Add the Content-ID header on attachments

This allows developer to reference attachments in the html body to allow
images to be viewed offline.
You can use it as follow:

Where the name-of-the-file.ext part matches the actual file name of the
file. Notice the cid: prefix, which makes it work!
@michael-e I can wait for you to review this. If @brendo or even @creativedutchmen could do it too I would appreciate, since your mail-fu is greater than mine.
I've tested with and without references and everything works.

Can you add some references? I never heard about this, so some specs/articles might be helpful.

<opinionated> Sending all email images as attachments means a crude user experience </opinionated>, and I have not seen that anymore in the last two years or so.
That being said, the feature is defined in the RFC 2392, so it is a standards thingie. Here's some information I found on the web:

https://www.ietf.org/rfc/rfc2392.txt
https://sendgrid.com/blog/embedding-images-emails-facts/
http://mailformat.dan.info/headers/mime.html

But if we implement this, we should do it correctly.

The format should be<EMAIL_ADDRESS>where the domain name is the FQDN of the sending server.
The email process will not know the FQDN of the server (nor will the developer, sometimes). Could we use the domain name instead? (The Email Newsletter Manager, for example, uses Symphony's URL constant as pseudo_root parameter for the background process.)

URL Encoding is needed as well. The RFC describes the process precisely (but provides a wrong example IMHO):
 A "cid" URL is converted to the corresponding Content-ID message
 header [MIME] by removing the "cid:" prefix, converting the % encoded
 character to their equivalent US-ASCII characters, and enclosing the
 remaining parts with an angle bracket pair, "<" and ">".  For
 example<EMAIL_ADDRESS>corresponds to

   Content-ID<EMAIL_ADDRESS>
 Reversing the process and converting URL special characters to their
 % encodings produces the original cid.

(Given the description, I would expect Content-ID<EMAIL_ADDRESS>

Regarding the necessity to URL encode, I don't really understand the RFC. In chapter 2 I read:

Since addr-spec in a Message-ID or Content-ID might contain
characters not allowed within a URL; any such character (including
"/", which is reserved within the "mid" scheme) must be hex-encoded
using the %hh escape mechanism in [URL].

which means that the Content-ID value must also be encoded.
Does anybody understand this?

Sending all email images as attachments means a crude user experience

It makes them works offline. It makes is possible to save the email as a .eml file and have all assets to print it at a later date. It also makes it possible to send image that should not be put online (discoverable) but still display them 'inline'.

So it would be filename.ext@domain ? Using the DOMAIN const would be just fine.
I do not see how the example is bad. Yes the Content-ID can be encoded as well, that's what the example shows :)

But the first text reads that the process starts from the url found in the content (that part is not 100% clear), then removes the cid: part, then % decode the chars, then adds <>, then does the lookup in the headers. So the cid:url in the html may or may not be % encoded, but the header value must be because the lookup will be done that way.
May or may not: This is the tricky part (second excerpt). No relationship between the too values is assumed. Some characters are invalid in URLs. Some characters are invalid in the headers (which may be a different set then in a URL). Having a < in your content-id would screw it up, but can be found in a url, hence you need to % encode it in the header but would not be needed in the template.
Thanks for sharing the ❤  for RFCs. It's written to be able to make a change at one place and the document is still valid.

This will be a bit more complicated. :-)
Regarding the example in the RFC 2392: If you look at the older RFC 2111 you will find exactly what I expected. So what is right? I am not sure, maybe it's indeed a mistake in the newer RFC.

So it would be filename.ext@domain ? Using the DOMAIN const would be just fine.

Yep, probably.
Regarding your pull request: Are you sure that such an "item" still has a Content-Disposition header as well? In the RFC examples, I don't see it. But your PR simply adds a Content-ID header in addition to the Content-Disposition header.
If I had more time, I would surely dive deeper. But at the moment, unfortunately, I can only express my concerns.

So what is right?

Or more like: What's the implementation in the wild ? :P

still has a Content-Disposition header as well?

If the spec does not clearly states that they must not be both present, I do not see a problem.
If you feel like this is risky, we could add it behind a flag. It could be a site wide or local call setting.
I've done much testing and did not broke any client and it worked in my 2007 outlook.
Mail on OS X showed the image inline and as an attachment, while outlook and gmail was only displaying the inline image.

Mail on OS X showed the image inline and as an attachment, while outlook and gmail was only displaying the inline image.

So could you test what happens if you remove the Content-Disposition header? Maybe the file is displayed inline in all clients without showing up as an attachment? (One might double-check this with Spam E-Mails, which also use inline images a lot.)

Will do ASAP.

I'll add a commit to enable it being a flag, to make sure I do not break stuff.

I've added a commit which requires the $file array to have a 'cid' key == true

LGTM. I guess you have tested everything?

@michael-e Yup yup I get Content-ID<EMAIL_ADDRESS>:D

Ah, looking at the code… you have not encoded the filename? Shouldn't this be done? (Forgive me, this disucussion is rather old, so I don't remember all the details.)

Ah damn you are right, I'll do it.

I am not sure. I read all the stuff again, and I still don't get it.

Wait. If at all, it should probably be rawurlencode, because this function does hex encodeing according to RFC 3986.
The problem lies in "if at all". I am definitely not sure about it. I may take another look tomorrow.

BTW, here's a small test to see the main difference between urlencode and rawurlencode:
<?php

$filename = 'foo<EMAIL_ADDRESS>echo urlencode($filename) . PHP_EOL;
echo rawurlencode($filename) . PHP_EOL;

The output is:
foo+bar%40example.com
foo%20bar%40example.com

I spent some time on this.
As a first note, I am no longer sure about the purpose of your latest commit ("Add a flag to enable Content-ID header field"). Doesn't this mean that only programmatic (custom) calls of the mail routines can enable the content-id on attachments? Why?
Apart from that I see several problems here:
Filenames are not unique
You use the filename to create the identifier. But:

A implementation conforming to this specification is required to
support the "mid" URL long form (message-id/content-id).  Conforming
implementations can choose to, but are not required to, take
advantage of the content-id's uniqueness and interpret a "cid" URL to
refer to any body part within the message store.

So content-ids are considered to be unique inside a "message store" (which probably means "all emails you have in your email reader"?). So IMHO using the filename as an identifier is dangerous (and it violates the RFC if you can not guarantee its uniqueness). An email program might refer to a different resource with the same filename.
Still not convinced? You also find this in the metioned RFC:

Both message-id and content-id are required to be globally unique.
That is, no two different messages will ever have the same Message-ID
addr-spec; no different body parts will ever have the same Content-ID
addr-spec.  A common technique used by many message systems is to use
a time and date stamp along with the local host's domain name, e.g.,
<EMAIL_ADDRESS>

RFC is "broken" regarding URL encoding

A "cid" URL is converted to the corresponding Content-ID message
header [MIME] by removing the "cid:" prefix, converting the % encoded
character to their equivalent US-ASCII characters, and enclosing the
remaining parts with an angle bracket pair, "<" and ">".  For
example<EMAIL_ADDRESS>corresponds to

  Content-ID<EMAIL_ADDRESS>
Reversing the process and converting URL special characters to their
% encodings produces the original cid.es that:

IMHO this is a contradiction.
Even if we say that the "Content-ID" line in the above description is a typo, it still contradicts the description of the MID aund CID URL schemes in the same RFC document:

The URLs take the form

  content-id    = url-addr-spec

  message-id    = url-addr-spec

  url-addr-spec = addr-spec  ; URL encoding of RFC 822 addr-spec

  cid-url       = "cid" ":" content-id

  mid-url       = "mid" ":" message-id [ "/" content-id ]

  Notes: In Internet mail messages, the addr-spec in a Content-ID
  [MIME] or Message-ID [822] header is enclosed in angle brackets
  (<>).  Since addr-spec in a Message-ID or Content-ID might contain
  characters not allowed within a URL; any such character (including
  "/", which is reserved within the "mid" scheme) must be hex-encoded
  using the %hh escape mechanism in [URL].

This tells me that addr-spec is already hex-encoded, so why the hell should this be encoded once again to build the CID URL?
What can we do?
Building unique identifiers using (encoded) timestamps and random numbers, as proposed in the RFC and elsewhere on the web (e.g. https://www.jwz.org/doc/mid.html) would solve both problems. (Those IDs wouldn't need any hex-encoding.)
However, I have no idea how this could be implemented. (How would you make the templating process know these identifiers?)
(We might, of course, say that it is the developer's responsibility to only use unique and unproblematic filenames like "950124.162336". But, automating this would require a special upload field or similar. Which would introduce a "secret" dependency.)

And BTW, regarding my comment about the Content-Disposition header: I have only found one example usage of Content-IDs in my emails, an email generated by a big email marketing company. They did not use this header on the image that was referenced:

...

------=_Part_15970192_1253472893.1518182683895
Content-Type: image/png
Content-Transfer-Encoding: base64
Content-ID: <image.1518182640619.1803@146716b4c084892efdd355e0c3b>

This prevented the image from showing up as an attachment below the email body in Mail (MacOS). (You could still use the dropdown menu on top of the email message to save the image.)
So one might consider removing the Content-Disposition header when a Content-ID is added. This needs more example emails and/or testing!

I went ahead and re-read the whole RFC. Like you've said, the RFC does contains an error (the content id should be "oo4%foo1" not "oo4%25foo1". The header does not needs to be % encoded, the html can be % encoded. So the last commit is not usefull at all.
I went ahead and also check other implementations. Microsoft lets you set anything you want https://msdn.microsoft.com/en-us/library/microsoft.exchange.webservices.data.attachment.contentid(v=exchg.80).aspx. From my testing, this was working with Outlook, Apple Mail and gmail, hence my first commit.
Apache generates a random string. https://commons.apache.org/proper/commons-email/userguide.html but pretty hard to use in templates.

How would you make the templating process know these identifiers?

I think this is why nobody ever bothered about it: It does not really needs to be unique in the whole world, just unique in the current email. I think the RFC went too far and nobody ever cared about that fact.

And BTW, regarding my comment about the Content-Disposition header:

I think the developer should have control over this! Let me rebase and get rid of
41f4019 and add a new commit.

After other tests, no mail client seems to bother with duplicate id in different emails.

So in the end, I've decided to:

Keep it simple. The RFC does not seems to describe what's implemented in the wild.
Require dev opt-in. If not, the behavior does not change from 2.7.x.
Let the developer controls both content-id and content-disposition values.
Provide sane and good defaults.

I think that the current state of the PR reflects that.

@michael-e I've fixed the issues in 24786e1. Tell me what you think!

@michael-e are you good here ?

I have only reviewed the code and tested some "standard email functionalities" (simple emails and emails with attachments) which I use in my projects. I have not noticed any change in behaviour.

Great, I've taken care of testing the new behaviour


Strategy Room Error

Map History, Resources History, Consumables history, and Crafting history
will be blank and show this error

edit i'm using https://github.com/dragonjet/KC3Kai/commit/e7718aa0f1612a18d4366b1831060fc95220b3b1

ah this is the same as #612 where the local database is getting an error. will track it there


[BUG] Soul Studio wont load properly just because there's 0 tables in database

Source of problem:
https://github.com/thevahidal/soul/blob/82cf9d42230dfa0ee78d17f3ef4cb3f78922d021/studio/src/routes/%2Bpage.svelte#L26-L29
Potential solution:
Handle empty array.
( copied from https://github.com/thevahidal/soul/issues/94, submitted by https://github.com/HanzCEO )

Hey @IanMayo,
I'm considering a rewrite of Soul Studio with React instead of Svelte, and for that, I'm hesitant to do fixes on the current version.
This one is a simple fix though and if it's a bother to you guys I can fix it.

Hello @thevahidal - no, it's no bother at all to us. I was just trying to ensure the issue didn't fall through the cracks.
Your React strategy sounds fine.


ima: Support signing metadata objects and checkout fs tree validation

Today ostree's IMA signatures supports signing regular file objects.  However, there are holes in this model; classically, IMA alone won't detect e.g. swapping two signed binaries, or replacing one signed binary with an older, insecure version etc.
However, we can implement a model where we do a "structural fsck" from the initramfs.  Assuming that the initramfs is signed and verified (e.g. as part of a Secure Boot flow), then we would (from inside the initramfs):

Load the target commit object
Perform signapi (GPG/builtin ed25519) + content checksum verification of the target commit object or use IMA/fsverity for the commit object directly (it makes total sense to reuse IMA as another commit signature mechanism)
Perform "structural verification"; walk over the target physical rootfs and verify directories and symlinks but not regular file contents

Thinking of directories and symlinks as metadata and regular files as data - we're verifying all metadata up front, and then relying on the dynamic IMA (and future fsverity) signature for all the (much larger) regular files.
This was motivated by this sub-thread https://twitter.com/cgwalters/status/1520465975719645184 and this blog https://0pointer.net/blog/fitting-everything-together.html
Vs dm-verity in particular, I think what we're trading off here is really an echo of the larger picture of ostree-style updates (file based) versus block device updates.  File updates are much, much more flexible and we can do things like deduplicate shared space trivially.  There's not a "hard cap" on disk size beyond which the OS cannot grow, and similarly there's not "unused dead space".
Now that blog says:

I think validation is still at too high a level, since Linux file system developers made very clear their implementations are not robust to rogue images.

But yes, see e.g.: https://lwn.net/Articles/755593/
OTOH, as long as the machine has any persistent Linux filesystems it mounts and reads from the kernel, they could also be exploitable in a similar fashion.  For "offline" AKA "evil maid" attacks, this is hopefully somewhat mitigated by dm-crypt; I suspect it'd be hard to corrupt the rootfs offline in such a way that it would be corrupted exploitably, but I am not aware of much research on this.

I feel like a one time verification is kinda limited. If you truly want to make this safe, then I think you would want a kernel based file system that mounted the commit directly from the repo. That way you will get rid of the hardlink farm with the vulnerable to modification directories.

The primary goal of this is to protect against:

offline/"evil maid" attacks - e.g. someone taking the ssd out of your laptop, injecting malware, and putting it back in.  Similarly, in many IoT cases, the computer may be physically accessible to people who do not own it, and it's desired to harden against this.
"anti persistence" - ensuring that if malicious code gains root privileges on the machine, a reboot would clear it out (and one could do a security update that fixes the bug before starting the vulnerable app e.g. web browser, or before bluetooth is started, etc.)

There's a 3rd related goal:

Enable "code signing enforcement" where the system can be configured such that all code executed as CAP_SYS_ADMIN must have a valid signature.    It also helps protect against accidental damage (ssh'd to the wrong server), a not small problem.

Of these, a one-shot boot time verification I think mainly addresses the first two - particularly anti-persistence.  (There's a lot of details to the offline case though).  I'd agree the "code-signing enforcement" case would in particular would be improved with always-on metadata verification.

I'm experimenting with ostreefs. Lets see how it works.

Initial work here: https://github.com/alexlarsson/ostreefs

Initial work here: https://github.com/alexlarsson/ostreefs

OK, this is a big interesting topic.  This clearly needs a README.md.  I have a ton of thoughts on this; probably the biggest one for me is whether such a thing should really be ostree specific.  Some of the design of ostree's data structures aren't bad, but it's not clear to me that we necessarily need to have the kernel parsing gvariants.  I think there's likely a better, cleaner design for a data structure we could feed to the kernel that could also be shared with other userspace software rather than them having to create ostree gvariants.
There's overlap with https://github.com/giuseppe/composefs/ around this topic.
We need a decision on verification of regular files; I think that's fsverity or IMA.
Related to that topic, I've been increasingly feeling like the "lots of little metadata objects" is not what should canonically live on disk.  If we have the approach of storing an entire commit/dirtree metadata as a single file, then we can also use fsverity on it, from userspace even before loading it to the kernel.
How serious are you about this effort?  Is this a spike/PoC to test things out?

(CC @giuseppe)
So, this repo is just 2 days of work, it doesn't have any docs because I just basically made it work. However, it is also almost feature complete (got some issues with selinux xattrs). It was made mainly as a proof that this is possible, and to show that it can perform well in terms of performance and verification robustness.
I will spend a few more days on it to "productize" it, but its not like I've decided as "the way" things should work. Its just that I really like the elegant simplicity of both dm-verity and the ostree repo format, but I feel that a lot of these other solutions, like IMA policies and "verify at boot" are inelegant hacks that are hard to reason about (in terms of security).
As for composefs, I'm very well aware of that, and used it liberally for inspiration (ie. copied large chunks) when writing ostreefs. However, for this case I'm not sure that It is a better solution. If you want to keep the ostree repo ideas working more or less as is (rather than moving to a more image-like model) you'd then have to replace the ostree checkout phase with a "create a composefs for this commit" kind of operation. This step is unnecessary for ostreefs. Composefs also produces a larger file that has to be read in its entirety on each boot, even if not all of it is used immediately.
Another nice thing about ostreefs is that the entire directory/metadata structure is cryptographically sealed from the mount option (commit id). No data from disk is parsed or even looked at before its digest it has been recursively verified all the way back to the commit id. Composefs has no built in verification, but as you say, it could be verified with e.g. fs-verity. However, that doesn't protect against the composefs file being replaced with a different fs-verity:ed file. You would need to pre-compute the composefs file on the build host and put its fs-verity digest into the (signed) commit for this to be trustworthy.
As for the individual file validation, this is really a multi-part question. First of all. What kind of digest is used. The default IMA digest is a full-file hash, which requires you to read and hash each file in full each time you open it. This is not great for things like glibc, where maybe only parts are needed but its used a lot. I think the merkle tree of fs-verity is a clear winner here, as we only require validation of the parts being read as they are used.
The second question is how we should do the validation of the digest. It will eventually be possible to make IMA use fs-verify, which makes that one option. But even if that is possible, I feel like this is only part of the solution. How can we guarantee that each file in the object dir has the right IMA xattrs? Its feels like selinux style scattered xattrs and complex global rulesets are gonna make this hard to understand, reason about and verify.
A much simpler solution would be to use fs-verity for the regular files on disk, but somehow encode the fs-verity digest in the dirtree objects (or equivalent). Then ostreefs (or composefs/whateverfs) could verify this digest (possibly hashed with the stat data) before chaining to the backing file. This model is much easier to understand and reason about. Basically we tie everything cryptographically (like an image) to the commit id (which is generated at the build host), and don't rely on complex rules and marking individual files.

I will spend a few more days on it to "productize" it, but its not like I've decided as "the way" things should work. Its just that I really like the elegant simplicity of both dm-verity and the ostree repo format, but I feel that a lot of these other solutions, like IMA policies and "verify at boot" are inelegant hacks that are hard to reason about (in terms of security).

I am not sure about "composefs" being "the way" as well, I've just used what maps better to the metadata used by eStargz and zstd:chunked.  We could probably come up with a compromise since the long-term goal is to use the SHA checksum of the file payload (similar to what ostree does) instead of a file path.  I like the idea of using fs-verity so we will have only to worry about the dir object.

I just want to say thanks so much for diving into this!  I certainly agree that a single pass verification at boot is suboptimal compared to continuous verification.

somehow encode the fs-verity digest in the dirtree objects (or equivalent).

The ostree data model has no convenient space to add new things (kind of by design because extensibility and reproducibility can conflict).  My offhand thought is that we can stick fsverity trees inside a magical ostree.fsverity xattr.  This xattr would client side be unpacked and attached to file via ioctl(FS_IOC_ENABLE_VERITY).  A tricky aspect here is that if we do this, then the fsverity tree itself becomes part of the ostree object sha256...which is not wrong, but then in order to have ostree fsck work we'd need to use FS_IOC_READ_VERITY_METADATA to get it back out (and that process needs to be bit-for-bit, which I think it is).

How can we guarantee that each file in the object dir has the right IMA xattrs?

Yes, this problem is related to why EVM was created on top of IMA; as we touch on in the ostree ima docs I think EVM is oriented towards machine-local signatures, but I think nothing blocks using EVM portable signatures.  I just didn't get to testing it.
Personally...I wish fsverity had supported a model where the xattrs are also immutable and part of the signature, along with the file modes too.  I honestly just think it's broken that one can make a fsverity file setuid i.e. chmod u+s for example without any problem.  I guess we can try to push for adding this as an opt-in thing.
For now though my thinking is that we live with the model that IMA and fsverity provide around solely providing integrity for file contents, and think of everything else (directories, symlinks, file modes, xattrs) as metadata needs a separate integrity model.

Ok, after some issues with kernel ASAN last week I'm almost ok with the current state of ostreefs in terms of matching  current non-verifying behaviour. The one maintaining issues (other than more testing and docs) is that for some  reason  selinux refuses to  read the selinux context from the xattrs.
However, I belive that is fixable, so I've been thinking a bit about the next step, continuous verification. This will be a two step thing. First we look at what we can do with what we currently have, and then step two is  making minor changes to the ostree format to make this perform better.
For this, lets take a step back and reason from first principles. The chain of trust starts from the commit id on the mount commandline, and from this we can (cheaply) recursively verify the the contents of the .dirtree and .dirmeta file until we reach a regular file. All we know about this file is the file object id, which is computed like this:
header = file_header(uid, gid, mode, symlink_target, xattrs)
content = read_file()
object_id = sha256(concat(header, content))

So, lets say we're given such an object_id from a (verified) dirtree, and we want to verify that the file on disk matches this. We can easily reconstruct header, and if we do that we can keep using that data for the lifetime of  the inode, so later changes on disk are unimportant. From this we can compute a object_id by reading the entire file and computing the hash.
However, such a verification is no guarantee that the file doesn't later change. But, assuming that when writing the repository we enabled fs-verity on the .file objects, then we could read back the verify checksum before doing the sha256 of the file contents. And given a verity csum if the sha256 hashes match, then we can trust this file, because the kernel makes it read-only and verifies on reads that it didn't change from the previously hashed content. We can even close the file as long as we store the verify digest in the in-memory inode and re-verify it next time we use the file.
This may sound lame, but actually it isn't really much worse than what non-fsverity IMA would give, as it also does a full-content validation on open. And this is without changing anything in ostree other than enabling fs-verity on the file objects in the repo.
So, next step is to add optional stuff to ostree to make this perfom better. Here we can't really put anything in the xattr of the file object, because we can't trust that. The only thing we trust is the dirtree, as that we verify its contents by sha256.
I propose that we add an ostree.alt_file_digests, which contains an array of sha256 digests, of the same length as the file array in the dirtree, and with matching order. Basically, if element N of the files list has a filename and a object_id, then element N of the alt-file-digests array has an alternative object_id for the file, which is computed like this:
header = file_header(uid, gid, mode, symlink_target, xattrs)
content = read_file()
alt_object_id = sha256(concat(header, fs-verity-checksum(content))

If this is available in the dirtree when looking up the child, then we have a trusted version of the verity checksum, and we can avoid the slow sha256 checksum of the entire file  and just compare it with the on-disk verity checksum.
This should give us full performance, at a slight increase in dirtree size.
It is additionally interesting in this setup that we don't actually need to have the file attributes applied to the on-disk repository objects. Instead we can use bare-user mode repos and avoid e.g. setuid files on disk (they will only be setuid in the mount).
Opinions?

In the above model we would still apply file xattrs to the backing files for file objects. The only thing that ends up in the directory xattr metadata is the alternative object id/digest. However, I agree that this is technically not really necessary, and in fact slightly risky. A better approach is probably starting with a bare-user mode repo, where all the per-file metadata (uid,gid,mode,xattr) is in a single xattr, making it easy to read in and validate its hash.

Also, it seems it should be easy to "upgrade" a bare repo to bare-user repo by just iterating over all files and add the ostree.usermeta xattr. Right?

But, assuming reflink support, we can pretty cheaply convert in-place to whatever we want by creating a new inode that just shares storage.

This is where the kernel supports hits us bad actually. fs-verity support is available on ext4 and btrfs, while reflink on xfs and btrfs, meaning the combined support is btrfs only. I wonder if we could use the fs-verity general code from the ostreefs code and use it ourselves to implement support independent of the backing filesystem.

Mike snitzer pointed me to this repo. This looks like very interesting piece of work. Trying to understand what does it do. Descriptions seems to suggest that it will verify checksums of the objects. I am wondering what makes sure that these checksums themselves are not modified.

@rhvgoyal The root of trust is the commit id, which is a sha256 digest. It gets passed in on the kernel command line. It is used to load the commit object (named by digest). The commit objects contains the digest of the root directory file, which we load and verify, it then contains references to other directory objects by digest, which are similarly verified.
Eventually we end up with a "leaf" regular file object. The exact way to verify those is what is being discussed now.

Oops, I think I might have commented on wrong thread. I wanted to ask this question in the context of ostreefs, instead. Sorry about that.

@rhvgoyal In the "regular" approach the directory metadata references the file by a digest of the metadata + file context. We can validate that, but it has weaknesses, see the README in the ostreefs repo.

This is where the kernel supports hits us bad actually. fs-verity support is available on ext4 and btrfs, while reflink on xfs and btrfs, meaning the combined support is btrfs only. I wonder if we could use the fs-verity general code from the ostreefs code and use it ourselves to implement support independent of the backing filesystem.

Hmmmm.  I think a key advantage of fsverity (AIUI) is that it's integrated with the underlying filesystem, and in particular compared to IMA this means that it's integrated with the page cache.  See the last section in https://docs.kernel.org/filesystems/fsverity.html "Q: Why is anything filesystem-specific at all? Shouldn’t fs-verity be implemented entirely at the VFS level?"


Double the amount of allowed time for a pod to be ready

from 60 seconds to now 120 seconds
See #2291

Ike Plugins (test-keeper)
Thank you @kwk for this contribution!

It appears that no tests have been added or updated in this PR.
Automated tests give us confidence in shipping reliable software. Please add some as part of this change.
If you are an admin or the reviewer of this PR and you are sure that no test is needed then you can use the command /ok-without-tests as a comment to make the status green.
For more information please head over to official documentation. You can find there how to configure the plugin.


[Deliver] cannot set price

When upload app having this error after upload screenshot
INFO [2017-12-28 16:37:15.27]: Successfully uploaded screenshots to iTunes Connect
INFO [2017-12-28 16:37:17.00]: <?xml version="1.0" encoding="UTF-8"?>
<String>There is no route for the path 'apps/ID_APP/pricing'.</String>

WARN [2017-12-28 16:37:17.00]: Lane Context:
INFO [2017-12-28 16:37:17.00]: {:DEFAULT_PLATFORM=>:ios, :PLATFORM_NAME=>:ios, :LANE_NAME=>"ios release", :SIGH_PROFILE_TYPE=>"app-store", :MATCH_PROVISIONING_PROFILE_MAPPING=>{"xxx =>"xxx, "xxx"=>"match AppStore xxx}, :IPA_OUTPUT_PATH=>"/Users/Shared/Home/workspace/tmp/Api/FSShop.ipa", :DSYM_OUTPUT_PATH=>"/Users/Shared/Home/workspace/tmp/Api/FSShop.app.dSYM.zip", :XCODEBUILD_ARCHIVE=>"/Users/Shared/Library/Developer/Xcode/Archives/2017-12-28/FSShop 2017-12-28 16.24.00.xcarchive", :SNAPSHOT_SCREENSHOTS_PATH=>"/Users/Shared/Home/workspace/tmp/Api/fastlane/screenshots"}
INFO [2017-12-28 16:37:17.00]: Successfully generated documentation at path '/Users/Shared/Home/workspace/tmp/Api/fastlane/README.md'

same issue here. started happening yesterday.
I'm currently using :
price_tier: 0

I have the same issue.

The issue was introduced in release 2.71.0.
I just backdated to release 2.70.3 and everything works as expected again.
@filograno  @GandjaFuzz @KrauseFx
I suggest backdating to get around this issue until further notice.


Get SGX_ERROR_INVALID_PARAMETER when Calling sgx_get_quote()

I'm a newbee in rust and sgx.  When I'm writing some toy examples for sgx_get_quote() in the simulation mode, I meet some problems that I can't solve.
In my main.rs file, I define some extern C function:
extern "C" {
    pub fn sgx_init_quote(p_target_info: *mut sgx_target_info_t, p_gid: *mut sgx_epid_group_id_t) -> sgx_status_t;

    pub fn sgx_calc_quote_size(p_sig_rl: *const uint8_t, sig_rl_size: uint32_t, p_quote_size: *mut uint32_t) -> sgx_status_t;

    pub fn sgx_get_quote(p_report: *const sgx_report_t, quote_type: sgx_quote_sign_type_t,
                         p_spid: *const sgx_spid_t, p_nonce: *const sgx_quote_nonce_t, p_sig_rl: *const uint8_t,
                         sig_rl_size: uint32_t, p_qe_report: *mut sgx_report_t, p_quote: *mut sgx_quote_t,
                         quote_size: uint32_t) -> sgx_status_t;
}

Then I initialize some paramters to call these functions:
   let mut target_info = sgx_target_info_t::default();
    let mut gid = sgx_epid_group_id_t::default();
    let status = unsafe { sgx_init_quote(&mut target_info, &mut gid) };
    if status != sgx_status_t::SGX_SUCCESS {
        println!("[-] Get error when get_init_quote, {}", status.as_str());
        return;
    }
    println!("SGX_INIT_QUOTE SUCCESS!");

    let mut quote_size: u32 = 0;
    let status = unsafe { sgx_calc_quote_size(std::ptr::null(), 0, &mut quote_size) };
    if status != sgx_status_t::SGX_SUCCESS {
        println!("[-] Get error when sgx_calc_quote_size, {}", status.as_str());
        return;
    }
    println!("SGX_calc_quote_size SUCCESS!");

    let spid = sgx_spid_t::default();
    let mut report = sgx_report_t::default();
    let mut the_quote = vec![0u8; quote_size as usize].into_boxed_slice();

    let status = unsafe {
        sgx_get_quote(&report,
                      sgx_quote_sign_type_t::SGX_UNLINKABLE_SIGNATURE,
                      &spid,
                      std::ptr::null(),
                      std::ptr::null(),
                      0,
                      std::ptr::null_mut(),
                      the_quote.as_mut_ptr() as *mut sgx_quote_t,
                      quote_size,
        )
    };
    if status != sgx_status_t::SGX_SUCCESS {
        println!("[-] Get error when sgx_get_quote, {}", status.as_str());
        return;
    }
    println!("SGX_GET_QUOTE SUCCESS!");

The results show that I can call sgx_init_quote() and sgx_calc_quote_size() successfully. But when I call sgx_get_quote(), it returns internal error "SGX_ERROR_INVALID_PARAMETER". I'm really confused of it because I set it as default value.
The following is the result:

Please look closer into Intel's manual:
https://download.01.org/intel-sgx/sgx-linux/2.7.1/docs/Intel_SGX_Developer_Reference_Linux_2.7.1_Open_Source.pdf
sgx_get_quote is on page 163-165.
at the bottom of page 165, intel writes clearly:

Library: Requirements - libsgx_epid.so or libsgx_uae_service_sim.so (simulation)

these two requirements (two general linux shared object), as well as the name of "uae_service) both indicate that this function can only be called in the untrusted app. you cannot call it in the enclave.
you can look into the mutual-ra enclave sample to see how to generate a quote:
https://github.com/apache/incubator-teaclave-sgx-sdk/blob/master/samplecode/mutual-ra/enclave/src/lib.rs#L373


Reindex ES directly from UI

From some conversations with users, plus having to ask usually to reindex data, it would be interesting to have a quick way to get this done via the UI.
We could prepare an endpoint that runs the DAG from Airflow REST by passing which elements to clean, and if we need to recreate the indexes or not.

@pmbrull planning on doing it directly from backend.

@mohitdeuex it would be good to have this with in the backend instead of a pipeline deployment. We have all the logic in the backend we can reuse and list each entity to index them.
We should use bulk api of ES to do this.


A question about starting hour

Hi,
thank you for your work, i really like it!!  🙂
I have a question, is there a way to start everyday at 07.00 and stop at 23.00 regardless the actual hour?
Thank you
Giobuc

Glad you like the card 🙂
The answer is: sort of. You cannot show past forecasts, since the underlying entity won't provide that information. But if you are ok with showing whatever the next 07.00-23.00 block is (e.g. today if it's before 07.00, or tomorrow if it's after 07.00), then you could do this with templates:
# Use this template for the `offset` config field
{% set now_hour = now().hour %}
{% set offset = (7 - now_hour) | abs %}
{{ offset }}

Then num_segments would be 16.
You could also consider showing 07.00 or now, depending on whether it's before or after 07.00. If you want to do that, the template gets slightly more complex:
# For `offset`:
{% set now_hour = now().hour %}
{% set offset = max((7 - now_hour), 0) %}
{{ offset }}

# For `num_segments`:
{% set now_hour = now().hour %}
{% set num_segments = 23 - max(now_hour, 7) %}
{{ num_segments }}

Hope this helps.


On non-public servers (e.g. localhost), The default user icons are invisible.

Gravater icons are available. However, on non-public servers (e.g. localhost), the icons of users who are not registered to Gravater or who are not logged in to the wiki are invisible.
It should be possible to disable the use of the Gravater icons in the LocalSettings.php.

Yes indeed! #15 is merged in.


Refactor Code

AS A marketing agency
I WANT a codebase that follows accessibility standards
SO THAT our own site is optimized for search engines
GIVEN a webpage meets accessibility standards

[x] WHEN I view the source code, THEN I find semantic HTML elements
[x] WHEN I view the structure of the HTML elements, THEN I find that the elements follow a logical structure independent of styling and positioning
[x] WHEN I view the image elements, THEN I find accessible alt attributes
[ ] WHEN I view the heading attributes, THEN they fall in sequential order
[x] WHEN I view the title element, THEN I find a concise, descriptive title

GitHub pages: https://areas-boot-camp.github.io/challenge-1-code-refactor/Develop/

Module 1 details https://courses.bootcampspot.com/courses/2188/assignments/38643?module_item_id=747902

May want to merge work to main


Add a Docker build CI step to reduce action build times

Using a pre-built container speeds up our builds and makes the base application more reproducible. Pushing this build to a container registry ensures we can achieve this.

Another potential solution here would be adopting a faster resolver such as uv, this may be a great option since uv does support a dependency lockfile which makes it easy for us to ensure the dependencies we use are the ones being deployed.


support for STRs in the Genotypes class

so that we can use the data module within the simulation framework
we already have unofficial support for this in that the data np.array can have dtype np.uint8 instead of np.bool_ as of 9d8fc06c
but currently we encode the ALT allele there, and instead we'll want to encode a count of the number of repeat units
I think we can put that functionality into a new method: convert_STRs() whose purpose is to convert STR entries in the data array into a count of the number of repeat units
and then we can store the REF/ALT alleles somewhere else (potentially in a new property?)
also, we should probably add a column to the variants np.array denoting the type of variant: SNP, STR, SV, indel, etc.

also TODO: consider whether we should use something larger than np.uint8
I'm guessing we probably should

I originally created this issue to handle genotype files in which there's a mix of SNPs and STRs, like our 1000G reference panel.
A presumably more common situation is one in which the STRs live in a different file than the SNPs. So how would we handle that within the Genotypes class?
Well, I'm inclined to change nothing except to add a new classmethod merge() which can merge Genotypes objects with each other. That way, we can merge the Genotypes we get from a SNP file with the Genotypes from an STR file and obtain a single Genotypes class containing both of them

closing in favor of https://github.com/CAST-genomics/haptools/issues/73


Add in way to handle synonyms

Jira link
https://transformuk.atlassian.net/browse/HOTT-4489
What?
This is a way of adding synonyms into the training data when generating the model. It will come after the search references and enrich the data so when we allow the model against the querying we have more data to match to commodity numbers

Going to close this and review later based on the accuracy benchmarking stuff


Fix docs. The ability to connect outgoing messages.

Fix docs. The ability to connect outgoing messages.

Looks great!


Extend Andor iDus/DU camera driver

This PR significantly extends the capabilities of the Andor iDus camera driver. A fairly large part of the SDK is now covered.
Since the central data parameter, ccd_data, is dynamic in that it returns different shapes of arrays depending on the acqusition and read modes, I dropped the spectrum moniker. However, this also means that backwards compatibility is broken. If this is something we want to avoid, one could add a DelegateParameter that issues a deprecation warning when called.
To Do

[ ] Test hardware triggering
Deferred to a later point in time.
[x] acquired_pixels needs to be aware of downsampling that, e.g., image mode performs.
[ ] acquisition in kinetics mode with the cosmic ray filter turned on errors.
This seems to be a camera feature, so users should handle it.

Missing Features / Needs testing

[x] Live stream of the CCD data using the run till abort mode. This requires some async work, but would be nice to have since taking a single picture at a time (1 or 2d) has quite a lot of communication overhead, meaning the fastest update rate I could achieve was ~200 ms.
[ ] Shutter modes (feature not available on our camera)
[ ] More real-time filter modes (feature not available on our camera)

I think this is ready to go for now. I'll postpone work on hardware triggers until I have more time.
Do we add a newspiece here in this repo as well?


UnicodeDecodeError: 'ascii' codec can't decode byte 0xe9 in position 12: ordinal not in range(128)

Hi,
Since a few days, I can't get subliminal to download anything.
I don't understand why, as I didn't changed anything, but I got that :
Traceback (most recent call last):
File "/usr/bin/subliminal", line 5, in
pkg_resources.run_script('subliminal==0.6.3', 'subliminal')
File "/usr/lib64/python2.7/site-packages/pkg_resources.py", line 500, in run_script
self.require(requires)[0].run_script(script_name, ns)
File "/usr/lib64/python2.7/site-packages/pkg_resources.py", line 1236, in run_script
execfile(script_filename, namespace, namespace)
File "/usr/lib64/python2.7/site-packages/subliminal-0.6.3-py2.7.egg/EGG-INFO/scripts/subliminal", line 99, in
main()
File "/usr/lib64/python2.7/site-packages/subliminal-0.6.3-py2.7.egg/EGG-INFO/scripts/subliminal", line 83, in main
force=args.force, multi=args.multi, scan_filter=scan_filter)
File "/usr/lib64/python2.7/site-packages/subliminal-0.6.3-py2.7.egg/subliminal/async.py", line 134, in download_subtitles
subtitles_by_video = self.list_subtitles(paths, languages, services, force, multi, cache_dir, max_depth, scan_filter)
File "/usr/lib64/python2.7/site-packages/subliminal-0.6.3-py2.7.egg/subliminal/async.py", line 120, in list_subtitles
tasks = create_list_tasks(paths, languages, services, force, multi, cache_dir, max_depth, scan_filter)
File "/usr/lib64/python2.7/site-packages/subliminal-0.6.3-py2.7.egg/subliminal/core.py", line 57, in create_list_tasks
scan_result.extend(scan(p, max_depth, scan_filter))
File "/usr/lib64/python2.7/site-packages/subliminal-0.6.3-py2.7.egg/subliminal/videos.py", line 233, in scan
return [(video, video.scan())]
File "/usr/lib64/python2.7/site-packages/subliminal-0.6.3-py2.7.egg/subliminal/videos.py", line 140, in scan
existing = [f for f in os.listdir(folder) if f.startswith(basename)]
UnicodeDecodeError: 'ascii' codec can't decode byte 0xe9 in position 12: ordinal not in range(128)
That's not the usual unicode problem, that's actually located in an other file.
I have tried to pull the latest version, but it does the same.

Do you have a properly configured locale?
http://stackoverflow.com/a/10563157/4169615


Tasmota variation - unknown state doesnt work

hey there, I just got everything setup and it works with the tasmota variation, except when the d1 mini goes offline, HA reports the state as unknown and the garage door never closes.  Is there a way to fix that?
Thanks
Jason

If your device shows as unknown, you may need to change the 'unavailable' in the blueprint to 'unknown'.
It shows up in 2 places.
trigger:
  - platform: state
    entity_id: !input car_presence
    to: 'on'
  - platform: state
    entity_id: !input car_presence
    to: 'unavailable'
    for:
      minutes: 1

AND
      - conditions:
          - condition: state
            entity_id: !input car_presence
            state: 'unavailable'
          - condition: state
            entity_id: !input garage_door
            state: open


🐞 - paddings in MultiSelectGroups with lable

Playground Link
https://stackblitz.com/edit/angular-nkjfa2-buexsz?file=src%2Fapp%2Fapp.component.html
Description
The first group has padding in the labeled multiselect, but the next group does not.

Angular version
12.2.17
Taiga UI version
3.37.0
Which browsers have you used?

[X] Chrome
[ ] Firefox
[ ] Safari
[ ] Edge

Which operating systems have you used?

[ ] macOS
[X] Windows
[ ] Linux
[ ] iOS
[ ] Android

@RandyVegas I am up for it


net/http: http.ListenAndServeTLS lowercasing request header keys

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go version go1.6.2 darwin/amd64

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN="/Users/dean/.go/bin"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/dean/.go"
GORACE=""
GOROOT="/usr/local/Cellar/go/1.6.2/libexec"
GOTOOLDIR="/usr/local/Cellar/go/1.6.2/libexec/pkg/tool/darwin_amd64"
GO15VENDOREXPERIMENT="1"
CC="clang"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fno-common"
CXX="clang++"
CGO_ENABLED="1"

What did you do?

unfortunately I could not make a runnable example, a valid SSL Certificate seems to be needed to recreate this issue, using:
tr := &http.Transport{
	TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
}

client := &http.Client{Transport: tr}

or

tlsConfig := &tls.Config{
	Certificates: make([]tls.Certificate, 1),
}

tlsConfig.Certificates[0], err = tls.X509KeyPair([]byte(httpPem), []byte(httpKey))
if err != nil {
	log.Fatal(err)
}
server = &http.Server{Addr: port, Handler: handler, TLSConfig: tlsConfig}
server.ListenAndServeTLS("","")

the issue does not occur, only using the http.ListenAndServerTLS that I could find so far. below is what causes the issue (need to use your own Cretificates + URL.
package main

import (
	"errors"
	"fmt"
	"log"
	"net/http"
	"time"
)

func main() {
	go server()

	time.Sleep(3000)

	req, err := http.NewRequest("GET", "https://localhost:8080", nil)
	if err != nil {
		log.Fatal(errors.New("Error Creating Request:" + err.Error()))
	}

	req.Header.Set("UPDATE_API_KEY", "Efewfjnewjkfewjkfew")

	// tr := &http.Transport{
	// 	TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
	// }

	// client := &http.Client{Transport: tr}

	// This issue is very specific, using the code above actually works as expected
	client := &http.Client{}

	_, err = client.Do(req)
	if err != nil {
		log.Fatal(fmt.Sprint("ERROR Fetching Updates:", err))
	}
}

func server() {

	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		log.Println(r.Header)
	})

	http.ListenAndServeTLS(":8080", "path to certFile", "path to keyFile", handler)
}

Go 1.6 does not have this issue, either patch 1.6.1 or 1.6.2 caused this.

What did you expect to see?

map[User-Agent:[Go-http-client/1.1] UPDATE_API_KEY:[Efewfjnewjkfewjkfew] Accept-Encoding:[gzip]]

map key of "UPDATE_API_KEY" is correct

What did you see instead?

map[Accept-Encoding:[gzip] User-Agent:[Go-http-client/2.0] update_api_key:[Efewfjnewjkfewjkfew]]

map key of "update_api_key" is not correct

The difference is HTTP/2. With HTTP/2, all header fields must be sent lowercase, mandated by the spec. In HTTP/1 any case is allowed, and they should be compared case-insensitively.
Go tries to map things into their Go-canonical form via https://golang.org/pkg/net/http/#CanonicalHeaderKey but because it has an underscore in it, Go does nothing (but fixed in Go 1.7).
I'd recommend using a hyphen instead of an underscore if possible. Otherwise you'll have to enumerate over the map keys looking for the "UpDaTE_api_KEY" yourself, normalizing the case of the keys as you look.

Btw, b24c6fbfb3303f994ea8adfdf68436d95d2f841b (issue #13767) was the commit which fixed this. It will be included in Go 1.7.

Thanks 👍


Sheet protect and background color cells

Hi guys,
i have a problem with sheetJs.
I have a sheet protected but some cells are editable (with editable: true).
I can edit these cell but can't edit the background color.
How can I solve?
Thank you all.

If this is an issue related to a Pro build, please email<EMAIL_ADDRESS>If not, the question does not make sense.  editable: true is only used in the context of HTML tables


[Timeline] Add the functionality of expanding and shrinking

Duplicates

[X] I have searched the existing issues

Latest version

[X] I have tested the latest version

Summary 💡
The functionality of expanding and shrinking the timeline component would be useful.
Examples 🌈
In shrunken state the timeline can e.g. only show the latest 3 items and when hovering, it animates to show the full timeline.
Motivation 🔦
I want to show only the lastest event but give the the user the possibility to see the full history of events, while hiding it when the user does not need it, to save screen space

I added a "waiting for upvotes" label. Let's wait to see if the other community members would love this functionality too.


does boxbilling support php 7.0 and mysql 5.7?

I can not install boxbilling 4.18 nor 4.20 under Debian 9 (mysql community and php 7.0).
does boxbilling support php 7.0 and mysql 5.7? no error message on logs (access_log nor error_log )
mysql --version
mysql  Ver 14.14 Distrib 5.7.19, for Linux (x86_64) using  EditLine wrapper
php --version
PHP 7.0.19-1 (cli) (built: May 11 2017 14:04:47) ( NTS )
Copyright (c) 1997-2017 The PHP Group
Zend Engine v3.0.0, Copyright (c) 1998-2017 Zend Technologies
with Zend OPcache v7.0.19-1, Copyright (c) 1999-2017, by Zend Technologies
apt-get install php7.0-mcrypt php7.0-curl php7.0-gettext php7.0-mysql
Reading package lists... Done
Building dependency tree
Reading state information... Done
Note, selecting 'php7.0-common' instead of 'php7.0-gettext'
Thank you

Check out my answer: https://github.com/boxbilling/boxbilling/issues/474#issuecomment-291483755
Maybe it can help you

Thank you Eiskaltereistee, I'll try your code...
I close this issue.


Metaclass handling

Right now a metaclass declaration will lead to either an error like ERROR: 'test:FooMeta' has no slots, but it could have. if it doesn't declare slots or an exception like the following being raised if it does declare __slots__:
Traceback (most recent call last):
  File "C:\Users\Lucina\.pyenv\pyenv-win\versions\3.10.6\lib\runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "C:\Users\Lucina\.pyenv\pyenv-win\versions\3.10.6\lib\runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "C:\Users\Lucina\Documents\VSC\Alluka\venv\lib\site-packages\slotscheck\__main__.py", line 4, in <module>
    root()
  File "C:\Users\Lucina\Documents\VSC\Alluka\venv\lib\site-packages\click\core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  File "C:\Users\Lucina\Documents\VSC\Alluka\venv\lib\site-packages\click\core.py", line 1055, in main
    rv = self.invoke(ctx)
  File "C:\Users\Lucina\Documents\VSC\Alluka\venv\lib\site-packages\click\core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "C:\Users\Lucina\Documents\VSC\Alluka\venv\lib\site-packages\click\core.py", line 760, in invoke
    return __callback(*args, **kwargs)
  File "C:\Users\Lucina\Documents\VSC\Alluka\venv\lib\site-packages\slotscheck\cli.py", line 201, in root
    messages = list(
  File "C:\Users\Lucina\Documents\VSC\Alluka\venv\lib\site-packages\slotscheck\cli.py", line 548, in slot_messages
    if slots_overlap(c):
  File "C:\Users\Lucina\Documents\VSC\Alluka\venv\lib\site-packages\slotscheck\checks.py", line 34, in slots_overlap
    for ancestor in c.mro()[1:]:
TypeError: unbound method type.mro() needs an argument

with the code this was run over being
class FooMeta(type):
    __slots__ = ()

class Foo(metaclass=FooMeta):
    __slots__ = ()

(where FooMeta is the meta class and v0.14.1 of slotscheck was used)

Great find! I'll have a look at this later, or you can submit a fix yourself if you like 🙂


Push the solution of 'Pixel align subpass textures' to stable

Use case
there have to be many flutter devs who can't use Flutter 3.22.1 due to the following status of issues.
============
[Impeller] Distorted text in Cupertino dialog #148588
which is related to:
[Impeller] Pixel align subpass textures. #52973
The solution for the issue above is pushed into
Flutter 3.22.0-43.0.pre.3
Which also contains the error of:
[ERROR:flutter/lib/ui/painting/image_encoding.cc(215)] Could not convert raster image to PNG.
Which also exist in the latest master:
Flutter 3.23.0-12.0.pre
============
Proposal
Yes, this has to be provided by Flutter. It's more or less a push request.

[Impeller] Distorted text in Cupertino dialog #148588

@Schefferbird This is fixed and should be available in master version.

[Impeller] Pixel align subpass textures. #52973

This is very old issue so not sure if it is relevant.

Which also contains the error of:
[ERROR:flutter/lib/ui/painting/image_encoding.cc(215)] Could not convert raster image to PNG.

This is duplicate of https://github.com/flutter/flutter/issues/148851 in which I see you have already commented. Please follow-up in the linked issue for further updates. I'll close this issue as duplicate. If you disagree, write in comments and I'll reopen it.
If your ask is to push the fixes to stable, then please read about https://github.com/flutter/flutter/blob/master/docs/releases/Flutter-build-release-channels.md
If the fix in master is a low-risk then it is hotfixed to stable, otherwise they all get in stable in quarterly releases.

The relevance is that I can't use 3.22.0-1 due to the issue [Impeller] Distorted text in Cupertino dialog (https://github.com/flutter/flutter/issues/148588). And even if there is a solution in Flutter 3.22.0-43.0.pre.3 I cant use that because of [Impeller][regression] image.toByteData fails to convert raster image to PNG (https://github.com/flutter/flutter/issues/148851) is not solved. The app totally breaks down due to this issue. And to wait a quarter for as an important issue as dialog text is not displayed correctly is quite a drawback.


Explain why we had to avoid bulk insert + django + transaction

https://github.com/opencivicdata/python-opencivicdata-django/commit/2b86baeda9914bf682728c83dd169099628d6c11
Something about the pseduo-upsert we did made Django sad. We shoud be able to explain this, and eventually file a bug / fix with Django.

This is a pretty awesome heisenbug; if someone wants something to dig into, this is a fun one.

anyone know best way to reproduce this?  I'd like to check if it is still happening in Django 1.9

@paultag do you remember how to reproduce this?

@jamesturk Shall we optimistically try reverting that commit?

Yeah, glad to give it a try soon but if you wind up in there feel free to
go for it.
On Mon, Feb 20, 2017 at 9:35 PM, James McKinney<EMAIL_ADDRESS>wrote:

@jamesturk https://github.com/jamesturk Shall we optimistically try
reverting that commit?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/opencivicdata/python-opencivicdata-django/issues/28#issuecomment-281228791,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAAfYj_v6N1jwZ9uawJ17ODPijCsZYfkks5rek1bgaJpZM4DnGay
.


Make Check your email (Forgot password) screen to full screen

Make it similar to Eventbrite.

i want to work o this issue

@hrprt96 confirm with @liveHarshit if he is not working on the same issue

Working on it. @hrprt96

@hrprt96 You can work on this.
I'm not working it for now.

@jmig5776 Go ahead.

@liveHarshit Kindly Review it.

@liveHarshit Can I work on this issue ?

Ask @jmig5776 , Because PR is already there.

@jmig5776 Can I take up this issue, or you are still working on it ?

Thanks @jmig5776


What is the extension to be deployed in the suggested registry key?

There are two possible extension to Google Chrome for a device policy: Windows Accounts or Office.  What is the extension that will be deployed if I use the registry key suggested on the page?

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: 625bb1b2-81fd-9804-c0b5-3cd2904decd9
Version Independent ID: e4468b05-200e-24ae-75e9-29fb2b3a6ddc
Content: Conditions in Conditional Access policy - Microsoft Entra
Content Source: articles/active-directory/conditional-access/concept-conditional-access-conditions.md
Service: active-directory
Sub-service: conditional-access
GitHub Login: @MicrosoftGuyJFlo
Microsoft Alias: joflore

@dantclee
Thanks for your feedback! We will investigate and update as appropriate.

@dantclee
The extension that needs to be deployed in the suggested registry key for Chrome support in Windows 10 Creators Update (version 1703) or later is Windows Accounts. The registry key is as follows:

Path HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist
Name 1
Type REG_SZ (String)
Data ppnbnpeolgkicgegkbkbjmhlideopiji;https://clients2.google.com/service/update2/crx

I hope this helps! Let me know if you have any other questions.

@dantclee
We are going to close this thread as resolved but if there are any further questions regarding the documentation, please tag me in your reply and we will be happy to continue the conversation.


Major changes to OS Drive expanding approach

With the introduction of Managed Disks in Azure, the approach for disk resizing has changed. The way to expand Managed disk size is different from Unmanaged disks. What approach and PS code is shown in this docs article is only for expanding OS drive size for Unmanaged disks. I have added the PS approach and code for expanding OS drives size for Managed disks. I have tried to keep the flow and formatting intact as per the original, and have also added the relevant section on Data Disks pertaining to Managed disks too. There were some script errors in existing PS code and some missing Info, which I corrected.

 Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.:x: bahreex sign nowYou have signed the CLA already but the status is still pending? Let us recheck it.

@bahreex : Thanks for your contribution to the Azure documentation! The author, @azdocprs, has been notified to review your proposed change.

@iainfoulds - Would you review the proposed changes?  Thanks


separate reports of file  and line changes to package-lock.json in commit CSV

US
As a researcher I can see separate reports of file and line changes to package-lock.json so that I can more accurately report on commit data.
Discussion
In the node framework, the file package-lock.json is object code, not source code.  It needs to be checked into GitHub for reproducibility of builds, but it should not be counted in analysis of commit data.
In this issue, we add three fields to the CSV for commits, all integers:

package-lock.json files: 1 if package-lock.json is present in commit, 0 otherwise.
package-lock.json additions: additions to only the file package-lock.json if present, otherwise 0
package-lock.json deletions: deletions to only the file package-lock.json if present, otherwise 0

Acceptance Criteria

[ ] Fields listed above are in the CSV file
[ ] Values have been spot checked for accuracy

Branch: pc-reportPackageJson


Missing ability to add NS Record Set

It seems that the ability to add NS Record Sets to an Azure DNS Zone is missing. The relevant links:
ARM Template Docs: https://docs.microsoft.com/en-us/azure/templates/microsoft.network/dnszones/ns
Pulumi Docs: https://www.pulumi.com/docs/reference/pkg/azure-nextgen/network/recordset/
The Azure Portal provides the ability to create "child DNS zones", which are really just NS records added to the parent DNS Zone. There does not appear to be a specific "child DNS zones" capability in ARM templates, and with the ability to manually add NS records missing we have to fall back to the original Pulumi Azure provider to accomplish that.

There's a bit of a mess with API versions here which is tracked in https://github.com/pulumi/pulumi-azure-nextgen/issues/67
I believe you should use v20180501, e.g. in TypeScript https://github.com/pulumi/pulumi-azure-nextgen/blob/14d7b054a3ba2371919312262dbee325c1a848f2/sdk/nodejs/network/v20180501/recordSet.ts#L77, see https://github.com/pulumi/pulumi-azure-nextgen/issues/67#issuecomment-753375218

There's a bit of a mess with API versions here which is tracked in https://github.com/pulumi/pulumi-azure-nextgen/issues/67
I believe you should use v20180501, e.g. in TypeScript https://github.com/pulumi/pulumi-azure-nextgen/blob/14d7b054a3ba2371919312262dbee325c1a848f2/sdk/nodejs/network/v20180501/recordSet.ts#L77, see https://github.com/pulumi/pulumi-azure-nextgen/issues/67#issuecomment-753375218


Miscellaneous fixes for named indices

Scope & Purpose

[x] Bug-Fix (missing functionality) for devel-branch (no need for backports)

Related Information

[x] There is an internal planning ticket: https://github.com/arangodb/release-3.5/issues/102

Testing & Verification
This change is already covered by existing tests, such as:
tests/js/common/shell/shell-index.js
tests/js/common/shell/shell-index-ensure.js
This PR adds tests that were used to verify all changes:

[x] Added new integration tests

http://jenkins01.arangodb.biz:8080/job/arangodb-matrix-pr/4614/
Documentation

[x] Added a Changelog Entry

https://jenkins01.arangodb.biz/view/PR/job/arangodb-matrix-pr/4657/

http://jenkins01.arangodb.biz:8080/job/arangodb-matrix-pr/4671/

http://jenkins01.arangodb.biz:8080/job/arangodb-matrix-pr/4672/


How to find the max _id or most recently updated object in collection

**How to find the max _id or most recently updated object in collection?**
I'm kind of new to LiteDB.
Got most things working. I can create a POCO, make a db connection and do a collection.Insert().
Now I need to get the most recently added record so I can pull a value  from it and increment it in a pattern.
I am struggling with using Queries and Expressions to find the MAX _id item in the collection.
Seems like this should be a pretty common problem but I can't find any examples.
Can someone help?

I just had this problem yesterday
var latest = Coll.FindOne(Query.All(1));
where coll is your LiteDbCollection
let me know if that works for you

Hi guys,
First, your poco class will be updated with _id inserted.
Also, Insert method returns this number.
But, as @nh43de say, you can get lower (or highest) value in a index using this command:
var latest = Coll.FindOne(Query.All(Query.Asc));

Hey Thanks!
I'm not used to people replying so quick and with such good options.
Both of these work:
var latest = collection.FindOne(Query.All(-1));
var latest = collection.FindOne(Query.All(Query.Descending));
Makes sense if you think of it as an object store and index rather than a database where you expect a simple MAX(col) function.

Awesome! Glad it worked for you. Also @mbdavid - this is one of the coolest libraries I have come accross in several years. Thank you thank you for you hard work! This library is an amazing alternative to using a MongoDb backend for lightweight applications in .NET

Agree Totally!
I've been using it now for just over a day and have already built an application using it. Great alternative to client-server SQL or NoSQL databases for some applications (like mine - a low use Windows Form application with just local storage needs).

Thanks guys! It's really nice to know about this. I'm still working v5 version that will the a biggest change in this project. In this case, you will resolve this using a single SQL query (or Linq query) like:
SELECT MAX(_id) FROM your_col
or
col.Query().Max(x => x.Id)

As I see in LiteCollection.cs,
// Summary:
//     Insert a new entity to this collection. Document Id must be a new value in collection
 //     - Returns document Id
 public BsonValue Insert(T document);
int recentId = -1;
var docId = coll.Insert(info);
if (docId != null) recentId = docId .AsInt32;

@chucksullivancvs  it's working for me.

Hi! With the objective of organizing our issues, we are closing old unsolved issues. Please check the latest version of LiteDB and open a new issue if your problem/question/suggestion still applies. Thanks!

Sorry for reopening this post, but it is my first time using LiteDB
var iLatestID = MainDB_Coll.FindOne(Query.All("iID", 1));
if (iLatestID == null)
{
MessageBox.Show("NULL");
DatabaseTemplate.iID = 1;
}
else
{
MessageBox.Show(int.Parse(iLatestID.ToString()).ToString());   //PROBLEM
DatabaseTemplate.iID = int.Parse(iLatestID.ToString()) + 1;
}
Seems like int.Parse(iLatestID.ToString()).ToString() returns a false string...
Why?

Sorry for reopening this post, but it is my first time using LiteDB
var iLatestID = MainDB_Coll.FindOne(Query.All("iID", 1));
if (iLatestID == null)
{
MessageBox.Show("NULL");
DatabaseTemplate.iID = 1;
}
else
{
MessageBox.Show(int.Parse(iLatestID.ToString()).ToString()); //PROBLEM
DatabaseTemplate.iID = int.Parse(iLatestID.ToString()) + 1;
}
Seems like int.Parse(iLatestID.ToString()).ToString() returns a false string...


ISPN-16069 Allow the indexes to start with embedded setup

https://issues.redhat.com/browse/ISPN-16069

Rebased!

merged! thanks @fax4ever !

Thanks Pedro!


For CASSANDRA-9318, make it possible to use byteman from CCM. Useful …

…for dtests.

Code lgtm. I'm going to run it through CI first though.

I added two commits. One to avoid changing the signature of the node constructor and another to make sure I didn't change the signature of cluster.populate.

Thanks. I'll re-run CI.

+1.


FontWeight of Button is Bold defaultly

Semi.Avalonia <IP_ADDRESS> latest
Avalonia 11.1.3 latest
.net 8
nuget:

app.axaml

MainWindow.axaml

screenshot

Yes this is by Semi design guideline.

There is display issue in Avalonia 11.1, it will be back to normal in 11.2 (confirmed in beta)


Does this vulnerability exist

Not so long ago I read that there is a **DNS Amplification attack ** vulnerability in DNSSEC
Is your program closed?

Yes, Attackers abuse open resolvers by sending a barrage of spoofed DNS queries where the IP source is set to be the MIT target IP. Most of these servers will cache the initial response so multiple queries are not made to the authoritative name servers.
In fact this is protocol related, because not only DNS is affected. The NTP, CHARGEN and SSDP protocols are also commonly used in such attacks and, unfortunately, as long as misconfigured servers and devices are available on the Internet, this technique will continue to be favored by attackers.

This is an urban legend spread by companies whose services don't support DNSSEC.
DNS amplification doesn't require DNSSEC at all.
Returning many large records is all it takes, and people conducting attacks understood this very well and set up dedicated zones returning such large responses. Without DNSSEC.
As stated by Chef-Koch, many other protocols are abused the same way.
That being said, the DNSCrypt protocol prevents amplification, as it requires questions to be at least as large as the question. That was implemented years ago both in the client and in all server implementations, with the exception of Cisco that still doesn't seem to support this.

Also, with elliptic curve based signatures, that are supported by all modern resolvers and authoritative servers, DNSSEC signatures are fairly small.
Modern servers with support for DNSSEC are also typically the ones implementing the best defenses against common attacks.


run_command: support an array of commands

!feature

*run_command: support an array of commands (#3333)
Added run_commands method which allows an array of commands to be passed to run_command

This does not address the use case described in the issue. The request is to mirror the pattern in puppet's exec to be more explicit about parameterization. The example they give is: command => ['/bin/echo', 'hello world; rm -rf /']. Your PR here would do: /bin/echo && hello world; rm -rf / which is absolutely not what we want.
Properly implementing this feature will involve making a similar change to how we use the underlying Open3 lib to take advantage of the explicit parameterization features.

Wondering if it would  be acceptable splitting commands, then escaping each argument and then lastly joining arguments again into a single command?  This way in [‘/bin/echo', 'hello world; rm -rf /'] the second command won’t run at all

I think you are misunderstanding the feature request. it is not to be able to run multiple commands in the same invocation of the function. Instead it is to support explicit parameters to a single command.


feat(eazy): Add support for setting password, username, url and custom messages

Just a simple PR with some functionality I added for my own usage.
Feel free to close this if you think these are outside the scope of this library.

Thanks.
I delete two methods, they are already defined with similar names.

My bad, I didn't find those when I got myself familiar with the library.

BTW, the PR title should've been fixed before merging. It's not factually correct anymore


add plugin inherit naming test

Current coverage is 54.74%

Merging #3 into master will increase coverage by +0.18% as of 3174b3b

@@            master      #3   diff @@
======================================
  Files           10      10
  Stmts          537     537
  Branches       123     123
  Methods          0       0
======================================
+ Hit            293     294     +1
+ Partial         48      47     -1
  Missed         196     196

Review entire Coverage Diff as of 3174b3b

Powered by Codecov. Updated on successful CI builds.


Add ansible role for GCP

Create ansible role for deploying Keylime against a vTPM in the google cloud environment. @lkatalin

I'll give this a spin on Monday and then we can merge it if there isn't anything big.

@avery-blanchard can you squash all of these commits into a single commit? That makes it easier to manage and is typical for most projects. There's no reason to keep all of the back and forth and fixes in separate commits and we'll have a nice clean history.


Introduce disable tooltip on hover property

Description
Added new property that allows users to disable tooltip on hover. The default value is false to keep
backward compatability. We will revisit the ideal
default value based on user's feedback in later release.
Issues Resolved
#259
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Codecov Report

Merging #313 (2078889) into main (26aea7a) will increase coverage by 0.02%.
The diff coverage is n/a.

:mega: This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more
@@            Coverage Diff             @@
##             main     #313      +/-   ##
==========================================
+ Coverage   91.66%   91.69%   +0.02%
==========================================
  Files          12       12
  Lines         288      289       +1
  Branches       38       38
==========================================
+ Hits          264      265       +1
  Misses         17       17
  Partials        7        7

Impacted Files
Coverage Δ

...Dashboards/plugins/dashboards-maps/common/index.ts
100.00% <0.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.


riscv: Add inline IRQ process functions

Summary
riscv adds inline IRQ process functions.
Impact
Testing

Hi @donghengqaz instead of creating a new ARCH_IRQ_FUNC why don't you use the ARCH_HAVE_IRQPRIO/ARCH_IRQPRIO ?

It's wrong to add an option to control these key functions since up_irq_save/up_irq_restore isn't optional feature.

@donghengqaz please add these functons by default and remove the Kconfig option.

@acassis @xiaoxiang781216 I think functions like save/restore interrupt are arch level functions, so we may not put implementation into each chip under this arch, and we should put these functions in arch common header file, besides this these function should be inline for better performance.
But some chips may be not able to use these functions, they use their private functions to save/restore interrupt, so I add this macro to let chips to select use arch common one to itself's private function.

@acassis @xiaoxiang781216 I think functions like save/restore interrupt are arch level functions, so we may not put implementation into each chip under this arch, and we should put these functions in arch common header file, besides this these function should be inline for better performance.
But some chips may be not able to use these functions, they use their private functions to save/restore interrupt, so I add this macro to let chips to select use arch common one to itself's private function.

How to enable/disable irq is defined by RISC-V spec, it suppose one implementation should work for all RISC-V chipset. Since other arch share the same implementation, we can do the same thing for RISC-V now until we find the chipset which need specially handling.

@acassis @xiaoxiang781216 I think functions like save/restore interrupt are arch level functions, so we may not put implementation into each chip under this arch, and we should put these functions in arch common header file, besides this these function should be inline for better performance.
But some chips may be not able to use these functions, they use their private functions to save/restore interrupt, so I add this macro to let chips to select use arch common one to itself's private function.

How to enable/disable irq is defined by RISC-V spec, it suppose one implementation should work for all RISC-V chipset. Since other arch share the same implementation, we can do the same thing for RISC-V now until we find the chipset which need specially handling.

OK, do you think it is OK for me to remove these functions from each risc-v chip's IRQ driver and implement them in risc-v common IRQ header file ?

Yes, if all implementation is same.

I see the compiling error is in BL602 external wifi driver, mainly about I make the up_irq_save and up_irq_restore from functions to be macros, so it causes linking error, @Virus-V could you give some review and help ?

I see the compiling error is in BL602 external wifi driver, mainly about I make the up_irq_save and up_irq_restore from functions to be macros, so it causes linking error, @Virus-V could you give some review and help ?

@donghengqaz Okay, I will update the external wifi firmware of BL602 as soon as possible.

I see the compiling error is in BL602 external wifi driver, mainly about I make the up_irq_save and up_irq_restore from functions to be macros, so it causes linking error, @Virus-V could you give some review and help ?

@donghengqaz Created a PR to your fork: https://github.com/donghengqaz/incubator-nuttx/pull/1

I see the compiling error is in BL602 external wifi driver, mainly about I make the up_irq_save and up_irq_restore from functions to be macros, so it causes linking error, @Virus-V could you give some review and help ?

@donghengqaz Created a PR to your fork: donghengqaz#1

@Virus-V Thanks you! I pull this PR.


how to post members only content

For this we'll need:

[x] an element that makes it super obvious not to share,
[x] make sure it doesn't come up in normal threads / latest,
[x] don't allow indexing / robots
[x] make a member-only thread

Netlify allows password-protected pages, but you need to pay for that -- $45/month.
This would be "private" HTML pages and, like you mentioned during our call, it wouldn’t be any different from sharing PDFs to members (they can still share it if they want even if they’re not "supposed" to).
Time estimate:  1 day

Designing the alert box that indicates this is member-only
Implementing the HTML page based on the public post template

[ ]  don't allow indexing / robots

I’ve added the noindex metatag and a robots.txt file, but you should also do it in the Google Search Console.

All members-only contents is in _members/. I’ve included one example post.
It will be accessible through https://infrastructure.sparcopen.org/members/ (once on master)

[ ] write some copy
[ ] configure google search console

Sorry this got reopened with the merge to master

it doesn't appear that google search console can do anything about this, noindex is enough.

I've just had the stupidest thought. This repository is public, meaning the code and content is public.
To actually do this privately we'd need to fork the repo, make a private version, and point netfly and a subdomain at it. At first glance this isn't all that much work so I'm not worried... but glade I noticed now and not in a week.

Hah! I hadn’t even thought about this.
Are you hoping to have members-only content soon?

Yes. We have a backlog that can be uploaded.
On Fri, Jun 26, 2020, 9:51 PM Sophy<EMAIL_ADDRESS>wrote:

Hah! I hadn’t even thought about this.
Are you hoping to have members-only content soon?
—
You are receiving this because you were assigned.
Reply to this email directly, view it on GitHub
https://github.com/sparcopen/infrastructure/issues/62#issuecomment-650395300,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ABFZMZ66YB7FHFPKNOEKKBTRYUC6XANCNFSM4N75IURA
.

[ ] We should turn off the cite it functionality here I think.