[NuGet.org Bug]: Search endpoint returns old versions

Impact
I'm unable to use NuGet.org
Describe the bug
Search endpoint fail to return newest versions of the Xamarin.Forms package. This breaks dependency updates through GitHub Dependabot.
Repro Steps
Hit any of the search endpoints with the following query:

https://api-v2v3search-0.nuget.org/query?q=xamarin.forms
https://azuresearch-usnc.nuget.org/query?q=xamarin.forms

Notice that the latest returned package versions are 4.3.
When looking at https://www.nuget.org/packages/Xamarin.Forms/ you can see the latest version is <IP_ADDRESS>5.
Expected Behavior
Version 5.0.xxxx should be returned.
Screenshots
No response
Additional Context and logs
No response

Hello, Xamarin.Forms's version includes build metadata (the stuff after the + in its version string) and is only supported by clients that support SemVer 2.0.0. We exclude these packages from search results unless the client explicitly declares its support for SemVer 2.0.0 by providing the semVerLevel=2.0.0 query parameter. For example: https://azuresearch-usnc.nuget.org/query?q=xamarin.forms&semverlevel=2.0.0&debug=true
I know this behavior is quite confusing, and many folks have run into this. We have a work item to update the search behavior to include semver 2 results by default here: https://github.com/NuGet/NuGetGallery/issues/8814
There's a few gotchas with the NuGet protocol. I would highly recommend using NuGet's SDKs if possible: https://docs.microsoft.com/en-us/nuget/reference/nuget-client-sdk#search-packages
If you cannot use NuGet's SDKs, please read the NuGet protocol's docs thoroughly:

https://docs.microsoft.com/en-us/nuget/api/search-query-service-resource#search-for-packages
https://docs.microsoft.com/en-us/nuget/api/service-index

By the way, please don't use the api-v2v3search-0.nuget.org domain. This endpoint is deprecated. Please make sure to discover the latest search endpoint using the service index. Using the NuGet SDK will do this automatically for you.
I'll close this off for now, but please let us know if you have additional questions or feedback!

Thanks for the detailed reply. I forwarded link to it to the support ticket for GitHub Dependabot.


How to return a collection of rust structs.

Hello! I suspect I'm missing something simple, I have a function, registered with #[extendr] / extendr_module! that I would like to have return something like Vec<Point>. Is that possible at this time?
Contrived example:
struct Point {
    x: u32,
    y: u32,
}

#[extendr]
impl Point {
    fn get_x(&self) -> u32 { self.x }
    fn get_y(&self) -> u32 { self.y }
}

#[extendr]
fn get_points(place: String) -> Vec<Point> {
    let points: Vec<Point> = get_points_from_place(place);
    points
}

extendr_module! {
    impl Point;
    fn get_points;
}

This generates an error like:
 the trait `From<Vec<Point>>` is not implemented for `extendr_api::Robj`

Hi @sstadick
Sorry about the delay.
You should probably return a List directly and implement From<Point> for Robj.
Then you can return List::from_values(get_points_from_place(place))
I hope this helps.

Something like:
impl From<Point> for Robj {
    fn from(point: Point) -> Self {
        r!([point.x, point.y])
    }
}

Using R types like List, Integers and Doubles is often preferable to using Vec, which requires an extra allocation.

Hi @andy-thomason thanks for getting back to me!
That makes sense - I was trying to use from_values but hadn't implemented From<Point> for Robj.
What if I do actually want a List of of the underlying class though? I'd like to be able to call my defined methods on (things that are more complex than get_x).
In my real code I'm executing a query on a data source, and gathering all the results, which are structs with defined impls on them. I want to pass back a the collection of results to R and still be able to call methods on elements in that collection.

Interesting...
You can use a List of ExternalPtr<Point> but it is not going to be efficient as there is a large overhead on an R object.
With vectors of structures, it is best to convert them to structures of vectors:
struct Points {
    x: Doubles,
    y: Doubles,
}

and return data_frame!(x=points.x, y=points.y)

I see. I think that makes sense. I'll try to re-think how I have things organized to fit that a little better. R is not my normal language and I'm not used to what is "normal" there just yet.


[SPARK-17116][Pyspark] Allow parameters to be {string,value} dict at runtime

What changes were proposed in this pull request?
This pull allows a dictionary containing string as keys to be passed in the fit() method. Presently it only allows an instance of the Estimator to be passed as key.
How was this patch tested?
This patch was manually tested on a local PC.

@srowen Could you take a look and check if this improvement is proper?

Can one of the admins verify this patch?

I think we need a test here maybe and update the argument description if this change is legitimate.

cc @holdenk

@HyukjinKwon this is my first time with contributing in Spark and so I didnt know if we add tests to each pull. If it is proper I will add the tests :)

@HyukjinKwon I have updated the code. Could you please take a look

Thanks for working on this! So at first glance I'm not super sure if we want to add this (is this being done to be more closely related to the skicitlearn apis or something?)
A good next step would probably be adding some tests for this as well :) Once we've got some tests we can ping some of the Python ML people and see what they think.

@holdenk Sure. I will add the tests. I saw that as per the issue opened the setParams was taking in string dict while fit() method was not. Hence I thought it would be an improvement to do that to the fit() method as well.

@aditya1702 - thanks that sounds like a good reason for us to be consistent between the two. Let me know how adding the tests goes :)

Hi @aditya1702, do you mind if I ask whether you are still working on this? Maybe it should be closed for now if you are currently not able to work on this further. It seems inactive for few months.


Fix Issue : https://github.com/apache/incubator-dubbo/issues/1470

What is the purpose of the change
Fix an error in URL class -- can not get username or password correctly while them contains "@" character.
For example : admin:hello<EMAIL_ADDRESS>Brief changelog
Replace indexOf("@") with lastIndexOf("@")
Verifying this change
Run unit test URLTest.testUserNamePasswordContainsAt()
Follow this checklist to help us incorporate your contribution quickly and easily:

[x] Make sure there is a GITHUB_issue filed for the change (usually before you start working on it). Trivial changes like typos do not require a GITHUB issue. Your pull request should address just this issue, without pulling in other changes - one PR resolves one issue.
[ ] Format the pull request title like [Dubbo-XXX] Fix UnknownException when host config not exist #XXX. Each commit in the pull request should have a meaningful subject line and body.
[ ] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
[x] Write necessary unit-test to verify your logic correction, more mock a little better when cross module dependency exist. If the new feature or significant change is committed, please remember to add integration-test in test module.
[ ] Run mvn clean install -DskipTests & mvn clean test-compile failsafe:integration-test to make sure unit-test and integration-test pass.
[ ] If this contribution is large, please follow the Software Donation Guide.

Codecov Report

Merging #1808 into master will decrease coverage by 0.01%.
The diff coverage is 100%.

@@             Coverage Diff              @@
##             master    #1808      +/-   ##
============================================
- Coverage     40.45%   40.44%   -0.02%
+ Complexity     4415     4414       -1
============================================
  Files           626      626
  Lines         30079    30079
  Branches       5319     5319
============================================
- Hits          12169    12165       -4
- Misses        15983    15987       +4
  Partials       1927     1927

Impacted Files
Coverage Δ
Complexity Δ

...on/src/main/java/com/alibaba/dubbo/common/URL.java
26.34% <100%> (ø)
77 <0> (ø)
:arrow_down:

...ubbo/rpc/protocol/dubbo/ChannelWrappedInvoker.java
37.5% <0%> (-8.34%)
3% <0%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 59f2b8b...b04e695. Read the comment docs.

Hi, please follow the pull request title naming convention, which is described in the checklist.


Some tests are not conditionally compiled

Currently the integration tests trigger a note that the compiled code contains non-API entry points:
https://github.com/extendr/extendr/pull/141/checks?check_run_id=1755212957#step:14:90
This isn't reported as an error, so tests seem to pass, but it would actually prevent us from submitting a package to CRAN, so it needs to be fixed.
One case where we have tests without conditional compilation is here:
https://github.com/extendr/extendr/blob/f43d2539e8ac0d5dcd562aa1d2282369528ae1a2/extendr-api/src/robj_ndarray.rs#L59-L61
There may be others. These can be difficult to find. It would be good to have some sort of automated test for these, so they don't sneak in to the code base unnoticed.

IIUC, we need to drop the dependency on extendr-engine. I think we need to remove this line
https://github.com/extendr/extendr/blob/daee5c88842b0ec226c32ae9472244b6c6a8a63e/tests/extendrtests/src/rust/Cargo.toml#L30
and make all tests in extendr-api using extendr_engine::start_r() as optional.
https://github.com/extendr/extendr/blob/daee5c88842b0ec226c32ae9472244b6c6a8a63e/extendr-api/src/robj/tests.rs#L5

IIUC, we need to drop the dependency on extendr-engine. I think we need to remove this line
https://github.com/extendr/extendr/blob/daee5c88842b0ec226c32ae9472244b6c6a8a63e/tests/extendrtests/src/rust/Cargo.toml#L30
and make all tests in extendr-api using extendr_engine::start_r() as optional.
https://github.com/extendr/extendr/blob/daee5c88842b0ec226c32ae9472244b6c6a8a63e/extendr-api/src/robj/tests.rs#L5

IIUC, we need to drop the dependency on extendr-engine. I think we need to remove this line

I believe that until extendr-engine is on crates.io, we need this line to keep cargo happy, since extendr-api depends on extendr-engine.
However, other things we can do to improve things is to move extendr-engine into dev-depenencies, then every test that isn't conditionally compiled will break compilation for downstream crates.

IIUC, we need to drop the dependency on extendr-engine. I think we need to remove this line

I believe that until extendr-engine is on crates.io, we need this line to keep cargo happy, since extendr-api depends on extendr-engine.
However, other things we can do to improve things is to move extendr-engine into dev-depenencies, then every test that isn't conditionally compiled will break compilation for downstream crates.

We have figured out that the problem is generated by the new test! macro defined here:
https://github.com/extendr/extendr/blob/daee5c88842b0ec226c32ae9472244b6c6a8a63e/extendr-api/src/rmacros.rs#L277-L291
which uses the test() function defined here:
https://github.com/extendr/extendr/blob/daee5c88842b0ec226c32ae9472244b6c6a8a63e/extendr-api/src/functions.rs#L380-L392
In my opinion, at least the test() function needs to move into extendr-engine, and possibly the test! macro also. This is very simple: If we ever want to be able to use extendr code in R packages on CRAN, then we cannot have any engine code in extendr-api.
We also have to make sure we don't let the tail wag the dog here. We cannot have engine code in the api. That's a hard requirement. On the other hand, test! is a convenience function for making documentation and tests simpler and easier to read. If some additional hoops need to be jumped through, it has to be on the testing side. We can't make a primary use case (write R packages using Rust) more difficult or complex just so writing documentation becomes easier.
I think this can be resolved relatively easily. I'll make a PR.

We have figured out that the problem is generated by the new test! macro defined here:
https://github.com/extendr/extendr/blob/daee5c88842b0ec226c32ae9472244b6c6a8a63e/extendr-api/src/rmacros.rs#L277-L291
which uses the test() function defined here:
https://github.com/extendr/extendr/blob/daee5c88842b0ec226c32ae9472244b6c6a8a63e/extendr-api/src/functions.rs#L380-L392
In my opinion, at least the test() function needs to move into extendr-engine, and possibly the test! macro also. This is very simple: If we ever want to be able to use extendr code in R packages on CRAN, then we cannot have any engine code in extendr-api.
We also have to make sure we don't let the tail wag the dog here. We cannot have engine code in the api. That's a hard requirement. On the other hand, test! is a convenience function for making documentation and tests simpler and easier to read. If some additional hoops need to be jumped through, it has to be on the testing side. We can't make a primary use case (write R packages using Rust) more difficult or complex just so writing documentation becomes easier.
I think this can be resolved relatively easily. I'll make a PR.

Fix was easier than I thought. See #150.

Fix was easier than I thought. See #150.

I believe that until extendr-engine is on crates.io, we need this line to keep cargo happy, since extendr-api depends on extendr-engine.

No, because extendr-api itself declares the dependency on extendr-engine with path specified, it doesn't matter. Actually, you can remove this and see it passes the checks.
https://github.com/extendr/extendr/blob/394a0ff5b70dc8be24efe4c47fc92b6f6c5a6a44/extendr-api/Cargo.toml#L19
I think it doesn't matter to extendr-api how extendrtests specifies extendr-engine. Maybe you confuse it with [patch.crates-io] section...?

I believe that until extendr-engine is on crates.io, we need this line to keep cargo happy, since extendr-api depends on extendr-engine.

No, because extendr-api itself declares the dependency on extendr-engine with path specified, it doesn't matter. Actually, you can remove this and see it passes the checks.
https://github.com/extendr/extendr/blob/394a0ff5b70dc8be24efe4c47fc92b6f6c5a6a44/extendr-api/Cargo.toml#L19
I think it doesn't matter to extendr-api how extendrtests specifies extendr-engine. Maybe you confuse it with [patch.crates-io] section...?

But anyway it seems it doesn't matter to avoid "non-API call" warning whether we keep it or remove it. So, I'm fine with either.

But anyway it seems it doesn't matter to avoid "non-API call" warning whether we keep it or remove it. So, I'm fine with either.

I'll remove it if it's not required.

I'll remove it if it's not required.


Security vulnerability reporting guidelines

If I've noticed an issue that potentially has security impact, what is the best way to report it? Is it preferable to report it privately, or is opening a public Github issue fine at this stage of the project?
Thanks!

Hi @nmoroze, can you send an email to<EMAIL_ADDRESS>with more details? We should be able to determine next steps based on that.
Thanks

Hi, following up on our email discussion since you said it's okay to continue discussion on Github (also changing the issue title to be more specific).
Repeating for context:
The issue we found is that the UART peripheral leaks a recently received byte of data from the RX FIFO when it's in an empty state. This is because the prim_fifo_sync FIFO implementation directly wires its rdata output to an entry of the buffer's internal storage, and these entries are only cleared when they're written over (but not when the FIFO clear input or the reset line are asserted). The rdata output of the UART's RX FIFO is directly wired to the software-accessible RDATA register, meaning that any software running with direct access to the UART MMIO region can read this data by intentionally omitting a check for whether there is valid data available.
It seems like at least one other peripheral uses a similar pattern (the in-progress I2C implementation), so we were thinking a good fix that would cover all users of prim_fifo_sync is to simply wire its rdata output to zero if the FIFO is empty (and have it behave normally otherwise).
Based on our email discussion it sounds like this isn't really seen as a security issue based on the security assumptions for how the OpenTitan is planned to be deployed. However, I'm still curious if anyone has thoughts on whether it might make sense to tweak the FIFO to prevent this behavior anyways.

One point brought up in the email thread was that "IO peripherals are not trusted for secrecy", and that secret data should be encrypted and authenticated while in transit. Is this true for all (intended) uses of the OpenTitan?
It's a little tough to talk about whether this is a reasonable assumption without some more details on how the OpenTitan is to be used/deployed, an OS and app model, etc. I skimmed through the logical security model, but I think that describes a couple general setups, and I couldn't tell if the following scenario is intended to be supported.
Suppose we wanted to use the OpenTitan as part of a device that has a user-facing component, such as a display and buttons. An example of such a device would be a cryptocurrency hardware wallet, which can be thought of as a generalization of devices like U2F tokens, that needs to support mutually untrusting apps. Here, it doesn't make sense for the interaction with user-facing I/O to be encrypted, and it is indeed security-sensitive. We could imagine having a traditional operating system that protects these devices from user space applications, but an alternative design could expose these peripherals directly to the user applications through MMIO. Depending on the setup of the peripheral, and what the kernel does to the peripheral between switching apps, this could be safe. For example, with the UART, if it weren't for the UART RX FIFO issue that Noah found, I think it would be safe to expose it directly (perhaps with some secret-purging code in the kernel).

For historical purposes, I'm tagging this as "security report", though I'll let @moidx and the security team sort through the full implications. Just thinking it worthy of applying the label.

However, I'm still curious if anyone has thoughts on whether it might make sense to tweak the FIFO to prevent this behavior anyways.

It should be a simple enough change. It does incur a minor implementation penalty in power, performance and area of course. In particular if a FIFO lies on a timing critical path the extra gate delay added by the masking to 0 when empty could cause issues.
However we're not pushing OT to its frequency limits (currently) so this may not be a problem. I don't off-hand know the proportion of power/area consumed by FIFOs currently but I doubt it's large so the addition of the masking logic won't cause any notable change.
 That way it will apply to all FIFOs across earlgrey but if there's specific instances where it's a bad idea for some reason it can be easily disabled.

Thanks @GregAC for your thoughts. I've opened PR #2420 based on your suggestions!


Consider moving configuration into env files or similar

@aaroncox just getting into running and configuring.
prod.php and other files are checking in git code, which makes it awkward to change those files just for my instance. Would be better if those were reading from an .env file that isn't checked into git.
I think I'm going to run a separate branch for now, which is what I'll set up to deploy to Heroku, and keep my master clean and tracking your stuff.

Yeah, those files won't be in the repository eventually. Generally what I'll do is add the config/*.php files to the .gitignore file, and then create templates/examples in the folder that you can copy into place as your configuration files.
I'll look into what options silex provides, and see what would be best for the docker/heroku combo configuration we've got running here now.


Morning session code review

The following problem was identified:
When new tasks are added, they dont want to to delete.

Thank You Victor

you did grate job kindly request in the clear complete there is an Issue when try to delete after you add so try to add reloader before it renders


Skipping updateCaught NaN in diff for kdiff for thread.

Any ideas/suggestions on how to overcome it? Latest GloVe from Github, here is the params:
time build/glove -save-file gigamega.cased.tokenized.glove.600d -threads 32 -input-file /mnt/cooccurrence.shuf.bin -x-max 40 -iter 50 -vector-size 600 -vocab-file /mnt/vocab.txt -verbose 3

Did you look at this:
https://github.com/stanfordnlp/GloVe/issues/50

We too had a lot of NaN problems.
Probably because an array was not totally initialized.
I solved this in glove.c and issued a pull request. #68
(which also includes a fix for a out-of-bounds problem in cooccur.c)
Feel free to test it:)


Transform Error when using unocss.config.ts as configuration file

When using unocss.config.ts as configuration file, npm run dev returns error.

Dependencies

vite.config.ts

unocss.config.ts

However, if unocss.config.ts is removed, npm run dev runs successfully. Am I missing something?

Can you share a minimal reproduction? Thanks.

Same here (quasar2 + vite). Error appears from unocss v0.35.0. Reverting back to v0.34.1 eliminates the error
<path to app>/node_modules/@unocss/transformer-directives/dist/index.mjs:2
var _cssTree = require("css-tree");
               ^

Error: TRANSFORM_ERROR: Export namespace should be first transformed by `@babel/plugin-proposal-export-namespace-from`.

 <path to app>/node_modules/css-tree/lib/index.js:0:0
    at <path to app>/node_modules/@unocss/transformer-directives/dist/index.mjs:2:16
    at jiti (<path to app>/node_modules/jiti/dist/jiti.js:1:196506)
    at <path to app>/node_modules/unocss/dist/index.mjs:10:53
    at jiti (<path to app>/node_modules/jiti/dist/jiti.js:1:196506)
    at <path to app>/uno.config.js:1:177
    at jiti (<path to app>/node_modules/jiti/dist/jiti.js:1:196506)
    at loadConfigFile (<path to app>/node_modules/unconfig/dist/index.cjs:149:11)
    at async Object.load (<path to app>/node_modules/unconfig/dist/index.cjs:82:24)
    at async Object.loadConfig (<path to app>/node_modules/@unocss/config/dist/index.cjs:50:18)
    at async reloadConfig (<path to app>/node_modules/@unocss/vite/dist/index.cjs:67:20)

Gladly,
First, I create a new Vite project by pnpm create vite, and choose react as the framework and react-ts as variant

Changed active directory to vite-project and run pnpm i

Installs unocss with pnpm i unocss

Import and add Unocss() to vite.config.ts plugin array.

Create unocss.config.ts file

This is the current directory structure

Run npm run dev to start development server

Error occurs.
However, if unocss.config.ts is removed, no error occurs and unocss will work as intended.

Forgot to mention that uno.css is imported in main.tsx

This was already fixed by #1016, just it's not released yet.
Seems like there is no way to link a closed pull request.

I see, I guess the best course of action is to revert to 0.34.1 as mention by Sfinx. Thank you for your help.

Published v0.35.2

Thanks, works !


Mark/signature

Create a mechanisms for serializing structs to signed JSON and verifying the signatures.

Before anyone asks why I have created three new crates, here are the reasons:

Because signed structs will be needed by both Pyrsia nodes and their clients, we need a library for shared code. For this reason, I created pyrsia_client_lib.
To make signed structs easy to use, I needed to define a procedural macro. Rust requires that procedural macros be in a separate crate by themselves. For his reason, I created signed_struct.
We need to test the macros in signed_struct. Rust won't allow the test to be in the same create as the procedural macro. Putting it in pyrsia_client_lib makes Cargo complain about a circular dependency. I had to create a separate crate to put the test in. This is why I created signed_struct_test.

I suspect the failures https://github.com/pyrsia/pyrsia/runs/4463970462?check_suite_focus=true#step:4:1267 are because of incorrect changes to the Cargo.lock
https://github.com/pyrsia/pyrsia/pull/62/files#diff-13ee4b2252c9e516a0547f2891aa2105c3ca71c6d7a1e682c69be97998dfc87eL533-L538

@prince-chrismc You wrote

I feel strongly the location of you new crates should be approved upon.
Ok. Please explain. What don't you like about the current location? If you have a better idea, where to you suggest that they go?

CLI should not be doing any "work" signing should be done in the node.
Again, what are your reasons for this?

Requiring signing to be done in the node opens a security risk. Do to that would require that we make private keys available to Pyrsia nodes. That is an unnecessary risk of compromising private keys. Because nodes are interacting with other nodes, we have to assume that they will be the target of hackers. Just the fact that private keys are available to nodes makes them more of a target. It will also make people question how secure we are.
Nodes support organizations will be particularly attractive targets. We should keep them out of nodes for this reason alone.
Another reason to not do signing in nodes is that it would imply that nodes are accepting unsigned data. This opens up another security risk. One simple rule that I think we should follow is that if data is not signed it is not on a Persia node. Allowing unsigned data means that someone who is trying to attack a Pyrsia node can remain anonymous.

"clients" can pick the parts they need from the node.

Cargo is extremely flexible! You can nest crates in the project structure. docs

Yes Cargo is flexible. I fail to understand what the point is that your are trying to make with that. I assume that you have some application of Cargo's flexibility in mind, but I do not know what.

Rust requires that procedural macros be in a separate crate by themselves

Again the does not require it to be at the root of the repository. Cargo is flexible. First example I found in mozilla github code base: https://github.com/mozilla/gecko-dev/blob/d36cf98aa85f24ceefd07521b3d16b9edd2abcb7/xpcom/rust/xpcom/Cargo.toml#L13

Agreed. That is why the procedural macro crate and its test crate are not in the root. They are under pyrsia-client-lib. I do not understand your point.

you can run integration tests. https://github.com/ferrous-systems/testing-proc-macros is a great example! You can also read https://doc.rust-lang.org/book/ch11-03-test-organization.html which I used in #80

Again, I do not know what you are asking of me. I have not integration tests here. If you consider testing a proc macro an integration test rather than a unit test. I don't what to argue semantics.
Please clarify what it is you want of me. The only change you actually requested, that we do our signing in the nodes, I will not do.

@prince-chrismc

I suspect the failures https://github.com/pyrsia/pyrsia/runs/4463970462?check_suite_focus=true#step:4:1267 are because of incorrect changes to the Cargo.lock
I have made no manual changes to Cargo.lock. What I understand from your statement is that your believe that I have somehow done something that resulted in the Cargo.lock file being somehow wrong. I have no idea what to do about this. Any suggestions?  Is there a particular command that I can run in my local environment to replicate the problem?

None of the new crates should be in the root of the repository.
They should all be under the pyrsia_node
pyrsia_node
|_src/
|_signing
   |_src/
   |_signing_macros
      |_src/
      |_tests/
|_tests/
pyrsia_cli/
|_src/


Enabling Application Insight  with Bot Composer and does not get "LuisResult" or "QnAMaker" name in telemetry data.

When I enable the application insight with Bot Composer and set log personal information to true, I can see in Apllication Insight log in CustomEvents the log name "BotMessageReceived" and "BotMessageSend" but I cannot collect luis or qna data as in the document:
https://docs.microsoft.com/en-us/azure/bot-service/bot-builder-telemetry-analytics-queries?view=azure-bot-service-4.0#total-intents-by-popularity
How can I enable LUISResults and QnA Maker result in the telemetry data?
Thank you!

Related issue https://github.com/microsoft/BotFramework-Composer/issues/7533


Bug: When PSM Open, Scrolling Focus Still on Background

Issue Summary
Device: iPhone 6
When you open the PSM, and try to scroll, you still scroll the background until you deliberatly tap on the PSM itself

Steps to Reproduce

Log into the admin interface on an iPhone\
Open anything like a new post or tags
Open the PSM and try to scroll

Technical details:

Ghost Version: Master
Client OS: Mac 10.10
Server OS: Mac 10.10
Browser: Safari Mobile
Database: SQLite

I've been unable to reproduce this on 0.7.4 on an iPhone 6s running iOS 9.2. Are you able to replicate the issue?
It's only the PSM that would exhibit this behaviour now that the tags screen has changed so anyone testing would need to open a long post in order to have "background" that's scrollable. When I tested I'm still able to scroll the main screen behind the PSM but only if I touch the extreme left of the screen which is covered by the PSM.

Ok, let's close this and reopen it if we get a new reproduction case :+1:


libhfs3 updates (xattr and patches)

Reviwers: @immuta/developers
These are all the C++ changes to libhdfs3 to:

use libhdfs3 outside of the hawq project
add the ability to list all the extended attributes for a path
add an example of how to query the namenode for information

What still remains to be done before submitting this back as a patch:

add setxattr, removexattr, getxattr
add all the xattr stuff to the c library

Does it make sense to add the xattrs stuff to depends/libhdfs3/src/client/hdfs.h and depends/libhdfs3/src/client/Hdfs.cpp too?


tap-token: SDK export & AirdropBroker deployment

commit: b9fce7d1704cb0885a0b3a6dc0887b6cdd6131f1

Task linked: CU-86796arhc Deploy AirdropBroker on testnet


inhaler refills

Need to check view code, as not all refills showing, e.g.
https://openprescribing.net/analyse/#org=CCG&numIds=0301040X0BBAAAA&denomIds=0301040X0BBAAAA,0301040X0BBABAB&selectedTab=chart
Current code for view:
with device_list AS
(with device_name AS
(select strpos(nm, ' with device') as device_posn, substr(nm, 0, strpos(nm, ' with device')-1) as name
from dmd.vmp
where UPPER(nm) LIKE '%WITH DEVICE%'
and bnf_code LIKE '03_______AA%')
SELECT device_name.name as name, device_posn from dmd.vmp AS dmd
inner join
device_name as device_name
on
device_name.name = substr(dmd.nm,0, device_posn-1)
group by device_name.name, device_posn
having count(device_name.name)>1
order by device_name.name)
SELECT
vmp.nm, bnf.presentation_code as bnf_code, bnf.presentation,
CASE WHEN REGEXP_CONTAINS(LOWER(vmp.nm), r'with device') THEN "device" ELSE "refill" END AS device_type  from dmd.vmp as vmp
inner join
device_list as device
on
device.name = substr(vmp.nm,0,(device.device_posn)-1)
inner join
hscic.bnf as bnf
on
concat(substr(bnf.presentation_code,0,9),substr(bnf.presentation_code,-2)) = concat(substr(vmp.bnf_code,0,9),substr(vmp.bnf_code,-2))

group by vmp.nm, bnf.presentation_code, bnf.presentation
order by presentation_code


Updated readme & added Isha2103

I have corrected the spelling of mention on line number 31 and added my name in the list.

Thank you! @Isha2103 :blush:


spop(): aredis.exceptions.RedisClusterException: Too many connections

aredis version: 1.1.8
aioredis version: 1.3.1
We are getting following error related to aredis when calling " js = await redis.spop('queue name')". Please suggest.
Observation:
spop is the only operation used when service runs in idle state. https://github.com/NoneGG/aredis/blob/master/aredis/pool.py#L385
 if self.count_all_num_connections(node) >= self.max_connections:
       if self.max_connections_per_node:
             raise RedisClusterException("Too many connection ({0}) for node: {1}"
                                            .format(self.count_all_num_connections(node),
                                                    node['name']))
       raise RedisClusterException("Too many connections")

I think aredis is leaking connections.
getting following error, stack trace:
2021-12-20 06:39:09,882 ERROR worker - failed
Traceback (most recent call last):
File "/usr/local/lib/python3.6/dist-packages/aredis/pool.py", line 504, in get_connection_by_node
connection = self._available_connections.get(node["name"], []).pop()

IndexError: pop from empty list
js = await redis.spop(Scheduler.r_report_q)
File "/usr/local/lib/python3.6/dist-packages/aredis/commands/sets.py", line 88, in spop
File "/usr/local/lib/python3.6/dist-packages/aredis/utils.py", line 179, in inner
File "/usr/local/lib/python3.6/dist-packages/aredis/client.py", line 407, in execute_command
File "/usr/local/lib/python3.6/dist-packages/aredis/pool.py", line 506, in get_connection_by_node
File "/usr/local/lib/python3.6/dist-packages/aredis/pool.py", line 397, in make_connection
aredis.exceptions.RedisClusterException: Too many connections

This PR should fix it: https://github.com/NoneGG/aredis/pull/194
Not sure if this project is still being maintained or not. Looks like @NoneGG didn't have any activity in 2021.

NoneGG had no activity during this period.

Hope he is all right.


[DO NOT MERGE] StringGuts-based grapheme breaking

This doesn't compile yet, but it implements the following:

Move grapheme breaking and character-based indexing entirely into UnmanagedString and UnmanagedOpaqueString

Introduce a new internal protocol, _StringVariant, to make it easier to extend these unmanaged views with new operations (such as grapheme breaking)

Implement CharacterView in terms of String, not the other way around

Fix the following three indexing bugs:

SR-6544 - Runtime crash on integer overflow while grapheme breaking huge Strings
SR-6545 - String: index(_:offsetBy:limitedBy:) can jump over limit if it's in the middle of a grapheme cluster
SR-6546 - String.distance(from:to:) can trap if end index falls in the middle of a grapheme cluster

Cc @milseman This is not ready to merge yet, but it may be worth a look in case you spot a major design problem. The idea is to push most read-only character operations down to the level of unmanaged views, skipping _StringGuts.
I'm hoping the internal _StringVariant protocol will let us share code between _UnmanagedString and _UnmanagedOpaqueString without affecting performance. It may also be helpful if we decide to split the ASCII and UTF-16 flavors of _UnmanagedString into two distinct types, which is an idea I'm toying with.
Unicode scalar operations can also be defined on top of _StringVariant, and probably string comparisons too.

@lorentey did you say this is ready for review + merge?


Update exercise3.py

sorting by IP addresses is actually not showed in your solution

???
https://github.com/ktbyers/pynet/blob/master/learning_python/lesson2/exercise3.py#L30

sort() call already exists.


"npm install ydn.db" doesnt install

npm WARN package.json<EMAIL_ADDRESS>No README data
npm WARN package.json<EMAIL_ADDRESS>No repository field.
npm WARN package.json<EMAIL_ADDRESS>No repository field.
npm ERR! Darwin 13.4.0
npm ERR! argv "node" "/usr/local/bin/npm" "install" "ydn.db" "--save"
npm ERR! node v0.10.36
npm ERR! npm  v2.3.0
npm ERR! code E404

npm ERR! 404 Not Found: ydn.db
npm ERR! 404
npm ERR! 404 'ydn.db' is not in the npm registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404 It was specified as a dependency of 'x'
npm ERR! 404
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.

npm ERR! Please include the following file with any support request:
npm ERR!   npm-debug.log

I also tried  "npm install ydn/db",  "npm install ydn-db",  "npm install ydndb",  "npm install ydn". None of them seems to work.

You didn't try the simplest thing: searching for it? It is the top hit at npmjs.com. It is called ydn.base. YMMV - I just happened to come by.

It does not seem to live on NPM, so why should it work? You can just simply specify the github repo in your package.json. Add it like this npm install --save-dev yathit/ydn-db. You can optionally specify a version tag or commit id, but refer to the npm docs for more. Know your tools.

@fatso83 , I got that, this issue was meant to address pushing to NPM, which should be the case given this commit: https://github.com/yathit/ydn-db/commit/a546bd23b1d6324499525a465d38e6ac25e6477b. Anyway, we went ahead with native IndexedDB for different reasons.

@fatso83 @kakadiya91 npm install ydn.db should work now. I have add compiled js file and publish them.

@yathit thanks, appreciate it! :)


Get-AzureRmResource Instead of Find-AzureRmResource

In the "Set up integration with Log Analytics" section the PowerShell is no longer accurate when using the current version of AzureRM module from the PowerShell Gallery. Using the following code will find the appropriate resource ID's and setup the integration:
$AutomationResourceID = (Get-AzureRmResource -ResourceType 'Microsoft.Automation/automationAccounts').ResourceId

$WorkspaceResourceID = (Get-AzureRmResource -ResourceType 'Microsoft.OperationalInsights/workspaces').ResourceId

Set-AzureRmDiagnosticSetting -ResourceId $AutomationResourceId -WorkspaceId $WorkspaceResourceId -Enabled $true -Categories 'DscNodeStatus'

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 8e6c1511-7ec9-8771-4ea1-397a01487878
Version Independent ID: e1082a60-b843-7f72-b3cf-f680488dd87a
Content: Forward Azure Automation State Configuration reporting data to Log Analytics
Content Source: articles/automation/automation-dsc-diagnostics.md
Service: automation
GitHub Login: @bobbytreed
Microsoft Alias: robreed

@lukealton Thanks for the feedback! We are currently investigating and will update you shortly.

@lukealton  I have a pull request created that fixes the steps you outlined.  Once the PR has been merged this issue will automatically close.  Don't hesitate to reach out again if you have issues with the docs or just have any questions.


FogVolume don't dispatch compute with zero-dimension groups

Fixes this error print when a tiny FogVolume calculates a kernel size with any zero dimensions.
Dispatch amount of Y compute groups<PHONE_NUMBER>) is larger than device limit (65535)
   at: RenderingDeviceVulkan::compute_list_dispatch (drivers\vulkan\rendering_device_vulkan.cpp:8055) - Condition "p_y_groups > limits.maxComputeWorkGroupCount[1]" is true.

This should be fixed in the FogVolume code, not in the RenderingDevice in accordance with best practice number 8 Prefer Local Solutions: https://docs.godotengine.org/en/stable/community/contributing/best_practices_for_engine_contributors.html#prefer-local-solutions
https://github.com/godotengine/godot/blob/d046817536a21358f9c51bf5b932d0a6615ee76a/servers/rendering/renderer_rd/renderer_scene_render_rd.cpp#L3978
If we add anything to the RenderDevice it should be an error print if any dimension is set to 0.

I added that change because setting groupCount dimensions to zero, while not useful, is within vulkan spec. I'd opt for a debug-only WARN_PRINT_ONCE for zero dimensions.
For the local solution, I assume a zero kernel_size is acceptable (as opposed to a minimum 1x1x1) and should just bail from computing? Or is this an off-by-one situation?

Thanks!


[QA] Add run-qa-checks script

Add run-qa-checks script like we have in other modules, ensure flake8, isort and black formatting issues are fixed.

Is it required to add a separate script? Will adding the required checks to the tox.ini file suffice?

Is it required to add a separate script? Will adding the required checks to the tox.ini file suffice?

Please read this whole paragraph to understand why we need the script:
https://openwisp.io/docs/developer/contributing.html#python-code-conventions
I also suggest taking a look at other modules.

Please assign me this issue.

Please assign me this issue.

There's no need to do that, go ahead and create a patch.


CI: ConformanceEKS/installation-and-connectivity/Install Cilium: Error: Unable to install Cilium: timeout while waiting for status to become successful: context deadline exceeded: Error: Process completed with exit code 1

CI failure
Background
Investigating the sysdump, we see that the coredns pods are not in the running state and are instead in pending. In EKS, Cilium is running with ENI IPAM mode which requires the Operator to connect to the AWS API to pull down the ENI information to populate the CiliumNode resource, which the Agent uses for IPAM. According to the Operator logs we see,
2023-04-05T15:05:46.388096278Z level=warning msg="Unable to synchronize EC2 VPC list" error="operation error EC2: DescribeVpcs, exceeded maximum number of attempts, 3, https response error StatusCode: 0, RequestID: , request send failed, Post \"https://ec2.us-east-2.amazonaws.com/\": dial tcp: lookup ec2.us-east-2.amazonaws.com on <IP_ADDRESS>:53: write udp <IP_ADDRESS>:60949-><IP_ADDRESS>:53: write: operation not permitted" subsys=eni
2023-04-05T15:05:46.388128823Z level=fatal msg="Unable to start eni allocator" error="Initial synchronization with instances API failed" subsys=cilium-operator-aws

which is likely because the DNS resolution failed due to the connection to <IP_ADDRESS> which failed because it's to the kube-dns service IP. Due to the coredns pods being in pending, there are no backends for the service.
This causes the Agent to hang for ~5m, until kubelet kicks in and restart Cilium:
2023-04-05T15:04:31.189152528Z level=info msg="Waiting for IPs to become available in CRD-backed allocation pool" available=0 helpMessage="Check if cilium-operator pod is running and does not have any warnings or error messages." name=ip-192-168-97-147.us-east-2.compute.internal required=2 subsys=ipam

Here, we have a chicken and egg problem if DNS is not available.
Output

Run cilium install --cluster-name=cilium-cilium-4619701977 --chart-directory=install/kubernetes/cilium --helm-set=image.repository=quay.io/cilium/cilium-ci --helm-set=image.useDigest=false --helm-set=image.tag=3e5fd58ca2f32adb7ffedca07b439f8c525beeff --helm-set=operator.image.repository=quay.io/cilium/operator --helm-set=operator.image.suffix=-ci --helm-set=operator.image.tag=3e5fd58ca2f32adb7ffedca07b439f8c525beeff --helm-set=operator.image.useDigest=false --helm-set=clustermesh.apiserver.image.repository=quay.io/cilium/clustermesh-apiserver-ci --helm-set=clustermesh.apiserver.image.tag=3e5fd58ca2f32adb7ffedca07b439f8c525beeff --helm-set=clustermesh.apiserver.image.useDigest=false --helm-set=hubble.relay.image.repository=quay.io/cilium/hubble-relay-ci --helm-set=hubble.relay.image.tag=3e5fd58ca2f32adb7ffedca07b439f8c525beeff --helm-set loadBalancer.l7.backend=envoy --helm-set tls.secretsBackend=k8s --wait=false --rollback=false --config monitor-aggregation=none --version=
Flag --cluster-name has been deprecated, This can now be overridden via `helm-set` (Helm value: `cluster.name`).
🔮 Auto-detected Kubernetes kind: EKS
ℹ  Using Cilium version 1.13.90
🔮 Auto-detected datapath mode: aws-eni
🔮 Auto-detected kube-proxy has been installed
ℹ  helm template --namespace kube-system cilium "install/kubernetes/cilium" --version 1.13.90 --set cluster.id=0,cluster.name=cilium-cilium-4619701977,clustermesh.apiserver.image.repository=quay.io/cilium/clustermesh-apiserver-ci,clustermesh.apiserver.image.tag=3e5fd58ca2f32adb7ffedca07b439f8c525beeff,clustermesh.apiserver.image.useDigest=false,egressMasqueradeInterfaces=eth0,encryption.nodeEncryption=false,eni.enabled=true,extraConfig.monitor-aggregation=none,hubble.relay.image.repository=quay.io/cilium/hubble-relay-ci,hubble.relay.image.tag=3e5fd58ca2f32adb7ffedca07b439f8c525beeff,image.repository=quay.io/cilium/cilium-ci,image.tag=3e5fd58ca2f32adb7ffedca07b439f8c525beeff,image.useDigest=false,ipam.mode=eni,kubeProxyReplacement=disabled,loadBalancer.l7.backend=envoy,nodeinit.enabled=true,operator.image.repository=quay.io/cilium/operator,operator.image.suffix=-ci,operator.image.tag=3e5fd58ca2f32adb7ffedca07b439f8c525beeff,operator.image.useDigest=false,operator.replicas=1,serviceAccounts.cilium.name=cilium,serviceAccounts.operator.name=cilium-operator,tls.secretsBackend=k8s,tunnel=disabled
ℹ  Storing helm values file in kube-system/cilium-cli-helm-values Secret
🚀 Creating ConfigMap for Cilium version 1.13.90...
ℹ  Manual overwrite in ConfigMap: monitor-aggregation=none
🔑 Created CA in secret cilium-ca
🔑 Generating certificates for Hubble...
🚀 Creating Service accounts...
🚀 Creating Cluster roles...
🚀 Creating ConfigMap for Cilium version 1.13.90...
ℹ  Manual overwrite in ConfigMap: monitor-aggregation=none
🚀 Creating EKS Node Init DaemonSet...
🚀 Creating Agent DaemonSet...
🚀 Creating Operator Deployment...
⌛ Waiting for Cilium to be installed and ready...

    /¯¯\
Error: Unable to install Cilium: timeout while waiting for status to become successful: context deadline exceeded
 /¯¯\__/¯¯\    Cilium:          3 errors
 \__/¯¯\__/    Operator:        OK
 /¯¯\__/¯¯\    Hubble Relay:    disabled
 \__/¯¯\__/    ClusterMesh:     disabled
    \__/

DaemonSet         cilium             Desired: 2, Unavailable: 2/2
Deployment        cilium-operator    Desired: 1, Ready: 1/1, Available: 1/1
Containers:       cilium             Running: 2
                  cilium-operator    Running: 1
Cluster Pods:     0/2 managed by Cilium
Image versions    cilium             quay.io/cilium/cilium-ci:3e5fd58ca2f32adb7ffedca07b439f8c525beeff: 2
                  cilium-operator    quay.io/cilium/operator-aws-ci:3e5fd58ca2f32adb7ffedca07b439f8c525beeff: 1
Errors:           cilium             cilium-hcqt8    unable to retrieve cilium status: command terminated with exit code 1
                  cilium             cilium-cs8zq    unable to retrieve cilium status: command terminated with exit code 1
                  cilium             cilium          2 pods of DaemonSet cilium are not ready
ℹ  Rollback disabled with '--rollback=false', leaving installed resources behind
Error: Process completed with exit code 1.

https://github.com/cilium/cilium/actions/runs/4619701977/jobs/8168912428
https://github.com/cilium/cilium/actions/runs/4618219691/jobs/8172578395

cilium-sysdump-final.zip
Potential solutions
(Thanks to @chancez, @marseel, and @joestringer for brainstorming)

Modify Operator to use node's DNS as it depends on cluster DNS today
Ensure in-cluster DNS pods are ready before installing Cilium
Make Operator resolve the AWS API with a different resolver/conf

Option (1) only works if the Operator doesn't need in cluster dns. AFAIK, the Operator talks to

K8s
kvstore
cloud-managed API for IPAM (aka AWS)

This seems to be the core error:
write udp <IP_ADDRESS>:60949-><IP_ADDRESS>:53: write: operation not permitted

This doesn't sound like a DNS resolution error, it sounds like an OS restriction on the ability to write DNS requests into a socket. Are we able to get any Hubble visibility into what's going on, proof that any DNS packets were created or confirmation of involvement from KPR?

Cilium was never able to come up in these cases, so Hubble visibility is not yet set up. Without that, I'm not sure how we can otherwise answer this question from the sysdump.

Possibly related, but hard to say for sure, KPR has an EPERM service translation rejection case:
https://github.com/cilium/cilium/blob/4b9c2340742d9ead5ccbf98fdbc5febdefb0e556/bpf/bpf_sock.c#L330-L337

Diagnosis
The same permission error message (dial tcp: lookup ... on ...:53: write udp ...->...:53: write: operation not permitted) occurs in various other cases online from what I was able to find.
I did find a very similar case of coredns not running in k8s and in-cluster DNS queries failing with a similar error: https://stackoverflow.com/questions/63132164/how-to-solve-coredns-always-stuck-at-waiting-for-kubernetes. I think that the permissions error is a misnomer.

We know that coredns is not running because the pods are pending based on the CI logs/sysdumps
We know that operator is connecting to the in-cluster DNS IP for DNS queries

Thus, it's I'm pretty sure it's just the chicken/egg problem.
Why haven't we noticed?
It might be that the DNS pods get networking with the built-in VPC CNI plugin before we uninstall the VPC CNI plugin and they’re up/ready to respond before cilium is installed.
My suggestion:

Change the default dnsPolicy for the operator to default, so that it uses the host's DNS configuration. This will mean it will not use in-cluster DNS.

I believe for the k8s API, it uses the KUBERNETES_HOST env-var, or another one, either way the value is the IP of the default/kubernetes service, so there's no DNS involved to talk to the API server in-cluster.
For kvstore, I was told we already us IPs there so it should be fine.

Update EKS conformance, and other AWS CI's to:

after uninstalling AWS VPC CNI, delete the coredns pods
wait for coredns pods to no longer be Running
proceed with installing Cilium

This ensures that the default pod dnsPolicy fixes the issue by making sure we hit this case in CI.

@pippolo84 can you look into this as ci-healer? It seems to be effecting quite a lot of PRs at the moment. Because of that, I also suggest we make this test not required until we have a fix like @joestringer suggested in https://github.com/cilium/cilium/pull/24410#issuecomment-1500459040.

After further inspection, it seems that https://github.com/cilium/cilium/pull/24471/files#diff-d58e521aeed563903eb9eb8a0d356682a42b26ff64f249f701e24e8cd201e346R242 is the culprit.
If you look at the failures of the CI job before the above PR landed and after the PR landed, you'll notice that after the PR landed, the failures that happen on installation where the Agent and Operator pods fail to come up are much more prevalent.
cc @sayboras


Correction for raw affiliation Oregon Health & Science University-Portland State University School of Public Health, USA.

Correction needed for raw affiliation Oregon Health & Science University-Portland State University School of Public Health, USA.
raw_affiliation_name: Oregon Health & Science University-Portland State University School of Public Health, USA.
new_rors: 009avj582;00yn2fy02
previous_rors: 009avj582
works_examples: W3046187494
contact: ea273d1a6650706ade003b88d96c2a06:f147d413 @ ourresearch.org

This issue was accepted and ingested by the OpenAlex team on 2024-10-10. The new affiliations should be visible within the next 7 days.


feat/Retain text indentations in PDF files

Is your feature request related to a problem? Please describe.
All text indentations and some line breaks are lost in partitioned PDF files. If there're code blocks in the PDF file, the extracted elements can't represent them.
Describe the solution you'd like
Retain indentations and line breaks in documents.
Describe alternatives you've considered
I see that there's a PR related: https://github.com/Unstructured-IO/unstructured/pull/2428. But idk.
Additional context
My test PDF is as simple as this:

After partition_pdf(), the element's text looks like this:

Which does not retain any format that might be crucial for understanding what a block of text means.

Hi @ChiNoel-osu - closing this one in favor of #711, which would track indent level as a metadata field


Undefined symbol error when calling higher order function

Some kind of higher order function occurs undefined symbol error.
No error in the code below.
> func(x){return func(){return x}}(1)()
1

But
> func(x){if true {return func(){return x}}}(1)()
1:32 undefined symbol 'x'

In this particular case, this is caused by the newenv.Destroy() on this line:
https://github.com/mattn/anko/blob/master/vm/vmStmt.go#L153
Maybe the solution is to remove all the Destroy calls from vm code?
@mattn
Any thoughts?

Yes, when the reference goes out of scope, it will be removed by GC.


Using with JUnit 5 @RunWith(JUnitPlatform.class) causes multiple deployment.

Using with JUnit 5 @RunWith(JUnitPlatform.class) causes multiple deployment.
Since the JUnit5 does not have the Test Suite and provide the interim solution by the JUnitPlatform which requires the junit:junit:4.13.2 in the classpath.

Using JUnit 4 to run the JUnit Platform
Using JUnit 4 to run the JUnit Platform: Test Suite
Are test suites considered deprecated in JUnit5?

Then the test suite will be like the following: -
import org.junit.platform.runner.JUnitPlatform;
import org.junit.platform.suite.api.IncludeClassNamePatterns;
import org.junit.platform.suite.api.SelectClasses;
import org.junit.platform.suite.api.SuiteDisplayName;
import org.junit.runner.RunWith;

/**
 * This is a first test suite.
 */
@RunWith(JUnitPlatform.class)
@SuiteDisplayName("JUnit Platform Suite Demo")
@SelectClasses({
    MyCdiJunit5IntgrtnTester.class
})
@IncludeClassNamePatterns("^(Test.*|.+[.$]Test.*|.*Tests?|.*Tester)$")
public class MyCdiJunit5IntgrtnTestSuite {

}

/**
 * This is a second test suite.
 */
@RunWith(JUnitPlatform.class)
@SuiteDisplayName("JUnit Platform Suite Demo")
@SelectClasses({
    MyCdiJunit5IntgrtnTester.class
})
@IncludeClassNamePatterns("^(Test.*|.+[.$]Test.*|.*Tests?|.*Tester)$")
public class MyCdiJunit5Round2IntgrtnTestSuite {

}

By using it, it causes the Arquillian-Suite-Extension to deploy multiple times  (each time for each test suite) !
#
# Only first executed test suite success, all the rest are failed
#
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 28.145 s - in it.test.app.github.charleech.my.cdi.MyCdiJunit5IntgrtnTestSuite

#
# The second test suite causes re-deployment !
#
[INFO] Running it.test.app.github.charleech.my.cdi.MyCdiJunit5Round2IntgrtnTestSuite
May 08, 2021 1:47:43 PM org.eu.ingwar.tools.arquillian.extension.suite.DeploymentClassFinder getDeploymentClassFromAnnotation
INFO: arquillian-suite-deployment: Found class annotated with @ArquillianSuiteDeployment: it.test.app.github.charleech.my.cdi.ArquillianSuiteDeployments
[ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 0.016 s <<< FAILURE! - in it.test.app.github.charleech.my.cdi.MyCdiJunit5Round2IntgrtnTestSuite
[ERROR] MyCdiJunit5IntgrtnTester  Time elapsed: 0.015 s  <<< ERROR!
java.lang.RuntimeException: Could not setup GlassFish Embedded Bootstrap
Caused by: org.glassfish.embeddable.GlassFishException: Already bootstrapped

[ERROR] Picked up JAVA_TOOL_OPTIONS: -Dfile.encoding=UTF-8
[ERROR] OpenJDK 64-Bit Server VM warning: ignoring option MaxPermSize=256m; support was removed in 8.0
[INFO]
[INFO] Results:
[INFO]
[ERROR] Errors:
[ERROR]   Could not setup GlassFish Embedded Bootstrap
[INFO]
[ERROR] Tests run: 3, Failures: 0, Errors: 1, Skipped: 0

The reproducer
I've create the reproducer at https://github.com/charleech/arquillian-junit5-payara
How to execute
1.1 The multiple tester without test suite
This is a base line which use pure JUnit 5 without  any dependency to JUnit4 and  JUnit 5 Platform.
cd path/to/arquillian-junit5-payara

mvn clean install -N

cd path/to/arquillian-junit5-payara/my-cdi-junit5-multiple-tester

mvn clean install -Dpayara-embedded=true

#
# Everything works fine !
#

1.2 The multiple test suite
This is a reproducer which use JUnit 5 with dependency to JUnit4 and  JUnit 5 Platform.
cd path/to/arquillian-junit5-payara

mvn clean install -N

cd path/to/arquillian-junit5-payara/my-cdi-junit5-multiple-testsuite

mvn clean install -Dpayara-embedded=true

#
# Only first executed test suite success, all the rest are failed
#
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 28.145 s - in it.test.app.github.charleech.my.cdi.MyCdiJunit5IntgrtnTestSuite

#
# The second test suite causes re-deployment !
#
# ... Could not setup GlassFish Embedded Bootstrap
# ... Already bootstrapped
# ...
# ... Could not setup GlassFish Embedded Bootstrap
#

1.3 My Environment

OS: Windows 10 Home Edition 64 Bits
JDK: AdoptOpenJDK 1.8.0_292

openjdk version "1.8.0_292"
OpenJDK Runtime Environment (AdoptOpenJDK)(build 1.8.0_292-b10)
OpenJDK 64-Bit Server VM (AdoptOpenJDK)(build 25.292-b10, mixed mode)

Build Tools: Apache Maven 3.8.1

Apache Maven 3.8.1 (05c21c65bdfed0f71a2f2ada8b84da59348c4c5d)
Maven home: C:\Java.Application\Apache\apache-maven\bin\..
Java version: 1.8.0_292, vendor: AdoptOpenJDK, runtime: C:\Java.Application\Sun\Java\jdk8u292-b10\jre
Default locale: en_US, platform encoding: UTF-8
OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"

Dependencies

Arquillian version 1.7.0.Alpha9
Arquillian Suite Extension version 1.2.2
JUnit4 version 4.13.2
JUnit5 version 5.8.0-M1
JUnit5 Platform version 1.8.0-M1
Payara version 5.2021.3
Payara Aqrquillian Container version 2.4.1

@charleech Plugin works with juint5 (just need few beta dependencies).
Here you have fully working solution https://github.com/ingwarsw/arquillian-suite-extension/tree/master/test-suites/junit5
Im not sure how suites works in junit5.. but seems arquillian and plugin dont use them..


@5.0.0 -<EMAIL_ADDRESS>

Pull Request Test Coverage Report for Build<PHONE_NUMBER>6
Details

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 100.0%

Totals

Change from base Build<PHONE_NUMBER>:
0.0%

Covered Lines:
44

Relevant Lines:
44

💛  - Coveralls

Pull Request Test Coverage Report for Build<PHONE_NUMBER>6
Details

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 100.0%

Totals

Change from base Build<PHONE_NUMBER>:
0.0%

Covered Lines:
44

Relevant Lines:
44

💛  - Coveralls


Browser support?

Hi guys,
which browsers are not supported by TweenJS?

All modern browsers. The current cut-off is IE9+. For earlier versions, you can use TweenJS version 0.5.1 or below. The inheritance model was upgraded for version 0.6.0, which no longer supports IE8 and earlier.

Thanks man! Is that somewhere written as I didn't find it.

Its actually out of date in the docs. Thanks for the reminder, we will update it. All libraries should have a browser support section on their main page (http://www.createjs.com/docs/tweenjs/modules/TweenJS.html)


Add proposal for the agent to provide contact IP and port

Here the proposal to allow the agent to provide a contact IP and port for the verifier to the registrar as discussed on Slack.
The tenant currently allows to specify a different agent IP than that is used for the verifier.
Is that used by someone and should we also allow the agent to specify values for that?

I see two "Story 2" entries there... The last one should be "Story 3" and even on this case, keylime_tenant should not fail, as it should read any address/port not specified via command-line directly from the keylime.conf

I see two "Story 2" entries there...

Fixed.

keylime_tenant should not fail, as it should read any address/port not specified via command-line directly from the keylime.conf

This is only true for the port the the address is not read from keylime.conf (https://github.com/keylime/keylime/blob/master/keylime/tenant.py#L94)

A note not related entirely to this enhancement, with the rust agent now reaching feature complete or parity with the python agent, all enhancements that change the agent , need to also be made in the rust agent.


lang: remove <account_name>.to_account_info().key. use <account_name>.key()

there are a number of <account_name>.to_account_info().key in the constraints.rs file. We should remove them and use <account_name>.key() instead to save compute

in the same PR, can also remove other unnecessary uses of to_account_info such as to_account_info().lamports where #name.as_ref().lamports() can be used


Add FIPS support to CLI extension.

This checklist is used to make sure that common guidelines for a pull request are followed.

For new extensions:

[ ] My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish
There is a pipeline to automatically build, upload and publish extension wheels.
Once your PR is merged into master branch, a new PR will be created to update src/index.json automatically.
The precondition is to put your code inside this repo and upgrade the version in the PR but do not modify src/index.json.

could you add a test?

could you add a test?

Test added.


Failing k8s e2e test:: [sig-network] Services should be able to switch session affinity for NodePort service [LinuxOnly]

Bug report
Kops master switched to using BPF/kubeproxy-free and this test started failing.
https://testgrid.k8s.io/kops-network-plugins#kops-aws-cni-cilium
See also #11302
Note that this issue is a part of conformance suite as of k8s 1.19.

Thanks for the report. Do you happen to have cilium status output from the test run? If not, what is exact cilium configuration you deploy?

Unfortunately, the K8s e2e system doesn't let me access the cluster directly. But the default config looks like this:
  auto-direct-node-routes: "false"
  bpf-ct-global-any-max: "262144"
  bpf-ct-global-tcp-max: "524288"
  cluster-name: default
  container-runtime: none
  debug: "false"
  enable-ipv4: "true"
  enable-ipv6: "false"
  enable-node-port: "true"
  enable-remote-node-identity: "true"
  identity-allocation-mode: crd
  install-iptables-rules: "true"
  ipam: kubernetes
  kube-proxy-replacement: strict
  masquerade: "true"
  monitor-aggregation: medium
  preallocate-bpf-maps: "false"
  sidecar-istio-proxy-image: cilium/istio_proxy
  tofqdns-dns-reject-response-code: refused
  tofqdns-enable-poller: "false"
  tunnel: vxlan
  wait-bpf-mount: "false"

Kubernetes recently tightened the conformance test that's failing here in kubernetes/kubernetes#92427

I'm hitting this as well. Output of cilium status (after the test run - hard to catch it during):
KVStore:                               Ok   etcd: 1/1 connected, lease-ID=4f7774b7915ec94d, lock lease-ID=4f7774b7915ec94f, has-quorum=true: https://56a0b5e8-4b56-4b83-b1c4-e0b198eeb0b2.internal.k8s.ondigitalocean.com:2379 - 3.4.9 (Leader)
Kubernetes:                            Ok   1.19 (v1.19.2) [linux/amd64]
Kubernetes APIs:                       ["CustomResourceDefinition", "cilium/v2::CiliumClusterwideNetworkPolicy", "cilium/v2::CiliumNetworkPolicy", "core/v1::Namespace", "core/v1::Node", "core/v1::Pods", "core/v1::Service", "discovery/v1beta1::EndpointSlice", "networking.k8s.io/v1::NetworkPolicy"]
KubeProxyReplacement:                  Partial   []   [SessionAffinity]
Cilium:                                Ok        OK
NodeMonitor:                           Disabled
Cilium health daemon:                  Ok
IPAM:                                  IPv4: 2/127 allocated from <IP_ADDRESS>/25,
Masquerading:                          IPTables
Controller Status:                     24/24 healthy
Proxy Status:                          OK, ip <IP_ADDRESS>, 0 redirects active on ports 10000-20000
Hubble:                                Disabled
Cluster health:                        2/3 reachable    (2020-09-22T23:09:55Z)
  Name                                 IP               Node          Endpoints
  cilium-master-test-1-19-2-2c58ef22   <IP_ADDRESS>   unreachable   reachable

Note that the unreachable node is normal - that node is not schedulable in the cluster.
Config:
  auto-direct-node-routes: "false"
  bpf-ct-global-any-max: "262144"
  bpf-ct-global-tcp-max: "524288"
  bpf-map-dynamic-size-ratio: "0.0025"
  bpf-policy-map-max: "16384"
  cluster-name: default
  cni-chaining-mode: portmap
  debug: "false"
  enable-auto-protect-node-port-range: "true"
  enable-bpf-clock-probe: "true"
  enable-endpoint-health-checking: "true"
  enable-external-ips: "true"
  enable-health-check-nodeport: "true"
  enable-ipv4: "true"
  enable-ipv6: "false"
  enable-node-port: "false"
  enable-remote-node-identity: "false"
  enable-session-affinity: "true"
  enable-well-known-identities: "true"
  enable-xt-socket-fallback: "true"
  identity-allocation-mode: kvstore
  install-iptables-rules: "true"
  kube-proxy-replacement: partial
  kvstore: etcd
  kvstore-opt: '{"etcd.config": "/var/lib/etcd-config/etcd.config"}'
  masquerade: "true"
  monitor-aggregation: medium
  monitor-aggregation-flags: all
  monitor-aggregation-interval: 5s
  node-port-bind-protection: "true"
  preallocate-bpf-maps: "false"
  prometheus-serve-addr: :9090
  sidecar-istio-proxy-image: cilium/istio_proxy
  tofqdns-enable-poller: "false"
  tunnel: vxlan
  wait-bpf-mount: "false"

Any potential workarounds for this?

Hey @adamwg
I am working on this, didn't get the time to investigate deep into this though. Looking to pick this up later this week, I will update the thread if I find something useful.

Pretty sure I've figured this out.
With debug logging enabled, if I change the labels for a Service, I see a Kubernetes service definition changed message in the logs. However, if I change only the sessionAffinity of the service, no such message is produced.
Digging into the cilium code, this function is used to determine whether a service has changed when the k8s watcher reports an update. Note that the sessionAffinity and sessionAffinityTimeoutSec are not considered in the comparison.
I'll attempt a fix for this.

The change in #13271 fixes this issue in my setup. Once that's merged I'd appreciate a backport to 1.8 and a patch release - let me know if there's anything I can do to help make that happen.

Hey, @adamwg thanks for your contribution :rocket: . The PR is labeled with backport/1.8 and will be picked up by backporters team soon to land into 1.8 release.

@olemarkus Does https://testgrid.k8s.io/kops-network-plugins#kops-aws-cni-cilium run with the cilium/cilium:latest image?

No, it runs with the default version in kops, which is currently 1.8.3.
The reason it shows green is because we filter failing tests that are outside of our control. Once the backports have been released, I can update cilium and remove the filters.


Add preview mode Key Bind: p to preview json string.

Going to close this PR for now.. I've got another branch that fixes many of your comments.


HTTP2 pushes not working

(Are you asking for help with using Caddy? Please use our forum instead: https://forum.caddyserver.com. If you are filing a bug report, please take a few minutes to carefully answer the following questions. If your issue is not a bug report, you do not need to use this template. Thanks!)
1. What version of Caddy are you running (caddy -version)?
Caddy 0.9.5 (+7d15435
2. What are you trying to do?
enable http2 push
3. What is your entire Caddyfile?
my.domain:443 {
push / {
/static/_cache/merged/d1da6bf60541e004556afd2b8358df2d.min.js
/static/_cache/merged/911bac75bca05a0baeedac6b4ebef29a.min.css
}
gzip
log /var/log/my.domain-access.log
errors /var/log/my.domain-error.log
proxy / <IP_ADDRESS>:80 {
header_upstream Host "my.domain"
header_upstream X-Forwarded-Proto "https"
}
tls my.domain.crt my.domain.key
root /var/www/html
}
4.  Please paste any relevant HTTP request(s) here.
Checked Network on Chrome and FF.
6. What did you expect to see?
/static/_cache/merged/d1da6bf60541e004556afd2b8358df2d.min.js
/static/_cache/merged/911bac75bca05a0baeedac6b4ebef29a.min.css
to be pushed
7. What did you see instead (give full error messages and/or log)?
no Link headers with pushed resources while GETting / and them are not pushed.
Can you please check why pushes not working.
Thanks.

Hi Vlad, can you post a screenshot of your network tab for the requests of those resources? Make sure the Protocol and Type columns are visible.
As I understand it, Link headers are not set by the push middleware, but they are read by the push middleware.

Ok,
I`m using Caddy->Varnish->Nginx
I set
add_header Link: </static/_cache/merged/d1da6bf60541e004556afd2b8358df2d.min.js>; rel=preload; as=script;
in nginx.
I set
push / {
method GET
header x-http2-push 1
/pub/static/_cache/merged/d1da6bf60541e004556afd2b8358df2d.min.js
/pub/static/_cache/merged/911bac75bca05a0baeedac6b4ebef29a.min.css
}
in caddy to check if obj is pushed (if header presents)
I got  curl -SLIXGET https://mydomain
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Alt-Svc: quic=":443"; ma=2592000; v="36,35"
Alternate-Protocol: 443:quic
Cache-Control: max-age=0, must-revalidate, no-cache, no-store
Content-Type: text/html; charset=UTF-8
Date: Thu, 13 Apr 2017 04:03:22 GMT
Expires: Wed, 13 Apr 2016 04:03:21 GMT
Link: </static/_cache/merged/d1da6bf60541e004556afd2b8358df2d.min.js>; rel=preload; as=script;
Pragma: no-cache
Server: ESF
Set-Cookie: PHPSESSID=cqbjtvljb1gdltark5uvc8o2u3; expires=Thu, 13-Apr-2017 05:03:21 GMT; Max-Age=3600; path=/; domain=mydomain; HttpOnly
Set-Cookie: mage-messages=%5B%5D; expires=Fri, 13-Apr-2018 04:03:22 GMT; Max-Age=31536000; path=/
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Varnish: 2
X-Xss-Protection: 1; mode=block
Transfer-Encoding: chunked
Then i check Network in Chrome for pushed JS
Response headers are:
accept-ranges:bytes
access-control-allow-origin:*
alt-svc:quic=":443"; ma=2592000; v="36,35"
alternate-protocol:443:quic
cache-control:max-age=31536000, public
content-encoding:gzip
content-length:425526
content-type:application/javascript; charset=UTF-8
date:Thu, 13 Apr 2017 04:03:37 GMT
etag:W/"58de3a37-1c1ee7"
expires:Fri, 13 Apr 2018 04:03:37 GMT
last-modified:Fri, 31 Mar 2017 11:15:03 GMT
server:ESF
status:200
vary:Accept-Encoding
x-frame-options:SAMEORIGIN
x-varnish:32779 98308
but should be additional x-http2-push=1 header in resp of pushed object.
I also use https://http2-push.io/ to check, but "No pushes found"

Hmm, what if you disable quic?

The same, except protocol. h2 instead of http2+quic35

I`m trying
import (
"net/http"
"strings"
"log"
"github.com/mholt/caddy/caddyhttp/httpserver"
)
func (h Middleware) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error) {
log.Printf("Enter push: %v")
pusher, hasPusher := w.(http.Pusher)
in push/handler.go to see if any log will appear
but no "Enter push" in any log.
i dont know Go well but seems some functions in push handler not working.
in setup.go:
httpserver.GetConfig(c).AddMiddleware(func(next httpserver.Handler) httpserver.Handler {
log.Printf("Enter push3: %v")
return Middleware{Next: next, Rules: rules}
})
i got
2017/04/14 08:43:04 Enter push3: %!v(MISSING)
2017/04/14 08:43:04 Enter push3: %!v(MISSING)
in /var/log/caddy.log
but not get
log.Printf("Enter push: %v") from func (h Middleware) ServeHTTP

Oh, this is because the push handler is executed after proxy, in other words, the request is getting proxied before the push handler will get to see it, and it won't, because proxy terminates the chain.
@wendigo Do you know if the placement of push behind proxy was intentional? I can't recall...

Matt, what if trust app (backend behind proxy directive) and push resources only from response Link headers? (like nghttp2)
App should know what will be pushed and http server should trust.
Your thoughts?

Matt, what if trust app (backend behind proxy directive) and push resources only from response Link headers? (like nghttp2)

The push middleware does this, the handler just doesn't appear to be ordered properly.

I mean no need "push" directive at all.

We'll get there: but before we blanket-enable this (disabling things is often more tedious/tricky to do well) we need to work out a lot of details with push.

For now i put push before proxy. Pushes seems working but "header" in Caddyfile ignored.
https://http2-push.io/ finaly found something.

Push work pretty cool, but 1 thing i see, initialy connection started using h2, and only after page reload (or loading static files) it starts quic.
Is that bug or feature? )

It looks like QUIC+h2push aren't operational yet in our (excellent) library of choice: https://github.com/lucas-clemente/quic-go/issues/372
Okay, so we need to reorder the push directive. Any objection, @wendigo? If not, or I don't hear by Tuesday evening or Wednesday, I'll probably make the change myself for release on Thursday. :+1:

Just 1 thing i forget to test.
If not add push resources to config, push module not automaticaly push them if Link resp header presents.
There is need to put those resources twice, in App and in Caddy as well.
but that is not a big issue i guess, push is working and thats cool.

@vladbondarenko Can you clarify? Does that mean you put push in your Caddyfile without any other arguments (i.e. on its own line) - is that what you tried, and it still doesn't push resources from the Link header?

if i put "push" at new line i get
2017/04/17 15:50:39 /etc/caddy/Caddyfile:8 - Parse error: Wrong argument count or unexpected line ending after 'push'
if i put "push /"
i get 2017/04/17 15:51:31 /etc/caddy/Caddyfile:8 - Parse error: Rule / has empty push resources list
Only works if i add args as resources.
Should it work just with
"push"
?

Ah, I didn't think about that. @wendigo What do you think? I think push by itself should be allowed, so that it can use the Link headers. (Also, the reordering of the directive -- I'm going to do that tomorrow unless I hear back that it's a bad idea.)

@vladbondarenko I've just pushed ce2a9cd which re-orders push to before proxy so the Link headers are read, and then I also made it so you can use push alone on a line just for pushing resources in the Link header.
Can you build the latest from master and see if that resolves this issue?

Yup, "push" alone and push re-order works now.
Thanks a lot.

@mholt: sorry for not answering this - I'm in a process of changing my job - quite busy right now :( Thank you for fixing this. You change looks good! Can't wait for next version release :)

Ah, no problem @wendigo! Good luck on changing jobs. I know that can be stressful. I appreciate your contributions and look forward to when you can contribute again!

Hi, I'm trying to use push too and it doesn't work. Should I open a new issue or report it here?

New issue please, don't reopen closed ones.


Do not pin compiler_builtins anymore

Since the sync is done, we can now revert this change.

This was implemented.


Egress Gateway TLS Origination fix

Please provide a description for what this PR is for.
Resolves https://github.com/istio/istio/issues/23910
And to help us figure out who should review this PR, please
put an X in all the areas that this PR affects.
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ X ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ X ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

@GregHanson: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

release-notes_istio
115a236c485f1f574562e49a2bf2482236f9113a
link
/test release-notes_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test release-notes_istio

This PR does not address auto MTLS for sidecar proxy-to-egress communication

The fix makes sense, but one thing I am confused though is if we have a subset shouldn't we be calling applyTrafficPolicy on a completely different Cluster{} object? Where does the sharing actually happen?

@howardjohn with the following example:
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: egressgateway-for-cnn
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  trafficPolicy: nil
  subsets:
  - name: cnn
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN
      portLevelSettings:
      - port:
          number: 80
        tls:
          mode: ISTIO_MUTUAL
          sni: edition.cnn.com

DestinationRules can have a top level TLS policy and a subset level TLS policy.  In cluster_builder.go, the subset cluster is run through applyTrafficPolicy() once with opts.policy set to the top level TLS context and then once more for any matching subset/port level TLS policies (https://github.com/istio/istio/blob/master/pilot/pkg/networking/core/v1alpha3/cluster_builder.go#L129).  So it's not so much sharing Cluster{} objects as the subset cluster is built/initialized once with default values (TransportSocketMatches in this case as part of auto mtls logic), and then more fine-grained settings are applied on top of the same subset cluster

@GregHanson: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-mixer-k8s-tests_istio
115a236c485f1f574562e49a2bf2482236f9113a
link
/test integ-mixer-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test integ-mixer-k8s-tests_istio

/hold
Just a question for confirming the logic before merging.
The PR looks legit, but in our config setup from the issue, we don't use subset in DestinationRule. How would this help explain we still get the transport_socket and transport_socket_match both set?

In response to a cherrypick label: #25588 failed to apply on top of branch "release-1.6":

In response to a cherrypick label: new issue created for failed cherrypick: #25749

@GregHanson @nschhina @vadimeisenbergibm
I am trying to use "egress g/w with mutual tls origination" in istio 1.6.3 version using example at https://preliminary.istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway-tls-origination/. I followed exact steps by copying and executing commands. no luck.
But it does not work. Below command simply stuck with "Trying cluster Ip...."
kubectl exec "$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -- curl -v http://my-nginx.mesh-external.svc.cluster.local
Since this issue was raised on 1.5.4 (https://github.com/istio/istio/issues/23910). I thought fix is available in 1.6.3 or 1.6.4. Can you please point me workaround for egress mutual tls in version 1.6.3 or 1.6.4.
thanks in advance
thanks

@satishmane the fix for this required both docs and code changes.  While the doc changes are reflected immediately after merge at preliminary.istio.io, the code fix will not be available until the next releases.  The fix was back ported to 1.6 so it will be available in the next 1.6.X release (1.6.6) and also when 1.7 is released as well.

thanks @GregHanson
Meanwhile can I implement mutual tls as below. From side-car proxy, send traffic to external nginx service instead of going through egress g/w. But where do I store certs that I used in destination rule.? I guess, can not use mountPath of egress g/w. Should I patch istiod to add new volumes and use it in destination rule

service entry
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: edition-cnn-com
spec:
hosts:

my-nginx.mesh-external.svc.cluster.local
ports:
number: 80
name: http-port
protocol: HTTP
number: 443
name: https-port
protocol: HTTPS
resolution: DNS

virtual service

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: direct-nginx-from-side-car-proxy
spec:
hosts:

my-nginx.mesh-external.svc.cluster.local
http:
match:

port: 80
route:
destination:
host: my-nginx.mesh-external.svc.cluster.local
subset: tls-origination
port:
number: 443

Destination rule with tls -> mutual and provide certs path here. But then where do I file mount certs?

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: originate-mtls-for-nginx
spec:
host: my-nginx.mesh-external.svc.cluster.local
trafficPolicy:
loadBalancer:
simple: ROUND_ROBIN
portLevelSettings:
- port:
number: 443
tls:
mode: MUTUAL
clientCertificate: /etc/istio/nginx-client-certs/tls.crt
privateKey: /etc/istio/nginx-client-certs/tls.key
caCertificates: /etc/istio/nginx-ca-certs/example.com.crt
sni: my-nginx.mesh-external.svc.cluster.local

This PR does not address auto MTLS for sidecar proxy-to-egress communication

Can you clarify why https://github.com/istio/istio/pull/25588/commits/a8310ddf0b21db928abbf83a5df34194ab76bd48 was reverted @GregHanson

@nickperry what istio version are you on?

@GregHanson 1.7.1

@GregHanson I just tested the https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway-tls-origination-sds/ example verbatim on a fresh cluster with Istio 1.7.1 and it worked fine. Tomorrow I'm going to look at porting my company's real egress traffic handling to the documented approach using subsets.

This PR does not address auto MTLS for sidecar proxy-to-egress communication

Can you clarify why a8310dd was reverted @GregHanson and is that going to be fixed separately?
We currently have to do
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: egress-gateway-mtls
  namespace: istio-system
spec:
  host: 'istio-egressgateway.istio-system.svc.cluster.local'
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

to get traffic to our egress gateway as auto mTLS doesn't seem to work.

@nickperry, I have the similar problem as you had. I applied DestinationRule to namespace and traffic from client pod seems to be mTLS but egress does not terminate it. Do you found any decision?

@nickperry, I have the similar problem as you had. I applied DestinationRule to namespace and traffic from client pod seems to be mTLS but egress does not terminate it. Do you found any decision?

@ldoctori - we have that DR fix in place on 30 or so clusters and we're on 1.16 in prod now. We just roll out that DR by default and haven't checked what happens if we remove it on newer versions. I will check and report back.

@ldoctori - I can confirm the above DestinationRule to force the tls mode to ISTIO_MUTUAL is still necessary.


'make trail' data resets when a shape block is reset

Start a new shape block. Add 'make trail' to the attributes. Change the data in 'make trail', like changing the trail type or interval. Change the attributes (add or subtract some) on the shape with the gear box menu to refresh the block. The data in make trail has reset to default.

@codestar12 I am a little weary about trying to push any changes for this issue as it may directly conflict with your mutator saved connections fixes that you are working on and also your fix may be able to relate to this issue as well?

@codestar12 @hgclose another note we did not discuss. If the make trail attribute had block inputs in the style of all the other attribute types then it would reflect the same procedure and would fix this issue as a side effect because they blocks already save "block connections" but do not store or reconnect values


Fixed SCM Badge Issue #42940

I have tested this out on my machine and it appears to work fine.

@shobhitchittora line-height equals to height helps vertically align numbers, while the display prop is for height, width to be actually effective. also changing padding will result in a non circular badge for numbers less than 10 which will still look strange.

LGTM.
@joaomoreno please review and close this.

Ping @joaomoreno.

There are bad whitespace indentation errors during the build;
src/vs/base/browser/ui/countBadge/countBadge.css(10,1): Bad whitespace indentation src/vs/base/browser/ui/countBadge/countBadge.css(11,1): Bad whitespace indentation

@pushqrdx Would you be so kind and fix the CI issues. Also please make sure to run the test before every commit / raising a PR. Doc link - https://github.com/nodejs/node/blob/master/doc/guides/contributing/pull-requests.md#commit-message-guidelines

Thanks! 🍻


Verify condition inference

Once Chompy has necessary terms, can it infer the correct conditions?
This issue revolves around the second problem: we should spoon-feed Chompy both sides of the rewrites detailed in the Intel paper, and see if our existing flow can infer the needed rules.

Not working on this for now, because conditional "inference" is just bottom-up enumeration + Z3 validation.


No need to 'Update Rates' Button if data is not present for the Update

Terms

[X] Before you openning this issue, i have checked if the issue has already been reported.

Bagisto Version(s) affected
master v1.4.5
Issue Description
Nothing Data exists for the update but the Update Rates button is also present on Exchange Rates Page
Preconditions
Admin should be Login.
Steps to reproduce

Go to 'Admin Panel'
Click on 'Setting'
Go to the 'Exchange Rates'
See the error

Expected Result
Updates Rates button should not be present
Actual Result
Update Rates button present
Screenshots

Additional context
No response

assign to me this task

No need. Will check in the new theme.


[bug/enhancement] Import time

The statement import portfolyotakes several seconds, compared to near instantaneous for other packages, including large ones. It seems some expensive code is executed, either in the package itself or in one of its dependencies.
Maybe we can improve this, maybe with the help of a profiler (cProfile e.g)

I'm not sure what the problem is. I rung this code:
import cProfile
import portfolyo as pf
def main():
import portfolyo as pf
if name == "main":
cProfile.run("main()", sort="cumulative")
and my results are zeros everywhere. Can you run it on your end and tell me the results?

If a package is imported once, it's skipped on subsequent imports. Try (from memory, so check) from importlib import releoad and then in main: pf = import portfolyo as pf

Let's close this issue for now and focus on other priorities


ToCode Solution: תרגול מודולים

Nice solution for 02_bonus!
03: for joining together pieces of a path, the best solution is to use os.path.join.
03_bonus: if you mark an argument as type=long in argparse then it will automatically convert the value to long, so there is no need for long in long(threshold)
👍


Add .read command

This would be really cool!

@sigoden can you please take a look at the PR? Thanks


Added new projects

Added a new web framework, 2 new libraries and a project template

@rpetrusha, I made the changes that you suggest.


.DS_Store

In the route folder (as well as in many sub folders) you have a file called .DS_Store as these refer to Mac's file folder and has nothing to do with flutter, it might be better to remove such files.  Personally I find these files a right pain in the neck when I transfer files from my MacBook to  Windows.
The following web page describes how you can disabled them on a mac:
https://www.techrepublic.com/article/how-to-disable-the-creation-of-dsstore-files-for-mac-users-folders/

I think in this case a well written .gitignore would be more better fitting for the project.

Rectified.


URI.prototype.getQuery may unexpectedly decode "%2B" to SPACE due to order of operations

https://github.com/google/caja/blob/d4635c9c014cd3d30c7e36f1d92c950d55a34916/src/com/google/caja/plugin/uri.js#L429
https://github.com/google/caja/blob/d4635c9c014cd3d30c7e36f1d92c950d55a34916/src/com/google/caja/plugin/uri.js#L501
https://github.com/google/caja/blob/d4635c9c014cd3d30c7e36f1d92c950d55a34916/src/com/google/caja/plugin/uri.js#L502
The current implementation will decode both "+" and "%2B" to SPACE. The replace operation could be performed before decodeURIComponent operation so that "+" is decoded to SPACE and "%2B" is decoded to "+".
Examples
> decodeURIComponent("x%2By+z").replace(/\+/g, ' ')
< "x y z"

> decodeURIComponent("x%2By+z".replace(/\+/g, ' '))
< "x+y z"

The reference https://www.w3.org/Addressing/URL/4_URI_Recommentations.html states

Within the query string, the plus sign is reserved as shorthand notation for a space. Therefore, real plus signs must be encoded. This method was used to make query URIs easier to pass in systems which did not allow spaces.

This indicates the expectation that "%2B" should be decoded to the plus sign.

The reference https://url.spec.whatwg.org/#concept-urlencoded-parser states

Replace any 0x2B (+) in name and value with 0x20 (SP).
Let nameString and valueString be the result of running UTF-8 decode without BOM on the percent decoding of name and value, respectively.

This indicates the replace operation should be performed before the decodeURIComponent operation.

Sounds good to me. Can you open a pull request with the change?


Update wasme deploy docs

I found this closed issue when trying to see why passing a deployment name wasn't working.
https://github.com/solo-io/wasme/issues/93
Hoping to fix the docs for the next person that might see them.

thanks!


Implemented isin and in1d

Implemented cupy.isin and cupy.in1d (isin requires this function) according to the specs of numpy
Since in1d is not implemented, this PR creates in1d as per numpy
Fixes #2331

Test patterns yet to be created

I have a question
The functionality of isin is to check if an element is in the list or not.
What kind of test patterns can I write for this?

Could you separate changes related to cross? I think that can be reviewed independently.

I have seperated unrelated changes. Have a look

@niboshi did you have a look at the changes?

@niboshi have a look at the changes :)

@niboshi have a look at the proposed changes and let me know what needs to be added :)

Okay I'll work on it 👍🏼

@niboshi I was wondering to write a wrapper function in cupy which uses numpy.isin. Anyways its just isin check, do you think its necessary to shift this to CUDA? I think it can be done on CPU itself. What do you think about this approach?

@niboshi I was wondering to write a wrapper function in cupy which uses numpy.isin. Anyways its just isin check, do you think its necessary to shift this to CUDA? I think it can be done on CPU itself. What do you think about this approach?

Sorry, I don't really understand.
Do you want to rewite cupy.isin by simply calling numpy.isin?
It's not a good way to take, because the computation would be on CPU which would not benefit from GPU parallelization.

Yes I want to do it that way but I'm not sure how isin would benefit from GPU parallelization.

Consider this example from NumPy isin documentation:
>>> element = 2*np.arange(4).reshape((2, 2))
>>> element
array([[0, 2],
       [4, 6]])
>>> test_elements = [1, 2, 4, 8]
>>> mask = np.isin(element, test_elements)
>>> mask
array([[ False,  True],
       [ True,  False]])

In this example,

mask[0, 0] (=False) depends on element[0, 0] and test_elements.
mask[0, 1] (=True) depends on element[0, 1] and test_elements.
mask[1, 0] (=True) depends on element[1, 0] and test_elements.
mask[1, 1] (=False) depends on element[1, 1] and test_elements.

Thus these four results can be computed independently, in parallel on separate GPU cores.

Okay got it, thanks for the explanation! I shall work on it

@niboshi Sorry for the late reply. I have completed -

Documentation
Unit Tests

Have a look and let me know if anything needs changes :smile:

@niboshi Sorry for the late response. I have added all the suggested fixes. Please do have a look at them!

I have added the suggested changes. Have a look and let me know if more changes are necessary

I have added the changes! Check them out

Jenkins, test this please

Jenkins CI test (for commit<PHONE_NUMBER>d8f7e7b3b88d95e264b702365aad2d, target branch master) failed with status FAILURE.

Yes I have added that. You can run Jenkins again!

@niboshi I have added the changes! I think you can run Jenkins again

@niboshi I have added the changes, have a look!

Thanks! Jenkins, test this please

Jenkins CI test (for commit b25275850cdef490cf28031383df260ab44075ff, target branch master) succeeded!

LGTM

Thanks!


createFromEntity type doesn't match declared type in ComponentFramework.NavigationApi.EntityFormOptions

When attempting to use the createFromEntity option with context.navigation.openForm(options, parameters), the declared Type doesn't match.
The documentation states:

createFromEntity: Lookup. Designates a record that will provide default values based on mapped attribute values. The lookup object has the following String properties: entityType, id, and name.

However, the declared Type for this object in the ComponentFramework.NavigationApi.EntityFormOptions uses the EntityReference interface, which has the following properties:
interface EntityReference {
        /**
         * The record id. Read-only.
         */
        id: { guid: string; };

        /**
         * The entity logical name. Read-only.
         */
        etn?: string;

        /**
         * The name of the entity reference. Read-only.
         */
        name: string;
    }

When attempting to use the EntityReference as the createFromEntity option, the code doesn't execute.  However, it will execute as expected when using the String properties that were mentioned in the documentation.
entityType, id, and name.
Workaround seems to be to insert @ts-ignore when creating the options object.  For example:

const createFromEntityLookupObj = {
					entityType: _lookupEntityType,
					id: _lookupId,
					name: _lookupName,
				};

				const options: ComponentFramework.NavigationApi.EntityFormOptions = {
					entityName: _targetEntityName,
					useQuickCreateForm: true,
					//@ts-ignore
					createFromEntity: createFromEntityLookupObj,
				};

				this._context.navigation.openForm(options).then(
					function (success) {
						console.log(success);
					},
					function (error) {
						console.log(error);
					}
				)

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: a1584e4c-abec-d444-2fa5-cf84dc3b33fe
Version Independent ID: 89452bfa-cd47-879c-90f5-64e327942b27
Content: openForm - Power Apps
Content Source: powerapps-docs/developer/component-framework/reference/navigation/openform.md
Service: powerapps
GitHub Login: @Nkrb
Microsoft Alias: nabuthuk

@rn85apps Thanks for contacting us. We have created a internal work item for the respective dev team to update the types. Will update the docs if any when the issue is resolved. Closing the issue.  If you need further help, please reopen the issue or open a new issue.


--help flag gets dropped in nested commands (ks prototype preview)

Tried to run
ks prototype preview --help

But got
ERROR No prototype names matched '--help'

Not super urgent but needs to be fixed.

related: #21

Ah sorry, didn't realize this was a dup---I'm going to close this and we can use the one you linked as the main tracking issue


build: vite v6

Motivation
Svelte v5 and notably @sveltejs/vite-plugin-svelte uses Vite v6 in their last version. Therefore we also want to keep the pace and use those version.

Let's use this PR to migrate to vite v6. Currently blocked because of an incompatibility in Vitest v3.
See https://github.com/sveltejs/vite-plugin-svelte/issues/1043#issuecomment-2529175816


Issues with 'az network dns zone create'

Issues with 'az network dns zone create':

Help text ('-h') shows 'Create or update a virtual machine'.  That is wrong, nothing to do with VMs.
Allows me to create or update (operations on existing resources are successful).  Given that we have a separate command for updates, should this command be create only, i.e. use 'If-none-match *' request header?  At the least we need to give the option of create-only vs create-or-update
Supports '--location -l' with default 'global'.  Given that the only supported value for DNS zones is 'global', this parameter is useless and should be removed.
In the help text, --name -n is described as "The name of the zone without a terminating dot." Whilst the service cares about terminating dots, the CLI should not.  I.e. the text should be "The name of the zone, for example 'contoso.com'."  And if a terminating dot is provided, the CLI should simply silently remove it before calling the service. In this way we optimize for usability by humans.

fix help
add if-none-match
force --location to global

Discuss #4

Discussed #4 with Jason...agreed this needs to be done client side.

[ ] Help text ('-h') shows 'Create or update a virtual machine'. That is wrong, nothing to do with VMs.
[ ] Allows me to create or update (operations on existing resources are successful). Given that we have a separate command for updates, should this command be create only, i.e. use 'If-none-match *' request header? At the least we need to give the option of create-only vs create-or-update
[ ] Supports '--location -l' with default 'global'. Given that the only supported value for DNS zones is 'global', this parameter is useless and should be removed.
[ ] In the help text, --name -n is described as "The name of the zone without a terminating dot." Whilst the service cares about terminating dots, the CLI should not. I.e. the text should be "The name of the zone, for example 'contoso.com'." And if a terminating dot is provided, the CLI should simply silently remove it before calling the service. In this way we optimize for usability by humans.


[feat]  From an optimization point of view, why not add the For tag like Solidjs

🧐 Problem Description

💻 Sample code
considering the optimization direction of vue jsx, can you refer to solidjs and provide some tags that help engine optimization, just like solidjs.

🚑 Other information

@chaozwn, you can use renderList function or renderSSRList, to render list of items.
Btw v-for inside templete compiles directlry into renderList or renderSSRList.


Registration of External model for TilingInterface leads to an error

Using https://github.com/MaheshRavishankar/iree/commits/pad_fusion_registration_err (the top two commits are part of the branch alone and not in IREE ToT) calling tensor::registerTilingInterfaceImpl(https://github.com/llvm/llvm-project/blob/main/mlir/include/mlir/Dialect/Tensor/IR/TensorTilingInterfaceImpl.h#L57) leads to a assertion when running the following command
iree-compile --output-format=vm-bytecode --mlir-print-op-on-diagnostic=false --iree-hal-target-backends=vmvx tests/e2e/linalg_ext_ops/scatter.mlir -o scatter.vmfb --debug

This is the error I see with debug log https://gist.github.com/MaheshRavishankar/9c0bdbd6094787fa7fd0245f37c4a067
Essentially it looks like the tensor dialect is not loaded before the interface is being registered. Note that dropping the top commit from that branch, things seems to work fine cause the tensor dialect is now explicitly loaded with the iree_linalg_ext dialect. Also at IREE ToT if just making the change to add tensor::registerTensorTilingInterfaceImpl in init_mlir_dialects.h doesnt cause an error. I dont immediately see what the issue is. AFAICS, there is nothing in the last two commits of https://github.com/MaheshRavishankar/iree/commits/pad_fusion_registration_err is the root cause for the issue.

https://github.com/iree-org/iree/pull/11271 is the draft PR to help repro this easier

CLosing. The issue was https://github.com/MaheshRavishankar/iree/commit/06198d65e447f2e75d0391359cec670344e5af05#diff-cb977f71bd0bbf52493c3c0d5b2bc7187facba89a70ce94bea523ad824ae3ae8 is within the addExtension for IREE::LinalgExt dialect. It should be within the add extesions of tensor::TensorDialect.