Document msteams: uri format

I've noticed when going to links for msteams channels like so;
https://teams.microsoft.com/l/channel/19%[redacted]%40thread.skype/Sprite%2520is%2520NOT%2520Lemonade?groupId=[redacted]&tenantId=[redacted]
It will take you to the Teams website which executes some Javascript behind the scenes to filter out all the undeeded crap so you get left with a URI that launches MS Teams. So you get something like this:
msteams:/l/channel/19:[redacted]@thread.skype/ICT%20-%20Information%20and%20Handy%20Hints?groupId=[redacted]&tenantId=[redacted]&deeplinkId=[redacted]
Obviously where all the redacted are is the GUID or whatever of the respective channel, I can't seem to find anywhere what the scheme of msteams: actually is, I have my own "research" on how it works and how to ceate my own URI links but I would like to see it offically documentated, I am more than happy if it comes to it to create my own PR with what I know to make life easier, but I doubt it would be upto standard.

My understanding is that when you have a link like this:
https://teams.microsoft.com/l/channel/
Which is assuming we're wanting to URI laucnh to a channel we can translate that to
msteams:/l/channel/
which is the URI version, then in the link we have
19%3a
Which translates in the URI to
/19:
where %3A is the :
Then you have what I assume is a hash of the channel so a random fill here:
140864078AECA1C7C35B4BEB33C53C34
Which doesn't need translating so it should make the whole URI so far look like this:
msteams:/l/channel/19:140864078AECA1C7C35B4BEB33C53C34
which wil launch teams but not to the channel we want, so next up we're gonna take the
%40thread.skype/
from the original link that Teams gives us, the only translation is the decode of the HTML character %40 which is "@"
giving us
@thread.skype/
It's nice to see btw that we're still using Skype backend names😉.
Once more we take the channel NAME from the link which for me is:
ICT%2520-%2520Information%2520and%2520Handy%2520Hints
we need to de-encode this as it's encoded twice as explained here.
which gives us
ICT%20-%20Information%20and%20Handy%20Hints
then for the last step we get the "groupId" which is just the GUID from the URL (it should be obvious) but will look like this
155983f3-2a3e-4dd0-8d4b-7e50b4b7d332
In my testing you didn't need the tenantId but if it turns out you do, just do the same step above , so your total URI should look like
msteams:/l/channel/19:140864078AECA1C7C35B4BEB33C53C34@thread.skype/ICT%20-%20Information%20and%20Handy%20Hints?groupId=155983f3-2a3e-4dd0-8d4b-7e50b4b7d332&tenantId=155983f3-2a3e-4dd0-8d4b-7e50b4b7d332

That's our cross-platform deep link format. It's actually a serialization of a JSON object, the schema of which is specific to each verb (message, team, channel, chat, meetup-join, and others). Currently the only one that's documented is the entity deep link format. Deep links do not use msteams:// URIs; they use https://teams.microsoft.com/l/... syntax.
The reason why we haven't documented the others is that we haven't provided any way to obtain the identifiers (e.g. channel IDs, conversation IDs,  user IDs) they use. The<EMAIL_ADDRESS>IDs are perfect examples of that.
We plan to expose this functionality later this year.

I found channel Ids etc from the desktop app when asking for a link so that is one way it's exposed, but it's nice to know it's on the backburner as they say.

saya setuju dengan alasan @billbliss bahwa untuk mengindentifikasi secara benar sangat diperlukan ada pengguna semacam user name karena jika log in pada situs msteams maka email kerja bisa bersamaan jalannya dengan serialisasi log in dengan Microsoft Online Account yang ada.

I think what bill says above resolves this issue.  Let me know if that is not the case.

That's our cross-platform deep link format. It's actually a serialization of a JSON object, the schema of which is specific to each verb (message, team, channel, chat, meetup-join, and others). Currently the only one that's documented is the entity deep link format. Deep links do not use msteams:// URIs; they use https://teams.microsoft.com/l/... syntax.
The reason why we haven't documented the others is that we haven't provided any way to obtain the identifiers (e.g. channel IDs, conversation IDs, user IDs) they use. The<EMAIL_ADDRESS>IDs are perfect examples of that.
We plan to expose this functionality later this year.

Hi! Any news on that subject?


Use standard import statements more when running the unit-tests

Please refer to the individual commit messages for additional information.

/botio unittest

/botio fonttest

/botio test

Looks much better. Thanks!

Looks much better. Thanks!

Thank you for reviewing/landing this, and the other recent test-related patches.
It's really fascinating how code sort of "ages", like in the font-tests, when you don't touch it for a couple of years.


fix(loader): escape backtick characters that may lie within comments

:tada: This PR is included in version 0.2.1 :tada:
The release is available on:

npm package (@latest dist-tag)
GitHub release

Your semantic-release bot :package::rocket:


compilation error of "bamtools_filter.cpp.o"

I am trying to install the BamTools on Mac Catalina. During the make compilation I have the following error:
mtajhusl@Drs-MacBook-Pro build % sudo make Password: [ 66%] Built target BamTools [ 74%] Built target BamTools-utils [ 76%] Building CXX object src/toolkit/CMakeFiles/bamtools_cmd.dir/bamtools_filter.cpp.o In file included from /Users/tajammul/Documents/packages/bamtools/src/toolkit/bamtools_filter.cpp:19: In file included from /usr/local/Cellar/jsoncpp/1.9.1/include/json/json.h:9: In file included from /usr/local/Cellar/jsoncpp/1.9.1/include/json/autolink.h:9: In file included from /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:132: /usr/local/Cellar/jsoncpp/1.9.1/include/json/allocator.h:18:22: warning: alias declarations are a C++11       extension [-Wc++11-extensions]   using value_type = T;                      ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/allocator.h:19:19: warning: alias declarations are a C++11       extension [-Wc++11-extensions]   using pointer = T*;                   ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/allocator.h:20:25: warning: alias declarations are a C++11       extension [-Wc++11-extensions]   using const_pointer = const T*;                         ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/allocator.h:21:21: warning: alias declarations are a C++11       extension [-Wc++11-extensions]   using reference = T&;                     ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/allocator.h:22:27: warning: alias declarations are a C++11       extension [-Wc++11-extensions]   using const_reference = const T&;                           ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/allocator.h:23:21: warning: alias declarations are a C++11       extension [-Wc++11-extensions]   using size_type = std::size_t;                     ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/allocator.h:24:27: warning: alias declarations are a C++11       extension [-Wc++11-extensions]   using difference_type = std::ptrdiff_t;                           ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/allocator.h:50:21: warning: variadic templates are a C++11       extension [-Wc++11-extensions]   template <typename... Args> void construct(pointer p, Args&&... args) {                     ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/allocator.h:50:61: warning: rvalue references are a C++11       extension [-Wc++11-extensions]   template <typename... Args> void construct(pointer p, Args&&... args) {                                                             ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/allocator.h:72:55: warning: alias declarations are a C++11       extension [-Wc++11-extensions]   template <typename U> struct rebind { using other = SecureAllocator<U>; };                                                       ^ In file included from /Users/tajammul/Documents/packages/bamtools/src/toolkit/bamtools_filter.cpp:19: In file included from /usr/local/Cellar/jsoncpp/1.9.1/include/json/json.h:9: In file included from /usr/local/Cellar/jsoncpp/1.9.1/include/json/autolink.h:9: /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:159:19: warning: alias declarations are a C++11       extension [-Wc++11-extensions] using Allocator = typename std::conditional<JSONCPP_USING_SECURE_MEMORY,                   ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:161:61: error: a space is required between       consecutive right angle brackets (use '> >')                                             std::allocator<T>>::type;                                                             ^~                                                             > > /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:162:16: warning: alias declarations are a C++11       extension [-Wc++11-extensions] using String = std::basic_string<char, std::char_traits<char>, Allocator<char>>;                ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:162:78: error: a space is required between       consecutive right angle brackets (use '> >') using String = std::basic_string<char, std::char_traits<char>, Allocator<char>>;                                                                              ^~                                                                              > > /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:163:23: warning: alias declarations are a C++11       extension [-Wc++11-extensions] using IStringStream = std::basic_istringstream<String::value_type,                       ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:166:23: warning: alias declarations are a C++11       extension [-Wc++11-extensions] using OStringStream = std::basic_ostringstream<String::value_type,                       ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:169:17: warning: alias declarations are a C++11       extension [-Wc++11-extensions] using IStream = std::istream;                 ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:170:17: warning: alias declarations are a C++11       extension [-Wc++11-extensions] using OStream = std::ostream;                 ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:174:24: warning: alias declarations are a C++11       extension [-Wc++11-extensions] using JSONCPP_STRING = Json::String;                        ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:175:31: warning: alias declarations are a C++11       extension [-Wc++11-extensions] using JSONCPP_ISTRINGSTREAM = Json::IStringStream;                               ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:176:31: warning: alias declarations are a C++11       extension [-Wc++11-extensions] using JSONCPP_OSTRINGSTREAM = Json::OStringStream;                               ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:177:25: warning: alias declarations are a C++11       extension [-Wc++11-extensions] using JSONCPP_ISTREAM = Json::IStream;                         ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/config.h:178:25: warning: alias declarations are a C++11       extension [-Wc++11-extensions] using JSONCPP_OSTREAM = Json::OStream;                         ^ In file included from /Users/tajammul/Documents/packages/bamtools/src/toolkit/bamtools_filter.cpp:19: In file included from /usr/local/Cellar/jsoncpp/1.9.1/include/json/json.h:10: /usr/local/Cellar/jsoncpp/1.9.1/include/json/features.h:44:8: error: function definition does not       declare parameters   bool allowComments_{true};        ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/features.h:48:8: error: function definition does not       declare parameters   bool strictRoot_{false};        ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/features.h:51:8: error: function definition does not       declare parameters   bool allowDroppedNullPlaceholders_{false};        ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/features.h:54:8: error: function definition does not       declare parameters   bool allowNumericKeys_{false};        ^ In file included from /Users/tajammul/Documents/packages/bamtools/src/toolkit/bamtools_filter.cpp:19: In file included from /usr/local/Cellar/jsoncpp/1.9.1/include/json/json.h:11: In file included from /usr/local/Cellar/jsoncpp/1.9.1/include/json/reader.h:11: /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:48:33: warning: 'override' keyword is a C++11       extension [-Wc++11-extensions]   ~Exception() JSONCPP_NOEXCEPT override;                                 ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:49:45: warning: 'override' keyword is a C++11       extension [-Wc++11-extensions]   char const* what() const JSONCPP_NOEXCEPT override;                                             ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:79:2: error: expected expression [[noreturn]] void throwRuntimeError(String const& msg);  ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:79:14: error: expected unqualified-id [[noreturn]] void throwRuntimeError(String const& msg);              ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:81:2: error: expected expression [[noreturn]] void throwLogicError(String const& msg);  ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:81:14: error: expected unqualified-id [[noreturn]] void throwLogicError(String const& msg);              ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:246:22: warning: rvalue references are a C++11       extension [-Wc++11-extensions]     CZString(CZString&& other);                      ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:249:33: warning: rvalue references are a C++11       extension [-Wc++11-extensions]     CZString& operator=(CZString&& other);                                 ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:331:14: warning: rvalue references are a C++11       extension [-Wc++11-extensions]   Value(Value&& other);              ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:337:25: warning: rvalue references are a C++11       extension [-Wc++11-extensions]   Value& operator=(Value&& other);                         ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:458:22: warning: rvalue references are a C++11       extension [-Wc++11-extensions]   Value& append(Value&& value);                      ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:646:18: warning: defaulted function definitions       are a C++11 extension [-Wc++11-extensions]     Comments() = default;                  ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:648:22: warning: rvalue references are a C++11       extension [-Wc++11-extensions]     Comments(Comments&& that);                      ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:650:33: warning: rvalue references are a C++11       extension [-Wc++11-extensions]     Comments& operator=(Comments&& that);                                 ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:656:19: warning: alias declarations are a C++11       extension [-Wc++11-extensions]     using Array = std::array<String, numberOfCommentPlacement>;                   ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:682:14: error: function definition does not       declare parameters   ArrayIndex index_{};              ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:683:8: error: function definition does not declare       parameters   Kind kind_{kindNone};        ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/value.h:784:8: error: function definition does not declare       parameters   bool isNull_{true};        ^ In file included from /Users/tajammul/Documents/packages/bamtools/src/toolkit/bamtools_filter.cpp:19: In file included from /usr/local/Cellar/jsoncpp/1.9.1/include/json/json.h:11: /usr/local/Cellar/jsoncpp/1.9.1/include/json/reader.h:242:12: error: function definition does not       declare parameters   Location begin_{};            ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/reader.h:243:12: error: function definition does not       declare parameters   Location end_{};            ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/reader.h:244:12: error: function definition does not       declare parameters   Location current_{};            ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/reader.h:245:12: error: function definition does not       declare parameters   Location lastValueEnd_{};            ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/reader.h:246:10: error: function definition does not       declare parameters   Value* lastValue_{};          ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/reader.h:249:8: error: function definition does not       declare parameters   bool collectComments_{};        ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/reader.h:256:27: warning: defaulted function definitions       are a C++11 extension [-Wc++11-extensions]   virtual ~CharReader() = default;                           ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/reader.h:282:26: warning: defaulted function definitions       are a C++11 extension [-Wc++11-extensions]     virtual ~Factory() = default;                          ^ /usr/local/Cellar/jsoncpp/1.9.1/include/json/reader.h:347:24: warning: 'override' keyword is a C++11       extension [-Wc++11-extensions]   ~CharReaderBuilder() override;                        ^ fatal error: too many errors emitted, stopping now [-ferror-limit=] 35 warnings and 20 errors generated. make[2]: *** [src/toolkit/CMakeFiles/bamtools_cmd.dir/bamtools_filter.cpp.o] Error 1 make[1]: *** [src/toolkit/CMakeFiles/bamtools_cmd.dir/all] Error 2 make: *** [all] Error 2
I checked JsonCpp is installed but still there are error.
Why it is so?

My feeling is you're using an ancient compiler. Bamtools implicitly now requires C++11, due to jsoncpp being a C++11 library. Which compiler are you using?

I am using gcc compiler.

are you using GCC 2.95 from 1998 or GCC 9.3 from 4 weeks ago?

I am using "gcc 9.3.0_1" which was installed on Mac using brew

First I cloned from git
git clone git://github.com/pezmaster31/bamtools.git
then build using cmake
mkdir build
cd build
cmake  ..
make

I've added C++11 as an explicit requirement, please give it a try.


Implement explicit JVP for integrals

Right now we let JAX fgure out the gradients automatically for integration, that works ok but I think it's causing large memory overhead, and when autodiffing lax.scan calls the graph takes very long to compile. So instead, we probably should implement custom JVP for integrals. Which is easy, it's just the integral of the inner  JVP.
I'm openning this issue to document my experimentations with this and gather any thoughts or ideas anyone may have.
To  get things started, here is my first attempt at a custom Simpson integration using jax.lax scan and custom JVP:
def my_simps(func, a,b, *args, N=128):
    if N % 2 == 1:
        raise ValueError("N must be an even integer.")
    dx = (b-a)/N
    x = np.linspace(a,b,N+1)
    return _custom_simps(func, x, dx, *args)

@partial(custom_jvp, nondiff_argnums=(0,1,2))
def _custom_simps(func, x, dx, *args):
    f = lambda x: func(x, *args)
    @jax.remat
    def loop_fn(carry, x):
        y = f(x)
        s = 4*y[0] + 2*y[1]
        return carry+s, 0
    r, _ = jax.lax.scan(loop_fn, f(np.atleast_1d(x[0]))[0], x[1:].reshape((-1,2)))
    S = dx/3 * ( r - f(np.atleast_1d(x[-1]))[0])
    return S

@_custom_simps.defjvp
def _custom_simps_jvp(func, x, dx, primals, tangents):
    # Define a new function that computes the jvp
    f = lambda x: jax.jvp(lambda *args:func(x, *args), primals, tangents)

    def loop_fn(carry, x):
        c, *args=carry
        s1 = f(x[0])
        s2 = f(x[1])
        return jax.tree_multimap(lambda a,b,c:a+4*b+2*c, carry, s1,s2), 0

    r, _ = jax.lax.scan(loop_fn, f(x[0]), x[1:].reshape((-1,2)))
    S = jax.tree_multimap(lambda a,b: dx/3 * (a-b), r, f(x[-1]))
    return S

It seems to work in simple examples, but is still hitting a strange issue in the lax.scan_tranpose function  used in reverse mode AD

For Simpson's rule with fixed step size, is it possible to autodiff dx/3 * sum(y[0:-2:2] + 4*y[1::2] + y[2::2])?

oh yeah for sure, that's what I'm curently doing

I see! Would the integral method of the spline be any faster?

Not really, it's more or less the same complexity. I think it's the same

So the main think to consider is about Batching. For the stuff I want I do is for instance sample 128 different cosmologies at once, for instance to run 128 chains in parallel.
Let's say I want to compute some lensing cl with the simpson formula you had above,
at some point in the calculation, I will have a tensor of shape:
[batch, nCls, n_ell, n_a1, n_a2]
where nCls is the number of cross-spectra, n_ell is the number of ells, n_a1 is the number of points in a in the limber integral evaluated by simps, and n_a2 is the number of points in a in integral of the lensing kernel.
So it quickly makes pretty big arrays, especially due  to the memory overhead of the grads.
That's why I wanted an integration method the used lax.scan, so an actual with a for loop, to compute some integrals sequentially instead of in parallel, to save memory

Thanks for the explanation! I was hoping spline might need fewer knots, even both are O(n) complexity.
In this large memory limit, do you expect speedup by batching as in #32?
Or maybe batching is not just for efficiency?
Actually in #32 I don't understand why it's a gain if the time are the same.
Sorry for so many questions :)

Ah yes they do, check out our fresh Spline PR #54 , far fewer points are necessary. So this may do the trick. I have implemented spline integration, but havent tested it in this bach setting yet.
So, because things happen in parallel, running a batch of size 1 is the  same speed as running a batch of size 128, if you can afford it. So if running a batch takes 1s, you can get 128 different cosmologies in 1s instead of 1.
I care about batching because I want to use SVI ^^' or train neural networks with gradients that go through cosmology calculations.
Absolutely no problem :-) keep asking! If I can get you interested that would  be awesome :-)


quiet flag to hide script name in output

This adds an optional "quiet" flag to the full script config object, which if set to "true" will hide the script name prefix in the output on stdout and stderr.

Added this option because without it, the output for a Mocha suite with --reporter spec has some, not all, of its newlines prefixed with the script name, thus messing up the nesting nature of the spec reporter. For example, see "[test]" in this screenshot:

Relevant parts of package.json:
"scripts": {
  "test": "npm run test:js",
  "test:js": "babel-node node_modules/.bin/isparta cover _mocha -- --ui exports --recursive --formatter spec test/**",
  "watch": "npm-watch",
},
"watch": {
  "test": "{lib,test}/**/*.js"
},

TBH I'd like to fix the bug as well, but I don't see any harm in having this option as well. Thanks for the PR!

Filed #18
I'd guess the bug has something to do with stream buffering...


Fix card-sort serialization [LEI-216]

Refs: https://openscience.atlassian.net/browse/LEI-216
Purpose
Instead of serializing card-sort data into the format: {bucket0: [card1, card2, card3...]}
change it to {card1: 0, card2: 0, card3: 0, ...}
Changes

Change meta.data.properties & responses computed

The validation is only on the front-end right now, but it is probably better to have both so I'll add validation to thecontinue actions

Server side validation would not happen in an emberJS action... and for 90-180 questions I agree that maintaining it in the front-end would be fairly painful.
We can discuss how server side validation works later to see if it's right for this use case. (it's possible it may not be- but again, that should be a conscious choice, not something we remove and forget about).

Oh, I see what you're saying. There would have to be 90 properties listed for both cardSort1 and cardSort2 in meta.data.properties


Add "Rename topic" option to three-dot topic menu

At present, when a user doesn't have permissions to move a topic to a different stream, they do not see a "Move topic" option in the three-dot menu for that topic (in the left sidebar).
However, that user may still have permissions to rename the topic, while keeping it in the same stream. When this is the case, we should show a "Rename topic" option in place of the "Move topic" option.
Additional details:

We should use a different icon than for "Move topic"; we can try a pencil.
The resulting pop-up should be much simpler than the "Move topic" pop-up. It can have just:
a. Title: "Rename topic"
b. Text: "Rename topic  to:"
b. A single text box to input the new topic name.
c. Cancel and Confirm buttons, as for Move topic.

Note that deciding when to show this option might be a bit tricky, similarly to #19881. See this CZO thread for discussion of that particular challenge.
CZO discussion of this issue can be found here.

At a technical level, we'll be adding a check in the build_topic_popover function and template to check settings_data.user_can_edit_topic_of_any_message as well as settings_data.user_can_move_messages_between_streams and use those values to render the appropriate template.

@timabbott @alya  I have gone through the files that require changes and create new files
According to me in stream-popover.js checking for rename and move topic permission and render according to that in topic_sidebar_actions.hbs and have to add new rename_topic_modal.hbs and link it to the body using jquery. This would be a good issues to work one. Can I work on this ?

@zulipbot abandon


Consideration for adding another verifier: inspec

Issue Type

Feature request

Molecule and Ansible details
ansible <IP_ADDRESS>
molecule, version 2.5.0

Molecule installation method: pip
Ansible installation method: pip

Desired Behaviour
Add the ability to use inspec as a verifier.
Actual Behaviour (Bug report only)
Only goss or testinfra are available. We have some experience/code with inspec that we would like to leverage in the verification step. If we do a PR that adds experimental capability, would you be open to it?
For example, this is what I have hacked up:
(venv) m-gwg8wl:ansible-windows<EMAIL_ADDRESS>molecule verify
--> Test matrix

└── default
    └── verify

--> Scenario: 'default'
--> Action: 'verify'
--> Executing Inspec tests found in /Users/s003477/code/ansible-windows/molecule/default/tests/...
WARN: Unresolved specs during Gem::Specification.reset:
      net-ssh (< 5.0, >= 2.6.5, >= 2.9)
      multi_json (~> 1.10)
      winrm-fs (~> 1.0)
      docker-api (~> 1.26)
      thor (~> 0.19)
      rspec (~> 3)
      addressable (~> 2.4)
      diff-lcs (< 2.0, >= 1.2.0)
WARN: Clearing out unresolved specs.
Please report a bug if this causes problems.

    Profile: tests from /Users/s003477/code/ansible-windows/molecule/default/tests/ansible_windows.rb (tests from .Users.s003477.code.ansible-windows.molecule.default.tests.ansible_windows.rb)
    Version: (not specified)
    Target:  winrm://vagrant@http://<IP_ADDRESS>:5985/wsman:3389

      File c:\windows\system.ini
         ✔  should exist

    Test Summary: 1 successful, 0 failures, 0 skipped
Verifier completed successfully.

$ cat /Users/s003477/code/ansible-windows/molecule/default/tests/ansible_windows.rb
describe file('c:\windows\system.ini') do
it { should exist }
end

Forgot that this was the molecule.yml values:
  name: inspec
  options:
    password: vagrant
    target<EMAIL_ADDRESS>  env:
    no_proxy: <IP_ADDRESS>

Hi @mkinney !  I have held off on inspec for two main reasons.

The way one must configure inspec to connect to the instances.  It doesn't piggy back on the existing ansible_connection options that Molecule sets up, where Testinfra uses the ansible connection.  This means testinfra can simply connect to the instances the same way Ansible does, and supports all the drivers Ansible does.

Molecule v1 used to support server spec but was removed in v2.  Molecule is somewhat biased, and supporting too many verifiers is tricky with limited time and knowledge of such verifiers.

I would prefer to hold off on such a feature.

Not going to support inspec at this time.

Example role with inspec support https://github.com/jugatsu/ansible-role-pritunl-server. A lit bit hacky)

Inspec support wil be big win btw.

@retr0h if we were able to work around concerns 1 and 3, would 2 be a blocker?
We can put some time and energy into finding ways to integrate better, but don't want to do it if the intent is to stay away from inspec regardless.

@eshamow why is it you wish to use Inspec vs Goss or Testinfra.  What benefit does it provide?

@eshamow inspec is my favourite because of:

lots of resources https://www.inspec.io/docs/reference/resources/

active development under Chef, Inc. support

great for TDD and compliance-as-code

supports ssh,winrm,docker connections and doesn't required any dependencies on instance

clean syntax compared to testinfra

@eshamow any updates on this issue?

@retr0h Sorry missed the first update on this.
I'd second @jugatsu's arguments, and add that I have a pretty large library of mocks and doubles that are developed in inspec that are non-trivial to port to another language/test suite.
We have used inspec to train our security teams and other groups to communicate requirements with us in terms of test feedback. As a result we have large groups writing tests against all sorts of integrations and doubles written against Inspec, and we use those in our molecule tests to verify compliance.

@retr0h
This would be a great addition. I have been stuck on molecule version 1 because I run both linux and windows servers using the same boiler plate code to stick everything together. The reason I am stuck on version 1 is that once we lost server spec verifier support we lost Windows support (which works great in version 1 btw).
I agree with dropping server spec in the sense that it is old and not that well maintained and I think that adding an inspec verifier would be a fantastic solution to bring unofficial Windows support back to molecule and allow me to upgrade all of our box repositories to molecule v2!!!

Hi @jamesla -
I have some questions about inspec.  Currently Goss and testinfra are able to test all of the drivers Molecule supports b/c testinfra simply uses the Ansible connection backend.  So anything Ansible can connect to, testinfra can as well.  Super simple.   Goss, is also able to test all drivers, simply b/c Ansible connects to the instances and installs the binary locally.
My question about inspec, is it's ability to test all drivers Molecule supports.  I understand we can use ssh to connect to ec2, gce, azure, openstack, and vagrant.  It appears inspec has docker support as well.  Does inspec support lxc and lxd testing?  Also, can I supply an ssh config file to inspec in the case where Molecule users are using the delegated driver, and simpy wish to provide the connection options on their own.
I do understand your concern, and appreciate your patience.

@jamesla Also, how do you target a specific test file to a subset of hosts?

@retr0h https://github.com/jugatsu/ansible-role-pritunl-server/blob/master/test/test.sh
Just run inspec executable on target hosts.

Guys, i don't understand why we even debated about inspec support :) IMO inspec is must-have for every modern framework especially molecule :)

I have an idea.

You guys win :)

Doesn’t that mean that we all win? 😀
How can we help?

Mike Kinney

On Apr 18, 2018, at 7:00 PM, John Dewey<EMAIL_ADDRESS>wrote:
You guys win :)
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.

Thank you for supporting this!

Reading this thread gave me feels... thanks @retr0h
However... I can't get inspec to be invoked. Is there an issue I should be watching?

Or change your molecule.yml's verifier.name to inspec.

Yeah, I tried that, but I got
└── inspec
    └── verify

--> Scenario: 'inspec'
--> Action: 'verify'
Skipping, no tests found.

The problem was that no controls could be found (wrong dir).
Inspec goes out of its way to make compliance easy to reproduce across scenarios, distributing them as profiles in the chef supermarket or git repos even. I had naively wanted to have something like:
verifier:
  name: inspec
  profile:
    url: https://github.com/EGI-Foundation/ansible-style-guide
  lint:
    name: rubocop

or something like that. If I find some time, I'll try send a PR for this...

Oh.... now that's cool.  You can see my lack of inspec knowledge while implementing this feature.
Would a person ever test multiple profiles along with additional local test files?
Could we do something like:
verifier:
  name: inspec
  profiles:
    - url: https://github.com/EGI-Foundation/ansible-style-guide
    - url: https://...
    - url: https://...
  lint:
    name: rubocop

Yes absolutely the profiles are usually developed by Ops, or the InfoSec team, so they are the ones which are sending  the devs the profiles that their applications have to pass. There is a dependency mechanism, just with Ansible roles.
See https://www.inspec.io/docs/reference/profiles/
I have taken a look at the code for generating the verify.yml as well. I have thoughts :face_with_head_bandage: Best open another issue on this to discuss this inspec integration there.
Let's be straight though : adding inspec to molecule is a huge frikkin win for everyone. I don't want to give you the impression that not enough has been done by you the maintainer! On the contrary... I really hope to find some free time soon to send a PR for how I think this should work.
Thanks for the work so far!


new UI using kanji's design

design can be seen in the discord server, posted by kanji

Request close.


[Bug]: After running for a period of time, it becomes unable to retrieve information from fail2ban.

Describe the bug

From the image I attached, you can see that I started the software at 23:11 on November 1, 2024. Throughout the following period until November 2, when I checked the status, it appeared normal. However, when I checked again at 9:52 this morning, I noticed that all the readings from midnight onwards were zeros, which is obviously problematic. Based on past experiences, I understand that this is not accurate and indicates that the dashboard has not retrieved the latest information. While I was checking, I observed that the dashboard automatically updated once more, suggesting that it was not terminated. I logged into the VPS:
root@sub:~# docker ps
CONTAINER ID   IMAGE                                          COMMAND                  CREATED        STATUS                  PORTS                                NAMES
d2fa883911f3   ghcr.io/verifiedjoseph/intruder-alert:latest   "docker-php-entrypoi…"   35 hours ago   Up 35 hours (healthy)   <IP_ADDRESS>:8080->8080/tcp, 9000/tcp   intruder-alert
ea1e5a94a4ea   jericx/syncclipboard-server:latest             "dotnet SyncClipboar…"   3 months ago   Up 38 hours             <IP_ADDRESS>:5033->5033/tcp             syncclipboard-server
root@sub:~# docker-compose down
Stopping intruder-alert ... done
Removing intruder-alert ... done
Removing network root_default
root@sub:~# docker-compose up -d
Creating network "root_default" with the default driver
Creating intruder-alert ... done

I restarted the dashboard.

As you can see, after restarting the dashboard, the latest data has been successfully retrieved.
Configuration
version: '3'

services:
  app:
    image: ghcr.io/verifiedjoseph/intruder-alert:latest
    container_name: intruder-alert
    environment:
      - IA_TIMEZONE=Asia/Shanghai
      - IA_SYSTEM_LOG_TIMEZONE=Asia/Shanghai
      - IA_MAXMIND_LICENSE_KEY=[redacted]
      - IA_LOG_FOLDER=/app/backend/data/logs
    volumes:
      - /var/log/fail2ban.log:/app/backend/data/logs/fail2ban.log:ro
      - /var/log/fail2ban.log.1:/app/backend/data/logs/fail2ban.log.1:ro
      - /var/log/fail2ban.log.2.gz:/app/backend/data/logs/fail2ban.log.2.gz:ro
      - /var/log/fail2ban.log.3.gz:/app/backend/data/logs/fail2ban.log.3.gz:ro
      - /var/log/fail2ban.log.4.gz:/app/backend/data/logs/fail2ban.log.4.gz:ro
    ports:
      - '<IP_ADDRESS>:8080:8080'
    security_opt:
      - no-new-privileges:true

Version
1.19.8
Deployment Method
docker-compose
PHP Version
8.2.24-fpm-alpine3.19
Additional context
I'm not sure what the cause of this issue is, as it has been occurring since earlier versions. At one point, I thought it might be due to insufficient memory on my VPS, causing the dashboard to close during operation. However, I later found that this was not the case; the dashboard was running fine, but it just couldn't retrieve the latest fail2ban information.
Please take a look into this issue. If you need any additional information, please feel free to contact me. I have also attached my personal email address<EMAIL_ADDRESS>for your convenience.

Hello Wrandz. Sorry to hear you are having trouble with the dashboard.

At one point, I thought it might be due to insufficient memory on my VPS [..]

It is possible that insufficient memory could be the issue as Intruder Alert's backend script only runs every 10 minutes and insufficient memory would stop it from starting or running successfully.
The next time the issue happens please post of the output of docker logs -t intruder-alert (https://docs.docker.com/reference/cli/docker/container/logs/). Its output with be helpful for troubleshooting.

Thank you. Below is the runtime log of my Docker container.
docker.log
The first line of this log entry occurred at 2024-11-03 02:04:46, which is after the 0:00 point mentioned in previous screenshot where the issue arose. Therefore, what happened at exactly 0:00 is unknown (but please hold on for a moment, as such an issue will occur again soon, and I will provide you with the log at the time of the issue).
However, from the log file, it seems that from the first line until 9:52 AM on November 3rd, when I noticed the issue and restarted intruder-alert, intruder-alert had been running normally and regularly throughout that period.
Since I restarted intruder-alert, there hasn't been any issue so far. I will continue to monitor the situation until the problem reappears. I'm really looking forward to your analysis of the log file to identify the cause of the issue.

After several days of careful observation, everything seemed normal until this morning when I noticed the same issue again: starting from midnight, Intruder Alert stopped updating data.

Below is the runtime log of my Docker container. Captured from 23:00 on November 9th.
docker.txt
From the log file, there are no apparent anomalies. It seems that starting from 0:00 on the 10th, Intruder Alert was still normally acquiring and processing logs from fail2ban, but it stopped updating the web table data.


[silgen] Clean up RValue::isPlus{One,Zero}().

rdar://33358110

@swift-ci smoke test and merge

@swift-ci smoke test and merge

@shahmishal This has been stuck in this state for a while. Do you know whats going on?


Phone number

Hello, When and how the security contact phone number is used (SMS, phone call, other)?

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 0a455a24-920e-f9f8-7a6f-60b5f4019acd
Version Independent ID: e6a4d8e2-0ada-e535-810f-5eb19e45ee1e
Content: Provide security contact details in Azure Security Center
Content Source: articles/security-center/security-center-provide-security-contact-details.md
Service: security-center
GitHub Login: @memildin
Microsoft Alias: memildin

@npigit Thanks for your feedback! We will investigate and update as appropriate.

@npigit As mentioned in another GitHub issue the phone number is not used today and you will not be called about security events. This email notification settings page will shortly be changed, and the phone number field will be removed.

@npigit We will now proceed to close this thread. If there are further questions regarding this matter, please reopen it and we will gladly continue the discussion.


Add Get-QuarantineMessage as an alternate solution

Target Recipe:  recipes/mailflow/find-quarantined-messages.md
Link to docs: https://docs.microsoft.com/en-us/powershell/module/exchange/get-quarantinemessage

the commit below adds the alternate solution to the recipe.
https://github.com/chadmando/Exchange-Online-PowerShell-Recipes/commit/0212ff23ef5678266f0808cc08cdf8748c3b78d8


dessai Kibeho

Keyword/ Reserved word

Keywords are reserved words that are part of the syntax in the programming language.
For example,
var a = 8;
Here, var is a keyword that denotes that a is a variable.
Some examples are for, function, this, typeof, void, true, etc.
JavaScript Identifiers
An identifier is a name that is given to entities like variables, functions, class, object etc.
var a = 8;
Here, we are using 'a' as an identifier to name the variable.
Keywords cannot be used to name identifiers.
In JavaScript, identifiers are case-sensitive and can contain Unicode letters, $, _, and digits (0-9), but may not start with a digit.

Variable

A named reference to a value is a variable. You can think of variables as simply “storage containers” for data in your code. We can use variables to store goodies, visitors, and other data. Until recently there was only one way to create a variable in JavaScript — the var statement.
But in the newest JavaScript versions ( ES6 ) we have two more ways
— let and const.
Difference between var, let, and const
var, let and const
For more detaile explanation please read this article

Operator

Operators are reserved words that perform the action on values and variables. Operators are used to perform specific mathematical and logical computations on operands.
For example, in 7 + "5", the + sign is an operator and 7 (number) is left side operand and "8" (string) is right-side operand. The + operator performs the addition of two values/expressions and returns a result.
In JavaScript, operators are used to compare values, perform arithmetic operations, etc. There are various operators supported by JavaScript:
Arithmetic Operators
Comparison Operators
Logical Operators
Assignment Operators
Ternary Operators
typeof Operator
String operators
Comma operator
Relational operators
Unary operators
Follow MDN for complete details about each Operator.

Expression

A reference, value, or a group of reference(s) and values(s) combined with operator(s), which result in a single value. In simple words, expression is a combination of values, variables, operators which computes a value.
Every syntactically valid expression resolves to some value but conceptually, there are two types of expressions: with side effects (for example those that assign value to a variable) and those that in some sense evaluate and therefore resolve to a value.
The expression x = 7 is an example of the first type. This expression uses the = operator to assign the value seven to the variable x. The expression itself evaluates to seven.
The code 3 + 4 is an example of the second expression type. This expression uses the + operator to add three and four together without assigning the result, seven, to a variable.

Statement

A group of words, numbers, and operators that do a task is a statement. JavaScript statements are the commands to tell the browser what action to perform. Statements are separated by a semicolon (;).
var a = 7 + "5";
is a JavaScript statement.

good job @kdessaik


Training for 100 epochs with default parameters, but the model does not converge

Dear Author
Thanks for your great paper and source code.
Something wrong i have encountered is that training for 100 epochs with default parameters, but the model does not converge. I have tried the method you provided in this issue(https://github.com/ai4ce/DeepMapping2/issues/6), but it doesn't seem to work. The result i got is shown in followed figures. Is there something i missing, or could you please tell me some training tips of your work?
Thanks again.

If you followed the previous requirements, please make sure that you removed the environment and re-create a new one. Try conda clean -a if you make sure the installation is not affected by any cached packages.
After you install the dependencies following the up-to-date README file, please try pip freeze to make sure the installed dependency is the same as requirements.txt (you also should have torch==1.13.1+cu116)

@liaoyifei1998 @Gaaaavin is this issue addressed?

Closed due to no further response. Please reopen if the problem is not solved.


memory leak linux FlValue map

Memory allocated for flvalue map not freed
Code
https://github.com/rogurotus/mem_leak

flutter run
use button for memory leak

      g_autoptr(FlValue) test = fl_value_new_map();
      fl_value_set_string(test, "test", fl_value_new_string("test"));

Flutter doc
[✓] Flutter (Channel stable, 2.10.4, on Debian GNU/Linux 11 (bullseye)
    5.17.0-trunk-amd64, locale ru_RU.UTF-8)
    • Flutter version 2.10.4 at /home/human/Docs/flutter
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision c860cba910 (11 дней назад), 2022-03-25 00:23:12 -0500
    • Engine revision 57d3bac3dd
    • Dart version 2.16.2
    • DevTools version 2.9.2

[✗] Android toolchain - develop for Android devices
    ✗ Unable to locate Android SDK.
      Install Android Studio from:
      https://developer.android.com/studio/index.html
      On first launch it will assist you in installing the Android SDK
      components.
      (or visit https://flutter.dev/docs/get-started/install/linux#android-setup
      for detailed instructions).
      If the Android SDK has been installed to a custom location, please use
      `flutter config --android-sdk` to update to that location.

[✓] Chrome - develop for the web
    • Chrome at google-chrome

[✓] Linux toolchain - develop for Linux desktop
    • Debian clang version 13.0.1-3+b2
    • cmake version 3.18.4
    • ninja version 1.10.1
    • pkg-config version 0.29.2

[!] Android Studio (not installed)
    • Android Studio not found; download from
      https://developer.android.com/studio/index.html
      (or visit https://flutter.dev/docs/get-started/install/linux#android-setup
      for detailed instructions).

[✓] VS Code (version 1.65.2)
    • VS Code at /usr/share/code
    • Flutter extension can be installed from:
      🔨 https://marketplace.visualstudio.com/items?itemName=Dart-Code.flutter

[✓] Connected device (2 available)
    • Linux (desktop) • linux  • linux-x64      • Debian GNU/Linux 11 (bullseye)
      5.17.0-trunk-amd64
    • Chrome (web)    • chrome • web-javascript • Google Chrome 100.0.4896.60

[✓] HTTP Host Availability
    • All required HTTP hosts are available

! Doctor found issues in 2 categories.

fl_value_set_string(test, "test", fl_value_new_string("test"));

This line is incorrect, which is why you have a leak. fl_value_set_string does not transfer reference ownership. That's what the _take variant is for.


Make compatible with Swift Package Manager

[ ] Move design/logo to separate branch/repo

This PR makes Reactor accessible via Swift Package Manager. It should be also accessible via Carthage.

Looks good. Thanks for doing this! 🍨


Test CopyDir and assert whether data-target-path is used

Test CopyDir pipeline and assert whether data-target-path is used correctly when specified.
I had the same issue as #524, and while I figured it was stemming from a regression, I just realized it was because my trunk install was from before fbb0be had landed and the data-target-path attr was simply ignored.
Regardless, I figured it would help to test if it was actually being used as intended so I loosely copied copy_file_test.rs to also test if dirs were created and contents copied.
Also do any of these points apply? It's just a test case after all.

Checklist

[ ] Updated CHANGELOG.md describing pertinent changes.
[ ] Updated README.md with pertinent info (may not always apply).
[ ] Updated site content with pertinent info (may not always apply).
[ ] Squash down commits to one or two logical commits which clearly describe the work you've done. If you don't, then Dodd will 🤓.

Awesome! Always happy to see more tests added.

Did this need anything else?


[pulsar-admin] allow tenant admin to manage subscription permission

Motivation
In #2981, we have added support to grant subscriber-permission to manage subscription based apis. However, grant-subscription-permission api requires super-user access and it creates too much dependency on system-admin when many tenants want to grant subscription permission.
So, allow each tenant to manage subscription permission in order to reduce administrative efforts for super user.

I think we should introduce v4 api and make the change there. I don't think it is a good idea to change the base which would impact existing v1, v2, and v3 api.

This is not a breaking change but it was a bug. Owner-Tenant can already manage all property level access rights such as : granting produce/consume permission to other tenants. and we have also added support to let consumer manage cursor level api in #2981 and admin-tenant should be able to access this api to grant permission.
We should not introduce v4 api for this functionality, this is definitely not required.

You can add a release note section for 2.6.0-SNAPSHOT in release notes and document this change.

I think we add release not once we create a release. can you please point me which file should be updated with this documentation.

@rdhabalia I understand that's a bug. However this behavior has been there from v1 to v3. If this "buggy" behavior was exposed publicly to the user, that means some existing tools might already rely on this behavior. Changing such an API is breaking the behavior that people saws before. Hence I think a better option is to introduce a newer API to amend this buggy behavior.
For any behavior changes, it should be highlighted in a release note. I understand that we used t create release notes when cutting a release. But it has introduced many troubles to the release manager as well as for the users. Because it is hard for a release manager to grab all the changes at the time of cutting a release. Users are frustrated about the breaking changes that are not documented and have complained about the documentation here and there. Hence I would suggest we should adding a place to track breaking changes and behavior during developing a release. Adding a section for an under-developing release in release notes for accumulating breaking changes seems to be a good way to go. Because the release manager can find it when cutting a release and users can find potential breaking changes in the upcoming release.
I think the conversation here should be brought to the mailing list for a discussion and a potential vote since it is related to behavior change and also release process/document change.

that means some existing tools might already rely on this behavior.

I don't understand what can it break? this is a new api and was added in 2.3. It is not a breaking change because It is not adding any restriction but adding the flexibility for owner to access this api.

It is 2.6.0 now. It has been 2 major releases since 2.3. If an API is exposed publicly, changing the behavior should be treated as a “breaking” change. Users should have been notified of this behavior change.
This change is not just about adding flexibility. From security point of view, this endpoint was only allowed for super-user but this change relaxes the permissions to a tenant admin. This is a red flag to a lot of enterprises. Because you are allowing a different set of people accessing the API. Correct me if I misunderstood this change here.

From security point of view, this endpoint was only allowed for super-user but this change relaxes the permissions to a tenant admin.

This api was only accessed by super-admin because of concern of increasing metadata footprint size and I had added it into the code-comment which has been removed in this PR. also, it will not create any security concern because this will allow tenant to grant permission and this semantics already exists eg: tenant grants users produce/consume messages, tenant increase quota, etc.. tenant is already allowed to manage property/namespace permission. so, It should not create red flag for any enterprises and I can agree if there will be or if any else also suggests same.

@rdhabalia I understand the original concern about why only super-users can grant permission. However, that was the behavior released in the previous version. Writing a comment in code is different from writing that in the documentation and release notes.  I am happy to see how other people feel about from the security perspective.
There are a lot of good articles on the internet talking about what is a breaking change for an API. (e.g. https://www.bennadel.com/blog/3501-when-is-a-change-a-breaking-change-for-an-api.htm)
At a minimum, changing a return code is commonly treated as a breaking change. In this case, when using versions older than 2.6.0, if non-super-user issues an HTTP request to this endpoint, the error is 401. After this change, if a tenant admin (who is not a super-user) issues an HTTP request to this endpoint, this returned code is 200. The return code is different. This should be treated as a breaking change. At a minimum, it should be highlighted in the release notes.
I think we should bring this conversation to the mailing thread to settle down a practice about how to define what are the breaking changes and how do we deal with them.

This should be treated as a breaking change. At a minimum, it should be highlighted in the release notes.

Sure. We should document into release notes. I think we create release-note after the release if that's not correct and if already have document then can you please point me to that doc and I will update the release-note.

I think we create release-note after the release if that's not correct and if already have document then can you please point me to that doc and I will update the release-note.

I pointed it out in my previous comment. Currently, we don't accumulate these release notes during development. This causes trouble for release managers and technical writers. So I suggested adding a section to the release notes doc for documenting these behavioral changes. It can be "2.6.0-SNAPSHOT (under development)".
I have started a discussion in dev@ mailing list to formalize the process for PIP. I will raise the discussion of having a release notes section for the development version.

ping @sijie @rdhabalia PTAL

Seems there is some discussion needed. @rdhabalia Do you think it is Ok to remove it from 2.5.1?

Do you think it is Ok to remove it from 2.5.1?

we need this change soon but unfortunately, we are not able to merge some essential and useful features and their releases keep changing.. :-(

@rdhabalia I think my main concern is changing a permission level from super-user to tenant admin is a big breaking change. I am fine with such a change if we have it well documented. It is a bit bad that everyone just wants to get a chance in but didn't think carefully how this would impact other users in the community. I don't want to be the one who sounds preventing merging a change. so if you can document this well and highlight it in the release notes. I am fine with that change.

@rdhabalia I see the grant-subscription-permission command of namespaces has been already shown on Pulsar Admin doc.

Is that enough for your code change? Or it (they) should be added for tenant as well?

Doc has been added as @sijie indicated that this item should be added to 2.5.1 release notes.
Done in https://github.com/apache/pulsar/pull/7276


[Feat]: Improve the Accessories card section

Is there an existing issue for this?

[X] I have searched the existing issues

Feature Description
There is not properly styling apply on this card detail .I would like to work on this issue
thank you .

Use Case
This will help to improve  the UI  of  website and make user experience good.
Benefits
No response
Priority
High
Agreements

[X] I agree to follow this project's Code of Conduct
[X] I'm a GSSoC contributor
[X] I'm a Hacktoberfest contributor
[X] I want to work on this issue
[X] I'm willing to provide further clarification or assistance if needed.

/assign


Service: Add Cloud Admin API

This pull request includes updates to the botocore/data/admin/2024-03-01/service-2.json file. The changes introduce new operations and shapes for the admin service in the AWS SDK for Python (Boto3).
Key updates include:

Addition of new operations such as DescribeCustomers, DescribeLimits, DescribeProjects, DescribeProviders, CreateCustomer, SetLimitValue, CreateProject, CreateProvider, DeleteCustomer, DeleteLimits, and ChangeCustomerTariff.
Each operation now includes details about the HTTP method, request URI, input shape, output shape, and documentation.
The "shapes" section has been expanded to define the structure of the request and response data for each operation.

These updates will enhance the functionality of the admin service by providing more operations and improving the structure of the request and response data.

@Yurzs , rebase plz


[Bug] [Super URL Bar] URL text shifts when hidden icons added / removed

Affected Theme

Super Url Bar
Version 1.3.0

Affected Theme Settings

Center URL text / Hiding right icons

Zen Version: 1.0.1-a.7
System OS: Linux
Describe the bug
If you have the URL text centered and enable hiding of icons on the right side, as you are navigating sites and those hidden icons are being added and removed when the functions enabled / changed in the background (ie. Zoom, Picture-in-Picture, etc), the URL text noticeably shifts back and forth left to right.
To Reproduce
Enable centering URL text and then hide icons on the right side. Observe URL text shifting back and forth when icons are added or removed while they are hidden.
Expected behavior
URL text does not move when icons are added / removed when hidden.

Yes. first of all this also happens when not hiding the icons, but i understand the issue. The problem is that i have only 2 options (that i know of) to hide these icons. One way is by removing them completely from the browser, so that they basically don't exist and the other way is by simply making them invisible. The difference is that when just making them invisible, if you only hide the reading mode icon. there would simply be a blank spot with empty space between the star and shield icon.
Removing the icon completely would fix that, but in turn create the shifting when the buttons appear.
I came to the conclusion to use the 1. option (removing competely) for hiding buttons without hover, while using the 2.option (making invisible) for hiding with hover.
I hope you understand my struggle with both of these options. I don't think there is a better way to do it right now, but i'm no expert, maybe i'll find a better way in the future, sry


download report returns empty array when json: true with some reports.

I am attempting to download a "GET_MERCHANT_LISTINGS_DATA_LITE" report, using SellingPartner.download(). The download succeeds and returns a tab delimited filed when passing no options object, or when {json: false}. When passing {json: true}, the function returns only '[]'. This does not happen for all reports, for example "GET_FLAT_FILE_OPEN_LISTINGS_DATA" reports download perfectly.

Hi @DoctorWhich,
just tried the report myself, can't confirm the problem. The report returns the same data with and without json:true for me. Whats strange though is that it apparently only returns SKUs with stock > 0 that are FBM. FBA SKUs seems to be inlcuded. Can you confirm that?

Ah, well, now that you mention it and I take a closer look at what it's actually putting out I see that the file it returns to me only contains the column headers and no data - in other words it's an empty table, which would explain why it was empty as a JSON. I presume because I'm only selling FBA items and nothing FBM. So if you meant to say excluded rather than included, then I can confirm. Otherwise I can't.

Ok, thats good to hear. Sorry for the typo, you're right, I meant excluded. So it seems the report works as expected and we can close this issue?

Sure, my mistake.


document.xsd?

I am using the msdesc.xsd from the alternatives folder. Now, when I load this schema into a stylesheet editor (altova style vision) I get an error message that a file document.xsd can't be found. I have msdesc.xsd, xml.xsd, xinclude.xsd and dcr.xsd available in the same folder. document.xsd is meant to be imported by dcr.xsd wih this line::
<xs:import namespace="http://www.tei-c.org/ns/1.0" schemaLocation="document.xsd"/>

any idea where this might be?

I wonder if this is a problem with the TEI site being down, so it can't access this XSD.

should it not be in the same folder as msdesc?

document.xsd is the name of the file generated by TEI-C's code which contains the bulk of the rules that define TEI P5 and our customizations. I renamed that to msdesc.xsd to match the other naming convention of the RelaxNG and DTD versions.
But I didn't notice the original filename is referenced in all the other .xsd files, which are libraries for handling other things, like XLink syntax. Presumably it is set up that way so you can validate an TEI document against any of them. Oxygen didn't raise an error when testing, because the namespace in the import statements is already associated with rules, when starting with msdesc.xsd. Trying it now with xmllint the missing document.xsd is noted but validation continues. Altova's parser must be even stricter.
I've changed it so msdesc.xsd is now a stub that does nothing except import document.xsd, which then imports the rest. Testing in xmllint returns no warnings.
@bequessel: Please try it in your software, and re-open this issue if it still causes problems.


<IP_ADDRESS>.1 reply buttons do not scale properly at 150% scale

The buttons on the notification panel do not scale properly with the scaling of the text, did not have this issue on previous version.

fixed in <IP_ADDRESS>


(MODULES-2668) Document Windows 2003 LFN issues

Suggest users employ environments to prevent installs on 2003

LGTM


CRD backend for kvstore

Use k8s CRD as kvstore backend to avoid requiring the deployment of a separate dedicated kvstore.
Considerations:

[ ] security identity allocation
[ ] ipcache
[ ] service ID allocation for DSR
[x] node discovery (already covered by k8s node resource)

Tasks:

[ ] Research feasibility of a generic backend that implements the existing kvstore operations go interface

Relevant upstream issues:

https://github.com/kubernetes/kubernetes/issues/57316
https://github.com/kubernetes/kubernetes/pull/63518

cc @andrewsykim

@tgraf according to your list, these are the data structs I have so far that needs to be converted to a versioned CRD:

IPIdentityPair - https://github.com/cilium/cilium/blob/master/pkg/identity/identity.go#L40-L53
identity allocator - https://github.com/cilium/cilium/blob/master/pkg/identity/allocator.go#L31-L34
node discovery - https://github.com/cilium/cilium/blob/master/pkg/node/node.go#L39-L76 (though likely won't be converted to CRD since covered by k8s node)
service ID allocation - https://github.com/cilium/cilium/blob/master/pkg/loadbalancer/loadbalancer.go#L447-L452

Can you confirm if there's anything else I'm missing here to build a working proof-of-concept for using CRDs to replace kvstore?

The etcd operator definitely helps! Do you still see value in replacing KV store entirely with CRDs or do you see KV store + etcd operator as the long-term/permanent solution?

I think we will know in a couple of weeks. We already have several users on EKS running the etcd operator and so far it is looking good but the feedback will tell whether it is a good long-term solution. CRDs are still evolving as well. It might be worth have a conversation with API machinery to check if we can have some form of allocation logic.

Sgtm! Please keep me updated, will hold off on any work til then :)

The 1.6 release notes mentions "kvstore free operation", which seems to fix this...
Some of the seemingly related PRs:
#8573
#8496
#8236
#8627

@mohag Yes, thanks for pointing this out.
Fixed by #8573


Must manually update nonce if deployer address sent TX after last deployment (IGN405)

What happened?
IgnitionError: IGN405: The next nonce for "0x...." should be 6, but is 28. Please make sure not to send transactions from "0x..." while running this deployment and try again.
We sent out a few other transactions using the deployment address, and then ignition stuck here. We bypass this issue by manually update the journal.json, changing the last nonce to be 27.
Minimal reproduction steps
Assuming we use address "0xaaa" as deployer.

Use hardhat ignition to deploy a contract A using create2.
Send any transaction from "0xaaa" so that its nonce changed.
Use ignition to deploy a contract B, using the same account.

Search terms
No response

Hey @Stumble, thanks for the feedback.
Can I check I have understood. Contract A gets deployed, then the deployment account is used to send some transactions, then you use Ignition to deploy Contract B.
Are you deploying Contract B by adding it to the Module you used for deploying Contract A?

Same issue, even without create2

Hey @bioharz, does your issue match with the steps above?

Minimal reproduction steps
Assuming we use address "0xaaa" as deployer.
Use hardhat ignition to deploy a contract A using create2.
Send any transaction from "0xaaa" so that its nonce changed.
Use ignition to deploy a contract B, using the same account.

Are all of the runs of Ignition against the local Hardhat node or is this against a mainnet/testnet - and which one?


Mapping of shared ViewModel UI State in Swift not working

Hello!
I need to map a list of items that come from the shared View Model into objects that implement the Identifiable protocol (needed for showing them in a List or pass them to Maps and display markers).
This is the exposed state from the ViewModel in Kotlin:
// ui state data class
data class HomeUiState(
    val isLoading: Boolean = true,
    val closeVenues: List<Venue> = emptyList(),
    val errorMessage: String? = null
)

// state defined in ViewModel.kt inside shared module
    @NativeCoroutinesState
    val uiState = _uiState.asStateFlow().stateIn(
        viewModelScope, SharingStarted.WhileSubscribed(), HomeUiState()
    )

And, in my iOS app, I'm trying to map it like this:
class HomeViewModel : shared.HomeViewModel {

    @Published var venues: [UiVenue] = []

    override init() {
        super.init()
        venues = uiState.closeVenues.compactMap { venue in
            venue.toUiVenue() // the UiVenue struct implements Identifiable protocol
        }
    }

}

...

// ContentView.swift

@ObservedViewModel var viewModel = HomeViewModel()

var body: some View {

            List(viewModel.venues) { venue in
                Text("Hello \(venue.name)").foregroundColor(Color.black)
            }.onAppear {
                 viewModel.getCloseVenues()
            }

}

However, the list is not rendering. I've tried using @State also, but nothing happens. The uiState.closeVenues returns a simple [Venue]object, not a Combine Observable.
However, if I use directly viewModel.uiState.closeVenues from the view, it works fine 🤔
Environment

Kotlin: 1.8.0
commonMain KMMViewModel dependency: com.rickclephas.kmm:kmm-viewmodel-core:1.0.0-ALPHA-3
nativeCoroutines: 1.0.0-ALPHA-4
ksp: 1.8.0-1.0.9

PS: this library is great, it has saved me a lot of time

Hi, glad to hear you find the library useful!
@NativeCoroutinesState converts your properties to two separate properties. In your case uiState and uiStateFlow.
The first exposes the current value of the StateFlow and the second exposes a callback wrapper for the Flow.
You can use the KMP-NativeCoroutines Combine wrappers to create a Combine publisher for the uiStateFlow.
Something like the following should work:
import KMPNativeCoroutinesCombine

class HomeViewModel : shared.HomeViewModel {

    @Published var venues: [UiVenue] = []

    override init() {
        super.init()
        createPublisher(for: uiStateFlow).map {
            $0.closeVenues.compactMap { venue in
                venue.toUiVenue()
            }
        }.assertNoFailure().assign(to: &$venues)
    }
}

Thank you, @rickclephas
The following was working:
// ContentView.swift

            @SwiftUI.State private var venues: [UiVenue] = []

            ...

            View()
            .onChange(of: viewModel.uiState) { updated in
                venues = updated.closeVenues.map({ venue in
                    venue.toUiVenue()
                })
            }

However, your approach is way clean. Thank you so much!


Disable ALL Messages to Players

I just use GP for Admin Claims only, How can I disable all Messages being sent to Players without disabling the Plugin in my Faction World?

Use /claiminfo -> Admin Settings and turn off DenyMessages.


Check clienttype for login operation

All other operations check for the clienttype so i added it to login also.
// Edit: Whoops, this also added the commit from the other pull request. I did checkout from that branch 🤦♂

Can you fix your PR to just include the client type check?

ok, dropped it.


error message "webdav: prefix mismatch"

Hello, developer!
I tested Flydav on Windows11 and found the following problems:
Run "flydav" in the command line to access Webdav successful. The actual physical path is C:\Users\xxx\AppData\Local\Temp\flydav.
Run "flydav.exe -c flydav.toml", The log sends an error message indicating "webdav: prefix mismatch". And cannot access Webdav.
May I ask if my configuration file was incorrectly configured? Thanks!
flydav.toml.txt
webdav.log

sub_fs_dir should be a relative path, please check

I tested the following, all with the same error
sub_fs_dir = ""
sub_fs_dir = "/"
sub_fs_dir = "\"

Do you have any folder called /clan/?

fs_dir = "D:\tmp"
[[auth.user]]
username = "clan"
sub_fs_dir = ""
sub_path = ""
Now I changed the above configurations, WebDAV work successful.
but I don't understand the mapping relationship between sub_fs_dir sub_path and actual physical path

fs means file-system
path or sub_path is only a part of url
These naming may be confusing, I'll appreciate it if you can help me assign them better names.

I can understand the name of fs, path , sub_path. I just don't understand the mapping relationship between sub_fs_dir and actual physical path.
For example, I configured the following parameters:
host = "<IP_ADDRESS>"
port = 7086
path = "/webdav"
fs_dir = "D:\tmp"
[[auth.user]]
username = "clan"
sub_fs_dir = "clan"
sub_path = "/clan"

Which physical path does the webdav url "<IP_ADDRESS>:7086/webdav" and "<IP_ADDRESS>:7086/webdav/clan"  actually point to?

OK, I see.
thanks for your answer!


can apply own style class to stars and if value set already, also use cl...

if you want to style the stars differently you can add a 'data-star-class' to the original input and that class will be applied to each star.
for example, i have a class 'star' that i made 'yellow' - so when the stars are shown, they now are yellow.

What about applying those styles to the active class or use another selector like:
.some_container_class i {
  color: yellow;
}


Update for Swift 3

Hi-
Thanks a lot for creating the swift-rpm project; it made getting Swift up and running on my Fedora laptop. I wanted to get the 3.0 release working and the script stopped working (I had been simply using the tagged version in the original script).
My pull request contains the changes necessary to make it work with the Swift 3-RELEASE version from Apple's repo with one exception: It builds the tar.gz file properly, and I have used that on my Fedora boxes, but it errors out when building the actual RPM because the RPM builder tool complains (Found ‘${BUILDROOT}’ in installed files; aborting). I have been struggling to get this working and haven't had much success so far.
I'm submitting this pull request in the hopes that it's obvious where I'm doing something wrong and hopefully we'll get it fixed and have a working 3.0 RPM builder; I've delayed submitting this pull request for several weeks in hopes of getting it working, but no luck so far.
Thanks for considering this PR,
Ron (tachoknight)

Got the RPM to build properly; switched the bulk of the work to the %build phase, and not the %install phase.

Accidentally closed the PR, sorry.

Added changes from R. Francis Smith

Any chance to merge this PR in master ?

🌹 thanks for your contrib


Added getter and setter functionality to Protocol's dosage function.

Added getter method Protocol.dose - accesses dose(t) function, name 'dose' preserved so as not to break new Solution methods.
Added setter method add_dosage_function - allows the user to alter the dose(t) function by passing a new function.
Closes #67.

Appears to be failing unit tests as protocol.dose() no longer returns a function, rather protocol.dose does.

Appears to be failing unit tests as protocol.dose() no longer returns a function, rather protocol.dose does.

So can we fix this by changing the test? test_protocol.py line 73 would be "dose = protocol.dose" instead?

Appears to be failing unit tests as protocol.dose() no longer returns a function, rather protocol.dose does.

So can we fix this by changing the test? test_protocol.py line 73 would be "dose = protocol.dose" instead?

Yeah I think so

Looks great :D :D :D <3 <3 <3


handleSort Function is not changing caret icon.

this.refs.table.handleSort('asc', 'volume')
This is not change the caret icon on the header

Thanks your bug report :) I'll fix it quickly

Fixed it, check the v1.4.2


Upgrade grpc-java to 1.42.1 and protoc to 3.17.3 to allow using native Mac osx-aarch_64 artifacts

[x] If this pull request closes/resolves/fixes an existing issue, replace the issue number. Closes #. NO
[x] Update the CHANGES log.

@kezhenxu94 The PR description mentions 3.19.1, however the correct one is 3.17.3
Could we update the PR description to avoid possible confusions?

@kezhenxu94 The PR description mentions 3.19.1, however the correct one is 3.17.3
Could we update the PR description to avoid possible confusions?

OK I copied it from the main repo and did not notice this, can you please update it in main repo (as well as the CHANGES.md)? I will update in this repo

I the main repo I just saw the version mismatch in the CHANGES.md file. Created a PR to fix it https://github.com/apache/skywalking/pull/8203


Contact and Account objects being created instead of single PersonAccount object

Describe the bug
When customer register for the site or login an Account and Contact object are created inside core instead of a single PersonAccount object. I didn't realize this at first until I started browsing existing PersonAccounts in our org and noticed that different fields show up.
To Reproduce
Steps to reproduce the behavior:

Deploy to full sandbox with .env that has personaccounts enabled
Follow all connection steps
Register a user
See Contact and Account records created

Expected behavior
Record should be represented as a single PersonAccount record

Hello @nek4life ,
Thank for opening an issue here.
This is not an issue actually, this is how Salesforce Core is designed, PersonAcounts are a mix of Account & Contact record, thus two records are technically created under the hood, but only one record is used within the Code/UI/API...
Please make sure you understand the PersonAccount concept and how Salesforce Core works prior to using this framework.
This is, anyway, not related to the framework.

Hi @jbachelet ,
Thanks for your help on this.
So we have PersonAccounts and I understand the concept and how they are combined. Here is an example of a PersonAccount in our system which has a combined record.

Here is an example of the Business Account that is created by the connector along with a linked contact.

Should these both not be PersonAccounts?
Charlie

Hey @nek4life ,
I think this is related to the discussion #103.
I did the PR#114 (https://github.com/SalesforceCommerceCloud/b2c-crm-sync/pull/114), would you be able to deploy this branch to your org and test it within your context, please?
Thanks!

@jbachelet if I redeploy metadata does that wipe out existing settings? We're working against a full sandbox and not a scratch org.

@nek4life You can just deploy the changed metadata from the PR, this will be a "merge" deploy, and so won't wipe out any existing metadata.
But, if you changed some custom metadata values in the B2C CRM Sync Settings, those will be wiped out to what is deployed if you deploy this metadata.

Thanks @jbachelet
Is this the command I need to run npm run crm-sync:sf:org:deploy reading through the docs this states it will purge the contents of the connectedApps, cspTrustedSites, duplicateRules, namedCredentials, and remoteSiteSettings meta-data folders.
Are these local folders? Sorry I'm still very new to service cloud / core development and want to make sure I'm not going to blow everything away.
As a side note it would be great to have instructions on how to update a configured instance. Appreciate all your help here.

This is all set now with the custom metadata setting. @jbachelet thanks for the help! Sorry it took so long for me to verify. We were having upstream issues in the project that was preventing me from testing.


Remove Arctic and Pystore connectors

Add deprecations for v1.5.0, and remove in a few months.

Started by #123, closing issue.


e2e: ExecCmd debug log on error

Closes: #XXX
What is the purpose of the change
This change was originally introduced in #1898. However, in #1898 if "error" was found, the system would fail on the following line:
https://github.com/osmosis-labs/osmosis/blob/8f31b5afdbc9dfdbfbc20045dcb7f7004ae72b53/tests/e2e/containers/containers.go#L101
That started causing issues because some applications such as Hermes log "error" to stderr in the normal mode of operation.  So the change was reverted in #1902
This log proved to be incredibly helpful, making me manually change every PR for debugging. So, a modified version is introduced here. This version does not fail but only logs when "error is encountered.
Testing and Verifying
This change is a trivial rework / code cleanup without any test coverage.
Documentation and Release Note

Does this pull request introduce a new feature or user-facing behavior changes? no
Is a relevant changelog entry added to the Unreleased section in CHANGELOG.md? no
How is the feature or change documented? not applicable

Can you give an example where this would be useful? I am just lacking context, since as it stands when an error occurs it eventually halts the e2e test suite and prints the error to the terminal right?

eventually halts the e2e test suite and prints the error to the terminal right

It does not print anything.
The arguments are evaluated before running the callback so it prints empty. In fact, we should remove this line because it always prints empt for errBuf and outBuf:
"tx returned a non-zero code; stdout: %s, stderr: %s", outBuf.String(), errBuf.String()

        // 1. We start here with empty errBuf
	require.Eventually(
		t,
		func() bool {
	                      // 3. We update errBug here (after it was evaluated in 2.)
		},
		time.Minute,
		time.Second,
		"tx returned a non-zero code; stdout: %s, stderr: %s", outBuf.String(), errBuf.String(),  // 2. This gets evaluated so this is always empty
	)

I made some updates, let me know what you think.
This change also allows us to see if there is an error right away as opposed to waiting for 1 minute to get a log without stdout or stderr


Issue #22 Added tests for running app

Created tests for shallow rendering the app. Note that you need to run npm install --save enzyme enzyme-adapter-react-16 react-test-renderer before running npm test

Alright I added in package.json and package-lock.json into the commit


No matching bindings found for serviceIdentifier: Symbol(Controller)

When trying to run with docker (image:node:latest) I get following error:

https://github.com/inversify/inversify-basic-example works without any issues

Issue was related to project being placed to /usr/src/app. After moving to just /app it was solved.


Selected tab from overflow stays in overflow

Describe the bug
Go to https://addonsv24.flowingcode.com/ and select Google Maps add-on from the side bar. See that Track Location demo is shown in the overflow. Click on it to see that demo. The demo is not shown adn the tab remains in the overflow. When repeating this steps but with the side bar being closed, then the tab seems to fit in the screen and the demo is then shown.
Expected behavior
Tab should become visible when selected from overflow menu.
Minimal reproducible example

Add-on Version
1.1.0
Vaadin Version
24.4.1
Additional information
Tested on latest Chrome, zoom 100%. Resolution 1920 x 1080.

@paodb Can you please try to reproduce again in staging? (I'm not sure if this is another occurrence of #17, or whether the long tab "clustering with custom renderer" requires additional processing when moving it out of the overflow section)

Still happening

Steps to reproduce
Go to https://addonsv24-staging.flowingcode.com/googlemaps/

Select "Customized Marker Icons"

Expected behavior


On item show page, change "Deposit type" field to use the label in 'WorkType'

because presently it is showing the wrong label when work_type = 'software, multimedia'


Quest hiding?

Trying to figure out whether or not quests can be hidden on npc's and not show up in the quest list until a previous "REQUIRED" quest has been completed.  I thought the "ignore-locked-quests" feature in the config did this but i must be wrong or its just not working...

This is not possible and is unfortunately not planned for this plugin.


Problems creating an executable

Hello,
Sorry to add to the issues, but I am not able to create an exe.
I followed your instructions, I created a venv python -m venv eel-test. Then, cd eel-test, scripts\activate.bat. After that, I did pip install eel, pip install PyInstaller. Then, I downloaded your 01 - hello world example, and entered into that. Once there, I ran python -m eel hello.py web. That resulted in this output.
I figured it might work anyway, so I tried python -m eel hello.py web --onefile --noconsole. However, that resulted in this output.
I can't be certain that this is an issue with your code and not with pyinstaller, but it seems like it may be.
Thanks.

Resolved by using virtualenv instead of venv.


Add helm flags for custom tls secret and caBundle in blueprint webhook controller

Change Overview
Add helm flags for accepting tls certs in k8s secret for Blueprint validation webhook controller. Also modified the chart accordingly
Pull request type
Please check the type of change your PR introduces:

[ ] :construction: Work in Progress
[ ] :rainbow: Refactoring (no functional changes, no api changes)
[x] :hamster: Trivial/Minor
[ ] :bug: Bugfix
[ ] :sunflower: Feature
[ ] :world_map: Documentation
[ ] :robot: Test

Issues

fixes #1515

Test Plan

[x] :muscle: Manual
[ ] :zap: Unit test
[ ] :green_heart: E2E

deploy kanister with bpValidatingWebhook.tls.mode set to  auto. This would create the secret and use self signed certificate
helm install kanister ./helm/kanister-operator/ --namespace kanister --create-namespace --set bpValidatingWebhook.tls.mode=auto

$kubectl get pod -n kanister
NAME                                          READY   STATUS    RESTARTS   AGE
kanister-kanister-operator-85c6c84469-ctt7m   1/1     Running   0          4s

$kubectl get secret -n kanister kanister-webhook-certs
NAME                     TYPE                DATA   AGE
kanister-webhook-certs   kubernetes.io/tls   2      93s

deploy kanister with  bpValidatingWebhook.tls.mode set to  custom. we would have to create a tls secret containing cert details.

# create self signed CA certificate

openssl genrsa -out ca.key 2048

openssl req -new -key ca.key -subj "/CN=kanister-kanister-operator-ca" -out ca.csr

openssl x509 -req -in ca.csr -signkey ca.key -CAcreateserial  -out ca.crt -days 365

# create tls certificate

openssl genrsa -out tls.key 2048

# create configuration file for kanister operator
vi openssl.cnf

[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = kanister-kanister-operator.kanister
DNS.2 = kanister-kanister-operator.kanister.svc

# sign it using CA cert

openssl req -new -key tls.key -subj "/CN=kanister-kanister-operator" -out tls.csr -config openssl.cnf

openssl x509 -req -in tls.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out tls.crt -extensions v3_req -extfile openssl.cnf -days 365

create a TLS secret in kanister namespace
``

$kubectl create secret tls my-tls-secret --cert tls.crt --key tls.key -n kansiter

$kubectl get secret -n kanister tls-certs
NAME                     TYPE                DATA   AGE
my-tls-secret   kubernetes.io/tls   2      93s

get ca bundle field

cat ca.crt | base64 -w 0
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMxekNDQWI4Q0ZCZnlMdkZNZ2xlVDJGMXpVTXNSc21rWTNPOXVNQTBHQ1NxR1NJYjNEUUVCQ3dVQU1DZ3gKSmpBa0JnTlZCQU1NSFd0aGJtbHpkR1Z5TFd0aGJtbHpkR1Z5TFc5d1pYSmhkRzl5TFdOaE1CNFhEVEl6TURJdwpNakV5TlRJMU9Gb1hEVEkwTURJd01qRXlOVEkxT0Zvd0tERW1NQ1FHQTFVRUF3d2RhMkZ1YVhOMFpYSXRhMkZ1CmFYTjBaWEl0YjNCbGNtRjBiM0l0WTJFd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUIKQVFEMEMrdktWUFpuTWZ1QU9oZU9tcndPMmpQeXlTUWZRRExsTzN6R2RKa01keWJ6a3Z3QlA0aVFlaTBzb09sdQpIbjBJRURDZzdRbUZiUWpNREpWM2pYV0NtUGg0VmpXRWRRNnhkSzd6ejZHd3ZPaFh0MFZxcURhSWJGRG1QS2xMCnlxVnVpWVR6Y1BQRnBwZFZKRnNFNGxBdmF5Q1BUT0xLZUpCVHVDcWVvQWxZZUFnRnFGV0daUGltNW9ZSmVnZk8KNy90REVsZGFBOERVNS8wR0xjSG5lS2pZRS9vbFpNVjVGRjZCZ2ttUjRHamxqQ01PRkFyQ3hxeHpVZXB5RFFhUQp1YWRRYkRHME5HTElLdURMeVZJQTFtMnpCYUE1M3JnaXdCTXZwWGJjSmR5OFZOdGtLcFdnMk8wanNNdkdhZiszCnhzRjhDd3BuWkpzTWprNW5Pc3ZGbHdjWkFnTUJBQUV3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUZVL0YzZDUKNGx2MHkvelllMWNuZ3EzZHJPMnZjZS81UkV4RlBFellTYTE2WFZFczZWTmVUaXlod0R1MktzU0VNbHFxOVlFMQpZZkxoU3hVZHhrRGxPd0ViV2FVOFRVLytiUytmWnUzVU0wZTBwdnJtOW8zMjVFdjQyczN6UkNYUjcxRGY4NGhnCkhhbWY2MTd6TUhQMFlMb2RJNDN4QlBQMXhTbXdIQXA4di9qcDFrSEU2Zjg4enBOc2NVaEl4dUE2elIvQkRpaEoKdy9NSVF2TWFWNzhOUDdxM1hMa1ZtSlNZK1BkMG4xZ2pIMFNNNGlYM1NVZXZBK2NjNDdRTmpHNjJERmpRTHBTcwpEQkRkRGltZmFNUlBYSWl0c2ZJY1ZXMzhHVlRsUnJTTi9nUUl3UDZxVjMzSUN4RVdwNERRM2UxY1NPU2RBQUxmClA2b0U1TmtVOWw5M1dROD0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=

Install kanister with tls mode set to custom

helm upgrade --install kanister ./helm/kanister-operator/ --namespace kanister --create-namespace --set bpValidatingWebhook.tls.mode=custom --set bpValidatingWebhook.tls.caBundle=LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMxekNDQWI4Q0ZCZnlMdkZNZ2xlVDJGMXpVTXNSc21rWTNPOXVNQTBHQ1NxR1NJYjNEUUVCQ3dVQU1DZ3gKSmpBa0JnTlZCQU1NSFd0aGJtbHpkR1Z5TFd0aGJtbHpkR1Z5TFc5d1pYSmhkRzl5TFdOaE1CNFhEVEl6TURJdwpNakV5TlRJMU9Gb1hEVEkwTURJd01qRXlOVEkxT0Zvd0tERW1NQ1FHQTFVRUF3d2RhMkZ1YVhOMFpYSXRhMkZ1CmFYTjBaWEl0YjNCbGNtRjBiM0l0WTJFd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUIKQVFEMEMrdktWUFpuTWZ1QU9oZU9tcndPMmpQeXlTUWZRRExsTzN6R2RKa01keWJ6a3Z3QlA0aVFlaTBzb09sdQpIbjBJRURDZzdRbUZiUWpNREpWM2pYV0NtUGg0VmpXRWRRNnhkSzd6ejZHd3ZPaFh0MFZxcURhSWJGRG1QS2xMCnlxVnVpWVR6Y1BQRnBwZFZKRnNFNGxBdmF5Q1BUT0xLZUpCVHVDcWVvQWxZZUFnRnFGV0daUGltNW9ZSmVnZk8KNy90REVsZGFBOERVNS8wR0xjSG5lS2pZRS9vbFpNVjVGRjZCZ2ttUjRHamxqQ01PRkFyQ3hxeHpVZXB5RFFhUQp1YWRRYkRHME5HTElLdURMeVZJQTFtMnpCYUE1M3JnaXdCTXZwWGJjSmR5OFZOdGtLcFdnMk8wanNNdkdhZiszCnhzRjhDd3BuWkpzTWprNW5Pc3ZGbHdjWkFnTUJBQUV3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUZVL0YzZDUKNGx2MHkvelllMWNuZ3EzZHJPMnZjZS81UkV4RlBFellTYTE2WFZFczZWTmVUaXlod0R1MktzU0VNbHFxOVlFMQpZZkxoU3hVZHhrRGxPd0ViV2FVOFRVLytiUytmWnUzVU0wZTBwdnJtOW8zMjVFdjQyczN6UkNYUjcxRGY4NGhnCkhhbWY2MTd6TUhQMFlMb2RJNDN4QlBQMXhTbXdIQXA4di9qcDFrSEU2Zjg4enBOc2NVaEl4dUE2elIvQkRpaEoKdy9NSVF2TWFWNzhOUDdxM1hMa1ZtSlNZK1BkMG4xZ2pIMFNNNGlYM1NVZXZBK2NjNDdRTmpHNjJERmpRTHBTcwpEQkRkRGltZmFNUlBYSWl0c2ZJY1ZXMzhHVlRsUnJTTi9nUUl3UDZxVjMzSUN4RVdwNERRM2UxY1NPU2RBQUxmClA2b0U1TmtVOWw5M1dROD0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= --set bpValidatingWebhook.tls.secretName=my-tls-secret

Verify

$ kubectl get pod -n kanister
NAME                                          READY   STATUS        RESTARTS   AGE
kanister-kanister-operator-68457b58f9-tdj8z   1/1     Running       0          9s
kanister-kanister-operator-85c6c84469-5857z   0/1     Terminating   2          5d21h

$ kubectl get secret -n kanister kanister-webhook-certs
Error from server (NotFound): secrets "kanister-webhook-certs" not found

create blueprint

$kubectl create -f https://raw.githubusercontent.com/kanisterio/kanister/master/examples/mysql/mysql-blueprint.yaml -n kanister
blueprint.cr.kanister.io/mysql-blueprint created

Hi @akankshakumari393 ,
I am not able to follow the test steps that you have documented here. In the second point your are saying create tls cert but the command that you have used is, to get the secret not create.
Also the helm install command that you have in the second point should specify where can I get the cabundle from.

@viveksinghggits I did those steps manually, I used a self signed certificate, got out the required field values, created TLS secret from private key and certs. and populated the values of CA bundle during helm install.
I was trying to put that in the description but the fields values were too big to be described here.

Can  you write the test steps in a way that you can someone can follow them if they want to? If the certs are too big you can just replace them with ... you don't have to put the entire cert here.

Relevant

I have updated the test plan to use a self signed certificate. PTAL.

@akankshakumari393 can we not have caBundle also, in the secret so that we have to just pass the secret name in the install command? That would make the install command significantly easier for users.
helm upgrade --install kanister ./helm/kanister-operator/ --namespace kanister --create-namespace --set bpValidatingWebhook.tls.mode=custom --set bpValidatingWebhook.tls.secretName=my-tls-secret

Let's document this in the kanister docs as well.

@akankshakumari393 can we not have caBundle also, in the secret so that we have to just pass the secret name in the install command? That would make the install command significantly easier for users.

@viveksinghggits we can do it, but that's not a ideal way. The certs information are in a tls type secret. Apart from it, If we even consider cert-manager tool, there also we do not combine the cabundle with secret.
I somehow agree that it would not be a user friendly process to add ca-bundle, but we would have to consider it, if we want to enforce bring your own certificate service.

@viveksinghggits we can do it, but that's not a ideal way. The certs information are in a tls type secret.
Can we not have another key in the secret? even if it's of type tls?

Apart from it, If we even consider cert-manager tool, there also we do not combine the cabundle with secret
are they doing the same thing that we are doing and  not specifying caBundle is secret? If not, in that case we not say this is the reason because of which we should have caBundle separately, right?

Can we not have another key in the secret? even if it's of type tls?
I don't think kubectl create secret tls supports any flag apart from --cert and --key. But we can add the data using declarative way in the secret.

I strongly believe we should not bind ca-cert into the same secret. let's say later on we choose to keep validating webhook server separately, then the tls secrets should only be restricted to that component using rbac but having cacert in it would not allow us to do that.
Either we can ask users to create a new opaque secret or we can keep the flag as it is.

@pavannd1 need your opinion on how we are using cabundle to populate vwc. We can have it as flag or we can ask users to create another generic secret with cacert in it, and pass as helm flag. cc @viveksinghggits

I don't have a problem even if we use configmap to store the caBundle. It's just, we will have to see how we can use that in ValidatingWebhookConfiguration.

@viveksinghggits You are right! There isn't an easy solution for this. The solutions I found were using ca-injector which seems to be yet another controller we need to run to dynamically inject the ca bundle into the configuration 😓
We should probably go ahead with this approach for now

ok.

@viveksinghggits You are right! There isn't an easy solution for this. The solutions I found were using ca-injector which seems to be yet another controller we need to run to dynamically inject the ca bundle into the configuration sweat We should probably go ahead with this approach for now

ok

@viveksinghggits @pavannd1 It wasn't clear from that conversation. Did we decide on using Secret or configMap?

I think Pavan is recommending that we should move ahead with the PR as it is.  There isn't an easy solution for this. The solutions I found were using ca-injector which seems to be yet another controller we need to run to dynamically inject the ca bundle into the configuration sweat
We should probably go ahead with this approach for now

@pavannd1 do we need modification in this PR?

@viveksinghggits You are right! There isn't an easy solution for this. The solutions I found were using ca-injector which seems to be yet another controller we need to run to dynamically inject the ca bundle into the configuration sweat
We should probably go ahead with this approach for now

@pavannd1 do we need modification in this PR?

No. We can move forward with this approach.


Refactor deploy asc

Refactored ASCDeploymentFlags and deployASC
Added checkpoints for Logic Signature as LsigInfo
left ASCInfo as it is (maybe used in stateful smart contracts)

checkpoint structure for Logic signature
lsigInfo = {
        creator: signer.addr,
        contractAddress: lsig.address(),
        logicSignature: encode(lsig)
      };

what is the use of deployer.getDelegatedLsig(lsigName, tx) (as per tracker) ?
we can get the Lsig directly from checkpoints.  using ( deployer.lsig.get(lsigname).logicSignature; )
should i implement it anyway ?

Please add also tests for getDelegatedLsig.

getDelegatedLsig requires algodClient and it also registers data, will have to create new AlgodClient while testing, i think that`s not good

Please add also tests for getDelegatedLsig.

getDelegatedLsig requires algodClient and it also registers data, will have to create new AlgodClient while testing, i think that`s not good

The idea is to create an operator, as I did with compile, and the only mock that part. Operator is just a tiny wrapper above SDK which only abstracts part of the functionality.

Ok, added test for getDelegatedLsig


Access GTK window before it's mapped

Is your feature request related to a problem? Please describe.
I'm trying to do wl-layer-shell stuff on the window the webview is in.  Per https://github.com/tauri-apps/wry/issues/1253 I am able to access the gtk window, but it's already mapped at that point it seems (is this due to the redraw call?):
custom_shell_surface_init: assertion '!gtk_widget_get_mapped (GTK_WIDGET (gtk_window))' failed
GtkWindow is not a layer surface. Make sure you called gtk_layer_init_for_window ()
GtkWindow is not a layer surface. Make sure you called gtk_layer_init_for_window ()
GtkWindow is not a layer surface. Make sure you called gtk_layer_init_for_window ()
GtkWindow is not a layer surface. Make sure you called gtk_layer_init_for_window ()
GtkWindow is not a layer surface. Make sure you called gtk_layer_init_for_window ()
GtkWindow is not a layer surface. Make sure you called gtk_layer_init_for_window ()
GtkWindow is not a layer surface. Make sure you called gtk_layer_init_for_window ()
GtkWindow is not a layer surface. Make sure you called gtk_layer_init_for_window ()

Describe the solution you'd like
I'm not sure the best way to do this... maybe in the long run a wl_layer_shell abstraction that could handle other platforms as well would be good.
Either being able to prevent the initial draw/put it off until later (maybe until the event loop starts?) or provide a callback to do stuff with the window earlier on would probably work.
Describe alternatives you've considered
A way to "bring your own window" might be a more flexible solution, for when cross-platform support isn't needed.
Additional context

Since I didn't get negative feedback here I went ahead and made https://github.com/tauri-apps/tao/pull/938 with what I thought would be a reasonable change to accomodate this.  If you wouldn't mind taking a look at that before I dig in too far I'd appreciate it.

For those who are trying to get around GTK Layer Shell, searching through every issue. Here is a working solution: https://github.com/tauri-apps/tauri/issues/2083#issuecomment-2424150009 to get everything done inside the Tauri setup hook.