Multiple ResTypeSpecs in a row, cannot be decoded.

Apktool 2.0.1 crashes and produces no results with this apk https://play.google.com/store/apps/details?id=it.ingdirect.app
I: Using Apktool 2.0.1 on a.apk
I: Loading resource table...
Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: 9
    at brut.androlib.res.decoder.ARSCDecoder.readConfig(ARSCDecoder.java:189)
    at brut.androlib.res.decoder.ARSCDecoder.readType(ARSCDecoder.java:159)
    at brut.androlib.res.decoder.ARSCDecoder.readPackage(ARSCDecoder.java:116)
    at brut.androlib.res.decoder.ARSCDecoder.readTable(ARSCDecoder.java:78)
    at brut.androlib.res.decoder.ARSCDecoder.decode(ARSCDecoder.java:47)
    at brut.androlib.res.AndrolibResources.getResPackagesFromApk(AndrolibResources.java:538)
    at brut.androlib.res.AndrolibResources.loadMainPkg(AndrolibResources.java:63)
    at brut.androlib.res.AndrolibResources.getResTable(AndrolibResources.java:55)
    at brut.androlib.Androlib.getResTable(Androlib.java:64)
    at brut.androlib.ApkDecoder.setTargetSdkVersion(ApkDecoder.java:209)
    at brut.androlib.ApkDecoder.decode(ApkDecoder.java:92)
    at brut.apktool.Main.cmdDecode(Main.java:165)
    at brut.apktool.Main.main(Main.java:81)

Yes, I confirm. Will look into this.

Okay, spent the morning on this one.
The problem shown above is just the failure point. The real problem occurs much early in the process. For example. entryCount reports 265 for the failure instance, but the config instance returns 9. Obviously storing 265 resources in 9 slots won't work, thus the above error. Manually setting the proper array size, allows apktool to complete but every resource is APKTOOL_DUMMY.
This means the failure is occurring way earlier. So I breakpointed after the first problem. We read a Type - https://github.com/android/platform_frameworks_base/blob/master/include/androidfw/ResourceTypes.h#L1246
and usually then we read the corresponding configuration after that - https://github.com/android/platform_frameworks_base/blob/master/include/androidfw/ResourceTypes.h#L1284
However, the type header is set to that of another type vs a configuration, so Apktool sets all the resources from that type to false values (APKTOOL_DUMMY, etc).

hi, ths your work.
the newest 2.0.2 version can work on LocusPro with the -r option.
but when I remove the -r option. the same exception occour again.
imac-2:test ao$ java -jar apktool_2.0.2.jar d LocusPro\ v3.10.3.apk -f
I: Using Apktool 2.0.2 on LocusPro v3.10.3.apk
I: Loading resource table...
Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: 1
at brut.androlib.res.decoder.ARSCDecoder.readConfig(ARSCDecoder.java:189)
at brut.androlib.res.decoder.ARSCDecoder.readType(ARSCDecoder.java:159)
at brut.androlib.res.decoder.ARSCDecoder.readPackage(ARSCDecoder.java:116)
at brut.androlib.res.decoder.ARSCDecoder.readTable(ARSCDecoder.java:78)
at brut.androlib.res.decoder.ARSCDecoder.decode(ARSCDecoder.java:47)
at brut.androlib.res.AndrolibResources.getResPackagesFromApk(AndrolibResources.java:544)
at brut.androlib.res.AndrolibResources.loadMainPkg(AndrolibResources.java:63)
at brut.androlib.res.AndrolibResources.getResTable(AndrolibResources.java:55)
at brut.androlib.Androlib.getResTable(Androlib.java:65)
at brut.androlib.ApkDecoder.setTargetSdkVersion(ApkDecoder.java:197)
at brut.androlib.ApkDecoder.decode(ApkDecoder.java:96)
at brut.apktool.Main.cmdDecode(Main.java:165)
at brut.apktool.Main.main(Main.java:81)

Started looking at this. Notes for myself
https://github.com/iBotPeaches/platform_frameworks_base/blob/apktool-mm/include/androidfw/ResourceTypes.h#L1309

readEntry --> ResTable_config
readConfig --> ResTable_type
readType --> ReadTable_typeSpec

Seems our failure occurs in the first readConfig, where entryCount is reflecting wrong number of Resources.

Okay disregard previous comment by myself. We correctly read the first Type which is attr, and it reports 295 entries.
  type 0 configCount=1 entryCount=295

Likewise, aapt reports 295 entries with 1 configuration for this type. However, after reading the flags. Our next chunk is another type. Instead of being the expected config chunk.. This means all 295 resources are filled with APKTOOL_DUMMY. All data after this point is in unexpected places because we incorrectly read the remaining data in that chunk.
At this point either I don't understand this failure or a bug has been discovered in the root way apktool functions. If apktool does not find a configuration for a given type, it fills it with dummy data. According to the comment here - https://github.com/iBotPeaches/platform_frameworks_base/blob/apktool-mm/include/androidfw/ResourceTypes.h#L850
/**
 * A collection of resource data types within a package.  Followed by
 * one or more ResTable_type and ResTable_typeSpec structures containing the
 * entry values for each resource type.
 */

The problem Apktool has is it expects Type --> Config, Type --> Config, etc, etc. Currently this application goes Type --> Type, which isn't expected nor supported yet.

ibotpeaches@tombstone:~$ apktool d 1.89.0.apk
I: Using Apktool 2.0.3-e7c1bc-SNAPSHOT on 1.89.0.apk
I: Loading resource table...
Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: 186
	at brut.androlib.res.decoder.ARSCDecoder.readTableType(ARSCDecoder.java:190)
	at brut.androlib.res.decoder.ARSCDecoder.readTableTypeSpec(ARSCDecoder.java:159)
	at brut.androlib.res.decoder.ARSCDecoder.readTablePackage(ARSCDecoder.java:116)
	at brut.androlib.res.decoder.ARSCDecoder.readTableHeader(ARSCDecoder.java:78)
	at brut.androlib.res.decoder.ARSCDecoder.decode(ARSCDecoder.java:47)
	at brut.androlib.res.AndrolibResources.getResPackagesFromApk(AndrolibResources.java:544)
	at brut.androlib.res.AndrolibResources.loadMainPkg(AndrolibResources.java:63)
	at brut.androlib.res.AndrolibResources.getResTable(AndrolibResources.java:55)
	at brut.androlib.Androlib.getResTable(Androlib.java:66)
	at brut.androlib.ApkDecoder.setTargetSdkVersion(ApkDecoder.java:198)
	at brut.androlib.ApkDecoder.decode(ApkDecoder.java:96)
	at brut.apktool.Main.cmdDecode(Main.java:165)
	at brut.apktool.Main.main(Main.java:81)

Additionally Ingress 1.89.0 has this exact problem. Time to bump priority. This is a major major major bug now. Affecting more and more apps daily.

Another comment for myself. Sorry for notifications.
I was correct in (https://github.com/iBotPeaches/Apktool/issues/1031#issuecomment-162319013) comment. All the TypeSpecs are read in a row instead of going TypeSpec -> Config -> Entry. The new order is TypeSpec -> TypeSpec --> ... -> TypeSpec, then finally Config -> Entry -> Entry -> Entry --> Config -> Entry etc.
So I adapted the code to read all the TypeSpec, then move onto the Configs. This worked, but each Entry read had the wrong ids. This is because of a flaw in apktool, in which it expected the last read Type to be the Type the resources were a part of. So the last read type (id) was being used, but the Config being read was for the attr type which was read first.
Our decoder needs a tiny rewrite to support this change, without breaking previous apks. Still on a mission to figure out how to get this to happen myself in a smaller test apk. Building Marshmallow apks by myself in Android Studio does not trigger this change. AAPT would be responsible for this, so maybe I'm missing a configuration/parameter value that is causing it.
Research / fixes are ongoing.

Okay, another update.
Patching the previous comment problem was a success. Types were correctly associated with the configurations they were part of, thus preserving the correct resource ids. In the case of Ingress 1.89.0, completely read the first block of resources. The [default] configuration of 32 attributes.
Next up was type 1 (drawables) with 15 configurations and 195 entries. This is where the problems started. The first config read was nodpi-v4 which is actually the 2nd configuration for this type according to aapt. When it should have read the default configuration first.
This is where things get strange. Reading the type returns 195 entries. Reading the first ConfigFlags should return the default config with 195 entries, but it didn't. So reading our int array resulted in tons of -1 values, thus going out of bounds.
Tis progress though

Okay another update x2.
Major progress.
$ apktool debug d 1.89.0.apk -f
I: Using Apktool 2.0.3-e7c1bc-SNAPSHOT on 1.89.0.apk
I: Loading resource table...
Exception in thread "main" brut.androlib.AndrolibException: Multiple resources: spec=0x7f0d0001 id/app_icon, config=[DEFAULT]
	at brut.androlib.res.data.ResType.addResource(ResType.java:63)
	at brut.androlib.res.data.ResType.addResource(ResType.java:56)
	at brut.androlib.res.decoder.ARSCDecoder.readEntry(ARSCDecoder.java:252)
	at brut.androlib.res.decoder.ARSCDecoder.readTableType(ARSCDecoder.java:220)
	at brut.androlib.res.decoder.ARSCDecoder.readTableTypeSpec(ARSCDecoder.java:166)
	at brut.androlib.res.decoder.ARSCDecoder.readTablePackage(ARSCDecoder.java:116)
	at brut.androlib.res.decoder.ARSCDecoder.readTableHeader(ARSCDecoder.java:78)
	at brut.androlib.res.decoder.ARSCDecoder.decode(ARSCDecoder.java:47)
	at brut.androlib.res.AndrolibResources.getResPackagesFromApk(AndrolibResources.java:544)
	at brut.androlib.res.AndrolibResources.loadMainPkg(AndrolibResources.java:63)
	at brut.androlib.res.AndrolibResources.getResTable(AndrolibResources.java:55)
	at brut.androlib.Androlib.getResTable(Androlib.java:66)
	at brut.androlib.ApkDecoder.setTargetSdkVersion(ApkDecoder.java:198)
	at brut.androlib.ApkDecoder.decode(ApkDecoder.java:96)
	at brut.apktool.Main.cmdDecode(Main.java:165)
	at brut.apktool.Main.main(Main.java:81)

The problem now, is that like previous comments I built a FIFO Queue (First In, First Out). Also known as a ArrayDeque in Java, leveraging addLast and removeFirst. However, I found after reading the configurations for the drawable type that since its sparse we might read the attributes then drawables, neither of which completely. So the current version of Apktool, reads the 'SpecType' type, pops it off stack and reads the configurations (which may only be one, instead of all configurations for that TypeSpec). When it returns to the attr type, it actually pops the next element off the stack which is drawables. This conflict between mapping the correct TypeSpec to configurations is causing multiple resources.
Need to update the TypeSpec system to be some of index based list, reading the TableType typeId in order to know what TypeSpec to load.
Good News - Types & TypeSpecs are correctly load for both sparse and densely packed apks.

Okay another update x3
$ apktool debug d 1.89.0.apk -f
I: Using Apktool 2.0.3-e7c1bc-SNAPSHOT on 1.89.0.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /home/ibotpeaches/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
Exception in thread "main" brut.androlib.err.UndefinedResObject: resource spec: 0x7f0d0001
	at brut.androlib.res.data.ResPackage.getResSpec(ResPackage.java:59)
	at brut.androlib.res.data.ResTable.getResSpec(ResTable.java:65)
	at brut.androlib.res.data.ResTable.getResSpec(ResTable.java:61)
	at brut.androlib.res.data.value.ResReferenceValue.getReferent(ResReferenceValue.java:57)
	at brut.androlib.res.data.value.ResEnumAttr.serializeBody(ResEnumAttr.java:56)
	at brut.androlib.res.data.value.ResAttr.serializeToResValuesXml(ResAttr.java:64)
	at brut.androlib.res.AndrolibResources.generateValuesFile(AndrolibResources.java:502)
	at brut.androlib.res.AndrolibResources.decode(AndrolibResources.java:252)
	at brut.androlib.Androlib.decodeResourcesFull(Androlib.java:136)
	at brut.androlib.ApkDecoder.decode(ApkDecoder.java:102)
	at brut.apktool.Main.cmdDecode(Main.java:165)
	at brut.apktool.Main.main(Main.java:81)

Per the last comment. TypeSpecs are now stored in a HashMap, indexed by the TypeId. During read, the TypeId of the TableType is used to reference a TypeSpec. That TypeSpec ID is used for building the correct resource id.
The next issue we encountered was handling INVALID TYPE lines. Some APKs have lines like such
      INVALID TYPE CONFIG FOR RESOURCE 0x01010267

I'm still not quite sure why those occur, but they do. To handle this we generate a bogus FALSE value with that resource id. However, the logic and code in Apktool for handling the what we call "Missing Res Specs" was dependent on a densely packed order of types. IE - looking for missing resources after reading a TypeSpec. We now know that TypeSpecs are sparse, so the logic for Missing Res Specs is wrong.
Multiple errors occurred with this logic as resources were duplicated. IE a bogus resource was created for a legitimate resource. A temporary and hacky fix, which was nothing more than disabling the Missing Res Specs was put into place. We were left with the stacktrace shown above. We correctly read the entire ResTable. Hurrah :)
While decoding files back to human readable form, we encounter an error while following a reference on a file. So this resource doesn't exist. Why?
Well its obvious. The "Missing Res Specs" are disabled.
I wonder what that bad resource is.
      INVALID TYPE CONFIG FOR RESOURCE 0x7f0d0001

Yep, one of those :)
I just need to patch MissingResSpecs back in Apktool, and make sure it works and knock on wood. This is fixed.

Okay another update x4.
$ apktool debug d 1.89.0.apk -f
I: Using Apktool 2.0.3-e7c1bc-SNAPSHOT on 1.89.0.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /home/ibotpeaches/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...

We did it :)
The current fix for MissingResSpecs is dirty and needs some clean up, because of a few things.

You can't assume all missing resources in a configuration are actually busted. Some configurations (ie -en) might not have some resources and fall back to default. Therefore it doesn't make sense to mark those resources as DUMMY. So in our case, we make them DUMMY resources. If another resID comes along with the same ID as a DUMMY resource, then we remove the DUMMY resource and replace it with the correct one. This allows the sparse reading of ResTable to work with adding in DUMMY resources.

I've touched code everywhere. ResPackage, ResResSpec, ResType, ResTypeSpec, ARSCDecoder, ExtMXSerializer, ResXMLEncoders. I need to clean up some of the fixes, because I think I've slowed down the execution time of some functions.

I have about 15 commits unpushed. I need to clean up history, and make sure backward compat is absolutely working.

I need to create a unit-test for this sparse ResTable.

https://github.com/iBotPeaches/Apktool/commit/eabb7d819b9a13f256153a174b8dd05e21c619f1

can i use the apktool to decode or decompile multiple apk file at once, and how?

@opysanni use python to  loop apktool


Create package table

fixes #134
I wasn't sure about the headings; what would be a more logical/helpful way to group the dependencies?
I used the the table generator script in js-ipfs. Right now, that script has the dependencies and headings hard-coded. Might it make more sense to have a more generic table generator for all the projects in the js-ifps universe?

Thanks a lot! It took me a while to figure out what "Packages" actually means (also in the js-ipfs case). Am I correct that this is a list of dependencies that belong to the IPFS ecosystem?
Could you please add that information (or the corresponding one if I'm wrong)?
PS: For the CI failures I've created https://github.com/ipld/js-ipld/issues/139

Yep, I think you got it right (see also: https://github.com/ipfs/js-ipfs/issues/1050). I've added some brief clarification above the table.
I believe the real advantage of a table like this is that you can see coverage and build status at a glance without having to go through each repo individually. To that end, it might make more sense to only include IPFS repos that are closely related to js-ipld, i.e. not ipfs/is-ipfs. Of course, this table is another thing that must be kept up to date, so it's really up to you if you think it's worth adding. Ideally, this sort of information could be managed automatically through waffle.io or something.


Ordered lists not starting with 1 should have start attribute set

An ordered list starting with an item other than 1 is not correctly translated:
2. some
3. item

becomes

some

item

but should become

some

item

It was fixed in the master code.

Which commit fixed this?

@kynan you can try with the master code.
It is not just a fix. In readme:

NOTE: This is the re-designed v2 of mistune.

It is re-designed.


Proposal: add IDE-specific configuration

This should come after the yeoman generator is done, but we could provide opt-in IDE/code editors configuration, like:

Jetbrains' IDE (webstorm, intellij...)
Visual Studio Code
any ideas?

As far a the target IDE supports it, we could add code-style/formatting settings as well as tool/run configuration pre-bound to the npm tasks.
What do you think?

Closing as it's pretty much useless by now, with Prettier and default IDE plugin 😄


controller: stop reflecting MCP conditions

Reflecting MCP conditions in the NRO object conditions is heavyweight and gives little extra value. Let's stop do that - the nested conditions are optional anyway, but let's add a command line option to re-enable it if really needed.

/cherry-pick release-4.15

/hold

/hold cancel
additional test locally

ci-install-e2e failure not critical: failed in must-gather (infra issue), our tests passed cleanly

/test ci-install-e2e


Allow mouse wheel scroll in any area of View() window

mouse wheel scroll only  works when the mouse is positioned over the horizontal or vertical scroll bars. Ideally, this scrolling would work if the mouse is positioned over any area of the grid window produced by a call to View(). It appears that the scrolling also works if the mouse is over a grid line, but not if the mouse is over the data area of a cell in the grid
Also, it would be nice to be able to select/highlight a row or multiple rows in the grid

+1
On Fri, Apr 14, 2017 at 3:40 PM, ebs238<EMAIL_ADDRESS>wrote:

mouse wheel scroll only works when the mouse is positioned over the
horizontal or vertical scroll bars. Ideally, this scrolling would work if
the mouse is positioned over any area of the grid window produced by a call
to View()
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/Microsoft/RTVS/issues/3417, or mute the thread
https://github.com/notifications/unsubscribe-auth/AAtUVCAKT01Qet-RxigNmFlrVVvmE-M9ks5rv_XygaJpZM4M-J2q
.


How to do bit shift in finite field variable?

Hello, I am new to ZEXE and I met some difficulties here:
in traditional programming language, we can do bit shifting like this:
int a = 8;
int b = a >> 1; // b = 4;
Because there is not divide operator for FpVar::::new_witness, I want to use some right/left bit shifting operations over finite field variables. Could you please guide me how to do this? I have not found out the corresponding functions.Thanks!

I personally obtain the BigInt of a field element (x as follows)
let bigint = x.into_repr();

Then, you can use divn in BigInteger (https://github.com/scipr-lab/zexe/blob/master/algebra-core/src/biginteger/mod.rs#L99) to modify the number.
And then convert it back, assuming that the field type is Fp.
x = Fp::from_repr(bigint)?;

where in some cases, ? should be replaced by .unwrap().

I think the question is asking about R1CS variables, not native field elements.
@brucechin The way to do this would be to convert the element to bits (via the ToBitsGadget) trait, and to then perform the shift on the bits. You can convert the bits back to field elements via double and add.

Oh yeah. If that is for FpVar, I think bit decomposition is necessary (and probably the only solution).

Great! Thanks for your fast response! I will try the bit decomposition way and reply back soon.

Emmm. Because the bits decomposed are little-endian, I can drop the first K bits and pack the rest bit Vect back to FpVar to achieve the same functionality of right shift K bits?

Packing  Vec<Boolean<F>> to FpVar would be slight manual work.
There are two solutions. One would save constraints but is complicated, as follows:

First allocate the result FpVar you desire by new_witness.

Construct a linear constraint that FpVar's variable, minus the linear constraint of each of such bit times their corresponding weight (b1 * 1 + b2 * 2 + b3 * 4 + ...).

Enforce this linear combination to be zero.

An example of this is here: https://github.com/arkworks-rs/nonnative/blob/master/src/lib.rs#L1345
Another solution would create a little bit more constraints:

Boolean has a method select. For each bit, we use it to select two constant FpVar (by FpVar::Constant(123)), one is the weight, one is zero.

Sum the selected result.

Thanks for your reply! I thought there could be some let res: FpVar = bits.into() interface haha. Also, the example is of much help! I will look into it today.

Hello guys. I do implement the bit decomposition and packing back methods, It works fine during sanity check:
    let sanity_cs = ConstraintSystem::<Fq>::new_ref();
    full_circuit
        .clone()
        .generate_constraints(sanity_cs.clone())
        .unwrap();
    let res = sanity_cs.is_satisfied().unwrap();
    println!("are the constraints satisfied?: {}\n", res);

However, during pre computing parameters, I met
thread 'main' panicked at 'called Result::unwrap() on an Err value: AssignmentMissing'
error. I think it is because those FpVar witnesses are placeholders and contain no values. I am confused that how can I bit decompose some placeholder FpVar witness and pack them back?
My ugly code is here:
        let mut tmp_bits = tmp.to_bits_le().unwrap();
        println!("tmp value :{:?} \n bits before drain: {:?}\n\n", tmp.value().unwrap(), tmp_bits.value());
        //because the bits decomposed are little endian. we need to drop the first 24 bits to achieve right-shift.
        tmp_bits.drain(0..24);
        //println!("bits after drain: {:?}\n\n", tmp_bits.value());
        let mut shift_res = FpVar::<Fq>::new_witness(r1cs_core::ns!(cs, "shift result gadget"), || Ok(Fq::zero())).unwrap();
        let a = 2u8;
        let b = 1u8;
        let double: Fq = a.into();
        let double_var = FpVar::Constant(double);
        let one: Fq = b.into();
        let one_var = FpVar::<Fq>::Constant(one);
        let zero_var = FpVar::<Fq>::Constant(Fq::zero());
        let mut shift_res_fq : Fq = Fq::zero();
        for (i, bit) in tmp_bits.iter().rev().enumerate() {
            match bit.value() {
                Ok(b) => {
                    if bit.value().unwrap() == true {
                        shift_res = shift_res.mul(&double_var).add(&one_var);
                        shift_res_fq = shift_res_fq * double + one;
                    }else{
                        shift_res = shift_res.mul(&double_var);
                        shift_res_fq = shift_res_fq * double;
                    }
                },
                Err(e) =>{
                    println!("Error: {} bit :{:?}", e, bit.value().unwrap());
                } ,
            }
        }

        let shift_res_check = FpVar::<Fq>::Constant(shift_res_fq);
        shift_res.enforce_equal(&shift_res_check).unwrap();

Does the compiler also say which unwrap() causes the error?

I think it is a way to implement it. Another way is to use the linear combination, but it is slightly more complicated.
I didn't find some bugs at the first glance. You can also try to turn on Rust Backtrace, which may show more information about where the error comes from.

Oh,  I think it is because bit is a placeholder so i can not call bit.value().unwrap() to judge whether it is true or false. I can use
        shift_res = shift_res.mul(&double_var).add(bit.select(&one_var, &zero_var).unwrap());

this line to pack bits back to FpVar

Another question is when I want to divide a FpVar by some 2^k I can do it by bit decomposition. What if I want to divide a FpVar by some non-2^k positive number like 3, 5 or 117? Thanks!

This is going to be complicated. But, if the number is always in a reasonable range, not too large, we may proceed as follows:
To check a = 3 * b + c, we basically want to use an R1CS constraint that:
b * 3 = a - c (in Fp)

where Fp is the curve's scale field.
However, we know that for any a, you can find many possible b and c, because it is in Fp.
To avoid this, we can enforce the range of b and c, such that:

b is surely smaller than p/3 (we can go for stricter, saying that b has only a specific number of bits so that it must be smaller than p/3).
c is 0, 1, or 2. This can be a bit decomposition check or a comparison.

I see. Actually b in my use case is a fixed number(something like 2^24) so if I can avoid bit decomposition many constraints can be saved. Thanks! And I will try to do this way soon.


Upgrade CSV Input Table

Describe the solution you'd like
The current CSV Input table, populated after a user uploads a CSV, is using 'react-csv' and populating all rows. We want to transfer to use MUI's Data Table for better UI and standardization. The new table should restrict the number of rows displayed to an arbitrary reasonable constant
Setup Instructions (what branch to work off of)
Create branch csv-table off of frontend.

@farisdurrani @mateo0203 how's progress going on this?

Resolved by z #552


MM-14124 - Updating sys console header height

Summary
MM-14124 - Updating sys console header height
Ticket Link
https://mattermost.atlassian.net/browse/MM-14124
Checklist
[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

[ ] Ran make check-style to check for style errors (required for all pull requests)
[ ] Ran make test to ensure unit and component tests passed
[ ] Added or updated unit tests (required for all new features)
[ ] Needs to be implemented in mobile (link to PR or User Story)
[ ] Has server changes (please link)
[ ] Has redux changes (please link)
[x] Has UI changes
[ ] Includes text changes and localization file (.../i18n/en.json) updates
[ ] Touches critical sections of the codebase (auth, posting, etc.)

@asaadmahmood Can you help cherry-pick this to v5.9?

@asaadmahmood ^


re-positioned drain/uncorden steps in kubeadm upgrade docs in release-1.16

Description - Re-positioned the drain/uncorden steps in kubeadm upgrade docs in release-1.16 #25732
I have moved the Drain the node step to be placed after running kubeadm upgrade on contron-plane and worker nodes, also I moved the Uncorden the node step to after Restart the kubelet to keep inline with the current version of the docs and as per discussions in [#25732] to ensure consistency between doc versions.

xref #25732
/sig cluster-lifecycle

/lgtm
/approve

/lgtm
/approve

/approve

/approve

/approve cancel

/approve cancel

/approve

/approve

https://github.com/kubernetes/website/blob/release-1.16/OWNERS_ALIASES#L37-L53 lists who can approve (we haven't yet backported the ownership changes).

https://github.com/kubernetes/website/blob/release-1.16/OWNERS_ALIASES#L37-L53 lists who can approve (we haven't yet backported the ownership changes).

Page preview:
https://deploy-preview-25887--k8s-v1-16.netlify.app/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/#upgrading-control-plane-nodes

Page preview:
https://deploy-preview-25887--k8s-v1-16.netlify.app/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/#upgrading-control-plane-nodes

Thanks for the updates @sculley .
It looks like the tab component is breaking up the list item numbers.
There are several places where the list numbers are repeated (1. ... 1. ...).
For example, https://deploy-preview-25887--k8s-v1-16.netlify.app/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/#upgrade-kubelet-and-kubectl-1
What do you think about updating the single numbered item lists to single bullet item lists, similar to:
https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/#upgrade-kubelet-and-kubectl-1

Thanks for the updates @sculley .
It looks like the tab component is breaking up the list item numbers.
There are several places where the list numbers are repeated (1. ... 1. ...).
For example, https://deploy-preview-25887--k8s-v1-16.netlify.app/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/#upgrade-kubelet-and-kubectl-1
What do you think about updating the single numbered item lists to single bullet item lists, similar to:
https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/#upgrade-kubelet-and-kubectl-1

It looks like the tab component is breaking up the list item numbers.

is this also a a problem in the other similar PRs that were merged?
https://github.com/kubernetes/website/pull/25886
https://github.com/kubernetes/website/pull/25885
https://github.com/kubernetes/website/pull/25883

It looks like the tab component is breaking up the list item numbers.

is this also a a problem in the other similar PRs that were merged?
https://github.com/kubernetes/website/pull/25886
https://github.com/kubernetes/website/pull/25885
https://github.com/kubernetes/website/pull/25883

It looks like the tab component is breaking up the list item numbers.

is this also a a problem in the other similar PRs that were merged?
#25886
#25885
#25883

@neolit123  - It's only a problem in this PR and #25886 the 1.18/1.19 releases already used bulleted item lists.

What do you think about updating the single numbered item lists to single bullet item lists, similar to:
https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/#upgrade-kubelet-and-kubectl-1

@kbhawkey - Apologies and thanks for reviewing and for spotting this issue. I will update this PR to use make the whole doc use bulleted item lists like the master and 1.18/1.19 releases and submit a new PR to update the numbered item lists in the 1.17 release too as that has already been approved and merged.
release-1.17 #25886
https://v1-17.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/

It looks like the tab component is breaking up the list item numbers.

is this also a a problem in the other similar PRs that were merged?
#25886
#25885
#25883

@neolit123  - It's only a problem in this PR and #25886 the 1.18/1.19 releases already used bulleted item lists.

What do you think about updating the single numbered item lists to single bullet item lists, similar to:
https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/#upgrade-kubelet-and-kubectl-1

@kbhawkey - Apologies and thanks for reviewing and for spotting this issue. I will update this PR to use make the whole doc use bulleted item lists like the master and 1.18/1.19 releases and submit a new PR to update the numbered item lists in the 1.17 release too as that has already been approved and merged.
release-1.17 #25886
https://v1-17.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/

Page preview:
https://deploy-preview-25887--k8s-v1-16.netlify.app/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/

Page preview:
https://deploy-preview-25887--k8s-v1-16.netlify.app/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/

/approve

/approve

/lgtm

/lgtm


manually manage API connection in Google Sign-In plugin

Right now the Android native code in the Google Sign-In Plugin relies on enableAutoManage, which requires FlutterActivity to extend FragmentActivity. By manually managing the API connection, we can avoid a dependency on the Android v4 support libraries, which are not currently included in the Flutter build system. This will allow the Google Sign-In plugin to work again.
Context: #9120, #9102, #9121

Is this done?

Not yet

@yjbanov here's a sketch of what I think needs to happen, but there may be other changes required to do it correctly.
index 99b6537..72afdfc 100644
--- a/android/src/main/java/io/flutter/plugins/googlesignin/GoogleSignInPlugin.java
+++ b/android/src/main/java/io/flutter/plugins/googlesignin/GoogleSignInPlugin.java
@@ -6,6 +6,7 @@ package io.flutter.plugins.googlesignin;

 import android.accounts.Account;
 import android.app.Activity;
+import android.app.Application.ActivityLifecycleCallbacks;
 import android.content.Intent;
 import android.net.Uri;
 import android.os.Bundle;
@@ -107,6 +108,30 @@ public class GoogleSignInPlugin
     this.activity = activity;
     this.backgroundTaskRunner = backgroundTaskRunner;
     this.requestCode = requestCode;
+    activity.getApplication().registerActivityLifecycleCallbacks(new ActivityLifecycleCallbacks() {
+      @Override
+      public void onActivityCreated(Activity activity, Bundle bundle) {}
+      @Override
+      public void onActivityDestroyed(Activity activity) {}
+      @Override
+      public void onActivityPaused(Activity activity) {}
+      @Override
+      public void onActivityResumed(Activity activity) {}
+      @Override
+      public void onActivitySaveInstanceState(Activity activity, Bundle outState) {}
+      @Override
+      public void onActivityStarted(Activity activity) {
+        if (activity == this.activity && googleApiClient != null) {
+          googleApiClient.connect();
+        }
+      }
+      @Override
+      public void onActivityStopped(Activity activity) {
+        if (activity == this.activity && googleApiClient != null) {
+          googleApiClient.disconnect();
+        }
+      }
+    });
     new FlutterMethodChannel(activity.getFlutterView(), CHANNEL)
       .setMethodCallHandler(this);
   }
@@ -154,7 +179,7 @@ public class GoogleSignInPlugin
      try {
        if (googleApiClient != null) {
          // This can happen if the scopes change, or a full restart hot reload
-         googleApiClient.stopAutoManage(activity);
+         googleApiClient.disconnect();
          googleApiClient = null;
        }
        GoogleSignInOptions.Builder optionsBuilder =
@@ -170,7 +195,6 @@ public class GoogleSignInPlugin
        this.requestedScopes = requestedScopes;
        this.googleApiClient =
            new GoogleApiClient.Builder(activity)
-               .enableAutoManage(activity, this)
                .addApi(Auth.GOOGLE_SIGN_IN_API, optionsBuilder.build())
                .addConnectionCallbacks(this)
                .build();
diff --git a/example/pubspec.yaml b/example/pubspec.yaml
index 950ca34..0ae9b05 100644

Thanks!

@yjbanov any status updates?  Can we close this?

I've been digging around the GoogleApiClient code and learning the Fragments API a bit. From what I've learned, Collin's sketch above (https://github.com/flutter/flutter/issues/9125#issuecomment-295464927) covers the primary functionality of "don't keep the connection open while FlutterActivity is inactive". However, enableAutoManage includes functionality for gracefully handling many different connectivity issues. It even includes UI that prompts the user to take action. We won't be able to replicate that functionality, so if we want it, we have to integrate with the Fragments API.
The good news is there seems to be a way for us to integrate with Fragments without pulling in the support libraries. The idea is to introduce a FlutterFragment, which FlutterActivity (which remains a direct descendant of Activity) then adds to itself. We can then provide a separate class FlutterFragmentActivity, which extends FragmentActivity, also delegates to FlutterFragment, but also depends on the fragments support library. For current users of FlutterActivity this should be a no-op. Only the users that require FragmentActivity would need to depend on the fragments support library.
I expect this will involve some yak shaving, which may be ok. In the meantime, to unblock everyone who needs Google Sign-in, we could start with applying Collin's patch, and work on a proper fix as a follow-up.


Error importing project in NodeJS environment.

I'm attempting to use this in a NodeJS project. I've tried ES5 and ES6 imports.
Version: "firebase-paginator": "^1.0.13",
var FirebasePaginator = require('firebase-paginator')

Results in the error:
FirebasePaginator is not a constructor on line
const paginator = new FirebasePaginator(testRef, { pageSize: 5, finite: false });

adding .default to the import does not resolve the issue.

import FirebasePaginator from 'firebase-paginator';

Causes the following error
_firebasePaginator2.default is not a constructor

i am getting the same issue:
"_firebasePaginator2.default is not a constructor"
but that is because I am using webpack to bundle my project for a react app which runs in a browser.
so the window object will be available but I would like to use the module exports.
if (typeof window === 'object') {
  window.FirebasePaginator = FirebasePaginator;
} else if (typeof process === 'object') {
  module.exports = FirebasePaginator;
}

I'm using React as well, (react-native), and the window.FirebasePaginator is also not a valid constructor, is it working for you? @crivera

the window version wokred for me but it wasnt ideal... so i made my own fork which should work only with module.exports (ie node)
https://github.com/crivera/firebase-paginator
the only thing since I am using it in the browser i removed the axiom dependency... so we might wanna update something there... but just gimme a pullrequest and ill add it

I think I got it fixed:
https://github.com/deltaepsilon/firebase-paginator/commit/13bb075fabae398309a13250b2eca0654f3d844a

@crivera It worked fine with regular Node, but React uses JSDom, which has a window and a global. So I moved all of my testing over to JEST and figured out a better way to check for Node.js vs the browser.
Let me know if this doesn't work. Also, do you have an idea for how to split the code to it doesn't need Axios in the browser?


fix dbTx time counting error

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.

@holajiawei good catch! thanks for the contribution.
I'll associate an issue with the PR before addressing it.
It will be faster to look up this fix later.


[UI] Improve Dark Mode Readability and Contrast

Is there an existing issue for this?

[X] I have searched the existing issues

Is your UI update related to a problem? Please describe.
We've received feedback regarding the difficulty reading content in our app's dark mode due to harsh contrast and dark-on-dark components. We need to address these concerns to improve overall user experience and accessibility.
Current Issues:

White font on dark background creates excessive contrast, causing eye strain.
Some components are dark-on-dark, making them hard to distinguish.
Overall readability in dark mode is poor, especially in low-light conditions.

Describe the solution you'd like (include image or link to prototype)

Replace white font in dark mode with softer colors
Review and adjust the color scheme of dark-on-dark components to improve visibility.
Consider removing or reducing transparency in certain UI elements to enhance readability.
Evaluate the current grey fonts and determine if they need further adjustment.

Goals:

Improve overall readability in dark mode
Reduce eye strain for users in low-light environments
Maintain a cohesive and attractive design while prioritizing usability

Describe alternatives you've considered
No response
Technical considerations
No response
Anything else?
No response

Do you think this task has been addressed in the recent design jam changes, or it still needs revision? @AtelyPham

We can close this @yurixander.


kube-lego not working with nginx-ingress

So not really sure quite where to start with this. I'm a maintainer on both of the helm charts involved here so I'm a bit perplexed not being able to solve this. When kube-lego tries to make a call to /.well-known/acme-challenge/_selftest this call fails and is redirected to tls. This never used to happen even though I have not changed the setup. I'm passing some configuration options to nginx-ingress (see below). The error in the nginx-ingress is as follows:
2017/08/01 21:22:12 [error] 6255#6255: *35341 broken header: "GET /.well-known/acme-challenge/_selftest HTTP/1.1
Host: example.com
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip

" while reading PROXY protocol, client: <IP_ADDRESS>, server: <IP_ADDRESS>:80

additional nginx config
  config:
      proxy-connect-timeout: "30"
      proxy-read-timeout: "600"
      proxy-send-imeout: "600"
      hsts-include-subdomains: "false"
      ssl-redirect: "false"
      hsts: "false"
      body-size: "64m"
      server-name-hash-bucket-size: "256"
      use-proxy-protocol: "true"
      error-log-level: "warn"

generated nginx.conf
daemon off;

worker_processes 8;
pid /run/nginx.pid;

worker_rlimit_nofile 130048;
events {
    multi_accept        on;
    worker_connections  16384;
    use                 epoll;
}

http {
    set_real_ip_from    <IP_ADDRESS>/0;
    real_ip_header      proxy_protocol;

    real_ip_recursive   on;

    geoip_country       /etc/nginx/GeoIP.dat;
    geoip_city          /etc/nginx/GeoLiteCity.dat;
    geoip_proxy_recursive on;

    vhost_traffic_status_zone shared:vhost_traffic_status:10m;
    vhost_traffic_status_filter_by_set_key $geoip_country_code country::*;

    # lua section to return proper error codes when custom pages are used
    lua_package_path '.?.lua;/etc/nginx/lua/?.lua;/etc/nginx/lua/vendor/lua-resty-http/lib/?.lua;';
    init_by_lua_block {
        require("error_page")
    }

    sendfile            on;
    aio                 threads;
    tcp_nopush          on;
    tcp_nodelay         on;

    log_subrequest      on;

    reset_timedout_connection on;

    keepalive_timeout  75s;
    keepalive_requests 100;

    client_header_buffer_size       1k;
    large_client_header_buffers     4 8k;
    client_body_buffer_size         8k;

    http2_max_field_size            4k;
    http2_max_header_size           16k;

    types_hash_max_size             2048;
    server_names_hash_max_size      1024;
    server_names_hash_bucket_size   256;
    map_hash_bucket_size            64;

    proxy_headers_hash_max_size     512;
    proxy_headers_hash_bucket_size  64;

    variables_hash_bucket_size      64;
    variables_hash_max_size         2048;

    underscores_in_headers          off;
    ignore_invalid_headers          on;

    include /etc/nginx/mime.types;
    default_type text/html;
    gzip on;
    gzip_comp_level 5;
    gzip_http_version 1.1;
    gzip_min_length 256;
    gzip_types application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component;
    gzip_proxied any;

    # Custom headers for response

    server_tokens on;

    # disable warnings
    uninitialized_variable_warn off;

    log_format upstreaminfo '$the_real_ip - [$the_real_ip] - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status';

    map $request_uri $loggable {
        default 1;
    }

    access_log /var/log/nginx/access.log upstreaminfo if=$loggable;
    error_log  /var/log/nginx/error.log warn;

    resolver <IP_ADDRESS> valid=30s;

    # Retain the default nginx handling of requests without a "Connection" header
    map $http_upgrade $connection_upgrade {
        default          upgrade;
        ''               close;
    }

    # trust http_x_forwarded_proto headers correctly indicate ssl offloading
    map $http_x_forwarded_proto $pass_access_scheme {
        default          $http_x_forwarded_proto;
        ''               $scheme;
    }

    map $http_x_forwarded_port $pass_server_port {
       default           $http_x_forwarded_port;
       ''                $server_port;
    }

    map $http_x_forwarded_for $the_real_ip {
        default          $http_x_forwarded_for;
        ''               $proxy_protocol_addr;
    }

    # map port 442 to 443 for header X-Forwarded-Port
    map $pass_server_port $pass_port {
        442              443;
        default          $pass_server_port;
    }

    # Map a response error watching the header Content-Type
    map $http_accept $httpAccept {
        default          html;
        application/json json;
        application/xml  xml;
        text/plain       text;
    }

    map $httpAccept $httpReturnType {
        default          text/html;
        json             application/json;
        xml              application/xml;
        text             text/plain;
    }

    # Obtain best http host
    map $http_host $this_host {
        default          $http_host;
        ''               $host;
    }

    map $http_x_forwarded_host $best_http_host {
        default          $http_x_forwarded_host;
        ''               $this_host;
    }

    server_name_in_redirect off;
    port_in_redirect        off;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    # turn on session caching to drastically improve performance
    ssl_session_cache builtin:1000 shared:SSL:10m;
    ssl_session_timeout 10m;

    # allow configuring ssl session tickets
    ssl_session_tickets on;

    # slightly reduce the time-to-first-byte
    ssl_buffer_size 4k;

    # allow configuring custom ssl ciphers
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers on;

    ssl_ecdh_curve secp384r1;

    proxy_ssl_session_reuse on;

    upstream upstream-default-backend {
        # Load balance algorithm; empty for round robin, which is the default
        least_conn;
        server <IP_ADDRESS>:8080 max_fails=0 fail_timeout=0;
        server <IP_ADDRESS>:8080 max_fails=0 fail_timeout=0;
    }

    upstream prod-oauth-chronograf-80 {
        # Load balance algorithm; empty for round robin, which is the default
        least_conn;
        server <IP_ADDRESS>:8888 max_fails=0 fail_timeout=0;
    }

    upstream discourse-discourse-webhooks-5000 {
        # Load balance algorithm; empty for round robin, which is the default
        least_conn;
        server <IP_ADDRESS>:5000 max_fails=0 fail_timeout=0;
        server <IP_ADDRESS>:5000 max_fails=0 fail_timeout=0;
    }

    upstream usage-ingest-usage-server-80 {
        # Load balance algorithm; empty for round robin, which is the default
        least_conn;
        server <IP_ADDRESS>:8080 max_fails=0 fail_timeout=0;
        server <IP_ADDRESS>:8080 max_fails=0 fail_timeout=0;
    }

    upstream kube-system-kube-lego-nginx-8080 {
        # Load balance algorithm; empty for round robin, which is the default
        least_conn;
        server <IP_ADDRESS>:8080 max_fails=0 fail_timeout=0;
    }

    geo $the_real_ip $deny_76fcb8fb-57ba-4bf1-8f3c-c91e388f2dc3 {
        default 1;

        <IP_ADDRESS>/0 0;
    }
    geo $the_real_ip $deny_c40c003b-9552-4919-9ddf-6a982254838a {
        default 1;

        <IP_ADDRESS>/0 0;
    }
    geo $the_real_ip $deny_9d72727d-2d00-4769-badb-a2f7e3e7d935 {
        default 1;

        <IP_ADDRESS>/0 0;
    }

    server {
        server_name _;
        listen 80 proxy_protocol default_server reuseport backlog=511;
        listen [::]:80 proxy_protocol default_server reuseport backlog=511;
        set $proxy_upstream_name "-";

        listen 442 proxy_protocol default_server reuseport backlog=511 ssl http2;
        listen [::]:442 proxy_protocol  default_server reuseport backlog=511 ssl http2;

        ssl_certificate                         /ingress-controller/ssl/default-fake-certificate.pem;
        ssl_certificate_key                     /ingress-controller/ssl/default-fake-certificate.pem;
        vhost_traffic_status_filter_by_set_key $geoip_country_code country::$server_name;

        location / {
            set $proxy_upstream_name "upstream-default-backend";

            port_in_redirect off;

            client_max_body_size                    "1m";

            proxy_set_header Host                   $best_http_host;

            # Pass the extracted client certificate to the backend

            # Allow websocket connections
            proxy_set_header                        Upgrade           $http_upgrade;
            proxy_set_header                        Connection        $connection_upgrade;

            proxy_set_header X-Real-IP              $the_real_ip;
            proxy_set_header X-Forwarded-For        $the_real_ip;
            proxy_set_header X-Forwarded-Host       $best_http_host;
            proxy_set_header X-Forwarded-Port       $pass_port;
            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
            proxy_set_header X-Original-URI         $request_uri;
            proxy_set_header X-Scheme               $pass_access_scheme;

            # mitigate HTTPoxy Vulnerability
            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
            proxy_set_header Proxy                  "";

            # Custom headers to proxied server

            proxy_connect_timeout                   30s;
            proxy_send_timeout                      60s;
            proxy_read_timeout                      600s;

            proxy_redirect                          off;
            proxy_buffering                         off;
            proxy_buffer_size                       "4k";
            proxy_buffers                           4 "4k";

            proxy_http_version                      1.1;

            proxy_cookie_domain                     off;
            proxy_cookie_path                       off;

            # In case of errors try the next upstream server before returning an error
            proxy_next_upstream                     error timeout invalid_header http_502 http_503 http_504;

            proxy_pass http://upstream-default-backend;
        }

        # health checks in cloud providers require the use of port 80
        location /healthz {
            access_log off;
            return 200;
        }

        # this is required to avoid error if nginx is being monitored
        # with an external software (like sysdig)
        location /nginx_status {
            allow <IP_ADDRESS>;
            allow ::1;
            deny all;

            access_log off;
            stub_status on;
        }
    }

    server {
        server_name chronograf.influxdata.com;
        listen 80 proxy_protocol;
        listen [::]:80 proxy_protocol;
        set $proxy_upstream_name "-";

        listen 442 proxy_protocol ssl http2;
        listen [::]:442 proxy_protocol  ssl http2;

        ssl_certificate                         /ingress-controller/ssl/prod-oauth-chronograf-tls.pem;
        ssl_certificate_key                     /ingress-controller/ssl/prod-oauth-chronograf-tls.pem;
        vhost_traffic_status_filter_by_set_key $geoip_country_code country::$server_name;

        location /.well-known/acme-challenge {
            set $proxy_upstream_name "kube-system-kube-lego-nginx-8080";
            if ($deny_76fcb8fb-57ba-4bf1-8f3c-c91e388f2dc3) {
                return 403;
            }

            port_in_redirect off;

            client_max_body_size                    "1m";

            proxy_set_header Host                   $best_http_host;

            # Pass the extracted client certificate to the backend

            # Allow websocket connections
            proxy_set_header                        Upgrade           $http_upgrade;
            proxy_set_header                        Connection        $connection_upgrade;

            proxy_set_header X-Real-IP              $the_real_ip;
            proxy_set_header X-Forwarded-For        $the_real_ip;
            proxy_set_header X-Forwarded-Host       $best_http_host;
            proxy_set_header X-Forwarded-Port       $pass_port;
            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
            proxy_set_header X-Original-URI         $request_uri;
            proxy_set_header X-Scheme               $pass_access_scheme;

            # mitigate HTTPoxy Vulnerability
            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
            proxy_set_header Proxy                  "";

            # Custom headers to proxied server

            proxy_connect_timeout                   30s;
            proxy_send_timeout                      60s;
            proxy_read_timeout                      600s;

            proxy_redirect                          off;
            proxy_buffering                         off;
            proxy_buffer_size                       "4k";
            proxy_buffers                           4 "4k";

            proxy_http_version                      1.1;

            proxy_cookie_domain                     off;
            proxy_cookie_path                       off;

            # In case of errors try the next upstream server before returning an error
            proxy_next_upstream                     error timeout invalid_header http_502 http_503 http_504;

            proxy_pass http://kube-system-kube-lego-nginx-8080;
        }
        location / {
            set $proxy_upstream_name "prod-oauth-chronograf-80";

            port_in_redirect off;

            client_max_body_size                    "1m";

            proxy_set_header Host                   $best_http_host;

            # Pass the extracted client certificate to the backend

            # Allow websocket connections
            proxy_set_header                        Upgrade           $http_upgrade;
            proxy_set_header                        Connection        $connection_upgrade;

            proxy_set_header X-Real-IP              $the_real_ip;
            proxy_set_header X-Forwarded-For        $the_real_ip;
            proxy_set_header X-Forwarded-Host       $best_http_host;
            proxy_set_header X-Forwarded-Port       $pass_port;
            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
            proxy_set_header X-Original-URI         $request_uri;
            proxy_set_header X-Scheme               $pass_access_scheme;

            # mitigate HTTPoxy Vulnerability
            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
            proxy_set_header Proxy                  "";

            # Custom headers to proxied server

            proxy_connect_timeout                   30s;
            proxy_send_timeout                      60s;
            proxy_read_timeout                      600s;

            proxy_redirect                          off;
            proxy_buffering                         off;
            proxy_buffer_size                       "4k";
            proxy_buffers                           4 "4k";

            proxy_http_version                      1.1;

            proxy_cookie_domain                     off;
            proxy_cookie_path                       off;

            # In case of errors try the next upstream server before returning an error
            proxy_next_upstream                     error timeout invalid_header http_502 http_503 http_504;

            proxy_pass http://prod-oauth-chronograf-80;
        }

    }

    server {
        server_name hooks.jackzampolin.com;
        listen 80 proxy_protocol;
        listen [::]:80 proxy_protocol;
        set $proxy_upstream_name "-";

        listen 442 proxy_protocol ssl http2;
        listen [::]:442 proxy_protocol  ssl http2;
        ssl_certificate                         /ingress-controller/ssl/discourse-jackserver-tls.pem;
        ssl_certificate_key                     /ingress-controller/ssl/discourse-jackserver-tls.pem;
        vhost_traffic_status_filter_by_set_key $geoip_country_code country::$server_name;

        location /.well-known/acme-challenge {
            set $proxy_upstream_name "kube-system-kube-lego-nginx-8080";
            if ($deny_c40c003b-9552-4919-9ddf-6a982254838a) {
                return 403;
            }

            port_in_redirect off;

            client_max_body_size                    "1m";

            proxy_set_header Host                   $best_http_host;

            # Pass the extracted client certificate to the backend

            # Allow websocket connections
            proxy_set_header                        Upgrade           $http_upgrade;
            proxy_set_header                        Connection        $connection_upgrade;

            proxy_set_header X-Real-IP              $the_real_ip;
            proxy_set_header X-Forwarded-For        $the_real_ip;
            proxy_set_header X-Forwarded-Host       $best_http_host;
            proxy_set_header X-Forwarded-Port       $pass_port;
            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
            proxy_set_header X-Original-URI         $request_uri;
            proxy_set_header X-Scheme               $pass_access_scheme;

            # mitigate HTTPoxy Vulnerability
            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
            proxy_set_header Proxy                  "";

            # Custom headers to proxied server

            proxy_connect_timeout                   30s;
            proxy_send_timeout                      60s;
            proxy_read_timeout                      600s;

            proxy_redirect                          off;
            proxy_buffering                         off;
            proxy_buffer_size                       "4k";
            proxy_buffers                           4 "4k";

            proxy_http_version                      1.1;

            proxy_cookie_domain                     off;
            proxy_cookie_path                       off;

            # In case of errors try the next upstream server before returning an error
            proxy_next_upstream                     error timeout invalid_header http_502 http_503 http_504;

            proxy_pass http://kube-system-kube-lego-nginx-8080;
        }
        location / {
            set $proxy_upstream_name "discourse-discourse-webhooks-5000";

            port_in_redirect off;

            client_max_body_size                    "1m";

            proxy_set_header Host                   $best_http_host;

            # Pass the extracted client certificate to the backend

            # Allow websocket connections
            proxy_set_header                        Upgrade           $http_upgrade;
            proxy_set_header                        Connection        $connection_upgrade;

            proxy_set_header X-Real-IP              $the_real_ip;
            proxy_set_header X-Forwarded-For        $the_real_ip;
            proxy_set_header X-Forwarded-Host       $best_http_host;
            proxy_set_header X-Forwarded-Port       $pass_port;
            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
            proxy_set_header X-Original-URI         $request_uri;
            proxy_set_header X-Scheme               $pass_access_scheme;

            # mitigate HTTPoxy Vulnerability
            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
            proxy_set_header Proxy                  "";

            # Custom headers to proxied server

            proxy_connect_timeout                   30s;
            proxy_send_timeout                      60s;
            proxy_read_timeout                      600s;

            proxy_redirect                          off;
            proxy_buffering                         off;
            proxy_buffer_size                       "4k";
            proxy_buffers                           4 "4k";

            proxy_http_version                      1.1;

            proxy_cookie_domain                     off;
            proxy_cookie_path                       off;

            # In case of errors try the next upstream server before returning an error
            proxy_next_upstream                     error timeout invalid_header http_502 http_503 http_504;

            proxy_pass http://discourse-discourse-webhooks-5000;
        }

    }

    server {
        server_name usagetest.influxdata.com;
        listen 80 proxy_protocol;
        listen [::]:80 proxy_protocol;
        set $proxy_upstream_name "-";

        listen 442 proxy_protocol ssl http2;
        listen [::]:442 proxy_protocol  ssl http2;
        ssl_certificate                         /ingress-controller/ssl/usage-usage-server-tls.pem;
        ssl_certificate_key                     /ingress-controller/ssl/usage-usage-server-tls.pem;
        vhost_traffic_status_filter_by_set_key $geoip_country_code country::$server_name;

        location /.well-known/acme-challenge {
            set $proxy_upstream_name "kube-system-kube-lego-nginx-8080";
            if ($deny_9d72727d-2d00-4769-badb-a2f7e3e7d935) {
                return 403;
            }

            port_in_redirect off;

            client_max_body_size                    "1m";

            proxy_set_header Host                   $best_http_host;

            # Pass the extracted client certificate to the backend

            # Allow websocket connections
            proxy_set_header                        Upgrade           $http_upgrade;
            proxy_set_header                        Connection        $connection_upgrade;

            proxy_set_header X-Real-IP              $the_real_ip;
            proxy_set_header X-Forwarded-For        $the_real_ip;
            proxy_set_header X-Forwarded-Host       $best_http_host;
            proxy_set_header X-Forwarded-Port       $pass_port;
            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
            proxy_set_header X-Original-URI         $request_uri;
            proxy_set_header X-Scheme               $pass_access_scheme;

            # mitigate HTTPoxy Vulnerability
            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
            proxy_set_header Proxy                  "";

            # Custom headers to proxied server

            proxy_connect_timeout                   30s;
            proxy_send_timeout                      60s;
            proxy_read_timeout                      600s;

            proxy_redirect                          off;
            proxy_buffering                         off;
            proxy_buffer_size                       "4k";
            proxy_buffers                           4 "4k";

            proxy_http_version                      1.1;

            proxy_cookie_domain                     off;
            proxy_cookie_path                       off;

            # In case of errors try the next upstream server before returning an error
            proxy_next_upstream                     error timeout invalid_header http_502 http_503 http_504;

            proxy_pass http://kube-system-kube-lego-nginx-8080;
        }
        location / {
            set $proxy_upstream_name "usage-ingest-usage-server-80";

            port_in_redirect off;

            client_max_body_size                    "1m";

            proxy_set_header Host                   $best_http_host;

            # Pass the extracted client certificate to the backend

            # Allow websocket connections
            proxy_set_header                        Upgrade           $http_upgrade;
            proxy_set_header                        Connection        $connection_upgrade;

            proxy_set_header X-Real-IP              $the_real_ip;
            proxy_set_header X-Forwarded-For        $the_real_ip;
            proxy_set_header X-Forwarded-Host       $best_http_host;
            proxy_set_header X-Forwarded-Port       $pass_port;
            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
            proxy_set_header X-Original-URI         $request_uri;
            proxy_set_header X-Scheme               $pass_access_scheme;

            # mitigate HTTPoxy Vulnerability
            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
            proxy_set_header Proxy                  "";

            # Custom headers to proxied server

            proxy_connect_timeout                   30s;
            proxy_send_timeout                      60s;
            proxy_read_timeout                      600s;

            proxy_redirect                          off;
            proxy_buffering                         off;
            proxy_buffer_size                       "4k";
            proxy_buffers                           4 "4k";

            proxy_http_version                      1.1;

            proxy_cookie_domain                     off;
            proxy_cookie_path                       off;

            # In case of errors try the next upstream server before returning an error
            proxy_next_upstream                     error timeout invalid_header http_502 http_503 http_504;

            proxy_pass http://usage-ingest-usage-server-80;
        }

    }
    # default server, used for NGINX healthcheck and access to nginx stats
    server {
        # Use the port 18080 (random value just to avoid known ports) as default port for nginx.
        # Changing this value requires a change in:
        # https://github.com/kubernetes/contrib/blob/master/ingress/controllers/nginx/nginx/command.go#L104
        listen 18080 default_server reuseport backlog=511;
        listen [::]:18080 default_server reuseport backlog=511;
        set $proxy_upstream_name "-";

        location /healthz {
            access_log off;
            return 200;
        }

        location /nginx_status {
            set $proxy_upstream_name "internal";

            vhost_traffic_status_display;
            vhost_traffic_status_display_format html;
        }

        # this location is used to extract nginx metrics
        # using prometheus.
        # TODO: enable extraction for vts module.
        location /internal_nginx_status {
            set $proxy_upstream_name "internal";

            allow <IP_ADDRESS>;
            allow ::1;
            deny all;

            access_log off;
            stub_status on;
        }

        location / {
            set $proxy_upstream_name "upstream-default-backend";
            proxy_pass             http://upstream-default-backend;
        }

    }

    # default server for services without endpoints
    server {
        listen 8181;
        set $proxy_upstream_name "-";

        location / {
            return 503;
        }
    }
}

stream {
    log_format log_stream [$time_local] $protocol $status $bytes_sent $bytes_received $session_time;
    access_log /var/log/nginx/access.log log_stream;
    error_log  /var/log/nginx/error.log;
    # TCP services
    # UDP services
}

Anyone have any good ideas on this one?

+1

So I ended up finding out what was going on. You can't use the Proxy Pass features of Nginx and get the real client IP while using kube-lego on GCE. Its kind of a bummer but thats the case.

@jackzampolin May I ask, why you cannot? What is the problem? And how can this be solved? What are the alternatives?

@m-koepke I ended up banging my head against the wall for couple of days on this. Just went through my notes on this and the below explanation may or may not make sense:
If you enable the proxy pass on the nginx-ingress ( use-proxy-protocol: "true") it causes the verification requests from kube-lego to timeout, so no new certs and no renewals. The verification requests come in over HTTP but the GCE LB (provisioned with LoadBalancer) only handles proxy protocol over HTTPS so the requests fail. I tried a number of way to get around this but was unable to. The service I was deploying depended on both proxy pass and SSL so I ended up deploying it on a bare VM. Kind of a bummer.
Hope that helps!

@jackzampolin Thanks for the explanation. This seems to be related to https://github.com/jetstack/kube-lego/issues/173. If the selftest would use https, everything should work, right?

@m-koepke That seemed to be the case when I was working on it last.

kube-lego could allow for an config option to chose the desired reachability test to try.
lego.test: http
lego.test: https
lego.test: dns
...
I think it is important to support setups that need 'use-proxy-protocol' at IC level.
What do you think?

I totally agree. This was a very frustrating issue for me. I'll change the title of the issue.


I need a promptpay feature.

promptpay is not supported right now.
Please update this important feature for mobile.

Hi! We don't keep track of payment method feature requests in Github issues, so I'm going to close this. Although we do support Promptpay on web, we don't have a timeline yet for supporting it on mobile


JKBMS V11.26  raspberry venus os large

Hi Louis,
Thank you for your work.

How did you solve it?

Hi Louis,
I cut the cable from the JKBMS 485 and kept only the side with the connector to the GPS. I connected the ground, TX and TX to the TTL to USB converter.
It has been running flawlessly for two days now.
image.png
I also tested another TTL converter
https://drive.google.com/file/d/1Kadc8Wt0xzEfWW1uRZ9p5hc5X2WTZqsp/view?usp=sharing
https://drive.google.com/file/d/1JOqjtiiXrSSm0qrLVHdL2eSq9X5_-2ce/view?usp=sharing
I will now look for a much smaller TTL converter and see if I can welded directly to the raspberry to keep it into the case.
I will see how to start the serial comm port on Venus OS.
Thank you for your work.
Best regards
Patrick

Ok, so related to https://github.com/Louisvdw/dbus-serialbattery/discussions/524. Thanks

I dont know if I'm on the right topic but i have issue ( connectet via BLUETOOTH) with 2 of 3 JK devices. one is working well 2 are working also but i only get the voltage of each cell but not the "rest" of datas. the working jk is SW 10.09, the not working SW11.25 maybe you can help me , thanks


FE-assignment-1

Metric
Value

alert_status
b:white_check_mark: OK/b

bugs
2

code_smells
3

reliability_rating
C (at least 1 Major Bug)br/Note: A being best, E being worst

security_rating
A (0 Vulnerabilities)br/Note: A being best, E being worst

vulnerabilities
0


[Auth] Explore better silent renew auth token strategies

Post-mvp, we should re-visit our silent renew strategies as outlined in this ticket.
Summary of current state
We were seeing testers during bug bashes hit 403s when sitting on the upload page for more than 10 minutes. This is a hotfix meant to fix this bug for the beta / next bug bash on Friday, but the react-oidc-context library will be revisited after launch. A lot of people have this issue it seems when users idle on a page, with the most common approach being to pop up an alert or use the approach I do in this PR: silently renewing the tokens if they expire. I'd rather lean on just automaticSilentRenew, and I think it may work in later versions of the library if we upgraded, but I'd like to fix it for now for the next bug bash then do a more thorough look at the automaticSilentRenew behavior when we get more time.
The obvious problem with this implementation is that currently this causes a re-render when a user's token expires (if they sit on the same page for 10 minutes). I think it's probably a mix of the useEffect but also maybe our config generally. I'd like to dig in a little deeper, but for now, let's fix it and then go back and try upgrading / creating a more nuanced auth strategy (maybe even upload page specific) after the next bug bash / post-mvp. I'm also going to ask that we bump the timeout to 15 minutes, and I think this issue will be mostly solved in the short-term. Here's the stub of a ticket for post-mvp work, and I might explore a more refined solution just for the upload page later.
Current behavior

If I sit on a page for 10 minutes, my token expires unless I refresh the page.

Expected behavior

If I sit on a page for 10 minutes, my token expires, the token refreshes, I can still perform actions.

Steps to replicate behavior (include URLs)

Sit on the upload page for 15 minutes then try to upload.

Closed by #697


Add tracker config to control block, entity, and TE tracking.

Just for verifying the changes proposed for improving capturing compatibility and allowing server administrators to configure for better compatibility with mod entities.

got multiple gb of this https://gist.github.com/phit/d61a72b67d227b3057721dd133bec330
related or separate issue?

It looks like there is a tile entity that is causing chunk loads, but I don't think ti's directly caused by this branch. I'll need to get the Unwinding state to provide the nested context to get some better understanding. I'll push some changes to better debug this sort of issue once I finish documenting IPhaseState.


Add CI

Almost certainly what we'll want is Flurry's CI config with the addition of loom:
https://github.com/jonhoo/flurry/blob/master/azure-pipelines.yml
We can probably cut out the cargo deny bits for now.
We should also probably include an adjusted version of codecov.yml. Something like

https://github.com/jonhoo/flurry/blob/master/codecov.yml
https://github.com/HdrHistogram/HdrHistogram_rust/blob/1bba4121f74016e02bb6a792cddd9c99d49dbf1c/.codecov.yml

I wonder if MIRI, ASAN, and TSAN will actually let the current tests we have pass :thinking:

I've set up Azure Pipelines now, so in theory it should just be a matter of adjusting azure-pipelines.yml in a PR now if anyone has the time :sweat_smile:
Or, even just fix the things that are already broken (most notably that we require nightly).

This is now done! Although admittedly I'm tempted to move over to GitHub Actions...


NB Disclaimer and Acks update - BM batch

Updated the Disclaimer and Acks for 11 notebooks.

@bmerino95 one NB in your batch has a conflict, likely because I just merged your DRAGONS NBs, and one of them was this very NB. I'll attempt to resolve it by pushing to your branch.
And I'll review the entire batch (today and/or tomorrow).

@bmerino95 I think I resolved the merge conflict correctly. I'm still checking the offending NB 04_HowTos/DataReduction/DRAGONS_reduction_examples/GMOS_Imaging_StarryField/GMOS_Imaging_StarryField.ipynb --> It seems to have both your Disclaimer & Acks changes, and the updated language from David's comments.
If you could also please take a quick look and let me know whether things look alright? Thanks!

Hey @rnikutta. I just looked through the GMOS_Imaging_StarryField.ipynb and it looks good. The disclaimer/acknowledgments are updated and David’s suggestions are present.

Thanks @bmerino95 I will attempt a merge! Fingers crossed..


readme: add note about using this in an app that has state

Adds a note to the readme saying what to do if you want to use this in an app that has state.

ugh wrong repo


XP: Line 27 of the INF file Vi386\winnt.sif is invalid

Operating system
Debian GNU/Linux 12
Description
Thank you for the great project.
I've tried to install the Windows XP but after the inspecting of the hardware configuration I get an error:
Line 27 of the INF file Vi386\winnt.sif is invalid
Setup cannot continue. Press any key to exit.

After restarting it repeats of course.
(I've started from the Russian image and locale, and also tested using the default compose — the same result.)
Docker compose
services:
  windows:
    image: dockurr/windows
    container_name: winxp
    environment:
      VERSION: "winxp"

      #LANGUAGE: "Russian"
      #REGION: "ru-RU"
      #KEYBOARD: "ru-RU"

      RAM_SIZE: "1G"
      CPU_CORES: "1"
      DISK_SIZE: "10G"

      USERNAME: "Dmitry"
      PASSWORD: "${PASSWORD}"

    volumes:
      - ${APPDATA}/winxp:/storage
    devices:
      - /dev/kvm
    #cap_add:
    #  - NET_ADMIN
    ports:
      - 8006
      - 3389:3389/tcp
      - 3389:3389/udp
    stop_grace_period: 2m

Docker log
DSsDSsDSsDSs
SeaBIOS (version 1.16.3-debian-1.16.3-2)
Booting from Hard Disk...
Boot failed: not a bootable disk

Booting from DVD/CD...

Screenshots (optional)
No response

God, thank you, you've saved my day.
By the way, is it possible to debug install.sh? I've tried to source it and run the specific function, but it closes the docker exec session and returns me back to the host.


Add missing dot for equity/salary exchange

The language could be more clear here, but the "totaling" is intended to mean that it brings the total (.9 + .1) to ~1%

Fixed this here https://github.com/clef/handbook/pull/97


Add Developing in README

Description
Seems adding some README for introducing other developers how to set up dev env is helpful?
Submitter checklist

[ ] Link to JIRA ticket in description, if appropriate.
[ ] Change is code complete and matches issue description
[ ] Appropriate unit or acceptance tests or explanation to why this change has no tests

Reviewer checklist

[ ] Run the changes and verified the change matches the issue description
[ ] Reviewed the code
[ ] Verified that the appropriate tests have been written or valid explanation given

@reviewbybees

This pull request originates from a CloudBees employee. At CloudBees, we require that all pull requests be reviewed by other CloudBees employees before we seek to have the change accepted. If you want to learn more about our process please see this explanation.

LGTM

thank you!


[MB-14356] Refactor updateBillableWeight templates

Jira ticket for this change
Summary

[x] Refactor updateBillableWeight template and test
[x] Refactor updateBillableWeightAsTIO template and test
[x] Refactor updateBillableWeightRemarkAsTIO template and test

Setup to Run Your Code

💻 You will need to use three separate terminals to test this locally.
Terminal 1
Start the UI locally.
make client_run

Terminal 2
Start the Go server locally.
make server_run

Additional steps

In the officer user app, login as TOO
Open a move that has been approved.
Go to the move item tab and edit the max billable weight

[ ] There should be a Update move event with the labeled details stating the Max billable weight has been updated.

In the officer user app, login as TIO
Open a move that has been completed.
Go to payment request tab and choose Review weights
update the max billable weight and remarks

[ ] There should be a Update move event with the labeled details stating the Max billable weight with updated value,
[ ] There should be a Update move event with the labeled details stating the Max billable weight remarks with updated value.

Verification Steps for Author
These are to be checked by the author.

[ ] Tested in the Experimental environment (for changes to containers, app startup, or connection to data stores)
[ ] Request review from a member of a different team.
[ ] Have the Jira acceptance criteria been met for this change?

Verification Steps for Reviewers
These are to be checked by a reviewer.

Frontend

[ ] User facing changes have been reviewed by design.
[ ] There are no aXe warnings for UI.
[ ] This works in Supported Browsers and their phone views (Chrome, Firefox, IE, Edge).
[ ] There are no new console errors in the browser devtools
[ ] There are no new console errors in the test output
[ ] If this PR adds a new component to Storybook, it ensures the component is fully responsive, OR if it is intentionally not, a wrapping div using the officeApp class or custom min-width styling is used to hide any states the would not be visible to the user.

Screenshots
Start the Storybook locally.
make storybook

Terminal 2
Start the UI locally.
make client_run

Terminal 3
Start the Go server locally.
make server_run

Additional steps

Access the
Login as a

Verification Steps for Author
These are to be checked by the author.

[ ] Tested in the Experimental environment (for changes to containers, app startup, or connection to data stores)
[ ] Request review from a member of a different team.
[ ] Have the Jira acceptance criteria been met for this change?

Verification Steps for Reviewers
These are to be checked by a reviewer.

Frontend

[ ] User facing changes have been reviewed by design.
[ ] There are no aXe warnings for UI.
[ ] This works in Supported Browsers and their phone views (Chrome, Firefox, IE, Edge).
[ ] There are no new console errors in the browser devtools
[ ] There are no new console errors in the test output
[ ] If this PR adds a new component to Storybook, it ensures the component is fully responsive, OR if it is intentionally not, a wrapping div using the officeApp class or custom min-width styling is used to hide any states the would not be visible to the user.

Screenshots

Messages

:book:
:link: MB-14356

  Generated by :no_entry_sign: dangerJS against b856f9af580c4cb09cad59269d86c1bf7971f3b7


feat!: Set a default service name (DD_SERVICE) when no service is configured

Description
Adds a default service for the configuration if none was set in the DD_SERVICE environment variable or user configuration. This is a breaking change as previously a missing service would throw a configuration initialization error.
The default value will be set to the name of the executable.
Motivation
This aligns the cpp tracer behavior for an unconfigured DD_SERVICE with the expected behavior of all the tracers in our Config Consistency initiative.
Additional Notes
Also updates the parametric test so that the DD_ENV behavior works as expected.
This has been tested on Ubuntu 24.04 (run on a Windows machine in WSL), Windows 11, and macOS Monterey
Jira ticket: APMAPI-709 APMAPI-708

Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 94.66%. Comparing base (85370e7) to head (c312c99).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #158   +/-   ##
=======================================
  Coverage   94.66%   94.66%
=======================================
  Files          72       72
  Lines        3804     3806    +2
=======================================
+ Hits         3601     3603    +2
  Misses        203      203

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.


The named parameter 'display4' isn't defined.

The named parameter 'display4' isn't defined.
Try correcting the name to an existing named parameter's name, or defining a named parameter with the name 'display4'.

but it is defined, but let's check again thanks.


Unable to Access Terminal of Host

I am not able to access the shared terminal session of the host as a participant in a Live Share session. Other functionality related to the Live Share session seems to work fine. For example, I can follow him as he navigates through code and I can modify files on the host machine myself.
However, I do not have access to the host's terminal. Instead, any terminal session that is opened is connected to my computer. I can see the host opening terminals by means of the menus in the Live Share Pane on the left under "Shared Terminals", and I can see the terminals' process names' and R/W status also under the terminal selection pane in the bottom right corner of my screen, but in reality all the terminals that are started in my terminal pane are sessions to my local machine.
For reference, if I act as the host, other people can connect to my terminal sessions. I just can't access a host's shared terminals.
I only encounter this issue on VSCode Insider:
Version: 1.37.0-insider
Commit: 92da68a71cfb60bd3b9b0d7fbfb2a7e1fff9dbaf
VSCode Release: Version 1.36.1 (1.36.1) works as expected.
Product and Version [VS/VSCode]: VSCode
OS Version [macOS/Windows]: 10.14.6
Live Share Extension Version: 1.0.614
Target Platform or Language [e.g. Node.js]: Not applicable to a specific language; the issue is related to my connectivity/access to the host's terminal session.
Steps to Reproduce / Scenario:

Host creates a live share session.
I join host's live share session by clicking on the link.
I see terminals being manipulated (R/W access, title of terminal changing as processes running, etc).
However, the actual process that's running in the terminal session is a session on my local machine.

Screenshots
If applicable, add screenshots to help explain your problem.

This is s change in Terminals VSCode API in VSCode insiders. We have a fix in Live Share to match it, it will be available in the next release of VSCode Live Share extension.


MNT: remove Python2 only code

These special methods were for Cython to support a version of the buffer protocol that was superceeded by PEP 3118 in Python 2.6 and removed from CPython in 3.0.
In Cython 3.1 will be remove support for these methods and fail at build time.
closes #1915
xref https://github.com/cython/cython/pull/5869/f

Thanks!

well, that was fast.

Perfect timing, since I meant to make 25.1.2 for #1913 yesterday, but forgot. Should propagate over the next hour or two. sdist is up.


Fix issue with space offsets in TJs

We were having issues in multiple documents with spaces in a table-like text block that used TJs when selecting text.
master:

this branch:

because of the math involved in calculating the offsets in spaced text (TJ), you can't really separate out that logic into two separate operations.
Reference equation from the spec is on page 252.
I wasn't sure if just adding the pdf to the test_manifest was enough, so let me know if you need more than that.

#5813 is also (partially) touching this code, however, in a code block that you removed here. Will this PR also fix the issue mentioned there?

It really great that you've included a reduced test-case!
However the PDF file is unfortunately slightly malformed, since Adobe Reader won't render anything and PDF.js complains about it as well.
Since I know from first hand experiences that it's sometimes difficult to create working test-cases, I took the liberty of providing a cleaned-up version of the PDF file: https://www.dropbox.com/s/efo05mrfo1fa2k4/pr6019.pdf?dl=0. (If you use this file instead, please don't forget to update the md5 entry in the manifest.)

@timvandermeij in regards to #5813, it doesn't completely fix his issue, but they do work in concert when you just take the changes from within buildTextGeometry.
@Snuffleupagus what did you use to make your pdf? I only have a grasp of the obj streams well enough to screw with them.

/botio-linux preview

/botio test

The test results seem both good and (perhaps) less good. In e.g. taro-text there are improvements in the horizontal text, but the vertical text (on pages 2 and 4) seem to regress a bit.

In the vertical, if I add the offset instead of subtract it, it looks fine. But that doesn't seem to match up with the spec. I'll keep digging.

Desarrolladores y líderes de Mozilla, que son travestis culo!
Alguien debe colgar ustedes para arriba en sus propias bolas y dejar que su perro muerda su caricatura de una polla!
Posteriormente deben ponerlo tiempo que sea necesario por la garganta hasta que traga a sí mismos en el suicidio!
Ustedes Mozilla está ... Estúpido de mierda coños!
Developers and leaders of Mozilla, which are shemales ass!

They should then put it long as needed by the throat until he swallows themselves in suicide!
You Mozilla is...

I don't understand the vmetric property on the glyph, which in about every case in the taro-text document seems to be glyph.width * -1. I'm wondering if that could be part of it. I just need some more context around it. It could be as easy and flipping the offset if vmetric exists.

Let's get this PR rolling again. @brendandahl Do you have any idea on how the vmetric property works as asked above?

Vmetrics come from DW2  array in the font dictionary.   There's alot more info in <IP_ADDRESS> Glyph Metrics in CIDFonts, but the number you're seeing is negative is because in the PDF coordinate system the origin starts at the bottom left, so a negative moves up.

Oh, it's actually possible that some of the movement, in the vertical text, seen in the earlier testing of this patch exposed an issue which has since been fixed by PR #6391.
/botio test

/botio-linux preview

Let me know if you're ready for me to squash this. Or if there are any additional comments.

@kalley In the generated preview above and with the tracemonkey demo paper, text selection on the first paragrapher (and others) is larger than before and seems buggy. Is it normal ?

@SamyCookie nope, that's not normal. I may need to go back to the drawing board a little after #6391. I think originally I had completely removed any offset logic from that if block, but when I rebased, I thought that needed to be there. I'll dig in tomorrow.

Looks like what @SamyCookie found is fixed now, and my initial visual test of the taro-text looks correct as well.

Strangely, changing the - to a + here: https://github.com/mozilla/pdf.js/pull/6019/files#diff-0b94c2e77a5259f7a728122fdbf9f46aR1045 fixes the issues with issue6387.pdf, but breaks page 2 and 4 of taro-text. I'll keep digging around, but if someone has any insight, that would be awesome.

The broken PDF was fixed by #6588. Thanks for looking into the issue.


cantools don't work in python3

Hello, i wrote a python-programm which can read and save CAN-data on a raspberry pi 3B+. When I start it in the terminal of the raspberry in python, it works. But when i start it in python3, it don't work.
ERROR:
File "program.py", line11, in
import cantools
ModuleNotFoundError: No module named 'cantools'

Looks like you havn't installed cantools. I've not used Raspberry PI myself, but I think you can install it with pip, or possibly pip3?

thanks for your fast advice. I found my mistake.
I just installed cantools for python --> pip install cantools
now i installed it for python3 --> pip3 install python


Allow more closures

This allows passing closures that are not unwind-safe.
For example, closures that capture mutable references are now allowed.

@g2p, thanks a lot for this work, it really helped me understand what was at stake with this unwind-safety thing!
I directly cherry-picked or implemented the ideas from this PR in master, so I'm closing it.

Thank you!


Refactor for inference

I needed to be able to obtain the pipeline to deploy it on an inference endpoint, so I did a little refactor of the whole file.

LGTM! thanks 🤗


Install Fails on Raspberry Pi 3B+ python 3.7.3 with arch. armv7l

Expected behaviour
pip3 install opencv-python

Actual behaviour
I have tried this on Raspberry Pi B3+ with python 3.7.3 with NOOB OS (Buster version).
It shows the following issue.
Looking in indexes: https://pypi.org/simple, https://www.piwheels.org/simple
Collecting opencv-python
  Could not find a version that satisfies the requirement opencv-python (from versions:  )
No matching distribution found for opencv-python

I have also tried to build lib for this buster version
It still generates an error and refuses to build.
...
...
[ 51%] Built target opencv_reg
[ 52%] Built target opencv_xphoto
make: *** [Makefile:163: all] Error 2

Steps to reproduce

Raspberry Pi 3B+ 1GB Ram
operating system: NOOB - Raspbian (Buster version)
architecture: armv7l
opencv-python : 4.1.1

As the README states, this repository does not provide Raspberry Pi wheels. PiWheels has an issue about this: https://github.com/piwheels/packages/issues/28


when bare no need to check  PAS ?

hi  ,sir :
in the tran function ,  when bare ,  jump to step 8  ,but in step 8 ,no code to check PAS;

thanks!

in the tran function , when bare , jump to step 8 ,but in step 8 ,no code to check PAS;

The physical address that is the result of an address translation is provided to the IO bridge and further checking of validity of that PA is done by downstream components such as the PMA and PMP checkers.

Hi,Sir:
i mean this parameter .    the final PA  no need to  limit by  this  parameter when bare ?
thanks!

i mean this parameter . the final PA no need to limit by this parameter when bare ?

This parameter determines what the IOMMU itself can address. It does not affect the final PA (even when IOMMU is not in Bare mode).

ok  ,understand , thank !


Task/make action response obsolete

I am personally not totally opposed to this, BUT it was always meant to be a level of separation just like the ActionRequest is. Granted I see way less reason for the response to be that, especially the way it exists here, but I am sure this will be in question.

Yes i know. I also thought a bit about this before i wanted to experiment with this.
The way i see it is that the current ActionResponse is since flow 7 broken, as it allows to "replace" the http reponse. This behaviour is in many cases currently undefined and behaves unexpectedly: https://github.com/neos/flow-development-collection/issues/2492
But even  before Flow 7 and prs 7, the ActionResponse was at least partially inconsistent and the abstraction broken.
The response had these properties:

content StreamInterface
redirectUri UriInterface
statusCode int
contentType string
cookies Cookie[]
headers array<string, array>

the first 5 are a well fit abstraction, but the headers are an escape hatch to the lower level with possibly undeclared behaviour:
What if i actually set cookies AND a Set-Cookie header? Will getCookie understand this? What if i set a custom Location header AND redirect uri, what will win and what will getHeader return? And most importantly contentType vs Content-Type.
After reading the code, i can say that the "headers" functionality is just an array carried around with no validation or transformation. So that will cause conflicts one would ran into with duplicated headers set on the final result.
Additionally the mutability of the ActionResponse is completely unpredictable to work with. We might offer this as a legacy behaviour in the action controller, but we should prevent leaking this mutable action response anywhere far outside.
The ViewInterface must support the usecase to render a psr message (see fusion view) and it doesnt really make sense to transform a lower level abstraction to a higher one as this might not always even be possible and features might not be supported.
in our case transforming the ResponseInterface to an actual ActionResponse is actually possible (without using the httpRequest hack) as the action response allows the lower level headers feature already so that could be a way https://github.com/neos/flow-development-collection/pull/3287
but im clearly in favour of working with the pretty immutable ResponseInterface directly.
For the ActionRequest it seems to be a different case, as we need the additional controller information and subrequest details.

For the ActionRequest it seems to be a different case, as we need the additional controller information and subrequest details.

I did actually think about replacing it with \Psr\Http\Message\ServerRequestInterface::withAttribute at some point, there is still some stuff to be considered, especially nesting behavior for subrequests (that I think we need for some functionality) but in general we could store our special stuff in custom attributes.

@bwaidelich
mentioned once:

I remember that this kind of logic holes were the reason why I was in favor of a response abstraction that is not so closely related to the HTTP response.

but im not sure that we can ever found a well fit response abstraction and then we will always still have the problem that a view might return a psr response which is too low level for us to handle, if were not that low level ourselves.

Ha it seem this ActionResponse.setHeader is not that ooold. It was introduce with Flow 7, and previously one would use a SetHeader component:
https://github.com/neos/flow-development-collection/pull/2219
So it seems the abstraction of the response was intact before psr 7.
Now we just need to find out what to do :D
Either remove httpResponse and headers from the ActionResponse or remove the whole ActionResponse :D


Fix #666: Updated Footer

Description
I have updated the footer and changed the colour of social media icons. please refer my previous pr #710. @huamanraj @anuragverma108
Fixes:  #666

Type of change

[X ] Bug fix (non-breaking change which fixes an issue)

Checklist:

[X ] I have made this from my own
[X ] My code follows the style guidelines of this project
[X ] I have performed a self-review of my own code
[X ] I have commented my code, particularly in hard-to-understand areas
[ X] My changes generate no new warnings

ATTACH SCREEN-SHOTS / DEPLOYMENT LINK
Before:

After:

Description
I have updated the footer and changed the colour of social media icons. please refer my previous pr #710. @huamanraj @anuragverma108
Fixes:  #666

Type of change

[X ] Bug fix (non-breaking change which fixes an issue)

Checklist:

[X ] I have made this from my own
[X ] My code follows the style guidelines of this project
[X ] I have performed a self-review of my own code
[X ] I have commented my code, particularly in hard-to-understand areas
[ X] My changes generate no new warnings

ATTACH SCREEN-SHOTS / DEPLOYMENT LINK
Before:

After:

there are some conflicts!

@huamanraj resolved conflicts.

Great contribution to GSSOC'24! 🎉