Error of type -610

I followed the installation instructions but I'm getting the following errors and the install just hangs until I quit:
$ bazel run upvote/gae:monolith_binary.deploy -- "${PROJ_ID}" app.yaml
WARNING: /private/var/tmp/_bazel_seadmin/dc15004ff28b5d5c51a9b82d37540f68/external/com_google_protobuf_java/WORKSPACE:1: Workspace name in /private/var/tmp/_bazel_seadmin/dc15004ff28b5d5c51a9b82d37540f68/external/com_google_protobuf_java/WORKSPACE (@com_google_protobuf) does not match the name given in the repository's definition (@com_google_protobuf_java); this will cause a build error in future versions
INFO: Analysed target //upvote/gae:monolith_binary.deploy (1 packages loaded).
INFO: Found 1 target...
Target //upvote/gae:monolith_binary.deploy up-to-date:
  bazel-bin/upvote/gae/monolith_binary_deploy.sh
  bazel-bin/upvote/gae/monolith_binary.deploy
INFO: Elapsed time: 3.435s, Critical Path: 0.07s
INFO: 0 processes.
INFO: Build completed successfully, 1 total action

INFO: Running command line: bazel-bin/upvote/gae/monolith_binary.deploy upvote-205913 app.yaml
04:25 PM Application: upvote-205913 (was: auto); version: auto
04:25 PM Host: appengine.google.com
04:25 PM Starting update of app: upvote-205913, version: auto
04:25 PM Getting current resource limits.
0:370: execution error: An error of type -610 has occurred. (-610)
70:78: execution error: An error of type -610 has occurred. (-610)
69:77: execution error: An error of type -610 has occurred. (-610)
^C
Bazel caught interrupt signal; shutting down.

Here are my Basel and gcloud versions:
$ bazel version
Build label: 0.13.1-homebrew
Build target: bazel-out/darwin-opt/bin/src/main/java/com/google/devtools/build/lib/bazel/BazelServer_deploy.jar
Build time: Wed May 23 16:57:59 2018<PHONE_NUMBER>)
Build timestamp:<PHONE_NUMBER>
Build timestamp as int:<PHONE_NUMBER>

$ gcloud version
Google Cloud SDK 203.0.0
bq 2.0.34
core 2018.05.25
gsutil 4.31

Any ideas what's wrong?

may want to try with my update to the latest bazel appengine which uses gcloud deploy command instead of appcfg: https://github.com/farmersbusinessnetwork/upvote/commit/05abd2d1f9afb88e4b18528eafa3455ff4c072cf


exp/recoverysigner: improve PUT /accounts/{address} with a delta set

Why
Right now we are replacing the existing identifies and auth methods of an account with the incoming identities by deleting all identities of the account and re-insert the new identities, which can be optimized.
For example,
If the original identities are the following
"identities": [
		{
			"role": "owner",
			"auth_methods": [
				{ "type": "stellar_address", "value": "GBF3XFXGBGNQDN3HOSZ7NVRF6TJ2JOD5U6ELIWJOOEI6T5WKMQT2YSXQ" },
				{ "type": "phone_number", "value": "+10000000000" },
			]
		}
	]

updating it to become
"identities": [
		{
			"role": "owner",
			"auth_methods": [
				{ "type": "stellar_address", "value": "GBF3XFXGBGNQDN3HOSZ7NVRF6TJ2JOD5U6ELIWJOOEI6T5WKMQT2YSXQ" },
				{ "type": "phone_number", "value": "+10000000000" },
				{ "type": "email", "value"<EMAIL_ADDRESS>}
			]
		}
	]

should only involve one insertion to the auth_methods table (email, user1@example) as opposed to remove the existing 1 identity and 2 auth methods and insert 1 identity and 3 auth methods.
However given that the expected use cases currently only involves a small number of identities and auth methods, replacing one set with another isn't that costly.
Note that we can't really use UPDATE statement because there could be more than one rows with the same auth_method_type, account_id, identity_id. This means that changing an auth value requires a DELETE statement and an INSERT statement.
Constructing a delta set for this operation can only benefit some of the cases and is not straightforward to get right. Thus we are deferring this optimization.

Closing all recoverysigner issues


State machine Example Fix

Attempting to fix #327
While this resolves the issue of synchronizing states across all clients and host, we're 2 steps back with the state flickering after certain events such as landing a jump.

https://github.com/user-attachments/assets/8f1ed2c1-babb-4db2-b3eb-95cd3f4d61a4
Let me know if this solves the base issue and I'll address the other issues mentioned here and by BatteryAcidDev on discord.

Confirmed this is working just fine, even at high latency.


html2canvas not supported on Safari v13

I downloaded your release of html2canvas, it works perfectly on windows and android. But on IOS it canvas don't draw. Please help!

i'm using your version RC 5, but it don't draw anything, also tried your version rc 1 it works but the image is displaced transform: translateX doesn't work.

IOS it canvas don't draw~~~~~

no erro

it can't work in Wechat Browser on ios 13.4
but it can work in Safari
then I fork the project
bebug......
then found this line of code isn't valid
...no return ...no erro
// src/dom/document-cloner.ts
//  line 96
if (documentClone.fonts && documentClone.fonts.ready) {
       // await documentClone.fonts.ready;
 }

then I delete it
because i don't use web font
then
it's  work!!!
then i create a branch to use this
https://github.com/niklasvh/html2canvas
you can add this to your project, if you you need....
"html2canvas": "git+https://github.com/TuffyLiu/html2canvas.git#1.0.0-rc.6",''

Can you share with me the source script file? I can't find your
html2canvas.js rc 6 in your git thanks a lot!
On Thu, Mar 26, 2020 at 11:39 PM Tuffy<EMAIL_ADDRESS>wrote:

it can't work in Wechat Browser on ios 13.4
but it can work in Safari
then I fork the project
bebug......
then found this line of code isn't valid
...no return ...no erro
// src/dom/document-cloner.ts
//  line 96
if (documentClone.fonts && documentClone.fonts.ready) {
// await documentClone.fonts.ready;
}
then I delete it
because i don't use web font
then
it's work!!!
then i create a branch to use this
https://github.com/niklasvh/html2canvas
you can add this to your project, if you you need....
"html2canvas": "git+https://github.com/TuffyLiu/html2canvas.git#1.0.0-rc.6
",''
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/niklasvh/html2canvas/issues/2188#issuecomment-604502539,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AOKXD6YSNPCB3HQREUV5CSLRJNZL7ANCNFSM4LSKCG6A
.

I used your html2canvas.js but i doesn't work on any iPhone / ios related
devices handheld browsers / viber browsers. Can you please cite example or
instruction on how will i use your script? Or if it really works on any
browsers except for Wechat browser.
On Fri, Mar 27, 2020 at 10:39 AM Joshua Bernardo<EMAIL_ADDRESS>wrote:

Can you share with me the source script file? I can't find your
html2canvas.js rc 6 in your git thanks a lot!
On Thu, Mar 26, 2020 at 11:39 PM Tuffy<EMAIL_ADDRESS>wrote:

it can't work in Wechat Browser on ios 13.4
but it can work in Safari
then I fork the project
bebug......
then found this line of code isn't valid
...no return ...no erro
// src/dom/document-cloner.ts
//  line 96
if (documentClone.fonts && documentClone.fonts.ready) {
// await documentClone.fonts.ready;
}
then I delete it
because i don't use web font
then
it's work!!!
then i create a branch to use this
https://github.com/niklasvh/html2canvas
you can add this to your project, if you you need....
"html2canvas": "git+
https://github.com/TuffyLiu/html2canvas.git#1.0.0-rc.6",''
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/niklasvh/html2canvas/issues/2188#issuecomment-604502539,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AOKXD6YSNPCB3HQREUV5CSLRJNZL7ANCNFSM4LSKCG6A
.

https://github.com/TuffyLiu/html2canvas/releases

Yea that;s what i am using i downloaded that one, but it still didn't draw
canvas for me.
On Fri, Mar 27, 2020 at 2:02 PM Tuffy<EMAIL_ADDRESS>wrote:

https://github.com/TuffyLiu/html2canvas/releases
[image: image]
https://user-images.githubusercontent.com/14903912/77726722-8679e580-7033-11ea-8b22-5e6b702f027b.png
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/niklasvh/html2canvas/issues/2188#issuecomment-604830578,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AOKXD64JCDNVDPTHVTO2LU3RJQ6PBANCNFSM4LSKCG6A
.

maybe you can try R4~~

Still not working. :(
On Fri, Mar 27, 2020 at 4:44 PM Tuffy<EMAIL_ADDRESS>wrote:

maybe you can try R4~~
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/niklasvh/html2canvas/issues/2188#issuecomment-604884089,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AOKXD66HUHA64UTKOB3DZ5LRJRRQTANCNFSM4LSKCG6A
.

it can't work in Wechat Browser on ios 13.4
but it can work in Safari
then I fork the project
bebug......
found that one line of code isn't valid
...no return ...no erro
// src/dom/document-cloner.ts
//  line 96
if (documentClone.fonts && documentClone.fonts.ready) {
       // await documentClone.fonts.ready;
 }

I delete it
because i didn't use web font
it's work!!!
then i create a branch to use this
https://github.com/TuffyLiu/html2canvas/releases
you can add this to your project package, if you you need....
"html2canvas": "git+https://github.com/TuffyLiu/html2canvas.git#1.0.0-rc.6",''
your guys has any good solution?

hey, could u tell me how to debug in wechat browser? today i found the same problom, and debug three hours but i have no idea... how can u do it?

Still not working. :(
…
On Fri, Mar 27, 2020 at 4:44 PM Tuffy @.***> wrote: maybe you can try R4~~ — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#2188 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AOKXD66HUHA64UTKOB3DZ5LRJRRQTANCNFSM4LSKCG6A .

I had tested my html2canvas.js , and it's working~~
I added the project's example to my release branch ~~
you can try~~
maybe some error on your code~~

it can't work in Wechat Browser on ios 13.4
but it can work in Safari
then I fork the project
bebug......
found that one line of code isn't valid
...no return ...no erro
// src/dom/document-cloner.ts
//  line 96
if (documentClone.fonts && documentClone.fonts.ready) {
       // await documentClone.fonts.ready;
 }

I delete it
because i didn't use web font
it's work!!!
then i create a branch to use this
https://github.com/TuffyLiu/html2canvas/releases
you can add this to your project package, if you you need....
"html2canvas": "git+https://github.com/TuffyLiu/html2canvas.git#1.0.0-rc.6",''
your guys has any good solution?

hey, could u tell me how to debug in wechat browser? today i found the same problom, and debug three hours but i have no idea... how can u do it?

change Logger class debug function to send msg data to your service(you can write a http Server by node)~~
then Find out what's missing~~
searching the special word ~~
debug~~~
my solutions is working???right???

My server is in xampp, have any ideas to debug it from there? Thanks!
On Sat, Mar 28, 2020 at 11:43 PM Tuffy<EMAIL_ADDRESS>wrote:

it can't work in Wechat Browser on ios 13.4
but it can work in Safari
then I fork the project
bebug......
found that one line of code isn't valid
...no return ...no erro
// src/dom/document-cloner.ts
//  line 96
if (documentClone.fonts && documentClone.fonts.ready) {
// await documentClone.fonts.ready;
}
I delete it
because i didn't use web font
it's work!!!
then i create a branch to use this
https://github.com/TuffyLiu/html2canvas/releases
you can add this to your project package, if you you need....
"html2canvas": "git+https://github.com/TuffyLiu/html2canvas.git#1.0.0-rc.6
",''
your guys has any good solution?
hey, could u tell me how to debug in wechat browser? today i found the
same problom, and debug three hours but i have no idea... how can u do it?
change Logger class debug function to send msg data to your service(you
can write a http Server by node)~~
then Find out what's missing~~
searching the special word ~~
debug~~~
my solutions is working???right???
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/niklasvh/html2canvas/issues/2188#issuecomment-605464554,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AOKXD6YL2ABY7C7VFIIOMWTRJYLLVANCNFSM4LSKCG6A
.

I tried using RC 1 version and it works on ios but the problem is image
transformation (Translate X and Y) is not working properly. Because i am
using also cropper.js to crop an image and preview to an separate image
template then save that, using this html2canvas v1.0.0 rc 1.Maybe you can
identify in here why isn't image transformation working properly? Thanks!
On Mon, Mar 30, 2020 at 9:09 AM Joshua Bernardo<EMAIL_ADDRESS>wrote:

My server is in xampp, have any ideas to debug it from there? Thanks!
On Sat, Mar 28, 2020 at 11:43 PM Tuffy<EMAIL_ADDRESS>wrote:

it can't work in Wechat Browser on ios 13.4
but it can work in Safari
then I fork the project
bebug......
found that one line of code isn't valid
...no return ...no erro
// src/dom/document-cloner.ts
//  line 96
if (documentClone.fonts && documentClone.fonts.ready) {
// await documentClone.fonts.ready;
}
I delete it
because i didn't use web font
it's work!!!
then i create a branch to use this
https://github.com/TuffyLiu/html2canvas/releases
you can add this to your project package, if you you need....
"html2canvas": "git+
https://github.com/TuffyLiu/html2canvas.git#1.0.0-rc.6",''
your guys has any good solution?
hey, could u tell me how to debug in wechat browser? today i found the
same problom, and debug three hours but i have no idea... how can u do it?
change Logger class debug function to send msg data to your service(you
can write a http Server by node)~~
then Find out what's missing~~
searching the special word ~~
debug~~~
my solutions is working???right???
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/niklasvh/html2canvas/issues/2188#issuecomment-605464554,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AOKXD6YL2ABY7C7VFIIOMWTRJYLLVANCNFSM4LSKCG6A
.

it still can't work in Wechat Browser on ios 13.4.The reason, I discovered, was that html2canvas promise had no feedback

it still can't work in Wechat Browser on ios 13.4.The reason, I discovered, was that html2canvas promise had no feedback

解决了吗？fix it ？

it can't work in Wechat Browser on ios 13.4
but it can work in Safari
then I fork the project
bebug......
found that one line of code isn't valid
...no return ...no erro
// src/dom/document-cloner.ts
//  line 96
if (documentClone.fonts && documentClone.fonts.ready) {
       // await documentClone.fonts.ready;
 }

I delete it
because i didn't use web font
it's work!!!
then i create a branch to use this
https://github.com/TuffyLiu/html2canvas/releases
you can add this to your project package, if you you need....
"html2canvas": "git+https://github.com/TuffyLiu/html2canvas.git#1.0.0-rc.6",''
your guys has any good solution?

same question

I'm having the same issue with safari 13.1 on iOS 13.6.
The demo on the authors homepage works fine, but the newest version (rc7) on our homepage does not work properly on safari. It does on pretty much everything else.

I'm having same issue with safari.
Iam able to capture the screenshot but the content like tables, images, graphs are not visible on screen shot.
Working perfectly on chrome browser.
Is there any solution for this ? can any one suggest alternative package to capture screenshot ?

I'm having same issue with safari.
Iam able to capture the screenshot but the content like tables, images, graphs are not visible on screen shot.
Working perfectly on chrome browser.
Is there any solution for this ? can any one suggest alternative package to capture screenshot ?

@anibablu @Wegi did you find a fix for this? I am having the same issue. When I capture a HTML SVG element with html2canvas on Chrome or Firefox everything works fine. When I switch to Safari it doesn't capture properly but instead translates and crops the image. Stuck on this and any help you may have found would be appreciated! Thanks.

Tried to bypass html2canvas using raw canvas as described here: https://stackoverflow.com/questions/3975499/convert-svg-to-image-jpeg-png-etc-in-the-browser/64800570#64800570
Didn't work, just hung forever loading, no error output. Leads me to believe this is an issue with newer versions of Safari and the canvas DOM element.

This is still an issue. Even with the latest versions of Safari. Any alternative to this library?

I believe this is an issue with canvas as an HTML DOM element, rather than the library, as I implemented my own "raw" solution, without the lib, and still had the same issues.

In my case converting the SVG to PNG is the issue, someone suggested using CloudConvert or similar services to handle the conversion.

The library CI tests ios 12, 13, 14 and they all pass - so it seems to be something specific that you have on the page that is triggering it not to work. Without a repro of what that is, it's quite difficult to find a fix for it.

They might pass, but are they generating the correct output?
In my case I see a lot of misplacement of the canvas, sometimes with a very large "top padding".
It is reproducible using Gnome Web, also known as Epiphany Browser which uses Webkit.

They might pass, but are they generating the correct output?
In my case I see a lot of misplacement of the canvas, sometimes with a very large "top padding".
It is reproducible using Gnome Web, also known as Epiphany Browser which uses Webkit.

You can check all the results for all the browsers at https://html2canvas.hertzen.com/tests/ or at https://github.com/niklasvh/html2canvas/tree/gh-pages/results
If there is some specific scenario that doesn't work, then would need a repro of it.

They might pass, but are they generating the correct output?
In my case I see a lot of misplacement of the canvas, sometimes with a very large "top padding".
It is reproducible using Gnome Web, also known as Epiphany Browser which uses Webkit.

You can check all the results for all the browsers at https://html2canvas.hertzen.com/tests/ or at https://github.com/niklasvh/html2canvas/tree/gh-pages/results
If there is some specific scenario that doesn't work, then would need a repro of it.

well I'm checking the link test with a lot of errors, the first one is the one that should be, but the second one is the one showing in the browser:


Add uid in MinWriterRoleInfo

protocol tweak to pass uid  in minWriterRoleInfo

merging since https://github.com/keybase/keybase/pull/2684 was approved


ST7789 color inversion

For reasons unknown (missing git history) ST7789 driver inverts colors by default:
https://github.com/lvgl/lvgl_esp32_drivers/blob/master/lvgl_tft/st7789.c#L68
This has to be made configurable.
This is more-or-less a feature request, as most of the LCD displays support color inversion.

The git history was lost when we moved the lvgl_esp32_drivers content from the lv_port_esp32 repo into it's own repo (this one). I didn't knew on how to do it properly.


⚠ ClamAV has degraded performance

In bc653b5, ClamAV (https://spamassassin.apache.org/) experienced degraded performance:

HTTP code: 200
Response time: 84 ms

Resolved: ClamAV performance has improved in 15a23a0.


Android crash：When I return to the normal page from a page with Webview

When I return to the normal page from a page with Webview,app got crash!
Environmental：
"react-native": "0.62.2",
"@react-navigation/stack": "^5.0.0",
"react-native-webview": "^8.1.2",
code:
<View style={{ flex: 1, backgroundColor: config.theme.backgroundColor }}>
{/* header */}
<components.Angle />
<View style={{ flex: 1, backgroundColor: config.theme.backgroundColor }}>
<components.CustomWebView
handleMessage={handleMessage}
uri={url}
/>

Fix here https://github.com/react-native-community/react-native-webview/pull/1298

"react-native": "^0.62.2",
"@react-navigation/native": "^5.1.6",
"@react-navigation/stack": "^5.2.11",
"react-native-screens": "^2.5.0",
"react-native-webview": "^9.2.2"
Crash is still here if using
import { enableScreens } from 'react-native-screens';
enableScreens();
if not using this - it's ok
https://reactnavigation.org/docs/react-native-screens/

Can confirm this is happening on recent android versions with react-native-screens support enabled. Could reproduce on android 9+, but had no issue on android 7.
Disabling react-native-screens fixes the issue.
Using:
"react-native": "~0.61.5",
"react-native-webview": "^9.4.0",
"@react-navigation/native": "^5.2.2",
"@react-navigation/stack": "^5.2.17",
"react-native-screens": "^2.7.0",

Confirmed as well on android 9+, disabling react-native-screens fixes the issue.
Using:
"react-native": "~0.61.4",
"react-native-webview": "^9.4.0",
"@react-navigation/native": "^5.1.3",
"@react-navigation/stack": "^5.2.6",
"react-native-screens": "^2.7.0"


Use COOKIES_FILE to fetch page titles

Summary
This PR lets the title extractor use the COOKIES_FILE, if available. This helps avoid extracting the titles of captcha or login pages.

Related issues
#761

Changes these areas

[ ] Bugfixes
[x] Feature behavior
[ ] Command line interface
[x] Configuration options
[ ] Internal architecture
[ ] Snapshot data layout on disk

Down to merge this if you've tested it! Just change it to Ready for Review when you're ready :)

I've been testing it and I'm actually having trouble verifying that this works. I thought it was working when I opened this PR, but it seems I was wrong. For my test case, the title isn't correct if the title extractor is the only enabled extractor. It is correct when wget is enabled, so the cookie file is being read correctly by ArchiveBox, but my fix here doesn't seem to be working. Not sure where it's failing yet.

After throwing some stuff at the wall, I got to a solution that works for me. For some reason, the cookie file only seems to work with requests when I set each cookie one by one, like
        for cookie in cookie_jar:
            session.cookies.set(cookie.name, cookie.value, domain=cookie.domain, path=cookie.path)

It didn't work for me when I tried session.cookies = cookie_jar or session.cookies.update(cookie_jar), and from the docs I can't tell why. If anyone could tell me what I'm missing, I'd appreciate it.


[Request feature]: Increase font size of body content on new version

Hi,
At new this version, I feel font size of body content very small, your team can increase it or make a function allow change font size?
Thanks
Versions
App: 10.0.3
Platform: 5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Hi,
Thank you for the issue report. I'm marking it as a duplicate of #1072 since I answered there already.
I'll update the app in a minute.


_.slice() v.s. Array.prototype.slice()

Should we change the implementation to same as JS to not included the end index?

We could look at how many of these are pit falls and how easily we would fall into.
The biggest pitfall in the lib here is index (starts from 1). I would agree to have functions to use less parameters as indexes and use more on certain ones.

We could follow how https://lodash.com/docs/4.17.4#slice implement it, so that we don't need to worry about the implementation and documentation, since we are all familiar with JavaScript, furthermore, this function is rarely used.

I prefer to implement it like js behavior. Is that ok for you, @ophentis ?

yes


Sitemap can't be used with browserify

If sitemap.js is pulled into a browserify build, the javascript has frontend errors, because the use of fs.readFileSync to get the version number is done in a way that brfs can't understand:
/**
 * Framework version.
 */
var fs = require('fs')
  , path = require('path')
  , pack_file = path.join(__dirname, 'package.json');

if ( !module.exports.version ) {
  module.exports.version = JSON.parse(
    fs.readFileSync(pack_file, 'utf8')).version;
}

If this was changed to be something like:
var fs = require('fs');

if ( !module.exports.version ) {
  module.exports.version = JSON.parse(
    fs.readFileSync(__dirname + "/package.json", 'utf8')).version;
}

It should work with brfs

(yes, I admit that sitemap.js being pulled into a browserify build probably means something else has gone wrong)

+1

@alexeybondarenko can you give us an example how do use both together, I am trying to make a dynamic sitemap using sitemap.js and react-router-sitemap. I want to get my react routes dynamically :)


Fonts look like wash out

VSCode Version:1.35.1
OS Version:Linux (Kde Neon)

Fonts look blurry and wash out.

Could be electron related?


JwtBearer should append WWW-Authenticate to any existing values

WWW-Authenticate can officially exist as a single header comma separated header or as multiple header entries, but browsers only support the former format. Right now the middleware appends a new string to the StringValues array, but it needs to append to the string directly.
Actual:
www-authenticate: Bearer realm="http://example1.com"
www-authenticate: Bearer realm="http://example2.com"

Expected:
www-authenticate: Bearer realm="http://example1.com", Bearer realm="http://example2.com"

Adding error/error_description/error_uri in the equation makes thing much more complex:
WWW-Authenticate: Bearer realm="example1", error="invalid_token", error_description="The access token expired", Bearer realm="example1", error="invalid_token", error_description="The access token expired"

I doubt many clients will be able to parse that correctly.

I actually had to re-write the code for HttpWebRequest to parse that correctly, so I at least know that one works.

We do this on purpose. Please talk to @Tratcher if you don't believe me 😄

We do this on purpose.

Best explanation ever :trollface:

Yeah, I had it backwards. Browsers require separate headers for www-authenticate.

Ah, that's clearer :smile:
I'm still not sure why you'd want multiple automatic authentication middleware to apply a challenge at the same time, but okay.

Basic, Bearer, Negotiate, and Kerberos are all compatible and the client can choose between them.

Basic, Bearer

In theory, sure. But in practice I can't think of scenario where you'd like to mix basic and bearer :smile:

Negotiate, and Kerberos

IMHO, Negociate and Kerberos are unlikely to be added at the app/middleware level (unless someone is brave enough to write a managed implementation :smile:).
It's more something that should be handled at the host level. And in this case, what's supposed to happen if the app has already sent a WWW-Authenticate response header with Basic or Bearer? Will the host (e.g IIS or WebListener) send an additional challenge if WA is enabled?

WebListener is plugged into the Challenge pipeline to add the auth headers as needed. IIS can add headers as well.


Convert View to Mid Fi (Analyzer Ranges )

Definition of Ready

[x] Does this meet the INVEST criteria?
[x] Does this have a clearly defined user?
[x] Does this have an estimate?
[x] Does this have acceptance criteria?
[x] Does this have sufficient context (wireframes, business rules, etc.)?
[x] Is this traceable to a feature, epic, or PI?

User Story
As a user
I want to view MP analyzer ranges using the mid fidelity design
So that I have a better experience
Acceptance Criteria
Given a user has accessed MP analyzer ranges
When it is viewed
Then it is displayed according to the wireframes
Context
https://xd.adobe.com/view/dccab567-3abe-484a-bff7-844d701cd4eb-8999/
Testing
Test Case:
Tester:
Definition of Done

[ ] Have all Acceptance Criteria been agreed to and validated by the scrum team?
[ ] Has the code been unit tested and peer reviewed?
[ ] Have the functional tests been executed?
[ ] Have all defects been reviewed and dispositioned, resolved, or deferred?
[ ] Has the user story been accepted by the Product Owner?
[ ] Is the user story ready to be deployed to the test/staging environments?

Modal not built yet. Will address responsiveness when modal is built.


Access Denied Error

Hello, I'm trying to use node-s3-client to sync a directory to s3:
    s3.createClient({
        s3Options: {
            "accessKeyId": "ACCESSKEY",
            "secretAccessKey": "SECRETKEY"
        }
    })
    .uploadDir({
        localDir: 'path/to/localdir',
        s3Params: {
            Prefix: '',
            Bucket: 'bucket-1'
        }
    });

I'm consistently getting an AccessDenied error:
AccessDenied: Access Denied
    at Request.extractError (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/services/s3.js:343:35)
    at Request.callListeners (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/sequential_executor.js:100:18)
    at Request.emit (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/sequential_executor.js:77:10)
    at Request.emit (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/request.js:604:14)
    at Request.transition (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/request.js:21:12)
    at AcceptorStateMachine.runTo (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at /Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/state_machine.js:26:10
    at Request.<anonymous> (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/request.js:22:9)
    at Request.<anonymous> (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/request.js:606:12)
    at Request.callListeners (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/sequential_executor.js:104:18)
    at Request.emit (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/sequential_executor.js:77:10)
    at Request.emit (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/request.js:604:14)
    at Request.transition (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/request.js:21:12)
    at AcceptorStateMachine.runTo (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at /Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/state_machine.js:26:10
    at Request.<anonymous> (/Users/alden/Source/bidder/ui/apps/onespot-dashboard/node_modules/s3/node_modules/aws-sdk/lib/request.js:22:9)

My IAM settings are as follows:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1412975049000",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-1/*",
                "arn:aws:s3:::bucket-2/*"
            ]
        }
    ]
}

Any ideas as to what is going on or how to debug?
Thanks!

Figured it out. My resources need to be
arn:aws:s3:::bucket-1 rather than
arn:aws:s3:::bucket-1/*
Closing.

More precisely, both permissions are needed:
"Resource": [
  "arn:aws:s3:::bucket-1",
  "arn:aws:s3:::bucket-1/*",
  "arn:aws:s3:::bucket-2",
  "arn:aws:s3:::bucket-2/*"
]

The /* resource gives access to the objects within the bucket while the resource without the /* gives access to work with the bucket itself.

This is a very old thread... but I thought I'd add some additional notes about my experience in solving this issue of Access Denied.
The main difference from the answer above, is that I have a multiple clients using the same bucket. I needed to allow access to their own folder.
Also note that I am using the deleteRemoved: true flag which appears to require ListBucket permissions.
The IAM definition that finally worked required ListBucket access to the actual bucket (as compared to the full folder path). See below for complete IAM definition.
Just as a side note, I'd avoid s3:* permissions used in the example above.
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::mybucket/client1",
                "arn:aws:s3:::mybucket/client1/*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::mybucket"
        }
    ]
}


Add current time into logging message

Right now the logging message is the following (trainin-info.log):
...
[ignite]: train [1/90]: {'epoch': 1, 'train_loss': 2.521751880645752}
[ignite]: train [1/100]: {'epoch': 1, 'train_loss': 2.4120213985443115}
...

Let's add current datetime instead of "ignite" as following:
...
[20230819-12:34:56]: train [1/90]: {'epoch': 1, 'train_loss': 2.521751880645752}
[20230819-12:35:12]: train [1/100]: {'epoch': 1, 'train_loss': 2.4120213985443115}
...

Fixed in https://github.com/pytorch-ignite/code-generator/pull/303


sha256_var crashes in runtime

Aim
Getting a sha256 hash of some data. I am using a new version of sha256_var from #5760.
Expected Behavior
I got a hash
Bug
I got a runtime error:
Running 1 test function
Testing test_hash...
None
Support Needs
No response

cc @vezenovm

Ah I know what this is, will push something in a moment.


Unwanted el.dataset.obfuscated_name

[advanced optimizations] Hi, I'm using HTML data attributes via dataset, but sometimes they get obfuscated.

el.dataset.active → el.dataset.active
el.dataset.sliding → el.dataset.a, breaking my app

As those names are a part of the HTML, I think they shouldn't be obfuscated. Is there an option to disable it? Thanks.

You will either need to use externs or quote the properties to block renaming.


This guide used legacy backticks.

https://github.com/koalaman/shellcheck/wiki/SC2006
https://github.com/koalaman/shellcheck/wiki/SC2046

@docker/core-compose-maintainers Is this a canonical way to get Docker Compose?

By "canonical" I mean, is this a sustainable, best-practice way to get Docker Compose that the Compose team would recommend we provide to users?

@johndmulhausen Yes, this is the way we have recommended users install Compose for a long time.

@shin- Thanks so much! Merging now. :)


Fix go format in test/e2e/*.go

This patch fixes go fmt by:
go fmt ./test/e2e/*.go

Signed-off-by: Kenjiro Nakayama<EMAIL_ADDRESS>

CI is failing due to https://github.com/projectcontour/contour/pull/3505.

/lgtm

https://github.com/projectcontour/contour-operator/pull/248 is required for CI to pass.


Getting Windows error "FileNotFoundError"

Just installed the package and copied the exact usage example from the docs (active layer). Windows throws this WinError 2 error because apparently I have a 32 bits Python and it's looking for Photoshop as if it was also 32 bits (which is is not) according to this stack overflow issue.
Using the suggested answer of adding the argument access=winreg.KEY_READ | winreg.KEY_WOW64_64KEY inside the function _get_install_version in _core.py worked for me.
key = winreg.OpenKey(
        winreg.HKEY_LOCAL_MACHINE,
        self.REG_PATH,
        access=winreg.KEY_READ | winreg.KEY_WOW64_64KEY
)

Just in case:
Using Windows 10, Python 3.7 and version 0.6.0 of this package.

Hi @tubi-carrillo,
Thank you for your report, I updated the new version (0.7.0) to fix this. let me know if that still is an issue.
Cheers,
Hal

It threw the same error, this time specifically in line 66:
File "[...]\photoshop\_core.py", line 66, in open_key
    access=winreg.KEY_READ | mappings[bitness]
FileNotFoundError: [WinError 2]

I don't know if it related, but just in case, I manually added the same suggested line I made when opening this issue and got this error.
  File "ps.py", line 3, in <module>
    with Session("test.psd", action="open", auto_close=False) as ps:
  File "D:\[...]\photoshop\__init__.py", line 164, in __enter__
    _action()
  File "D:\[...]\photoshop\__init__.py", line 153, in _action_open
    self.active_document = self.app.open(self.path)
  File "D:\[...]\photoshop\application.py", line 244, in open
    return ActiveDocument(self.app.open(document_file_path))
  File "D:\[...]\comtypes\client\lazybind.py", line 182, in caller
    return self._comobj._invoke(descr.memid, descr.invkind, 0, *args)
  File "D:\[...]\comtypes\automation.py", line 729, in _invoke
    dp, var, None, argerr)
_ctypes.COMError: (-2147220262, None, (None, None, None, 0, None))

I don't know if it related, but just in case, I manually added the same suggested line I made when opening this issue and got this error.
  File "ps.py", line 3, in <module>
    with Session("test.psd", action="open", auto_close=False) as ps:
  File "D:\[...]\photoshop\__init__.py", line 164, in __enter__
    _action()
  File "D:\[...]\photoshop\__init__.py", line 153, in _action_open
    self.active_document = self.app.open(self.path)
  File "D:\[...]\photoshop\application.py", line 244, in open
    return ActiveDocument(self.app.open(document_file_path))
  File "D:\[...]\comtypes\client\lazybind.py", line 182, in caller
    return self._comobj._invoke(descr.memid, descr.invkind, 0, *args)
  File "D:\[...]\comtypes\automation.py", line 729, in _invoke
    dp, var, None, argerr)
_ctypes.COMError: (-2147220262, None, (None, None, None, 0, None))

You try to use the absolute path of psd file. This error is that COM object access is null

It threw the same error, this time specifically in line 66:
File "[...]\photoshop\_core.py", line 66, in open_key
    access=winreg.KEY_READ | mappings[bitness]
FileNotFoundError: [WinError 2]

This is very strange. What version of photoshop are you using?

You try to use the absolute path of psd file. This error is that COM object access is null

That worked! In version 0.6.0 I didn't need to do this.

It threw the same error, this time specifically in line 66:
File "[...]\photoshop\_core.py", line 66, in open_key
    access=winreg.KEY_READ | mappings[bitness]
FileNotFoundError: [WinError 2]

This is very strange. What version of photoshop are you using?

I'm using cc2018.
Printing the result of bitness = platform.architecture()[0] says that bitness is 32bit (even though my pc is 64bit). So instead of using the winreg.KEY_WOW64_64KEY for Photoshop, it's using the 32bit.

Hi @tubi-carrillo
There is also a situation where you can check if a local registry key exists. If not, then FileNotFoundError is also returned.

It exists, I manually checked.
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Photoshop\120.0

Hi @tubi-carrillo one more question, if you change to use winreg.KEY_WOW64_32KEY it is work?
Below is from my PC.

Hi @tubi-carrillo make sure you installed 64-bit python.
I tested install 32-bit python it will return 32-bit.

So I definitely have a 32bit version of Python and a 64bit version of Photoshop. For some reason, platform.architecture()[0] says I have a 32bit architecture (apparently I have two processors, a 32bit Intel and a 64bit AMD).

When I use winreg.KEY_WOW64_32KEY it doesn't find Photoshop, but it does with the 64 key. I guess the solution would be to gather information on which version Photoshop is (either 32bit or 64bit), but I don't know if it is possible through winreg.

once again Thank for your report, I will update the logic later,
I find it may be more accurate to use environment variables to determine.

Thank you too!

@all-contributors please add tubi-carrillo for Bug reports

@all-contributors please add @tubi-carrillo  for Bug reports


chore(main): release sdk 7.2.0

:robot: I have created a release beep boop
7.2.0 (2024-11-16)
Features

sdk: Add asset search by multi-location ✨ (54d0d46)
sdk: Add support for abstracted assets selection ✨ (b5ffed8)

Bug Fixes

sdk: Fix asset checks relaychain symbol validation 🛠 (bc498ac)
sdk: Remove @polkadot/apps-config depencency (8a5bbc7)

Miscellaneous Chores

sdk: Add advanced symbol selection info (a4db9c3)
sdk: Update readme with PJS-less PAPI version (896bc60)
sdk: Update README.md (0fd4655)
xcm-tools: Update readme (66f9278)

This PR was generated with Release Please. See documentation.

:robot: Created releases:

sdk-v7.2.0
:sunflower:


☂ Solution For Automated Shoot CA/Credentials Rotation

How to categorize this issue?

/area control-plane
/kind enhancement
What would you like to be added:
A documented and tested way to automatically manage and rotate Shoot CA credentials without downtime. One proposition would be to use the cert-manager.io project for it as it is well integrated within the K8s Community.
An integration with secure stores like Hashicorp Vault is certainly desirable and also already supported by Cert-Manager (https://cert-manager.io/docs/configuration/vault/)
Why is this needed:
Currently the Gardenlet and Kubelet Client certificates get automatically rotated after 10 months to prevent them from expiration (12 months).
For the Shoot Certificate Authority there is no such mechanism implemented at the moment and it's up to the cluster operator to manage this.
CC: @timebertt @cypherfox @schmidtdu

Copied from https://github.com/gardener/gardener/issues/3292#issuecomment-1036058890 and now maintained here:
Now that GEP18 got merged with https://github.com/gardener/gardener/pull/5395, we can start with the implementation.
Please note that the below list is continuously subject to change and can be extended or shrank based on the made experience during the implementation phase.
Tasks
Prerequisites

Add feature gate and trigger annotations, extend ShootStatus API

[x] https://github.com/gardener/gardener/pull/5449
[x] https://github.com/gardener/gardener/pull/5595

Make sure that all control plane and system components restart in case the CA bundle changes

~https://github.com/gardener/gardener/pull/5459~, closed due to https://github.com/gardener/gardener/issues/3292#issuecomment-1042984874

[x] Introduce a new secrets manager supporting rotation scenarios https://github.com/gardener/gardener/pull/5503

Adapt gardener/gardener component (use new secrets manager)

[x] https://github.com/gardener/gardener/pull/5503
[x] https://github.com/gardener/gardener/pull/5510
[x] https://github.com/gardener/gardener/pull/5524
[x] https://github.com/gardener/gardener/pull/5583
[x] https://github.com/gardener/gardener/pull/5608
[x] https://github.com/gardener/gardener/pull/5616
[x] https://github.com/gardener/gardener/pull/5668
[x] https://github.com/gardener/gardener/pull/5688
[x] https://github.com/gardener/gardener/pull/5671
[x] https://github.com/gardener/gardener/pull/5656
[x] https://github.com/gardener/gardener/pull/5669
[x] https://github.com/gardener/gardener/pull/5673
[x] https://github.com/gardener/gardener/pull/5662
[x] https://github.com/gardener/gardener/pull/5629
[x] https://github.com/gardener/gardener/pull/5661
[x] https://github.com/gardener/gardener/pull/5682
[x] https://github.com/gardener/gardener/pull/5664
[x] ~Adapt dependency-watchdog-{internal,external}-probe client secrets (removed entirely with https://github.com/gardener/gardener/pull/5685)~
[x] https://github.com/gardener/gardener/pull/5691
[x] https://github.com/gardener/gardener/pull/5745
[x] https://github.com/gardener/gardener/pull/5790
[x] https://github.com/gardener/gardener/pull/5679
Adapt seed controller (creates a CA and other credentials for the seed)

[x] https://github.com/gardener/gardener/pull/5655
[x] https://github.com/gardener/gardener/pull/5669
[x] https://github.com/gardener/gardener/pull/5745
[x] https://github.com/gardener/gardener/pull/5686
[x] https://github.com/gardener/gardener/pull/5806

Revendor/Adapt Gardener extension components (use new secrets manager for generation, generate dedicated CAs, adapt usage of generic token kubeconfig)

[x] https://github.com/gardener/gardener/pull/5607
[x] https://github.com/gardener/gardener/pull/5666
[x] https://github.com/gardener/gardener/pull/5803
[x] shoot-cert-service: https://github.com/gardener/gardener-extension-shoot-cert-service/pull/113, released with v1.21.0
[x] shoot-dns-service: https://github.com/gardener/gardener-extension-shoot-dns-service/pull/122, released with v1.19.0
[x] shoot-oidc-service: https://github.com/gardener/gardener-extension-shoot-oidc-service/pull/41, released with v0.6.0
[x] provider-alicloud: https://github.com/gardener/gardener-extension-provider-alicloud/pull/475, released with v1.36.0
[x] provider-aws: https://github.com/gardener/gardener-extension-provider-aws/pull/538, released with v1.36.0
[x] provider-azure: https://github.com/gardener/gardener-extension-provider-azure/pull/493, released with v1.28.0
[x] provider-gcp: https://github.com/gardener/gardener-extension-provider-gcp/pull/434, released with v1.23.0
[x] provider-openstack: https://github.com/gardener/gardener-extension-provider-openstack/pull/443, released with v1.26.0
[x] provider-vsphere: https://github.com/gardener/gardener-extension-provider-vsphere/pull/230, released with v0.13.0
[x] provider-equinix-metal: https://github.com/gardener/gardener-extension-provider-equinix-metal/pull/209, released with v2.3.0
[x] auditlog-extension, released with v0.45.0

Adapt other components

[x] gardenlogin-controller-manager (adapt to new CA data type in ShootState in garden): https://github.com/gardener/gardenlogin-controller-manager/pull/24
[x] dashboard (reading monitoring ingress credentials from Secret in seed): https://github.com/gardener/dashboard/pull/1178
[x] etcd-custom-image: https://github.com/gardener/etcd-custom-image/pull/10
etcd-druid

[x] https://github.com/gardener/etcd-druid/pull/309
[x] https://github.com/gardener/etcd-druid/pull/310
[x] https://github.com/gardener/gardener/pull/5693

[x] https://github.com/gardener/gardener/pull/5612

[Not strictly necessary/optional improvement] Adapt gardenlogin-controller-manager to use dedicated secret (instead of reading shoot CA data from ShootState in garden) or drop it entirely
[x] landscape-setup (adapt roles-seed to use dedicated secret instead of reading shoot CA data from ShootState in garden for OIDC kubeconfigs)

Shoot CA Rotation Business Logic

[x] https://github.com/gardener/gardener/pull/5774 (Support rolling update scenario for local shoots to re-enable e2e tests for CA rotation after #5666)
[x] https://github.com/gardener/gardener/pull/5779
[x] https://github.com/gardener/gardener/pull/5785
[x] https://github.com/gardener/gardener/pull/5807
[x] https://github.com/gardener/gardener/pull/5897
[x] https://github.com/gardener/gardener/pull/5944
[x] https://github.com/gardener/gardener/pull/5945
[x] https://github.com/gardener/gardener/pull/6099

Extension Webhook Server CA Rotation

[x] https://github.com/gardener/gardener/pull/6003
[x] https://github.com/gardener/gardener/pull/6060
Revendor/Adapt extensions

[x] ~kupid~ (not considered since kupid is considered deprecated and should be replaced with https://github.com/gardener/kupid/issues/33)
[x] networking-cilium: https://github.com/gardener/gardener-extension-networking-cilium/pull/92
[x] shoot-oidc-service: https://github.com/gardener/gardener-extension-shoot-oidc-service/pull/44, released with v0.8.0
[x] provider-alicloud: https://github.com/gardener/gardener-extension-provider-alicloud/pull/492, released with v1.37.0
[x] provider-aws: https://github.com/gardener/gardener-extension-provider-aws/pull/556, released with v1.36.0
[x] provider-azure: https://github.com/gardener/gardener-extension-provider-azure/pull/513, released with v1.28.0
[x] provider-gcp: https://github.com/gardener/gardener-extension-provider-gcp/pull/446, released with v1.23.0
[x] provider-openstack: https://github.com/gardener/gardener-extension-provider-openstack/pull/455, released with v1.26.0
[x] provider-vsphere: https://github.com/gardener/gardener-extension-provider-vsphere/pull/241, released with v0.14.0
[x] provider-equinix-metal: https://github.com/gardener/gardener-extension-provider-equinix-metal/pull/212, released with v2.4.0

Related Tasks

ServiceAccount Signing Key Rotation

[x] https://github.com/gardener/gardener/pull/5968
Revendor/Adapt extensions

[x] provider-alicloud: https://github.com/gardener/gardener-extension-provider-alicloud/pull/492, released with v1.37.0
[x] provider-aws: https://github.com/gardener/gardener-extension-provider-aws/pull/556, released with v1.36.0
[x] provider-azure: https://github.com/gardener/gardener-extension-provider-azure/pull/513, released with v1.28.0
[x] provider-gcp: https://github.com/gardener/gardener-extension-provider-gcp/pull/446, released with v1.23.0
[x] provider-openstack: https://github.com/gardener/gardener-extension-provider-openstack/pull/455, released with v1.26.0
[x] provider-vsphere: https://github.com/gardener/gardener-extension-provider-vsphere/pull/241, released with v0.14.0
[x] provider-equinix-metal: https://github.com/gardener/gardener-extension-provider-equinix-metal/pull/212, released with v2.4.0

[x] https://github.com/gardener/gardener/pull/6063
[x] https://github.com/gardener/gardener/pull/6078

ETCD Encryption Key Rotation

[x] https://github.com/gardener/gardener/pull/6021
[x] https://github.com/gardener/gardener/pull/6064
[x] https://github.com/gardener/gardener/pull/6065

[x] https://github.com/gardener/gardener/pull/5926
[x] https://github.com/gardener/gardener/pull/6038
[x] https://github.com/gardener/gardener/pull/6039
[x] https://github.com/gardener/gardener/pull/6148

Rollout

[x] https://github.com/gardener/gardener/pull/5939
Testing

[x] https://github.com/gardener/gardener/pull/6072
Advanced checks for credentials e2e test

[x] https://github.com/gardener/gardener/pull/6098
[x] https://github.com/gardener/gardener/pull/6112

[x] https://github.com/gardener/gardener/issues/5895
[x] https://github.com/gardener/gardener/issues/6081
[x] https://github.com/gardener/gardener/issues/6092
[x] Perform a few e2e smoke tests on real landscapes

[x] https://github.com/gardener/gardener/pull/6079
[x] https://github.com/gardener/gardener/pull/6110
[x] https://github.com/gardener/gardener/pull/6149

Future Tasks

Drop code related to migration and cleanup (annotated with TODO(rfranzke):)
Promote feature gate

adding @dergeberl @mganter @einfachnuralex

adding @alesti

addin @iss0

Ok, I see 3 (more or less) distinct topics touched here:

rotation of the Shoot root CA

I have listed some steps that are necessary for doing this gracefully, can add them here
This should probably be automated somehow via some annotation similar to the kubeconfig rotation feature

rotation of the Garden cluster CA

not sure, if we can do something about it here, because the garden CA is supplied by the landscape administrator
I think, this might rather be a feature requests either for garden-setup or for the gardener control plane landscaper component, though nobody has started working on it yet (cc @schrodit)
Maybe some adaption in gardeners components will be needed to do that gracefully, though I guess, this is only the minor part

using cert-manager to generate certificates (and storing them in vault)

not sure, how cert-manager comes into play here, as the gardenlet already has all the logic for generating the necessary certificates/secrets/... for a given Shoot cluster
so if a given secret (e.g. root CA) is deleted from the Seed and ShootState, gardener will automatically regenerate it, so no need for an extra component/dependency

Can you guys also outline, what you have already been investigating in / working on / what you would like to implement from the this list?

Ok, I see 3 (more or less) distinct topics touched here:

rotation of the Shoot root CA

I have listed some steps that are necessary for doing this gracefully, can add them here

Please do. I also think we need a diagram that shows ALL certs that we are talking about here. Otherwise, misunderstanding is guaranteed.

rotation of the Garden cluster CA

I think, this might rather be a feature requests either for garden-setup or for the gardener control plane landscaper component, though nobody has started working on it yet (cc @schrodit)

Maybe some adaption in gardeners components will be needed to do that gracefully, though I guess, this is only the minor part

I doubt that this is minor, as all other trust derives from that. Unless the root of the chains for the Shoots can be injected independently from the Gardener (see below).

using cert-manager to generate certificates (and storing them in vault)

We would like to generate and maintain those root CAs with Vault, that are not generated by a subsystem (e.g. Gardener, Kubernetes, Linkerd) internally. If the certs are completely maintained internally, this cert-manager is not relevant.

not sure, how cert-manager comes into play here, as the gardenlet already has all the logic for generating the necessary certificates/secrets/... for a given Shoot cluster

Does the gardenlet contain logic for cert rotation as well as initial generation? We have run with Linkerd in a similar problem, that in large, high churn cluster, simple cert replacement is almost guaranteed to cause a downtime due to a cascading communication failures.
Also I do not trust cert handling implementations to correctly handle cert bundles and chains longer than 2 steps . I have been bitten too often. We need a specific test for that.

so if a given secret (e.g. root CA) is deleted from the Seed and ShootState, gardener will automatically regenerate it, so no need for an extra component/dependency

Again, if the key within that secret is also regenerated, it basically needs a chain rotation, and the same as above applies. Otherwise a downtime will be the result.

Ok, I already sense some misunderstanding here. So let me try to clarify :)

I doubt that this is minor, as all other trust derives from that. Unless the root of the chains for the Shoots can be injected independently from the Gardener (see below).

Actually, the Shoots' root CA (CN kubernetes) is self-signed and is not related to the CA of the garden cluster in any way (which is good, you already outlined some disadvantages of such an approach).

We would like to generate and maintain those root CAs with Vault, that are not generated by a subsystem (e.g. Gardener, Kubernetes, Linkerd) internally. If the certs are completely maintained internally, this cert-manager is not relevant.

Not sure, if I get this point. The Shoots' CAs are generated and "maintained" by the gardenlet. Would that fit to your understanding of a "subsystem"? Or is your concern, that it is not maintained "internally" because it materializes in a Secret on the Seed cluster?

Does the gardenlet contain logic for cert rotation as well as initial generation? We have run with Linkerd in a similar problem, that in large, high churn cluster, simple cert replacement is almost guaranteed to cause a downtime due to a cascading communication failures.

No, the gardenlet has no dedicated logic for the cert rotation, yet. And yes, the replacement is no option for productive clusters, that's why we would need such a feature. That's exactly what I meant with my first point 👍

Again, if the key within that secret is also regenerated, it basically needs a chain rotation, and the same as above applies. Otherwise a downtime will be the result.

Exactly, that would need to be respected when implementing the Shoot CA rotation feature.

Here are some of my personal notes of what needs to be done, when manually rotating a Shoot CA (@rfranzke @mvladev please add, if I missed something):
procedure
  - much like https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/
  - save all secrets of the Shoot
  - generate new CA (or take one from a local shoot cluster)
  - create a CA secret containing both old and new CA
  - update kube-controller-manager, kube-scheduler and kube-proxy kubeconfigs to trust both CAs
  - Scale down all other controllers in shoot namespace (ccm, mcm, dns and cert controller, vpa components)
  - skip step to update ServiceAccount tokens (kcm already updates them)
  - restart all pods, which use either a service account or a client certificate (e.g. kube-proxy, calico-node; if shooted seed: gardenlet, extension controllers, controllers in control plane, ...)
  - go to all nodes and
    - update the cloud-config-downloader script to trust both CAs
    - delete the `/var/lib/kubelet/kubeconfig-real` file and `/var/lib/kublet/pki` dir
    - restart the `cloud-config-downloader` systemd unit
    - -> will re-bootstrap kubelet (create CSR, obtain new valid certificate and create new kubeconfig trusting both CAs)
  - patch all secrets signed by shoot cluster root CA out of ShootState and update root CA in ShootState
  - delete ca secret and all secrets signed by it from the Seed
  - trigger a Shoot reconciliation
    - will regenerate all the secrets and sign them using the new CA
    - will also roll the kube-apiserver and reject all client-certificates that were signed by old CA
problems with the approach
  - vpa isn't available and some pods may get OOMKilled -> needs manual scaling until vpa is scaled up again
  - all nodes need to be touched or rolled

This can probably be used to derive some concrete steps when implementing automation for this.

Actually, the Shoots' root CA (CN kubernetes) is self-signed and is not related to the CA of the garden cluster in any way

:+1:

(which is good, you already outlined some disadvantages of such an approach).

We would like to generate and maintain those root CAs with Vault, that are not generated by a subsystem (e.g. Gardener, Kubernetes, Linkerd) internally. If the certs are completely maintained internally, this cert-manager is not relevant.

Not sure, if I get this point. The Shoots' CAs are generated and "maintained" by the gardenlet. Would that fit to your understanding of a "subsystem"? Or is your concern, that it is not maintained "internally" because it materializes in a Secret on the Seed cluster?

No, Shoot secrets in the Seed are fine (exception see below).  For this I would define a "subsystem" as a set of containers/processes that are communicating via TLS, trusted by certs from the same cert tree -> trust the same CA certs.  A container may be part of multiple subsystems at the same time.
These "subsystems" usually eventually come to a point where the manual states: "...and the admin injects the secret here...", resulting in the the need for a) the admin would in theory know the contents of the secret and b) require manual steps.
But I am wondering about the CA rotation of the Seed! (and thus, when talking about a shooted Seed, we are back to square one, I guess) And that is where the external root-key management comes in: when storing the secret in the next higher (Shoot -> Seed, Seed -> Garden) is not an option, can we store it somewhere else?

We had a call today to discuss the topics discussed here. It became apparent, that we basically deal with three topics:

Shoot CA rotation & automation
Garden Base Cluster CA management & rotation
(where applicable) Support for Hashicorp Vault for secure storage of secrets

I changed the title of this ticket to focus on the Shoot CA rotation. Bascially we agreed it boils down to implement/automate the rotation procedure as described above by @timebertt
For topic 2 I will create a separat ticket

Great, seems like we're on the same page, then. Your list resembles my list very much :)
Yes, let's first discuss the Shoot CA rotation here and keep the other topics separated and discuss them in dedicated issues.
What would be the next steps on this issue, then?
I think, this would make a great first PR :)
Anyone interested in pulling this off?

@timebertt I am wondering about how to implement the rotation component (starting with the Shoot CA). Did you envision this as a tool to be run by some admin, or as an extension that checks the remaining validity of the CA cert and then swings into action?

I would teach gardener to automate it, similar to the kubeconfig rotation, as metioned above:

rotation of the Shoot root CA

This should probably be automated somehow via some annotation similar to the kubeconfig rotation feature

So at first, operators and endusers can trigger the automation via the new annotation. And maybe later on, gardener-controller-manager could be instructed to do it automatically when approaching the end of a CA's validity

We had an initial meeting (THX @timebertt ) where a number of notes were taken:
Notes from SAP Meeting:

Hint is towards the rotate kubeconfig credentials as it is relatively similar as to what we want to achieve: https://github.com/gardener/gardener/blob/master/docs/usage/shoot_operations.md#rotate-kubeconfig-credentials
Shoot Controller is here: https://github.com/gardener/gardener/tree/master/pkg/gardenlet/controller/shoot
There are some small places in the code where a Shoot and a Shooted Seed are handled differently. Those need to be treated with extra care to ensure rotation works in both cases.
currently all state for a Shoot is saved in the shootstate CRD, which could be reused in the first step to save all secret of the Shoot.
Suggestion is to duplicate the ShootState as a Backup
Code to generate CA for a Shoot: https://github.com/gardener/gardener/blob/master/pkg/operation/botanist/secrets.go#L44
The node rollout should be done 2 times:

First time to update kubelet and everything with the new CA bundle

(Optional) A second time to remove the old CA

| - update the cloud-config-downloader script to trust both CAs
This part might already be covered by the following PR: https://github.com/gardener/gardener/pull/3449

We had an initial meeting (THX @timebertt ) where a number of notes were taken:
Notes from SAP Meeting:

Hint is towards the rotate kubeconfig credentials as it is relatively similar as to what we want to achieve: https://github.com/gardener/gardener/blob/master/docs/usage/shoot_operations.md#rotate-kubeconfig-credentials
Shoot Controller is here: https://github.com/gardener/gardener/tree/master/pkg/gardenlet/controller/shoot
There are some small places in the code where a Shoot and a Shooted Seed are handled differently. Those need to be treated with extra care to ensure rotation works in both cases.
currently all state for a Shoot is saved in the shootstate CRD, which could be reused in the first step to save all secret of the Shoot.
Suggestion is to duplicate the ShootState as a Backup
Code to generate CA for a Shoot: https://github.com/gardener/gardener/blob/master/pkg/operation/botanist/secrets.go#L44
The node rollout should be done 2 times:

First time to update kubelet and everything with the new CA bundle

(Optional) A second time to remove the old CA

| - update the cloud-config-downloader script to trust both CAs
This part might already be covered by the following PR: https://github.com/gardener/gardener/pull/3449

One additional note from my side:

We might want to have some metrics / dashboards showing the expiration date of the Shoot CA (will open a dedicated issue for that)

One additional note from my side:

We might want to have some metrics / dashboards showing the expiration date of the Shoot CA (will open a dedicated issue for that)

One additional note from my side:
* We might want to have some metrics / dashboards showing the expiration date of the Shoot CA (will open a dedicated issue for that)

For simplicity sake, IMHO it should expose the validity of any and all certs that it knows about.

One additional note from my side:
* We might want to have some metrics / dashboards showing the expiration date of the Shoot CA (will open a dedicated issue for that)

For simplicity sake, IMHO it should expose the validity of any and all certs that it knows about.

/assign @BeckerMax @rfranzke
/in-progress

Now that GEP18 got merged with https://github.com/gardener/gardener/pull/5395, we can start with the implementation.
Please note that the below list is continuously subject to change and can be extended or shrank based on the made experience during the implementation phase.
Tasks
Prerequisites

[ ] Introduce CARotation  feature gate, extend core.gardener.cloud/v1beta1.ShootStatus, introduce trigger annotation and maintain new status fields.
[ ] Make sure that all control plane and system components

Phase 1 ("Preparation")

[ ] Generate a new CA and put it into the bundle together with the old CA (for each of the CAs)
[ ] Trigger a node rollout

Phase 2 ("Completion")

[ ] Renew server and client certificates
[ ] Drop old CA

After https://github.com/gardener/gardener/pull/5459, I was not too happy with the manual injection of the checksums since this can easily lead to issues when it is forgotten or done wrongly. The same needs to be done for the extensions and it is generally quite fragile.
In a discussion with @timebertt, we agreed on closing this PR and rather rework the entire secret generation in gardener/gardener.
Concretely, we want to work with immutable Secrets with unique names. This way, we don’t need any checksum annotations since the Secrets would have unique names, i.e., referencing a different Secret triggers a rolling update.
Additionally, we would like to introduce a new SecretsManager concept in preparation for the multiple CAs, CA bundles, etc. later on such that it’s easy for components to consume the right secret while encapsulating the related logic in this SecretsManager instead of replicating it to each component.
We are also thinking about combining this with a webhook in GRM for auto-replacing secret names in volumes with the unique names of the secrets, similar to the projectedtokenmount webhook. This way, extensions would not need to care about the CA rotation at all.
Along the way, we envision cleaning up a few things regarding today’s central secret management, so the full motivation for doing this now is:

Get rid of duplicated ca.crt key in secrets data
Scalability:

Immutable Secrets/ConfigMaps are not watched by kubelet
No need to persist such secrets in ShootState

Move secret generation to components (ref #2754)
Prevent programmer-level errors when checksums annotations are forgotten to inject
Refactoring of complicated and legacy central secret generation is anyways overdue (this coding is one of the oldest in this repository and building rotation on top of the existing implementation will just create new technical debt)

All related tasks have been completed.
/close

Awesome!

Outstanding!


feat: bump deps and avoid using @import

Pull Request Test Coverage Report for Build<PHONE_NUMBER>0
Details

0 of 2 (0.0%)  changed or added relevant lines in 1 file are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-0.05%) to 57.785%

Changes Missing Coverage
Covered Lines
Changed/Added Lines
%

plugins/development/plugin-palette/src/node/palettePlugin.ts
0
2
0.0%

Totals

Change from base Build<PHONE_NUMBER>7:
-0.05%

Covered Lines:
1171

Relevant Lines:
1820

💛  - Coveralls


Logout component

The application was missing the ability for a user to logout from their session from anywhere within the application.
https://www.loom.com/share/005a2706552c41a9ac3dafe3d66329a5
Description
3/7/22:
See Trello card here
Type of change
Bug fix (non-breaking change which fixes an issue)
Change Status
Complete, tested, ready to review and merge
Has This Been Tested
Yes
Checklist

[x] My code follows the style guidelines of this project

[x] I have performed a self-review of my own code

[x] I have commented my code, particularly in hard-to-understand areas

[x] I have made corresponding changes to the documentation

[x] My changes generate no new warnings

[x] There are no merge conflicts

Can you rebase main into your branch? That should resolve the merge conflicts that are there.

Having a lot of issues with this because the filename has changed and there is a rebase conflict.
Took a few cracks at it but I'm getting stuck.


Feature: Credential injection via command line

Feature description
I have a small request regarding credential management for conduit.  I would like to inject my AWS keys from the command line (environment vars) for use in accessing AWS resources like S3.  Thanks!

@dannob Thanks for submitting this feature request! May I ask to clarify a bit more, what kind of AWS resources would you like to access from Conduit, i.e. what are your use cases?
We do have an S3 plugin, which allows you to stream data from S3 or into S3, and that plugin can be easily configured.

We plan to address this issue in #32, which will add a way to define a pipeline in a configuration file that Conduit loads at startup. It will be possible to inject environment values in that file, I think this should cover your use case.
I'm closing the issue now as this will be addressed in another issue, let us know if you had something different in mind.


Support for arm?

Hello,
Do you support arm?

Will current limited man power and resource, arm support is not in roadmap, yet:

My clients use amd64, for both bare meta, private cloud or public cloud
All these Ansible Collection and Roles are tested with amd64 Vagrant + Libvirt
All these OBS repo (see https://build.opensuse.org/project/show/home:alvistack) are amd64 only
In case you would like to have a relatively stable arm support from Ubuntu / Fedora / openSUSE, most likely you will need the latest rolling release for now, e.g. Fedora Rawhide or openSUSE Tumbleweed (which are not daily data center production ready and focus)

Back to the 1st point: no paid production use case from client, no funding and resource for corresponding arm support.
P.S. contribution is welcome, but first of all we need to make OBS repo support arm smoothly.

Hi, Im trying that but im hitting some issues, Ill close this and open another with the error im hitting, thanks!


[otbn,dv] Add functional coverage for the key sideload interface

@prajwalaputtappa: Since I know you've thought about this interface a bit: anything you can think of that I've missed?

@prajwalaputtappa: Since I know you've thought about this interface a bit: anything you can think of that I've missed?

@rswarbrick: This looks good to me. I can't think of anything you have missed.


Configuring the default shell for OpenSSH in Windows

https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_server_configuration

Document details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 07417484-bd6d-e6f4-110e-e42c2428a369
Version Independent ID: 844743a6-f67b-421f-9591-13da36b23b14
Content: Installation of OpenSSH For Windows
Content Source: WindowsServerDocs/administration/OpenSSH/OpenSSH_Install_FirstUse.md
GitHub Login: @maertendMSFT

Hi, there is not description about what the issue is with this article. I will close this now, but if you want to provide more information later, then please open a new issue. Thank you.
#please-close


[TimeSeriesCard] Y Axis values not correct for Line chart

Describe the bug
Y-axis values are all the same when the actual graphed values are different.
To Reproduce
Steps to reproduce the behavior:

Go to TimeSeriesCard implementation
Set values to 4700-4800
See that the Y-axis only shows '5K'

Expected behavior
Y-axis should show more distinct ranges such as 4700, 4800, 4900
Environment/versions:

OS: MacOS
Browser: chrome
carbon-addons-iot-react version:v2.92.0

Additional context

Specific timeline issues / requests
will fix myself

:tada: This issue has been resolved in version 2.98.1 :tada:
The release is available on:

npm package (@latest dist-tag)
GitHub release

Your semantic-release bot :package::rocket:


"Requesting mirror on un-marked class" while using isSubtypeOf()`

I have a setup like this:

@MyReflector()
class A {}

class B extends A {}

@MyReflector()
class C extends B {}

@MyReflector()
class D extends C {}

class MyReflector extends Reflectable {
  const MyReflector() : super(declarationsCapability, typeRelationsCapability);
}

Note that the classes or not really declared like this, they are in different libraries, but the tree in important and what classes are reflected on.
Now, when I have a class mirror on D and one on A and I try to do dMirror.isSubtypeOf(aMirror), I get this error:
  Failed to load "test/all_tests_web.dart": Requesting mirror on un-marked class, superclass of 'C'
  all_tests_web.dart.browser_test.dart.js 3187:17   dart.wrapException
  all_tests_web.dart.browser_test.dart.js 37186:19  NonGenericClassMirrorImpl.dart.ClassMirrorBase.get$superclass
  all_tests_web.dart.browser_test.dart.js 37163:18  NonGenericClassMirrorImpl.dart.ClassMirrorBase._isSubtypeOf$1
  all_tests_web.dart.browser_test.dart.js 37168:35  NonGenericClassMirrorImpl.dart.ClassMirrorBase._isSubtypeOf$1
  all_tests_web.dart.browser_test.dart.js 37157:21  NonGenericClassMirrorImpl.dart.ClassMirrorBase.isSubtypeOf$1
  all_tests_web.dart.browser_test.dart.js 33441:28  FactoryRegistry.dart.FactoryRegistry._isRegistrableDeclaration$1
  all_tests_web.dart.browser_test.dart.js 3507:14   anonymous.eval
  all_tests_web.dart.browser_test.dart.js 9072:24   WhereIterator.dart.WhereIterator._f$1
  all_tests_web.dart.browser_test.dart.js 9064:20   WhereIterator.dart.WhereIterator.moveNext$0
  all_tests_web.dart.browser_test.dart.js 15398:47  WhereIterable.dart.Iterable.forEach$1

This error only occurs in transformed mode.
I noticed that, in the VM, the class mirror instances had this String representation
ClassMirrorImpl('ClassMirror on 'ClassName''),
while in transformed mode, they are
NonGenericClassMirrorImpl(library.namespace.to.class.ClassName).
Note the use of the qualified name in transformed mode. This is probably not a problem, but it would be nice to have a more streamlined idea of when the class name is used and when the qualified name.
This issue is probably due to the fact that isSubtypeOf works recursively over the inheritance tree and when a class is in the tree that is not reflected on, it fails.
I just tried by adding a SuperclassQuantifyCapability to my reflector and it works. But I think the TypeRelationsCapability should work without having reflection over all superclasses.

It seems that after adding SuperclassQuantifyCapability, isSubtypeOf does no longer throw, but I seems to always return false.

In fact, isSubtypeOf needs to traverse the supertype graph (including the superclass chain), and it is unable to respond with either true nor false when some types in that graph are not defined (that is, no support for them has been requested) and no evidence is found for a subtype relationship. It would be possible to return true when evidence is found, even in the cases where some types are not defined, but this would still make subtyping queries quite unsafe in a setting where just a part of the subtype graph is supported.
We need to consider whether we want to extend the semantics to tolerate some undefined types, but it will not be possible to return false when only a part of the graph is available, so there is no way it could be made safe.
Can't you use SubtypeQuantifyCapability to ensure that you get a complete graph in the first place?
If you have a case where you get false but should have had true then it would be very useful if you extract a minimal example---that would be a clear bug.

Bumped into https://github.com/dart-lang/reflectable/issues/72 trying to resolve this.
In fact, this issue can be closed when isSubtypeOf is documented with a mention of the fact that all intermediary classes should have reflection support as well.

https://codereview.chromium.org/1695453002/ adds documentation to many mirror methods, including the fact that isSubtypeOf and isAssignableTo requires coverage for all classes traversed by those algorithms. Issue #76 describes the underlying problem (that isSubtypeOf and isAssignableTo are expensive in terms of class coverage), so further developments will be covered there (if anybody gets a good enough idea about how to do it ;-).


fix fullscreen in notch displays

I would like to work on this @LiquidatorCoder

@Himanshuranjan30 Thanks for showing interest.
For this issue please add <item name="android:windowLayoutInDisplayCutoutMode">shortEdges</item>
inside android/app/src/main/res/values/styles.xml inside the style tag.

@LiquidatorCoder Its done and have posted a PR too
Kindly give it a check

Okay will update you soon!

fixed in 76c76bb919f31f2b76cb7618cb77ad0de71baa3c


handling outlier molecules in match_minima.py

On the full benchmark set, while generating plots with match_minima.py using data read in from pickle file, the memory grows exceedingly high (observed > 60 Gb) and is eventually killed.
I am working on identifying high memory use areas using the memory_profiler package with
PYTHONPATH=../ python -m memory_profiler ../match_minima.py -i match.in --cutoff 1.0 --plot --readpickle

Issue was traced back to molecules with extremely high disparate energies. For example, in this plot (disregarding the RMSD axis) some GAFF energies are exceedingly high -- 3.5e7 kcal/mol.

This particular case is due to GAFF missing a specific vdW parameter for polar hydrogen atoms leading to overlapping atoms. Additional molecules with this issue are here:

A temporary workaround is commented in https://github.com/MobleyLab/benchmarkff/blob/master/03_analysis/match_minima.py#L847-L852


Support trusted connection for mssql

This is related to this discussion: https://github.com/sfu-db/connector-x/discussions/145


Test: Viewlet/ViewContainer Refactor

Refs #85566

[ ] anyOS @isidorn
[ ] anyOS @sandy081

Complexity: 2
Test the branch for the PR to ensure there are no regressions introduced so that we can be in a great starting state for next iteration.

Sounds good. Imho this touches a lot of areas and will require a bit more time, thus increasing complexity to 3.

Great work. I could find some issues, but they were mostly present before your refactoring.


remove app.views.dll from all .NET 6 content

Fixes  #22204

@captainsafia the diff is not highlighting what was deleted, but it's correct. Removed app.views.dll and app.views.pdb.
Amazingly, all other app.views.dll in the repo were in previous versions and won't show in .NET 6


Missing UC Mobile Browser in Mobiles test

Hi  Niels:
I created issue #151 several days ago and  I'm not sure if you read it. Maybe I didn't make sense to you.
Could you just please add UA support for UC Mobile Browser in the Html5test process.
UC Browser 8.5  of android platform is currently the leading scorer in the Mobiles category with 415 points + 7 bonus points. Our user-agent string in HTC One X is showed as follow:
"Mozilla/5.0 (Linux; U; Android 2.1-update1; zh-cn; HTC One X/ERE27) UC AppleWebKit/530+ (KHTML; like Gecko) Mobile Safari/530"
As you can see, just matching "UC" should detect us.
You can get our product from http://www.uc.cn/product/product_ucbrowser_android.shtml. By the way, UC Browser 8.5  of android platform is not released yet, and it is coming soon. If you need to detect our product now, I can send it to you by e-mail.
In addition, you can know about further information of UC Browser from http://www.ucweb.com/index.html. UC Browser is very famous mobile browser in China, and over half of mobile Internet users are using it. In India market, we get  more than 25% of market share. And our servers cover over 150 countries.
Thanks in adavance for your assistance and do not hesitate to contact me shall you need further information.
Best Regards,
Rocky Ding

UC Browser is now supported


Add download speed limit support

What problem are we solving?
related to #3403
Avoid large file downloads taking up too much io time, causing other requests to execute slowly, resulting in decreased throughput
How are we solving the problem?
In the 'weed/filer/stream.go:74' method, slow down the chunk download frequency to ensure that the download speed does not exceed 'downloadSpeedMBps' (filer startup parameter)
Checks

[ ] I have added unit tests if possible.
[ ] I will add related wiki document changes and link to this PR after merging.


[base] plain pickling support

If users restore an object stored with an old version,
they receive a warning that things could fail.
Fixes #16

The problem only arises, when one uses a unit, which isn't defined in
the registry used to unpickle it.


Convert spec to be more RFC2119 and less CF-specific

Right now the spec is written like its a subset of the CF docs, which is it  :-)  but we need to make it more stand-alone and so a re-org is probably needed. While doing that we should make it more normative by adding the appropriate RFC2119 keywords to make it clear what's required/optional for people wanting to implement the spec.

I SHALL take a stab at a rough outline. First time writing a spec. :-)

see #95 for a start. I have several PRs ready to go after that merges to clean up the language and sections.

On a semi-related note I would love for the spec to be markdown. I object on principle to writing raw html in the year 2016.

@pmorie you and me both. I didn't want to mess with the conversion before I had to. I had to massage some of the tables from html into markdown, and I'll hit the rest of them in the future. I left the pandoc invocation I used in the PR.

@duglin I think this one can be closed? Or do you want to keep it open to review the doc coming from CF?

I'd prefer to leave it open because if the current work is more of a "move" then I suspect it'll still need some work to use the RFC2119 stuff.

Closing this as we have other issues/PRs in flight that should cover this.


Any new Project with Sass or Rest template fails to build

Description
Any fresh new Project  (made with the Sass or Rest template)  fails to build with error message
error: could not compile `time` (lib) due to 1 previous error
error[E0282]: type annotations needed for `Box<_>` \.cargo\registry\src\index.crates.io-6f17d22bba15001f\time-0.3.34\src\format_description\parse\mod.rs:83:9

let items = format_items
   |         ^^^^^
...
86 |     Ok(items.into())
   |              ---- type must be known at this point
   |
help: consider giving `items` an explicit type, where the placeholders `_` are specified
   |
83 |     let items: Box<_> = format_items

To Reproduce
Setup a new project using the Sass template and run cargo build or cargo run
Expected Behavior
the project should build
Environment:
Windows 11
Additional Context
the error happens inside the dev container too so it's not windows related

This is strange, we have a CI job that generates and builds a project for each of those. Can you take a look at the CI job and see what the difference is from what you're trying to do?

@brahimABD98, can you now try the latest nightly version?

@kaplanelad works perfectly