Proposal: A Slightly Less Imperative .feedbackHapticSelection Option

One of the most common times I find myself using a selection haptic is when I want to provide a user feedback upon tapping a button. I've been able to integrate Pow's new .changeEffect(.feedbackHapticSelection, value: someValue) really effectively in picker-type controls, but unfortunately a button tap an imperative action, which does not work great out the box with SwiftUI's and Pow's declarative APIs.
A workaround I came up with is to hold my own state, in a way that isn't particularly pretty (and seems to create some sort of extra tap once in a while for some reason I can't track down in my code.)
What I'm doing is

Creating a View that holds a Button.
Attach the changeEffect, based on some internal state keeping track of whether the haptic feedback is active.
When the user taps the button, call activateSelectionHaptic to set the haptic active, and set it inactive 0.5 seconds later.

@State private var isActive = false

var body: some View {
    Button("Selection Demo", action: {
        print("Selected!")

        Task { await self.activateSelectionHaptic(isActive: $isActive) }
    })
    .changeEffect(.feedbackHapticSelection, value: isActive == true, isEnabled: self.preferences.hasHapticsEnabled)
}

extension View {

    func activateSelectionHaptic(isActive: Binding<Bool>) async {
        isActive.wrappedValue = true
        do {
            try await Task.sleep(for: .seconds(0.5))
            isActive.wrappedValue = false
        } catch {
            isActive.wrappedValue = false
        }
    }

}

This isn't pretty but it does wrap up some logic that I found myself rewriting often. I was wondering if you had any ideas for how I could make this better, or perhaps with first party access include a more semantically viable version built into Pow?
Thank you as always!

Oh, and the self.preferences.hasHapticsEnabled shouldn't be needed as the change effect should be fire and forget (lmk if it's not).

I like the buttonStyle idea, that's something I hadn't considered but fits really nicely. I think I may be holding the selection feedback generator wrong though because I'm not getting the same effect. This is the ButtonStyle I created.
struct HapticFeedbackStyle: ButtonStyle {

    var isEnabled = false

    func makeBody(configuration: Configuration) -> some View {
        configuration.label
            .changeEffect(.feedbackHapticSelection, value: configuration.isPressed == true, isEnabled: isEnabled)
    }

}

The call-site looks like this.
Button(action: {
    debugButtonAction()
}, label: {
    Image.icons.debugCircleFilled
        .foregroundColor(palette.alternativeBackground)
})
.buttonStyle(HapticFeedbackStyle(isEnabled: self.preferences.hasHapticsEnabled))

Side note: self.preferences.hasHapticsEnabled is actually a condition in my app because the user can disable haptics entirely, so we can actually ignore that.

When I tap the button, it feels different than if you'd called selectionGenerator.selectionChanged() in the Button(action: {}) block.
I wouldn't be surprised if I was holding it wrong, but since I don't have source code access figured I'd ask here to see if this isn't how you intended it to be used.

Yeah, I think the different feel is isPressed changing twice, once when you tap and once when you let go.
Here's how I would write this using a PrimitiveButtonStyle:
import Pow
import SwiftUI

struct ContentView: View {
    @State
    var feedbackEnabled = true

    var body: some View {
        VStack {
            GroupBox {
                Toggle("Feedback", isOn: $feedbackEnabled)
            }

            Spacer()

            Button("Do Something") {
                print("done something")
            }

            Button("Do Something else") {
                print("done something else")
            }

            Spacer()
        }
        .environment(\.hapticFeedbackEnabledKey, feedbackEnabled)
        .buttonStyle(.feedback)
        .padding()
    }
}

struct FeedbackButtonStyle: PrimitiveButtonStyle {
    func makeBody(configuration: Configuration) -> some View {
        FeedbackButton(configuration: configuration)
    }
}

extension PrimitiveButtonStyle where Self == FeedbackButtonStyle {
    static var feedback: Self { FeedbackButtonStyle() }
}

// A separate view is required to get access to the environment.
private struct FeedbackButton: View {
    @Environment(\.hapticFeedbackEnabledKey)
    var hapticFeedbackEnabledKey

    @State
    // Alternatively, use a change tracking struct here.
    var interactionCount: Int = 0

    var configuration: PrimitiveButtonStyleConfiguration

    var body: some View {
        Button(role: configuration.role) {
            interactionCount += 1

            configuration.trigger()
        } label: {
            configuration.label
        }
        // You could style this yourself here, hardcode your preferred button
        // style or parameterize the view by it.
        .buttonStyle(.borderedProminent)
        .changeEffect(.feedbackHapticSelection, value: interactionCount, isEnabled: hapticFeedbackEnabledKey)
    }
}

extension EnvironmentValues {
    struct HapticFeedbackEnabledKey: EnvironmentKey {
        static var defaultValue: Bool = true
    }

    var hapticFeedbackEnabledKey: Bool {
        get { self[HapticFeedbackEnabledKey.self] }
        set { self[HapticFeedbackEnabledKey.self] = newValue }
    }
}

struct ContentView_Previews: PreviewProvider {
    static var previews: some View {
        ContentView()
    }
}

Hope this was improved by 0.2.0 – feel free to reopen if it's not :)


Interactive window creates two sysinfos

Testing #127378
Create IW from a code lens
Reload VS code
IW has two sys infos in it after it starts up

This is expected behavior. The second sys info gets inserted when the controller is selected for the interactive window after the reload.

From a user's perspective it seems off to me. Of course it's the same kernel, it was just using it. I believe you're saying the second sysinfo is indicating it reconnected?

Maybe it should have a 'reconnected' message instead?

We don't have the notion of reconnecting to a raw kernel afaik. Under the hood we actually kill and restart that raw kernel on the reload IIRC.


Issues with proxy authentication in backend STS

Azure Data Studio Version: main
OS Version: Windows 11

In a proxy enabled setup, where if proxy URL is specified in http.proxy setting and similar settings, the values don't pass through to backend STS service, leading to authentication issues when acquiring access token silently with MSAL.NET.
Mitigation:
Using http_proxy or https_poxy environment variables resolves issue.
Solution:
Pass Http Proxy settings to STS during initialization so http client instances can be made proxy-aware.

Closing as resolved.


userspace: Add --no-relax build option

In some architectures the linker performs global optimization relaxing address modes and changing instructions in the output object file. This is a problem when userspace is enabled since it assumes that addresses won't changes after certain build stage. In no supported architectures this option is ignored.
Signed-off-by: Flavio Ceolin<EMAIL_ADDRESS>

Adding --no-relax can reduce performance, as the linker is no longer able to substiture long / in-effective jump calls to shorter / more effective instructions.
So we should definitely mention this decrease in performance here:
https://github.com/zephyrproject-rtos/zephyr/blob/02d5290e070d13be39722596a1df99c260bae972/arch/Kconfig#L277
and probable also mention this somewhere in the docs: docs.zephyrproject.org/latest/kernel/usermode/index.html
Please try to find a suitable location for this piece of information in general docs.

That is a good point, but the performance penalty in this case is eclipsed by all other userspace required changes. I think a a comment in the code (together with the explanation why this is need) is enough. I mean, it is needed, we can afford the linker changing address so we can consider it as part of userspace "package".

@tejlmand can you review it again ?

but the performance penalty in this case is eclipsed by all other userspace required changes.

will it ? I'm not into the finer details on the userspace implementation, but my understanding is that naturally the multithreading itself is the costly part, the book keeping required for the userspace addition is not as costly. (I could of course be wrong on this)

I mean, it is needed, we can afford the linker changing address so we can consider it as part of userspace "package".

Of course we can afford it, we must afford. No question on that.
My comment is more related to the fact that enabling userspace results in extra degradation of performance, and this PR just revealed that such info is missing.
Of course any feature requires processing, but when we specifically requests the linker to not do an optimization, then I still think we should be clear on that. We cannot expect everyone to look into build files.
Thinking a bit more on this, and the fact that this is a linker optimization flag, then maybe a Kconfig for enabling (disabling) --no-relax is the best path forward. That would be clean, and allow features (not only userspace) to enable the linker flag, when there is a need. The userspace Kconfig feature can then do a select on the corresponding symbol.
Pros:

Feature / flag not limited to userspace
Having link optimization configurable similar to compiler optimization
No need to clutter userspace with description related to link flags.

Fair enough. I've added a Kconfig option for it. The default is using --relax.

If I understand the initial problem correctly then we want to enfurce the use of no relax when CONFIG_USERSPACE=y.
If that is the case, then you missed to do this comment:

We only need a LINKER_USE_NO_RELAX setting and then to update here:
https://github.com/zephyrproject-rtos/zephyr/blob/50274718e22a3757c79384e2b8a1f6c57d288a30/arch/Kconfig#L276
with a select LINKER_USE_NO_RELAX line to ensure this setting gets disabled when USERSPACE is enabled.

Ref: #53237 (review)

If I understand the initial problem correctly then we want to enfurce the use of no relax when CONFIG_USERSPACE=y.
If that is the case, then you missed to do this comment:

We only need a LINKER_USE_NO_RELAX setting and then to update here:
https://github.com/zephyrproject-rtos/zephyr/blob/50274718e22a3757c79384e2b8a1f6c57d288a30/arch/Kconfig#L276
with a select LINKER_USE_NO_RELAX line to ensure this setting gets disabled when USERSPACE is enabled.

Ref: #53237 (review)

:/ Oh man, forgot to push this. Thanks for checking it out !

lgtm, thanks for the effort +1

thank you !


fix: memory leak due not closed SQLite cursors

The cause of the problem can be visible when activating strict mode:

03-26 17:22:07.420 21166-21176/com.aida.one.debug E/StrictMode: Finalizing a Cursor that has not been deactivated or closed. database = /data/user/0/com.aida.one.debug/databases/apollo_cache_db, table = records, query = SELECT _id, key, record FROM records WHERE key = ?
                                                                android.database.sqlite.DatabaseObjectNotClosedException: Application did not close the cursor or database object that was opened here
                                                                    at android.database.sqlite.SQLiteCursor.<init>(SQLiteCursor.java:98)
                                                                    at android.database.sqlite.SQLiteDirectCursorDriver.query(SQLiteDirectCursorDriver.java:50)
                                                                    at android.database.sqlite.SQLiteDatabase.rawQueryWithFactory(SQLiteDatabase.java:1318)
                                                                    at android.database.sqlite.SQLiteDatabase.queryWithFactory(SQLiteDatabase.java:1165)
                                                                    at android.database.sqlite.SQLiteDatabase.query(SQLiteDatabase.java:1036)
                                                                    at android.database.sqlite.SQLiteDatabase.query(SQLiteDatabase.java:1204)
                                                                    at com.apollographql.apollo.cache.normalized.sql.SqlNormalizedCache.selectRecordForKey(SqlNormalizedCache.java:156)

build is not failing because of this PR, it's because the master was (and is still) broken


add headless windows

Description
Add headless windows test to test CI fails

Closing as will be superseded by #2223


Add support for Kafka 2.1.0

Doing the same thing as everything for 2.0.0, just for 2.1.0 now. Seems it passes tests...

Thank you for submitting this pull request, however I do not see a valid CLA on file for you. Before we can merge this request please visit https://yahoocla.herokuapp.com/ and agree to the terms. Thanks! :smile:


Fix issue 1124: Segmentation fault when using specific tables (#1125)

This is a fix for issue 1124 -
Segmentation fault when using specific names for tables.
This issue is due to an oversight of some very specific types of tables that are parameterless functions. The logic to walk through these nodes didn't expect them and would crash due to them.
This fix adds in code to skip over these types of tables.
Added regression tests.

Looks Good.


Update Sample Apps

These changes update, fix bugs in, and improve the sample apps.

Migrated example pods to Cocoapods for easier testing and debugging. (Ignore all .xcworkspace/xcodeproj files)
Migrate renames.
Fix / improve sample apps / SDK code:

Obj-C sample was missing deeplink handler for iOS 8
Add @discardableResult annotation to token manager methods, removing warnings for unused result values.
Fix crash from performing WebKit operation off main thread
Fix Ride Request Widget load errors.

The build failed because of this issue:
https://github.com/Carthage/Carthage/issues/1236
For now, will re-run the build so it passes.


Add more metrics to Grafana dashboards

The current set of Prometheus dashboards display a small fraction of the metrics Harvest collects.
We should consider:

culling metrics we don't plan on ever displaying
add useful ones to existing dashboards
make it easy for customers to decide on their own

I am working on this, I will commit new dashboards set in a couple of days

Covered


Substitute dash with n/a in the participants.tsv

Same issue was encountered with sct-testing-large.
See: https://github.com/ivadomed/ivadomed/issues/796

yes indeed. I will fix it.

@kousu should I work from my fork or is it better to create a branch on this repo ? I think we had issues in the past as in here.

Please work in a branch here.

this issue was already addressed. closing it.


Machine linux-5 lost connection from an external phone device.

Machine linux-5 lost connection from an external phone device.  It showed in machine linux-5 following errors below
[   12.929044] usb usb1-port5: Cannot enable. Maybe the USB cable is bad?
[   13.897036] usb usb1-port5: Cannot enable. Maybe the USB cable is bad?
[   13.897152] usb usb1-port5: attempt power cycle
[   14.941100] usb usb1-port5: Cannot enable. Maybe the USB cable is bad?
[   15.917093] usb usb1-port5: Cannot enable. Maybe the USB cable is bad?
[   15.917304] usb usb1-port5: unable to enumerate USB device
[   16.900845] usb usb1-port5: Cannot enable. Maybe the USB cable is bad?
[   17.873075] usb usb1-port5: Cannot enable. Maybe the USB cable is bad?

The external connection phone device has been restored by rebooting machine linux-5.
63.360266] usb 1-5: new high-speed USB device number 12 using xhci_hcd
[   63.509071] usb 1-5: New USB device found, idVendor=22b8, idProduct=2e76, bcdDevice= 3.10
[   63.509074] usb 1-5: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   63.509075] usb 1-5: Product: Moto G (4)
[   63.509076] usb 1-5: Manufacturer: motorola
[   63.509078] usb 1-5: SerialNumber: ZY223CXXGL


Allow HTML inside ion-option

Ionic version:  (check one with "x")
[ ] 1.x
[x] 2.x
I'm submitting a ...  (check one with "x")
[ ] bug report
[x] feature request
[ ] support request => Please do not submit support requests here, use one of these channels: https://forum.ionicframework.com/ or http://ionicworldwide.herokuapp.com/
Current behavior:
Right now ion-option is using this._elementRef.nativeElement.textContent so it only renders text.
Expected behavior:
Due to the way that ion-select works, I think it should be posible to use HTML as an option, for example for icons.
Steps to reproduce:

Related code:
text() => this._elementRef.nativeElement.textContent;

Other information:

I would love to create a PR if its aligned with how ion-option should work!
Ionic info: (run ionic info from a terminal/cmd prompt and paste output below):
insert the output from ionic info here

Hello, thanks for using Ionic! As this is not something we plan on doing anytime soon I am going to close this for now and move it to our internal feature tracking repo, but if you would like to do a PR for it then feel free too and we can evaluate it! Thanks.

This issue was moved to driftyco/ionic-feature-requests#20


AutocompleField uses wrong ES configuration

Issue Summary
Default configuration filters numbers so finding anything that starts with digits is impossible.
Steps to Reproduce

Create any indexable object where AutocompleField is configured.
Use digits in autocomplete source field (123Test)
Try to search against 123

See: https://stackoverflow.com/questions/13636419/elasticsearch-edgengrams-and-numbers

Context:
AutocompleFields end up defined with an _edgengrams suffix ([https://github.com/wagtail/wagtail/blob/13a350ed264e0857c81e4969946f1f7eae093b83/wagtail/search/backends/elasticsearch5.py#L126-L127)) which is configured with the "lowercase" tokenizer (https://github.com/wagtail/wagtail/blob/13a350ed264e0857c81e4969946f1f7eae093b83/wagtail/search/backends/elasticsearch5.py#L1060-L1064) which according to https://stackoverflow.com/questions/13636419/elasticsearch-edgengrams-and-numbers filters out digits
In the meantime, change this using the WAGTAILSEARCH_BACKENDS
# settings.py

WAGTAILSEARCH_BACKENDS = {
    "default": {
        ...,
        "INDEX_SETTINGS": {
            "settings": {
                "analysis": {
                    "analyzer": {
                        "edgengram_analyzer": {
                            "tokenizer": "standard",
                            "filter": ["asciifolding", "edgengram", "lowercase"],
                        }
                    }
                }
            }
        }
    }

We encounter the same problem and also updated the analyzers. I think its unexpected behavior that you can not search numbers like phone numbers.
Also this limit default support to only European languages: https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-letter-tokenizer.html. Standard tokenizer support more languages: https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-standard-tokenizer.html
We could keep lowercase support by using the lowercase filter.


Chinese language pack request

Dear Github Author,
I am a user of SD, and the updates of the interface has caused the prior version to be unusable. I do not quite understand the operation methods, so the new version cannot be translated into Chinese. If you could provide an additional Chinese translation package of the words and terms, I would be very grateful.
Thank you for your time and effort.

If you mean translated tags in general: #23 has files by another user. They both need "3-column translation format" checked to work:

Which should then work as expected:

The difference between the settings is just that the new way has <original>,<translation> while the old one had
<original>,<placeholder>,<translation> since it was based on another system originally.

Thank you for the advice!


Access Worn Inventories

There needs to be the ability to access the inventories of worn items, like backpacks and tool belts.
Requirements:

[x] Ability to access the contents of a worn inventory without unequipping it.

It is your choice how you want to implement this. The backpack or belt contents could always be displayed as a toolbar at the bottom of the screen, or you could open a UI element when clicking on the item in the character screen.

it could use some little button that appears in inventory slot window only for worn inventories

I'm going to attempt to work on this.
SS13:
Click with empty hand
ActivateItemInHand while holding Storage item
Dragging Storage item onto character
SS14:
Click with empty hand
ActivateItemInWorld while hovering over the Storage item
ActivateItemInHand while holding Storage item
Click the small storage icon

This appears to be completed. Nice Job!


Orginize imports when locklift using

Make an option in context menu for organizing imports when locklift using

Solved better way with https://github.com/tonlabs/everdev/pull/128


Group events take a while to detect

This seems to only happen on my High Sierra deployment. Maybe it just needs a reboot. Not totally sure. Works almost instantly on my macOS Catalina instance. Closing


ocamlPackages.uunf: re-generate source from the Unicode Character Database

Motivation for this change
Let’s hope this fixes the build on Aarch
Things done

[x] Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
Built on platform(s)

[x] NixOS
[ ] macOS
[ ] other Linux distributions

[ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[x] Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
[ ] Tested execution of all binary files (usually in ./result/bin/)
[ ] Determined the impact on package closure size (by running nix path-info -S before and after)
[ ] Ensured that relevant documentation is up to date
[x] Fits CONTRIBUTING.md.

@GrahamcOfBorg build ocamlPackages.uunf ocamlformat


XO should spawn with senior comms

Description

parity
Reproduction

spawn as XO, don't get senior comms
Screenshots

Additional context

parity

the XO WAS A STAFF OFFICER IN DISGUISE THIS ENTIRE TIME?!!


Update postgresql from 9.2.9 to latest 9.3.x or 9.4.x

Hi Chef team,
Is it possible to update postgresql in Chef Server 11 from 9.2.9 to latest 9.3.x or 9.4.x ?  Our product uses Chef 11 and doesn't want to upgrade from Chef 11 to 12 yet, and the security strategry is using postgresql 9.3.5 or 9.4.x (rather than 9.2.9 which is packaged in latest chef server)
Thanks.

@jessehu In the near term we are more likely to move to 9.2.10 (http://www.postgresql.org/docs/9.2/static/release-9-2-10.html). 9.2 receives security updates until Sept 2017.  Are there specific vulnerabilities that are addressed in 9.3/9.4 that aren't addressed in the latest 9.2 release?

Hi @stevendanna ,
I read the code and find that moving to postgresql 9.3/9.4 seems not a trivial effort.
As per this (http://www.postgresql.org/support/security/) link following CVE's which are fixed in 9.2.10.   Is there a ETA we move to 9.2.10 in Chef Server 11.x ? We really want this update to satisfy the security requirement.
CVE-2015-0241
CVE-2015-0242
CVE-2015-0243
CVE-2015-0244
CVE-2014-8161
CVE-2014-0067
Thanks a lot.

@jessehu Thank you for the research you put into this.  I've moved your ticket here: https://github.com/chef/chef-server/issues/181 as part of our new centralized repository.


Avoid panicking in tests

Using Gomega assertions makes test errors more readable in most cases.
Signed-off-by: Andrea Panattoni<EMAIL_ADDRESS>

Yep

/lgtm

@adrianchiris PTAL

@zeeke can you please have a look on the CI status?

Yes, It seems to be related to an incompatibility between GolangCI 1.29 and Go 1.18 as GolangCI actions v2 automatically checks out Go to the latest version.
I encountered the same problem in #205 and I think it's not related to the code changes themselves.
I fixed upgrading golangci to 1.49


Shift Enter on a file with cells runs the cell twice

See screenshot:

Result:

Looks to me like the same code is getting added twice.

This repros on any file with cells defined. If no cells, it works correctly.

Only happens with context menu


Default GetHashCode() is not repeatable

Expected
Default GetHashCode() invocations for classes having fields being custom classes should return same values for unchanged object.
Actual
Actually it returns different values.
Steps To Reproduce

	public class Bar {}

	class Foo {
		private object _bck = new Bar();
	}

	public class App
	{
		[Ready]
		public static void Main()
		{
			var foo = new Foo();
			var h1 = foo.GetHashCode();
			var h2 = foo.GetHashCode();

			Console.WriteLine(h1 != h2 ? "has bug" : "no bug");
		}
	}

Hi,
Solution proposal is in pull request #1265
I'm not able to tell if it doesn't break anything. This is due to Test\Batch1 and Test\Batch2 projects referencing unknown package "Bridge.Test". Do you have any idea if/when it will be released? Lack of it makes submitting patches uncomfortable...
Thanks
Dominik

Thank you for the report and submitting the pull request! We will review.

Do you have any idea if/when it will be released? Lack of it makes submitting patches uncomfortable...

Our apologies for the inconvenience. We are getting closer with releasing it. We'll tweet once it gets available.

Daniil,
That is good news.
Thanks!


Helm chart fails because of quotes for number in configMap

Provisioning fails with
Error: ConfigMap in version "v1" cannot be handled as a ConfigMap: v1.ConfigMap.Data: ReadString: expects " or n, but found 1, error found in #10 byte of ...|RVAL_MS":1000,"KAFKA|..., bigger context ...|-kafka-headless:9092","KAFKA_COMMIT_INTERVAL_MS":1000,"KAFKA_SCHEMA_REGISTRY_URL":"http://airy-cp-sc|...

Resolved.


Should public IP be associated with LoadBalancer ?

Hi,
In this document, after we created AKS, we also created public IP for App Service Extension but the IP is not associated with LoadBalancer.
aksClusterGroupName="<group-name>" # Name of resource group for the AKS cluster
aksName="${aksClusterGroupName}-aks" # Name of the AKS cluster
resourceLocation="eastus" # "eastus" or "westeurope"

az group create -g $aksClusterGroupName -l $resourceLocation
az aks create --resource-group $aksClusterGroupName --name $aksName --enable-aad --generate-ssh-keys
infra_rg=$(az aks show --resource-group $aksClusterGroupName --name $aksName --output tsv --query nodeResourceGroup)
az network public-ip create --resource-group $infra_rg --name MyPublicIP --sku STANDARD
staticIp=$(az network public-ip show --resource-group $infra_rg --name MyPublicIP --output tsv --query ipAddress)

Do we need some command to associate with AKS ? The last command failed with error Unable to find Kube Environment associated to the Custom Location
$ az webapp create \
>     --resource-group $groupName \
>     --name kemura-aks-app \
>     --custom-location $customLocationId \
>     --runtime 'NODE|12-lts'
The behavior of this command has been altered by the following extension: appservice-kube
Plan not specified. Creating Plan 'kemura-aks-app_plan_xxxxxxxxxxxx' with sku 'K1'
Unable to find Kube Environment associated to the Custom Location

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 95bceeac-dc48-471b-2d60-b7442b60ee06
Version Independent ID: a0381e86-0a67-19a3-eb35-f758ce1c2f2c
Content: Set up Azure Arc for App Service, Functions, and Logic Apps - Azure App Service
Content Source: articles/app-service/manage-create-arc-environment.md
Service: app-service
GitHub Login: @cephalin
Microsoft Alias: cephalin

Thanks for bringing this to our attention. We are actively investigating and will get back to you soon.

Hi, I found my mistakes and forgot some commands.


[BREAKING] Make packages (pandas) optional

I would like to change all dependencies except prqlc to optional so that we can install only what we need like pyprql[pandas] or pyprql[jupyter].
In many cases pandas are no longer needed, especially when polars are added to the dependency by #373.

One problem with using optional packages in pip is that they're quite rarely used — unlike rust. So IME most users aren't familiar with how to install them / that they should check which set of dependencies they want.
We do have prqlc itself if folks only want the compiler.
If there is a large enough use case for splitting the dependencies here, then OK, but otherwise I would leave away from it. Maybe pandas is that? But also most installations would have pandas anyway...

Just as great_tables recently removed both pandas and polars from its required dependencies (technically, it removed pandas, which was once a required dependency, to support polars-only installation), polars users may not want to install pandas.
Currently pyprql pulls pyarrow (including Acero) and duckdb, while these are completely unnecessary for users who want to use only polars.
As like the discussion of making pyarrow a required dependency of pandas seems to be (pandas-dev/pandas#57073), I think packages with huge binaries tend to be shunned.

Certainly jupysql and duckdb are worth keeping for now, but pandas is really unnecessary.
Users who need pandas should already have it installed and prql.pandas_accessor can only be used if an instance of pandas.DataFrame is created using pandas in the first place.

Users who need pandas should already have it installed and prql.pandas_accessor can only be used if an instance of pandas.DataFrame is created using pandas in the first place.

This is a very good point! Because this augments pandas' functionality but doesn't otherwise require pandas to work, we could even remove it from the dependencies all together. Then if someone has pandas / polars installed, this library augments that, otherwise it doesn't interfere by installing anything.
(We'd still have them in dev dependencies so tests can run etc. And OK if you prefer to have them as optional dependencies)


Lapce is missing icon in a lot of places for Gnome/Wayland

Lapce Version
0.2.6
System information
ArchLinux, running Gnome & Wayland
Describe the bug
Lapce icon is missing in activies view, application switcher, activities "dock" or top-side bar when lapce is on foreground.
It seems to be missing from everywhere excepted application list when pressing super key.
Additional information
Screenshot of some of the affected cases:

An interrelated issue is that new instances of the application can only be created from the original icon and not from a preexisting instance. In addition, these instances are treated as individual applications, so the multiple Lapce instances are shown individually on the application bar rather than once under the Lapce application icon.

The issue is that the app identifies itself to the compositor as lapce but the desktop entry is named dev.lapce.lapce.
> WAYLAND_DEBUG=1 lapce --wait |& grep app_id
[1675469.343]  -> xdg_toplevel@36.set_app_id("lapce")

Maybe it could help to add StartupWMClass ?

(For context, I reported it to the distro on https://bugs.archlinux.org/task/77772 as requested by @panekj on Matrix)

Fixed via #2228


display-parent-updates follow-up

display-parent-updates follow-up
First of all thank you for taking care of my PR #1016!
I noticed it has been release as 2.16.2 but I used 2.17.0 in at-since javadoc comments. If you care, I could file another PR to fix this. Just let me know.
Also I would like to discuss two ideas I had while implementing #1017.
Display- vs update goals.
For the display-*-updates goals which correspond 1:1 to an update-* goal - would't it make sense to replace the display goal with an additional property (displayOnly, or dryRun) in the update goal? This would eliminate a lot of  duplications.
Mojos/Goals we could refactor accordingly would be imo

update-parent and display-parent-update
update-properties and display-property-updates

Adopt Reports to the concept of Segments
org.codehaus.mojo.versions.api.Segment
Instead of filtering versions like in the display or update goal, I would suggest to report per Segment:
Example:
Current Version: 1.2.3
Latest Increment update: 1.2.4
Latest Minor update: 1.3.7
Latest Major update: 2.0.1

Hi there.

For the display--updates goals which correspond 1:1 to an update- goal - would't it make sense to replace the display goal with an additional property (displayOnly, or dryRun) in the update goal? This would eliminate a lot of duplications.

Implementation-wise, that would make sense indeed. However, most users don't pay close attention to changes in plugin as they mostly have it plugged into their CI/CD pipelines. Removing a goal or changing option semantics (even preceded by a deprecation) would eventually cause a barrage of bug reports with complaints about broken pipelines.
So, personally, I wouldn't introduce any breaking usage changes.

I noticed it has been release as 2.16.2 but I used 2.17.0 in at-since javadoc comments. If you care, I could file another PR to fix this. Just let me know.

I had a plan to bump project version to 2.17.0 .... but forgot about it,  @olamy  release next version as is ....
Master version should be always ready for release without magic - so it was my mistake 😢
Now we can update since tags to corresponding correct version 2.16.2 and with next release documentation will be ok.


Data Factory - Validation Error when trying to change PublicNetworkAccess

Bug Report

azure-sdk-for-go/services/datafactory/mgmt/2018-06-01/datafactory
SDK Version 48.1.0
go version go1.15 darwin/amd64

I'm trying to adjust just the PublicNetworkAccess Data Factory attribute but I'm getting a validation error
validation failed: parameter=factory.FactoryProperties.RepoConfiguration constraint=Null value=<nil> details: unknown type invalid

I'm not specifying a RepoConfiguration and a RepoConfiguration isn't needed to change PublicNetworkAccess. Digging into the sdk shows exactly where the validation error is.
The below is the payload I'd like to send
dataFactory := Factory{
		Location:          &location,
		FactoryProperties: &FactoryProperties{
                             PublicNetworkAccess: PublicNetworkAccessDisabled,
                 },
}

Hi @mbfrahry thanks for this issue!
I could tell that this should be a bug in the validation part of go-autorest. I will go through this and probably provide a valid fix for this.

This will require some changes in the code generator to fix.  In the meantime, I'm adding an escape-hatch to disable parameter validation https://github.com/Azure/go-autorest/pull/595

The flag to disable validation is in autorest/validation/v0.3.1
validation.Disabled = true

Reopen this issue since this is only resolved when a new package for data factory is released.


incorrect musl interpreter/loader chosen when cross compiling with PIE

What version of Go are you using (go version)?
go version go1.16.7 linux/arm64
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (go env)?
Alpine Linux, Edge
go env Output
GO111MODULE=""
GOARCH="arm64"
GOBIN=""
GOCACHE="/home/clayton/.cache/go-build"
GOENV="/home/clayton/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="arm64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/clayton/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/clayton/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/lib/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_arm64"
GOVCS=""
GOVERSION="go1.16.7"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/tmp/foo/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1367468762=/tmp/go-build -gno-record-gcc-switches"

What did you do?
$ cat main.go
package main

import "fmt"

func main() {
        fmt.Println("foo")
}

$ GOARCH=amd64 go build -buildmode=pie

What did you expect to see?
exe using the correct loader for the taget arch
What did you see instead?
$ file main
test: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-musl-aarch64.so.1, Go BuildID=5pIV1wbPZ4pH6rm5vEN9/bGZw1QTL944QcT3btQaA/ziMAbLCwuKttrRi0Aq6r/C8Xufy3gwfIwLIPE6IQj, not stripped

Seems like the fix for https://github.com/golang/go/issues/45034 doesn't work when cross compiling, since the test there fails to use the cross compiler (?)
Note that the info here is from an arm64 system, but the same issue occurs on x86_64 when, e.g. GOARCH=arm64 (it wrongly uses the path to a x86_64 loader)

Duplicate of #47760


Have to change present working directory to project in solution to use EF Core CLI tools

I have installed EF Core in a library project which is then referenced in my ASP.NET Core application.
When finally I got the package Microsoft.EntityFrameworkCore.Tools.Dotnet  installed, I was unable to use the dotnet ef commands until or unless I change my present working directory in Package Manager Console to that project.
Project Structure
`

Project

Project.Lib

Project.Data
Other Libraries

Project.Web

Project.Web.Portal
Other Web Projects
`

The present working directory is set to Project and the Default Project in Package Manager Console is set to Project.Data.
Steps to reproduce
Follow the project structure mentioned above and then try to run the following command after installing the Microsoft.EntityFrameworkCore.Tools.Dotnet package:
dotnet ef
Expected Behaviour
PM> dotnet ef

Entity Framework Core .NET Command Line Tools 1.0.1-rtm-10418

Usage: dotnet ef [options] [command]

Options:
  --version        Show version information
  -h|--help        Show help information
  -v|--verbose     Show verbose output.
  --no-color       Don't colorize output.
  --prefix-output  Prefix output with level.

Commands:
  database    Commands to manage the database.
  dbcontext   Commands to manage DbContext types.
  migrations  Commands to manage migrations.

Use "dotnet ef [command] --help" for more information about a command.
PM>

Current Behaviour
PM> dotnet ef
dotnet : No executable found matching command "dotnet-ef"
At line:1 char:1
+ dotnet ef
+ ~~~~~~~~~
    + CategoryInfo          : NotSpecified: (No executable f...and "dotnet-ef":String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError

Workaround
Change present working directory to Project.Lib/Project.Data:
PM> cd Project.Lib/Project.Data
Now If I use the dotnet ef command, it works perfectly fine.
Further Details
I'm creating this issue because, in Entity Framework 6, it doesn't matter in which project EF is installed. I could simply use EF 6 commands from the Package Manager Console without changing my present working directory. I just had to make sure the Default Project option of the Package Manager Console is set to the class library project which has EF 6 installed.
I'm curious whether this behavior is intended or a consequence of 'everything-as-a-package' pattern .NET Core follows.

We strongly recommend using the PMC commands (Add-Migration, Update-Database, etc.) inside package manager console since they provide a more integrated experience.

@bricelam Pardon my incompetence, but the PMC commands you mentioned are compatible with EF Core when used with the Npgsql Adapter? I didn't know this until now!

@roji Are you aware of any issues using the PMC commands with Npgsql?

@ajcvickers I admit I spend my time with the dotnet cli commands rather than Powershell, but I'm not aware of any issues... would definitely want to know if someone comes across any.

Thanks @roji
@humzakhan If PMC commands are not working for you, then could you file a new issue showing how to reproduce the problem and what error message and/or stack trace you see?

@tdykstra @Rick-Anderson It seems that none of the tutorials for ASP.NET Core show using of the PMC commands even when clicking on the link that says "using Visual Studio"--for example: https://docs.microsoft.com/en-us/aspnet/core/data/ef-mvc/migrations. We are wondering if this is contributing to the idea that the PMC commands do not work with EF Core? Where would be the best place to file an issue on this?
/cc @divega

@ajcvickers  My tutorial uses PMC - however I just added that a week ago. I know @tdykstra  planned on adding it to his. I created https://github.com/aspnet/Docs/issues/3747 to get PMC added to @tdykstra 's tutorial.

Okay, thanks @Rick-Anderson. Looks like you guys have it covered.

@ajcvickers Hello there, the PMC commands works perfectly fine. Just started to use them, and yes you're right, none of the tutorials available online use the PMC commands. All of them use the .NET CLI ones. This was the major reason I didn't know about their compatibility with EF Core and Npgsql.


Downloading https://www.openssl.org/source/openssl-1.0.2.tar.gz 404

执行 brew install libimobiledevice  在Terminal, ==> Installing libimobiledevice dependency: openssl
Warning: Building source; cellar of openssl's bottle is /usr/local/Cellar
==> Downloading https://www.openssl.org/source/openssl-1.0.2.tar.gz
curl: (22) The requested URL returned error: 404 Not Found
Trying a mirror...
==> Downloading https://raw.githubusercontent.com/DomT4/LibreMirror/master/OpenS
curl: (22) The requested URL returned error: 404 Not Found
Error: Failed to download resource "openssl"
Download failed: https://raw.githubusercontent.com/DomT4/LibreMirror/master/OpenSSL/openssl-1.0.2.tar.gz

应该和你的网络因素相关，可以自行google解决怎样安装libimobiledevice


Add option to disable volume normalisation

When playing an album like The Wall, the songs have very different dynamic ranges but smooth transitions and with volume normalisation it is painfully obvious that the song changes, because there is an audible cut to another volume
Describe the solution you'd like
Add a new Environment Variable e.g. DISABLE_VOLUME_NORMALISATION
# Start raspotify
if [[ $DISABLE_VOLUME_NORMALISATION == "1" ]]; then
  exec /usr/bin/librespot --name "$DEVICE_NAME" $SPOTIFY_BACKEND --bitrate 320 --cache /var/cache/raspotify --linear-volume --initial-volume=$SYSTEM_OUTPUT_VOLUME $SPOTIFY_CREDENTIALS $SPOTIFY_DEVICE
else
  exec /usr/bin/librespot --name "$DEVICE_NAME" $SPOTIFY_BACKEND --bitrate 320 --cache /var/cache/raspotify --enable-volume-normalisation --linear-volume --initial-volume=$SYSTEM_OUTPUT_VOLUME $SPOTIFY_CREDENTIALS $SPOTIFY_DEVICE
fi

Solved by #268


Add realm currency calculator

Screenshot:

I made some improvements to your PR:

Some UI improvements
Fixed textbox not being dynamically sized
Abstracted away textbox autosize logic from the calculator for code reuse
Added an estimator and a clear button
Ensured all inputs are validated and clamped in the possible ranges

If everything looks good after reviewing, please mark it as approved and I will merge!

Nice, really looking forward to this 🚀

please mark it as approved

I can't find an "approve" button.
Are you just asking if I approve these changes? This is your project, so I have no question with your changes.

I can't find an "approve" button.

I'm talking about "Approve Changes" button in the review pull request page. If you can't find it, no worries.

Are you just asking if I approve these changes? This is your project, so I have no question with your changes.

It doesn't hurt to have multiple reviewers even if it's the owner's code. I can make mistakes and introduce bugs too ;)


dask dev upstream test failiures

Our upstream tests fail due to a change in dask. The likely culprit is dask/dask#6680 - dask.array.zeros_like does now take the meta keyword and thus it tries to coerce str to a bool which fails (and it didn't do before).  Thanks @pentschev!


Secret keys are generated externally

Describe the bug
From examining https://github.com/nhsx/COVID-19-app-Android-BETA/blob/master/app/src/main/java/uk/nhs/nhsx/sonar/android/app/registration/ResidentApi.kt#L46 it appears that the app relies on an external HTTP server to generate a key pair, which it then stores:
fun confirmDevice(deviceConfirmation: DeviceConfirmation): Promise<Registration> {
    ....
    val request = HttpRequest(POST, "$baseUrl/api/devices", requestJson)

    return httpClient
        .send(request)
        .map { json: JSONObject ->
            val key = json.getString("secretKey")
            val publicKey = json.getString("publicKey")
            ...
            keyStorage.storeServerPublicKey(publicKey)
            keyStorage.storeSecretKey(key)
            ...
        }
}

Since this key pair was generated by an external service the "private" key is, by definition, not private.
This implementation flaw is separate from the basic design flaw of any centralised approach to contact tracing.  The basic design flaw allows a government to trace the movements and meetings of its citizens.  This implementation flaw additionally allows the government to forge records of such movements and meetings, and to create valid digital signatures for the forged records.

The app should instead be generating a key pair locally.  It should then create a signature over its own public key using the corresponding private key, and then communicate only the public key and the signature (to prove ownership of the corresponding private key).  The private key itself should never leave the device.  See, for example, the way that SubjectPublicKeyInfo is signed in an X.509 certificate, or the way that a SeedReport is signed in the decentralised contact-tracing CX protocol (https://github.com/ipxe/cx/releases/download/v0.10.1/cx.pdf section 5.3).

This matches the design here - https://www.ncsc.gov.uk/files/NHS-app-security-paper V0.1.pdf
"Device contacts the registration service with the activation code, which returns the InstallationID and symmetric key."
The symmetric key is called the secret key in the code, so please review the PDF to understand how it's used and why it is server-generated.

Reading through what little documentation we have, and through the codebase itself of the application, it seems like this "Secret Key" is the key used to create the HMAC signature sent as part of the Bluetooth transmissions, not a private key within a Public-Private keypair. This is most likely the "Symmetric Key" detailed in https://www.ncsc.gov.uk/files/NHS-app-security-paper V0.1.pdf The following are the handful of uses I could find for the key - do let me know if there's any I've missed:
https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a167f8dba422fd9001b64f9c4fd82275abb1c8/app/src/main/java/uk/nhs/nhsx/sonar/android/app/crypto/BluetoothIdSigner.kt#L11-L24
https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a167f8dba422fd9001b64f9c4fd82275abb1c8/app/src/main/java/uk/nhs/nhsx/sonar/android/app/referencecode/ReferenceCodeApi.kt#L15-L31
https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a167f8dba422fd9001b64f9c4fd82275abb1c8/app/src/main/java/uk/nhs/nhsx/sonar/android/app/diagnose/review/CoLocationApi.kt#L16-L33
A HMAC key needs to be known by both parties in order to verify messages using it - and I assume they decided assigning a valid one for each user would be less risky than having a user provide their own initially.
There may be other issues here - but the transfer of the private part of a keypair without any protection doesn't seem to be one of them

Reading through what documentation we have, and through the codebase itself of the application, it seems like this "Secret Key" is the key used to create the HMAC signature sent as part of the Bluetooth transmissions, not a private key within a Public-Private keypair. This is most likely the "Symmetric Key" detailed in https://www.ncsc.gov.uk/files/NHS-app-security-paper V0.1.pdf

You're right, but this makes the issue worse than initially reported.  There seems to be nothing within the protocol that allows for verification that the Bluetooth message was originally generated by the device itself rather than by something with access to the central server's database and hence access to the "Symmetric Key".
The message content proves ownership of the key pair Priv_Device,t and Pub_Device,t used to generate the message, but the only guarantee that this key pair was actually generated by the device corresponding to InstallationID comes from the HMAC signature by the "Symmetric Key".  Since the central server knows the value of "Symmetric Key", it can produce validly signed messages for a forged key pair Priv_Device,forged and Pub_Device,forged.
The ability for the central authority to forge validly signed Bluetooth messages remains.  You have shown that fixing this issue will require a wire-level change to the Bluetooth message format, rather than requiring only a change to the registration HTTP API.

This assumes that there are no constraints on the ephemeral key pairs chosen by the device.  The code that generates them in EphemeralKeyProvider accepts no outside parameters, so it seems safe to assume that it is generating completely arbitrary keys.

The messages are authenticated for the benefit of the central server. What would be the use of that server faking its own data?

The messages are authenticated for the benefit of the central server. What would be the use of that server faking its own data?

The threat model is not the central server faking data for its own consumption.  The threat model is a malicious attacker (e.g. a criminal or state actor) who gains read access to the central server's database.
As a relatively benign example: suppose that I compromise the central server and thereby gain access to your Installation ID and Symmetric Key.  I can then impersonate you.  I can wander around transmitting Bluetooth messages that will be recorded by other app users.  The central server will treat every single one of my forged messages as legitimately having been sent by you.  There is no way for it to know otherwise.
As a slightly less benign example: suppose that I am a state actor wishing to forge an evidence trail for a suspect I wish to frame for a crime.  I access the database and then do exactly the same thing: I transmit Bluetooth messages in the location of my choosing.  I later use the digitally signed messages recorded by other app users as evidence of the suspect's location at trial.
A general principle is that a compromise of an authentication token database should not allow for impersonation using the compromised tokens.  This is why, for example, password databases store hashed passwords rather than plaintext passwords.  Knowledge of the hashed password allows you to verify the password, but does not (directly) help you to discover the plaintext password itself.
It's the same principle at work here.  The central server requires only the knowledge of how to verify the received messages.  In the current design (which chooses a shared symmetric key), it also has the knowledge of how to sign messages.  This is the design flaw that leads to the attack.

You're right that this makes it unsuitable as a forensic audit log.

You're right that this makes it unsuitable as a forensic audit log.

A tool such as this, if it ever gets sufficiently wide adoption, will be treated as though the data captured is trustworthy, and will inevitably see its data (ab)used in scenarios other than the original use case.
There are two options to solve this issue:

Fix the protocol so that the central server never possesses the knowledge required to sign messages, as outlined in my original post.
Fix the whole of society, the government, and the justice system so that they will understand the precise implications of a particular digital signature scheme, and will not treat the signatures as conveying any significance.

Option 1 is an irritating fix to have to make but is entirely possible, assuming that the protocol was designed in a way that allows for protocol versioning.  (If it doesn't, then that's an even bigger problem.)
Option 2 is never going to happen.

I have to agree with mcb30 here, this creates an unacceptable long term risk to the public and is entirely, easily avoidable.

Using a public/private key pair to transmit a symmetric key is fine in the sense that the transmission of the symmetric key is secure, how long the symmetric key is allowed to be used though is important. If the permitted session length is very short then this limits the damage that could be done by the key being discovered. That being said, from reading the documentation the symmetric key in question is intended to be used to authenticate the device,
Another approach perhaps could be that during app registration the device generates a random series of characters (i.e. a strong password) and submits it to the server (in plaintext) which stores a hash of it. When the device then sends future submissions to the server it includes its plaintext password along with them.

@mcb30 it's explicitly described in the documentation as a symmetric key. Someone would need to read only particular lines of code out of context to believe the server doesn't know it. In other protocols, a shared HMAC is used to claim plausible deniability.
It's also not as simple a change as it sounds. The server still needs to authenticate messages, so a signature will add 512 bits to the 1024-bit payload. To prevent an attacker reusing a signature, BV would need to be re-signed more frequently than every 24 hours, which consumes battery. The new public key must be protected to prevent tracking, but must also be revealed to dispute the forged signatures. And this still doesn't cover what happens when it's uninstalled, or the more likely attack of rebroadcasting messages in realtime.
The risk to the public from abusing data should be tackled by legislation, as demanded by JCHR https://committees.parliament.uk/committee/93/human-rights-joint-committee/news/146351/report-on-the-contact-tracing-app-published/

Shouldn't the device generate the private/public key locally and issue the public key back to the server on registration? I'm not sure I follow why the server must have access to that private key

@Xenoamor it's not a keypair, but a shared secret, effectively being used by the server to send itself messages via the bluetooth messages received on people's phones. As a result, the server is trusting devices, not the other way around.

The threat model is not the central server faking data for its own consumption. The threat model is a malicious attacker (e.g. a criminal or state actor) who gains read access to the central server's database.

I am going to raise this point at https://hackerone.com/nhscovid19app. Would you mind contributing there too? I ask because although understood your point generally, to be honest you illustrated the technical details better than I can.

@mcb30 it's explicitly described in the documentation as a symmetric key. Someone would need to read only particular lines of code out of context to believe the server doesn't know it. In other protocols, a shared HMAC is used to claim plausible deniability.

@marksteward Then let's see an official government statement acknowledging in writing that the protocol is explicitly designed to allow message forgery (which is precisely the same thing as "plausible deniability"), and that any recorded messages have zero evidentiary value and are inadmissible in court.

It's also not as simple a change as it sounds. The server still needs to authenticate messages, so a signature will add 512 bits to the 1024-bit payload. To prevent an attacker reusing a signature, BV would need to be re-signed more frequently than every 24 hours, which consumes battery. The new public key must be protected to prevent tracking, but must also be revealed to dispute the forged signatures.

Then choose a signature scheme that doesn't require the ability to verify the message signature before it becomes necessary to do so!
CX solves the equivalent problem by having the transmitting device retain its secret until an explicit disclosure event takes place (e.g. an infected person choosing to disclose the RNG seed from which their messages were generated), by deriving the initial secret in a way that allows for proof of ownership, and by ceasing transmission from that secret as soon as disclosure takes place.  Read sections 4 and 5 of the specification document for the implementation details.
There is simply no need for the server to be able to verify messages prior to the disclosure event.  You don't need to (and should not) choose a signature scheme that requires this unnecessary ability.

The risk to the public from abusing data should be tackled by legislation, as demanded by JCHR https://committees.parliament.uk/committee/93/human-rights-joint-committee/news/146351/report-on-the-contact-tracing-app-published/

I don't disagree that legislative protection is important, but that doesn't remove the need for technical protection.  We have the Computer Misuse Act that makes unauthorised access a criminal offence and therefore gives us legislative protection, but we still use passwords.

I am going to raise this point at https://hackerone.com/nhscovid19app. Would you mind contributing there too? I ask because although understood your point generally, to be honest you illustrated the technical details better than I can.

@adarrel753 Sure; just CC me on whatever you submit.  You can find my e-mail address in many git commit logs :slightly_smiling_face:

I am going to raise this point at https://hackerone.com/nhscovid19app. Would you mind contributing there too? I ask because although understood your point generally, to be honest you illustrated the technical details better than I can.

@adarrel753 Sure; just CC me on whatever you submit. You can find my e-mail address in many git commit logs

Nice one. Here you go: https://hackerone.com/reports/870145

Nice one. Here you go: https://hackerone.com/reports/870145

Thank you.  I get an "Oops! You can't access this report because it isn't public yet" error.  Could you add me to the authorised user list (or whatever action is required by HackerOne)?  Thanks.

Please keep this thread updated. You can't read the other site without logging in.

Haven't heard anything yet to suggest that NHSX is planning to fix this security vulnerability.

Sounds like most of it is being canned in favour of moving to the Google/Apple system, that's probably why.

I've not heard news of that. Was this in the roadmap leak from yesterday?

It's been reported, e.g. today: https://www.theguardian.com/world/2020/may/14/nhs-coronavirus-advisory-board-split-over-ditching-government-app

Lots of silence around tihs fairly fundamental design flaw, especially considering the timescales in question...

I don't think it's a big problem, most database systems I have worked with have several layers of security in place anyway, so that one part can be taken down temporarily for maintenance without jeopardising the whole system.

By that argument, why not store everything in plaintext?

I just dont see how this security flaw represents a serious risk to its end-users

I don't think it's a big problem, most database systems I have worked with have several layers of security in place anyway, so that one part can be taken down temporarily for maintenance without jeopardising the whole system.

This is the only layer of security in terms of asserting authenticity of the messages, and it's broken by design.

I just dont see how this security flaw represents a serious risk to its end-users

I already described the threat in my comment above: https://github.com/nhsx/COVID-19-app-Android-BETA/issues/14#issuecomment-626193757

Lots of silence around tihs fairly fundamental design flaw, especially considering the timescales in question...

It's not a flaw, @mcb30 is conflating the design of a decentralised protocol (like CX) with a centralised one. In particular:

There is simply no need for the server to be able to verify messages prior to the disclosure event. You don't need to (and should not) choose a signature scheme that requires this unnecessary ability.

In a centralised model, proximity events are uploaded on disclosure. If the server can't verify these on its own, it must reach out to each contact, stalling the notification cascade that's a central goal of this design.
As an aside, the CX protocol allows anyone (including authorities) to forge proximity messages after disclosure. It could fix this by including a signature in every broadcast, but I suspect it's also by design.

Once the device has completed registration the server could generate a hash of the shared secret (which happens to be a symmetric key in this NHS app), store the hash and then destroy it's own copy of the raw key/secret. Then, when a device submits its payload (contact history) the server could authenticate each contact event by generating a hash for the key that is in the contact event record and compare it with the hash that server stored during the registration of that device (Installation ID).
Although (for each device) the server will have knowledge of the key in its raw form briefly during registration, it does not need to store it in its raw form.

As an aside, the CX protocol allows anyone (including authorities) to forge proximity messages after disclosure. It could fix this by including a signature in every broadcast, but I suspect it's also by design.

@marksteward I think you've misunderstood what "disclosure" means.  It's not the broadcast of the Bluetooth packet: it's the decision to disclose some information that was previously kept secret (the Seed Value, in the case of CX).  Section 5 of the CX spec (https://github.com/ipxe/cx/releases/download/v0.10.1/cx.pdf) clearly states:

The act of sending a Seed Report is a deliberate disclosure of a set of Preseed Values and Seed Values. Once the Seed Report has been sent, the included Preseed Values (and the derived Seed Values) are no longer private to the Advertiser.
An Advertiser MUST NOT transmit any Contact Identifiers generated by a Generator instance once the Seed Report corresponding to that Generator’s Seed Value has been sent. An Advertiser SHOULD immediately construct a new Seed Value as described in section 4 and continue by transmitting Contact Identifiers generated from the new Seed Value.

Once this disclosure has taken place (i.e. once anyone other than the device owner knows the Seed Value) then the Seed Value is exhausted: any further transmissions derived from that Seed Value will be ignored by all devices.

I like the idea of the seed value, it would mean you're basically unknown to the decentralised system until you reveal the value.
Doesn't the current system issue you a value every day or something so you're identifiable in other people's data before reporting (to the decentralised server)?

For those that haven't already seen it, there's an NCSC blog post about the security questions raised.
https://www.ncsc.gov.uk/blog-post/nhs-covid-19-app-security-two-weeks-on

@edent Thanks for the link.  Good to see that this problem is at least recognised in the report at https://github.com/vteague/contactTracing/blob/master/blog/2020-05-19UKContactTracing.md#InstallationID-HMAC
The report then says that "NCSC have confirmed that there were existing plans to refine the registration process".  Do you have any information about the new registration process that will be used?

The general logic that MACs are plausibly deniable is sound, but I still don't think the server needs to know the signing key.
Unless I've misunderstood: The purpose of signing the bluetooth transmissions is to prevent replay attacks. The harms of a replay attack seem to mostly fall on the user: they may falsely believe they have been in proximity to someone with COVID-19. Hence, only the user needs to know the HMAC signing key. The server can send them any proximity events that matches their ID, along with the associated MACs; the user's app then checks the MACs, and ignores them if they don't match their MAC signing key. If the app generates a fresh MAC signing key every 24 hours, and keeps 2 weeks of these keys, then it provides authenticity to the user while also maintaining complete deniability: since no one but the user's app knows the MAC key, then the MAC itself is meaningless noise once the user deletes the key.
Why does the server need to authenticate proximity events? Besides a DDoS attack on the user by flooding the the server with fake proximity events, which it will forward to the user's app, which must process and discard them.
This also means that a contact event is deniable, even to the server, unless the user decides to admit that a contact event is genuine. This adds another type of privacy.

I'm pasting this message in every active GitHub issue, so you may receive duplicate notifications.
Today, I'm happy to announce that NHSX has released the full git commit history for the Isle of Wight Beta apps.

Android - https://github.com/nhsx/COVID-19-app-Android-BETA
iOS - https://github.com/nhsx/COVID-19-app-iOS-BETA

As discussed, we have redacted API keys, sensitive domain names, and some of the developers' personal details. I am still waiting on final approval to publish the server-side code.
I would like to personally thank the community for your comments, bug reports, and vulnerability disclosures. They all went into helping the development process.
The beta trial of this app has now ended and we've moved to the next phase of app development. It is our intention to publish the source code of future apps as the binaries are released to the public.
Once again, thank you for being part of this.
Terence Eden
Head of Open Technology - NHSX


bug(router-vite-plugin): experimental.enableCodeSplitting nextCreate is not a function

Describe the bug
Using the experimental.enableCodeSplitting flag, when you use a named inline function (instead of an arrow function), an error is thrown in both development and production.
This is the error that is thrown.
nextCreate is not a function

This error is not triggered when you use a traditional inline arrow function.
Reproduction
https://stackblitz.com/edit/github-is6hai?file=src%2Froutes%2Fabout.tsx
Reproduction steps

Go to the 'About' page.
See the error being printed to the console.

Expected behavior
Not sure what should be the 'expected behaviour', but figured I should point this out before take the feature out of experimental status.
IMO: This is not urgent, with a simple enough workaround of converting the inline-named functions to inline-arrow functions.
Platform

OS: macOS
Browser: Chrome/Arc
TanStack React Router Version: 1.26.7
TanStack Router Vite Plugin Version: 1.26.6

Currently
this
  const value = React.useMemo(function somethingHere() {
    return 'memoed-value';
  }, []);

compiles to
const value = React.useMemo([]);

The issue lies in eliminateUnreferencedIdentifiers.
If this is commented out in compilers.ts,  the function is not removed and the error does not occur.

I released a new version, did that help at all? I was noticing an issue with array destructuring as well.

I released a new version, did that help at all? I was noticing an issue with array destructuring as well.

no same problem exists in v1.26.8
https://stackblitz.com/edit/github-is6hai-wa51rg?file=package.json

Did a bit of debugging and figured it out.
If this line in the getIdentifier function is modified to include this, then this gets resolved.
if (path.node.type === 'ArrowFunctionExpression' || path.node.type === 'FunctionExpression') {
    return null
  }

Alternatively, in the isIdentifierReferenced function, you could add a check before this line to check if a FunctionExpression is a child of a CallExpression.
function isIdentifierReferenced(
  ident: NodePath<BabelTypes.Identifier>,
): boolean {
  const binding = ident.scope.getBinding(ident.node.name)

  if (
    binding?.path.node.type === 'FunctionExpression' &&
    binding.path.parentPath?.node.type === 'CallExpression'
  ) {
    return true
  }
 // ...
}

@tannerlinsley I'm hesitant to add a PR for this since testing pretty much breaks as some files rely on some absolute pathing for the tests to pass.
This was the test I used to validate that this worked.
// tests/test-files/functionAsParameter.tsx
import * as React from 'react'

const value = React.useMemo(function performAction() {
  return 'true'
}, [])

console.log(value)

const value2 = React.useMemo(() => {
  return 'true'
}, [])

console.log(value2)


Correctly handle internal magnetometer rotations

@priseborough @LorenzMeier This properly fixes #7325. Please test.

I've tested this with internal and external mags and it all worked out. Thanks!

@priseborough @sirPerna Could you please cross-test with master / developer build?


[reg] First step to adding device integrity check

Add device side integrity checker
Add host side command integrity generation, but host side checking is missing.

o yeah i added that in because somehow the pattgen reg files got out of date, and then this caused a CI build failure because certain signals were missing.  Should i do that as a separate PR?

nah.. that's fine. Thanks!


net::ERR_FAILED 413 (Payload Too Large)

Hi @jw-12138,
Appreciate your efforts with the r2-uploader, I love it!
Sadly, there appears to be an issue with larger files. I'm attempting to upload a file 240.3MB (227,084,287 bytes). It hangs on the status bar and after some time, in the console I see net::ERR_FAILED 413 (Payload Too Large). Have attempted to use this in different browsers also (Chrome and Safari, same issue).
The file works through the Cloudflare uploader.
Possibly something has changed on the Cloudflare side as I see in the readme, references to this supporting files > 300MB.
Many Thanks
James

this is indeed a problem, cloudflare workers have a strict body size limit around 100mb (for both free and pro plan), meaning any file that's over this limit will trigger 413 error.
i'll see what i can do!

If you were to go down the server route on this, I can help create a Dockerfile to allow people to run the server locally conveniently as a single Docker command.
We could also look at taking this further as a Docker Desktop extension, allowing people to install this via the Docker Desktop marketplace for convenience as a single click.
They'd have their own private server from the Docker Desktop UI.
I've created a number of Docker Desktop extensions and published them so this bit, I can volunteer if it helps?

appreciate the will to help, after some drafting i found this might not be a good idea, people are downloading the files which they just uploaded, and it's making the pattern more complex. i need some time to think this through...

and i made a mistake, r2 can only be accessed via a worker or the s3-like api, so a server could never put the merged file directly into r2, meaning s3-like api is the only option left🥲, which is not what i prefer, cause there're already a lot of tools out there...
i'm sorry to let you know that this issue might get tagged with won't fix

It looks like there may be a way to perform multipart uploads, using the r2 worker api. The example is in python but I think this approach could possibly be implemented into the uploadFile function - https://developers.cloudflare.com/r2/api/workers/workers-multipart-usage/#perform-a-multipart-upload-with-your-worker-optional

I've experimented with GPT, referencing your existing upload function with a request to refactor, based on the approach from the r2 documented python multipart guide.
Here's the output in case any of this is re-usable in this exploration:
async function uploadFile(file) {
  let endPoint = localStorage.getItem('endPoint');
  let apiKey = localStorage.getItem('apiKey');

  if (!endPoint || !apiKey) {
    alert('Please set an endpoint and api key first.');
    return;
  }

  if (file['compressing'] !== undefined) {
    file.compressing = false;
  }

  const fileKey = renameFileWithRandomId.value ? file.id_key : file.key;
  let fileName = '/' + formatFileName(fileKey);
  if (endPoint[endPoint.length - 1] === '/') {
    fileName = formatFileName(fileKey);
  }

  const partSize = 10 * 1024 * 1024; // 10MB part size
  const totalSize = file.size;
  const totalParts = Math.ceil(totalSize / partSize);
  let uploadId;

  try {
    const createResponse = await axios.post(endPoint + fileName, {
      params: { action: 'mpu-create' },
      headers: { 'x-api-key': apiKey }
    });
    uploadId = createResponse.data.uploadId;
  } catch (error) {
    console.error('Error initiating multipart upload:', error);
    return;
  }

  const uploadPartPromises = [];
  for (let partNumber = 0; partNumber < totalParts; partNumber++) {
    const start = partNumber * partSize;
    const end = Math.min(start + partSize, totalSize);
    const blob = file.slice(start, end);

    const partPromise = axios.put(endPoint + fileName, blob, {
      params: { action: 'mpu-part', partNumber: partNumber + 1, uploadId: uploadId },
      headers: {
        'x-api-key': apiKey,
        'Content-Type': 'application/octet-stream',
        'Content-Range': `bytes ${start}-${end - 1}/${totalSize}`
      }
    }).then(response => ({ partNumber: partNumber + 1, etag: response.headers.etag }));

    uploadPartPromises.push(partPromise);
  }

  const parts = await Promise.all(uploadPartPromises);

  try {
    const completeResponse = await axios.post(endPoint + fileName, {
      params: { action: 'mpu-complete', uploadId: uploadId },
      headers: { 'x-api-key': apiKey },
      data: { parts: parts }
    });

    if (completeResponse.status_code === 200) {
      console.log('Multipart upload completed successfully');
    } else {
      console.error('Failed to complete multipart upload', completeResponse.data);
    }
  } catch (error) {
    console.error('Error completing multipart upload:', error);
  }
}

@spurin this is pretty much just what we talked before, multiple api calls to upload chunks, server side will have to handle the merge which is not possible with cloudflare workers.
now the best (also only) option is to integrate s3-like api with server-oriented code, and the deployment can be docker-ized just like you said, except that now the workers look like a joke...
i'll let you know when the new back-end is done, just don't expect me can do this in no time, kinda swamped recently (juggling a new job), but yeah, we are getting there!

Thanks so much for your detailed explanations. Initially I assumed that this functionality was native to the worker but, your diagrams helped.
After some experimentation today, I've been able to create a working proof of concept with the multipart functionality. I've raised a pull request with the changes here: https://github.com/jw-12138/r2-uploader/pull/5
Have also added guidance on how to run the project with Docker.
Hope this helps and thanks again for this project!

bucket.createMultipartUpload()
bucket. resumeMultipartUpload()
how the hell did i miss these 2 functions🫠, thank you for the PR! suddenly i got the hope to do this lol, the workers script will actually be refactored using hono and typescript, and i've already made some progress:

things left to do is to impleament some other APIs to handle multipart uploading which you have already wrote most of the code! and for the client side i'm thinking, we would still use the old upload api for files that's less than 100 mb, use multipart uploading api only when file is bigger than 100mb!
should be done in this weekend!

https://github.com/jw-12138/r2-uploader/assets/29943110/33f82f15-cda4-484c-bb3e-d1df617a0bb5
just couldn't wait, works like a charm, changes has been pushed, README will be updated later!

readme updated

Love this so much!
Was dreading the thought of having to go down the route of S3 tools and this interface, is so slick! It's the icing on the cake to see this working 👏
Thank you! Also, very kind of you to reference me on the contributor side!
I've not dug into the code implementation as yet but something to think about, if not already done is the retry logic for the failure of individual chunks. I think that the Python implementation may have had this.
By the way, please feel free to close the issue/pr whenever you're ready.

good point! i've added a retry mechanism, each chunk will now have 5 chances to retry the upload, when the chances go to 0, the UI will tell the user that the upload have failed, and they can choose whether to re-upload the whole file, or just remove that file from the queue.


Add follow-up blog post

Add follow-up blog post by Martin Björkström

:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

docs/reference/NuGet-Client-SDK.md
:white_check_mark:Succeeded
View

For more details, please refer to the build report.
Note: If you changed an existing file name or deleted a file, broken links in other files to the deleted or renamed file are listed only in the full build report.

Any chance we could get this merged? My series is getting a little stale and Martin's is both an alternate and probably better way to deal with packages from source. The sooner we get the word out, the better IMO.


Client: Design

Use this issue to discuss and propose designs views for the game client

What about a Balatro style ?


Project cost breakdown per ministry

Describe the Issue
Project cost breakdown per ministry
Additional Context
Add any other context, attachments or screenshots
Acceptance Criteria

[ ] Create cost breakdown per ministry
[ ] Review with Olena

Was completed and presented


Update bootstrap.sh to get the correct $max_num_pods for instance types f1.16xlarge, g3.16xlarge, h1.16xlarge, i3.16xlarge, and r4.16xlarge

Issue #, if available:
When running the the bootstrap.sh script with the instances f1.16xlarge, g3.16xlarge, h1.16xlarge, i3.16xlarge, and r4.16xlarge it would fail with the error:
line XXX: If: unbound variable
The error is happening because apart from the list of instances and the max number of pods the eni-max-pods.txt is also listing this instances at the beginning of the file in this note:
# If f1.16xlarge, g3.16xlarge, h1.16xlarge, i3.16xlarge, and r4.16xlarge
# instances use more than 31 IPv4 or IPv6 addresses per interface

Therefore the following lines of code fail
max_num_pods=$(cat /etc/eks/eni-max-pods.txt | grep $instance_type | awk '{print $2;}')
memory_to_reserve=$((11 * $max_num_pods + 255))

For example $instance_type  is replaced with  f1.16xlarge and we run the following commands the value for max_num_pods will be:
$ max_num_pods=$(cat /etc/eks/eni-max-pods.txt | grep r4.16xlarge | awk '{print $2;}')
$ echo $max_num_pods
If 452

instead of just 452
Description of changes:
I modified the function get_memory_mebibytes_to_reserve()
new one
get_memory_mebibytes_to_reserve() {
    local max_num_pods=$1
    memory_to_reserve=$((11 * $max_num_pods + 255))
    echo $memory_to_reserve
}

existent one
get_memory_mebibytes_to_reserve() {
    local instance_type=$1
    max_num_pods=$(cat /etc/eks/eni-max-pods.txt | grep $instance_type | awk '{print $2;}')
    memory_to_reserve=$((11 * $max_num_pods + 255))
    echo $memory_to_reserve
}

With this modification it will receive the max_num_pods value and in this way it will not need to calculate the max number of pods twice.
This lines will calculate the max number of pods, it checks that it starts with the instance type so it will no take the ocurrence in comments:
MAX_PODS_FILE="/etc/eks/eni-max-pods.txt"
set +o pipefail
MAX_PODS=$(cat $MAX_PODS_FILE | awk "/^$INSTANCE_TYPE/"' { print $2 }')
set -o pipefail
if [ -z "$MAX_PODS" ]; then
    echo 'No entry for $INSTANCE_TYPE in $MAX_PODS_FILE'
    exit 1
fi

I added to exit with an error if it does not find the instance type in the file, because if this is not included it will fail with with unbound error in the function get_memory_mebibytes_to_reserve(),
However, checked that according with this code that the idea is to continue setting the variables even if the instance type is not provided. My question in this point is which should be the best "default "value for mebibytes_to_reserve when the instance type is not in the list, as it is expected to be calculated base on the pod density on the nodes [1], and given that the instance features is very different from one type of instance to other. Do you think assume the bigger number of pods could be an option?
if [[ -n "$MAX_PODS" ]]; then
    echo "$(jq ".maxPods=$MAX_PODS" $KUBELET_CONFIG)" > $KUBELET_CONFIG
else
    echo "No entry for $INSTANCE_TYPE in $MAX_PODS_FILE. Not setting max pods for kubelet"
fi

Continue with the description of the changes I modified this line to pass $MAX_PODS instead of
new one
mebibytes_to_reserve=$(get_memory_mebibytes_to_reserve $MAX_PODS)

existent one
mebibytes_to_reserve=$(get_memory_mebibytes_to_reserve $INSTANCE_TYPE)

Finally, I remove the calculation of the pods in this section because it was calculated in the previous lines
new one
if [[ "$USE_MAX_PODS" = "true" ]]; then
    if [[ -n "$MAX_PODS" ]]; then
        echo "$(jq ".maxPods=$MAX_PODS" $KUBELET_CONFIG)" > $KUBELET_CONFIG
    else
        echo "No entry for $INSTANCE_TYPE in $MAX_PODS_FILE. Not setting max pods for kubelet"
    fi
fi

existent one
if [[ "$USE_MAX_PODS" = "true" ]]; then
    MAX_PODS_FILE="/etc/eks/eni-max-pods.txt"
    set +o pipefail
    MAX_PODS=$(grep ^$INSTANCE_TYPE $MAX_PODS_FILE | awk '{print $2}')
    set -o pipefail
    if [[ -n "$MAX_PODS" ]]; then
        echo "$(jq ".maxPods=$MAX_PODS" $KUBELET_CONFIG)" > $KUBELET_CONFIG
    else
        echo "No entry for $INSTANCE_TYPE in $MAX_PODS_FILE. Not setting max pods for kubelet"
    fi
fi

References:
[1] https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@dianibar-work Thank you for fixing this.


[ADD] New link for internet_of_things

Category Name
internet_of_things
Subcategory Name
arduino
Additional Context
Description
The subcategory contains link to Introduction to IOT with Arduino course for beginners by freecodecamp which is helpful for the beginners to start their career in field of IOT.
Link to the course
https://www.freecodecamp.org/news/create-your-own-electronics-with-arduino-full-course
Category
internet_of_things
Sub Category
arduino
Checklist

[X] I have checked the existing issues
[X] I have read the Contributing Guidelines
[ ] I have checked that this category does not exist
[X] I have checked that this subcategory does not exist
[X] I am willing to work on this issue (optional)
[X] I am participating in Hacktoberfest 2023

@subhayudutta
I have assigned you the issue. Please proceed with it, and don't hesitate to tag me @Anmol-Baranwal or @CBID2 if you require any assistance.


Bugfixes

-removed module drawing functionality
-cleaned up overly long/ugly lines
-cleaned up draw_glyph - delegated some repeated code to new helper functions
-corrected way in which interaction lengths can be adjusted: xy_skew was not appropriate for rotated interactions
-fixed and updated examples with new some pdfs + a gif for the animated CDS
-added documentation for label_parameters + small doc adjustments

This looks much better. There are still a couple names of parameters, etc that we probably should discuss a little further before the final release, but this fixes a lot of the outstanding issues.


mambaforge link is returning a 404

I'm getting this error when I try an action with mamba forge:
  Will fetch Miniforge3 Mambaforge from https://github.com/conda-forge/miniforge/releases/download/Mambaforge/Miniforge3-Mambaforge-Linux-x86_64.sh
  Ensuring Installer...
  Checking for cached<EMAIL_ADDRESS>  Did not find Miniforge3-Mambaforge-Linux-x86_64.sh Mambaforge in cache

Looks like the link is actually: https://github.com/conda-forge/miniforge/releases/latest/download/Mambaforge-Linux-x86_64.sh

What are the with inputs to your action?

Here they are:
- name: Setup Miniconda
  uses: conda-incubator/setup-miniconda@master
  with:
    activate-environment: separate
    environment-file: environment.yml
    auto-update-conda: false
    auto-activate-base: false
    python-version: 3.7
    use-only-tar-bz2: true
    miniforge-version: Mambaforge
    use-mamba: true

 miniforge-variant: Mambaforge
         # !version

🤦 ... Sorry.


Streamline Random Seeding

Currently: Random number generation happening in different places w or without a well-specified RNG. Work through repo to ensure all random numbers are generated with well-spec'd seeds.

Feature_streamlined_seeding


Windows XP Support?

I compiled an app and ran it on win xp, and dwmapi.dll missing error pops up. Simply putting the dll from the windows vista won't help, other errors follow. It's related with some composite window checks, I think.
Is it because of one of the dependencies - like winapi, or could it be fixed inside glutin??
I know xp is an ancient, unsupported os, but as long as the graphic driver support it, I'd like to see apps running on wide range of platforms.

I modified transparency-related code and removed dwmapi dependency, but now I get
thread panicked while processing panic. aborting.

Broken panic is due to rust-lang/rust/issues/34538
I debugged using gdb, and figured sync::mpsc is the one, as with the broken panic.
I guess it cannot be fixed until rust supports cond vars for xp


[Edit profile, edit photo] The uploading page isn't displayed after clicking on the 'Upload new photo' button

Environment: OS Windows 10 x64, Google Chrome 89.0.4389.128
Reproducible: always
Build found: 16.04.2021
Description:
The uploading page isn't implemented
Requirements describe in User Story's Change request which is linked to this bug report
Preconditions:

The User should be logged in GreenCity https://ita-social-projects.github.io/GreenCityClient/#/welcome

Steps to reproduce:

Click on the 'My habits' tab
Click on the 'Edit' button on the Profile section
Click on the 'Edit photo' button
Click on the 'Upload new photo' button
Pay attention to that file system of the user's computer opens instead of the uploading page

Actual result:
The file system of the user's computer is opened

Expected result:
The uploading page is opened

User story #1006
[Test case]
https://jira.softserve.academy/browse/GC-1566
https://jira.softserve.academy/browse/GC-1567
https://jira.softserve.academy/browse/GC-1580
https://jira.softserve.academy/browse/GC-1581
https://jira.softserve.academy/browse/GC-1591
https://jira.softserve.academy/browse/GC-1593

The bug is not fixed. The same problem appears.


Fix Java dependencies/host specifications

Checklist

[x] Used a personal fork of the feedstock to propose changes
[x] Bumped the build number (if the version is unchanged)
[ ] Reset the build number to 0 (if the version changed)
[x] Re-rendered with the latest conda-smithy (Use the phrase @conda-forge-admin, please rerender in a comment in this PR for automated rerendering)
[x] Ensured the license file is being packaged.

closing #2
closing #3

Hi! This is the friendly automated conda-forge-linting service.
I just wanted to let you know that I linted all conda-recipes in your PR (recipe) and found it was in an excellent condition.

@conda-forge-admin, please rerender

@conda-forge-admin, please rerender


Refactor method call logic

Currently the method call logic is put inside a function called thread.evalMethodObject. It contains arguments checking, error reporting and method evaluation logic (and other logics maybe). This is a huge code smell and should be fixed ASAP.
@shuheiktgw Do you want help with this?

Implemented in #462


feat(h): make h set attributes on custom-element via attributes prop

this is a breaking change by how attributes are set ( via attrs )
adds event setup via events

Closes #14

changes added. re - review pls @treshugart

Hey @Hotell instead of adding nits / codestyle stuff (that semistandard didn't seem to catch) I've just created a PR for some minor things rather than going back and forth or pushing directly to your branch. Cheers!

Approved pending other PR is either merged here, or this is merged and that is retargeted to master.


Move ISA-Tab templates into a separate repository (#96)

This is a pull request for #96.
The new separate template repo cubi-isa-templates can be found here.
This is still a draft, please comment or improve as you need fit. I haven't published the package on PyPI yet and I don't recommend merging this until there's a proper PyPI dependency.
I've been unable to test this locally because I run into some errors with varfish-cli dependencies (see below). Some cubi-tk expert might want to tell me what I'm doing wrong.

Getting the following conflict locally: pkg_resources.ContextualVersionConflict: (attrs 23.1.0 (/home/mikkopen/.virtualenvs/cubi-tk/lib/python3.8/site-packages), Requirement.parse('attrs<22.0,>=21.2.0'), {'varfish-cli'})
Once I attempt installing the expected depdndencies, the result is:
pkg_resources.ContextualVersionConflict: (attrs 23.1.0 (/home/mikkopen/.virtualenvs/cubi-tk/lib/python3.8/site-packages), Requirement.parse('attrs<22.0,>=21.2.0'), {'varfish-cli'})
Traceback (most recent call last):
  File "/home/mikkopen/.virtualenvs/cubi-tk/bin/cubi-tk", line 11, in <module>
    load_entry_point('cubi-tk', 'console_scripts', 'cubi-tk')()
  File "/home/mikkopen/.virtualenvs/cubi-tk/lib/python3.8/site-packages/pkg_resources/__init__.py", line 489, in load_entry_point
    return get_distribution(dist).load_entry_point(group, name)
  File "/home/mikkopen/.virtualenvs/cubi-tk/lib/python3.8/site-packages/pkg_resources/__init__.py", line 2852, in load_entry_point
    return ep.load()
  File "/home/mikkopen/.virtualenvs/cubi-tk/lib/python3.8/site-packages/pkg_resources/__init__.py", line 2443, in load
    return self.resolve()
  File "/home/mikkopen/.virtualenvs/cubi-tk/lib/python3.8/site-packages/pkg_resources/__init__.py", line 2449, in resolve
    module = __import__(self.module_name, fromlist=['__name__'], level=0)
  File "/home/mikkopen/code/cubi-tk/cubi_tk/__main__.py", line 26, in <module>
    from .sea_snap import run as run_sea_snap
  File "/home/mikkopen/code/cubi-tk/cubi_tk/sea_snap/__init__.py", line 26, in <module>
    from .itransfer_raw_data import setup_argparse as setup_argparse_itransfer_raw_data
  File "/home/mikkopen/code/cubi-tk/cubi_tk/sea_snap/itransfer_raw_data.py", line 7, in <module>
    from ..snappy.itransfer_common import SnappyItransferCommandBase
  File "/home/mikkopen/code/cubi-tk/cubi_tk/snappy/__init__.py", line 56, in <module>
    from .varfish_upload import setup_argparse as setup_argparse_varfish_upload
  File "/home/mikkopen/code/cubi-tk/cubi_tk/snappy/varfish_upload.py", line 11, in <module>
    from varfish_cli.__main__ import main as varfish_cli_main
  File "/home/mikkopen/.virtualenvs/cubi-tk/lib/python3.8/site-packages/varfish_cli/__main__.py", line 13, in <module>
    from varfish_cli.case import run as run_case
  File "/home/mikkopen/.virtualenvs/cubi-tk/lib/python3.8/site-packages/varfish_cli/case/__init__.py", line 9, in <module>
    from varfish_cli.case.list_case import setup_argparse as setup_argparse_list
  File "/home/mikkopen/.virtualenvs/cubi-tk/lib/python3.8/site-packages/varfish_cli/case/list_case.py", line 9, in <module>
    import attrs
ModuleNotFoundError: No module named 'attrs'


Validation failing

I've followed the example here, however I am getting an empty 204 No Content instead of a proper error message.
It's working as expected when I provide the name.
This is my resource method:
    @POST
    @Path("/register-user")
    public User registerUser(@Valid User user) {
        return user;
    }

This is my User model:
public class User {

    @NotEmpty
    private final String name;

    @JsonCreator
    public User(@JsonProperty("name") String name) {
        this.name = name;
    }

    @JsonProperty("name")
    public String getName() {
        return name;
    }

}

Am I doing something wrong, or is this not working as intended?

@Valid doesn't include a null-check, so maybe you want to add @NotNull to your method declaration.
If that's not what you mean, please elaborate on the problem and tell us which version of Dropwizard you're using and provide some example code.

I see. Adding @NotNull did the trick. I expected that it would be automatic since there is no default parameter. Thanks!


Enabling "Sticky Titles" makes the annotations invisible

After setting ControlPanel -> Appearance -> Theme Tweaks -> Sticky Titles to "Yes", all the word annotations and sentence excerpts became invisible, the text just shown as unannotated. Turning it off makes annotations work again.
The annotations of the Dynannotate Plugin itself were still working though, according to the provided examples.
Reproduction:

Download TiddlyMemo.html from the manual site
Import a book and split it
Annotate the text, the annotations visible
Enabling "Sticky Titles"
Save wiki and reopen the text, annotations become invisible

I tried it and it does have the problem you described.
Thanks for finding this bug!


validate source is string

avoids continual crashing if array is provided

@joeheaton
Can you please sign the CLA

@joeheaton - thanks, i will get this released soon.

this has been released in 1.0.2 , thanks again @joeheaton


Add test for SimpleSmartAnswer to Answer conversion

The functionality is already there, but there was no test coverage for it.
The ability to change a Simple Smart Answer to an Answer has been requested by the content team, and will require code changes in the publisher app.
Trello

I don't think that a test is needed for this because it is generic behaviour - if it had any custom behaviour, then there would be a stronger case for a test.

I dunno, I think this is valid as it ensures that this use case is compatible with the logic in the gem. It also asserts that the fields are being mapped correctly. Plus, more tests never* hurt.

I agree with @boffbowsh. I like that the test indicates there is no custom behaviour when converting a SimpleSmartAnswer.

I think I've figured out what was bothering me: the implementation seems unnecessarily complicated and specific. I've taken a stab at fixing it here: https://github.com/alphagov/govuk_content_models/pull/330
With my suggested change, perhaps we can more confidently provide an interface that lets users convert between any Edition type? If so, is this test still as valuable?


Prepare to add world generation

This will eventually add full world generation. For now, it's focusing on creating the infrastructure to do so:

Create a main menu with the ability to generate worlds.
Separate rendering and generation onto own threads (kinda hard!)
Make loading screens. In debug mode, they should have a little window with a camera that shows the generation progress. I might keep this for release builds - it should look cool!

You can see a list of the preliminary biomes in the generation module. These aren't from any other game - I just looked at Wikipedia and picked some fun ones!
My current plan is to have various layers of noise stemming from the seed. The seed doesn't provide as many options as I'd like as-is (only 4,294,967,296 combinations), so I might have to write my own version of noise :sweat_smile:

fair warning: this PR has a lot of foundational changes, so i'll merge it and make a new one


Allow storing snapshots outside of the session directory

This means that the snapshots can be stored on a different drive that is more suitable for persisting table snapshots.
The use case is a cloud instance where the local SSD should be considered ephemeral. Active tables can exist on the SSD, but persistent snapshots should live on a persistent network EBS volume.

With this feature, it allows multiple sessions to share the same snapshots dir, and thus be used from different processes that do not coordinate on the session or lock file. Thus, when implementing this, we should review the code to create, and delete snapshots to make sure it's safe to use from concurrent sessions.
This probably just means making sure that for creating snapshots we guarantee that the files are new (not existing), so any race results in the loosing side getting an exception. This can be done using the MustBeNew modifier to the OpenMode for the fs-api's hOpen.


Check node and broker id equality in KRaft mode on start up and not in broker.id setter

Fixes https://github.com/strimzi/test-container/issues/124

Also, there are a few checkstyle errors i.e.,
[ERROR] /home/vsts/work/1/s/src/test/java/io/strimzi/test/container/StrimziKafkaKraftContainerIT.java:139:35: Empty statement. [EmptyStatement]
[ERROR] /home/vsts/work/1/s/src/test/java/io/strimzi/test/container/StrimziKafkaKraftContainerIT.java:141: 'lambda arguments' has incorrect indentation level 16, expected level should be 12. [Indentation]

before you push always try to execute mvn clean install -DskipTests.

Also as you removed this one test case the mutation testing is failing because the average now of what is covered is less than it was before.
Line coverage of 71(326/459) is below threshold of 72

So please update it also in the pom.xml. Specifically here [1].
[1] - https://github.com/strimzi/test-container/blob/main/pom.xml#L458


print client/server version mismatch in arangosh

Scope & Purpose
Print a version mismatch (major/minor version difference) between the arangosh version and the remote arangod version at arangosh startup.

[ ] :hankey: Bugfix (requires CHANGELOG entry)
[x] :pizza: New feature (requires CHANGELOG entry, feature documentation and release notes)
[ ] :fire: Performance improvement
[ ] :hammer: Refactoring/simplification
[x] :book: CHANGELOG entry made

Backports:

[x] No backports required

Testing & Verification

[x] This change is a trivial rework / code cleanup without any test coverage.
[x] The behavior in this PR was manually tested

Link to Jenkins PR run:
http://<IP_ADDRESS>:8080/view/PR/job/arangodb-matrix-pr/13574/

Tests blue

Tests blue


Add missing files to release artifacts

Add amalgamated json_fwd.hpp to include.zip.
Should we add other files as well?

wsjcpp.yml (Probably.)
nlohmann_json.natvis (Not sure. Leaning toward no.)
(Generated Bazel build file)

Fixes #3727.

With regards to wsjcpp.yml, I just don't know if that file is required to consume a package with wsjcpp or if it's a recipe to produce a package for wsjcpp.

Confirming that single_include/nlohmann/json_fwd.hpp is added to include.zip:
$ make include.zip
(...)
  adding: single_include/nlohmann/json.hpp (deflated 85%)
  adding: single_include/nlohmann/json_fwd.hpp (deflated 74%)
  adding: meson.build (deflated 56%)
  adding: LICENSE.MIT (deflated 41%)

(Let's wait on #3709.)

Coverage remained the same at 100.0% when pulling 6e131c47afaad98cf47d3bf10f0312b8bc0fe53c on falbrechtskirchinger:add-missing-release-files into 307c053b9b250abc6e6d478a4336fd98592ae173 on nlohmann:develop.

Thanks!