Allow a custom HttpMessageHandler to support overriding the verification of Self-Signed SSL certificates.

With the V2 client now using the latest framework it is possible to override the HttpMessageHandler and override self-signed certificate checking.
	var handler = new HttpClientHandler();
	handler.ClientCertificateOptions = ClientCertificateOption.Manual;
	handler.ServerCertificateCustomValidationCallback += DangerousAcceptAnyServerCertificateValidator;

	_client = new DocumentClient(new Uri(_documentDbOptions.Endpoint), _documentDbOptions.Key, handler);

However with the V3 client, there is no ability to do this.
Can we look for a suitable way to do this?
Self-Signed certification verification overrides are required when running on Linux clients that wish to connect to the emulator. Despite all of the good work that has been done with the emulator such as allowing you to specify the alternative subject names for the self-signed certificate and export it, there are still limitations. I've found that the Linux implementation of .NET core that uses cURL/OpenSSL will still error with a self-signed certificate, even if you install it into the ca-certificates store. (Windows will honor the certificate if you put it into the Trusted Certificate Authorities store).
It would be preferable to use the V3 SDK rather than the V2.

I'm having a look through the source code to see how this might be done.
Initially, it looks difficult. The example above uses the HttpClientHandler which derives from the abstract HttpMessageHandler. The Cosmos DB client framework uses a different derivative, HttpRequestMessageHandler which derives from a DelegatingHandler and the abstract HttpMessageHandler.
Unfortunately this chain does not have access to the same ClientCertificateOptions and ServerCertificateCustomValidationCallback properties.

I've got a working solution. I'll start to prepare for a pull request.

@j82w would you like to discuss this?

I'm worried that there are other scenarios that will be blocked by not having the same access in v2. This will approach will not scale nicely if multiple other options need to be exposed.
@kirankumarkolli do you know if this is the only option that will be needed or do we need to find a better way to expose the different options?

@j82w Thanks for replying. Can you clarify what do you mean by "options"?
Are you concerned that the DisableSslVerification property is too specific to HTTP Gateway connections and will cause property bloat? Should it be encapsulated within a connection abstraction?

I am not to worried about the property bloat since Java and Python SDK have it.
I'm more interested in is if there are other scenarios that are being blocked by not having the ability to override the HttpClientHandler.  It exposes a lot of properties which the HttpMessageHandler does not have. If users need access to all of those properties that are no longer available then we should find a better way to expose it.

@ElasticCoder Our local development environment is behind a proxy. That's one scenario where we need to override the HttpClientHandler to set a proxy. We already do that for Azure Storage and Search client SDKs. But I couldn't find a way in the new Azure Cosmos SDK.

@ElasticCoder Our local development environment is behind a proxy. That's one scenario where we need to override the HttpClientHandler to set a proxy. We already do that for Azure Storage and Search client SDKs. But I couldn't find a way in the new Azure Cosmos SDK.

Thank you, that is a good concrete example. I'll have a look at the code impact.

I may have found a way to inject an HttpClientHandler into the DocumentClient which should satisfy the requirements that @Schueh and @j82w have raised. I will have a look at this next week.

I have addressed this requirement now with #74 which allows the consumer to specify a custom HttpMessageHandler.

Hi any plan on this pr going to release? Same situation working behind a corporate firewall. Thanks.

.net standard 2.0 now seems has supports for custom SSL handling.
@ausfeldt started investigating and will update with details.

@ElasticCoder we have a PR with the required changes.
If possible can you please validate it?

Saw the pr merged to master! thanks guys looking forward to the next build!

Folks, how is that PR fixing the SSL bypass issue? I don't see how to set the HttpClientHandler or other way to ignore the SSL cert. I'm on OSX with the same issue on the emulator...
Can someone shed a light on this? Thanks!

Just in case anyone finds this issue it was fixed in 3.12.0.
Here are examples on how to configure it:
CosmosClientOptions cosmosClientOptions = new CosmosClientOptions()
{
    HttpClientFactory = () =>
    {
        HttpMessageHandler httpMessageHandler = new HttpClientHandler()
        {
            ServerCertificateCustomValidationCallback = (req, cert, chain, errors) => true
        };
        return new HttpClient(httpMessageHandler);
    },
    ConnectionMode = ConnectionMode.Gateway
};

CosmosClient client = new CosmosClient("https://localhost:8081",
    "C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDuVTqobD4b8mGGyPMbIZnqyMsEcaGQy67XIw/Jw==",
    cosmosClientOptions);

Or if you are using a NET Standard 2.1 project:
CosmosClientOptions cosmosClientOptions = new CosmosClientOptions()
{
    HttpClientFactory = () =>
    {
        HttpMessageHandler httpMessageHandler = new HttpClientHandler()
        {
            ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
        };
        return new HttpClient(httpMessageHandler);
    },
    ConnectionMode = ConnectionMode.Gateway
};

CosmosClient client = new CosmosClient("https://localhost:8081",
    "C2y6yDj",
    cosmosClientOptions);

Just in case anyone finds this issue it was fixed in 3.12.0.
Here are examples on how to configure it:
CosmosClientOptions cosmosClientOptions = new CosmosClientOptions()
{
    HttpClientFactory = () =>
    {
        HttpMessageHandler httpMessageHandler = new HttpClientHandler()
        {
            ServerCertificateCustomValidationCallback = (req, cert, chain, errors) => true
        };
        return new HttpClient(httpMessageHandler);
    },
    ConnectionMode = ConnectionMode.Gateway
};

CosmosClient client = new CosmosClient("https://localhost:8081",
    "C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDuVTqobD4b8mGGyPMbIZnqyMsEcaGQy67XIw/Jw==",
    cosmosClientOptions);

Or if you are using a NET Standard 2.1 project:
CosmosClientOptions cosmosClientOptions = new CosmosClientOptions()
{
    HttpClientFactory = () =>
    {
        HttpMessageHandler httpMessageHandler = new HttpClientHandler()
        {
            ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
        };
        return new HttpClient(httpMessageHandler);
    },
    ConnectionMode = ConnectionMode.Gateway
};

CosmosClient client = new CosmosClient("https://localhost:8081",
    "C2y6yDj",
    cosmosClientOptions);


codegen test fail

Aim
run cargo test
Expected Behavior
codegen test pass
Bug
codegen test didn't pass
To Reproduce

install nix direnv as the instructions
run cargo test

Installation Method
Compiled from source
Nargo Version
No response
Additional Context

Would you like to submit a PR for this Issue?
Maybe
Support Needs
wondering if this is specific to my setup.  simple_verifier_codegen seems to be failing when running cargo test

@Ethan-000
I have the same problem on two of my machines with latest master
simple_verifier_codegen fails

can you provide example command how to that for people that will find this issue in the future


OIDC authorization fails to log in

Bug Report
Description
Bug Summary:
I have configured OAuth according to the docs using Authentik. The authorization is successful on the Authentik side, redirects to the Open WebUI callback, and it fails. No user is created.
The browser displays:
{"detail":"The email or password provided is incorrect. Please check for typos and try logging in again."}
Expected Behavior:
User is created and successful login to Open WebUI
Actual Behavior:
No user is created and no login to Open WebUI
Environment

Open WebUI Version: 0.3.6 and 0.3.7

Operating System: Linux

Browser (if applicable): Firefox 127 and Chrome 126

Reproduction Details
Confirmation:

[x] I have read and followed all the instructions provided in the README.md.
[x] I am on the latest version of both Open WebUI and Ollama.
[x] I have included the browser console logs.
[x] I have included the Docker container logs.

Logs and Screenshots
Docker Container Logs:
open-webui  | INFO:     <IP_ADDRESS>:0 - "GET /oauth/oidc/login HTTP/1.1" 302 Found
open-webui  | INFO:httpx:HTTP Request: POST https://authentik.***/application/o/token/ "HTTP/1.1 200 OK"
open-webui  | INFO:httpx:HTTP Request: GET https://authentik.***/application/o/open-webui/jwks/ "HTTP/1.1 200 OK"
open-webui  | INFO:httpx:HTTP Request: GET https://authentik.***/application/o/open-webui/jwks/ "HTTP/1.1 200 OK"
open-webui  | WARNING:main:OAuth callback error: Invalid key set format
open-webui  | INFO:     <IP_ADDRESS>:0 - "GET /oauth/oidc/callback?code=72936687cb604dac9c24396dcfe5jssy&state=BK98k4OjDea2MQRaus3gvj8R4Ghpvm HTTP/1.1" 400 Bad Request

Installation Method
Docker compose on a Debian host
OAuth authorized by Authentik 2024.6.0 (latest)
Additional Information
Docker environment variables:
    environment:
      - 'ENABLE_OAUTH_SIGNUP=true'
      - 'OAUTH_CLIENT_ID==*******''
      - 'OAUTH_CLIENT_SECRET=*******'
      - 'OPENID_PROVIDER_URL=https://authentik.***/application/o/open-webui/.well-known/openid-configuration'

I'd like to add that I am having the same behaviour, using the same settings in my environment. The only difference is that I have tried with 2 users in Authentik. One should map onto an existing user in Open Webui (using OAUTH_MERGE_ACCOUNTS_BY_EMAIL) another which should create a new user.
I'll also add the traceback in my logs:
ERROR:    Exception in ASGI application
  + Exception Group Traceback (most recent call last):
  |   File "/usr/local/lib/python3.11/site-packages/starlette/_utils.py", line 87, in collapse_excgroups
  |     yield
  |   File "/usr/local/lib/python3.11/site-packages/starlette/middleware/base.py", line 190, in __call__
  |     async with anyio.create_task_group() as task_group:
  |   File "/usr/local/lib/python3.11/site-packages/anyio/_backends/_asyncio.py", line 680, in __aexit__
  |     raise BaseExceptionGroup(
  | ExceptionGroup: unhandled errors in a TaskGroup (1 sub-exception)
  +-+---------------- 1 ----------------
    | Traceback (most recent call last):
    |   File "/usr/local/lib/python3.11/site-packages/uvicorn/protocols/http/httptools_impl.py", line 435, in run_asgi
    |     result = await app(  # type: ignore[func-returns-value]
    |              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/usr/local/lib/python3.11/site-packages/uvicorn/middleware/proxy_headers.py", line 78, in __call__
    |     return await self.app(scope, receive, send)
    |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/usr/local/lib/python3.11/site-packages/fastapi/applications.py", line 1054, in __call__
    |     await super().__call__(scope, receive, send)
    |   File "/usr/local/lib/python3.11/site-packages/starlette/applications.py", line 123, in __call__
    |     await self.middleware_stack(scope, receive, send)
    |   File "/usr/local/lib/python3.11/site-packages/starlette/middleware/errors.py", line 186, in __call__
    |     raise exc
    |   File "/usr/local/lib/python3.11/site-packages/starlette/middleware/errors.py", line 164, in __call__
    |     await self.app(scope, receive, _send)
    |   File "/usr/local/lib/python3.11/site-packages/starlette/middleware/sessions.py", line 85, in __call__
    |     await self.app(scope, receive, send_wrapper)
    |   File "/usr/local/lib/python3.11/site-packages/starlette/middleware/base.py", line 189, in __call__
    |     with collapse_excgroups():
    |   File "/usr/local/lib/python3.11/contextlib.py", line 158, in __exit__
    |     self.gen.throw(typ, value, traceback)
    |   File "/usr/local/lib/python3.11/site-packages/starlette/_utils.py", line 93, in collapse_excgroups
    |     raise exc
    |   File "/usr/local/lib/python3.11/site-packages/starlette/middleware/base.py", line 191, in __call__
    |     response = await self.dispatch_func(request, call_next)
    |                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/app/backend/main.py", line 807, in update_embedding_function
    |     response = await call_next(request)
    |                ^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/usr/local/lib/python3.11/site-packages/starlette/middleware/base.py", line 166, in call_next
    |     raise RuntimeError("No response returned.")
    | RuntimeError: No response returned.
    +------------------------------------

I am also experiencing this behavior with Authentik OIDC. But given that the OAuth feature is both experimental and only 4 days from release I'm hopeful it'll be working soon.

+1 . I saw the same issues.

I was able to get it working.

By turning off OAUTH_MERGE_ACCOUNTS_BY_EMAIL and changing the email of the OAuth user to one not present on the local open-webui instance it got through to the pending screen.

I wonder if OAUTH_MERGE_ACCOUNTS_BY_EMAIL is broken or if it's due to bringing in an old database.
Either way, I nuked the configuration for open-webui and logged in with my OAuth user, and it appears to be working.

+1 TShapinsky's comments.
I was able to fix the issues by nuking the config and start a new instance with OAUTH_MERGE_ACCOUNTS_BY_EMAIL disabled. I was using 0.3.7.

I deleted my Authentik application and provider, then created new ones with the exact same settings as before. After loading in the values of the new provider, everything works. Even merge by email.
I have no explanation as to why it works now.

+1 TShapinsky's comments.
I was able to fix the issues by nuking the config and start a new instance with OAUTH_MERGE_ACCOUNTS_BY_EMAIL disabled. I was using 0.3.7.

What do you mean nuke the config? A config file or.simply redeploy the docker container?

+1 TShapinsky's comments.
I was able to fix the issues by nuking the config and start a new instance with OAUTH_MERGE_ACCOUNTS_BY_EMAIL disabled. I was using 0.3.7.

What do you mean nuke the config? A config file or.simply redeploy the docker container?

I just got rid of all persistent data. I'm running on k8s so the process is different, but if you're in docker just deleting the volume would have the same effect. It definitely has downsides of losing all your data, but I didn't have much of value in it anyways.

+1 TShapinsky's comments.
I was able to fix the issues by nuking the config and start a new instance with OAUTH_MERGE_ACCOUNTS_BY_EMAIL disabled. I was using 0.3.7.

What do you mean nuke the config? A config file or.simply redeploy the docker container?

I just got rid of all persistent data. I'm running on k8s so the process is different, but if you're in docker just deleting the volume would have the same effect. It definitely has downsides of losing all your data, but I didn't have much of value in it anyways.

Perfect ill try. Im just setting up, havent had any constructive conversations with it either ;).

I'm experiencing the same issue here. OIDC just doesn't work suddenly without any config change. This happened to all my OIDC instances now, including Overleaf Pro and Outline. I also started a newly installed Authentik docker to reproduce, which ended up with the same problem.
During an OIDC authentication, when browser redirects to application URL (Outline for example) from authentik page, it returns 502 bad gateway. Here is the outline logs, since no error found in the authentik logs(I replaced my real IP with many X):

outline-outline-1   | {"error":"connect ETIMEDOUT XXX.XXX.XXX.XX:443","level":"error","message":"Error during authentication","stack":"Error: connect ETIMEDOUT XXX.XXX.XXX.XX:443\n    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1606:16)"}

@zylhuang your issue seems to be with your authentication server, not the services using it.

I am experiencing the same issue using Microsoft OAuth. Despite configuring everything according to the documentation, I receive the same error regardless of whether OAUTH_MERGE_ACCOUNTS_BY_EMAIL is enabled and whether a user with the same email address already exists. The system consistently fails to log in and does not create a new user. This seems to indicate a broader problem with the OAuth implementation, possibly related to the JWKS key set handling. Any insights or solutions would be greatly appreciated.

I am experiencing the same issue using Microsoft OAuth. Despite configuring everything according to the documentation, I receive the same error regardless of whether OAUTH_MERGE_ACCOUNTS_BY_EMAIL is enabled and whether a user with the same email address already exists. The system consistently fails to log in and does not create a new user. This seems to indicate a broader problem with the OAuth implementation, possibly related to the JWKS key set handling. Any insights or solutions would be greatly appreciated.

same here.


Add codegen/autodiff support for eigen coeff-wise min and max operations

This PR creates codegen/autodiff support for the Eigen min/max operations.
For that purpose, the min/max specialization needs to be loaded before Eigen/Core is loaded. Else, the eigen implementation defaults to std::max/min.

I had to separate the traits from the fwd.hpp so it could be loaded before Eigen/Core
The minmax.hpp file has to be loaded before Eigen/Core is loaded. This means loading it before math/fwd.hpp.
Since minmax.hpp needs to be included before Eigen, I had to redefine the eigen inline macros.
I had to refactor the header math/fwd.hpp, since it was loading Eigen/Core module, and pinocchio/math/fwd.hpp did not require Eigen. With this PR, Eigen/Core is not loaded with pinocchio/math/fwd.hpp.
I've added a unittest to check the min/max support

Point 3 might affect downstream repositories, if they only include math/fwd.hpp and not fwd.hpp.

Any downstream user that is doing that would need to include fwd.hpp as well.
On the other hand, this refactoring is needed for inequality cost support in crocoddyl.

I've simplified the inclusions, so there is no change in math/fwd.hpp

But the right way to do it is to define the min max functions in the cppad namespace. It will be much more simpler and cleaner.


Overflow bug when running tf.keras.layers.ZeroPadding3D

Issue type
Bug
Have you reproduced the bug with TensorFlow Nightly?
No
Source
binary
TensorFlow version
2.13.0
Custom code
Yes
OS platform and distribution
No response
Mobile device
No response
Python version
No response
Bazel version
No response
GCC/compiler version
No response
CUDA/cuDNN version
No response
GPU model and memory
No response
Current behavior?
Due to large integer value
Standalone code to reproduce the issue
import tensorflow as tf
import os
import numpy as np
try:
  padding =<PHONE_NUMBER>
  arg_class = tf.keras.layers.ZeroPadding3D(padding=padding,)
  arg_input_0_tensor = tf.random.uniform([1, 1, 2, 2, 3], dtype=tf.float32)
  arg_input_0 = tf.identity(arg_input_0_tensor)
  arg_input = [arg_input_0,]
  out = arg_class(*arg_input)
except Exception as e:
  print("Error:"+str(e))

### Relevant log output

```shell
Error:Exception encountered when calling layer 'zero_padding3d' (type ZeroPadding3D).

{{function_node __wrapped__Pad_device_/job:localhost/replica:0/task:0/device:GPU:0}} Encountered overflow when multiplying<PHONE_NUMBER> with<PHONE_NUMBER>, result: -8070450522584252414 [Op:Pad]

Call arguments received by layer 'zero_padding3d' (type ZeroPadding3D):
  • inputs=tf.Tensor(shape=(1, 1, 2, 2, 3), dtype=float32)

Hi @dmc1778 ,
The reported behaviour is replicated with Tf2.13v and tf-nightly and attached gists 2.13v and nightly for reference.

@dmc1778 ,
Please refer to the responses of Developer team related to the exception raised https://github.com/tensorflow/tensorflow/issues/61630#issuecomment-1685333019 and https://github.com/tensorflow/tensorflow/issues/61629#issuecomment-1686504422 stating it as intended behaviour.
The Op tries to allocate the memory for the inputs and outputs before performing computations and it fails. The same error returned to python and its adding more details to error log.
As requested please read SECURITY.md to disclose these types of issues.
Thanks!

Not an issue, it is a normal error being returned to the user.


Links to pages in the sidebar hide the top of the page

What happened?
For example, if I click on https://kuma.io/docs/2.1.x/policies/meshhttproute/ in Google Chrome, the content is scrolled down such that the warning at the top is hidden by the page header.

Triage: it seems to be in acceptable state now


Update CAPI version to v1.1.0-gsalpha.2 from our fork

Closes https://github.com/giantswarm/roadmap/issues/670

This PR:

Updates CAPI version to v1.1.0-gsalpha.2 from our fork.

Testing
Description on how {APP-NAME} can be tested.

[ ] fresh install works

[ ] AWS
[ ] Azure
[ ] KVM

[ ] upgrade from previous version works

[ ] AWS
[ ] Azure
[ ] KVM

Other testing
Description of features to additionally test for {APP-NAME} installations.

[ ] check reconciliation of existing resources after upgrading
[ ] X still works after upgrade
[ ] Y is installed correctly

Checklist

[ ] Update changelog in CHANGELOG.md.
[ ] Make sure values.yaml and values.schema.json are valid.

Not sure why I added Atlas here, meant to add Rocket :smile:

I think this can be closed now


Running without jquery

Are you interested in tracking this effort? I tried to go without jQuery in our app (we aren't using it directly), but the first console error I noticed was from here. It is fair if you don't want to support this use case, in which case you can close this issue.

Totally cool supporting this use-case, is there a best practice for how do do this?
"Just use DOM API?"
Use some other shim?

This is a pretty good guide, although slightly outdated by now http://miguelcamba.com/blog/2017/04/11/the-future-of-embers-testing-and-the-beheading-of-jquery/
There is a section at the bottom on how to update an addon. It involves using the new jquery-free test helpers (codemod available I believe), and some ember-try fixing for older ember versions. This also helps a lot https://github.com/ember-cli/eslint-plugin-ember/blob/master/docs/rules/no-jquery.md.

any progress on this? just ran in to:

So, I can't use atm.

Have you tried using the new beta? v4.0.0-beta.2?

yeah, pointing at master removed the error. forgot to reply back :)

Woop! Awesome. I'll close this issue when 4.x lands officially 🎉
(also, lmk if you come across any bugs!!)

@Robdel12 any idea when v4 will be released?


[NPM Packaging] AAUser I can specify my openAI organization

Description:
We are using aleios and Theodo openai organisations. We do not have gpt4 on the aleios org yet. If we want to use gpt4 we need to specify the org id of Theodo.
Validation:
Screenshot using gpt4
Current Tech steps:
add a new flag in args --org, this is the organisation to use. defaults to undefined.
use the value of org and set it in the configuration object when the openai client object is created.


fix(test): fix webhook test case

Thanks for your feedback @terry-xiaoyu I will fix these comments later

Thanks for your feedback @terry-xiaoyu I will fix these comments later


[Event Request] Application “Tests-General Journal”, Codeunit 134930 "ERM Applies-To Doc. No."

[Event Request]Application “Tests-General Journal”, 134930 "ERM Applies-To Doc. No."
Could you please insert the Event OnTestInitialize at the beginning of the Initialize procedure

Thanks for reporting this. We agree, and we’ll publish a fix asap, either in an update for the current version or in the next major release. Please do not reply to this, as we do not monitor closed issues. If you have follow-up questions or requests, please create a new issue where you reference this one.


Avoid inject panic with corner case

Signed-off-by: clyang82<EMAIL_ADDRESS>Please provide a description for what this PR is for
This pr is to avoid generate panics on the following input for istioctl kube-inject -f test.yaml
cat <<EOF > test.yaml
apiVersion: v1
kind: ReplicationController
metadata:
  name: my-nginx
spec:
  replicas: 1
EOF

FYI @esnible
And to help us figure out who should review this PR, please
put an X in all the areas that this PR affects.
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[x] User Experience
[ ] Developer Infrastructure

[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by: clyang82
To complete the pull request process, please assign howardjohn
You can assign the PR to them by writing /assign @howardjohn in a comment when ready.
The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

pilot/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@clyang82: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

integ-security-k8s-presubmit-tests-master
c4f229bcf773345ba22a661de66a2be152530f22
link
/test integ-security-k8s-presubmit-tests-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

lgtm, will give others some time to review if they want

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: clyang82, howardjohn
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

pilot/OWNERS [howardjohn]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

/retest

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: clyang82, howardjohn, hzxuzhonghu
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

pilot/OWNERS [howardjohn,hzxuzhonghu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

/test integ-security-k8s-presubmit-tests-master


[JSON RPC] migrate CLI submit_transaction from gRPC to JSON RPC

Summary
As a first step in migrating from gRPC to JSON RPC in Libra Client CLI, migrating submit_transaction functionality to use JSON RPC

add new JsonRpcClientBlocking analogous to AdmissionControlClientBlocking
updated CLI and libra-swarm initialization to support both AC and JSON RPC to temporarily support transition

Test Plan
Tested on local Libra swarm CLI

@christinacelee: please change default port value to be the same as in config and also update scripts/cli/start_cli_testnet.sh

@bors-libra: r+

:pushpin: Commit 4941146 has been approved by phoenix-antigravity

:hourglass: Testing commit<PHONE_NUMBER>5f9769b2fa4a096af8cae254ebd197 with merge bf22198145009538c76194cf579da05f5e3dc3ec...

:sunny: Test successful - checks-actions_land_blocking_test, checks-circle_commit_workflow
Approved by: phoenix-antigravity
Pushing bf22198145009538c76194cf579da05f5e3dc3ec to master...


Do not allow Non Admin object spec change after Velero object is created

We should write a webhook to validate spec changes.
Example: if user tries to update spec after NonAdminBackup status is created, it should be not allowed.

As discussed today, we will remove code that updates NAC Spec in Reconcile
We will evaluate in the future if we want to re enable this, for user experience (seeing what VeleroBackup Spec its NonAdminBackup Spec generated)

Closing this issue as mentioned in https://github.com/migtools/oadp-non-admin/issues/87

Reopening as it has not been fixed yet (there is no safe mechanism that disallows users to change NAB spec after it hits a certain status.phase)

validating admission webhook


Implement final class

Problem
Add ability to define a class that cannot be subclassed.
We have asks for this ~every week.
Proposed solution
A check in Sorbet-static & in runtime.

cc @benbuckman

In addition to this, it would be nice to have final methods (methods that may not be overridden by subclasses) as a separate but related concept. This would allow for the class itself not to be final, but some chosen methods to be final.
Note that if the class is final, all the methods on that class are automatically final because you can't override the methods because you can't subclass the class.

Note that if the class is final, all the methods on that class are automatically final because you can't override the methods because you can't subclass the class.

note that we want to enforce that, by redefining define_method and friends.

Closed in #1394, #1364, #1353, #1341, #1316, #1181, #1178, and others.


[Improvement]: Use time module API to convert UTC time to email string

Connector Name
module/azure-storageservice (Azure Blob & Storage Service)
Task Description
Check whether we can use UTC to email string APIs to construct string values [1] in code[2]

https://lib.ballerina.io/ballerina/time/2.2.1/functions#utcToEmailString
https://github.com/ballerina-platform/module-ballerinax-azure-storage-service/blob/main/storageservice/modules/utils/utils.bal#L25-L39

Yes, we can use utcToEmailString & the code will be updated.

@SanduDS Can you also check the azure cosmosdb[1] and change

https://github.com/ballerina-platform/module-ballerinax-azure-cosmosdb/blob/main/cosmosdb/constants.bal#L186

The email string format is not valid for Microsoft APIs' authorization headers.
Expected: Fri, 03 Jun 2015 23:39:12 GMT
Provided : Fri, 3 Jun 2022 03:28:54 GMT

The email string format is based on RFC 5322[1] format. it supports both with and without leading zero for the date value.

https://datatracker.ietf.org/doc/html/rfc5322#section-3.3


Border improvements

fixes issues with window and workspace border related rules not working as intended
also simplifies getting window border size and setting the workspace rules
closes: https://github.com/hyprwm/Hyprland/issues/2957
shouldn't case any issues

the specialrenderdata / additionalconfigdata situation is a mess, it needs to be cleaned up. Note to self...

I though about making a windowProps object that could be set using hyprctl or window rules and workspace rules (maybe combine them into something new to reduce the number of workspace and window rules and the need to update each one every time we want to add something new).
each thing that could set the property would have a certain priority (hyprctl > window rules > workspace rules > layout requests > global config)
but that was more work, and would be storing a lot of redundant -1 most of the time (no idea if there is a better way to do this)
using rounding() now so should be ready for merge @vaxerski

I though about making a windowProps object that could be set using hyprctl or window rules and workspace rules (maybe combine them into something new to reduce the number of workspace and window rules and the need to update each one every time we want to add something new).
each thing that could set the property would have a certain priority (hyprctl > window rules > workspace rules > layout requests > global config)
but that was more work, and would be storing a lot of redundant -1 most of the time (no idea if there is a better way to do this)

I will probably look into it when I am back from holidays.


Runner runaway if task ready never resolves

Currently runStage doesn't have a timeout for awaiting any task.ready. In the case of a bug where the task process infinite loops without printing the trigger for ready, the runner will never stop. This recently happened (daily-perf-d395e3f999e5) after a change (between agoricstage-10 and agoricstage-11) where the client would infinite print errors not being able to deploy the wallet.

Fixed in #44, dup of #40.


API (cloud) /dbrps POST: parameter 'default' is always set to true.

Steps to reproduce:
List the minimal actions needed to reproduce the behavior.

Using the API send a POST request to /dbrps with the property default set to false

example from grace tests.
  describe.only('troubleshoot', () => {
    it('creates a dbrps with default=false', async () => {

      let resp = await request(url)
        .post('/dbrps')
        .set('Authorization', `Token ${alt.getAuth().token}`)
        .set('Content-Type', 'application/json')
        .send(
          JSON.stringify({
            orgID: alt.getOrg().id,
            bucketID: alt.getBucket().id,
            database: 'foo',
            retention_policy: 'bar',
            default: false,
            links: {},
          })
        )

      await log.cout(log.level.debug, `resp ${log.objFmt(resp)}`)
      await log.cout(log.level.debug, `resp.body ${log.objFmt(resp.body)}`)
      expect(resp.body.default).to.be.false

    })
  })

Expected behavior:
That the created DBRP mapping would have the default value set as defined in the request object.
Actual behavior:
From running the above test.

...
 DEBUG: resp {
  ...
   "status": 201,
  ...
}
 DEBUG: resp.body {
   "id": "09c3aa0dbdbe1000",
   "database": "foo",
   "retention_policy": "bar",
   "default": true,
   "orgID": "2b83f4fbef22236f",
   "bucketID": "0fd507409b6bc01f"
}
      1) creates a dbrps with default=false
 ...

  0 passing (10s)
  1 failing

  1) Dbrps
       troubleshoot
         creates a dbrps with default=false:

      AssertionError: expected true to be false
      + expected - actual

      -true
      +false

      at Context. (test/beta/dbrps.test.js:827:38)
      at processTicksAndRejections (internal/process/task_queues.js:95:5)
...

Environment info:
Testing against K8SIDPE remocal
latest K8SIDPE commit
commit 64130b73dc7942115ec1a57147ee8fdf26d7ce58 (HEAD -> master, origin/master, origin/HEAD)
Author: influx-acs[bot]<EMAIL_ADDRESS>Date:   Tue Aug 2 07:24:50 2022 +0000

    chore: apply new influxdb_iox images for fec6b18d80 (#9288)

    Autocommit-INFLUXDB_IOX-SHA: fec6b18d80d60ae54c1336d42eaff364202c0b92
    Autocommit-Reason: new images published

    Co-authored-by: Hercules Mango Churchill<EMAIL_ADDRESS>
N.B. /dbrps/{dbrpID} PATCH
When patching the parameter default to be false, the request is accepted and the response object shows default is in fact false.  So why does POST always return {..., default:true}?

This is correct behavior. If there is no DBRP mapping, newly created one is automatically set as default. Since 2.5.0, there are virtual mapping provided by default, so the behavior is: if there no non-virtual mapping for given bucket, newly created one is set as default.


Build with JS Files

Description
Yes, Vite works with JSX and TSX, can it also work with JS files please, I don't have any justification but for the sake of not renaming a 3 years old project js files to jsx just to hop on board a faster train, if JS files can be supported everyone is happy.
Suggested solution
Enable JS files pls
Alternative
No response
Additional context
No response
Validations

[X] Follow our Code of Conduct
[X] Read the Contributing Guidelines.
[X] Read the docs.
[X] Check that there isn't already an issue that request the same feature to avoid creating a duplicate.

See https://github.com/vitejs/vite/discussions/3448


The BasicDAO does not consider the information added in the MappedClass Mapper earlier

I'm following this code to use Morphia without annotations, so my code is as follows
Mongo Mongo; // I create the Mongo
Morphia morphia = new Morphia ();
/ *
In this place I call a method that maps the class by adding the annotation @Entity and @Id and in my Mapper Morphia

/

Datastore ds = new DatastoreImpl (morphia, mongo, "db");
/ *
When creating the DAO get an exception "Noid complained about com.hipersistence.resources.People:. In the field is annotated with ..."

/
BasicDAO <People, String> dao = new BasicDAO <People, String> (People.class, ds);

// The exeption is because when creating the BasicDAO it executes the following code:
protected void initType (Class end  type) {
       entityClazz = type;
       ds.getMapper () addMappedClass (type).;
}
/ *
And the method of addMappedClass Mapper class that was called, creates a new MappedClass internally and does not consider the mappings previously made

/
public MappedClass addMappedClass (final Class c) {
       return addMappedClass (new MappedClass (c, this), true);
}

(note to self) the fix:  add a check in addMappedClass():
if(ds.getMapper().getMappedClass(type) == null)


BK7231 MQTT

MQTT won't compile for BK7231, Can't compile https://github.com/OttoWinter/async-mqtt-client, maybe we should fork it and change
#ifdef ESP32   in https://github.com/OttoWinter/async-mqtt-client/blob/master/src/AsyncMqttClient.hpp

MQTT should work now, starting with https://github.com/kuba2k2/libretuya-esphome/commit/65864298a3afcf951d6a5b6329d273b3f40c6457.

I'm running into the same problem with a cb3s board.
I'm using the current ESPHome addon in HA and even tried directly listing the library from your linked commit, but it still complains about being unable to find AsyncTCP during compilation.
Do I have to switch to any dev versions of ESP home or bk72xx/libretiny for this to work? (your post is from January, so I hope not)
Configuration yaml:
bkwindow1.yaml.txt
Failed compile log:
logs_bkwindow1_run.txt
Any advice is greatly appreciated.

@dskw it seems esphome/AsyncTCP-esphome dependency is missing.
Adding following lines to config should force it to be downloaded
esphome:
  libraries:
    - "esphome/AsyncTCP-esphome"

Ahh I tried that before but did not add the esphome prefix/suffix! That works indeed, thank you @olemmela !


Update dependencies

https://github.com/advisories/GHSA-566m-qj78-rww5 is a thing. I don't think it's directly relevant to us, but upgrading is good.

the CI isn't very happy with the upgrade :(

ugh, I was hoping this would be easy. Apparently, as of postcss-cli v8, you have to install postcss separately. No idea why, or how this is an improvement in the world.


Cannot read property 'firstChild' of null at Titlebar.createTitlebar

Cannot create the titlebar it is getting error
Cannot read property 'firstChild' of null at Titlebar.createTitlebar
To Reproduce

Home

Desktop (please complete the following information):

OS:  Windows
Electron version 9.1.0
Node Version 13.11.0

You must add cet (custom-electron-titlebar) to your preload.js file


Managing state variables

Need a way to either 1. show multiple OR 2. prioritize.
Use case:  An entity pool node with two or more state variables. One or more may be useful. However, which one is shown seems to depend on the order in which the source SBGN-ML is processed.
Related to https://github.com/PathwayCommons/pathways-search/issues/98 ; https://github.com/PathwayCommons/app-ui/issues/87

do we have to show it on the nodes or can it be shown in the tooltip

How many is reasonable to show? 2? I guess after that everything else has to go in the tooltip

I would vote for 4.


build missing on docker hub registry

Did you remove this image from the docker hub registry awhile back?  I've been using it, and just wondering if I need to rebuild myself or just a bug/oversight.  Thanks.

I found this fork that's still active, so we can close this.
https://github.com/doig-u/docker-sslh


Update 02-sbt-by-example.md

Added a necessary step: need to reload in order for dist command to work

Hi @cbogart,
Thank you for your contribution! We really value the time you've taken to put this together.
Before we proceed with reviewing this pull request, please sign the Lightbend Contributors License Agreement:
http://www.lightbend.com/contribute/cla

I just signed the cla.


[jax2tf] Add the convert_and_save_model to the jax2tf API.

@tomhennigan I have tried to write down a recipe for how one would save a model from Haiku. PTAL.


python/client: generate Python facets from JSON schemas.

Problem
So far objects specified with JSON Schema needed to be manually developed and checked in Python. This brought many discrepancies, including wrong schema URLs, some attributes changes and inconsistent naming.
Solution
This PR makes use of datamodel-code-generator. It's capable of parsing JSON Schema and generating e.g. Pydantic or dataclasses classes. In order to use attrs (which is more modern version of dataclasses) and overcome some limitations of the tool there's a number of steps added in order to customize code enough to meet OpenLineage requirements.
This PR also updates references to the latest base JSON Schema spec for all child facets.
Important note
Newly generated code creates v2 interface which is going next to be used in existing integrations. v2 interface introduces some breaking changes (facets are put into separate modules per JSON Schema spec file, some names changed, several classes are now kw_only).
One-line summary:
Generate Python facets from JSON schemas.
Checklist

[x] You've signed-off your work
[x] Your pull request title follows our guidelines
[x] Your changes are accompanied by tests (if relevant)
[x] Your change contains a small diff and is self-contained
[ ] You've updated any relevant documentation (if relevant)
[x] Your comment includes a one-liner for the changelog about the specific purpose of the change (if necessary)
[x] You've versioned the core OpenLineage model or facets according to SchemaVer (if relevant)
[x] You've added a header to source files (if relevant)

SPDX-License-Identifier: Apache-2.0
Copyright 2018-2023 contributors to the OpenLineage project

@pawel-big-lebowski
I think it's a good idea to give a deprecation warning when importing existing modules with facets and events.
For an example of usage you can check branch that introduces v2 facets in Airflow and common integrations: https://github.com/OpenLineage/OpenLineage/compare/python/generate-facets-code...use-v2-facets?expand=1
I'm also not sure where and how to document changes needed to migrate to v2.

Closes: #1746


[Feature Request] Gluon SymbolBlock structured imports.

As far as I am aware, gluon provides only 2 ways to save/load models. Please correct me, if I am wrong.

using save/load_parameters

The problem with this option is that it doesn't save the model architecture, so you have to construct the model, before loading the parameters. You have to know exactly what the model was. which is really inconvenient.
For example, if you are trying to do transfer learning, you have to know the exact number of classes the model was pretrained on and all the hyperparameters used during pretraining, which is really inelegant and annoying.
Furthermore, when releasing to production, this means that you need to actually create the whole model and then load parameters, instead of just doing an imports. This essentially rules out this option unless you can ship the whole training code to production.

using export/imports

This is a much saner option for exporting your model for inference. But it is (as far as I can tell) completely useless for experiments/training/transfer learning. That is because export/imports doesn't actually preserve the Block hierarchy and instead squashes the whole model into one block.
For example:
from mxnet import gluon, ndarray
M = gluon.nn.HybridSequential()
with M.name_scope():
    M.add(gluon.nn.Dense(10))
    M.add(gluon.nn.Dense(1))
M.initialize()
M.hybridize()
M(ndarray.arange(10))

At this point, M is a Hybrid Block, with structure
HybridSequential(
  (0): Dense(1 -> 10, linear)
  (1): Dense(10 -> 1, linear)
)

And I can access the various children by indexing (or by names if it's not a sequential block).
However after I do
M.export('model')
M = gluon.nn.SymbolBlock.imports('model-symbol.json', ['data'], 'model-0000.params')

M is a Symbol Block without any structure, so if I wanted to access only the first dense layer, I couldn't.
SymbolBlock(

)

In the end, I am left with two options

rebuild a model from scratch every time I want to load it (which is a complete nightmare if your model could potentially change while you are experimenting with the architecture and requires you to ship training code to production)
give up transfer learning

Please correct me if I am wrong. Otherwise this is a feature request to somehow save the HybridBlock structure, when using export/imports.

Temporary Workarounds:

use both (1) and (2), load from 1 during development, ship 2 to production (I'm currently doing this)
use (2) and write your own thing to extract the weights from M.params for transfer learning (this sounds like a huge pain)

@mxnet-label-bot add [Gluon, feature request]

I encountered the same problem, I can not transfer learning on pre_trained.


snowflake staging with gcs and s3

Fairly simple PR for snowflake staging. I could not get the aws s3 integration to work. I completed the setup process 3 times but I still get access denied..

@sh-rp should we close this?


[unsplash]  Fixed background updates not working.

Description

Fixed background updates not working.

#6214

Checklist

[x] I read the extension guidelines
[x] I read the documentation about publishing
[x] I ran npm run build and tested this distribution build in Raycast
[x] I checked that files in the assets folder are used by the extension itself
[x] I checked that assets used by the README are placed outside of the metadata folder

Do you mind checking this @eggsy

Do you mind checking this @eggsy

Seems fine 🤷♂, just a change that combines if statements. Though I don't have any idea how this "fixes" anything as it doesn't change the way the code operates (this is just the display message part).

Ah, I can see - @kkange do you commit all changes?

@pernielsentikaer  Yes, I have committed all changes.

Can you see the comment from @eggsy - what does it fix? Looks like it's only about some messages?

@pernielsentikaer Removed the code that was terminating the function when it ran in the background and changed it to work correctly


Error when running restQL-manager via npm

I'm getting an error when trying to access localhost:3000, running restql-manager which was globally installed using npm.
The error message is as follows:
Error: ENOENT: no such file or directory, stat '/usr/lib/node_modules/restql-manager/build/index.html'

New fixed version published at https://www.npmjs.com/package/@b2wdigital/restql-manager


Link broken

The click here link is broken in the space facts sample: https://github.com/alexa/skill-sample-nodejs-fact/blob/master/instructions/cli.md
redirects here: https://github.com/alexa/skill-sample-nodejs-fact/blob/master/instructions/1-voice-user-interface.md
404

broken link issue resolved.


Lower required version of React in peerDependencies

Lowers required version of React in peerDependencies to match the range currently supported by react-hook-form ("^16.8.0 || ^17 || ^18")
Closes #93

Thank you! :)


Using range filter under nested

{"and": [
      {"nested":
        {"path": "settings",
          "filter": {
            "and": [
              {"range": {
                "settings.start_time": {"lte": end_time_str}
                }
              },
              {"range": {
                "settings.end_time": {"gte": start_time_str}
              }},
              {"term":
                {"week_day": week_day}
              }
            ]
          }
        }
      },
      {"term":
        {"country": "tz"}
      }
    ]
  }
~~~
But it not work well as expected
as i think i changed to
~~~
{"and": [
      {"nested":
        {"path": "settings",
          "filter": {
            "and": [
              {"range": {
                "settings.start_time": {"lte": end_time_str},
                 "settings.end_time": {"gte": start_time_str}
                }
              },
              {"term":
                {"week_day": week_day}
              }
            ]
          }
        }
      },
      {"term":
        {"country": "tz"}
      }
    ]
  }
~~~
I want to search our the two the mathc with Interval

All both up not working as period
i have tried
https://gist.github.com/zombor/56eab31c1a1147176d902fed241ddd78 not same work.
anyone can help me?

I solved it as follows
    {"and": [
      {"nested":
        {"path": "appointment_settings",
          "filter": {
            "and": [{
              "and": [
                {"range": {
                  "settings.start_time": {"lte": end_time_str, "gte": "00:00"}
                  }
                },
                {"term":
                  {"settings.week_day": week_day}
                }
              ]},
              {
              "and": [
                {"range": {
                  "settings.end_time": {"gte": start_time_str, "lte": "23:59"}
                  }
                },
                {"term":
                  {"settings.week_day": week_day}
                }
              ]}
            ]
          }
        }
      },
      {"term":
        {"country": 'tz'}
      }
    ]
  }


Add firewall rules for ceph-nfs

When ceph-nfs is deployed as part of Ceph with an associated ingress daemon, we should provide firewall rules to avoid unexpected behavior when the cluster is created and clients try to reach the VIP endpoint.
Required for https://github.com/openstack-k8s-operators/ci-framework/pull/557

recheck

recheck


Regular nuget packages show up in BaGet

Describe the bug
Somehow regular/official nuget packages like Newtonsoft.Json show up in my private api-key protected BaGet server. This behavior wasn't present like 4 months ago.
To Reproduce
Steps to reproduce the behavior:

Using this version of BaGet 'latest docker image'
Run this code 'via csproj file my packages are pushed on build'

  <Target Name="PushNuGetPackage" AfterTargets="GenerateNuspec" Condition="'$(Configuration)' == 'Release'">
    <Message Text="Push NuGet Package to NuGet Feed" Importance="high"></Message>
    <Exec Command="dotnet nuget push $(ProjectDir)bin\Release\$(PackageId).$(PackageVersion).nupkg -s http://some-baget-server-ip -k SOME-API-KEY"></Exec>
  </Target>

Expected behavior
Maybe this behavior is a new feature in BaGet? But I would like to have my private packages repo to be clean and not filled with regular/official nuget packages.
Also it is remarkable that these regular/official nuget packages got pushed to my api-key protected BaGet server as there is no way the process responsible pushing these official  packages could have my api-key right?

turn off mirroring

Thanks.
Please consider setting the default value to false for the Mirror feature.

Thanks for reporting. This config was enabled by accident, I've reverted that with https://github.com/loic-sharma/BaGet/commit/79ab701ab16b12f3ee951e7d43ffc90a85ad3f6a. Please let me know if you have any other issues!


forth

implements simple FORTH-ish interpreter

@glennj wouldn't mind your opinion too

Looks pretty good, might be worth changing ERROR_EMPTY_STACK etc to constants, and testing at least one long joined up (but still ";"-separated) string such as ": foo 5 ; : bar foo ; : foo 6 ; bar foo" which I think will work without any other changes.


Problem displaying roads and names

Shader error : Roads and names (country, street) are not displayed
When I launch my web application, three js displays the buildings well but doesn't display everything else. I have  three js errors in the console. I tried on several computers the error remains the same and the roads are not displayed. I've tried several versions of three js, and I'm currently on the latest version. I've done the tutorial to integrate harp gl in a web application and I don't understand where the problem comes from (the buildings are well displayed). I tried different themes, and verified that the renderLabel was true.
Do you know how I could fix this?
Configuration
Grahic card : Quadro K2200/PCIe/SSE2
Mozilla : Version 68.5.0
Google Chrome :  Version 80.0.3987.132
Web GL Shader error

Map

@NicoBrug , thanks for the bug report! Are you using the latest release or the source code directly?
If you use the source code directly it should work, however the latest version doesn't work with three.js 0.118 unfortunately, but I fixed it here: https://github.com/heremaps/harp.gl/commit/546c0446a5ea49849770a4cf47dc6f7a8b9f1138 so you will need to wait for the next release and temporarily use three.js 0.117 until the next is out.

Ok I switched to three js r117 and everything works fine. Thank you for your answer!
Very good job anyway, it's really amazing.

You're welcome, and thanks for taking an interest in harp.gl!