Better ppc64 support

What is the problem you're trying to solve
Our existing CI infrastructure doesn't have ppc64 (PowerPC). Due to that we have/had issues on the architecture;

#6627
#5436
#3005

We are currently reactive regarding this architecture.
Describe the solution you'd like
Continuously test containerd in ppc64. Apparently Oregon State University has https://powerci.osuosl.org/ which hosts some other CNCF projects such as Kubernetes and Envoy.
Once we are confident about the quality, we could have release binaries. There is #6516 already.
Additional context
No response

I would like to work on this. Was there already a request sent to the OSU?
There is a form for this, but I don't know if I should do this or some maintainer of containerd.
https://osuosl.org/services/powerdev/request_powerci/

/assign @termdew

Ping @termdew any update?


Upgrade to new major dependency versions

Java 17
Spring 6
Tomcat 10
Hibernate Validator 8
Logback 1.4.5

Might need JDK 17 Toolchain for Lowkey Vault App while others keep using JDK 11 to ensure compatibility with existing users.
https://docs.gradle.org/current/userguide/toolchains.html

Expected to be delivered close to the end of life of JDK 11, August-September 2023.


[mqtt] Zwave-Js-UI clears retained message even though retain is disabled

Checklist

[X]  I am not using Home Assistant. Or: a developer has told me to come here.
[X] I have checked the troubleshooting section and my problem is not described there.
[X] I have read the changelog and my problem is not mentioned there.

Deploy method
Docker
Z-Wave JS UI version
<IP_ADDRESS>b107
ZwaveJS version
12.4.4
Describe the bug
Zwave-Js-UI clears retained message even though retain is disabled.
To Reproduce
Disable retain

Find node that uses a notification or a scene

trigger scene, observe that the scene is reported.
Observe clearing of retained value by sending an empty payload
[2024-03-06 13:24:46] [INFO] Message arrived for broker with topic: "zwave/53/91/0/scene/002",  payload: "0"
[2024-03-06 13:24:47] [INFO] Message arrived for broker with topic: "zwave/53/lastActive", payload: "1709727886877"
[2024-03-06 13:24:47] [INFO] Message arrived for broker with topic: "zwave/53/91/0/scene/002", payload: ""

Expected behavior
When retain is disabled the last message with empty payload should not be send
e.g. the above messages should look like this
[2024-03-06 13:24:46] [INFO] Message arrived for broker with topic: "zwave/53/91/0/scene/002",  payload: "0"
[2024-03-06 13:24:47] [INFO] Message arrived for broker with topic: "zwave/53/lastActive", payload: "1709727886877"

Additional context
Since retain is disabled it's not necessary to clear the retained value since it will not be republished on connect.
It actually makes processing these messages much harder because one hast to actively filter out the messages with empty payload on the mqtt client side.

@spacemanspiff2007 That's not used to clear retain, that's just default behaviour of notificaitons. Notifications are not sent with retain flag neighter when retain flag is true


bug: after authentication cannot route to other pages

Description
After I have gone through authentication i am not getting routed to the default dashboard page. Instead I am getting routed to the check user exists page.

closing this issue since it's fixed not part of this repository.


Cannot be used in a browser with a CSP set that does not include the unsafe-eval permission

The usage of eval in Parser.ts prevents the library from being used in any browser-based application that disallows eval for security reasons. The error thrown is a generic "Cannot parse (valid grammar)" error, which may be the origin of the issue in #43.

Can you pin point the file including eval? From what I recall, this lib should not include it anywhere

I included a link to the offending line in my OP. Parser.ts, line 276. There is a tslint-ignore comment directly above it to allow the use of it. It seems to be used exclusively to turn a JSON string into a JS string - for which JSON.parse would also work.

If that's the case, it should certainly work. Will try from the github UI hoping the CI is still working.
I didn't see the link from mobile, my bad

Would you test if<EMAIL_ADDRESS>solves the issue?

I can't really... I was consuming this package as a part of json-schema-library, which itself uses this package as part of json-query. But if the eval is gone that will definitely solve the underlying problem

Ok, will publish a patch. Tests are passing and are extensive

Thanks! I'll see if I can get the downstream library I was trying to use to pick up the update.


Be able to display labels in scatter plot

Should we allow a label property in a point ?
We would need to be able to style the label.
The position of the labels should be optimised in order to prevent overlap of labels and a line should be added between the label and the point.

I have created a new dataset
data.json.zip
That corresponds to:

The data does not contain the ellipses but only the scatter points. The ellipses can be calculated using https://github.com/mljs/directional-distribution and in order to prepare the 4 required ellipses the data can be preprocessed using the following code:
const categories =
    [... new Set(data.map(datum => datum.category))]
    .map(category => ({
        category,
        x: data.filter(datum => datum.category===category).map(datum => datum.x),
        y: data.filter(datum => datum.category===category).map(datum => datum.y),
    }));

@wadjih-bencheikh18 please could you replace the PCA example of ecstasy with this new dataset ? The main difference is that we will calculate directly in the storybook the ellipses based on the categories and that we will use 'DirectionalEllipse' annotations. There could be also the label for the categories in the middle of the ellipses.
Would be great if this example also allow to zoom (rectangular zoom).
Once this is done we will think about how to display the labels for each point in the scatter plot.
For completion, if ever we want to rebuild the dataset this is the code that can be used on www.c6h6.org:
const pca = API.getData('pca');
const pcaAnnotations = API.getData('pcaAnnotations');
const ellipsis = API.getData('ellipsis');

const data = [];
for (let i=0; i<pca.x.length; i++) {
    data.push({
        label: pca.info[i].meta.TITLE,
        x: pca.x[i],
        y: pca.y[i],
        color: pca.info[i].meta.color,
        category:  pca.info[i].meta.category,
    })
}

const categories =
    [... new Set(data.map(datum => datum.category))]
    .map(category => ({
        category,
        x: data.filter(datum => datum.category===category).map(datum => datum.x),
        y: data.filter(datum => datum.category===category).map(datum => datum.y),
    }));

console.log(categories);

@lpatiny how could I find ellipses in categories ? center , rx,ry,and angle

@lpatiny how could I find ellipses in categories ? center , rx,ry,and angle

As explained in the issue you need to calculate those values using the project https://github.com/mljs/directional-distribution


Fix syntax issues with notebook

There were some indent/parentheses issues, this fixes those

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

[ ] Mention the appropriate issue in your description (for example: addresses #123), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment fixes #<ISSUE NUMBER> instead.
[ ] Update CHANGES.md with noteworthy changes.
[ ] If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.
To check the build health, please visit https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md
GitHub Actions Tests Status (on master branch)

See CI.md for more information about GitHub Actions CI.

R: @AnandInguva

Hey, some imports are missing too.
https://github.com/apache/beam/pull/26435/files. can you add them here?

Done

(FWIW, colab masks that problem, though maybe just in my environment)


Fix broken syntax in action.yml

Add missing '

Hey @jmealo , can we have this one merged and a new version released?
v1.0.1 does not work because of this.


Deprecate configuration methods for certain roles

Most importantly, ensure getIncoming and getOutgoing are properly restricted Also limit setTransitive, withDependencies, iterator, isEmepty, getResolutionStrategy
Reviewing cheatsheet
Before merging the PR, comments starting with

❌ ❓must be fixed
🤔 💅 should be fixed
💭 may be fixed
🎉 celebrate happy things

@bot-gradle test ast

I've triggered the following builds for you. Click here to see all build failures.

AllSmokeTestsPullRequestFeedback build


Failure to remove blocks.

Hello,
I've really been enjoying this plugin, as it helps to organize my obligations. However, I've run into some issues that make the plugin quite functionless. Essentially, what is happening is when I delete older recurrence blocks, they randomly come back. Repeat ad nauseam. Below is the simple steps taken to "recreate" this issue, performed on a MacBook Pro, but this issue was also seen on my HP Spectre (Windows 11) computer.

First, I have some set of blocks that I set up a few months ago. Then, I access the recurrence data by using /set recurrence. From there, I see all my various entries. I click delete all but one block, which is still useful for me in the present time.

At this point, it doesn't seem to matter if I leave LogSeq to "save" the state, or if I continue working and simply add new blocks using the /set recurrence keyword. Whenever I add a new block, the recurring tasks I had just deleted come back:

It seems that in addition to the old blocks coming back, the new blocks are kept properly. This may mean that storing new blocks is working, but deleting old blocks is not. I hope these details are helpful.
Thank you for your assistance.
(Edit: First image wasn't logically selected, but I replaced it. Essentially it is identical to the 3rd image, but the 3rd image would have new items and incorrectly has all the old items as well).

Thank you for your feedback. This plugin is due a refactor. Let me look into these bugs at the same time.


tiny CSS change

This PR changes background properties to background-color. This should make no difference to the rendered site (when only color is given, the two properties yield identical results).  But for some reason, in the Firefox developer tools, specifying as background-color makes it show up in the "computed styles" list when filtering on either "background" or "color" (as you would expect), but when specified as just background the property doesn't show up for either search term.
Arguably this is a bug in the FF dev tools, but this workaround is fast and painless so why not?

main
PR

They look the same 🎉


4337 - Post endpoint to store Safe configuration

What is needed?
Store Safe Configuration for not deployed Safes, in case 4337 will need to deploy a new Safe that does not exist.
Related issues

#1861

Endpoint
If applicable, description on the endpoint and the result you expect:
URL
POST /api/v1/safes/4337-configuration/
Payload
TBD
Response
201 CREATED

Hello @Uxio0, I would love to help resolve this issue with your guidance.

Hi @AkintolaRichard , thank you very much but we don't require external help for this concrete issue 🙂

Oh, thank you @Uxio0  for the clarification, perhaps in the nearest future if you have non concrete issue, I am available to help.

Waiting for @usame-algan feedback on what's needed to make this compatible with counterfactual deployment


Fix bug with HDFS of the Server fat jar

http://stackoverflow.com/questions/17265002/hadoop-no-filesystem-for-scheme-file

LGTM


GLTF loaded as a stream

Hei ! :)
When I import a GLTF model into Unity using your tool, the import is like a stream. So the model is constructed at runtime in Unity (can be seen in the Unity editor) and after some time the whole mode is constructed.
Is there a way that the model can be imported in a direct way?

@dave-hill

How do you import your gltf model at all? I can't do it, nothing appears on my scene.. :(

What do you mean by direct? You can load it as a glb at design time.


Different type of data rendered items in wrong order when loop is true

version:
"react": "16.9.0",
 "react-native": "0.61.2",
"react-native-snap-carousel": "^3.8.2",

code:
      <Carousel
          loop
          data={data}
          itemWidth={width}
          sliderWidth={width}
          renderItem={this.renderItem}
        />

which the data is:
const data = [
  {type: 'a', uri: 'https://tmp.mp4'},
  {type: 'b', uri: 'https://tmp.png'},
  {type: 'b', uri: 'https://tmp2.png'},
  {type: 'b', uri: 'https://tmp3.png'},
  {type: 'b', uri: 'https://tmp4.png'},
]

and the renderItem:
  if (item.type === 'a') {
      return (
          <View style={{width, height: widht, backgroundColor: 'blue'}} />
      )
    } else if (item.type === 'b') {
      return (
        <Image
          resizeMode="contain"
          style={styles.swiperImg}
          source={{ uri: `${item.uri}` }}
        />
      )
    }

When the loop set to true, the first screen of snap-carousel will never be type a view. The currentIndex is 0, and then swipe next screen, the currentIndex turned to 2.

I have the same issue and after think, removing and put again loop, I made  in this way (and worked)
Use the prop 'loopClonesPerSide' and define his value as the data length.

I suppose that works because carousel has its own index, and the size is mutable. When we pass our index, it has a mistake to define carousel index.
When you define that you have the same proportion of your data length, the index is always the same.

Ran into this issue today as well. The suggestion that @adurra made did fix it for me but i'm not really understanding why.
The documentation for both loop and loopClonesPerSide don't seem to shed any light on what the root cause of this issue is. I know the project is looking for maintainers but if anyone has any clues as to where a possibly fix could be, i wouldn't mind submitting a pull request.
https://github.com/meliorence/react-native-snap-carousel/blob/master/doc/PROPS_METHODS_AND_GETTERS.md#loop
Loop

Prop
Description
Type
Default

loop
Enable infinite loop mode. :warning: It won't work if enableSnap has been set to false.
Boolean
false

loopClonesPerSide
Number of clones to append to each side of the original items. When swiping very quickly, the user will eventually need to pause for a quick second before the scroll is repositioned (this occurs when the end of the set is reached). By increasing this number, the user will be able to scroll more slides before having to stop; but you'll also load more items in memory. This is a trade-off between optimal user experience and performance.
Number
3


jar does not accept filenames with commas

When calling the compiled jar file with a single pdf filename that contains commas, the program only reads the part of the filename before the comma.
For example, when supplying the filename "a088237_e28-1397,a10_13923644.pdf", the program returns "Error: Input file a088237_e28-1397 is not a PDF file".

Hello，i tried many times to build the jar file, but failed.  Can you share your jar file with me.Thanks a lot!


More module system bugs

I have three files Main.elm Mod/Foo.elm Mod/Bar.elm with the following contents:
Main.elm:

import Mod.Bar(foo)

main = text foo

Mod/Bar.elm:

module Mod.Bar(foo) where

import Mod.Foo(foo)

Mod/Foo.elm
module Mod.Foo(foo) where

foo = toText "foo"

This program would work with Haskell, but Elm does not accept the file Bar.elm since it only has imports. I guess this should be changed. Now if we change the file Bar.elm to:

module Mod.Bar(foo) where

import Mod.Foo(foo)

dummy = "dummy"

The program compiles but the output is undefined. Based on the Haskell like behavior, the foo function should get called, and if not, the compiler should at least throw an error. For this to work, Bar.elm has to be changed to:
module Mod.Bar(foo) where

import Mod.Foo(foo)

foo = Mod.Foo.foo
dummy = "dummy"

I wanted to try fixing this issues, so I post here to make sure they are issues and that they should be fixed the way I propose.

Moving this to #931


Optimization

Hi,
Here is an optimization to get the actual size of the feat_vec for dynamic_rnn.
It's faster and better for the learning process.
I merged your recent commit, only removed seq2seq which is not used.
Thanks,
Antoine.

Good work, that's something I was unsure how to handle originally. I had assumed the network would learn to ignore the padding, but this is clearly a better solution.

Thanks, I think there is still an issue here : when truncating the wav file we should truncate also the corresponding text, if we do not we would expect the rnn to find "what the end of the sentence would like" which is not what we want in this case.
Problem is we don't know where to cut the text file, we could do it proportional to what we did on the wav file but I think it would be a mistake.
Only solution I see would be to reject files that are to long. Keeping the last part to put it in another batch wouldn't be better because we would still have to know where to cut so that the resulting text and wav files are fully synchronous.
What do you think ?

I agree. I don't think throwing out data should never be a problem since we can always either a) increase sequence length, or b) just get more data as there seems to be a lot more available.


added workflow_dispatch to deploy if

It seems that only main can deploy. I cannot find this rule in settings. going to merge now to make the docs running.
Restrictions for deploy if ... can be introduced latter
@redeboer


[compute] [azure_arm] app create; sp create; role assignment create

[compute] [azure_arm] app create; sp create; role assignment create
Description
The goal is to replace the first 3 CLI commands that require the Azure client installed, with Apache Libcloud code: http://libcloud.readthedocs.io/en/latest/compute/drivers/azure_arm.html
Status

work in progress

Checklist (tick everything that applies)

[ ] Code linting (required, can be done after the PR checks)
[ ] Documentation
[ ] Tests
[ ] ICLA (required for bigger changes)

Thanks! The build will need to pass and we'll need tests, too.

This would be awesome to have.

First thank you for your contribution.
This PR is very old and out of date now so I will go ahead and close it.
If it's still relevant, please sync your changes with the latest master / trunk and open a new PR. Thanks!

Pushed 666 commits into master; hope that doesn't mean anything!

I think you have to open a new PR?


NO-JIRA Remove unused tomcat-servlet-api dependency

Looks good, pushed. I tweaked the log to put it against a recent JIRA cleaning up the assembly since its essentially related.


MM-34460 Added framework for having admin console settings in sections

Summary
Added framework for having admin console settings in sections and refactored AD/LDAP config for use this framework.
Ticket Link
https://mattermost.atlassian.net/browse/MM-34460
Screenshots
https://i.imgur.com/1oyjcF4.png
Release Note
none

The only problem I'm seeing is that in the design file only the first section and last section have subtitles, in your uploaded image, the subtitle of the first section is repeated as a placeholder in a few of the other sections...
I'd say for this release, remove all subtitles except the first and last section.

Yeah, that was a typo. I'll update them.

@michaelgamble I've fixed the incorrect subtitles now. I've also updated the screenshot in PR so you can take a look there.

@sbishel
Yes, we cannot have both settings and sections together, i.e., a system console page will either have to have everything in sections or nothing. But the sections title and subtitles are purely optional if it helps.
The idea of settings and sections was to keep the changes isolated and to avoid sections from affecting anywhere we don't use it. It also made the different styling of sections vs non-sections part much easier and cleaner.
We need to know what group of settings constitute a section and this was the simplest idea I came up with. I'm open to any other ideas.

/update-branch

@furqanmlk My bad, I didn't mention this in our conversation that we're not implementing those buttons right now. Those would need API changes and much more time, so we simply did a cosmetic facelift of the AD/LDAP section.
For Canceled vs Cancelled, I see that in our codebase we actually use Canceled instead of Cancelled.

@furqanmlk My bad, I didn't mention this in our conversation that we're not implementing those buttons right now. Those would need API changes and much more time, so we simply did a cosmetic facelift of the AD/LDAP section.
For Canceled vs Cancelled, I see that in our codebase we actually use Canceled instead of Cancelled.

Thanks @harshilsharma63 no problem.
All look good , just last question, can you have a look at the first issue, "the contact card icon is missing in AD/LDAP field"

@furqanmlk It's not a Mattermost thing. I believe the icon is coming from the browser's auto-fill feature or from LastPass.
I get this from LastPass and Safari -


Refactor - CreateTable needs CqlOptions that work on two different query builder classes

the ifExists is on one class and then extensions is on another (not the statement).

possibly related to #1636

never mind, I think this is old and not needed


scene class

use a separate class to implement the in-world semantics of TileView such as where things are positioned according to each other. later this will also handle preset maps. TileView should also probably be renamed SceneView or the like

resolved by 43f22d3c6dabdf39370b3013ed84561d3658139d


use yaml safe loader

Prevent execution of code inside yaml configuration file.
Local configuration files should be considered trusted, I guess. But there are no practical reasons to allow this anyway, since it doesn't make sense to allow arbitrary code to be executed as a side effect of reading a configuration file.
example:
foo: !!python/object/apply:os.system
  args: ['echo hello > /tmp/foobar'] # or something more evil

This does't affect the ability to !include files

I'm surprised it's even allowed in the first place

Yes, it is a dangerous design.
(this was also the reason for a big security hole in ruby on rails some time ago where an attacker could POST a yaml document, causing the yaml parser to be invoked with the payload, I believe).


Update MD file on new branch 2017-43-02_16-11-50

:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

split/updateTestCon.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: If you changed an existing file name or deleted a file, broken links in other files to the deleted or renamed file are listed only in the full build report.


UserRepository prevents build

I get 4 errors out of the box,
Undeclared type FieldProtocol
and Value is not a member of type Field.
In UserRepository.swift

Might have been broken with this PR, idk.
https://github.com/vapor/fluent-kit/pull/268/commits/c8d67d944ed5a0275665a63f37ab06c91dd49991

Fixed in #9


Create SuspiciousNetworkConnection-NotionAPI.yaml

Summary
I created a query to help detect activity related to the OffensiveNotion and GC2-sheets tools. Both command and control tools that leverages the Notion SaaS application, and Google Sheets and Drive SaaS apps. Google sheets and drive have recently been abused as a C2 by nation state actors APT41.
Ref:
https://cyware.com/news/apt41-uses-open-source-red-teaming-tool-gc2-9eaecb18
https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf
https://github.com/looCiprian/GC2-sheet
https://github.com/mttaggart/OffensiveNotion
Required items, please complete
Change(s):
Created a new hunt rule to detect possible OffensiveNotion C2 activity
Created several new hunt rules to detect possible GC2-sheet C2 activity
Reason for Change(s):
Security research into new C2 tools OffensiveNotion and GC2-sheet
Version Updated:
N/A - new analytics
Testing Completed:
Yes - queries works in both Sentinel and Microsoft Defender for Endpoint Advanced Hunting blade.
Sentinel:

Sentinel: Suspicious network connection to Google APIs - Possible GC2-Sheet C2

Sentinel: Suspicious network connection to Google APIs with aggregated process commandlines and files created

Sentinel: Suspicious network connection to Google APIs resulting in file creation

Checked that the validations are passing and have addressed any issues that are present:

See guidance below

Hi @m4nbat, can you please fix the failing validations?

Hi @m4nbat, can you please fix the failing validations?

Hi @v-rbajaj, the field its saying doesn't exist is present in the schema here:

When I run getschema in my sentinel instnace it is also present in the DeviceNetworkEvents table:

Just to clarify these errors:

Are indicating that the field InitiatingProcessVersionInfoCompanyName does not exist in the table, but my queries run without error as pictured in my original pull request.
Can you please advise further on the correct course of action?

Hi @devikamehra, please provide your feedback on this. Thanks

Hi @m4nbat, can you please fix the failing validations?

Hi @v-rbajaj, the field its saying doesn't exist is present in the schema here: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/devicenetworkevents

When I run getschema in my sentinel instance it is also present in the DeviceNetworkEvents table:

Just to clarify these errors:

Are indicating that the field InitiatingProcessVersionInfoCompanyName does not exist in the table, but my queries run without error as pictured below:

Can you please advise further on the correct course of action?

For this @v-rbajaj Please ensure the Table in validation is updated with latest schema.

@devikamehra  hos is this looking now? I have acted on your feedback. Thanks

Hi @m4nbat, please act on @devikamehra's comments. Thanks

Hi @m4nbat, please act on Devika's comment, make the necessary changes.

Hi @m4nbat, please make the necessary changes.

Hi @m4nbat, please make the requested changes.

@rahul0216 This PR has changes pending from the author

Hi @m4nbat, you can go through the Query Style Guide - https://github.com/Azure/Azure-Sentinel/wiki/Query-Style-Guide
to get some understanding on new entity mappings once you are back from holiday.

Hi @m4nbat, once you are back from vacation please do update this PR.

Will do. Back in work on 14th of August.

Ok @m4nbat, noted, thanks for providing this update.

Hi @m4nbat, I hope you are back from vacation. Please do share some update on this PR.

Hi @m4nbat, please provide some update on this PR.

Hi @m4nbat, request you to please provide some update on this PR.

Hi @m4nbat, please provide some update on this PR

Hi @m4nbat, We wanted to check on the status of PR https://github.com/Azure/Azure-Sentinel/pull/7963 . PR is pending for more than 30 days. Please let us know if you need any assistance to review this PR. Per our standard operating procedures if no response is received in the next 7 business days, we will close this PR. Thank you for your cooperation

Since we have not received a response in the last 7 days, we are closing your PR #7963  per our standard operating procedures. If you still need support for this PR, you can re-open the PR at any time.
If you do re-open, we simply request that you ensure the PR has response to the last request. Thank you for your cooperation.


UI changes are not reflecting after restart

I did background changes to UI in dash.css.. But changes wont reflect in later start of UI.
tried clearing cache and cookies no result
Any ideas ?

Hey! I have a couple questions:
Are you referring to /UI/src/components/themes/dash.less?
What gulp command are you using to serve the UI?

Awesome. Gulp serve is the correct command. What "gulp serve" does is it takes the files in the UI/src directory, does some processing and then outputs those files to another directory 'dist'. So, if you modify the files in your dist folder they will be overridden the next time gulp runs the "themes" task. For more information see https://github.com/capitalone/Hygieia/blob/master/UI/gulpfile.js and look for the line that starts gulp.task('themes', function() {
tldr; If you want your changes to persist, only modify files in the src directory.


Lexeme line positions don't account for import lines

Lexeme line positions don't account for import lines, meaning that references to line/columns are off by a number of lines when the definition has import lines.
AC:

[ ] The lexemes for definitions correctly match the line regardless of the presence of imports

We could circumvent this by re-organizing imports.

This is OBE after the meta structure changes now that we have a direct field -> token -> line link now.


fix create&update workflow cron APIs, verify the end time must bigger than start time

Purpose of the pull request
This PR fix create & update workflow cron APIs, verify the end time must be bigger than the start time
Brief change log
fix workflow cron time verification
Verify this pull request

This pull request is code cleanup without any test coverage.
(or)
This pull request is already covered by existing tests, such as (please describe tests).
(or)
This change added tests and can be verified as follows:

Codecov Report

Merging #8871 (8778000) into dev (a9c9eb0) will decrease coverage by 0.02%.
The diff coverage is 0.00%.

@@             Coverage Diff              @@
##                dev    #8871      +/-   ##
============================================
- Coverage     45.31%   45.29%   -0.03%
- Complexity     4077     4081       +4
============================================
  Files           702      702
  Lines         27111    27177      +66
  Branches       2897     2909      +12
============================================
+ Hits          12285    12309      +24
- Misses        13674    13706      +32
- Partials       1152     1162      +10

Impacted Files
Coverage Δ

...heduler/api/service/impl/SchedulerServiceImpl.java
8.36% <0.00%> (-0.27%)
:arrow_down:

...org/apache/dolphinscheduler/alert/AlertSender.java
74.03% <0.00%> (-14.43%)
:arrow_down:

.../remote/command/alert/AlertSendRequestCommand.java
92.00% <0.00%> (-8.00%)
:arrow_down:

...e/dolphinscheduler/remote/NettyRemotingClient.java
50.70% <0.00%> (-2.82%)
:arrow_down:

...eduler/api/service/impl/AlertGroupServiceImpl.java
90.80% <0.00%> (-0.87%)
:arrow_down:

...che/dolphinscheduler/common/enums/WarningType.java
0.00% <0.00%> (ø)

...inscheduler/service/alert/ProcessAlertManager.java
44.84% <0.00%> (+0.05%)
:arrow_up:

...i/service/impl/AlertPluginInstanceServiceImpl.java
65.95% <0.00%> (+0.36%)
:arrow_up:

.../org/apache/dolphinscheduler/dao/entity/Alert.java
46.26% <0.00%> (+0.36%)
:arrow_up:

...pache/dolphinscheduler/common/utils/DateUtils.java
79.43% <0.00%> (+0.41%)
:arrow_up:

... and 3 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a9c9eb0...8778000. Read the comment docs.


query frontend, query UI: Native histogram support

As followup to #6032 , this PR adds native histogram support for query frontend and query UI. Additionally this PR adds native histogram support in the ApplyCounterResetsSeriesIterator, which is required for histogram rates.

[ ] I added CHANGELOG entry for this change.
[ ] Change is not relevant to the end user.

Changes

Native histogram support for query frontend
Native histogram support for query UI (table and graph)
Native histogram support in ApplyCounterResetsSeriesIterator
Enable native histograms rates.

Verification
Unit tests and e2e tests.

Sorry for the delay. Is this ready for review?

Sorry for the delay. Is this ready for review?

Yes it's ready and I just rebased it.

Please avoid rewriting history in the future with --force because now I'm forced to review thousands of lines again. 😢

Sry for that, will avoid it in the future. I realized what I have done when it was too late already. 😞

LGTM minus those small nits, I think you forgot to add DCO on your latest commit 😄

I addressed the comments and fixe DCO.
Btw. I track progress for native histograms in https://github.com/thanos-io/thanos/issues/5907.


large file uploads eating up memory

Hi,
when handling large file uploads +300MB, the files seem to be cached in memory till the upload is finished. This is not very practical.
The doc states:

(...) So how exactly does Flask handle uploads? Well it will store them in the webserver’s memory if the files are reasonable small otherwise in a temporary location

I am unsure on how to interpret this, but as I saw it: cache the data on disk till the file is uploaded, before moving on. :-)
So my question is: is storing everything in memory during upload, intended behaviour?
To give a little more details on the code:
def store_upload(project_id):
    file = request.files['file']
    # boiler plate checks ...
    file.save(os.path.join(destination_base, destination))  #save file to decent location
    return _response_stuff()

I am using python 3.5, flask 0.11.1.
PS: I went through #pocoo and github issues here, but couldn't find any answer matching my request
Thanks!

Looks similar to a werkzeug issue. (which is closed)
here
The werkzeug version I am using: 0.11.10, so the fix should be applied.
Here someone is experiencing the same issue as I am. here
Shall I have a look there?

There's two issues you are likely experiencing:

Werkzeug's multipart form parser is very slow for large files - see pallets/werkzeug#875
Werkzeug will write a temporary file for anything larger than 500KB: https://github.com/pallets/werkzeug/blob/master/werkzeug/formparser.py#L41

If you want to upload large files through Flask I suggest you simply stream them directly in the request body. It's magnitudes faster on both client and server side as there's no encoding/decoding of the file. Basically you just read from request.stream.
This is what we've done on zenodo.org and we're having users upload 200GB+ datasets over HTTP with speeds that's only limited by our storage clusters incoming capacity.

Thanks for your tip!
However, reading from the stream, does not seem to fix the issue... The memory consumption still grows with the same order as the size of the file it receives...
The code is basically doing:
#(...)
 with open(temp_file, 'wb') as f:
        while not request.stream.is_exhausted:
            f.write(request.stream.read(10))

Also using request.stream.read() does not seem to make any difference.
Perhaps I am doing something wrong.
All tips (even to better frame the problem) are welcome.
thanks again

Check e.g. the request.mimetype and make sure it is not application/multipart-formdata (if it is, the form parser will likely kick in no matter what).
A side not is that likely you want to read bigger chunks that 10 bytes when writing the file.

Hi,
thanks for the tips again!
Yes the 10 bytes reading was just illustrative to make sure the chunks remain small.
However, I am Still facing the same issue, even with other mimetypes. With or without WSGI server (gunicorn). Memory usage just explodes.
But it looks like more and more an issue with werkzeug. Citing someone in this issue

(...) What it does instead is always store the entire file in memory, at least in one part of the code.

I will try to look for alternatives and bump the werkzeug people
Thanks for all the help!

To better frame the issue, I created a docker image which may be tried out.
To run it:
docker run --name flask_upload_issue -p 5000:5000 docker.io/cecemel/flask_upload_issue
Client side you could upload a file, like
curl -X POST -F file=@some_large_file http://localhost:5000/uploads
To monitor memory usage
docker stats flask_upload_issue
To check the code, go inside the container (so it should be running):
docker exec -ti flask_upload_issue bash
The folder 'example' contains the code.
Perhaps this gives more clues.
Thanks!

Cross post from https://github.com/pallets/werkzeug/issues/1041 :
Here is a sample Flask application for handling huge file uploads:
https://gitlab.nsd.uib.no/ire/python-webserver-file-submission-poc/blob/master/flask_app.py
At my machine it handles a 22 GiB file in ~60 seconds. Memory usage is constant at about 13 MiB.

Closing, this is a Werkzeug issue and is already reported there.

@ivarref I tried your way， but buf /cache will be used too much：
You can reproduce the result with 'free -m'

@ivarref thank you for the snippet! It works great locally but when I put it in an environment w/ Gunicorn behind an NGINX server, I keep seeing ClientDisconnect errors during the parsing of the from. Any idea what might be going on? Have you encountered this?

Sorry @dhruvp I have no suggestion.

Hey @ivarref ,
Thank you for your snippet! What kind of request must be done to that flask server? I hope that my question is not extremely elementary.
Cheers! :)

Hey @OdysLam
Here is an example request using curl:
curl -XPOST -F<EMAIL_ADDRESS>"http://localhost:8090/"

This is documented at the repository root.
Warning: Please note that this code uses Flask version 0.11.1, while as of writing this Flask 1.1.1 has been released. Also I have not looked at this code since writing it.

There's two issues you are likely experiencing:

Werkzeug's multipart form parser is very slow for large files - see pallets/werkzeug#875
Werkzeug will write a temporary file for anything larger than 500KB: https://github.com/pallets/werkzeug/blob/master/werkzeug/formparser.py#L41

If you want to upload large files through Flask I suggest you simply stream them directly in the request body. It's magnitudes faster on both client and server side as there's no encoding/decoding of the file. Basically you just read from request.stream.
This is what we've done on zenodo.org and we're having users upload 200GB+ datasets over HTTP with speeds that's only limited by our storage clusters incoming capacity.

Hi @lnielsen
How you deal with the request.stream?
request.stream.read() doesn't work for me. It still consums lots of memories.


Including third party libraries like bootstrap from node_modules

Hi,
I dont want to use CDN, i want to be able to include modules from node_modules like bootstrap, jQuery, etc etc. How can I achieve this?
Frank B

Many libraries at this moment support the CommonJS format. You can just install jQuery using npm, like this (in the root of your project):
npm install jquery --save

And then import it in some JS file:
import $ from 'jquery'

$('button').addClass('btn')

You may also want to add third-party libraries to the compiler_vendor array in this file:
https://github.com/davezuko/react-redux-starter-kit/blob/master/config/_base.js
It tells webpack to compile them to the vendor bundle instead of app.

But what If I want to include the bootstrap.min.css from the node_modules directory.. how can I achieve this? Been trying lots of things, but nothing seems to be working.

You can add Modules to the build path in the build/webpack.config.js file. I am not sure if this also works with bootstrap installed via npm, but it should. Just add to line 166 'bootstrap' or what ever your module is called.
BUT: You should focus more on the code you got and work with it. It is a bad idea to use jQuery AND React AND Redux AND ... You will bloat your app. You already got one strong library. Try to focus on this. If you want some tools to handle Arrays, Objects and Strings better look into lodash. If you want do to basic HTTP Request, use axios (still not for beginners. You have to learn to use redux-thunk with its promise based response). For Bootstrap you could use bootstrap-react.
But i would highly recommend you to first learn the basics of react/redux. Load in the bootstrap-react module so you can build fancy prototypes and try to learn the mechanics. Look into the build process with webpack (files in /build)... Hope i could help.

See: https://github.com/shakacode/bootstrap-loader

@frankbolviken In the bolilerplate you can just import CSS files. For example, add this to the main.js:
import 'bootstrap/dist/css/bootstrap.min.css'

And don't forget to remove bootstrap.css from the index.html:
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css">

For more information, how it's configured, see this file:
https://github.com/davezuko/react-redux-starter-kit/blob/master/build/webpack.config.js#L196

@frankbolviken Correct me someone, if I'm wrong, but I think that in the bolilerplate you can just import CSS files. For example, add this to the main.js:
import 'bootstrap/dist/css/bootstrap.min.css'

And don't forget to remove bootstrap.css from the index.html:
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css">

For more information, how it's configured, see this file:
https://github.com/davezuko/react-redux-starter-kit/blob/master/build/webpack.config.js#L196

@frankbolviken Look into adding bootstrap to your project via the npm package and then mimic how core.scss imports normalize.css.
@import '~normalize.css/normalize';

See @marshallford 's comment. Will consider moving bootstrap to a local dependency since this is brought up fairly frequently.


Text-diff for comparing page revisions

I'll work on this one.
If you have some ideas on how you would implement this, please share :)
I didn't have a look on the source code yet

It would be great if a moderation/editor group was able to approve changes in this way too...

#139


Question: How do I get root on encrypted zfs

Dear numtide Team,
first of all: I appreciate your great work and learn so much working with your tools.
Here comes the Question:
As far as I know root on zfs only works with keylocation=prompt. But this did not work with nixos-anywhere. So I went with keylocation = "file:///tmp/secret.key" and pass the key to nixos-anywhere with:
--disk-encryption-keys /tmp/secret.key /tmp/secret.key

After installation/before I reboot I do
$ umount -Rl /mnt
$ zpool export -a
$ reboot

On reboot the key is not found and the system refuses therefore to boot.
What ma I missing? Is there a way to use nixos-anywhere with root on encrypted zfs.
For reference: here are the relevant nix-files.
configuration.nix
# Edit this configuration file to define Options of your System. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config
, pkgs
, ...
}: {

  #nixpkgs.config.allowUnfree = true;
  #nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
  #  "vscode"
  #];

  boot ={
    loader = {
      # when installing toggle this to true
      efi ={
        canTouchEfiVariables = true;
        efiSysMountPoint = "/boot";
      };
      systemd-boot.enable = true;
    };
    #zfs.requestEncryptionCredentials = [ "zroot/root" ];
  };

  networking.hostName = "lombok";
  networking.hostId = "83b0a257";

  networking.networkmanager.enable = true;
  time.timeZone = null;
  services.geoclue2.enable = true;

  programs.vim.defaultEditor = true;

  environment.systemPackages = with pkgs; [
    firefox-wayland
    chromium
    vscodium
    mpv
    inkscape
    yt-dlp
    calibre
    ubuntu_font_family
    aspell
    aspellDicts.de
    aspellDicts.fr
    aspellDicts.en
    hunspell
    hunspellDicts.en-gb-ise
    signal-desktop
    gimp
    wl-clipboard
    poppler_utils
  ];

  fonts.enableDefaultFonts = true;

  documentation.doc.enable = false;
  documentation.man.enable = false;

  services.openssh.enable = true;
  services.printing = {
    enable = true;
    browsing = true;
    drivers = [ pkgs.gutenprint ];
  };
  sops.defaultSopsFile = ./secrets/secrets.yaml;
  system.stateVersion = "23.05";
}

disko.nix
{...}: {
  disko.devices = {
    disk.nvme = {
      type = "disk";
      device = "/dev/disk/by-id/nvme-Samsung_SSD_960_EVO_1TB_S3ETNB0J405286H";
      content = {
        type = "table";
        format = "gpt";
        partitions = [
          {
            name = "bootcode";
            start = "0";
            end = "1M";
            part-type = "primary";
            flags = ["bios_grub"];
          }
          {
            name = "efiboot";
            fs-type = "fat32";
            start = "1MiB";
            end = "1GiB";
            bootable = true;
            content = {
              type = "filesystem";
              format = "vfat";
              mountpoint = "/boot";
            };
          }
          {
            name = "swap";
            start = "1GiB";
            end = "17GiB";
            content = {
              type = "swap";
              randomEncryption = true;
            };
          }
          {
            name = "zroot";
            start = "17GiB";
            end = "100%";
            content = {
              type = "zfs";
              pool = "rpool";
            };
          }
        ];
      };
    };
    zpool = {
      rpool = {
        type = "zpool";
        rootFsOptions = {
          acltype = "posixacl";
          canmount = "off";
          checksum = "edonr";
          compression = "zstd";
          dnodesize = "auto";
          encryption = "aes-256-gcm";
          keyformat = "passphrase";
          # if you want to use the key for interactive login be sure there is no trailing newline
          # for example use `echo -n "password" > /tmp/secret.key`
          #keylocation = "file:///tmp/secret.key";
          keylocation = "prompt";
          mountpoint = "none";
          normalization = "formD";
          relatime = "on";
          xattr = "sa";
          "com.sun:auto-snapshot" = "false";
        };
        options = {
          ashift = "12";
          autotrim = "on";
        };

        datasets = {
          # zfs uses cow free space to delete files when the disk is completely filled
          reserved = {
            options = {
              canmount = "off";
              mountpoint = "none";
              reservation = "5GiB";
            };
            type = "zfs_fs";
          };
          home = {
            type = "zfs_fs";
            options.mountpoint = "legacy";
            mountpoint = "/home";
            options."com.sun:auto-snapshot" = "true";
            postCreateHook = "zfs snapshot rpool/home@empty";
          };
          persist = {
            type = "zfs_fs";
            options.mountpoint = "legacy";
            mountpoint = "/persist";
            options."com.sun:auto-snapshot" = "true";
            postCreateHook = "zfs snapshot rpool/persist@empty";
          };
          nix = {
            type = "zfs_fs";
            options.mountpoint = "legacy";
            mountpoint = "/nix";
            options = {
              atime = "off";
              canmount = "on";
              "com.sun:auto-snapshot" = "true";
            };
            postCreateHook = "zfs snapshot rpool/nix@empty";
          };
          root = {
            type = "zfs_fs";
            options.mountpoint = "legacy";
            mountpoint = "/";
            postCreateHook = ''
              zfs snapshot rpool/root@empty
              zfs snapshot rpool/root@lastboot
            '';
          };
        };
      };
    };
  };
}

hardware-configuration.nix
{ lib
, modulesPath
, ...
}: {
  imports = [
    (modulesPath + "/installer/scan/not-detected.nix")
  ];

  boot = {
    extraModulePackages = [ ];

    initrd = {
      availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
      kernelModules = [ ];

      postDeviceCommands =
        #wipe / and /var on boot
        lib.mkAfter ''
          zfs rollback -r rpool/root@empty
      '';
    };

    kernelModules = [ "kvm-intel" ];

  fileSystems."/persist".neededForBoot = true;

  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
}

zfs.nix
{ config, pkgs, lib, ... }:
# Other useful settings come from srvos's zfs module
{
  config = lib.mkIf config.boot.zfs.enabled {
    environment.systemPackages = [
      pkgs.zfs-prune-snapshots
    ];

    boot = {
      # Newest kernels might not be supported by ZFS
      kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
      # ZFS does not support swapfiles, disable hibernate and set cache max
      kernelParams = [
        "nohibernate"
        "zfs.zfs_arc_max=17179869184"
      ];
      supportedFilesystems = [ "vfat" "zfs" ];
      zfs = {
        devNodes = "/dev/disk/by-id/";
        forceImportAll = true;
        removeLinuxDRM = pkgs.hostPlatform.isAarch64;
        requestEncryptionCredentials = true;
        #zfs.requestEncryptionCredentials = [ "rpool/root" ];
      };
    };

    services.zfs = {
      autoScrub.enable = true;
      trim.enable = true;
    };
    # Don't let zfs mount the the datasets, because of legacy mounting
    systemd.services.zfs-mount.enable = false;
  };

}

Thanks in advance.

Hey @lutzgo, thanks for the kind words! Your first approach is almost correct, we probably should improve documentation here.
There's a hook system in disko, so keep your --disk-encryption-keys /tmp/secret.key /tmp/secret.key and try the following in your zpool config:
    rpool = {
      [...]
      rootFsOptions = {
        keylocation = "file:///tmp/disk.key";
        keyformat = "passphrase";
        [...]
      };
      postCreateHook = ''
        zfs set keylocation="prompt" $name;
      '';

(I implemented the hook system for exactly this use case ;))

Hey @phaer,
thank you so much for the fast and explicit answer. Actually very obvious. 🤷🏼♀ I am constantly learning.👨🎓

You are welcome :)
One thing to keep in mind is that the secret key file `/tmp/secret.key´ should not end in a newline, otherwise the prompt will fail as pressing the enter key there would submit your key, so it would end up comparing "top-secret" to "top-secret\n".
A quick check in code whether that's the case might even be a better solution than documentation here.

Thank you for the advice @phaer. I even got it in my code, so that I always remember it, when I am editing:
disko.nix
encryption = "aes-256-gcm";
keyformat = "passphrase";
# if you want to use the key for interactive login be sure there is no trailing newline
# for example use `echo -n "password" > /tmp/secret.key`
keylocation = "file:///tmp/secret.key";


dotnet 8: Error Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 31 - Encryption(ssl/tls) handshake failed)

Describe the bug
This is the same issue as described here. We need to upgrade dotnet from 6 to 8, needed for LTS, however, we cannot upgrade the database (yet).
Stack trace:
System.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 31 - Encryption(ssl/tls) handshake failed)
 ---> System.IO.EndOfStreamException: End of stream reached
   at System.Data.SqlClient.SNI.SslOverTdsStream.ReadInternal(Byte[] buffer, Int32 offset, Int32 count, CancellationToken token, Boolean async)
   at System.Data.SqlClient.SNI.SslOverTdsStream.Read(Byte[] buffer, Int32 offset, Int32 count)
   at System.IO.Stream.Read(Span`1 buffer)
   at System.Net.Security.SyncReadWriteAdapter.ReadAsync(Stream stream, Memory`1 buffer, CancellationToken cancellationToken)
   at System.Net.Security.SslStream.EnsureFullTlsFrameAsync[TIOAdapter](CancellationToken cancellationToken, Int32 estimatedSize)
   at System.Runtime.CompilerServices.PoolingAsyncValueTaskMethodBuilder`1.StateMachineBox`1.System.Threading.Tasks.Sources.IValueTaskSource<TResult>.GetResult(Int16 token)
   at System.Net.Security.SslStream.ReceiveHandshakeFrameAsync[TIOAdapter](CancellationToken cancellationToken)
   at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
   at System.Net.Security.SslStream.AuthenticateAsClient(SslClientAuthenticationOptions sslClientAuthenticationOptions)
   at System.Data.SqlClient.SNI.SNITCPHandle.EnableSsl(UInt32 options)
   at System.Data.SqlClient.SNI.SNIProxy.EnableSsl(SNIHandle handle, UInt32 options)
   at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, SqlCredential credential, Object providerInfo, String newPassword, SecureString newSecurePassword, Boolean redirectedUserInstance, SqlConnectionString userConnectionOptions, SessionData reconnectSessionData, Boolean applyTransientFaultHandling, String accessToken)
   at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, DbConnectionPoolKey poolKey, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection, DbConnectionOptions userOptions)
   at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnectionPool pool, DbConnection owningObject, DbConnectionOptions options, DbConnectionPoolKey poolKey, DbConnectionOptions userOptions)
   at System.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject, DbConnectionOptions userOptions, DbConnectionInternal oldConnection)
   at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject, DbConnectionOptions userOptions, DbConnectionInternal oldConnection)
   at System.Data.ProviderBase.DbConnectionPool.TryGetConnection(DbConnection owningObject, UInt32 waitForMultipleObjectsTimeout, Boolean allowCreate, Boolean onlyOneCheckConnection, DbConnectionOptions userOptions, DbConnectionInternal& connection)
   at System.Data.ProviderBase.DbConnectionPool.TryGetConnection(DbConnection owningObject, TaskCompletionSource`1 retry, DbConnectionOptions userOptions, DbConnectionInternal& connection)
   at System.Data.ProviderBase.DbConnectionFactory.TryGetConnection(DbConnection owningConnection, TaskCompletionSource`1 retry, DbConnectionOptions userOptions, DbConnectionInternal oldConnection, DbConnectionInternal& connection)
   at System.Data.ProviderBase.DbConnectionInternal.TryOpenConnectionInternal(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource`1 retry, DbConnectionOptions userOptions)
   at System.Data.ProviderBase.DbConnectionClosed.TryOpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource`1 retry, DbConnectionOptions userOptions)
   at System.Data.SqlClient.SqlConnection.TryOpen(TaskCompletionSource`1 retry)
   at System.Data.SqlClient.SqlConnection.Open()
   at sqltest.Program.Main(String[] args) in /src/src/ConsoleAppConnectivity/Program.cs:line 29
ClientConnectionId:d974cac0-f1a3-4864-9867-17360db6e502

To reproduce
Very simple console app to replicate:
using System.Data.SqlClient;

namespace sqltest
{
    class Program
    {
        static void Main(string[] args)
        {
            try
            {
                var builder = new SqlConnectionStringBuilder
                {
                    DataSource = "<host>",
                    UserID = "<user>",
                    Password = "<pw>",
                    InitialCatalog = "<DB>",
                    TrustServerCertificate = true,
                    Encrypt = false
                };

                using SqlConnection connection = new(builder.ConnectionString);
                Console.WriteLine("\nQuery data example:");
                Console.WriteLine("=========================================\n");

                connection.Open();

                var sql = "SELECT top 10 * FROM dbo.<Table>";
                using SqlCommand command = new(sql, connection);
                using SqlDataReader reader = command.ExecuteReader();
                while (reader.Read())
                {
                    Console.WriteLine("{0} {1}", reader.GetString(0), reader.GetString(1));
                }
            }
            catch (SqlException e)
            {
                Console.WriteLine(e.ToString());
            }
            Console.WriteLine("\nDone. Press enter.");
            Console.ReadLine();
        }
    }
}

Dockerfile:
FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
COPY certificates/ca/cert.pem /etc/ssl/certs/cert.pem
RUN update-ca-certificates

WORKDIR /app

FROM mcr.microsoft.com/dotnet/sdk:8.0 as build
COPY certificates/ca/cert.pem /etc/ssl/certs/cert.pem
RUN update-ca-certificates

WORKDIR /src
COPY . .

RUN dotnet restore src/ConsoleAppConnectivity --ignore-failed-sources
RUN dotnet build src/ConsoleAppConnectivity/ConsoleAppConnectivity.csproj -c Release -o /app --no-restore

FROM build AS publish
RUN dotnet publish src/ConsoleAppConnectivity/ConsoleAppConnectivity.csproj -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .

# Recommended change to make it work
RUN sed -i 's/CipherString = DEFAULT@SECLEVEL=2/CipherString = DEFAULT@SECLEVEL=1/g' /etc/ssl/openssl.cnf

ENTRYPOINT ["dotnet", "ConsoleAppConnectivity.dll"]

Expected behaviour
Top 10 records from "dbo.< Table > "
Further technical details
Microsoft.Data.SqlClient version: 5.1.2
.NET target: 8
SQL Server version: SQL Server 2012
Operating system: Microsoft SQL Server Standard (64-bit)
Additional context
I have tested with different dotnet images, any of the dotnet 8 works.
The same run changing dotnet images and target framework to 5, 6 and 7 connects properly and works as expected.
I've run and made changes in the openssl.cnf in "/etc/ssl/" and "/usr/lib/ssl/openssl.cnf" and looks like it does not contain the "SECLEVEL" and/or "MinProtocol" properties.
I have also appended the properties into the configuration files, but seems not difference take effect.
Here is the output once I open the file:
RUN cd /usr/lib/ssl/ && cat openssl.cnf

8d69270d56e1a1f3171d4c6b0de34fc5d6c277f2521d2db752d9403d675b
#
# OpenSSL example configuration file.
# See doc/man5/config.pod for more info.
#
# This is mostly being used for generation of certificate requests,
# but may be used for auto loading of providers

# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .

 # Use this in order to automatically load providers.
openssl_conf = openssl_init

# Comment out the next line to ignore configuration errors
config_diagnostics = 1

# Extra OBJECT IDENTIFIER info:
# oid_file       = $ENV::HOME/.oid
oid_section = new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		=
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=<IP_ADDRESS>
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = <IP_ADDRESS>.1
tsa_policy2 = <IP_ADDRESS>.5.6
tsa_policy3 = <IP_ADDRESS>.5.7

# For FIPS
# Optionally include a file that is generated by the OpenSSL fipsinstall
# application. This file contains configuration data required by the OpenSSL
# fips provider. It contains a named section e.g. [fips_sect] which is
# referenced from the [provider_sect] below.
# Refer to the OpenSSL security policy for more information.
# .include fipsmodule.cnf

[openssl_init]
# providers = provider_sect

# List of providers to load
# [provider_sect]
# default = default_sect
# The fips section name should match the section name inside the
# included fipsmodule.cnf.
# fips = fips_sect

# If no providers are activated explicitly, the default one is activated implicitly.
# See man 7 OSSL_PROVIDER-default for more details.
#
# If you add a section explicitly activating any other provider(s), you most
# probably need to explicitly activate the default provider, otherwise it
# becomes unavailable in openssl.  As a consequence applications depending on
# OpenSSL may not work correctly which could lead to significant system
# problems including inability to remotely access the system.
# [default_sect]
# activate = 1

####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= ./demoCA		# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several certs with same subject.
new_certs_dir	= $dir/newcerts		# default place for new certs.

certificate	= $dir/cacert.pem 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crlnumber	= $dir/crlnumber	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/private/cakey.pem# The private key

x509_extensions	= usr_cert		# The extensions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 2048
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extensions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]

# Extensions for a typical CA

# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

basicConstraints = critical,CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= ./demoCA		# TSA root directory
serial		= $dir/tsaserial	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir/cacert.pem	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest  = sha256			# Signing digest to use. (Optional)
default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)
ess_cert_id_alg		= sha1	# algorithm to compute certificate
				# identifier (optional, default: sha1)

[insta] # CMP using Insta Demo CA
# Message transfer
server = pki.certificate.fi:8700
# proxy = # set this as far as needed, e.g., http://<IP_ADDRESS>:8080
# tls_use = 0
path = pkix/

# Server authentication
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
ignore_keyusage = 1 # potentially needed quirk
unprotected_errors = 1 # potentially needed quirk
extracertsout = insta.extracerts.pem

# Client authentication
ref = 3078 # user identification
secret = pass:insta # can be used for both client and server side

# Generic message options
cmd = ir # default operation, can be overridden on cmd line with, e.g., kur

# Certificate enrollment
subject = "/CN=openssl-cmp-test"
newkey = insta.priv.pem
out_trusted = apps/insta.ca.crt # does not include keyUsage digitalSignature
certout = insta.cert.pem

[pbm] # Password-based protection for Insta CA
# Server and client authentication
ref = $insta::ref # 3078
secret = $insta::secret # pass:insta

[signature] # Signature-based protection for Insta CA
# Server authentication
trusted = $insta::out_trusted # apps/insta.ca.crt

# Client authentication
secret = # disable PBM
key = $insta::newkey # insta.priv.pem
cert = $insta::certout # insta.cert.pem

[ir]
cmd = ir

[cr]
cmd = cr

[kur]
# Certificate update
cmd = kur
oldcert = $insta::certout # insta.cert.pem

[rr]
# Certificate revocation
cmd = rr
oldcert = $insta::certout # insta.cert.pem

Any help would be much appreciated.

dotnet8 base image uses debian 12, which uses openssl-3, where SHA-1 was downgraded to security level 0. I did not manage to connect yet, even with CipherString = DEFAULT@SECLEVEL=0, only TLS1.2 ciphers are proposed in ClientHello
Transmission Control Protocol, Src Port: 38146, Dst Port: 1433, Seq: 95, Ack: 49, Len: 276
Tabular Data Stream
    Type: TDS7 pre-login message (18)
    Status: 0x01, End of message
    Length: 276
    Channel: 0
    Packet Number: 0
    Window: 0
    Pre-Login Message
    Transport Layer Security
        TLSv1 Record Layer: Handshake Protocol: Client Hello
            Content Type: Handshake (22)
            Version: TLS 1.0 (0x0301)
            Length: 263
            Handshake Protocol: Client Hello
                Handshake Type: Client Hello (1)
                Length: 259
                Version: TLS 1.2 (0x0303)
                Random: 028f739bddd548bca2e0ee52244232df1b32fa6f90b5bf4058dbced2219a6de8
                Session ID Length: 32
                Session ID: 06a201cf00cf98334a137210de9c81065ac16697c6020f3f5c9ae19bdc409b03
                Cipher Suites Length: 24
                Cipher Suites (12 suites)
                    Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)
                    Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303)
                    Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301)
                    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
                    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
                    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
                    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
                    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)
                    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
                    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
                    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
                    Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)
                Compression Methods Length: 1
                Compression Methods (1 method)
                Extensions Length: 162
                Extension: ec_point_formats (len=4)
                    Type: ec_point_formats (11)
                    Length: 4
                    EC point formats Length: 3
                    Elliptic curves point formats (3)
                Extension: supported_groups (len=22)
                    Type: supported_groups (10)
                    Length: 22
                    Supported Groups List Length: 20
                    Supported Groups (10 groups)
                Extension: session_ticket (len=0)
                    Type: session_ticket (35)
                    Length: 0
                    Session Ticket: <MISSING>
                Extension: status_request (len=5)
                    Type: status_request (5)
                    Length: 5
                    Certificate Status Type: OCSP (1)
                    Responder ID list Length: 0
                    Request Extensions Length: 0
                Extension: encrypt_then_mac (len=0)
                    Type: encrypt_then_mac (22)
                    Length: 0
                Extension: extended_master_secret (len=0)
                    Type: extended_master_secret (23)
                    Length: 0
                Extension: signature_algorithms (len=42)
                    Type: signature_algorithms (13)
                    Length: 42
                    Signature Hash Algorithms Length: 40
                    Signature Hash Algorithms (20 algorithms)
                Extension: supported_versions (len=9) TLS 1.3, TLS 1.2, TLS 1.1, TLS 1.0
                    Type: supported_versions (43)
                    Length: 9
                    Supported Versions length: 8
                    Supported Version: TLS 1.3 (0x0304)
                    Supported Version: TLS 1.2 (0x0303)
                    Supported Version: TLS 1.1 (0x0302)
                    Supported Version: TLS 1.0 (0x0301)
                Extension: psk_key_exchange_modes (len=2)
                    Type: psk_key_exchange_modes (45)
                    Length: 2
                    PSK Key Exchange Modes Length: 1
                    PSK Key Exchange Mode: PSK with (EC)DHE key establishment (psk_dhe_ke) (1)
                Extension: key_share (len=38) x25519
                    Type: key_share (51)
                    Length: 38
                    Key Share extension
                [JA4: t13i121000_a538d02d76d5_f6eeaf393d2e]
                [JA4_r: t13i121000_00ff,1301,1302,1303,c023,c024,c027,c028,c02b,c02c,c02f,c030_0005,000a,000b,000d,0016,0017,0023,002b,002d,0033_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602]
                [JA3 Fullstring: 771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191-255,11-10-35-5-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2]
                [JA3: 64415168a62acdefdaa061ac3ae40abc]

Here is the modified openssl.cnf I used to correctly connect :
#
# OpenSSL example configuration file.
# See doc/man5/config.pod for more info.
#
# This is mostly being used for generation of certificate requests,
# but may be used for auto loading of providers

# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .

 # Use this in order to automatically load providers.
openssl_conf = openssl_init

# Comment out the next line to ignore configuration errors
config_diagnostics = 1

# Extra OBJECT IDENTIFIER info:
# oid_file       = $ENV::HOME/.oid
oid_section = new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		=
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=<IP_ADDRESS>
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = <IP_ADDRESS>.1
tsa_policy2 = <IP_ADDRESS>.5.6
tsa_policy3 = <IP_ADDRESS>.5.7

# For FIPS
# Optionally include a file that is generated by the OpenSSL fipsinstall
# application. This file contains configuration data required by the OpenSSL
# fips provider. It contains a named section e.g. [fips_sect] which is
# referenced from the [provider_sect] below.
# Refer to the OpenSSL security policy for more information.
# .include fipsmodule.cnf

[openssl_init]
# providers = provider_sect

ssl_conf = ssl_sect

# List of providers to load
# [provider_sect]
# default = default_sect
# The fips section name should match the section name inside the
# included fipsmodule.cnf.
# fips = fips_sect

# If no providers are activated explicitly, the default one is activated implicitly.
# See man 7 OSSL_PROVIDER-default for more details.
#
# If you add a section explicitly activating any other provider(s), you most
# probably need to explicitly activate the default provider, otherwise it
# becomes unavailable in openssl.  As a consequence applications depending on
# OpenSSL may not work correctly which could lead to significant system
# problems including inability to remotely access the system.
# [default_sect]
# activate = 1

####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= ./demoCA		# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several certs with same subject.
new_certs_dir	= $dir/newcerts		# default place for new certs.

certificate	= $dir/cacert.pem 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crlnumber	= $dir/crlnumber	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/private/cakey.pem# The private key

x509_extensions	= usr_cert		# The extensions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 2048
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extensions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]

# Extensions for a typical CA

# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

basicConstraints = critical,CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= ./demoCA		# TSA root directory
serial		= $dir/tsaserial	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir/cacert.pem	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest  = sha256			# Signing digest to use. (Optional)
default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)
ess_cert_id_alg		= sha1	# algorithm to compute certificate
				# identifier (optional, default: sha1)

[insta] # CMP using Insta Demo CA
# Message transfer
server = pki.certificate.fi:8700
# proxy = # set this as far as needed, e.g., http://<IP_ADDRESS>:8080
# tls_use = 0
path = pkix/

# Server authentication
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
ignore_keyusage = 1 # potentially needed quirk
unprotected_errors = 1 # potentially needed quirk
extracertsout = insta.extracerts.pem

# Client authentication
ref = 3078 # user identification
secret = pass:insta # can be used for both client and server side

# Generic message options
cmd = ir # default operation, can be overridden on cmd line with, e.g., kur

# Certificate enrollment
subject = "/CN=openssl-cmp-test"
newkey = insta.priv.pem
out_trusted = apps/insta.ca.crt # does not include keyUsage digitalSignature
certout = insta.cert.pem

[pbm] # Password-based protection for Insta CA
# Server and client authentication
ref = $insta::ref # 3078
secret = $insta::secret # pass:insta

[signature] # Signature-based protection for Insta CA
# Server authentication
trusted = $insta::out_trusted # apps/insta.ca.crt

# Client authentication
secret = # disable PBM
key = $insta::newkey # insta.priv.pem
cert = $insta::certout # insta.cert.pem

[ir]
cmd = ir

[cr]
cmd = cr

[kur]
# Certificate update
cmd = kur
oldcert = $insta::certout # insta.cert.pem

[rr]
# Certificate revocation
cmd = rr
oldcert = $insta::certout # insta.cert.pem

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=0

@BastienDurel have you looked into WireShark traces to see what TLS version is being sent to the server?   SQL Server 2012 does not support TLS 1.3.

@BastienDurel have you tried disabling TLS 1.3 and see the results? Another approach would be testing against SQL Server 2022 to see if you can make a connection.  SQL Server 2022 and after are supporting TLS 1.3.
in this packet Client has offered TLS1.3 and TLS 1.2

I cannot upgrade the SQL server itself, it's a client's production server :(
But the problem is not the TLS1.3 offering, is the fact openssl does not offer TLS1 ciphers and SHA-1 hash methods by default, hence the modified openssl.cnf

so, the issue seems like not SqlClient related maybe?

Thank you @BastienDurel
I have tested with the below modification in the openssl.cnf
[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=0

I can confirm now it is connected with SQL and working as expected.
Again, thank you for your help.

so, the issue seems like not SqlClient related maybe?

not really SqlClient-specific, it's a general TLS problem which affects SqlClient because the server it connects to is often non-upgradable (no-one exposes a web-server that does not support TLS1.2, but the problem should arise with every TLS client trying to connect to an outdated server.)
The real problem with sqlClient is it requires (AFAIK) a container-wide workaround, I would love to set the cipher/hash list in a client option and not have to mess with the container-wide configuration

I have tested with the below modification in the openssl.cnf
[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=0

I can confirm now it is connected with SQL and working as expected.

Did you append it manually or using a command in your Dockerfile? Was curious if I'm on the right track by trying to modify openssl.cnf with "RUN -i -e" commands in my Dockerfile.

I used to append via printf : RUN printf "[system_default_sect]\nMinProtocol = TLSv1.2\nCipherString = DEFAULT@SECLEVEL=1\n" >> /etc/ssl/openssl.cnf, but now I'm overriding the whole file with COPY d12-openssl.cnf /etc/ssl/openssl.cnf

BTW: I use a conditional inclusion :
ARG BUILD_FOR=new

[...]

FROM base as int_old
ONBUILD COPY d12-openssl.cnf /etc/ssl/openssl.cnf

FROM base as int_new
ONBUILD RUN echo "does not override openssl.cnf"

FROM int_${BUILD_FOR} AS final
COPY --from=publish /app/publish /app

So I can generate images for old servers or new ones by changing BUILD_FOR parameter

Considering the .Net 8.0 default image using Debian 12 we can use  dotnet/sdk:8.0-jammy instead of dotnet/sdk:8.0
more detail
then add the code below in the Dockerfile according @BastienDurel comment:
RUN printf "[system_default_sect]\nMinProtocol = TLSv1.2\nCipherString = DEFAULT@SECLEVEL=0\n" >> /etc/ssl/openssl.cnf
ConnectionString:
 "DefaultConnection": "Data Source=<IP_ADDRESS>;Initial Catalog=yourDb;User ID=yourUser;Password=yourPassword;MultipleActiveResultSets=True;TrustServerCertificate=True;"

Closing as it is not SQL client related

hi guys, this is aproblem with tsl/ssl communication between net 8 and sql server with old tsl version adopted..
by puting this into the docker file before the "AS build" block will be work great.
RUN sed -i '/[openssl_init]/a ssl_conf = ssl_sect' /etc/ssl/openssl.cnf
RUN printf "\n[ssl_sect]\nsystem_default = system_default_sect\n" >> /etc/ssl/openssl.cnf
RUN printf "\n[system_default_sect]\nMinProtocol = TLSv1.2\nCipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf
you can convert those 3 lines into 2 lines but is too long, I dont like it..
I've proved in net 8 with sql server 2016 in docker enviroment.
this is my dockerfile
`FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
WORKDIR /app
EXPOSE 5000
RUN sed -i '/[openssl_init]/a ssl_conf = ssl_sect' /etc/ssl/openssl.cnf
RUN printf "\n[ssl_sect]\nsystem_default = system_default_sect\n" >> /etc/ssl/openssl.cnf
RUN printf "\n[system_default_sect]\nMinProtocol = TLSv1.2\nCipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf
FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
ARG BUILD_CONFIGURATION=Release
WORKDIR /src
RUN dotnet restore "./WebApi/./WebApi.csproj"
COPY . .
WORKDIR "/src/WebApi"
RUN dotnet build "./WebApi.csproj" -c $BUILD_CONFIGURATION -o /app/build
FROM build AS publish
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "./WebApi.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false
FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "WebApi.dll"]`

Hi everyone, I encountered that this is an issue with TLS/SSL communication between .NET 8 and SQL Server due to an older TLS version being used.
To resolve this, inserting the following into the Dockerfile before the "AS build" block works great:
RUN sed -i '/\[openssl_init\]/a ssl_conf = ssl_sect' /etc/ssl/openssl.cnf
RUN printf "\n[ssl_sect]\nsystem_default = system_default_sect\n" >> /etc/ssl/openssl.cnf
RUN printf "\n[system_default_sect]\nMinProtocol = TLSv1.2\nCipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf

Although these 3 lines can be combined into 2 lines, it makes it too lengthy, so I preferred this format.
I've tested it on .NET 8 with SQL Server 2016 in a Docker environment.
Here's a snippet of my Dockerfile:
FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
WORKDIR /app
EXPOSE 5000
RUN sed -i '/\[openssl_init\]/a ssl_conf = ssl_sect' /etc/ssl/openssl.cnf
RUN printf "\n[ssl_sect]\nsystem_default = system_default_sect\n" >> /etc/ssl/openssl.cnf
RUN printf "\n[system_default_sect]\nMinProtocol = TLSv1.2\nCipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
ARG BUILD_CONFIGURATION=Release
WORKDIR /src

RUN dotnet restore "./WebApi/./WebApi.csproj"
COPY . .
WORKDIR "/src/WebApi"
RUN dotnet build "./WebApi.csproj" -c $BUILD_CONFIGURATION -o /app/build

FROM build AS publish
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "./WebApi.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "WebApi.dll"]

This works to me to connect sql 2012 ( set MinProtocol = TLSv1 and  DEFAULT@SECLEVEL=1)
RUN sed -i '/\[openssl_init\]/a ssl_conf = ssl_sect' /etc/ssl/openssl.cnf
RUN printf "\n[ssl_sect]\nsystem_default = system_default_sect\n" >> /etc/ssl/openssl.cnf
RUN printf "\n[system_default_sect]\nMinProtocol = TLSv1\nCipherString = DEFAULT@SECLEVEL=1" >> /etc/ssl/openssl.cnf

Hi Everyone,
I'm facing the same exception but in my case it's a .Net 8 AWS Lambda project from where I'm connecting to the SQL server version 12.0.6372.1 and it doesn't have a docker file so not sure how to modify the openssl.cnf file.
Any help would be greatly appreciated.
Thanks in advance! :)

This works to me to connect sql 2012 ( set MinProtocol = TLSv1 and DEFAULT@SECLEVEL=1)
RUN sed -i '/\[openssl_init\]/a ssl_conf = ssl_sect' /etc/ssl/openssl.cnf
RUN printf "\n[ssl_sect]\nsystem_default = system_default_sect\n" >> /etc/ssl/openssl.cnf
RUN printf "\n[system_default_sect]\nMinProtocol = TLSv1\nCipherString = DEFAULT@SECLEVEL=1" >> /etc/ssl/openssl.cnf

it works for me，but DEFAULT@SECLEVEL needs to be set to 0，which is as follows：
RUN sed -i '/\[openssl_init\]/a ssl_conf = ssl_sect' /etc/ssl/openssl.cnf RUN printf "\n[ssl_sect]\nsystem_default = system_default_sect\n" >> /etc/ssl/openssl.cnf RUN printf "\n[system_default_sect]\nMinProtocol = TLSv1\nCipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf
In my testing, TLSv1 and TLSv1.0 are not equivalent

only a recomendation. In some cases We must add the next line after the first line in our docker file.
We migth add "USER root" line, because If it isn't there It will fail When We execute docker build
I show you how It is:
FROM mcr.microsoft.com/dotnet/aspnet AS base
USER root
WORKDIR /app
EXPOSE 8080
EXPOSE 8081
#RUN chmod +rwx /etc/ssl
RUN sed -i '/[openssl_init]/a ssl_conf = ssl_sect' /etc/ssl/openssl.cnf
RUN printf "\n[ssl_sect]\nsystem_default = system_default_sect\n" >> /etc/ssl/openssl.cnf
RUN printf "\n[system_default_sect]\nMinProtocol = TLSv1\nCipherString = DEFAULT@SECLEVEL=1" >> /etc/ssl/openssl.cnf

I have a .NET 8 application and SQL Server 2016. I tried the following commands, but they didn't resolve the issue:
RUN sed -i '/[openssl_init]/a ssl_conf = ssl_sect' /etc/ssl/openssl.cnf
RUN printf "\n[ssl_sect]\nsystem_default = system_default_sect\n" >> /etc/ssl/openssl.cnf
RUN printf "\n[system_default_sect]\nMinProtocol = TLSv1.2\nCipherString = DEFAULT@SECLEVEL=0\n" >> /etc/ssl/openssl.cnf


Use Location as starting point

As a user, I want to use my location as the starting point of my navigation to get to a destination.

Acceptance:

[ ] Start a navigation query with own location as starting point

DoD:

[ ] Tests
[ ]  Documentation
[ ]  CI Build passing
[ ]  Peer Review
[ ]  Approval from PO