Graph Api adding tab to MSTeams error: "needs to be in an unblocked state to install/update a tab"

I get this error on this graph api request (for adding a tab to a MSTeams team):
Request:
POST<EMAIL_ADDRESS>{"displayName":"hello","teamsApp@odata.bind":"https://graph.microsoft.com/v1.0/appCatalogs/teamsApps/a79c6959-0c6d-4353-a22c-682611b86c5f","configuration":{"entityId":"9c2fbbf5-bf26-4ef7-9401-abe8d03d2c17","contentUrl":"https://fast-snake-22.loca.lt/teams/tabs/dash","removeUrl":"https://fast-snake-22.loca.lt/teams/tabs/remove","websiteUrl":"https://fast-snake-22.loca.lt/personal/tab";}}
Response:
{
"error": {
"code": "BadRequest",
"message": "App id a79c6959-0c6d-4353-a22c-682611b86c5f needs to be installed to the team<EMAIL_ADDRESS>and be in an unblocked state to install/update a tab",
"innerError": {
"date": "2021-01-05T22:25:03",
"request-id": "487a5591-d81e-4abb-a3f3-65fb620d5d36",
"client-request-id": "62e00982-09cf-1811-c501-fb43f9f4c3de"
}
}
}
Question: I don't understand what it means to be in "unblocked state." My app is installed on the team so that is not the error
Any help is greatly appreciated.

I understand app is already installed in Team, can you please reconfirm if app is listed in your apps list in Team where you are trying to create new tab.
Just cross verify you are picking the correct team and channel id in request endpoint.

I understand app is already installed in Team, can you please reconfirm if app is listed in your apps list in Team where you are trying to create new tab.
Just cross verify you are picking the correct team and channel id in request endpoint.

@Abhijit-MSFT the app is definitely added to the team. Here is a screenshot:

@Abhijit-MSFT the app is definitely added to the team. Here is a screenshot:

@Abhijit-MSFT Do you think the app is in blocked state? The error message explains that the app needs to be in unblocked state.
The app was also installed via sideload and not from the app store or from global installation. Do you think that makes a difference?

@Abhijit-MSFT Do you think the app is in blocked state? The error message explains that the app needs to be in unblocked state.
The app was also installed via sideload and not from the app store or from global installation. Do you think that makes a difference?

@liangchr : Hi, I will be handling this question from now. Just to confirm you created teams app > downloaded manifest > made changes to manifest > uploaded it to channel in specific team > then using graph call? Is my understanding right? Could you please provide repro steps. This will help us quickly resolve question.

@liangchr : Hi, I will be handling this question from now. Just to confirm you created teams app > downloaded manifest > made changes to manifest > uploaded it to channel in specific team > then using graph call? Is my understanding right? Could you please provide repro steps. This will help us quickly resolve question.

@liangchr : I just successfully install/update tab in channel in teams.
Here are the steps that I followed.

Created a tab and sideloaded in it in teams.
Sent a request to https://graph.microsoft.com/v1.0/teams/{team id}/channels/{channel}/tabs and got the json data. It will be in the form of

            "id": "16824248-f784-4e08-bd57-e3c73947c967",
            "displayName": "AAD SSO Tab Sample",
            "webUrl": "https://teams.microsoft.com/l/entity/69d556a2-7dbc-4ecc-a120-39949a139035/_djb2_msteams_prefix_9a194990-3431-4cb0-a4e7-6a1be263e7f6?label=AAD+SSO+Tab+Sample&context=%7b%0d%0a++%22canvasUrl%22%3a+%22https%3a%2f%2f4d43ec148b9b.ngrok.io%2fssoDemo%22%2c%0d%0a++%22channelId%22%3a+%2219%3ac541d3cdf1664612b53387a5cd4081f1%40thread.skype%22%2c%0d%0a++%22subEntityId%22%3a+null%0d%0a%7d&groupId=f2f36090-8910-4110-a861-cd60147298e5&tenantId=0d9b645f-597b-41f0-a2a3-ef103fbd91bb",
            "configuration": {
                "entityId": "https://4d43ec148b9b.ngrok.io/ssoDemo",
                "contentUrl": "https://4d43ec148b9b.ngrok.io/ssoDemo",
                "removeUrl": null,
                "websiteUrl": null,
                "dateAdded": "2021-01-19T08:22:29.945Z"
            }
        }

Created a post request to  https://graph.microsoft.com/v1.0/teams/{team id}/channels/{channel}/tabs and in response I have added<EMAIL_ADDRESS>below with Property with same id which is present in weburl property after /entity/{id} i.e.69d556a2-7dbc-4ecc-a120-39949a139035. Your request must look like below.

    "id": "16824248-f784-4e08-bd57-e3c73947c967",
    "displayName": "AAD SSO Tab Sample Manish",
<EMAIL_ADDRESS>"https://graph.microsoft.com/v1.0/appCatalogs/teamsApps/69d556a2-7dbc-4ecc-a120-39949a139035",
    "webUrl": "https://teams.microsoft.com/l/entity/69d556a2-7dbc-4ecc-a120-39949a139035/_djb2_msteams_prefix_9a194990-3431-4cb0-a4e7-6a1be263e7f6?label=AAD+SSO+Tab+Sample&context=%7b%0d%0a++%22canvasUrl%22%3a+%22https%3a%2f%2f4d43ec148b9b.ngrok.io%2fssoDemo%22%2c%0d%0a++%22channelId%22%3a+%2219%3ac541d3cdf1664612b53387a5cd4081f1%40thread.skype%22%2c%0d%0a++%22subEntityId%22%3a+null%0d%0a%7d&groupId=f2f36090-8910-4110-a861-cd60147298e5&tenantId=0d9b645f-597b-41f0-a2a3-ef103fbd91bb",
    "configuration": {
        "entityId": "https://4d43ec148b9b.ngrok.io/ssoDemo",
        "contentUrl": "https://4d43ec148b9b.ngrok.io/ssoDemo",
        "removeUrl": null,
        "websiteUrl": null,
        "dateAdded": "2021-01-19T08:22:29.945Z"
    }
}

You have successfully added a new tab

@liangchr : I just successfully install/update tab in channel in teams.
Here are the steps that I followed.

Created a tab and sideloaded in it in teams.
Sent a request to https://graph.microsoft.com/v1.0/teams/{team id}/channels/{channel}/tabs and got the json data. It will be in the form of

            "id": "16824248-f784-4e08-bd57-e3c73947c967",
            "displayName": "AAD SSO Tab Sample",
            "webUrl": "https://teams.microsoft.com/l/entity/69d556a2-7dbc-4ecc-a120-39949a139035/_djb2_msteams_prefix_9a194990-3431-4cb0-a4e7-6a1be263e7f6?label=AAD+SSO+Tab+Sample&context=%7b%0d%0a++%22canvasUrl%22%3a+%22https%3a%2f%2f4d43ec148b9b.ngrok.io%2fssoDemo%22%2c%0d%0a++%22channelId%22%3a+%2219%3ac541d3cdf1664612b53387a5cd4081f1%40thread.skype%22%2c%0d%0a++%22subEntityId%22%3a+null%0d%0a%7d&groupId=f2f36090-8910-4110-a861-cd60147298e5&tenantId=0d9b645f-597b-41f0-a2a3-ef103fbd91bb",
            "configuration": {
                "entityId": "https://4d43ec148b9b.ngrok.io/ssoDemo",
                "contentUrl": "https://4d43ec148b9b.ngrok.io/ssoDemo",
                "removeUrl": null,
                "websiteUrl": null,
                "dateAdded": "2021-01-19T08:22:29.945Z"
            }
        }

Created a post request to  https://graph.microsoft.com/v1.0/teams/{team id}/channels/{channel}/tabs and in response I have added<EMAIL_ADDRESS>below with Property with same id which is present in weburl property after /entity/{id} i.e.69d556a2-7dbc-4ecc-a120-39949a139035. Your request must look like below.

    "id": "16824248-f784-4e08-bd57-e3c73947c967",
    "displayName": "AAD SSO Tab Sample Manish",
<EMAIL_ADDRESS>"https://graph.microsoft.com/v1.0/appCatalogs/teamsApps/69d556a2-7dbc-4ecc-a120-39949a139035",
    "webUrl": "https://teams.microsoft.com/l/entity/69d556a2-7dbc-4ecc-a120-39949a139035/_djb2_msteams_prefix_9a194990-3431-4cb0-a4e7-6a1be263e7f6?label=AAD+SSO+Tab+Sample&context=%7b%0d%0a++%22canvasUrl%22%3a+%22https%3a%2f%2f4d43ec148b9b.ngrok.io%2fssoDemo%22%2c%0d%0a++%22channelId%22%3a+%2219%3ac541d3cdf1664612b53387a5cd4081f1%40thread.skype%22%2c%0d%0a++%22subEntityId%22%3a+null%0d%0a%7d&groupId=f2f36090-8910-4110-a861-cd60147298e5&tenantId=0d9b645f-597b-41f0-a2a3-ef103fbd91bb",
    "configuration": {
        "entityId": "https://4d43ec148b9b.ngrok.io/ssoDemo",
        "contentUrl": "https://4d43ec148b9b.ngrok.io/ssoDemo",
        "removeUrl": null,
        "websiteUrl": null,
        "dateAdded": "2021-01-19T08:22:29.945Z"
    }
}

You have successfully added a new tab


When theres no icon it sends an error

its not a lot, but its really annoying, gonna fix that in a bit

FIxed it by making it a warning instead

its not a lot, but its really annoying, gonna fix that in a bit


possible bug: swarm preview broken?

I looked briefly... it doesn't seem the swarm preview gets tested during integration tests.  Am I mistaken?
When using it locally (from the master branch), I see errors like those below repeated over and over for both deis-swarm-manager and deis-swarm-node.
Jul 31 01:36:12 deis-02 systemd[1]: Starting deis-swarm-node...
Jul 31 01:36:12 deis-02 systemd[1]: Started deis-swarm-node.
Jul 31 01:36:12 deis-02 sh[9830]: ./deis-swarm join --addr=<IP_ADDRESS>:2375 etcd:///deis/scheduler/swarm/node
Jul 31 01:36:12 deis-02 sh[9830]: error at command wait
Jul 31 01:36:12 deis-02 sh[9830]: 2015/07/31 01:36:12 exit status 1
Jul 31 01:36:12 deis-02 systemd[1]: deis-swarm-node.service: main process exited, code=exited, status=1/FAILURE
Jul 31 01:36:12 deis-02 systemd[1]: Unit deis-swarm-node.service entered failed state.
Jul 31 01:36:12 deis-02 systemd[1]: deis-swarm-node.service failed.
Jul 31 01:36:17 deis-02 systemd[1]: deis-swarm-node.service holdoff time over, scheduling restart.

I wonder if flannel has confused things for swarm.

I wondered the same thing.  I've rolled back to pre-flannel and am still seeing the same thing.

If I go back to 1.8.0 and make discovery-url && vagrant up, I can install the 1.8.0 swarm components no problem.  In fact, on that local cluster, I can also successfully cd swarm && make build deploy
Now on the other hand, if I go back to 2f41ca0 (one commit before flannel), and make discovery-url && vagrant up, neither 1.8.0 or cd swarm && make build deploy work out.  Both yield the errors shown above.
This would seem to indicate something changed in how we bring up local vagrant clusters-- most likely userdata.

@mboersma I just determined it broke immediately after we added etcd2 to the user-data.

I'm feeling pretty stumped by this.  We're using early-docker to pull and start a containerized etcd2.  I have a vague suspicion that may have something to do with this, but none of my experimentation can confirm that yet.

Ping @kmala and @smothiki.  I think you guys worked on the swarm preview.  Do you have any ideas on how that could have been broken by etcd2 or the early-docker service that etcd2 depends on in our case?

Swarm requires docker version >1.6 . Recently we have downgraded CoreOS version to 647 whihc uses docker 1.5 because of some bug.

Interesting.  This seems to have broken at commit d332f73.  I didn't not a difference in docker version before that commit vs after, but I'm going to re-run my experiment to confirm that.


[dag] fail to insert processed certificates in DAG

Description
When tried to run a small cluster of 4 primary and 4 worker nodes, with consensus disabled, I observed on the log files that the insert operations on the DAG were failing. More specifically receiving errors like the one bellow:
2022-05-24T14:30:44.464149Z DEBUG primary::core: Processing uPR8oR9AvWWXSHKr: C1(noDjBFfXGqQioHTf6jEIPYthhUWCMsC12ZJ9DMh7Ujk=, I7eRt6/Y5Z0IgQ6L)
2022-05-24T14:30:44.465776Z ERROR insert{self=InnerDag { rx_primary: Receiver { chan: Rx { inner: Chan { tx: Tx { block_tail: 0xaaab101d5010, tail_position: 2 }, semaphore: (Semaphore { permits: 999 }, 1000), rx_waker: AtomicWaker, tx_count: 1, rx_fields: "..." } } }, rx_commands: Receiver { chan: Rx { inner: Chan { tx: Tx { block_tail: 0xaaab101dac70, tail_position: 0 }, semaphore: (Semaphore { permits: 1000 }, 1000), rx_waker: AtomicWaker, tx_count: 1, rx_fields: "..." } } }, dag: NodeDag { node_table: {} }, vertices: RwLock { data: {}, poisoned: false, .. } } certificate=1p1Dtk/cWV5BEYIk: C1(Zy82aSpF8QghKE4wWvyIoTWyLetCuUSfk2gxHEtwdbg=, FTno2BRK45kvbLJn)}: consensus::dag: error=Dag invariant violation No vertex known by these digests: [UXWPnsSff4MWl6KDu4yCsSx/gDW3GSGxWQguXZYs5gk=, Zp+McZcRLR6cXMYoDmLHj3VYNb+qeBJb9pWI/qo+fJ4=, a11qQmG81vCtFbwYkKPsh9k6MTFdau840cfhVSqBEo0=, ch8wEJmFilfbYjl/h3EJ6h3qI8+Gf1UPwSQC+7viC0M=]

The above issue observed on all the primary nodes, so it seems to be a common behaviour.
By a quick investigation I believe that this is attributed to the fact that on an empty DAG, when we try to insert the very first certificates, its parents don't exist - meaning the genesis headers - and the insertion fails.
Steps to reproduce

Spin up a cluster of Narwhal nodes (e.x via https://github.com/MystenLabs/narwhal/pull/269)
Open the log files and observe for errors
After the max_header_delay has passed, primary nodes should form a new header
An error like the above ERROR insert{self=InnerDag { rx_primary: Receiver...... will appear

CC @huitseeker

@akichidis Yep, exactly, as unit tests will show (because they set things up correctly, even if I forgot to do the same on the production line), you need to feed the genesis to the Dag.

Ok cool, so seems like populating the genesis certificates to the DAG when the primary node does spin up (probably here) would be the way to go.
Having said that, I believe that this leads to a small amendment to the GetCollections (probably the block_waiter) implementation - which to be honest I was thinking about some time ago - to ensure that an empty payload will be returned if the genesis headers are requested via the GetCollections. If we add the genesis certificates to the DAG, then those will be picked up by the consensus (via the read_causal) and next step will be to perform a GetCollections. Now, those certificates in practice don't exist anywhere in our system and the call will fail.


Problem with OpenCvSharp.VideoWriter

I'm trying to save a video from a camera stream, where the video stream is not compatible with the openCV camera.
I get a bitmap, and try to save it to a video using VideoWriter.  The process throws no errors, but the resultant .AVI file is empty even after 2000 writes to it.
I've noticed that neither the constructor nor the .Open method likes to have the second parameter, FourCC, specified but the default AVI would be fine, as long as it works.  When I look at the specs of my VFwriter after it's been opened, all the parameters are correct (size, color, framerate, etc),  It's just that the Write method doesn't actually write a valid Mat
All thoughts welcomed (and by welcomed, I mean I'm begging).
Phil
try
{
    VFwriter = new OpenCvSharp.VideoWriter();
    VFwriter.Open(theFile, -1, 13, new OpenCvSharp.Size(theBitmap.Width, theBitmap.Height), true);
}
catch (Exception ex2)
{
    MessageBox.Show("Exception at VFWriter.open(...)" + ex2.InnerException.Message);
}

Adding to the video is as follows:
try
{
    Mat image = BitmapConverter.ToMat(thisone.bmp );
    VFwriter.Write(image);
    if (this.iGrabCounter < 10)
    {
        image.SaveImage("C:\\temp\\image#" + iGrabCounter.ToString() + ".bmp");
    }
    // above line is just to verify that the Mat 'image' is valid - it is
    image.Dispose();
    thisone.bmp.Dispose();
}
catch (Exception ex)
{
    MessageBox.Show("Exception in savebmp_dowork" + ex.InnerException.Message);
}

Hi,
I got the same issue on my side. I'm able to do SaveImage it's working fine but when i want to write Mat to create video file, file is not created.
`using (var capture = new VideoCapture())
{
capture.Set(CaptureProperty.FrameWidth, 1920);
capture.Set(CaptureProperty.FrameHeight, 1080);
capture.Set(CaptureProperty.Fps, 60.0);
capture.Set(CaptureProperty.FrameCount, 80.0);
capture.Open(0);
Size dsize = new Size(capture.FrameWidth, capture.FrameHeight);
if (!capture.IsOpened())
throw new Exception("capture initialization failed");
            using (VideoWriter writer = new VideoWriter(OutVideoFile, FourCC.Prompt, capture.Fps, dsize))
            using (var window = new Window("capture"))
            {
                // Frame image buffer
                using (Mat image = new Mat())
                {
                    var count = 0;
                    // When the movie playback reaches end, Mat.data becomes NULL.
                    while (true)
                    {
                        if (count == 500)
                            break;

                        capture.Read(image); // same as cvQueryFrame
                        if (image.Empty()){
                            break;
                            }
                        image.SaveImage($"C:\\temp\\out{count}.bmp");
                        Console.CursorLeft = 0;
                        Console.Write($"FPS: {capture.Fps} FRAME COUNT {capture.FrameCount}");

                        writer.Write(image);

                        window.ShowImage(image);

                        Cv2.WaitKey(5);
                        count++;
                    }
                }
            }
        }`

Someone can help us?
Thanks

@ioxFR Hi,
you could replace FourCC.Prompt to capture.FourCC when you create VideoWriter object... in this case the file will be created, but you will not be able to open it in any player ;)  seems a bug

I met the same problem, the VideoWriter object file is not created...
The software is Visual Studio 2017. Codes are as follow.
Can someone experienced help me? Thank you very much.
VideoCapture capture = new VideoCapture(@"E:\video.mp4");
Mat image = new Mat();
capture.Read(image);
Cv2.ImShow("output", image);
OpenCvSharp.Size frame_size = new OpenCvSharp.Size(960, 544);
FourCC codec = FourCC.MPG4;
VideoWriter video_save = new VideoWriter(@"E:\video_save.avi", codec, 60, frame_size, true);
int i = 10;
while (i > 0)
{
i--;
capture.Read(image);
Cv2.ImShow("output2", image);
video_save.Write(image);
//MessageBox.Show(i.ToString());
}
video_save.Release();


support historical analysis for HC detector

Signed-off-by: Yaliang Wu<EMAIL_ADDRESS>Description
Support historical analysis for HC detector. For single entity detector, we just need to create one AD task as it has only one ML model. For HC detector, AD will run separate ML model for each entity. So we will create individual task for each entity. And we will have one detector level task to track overall state like progress. Will save detector level task id as parent task id in entity task.
The main steps for HC detector historical analysis:

Get top entities
Calculate how many entities can run concurrently based on settings and cluster resources. Then start N task lanes to run entities. Each lane will run 1 entity. For every entity task will get all data node's state and dispatch entity task to the node with least node.
If one entity task finished, worker node will send entity task done message to coordinating node to poll next entity task.
If entity task failed, will handle exception. Check java doc of ADTaskManager#getAdEntityTaskAction for details.
Once all entities done. Will mark the HC detector level task as done.

Check List

[x] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Codecov Report

Merging #104 (e3c4299) into single-flow-development-rc1 (d5e5084) will decrease coverage by 9.05%.
The diff coverage is 18.75%.

@@                        Coverage Diff                        @@
##             single-flow-development-rc1     #104      +/-   ##
=================================================================
- Coverage                          79.12%   70.07%   -9.06%
+ Complexity                          2700     2523     -177
=================================================================
  Files                                243      244       +1
  Lines                              11244    11895     +651
  Branches                            1033     1089      +56
=================================================================
- Hits                                8897     8335     -562
- Misses                              1917     3137    +1220
+ Partials                             430      423       -7

Flag
Coverage Δ

plugin
70.07% <18.75%> (-9.06%)
:arrow_down:

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files
Coverage Δ

...rg/opensearch/ad/AnomalyDetectorProfileRunner.java
76.47% <ø> (-0.79%)
:arrow_down:

...java/org/opensearch/ad/feature/FeatureManager.java
93.96% <ø> (-2.27%)
:arrow_down:

...ensearch/ad/rest/RestAnomalyDetectorJobAction.java
41.37% <0.00%> (-15.77%)
:arrow_down:

...arch/ad/rest/RestExecuteAnomalyDetectorAction.java
26.19% <0.00%> (ø)

...est/handler/IndexAnomalyDetectorActionHandler.java
43.08% <0.00%> (-6.31%)
:arrow_down:

...ava/org/opensearch/ad/task/ADHCBatchTaskCache.java
0.00% <0.00%> (ø)

...d/transport/GetAnomalyDetectorTransportAction.java
53.95% <ø> (-3.60%)
:arrow_down:

...rch/ad/transport/ForwardADTaskTransportAction.java
10.16% <4.34%> (-75.55%)
:arrow_down:

...ava/org/opensearch/ad/task/ADTaskCacheManager.java
42.77% <7.46%> (-50.81%)
:arrow_down:

...ain/java/org/opensearch/ad/task/ADTaskManager.java
21.09% <10.03%> (-52.13%)
:arrow_down:

... and 57 more

resolved all of open comments from me.  Please address the left over comments from the old PR: https://github.com/opensearch-project/anomaly-detection/pull/58

resolved all of open comments from me. Please address the left over comments from the old PR: #58

Thanks Kaituo. To save some effort, I just replied most other comments on the old PR directly. You can check my replies on the old PR and comment more on this PR if have new questions.


Stack deploy should respect service running status

Current behavior:

Every service of stack-a is running
Stop stack-a/service-a
Deploy stack-a
service-a is running

Expected behavior:

Every service of stack-a is running
Stop stack-a/service-a
Deploy stack-a
Every service other than service-a is running

The use case here is to do update deployments in a controlled way. We want to e.g. shut down the web server, then update every service and verify everything works 💯%, then after that start the (updated) web server.

IMO it's good that kontena stack deploy will start any stopped services, it ensures that the stack will be working/running after a deploy, even if you forgot that you had some services stopped.
I think the ideal workaround for these kind of "manual" stack deployments would be to use kontena stack upgrade --no-deploy followed by a manual kontena service deploy of any services that you would like to have running.
Unfortunately, this workaround doesn't work, because kontena stack upgrade --no-deploy will not actually update the services. Only kontena stack deploy will apply the changes from the stack revision  to the actual grid services on the master, allowing you to deploy the services, but that command/API will also deploy all the services. Filed #2311 to propose changing this.
Closing this issue in favor of the #2311 design proposal to allow the kontena stack upgrade --no-deploy + manual kontena service deploy workaround.


complete doxygen documentation

for classes and functions
for each module and data structure in the emorph_lib add a more detailed description of how it works as a doxygen 'module'

The documentation of all modules is due by May 31. Let's talk and organise who can do which parts.


use Shippable instead of Travis

Otherwise, that look like a good step. Do we want to merge right now ? (cause anything can be fixed later), use it as a test for now, change everything ?

would be nice to test, even if I'm working on the next step

Misc said OK on IRC


[8.2] Backport AWS Lambda doc updates

This PR backports the following commits:

https://github.com/elastic/apm-aws-lambda/pull/158
https://github.com/elastic/apm-aws-lambda/pull/173
d0f03e72b9e5d467dd375a60fc8ef98a1d34b29c (typo fix)

:green_heart: Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2022-04-01T19:00:01.340+0000

Duration: 8 min 31 sec

Test stats :test_tube:

Test
Results

Failed
0

Passed
240

Skipped
6

Total
246

:robot: GitHub comments
To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

The preview looks good. All links to agent docs tested and working ✅


Merge upstream 20231219

Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:

Comparison is base (69ac752) 39.15% compared to head (ed2f09e) 63.48%.

:exclamation: Your organization needs to install the Codecov GitHub app to enable full functionality.
Additional details and impacted files
@@             Coverage Diff              @@
##           develop      #91       +/-   ##
============================================
+ Coverage    39.15%   63.48%   +24.33%
============================================
  Files          177       16      -161
  Lines         7483     1427     -6056
  Branches      1199        0     -1199
============================================
- Hits          2930      906     -2024
+ Misses        4439      475     -3964
+ Partials       114       46       -68

Flag
Coverage Δ

cannon-go-tests
63.48% <100.00%> (+0.01%)
:arrow_up:

chain-mon-tests
?

common-ts-tests
?

contracts-bedrock-tests
?

contracts-ts-tests
?

core-utils-tests
?

sdk-next-tests
?

sdk-tests
?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files
Coverage Δ

cannon/cmd/json.go
39.13% <100.00%> (-3.73%)
:arrow_down:

cannon/mipsevm/evm.go
90.76% <ø> (+24.10%)
:arrow_up:

cannon/mipsevm/witness.go
100.00% <ø> (+14.28%)
:arrow_up:

... and 161 files with indirect coverage changes


Iran situation

Iran overall is spammed with onosm.org notes, to the point of killing note feature there, see https://resultmaps.neis-one.org/osm-notes-country?c=Iran

See also #121 and  #103
Last month about 13 000  old notes in Iran were mass-closed with a script by someone, due to onosm.org note wave.

Dupe of #103

Dupe of https://github.com/osmlab/onosm.org/issues/103

No, as many of them are in Iran - with so high activity that they killed note feature in Iran

Maybe it would be a good idea to block futher onosm.org notes in Iran until this notes are processed?
Right now whoever does this manually wastes time (or is completely misguided if they do it automatically) and makes much harder to process real notes.

I'm grouping all the "lots of notes in the wrong spot" issues into #103, simply because that's where most of the discussion has been happening.

(1) then maybe changing title would be a good idea? I searched whether it was reported, seen that, not even opened it as title was about something clearly different
(2) it is not merely about "many notes at a single location" - it is about confused/too large scale/misautomated use of onosm.org swamping any other notes in Iran and ending as a huge waste for everyone (whoever makes them whoever mass closes them, whoever processes notes)

then maybe changing title would be a good idea?

I changed the title of 103. The reason I replied to this and other tickets was to redirect people who might come upon these tickets (that perhaps match their search terms better).

it is about confused/too large scale/misautomated use of onosm.org swamping any other notes in Iran and ending as a huge waste for everyone

I am redirecting people because I think a solution to the problem you mention is to fix the bug that makes it easy to generate Notes in the wrong spot with onosm.org.

I am redirecting people because I think a solution to the problem you mention is to fix the bug that makes it easy to generate Notes in the wrong spot with onosm.org.

How it will fix problem of creating tens of thousands of notes in Iran, beyond any capacity of mappers active there?

Lots of people suggesting data improvements to OSM is not a problem.

It is a problem when people processing notes are overwhelmed by huge volume.
It can easily result in situation where people start ignoring note feature completely if it is overwhelming. Low quality notes can make it even worse.


not update RemoteVideoListener.java for New RecordingMode.ALL

you forgot to rewrite the class testng/src/main/java/com/automation/remarks/testng/RemoteVideoListener.java
to work with new Mode (RecordingMode.ALL)
Change to
 private boolean videoEnabled(Video video) {         return VideoRecorder.conf().getMode().equals(ALL) || (video != null && video.enabled());     }

@crazyk2 ok, need to be fixed in 1.0.5 version

Fixed by https://github.com/SergeyPirogov/VideoRecorder/commit/aac8f3835f9cd80d107ee07d49e5e32e5130c2ac

please, give me your email, skype, whatsupp
<EMAIL_ADDRESS>i write fast fix for remote attach video and want to send it for you

@crazyk2 why do not create pull request?

I want to consult and clarify some details

@SergeyPirogov
I want to consult and clarify some details

@crazyk2 please add me sergio_894, because there are a lot skype ids similat to yours


scoreboard values not working.

Describe the bug
None of the values are working for the scoreboard

Expected behavior
The values should show correctly
Desktop (please complete the following information):
Game version 1.21.1

Describe the bug None of the values are working for the scoreboard

Expected behavior The values should show correctly
Desktop (please complete the following information): Game version 1.21.1

Hello, you need to use placeholderapi for those values.


ItemEdit

Plugin Name: ItemEdit
Plugin Version: 3
Author: Adam
Server Version: paper 1.15.2
Skript Version: 2.4.1
Bug: Name displays as  in the GUI.
Steps to reproduce: Use /edit

I'm not sure what this means but I'll take a look

Sorry, made a typo. The name displays as


Project count duplication

I hit import button on the DNO company file (Norwegian companies) twice
it led to duplicate count on project page:
DNO Iraq has 3 project not 6
DNO yemen has 5 not 10 projects
http://dev.resourceprojects.org/company/56fc03df1ca3ee0100580a45

Double loads are now prevented at the html-page level: can we hence move this to hard launch?

Awesome thanks!


Panic when using example on ARM

I built the "surgemq" example on a Raspberry Pi 2 with Debian Jessie and get this
E0221 22:25:38.464626    3586 service.go:193/func·008] (1/mosqpub/3594-jessie-rpi) Recovering from panic: runtime error: invalid memory address or nil pointer dereference
E0221 22:25:38.468213    3586 sendrecv.go:33/func·003] (1/mosqpub/3594-jessie-rpi) Recovering from panic: runtime error: invalid memory address or nil pointer dereference
E0221 22:25:38.468502    3586 sendrecv.go:74/func·004] (1/mosqpub/3594-jessie-rpi) Recovering from panic: runtime error: invalid memory address or nil pointer dereference
^CE0221 22:25:45.004451    3586 surgemq.go:77/func·001] Existing due to trapped signal; interrupt

when I execute mosquitto_pub -r -m "test by mr" -t 'test/topic'.
I had to change the example although as otherwise I got more errors. My imports look now like this:
        "github.com/surgemq/surgemq/service"
        "github.com/surge/glog"

sorry, looks like a bug in Go on ARM.
For the curious, this is the repro:
package main

import (
    "sync"
    "sync/atomic"
    "fmt"
)

type buffer struct {
        id int32

        mask int64

        done int64

        pcond *sync.Cond
        ccond *sync.Cond

        cwait int64
        pwait int64
}

func test(buf *buffer) bool {
        if atomic.LoadInt64(&buf.done) == 1 {
                return true
        }

        return false
}
func main() {
        var buf buffer
				buf.done = 1
        fmt.Println("pre-fail")
        res := test(&buf)
        fmt.Println("post-fail", res)
}


stop allowing str as basic input to validators

Codecov Report

Merging #256 (4b600cd) into main (08cecc5) will increase coverage by 0.03%.
The diff coverage is 97.87%.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #256      +/-   ##
==========================================
+ Coverage   98.54%   98.58%   +0.03%
==========================================
  Files          50       50
  Lines        5166     5157       -9
  Branches       36       36
==========================================
- Hits         5091     5084       -7
+ Misses         74       73       -1
+ Partials        1        0       -1

Impacted Files
Coverage Δ

src/validators/union.rs
99.11% <95.83%> (-0.01%)
:arrow_down:

pydantic_core/core_schema.py
100.00% <100.00%> (+0.84%)
:arrow_up:

src/validators/mod.rs
99.62% <100.00%> (-0.01%)
:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 08cecc5...4b600cd. Read the comment docs.


nvhsp added to nvenc hdr content

I have a feature request for NVEncC64 encoded videos with HDR on a 10x0 Nvidia card. Could you please add nvhsp.exe as a post process for hdr content specially for those kind of reencodes with NVEncc64 to add the HDR10 Metadata?
It's totally free and this is the website:
https://github.com/SK-Hardwired/nv_hevc_hdr_patcher
This would save me tons of time instead of having to type everything myself manually in a bat file. This is simply because it can go straight to an MKV instead of having to do the post process manually.
PS: of course this doesn't work together with the OLD region settings (PAL) in V1.6 of staxrip.
So my idea is to add an on and off switch for hdr content and if it's on you can enter the things needed by nvhsp to add HDR10 Metadata specially for nvenc videos. The on and off switch means it will either do or skip the nvhsp after the h265 reencode and put it into an mkv.
Many thanks for the backup tool and hopefully you can make this work too.

I usually don't add HDR features, I've added an event after the video encoder and a macro to get the encoder name, there are two ways you will be able to do it either with a powershell extension which is difficult or with a event command (Tools > Advanced > Event Command), here is a event command example using dos/batch:

Thank you SO much for this

A new build should be online in 1-2 minutes.

hello i use this settings
-masterdisplay G(15000,30000)B(7500,3000)R(32000,16500)WP(15635,16450)L(4000000,1) -maxcll 400,400
but the HDR do not works why ?

Hello, which videocard do you have? Only the 10x0 series from nvidia
support this. Second your maxcll are odd...avg is the same as max
Op 11 nov. 2017 12:24 p.m. schreef "foXaCe"<EMAIL_ADDRESS>
hello i use this settings
-masterdisplay G(15000,30000)B(7500,3000)R(32000,16500)WP(15635,16450)L(4000000,1)
-maxcll 400,400
but the HDR do not works why ?
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/stax76/staxrip/issues/261#issuecomment-343658044, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AdX5NIjgdbjXWKtifFkNODpEuBirGIdJks5s1YPjgaJpZM4Oyxkk
.

yes it is a 1060.
what are the [-params] that you use?

I use properties with mpc-be to see the correct values. Mpc-be is a very
small mediaplayer with mediainfo intergrated.
Op 11 nov. 2017 12:30 p.m. schreef "foXaCe"<EMAIL_ADDRESS>
yes it is a 1060.
what are the [-params] that you use?
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/stax76/staxrip/issues/261#issuecomment-343658366, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AdX5NGhzg6hiKjVwBjLaYJEC2DnX10Rwks5s1YVngaJpZM4Oyxkk
.

These are the correct parameters when translating from mediainfo:
Inferno (2016) -colorprim bt2020 -transfer smpte-st-2084 -chromaloc 2
-videoformat pal -colormatrix bt2020nc -full_range tv -masterdisplay
G(13250,34500)B(7500,3000)R(34000,16000)WP(15635,16450)L(40000000,50)
-maxcll '10000,3647'
La La Land (2016) -colorprim bt2020 -transfer smpte-st-2084 -chromaloc 2
-videoformat pal -colormatrix bt2020nc -full_range tv -masterdisplay
G(13250,34500)B(7500,3000)R(34000,16000)WP(15635,16450)L(10000000,0)
-maxcll '1000,640'
Passengers (2016) -colorprim bt2020 -transfer smpte-st-2084 -chromaloc 2
-videoformat pal -colormatrix bt2020nc -full_range tv -masterdisplay
G(13250,34500)B(7500,3000)R(34000,16000)WP(15635,16450)L(40000000,50)
-maxcll '1529,380'
Patriots Day (2016) -colorprim bt2020 -transfer smpte-st-2084 -chromaloc 2
-videoformat pal -colormatrix bt2020nc -full_range tv -masterdisplay
G(13250,34500)B(7500,3000)R(34000,16000)WP(15634,16450)L(10000000,0)
-maxcll '1000,510'
The Huntsman - Winter's War (2016) (Extended Edition) -colorprim bt2020
-transfer smpte-st-2084 -chromaloc 2 -videoformat pal -colormatrix bt2020nc
-full_range tv -masterdisplay
G(13250,34500)B(7500,3000)R(34000,16000)WP(15635,16450)L(10000000,50)
-maxcll '1000,400'
The Martian (2015) (Extended Edition)  -colorprim bt2020 -transfer
smpte-st-2084 -chromaloc 2 -videoformat pal -colormatrix bt2020nc
-full_range tv -masterdisplay
G(13250,34500)B(7500,3000)R(34000,16000)WP(15635,16450)L(10000000,0)
The Shallows (2016) -colorprim bt2020 -transfer smpte-st-2084 -chromaloc 2
-videoformat pal -colormatrix bt2020nc -full_range tv -masterdisplay
G(13250,34500)B(7500,3000)R(34000,16000)WP(15635,16450)L(40000000,50)
-maxcll '1933,709'
The Smurfs 2 (2013) -colorprim bt2020 -transfer smpte-st-2084 -chromaloc 2
-videoformat pal -colormatrix bt2020nc -full_range tv -masterdisplay
G(13250,34500)B(7500,3000)R(34000,16000)WP(15635,16450)L(40000000,50)
-maxcll '1132,923'
For the dutch version of these movies.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/stax76/staxrip/issues/261#issuecomment-343658366, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AdX5NGhzg6hiKjVwBjLaYJEC2DnX10Rwks5s1YVngaJpZM4Oyxkk
.

And further more make sure you do NOT set PAL settings IN staxrip itself,
since that is the OLD version of PAL.
2017-11-11 12:30 GMT+01:00 foXaCe<EMAIL_ADDRESS>
yes it is a 1060.
what are the [-params] that you use?
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/stax76/staxrip/issues/261#issuecomment-343658366, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AdX5NGhzg6hiKjVwBjLaYJEC2DnX10Rwks5s1YVngaJpZM4Oyxkk
.

https://drive.google.com/open?id=0B_w0SPyAj5qLNnBrWFJINVFYQlU
Here are some templates for StaxRip you can use.
2017-11-11 12:45 GMT+01:00 Pieter Cooijmans<EMAIL_ADDRESS>
And further more make sure you do NOT set PAL settings IN staxrip itself,
since that is the OLD version of PAL.
2017-11-11 12:30 GMT+01:00 foXaCe<EMAIL_ADDRESS>
yes it is a 1060.
what are the [-params] that you use?
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/stax76/staxrip/issues/261#issuecomment-343658366,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AdX5NGhzg6hiKjVwBjLaYJEC2DnX10Rwks5s1YVngaJpZM4Oyxkk
.

ok thank you. I will test

ok thank you, all work very good.
thank for you help

NVIDIA Driver 385.69 is the last driver to work properly with this, after
that nvenc stops to work correctly. It's waiting for a major update on
nvenc before this will be fixed. And NVEnc version 3.17 is kinda stable.
Anything below that and you will get problems.

I use properties with mpc-be to see the correct values. Mpc-be is a very
small mediaplayer with mediainfo intergrated.
2018-01-31 17:43 GMT+01:00 Biatscho<EMAIL_ADDRESS>
How you get ur nvhsp to work ????, cant get it working ...... (when it
writes the vui it deletes my sei data) staxrip <IP_ADDRESS> running
tried with 1.6.7 still no luck ?????
do you got a step by step guide wich settings u use in nvenc sei (not the
specifics for movies just standards to tryout and fill ins to the nvhsp
command
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/stax76/staxrip/issues/261#issuecomment-361992981, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AdX5NF_vB78gRGr2Zo1YU82zczV5Cp0Tks5tQJhBgaJpZM4Oyxkk
.

And last but not least:
Why do I use these versions of the software and not more recent ones:
-MKVToolNix <IP_ADDRESS> (ALSO IN STAXRIP!!!!...you HAVE to manually replace
the files) Why? After version <IP_ADDRESS> from MKVToolNix the team has started
rebuilding MKVToolNIX ENTIRELY. This process will take YEARS. Yes they do
put out versions very frequently. But EVERY EMBL library update means they
HAVE to rebuild MKVToolNix. So I stick with the old library TILL a new EMBL
library is added. That means the version is finally somewhat stable and
most bugs have been fixed. So keep in mind ALWAYS Stay 1 EMBL Library
behind!
-NVEnc 3.17 (ALSO IN STAXRIP!!!....you MAY have to manually replace these
files) This version was the first kinda stable version to work properly
with nvhsp. After that there have been updates I know, however these
updates were made on current drivers from NVIDIA meaning some important
features were removed like -weightp and things like that.
-StaxRip test version: This is because <IP_ADDRESS> was totally buggy and this
is probably the last version that works with nvhsp properly. 1.6.7 has a
half intergrated "nvhsp" that StaxRip itselfs tries to do. However it lacks
a LOT of features that real nvhsp has. Yes I know it's a test version....so
it's not bug free either. The most important thing you have to remember is
that this version will not support more then a max of 8 jobs in the queue
due to a memory leak. Rest of it works fine.
StaxRip 1.7 makes use of MKVToolNix <IP_ADDRESS> which means it is based on a
different commandline command so you can't copy MKVToolNix <IP_ADDRESS> into
1.7 and make it work. Also 1.7 has a futher intergrated own version of
nvhsp...however still not with all the features neccesary.
-Why do I set a PAL region? Simply because a LOT of TVs do NOT support NO
region specified and PAL region is the Dutch region. There is a map
included in the google drive link I sent you earlier.
-And last but not least: I made profiles of the new standard blu-ray discs
with "lossless" quality. Of course it's not 100% lossless however the naked
eye won't see the difference. The subjective lossless h265 from h264 files
is a very interesting one. It basicly means you can encode any old blu-ray
25GB or 50GB into 12000kilobits per second h265 and if you play the video
normally you shouldn't be able to see a difference in quality. However if
you stop the video you will see a change. This I can support with math.
Just lookup on Wiki what the subjective test results are for h265 compared
to h264. You will see it's 62.something % reduction on avg for 1080p. This
means that you can reduce the bitrate by 56% (also from the same article)
and it's for all 1080p movies. Normally a standard 50GB blu-ray movie in
1080p has a bitrate between 25000 and 40000 for the more modern blu-rays.
The new blu-ray discs at 4k HDR need at LEAST 25000kilobits per second avg
in h265 codec with a max of 40000 to at least see an improvement in quality
over the old blu-ray. Simply put: Don't try to reencode 4K lower than
25000kilobits avg or you are better off with the old 1080p version. This is
because of the extra features added to 4K HDR blu-rays like color depth and
so on and so on. Then why did I choose for 25000kilobits and not higher?
This has to do with the TVs again. Since there are PLENTY of TVs that do
NOT support bitrates in 4K HDR over 25000kilobits. So it's just because of
compatibility.
-PS: Forget about streaming to google chromecast ultra or any other media
player. The ONLY mediaplayer that supports 4K HDR properly atm is the
nvidia shield pro 2017 with the 500GB hdd in combination with kodi or a PC
with a 10x0 graphics card connected to a tv. Maybe the new playstation
and/or xbox also work however I have no clue about that. And YES YOU WILL
NEED WIRED 1gigabit ethernet. 100Mbit is too slow and will result in a LOT
of lag and desync issues. So you can say for sure that ANY mediaplayer with
100Mbit can NOT properly support 4K HDR streams. Wifi in very very rare
cases works, but more than 90% of the time it ends up in lagfest. The best
movie to test if your player is up for the task is Inferno. This movies is
made so that it causes extreme bitrate spikes. Especially the scene where
Tom Hanks is in the fake hospital near the start of the movie. It's basicly
a performance test for mediaplayers.
2018-02-01 3:00 GMT+01:00 Pieter Cooijmans<EMAIL_ADDRESS>
I use properties with mpc-be to see the correct values. Mpc-be is a very
small mediaplayer with mediainfo intergrated.
2018-01-31 17:43 GMT+01:00 Biatscho<EMAIL_ADDRESS>
How you get ur nvhsp to work ????, cant get it working ...... (when it
writes the vui it deletes my sei data) staxrip <IP_ADDRESS> running
tried with 1.6.7 still no luck ?????
do you got a step by step guide wich settings u use in nvenc sei (not the
specifics for movies just standards to tryout and fill ins to the nvhsp
command
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/stax76/staxrip/issues/261#issuecomment-361992981,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AdX5NF_vB78gRGr2Zo1YU82zczV5Cp0Tks5tQJhBgaJpZM4Oyxkk
.

Sorry I meant the NVidia Shield TV Pro of course with 500Gb harddisk. Why
the harddisk?...kodi takes up a LOT of space and the 16GB flash memory you
get on the lower model is frustratingly slow AND you will run out of space
quick if you want to install games or anything else.
2018-02-01 4:09 GMT+01:00 Pieter Cooijmans<EMAIL_ADDRESS>
And last but not least:
Why do I use these versions of the software and not more recent ones:
-MKVToolNix <IP_ADDRESS> (ALSO IN STAXRIP!!!!...you HAVE to manually replace
the files) Why? After version <IP_ADDRESS> from MKVToolNix the team has started
rebuilding MKVToolNIX ENTIRELY. This process will take YEARS. Yes they do
put out versions very frequently. But EVERY EMBL library update means they
HAVE to rebuild MKVToolNix. So I stick with the old library TILL a new EMBL
library is added. That means the version is finally somewhat stable and
most bugs have been fixed. So keep in mind ALWAYS Stay 1 EMBL Library
behind!
-NVEnc 3.17 (ALSO IN STAXRIP!!!....you MAY have to manually replace these
files) This version was the first kinda stable version to work properly
with nvhsp. After that there have been updates I know, however these
updates were made on current drivers from NVIDIA meaning some important
features were removed like -weightp and things like that.
-StaxRip test version: This is because <IP_ADDRESS> was totally buggy and this
is probably the last version that works with nvhsp properly. 1.6.7 has a
half intergrated "nvhsp" that StaxRip itselfs tries to do. However it lacks
a LOT of features that real nvhsp has. Yes I know it's a test version....so
it's not bug free either. The most important thing you have to remember is
that this version will not support more then a max of 8 jobs in the queue
due to a memory leak. Rest of it works fine.
StaxRip 1.7 makes use of MKVToolNix <IP_ADDRESS> which means it is based on a
different commandline command so you can't copy MKVToolNix <IP_ADDRESS> into
1.7 and make it work. Also 1.7 has a futher intergrated own version of
nvhsp...however still not with all the features neccesary.
-Why do I set a PAL region? Simply because a LOT of TVs do NOT support NO
region specified and PAL region is the Dutch region. There is a map
included in the google drive link I sent you earlier.
-And last but not least: I made profiles of the new standard blu-ray discs
with "lossless" quality. Of course it's not 100% lossless however the naked
eye won't see the difference. The subjective lossless h265 from h264 files
is a very interesting one. It basicly means you can encode any old blu-ray
25GB or 50GB into 12000kilobits per second h265 and if you play the video
normally you shouldn't be able to see a difference in quality. However if
you stop the video you will see a change. This I can support with math.
Just lookup on Wiki what the subjective test results are for h265 compared
to h264. You will see it's 62.something % reduction on avg for 1080p. This
means that you can reduce the bitrate by 56% (also from the same article)
and it's for all 1080p movies. Normally a standard 50GB blu-ray movie in
1080p has a bitrate between 25000 and 40000 for the more modern blu-rays.
The new blu-ray discs at 4k HDR need at LEAST 25000kilobits per second avg
in h265 codec with a max of 40000 to at least see an improvement in quality
over the old blu-ray. Simply put: Don't try to reencode 4K lower than
25000kilobits avg or you are better off with the old 1080p version. This is
because of the extra features added to 4K HDR blu-rays like color depth and
so on and so on. Then why did I choose for 25000kilobits and not higher?
This has to do with the TVs again. Since there are PLENTY of TVs that do
NOT support bitrates in 4K HDR over 25000kilobits. So it's just because of
compatibility.
-PS: Forget about streaming to google chromecast ultra or any other media
player. The ONLY mediaplayer that supports 4K HDR properly atm is the
nvidia shield pro 2017 with the 500GB hdd in combination with kodi or a PC
with a 10x0 graphics card connected to a tv. Maybe the new playstation
and/or xbox also work however I have no clue about that. And YES YOU WILL
NEED WIRED 1gigabit ethernet. 100Mbit is too slow and will result in a LOT
of lag and desync issues. So you can say for sure that ANY mediaplayer with
100Mbit can NOT properly support 4K HDR streams. Wifi in very very rare
cases works, but more than 90% of the time it ends up in lagfest. The best
movie to test if your player is up for the task is Inferno. This movies is
made so that it causes extreme bitrate spikes. Especially the scene where
Tom Hanks is in the fake hospital near the start of the movie. It's basicly
a performance test for mediaplayers.
2018-02-01 3:00 GMT+01:00 Pieter Cooijmans<EMAIL_ADDRESS>
I use properties with mpc-be to see the correct values. Mpc-be is a very
small mediaplayer with mediainfo intergrated.
2018-01-31 17:43 GMT+01:00 Biatscho<EMAIL_ADDRESS>
How you get ur nvhsp to work ????, cant get it working ...... (when it
writes the vui it deletes my sei data) staxrip <IP_ADDRESS> running
tried with 1.6.7 still no luck ?????
do you got a step by step guide wich settings u use in nvenc sei (not
the specifics for movies just standards to tryout and fill ins to the nvhsp
command
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/stax76/staxrip/issues/261#issuecomment-361992981,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AdX5NF_vB78gRGr2Zo1YU82zczV5Cp0Tks5tQJhBgaJpZM4Oyxkk
.

The NVidia Shield TV Pro 2017 500GB is meant for streaming movies over your
ethernet connection. It can however store movies on the 500GB harddisk but
a NAS or PC network Share is more ideal. It ALSO has a build in google
chromecast ultra so that also works ...funny thing is it actually works
better than the chromecast ultra itself due to the WAAAAY faster processor
the shield has.
2018-02-01 4:18 GMT+01:00 Pieter Cooijmans<EMAIL_ADDRESS>
Sorry I meant the NVidia Shield TV Pro of course with 500Gb harddisk. Why
the harddisk?...kodi takes up a LOT of space and the 16GB flash memory you
get on the lower model is frustratingly slow AND you will run out of space
quick if you want to install games or anything else.
2018-02-01 4:09 GMT+01:00 Pieter Cooijmans<EMAIL_ADDRESS>
And last but not least:
Why do I use these versions of the software and not more recent ones:
-MKVToolNix <IP_ADDRESS> (ALSO IN STAXRIP!!!!...you HAVE to manually replace
the files) Why? After version <IP_ADDRESS> from MKVToolNix the team has started
rebuilding MKVToolNIX ENTIRELY. This process will take YEARS. Yes they do
put out versions very frequently. But EVERY EMBL library update means they
HAVE to rebuild MKVToolNix. So I stick with the old library TILL a new EMBL
library is added. That means the version is finally somewhat stable and
most bugs have been fixed. So keep in mind ALWAYS Stay 1 EMBL Library
behind!
-NVEnc 3.17 (ALSO IN STAXRIP!!!....you MAY have to manually replace these
files) This version was the first kinda stable version to work properly
with nvhsp. After that there have been updates I know, however these
updates were made on current drivers from NVIDIA meaning some important
features were removed like -weightp and things like that.
-StaxRip test version: This is because <IP_ADDRESS> was totally buggy and this
is probably the last version that works with nvhsp properly. 1.6.7 has a
half intergrated "nvhsp" that StaxRip itselfs tries to do. However it lacks
a LOT of features that real nvhsp has. Yes I know it's a test version....so
it's not bug free either. The most important thing you have to remember is
that this version will not support more then a max of 8 jobs in the queue
due to a memory leak. Rest of it works fine.
StaxRip 1.7 makes use of MKVToolNix <IP_ADDRESS> which means it is based on a
different commandline command so you can't copy MKVToolNix <IP_ADDRESS> into
1.7 and make it work. Also 1.7 has a futher intergrated own version of
nvhsp...however still not with all the features neccesary.
-Why do I set a PAL region? Simply because a LOT of TVs do NOT support NO
region specified and PAL region is the Dutch region. There is a map
included in the google drive link I sent you earlier.
-And last but not least: I made profiles of the new standard blu-ray
discs with "lossless" quality. Of course it's not 100% lossless however the
naked eye won't see the difference. The subjective lossless h265 from h264
files is a very interesting one. It basicly means you can encode any old
blu-ray 25GB or 50GB into 12000kilobits per second h265 and if you play the
video normally you shouldn't be able to see a difference in quality.
However if you stop the video you will see a change. This I can support
with math. Just lookup on Wiki what the subjective test results are for
h265 compared to h264. You will see it's 62.something % reduction on avg
for 1080p. This means that you can reduce the bitrate by 56% (also from the
same article) and it's for all 1080p movies. Normally a standard 50GB
blu-ray movie in 1080p has a bitrate between 25000 and 40000 for the more
modern blu-rays. The new blu-ray discs at 4k HDR need at LEAST
25000kilobits per second avg in h265 codec with a max of 40000 to at least
see an improvement in quality over the old blu-ray. Simply put: Don't try
to reencode 4K lower than 25000kilobits avg or you are better off with the
old 1080p version. This is because of the extra features added to 4K HDR
blu-rays like color depth and so on and so on. Then why did I choose for
25000kilobits and not higher? This has to do with the TVs again. Since
there are PLENTY of TVs that do NOT support bitrates in 4K HDR over
25000kilobits. So it's just because of compatibility.
-PS: Forget about streaming to google chromecast ultra or any other media
player. The ONLY mediaplayer that supports 4K HDR properly atm is the
nvidia shield pro 2017 with the 500GB hdd in combination with kodi or a PC
with a 10x0 graphics card connected to a tv. Maybe the new playstation
and/or xbox also work however I have no clue about that. And YES YOU WILL
NEED WIRED 1gigabit ethernet. 100Mbit is too slow and will result in a LOT
of lag and desync issues. So you can say for sure that ANY mediaplayer with
100Mbit can NOT properly support 4K HDR streams. Wifi in very very rare
cases works, but more than 90% of the time it ends up in lagfest. The best
movie to test if your player is up for the task is Inferno. This movies is
made so that it causes extreme bitrate spikes. Especially the scene where
Tom Hanks is in the fake hospital near the start of the movie. It's basicly
a performance test for mediaplayers.
2018-02-01 3:00 GMT+01:00 Pieter Cooijmans<EMAIL_ADDRESS>
I use properties with mpc-be to see the correct values. Mpc-be is a very
small mediaplayer with mediainfo intergrated.
2018-01-31 17:43 GMT+01:00 Biatscho<EMAIL_ADDRESS>
How you get ur nvhsp to work ????, cant get it working ...... (when it
writes the vui it deletes my sei data) staxrip <IP_ADDRESS> running
tried with 1.6.7 still no luck ?????
do you got a step by step guide wich settings u use in nvenc sei (not
the specifics for movies just standards to tryout and fill ins to the nvhsp
command
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/stax76/staxrip/issues/261#issuecomment-361992981,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AdX5NF_vB78gRGr2Zo1YU82zczV5Cp0Tks5tQJhBgaJpZM4Oyxkk
.

Oh and the last thing....you said not specifics for movies....this is a
pretty common mistake due to the legacy of the h264 standard. ALL movies
WITH HDR have a specific setting, because they were made on a specific
monitor with a specific setting for professional use. IF you do NOT set
these specific settings the device you play the movie from in most cases
will NOT play back in HDR, simply because it does NOT know how to translate
the specific monitor settings correctly to the playback monitor so that the
movie looks correctly. The WHOLE idea behind HDR is to END the ENDLESS
tweaking of colors due to differences between monitors. No monitor is
exactly the same as a second same type of monitor, so in order to make the
colors on every monitor somewhat the same there have been made a LOT of
rules what makes an HDR monitor an HDR monitor. If you have a decent HDR
monitor it lets the playback device know the display string as shown in
earlier e-mails so it can calculate back what the correct colors for THAT
specific movie are on the CURRENT monitor. This is all factory standard and
yes still you can of course tweak your monitor to your likings. However
without those settings most devices don't know what to do with the HDR
stream OR play it back at some random factory default that doesn't make any
sense. Hope this makes some things clear about the somewhat new HDR
standard. It's just one of the major problems movies studios kept running
in to. If you have 40 people making a movie on 40 different computers you
get 40 different color strings. So in order to make a movie look okay they
needed this standard else the increase of color depth would reveal a LOT of
artifects....not because they ARE artifects...but simply monitors that
didn't have the proper alignment. So to say it in math, color: 127,127,127
would be different on each monitor so some movie editors would make it
128,126,129 to make it look right on THEIR monitor, hench the issues.
2018-01-31 17:43 GMT+01:00 Biatscho<EMAIL_ADDRESS>
How you get ur nvhsp to work ????, cant get it working ...... (when it
writes the vui it deletes my sei data) staxrip <IP_ADDRESS> running
tried with 1.6.7 still no luck ?????
do you got a step by step guide wich settings u use in nvenc sei (not the
specifics for movies just standards to tryout and fill ins to the nvhsp
command
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/stax76/staxrip/issues/261#issuecomment-361992981, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AdX5NF_vB78gRGr2Zo1YU82zczV5Cp0Tks5tQJhBgaJpZM4Oyxkk
.

HDR is one of the main reasons that real 4K HDR content from a playback
device connected to a TV only works via the hdmi 2.0 port because of the
master display string and such on most current TVs.
2018-02-01 7:31 GMT+01:00 Pieter Cooijmans<EMAIL_ADDRESS>
Oh and the last thing....you said not specifics for movies....this is a
pretty common mistake due to the legacy of the h264 standard. ALL movies
WITH HDR have a specific setting, because they were made on a specific
monitor with a specific setting for professional use. IF you do NOT set
these specific settings the device you play the movie from in most cases
will NOT play back in HDR, simply because it does NOT know how to translate
the specific monitor settings correctly to the playback monitor so that the
movie looks correctly. The WHOLE idea behind HDR is to END the ENDLESS
tweaking of colors due to differences between monitors. No monitor is
exactly the same as a second same type of monitor, so in order to make the
colors on every monitor somewhat the same there have been made a LOT of
rules what makes an HDR monitor an HDR monitor. If you have a decent HDR
monitor it lets the playback device know the display string as shown in
earlier e-mails so it can calculate back what the correct colors for THAT
specific movie are on the CURRENT monitor. This is all factory standard and
yes still you can of course tweak your monitor to your likings. However
without those settings most devices don't know what to do with the HDR
stream OR play it back at some random factory default that doesn't make any
sense. Hope this makes some things clear about the somewhat new HDR
standard. It's just one of the major problems movies studios kept running
in to. If you have 40 people making a movie on 40 different computers you
get 40 different color strings. So in order to make a movie look okay they
needed this standard else the increase of color depth would reveal a LOT of
artifects....not because they ARE artifects...but simply monitors that
didn't have the proper alignment. So to say it in math, color: 127,127,127
would be different on each monitor so some movie editors would make it
128,126,129 to make it look right on THEIR monitor, hench the issues.
2018-01-31 17:43 GMT+01:00 Biatscho<EMAIL_ADDRESS>
How you get ur nvhsp to work ????, cant get it working ...... (when it
writes the vui it deletes my sei data) staxrip <IP_ADDRESS> running
tried with 1.6.7 still no luck ?????
do you got a step by step guide wich settings u use in nvenc sei (not the
specifics for movies just standards to tryout and fill ins to the nvhsp
command
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/stax76/staxrip/issues/261#issuecomment-361992981,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AdX5NF_vB78gRGr2Zo1YU82zczV5Cp0Tks5tQJhBgaJpZM4Oyxkk
.

@foXaCe
just insert these settings
--max-cll 1000,602
--master-display G(13250,34500)B(7500,3000)R(34000,16000)WP(15635,16450)L(40000000,50)
in command line


Typo in navigation - Utilites

This is a fantastic effort.  We're working on a asp.net framework over at https://github.com/rovercore/rovercore that is using Tabler as well.  I like the idea of a clean theme that is fully open source.
I did want to report a small typo in the menu.  You have Utilities being spelled as Utilites.

Thank you


Feature Request

Describe the solution you'd like
Is there a way that we can deploy azure exemptions along with EPAC in a single bicep file ? any roadmap for this ? It would be handy if we can have exemptions.bicep file to deploy across multiple scopes such as subscription / resoruce group

@muhammad-sha-meme a different team looks after EPAC. Can you please raise the issue there: https://github.com/Azure/enterprise-azure-policy-as-code
As we can't help with this, I'll close the issue here.


OpenSSL 3.4.0 no cipher match

OS: Ubuntu 22.04.5
OpenSSL version: 3.4.0
curl version: 8.10.1
$ ./openssl version
OpenSSL 3.4.0 22 Oct 2024 (Library: OpenSSL 3.4.0 22 Oct 2024)

$ ./openssl s_client -quic -alpn h3 -connect www.cloudflare.com:443 </dev/null
4057E5A54D7F0000:error:0A0000B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match:ssl/ssl_lib.c:3346:
4057E5A54D7F0000:error:0A000180:SSL routines:SSL_CONF_cmd:bad value:ssl/ssl_conf.c:973:cmd=CipherString, value=DEFAULT:@SECLEVEL=2
4057E5A54D7F0000:error:0A0001A3:SSL routines:SSL_CTX_new_ex:error in system default config:ssl/ssl_lib.c:4117:

$ curl -V
curl 8.10.1 (x86_64-pc-linux-gnu) libcurl/8.10.1 OpenSSL/3.4.0 zlib/1.3.1 brotli/1.1.0 zstd/1.5.7 c-ares/1.34.2 libidn2/2.3.7 libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.64.0 nghttp3/1.6.0 librtmp/2.3
Release-Date: 2024-09-18
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Largefile libz NTLM PSL SSL threadsafe TLS-SRP UnixSockets zstd

$ curl -4 -vI --http3-only https://www.cloudflare.com
* Host www.cloudflare.com:443 was resolved.
* IPv6: (none)
* IPv4: <IP_ADDRESS>, <IP_ADDRESS>
*   Trying <IP_ADDRESS>:443...
* SSL: could not create a context: error:0A0000B9:SSL routines::no cipher match
* QUIC connect to <IP_ADDRESS> port 443 failed: Out of memory
*   Trying <IP_ADDRESS>:443...
* SSL: could not create a context: error:0A0000B9:SSL routines::no cipher match
* QUIC connect to <IP_ADDRESS> port 443 failed: Out of memory
* Failed to connect to www.cloudflare.com port 443 after 2 ms: Out of memory
* closing connection #0
curl: (27) SSL: could not create a context: error:0A0000B9:SSL routines::no cipher match

OpenSSL 3.3.2 is working fine.
$ ./openssl version
OpenSSL 3.3.2 3 Sep 2024 (Library: OpenSSL 3.3.2 3 Sep 2024)

$ ./openssl s_client -quic -alpn h3 -connect www.cloudflare.com:443 </dev/null
Connecting to <IP_ADDRESS>
CONNECTED(00000003)
...
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
ALPN protocol: h3
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID:
    Session-ID-ctx:
    Resumption PSK:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time:<PHONE_NUMBER>
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
...

---
DONE

4057E5A54D7F0000:error:0A0001A3:SSL routines:SSL_CTX_new_ex:error in system default config:ssl/ssl_lib.c:4117:

Can you show us what your OpenSSL config file looks like?

$ cat /etc/ssl/openssl.cnf
#
# OpenSSL example configuration file.
# See doc/man5/config.pod for more info.
#
# This is mostly being used for generation of certificate requests,
# but may be used for auto loading of providers

# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .

 # Use this in order to automatically load providers.
openssl_conf = openssl_init

# Comment out the next line to ignore configuration errors
config_diagnostics = 1

# Extra OBJECT IDENTIFIER info:
# oid_file       = $ENV::HOME/.oid
oid_section = new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		=
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=<IP_ADDRESS>
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = <IP_ADDRESS>.1
tsa_policy2 = <IP_ADDRESS>.5.6
tsa_policy3 = <IP_ADDRESS>.5.7

# For FIPS
# Optionally include a file that is generated by the OpenSSL fipsinstall
# application. This file contains configuration data required by the OpenSSL
# fips provider. It contains a named section e.g. [fips_sect] which is
# referenced from the [provider_sect] below.
# Refer to the OpenSSL security policy for more information.
# .include fipsmodule.cnf

[openssl_init]
providers = provider_sect
ssl_conf = ssl_sect

# List of providers to load
[provider_sect]
default = default_sect
# The fips section name should match the section name inside the
# included fipsmodule.cnf.
# fips = fips_sect

# If no providers are activated explicitly, the default one is activated implicitly.
# See man 7 OSSL_PROVIDER-default for more details.
#
# If you add a section explicitly activating any other provider(s), you most
# probably need to explicitly activate the default provider, otherwise it
# becomes unavailable in openssl.  As a consequence applications depending on
# OpenSSL may not work correctly which could lead to significant system
# problems including inability to remotely access the system.
[default_sect]
# activate = 1

####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= ./demoCA		# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several certs with same subject.
new_certs_dir	= $dir/newcerts		# default place for new certs.

certificate	= $dir/cacert.pem 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crlnumber	= $dir/crlnumber	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/private/cakey.pem# The private key

x509_extensions	= usr_cert		# The extensions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 2048
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extensions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]

# Extensions for a typical CA

# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

basicConstraints = critical,CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= ./demoCA		# TSA root directory
serial		= $dir/tsaserial	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir/cacert.pem	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest  = sha256			# Signing digest to use. (Optional)
default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)
ess_cert_id_alg		= sha1	# algorithm to compute certificate
				# identifier (optional, default: sha1)

[insta] # CMP using Insta Demo CA
# Message transfer
server = pki.certificate.fi:8700
# proxy = # set this as far as needed, e.g., http://<IP_ADDRESS>:8080
# tls_use = 0
path = pkix/

# Server authentication
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
ignore_keyusage = 1 # potentially needed quirk
unprotected_errors = 1 # potentially needed quirk
extracertsout = insta.extracerts.pem

# Client authentication
ref = 3078 # user identification
secret = pass:insta # can be used for both client and server side

# Generic message options
cmd = ir # default operation, can be overridden on cmd line with, e.g., kur

# Certificate enrollment
subject = "/CN=openssl-cmp-test"
newkey = insta.priv.pem
out_trusted = insta.ca.crt
certout = insta.cert.pem

[pbm] # Password-based protection for Insta CA
# Server and client authentication
ref = $insta::ref # 3078
secret = $insta::secret # pass:insta

[signature] # Signature-based protection for Insta CA
# Server authentication
trusted = insta.ca.crt # does not include keyUsage digitalSignature

# Client authentication
secret = # disable PBM
key = $insta::newkey # insta.priv.pem
cert = $insta::certout # insta.cert.pem

[ir]
cmd = ir

[cr]
cmd = cr

[kur]
# Certificate update
cmd = kur
oldcert = $insta::certout # insta.cert.pem

[rr]
# Certificate revocation
cmd = rr
oldcert = $insta::certout # insta.cert.pem

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
CipherString = DEFAULT:@SECLEVEL=2

4057E5A54D7F0000:error:0A0001A3:SSL routines:SSL_CTX_new_ex:error in system default config:ssl/ssl_lib.c:4117:

Can you show us what your OpenSSL config file looks like?

if -quic is removed,  ./openssl s_client -connect www.cloudflare.com:443 </dev/null works.

The problem here is a latent bug which even 3.3 suffers from. The issue is that calling the function SSL_CTX_set_cipher_list() on a QUIC SSL_CTX object, always returns the error "no cipher match" (even though it does successfully process directives such as "SECLEVEL=2".
When we process the config file the line "CipherString = DEFAULT:@SECLEVEL=2" causes the function SSL_CTX_set_cipher_list() to be called, and when combined with the "-quic" option to s_client we see this problem occur.
What changed between 3.3 and 3.4 is commit 21819f78b05. Prior to that commit those errors while processing the config file were silent and ignored - so we never noticed the bug. That commit causes errors raised during libssl related config file processing to no longer be silent and ignored - but instead to report them (thus causing the calling function that initiated this to fail).


Add nitro from nuxt

Hello, could you add nitro from nuxt in your results please ? I suppose it will be a little below h3.
Thanks.

My primary benchmarking focus is on the runtime performance of the framework.

hyper

warp
axum
graphul
poem

bun

elysia
hono
h3
oak

uws

hyper-express
fastify-uws

deno

nhttp
hono
oak

node

polka
fastify
hono
h3

nitro <- Adding nitro will place it here

express


PID package refactoring

Before issuing a pull request, please see the contributing page.

Also, please use gitjava and make an iml commit. Please.

So I started a MasqOdometry class and it didn't get added by gitjava but instead in git add -A with the imls

So I started a MasqOdometry class and it didn't get added by gitjava but instead in git add -A with the imls

That may just be it only adding modified files and not newly created/deleted files. We can look into that on Saturday.


Implement hash chain support in Caliptra ROM

This supports Stable Identity. Requirements:

Stable across FMC/RT FW updates.
Non-stable across epoch updates.
Allows SVN-specific keys to be derived.
Allows firmware that cold-booted with SVN X to wield the key bound to SVN X or below.

We'll implement SVN-specific keys using a hash chain. However, to make this FIPS compliant, each link in the chain will need to be a KDF. Hopefully a future version of SP 800-133 will allow cryptographic keys to be chained together via hashes.
We will have to anchor the hash chain to the min-SVN-since-cold-boot value, instead of simply the current SVN. The reason being:

If we want to support update-resets from an older SVN to a newer SVN, we will need to re-start the hash chain from a secret that is available upon update reset.
The only secret that fits this bill in ROM is the FMC CDI.
The FMC CDI is not guaranteed to be stable across cold-boots; if the FMC updates, anything derived from the FMC CDI will be lost. This will not satisfy the stability requirement.
Therefore, when ROM is generating the hash chain, it will fork off from the LDevID CDI, which does remain stable across FMC updates.
However, the LDevID is not available to ROM upon an update reset. Therefore, ROM will not be able to shorten the hash chain.
What ROM can do though, is lengthen the hash chain, such that its length corresponds with min-SVN-since-cold-boot. With this PR the ROM will be tracking this value.

In short: if we update-reset from an older SVN to a newer SVN, the hash chain will remain where it is. If we update-reset from a newer SVN to an older SVN, ROM will crank the hash chain until it corresponds with the older SVN, before it allows that older firmware to boot.


Support Vite base: url prefix

Hi guys
We have a Vue app with a base: prefix set in our Vite config like this:
export default defineConfig({
    base: '/app',
.........
})

We're using NGINX to route mydomain.com/app to the app. Everything works correctly except Vue Devtools. We're getting the following error in the console:
GET http://mydomain.com/@id/virtual:vue-devtools-path:app.js net::ERR_ABORTED 404 (Not Found)
The URL should include /app, i.e. the GET request should be made to http://mydomain.com/app/@id/virtual:vue-devtools-path:app.js. Is it possible to fix this so Vue Devtools respects base: if set?

+1, same here, but it looks like this issue was only introduced in vite v5, reverted to vite 4.5, there's no issue

Released in v1.0.0-rc.7 , upgrade and try again 🙏


Switch Travis CI to container-based infrastructure.

Brings significant build speed improvements.

Just realized there's no need to switch explicitly: Newer projects already run inside containers by default.
Closing.


added looping over the graph portion

Tested it still ran. I also tried to add _{{CATCHMENT_ID}} to the tasks but got an error due to the quotations.

Fixed the quotes error and tests locally with the small catchment files


Cannot build Dockerfile example

I just copied the Dockerfile example as it is:
FROM golang:1.18 AS build

RUN apt-get update -y && apt-get install -y xz-utils
RUN useradd -u 1000 -m esm
RUN mkdir /esm && chown esm:esm /esm
RUN git clone https://github.com/esm-dev/esm.sh /esm/esm.sh
RUN git checkout v126

USER esm
WORKDIR /esm
RUN go build -o bin/esmd esm.sh/main.go

RUN echo "{\"port\":80,\"workDir\":\"/esm\"}" >> /esm/config.json
ENTRYPOINT ["/esm/bin/esmd", "--config", "config.json"]

Then, I'm just trying to build the image:
 docker build -f ./Dockerfile -t mylocal/esm-service .

And I'm getting this error:
[+] Building 6.2s (10/13)
 => [internal] load build definition from Dockerfile                                                                                0.0s
 => => transferring dockerfile: 450B                                                                                0.0s
 => [internal] load .dockerignore                                                                                0.0s
 => => transferring context: 2B                                                                                0.0s
 => [internal] load metadata for docker.io/library/golang:1.18                                                                                5.8s
 => [auth] library/golang:pull token for registry-1.docker.io                                                                                0.0s
 => [1/9] FROM docker.io/library/golang:1.18@sha256:50c889275d26f816b5314fc99f55425fa76b18fcaf16af255f5d57f09e1f48da                               0.0s
 => CACHED [2/9] RUN apt-get update -y && apt-get install -y xz-utils                                                                              0.0s
 => CACHED [3/9] RUN useradd -u 1000 -m esm                                                                                0.0s
 => CACHED [4/9] RUN mkdir /esm && chown esm:esm /esm                                                                                0.0s
 => CACHED [5/9] RUN git clone https://github.com/esm-dev/esm.sh /esm/esm.sh                                                                       0.0s
 => ERROR [6/9] RUN git checkout v126                                                                                0.3s
------
 > [6/9] RUN git checkout v126:
#0 0.295 fatal: not a git repository (or any of the parent directories): .git
------
Dockerfile:7
--------------------
   5 |     RUN mkdir /esm && chown esm:esm /esm
   6 |     RUN git clone https://github.com/esm-dev/esm.sh /esm/esm.sh
   7 | >>> RUN git checkout v126
   8 |
   9 |     USER esm
--------------------
ERROR: failed to solve: process "/bin/sh -c git checkout v126" did not complete successfully: exit code: 128

Which kinda makes sense since it isn't changing any directory after clonning the repo.
My docker version:
$ docker --version
Docker version 24.0.2, build cb74df

updated, and you also can use it from ghcr.io now:
FROM ghcr.io/esm-dev/esm.sh


Enhance Database Reset Commands

This PR adds a number of small changes and features to the dbreset scripts.
Overview of all changes:

Renamed some variables to be less ambiguous
Added timestamp(s) to status messages, including random code expiration and time until reset completion
Reduced DB interactions where possible
Prevent extra execCC before sending completion message
Change embed formatting and wording for more clarity (you can of course easily change this to whatever you think is reasonable)
Reduced redundancy, therefore less characters
Reformatted some code for better readability
Use truthiness instead of comparison operators in some conditional statements
Improve random code generation method (using randInt and printf instead of shuffle)

In my testing, this seems to not have any of the known bugs, those being issue #36 and the very recent reports of invalid key errors.

I've made a few more changes here, mainly prompted by 989031387f0985c723e448cdc3c4b749cd088384.
These changes make the deletetion significantly more efficient, avoiding the extra costly dbCount call each CC execution, and instead uses the existing $count variable.
It also now only deleted entries when there are entries to delete, using a comparison instead of truthiness within range (I figured adding an else branch with break isn't necessary, since it's only going to iterate at most 10 times).
Additionally, I've changed the sdict key casing within the database entry and execdata to be more readable and follow convention.
Unrelated to this PR, you may consider changing the CC to dbresetpattern, since this is what it actually does (dbCount also reflects this, which was previously misdocumented as counting by the key exactly)

I saw this but my fluffbutt hasn't come to this yet. Sorry :/


docs: global task env versus task context env

I think this is more of a documentation issue than a bug or feature. I think there's some nuance missing from the docs around env in tasks.yml. Please consider the following .moon/tasks.yml file:
# https://moonrepo.dev/docs/config/tasks
$schema: 'https://moonrepo.dev/schemas/tasks.json'

env:
  MAKEFILES: '../../Makefile'

tasks:
  build:
    platform: 'system'
    command: 'make hello'
    envFile: true

The target Makefile exists at the repo root, and the task is being run with the moon run svc-api:build command. svc-api exists at services/svc-api at the repo root.
When running the build command, this fails with a message that make cannot find the hello target. It was my expectation based on the docs that the MAKEFILES envar would be applied to all tasks. When we change tasks.yml to the following:
# https://moonrepo.dev/docs/config/tasks
$schema: 'https://moonrepo.dev/schemas/tasks.json'

tasks:
  build:
    platform: 'system'
    command: 'make hello'
    env:
      MAKEFILES: '../../Makefile'
    envFile: true

Adding the envar to the task context itself, things work as per usual, make files Makefile and we get the expected output.
Is there nuance missing around how env vars are applied to tasks, or is there something else going on behind the scenes that isn't obvious?

Yeah that looks correct. I have a handful of test cases here: https://github.com/moonrepo/moon/blob/master/crates/core/project-graph/tests/projects_test.rs#L920
Let me add some more and see if there's an edge case.

One thing to note is that envFile should be under options, so:
tasks:
  build:
    platform: 'system'
    command: 'make hello'
    options:
      envFile: true

OK I'll see if I can get a public repro going for this

Oh I misread the original post. The .moon/tasks.yml doesn't support env at the root, only moon.yml does.

Ah, that might be a good target for a warning in the console

Done https://github.com/moonrepo/moon/pull/701


using anchors with css

What is the recommended practice for using anchors with a fluid layout.  I do not have nav in the topbar, but on the side of the page, so I am not able to use ScrollSpy. Or should I?
For instance I have this:

Create a New Campaign

Which links to this

Create a New Campaign

But I have to put the margin-top or the text goes under the topbar ... :(
Thanks
Chris

If you have a fixed top bar, you need to add 40px of padding to the body or do something similar to prevent text from rolling under the topbar.
Scrollspy should work on any nav.

The padding of 40px does not work.  I am still getting the links hidden by the topbar ... grrr


Board Review: Azure::Keyvault::Keys for C++

Thank you for submitting this review request. Thorough review of your client library ensures that your APIs are consistent with the guidelines and the consumers of your client library have a consistently good experience when using Azure.
The Architecture Board reviews Track 2 libraries only. If your library does not meet this requirement, please reach out to Architecture Board before creating the issue.
Please reference our review process guidelines to understand what is being asked for in the issue template.
To ensure consistency, all Tier-1 languages (C#, TypeScript, Java, Python) will generally be reviewed together.  In expansive libraries, we will pair dynamic languages (Python, TypeScript) together, and strongly typed languages (C#, Java) together in separate meetings.
For Tier-2 languages (C, C++, Go, Android, iOS), the review will be on an as-needed basis.
Before submitting, ensure you adjust the title of the issue appropriately.
Note that the required material must be included before a meeting can be scheduled.
Contacts and Timeline

Responsible service team:
Main contacts: @vhvb1989  @RickWinter
Expected code complete date:  4/2/21
Expected release date: 4/6/21

About the Service

Link to documentation introducing/describing the service:
Link to the service REST APIs:
Link to GitHub issue for previous review sessions, if applicable:

About the client library

Name of the client library: azure-security-keyvault-keys
Languages for this review: C++

Artifacts required (per language)
Please read through “API Review” section here to understand how these artifacts are generated. It is critical that these artifacts are present and are in the right format. If not, the language architects cannot review them with the SDK Team’s API review tool.
C++

APIView Link:

https://apiview.dev/Assemblies/Review/da8d0ecdf87c49238b75fee069413029

Link to Champion Scenarios/Quickstart samples:

hello-world: https://github.com/Azure/azure-sdk-for-cpp/blob/master/sdk/keyvault/azure-security-keyvault-keys/samples/sample1_hello_world.md
backup and restore: https://github.com/Azure/azure-sdk-for-cpp/blob/master/sdk/keyvault/azure-security-keyvault-keys/samples/sample2_backup_and_restore.md
list keys: https://github.com/Azure/azure-sdk-for-cpp/blob/master/sdk/keyvault/azure-security-keyvault-keys/samples/sample3_get_keys.md

Thank you!

scheduled for 4/5

Recording[MS INTERNAL ONLY]

@lilyjma at what point do we usually close this issue?  The preview version reviewed here was now shipped.


[WIP] [YUNIKORN-1615] Ensure node coordinator accounts for all non-yunikorn pod updates

Under certain circumstances, the node coordinator has been observed updating occupied resources on a node to negative values.
Ensure that we handle all pod add/update/delete events for non-yunikorn pods appropriately.
What type of PR is it?

[x] - Bug Fix
[ ] - Improvement
[ ] - Feature
[ ] - Documentation
[ ] - Hot Fix
[ ] - Refactoring

Todos

[ ] - Task

What is the Jira issue?
https://issues.apache.org/jira/browse/YUNIKORN-1615
How should this be tested?
Screenshots (if appropriate)
Questions:

[ ] - The licenses files need update.
[ ] - There is breaking changes for older versions.
[ ] - It needs documentation.

Reverting to draft as this is broken (counts occupied resources double on startup due to context_recovery handling conflicts).

Closing in favor of #734.


Fix reduceRight

There is currently a method called reduceRight that lives in /lib/reduceRight.js.
It is incomplete and needs to be fixed!
Like your usual reduce, but works from right to left.
Acceptance Criteria:

Running yarn test <methodName> results in tests passing.
You have written a skeleton method for someone else to work on.
You have written tests surrounding your skeleton method.
Running yarn lint does not print any errors to the console!
Optional: write one or two more tests surrounding the method you are solving to account for potential edge cases.

Please include the skeleton of a new method + an accompanying test for someone else to work on at the time of creating a pull request! A pull request will most likely be denied if it does not contain a skeleton method for someone else to work on! For more information, please read the Contributing Guide.
Thank you so much for your contribution!

I'll take it

@rgehan It's all yours! Thanks!


Modal doc improvements

Linked Issue
Closes #2120
Description
Makes a number of improvements to the modal documentation:

Provides a better explanation of Modal Settings vs Modal Props
Major reworks to the Component Modals section
Component Modal examples now use the standard Previewer format
The Register/Direct methods are no longer hidden in the Previewer code view
Greatly simplified the examples
Rewrote most accordion sections; each include proper code snippets

Overall this should be MUCH more accessible.
Changsets
Instructions: Changesets automate our changelog. If you modify files in /packages/skeleton, run pnpm changeset in the root of the monorepo, follow the prompts, then commit the markdown file. Changes that add features should be minor while chores and bugfixes should be patch. Please prefix the changeset message with feat:, bugfix: or chore:.
Checklist
Please read and apply all contribution requirements.

[x] This PR targets the dev branch (NEVER master)
[x] Documentation reflects all relevant changes
[x] Branch is prefixed with: docs/, feat/, chore/, bugfix/
[x] Ensure Svelte and Typescript linting is current - run pnpm check
[x] Ensure Prettier linting is current - run pnpm format
[x] All test cases are passing - run pnpm test
[x] Includes a changeset (if relevant; see above)

@Sarenor I'll add you as the reviewer on this since you suggested the original ticket. Feel free to double check spelling and grammar please!

@Sarenor

On the other hand a more contained one, I was thinking about expanding the DocsShell to allow for some form of arbitrary content in the props tab. Definitely like this way better, let's hope it's obvious enough!

I'm foreseeing some wider reaching changes to the Doc layouts in the future. Keep that in mind and let's discuss then.


chore(appveyor): Notification config.

This config is supposed to send notifications back to github...

retrigger


Signing API

There should be an endpoint to create signatures for 3rd party API requests such as S3, and Cloudinary. The provider should be removed and requests should be handled from plugins with a signing endpoint enabled.

S3 requests are already signed by the S3 provider.
Cloudinary requests can be signed like so:
https://cloudinary.com/documentation/upload_images#generating_authentication_signatures

The cloudinary provider should sign requests rather than parse the request body to the cloudinary API. https://cloudinary.com/documentation/upload_images#generating_authentication_signatures

Requests to S3 and cloudfront currently require a set package dependencies.
    "@aws-sdk/client-s3": "^3.398.0",
    "@aws-sdk/cloudfront-signer": "^3.398.0",
    "@aws-sdk/s3-request-presigner": "^3.398.0",

Access should also be possible through the AWS Security Token Service (AWS STS).
The lambda running the XYZ host would be a proxy app to request a federated session token.
The federation token can provide temporary security credentials for IAM services, eg. cloudfront, s3.
https://docs.aws.amazon.com/IAM/latest/UserGuide/create-signed-request.html