DeviceInfo not detecting iPhone 6S Plus

I'm testing with both an actual iPhone and the iOS Simulator. Everything works fine on the simulator, but not on the real device. The failure to detect is happening in DeviceInfo.prototype.determineIPhone_.
In the simulator, screen.availWidth is 414, which multiplied by dpr of 3 is 1242, which matches the hard-coded iPhone6Plus data. However, on the real iPhone, screen.availWidth is 375, so pixelWidth is 1125 and doesn't match anything.
I don't know why the two devices don't match, but I did find one reference online to someone else who's seen the same value. I've confirmed that both the simulated device and the real one are actually iPhone 6S Plus, which incidentally has the same screen specs as the iPhone 6 Plus (according to Apple's site). I also don't really follow why these values to the specs listed on Apple's site.
Maybe there need to be multiple values per device, or maybe someone who knows more about this can suggest an alternative approach.

A good alternative is checking the WebGL version script. iOS puts the name of the hardware chip into the GL string, allowing differentiating different iPhone and iPad models (a true feature test, rather than user-agent sniffing). Unfortunately, Android phones don't seem to help in this way...
I have a draft detector up on my github:
https://github.com/pindiespace/webvr-detector/blob/master/src/webvr-detector.js
iOs Detects originally from:
https://github.com/uupaa/UserAgent.js/wiki/UserAgent

While we're at it, DeviceInfo.prototype.getDistortedFieldOfViewLeftEye throws an error if no device is provided. For Android, there is AVERAGE_ANDROID as a fallback. It may not be a bad idea to have a similar backup for iOS for when future devices are released before someone has time to update this code.
Also, I haven't tested this on iPad, but I imagine it will fail.

@pindiespace, that's an interesting idea, though I wouldn't call it a feature test - it's still string sniffing. Seems like it doesn't really help here though, because for iPhone 6S+, it reports A9 which could just as easily be an iPad or a 6S.

But the combination of UA sniffing for "ipad" (which is always present) and
the GL version allows you to differentiate them.
So, use a combo of searching "iphone", "ipad", "ipod" + GL Version. The
only problem is with the iPad 1. It can be ruled out by checking for motion
detect (the iPad 2 was the first with accelerometer).
Also, the GL string presumably reflects the actual hardware chip, which was
specific to each iOS device. It seems unlikely that it would be overwritten
even if the OS is upgraded (unlike the user-agent, which is easily changed).
On Fri, Jan 8, 2016 at 12:26 PM, Brian Chirls<EMAIL_ADDRESS>wrote:

@pindiespace https://github.com/pindiespace, that's an interesting
idea, though I wouldn't call it a feature test - it's still string
sniffing. Seems like it doesn't really help here though, because for iPhone
6S+, it reports A9 which could just as easily be an iPad or a 6S.
—
Reply to this email directly or view it on GitHub
https://github.com/borismus/webvr-boilerplate/issues/102#issuecomment-170114307
.

--
=================
Dr. Pete Markiewicz
Email<EMAIL_ADDRESS>Sustainable virtual design blog:
http://sustainablevirtualdesign.wordpress.com
Sustainability template: http://greenboilerplate.com
*Teaching site: *http://plyojump.com http://www.plyojump.com/
*Buy my book! *- Millennials and the Popular Culture
Lifecourse: http://www.lifecourse.com/store/catalog/lca/mpc.html

AmazonAuthor Page:*
http://www.amazon.com/Pete-Markiewicz/e/B0069VZ7BG/ref=ntt_athr_dp_pel_pop_2
On that page, see my DARPA Grand Challenge 2005 entry video, "Team
Robomonster":
*Team Robomonster *(DARPA 2005 Grand Challenge):
http://robotsthatjump.wordpress.com/category/team-robomonster/
*Indiespace *(1st to sell downloaded music, March 1994):
http://www.indiespace.com. Also see http://archive.org under
"Kspace.com" 1996 for our original site.
============================================================
=================

That sounds pretty complicated, but if it ends up being the only way then I'm for it. However, I'd still love to know why this particular iPhone returns two different values for screen.availWidth and see if that approach can't still work.
There's something to be aware of when making temporary WebGL contexts for feature detection...if you're not gonna use the existing one created by three.js. I ran into these problems with Seriously.js. It's possible (especially if you make too many of them) that you'll run out of GL contexts on the page (I think the limit is 16 in Chrome on OSX, for example), in which case the browser will throw a bit of a fit. At best, the browser will kill one of the contexts so you can create a new one, and that may be the one you're drawing with. So you gotta make sure you share one for all the tests and then prevent default if a "losecontext" event fires.
Here's how I handled it in Seriously.js, which seems pretty reliable.

Is there a reason for using undefined instead of null?
I've been using a separate detector is to check for Promise and Fullscreen
API support.
On Fri, Jan 8, 2016 at 12:53 PM, Brian Chirls<EMAIL_ADDRESS>wrote:

That sounds pretty complicated, but if it ends up being the only way then
I'm for it. However, I'd still love to know why this particular iPhone
returns two different values for screen.availWidth and see if that
approach can't still work.
There's something to be aware of when making temporary WebGL contexts for
feature detection...if you're not gonna use the existing one created by
three.js. I ran into these problems with Seriously.js. It's possible
(especially if you make too many of them) that you'll run out of GL
contexts on the page (I think the limit is 16 in Chrome on OSX, for
example), in which case the browser will throw a bit of a fit. At best, the
browser will kill one of the contexts so you can create a new one, and that
may be the one you're drawing with. So you gotta make sure you share one
for all the tests and then prevent default if a "losecontext" event fires.
Here's how I handled it
https://github.com/brianchirls/Seriously.js/blob/master/seriously.js#L559-L594
in Seriously.js, which seems pretty reliable.
—
Reply to this email directly or view it on GitHub
https://github.com/borismus/webvr-boilerplate/issues/102#issuecomment-170120996
.

--
=================
Dr. Pete Markiewicz
Email<EMAIL_ADDRESS>Sustainable virtual design blog:
http://sustainablevirtualdesign.wordpress.com
Sustainability template: http://greenboilerplate.com
*Teaching site: *http://plyojump.com http://www.plyojump.com/
*Buy my book! *- Millennials and the Popular Culture
Lifecourse: http://www.lifecourse.com/store/catalog/lca/mpc.html

AmazonAuthor Page:*
http://www.amazon.com/Pete-Markiewicz/e/B0069VZ7BG/ref=ntt_athr_dp_pel_pop_2
On that page, see my DARPA Grand Challenge 2005 entry video, "Team
Robomonster":
*Team Robomonster *(DARPA 2005 Grand Challenge):
http://robotsthatjump.wordpress.com/category/team-robomonster/
*Indiespace *(1st to sell downloaded music, March 1994):
http://www.indiespace.com. Also see http://archive.org under
"Kspace.com" 1996 for our original site.
============================================================
=================

Thanks for flagging this. I don't have a 6S Plus to try on. If it's impossible to detect using the current iOS specific resolution scheme, maybe we consider moving to UA sniffing, but it seems uglier.
Maybe we should have a generic smartphone instead of the Android one. But this is a bad state to be in.

Yeah, one of my partners has an 6S+, so I can test it when she's around. I've been digging all over the interwebs and haven't found any other reference to it. I've gone through as many settings as I can find and nothing makes a difference. I'll keep an eye out for anyone who might have another one so I can compare further.
Yes, I think a generic phone as a fallback is necessary. Better to have the distortion be slightly off than to just crash. Maybe we can get that going first? And then if I or anyone else discovers WTF is up with the 6S+, we can add that model specifically.
Also, I looked into the UA, and it doesn't seem to indicate the exact model of iPhone, so I think that's a bust.

@borismus I figured it out! iPhone 6 (S)? (Plus)? has this thing called [Display Zoom] that changes the reported screen dimensions. This has been tricky to debug, since the xcode simulator doesn't have this feature at all. It's only on the real phones.
Since there's no way to predict or detect whether this feature is enabled, we need to have a second instance of both the 6 and 6+. Screen resolutions are listed here:
http://www.paintcodeapp.com/news/ultimate-guide-to-iphone-resolutions

This doesn't appear to account for the 20 pixel differential observed in #105, so we'll have to keep digging on that one.

According to the iPhone resolution guide, iPhone 6 with display zoom will have exactly the same pixel dimensions as iPhone 5. So the only way to tell the difference will be to do as @pindiespace suggests and check for the different GPU chipsets: A8 for iPhone 6/6S, SGX543 or A7 for iPhone 5/5c/5s.

Are there any other APIs that spit out the equivalent of a vendor string
tied to hardware (e.g. media or audio synth api)?
On Wed, Jan 20, 2016 at 1:28 PM, Brian Chirls<EMAIL_ADDRESS>wrote:

According to the iPhone resolution guide
http://www.paintcodeapp.com/news/ultimate-guide-to-iphone-resolutions,
iPhone 6 with display zoom will have exactly the same pixel dimensions as
iPhone 5. So the only way to tell the difference will be to do as
@pindiespace https://github.com/pindiespace suggests and check for the
different GPU chipsets: A8 for iPhone 6/6S, SGX543 or A7 for iPhone 5/5c/5s.
—
Reply to this email directly or view it on GitHub
https://github.com/borismus/webvr-boilerplate/issues/102#issuecomment-173364502
.

--
=================
Dr. Pete Markiewicz
Email<EMAIL_ADDRESS>Sustainable virtual design blog:
http://sustainablevirtualdesign.wordpress.com
Sustainability template: http://greenboilerplate.com
*Teaching site: *http://plyojump.com http://www.plyojump.com/
*Buy my book! *- Millennials and the Popular Culture
Lifecourse: http://www.lifecourse.com/store/catalog/lca/mpc.html

AmazonAuthor Page:*
http://www.amazon.com/Pete-Markiewicz/e/B0069VZ7BG/ref=ntt_athr_dp_pel_pop_2
On that page, see my DARPA Grand Challenge 2005 entry video, "Team
Robomonster":
*Team Robomonster *(DARPA 2005 Grand Challenge):
http://robotsthatjump.wordpress.com/category/team-robomonster/
*Indiespace *(1st to sell downloaded music, March 1994):
http://www.indiespace.com. Also see http://archive.org under
"Kspace.com" 1996 for our original site.
============================================================
=================

@pindiespace I honestly don't think so, but maybe poke around here: https://www.browserleaks.com/

Okay, I tested this on iPhone 6S+ with Display Zoom and can confirm that #103 does not fix this issue. The new code does avoid the thrown error, but the distortion/alignment is wrong, so the 3D doesn't work.

Hey brian, could you please visit this page using the device and post the output?
http://goo.gl/OMe7mW

@btco: Sure thing.
Here's the output from the real iPhone 6S+ with Display Zoom turned on:
UA: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13D15 Safari/601.1
computed resolution: 2001 x 1125
screen.width: 375
screen.height: 667
screen.availWidth: 375
screen.availHeight: 667
window.devicePixelRatio: 3

For comparison, here's the output from the comparable model iPhone on the xcode simulator, with no Display Zoom:
UA: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H141 Safari/600.1.4
computed resolution: 2208 x 1242
screen.width: 414
screen.height: 736
screen.availWidth: 414
screen.availHeight: 736
window.devicePixelRatio: 3

Cool! Thanks! Could you please add this device definition to src/dpdb-cache.js in your working copy and see if that fixes the distortion? (Remember to call make after you do that so the JS gets recompiled).
{
    "type": "ios",
    "rules": [ { "res": [ 1125, 2001 ] } ],
    "dpi": [ 410.9, 415.4 ],
    "bw": 4,
    "ac": 1000
},

(add this to src/dpdb-cache.js, at the end of the "devices" list).

@btco: I'll check in the morning when I get access to that phone again. I'm still not sure what we're gonna do about the iPhone 6 w/ display zoom looking like the iPhone 5.
Also, @petersgrandadventure reported in the webvr Slack that it's not recognizing the Samsung Galaxy S6 edge+. Details below:
UA: Mozilla/5.0 (Linux; Android 5.1.1; SM-G928T Build/LMY47X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.15 Mobile Safari/537.36
computed resolution: 2562 x 1442
screen.width: 412
screen.height: 732
screen.availWidth: 412
screen.availHeight: 732
window.devicePixelRatio: 3.5

Is there a place for requesting updates to dpdb somewhere?

@btco Yup, that matched the iPhone and fixed the problem.

Ok! I'm including that in the DPDB then. Thanks for testing!
As for your other question about where to request dpdb updates: we're still figuring it out. I'll update README.md with instructions once we establish a process.

DPDB updated.

@brianchirls Please reopen if you're still seeing this.

My colleague with the iPhone just walked out, but I have no reason to believe this would have been fixed. Will check for sure tomorrow.

{
"type": "ios",
"rules": [ { "res": [ 1125, 2001 ] } ],
"dpi": [ 410.9, 415.4 ],
"bw": 4,
"ac": 1000
}
is not part of /webvr-polyfill/build/webvr-polyfill.js here.  Was there any reason why it was omitted.  I just got an ugly looking screenshot from an iPhone 6S+ with wplit screen line almost at +80% mark.


Contact form functionality, alignment

Description
The contact form at the bottom of the page should function in the same manner as the form on the Deginner website. Form should also be centered on the page, and the fields should match the specifications outlined in the wiki.
Tasks

[ ] Add functionality to contact form
[ ] Center contact form on page
[ ] Remove company field
[ ] Ensure fields match wiki specifications

We can hook up to Zoho CRM just like deginner.com. @d3brouille

Git Guild Bounty Program

Total
Dev
Sales
Reporter
Tester(s)
Maintainer
Documenter

N/A
assignee(s)
@isysd
@indieinc
@indieinc, @d3brouille
@cindy-zimmerman
@d3brouille

$165
$99
$8.25
$8.25
$33
$8.25
$8.25

@isysd, does tigo have its own zoho crm account or is it sufficient to reuse deginner's for the purposes of this form for the time being?

I align the form in the center, here is the branch: https://github.com/luisvillara/tigoctm/tree/17-contact-form-functionality


 A AAAA RRSIG NSEC

;; Query time: 0 msec
;; SERVER: <IP_ADDRESS>#5355(<IP_ADDRESS>)
;; WHEN: Wed Nov 17 16:53:04 CET 2021
;; MSG SIZE  rcvd: 100

To reproduce
Steps to reproduce the behavior:

see above; tested with an unbound docker container on localhost and on a raspberry pi

Expected behavior
Should return the same as cloudflare google etc.
no idea what is rfc compliant in this case.
System:

Unbound version: 1.13.2
OS: arch/ubuntu
unbound -V output:

Version 1.13.2

Configure line: --with-deprecate-rsa-1024 --disable-dependency-tracking --prefix=/opt/unbound --with-pthreads --with-username=_unbound --with-ssl=/opt/openssl --with-libevent --with-libnghttp2 --enable-tfo-server --enable-tfo-client --enable-event-api
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 1.1.1k  25 Mar 2021
Linked modules: dns64 respip validator iterator
TCP Fastopen feature available

BSD licensed, see LICENSE in source package for details.
Report bugs to<EMAIL_ADDRESS>or https://github.com/NLnetLabs/unbound/issues

all the best and thank you for unbound!
paul

This happens because the upstream server responds with a CNAME. If unbound had hosted the authoritative zone, with eg. auth-zone, it would likely have responded with the NSEC response that you want. But the upstream authoritative server does not respond in that manner. It ignores the direct query for type NSEC and replies with the CNAME. Unbound can do nothing else but chase the cname.
 If Unbound was to query another type of upstream server that responds in a different manner, eg. with the correct NSEC record that you want, then you would get the response you are looking for.

Thank you for the quick response.
I tinkered around for a bit, and it does not look like an upstream bug.
I am using PowerDNS, and it sure could be a bug in there, but other servers that use NSEC behave like this too (queried through unbound):

Our local university: autoconfig.hs-augsburg.de
One of the biggest German banks: www.3dsecure.sparkasse.de

Google, Cloudflare, OpenDns, Level3 give the expected, same answer when asked, and I could not figure out what they are doing to get it.
Verisign(<IP_ADDRESS>) gives exactly the same answer as unbound on my local machine. (maybe they are using unbound)
Note that Quad9(<IP_ADDRESS>) responds with NXDOMAIN
Further strange is that dig, when sending a query directly to the authoritative server like you did, also only gives back the CNAME and its resolution.
We thought that this part from the RFC might be related, but it couldn't help us finding the whole truth:
https://datatracker.ietf.org/doc/html/rfc4035#section-2.5
It explains how the public resolvers got to the DNSSEC types of the next record in the NSEC chain:
autoconfig.y.gy.	3600	IN	NSEC	autodiscover.y.gy. CNAME RRSIG NSEC
(CNAME and the signed zone implies the existence of RRSIG and NSEC) but not how they got  the TTL (3600) the next signed record (autodiscover.y.gy.) and the type of the next signed record (CNAME)
Thank you and have a great day.

Unbound gets the CNAME answer from the authoritative server, so it makes a CNAME response. I am closing the issue, because there seems to be nothing I can do, but agree that those differences exist in servers out there. But I have nothing to act on, so I am closing the issue. If you are looking for opinions, people to talk to, perhaps try the unbound-users list, or another discussion forum.

Ok, I think I figured it out.
When adding the +dnssec option to dig, querying the authoritative server directly, it returns the expected record:
From the dig manpage:

+[no]dnssec
Request DNSSEC records be sent by setting the DNSSEC OK bit (DO) in the OPT record in the additional section of the query (off by default).

paul@blackbox ~> dig NSEC autoconfig.y.gy. @2a01:4f8:c2c:3c85::1 +dnssec

; <<>> DiG 9.16.23 <<>> NSEC autoconfig.y.gy. @2a01:4f8:c2c:3c85::1 +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64432
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;autoconfig.y.gy.		IN	NSEC

;; ANSWER SECTION:
autoconfig.y.gy.	3600	IN	RRSIG	NSEC 13 3 3600<PHONE_NUMBER>0000<PHONE_NUMBER>0000 38180 y.gy. 0XX4EF+a968lOBbiE8Wr4VLpnyayV0GLL+Llf0VrakIBawhpWKpcjwNz WwDCZwAauolUXLVVtCU17L6zJCT5bw==
autoconfig.y.gy.	3600	IN	NSEC	autodiscover.y.gy. CNAME RRSIG NSEC

;; Query time: 33 msec
;; SERVER: 2a01:4f8:c2c:3c85::1#53(2a01:4f8:c2c:3c85::1)
;; WHEN: Tue Nov 30 17:49:38 CET 2021
;; MSG SIZE  rcvd: 183

When querying Unbound, this is what happens:
paul@blackbox ~> dig NSEC autoconfig.y.gy. @localhost -p 5355 +dnssec

; <<>> DiG 9.16.23 <<>> NSEC autoconfig.y.gy. @localhost -p 5355 +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45058
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;autoconfig.y.gy.		IN	NSEC

;; ANSWER SECTION:
autoconfig.y.gy.	10800	IN	CNAME	mx.y.gy.
autoconfig.y.gy.	10800	IN	RRSIG	CNAME 13 3 10800<PHONE_NUMBER>0000<PHONE_NUMBER>0000 38180 y.gy. Hu27hL6Iz8HCYIXz4bybLCP4P3P4hxXl1/K2aA025winILzuCtrxeUxg hJzH2PD3tOabl44Aqha62cwggXKYsA==
mx.y.gy.		3600	IN	NSEC	_110._tcp.mx.y.gy. A AAAA RRSIG NSEC
mx.y.gy.		3600	IN	RRSIG	NSEC 13 3 3600<PHONE_NUMBER>0000<PHONE_NUMBER>0000 38180 y.gy. gL712MR+kclfgtyj2S/rf2uzRle8lbOG/lNdpB4vtc1ljEVcjdj/xHUR xBs7nCbc4i/ONBgCm3rJSwU1Ul5Kkg==

;; Query time: 176 msec
;; SERVER: <IP_ADDRESS>#5355(<IP_ADDRESS>)
;; WHEN: Tue Nov 30 17:49:56 CET 2021
;; MSG SIZE  rcvd: 300

This is not the expected behavior, as it should return an answer to the initial question.
This issue not only occurs when PowerDNS is the authoritative resolver (assuming nlnetlabs.nl is not using PowerDNS)
Asking the local Unbound resolver this is what comes up when querying for the NSEC record of _acme-challenge.nlnetlabs.nl. (a CNAME record)
paul@blackbox ~> dig NSEC _acme-challenge.nlnetlabs.nl. @localhost -p 5355

; <<>> DiG 9.16.23 <<>> NSEC _acme-challenge.nlnetlabs.nl. @localhost -p 5355
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 26550
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;_acme-challenge.nlnetlabs.nl.	IN	NSEC

;; ANSWER SECTION:
_acme-challenge.nlnetlabs.nl. 9815 IN	CNAME	nlnetlabs.nl.acme.nlnetlabs.nl.

	IN	NSEC

;; ANSWER SECTION:
_acme-challenge.nlnetlabs.nl. 9782 IN	CNAME	nlnetlabs.nl.acme.nlnetlabs.nl.
_acme-challenge.nlnetlabs.nl. 9782 IN	RRSIG	CNAME 8 3 10200<PHONE_NUMBER>5021<PHONE_NUMBER>5021 42393 nlnetlabs.nl. EYnzdU87i4bSf7jP3wxw9SdYPtdXrVCdZr2fvIaIk/pHWCaCq+5rqQ0r m0Op/qEGEtcEyGAiOxh7mZ05KqEFNsACkacUtvO7B52NNuvsE1tyW1cI 141ceiPvWePCleKv3ayuZqPpOk49/51EUKTudvEBfqD/IcGQeipyVkRp 7HY=

;; AUTHORITY SECTION:
hhb2ngapsbkfdpijh6nqq4qbepkp9sb3.acme.nlnetlabs.nl. 3182 IN NSEC3 1 0 5 34CCDEF2984D916D HHB2NGAPSBKFDPIJH6NQQ4QBEPKP9SB3 NS SOA TXT RRSIG DNSKEY NSEC3PARAM
hhb2ngapsbkfdpijh6nqq4qbepkp9sb3.acme.nlnetlabs.nl. 3182 IN RRSIG NSEC3 7 4 3600<PHONE_NUMBER>0130<PHONE_NUMBER>3940 35465 acme.nlnetlabs.nl. eTP+3XMq+fRJqUmYU09Qvm+q9+nJOzcN1+LmXzsuUEGJzi/FQqu8bI6R 5idzL4ZAtUWmQyVbtGzTGd9C3c0ipyXsEmvVu35SnIoEFoqgdU/VwvOl D1omCbfdMb9I+AFxxI2HHjiFmxGuOaOX2KJe1VWK11Ks3TTGYhGWRNzM H50=
acme.nlnetlabs.nl.	3182	IN	SOA	ns.nlnetlabs.nl. sysadmin.nlnetlabs.nl.<PHONE_NUMBER> 14400 3600<PHONE_NUMBER>
acme.nlnetlabs.nl.	3182	IN	RRSIG	SOA 7 3 3600<PHONE_NUMBER>3001<PHONE_NUMBER>3940 35465 acme.nlnetlabs.nl. Dic9x0rhcBz4AQgIzwppt30jEi9guTWNOnykfjr4kDOGJwKvjABDMksD GdB49hFPU5TGS9cF7rHh1D1MD6DAxTt73U1Z7FSAyV8FNF2kv0S705FO DLsuGz1gV6OYr899sLjQu2/K9526yDq6eVFRWenwFcoDA+8l5TE8IPwd GIo=

;; Query time: 0 msec
;; SERVER: <IP_ADDRESS>#5355(<IP_ADDRESS>)
;; WHEN: Tue Nov 30 18:17:17 CET 2021
;; MSG SIZE  rcvd: 751

but when the query is sent directly to the authoritative server, ns.nlnetlabs.nl. dig gets the expected record (even without the +dnssec flag):
paul@blackbox ~> dig NSEC _acme-challenge.nlnetlabs.nl. @ns.nlnetlabs.nl

; <<>> DiG 9.16.23 <<>> NSEC _acme-challenge.nlnetlabs.nl. @ns.nlnetlabs.nl
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3527
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;_acme-challenge.nlnetlabs.nl.	IN	NSEC

;; ANSWER SECTION:
_acme-challenge.nlnetlabs.nl. 240 IN	NSEC	3.1.1._dane.nlnetlabs.nl. CNAME RRSIG NSEC

;; AUTHORITY SECTION:
nlnetlabs.nl.		240	IN	NS	ns.nlnetlabs.nl.
nlnetlabs.nl.		240	IN	NS	anyns.pch.net.
nlnetlabs.nl.		240	IN	NS	ns-ext1.sidn.nl.

;; ADDITIONAL SECTION:
ns.nlnetlabs.nl.	10200	IN	AAAA	2a04:b900::8:0:0:60
ns.nlnetlabs.nl.	10200	IN	A	<IP_ADDRESS>

;; Query time: 193 msec
;; SERVER: 2a04:b900::8:0:0:60#53(2a04:b900::8:0:0:60)
;; WHEN: Tue Nov 30 18:24:42 CET 2021
;; MSG SIZE  rcvd: 218

In conclusion, this means we have two separate issues:
PowerDNS should return the NSEC record even without the need for the +dnssec flag to be set. (but this is not related to the Unbound issue)
AND
Unbound should return the NSEC record when asked for it. Even if all above is PowerDNS's fault, this still happens even when querying the authoritative server of your company with Unbound.
Please consider re-opening the issue and fixing it.

You are trying to query for the type NSEC and that is not really supported. Also for type NSEC3 where the spec even disallows type NSEC3 queries. What seems to happen is that the CNAME is in cache. Unbound picks up the cname and then continues to create an answer from there. That would always happen. Apart from that, if Unbound queries the authoritative server, if that server responds with a CNAME unbound chases it, but if that server responds with the NSEC answer, then Unbound is likely going to create an answer out of that.
The issue is the data next to the CNAME. CNAME is defined to redirect all queries to the target, and this is also for other types, as the user wants to know what the data item at the target name is. And then needs the DNSSEC NSEC information for that target name to find out in the type bitmap if that type does not exist.
I think your query for type NSEC is not going to work. Try querying for another type, what did you really want? If you want to download the zone itself, ask for that, and use AXFR. If you want to have the type bitmap, ask for a nonexistent type. If you want a particular type ask for that.
It is interesting that servers differ in behaviour. But here unbound is just modifying the answer by what is in cache and the behaviour from the authoritative server. Why do you think PowerDNS is involved? It would be nicer if you got consistent answers from everyone.

PowerDNS is my authoritative server, for that it is involved.
I used Cloudflare and Googles public DNS before to perform zone enumeration and wanted to switch to unbound for privacy reasons.
I'm just trying to query unbound for NSEC records in the first step (walking the zone) but can in no way get an answer from unbound, related to the requested NSEC record, in the case of an existing CNAME record.

I guess i found a solution to my problem.
I'm using bind now...
It works as expected in this case.


Fix error when MVC module is on a page multiple times

Fixes #3634, thanks @DaveMartinSE!

@bdukes Did you run a performance test on this?

The performance was broken before and not broken after 😉
In reality, scoped would be one per request, and transient would be one per module, so the only time there would be a difference would be when there are multiple modules on one page, and that's the case where it's broken anyway.  But, to answer the question, no, I didn't run any performance comparison.

I was thinking of the memory leak side of things, but this appears to be no impact.


[homeassistant] uv 0.5.12 breaks container build

FYI, after some debugging I found out that uv 0.5.12 breaks the container build for homeassistant:
https://github.com/onedr0p/containers/blob/a8d939027e207b8ed0e16a0fbf32037d1668e663/apps/home-assistant/Dockerfile#L79
13.29 Installing collected packages: uv
13.46 Successfully installed uv-0.5.12
15.79 Using Python 3.13.1 environment at: /usr/local
16.11 error: Failed to read `--find-links` URL: https://wheels.home-assistant.io/musllinux/
16.11   Caused by: Failed to fetch: `https://wheels.home-assistant.io/musllinux/`
16.11   Caused by: error decoding response body
16.11   Caused by: there are extra bytes after body has been decompressed
------

Forcing uv to 0.5.11 resolves the issue:
    pip install uv==0.5.11 \

I see some reports coming in thru their GH issues, so lets wait this out a bit seeing the release is only 6 hours old as of this post. Thanks for reporting though!


Result training on custom data is not good

Hi, thanks for the work here, I've trained your model on a custom dataset with one class but the results is not quite good.
I've been tried to segment the lines on some tires, after 80000 epochs with 3200 training images and 800 validation images, result of the model is in the blue color which absolutely not good. Do you have any advice for me, I'll be really appreciate any help!

Here is some log at the end of training:
[10/01 21:53:22 d2.utils.events]: eta: 3:56:25  iter: 80379  total_loss: 0.655  loss_cls: 0.000  loss_reg: 0.046  loss_centerness: 0.601  loss_mask: 0.003  loss_mask_bo: 0.001  loss_boundary_bo: 0.005  loss_boundary: 0.004  time: 1.3964  data_time: 0.0127  lr: 0.000100  max_mem: 7583M
[10/01 21:53:50 d2.utils.events]: eta: 3:55:51  iter: 80399  total_loss: 0.653  loss_cls: 0.000  loss_reg: 0.043  loss_centerness: 0.597  loss_mask: 0.002  loss_mask_bo: 0.001  loss_boundary_bo: 0.004  loss_boundary: 0.003  time: 1.3964  data_time: 0.0128  lr: 0.000100  max_mem: 7583M
[10/01 21:54:18 d2.utils.events]: eta: 3:55:14  iter: 80419  total_loss: 0.635  loss_cls: 0.000  loss_reg: 0.042  loss_centerness: 0.582  loss_mask: 0.003  loss_mask_bo: 0.001  loss_boundary_bo: 0.004  loss_boundary: 0.005  time: 1.3964  data_time: 0.0124  lr: 0.000100  max_mem: 7583M

Hi, thanks for watching our work. Why the loss_mask and loss_bound is so low compared to the loss_centerness?

idk, i used the same model and config in your repo. Do you know what might cause the problem here?

The loss weights could be adjusted to balance each components.


Complete nex UI integration

Proposed change
The current UI implementation is stubs and placeholders. The following features need to be "live" for the UI to be considered MVP:

Monitor logs
Monitor events
Filter logs/events by namespace
Discover and browse workloads
Start a workload via devrun and an upload button/form

These were all built and completed in the Elixir Phoenix prototype in under a week so hopefully the Go version won't take much longer.
Use case
I want to be able to use nex ui to make it easier and more comfortable to perform some common nex tasks like monitoring logs and events, discovering workloads, and starting (devrun) workloads
Contribution
No response

Closing in favor of a new concept around the UI


Fix docs of n_step_rnn and n_step_lstm

I deleted docs of some parameters which do not exist yet.

Jenkins, test this please.

Jenkins CI test (for commit dd33c27ec7d0f7486c632b1bb68f8b9c38fe60aa) succeeded without errors!

Thanks!


Add picknik_controllers

Please add these packages to be indexed in the rosdistro.
For Distributions
Humble, Iron, Rolling
Package names:

picknik_reset_fault_controller
picknik_twist_controller

The source is here:
https://github.com/PickNikRobotics/picknik_controllers
Purpose of using this:
The purpose of picknik_controllers repository is hold controllers that we are in the process of open sourcing and up-streaming.
The controllers in this repository have been prefixed with picknik_ so that if they are accepted upstream we will drop the prefix and release the prefixed versions with deprication warnings.
As we make changed requested upstream in ros-control/ros2_controllers we may need to keep both versions around during the transition phase.

picknik_reset_fault_controller has been discussed here https://roscontrol.slack.com/archives/C01HA09KDLH/p1686332900429009
picknik_twist_controller https://github.com/ros-controls/ros2_controllers/pull/300

These do not have a gbp-release package and have not been release they are currently source only.
Following the steps outlined here: https://docs.ros.org/en/rolling/How-To-Guides/Releasing/First-Time-Release.html This PR is for step 2

Be part of a release team: https://github.com/ros2-gbp/ros2-gbp-github-org/pull/281 I've added @MarqRazz and @moriarty
https://docs.ros.org/en/rolling/How-To-Guides/Releasing/Release-Team-Repository.html#create-a-new-release-repository

Note:
I found the instructions were unclear here:

Create a new release repository
If your repository is new to the ROS community, you should first open a pull request on ros/rosdistro adding a source entry for your repository. The review process for the rosdistro database will ensure your repository and packages conform to the REP 144 package naming conventions and other requirements before release. Once your package name has been approved and merged, fill in the Add New Release Repositories issue issue template if you don’t have a release repo for your project yet.

Unclear in that there were no existing examples of how to create a source entry for your repository. and still have the names of the packages in the pull request to discuss. So I added them here but maybe they were only meant to be discussed in the pull request comments not actually in the code.
Checks

[ ] All packages have a declared license in the package.xml
[ ] This repository has a LICENSE file
[ ] This package is expected to build on the submitted rosdistro

New package review:

[x] At least one of the following must be present

[x] Top level license file: https://github.com/PickNikRobotics/picknik_controllers/blob/main/LICENSE
[ ] Per package license files

[x] License is OSI-approved: Apache-2.0
[x] License correctly listed in package.xmls

[x] picknik_reset_fault_controller: https://github.com/PickNikRobotics/picknik_controllers/blob/main/picknik_reset_fault_controller/package.xml#L11
[x] picknik_twist_controller: https://github.com/PickNikRobotics/picknik_controllers/blob/main/picknik_twist_controller/package.xml#L8

[x] Public source repo: https://github.com/PickNikRobotics/picknik_controllers/tree/main
[x] Source repository contains ROS packages and each package meets REP-144 naming conventions

[x] picknik_reset_fault_controller
[x] picknik_twist_controller

Unclear in that there were no existing examples of how to create a source entry for your repository. and still have the names of the packages in the pull request to discuss. So I added them here but maybe they were only meant to be discussed in the pull request comments not actually in the code.

Thanks for sharing this feedback. The process here is still developing and so the feedback definitely helps us improve things. When reviewing new packages for inclusion in ROS distributions we get most of the information, including package names and license info, from the source repository linked. It definitely helps to see it in the PR description as it let's us know that the submitter has considered whether their package meets these requirements explicitly which at least for me, makes the review more straightforward. In my wishlist are some added checks which can check the submitted source repository and collect this information in an automated check to provide feedback immediately. Some repositories will have complicated licensing setups that require a human to confirm and REP-144 naming is not an automatable task but checking package sources and licenses and setting them in the PR somewhere is doable.


[BUG] Support for v12?

With all other modules off, Alpha Suit seems to not work on v12.331. If there are no plans for updates please let us know!

Hi. Tbh I didn't have plans to do it. And due to the fact that you are the first person who asked, looks like the module isn't very popular.
But. If you want to use it, I can update it. It will take some time, but it is possible.

I find it better than some alternatives that have more limited functionality. I suspect that the reason it is not popular is due to the name. After all these years of Foundry we still don't have a way to find and filter modules. People mostly search by name by typing something they want. "Alpha Suit" doesn't indicate anything of what the module does.

I think, you are right. Maybe it's a good time to split them. It can be a complex task due to high reuse of code base. But doable. I will try to start updating next week

Awesome!On Oct 13, 2024 01:55, Averrin @.***> wrote:
I think, you are right. Maybe it's a good time to split them. It can be a complex task due to high reuse of code base. But doable. I will try to start updating next week
—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: @.***>


Theme submission: Hugowind

Theme submission
Please make sure that you have read the theme submission guidelines before submitting a theme. The guidelines provide all relevant information and requirements that have to be fulfilled before the submission. Please tick the relevant boxes for your theme in the checklist below:
Link to my theme repository: https://github.com/ianrodrigues/hugowind
I made sure that...

[x] the repository contains a good README.md describing my theme
[x] an open source license has been added to LICENSE.md
[x] all metadata have been added to theme.toml
[x] screenshots have been added in the images/ folder with the required dimensions
[x] in case I'm using a customized demo via the exampleSite folder that

[x] https://example.com is set as base url in exampleSite/config.{toml, yaml, json} to avoid the abuse of unused domains
[x] I tested that my theme's demo works with the content directory of gohugoio/HugoBasicExample

[x] I tested my theme against the gohugoio/HugoBasicExample

[x] I've checked the developer tools' console in my browser for error messages

[x] in case my theme is using Hugo Pipes features like toCSS and PostCSS that I have committed the /resources directory with all generated assets, for my theme to work in the basic version of Hugo

N.B. By submitting a theme to the Hugo Themes Showcase you understand that you need to maintain your theme. You will need to keep an eye on whether your theme's demo generates on the Hugo website, whenever there is a new release. We are a very small team and we just cannot keep up opening issues in the various theme repositories to notify authors. Whenever a theme demo breaks and remains broken then at some point it will be removed from the list without prior warning. If you no longer wish to maintain a theme please let us know.
New themes will usually be promoted on Hugo's official Twitter account. If you would like to be mentioned in the tweet please add your Twitter username to this submission.
Link to my Twitter account (optional): https://twitter.com/ianrdgs
Feel free to ask questions. We're glad to help.

Hello Ian,
thanks for your theme submission. While reviewing your theme I found a small issue:
By default all theme demos use the demo content provided by the hugoBasicExample which includes an about page. Hugowind is displaying all kind of pages on the homepage as blog posts. To exclude pages like the aforementioned about page Hugo provides a way to filter the content using the mainSections variable. This array contains all content types (think folders) that have the most content files, excluding the about page(s) to be few in numbers compared to blog posts. Therefore, I suggest to apply this small content filter.

One other issue: according to the title of this thread, the provided screenshots under /images and the name of the theme repository it is called hugowing while the headline of your README and the [theme.toml](https://github.com/ianrodrigues/hugowind/blob/master/theme.toml#L1) is called Tailwind Simple Blog.
This inconsistency can be confusing for theme users.

Thanks @digitalcraftsman , I'm going to address those issues this week.

Ping me when you're ready to proceed.

Done, @digitalcraftsman !

While looking at your theme I noticed that all blog posts are shown on every pagination page (those with an url like /,  /page/2,  /page/3). This is because on every paginated page you're iterating over all content files whose kind is in site.Params.mainSections. But the list of content files returned by the where-filter have to be paginated with .Paginate.


fix: 2295: extremely ambiguous error when attempting Labeling

support import task list csv/txt like json

Hi @makseq not sure if this is the approach you want but this will resolve the issue reported the user


Unable to find CollectionSelector()

Running this portion from the Slow Start breakdown:
collection_selector = quest.util.CollectionSelector()
pn.Row(collection_selector)
produces this error:
AttributeError                            Traceback (most recent call last)
 in
----> 1 collection_selector = quest.util.CollectionSelector()
2 pn.Row(collection_selector)
AttributeError: module 'quest.util' has no attribute 'CollectionSelector'
Looking through the quest.util doc, it looks like all other Selector methods are there except for CollectionSelector. Please help with this issue.

The CollectionSelector is relatively new and is only available in Quest version 3.1.0 or greater. Currently the conda package for that version is only available on the erdc channel.
To get the latest version of quest from the erdc channel run the following command:
conda install -c erdc  -c conda-forge quest

Please let me know if you are still getting this error after ensuring you have the latest version of Quest.

That did the trick! Thanks for the quick reply.


[Cherry-Pick] Horizontal Gallery left/right button height fixed (#1285)

fix  bug-2674356

Change files

Verified that the chevrons look correct now. Still nothing happens on click though.

Verified that the chevrons look correct now. Still nothing happens on click though.

Click not working is a separate issue - https://skype.visualstudio.com/SPOOL/_queries/edit/2674355/ working on that right now.


Memory leak when switching between views

When Switching between Tabs / Views, the used memory is increased by 0.3-0.7 MB each switch.
This happens also, when the app content (ion-content) is completely blank and all functionalities within controller.js/app.js are commented out.
Ionic Version: 1.2.4
Cordova version<EMAIL_ADDRESS>Browser & Operating System: iOS
Run ionic info from terminal/cmd prompt:
ionic info

Your system information:

Cordova CLI: 6.0.0
Gulp version:  CLI version 3.9.1
Gulp local:   Local version 3.9.1
Ionic Version: 1.2.4
Ionic CLI Version: 1.7.14
Ionic App Lib Version: 0.7.0
ios-deploy version: Not installed
ios-sim version: 5.0.6
OS: Mac OS X El Capitan
Node Version: v0.12.7
Xcode version: Xcode 7.2.1 Build version 7C1002

Hello! Thanks for opening an issue with us, we just need a little more info from you so that we can better help you with your issue. Would you mind posting a code sample, plunkr or codepen that we can use to reproduce your issue? Also, would you mind running ionic info and posting the output? Thanks again!

Hi
ionic info output is already in my previous post.
As an example you can just take an empty ionic app with tab navigation... When switching around through the views, the memory just increases
Thanks

@pyroon, will have to do some testing of my own, Thanks! Are you using chrome dev tools to inspect memory usage?

Yes, but you can see it best when running the app on the iOS simulator (e.g. ipad simulator) and inspecting the memory usage with xcode.

@pyroon Are you using any external libraries?

I use some plugins like those:
"com.telerik.plugins.wkwebview": {             "WKWEBVIEW_SERVER_PORT": "12344",             "PACKAGE_NAME": "ch.codeflair.floormanager"         },         "cordova-plugin-console": {             "PACKAGE_NAME": "ch.codeflair.floormanager"         },         "cordova-plugin-device": {             "PACKAGE_NAME": "ch.codeflair.floormanager"         },         "cordova-plugin-network-information": {             "PACKAGE_NAME": "ch.codeflair.floormanager"         },         "cordova-plugin-webserver": {             "PACKAGE_NAME": "ch.codeflair.floormanager"         },         "ionic-plugin-keyboard": {             "PACKAGE_NAME": "ch.codeflair.floormanager"         }
additionally, I'm using ng-websocket

Hi @pyroon,
Can you provide a codepen to recreate this?  Let's try to limit external dependencies so we can determine if this is an Ionic issue or a cordova issue.
Thanks,
Dan

Hi
I think I found the issue. It's related to ng-repeat (https://github.com/angular/angular.js/issues/11169)
Cheers

@pyroon so are you not having the memory leak anymore? Also if you can, could your provide a plunkr or codepen that demonstrates this issue? Thanks!

Hi
we still have memory issues, but it looks like it's related to the angular ng-repeat memory problem. So no need to go more in detail for ionic. I think switching to ionic 2 asap would help to resolve this issue as the bug is fixed in angular 2
Cheers

@pyroon sounds good then! Thanks for using ionic!

@jgw96 @pyroon is this problem resolved ? it still exists on<EMAIL_ADDRESS>

Seems to be an angular and not ionic issue @dig1234


Update critical-impact-accounts.md

@alexbuckgit : Thanks for your contribution! The author(s) have been notified to review your proposed change.


Alamofire doesn't catch error the error

I'm using Alamofire to get data from my server. However, it doesn't catch the error, as the error returned is nil. I've tested with AFNetworking, and it works fine. For both operation, the status code returned is 401 Unauthorized .
I'm using GrapeAPI for my backend. All it does is just to return the error on fail request
GrapeAPI
error!('Unauthorized', 401)

AFNetworking
manager.GET("someUrl", parameters: nil, success: { (_, object) in

        }, failure: { (operation, error) in
            // These are the outputs. I'm not assigning any values
            // error.localizedDescription = "Request failed: unauthorized (401)"
            // statusCode = 401
        })

Alamofire
Alamofire.request(.GET, "url", parameters: nil)
        .response { (a,b,data,error) in
        // These are the outputs. I'm not assigning any values
        // error = nil
        // data = {"error":"Unauthorized"}
        // statusCode = 401
        }

I can check the failure using the statusCode. But I prefer to check the error object instead. However, since the error is nil in Alamofire, it's quite confusing to check whether the request has failed or not. Posted in Stackoverflow since it might be my code. But I wonder if this a bug?

@cnoon can correct me if I'm wrong, but I believe this is due to the fact that Alamofire doesn't do any validation of response codes by default. To enable it, call .validate() as part of your request call chain. See the Alamofire docs to know more. However, the error returned by .validate() isn't nearly as nice as the one from AFNetworking, but that may change in 1.3. See #447.

Thanks @jshier. Mattt said the same thing, which is to call .validate() before my response(). However, I wonder why this behaviour is not by default in Alamofire since it works fine with AFNetworking. And yes, the error returned by .validate() isn't really helpful too.
Anyway, thanks for clarifying the issue. Would be great if someone could explain or point me to the documentation explaining the reasoning behind the current design. Otherwise, feel free to close this issue :)

Thanks for helping out @jshier.
To start @alienxp03, let me give a bit of background. Alamofire was not designed to be a Swift port of AFNetworking. It was designed to be a new Swift approach to networking in general. Things like method chaining, powerful enumerations and generics were not possible when AFNetworking was built. Therefore, we can create MANY new design patterns making Alamofire much easier to use. Please do not expect Alamofire to work exactly as AFNetworking. The two are VERY different libraries.
With that said, you have an interesting PoV here @alienxp03. Why do you feel that a 401 should automatically trigger an error? Apple doesn't trigger an error for a 401, why should Alamofire? As @jshier mentioned, this is why the validation methods exist. It allows you, the user, to customize the behavior of all possible status codes. In certain cases, a 401 may mean there was a basic auth issue, or possibly a server call that was making an unauthorized request to another service. There are endless amounts of situations where a 401 could mean different things. In certain cases, it isn't even actually an error to the client. This is why we don't automatically generate errors at the Alamofire level. We require the user to tell us what the error conditions are. Does that make sense?
Now, to your last point that the validation error that is returned is not super helpful. I agree that it could be better, but it is still enough for you to know that you didn't pass validation. You can then check the status code to see why it failed validation if you like. In the Alamofire 2.0 release, we are going to be reworking all the error handling logic to accommodate the Swift 2.0 changes as well as make cases like this a bit easier to diagnose.
Hopefully that helps clear up any confusion. Cheers 🍻

Thanks for the explanation @cnoon. That helps a lot :)

Issue #447 is a feature request for improving the Validator to support better and customizable errors.

@cnoon I don't think that 401 should be treated by error, because it prevents the app to detect Basic Auth failed login attempt.
But why currently in Alamofire it IS tread as an error? — #1031


[VL] Refine memory changes logic when growCapacity

What changes were proposed in this pull request?
Changes:

add new config spark.gluten.sql.columnar.backend.velox.memInitCapacity to reduce memory arbitration times, default value is 0M.
set memoryPoolTransferCapacity_ with spark.gluten.memory.reservationBlockSize, move reservation computation logic from SparkAllocationListener to Arbitrator.
refactor backend-wise config usage.

/Benchmark Velox

/Benchmark Velox


Cannot use :global() in scoped style in nesting rules like SCSS

Vue version
3.4.19
Link to minimal reproduction
https://stackblitz.com/edit/vitejs-ts-scss-63q1ja?file=src%2FApp.vue
Steps to reproduce
Write a DOM structure like

    I am in red!

        I am in blue!

Without :global()

Result:

The first line is in red and the second line is in blue, it is right.
If with :global()

What is expected?
Expect to render same as above.

.foo {
    color: red;
}

.foo .bar {
    color: blue;
}

What is actually happening?
Result:

Both two line is in blue.
This is because it was render to
.foo {
    color: red;
}

.foo {
    color: blue;
}

instead of
.foo {
    color: red;
}

.foo .bar {
    color: blue;
}

System Info
System:
    OS: Windows 11 10.0.22631
    CPU: (8) x64 Intel(R) Core(TM) i5-10210U CPU @ 1.60GHz
    Memory: 1.61 GB / 11.80 GB
  Binaries:
    Node: 20.6.1 - D:\Program Files\nodejs\node.EXE
    Yarn: 1.22.17 - ~\AppData\Roaming\npm\yarn.CMD
    npm: 10.2.5 - D:\Program Files\nodejs\npm.CMD
    pnpm: 7.26.3 - ~\AppData\Roaming\npm\pnpm.CMD
  Browsers:
    Edge: Chromium (121.0.2277.112)
    Internet Explorer: 11.0.22621.1

Any additional comments?
I know the correct syntax is
:global(.foo) {
    color: red;
}

:global(.foo .bar) {
    color: blue;
}

:global(.foo .bar .baz) {
    // something others
}

However if you use with SCSS/Less/... to writing nesting rules, this will be very troublesome.

This is expected behavior - see https://github.com/vuejs/core/pull/10436#issuecomment-2067417099 and https://github.com/vuejs/core/pull/10436#issuecomment-2222422063.
If you have a lot of global styles, just use a separate


[8.x] Corrected code comment for carry() function

This is a very small code comment correction.  I've been reading through the whole application and framework line by line as they are executed and found this little gem.

It helps keep my three line cascading comments 🤷


pkg_resources.ResolutionError

Traceback (most recent call last):
File "/usr/local/bin/compp", line 4, in
import('pkg_resources').run_script('ComPP==1.0.5', 'compp')
File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 651, in run_script
self.require(requires)[0].run_script(script_name, ns)
File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 1436, in run_script
raise ResolutionError(
pkg_resources.ResolutionError: Script 'scripts/compp' not found in metadata at '/home/kali/.local/lib/python3.9/site-packages/ComPP-1.0.5.dist-info'

Just remove the pip version and installed manual from github


Fix read capacity calculation and wait between scans

Related to #60
The current implementation of the usable read capacity has some issues and might lead to provisioned throughput exceptions.
The current implementation has two problems:

All items are treated as units of 8kb, although some items might be smaller or larger than 8kb. This leads to problems especially where items are larger than 8kb.
The current read capacity limit is effectively ignored, since the limit has a small impact on a single request, but there is no waiting period between requests. Therefore, the current implementation is solely bound by the available resources (most likely network) and is theoretically able to perform a full table backup within one second. Provisioned read capacity is however limited to a single second, therefore the new implementation will now wait until enough capacity is available again to proceed to the next scan request.

The new implementation solves these issues and will no longer exceed the requested limit. Exceptions to this case are tables that have a very low provisioned read capacity (e.g. 1), where the percentage limit has little effect and will result in an average consumption of 1 read capacity.
Backups might now take longer, but at least they respect the given read capacity.

Closed due to inactivity of repository.


Support for SDXL in ComfyUI_HelloMeme

Hi,
Does the ComfyUI_HelloMeme custom node support the SDXL-based model?
When I attempt to use it, I encounter a ValueError due to mismatched tensor sizes, which suggests a possible incompatibility with this model's architecture.
If it is not currently supported, are there plans to add support or any suggested workarounds?

The current version is still being optimized based on SD1.5 because it seems to have further room for improvement. Therefore, my next step will be to fully explore the potential of SD1.5 before training the SDXL version (which should be relatively quick).


Heed an LGTM alert

vy_eval wasn't being called with a context argument in one place
lgtm was complaining about a non-callable being called so I shut it up

Needs reformatting with Black

uh

Wait why'd it let it go through without passing all checks?

I think the branch protection rules don't require all checks to pass in order to merge; they only require 2 reviews. I'll change that.

would...

did :)


Model editor: Add links to model

🎉 New feature
Summary
This pull request adds a + menu button to the Component Inspector for adding links to models. Currently supports adding links consisting of simple shapes and lights.
The changes are written to the ECM and GUI side and assumes that GUI and server ECM synchronization (#1109) is available. Marked as draft until the newly added entities can be reflected on the server side.
Test it

launch ign gazebo with shapes.sdf world
Open the Model Editor GUI plugin by going to top right 3 dots menu and select Model Editor
Click on one of the shapes, e.g. box
Go the Component Inspect and you should see a new + button appear on the top bar
Click on the + button and select a link type to add, .e.g Cylinder
Once selected, a black cylinder should now appear at where the original box model is.

Checklist

[x] Signed all commits for DCO
[ ] Added tests
[ ] Added example and/or tutorial
[ ] Updated documentation (as needed)
[ ] Updated migration guide (as needed)
[ ] codecheck passed (See contributing)
[ ] All tests passed (See test coverage)
[ ] While waiting for a review on your PR, please help review another open pull request to support the maintainers

Note to maintainers: Remember to use Squash-Merge

Can the ModelEditor not be a plugin, but instead be built into the component inspector? It can still be a separate class that is instantiated by the ComponentInspector. The graphical interface for adding links is in the ComponentInspector, but right now a separate plugin has to be loaded in order to use the menu options.

One suggestion here: https://github.com/ignitionrobotics/ign-gazebo/pull/1176

Another suggestion in #1177.

One suggestion here: #1176

merged

Another suggestion in #1177.

merged

Adding an ellipsoid link doesn't seem to add the collision and visual elements in the entity tree.

fixed. 1c4f59c

Can the ModelEditor not be a plugin, but instead be built into the component inspector?

Merged Model Editor plugin into Component Inspector. 0ecc731

Adding a link to a model doesn't change the entity tree (I can't see the light in the entity tree). Is that expected?

Adding a link to a model doesn't change the entity tree (I can't see the light in the entity tree). Is that expected?

should be fixed in abb667d

Retargeting this to a model_editor branch. The model_editor branch can serve as model editor feature release branch.


conditionally create the application identity if one isn't passed

Azure is a bit different in how they manage "identities" for things like App Service and Function App.
Instead of creating a separate entity (like a service principal - or in AWS an IAM Role or GCP a Service Account), Azure allows you to bind permissions to the App Service entity itself.  It would be like instead of associating a role with permissions to an AWS lambda, you bind permission to the Lambda itself.
This has a few benefits, and one drawback.
Benefits:

We don't create an unnecessary external identity (and credentials) to manage
Permissions are literally bound to the thing that uses them (instead of an intermediary identity) which increases security
This is Azure's best-practice recommended way
Drawbacks
The entity is not re-usable (but this isn't a drawback for us at all - in fact it fits our model perfectly!)

The problem is (was?) that the application module always created an identity (in Azure that would be an Application + Service Principal).  This change makes it so the application identity creation is conditional depending on whether an identity is passed.  This way in Azure we can make the App Service first, pass the App Service ID as the identity, and get all the benefits of this powerful module.

Does azure app services use any of the policy binding in this module?

Closing this since it was supposed to merge into another branch.  We'll merge just the relevant changes into main.


Why sendMessage need pass an TBMessage Object?

I believe it would be much better if this had a more flexible and clear implementation.
I don't know much about programming, so I apologize in advance for my overuse of strings and possible bugs in the code, but here's an example idea to make the implementation clearer.
bool AsyncTelegramBot::sendTextMessage(int64_t chat_id, String text, String parse_mode = "Default", String entities = "", bool disable_web_page_preview = false, bool disable_notification = false, int32_t reply_to_message_id = 0, bool force_reply = false, bool allow_sending_without_reply = true, String reply_markup = "")
{
    if (!strlen(text.c_str()))
        return false;

    if (chat_id == 0)
        return false;

    DynamicJsonDocument root(BUFFER_BIG);
    // Backward compatibility
    root["chat_id"] = chat_id;
    root["text"] = text;

    if (parse_mode != "Default")
        if (parse_mode == "Markdown" || parse_mode == "MarkdownV2" || parse_mode == "HTML")
            root["parse_mode"] = parse_mode;

    if (disable_web_page_preview)
        root["disable_web_page_preview"] = disable_web_page_preview;

    if (disable_notification)
        root["disable_notification"] = disable_notification;

    if (reply_to_message_id != 0)
        root["reply_to_message_id"] = reply_to_message_id;

    if (allow_sending_without_reply)
        root["allow_sending_without_reply"] = allow_sending_without_reply;

    if (strlen(entities.c_str()))
    {
        StaticJsonDocument<BUFFER_MEDIUM> doc;
        deserializeJson(doc, entities);
        JsonObject myEntities = doc.as<JsonObject>();
        root["entities"] = myEntities;
    }

    if (strlen(reply_markup.c_str()) || force_reply)
    {
        StaticJsonDocument<BUFFER_MEDIUM> doc;
        deserializeJson(doc, reply_markup);
        JsonObject myKeyb = doc.as<JsonObject>();
        root["reply_markup"] = myKeyb;
        if (force_reply)
        {
            root["reply_markup"]["selective"] = true,
            root["reply_markup"]["force_reply"] = true;
        }
    }

    root.shrinkToFit();

    size_t len = measureJson(root);
    char payload[len];
    serializeJson(root, payload, len);

    debugJson(root, Serial);
    const bool result = sendCommand("sendMessage", payload);
    return result;
}

Hi @matheusbach
This mechanism originates from the fact that the library born with the principle of the "bot responding to the user" and not vice versa and therefore you need something to store all the information relating to the received message (user id, message text, type of message etc etc)
Subsequently, methods were also added for direct sending to a specific chat id (user or group) which obviously you must know in advance.
sendTo (const int64_t userid, const char * message, const char * keyboard = nullptr);
sendTo (const int64_t userid, const String & message, String keyboard = "");

Thanks for your suggestion, but in my opinion a function will be simpler with less parameters (even if there are default values) and all this kind of stuff it's already defined in the struct TBMessage and you can easily enable or disable only when really needed.
bool AsyncTelegramBot::sendTextMessage(int64_t chat_id, String text, String parse_mode = "Default", String entities = "", bool disable_web_page_preview = false, bool disable_notification = false, int32_t reply_to_message_id = 0, bool force_reply = false, bool allow_sending_without_reply = true, String reply_markup = "")
In this way, if for example you need only force_reply option, you have to pass also the others parameter otherwise compiler will not be able to find wich parameter you are trying to pass and something as
bot.sendTextMessage(123456789, "Hello World",  "Default", "", false, false, 0, true, true, "");

is less clear as this where you explicit declare what it's needed
TBMessage msg;
msg.force_reply = true;
msg.chatId = 123456789;
bot.sendMessage(msg, "Hello World");

It's just a point of view off course, but if you prefer your way, you could easily declare your own class derivated from AsyncTelegram2 and add or overload methods written in a style more comfortable respect to yours.
With the above function for example you should also set the method sendCommand as protected otherwise inherited class is not able to access the method.
From my side, I've already done it anyway in order to increase flexibility (will be in the next release, but edits are already online)
#include <AsyncTelegram2.h>

class myTelegramClass : AsyncTelegram2 {
  public:
    bool sendTextMessage(int64_t chat_id, String text, String parse_mode = "Default".......


Idea for app to show user best time to leave for destination

This is very close to an app I have always wanted and thought about trying to make. The one thing that is missing is the ability to gather data over time. The idea is I would like to take two points and through the times 4PM and 7PM for example leave the app running and have it gather the estimated time to travel each minute. At 7PM I would like the ability to see this information in a graph.
The main point is it would tell me between two periods of time what time is the best time to leave work.
It seems the app almost does this. It just needs a place to store the data and way to show the results.

That would be interesting! Sounds like a great way to extend the app.


generalize serial port configuration

We need to generalize serial port configuration (exposed as parameters) with appropriate defaults set per board.
For the most part these are hard coded, but with SYS_COMPANION (telem2) configurable. I'd like to extend that to all serial ports.

telem port x N
one or more GPS ports
generic (eg pixhawk serial 4/5)

Previous issue https://github.com/PX4/Firmware/pull/5184
TODO

each serial needs a configuration parameter, and likely a baudrate parameter.

SERIAL_X, SERIAL_X_BAUD

each board needs to specify the available serial ports and set appropriate defaults

ie telem 1 = mavlink normal at 57600, etc

PX4 modules (drivers) need to register themselves in this configuration list

https://github.com/PX4/Firmware/pull/8826

Thinking about this some more, I'm now considering placing the burden of configuration on each Driver/Module itself.
I don't see how we could handle configuration per serial port without maintaining large lists of every possible option. This starts to fall apart when you think about boards that only include a subset of Drivers, custom configurations, deleting old drivers, or vendor proprietary extensions.
The downside is PX4 itself would need to deconflict serial port usage. I think this is relatively easy to do if we use the Driver base class for serial devices as well.

For the board manifest we need to know.

which serial ports are available to the system
if some need to be hard coded (eg px4io)
default functionality that isn't hard coded (eg mavlink on telem2)

GPS

GPS1 serial port (per board default)
GPS2 serial port (per board default)

Mavlink

parameters for each instance (need a general solution? https://github.com/PX4/Firmware/issues/8821)

Serial port drivers standard configuration

port
baud

misc

frsky
crazyflie
iridium

How about this:
We add a script to generate params.c for N uarts (configured driver, baud, mavlink mode, ... params) and the necessary romfs code to start the corresponding drivers:

UART mapping: the script contains a per-board mapping from TELEM1, GPS1, ... to /dev/ttySx, and the params apply to the former: e.g. UART_TELEM1_BAUD, UART_GPS1_BAUD. The per-board config can also be pulled out into separate config files or the cmake config.
a user can easily specify per UART what to run, and the mapping makes it easy to know which UART it is (it matches the label on the board).
no conflicts: you specify what to run on a port, so you cannot run multiple things on a single port
hardcoded UARTs such as px4io are not included
the script contains a list of drivers that includes the required romfs startup command.
adding a new device is simple: just add a list entry to the script (device name & startup command) (or we can create a separate config file for that).
no/minimal code changes needed
generated romfs code can be kept small by using a while loop
To pass the params to the driver via CLI, we could use: set BAUD=`param show UART_X_BAUD` . But unfortunately this requires a tmpfs which we don't have. Alternatively we can do it as the pwm command does: -b p:<PARAM_NAME>, thus requiring only minimal code changes.

potential downsides:

QGC metadata is static (more or less), thus all existing drivers will be in the dropdown list. Though the script could easily handle this by excluding certain entries depending on the board. But the QGC default param XML must include all possible configs and UARTs. In both cases the user will only see the params for UARTs that the board actually has.
adding a new device requires editing a file at a specific location. It will require good documentation, then it's not an issue.

@bkueng that's what I wanted to do initially, but I see various issues with either maintaining lists of all possible serial drivers (+ range of configurations) or generating that list (parameter stability). Splitting baudrate helps, but there's more than that. You can end up with a large number of options that aren't possible or relevant for the specific build you're using. The other problem is that our init scripts are currently a bad way to handle this as they aren't even used on many platforms (or many custom nuttx configurations for that matter). We already have many frustrating configuration holes where active parameters shown to the user don't do anything.
What I was wondering about was pushing the configuration to each module as parameters plus special parameter types for specifying the port. Eventually we could have QGC collect all of these (imagine a board graphic where you click on each port) and let you select the configuration per port.
Pros

keeps everything modular and scalable across a wide range of configurations and setups (both upstream and custom)
users will only ever see relevant parameters for the specific setup they're connected to
works well in custom deployments that may add additional drivers and remove many of the existing options
avoid disconnect between command line arguments and parameters. Configuration via command is effectively inaccessible to most users. Init script level configuration has proven to be brittle for us.

Cons

requires more effort
getting to a centralized per UART configuration view in QGC requires much more work than a per UART param
likely need (or would prefer) a concept of parameter instances (eg configure mavlink 0, 1, 2, etc)

I'm sure you've through all this through ...

For docs would be good if the solution allows us to (easily) generate mappings of board -> driver -> port mappings. Ie  as previously discussed, be able to autogenerate list all sensors, and list the default port where they should be connected. Ultimately I would like what is actually available and tested to drive our peripherals docs.
It should be very difficult to accidentally try run multiple things on the same port.

@dagar I agree, my proposal aims to be simple, user-friendly and implementable, not necessarily the best in the long-term (though it would allow for a QGC board graphic too). And I would prefer a solution where each module specifies its own configuration as well. But the current situation is already limiting for various users/use cases, among which:

dual GPS
frsky telemetry
RTPS
on which port to run a sensor driver
the omnibus board has only a limited amount of UARTs and thus a user needs the ability to decide what to run and where
newer boards such as the pixhawk pro and pixhawk 4 come with an additional UART port which is currently not configurable

And given that this issue has been long standing, we should aim for something that actually gets implemented sometime soon.

The other problem is that our init scripts are currently a bad way to handle this as they aren't even used on many platforms (or many custom nuttx configurations for that matter). We already have many frustrating configuration holes where active parameters shown to the user don't do anything.

I'm still for the posix shell, which would fundamentally solve this.
@hamishwillee agreed with all points. For the first one: you would be able to run every driver on any of the available UART ports, thus having maximum flexibility.

Distance sensors should all definitely share the same approach (whatever it is), if only so that setup instructions can all be harmonised.
You both talk about this mysterious implementer - who is that likely to be?
Is there any docs on the posix shell solution? - just FMI (I'm interested on what this is, why this solves the problem, and why we don't use it). I fill like I'm missing an in-joke. If this is too much effort to point me to, don't worry about it.

You both talk about this mysterious implementer - who is that likely to be?

Is there any docs on the posix shell solution? - just FMI (I'm interested on what this is, why this solves the problem, and why we don't use it). I fill like I'm missing an in-joke. If this is too much effort to point me to, don't worry about it.

It's a feature that so far has not been finished (https://github.com/PX4/Firmware/pull/5162). Basically it would allow us to use the NuttX startup scripts also on Linux.

Idea for doing the configuration per module.

each module or driver has a set of parameters for each possible instance

MAV_PORT_X, MAV_BAUD_X, etc

parameters that specify ports have a new serial device metadata tag

QGC collects all active serial device parameters and creates a configuration drop down per serial port

PX4 side we extend the driver/Device base class to have a serial type prevents duplication
each module/driver automatically registers itself for startup (eg mavlink start could be responsible for starting all instances based on MAV_* param configuration)

Does this solution leave anything unresolved?


please update the hybrid version to the latest one

Can you please update to "hybridauth/hybridauth"  to the latest version?

The master branch is for cake 3.x not 2.x. I'll update the cake2 branch and make a new cake 2.x compatible release.


rendercomplete event

Hi, the rendercomplete event would be useful to be exposed.
I'm looking for a way to make sure that map is finished loading and rendering, and I was thinking that the 'rendercomplete' event might be the solution.

#12 created, feel free to comment and suggest improvements, I'm not sure if everything is done by the book but at least I got it to do what I wanted

Implemented via #13, available in Release 1.2.0


[BAD] Add quick installation demo video and synchronize doc and video

Signed-off-by: Meg McRoberts<EMAIL_ADDRESS>This PR is replaced by https://github.com/keptn/keptn.github.io/pull/1393 .

Add link to @agardnerIT 's video of a simple installation
Update and sync docs with video.  Two goals:

Ensure that the video and doc do not contradict each other.  Docs have far more info than video and that is fine, just do not want contradictions
Ensure that all commands used in the video are in the docs for easy copy/paste

Additional work is needed for these pages, including:

Revise/rework instructions beyond Control Plane installation.  I changed the header levels of these sections to correct the structure but did not revise contents.
Improve flow between this page and multi-cluster.  This includes using the explanation of Control Plane and Execution Plane that is currently in multi-cluster into helm-service and perhaps removing instructions for installing Control Plane from the multi-cluster page since I think that process is exactly the same.
Reference values.yaml reference page when it is merged and discuss modifying that file along with info about the --set flag

https://github.com/keptn/keptn.github.io/issues/1370

This PR is hopelessly corrupted so will be closed.  The content has been moved to https://github.com/keptn/keptn.github.io/pull/1393 .


Make error and fatal entry points only take StaticString

Dynamically generating these causes all kinds of problems with error deduplication, so we should just force them to be static.
I'm not totally clear if this is also doable in Kotlin but if it is, we should do it on Android as well.

It might also be nice, as part of this, to have SOME way to associate some dynamic text with the error as an additional field (just not affecting the main error text used for deduplication)


core: docstrings utils update

Added missed docstrings. Formatted docstrings to the consistent form.

@eyurtsev Thanks!


Run tests improvements

-- kill multi-config support in run_tests.py (we weren't using it for anything and it was making the code more complicated)
-- a bit of cleanup in run_tests.py
-- cleanup the concept of "language.make_options()"
-- add support for switching compilers based on --compiler cmdline arg (and introduce some checking to make sure it behaves as expected with/without docker).
-- added Dockerfiles that support gcc4.4 (debian squeeze) and gcc5.3 (ubuntu 16.04).
-- C tests currently pass with gcc5.3 and there is a failure with gcc4.4

Seems green enough.


where can I get offline image converter tool for v5.3?

I cannot find the url.
thinks

It is in the lv_utils repo.

We use GitHub Issues for development related discussions.
Please ask your question in the Forum. You can simply log in with your GitHub account too.


cni should handler unmont volume, when delete pod.

Bug fixes

cni should handler unmont volume, when delete pod.

One more thing, please execute git rebase xxx and go mod tidy.


schoolshooting

Operation System and Version:
SAFE Browser Version:
Network: <Testnet, Alpha, Mock>
Description:
Steps to reproduce: <Please be as detailed as possible here, include a link if you have an example on the network.>

doorlockdown.com new device  to enhance lock down procedure

Anyone that has come upon this issue, please do not navigate to the url posted above since it has been flagged for phishing.


If the guide button isn't pressed it shouldn't prevent the "home" button on the interface to work

If the guide button isn't pressed it should not prevent the "home" button on the interface to work correctly.

I'm writing a PR to accomodate that, and I also added some other things which you can understand, and then see if it suits you


Add automated documentation generation

At the moment, the project's documentation is limited to what is in the README, and a short note about filtering limitation in docs/. It would be nice if there was more complete documentation generated automatically: a full API reference, with links back to the source code, based on the Flow types (or JSDoc).
Ideally this would be generating Markdown so it can be versioned with the code in Git/GitHub.
Tools to consider & useful info:

https://github.com/documentationjs/documentation
https://github.com/esdoc/esdoc
https://survivejs.com/maintenance/documentation/readme/
https://survivejs.com/maintenance/documentation/api/

Hi,
I am a professional technical writer and am eager to contribute to my first Github project.
I keep seeing JSDoc being discussed for similar projects, so I think that sounds as good as any solution.  Would you like me to help?

Ryan

Hey @rjseymour66, thank you for offering your help! Someone else has already had a shot at this (#26), so I think I'll go with their implementation.
Generally JSDoc would be a very good fit for such use case, but here the project already has annotations with Flow so it would be even better if the documentation generator used these.


IS THIS BUG? =>  conflict click with keyboardShouldPersistTaps(android only)

Hi, with IOS, only 1 click to select user from mentionView, but in Android, i need to click 3 times, can u help? I dont know why, please see the below video:
https://user-images.githubusercontent.com/8202437/185751258-48219e9e-f569-46a4-a61d-37baf391d907.mov

@dabakovich can u take a look?

@imhazige i need to put keyboardShouldPersistTaps inside mentionView scroll

Hey, @fukemy,
Thank you, but I did not find any scoll view in the source code, are you  using version 3?

hi, i am using version 3 to avoid using MentionInput directly. About scrollView u can go to the source code to find it.
For example, wrap this line by scrollView:
https://github.com/dabakovich/react-native-controlled-mentions/blob/8b286da2bec38ee3a02f7239af474a6e46708ad3/src/components/mention-input.tsx#L129-L136

Hey, @fukemy
Thank you so much, it is keyboardShouldPersistTaps problem.
Actually I also need render the suggestion outside the input, I made a workaround based on v2
renderSuggestions: ({ keyword, onSuggestionPress }) => {
                  // can not use the library's ui, android bug: will have @ as keyword
                  if (keyword === mentionKeyworkRef.current || keyword === '@')
                    return;
                  // undefined mean no @ typed
                  mentionKeyworkRef.current = keyword;
                  onSuggestionPressRef.current = onSuggestionPress;
                  setShowMention(keyword !== undefined);

                  return null;
                }

good job bro


Sunspotter improvement

Oh boy, this is a big one.
Adds a lot of functionalities, mostly related to querying the Sunspotter dataset.

Hello @Raahul-Singh! Thanks for opening this PR.

In the file pythia/seo/sunspotter.py:

Line 12:101: E501 line too long (113 > 100 characters)
Line 13:101: E501 line too long (107 > 100 characters)
Line 13:108: W291 trailing whitespace
Line 71:45: E128 continuation line under-indented for visual indent
Line 74:45: E128 continuation line under-indented for visual indent
Line 75:45: E128 continuation line under-indented for visual indent
Line 97:45: E128 continuation line under-indented for visual indent
Line 100:45: E128 continuation line under-indented for visual indent
Line 101:45: E128 continuation line under-indented for visual indent
Line 177:55: W291 trailing whitespace
Line 267:46: E203 whitespace before ':'

In the file pythia/seo/tests/test_sunspotter.py:

Line 169:25: E128 continuation line under-indented for visual indent
Line 180:86: E201 whitespace after '['
Line 180:89: E241 multiple spaces after ','
Line 180:93: E241 multiple spaces after ','
Line 180:97: E241 multiple spaces after ','
Line 180:101: E501 line too long (118 > 100 characters)

Do see the Hitchhiker's guide to code style

I'm merging this as soon as the CI passes as I need it for writing the blogpost. :sweat_smile:


feat: ids token validation extension

Extended token validation
Issue: https://github.com/eclipse-dataspaceconnector/DataSpaceConnector/issues/380

Adds additional IDS specific token validation as extension.
Extends the Oauth2ValidationRule.
Setting option to enable or disable the referringconnector-validation.
Introduces the possibility to retrieve a boolean setting via SettingResolver/Config.
Changes passing the complete JWT to the validations to also keep IDS specific claims for the validations.
Introduces additional map for verifyJwtToken to be able to forward additional information to the validations, which are not part of the token (e.g. part of incoming IDS message to validate contents of the IDS message with the token content).

Hi, thanks for the contribution and really clear PR summary!
TokenValidation should be written as a ValidationRule and plugged in as an extension into the OAuth2IdentityServiceImpl. This is because we want to ensure the IDS layer can continue to work with a distributed identity system that may not be aware of or require those specific claims.
Doing so would also avoid having to wrap the IdentityService.
Does that make sense?

@jimmarino @ndr-brt
Please review again, have now built it as an extension.

will rebase it on the new structure

Codecov Report

Merging #625 (dd79180) into main (2edeb9f) will increase coverage by 0.00%.
The diff coverage is 67.32%.

@@            Coverage Diff            @@
##               main     #625   +/-   ##
=========================================
  Coverage     56.17%   56.17%
- Complexity     2069     2081   +12
=========================================
  Files           584      587    +3
  Lines         12913    12968   +55
  Branches        916      924    +8
=========================================
+ Hits           7254     7285   +31
- Misses         5250     5269   +19
- Partials        409      414    +5

Impacted Files
Coverage Δ

...validation/IdsTokenValidationServiceExtension.java
0.00% <0.00%> (ø)

...e/api/validation/RemoteTokenValidationService.java
0.00% <ø> (ø)

...nnector/identity/DecentralizedIdentityService.java
75.67% <ø> (ø)

...paceconnector/iam/oauth2/core/Oauth2Extension.java
0.00% <0.00%> (ø)

...se/dataspaceconnector/spi/iam/IdentityService.java
0.00% <0.00%> (ø)

...dataspaceconnector/spi/system/SettingResolver.java
0.00% <0.00%> (ø)

.../api/multipart/controller/MultipartController.java
59.25% <54.54%> (+3.25%)
:arrow_up:

...r/ids/token/validation/rule/IdsValidationRule.java
56.00% <56.00%> (ø)

...or/iam/oauth2/core/identity/Oauth2ServiceImpl.java
22.91% <57.14%> (-4.75%)
:arrow_down:

...connector/spi/system/configuration/ConfigImpl.java
91.52% <80.00%> (-2.71%)
:arrow_down:

... and 8 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2edeb9f...dd79180. Read the comment docs.

ready for review again

@jimmarino @paullatzelsperger Any veto? There are already two independent approvals, so we could merged this.


Added correct timestamp management in replay

Fixes #3307.

request doesn't exist in this context - I think you are looking for f.request?


Add HTTPS/TLS support to the auth proxy

Proposed changes
As #2397 is large and needs some significant changes from the agent's perspective, this PR separates out the changes to the auth proxy, which add the HTTPS support, but not (public-facing) support for client certificates, in an attempt to make some progress in merging the changes. Internally, all the support for certificate authentication exists, and the unit tests use this, but the built mapper will be unchanged apart from using HTTPS to serve the API.
Types of changes

[ ] Bugfix (non-breaking change which fixes an issue)
[x] New feature (non-breaking change which adds functionality)
[ ] Improvement (general improvements like code refactoring that doesn't explicitly fix a bug or add any new functionality)
[ ] Documentation Update (if none of the other choices apply)
[ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)

Paste Link to the issue

Checklist

[x] I have read the CONTRIBUTING doc
[x] I have signed the CLA (in all commits with git commit -s)
[x] I ran cargo fmt as mentioned in CODING_GUIDELINES
[x] I used cargo clippy as mentioned in CODING_GUIDELINES
[x] I have added tests that prove my fix is effective or that my feature works
[ ] I have added necessary documentation (if appropriate)

Further comments

@jarhodes314 is the file transfer http service? Or are going to address that part in a different PR?

Not currently, although I should probably move some of the logic out of the auth proxy crate so it can be re-used there. Aside from some minor tweaks, this doesn’t contain anything new compared to #2397, it’s just a subset of that that should make merging the work less painful.

* `curl http://<IP_ADDRESS>:8001/c8y/inventory/managedObjects` leads to a weird error `curl: (1) Received HTTP/0.9 when not allowed`. Minor, but it would be good to serve a 404 not found on all HTTP requests.

Should this be a 404, or should it be a 302 (temporary redirect) with the https URL in the location header? If we do want a redirect, I think 302 makes most sense, as there's no guarantee the HTTPS won't later be disabled (and if an application caches a 301, this can be really quite annoying to reverse).

* `curl http://<IP_ADDRESS>:8001/c8y/inventory/managedObjects` leads to a weird error `curl: (1) Received HTTP/0.9 when not allowed`. Minor, but it would be good to serve a 404 not found on all HTTP requests.

Should this be a 404, or should it be a 302 (temporary redirect) with the https URL in the location header? If we do want a redirect, I think 302 makes most sense, as there's no guarantee the HTTPS won't later be disabled (and if an application caches a 301, this can be really quite annoying to reverse).

Indeed, a 302 redirect from HTTP to HTTPS might be more appropriate.

In order to avoid all these annoying typos warning in the cert and private key files, you can add them to https://github.com/thin-edge/thin-edge.io/blob/main/.typos.toml#L9

I observed an issue. Am I missing something?
The mapper being configured to enforce certificate-based client authentication and the agent being given a local certificate, I cannot install a software which has to be downloaded form c8y:
2023-11-16T09:08:21.343290588Z ERROR plugin_sm::plugin: Download error: DownloadError {
    reason: "Could not make a successful request to the remote server",
    url: "https://<IP_ADDRESS>:8001/c8y/inventory/binaries/367251",
    source_err: "error sending request for url (https://<IP_ADDRESS>:8001/c8y/inventory/binaries/367251): error trying to connect: invalid peer certificate: Other(CaUsedAsEndEntity)",

I set the following tedge config settings:
$ tedge config get c8y.proxy.cert_path
/etc/tedge/device-local-certs/demo-device-777.pem
$ tedge config get c8y.proxy.key_path
/etc/tedge/device-local-certs/demo-device-777.key
$ tedge config get c8y.proxy.ca_path
/etc/tedge/device-local-certs/roots
$ tedge config get http.client.auth.cert_file
/etc/tedge/device-local-certs/demo-device-007.pem
$ tedge config get http.client.auth.key_file
/etc/tedge/device-local-certs/demo-device-007.key

Note that curl works fine when given the same certificate is given to authenticate the client. i.e. the certificate is trusted by c8y_auth_proxy.

I confirm that this is nicely working. The settings is simply not obvious.
Things, I missed during my first testing session:

The certificate that authenticates the auth proxy (c8y.proxy.cert_path) must not be a signed certificate and must have a CN that is the hostname used to access the auth proxy.  subjectAltName must include this hostname.
c8y.proxy.client.host must be set to the auth proxy hostname aka its CN
The signing certificate of the auth proxy must be added to /etc/ssl/certs of the clients
The signing certificate of the clients must be added to /etc/ssl/certs of the auth proxy.
Proper keyUsage and extendedKeyUsage must be attached to the key (at least keyAgreement for the proxy, and clientAuth for the clients).

I will create a ticket to document these steps.