How to generate time_matrix in Time Windows Constraints

I have different delivery time windows, for exp:
Scheduled delivery start date | Scheduled delivery end date
8/13/2019 18:00 | 8/13/2019 22:00
8/13/2019 8:00 | 8/13/2019 14:00
8/13/2019 8:00 | 8/13/2019 14:00
For above example what should be time_matrix array.
I have already check or-tool example about time window, but I am not able to understand, How to generate time_matrix. what and how we generate time_matrix values.
data['time_matrix'] = [
[0, 6, 9, 8, 7, 3, 6, 2, 3, 2, 6, 6, 4, 4, 5, 9, 7],
[6, 0, 8, 3, 2, 6, 8, 4, 8, 8, 13, 7, 5, 8, 12, 10, 14],
[9, 8, 0, 11, 10, 6, 3, 9, 5, 8, 4, 15, 14, 13, 9, 18, 9],
[8, 3, 11, 0, 1, 7, 10, 6, 10, 10, 14, 6, 7, 9, 14, 6, 16],
[7, 2, 10, 1, 0, 6, 9, 4, 8, 9, 13, 4, 6, 8, 12, 8, 14],
[3, 6, 6, 7, 6, 0, 2, 3, 2, 2, 7, 9, 7, 7, 6, 12, 8],
[6, 8, 3, 10, 9, 2, 0, 6, 2, 5, 4, 12, 10, 10, 6, 15, 5],
[2, 4, 9, 6, 4, 3, 6, 0, 4, 4, 8, 5, 4, 3, 7, 8, 10],
[3, 8, 5, 10, 8, 2, 2, 4, 0, 3, 4, 9, 8, 7, 3, 13, 6],
[2, 8, 8, 10, 9, 2, 5, 4, 3, 0, 4, 6, 5, 4, 3, 9, 5],
[6, 13, 4, 14, 13, 7, 4, 8, 4, 4, 0, 10, 9, 8, 4, 13, 4],
[6, 7, 15, 6, 4, 9, 12, 5, 9, 6, 10, 0, 1, 3, 7, 3, 10],
[4, 5, 14, 7, 6, 7, 10, 4, 8, 5, 9, 1, 0, 2, 6, 4, 8],
[4, 8, 13, 9, 8, 7, 10, 3, 7, 4, 8, 3, 2, 0, 4, 5, 6],
[5, 12, 9, 14, 12, 6, 6, 7, 3, 3, 4, 7, 6, 4, 0, 9, 2],
[9, 10, 18, 6, 8, 12, 15, 8, 13, 9, 13, 3, 4, 5, 9, 0, 9],
[7, 14, 9, 16, 14, 8, 5, 10, 6, 5, 4, 10, 8, 6, 2, 9, 0],
]
data['time_windows'] = [
(0, 5),  # depot
(7, 12),  # 1
(10, 15),  # 2
(16, 18),  # 3
(10, 13),  # 4
(0, 5),  # 5
(5, 10),  # 6
(0, 4),  # 7
(5, 10),  # 8
(0, 3),  # 9
(10, 16),  # 10
(10, 15),  # 11
(0, 5),  # 12
(5, 10),  # 13
(7, 8),  # 14
(10, 15),  # 15
(11, 15),  # 16
]

there are 24 * 60 minutes in a day. Count from midnight, and round time to
the minute ?
Laurent Perron | Operations Research |<EMAIL_ADDRESS>| (33) 1 42 68 53
00
Le sam. 31 août 2019 à 13:01, shimyonscrumbees<EMAIL_ADDRESS>a
écrit :

I have different delivery time windows, for exp:
Scheduled delivery start date | Scheduled delivery end date
8/13/2019 18:00 | 8/13/2019 22:00
8/13/2019 8:00 | 8/13/2019 14:00
8/13/2019 8:00 | 8/13/2019 14:00
For above example what should be time_matrix array.
I have already check or-tool example about time window, but I am not able
to understand, How to generate time_matrix. what and how we generate
time_matrix values.
data['time_matrix'] = [
[0, 6, 9, 8, 7, 3, 6, 2, 3, 2, 6, 6, 4, 4, 5, 9, 7],
[6, 0, 8, 3, 2, 6, 8, 4, 8, 8, 13, 7, 5, 8, 12, 10, 14],
[9, 8, 0, 11, 10, 6, 3, 9, 5, 8, 4, 15, 14, 13, 9, 18, 9],
[8, 3, 11, 0, 1, 7, 10, 6, 10, 10, 14, 6, 7, 9, 14, 6, 16],
[7, 2, 10, 1, 0, 6, 9, 4, 8, 9, 13, 4, 6, 8, 12, 8, 14],
[3, 6, 6, 7, 6, 0, 2, 3, 2, 2, 7, 9, 7, 7, 6, 12, 8],
[6, 8, 3, 10, 9, 2, 0, 6, 2, 5, 4, 12, 10, 10, 6, 15, 5],
[2, 4, 9, 6, 4, 3, 6, 0, 4, 4, 8, 5, 4, 3, 7, 8, 10],
[3, 8, 5, 10, 8, 2, 2, 4, 0, 3, 4, 9, 8, 7, 3, 13, 6],
[2, 8, 8, 10, 9, 2, 5, 4, 3, 0, 4, 6, 5, 4, 3, 9, 5],
[6, 13, 4, 14, 13, 7, 4, 8, 4, 4, 0, 10, 9, 8, 4, 13, 4],
[6, 7, 15, 6, 4, 9, 12, 5, 9, 6, 10, 0, 1, 3, 7, 3, 10],
[4, 5, 14, 7, 6, 7, 10, 4, 8, 5, 9, 1, 0, 2, 6, 4, 8],
[4, 8, 13, 9, 8, 7, 10, 3, 7, 4, 8, 3, 2, 0, 4, 5, 6],
[5, 12, 9, 14, 12, 6, 6, 7, 3, 3, 4, 7, 6, 4, 0, 9, 2],
[9, 10, 18, 6, 8, 12, 15, 8, 13, 9, 13, 3, 4, 5, 9, 0, 9],
[7, 14, 9, 16, 14, 8, 5, 10, 6, 5, 4, 10, 8, 6, 2, 9, 0],
]
data['time_windows'] = [
(0, 5), # depot
(7, 12), # 1
(10, 15), # 2
(16, 18), # 3
(10, 13), # 4
(0, 5), # 5
(5, 10), # 6
(0, 4), # 7
(5, 10), # 8
(0, 3), # 9
(10, 16), # 10
(10, 15), # 11
(0, 5), # 12
(5, 10), # 13
(7, 8), # 14
(10, 15), # 15
(11, 15), # 16
]
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/google/or-tools/issues/1535?email_source=notifications&email_token=ACUPL3PUH4LAWFWCBOPFTCDQHJFPFA5CNFSM4ISTLI22YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4HISTJOA,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ACUPL3LQFCA6SHYFFZEZM73QHJFPFANCNFSM4ISTLI2Q
.


Error constructing PN532: Message transmission failed

I am using PN532 NFC with imp005.
local spi = hardware.spi0;
local ncs = hardware.pinD;
local rstpd_l = hardware.pinQ;
local irq = hardware.pinN;
spi.configure(USE_CS_L, 15000);
function constructorCallback(error) {
server.log("Custructor");
if(error != null) {
server.log("Error constructing PN532: " + error);
return;
}
// It's now safe to use the PN532
}
reader <- PN532(spi, ncs, rstpd_l, irq, constructorCallback);

See comments here: https://github.com/electricimp/PN532MifareClassic/issues/2
Please look at the notes on using SPI with imp005 here: https://developer.electricimp.com/hardware/imp/imp005_hardware_guide
You likely need to (a) reduce the SPI clock rate, and (b) add an R-C filter to the MOSI pin.


Throw exception if field is null

1. Description
Hi,
Given the following snippet:
var foo = new Foo
{
    Bar = null
};

var rule = "Bar > \"2024-07-11\"";

try
{
    var lst = new List<Foo> { foo };
    var isMatched = lst.AsQueryable().Where(rule).Any();
}
catch (Exception exception)
{
    throw;
}

public class Foo
{
    public DateTime? Bar { get; set; }
}

What I would like to happen:
Since the field Bar is null, when trying to compare the values it would throw an exception.
What's actually happening:
No exception is thrown, and isMatched = false.
I understand that this is default C# behaviour regarding null comparison.
However, for my use-case, it would be useful to force the comparison to throw an exception, letting me know that the Bar value is null without having to check for it beforehand.
Is there anyway to force the exception throw?
Thanks!

Right after posting, I had the idea of trying var rule = "Bar.Value > \"2024-07-10\"";, which does what I need it to.
Closing this issue.


chore: Update dependencies license file name

Description
Modified the file name from License-dependencies.md to dependencies-license.md and updated the guide to reflect these changes.
Related Issue (Optional)

N/A

Changes

Renamed License-dependencies.md to dependencies-license.md.
Updated the guide documentation to match the new file name.

Screenshots (Optional)
N/A
Additional Comments (Optional)
N/A

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.


Bearer link target only have one target - AppURL.

Description
As i'm using Gitea Actions with act runner i have a problem that the Bearer redirect points to an "invalid" host from the perspective of the runner.
Gitea is running in a Kubernetes cluster and is a accessible via Ingress over gitea.example.com.
Ingress (gitea.example.com) -> Service (gitea-http:3000) -> Pod (gitea)
The parameters (GITHUB_SERVER_URL=http://gitea-http.gitea.svc:3000) for the runner will point directly to the service, which is perfectly fine.
BUT: If the runner wants to push the Docker image to the gitea repository, gitea answers the request with an 401 Unauthorized and the www-authenticate header.
curl -v -X POST http://gitea-http.gitea.svc:3000/v2/project-y/ms-go/blobs/uploads/
...
< HTTP/1.1 401 Unauthorized
< Www-Authenticate: Bearer realm="http://git.example.local/v2/token",service="container_registry",scope="*"

This is because the setting.AppURL is used instead of resolve the host dynamically.
ctx.Resp.Header().Add("WWW-Authenticate", `Bearer realm="`+setting.AppURL+`v2/token",service="container_registry",scope="*"`)

But the runner isn't able to resolve git.example.local.
My suggestion is
routers/api/packages/container/container.go:120
// using x-forwarded headers
realmUrl, err := url.Parse(fmt.Sprintf("%v://%v/", ctx.Req.Header.Get("X-Forwarded-Proto"), ctx.Req.Header.Get("X-Forwarded-Host")))
if err != nil {
	// using host header
	realmUrl, err = url.Parse(fmt.Sprintf("%v://%v/", "http", ctx.Req.Host))
}
if err != nil {
	// fallback
	realmUrl, err = url.Parse(setting.AppURL)
}

ctx.Resp.Header().Add("WWW-Authenticate", `Bearer realm="`+realmUrl.String()+`v2/token",service="container_registry",scope="*"`)

The effect would be
curl -v -X POST http://gitea-http.gitea.svc:3000/v2/project-y/ms-go/blobs/uploads/
...
< HTTP/1.1 401 Unauthorized
< Www-Authenticate: Bearer realm="http://gitea-http.gitea.svc:3000/v2/token",service="container_registry",scope="*"

Gitea Version
1.20.3
Can you reproduce the bug on the Gitea demo site?
No
Log Gist
No response
Screenshots
No response
Git Version
No response
Operating System
No response
How are you running Gitea?
I'm running Gitea in a Kubernetes cluster configured with Helm Chart (https://dl.gitea.io/charts).
I'm also using actions with act_runner.
Database
PostgreSQL

#26872

But the runner isn't able to resolve git.example.local (or .com?)

I think this is the real problem.  Why gitea.example.com can't be used? It should be used everywhere.
And I have read your PR, besides some nits, url.Parse(fmt.Sprintf("%v://%v/", "http", ctx.Req.Host)) is not right, because Gitea itself can serve HTTPS directly.

Thank you @wxiaoguang for your feedback. You're right, now i will also check if there is a TLS connection.

I do no think guessing the absolute URL is a good solution for everyone. For example, if people use Gitea (HTTP) behinds nginx (HTTPS) but there is no "X-Forwared" headers, it will still be wrong.
The first question is:  why gitea.example.com can't be used? It should be used everywhere.

You should set https://gitea.example.com as your root_url

Ok, thank you.


CrudAuth Filter not Working Properly

I have my users joined to my organization entity but it's not being fetched/joined when I want to use the filter in crudAuth decorators .
 @OneToMany(() => User, (user) => user.organization)
  users?: User[];

import { Body, Controller, HttpStatus, Patch, Res, UseInterceptors } from "@nestjs/common";
import { OrganizationService } from "./organization.service";
import { CreateOrganizationDto } from "./dto/create-organization.dto";
import { UpdateOrganizationDto } from "./dto/update-organization.dto";
import { Crud, CrudAuth, CrudRequest, CrudRequestInterceptor, ParsedRequest } from "@dataui/crud";
import { ApiSecurity, ApiBearerAuth, ApiParam, ApiTags } from "@nestjs/swagger";
import { Organization } from "./entities/organization.entity";
import { FastifyReply } from "fastify";
import { MergeJsonb } from "src/interceptors/mergeJsonb.interceptor";

@ApiSecurity("x-organization-id")
@ApiBearerAuth()
@ApiTags("Organization")
@Crud({
  model: {
    type: Organization,
  },
  routes: {
    only: ["getOneBase", "getManyBase", "updateOneBase"],
    updateOneBase: {
      decorators: [ApiParam({ name: "id", type: String, description: "The ID of the organization to update" })],
      returnShallow: true,
    },
  },
  query: {
    alwaysPaginate: true,
    join: {
      entitlement: {
        eager: true,
        allow: ["id", "name"],
      },
      user: {
        eager: true,
        alias: "user",
        allow: ["id"],
        required: true,
      },
    },
  },
  dto: {
    create: CreateOrganizationDto,
    update: UpdateOrganizationDto,
  },
  params: {
    id: {
      field: "id",
      type: "string",
      primary: true,
    },
  },
})
@CrudAuth({
  property: "user",
  filter: (user) => {
    return { '"user"."id"': user.sub };
  },
  persist: (user) => ({ organization: { id: user.organizationId } }),
})
@Controller("organization")
export class OrganizationController {
  constructor(public service: OrganizationService) {}

  @UseInterceptors(CrudRequestInterceptor, MergeJsonb(Organization, ["onboarding"]))
  @ApiParam({ name: "id", type: String, description: "The ID of the organization to update" })
  @Patch(":id/onboarding")
  async updateCurrentUser(@ParsedRequest() req: CrudRequest, @Body() dto: UpdateOrganizationDto, @Res() res: FastifyReply) {
    const updatedUser = await this.service.updateOne(req, dto);
    res.code(HttpStatus.OK).send({ data: updatedUser });
  }
}

Query Generated and error
query failed: SELECT "Organization"."id" AS "Organization_id", "Organization"."created_at" AS "Organization_created_at", "Organization"."updated_at" AS "Organization_updated_at", "Organization"."deleted_at" AS "Organization_deleted_at", "Organization"."version" AS "Organization_version", "Organization"."created_by" AS "Organization_created_by", "Organization"."updated_by" AS "Organization_updated_by", "Organization"."name" AS "Organization_name", "Organization"."website" AS "Organization_website", "Organization"."address" AS "Organization_address", "Organization"."city" AS "Organization_city", "Organization"."state" AS "Organization_state", "Organization"."zip_code" AS "Organization_zip_code", "Organization"."country" AS "Organization_country", "Organization"."phone" AS "Organization_phone", "Organization"."type" AS "Organization_type", "Organization"."onboarding" AS "Organization_onboarding", "Organization"."owner_id" AS "Organization_owner_id" FROM "organization" "Organization" WHERE ( ("user"."id" = $1 AND "Organization"."id" = $2) ) AND ( "Organization"."deleted_at" IS NULL ) -- PARAMETERS: ["01J3XZT65BB24BY854ZGFWZS0G","01J3XZT52M46QHH39VPEMG0MRH"]
error: error: missing FROM-clause entry for table "user"
[Nest] 19491  - 08/16/2024, 1:58:46 AM   ERROR [ExceptionsHandler] missing FROM-clause entry for table "user"
QueryFailedError: missing FROM-clause entry for table "user"
    at PostgresQueryRunner.query (/home/abdussamad/Advatyzly/Advatyzly-Backend/node_modules/typeorm/driver/src/driver/postgres/PostgresQueryRunner.ts:331:19)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at SelectQueryBuilder.loadRawResults (/home/abdussamad/Advatyzly/Advatyzly-Backend/node_modules/typeorm/query-builder/src/query-builder/SelectQueryBuilder.ts:3805:25)
    at SelectQueryBuilder.executeEntitiesAndRawResults (/home/abdussamad/Advatyzly/Advatyzly-Backend/node_modules/typeorm/query-builder/src/query-builder/SelectQueryBuilder.ts:3551:26)
    at SelectQueryBuilder.getRawAndEntities (/home/abdussamad/Advatyzly/Advatyzly-Backend/node_modules/typeorm/query-builder/src/query-builder/SelectQueryBuilder.ts:1670:29)
    at SelectQueryBuilder.getOne (/home/abdussamad/Advatyzly/Advatyzly-Backend/node_modules/typeorm/query-builder/src/query-builder/SelectQueryBuilder.ts:1697:25)
    at OrganizationService.getOneOrFail (/home/abdussamad/Advatyzly/Advatyzly-Backend/node_modules/@dataui/crud-typeorm/src/typeorm-crud.service.ts:446:9)
    at OrganizationService.updateOne (/home/abdussamad/Advatyzly/Advatyzly-Backend/node_modules/@dataui/crud-typeorm/src/typeorm-crud.service.ts:187:19)

Please any Ideas @zaro  ?

could you provide some repo that will reproduce your problem


Managed Identity Support

[Enter feedback here]
Is there a sample / Support for Using Content Moderator client with managed Identities ?

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 54699297-e828-23c5-77ff-267f5d9c2593
Version Independent ID: f591d910-92fe-4099-0ec4-7e17800a68b7
Content: Quickstart: Use the Content Moderator client library - Azure Cognitive Services
Content Source: articles/cognitive-services/Content-Moderator/client-libraries.md
Service: cognitive-services
Sub-service: content-moderator
GitHub Login: @PatrickFarley
Microsoft Alias: pafarley

Thanks for the feedback! We are currently investigating and will update you shortly.

@PatrickFarley Hello Patrick, I just went through all the samples but I have no finding about managed identities, do you have any insight here? Thank you!
https://github.com/Azure-Samples/cognitive-services-dotnet-sdk-samples/tree/master/ContentModerator

@YutongTie-MSFT I believe this is what they are looking for https://docs.microsoft.com/en-us/azure/cognitive-services/content-moderator/encrypt-data-at-rest
#please-close


Add dropConsole option for JavaScriptOptimizerPlugin for using in Terser

🚀 Feature request
Command (mark with an x)

[ ] new
[x] build
[ ] serve
[ ] test
[ ] e2e
[ ] generate
[ ] add
[ ] update
[ ] lint
[ ] extract-i18n
[ ] run
[ ] config
[ ] help
[ ] version
[ ] doc

Description
Need to remove all console calls in production to minimize the bundle size, Terser plugin can do that, but we need to pass the option there.
Describe the solution you'd like
In https://github.com/angular/angular-cli/blob/master/packages/angular_devkit/build_angular/src/webpack/plugins/javascript-optimizer-worker.ts
optimizeWithTerser(
...
  const result = await minify(
    { [name]: code },
    {
      compress: {
        passes: advanced ? 2 : 1,
        pure_getters: advanced,
        drop_console: options.dropConsole // pass the option here
      },

Describe alternatives you've considered
It would be great if all plugins options would be configurable outside.
Before angular 12 it was possible to do that using custom webpack configs:
config.optimization.minimizer
	.filter(({constructor: {name}}) => name === 'TerserPlugin')
	.forEach((terserPlugin: any) => {
		terserPlugin.options.terserOptions.compress.drop_console = true;
	});

Hi all,
could you explain in more detail how you solved of removing all console calls for production?


Watch mode always runs all exclusive tests

Fixes #635.

One minor nit on the docs.
Otherwise LGTM

Updated.


Declaring a top-level payable constant results in CompileInferenceError

Environment
Latest release, v18.1.1
Scenario
When a payable constant is defined outside of a contract, the compiler throws a CompileInferenceError. No error is thrown in the same scenario but without payable.
To test put the following in sample.sol:
pragma solidity 0.8.24;
address payable constant SWAPROUTER_ADDRESS = payable(0xE592427A0AEce92De3Edee1F18E0157C05861564);

Then try to compile:
import { compileSol} from 'solc-typed-ast';
const result = compileSol('./sample.sol', 'auto');

Expected behavior
Successful compilation.
Current behavior
CompileInferenceError: Failed parsing imports at ./sample.sol:65:1 - Expected " ", "/*", "//", "[", "\t", "\x0B", "\x0C", "constant", " ", "", [ , , , - , , ,　], or [\n,\r,,] but "p" found.
    at findAllFiles (/node_modules/solc-typed-ast/src/compile/inference/imports.ts:171:23)
    at compileSol (/node_modules/solc-typed-ast/src/compile/utils.ts:317:27)

Hey @blitz-1306, pinging you because you've helped us before. Any chance you could take a look at this issue? Huge thanks in advance 🙏🏻

@gas1cent Hello there and thanks for the input. I will look into it and provide feedback on this week. If there would be a fix, it would likely arrive on next week.

Okay, this is clearly a bug related ty file-level definitons parser, that we use to preprocess imports. I will look into a possible solution. Stay tuned.

See #256 with the bugfix. I believe we should be able to deliver it soon enough.

@gas1cent Release v18.1.2 is out. Feel free to test. Thank you.


Quotes in datatype names or fields don't get escaped

If you have a type like
data Should = Should | Shouldn't

The tag for the latter will look like tag: 'Shouldn't' - need to escape single quotes

also should do something about type names themselves that have quotations in them, or if you try to make flowtypes for a type operator, hm...


Not finding MqttUserProperty set at Subscription time

I'm setting a MqttUserProperty at Subscription time but I can't get it anywhere else.
Here's my code
MqttClientSubscribeOptions options = new MqttClientSubscribeOptions
{
    TopicFilters = new List<MqttTopicFilter> { new MqttTopicFilter() { Topic = topic, QualityOfServiceLevel = (MQTTnet.Protocol.MqttQualityOfServiceLevel)Enum.ToObject(typeof(MQTTnet.Protocol.MqttQualityOfServiceLevel), qos) } },
    UserProperties = new List<MqttUserProperty> { new MqttUserProperty("gxrocedure", $"{{\"gxrocedure\":\"{gxproc}\"}}") }
};

MqttClientSubscribeResult result = mqtt.m_mqttClient.SubscribeAsync(options).GetAwaiter().GetResult();

When I disconnect and connect again using the previous session, I can't find that property (gxprocedure).
I'm not sure if it's a bug or I'm not using it right.
Which project is your question related to?

Client

I quickly checked the spec but I did not find anything which indicates that the user properties should be stored anywhere. They are just custom parameters which can be read by the server to perform some custom tasks (like MQTTnet.Server does with custom Python scripts and interception).

Oh ok, I thought they could be used as metadata for every subscriber.
Thanks for your prompt response.


Fixing preFooter bug when showShare is true

There were a few changes in the preFooter.js file made by the linter.


[nginx] Annotation ingress.kubernetes.io/ssl-redirect cannot be set independently for multiple ingress with same host

We have multiple Ingress definitions for the same host, where some paths need to be secured with HTTPS while some need to be available via HTTP for legacy clients.
We tried setting the annotation ingress.kubernetes.io/ssl-redirect to "false" for the HTTP paths, and setting to "true" for the HTTPS paths.
This does not work. The SSL redirect is still active for the HTTP paths.
A different value for ssl-redirect only works if the Ingresses have separate hosts.
The cause is clear when we look at the generated nginx.conf: The routes are located below the same server, which listen to both HTTP and HTTPS. SSL redirect is switched on or off for the complete server, not for individual routes.
Setting ssl-redirect to false for all Ingresses does not work for us, as then the HTTPS paths are available via HTTP too.
Example:
# HTTPS routes
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: https-ingress
  annotations:
    ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - example.com
    secretName: tls-secret
  rules:
  - host: example.com
    http:
      paths:
      - path: /secured
        backend:
          serviceName: my-service
          servicePort: 8080

---

# HTTP routes
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: http-ingress
  annotations:
    ingress.kubernetes.io/ssl-redirect: "false"
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /unsecured
        backend:
          serviceName: my-service
          servicePort: 8080

The relevant parts from the generated nginx.conf:
server {
  server_name example.com;
  listen 80;
  listen [::]:80;

  listen 442 ssl http2;
  listen [::]:442  ssl http2;

  ...
  # enforce ssl on server side
  if ($pass_access_scheme = http) {
    return 301 https://$best_http_host$request_uri;
  }

I am also having the same problem and it happens with kube-lego which creates Ingress for /.well-known/acme-challenge for the same host. The ssl redirect causes respond with a 301 redirect to https protocol which doesn’t work if the certificate in question doesn’t validate.

@henning77 please update to gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.11

I'm still running into this issue with the 0.9.0-beta.11.

nginx-ingress-controller:0.9.0-beta.13 fixed this issue for me. beta.12 did not work.


[e2e]: go workflow_dispatch main workflow_inputs-noldflags slsa3

Repo: https://github.com/slsa-framework/example-package/tree/main
Run: https://github.com/slsa-framework/example-package/actions/runs/3653859505
Workflow file: https://github.com/slsa-framework/example-package/tree/main/.github/workflows/e2e.go.workflow_dispatch.main.workflow_inputs-noldflags.slsa3.yml
Workflow runs: https://github.com/slsa-framework/example-package/actions/workflows/e2e.go.workflow_dispatch.main.workflow_inputs-noldflags.slsa3.yml
Trigger: workflow_dispatch
Branch: main
Date: Fri Dec  9 02:25:14 UTC 2022

Repo: https://github.com/slsa-framework/example-package/tree/main
Run: https://github.com/slsa-framework/example-package/actions/runs/3662189463
Workflow file: https://github.com/slsa-framework/example-package/tree/main/.github/workflows/e2e.go.workflow_dispatch.main.workflow_inputs-noldflags.slsa3.yml
Workflow runs: https://github.com/slsa-framework/example-package/actions/workflows/e2e.go.workflow_dispatch.main.workflow_inputs-noldflags.slsa3.yml
Trigger: workflow_dispatch
Branch: main
Date: Sat Dec 10 02:19:51 UTC 2022
Tests are passing now. Closing this issue.


Install failure within locally built metaproject

I am trying to build a copy of a metaproject locally and install simweights within the build/lib of the same metaproject
this is the command i used
pip install --target $I3_BUILD/lib git+https://github.com/icecube/simweights.git
and i am running into following error:
Cloning https://github.com/icecube/simweights.git to /tmp/pip-req-build-7_2ebp8p
  Running command git clone --quiet https://github.com/icecube/simweights.git /tmp/pip-req-build-7_2ebp8p
  Resolved https://github.com/icecube/simweights.git to commit bb041001bc330ec14f4e627d3ae1d8b6dbbc89dd
  Installing build dependencies ... done
  Getting requirements to build wheel ... error
  error: subprocess-exited-with-error

  × Getting requirements to build wheel did not run successfully.
  │ exit code: 1
  ╰─> [4 lines of output]
      Traceback (most recent call last):
        File "/cvmfs/icecube.opensciencegrid.org/py3-v4.2.1/RHEL_7_x86_64/lib/python3.10/site-packages/pip/_vendor/pep517/in_process/_in_process.py", line 15, in <module>
          from glob import glob
      ModuleNotFoundError: No module named 'glob'
      [end of output]

  note: This error originates from a subprocess, and is likely not a problem with pip.
error: subprocess-exited-with-error

× Getting requirements to build wheel did not run successfully.
│ exit code: 1
╰─> See above for output.

note: This error originates from a subprocess, and is likely not a problem with pip.

This is  not a problem with simweights but a problem with the way python was installed on cvmfs. As a work around you can do the following:
python -m pip install build
git clone https://github.com/icecube/simweights.git
python -m build
python -m pip install dist/simweights-0.1-py3-none-any.whl

I ended up doing something similar.. Thanks though

note that pip install --no-build-isolation git+https://github.com/icecube/simweights.git would have also worked


Dowload plugin should follow redirects

As of this writing, an HTTP GET of https://github.com/indygreg/python-build-standalone/releases/download/20220528/cpython-3.10.4+20220528-x86_64-apple-darwin-pgo-full.tar.zst returns a 302.
Setting PUP_PBS_URL to it fails, thus!

CLOSING after having merged PR #227.


dropdown_list_widget: Fix miscellaneous Keyboard UI bugs.

Link to czo conversation.
Screenshots:
Commit -- 8a3bda5

Commit -- 872ece8

(As of now, nothing really happens when the user hits the Enter key)
Fixes #18415

This is great, merged after some small tweaks to the commit message.  Thanks @aryanshridhar!


add a comment i do not understand

FYI: I tried to test this in order to verify if the check is really needed and to come up with a good explanation but it's not done yet and will be implemented with #15

Obsolete with #19


Record prefix data in front of ZIP

It would be nice for our ZipArchive to record any data seen at the front of the file to support cases like Jar2Exe which slap a executable file at the front of the file. The user could then write back the prefix data, then the archive itself.

5595347ab1f5f6ddb79dee8e9798696360bdcc6a


Make virtualenv optional?

Our use case is to have a single default production environment which is always sourced. This environment also contains the other MIP dependencies which makes it very convenient to deploy.
But if we have to source another env we loose all these binaries - how can we use the already existing env to run MIP?

I guess I can make the python env optional by the user. Then MIP would then trust that the user has solved this before starting MIP and just try to call the program in batch as is.
On 20 Oct 2015, at 08:02, Robin Andeer<EMAIL_ADDRESS>wrote:

Our use case is to have a single default production environment which is always sourced. This environment also contains the other MIP dependencies which makes it very convenient to deploy.
But if we have to source another env we loose all these binaries - how can we use the already existing env to run MIP?
—
Reply to this email directly or view it on GitHub.

Henrik Stranneheim Ph.D.
Department of Molecular Medicine and Surgery
Karolinska Institute
Science for Life Laboratory
E-mail<EMAIL_ADDRESS>Visiting address:
Science for Life Laboratory - SciLifeLab
Gamma building
Tomtebodavägen 23A
Delivery address:
Science for Life Laboratory - SciLifeLab
Gamma building
Tomtebodavägen 23B
171 65 Solna

That would suit us very well I believe :)


lodash is declared as a peer dependency

The installation documentation of e.g. the typedoc-plugin-pages package says:
npm install --save-dev @knodes/typedoc-plugin-pages<EMAIL_ADDRESS>
However this is not sufficient since lodash is declared as a peer dependency. This means that if a project does not have lodash installed, the plugin will crash.
I am also questioning the motivation behind having lodash as a peer dependency, especially for a server-side only module.
In any case, thanks for the great plugins.

Indeed. I'm working on a new iteration, during which I'll fix this. Thank you

Excellent, thanks for the quick response.


Get birds speccies

Build files structure for your React app.
Create routes and navigation in your app.
Display a list of items and filter them. The data come from the API.
Style the components to align with the design provided.
Deploy the project.
Record a video for the project.

Hi @DeliceLydia . Thanks for your review.
I gave appropriate credit to Nelson Sakwa the author of the original design, as required by the Creative Commons License and added unit tests for some components of the app.
Thank you,

Thank you @Efiamotu-1


Parallelize Decode

Use threads to parallelize decoder either at utterance (ie item in batch) and/or beam level.

Now OBE. Decodes are parallelized by one thread per utterance in a batch.


youtube-dl said a video has no subtitles, but you-get can download its subtitle

❯ proxychains -q youtube-dl --list-subs N7-XLjJ-fjM|rg subtitles
WARNING: parsing .netrc: No authenticators for youtube (None, line None)
N7-XLjJ-fjM has no subtitles

However,
proxychains -q you-get 'https://www.youtube.com/watch?v=N7-XLjJ-fjM'

will download the *.srt file.
Why this phenomenon happens?
Thanks!

 Use --write-auto-sub to get automatic caption.
I tried you-get -d and it seems to download the automatic caption (the url contains caps=asr and kind=asr).

❯ proxychains -q you-get 'https://www.youtube.com/watch?v=N7-XLjJ-fjM'
site:                YouTube
title:               Roger Federer press conference (Final) | Australian Open 2017
stream:
    - itag:          137
      container:     mp4
      quality:       1920x1080 (1080p)
      size:          102.7 MiB (107731387 bytes)
    # download-with: you-get --itag=137 [URL]

Downloading Roger Federer press conference (Final) - Australian Open 2017.mp4 ...
 100% (102.7/102.7MB) ├██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████┤[2/2]    1 MB/s
Merging video parts... Merged into Roger Federer press conference (Final) - Australian Open 2017.mp4

Saving Roger Federer press conference (Final) - Australian Open 2017.en.srt ... Done.
❯ head Roger\ Federer\ press\ conference\ \(Final\)\ -\ Australian\ Open\ 2017.en.srt
1
00:00:02,000 --> 00:00:06,000
what does it mean a lot to you to put

2
00:00:04,380 --> 00:00:09,620
some more distance between you and your

3
00:00:06,000 --> 00:00:13,580


Sanitize and/or provide useful X-Forwarded-For header

Describe the bug
X-Forwarded-For header isn't sanitized before being forwarded by ingress gateway, which means that malicious client can easily spoof its source address by sending X-Forwarded-For header with fake IP address, and while the fake IP address won't be used by ingress gateway (because of the use_remote_address: true setting), it might be accepted by workloads trusting ingress to pass client's IP using this header.
Note that the presence of spoofed X-Forwarded-For header results in either X-Envoy-Internal or X-Envoy-External-Address being forwarded to the workload.
Furthermore, even without spoofing, both X-Forwarded-For and X-Envoy-External-Address headers contain IP address of kube-proxy (e.g. <IP_ADDRESS>) and not client's IP, rendering it pretty useless.
External request:
curl -v -H"Host: httpbin.example.com" http://$INGRESS_HOST:$INGRESS_PORT/get?show_env=1

< HTTP/1.1 200 OK
< server: envoy
< date: Tue, 07 Aug 2018 00:29:34 GMT
< content-type: application/json
< access-control-allow-origin: *
< access-control-allow-credentials: true
< content-length: 534
< x-envoy-upstream-service-time: 6
<
{
  "args": {
    "show_env": "1"
  },
  "headers": {
    "Accept": "*/*",
    "Content-Length": "0",
    "Host": "httpbin.example.com",
    "User-Agent": "curl/7.60.0",
    "X-B3-Sampled": "1",
    "X-B3-Spanid": "f318863530d246b3",
    "X-B3-Traceid": "f318863530d246b3",
    "X-Envoy-Internal": "true",
    "X-Forwarded-For": "<IP_ADDRESS>",
    "X-Forwarded-Proto": "http",
    "X-Request-Id": "a53a017d-dc07-9784-a4ec-5957a1915800"
  },
  "origin": "<IP_ADDRESS>",
  "url": "http://httpbin.example.com/get?show_env=1"
}

External request with spoofed X-Forwarded-For header:
curl -v -H"Host: httpbin.example.com" -H"X-Forwarded-For: <IP_ADDRESS>" http://$INGRESS_HOST:$INGRESS_PORT/get?show_env=1

< HTTP/1.1 200 OK
< server: envoy
< date: Tue, 07 Aug 2018 00:29:50 GMT
< content-type: application/json
< access-control-allow-origin: *
< access-control-allow-credentials: true
< content-length: 566
< x-envoy-upstream-service-time: 13
<
{
  "args": {
    "show_env": "1"
  },
  "headers": {
    "Accept": "*/*",
    "Content-Length": "0",
    "Host": "httpbin.example.com",
    "User-Agent": "curl/7.60.0",
    "X-B3-Sampled": "1",
    "X-B3-Spanid": "384e7075880e36c8",
    "X-B3-Traceid": "384e7075880e36c8",
    "X-Envoy-External-Address": "<IP_ADDRESS>",
    "X-Forwarded-For": "<IP_ADDRESS>, <IP_ADDRESS>",
    "X-Forwarded-Proto": "http",
    "X-Request-Id": "38bab7c1-5691-9825-ba76-a3a654b83842"
  },
  "origin": "<IP_ADDRESS>, <IP_ADDRESS>",
  "url": "http://httpbin.example.com/get?show_env=1"
}

Expected behavior
X-Forwarded-For header should contain valid client's IP, and ingress gateway should sanitize and/or strip untrusted values before forwarding requests to backend services.
Note that we should account for trusted load balancers being deployed in front of ingress gateway and forwarding valid client's IP using this header.
Steps to reproduce the bug
Deploy sample httpbin service and expose it via ingress gateway from the official guide and issue curl commands mentioned above.
Version
$ istioctl version
Version: 1.0.0
GitRevision: 3a136c90ec5e308f236e0d7ebb5c4c5e405217f4
User: root@71a9470ea93c
Hub: gcr.io/istio-release
GolangVersion: go1.10.1
BuildStatus: Clean

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.1", GitCommit:"b1b29978270dc22fecc592ac55d903350454310a", GitTreeState:"clean", BuildDate:"2018-07-17T18:53:20Z", GoVersion:"go1.10.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"10+", GitVersion:"v1.10.5-gke.3", GitCommit:"6265b9797fc8680c8395abeab12c1e3bad14069a", GitTreeState:"clean", BuildDate:"2018-07-19T23:02:51Z", GoVersion:"go1.9.3b4", Compiler:"gc", Platform:"linux/amd64"}

Is Istio Auth enabled or not?
n/a
Environment
GKE
cc @louiscryan @costinm @rshriram

Ingress gateways should run with externalTrafficPolicy set to Local (see https://github.com/istio/istio/issues/7328)

@kyessenov Good find, thanks! Indeed, changing externalTrafficPolicy from Cluster to Local results in real client IP being passed via X-Forwarded-For header.
That leaves us with sanitization that won't break X-Forwarded-For passed by load balancers.

It depends on which lbs are in the front of ingress. If there is a trusted lb like gcp lb or  elb is in front, then you want the left most address set by in xff, if the fronting lb already sanitizes. this should be configurable by deployment.
Is there a way to configure trusted downstream in envoy?

There is a load balancer source ip range in kube. Not sure if that helps. Else we can look into ip tagging filter or add a source subnet field in the filter chain match so that we can enable it via api (users specify source ip ranges in the gateway spec).

I think source subnet match is easiest way forward.

@mandarjog you can configure number of trusted proxies (xff_num_trusted_hops), which, while not perfect, works for the "behind cloud load balancer" use case.

@kyessenov
I've changed externalTrafficPolicy from Cluster to Local, Ingressgateway seems stopped working. envoy is still listening port but the port doesn't response any request.
my istio-ingressgateway config
apiVersion: v1
kind: Service
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"app":"istio-ingressgateway","chart":"gateways-1.0.0","heritage":"Tiller","istio":"ingressgateway","release":"istio"},"name":"istio-ingressgateway","namespace":"istio-system"},"spec":{"ports":[{"name":"http2","nodePort":31380,"port":80,"targetPort":80},{"name":"https","nodePort":31390,"port":443},{"name":"tcp","nodePort":31400,"port":31400},{"name":"tcp-pilot-grpc-tls","port":15011,"targetPort":15011},{"name":"tcp-citadel-grpc-tls","port":8060,"targetPort":8060},{"name":"http2-prometheus","port":15030,"targetPort":15030},{"name":"http2-grafana","port":15031,"targetPort":15031}],"selector":{"app":"istio-ingressgateway","istio":"ingressgateway"},"type":"LoadBalancer"}}
  creationTimestamp: 2018-08-09T09:07:09Z
  labels:
    app: istio-ingressgateway
    chart: gateways-1.0.0
    heritage: Tiller
    istio: ingressgateway
    release: istio
  name: istio-ingressgateway
  namespace: istio-system
  resourceVersion: "1430477"
  selfLink: /api/v1/namespaces/istio-system/services/istio-ingressgateway
  uid: 98cb3523-9bb3-11e8-91cb-000c29469214
spec:
  clusterIP: <IP_ADDRESS>
  externalIPs:
  - <IP_ADDRESS>
  externalTrafficPolicy: Cluster
  ports:
  - name: http2
    nodePort: 31380
    port: 80
    protocol: TCP
    targetPort: 80
  - name: https
    nodePort: 31390
    port: 443
    protocol: TCP
    targetPort: 443
  - name: tcp
    nodePort: 31400
    port: 31400
    protocol: TCP
    targetPort: 31400
  - name: tcp-pilot-grpc-tls
    nodePort: 30833
    port: 15011
    protocol: TCP
    targetPort: 15011
  - name: tcp-citadel-grpc-tls
    nodePort: 32514
    port: 8060
    protocol: TCP
    targetPort: 8060
  - name: http2-prometheus
    nodePort: 30431
    port: 15030
    protocol: TCP
    targetPort: 15030
  - name: http2-grafana
    nodePort: 31506
    port: 15031
    protocol: TCP
    targetPort: 15031
  selector:
    app: istio-ingressgateway
    istio: ingressgateway
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer: {}

We can add a helm deployment option in the istio-ingressgateway proxy, where the user can specify if the gateway is an edge proxy, or it is located behind a trusted load balancer. This will get passed via proxy node Metadata  to Pilot, which will generate the correct Envoy config with the correct combination of use_remote_address and xff_num_trusted_hops as described here:
https://www.envoyproxy.io/docs/envoy/latest/configuration/http_conn_man/headers#config-http-conn-man-headers-x-forwarded-for
Let me know if you see issues with this approach for 1.0.1.

@rshriram's proposal to filter on source IP with a CIDR or similar would handle cases where an ingress gateway wants to strip an xff header from some but not all of its clients.   The current approach is all or nothing - the ingress gateway trusts all of its clients or none of its clients.
Is that flexible enough?

@duderino Envoy does not have support for filtering x-forwarded-for , it would need to be added.
What are the best practices in the industry to prevent spoofing and how do other proxies handle it? I wonder why Envoy went with the num_hops solely. @PiotrSikora

filtering based on IP is discussed here also as a possible fix: https://github.com/cloudfoundry/gorouter/issues/179

@PiotrSikora We want to cut a build on Friday, what is the status of this bug

Should this work with AWS ELB?
I've added externalTrafficPolicy: Local to istio-ingressgateway service but can see only the balancer's IP in nginx logs.

@rkpagadala I am working on this as per this proposal: https://github.com/istio/istio/issues/7679#issuecomment-412739471

@andraxylia I thought the plan for 1.0.1 was to only strip X-Forwarded-For, since we don't have externalTrafficPolicy: Local merged yet (see: https://github.com/istio/istio/pull/7918), so the info there is pretty useless.

@PiotrSikora the agreement was to have a flag for edge proxy, on by default, and to strip only for edge proxies. This way, when externalTrafficPolicy is fixed, we don't need to revisit this issue anymore, it will just work.

@exiaohao Did you find a fix for this? I'm seeing the same thing.

@exiaohao Did you find a fix for this? I'm seeing the same thing.

You can specify the parameter gateways.istio-ingressgateway.externalTrafficPolicy to Local if using Helm to deploy.

I'm having the same problems as @exiaohao . When I use externalTrafficPolicy: Local the IngressGateway basically stops working. I'm even seeing the NLB is unable to perform the healthchecks...

@mandarjog you can configure number of trusted proxies (xff_num_trusted_hops), which, while not perfect, works for the "behind cloud load balancer" use case.

How is it possible in istio to do this?  I'm running my istio-ingressgateway behind a CDN so I need envoy to process the X-Forwarded-For header - so far using Istio 1.0.3 I've been unable to figure out how to do it.

We'd like to use the X-Forwarded-For header for client ip affinity, using LoadBalancerSettings.ConsistentHashLB, so this is a blocker for us to use Istio on GKE, with a hop to a GCLB.
x-forwarded-for=<client ip>, <gclb ip>, <ingress ip>

It's a bit hackish but it's actually possible to do this with a separate pod and the envoy External Authorization filter.  You can specify which client header to send to the authorization service and which  return header to then forward to your upstream.
I ended up with a filter like this:
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: header-sanitize
spec:
  filters:
  - filterConfig:
      http_service:
        allowed_authorization_headers:
        - x-forwarded-for
        allowed_request_headers:
        - x-forwarded-for
        server_uri:
          cluster: outbound|80||headersanitizer.default.svc.cluster.local
          failure_mode_allow: true
          timeout: 0.25s
          uri: headersanitizer.default.svc.cluster.local:80
    filterName: envoy.ext_authz
    filterType: HTTP
    listenerMatch:
      listenerProtocol: HTTP
      listenerType: GATEWAY
      portNumber: 443
  workloadLabels:
    istio: ingressgateway

The header sanitizer can just be a simple apache container that does a rewrite for all requests to a simple script that can then manipulate the headers for you:
apache.conf
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/index\.php$
RewriteRule . /index.php [L]

index.php
<html>hello world</html>
<?php

if( !function_exists('apache_request_headers') ) {
///
function apache_request_headers() {
  $arh = array();
  $rx_http = '/\AHTTP_/';
  foreach($_SERVER as $key => $val) {
    if( preg_match($rx_http, $key) ) {
      $arh_key = preg_replace($rx_http, '', $key);
      $rx_matches = array();
      // do some nasty string manipulations to restore the original letter case
      // this should work in most cases
      $rx_matches = explode('_', $arh_key);
      if( count($rx_matches) > 0 and strlen($arh_key) > 2 ) {
        foreach($rx_matches as $ak_key => $ak_val) $rx_matches[$ak_key] = ucfirst($ak_val);
        $arh_key = implode('-', $rx_matches);
      }
      $arh[$arh_key] = $val;
    }
  }
  return( $arh );
}
///
}

$headers = apache_request_headers();

foreach ($headers as $header_name => $header_field) {
    if (strcasecmp($header_name, "X-Forwarded-For") === 0) {

        $x_forwarded_for = explode(",", $header_field);

        array_pop($x_forwarded_for);
        array_pop($x_forwarded_for);

        header("$header_name: " . trim(end($x_forwarded_for)));
        exit();
    }
}
exit;

?>

This one just removes the 2 right most values from the x-forwarded-for

@kyessenov
I've changed externalTrafficPolicy from Cluster to Local, Ingressgateway seems stopped working. envoy is still listening port but the port doesn't response any request.
my istio-ingressgateway config
apiVersion: v1
kind: Service
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"app":"istio-ingressgateway","chart":"gateways-1.0.0","heritage":"Tiller","istio":"ingressgateway","release":"istio"},"name":"istio-ingressgateway","namespace":"istio-system"},"spec":{"ports":[{"name":"http2","nodePort":31380,"port":80,"targetPort":80},{"name":"https","nodePort":31390,"port":443},{"name":"tcp","nodePort":31400,"port":31400},{"name":"tcp-pilot-grpc-tls","port":15011,"targetPort":15011},{"name":"tcp-citadel-grpc-tls","port":8060,"targetPort":8060},{"name":"http2-prometheus","port":15030,"targetPort":15030},{"name":"http2-grafana","port":15031,"targetPort":15031}],"selector":{"app":"istio-ingressgateway","istio":"ingressgateway"},"type":"LoadBalancer"}}
  creationTimestamp: 2018-08-09T09:07:09Z
  labels:
    app: istio-ingressgateway
    chart: gateways-1.0.0
    heritage: Tiller
    istio: ingressgateway
    release: istio
  name: istio-ingressgateway
  namespace: istio-system
  resourceVersion: "1430477"
  selfLink: /api/v1/namespaces/istio-system/services/istio-ingressgateway
  uid: 98cb3523-9bb3-11e8-91cb-000c29469214
spec:
  clusterIP: <IP_ADDRESS>
  externalIPs:
  - <IP_ADDRESS>
  externalTrafficPolicy: Cluster
  ports:
  - name: http2
    nodePort: 31380
    port: 80
    protocol: TCP
    targetPort: 80
  - name: https
    nodePort: 31390
    port: 443
    protocol: TCP
    targetPort: 443
  - name: tcp
    nodePort: 31400
    port: 31400
    protocol: TCP
    targetPort: 31400
  - name: tcp-pilot-grpc-tls
    nodePort: 30833
    port: 15011
    protocol: TCP
    targetPort: 15011
  - name: tcp-citadel-grpc-tls
    nodePort: 32514
    port: 8060
    protocol: TCP
    targetPort: 8060
  - name: http2-prometheus
    nodePort: 30431
    port: 15030
    protocol: TCP
    targetPort: 15030
  - name: http2-grafana
    nodePort: 31506
    port: 15031
    protocol: TCP
    targetPort: 15031
  selector:
    app: istio-ingressgateway
    istio: ingressgateway
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer: {}

Have the same issue, how to fix it, thx

@kyessenov
@exiaohao Have you solved the problems? Or maybe other params need change.
Or change the param in Helm?

@exiaohao Did you find a fix for this? I'm seeing the same thing.

You can specify the parameter gateways.istio-ingressgateway.externalTrafficPolicy to Local if using Helm to deploy.

@osswangxining
I upgrade from 1.1 => 1.2.5 by using helm template and changed the externalTrafficPolicy to Local but the ingressgateway is not working. kubectl edit svc istio-ingressgateway -n istio-system change it to local it works well.
I just wanna get a real client IP to have a dynamic blacklist to limit rate by IP.

for anyone who had the issue with setting externalTrafficPolicy from Cluster to Local you would need to make sure istio-ingress is running on the node you are connecting to. for example in my case I had 4 ingress gateway when I changed externalTrafficPolicy on the service from Cluster to Local I couldnt get access to my internal nodes. so what I had to do was add podaffinity to make sure istio-ingressgateway is running on the hosts that traffic is going to. when you are changing Cluster to Local it basically stops kubernetes service to proxy traffic to another host. for example if you have host A and B and you are accessing host B but istio-ingressgateway is running on host A  changing externalTrafficPolicy Cluster to Local would break the traffic. that was the issue I had.           - preference:               matchExpressions:               - key: kubernetes.io/network                 operator: In                 values:                 - public

cc @nrjpoddar @costinm

/cc @incfly

Does https://github.com/istio/istio/pull/23292 fix this or is it just a part of it?

https://blog.opstree.com/2020/04/07/preserve-source-ip-in-aws-classic-load-balancer-and-istios-envoy-using-proxy-protocol/

for anyone who had the issue with setting externalTrafficPolicy from Cluster to Local you would need to make sure istio-ingress is running on the node you are connecting to. for example in my case I had 4 ingress gateway when I changed externalTrafficPolicy on the service from Cluster to Local I couldnt get access to my internal containers. so what I had to do was add podaffinity to make sure istio-ingressgateway is running on the hosts that traffic is going to. when you are changing Cluster to Local it basically stops kubernetes service to proxy traffic to another host. for example if you have host A and B and you are accessing host B but istio-ingressgateway is running on host A changing externalTrafficPolicy Cluster to Local would break the traffic. that was the issue I had.
or change ingressgateway to run as DaemonSet

      - preference:

          matchExpressions:
          - key: kubernetes.io/network
            operator: In
            values:
            - public
        weight: 2

Is there a way to configure the ingress-gateway to run on all nodes via the helm values ?
I manually scaled it up to run on all nodes, but an update of istio in Rancher reverted my changes... and it took me some time to remember this problem.
Whats the correct way to do this ?

Does #23292 fix this or is it just a part of it?

Envoy doesn't sanitize XFF headers, you can only set which XFF to use and the trusted proxies in front is supposed to sanitize if needed. The Gateway topology API allows users to easily specify which XFF to choose but doesn't guarantee sanitization.


fix: docs/integrate/concepts/dotnet-client-libraries.md

referening -> referencing
aorund -> around
someitme -> sometime
Use NOTE/TIP blocks
Trim trailing space

@nschonni : Thanks for your contribution! The author, @elbatk, has been notified to review your proposed change.

@nschonni : Thanks for your contribution! The author, @elbatk, has been notified to review your proposed change.


This is not working

Not working ! I switched to ioredis because this is not working ! 😭😭😭😭😭😭😭😭

I kept on doing redis.createClient but it didn't work ! I was giving proper hostUrl, password and port by passing an object in the createClient function but it didn't worked ! It would be amazing if you can tell me the reason why it didn't worked !!
const client = redis.createClient({
host: host,
password: password,
port: port
});

Kindly tell me what is wrong with this ??

https://github.com/redis/node-redis/blob/master/docs/client-configuration.md
const client = redis.createClient({
  socket: {
    host,
    port
  },
  password
});


new stat: drinker affinities

New statistic to maintain: drinker affinities.
Each drinker has a map of {drinker -> counter}.  For each session, for each other drinker in the session, update the counter for that drinker.
Result should be a rank of all co-drinkers by frequency.

Obsolete / fix later.


Move obs-nebula profile Readme to this repository and update with information about branches

In some repositories we have hidden and useful branches with different experiments.
Since this notes repository will centralize different types of information, we need to move the readme org profile here.

https://github.com/obs-nebula/notes/commit/a87e17c9390ae650dc3289df3298a54732b324e9


Warning when building react-easy-chart module in webpack

After npm install react-easy-chart when I try to build the webpack bundle, I get a warning:

WARNING in ../~/react-easy-chart/~/object-hash/dist/object_hash.js
Critical dependencies:
1:383-390 This seems to be a pre-built javascript file. Though this is possible, it's not recommended. Try to require the original source to get better results.
@ ../~/react-easy-chart/~/object-hash/dist/object_hash.js 1:383-390

Any suggested way of fixing that?

Whats the solution ?


Switch processing of default accept header and simple names to newest format by default

The following mapping should be followed

*/* -> application/json -> default newest version

'application/json` -> default newest (e.g. for timeseries "application/json;version=2")

application/json;version=1 -> the original formats.

application/json;version=<X> -> the exact requested format.

And except for */*, the same for xml
For basins, application/json should load as application/vnd.named+pg+json
Specific tasks:

[ ] #507
[ ] #506
[ ] #505
[ ] #504
[ ] #503
[ ] #502
[ ] #501
[ ] #500
[ ] #499
[ ] #498
[ ] #497

#526 Is asking for something similar but for Ratings - which I don't see in the list of tasks above.

Add it. It's only missing because I couldn't think of everything.

@MikeNeilson all tickets associated with this ticket have been completed.  Please let me know if you have any additional review comments, or if we can close this ticket.


Can't connect to WSL2 application via Websockets when using Postman like application

Version
Microsoft Windows [Version 10.0.22621.1105]
WSL Version

[X] WSL 2
[ ] WSL 1

Kernel Version
<IP_ADDRESS>
Distro Version
Ubuntu 22.04
Other Software
Postman for Windows, version 10.8.7
Insomnia for Windows, version 2022.7.5
Repro Steps
Demo application - https://github.com/filipe-costa/repro-demo-wsl2-websockets

Fork project
Clone it to the local environment in WSL2
Run npm install
Run node index.js
Open postman or insomnia UI from windows -  create a WebSocket connection and request ws://localhost:3000/

Expected Behavior
I expected to be able to connect to the WSL2 application that has a WebSocket endpoint without any issues. On the other hand, it is possible to connect to it via a Web Browser.
Actual Behavior
Could not connect to ws://localhost:3000/
Error: connect ECONNREFUSED <IP_ADDRESS>:3000

Similar issues:
https://github.com/microsoft/WSL/issues/7849
https://github.com/microsoft/WSL/issues/4204
Diagnostic Logs
WslLogs-2023-01-27_18-46-42.zip

Some screenshots to aid the diagnostic logs.
Regular HTTP requests go through without an issue:

Fails for WebSockets:

Works within browser context:

I'm seeing this same issue. My guess is that they automatically try connecting to <IP_ADDRESS> which WSL doesn't like.

I have same issue. I'm unable to connect to either Postman or any other application.

@filipe-costa My issue was server was started on ipv6 which was unable to listen. You can use sudo lsof -i -P -n | grep LISTEN to check if your port is ipv6 or ipv4. If ipv6, then try putting <IP_ADDRESS> after port. The issue for connection refused will be solved.
 Now, this will be because you are using socket.io library and going through the documentation, it seems like it expects socket.io-client, its own library for proper handshake to establish a connection. So, we might not be able to do it from postman at all.
What you can try is using the base ws library which is barebone of websockets (upon which socket.io runs). I was able to establish a connection through it.

Also, just going through postman in detail, it does have a separate request type for socket.io and it works.

@filipe-costa To make a postman call, you must specify the wsl ip address. You can find it using the command wsl hostname -I.


Update manifest docs - with support for minimal-ui

:+1:

:tada: This has been pushed live to https://developers.google.com/web/


An error on Mac

wine@f243b37b8ad0:/$  wine '/home/wine/.wine/drive_c/Program Files/Amazon/Kindle/Kindle.exe'
wine: Unhandled page fault on read access to 0x00000000 at address 0x65039e19 (thread 0009), starting debugger...
002f:err:winediag:nodrv_CreateWindow Application tried to create a window, but no driver could be loaded.
002f:err:winediag:nodrv_CreateWindow Make sure that your X server is running and that $DISPLAY is set correctly.
Unhandled exception: page fault on read access to 0x00000000 in 32-bit code (0x65039e19).
Register dump:
 CS:0023 SS:002b DS:002b ES:002b FS:006b GS:0063
 EIP:65039e19 ESP:0033fb5c EBP:067d54e0 EFLAGS:00210246(  R- --  I  Z- -P- )
 EAX:00000000 EBX:067d57c8 ECX:067d57c8 EDX:ffffffff
 ESI:00000001 EDI:00000001
Stack dump:
0x0033fb5c:  067d5588 067d54e0 067d54c0 00000001
0x0033fb6c:  00000000 067d54c0 067d57c8 6722f354
0x0033fb7c:  067d59e0 067ba008 8800f001 6501129b
0x0033fb8c:  02e34a78 067be724 067d54e0 00000000
0x0033fb9c:  00000280 000001e0 6722f354 00000001
0x0033fbac:  6722f364 6722f364 6503abc9 0000003c
Backtrace:
=>0 0x65039e19 EntryPoint+0xffffffff() in qt5widgets (0x067d54e0)
  1 0x067d54c0 (0x652ab888)
  2 0x650421f0 EntryPoint+0xffffffff() in qt5widgets (0x65005040)
  3 0xe98b5502 (0x042444f6)
0x65039e19 EntryPoint+0xffffffff in qt5widgets: movl	0x0(%eax),%edx
Modules:
Module	Address			Debug info	Name (68 modules)
PE	  340000-  367000	Deferred        qt5sensors
PE	  370000-  399000	Deferred        qt5positioning
PE	  3a0000-  3e7000	Deferred        ssleay32
PE	  3f0000-  400000	Deferred        pthreadvc2
PE	  400000- 2cfa000	Deferred        kindle
PE	 2d00000- 2fee000	Deferred        qt5gui
PE	 2ff0000- 3149000	Deferred        icuuc55
PE	 3150000- 3fe3000	Deferred        qt5webkit
PE	 3ff0000- 4079000	Deferred        qt5multimedia
PE	 4080000- 41a5000	Deferred        libeay32
PE	 41b0000- 41c2000	Deferred        qt5multimediawidgets
PE	 41d0000- 4214000	Deferred        qt5printsupport
PE	 4220000- 4249000	Deferred        qt5winextras
PE	 4250000- 4365000	Deferred        qt5script
PE	 4370000- 43aa000	Deferred        webcoreviewer
PE	 43b0000- 44a5000	Deferred        libxml2
PE	 44b0000- 5330000	Deferred        icudt46
PE	 5330000- 5457000	Deferred        javascriptcore
PE	 5460000- 5504000	Deferred        cflite
PE	 5510000- 5646000	Deferred        icuin46
PE	 5650000- 5d6b000	Deferred        libwebcore
PE	 5d70000- 5dad000	Deferred        libjpeg
PE	 6a40000- 6b19000	Deferred        qwindows
PE	10000000-10032000	Deferred        qt5webkitwidgets
PE	4a800000-4a8eb000	Deferred        icuuc46
PE	4a900000-4aafd000	Deferred        icuin55
PE	4ad00000-4c5b8000	Deferred        icudt55
PE	61000000-61028000	Deferred        qt5xml
PE	61b80000-61b98000	Deferred        zlib1
PE	62000000-620bc000	Deferred        qt5sql
PE	64000000-640ca000	Deferred        qt5network
PE	65000000-65434000	Export          qt5widgets
PE	67000000-673de000	Deferred        qt5core
PE	7b420000-7b5d1000	Deferred        kernel32
PE	7bc10000-7bc14000	Deferred        ntdll
PE	7d220000-7d224000	Deferred        uxtheme
PE	7e190000-7e222000	Deferred        oleaut32
PE	7e2e0000-7e2e3000	Deferred        msvcp100
PE	7e3f0000-7e3f4000	Deferred        msvcr100
PE	7e4b0000-7e4b4000	Deferred        wsock32
PE	7e4e0000-7e524000	Deferred        msvcrt
PE	7e590000-7e594000	Deferred        wintrust
PE	7e5c0000-7e5c4000	Deferred        imm32
PE	7e5e0000-7e5e3000	Deferred        usp10
PE	7e630000-7e6ad000	Deferred        comctl32
PE	7e7a0000-7e87e000	Deferred        comdlg32
PE	7e8d0000-7e8db000	Deferred        winspool
PE	7e910000-7e914000	Deferred        bcrypt
PE	7e930000-7e972000	Deferred        crypt32
PE	7ea00000-7ea04000	Deferred        iphlpapi
PE	7ea30000-7ea33000	Deferred        netapi32
PE	7ea80000-7ea84000	Deferred        dnsapi
PE	7eaa0000-7eaa9000	Deferred        msacm32
PE	7ead0000-7eb48000	Deferred        winmm
PE	7ebc0000-7ebc3000	Deferred        msvcp90
PE	7ecf0000-7ecf4000	Deferred        msvcr90
PE	7edb0000-7edb4000	Deferred        rpcrt4
PE	7ee40000-7ee68000	Deferred        ole32
PE	7ef90000-7ef93000	Deferred        shcore
PE	7efc0000-7f893000	Deferred        shell32
PE	7f990000-7f998000	Deferred        shlwapi
PE	7f9f0000-7f9f4000	Deferred        version
PE	7fa10000-7fa14000	Deferred        advapi32
PE	7fa90000-7fa97000	Deferred        gdi32
PE	7fbd0000-7fcb8000	Deferred        user32
PE	7fdd0000-7fddb000	Deferred        mpr
PE	7fe20000-7fe3e000	Deferred        wininet
PE	7fea0000-7fea4000	Deferred        ws2_32
Threads:
process  tid      prio (all id:s are in hex)
00000008 (D) C:\Program Files\Amazon\Kindle\Kindle.exe
	00000009    0 <==
0000000c winemenubuilder.exe
	0000000d    0
0000000e services.exe
	0000002a    0
	00000025    0
	0000001d    0
	00000017    0
	00000016    0
	00000015    0
	00000010    0
	0000000f    0
00000011 mscorsvw.exe
	0000001a    0
	00000019    0
	00000018    0
	00000012    0
00000013 explorer.exe
	00000024    0
	00000021    0
	00000014    0
0000001b winedevice.exe
	0000001f    0
	0000001e    0
	0000001c    0
00000022 plugplay.exe
	00000027    0
	00000026    0
	00000023    0
00000028 winedevice.exe
	0000002d    0
	0000002c    0
	0000002b    0
	00000029    0
System information:
    Wine build: wine-4.0.2 (Ubuntu 4.0.2-1)
    Platform: i386
    Version: Windows 7
    Host system: Linux
    Host version: 5.4.39-linuxkit

I don't remember exactly, but I was able to fix this error by using Xquartz(just running the Dockerfile in XQuartz)


docs(installing-deis): add domain configuration

This addresses issue #112.

@technosophos is there still more to #112 after this?

@arschles I wasn't planning on it. Once I started writing, I realized that simpler is probably better here. But if people feel like there should be more, I'd do that.

cool, I was asking because I'm +1 on this finishing #112. ok if we close that out with this?


Support Parallel Upgrades

BREAKING CHANGE: New API for Upgrades

TODO:

[ ] Make iOS and Android upgrade states consistent, and update type to match

Self Review:

[ ] Appropriate test coverage
[ ] Relevant Documentation updated

Smoke Tests:

[ ] ...

broken for factory test as factory test edges id == bleId when discovered so wrong data is being requested from api
android crashes if an in progress upgrade is cancelled. I think this may be due to a promise being rejected twice so might need to put something in place to catch or prevent that from happenning

@saty9 that looks like that comment is for our app, rather than this PR?


add segmentio kafka producer, enabled via conditional build tag

This is a replacement PR for #75, the kafka producer can be selected via build option, defaults to existing sarama option

@awillis thank you so much for new pull request.
I need few changes to support both kafka libs through the binary. I'll take care of them.


sharing button does not appear on workbooks when the worksheet is added in the url

Fixed in this commit: https://github.com/isb-cgc/ISB-CGC-Webapp/commit/bd8e547de19642dfa00797ec441d7a9e6606ae50


Beast collection gameplay system

A method to:

track which beasts an Adventurer has encountered and slayed i.e. trophies
include the slayed beasts as trophies in an interface which displays all beasts that exists in the world ('beastdex' or similar)
show a leaderboard of which Adventurers have collected most trophies
'share my beastdex and leaderboard position' to twitter function

Extensions:
5. potentially include beast rarity in the game e.g. some rare beasts only encountered after level 10
6. potential for traits like luck to influence possibility of encountering rare beasts
7. potential for leaderboard to create a beastdex score where the rank is based not only on percentage of beast trophies collected (e.g. 24 out of 48) but the rarity of the beasts in the beastdex.
Objective - to create an alternative goal in the game for players who want to collect / compete for the best collection

I don't think we will implement for the V1 as more work to get this implemented, currently prioritising making the current game smooth. Some notes for V2:

For the beastdex it is relatively simple to add a tab that displays the beasts that you have slain. Currently there isn't rarity build in for these beasts, so really this will just be a cosmetic addition rather than an added feature to the game, and this rarity would require contract upgrades. If we then want to architect luck to also affect this rarity then that's also extra work to upgrade.

Calculating the trophy system is cool, but also something that we should focus on once rarity has been added in V2 (we would add rarity not only for beasts but items, obstacles etc)


Encode prefix where possible

There was an issue where the Krill 0.10.0-rc code TA certificates encoded all IPv4 resources as a range rather than a prefix.

With this branch the Krill E2E test passes where it was previously failing due to errors from Fort, rcynic and rpki-client.

The intention was that IpBlocks guarantees its content to be a sequence of blocks according to RFC 3779. I am proposing to fix the bug in the blocks builder code that doesn’t convert these blocks into prefixes in #225 rather than working around it.

This PR has been superseded by #225.


Require array -> bytes codec be specified in metadata

This removes the concept of a "default binary representation". Instead, it is required that an "array -> bytes" codec be specified in the list of codecs.  Implementations are still free to choose a default "array -> bytes" codec when creating an array if not specified by the user.  This should slightly simplify implementations, and makes it clearer to humans when reading the metadata which "array -> bytes" codec will be used.

@normanrz Please take a look.

Nice, this mostly LGTM. Please also add a changelog entry, preferably in a new section Changes after Provisional Acceptance (see #248 (comment)).

Done.

I am still seriously confused about what is required to handle endianness.
My current interpretation is that the first entry in the codecs chain must be "bytes" and it does nothing
but pass thru the bytes unchanged.
However it is unclear if it is also intended that the "bytes" codec also can specify endianness,
or is there still a separate "endian" codec that must the second element in the chain and is mandatory
for arrays whose type size is > 1.
Also, when specifying the endianness as a codec, it must specify the type of the data being encoded.
Can that type differ from the type of the associated array? Admittedly this is probably not useful, but
how is that situation to be interpreted and which type  takes precedence: the array type or the endian codec type?

The bytes codec specifies a conversion from the logical array representation to a specific physical.(byte sequence) representation.  Whether that just passes through the bytes or does some conversation depends on the specific in-memory representation used by the implementation.  For example, if the implementation stores bools packed as single bits in memory, they will need to be expanded to each occupy a whole byte.
There is no separate endian codec.
The data type is not specified as an option to the bytes codec, instead it is inferred from the data type specified in the metadata and the sequence of prior array to array codecs.  The endian configuration option is required if relevant for the data type, otherwise it is ignored.

Two questions:

Where is endian-ness encoding performed?
Where is the numcodecs specification for the bytes codec?

The endian conversion would presumably happen either in the encode/decode functions for the bytes codec, or not at all if the implementation has arranged to use the same endianness for the in-memory representation as in the stored representation.
I don't think zarr v3 support is implemented in zarr-python yet, but you can refer to some other implementations here:
https://github.com/google/tensorstore/blob/1b7417d4221c0e9fea50aef33e139fca1a439506/tensorstore/driver/zarr3/codec/bytes.cc#L192
https://github.com/google/neuroglancer/blob/master/src/neuroglancer/datasource/zarr/codec/bytes/decode.ts
https://github.com/scalableminds/zarrita/blob/78274781ad64aef95772eb4b083f7ea9b7d03d06/zarrita/codecs.py#L330

I do not think that it is a good idea to have an essential (mandatory even) concept in the V3 spec
where the concept has no definition in the V3 spec.
Apparently the only definition is in python code, so it becomes necessary for non-python implementors to follow changes to that python code.
This makes life very difficult for non-python V3 implementations.

When you say that there is an essential concept that is not defined in the V3 spec, which concept are you referring to?

The "bytes" codec.

The bytes codec is specified in this PR:
https://github.com/zarr-developers/zarr-specs/pull/263

The bytes codec is specified in this PR: #263

Thanks, that was the piece of information I was missing.


Node v13 causes builds to fail

For the past hour our builds on GitLab are failing due to incompatibility of node-sass with Node v13.
Given that Node v13 is not an LTS version, do we really need to jump to it as soon as it comes out? Or use odd versions at all? There were similar problems with v12, as gitlab-ci-pipeline-php was updated to it as soon as it came out. Isn't it reasonable even for LTS versions to wait for a month or so as glitches are dealt with or maybe maintain a stable version of this repo?
Don't get me wrong - I think this is a terrific project and makes it super easy to have PHP builds in GitLab CI. I'm skeptical about the value the bleeding edge brings while the problems that come with it are very real.

hi @ddinchev
You're right, actually, I don't have a pattern or standard to update the images, from time to time I check the https://nodejs.org/en/ and if there's a new version I update the images, but I think your suggestion to wait some time before upgrade the node is very good, I'll pay more attention to the release dates and be more cautious in the future.

Thanks for your quick reply! I'd suggest we stick to LTS versions - which are even numbers, eg v8, v10, v12 and in 6 months v14. Odd major versions like v9, v11, v13 are more likely to contain new features and breaking changes - until the LTS version comes, glitches are fixed.
Meanwhile - there is a node-sass:4.13 version, supporting v13.

I've pushed some changes with node v12 again and I'll wait a few weeks/months to update again to v13.
Thanks for your suggestion and sorry for the trouble

@edbizarro
we also face some build fails caused by sass and node-gyp trying to compile c++ files.
It may be nice, if we could use "nvm". Maybe with preinstalled versions of nodejs with nvm, so builds are faster. In my usecase I just fixed an typo an project and my build failed due the update of nodjs. So if some project is stuck to an old version and you dont realy have time to face this issue. I would prefer to fix a pipeline to a specifc nodejs version for those builds. Projects define and use the nodejs version that has worked and should work in future.
basically my idea is to support following:
scripts:
- nvm install 10.16.3
- nvm use 10.16.3

nvm and possibly preinstalled previous node versions would be a great addition. Even though I see not everyone will need this and it will enlarge the image.
I am currently in need of an image with PHP 7.2 and node 10.x. For now I solved it by installing nvm, node 10 and yarn manually on top of the 7.2 image... or is there a better yet still convenient way?

I thought about spliting my pipeline and do an extra job using an node image and pass all assets to the next job as artifact.


Provision security settings

Preflight Checklist

[x] I could not find a solution in the existing issues, docs, nor discussions
[ ] I have joined the ZITADEL chat

Describe your problem
I'd like to be able to set enableImpersonation to true programmatically via Terraform
Describe your ideal solution
Something like:
resource "zitadel_default_security_settings" "default" {
  enable_impersonation = true
}

Version
2.0.1
Additional Context
https://zitadel.com/docs/apis/resources/settings_service_v2/settings-service-set-security-settings

Thank you for sharing your idea.
If there is a significant demand from customers/community, we will carefully consider implementing the feature.
Currently, the issue will be added to our product backlog to collect feedback.
Meanwhile, if you're interested in implementing it yourself, we also welcome pull requests.


Fix Tall Screenshot tests

See https://github.com/google/horologist/blob/4bb0721c0f7c099bf68e306551873ede7f0a3a96/media-ui/src/test/snapshots/images/com.google.android.horologist.media.ui.screens.browse_PlaylistDownloadBrowseScreenA11yTallScreenshotTest_browseScreen.png
Broken after Wear Compose 1.2-alpha06. This uses extremely private APIs for our tests only, so not considering this blocking.

Has been addressed separately


Improve desired shard calculation

design doc: https://docs.google.com/document/d/1MQpFKWJ32vw3Cf3CDe_BHP1iXZVSvbN3b9MH9JiJaq4/edit#heading=h.gleyd16o594s
closes https://github.com/prometheus/prometheus/issues/9207

related https://github.com/prometheus/prometheus/issues/9178

will run this on a test system to see how it performs...

thank you for the review @bboreham, @csmarchbanks!

change you proposed here will tick the rate once for each queue, and hence give erroneous results if there are more than one.

oh yes, there's a hardcoded assumption that the tick() will only be called once per shardUpdateDuration. I think we can do away with this limitation. Calling tick() more often on samplesIn will allow us to be more reactive to the changes in flow and hence not allow the backlog to build a lot...

Do you know how far off the current values are in practice?

Not really. Unfortunately, I have no prior experience operating prometheus in remote write settings, so I am going by what seems to make sense at least mathematically.

Thank you

Hey there

Finding this during our bug scrub. Sorry for dropping the ball on this. @csmarchbanks is currently not available, but maybe @cstyan or @rfratto can comment on this. Is it still needed?

I'd need some time to get up to speed on how this is being implemented, but I'm about to go on PTO for a month so it likely wouldn't happen until then.
@darshanime if you would still like to continue this can you make updates to fix the merge conflicts please :)

Discussed at the bug-scrub; nothing has moved on this PR for 2 years so closing.
The shard calculation has changed since, e.g. in #9274.


Bad state: Tried to read a provider from a ProviderContainer that was already disposed

Hi.
I have AccountExistsScreen that receives authCredential as parameter.  I need to pass authCredential to AccountExistsViewModel.
Here are the providers that I am using:
// This provider is used to store authCredential and is read inside AccountExistsViewModel
final authCredentialProvider = Provider<AuthCredential?>((ref) => null);

// provider for AccountExistsViewModel
final accountExistsViewModelProvider =
    StateNotifierProvider.autoDispose<AccountExistsViewModel, AuthModel>(
  (ref) => AccountExistsViewModel(ref.read),
  // I need this dependency because inside the AccountExistsViewModel I need to read authCredentialProvider
  //  If I comment out the dependencies, the error goes away, but I can't read authCredential inside AccountExistsViewModel
  dependencies: [authCredentialProvider],
);

Here is the code for AccountExistsScreen:
class AccountExistsScreen extends HookConsumerWidget {
  // I need to pass this to AccountExistsViewModel
  // See the ProviderScope
  final AuthCredential? authCredential;

  const AccountExistsScreen({
    this.authCredential,
    Key? key,
  }) : super(key: key);

  @override
  Widget build(BuildContext context, WidgetRef ref) {

    // Here is where the problem start.
    // Because of the ref.read in the useEffect(), when I go one screen back, I get the following error:
    // Bad state: Tried to read a provider from a ProviderContainer that was already disposed
    // If I comment the ref.read(), then I will not receive the error
    // Why is this ref.read causing problem?
    // I have also noticed that this ref.read creates a second instance of accountExistsViewModelProvider
    // The first instance is created below in the EmailField
    useEffect(() {
      WidgetsBinding.instance?.addPostFrameCallback((_) {
        ref.read(accountExistsViewModelProvider.notifier).initializeEmail(email);
      });
      return null;
    }, []);

    return ProviderScope(
        overrides: [
         // authCredential need to read inside the accountExistsViewModelProvider
          authCredentialProvider.overrideWithValue(authCredential)
        ],
        child: Column(
          children: [
            EmailField(),
           //
          ],
        ),
      ),
    );
}

This is how the AccountExistsViewModel looks like
// this provider is used in the account_exits_screen.dart
class AccountExistsViewModel extends StateNotifier<AuthModel> {
  final Reader _read;
  AccountExistsViewModel(Reader read)
      : _read = read, super(const AuthModel());

  void initializeEmail(String email){
    //
  }

  Future<void> signInWithEmailAndPassword(BuildContext context) async {
    // If I comment out the dependencies above, authCredential will be null.
    final authCredential = _read(authCredentialProvider);
    debugPrint('$authCredential');

    //  other things...
  }

This is how the EmailField looks like:
class EmailField extends HookConsumerWidget {
  const EmailField({Key? key}) : super(key: key);

  @override
  Widget build(BuildContext context, WidgetRef ref) {
    final notifier = ref.watch(accountExistsViewModelProvider.notifier);

    return TextField(/**/);
  }
}

Does anyone know why I am getting this error?
Thanks alot.

Could you please provide a complete example? Something that can be executed on dartpad
With split snippets which don't compile, it's really difficult to see the problem. And the problem could very well be within this "// other things" / /* */

Does DartPad support RiverPod?

Yes it does

Here is a link to dart pad.
https://dartpad.dev/?id=e75b493dae1287757c5e1d77a0dc73f1
I tried to keep code at a minimum.
If you look at emailStateNotifierProvider, I am using "dependencies" over there that I would like to keep to pass the value of authCredentialProvider to EmailStateNotifier inside 'signInWithEmailAndPassword' function but it is not working.
I kept lots of comments to explain the code.
There are two things I looking to accomplish.
1- initialize the EmailField when the EmailScreen first loads
2- when I click the button, I want to read the value of authCredentialProvider in the signInWithEmailAndPassword function but the value is always null?
What is wrong with the dependencies that is causing problems?

Here is a link to dart pad.
https://dartpad.dev/?id=e75b493dae1287757c5e1d77a0dc73f1

@ablbol  This link does not work for me. Could you re-check the link?

Rather than the link not working, the code is not compiling.

Oops, I am so sorry.  I never shared dart files before.  Here you go.
https://dartpad.dev/?id=e0402fb8d4c02c5111252a08d5d41fa7

Oh, that's because you'd used a ref which is an ancestor of the ProviderScope which does the override:
final a = Provider<int>((ref) => 0);

Widget build(context, ref) {
  return ProviderScope(
    overrides: [a.overrideWithValue(42)],
    child: Button(
       onTap: () => print(ref.read(a)),  // Will not obtain 42 but 0 instead
    ),
  );
}

It's a visual confusion.
By shuffling code around, it should make the problem more obvious:
final a = Provider<int>((ref) => 0);

Widget build(context, ref) {
  final value = ref.watch(a); // Obviously obtains 0, since the override is defined in a child widget

  return ProviderScope(
    overrides: [a.overrideWithValue(42)],
    child: Button(
       onTap: () => print(a),  // Will not print 42 but 0 instead
    ),
  );
}

An easy solution is to use Consumer:
final a = Provider<int>((ref) => 0);

Widget build(context, ref) {
  return ProviderScope(
    overrides: [a.overrideWithValue(42)],
    child: Consumer(
      builder: (context, ref, child) {
        // By using `Consumer`, we now have a `ref` which is a child of our ProviderScope override
        return Button(
          onTap: () => print(ref.read(a)),  // correctly prints 42
      ),
    ),
  );
}

Here's the fixed code:
// Copyright (c) 2019, the Dart project authors.  Please see the AUTHORS file
// for details. All rights reserved. Use of this source code is governed by a
// BSD-style license that can be found in the LICENSE file.

import 'package:flutter/material.dart';
import 'package:flutter_hooks/flutter_hooks.dart';
import 'package:hooks_riverpod/hooks_riverpod.dart';

// A basic model to hold and change email in the email field
class EmailModel {
  final String _email;
  String get email => _email;
  const EmailModel({String email = ''}) : _email = email;

  EmailModel copyWith({String? email}) {
    return EmailModel(email: email ?? _email);
  }

  @override
  bool operator ==(Object other) {
    if (identical(this, other)) return true;
    return other is EmailModel && other._email == _email;
  }

  @override
  int get hashCode => _email.hashCode;
}

// Used to initialize and listen to changes to the email field
class EmailStateNotifier extends StateNotifier<EmailModel> {
  final Reader _read;
  final TextEditingController _emailController;

  EmailStateNotifier(Reader read)
      : _read = read,
        _emailController = TextEditingController(),
        super(const EmailModel());

  @override
  void dispose() {
    super.dispose();
    _emailController.dispose();
  }

  TextEditingController get emailController => _emailController;

  void initializeEmail(value) {
    _emailController.text = value;
    changeEmail(value);
  }

  void changeEmail(String email) {
    state = state.copyWith(email: email);
  }

  // I would like to read the value of authCredentialProvider but
  // I am unable to. It is always null
  Future<void> signInWithEmailAndPassword(BuildContext context) async {
    final authCredential = _read(authCredentialProvider);
    debugPrint('signInWithEmailAndPassword - authCredential - $authCredential');
  }
}

// will hold the value of the authCredential parameter passed to  the EmailScreen
final authCredentialProvider = Provider<String?>((ref) => null);

final emailStateNotifierProvider =
    StateNotifierProvider.autoDispose<EmailStateNotifier, EmailModel>(
  (ref) {
    debugPrint('emailStateNotifierProvider created');
    ref.onDispose(() => debugPrint('emailStateNotifierProvider disposed'));

    return EmailStateNotifier(ref.read);
  },
  // If I keep the dependencies, then
  // 1- emailStateNotifierProvider is ceated twice in a raw follewed by one dispose
  // look at the console for a proof.
  // 2- the email field is not initialized in the useEffect() in the EmailScreen below
  // why are these behaviors?
  // on the other hand, if I comment out the dependencies, then
  // 1- emailStateNotifierProvider is ceated once (see the console)
  // 2- the email field is initialized in the useEffect() in the EmailScreen below
  // How can I read the value of authCredentialProvider in EmailStateNotifier?
  dependencies: [authCredentialProvider],
);

void main() => runApp(const ProviderScope(child: MyApp()));

class MyApp extends StatelessWidget {
  const MyApp({Key? key}) : super(key: key);
  @override
  Widget build(BuildContext context) {
    return const MaterialApp(
      debugShowCheckedModeBanner: false,
      home: EmailScreen(
        email<EMAIL_ADDRESS>        authCredential: 'some credential',
      ),
    );
  }
}

class EmailField extends HookConsumerWidget {
  const EmailField({Key? key}) : super(key: key);

  @override
  Widget build(BuildContext context, WidgetRef ref) {
    final notifier = ref.watch(emailStateNotifierProvider.notifier);

    return TextField(
      controller: notifier.emailController,
      onChanged: notifier.changeEmail,
      decoration: const InputDecoration(labelText: 'Email'),
    );
  }
}

// in this screen, I would like to accomplish two things
// 1- when the screen loads, I want to initialize the email field
// with the email parameter. See useEffect() below.
// 2- I want to pass the authCredential parameteer to the
// EmailStateNotifier. See the ProviderScope below
class EmailScreen extends HookConsumerWidget {
  final String email;
  final String? authCredential;

  const EmailScreen({
    required this.email,
    this.authCredential,
    Key? key,
  }) : super(key: key);

  @override
  Widget build(BuildContext context, WidgetRef ref) {
    return Scaffold(
      body: ProviderScope(
        // I want to pass authCredential value to the EmailStateNotifier
        // but I am not able to!!.  I thought the dependencies in emailStateNotifierProvider
        // can help but it did not!!
        overrides: [authCredentialProvider.overrideWithValue(authCredential)],
        child: HookConsumer(
          builder: (context, ref, child) {
            // Why doesn't the email field get inialized when the dependencies are used in the emailStateNotifierProvider
            useEffect(() {
              WidgetsBinding.instance?.addPostFrameCallback((_) {
                ref
                    .read(emailStateNotifierProvider.notifier)
                    .initializeEmail(email);
              });

              return null;
            }, []);

            return Padding(
              padding: const EdgeInsets.all(16.0),
              child: Column(
                crossAxisAlignment: CrossAxisAlignment.stretch,
                children: [
                  const EmailField(),
                  const SizedBox(height: 36.0),
                  ElevatedButton(
                    child: const Text('LOG IN'),
                    onPressed: () {
                      ref
                          .read(emailStateNotifierProvider.notifier)
                          .signInWithEmailAndPassword(context);
                    },
                  ),
                ],
              ),
            );
          },
        ),
      ),
    );
  }
}

Thanks

I am using hooks_riverpod: ^2.0.0-dev.7 and running into the same exact problem.  I will downgrade tomorrow and see if the problem goes away.


Spike: arg transformations

@bilal-fazlani  this one needs your review.
This introduces a new design choice aimed to make it easier for us to compose parsing behavior.  We'll be able to introduce .rsp file support very easily with this.
When we fill confident with the API, we can expose it to devs to extend the parsing behavior.
We can use this pattern to introduce the middleware concept as a great way to introduce new optional features and provide greater extensibility.
This also gives us more information from the [parse] command.  I found it useful while debugging tests.  I just added [parse] and saw the bug in the test output.  No need to step into the debugger.
This also fixes our parsing errors from #59 and so you can disregard the other branch if we merge this one.
I'm eager to hear your thoughts.

With the argument fix, we can release a new version without the beta tag.

Ok, please help me get some deeper understanding.
I see that in this PR, user has to pass “[parse]” as as an argument so that app shows how all arguments and options are parsed. This is just for debugging purpose and does not actually execute any user logic, Right?
The idea seems cool. I have some questions on this.

What can be examples of

We can use this pattern to introduce the middleware concept as a great way to introduce new optional features and provide greater extensibility.

Why does the user has to pass this thing as an argument? Could it not be something like :

new AppRunner<MyApp>()
   .Parse(args )

Or maybe .Parse(args).Run(args) if they want to parse and run

What is a .rsp file?

We'll be able to introduce .rsp file support very easily with this.

I'll answer in reverse order...

Simplest to let someone else explain it.

https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild-response-files?view=vs-2019
https://github.com/dotnet/command-line-api/wiki/Features-overview#response-files

I've used this concept in the past.  It's a handy way to store common option sets and to let apps pass options to other apps.

This PR doesn't introduce the [parse] directive.  [parse] & [debug] were already added.  I used [parse] because it was already introduced by System.CommandLine docs.  It's purpose is to help the user of the console understand how their values were parsed, to log how the input was parsed.  Like an advanced echo command.   If [parse] is passed in, then no user logic is executed.

Examples of middleware

new AppRunner<MyApp>()
   .UseRspFiles()
   .AddArgumentTransformation( TaorisApp.MergeArguments )
   .UseMiddleware( DrewsApp.InjectArgModelsIntoContainers )

Middleware is the pipeline you suggested be implemented instead of the ICommandInvoker.  My org didn't have budget to implement the Middleware concept so we went with the easier-to-implement Decorator pattern.

Ohh yeah, the middlewares. I remember now. Sounds good to me 👍

RSP seems cool and very useful. 👍

about the parse thing, being able to view how arguments are parsed sounds good. However I have not seen any CLI tool that has exposed this feature to their end user. Have you seen anything like that?
Especially anything in the form of square brackets.. ([bla bla]).
If you have strong opinions/reasons about it, go ahead.

On a sidenote, the dotnet CommandLine thing seems good. Especially what they are doing with DragonFruit.

Great, sounds like we're on the same page.  I haven't seen the directives concept before.  I think CommandLine introduced it.  Since I've implemented this pretty much everywhere and I know I'll use and socialize it with my companies, it would be very useful to me to have it built in.
I agree, I think DragonFruit could be great.  I've been thinking that after I finish a couple more updates I'll look at helping out with that or merging these two projects by forking theirs and introducing the constructs we have.

I updated the parsing logic, adding a Tokenizer so arg transformations and parsing logic would be cleaner overall.  I also separated parsing logic from execution, finally getting the cyclomatic complexity of the parsing logic below the 100% threshold.  It's still ugly, but I think the control flow is a little more clear.
I also disabled directives by default and added an AppSettings.EnableDirectives.  This way we don't accidentally break existing scripts.


Add Ability to have primitive blocks

Instead of policy, mechanism, etc.
Would be loaded in the JSON block component and then added before adding in the policies, mechs, etc
Then we can design a GDS version that is not going into extreme detail with the root finding example


Move affecting type hints from symfony - Laravel 11 support

Fix for issue #42
Moving the type hint at the end of the function.
Borrowed the code from terax6669 just to move forward.

@specialtactics Do you have an idea, when you can merge this and make a release?

Done @rdeutz I'll tag it as next feature version.

Actually tagged as 4.2.1, as this is more of a fix.

This seems to be a regression that broke morph functionality, I am in the process of fixing it.


Added SLAT and SocketDesignation for Windows with Fixes for Printer Permission Bug

Hi,
I have Added Some Essential Information's to CPU and Fixed the Issue with Pulling Print Information without Proper Permissions Breaking the Code.
Information's Added to CPUList:
SLAT
SocketDesignation

Sure thing, I'll replace those add catch statement into 2 requests


In C++ interop mode, specifying --static-swift-stdlib causes the build to fail

Description
In C++ interop mode, when compiling certain code on Linux and specifying --static-swift-stdlib, the build fails.
The error occurs during the linking phase of the executable, reporting that symbols such as std.string.init(_: Swift.String) and Swift.String.init(_: std.string) cannot be found.
These functions are marked with @_alwaysEmitIntoClient, but the issue seems to arise when references to these functions are generated from code with function signature specialization optimizations. These references are not resolved properly during linking.
Below is the code causing the issue. While slightly complex, altering its structure results in different behavior, and the issue disappears.
// CxxCats.hpp
#pragma once

#include <string>
#include <optional>

using string_optional = std::optional<std::string>;

class Cat {
public:
    int foo;
};

std::optional<Cat> Cat_create(const std::string & name, std::optional<std::string> & e);

// Demo.swift
import CxxCats
import CxxStdlib

struct MessageError: Error {
    var description: String
}

func withCxxException<R>(_ body: (inout string_optional) -> R) throws -> R {
    var error = string_optional()

    let result = body(&error)

    if let message = Optional(fromCxx: error) {
        throw MessageError(description: String(message))
    }

    return result
}

func withCxxOptionalOrException<R>(_ body: (inout string_optional) -> some CxxOptional<R>) throws -> R {
    let result = try withCxxException(body)
    return Optional(fromCxx: result)!
}

public class WrapperCat {
    public init() throws {
        self.cat = try withCxxOptionalOrException { (e) in
            Cat_create(std.string("tama"), &e)
        }
    }

    var cat: Cat
}

Building this code results in the following error:
/usr/bin/ld.gold: error: cannot find -lswiftCxx
/usr/bin/ld.gold: error: cannot find -lswiftCxxStdlib
/usr/bin/ld.gold: error: cannot find -lswiftCxx
/usr/bin/ld.gold: error: cannot find -lswiftCxxStdlib
/work/.build/aarch64-unknown-linux-gnu/release/Demo.build/Demo.swift.o:Demo.swift.o:function $s4Demo10WrapperCatCACyKcfc:(.text.$s4Demo10WrapperCatCACyKcfc+0x38): error: undefined reference to '$sSo3stdO7__cxx11O0071basic_stringCCharchar_traitsCCharallocatorCChar_mHGHsqaGJcraCCfsaqChraaV9CxxStdlibE13stringLiteralAFSS_tcfC'
/work/.build/aarch64-unknown-linux-gnu/release/Demo.build/Demo.swift.o:Demo.swift.o:function $s4Demo10WrapperCatCACyKcfc:(.text.$s4Demo10WrapperCatCACyKcfc+0x100): error: undefined reference to '$sSS9CxxStdlibEySSSo3stdO7__cxx11O0071basic_stringCCharchar_traitsCCharallocatorCChar_mHGHsqaGJcraCCfsaqChraaVcfC'

Reproduction
I have created a repository to reproduce the issue.
https://github.com/omochi/swift-bug-cxx-staticstd
You can replicate the problem using the following commands:
git clone https://github.com/omochi/swift-bug-cxx-staticstd
cd swift-bug-cxx-staticstd
docker run -it --rm -v$(pwd):/work -w /work swift:6.0.2 bash
# in container
swift build -c release --static-swift-stdlib -v
...
clang: error: linker command failed with exit code 1 (use -v to see invocation)

Expected behavior
Build completes successfully without errors.
Environment
Swift version 6.0.2 (swift-6.0.2-RELEASE)
Target: aarch64-unknown-linux-gnu

Additional information
By providing the search path with linker options as shown below, the build succeeds.
However, this is likely not the correct solution.
swift build -c release --static-swift-stdlib -v -Xlinker -L/usr/lib/swift/linux

Additionally, this might be a separate issue, but the linker command line includes a large number of repeated -lswiftCxx and -lswiftCxxStdlib flags.
In the provided sample, they appear twice each, but in my real project, they are repeated up to 16 times.

Known issue that was brought up in the forum weeks ago, @egorzhdan or @Xazax-hun, please take a look.


Contribute a Spring Boot Application

I want to contribute a spring boot application demonstrating the Restful CRUD APIs. Can I work on this? If yes then where should I put it Java_Imp->Spring Boot OR a New Folder(Spring Boot) on the main directory?

Add a new folder in  the main and name it as Java Framework and under that directory make a new folder(spring boot) and push the code @Anirban-Chand


EID-279: add validation of authn statement

Authors: @timwspence

Closing as directly merged to master (couldn't approve PR due to EID-285)


Add Skeleton example

Subject
Add Skeleton example
Description
Create a Skeleton example with Skeleton components.
https://yamada-ui.com/components/feedback/skeleton
Are you willing to participate in the development of this feature and create a pull request?
None

Can I try this?

Can I try this?

Yes!!
Good Luck!!

@illionillion
Like the components page of yamadaUI, shoud I create Change Colors, Change Size...　etc.?

@illionillion Like the components page of yamadaUI, shoud I create Change Colors, Change Size...　etc.?

I would like to see a component created that is unique, using Skeleton and nothing else, rather than copied straight from the documentation page.
For example, how about using Skeleton when loading the message list, or using Skeleton to create the state of AI during its generation?

@illionillion
I was thinking something like this.
Can I implement loading using Skeleton, Skeleton Text, Skeleton Circle. and place a reload button?

@illionillion I was thinking something like this. Can I implement loading using Skeleton, Skeleton Text, Skeleton Circle. and place a reload button?

I think that's fine.


fix ddp device_ids for cpu only

Sets DDP device_ids to None if not using GPUs, which enables running on CPU.

It looks good to me, I think we can merge it.