for me:

Install mkcert and run mkcert localhost

add both the private key and certificate generated by mkcert to a single .pem file (e.g. server.pem)

add a prestart line to your package.json under scripts (assuming the .pem file is inside of a /cert folder): "prestart": "cp -f ./cert/server.pem ./node_modules/webpack-dev-server/ssl || :"

start CRA in HTTPS mode: HTTPS=true npm start

:moneybag: profit! :moneybag: http://oi65.tinypic.com/axmfyq.jpg

Similar discussions:
https://github.com/facebook/create-react-app/issues/430
https://github.com/facebook/create-react-app/pull/5845
https://github.com/facebook/create-react-app/pull/6544
Original solution by @Zwerge here: HTTPS In Development: A Practical Guide

For those searching for command line example, use the following:
brew install mkcert
mkcert localhost
cat ./localhost-key.pem ./localhost.pem > ./node_modules/webpack-dev-server/ssl/server.pem
npm run start       (HTTPS=true react-scripts start)

Hopefully this PR will solve it completely later - https://github.com/facebook/create-react-app/pull/5845

idk, is this stale ... again?

Nope, still waiting on the PR to be merged

🤷♂

Since you enable HTTPS by setting HTTPS=true in your environment (either via package.json, profile, or dotenv file, etc) - I went down the path of supporting HTTPS_CERT and HTTPS_KEY environment variables. All it takes is adding 4 lines to react-scripts/config/webpackDevServer.config.js
The environment variable names can be different if there is something more conventional that would "just work" in some environments.
I'd be happy to put in a PR if there is any interest.
react-scripts/config/webpackDevServer.config.js
// around line 20
const cert = (protocol === 'https' && process.env.HTTPS_CERT) || undefined;
const key = (protocol === 'https' && process.env.HTTPS_KEY) || undefined;

// around line 86
    cert: cert,
    key: key,

@JamesMaroney a PR implementing this feature has been open for a long time now: https://github.com/facebook/create-react-app/pull/5845
It seems that this feature is of no interest to Facebook so they're ignoring it.

@albertorestifo I've edited the original issue with the mention of the PR just so it's not lost in the noise. :)

For Ubuntu Debian/Bionic
sudo apt install wget libnss3-tools
For CentOS
sudo yum install nss-tools
export VER="v1.3.0"
wget -O mkcert https://github.com/FiloSottile/mkcert/releases/download/${VER}/mkcert-${VER}-linux-amd64
sudo chmod 777 mkcert
sudo mv mkcert /usr/local/bin
mkcert --help
mkcert -install
mkcert localhost <IP_ADDRESS> ::3000 domain.com
It's generate private key and certificate add both into single file, create a single file httpscert.pem same place as package.json exist and add the both the key.
For Linux
"start": "PORT=8000 HTTPS=true react-scripts start",
"prestart": "cp -f ./httpscert.pem ./node_modules/webpack-dev-server/ssl || :",
For Windows
"start": "set PORT=8000 HTTPS=true react-scripts start",
"prestart": "cp -f ./cert/server.pem ./node_modules/webpack-dev-server/ssl || :",
npm start
It's will works fine.

There is another way to setup HTTPS in development.
You can generate cert with mkcert for example, set SSL_KEY_FILE, and SSL_CRT_FILE, environment variables and create setupProxy.js with:
const fs = require('fs');
const path = require('path');
const proxy = require('http-proxy-middleware');

const makeCert = () => {
  const devServerCertPath = path.resolve(
    path.join(require.resolve('webpack-dev-server'), '../../'),
    'ssl/server.pem'
  );

  if (fs.existsSync(devServerCertPath)) {
    console.log('webpack-dev-server cert already exists, skipping');
    return;
  }

  const keyPath = path.resolve(path.join(__dirname, '..'), process.env.SSL_KEY_FILE);
  if (!fs.existsSync(keyPath)) {
    console.error(`Cert key is missing at ${keyPath}`);
    process.exit(-1);
  }

  const certPath = path.resolve(path.join(__dirname, '..'), process.env.SSL_CRT_FILE);
  if (!fs.existsSync(keyPath)) {
    console.error(`Cert is missing at ${certPath}`);
    process.exit(-1);
  }

  const key = fs.readFileSync(keyPath, 'utf8');
  const cert = fs.readFileSync(certPath, 'utf8');

  const fullCert = key + cert;
  fs.writeFileSync(devServerCertPath, fullCert);
  console.log(`Cert is writtent to ${devServerCertPath}`);
};

module.exports = (app) => {
  if (process.env.HTTPS === 'true') {
    makeCert();
  }
};

Just updated Chrome and I can't even view my local anymore, it won't let me pass the invalid certificate.

Coming here with the same output as the one presented by @noetix

I' m having the same issue. I have it running on a docker container but accessing through network. maybe that's related? as subject and issuer are localhost, but I'm accessing through a completely different network IP

@noetix @Lukortech @fedexyz
this is due to https://support.apple.com/en-us/HT210176
webpack-dev-server fixed it in https://github.com/webpack/webpack-dev-server/issues/2273
latest version of react-create-app seems to have fixed it (https://github.com/facebook/create-react-app/pull/7988)
if you want to fix it locally try
cd node_modules/react-scripts
npm install<EMAIL_ADDRESS>cd -
HTTPS=true npm start

Can confirm updating react-scripts to latest unblocks what I reported.

I had to update from react-scripts 3.3.0 to 3.4.0 for this to work.

@iansu I believe this has already landed using HTTPS=true npm start
https://create-react-app.dev/docs/using-https-in-development/

I think the docs still need a guide or at least a link about how to create your own certificate.

@rlueder  step 2 is unclear to me - so I should have two private keys in one file?

this didnt work for me:
PORT=3015 HTTPS='true' \
    SSL_CRT_FILE='certs/localhost/server.crt' \
    SSL_KEY_FILE='certs/localhost/server.key' \
    react-scripts start

but this did work eventually:
cp -f ./certs/localhost/server.pem ./node_modules/webpack-dev-server/ssl/server.pem
PORT=3015 HTTPS='true' react-scripts start

I copied my server.crt and server.key into the new server.pem file. the server.crt content was first, the server.key content was second, so basically two private keys in one file (server.pem).

You can specify the certificates location with environment variables or in a .ENV file and won't need the prestart step then.
I wrote this to help me remember how to do it Using HTTPS with create react app .

You can specify the certificates location with environment variables or in a .ENV file and won't need the prestart step then.
@wozzo Does this work with webpack-dev-server < v3.9? Because there's a bug and the prestart script is a workaround.

It needs react-scripts 3.4.2+


Is there a built-in way of making asynchronous requests?

👋
Is there a built-in way of issuing multiple concurrent requests (specifically, for TTS)?
My use case is as follows: I want to use TTS to convert text into audio, but since it's a long string I'd like to split it up into chunks of 5000 chars each and convert them concurrently (in order to save time).
In AWS' SDK, I use CommandPool, which makes this very easy (example).
Furrhermore, AWS' SDK will also retry any failed attempts, so all I had to do to implement AWS Polly (their version of TTS) is as follows:
    public function synthesize() : SynthesisInterface {
        $config = Config::getPollyConfig();
        $config += ['retries' => 1000];
        $polly = new PollyClient($config);

        $commandGenerator = function(array $chunks) use ($polly) {
            foreach ($chunks as $chunk) {
                yield $polly->getCommand('SynthesizeSpeech', [
                    'OutputFormat' => Config::Output_Format,
                    'Text' => $chunk,
                    'TextType' => 'text',
                    'VoiceId' => $this->voiceId
                ]);
            }
        };

        $commands = $commandGenerator($this->getTextChunks());
        $pool = new CommandPool($polly, $commands, [
            'concurrency' => 80,
            'fulfilled' => $this->getPollyFulfilledFn(),
            'rejected' => $this->getPollyRejectedFn()
        ]);

        $promise = $pool->promise();
        $promise->wait();
        ksort($this->audio);

        return $this;
    }

Can I do this with your SDK?

Check out the GCP client for all the latest bells and whistles: https://github.com/GoogleCloudPlatform/google-cloud-php#google-cloud-translation-ga


Application Hangs with UniformGridLayout with Data Binding using XamlReader

Describe the bug
When loading some XAML with ItemsRepeater and a UniformGridLayout dynamically via XamlReader:
        <muxc:ItemsRepeater
            ItemsSource="{Binding}">
            <muxc:ItemsRepeater.Layout>
                <muxc:UniformGridLayout Orientation="Horizontal"
                                        MinItemWidth="200" MinItemHeight="200"
                                        MinRowSpacing="16" MinColumnSpacing="8"
                                        ItemsStretch="Uniform"
                                        />
            </muxc:ItemsRepeater.Layout>
            <muxc:ItemsRepeater.ItemTemplate>
                <DataTemplate>
                    <Grid>
                        <Border Background="#99FFFFFF" VerticalAlignment="Bottom">
                            <TextBlock Text="{Binding title}" TextWrapping="WrapWholeWords"
                                    Foreground="Black" Margin="4"/>
                        </Border>
                    </Grid>
                </DataTemplate>
            </muxc:ItemsRepeater.ItemTemplate>
        </muxc:ItemsRepeater>

With an associated DataContext, the application will hang indefinitely.
I hit this when upgrading XAML Studio to use WinUI 2.7.1 from 2.3.1911. Thought I had broken something else, but this broke my go-to example of a conversion of the Toolkit's AdaptiveGridView to use UniformGridLayout instead, as we'd like this scenario to work to deprecate AdaptiveGridView in the future.
Appears this broke in WinUI 2.5.
Steps to reproduce the bug

Run the attached project:
UniformGridLayoutIssue.zip
Click button, see issue.

Note: Downgrade package reference to 2.4.3 and it'll work fine.
Also Note: ScrollViewer can be removed too from DynamicFiles\Visual.xaml and it still repros.
Expected behavior
Application shouldn't hang and content should be loaded.
Screenshots
CPU and memory seem to be consistent during hang:

NuGet package version
Microsoft.UI.Xaml 2.7.1
Windows app type

[X] UWP
[ ] Win32

Device form factor
Desktop
Windows version
Windows 10 (21H2): Build 19044
Additional context
Possibly Related to #6799 and #6689

The behavior was correct in https://github.com/microsoft/microsoft-ui-xaml/tree/v2.5.0-prerelease.200708003 but regressed with https://github.com/microsoft/microsoft-ui-xaml/tree/v2.5.0-prerelease.200812001. Not sure what exactly is causing this, it might be WinUI just hitting a bug in the OS right now.

Not sure what exactly is causing this, it might be WinUI just hitting a bug in the OS right now.

Note, that using the older package on the same OS version is working, so you're saying that something about the change in the code might be hitting a new OS issue? However, if we can identify the changed bits between those two versions in the code, could we possibly revert or work-around it still?
There were definitely changes to some of the layout related code as seen in the diff for the UniformGrid files here: https://github.com/microsoft/microsoft-ui-xaml/compare/v2.5.0-prerelease.200708003...v2.5.0-prerelease.200812001#diff-aef8e5d00840ae38a1ba4b51a391f62d0cc2c1d46db0f6f8ebe8ad8f0d78aaf5L75
@chingucoding, I think they're all encapsulated in the PR you did here to fix this crash: https://github.com/microsoft/microsoft-ui-xaml/pull/2969
Could we try reverting that change locally and seeing if that resolves the issue here? Then find a way to forward-fix the original issue and this new regression, if that's the case?


fixed broken rendering on Safari new iOS 14.2

Pull request for the issue opened this morning, here:
https://github.com/snapappointments/bootstrap-select/issues/2539
Thank you, btw
Keep safe and healthy
Teo

Was this fixed in later iOS versions? I'm on 14.4 and can't see any issues on demo/doc page


Add config to store objects on stack vs. scratch buffer

This PR adds a configurable limit on_stack_limit - default = 32 - to allow the user to specify whether tuples/fmt strings/str calls (and soon map keys/values) should be stored on the stack or in a scratch buffer. This allows us to balance supporting large strings/objects while avoiding making the ResourceAnalyser code too complex by trying to accurately estimating memory for map values/keys: https://github.com/bpftrace/bpftrace/pull/3483

@danobi @jordalgo
Updates:

Changed name to off_stack_limit and updated relevant descriptions
Updated strings to use stack if max_strlen > on_stack_limit
Added codegen tests for stack vs. scratch buffer
Refactored to use common stack vs. scratch buffer function in irbuilderbpf

Changed name to off_stack_limit and updated relevant descriptions

Also, you mean on_stack_limit

@ajor addressed your comments, mind taking another look?


backport doc_type_amq typo fix to <IP_ADDRESS>_cmsweb branch

Fixes https://gitlab.cern.ch/cmsweb-k8s/services_config/-/merge_requests/214
Related to https://github.com/dmwm/WMCore/issues/11429
Back-port to <IP_ADDRESS>_cmsweb branch
Status
ready
Description
Removed post_to_amq configuration parameter and local variable postToAMQ since they are not used in a code and fixed typo doc_to_amg to doc_to_amq which is used in MSPIleup configuration.
Is it backward compatible (if not, which system it affects?)
YES
Related PRs
#11573
External dependencies / deployment changes
<Does it require deployment changes? Does it rely on third-party libraries?>

Thanks Valentin.

I deployed <IP_ADDRESS> on testbed for ms pileup services only, e.g.
../tools/k8s_info -n dmwm | grep pileup
name       : ms-pileup
image      : registry.cern.ch/cmsweb/reqmgr2ms-pileup:<IP_ADDRESS>
name       : ms-pileup-filebeat
name       : ms-pileup-tasks
image      : registry.cern.ch/cmsweb/reqmgr2ms-pileup:<IP_ADDRESS>
name       : ms-pileup-tasks-fb

and I checked pods. Originally, the reqmgr2ms-pileup secrets have not had config.py, therefore I redeployed secrets for this service too. I checked that we DO have correct secrets in gitlab preprod branch, it seems somebody made a mistake when secrets were deployed originally and skip config.py. From my inspection of /etc/secrets on both pods (mspileup and mspileup-tasks) everything is fine in testbed cluster. I need to ping Ceyhun though to verify data flow to /topic/cms.ms-pileup-test AMQ end-point.


[Incident] Pangeo Hub has several critical issues

Summary
There are a variety of critical issues that have been reported on the Pangeo JupyterHub.
Certificate errors
Some users reported a certificate error when connecting to the hub. Here's an example of the error message:

FreshDesk tickets:

https://2i2c.freshdesk.com/a/tickets/41
https://2i2c.freshdesk.com/a/tickets/42

JupyterLab and kernal usability errors
Many users on the Pangeo hub are reporting slugging behavior. In particular, the following two actions take upwards of 30 seconds to complete, or do not complete at all:

Starting Kernels
Opening Terminals

FreshDesk tickets:

https://2i2c.freshdesk.com/a/tickets/43

Grafana is not reachable
I tried to go to grafana.us-central1-b.gcp.pangeo.io but received a "your connection is not private" error. So I haven't been able to look at any dashboards to understand what might be going on.
Timeline (if relevant)
If it makes sense to include a timeline for this incident, then do so below.
All times in {{ most convenient timezone}}.
{{ yyyy-mm-dd hh:mm }}
Start of incident. First symptoms, possibly how they were identified.
{{ hh:mm }}
Investigation starts.
{{ hh:mm }}
More details.

After-action report
These sections should be filled out once we've resolved the incident and know what happened.
They should focus on the knowledge we've gained and any improvements we should take.
What went wrong
Things that could have gone better. Ideally these should result in concrete
action items that have GitHub issues created for them and linked to under
Action items.
Where we got lucky
These are good things that happened to us but not because we had planned for them.
Action items
These are only sample subheadings. Every action item should have a GitHub issue
(even a small skeleton of one) attached to it, so these do not get forgotten. These issues don't have to be in infrastructure/, they can be in other repositories.
Process improvements

{{ summary }} [link to github issue]
{{ summary }} [link to github issue]

Documentation improvements

{{ summary }} [link to github issue]
{{ summary }} [link to github issue]

Technical improvements

{{ summary }} [link to github issue]
{{ summary }} [link to github issue]

Actions

[ ] Incident has been dealt with or is over
[ ] Sections above are filled out
[ ] Incident title and after-action report is cleaned up
[ ] All actionable items above have linked GitHub Issues

Grafana is not reachable
I tried to go to grafana.us-central1-b.gcp.pangeo.io but received a "your connection is not private" error. So I haven't been able to look at any dashboards to understand what might be going on.

This is not the correct grafana URL, this is the one listed in the config and is reachable https://pangeo-grafana.pangeo.2i2c.cloud

I suspect the certificate issues are due to the redirect Ryan asked me to setup last night.
Setup
We have two DNS zones: 2i2c.cloud managed by us through Namecheap, pangeo.io managed by the Pangeo community through Hurricane Electric (though I have access).
In 2i2c.cloud, we have a pangeo.2i2c.cloud A record that points to our LoadBalancer IP address.
In pangeo.io, we have us-central1-b.gcp.pangeo.io that is a CNAME for pangeo.2i2c.cloud.
It is setup this way such that if our LoadBalancer IP changes, we only need to edit the A record in 2i2c.cloud and pangeo.io will inherit the change through the CNAME.
The Redirect
We only assign one domain name to our hubs to avoid confusion, this means that once the CNAME for us-central1-b.gcp.pangeo.io was setup, pangeo.2i2c.cloud begins returning a 404 since ingress-nginx now only accepts traffic from the pangeo.io domain.
Hence Ryan asked me to setup a redirect from pangeo.2i2c.cloud to us-central1-b.gcp.pangeo.io, which I did here https://github.com/2i2c-org/infrastructure/issues/482#issuecomment-963411959
What I suspect is happening
I don't think the certificates are able to resolve properly because they're trying to get a response from ...pangeo.io which is a CNAME for pangeo.2i2c.cloud which is then redirecting back to ...pangeo.io --> vicious loop of nothing giving a correct response.
What I'm going to try

Remove the redirect in Namecheap
Wait some time to allow the DNS to resolve itself
Redeploy support on the pangeo-hubs cluster to trigger any certificate reissues

I did the above and logged into the production hub in a private browser. All certificates were present and the connection was private. So the certificates issue is now resolved.

JupyterLab and kernal usability errors
Many users on the Pangeo hub are reporting slugging behavior. In particular, the following two actions take upwards of 30 seconds to complete, or do not complete at all:

Starting Kernels
Opening Terminals

I could not replicate this so I suspect it was all a certificates/traffic problem.

I think there has been some confusion regarding the certificates on the pangeo.2i2c.cloud URL.
We stopped supporting multiple domains for a single hub to reduce complexity. See these PRs: https://github.com/2i2c-org/infrastructure/pull/460 and https://github.com/2i2c-org/infrastructure/pull/496
Hence when https://github.com/2i2c-org/infrastructure/pull/812 was merged, we stopped issuing certificates for pangeo.2i2c.cloud and the load balancer stopped accepting traffic from there. Instead, we issue certificates for us-central1-b.gcp.pangeo.io and accept traffic from there. As mentioned above, the pangeo.2i2c.cloud address is only used so we can update the IP address of the load balancer if required in the cases where we don't have access to the desired domain.
There are no certificate issues if folks use the us-central1-b.gcp.pangeo.io address, which I mentioned here https://github.com/2i2c-org/infrastructure/issues/482#issuecomment-963303591 But instead we got waylaid by redirects and all sorts.

Just a note that the following works as-expected for me:

Go to https://us-central1-b.gcp.pangeo.io , start a session, and start a kernel. This was much snappier than when I tried yesterday.
Go to pangeo-grafana.pangeo.2i2c.cloud - this correctly brought up the grafana so that I could log in!

Quick thoughts:

Do we anticipate moving pangeo-grafana.pangeo.2i2c.cloud to pangeo-grafana.us-central1-b.gcp.pangeo.io ? Or will the pangeo.2i2c.cloud only exist in order to serve pangeo-grafana.pangeo.2i2c.cloud?
Another hub we could to for inspiration is utoronto.2i2c.cloud, which redirects to https://jupyter.utoronto.ca/hub/login?next=%2Fhub%2F - not sure if that's the same setup or not, but just noting it in case it helps with redirection

Do we anticipate moving pangeo-grafana.pangeo.2i2c.cloud to pangeo-grafana.us-central1-b.gcp.pangeo.io ? Or will the pangeo.2i2c.cloud only exist in order to serve pangeo-grafana.pangeo.2i2c.cloud?

There's a bit of a name-clash for grafana atm since I wasn't very clever when setting up the COESSING hub.
https://github.com/2i2c-org/infrastructure/blob/6cf0a3ff3c9edf2154791e26c269dbbf681d5234/config/hubs/pangeo-hubs.cluster.yaml#L13-L16
So my plan was:

Tear down the COESSING hub
Move pangeo-grafana.pangeo.2i2c.cloud to grafana.pangeo.2i2c.cloud
Update our A record in Namecheap to be a wildcard record (*.pangeo) since pangeo-grafana.pangeo.2i2c.cloud, staging.pangeo.2i2c.cloud and pangeo.2i2c.cloud all point to the same IP address. This will be simpler to maintain.

I had intentions to point grafana at grafana.us-central1-b.gcp.pangeo.io unless the community specifically need it or we consider it best practice?
If we move forward with https://github.com/2i2c-org/infrastructure/issues/427 at some point, I had also considered making these URLs *.pangeo-gcp so we could have *.pangeo-aws in the future if need be.

Another hub we could to for inspiration is utoronto.2i2c.cloud, which redirects to jupyter.utoronto.ca/hub/login?next=%2Fhub%2F - not sure if that's the same setup or not, but just noting it in case it helps with redirection

Just checked out Namecheap for this. We have an A record utoronto in the 2i2c.cloud domain that points at an IP address (I assume the load balancer), and that's it. The redirect setup must be happening on the utoronto.ca end. In which case, I wonder if I took the wrong approach by trying to setup the redirect from Namecheap instead of in Hurricane Electric?

I'm simultaneously proud of and ashamed of how the utoronto redirect works - it works via JS in the homepage! https://github.com/utoronto-2i2c/homepage/blob/master/extra-assets/js/login.js. It only works if you land on the homepage - if you're already logged in it has no effect. Do not recommend.

@yuvipanda LOL that is amazing

I've tidied up the top comment. I don't think there's anything actionable left here so I'm going to close this.

I'm simultaneously proud of and ashamed of how the utoronto redirect works - it works via JS in the homepage! https://github.com/utoronto-2i2c/homepage/blob/master/extra-assets/js/login.js. It only works if you land on the homepage - if you're already logged in it has no effect. Do not recommend.

It is fun to realize I actually thought about something along these lines when I was thinking about possible workarounds 😜

Many thanks @sgibson91 for being awesome!


Iron-list is not selectable

Using the sample from here: http://vaadin.github.io/gwt-polymer-elements/demo/#iron/IronListSample
The iron-list items are not selectable.
@manolo Is there anything one has to add to make then selectable?
I tried:
  @UiField
  IronList resultList;

Polymer.ready(resultList.getElement(), arg -> {

       resultList.setSelectionEnabled(true);
       resultList.getPolymerElement().addEventListener(IronSelectEvent.NAME, event -> {

        GWT.log("selected!!");

      });
      return null;
    });

but it never fired.

The problem is that you cannot set tabindex$="[[tabIndex]]":
<iron-list items="[[data]]" as="item">
  <template>
    <div tabindex$="[[tabIndex]]">
      Name: [[item.name]]
    </div>
  </template>
</iron-list>

UIBinder will not allow this.

May be you could add some clever helper method to have a workaround.

could you provide your entire ui.xml file ? seems like you need an auxiliary template for the data binding


add unipept watermark to images

Original issue by @bmesuere on Tue Aug 21 2012 at 13:46.
Closed by @bmesuere on Tue Aug 21 2012 at 14:55.

will not fix
Original comment by @bmesuere on Tue Aug 21 2012 at 14:55.


Multi-WAN + IPsec Blocks each other

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
[X] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
[X] I have searched the existing issues and I'm convinced that mine is new.
Describe the bug
WAN1 (DHCP) this interface is used with IPsec
WAN2 (PPPOE) this interface is used in the same Balance GW as WAN1 (all works fine till IPsec is enabled)
The Bug/Problem comes up instant after adding IPsec then either the IPsec or the WAN2 GW cant be enabled anymore.
Both MultiWan as like IPsec (Site to Site to another OPNsense) are configured by offical guides.
It seems like the routes dont work since nothing is Blocked via Firewall but when i check the routed all is fine.
revert tested, no fix sadly
To Reproduce
Steps to reproduce the behavior:

Configure Multiwan with one DHCP n one PPPOE
Configure Firewall Rules to use just one WAN n not the balanced GW Group
Configure IPsec n Firewall
See either IPsec or PPPOE not working

Expected behavior
Both working IPsec and PPPOE
Relevant log files
Logs dont show any error, all seems fine there but every reboot its random whats working PPPOE WAN or IPsec
Environment
Software version used and hardware type if relevant.
e.g.:
OPNsense 20.7.2 (amd64, OpenSSL).
Intel(R) Atom(TM) CPU C2558 @ 2.40GHz (4 cores)

So i tested a few things n it seems to be linked to either pppoe or gateway of pppoe since when i disable it ipsec starts after a reboot but the gateway cant be enabled anymore

This all doesnt really makes sense. Screenshots of IPsec Phase1 and 2, Gateways, Gateway groups and Rules Tabs

so i used the gui to report the problem maybe there are more configs in that.
First off this is my ipsec conf, its just dif for ip n nets on the hosts:

With this all IPsec shows connected but as long as WAN2_PPPOE is online i cant ping anything from there for example <IP_ADDRESS> the firewall interface. It looks like this:

However after i reboot IPsec works like a charm i can ping i get to all services in the lan on the other site n so on, sadly WAN2 cant be enabled anymore n shows defunct all time no matter what i try to reenable it i will stay "disabled defunct"

i even tried delete full wan2 n then rebuild it since i though maybe its a config fail by myself but same errors then.

So further error testing from me i can enable wan2_pppoe if i disable auto gen rules in ipsec (log shows it goes on WAN2 to set the routing) when i then enable wan2_pppoe it comes up and runs but gets packetloss and additionally the ipsec network is not reachable anymore even when adding a manual rule with the right interface

@mimugmail anything else needed to check whats the bug here?
sry for the bad eng im from germany actually^^

WAN_PPPOE should be priority 2 and not equal to 1

@mimugmail just a quick reply, thanks a lot for this information seems like i gotta learn much since i didnt knew this had such an impact.
i changed the priority, after that it didnt work i had to reboot but then all worked, could i just ask out of curiosity why when i set both to 1 why it always takes the pppoe and disables the gateway completely?
"Priority | Prioritizes this gateway, a lower value means more important." i though of this like when i got two wan's with same speed to give them same priority.
thanks a lot since this simple comment fixed the problem i had trouble for near two days now 🥇 i wish a happy day!

The priority sets the default gateway of the system itself and all it's services (like Ipsec). There can only be one active at a time and when you have two with the same priority it's unpredictable what happens.
The loadbalancing via Groups are totally different as this only affects traffic going THROUGH the firewall (not IPsec since this is locally initiated).
Hope this makes it bit clearer.

ah great thanks for the competent help! will close the issue since its fixed now


Question about Compaction feature

What is the progress of the Compaction feature development?

@pnarayanan  because i has many delete operations, and i want save my disk space

Compaction is actively being worked on, as can be seen from the open PRs.


Add fixture docstrings

Closes #318

I see there are some regressions reported, but they can't be related to this PR as it is only docs, I'll go ahead and merge this, Thanks @hendrikmakait .


Phantom boards

The idea is boards that exist, but are not listed in board index or the child-boards or jump-to blocks, etc.
Reason?
Very limited usefulness, that's why I opened an issue instead of coding them. :angel:
I just had to delete a board that once contained something. The something has been moved to another board, but now the old links (search engines, bookmarks, etc.) are all invalid. With a phantom board I could have changed the old board to a redirect invible and obtain a "clean" redirect.

TBH I'm not entirely sure what I was talking about...

LOL

I like this idea. Each user could then set up his own "board" with his personal topic.
+1

@wintstar that was not about giving users the possibility to create boards, but I guess more about having multiple types of boards (that actually could be used for what you were suggesting as well), though I wrote it in a way that doesn't really make much sense.
The only way it somehow make sense is if I was referring to links to the board itself (board=1.0), that disappear when a board is deleted, while could work as a redirect with the setting I described above (i.e. board 1 remains in an hidden form and acts as a redirect to another board, for example 2, so that links pointing to 1 will not receive a 404, but a 301).

Yes, a brilliant idea. I think that you could make of this idea a little bit more.


Zebra falsely estimates that it's close to the tip when the network connection goes down

Motivation
Zebra currently estimates that it is close to the tip if the average number of synced blocks in the last four batches drops below 20. The decision is made in the function is_close_to_tip here https://github.com/ZcashFoundation/zebra/blob/update-column-family-names/zebrad/src/components/sync/status.rs#L67. Zebra uses the output of this function to activate the mempool.
However, when Zebra loses its peers during the syncing process, is_close_to_tip returns a false positive because the number of synced blocks in the last four batches naturally drops below 20. This happens, for example, when the internet connection goes down on the machine where Zebra is running.
A consequence of this bug is that the mempool is activated too early. Also, once the connection is back up, Zebra is likely to start crawling for tx IDs from other peers, and gossiping new block hashes to peers. This is unwanted load to other peers. However, this extra load won't last long because Zebra will figure out that it's not at the tip. It will also deactivate the mempool.
Solution
Make sure Zebra has enough connections before is_close_to_tip returns the final decision.
Steps

Move WatchReceiver to zebra-chain so that you can use it from both zebra-state and zebra-network
Create a new channel in https://github.com/zcashfoundation/zebra/blob/75a679792bb787b95b4e9ce87aaefe205c48c97a/zebra-network/src/peer_set/initialize.rs#L159, store the sender in PeerSet, and return the receiver.
Use the sender in update_metrics in PeerSet.
Store the receiver in SyncStatus as WatchReceiver, and use it in is_close_to_tip.
Test that Zebra does not activate the mempool when it has no peers.
Test that the getblocktemplate RPCs and other users of SyncStatus still work correctly.

Make sure Zebra has enough connections before is_close_to_tip returns the final decision.

What happens if we're using testnet in a box, or we only have a small number of working peers, but we are actually near the tip?
Here are some possible solutions:

use a different minimum for testnet, because it only usually has 5-8 peers in total
check that we're near the previous maximum number of peers (but peers can go down)
check that we're near the estimated tip, based on our local clock (but clocks can be wrong)

What happens if we're using testnet in a box, or we only have a small number of working peers, but we are actually near the tip?

I think checking if Zebra has at least one or two peers before returning a true from is_close_to_tip would be sufficient.

We're making network issues a lower priority for now.

This might add unwanted load to other nodes, so it's worth fixing.

Marek and I had a chat about this ticket. It's not a release blocker, so we're going to update the ticket with a design and a draft branch, and move it out of this sprint.
We can fix it if it ever becomes a problem for users.

I updated the solution in the PR description with implementation details.

We're not making changes this big while the audit is pending

This is actually happening and causing CI failures:

assertion failed: output.stdout_line_contains("activating mempool").is_err()
https://github.com/ZcashFoundation/zebra/actions/runs/3237875279/jobs/5305448541#step:15:520

This might have caused PR #5596 to fail in the merge queue:

Message:  assertion failed: output.stdout_line_contains("activating mempool").is_err()

https://github.com/ZcashFoundation/zebra/actions/runs/3430430965/jobs/5717404168#step:3:226

This doesn't seem to be causing any issues for users?

Can re-open if needed in future


add json for some extended metas

i want to add support for some extended metas and this would speed testing up a bit (perfect_A.json is going to have incremental updates and so i chose a diff based structure, not quite there just yet).

I managed to setup github pages on my end, sorry for getting ahead of myself with this pr. Closing until extended metagames support is ready.


Set targets to the current session.

It may be useful later. It is useful in our internal patched version
of ghcide.

This kind of change is likely to help other Bazel users (eg Digital Asset). Any change of a complete list of changes? I think we'd be happy to figure out the right abstractions that either let you have no patches and instead adjust Options, or perhaps even merge it all.

I don’t think this particular change would help us at Digital Asset, we want to be able to load all of our targets into a single GHCi session so as a general policy we don’t allow colliding module names which means that just searching in the include dirs works fine.
That said, I’m happy for things to be upstreamed but it should be in a somewhat coherent form. For this particular PR I agree with @mpickering that it’s confusing on its own.


[INFRA-288] Update README with systemd config

@kattrali this is a very minimal example. Is this enough?

Yes! This is great! ⭐ :shipit:


Fix build scripts. Remove unused files.

Removing some unused files and making the npm scripts slightly more robust for publishing.

 Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.Kaushik Krishnan seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.You have signed the CLA already but the status is still pending? Let us recheck it.


Update kafka chart to 22.1.3 for kafka 3.4.0

Kafka chart 17.1.0 is already more than one year old. Updating it to the latest so we can also get the latest kafka.
Still default to using zookeeper.
https://github.com/bitnami/charts/pull/16778
We have deployed this version of the chart to an existing cluster in GKE and kafka worked fine afterwards.
The corresponding docker change is in the PR below.
https://github.com/datahub-project/datahub/pull/8161

@david-leifker could you please take a look?

Thanks!


Use vaadin-tabs in navigation

Fixes #19
Also fixes https://cdn.vaadin.com/vaadin-grid/5.1.0-alpha2/demo/#grid-lumo-theme-demos navigation is not automatically scrolled to the correct place.

This change is

Released in https://github.com/vaadin/vaadin-demo-helpers/releases/tag/v2.0.3
Thanks!


[WIP] list files in the vault

List files from the backend (it is still a bogus file list)
Display current vault id in the topbar (as opposed to vault name, which we can expose later)

In the next PR, I would like to:

List real files

To set your current vault, use the following
~/.config/Electron/settings.json
{
    "vault": {
        "lastActiveVaultId": "/home/aviau/obsidian-aviau"
    }
}


[WIP] Update: use <IP_ADDRESS> for metrics host IP

cherry-pick https://github.com/opendatahub-io/opendatahub-operator/pull/430

close it as included in https://github.com/red-hat-data-services/rhods-operator/pull/33


Fundamentals on NextJS

Note: I could not post on spectrum.chat, as it shows "Internal Server Error" while posting. Pardon for posting here in this forum.
I am exploring NextJS and come across few questions.

Where console.log outputs to - server console or browser console.
How React Component Lifecycle methods are different here in nextjs? What methods to be used and what not to be used?
How the React State can be managed on Client side? how this can be done on server side?
Which part of code executes on server side and which part execute on client side?
Please point to any simple example for Login Page end to end working? - on entering userid and password, it updates state on clientside, calls ajax request using fetch on client side and then page refreshes to thank you page after validating on server side.

Please point to these in documentation? Appreciate your help.

Can you try posting it on spectrum again?


fix #94 by adding searchInputAutofocus option

Attempt to fix #94

Hey @MatTheCat,
I think this is close but it has some issues when tabbing back through inputs. Dropdown's aren't closing when they should be:

Closing this as focusing/blurring the input is how Choices determines an active dropdown.


Fix GoChecks pipeline such that it runs on new pull requests

New pull requests are not being checked against the standard suite of go checks.  This issue tracks the fix which ensures this occurs.

Yes, this is solved, we can close 🪄


Fix onsMutuallyExclusive component for jinja2 renderer

Will resolve #543

  caller() is not working correctly when using jinja render engine


[ENHANCEMENT] Add LLVM & version with VC to "Svt[Info]: SVT[build]:"

Is your feature request related to a problem? Please describe.
Considering the big speed differences with different compilers it would be nice to have the information if LLVM was used and which LLVM version for Visual Studio binaries.
Describe the solution you'd like
Svt[info]: -------------------------------------------
Svt[info]: SVT [version]: ...
Svt[info]: SVT [build]  :       Visual Studio 2022 64 bit, Clang 19.1.0
Svt[info]: ...
Svt[info]: -------------------------------------------

Describe alternatives you've considered
I've considered posting this suggestion to the official SVT-AV1 repo, but the -PSY people seem to be very responsive :-)
Additional context
Current output of SVT-AV1-PSY with VC is like this
Svt[info]: -------------------------------------------
Svt[info]: SVT [version]:
Svt[info]: SVT [build]  :       Visual Studio 2022 64 bit
Svt[info]: LIB Build date:
Svt[info]: -------------------------------------------

Current output of SVT-AV1 with MSYS2 is like this
Svt[info]: -------------------------------------------
Svt[info]: SVT [version]:
Svt[info]: SVT [build]  :       Clang 18.1.8     64 bit
Svt[info]: LIB Build date:
Svt[info]: -------------------------------------------

Hey, thanks for the feature request!
We're happy to look into implementing this - before we put any work forward, could you make a feature request on mainline first? This may be something they are interested in implementing, which would save us some work.
If they aren't responsive, we will give this a closer look.


[Webpack Performance Guide] Add notes about webpack 4

What's changed, or what was fixed?

Added a note about webpack 4 compatibility (re: https://github.com/google/WebFundamentals/pull/5798#issuecomment-367990550)

Target Live Date: 2018-02-26

[x] This has been reviewed and approved by (NAME)
[x] I have run gulp test locally and all tests pass.
[ ] I have added the appropriate type-something label.
[x] I've staged the site and manually verified that my content displays correctly.

CC: @petele @addyosmani

(I considered using a caution instead of a note, but that feels warning too much.)

:tada: This has been pushed live to https://developers.google.com/web/