Read-write capabilities

Note: this is a DBus API break
First patch namespaces the enums better (#224), but the meat is in the second and third patch (the API break).
Right now we have a set of device capabilities but they're a bit... random? We have separate bits for "resolution" vs "switchable resolution". I think it's better to just export the device capabilities as 'r', 'w', or 'rw'. There are devices where we can't read the config but we can write it, others where we can read but not write.
This is mostly mechanical search/replace, but the third patch has the new DBus API which now sends Capabilities as type a(us) - the enum value followed by a string with the characters for each mode ('r', 'w', 'rw', 'wr', ...).

Requesting lots of reviews because this may/will become the final API :)

Something that I thought of since pushing this: RATBAG_DEVICE_CAP_PROFILE_DISABLE and RATBAG_DEVICE_CAP_PROFILE_DEFAULT should be a profile capability, not a device capability. Which means that we need to either think of adding rw to those as well. We can then also rethink the other capabilities because now:

RATBAG_DEVICE_CAP_CONFIGURATION - still useful as flag for write-only devices (I don't think read-only devices exist, short of missing implementations)
RATBAG_DEVICE_CAP_RESOLUTION - implied if we have resolutions, so only the write bit is useful.
RATBAG_DEVICE_CAP_PROFILE - implied if we have profiles
RATBAG_DEVICE_CAP_BUTTON - implied if we have buttons
RATBAG_DEVICE_CAP_LED - implied if we have leds
RATBAG_DEVICE_CAP_BUTTON_KEY and RATBAG_DEVICE_CAP_BUTTON_MACROS is probably better as button flag

So effectively this leaves us with only one useful capability which is the one that tells us whether we can write to it. And - new feature - maybe a new bit that tells us it's not persistent. But all the other ones are implied, which makes me think this patchset isn't that useful and can be replaced with one that drops all of them.
Doubly so because we should assume that we have full access to a device, so the bits are more to tell us where a device doesn't do what we'd expect (e.g. we have LEDs but we can't write to them).

Closing in favour of #631


at_chops decryptBytes method fails if SymmetricEncryptionAlgorithm is set and IV is passed as null

Describe the bug
method
 AtEncryptionResult decryptBytes(
      Uint8List data, EncryptionKeyType encryptionKeyType,
      {AtEncryptionAlgorithm? encryptionAlgorithm,
      String? keyName,
      InitialisationVector? iv}) {
      ....
      }
      if (encryptionAlgorithm is SymmetricEncryptionAlgorithm) {
        atEncryptionResult.result = encryptionAlgorithm.decrypt(data, iv: iv!); //fails here due to non null IV in decrypt
        atEncryptionMetaData.iv = iv;
      }

Steps to reproduce
 var encryptionAlgo = AESEncryptionAlgo(AESKey(symmetricKey));
    final decryptionResultFromAtChops = super.atClient.atChops!
        .decryptString(encryptedValue, EncryptionKeyType.aes256,encryptionAlgorithm:encryptionAlgo, iv: iV);

Expected behavior

appropriate exception should be thrown asking caller to set IV correctly
or
defensive code in at_chops to use legacy IV

Screenshots
No response
Smartphones
No response
Were you using an atApplication when the bug was found?
No response
Additional context
No response

closed through https://github.com/atsign-foundation/at_libraries/pull/554

closed through https://github.com/atsign-foundation/at_libraries/pull/554


Add swagger query parser

Add parser for swagger query parameter objects.  Only queries explicitly added as parameters in swagger.yaml will be parsed.  No routes support queries yet; this work will be submitted in another PR.
String type queries can be logically ORed by seperating them with a '+'.  For example, ?name='John+George' matches resources with name=John or name=George.

*** BUILD #636 ***
Test Name: Redfish Session Service "before all" hook: start HTTP server
Error Details: timeout of 5000ms exceeded. Ensure the done() callback is being called in this test.
Stack Trace: Error: timeout of 5000ms exceeded. Ensure the done() callback is being called in this test.
    at tryCatcher (node_modules/on-core/node_modules/bluebird/js/main/util.js:26:23)
    at Promise._settlePromiseFromHandler (node_modules/on-core/node_modules/bluebird/js/main/promise.js:507:31)
    at Promise._settlePromiseAt (node_modules/on-core/node_modules/bluebird/js/main/promise.js:581:18)
    at Promise._settlePromises (node_modules/on-core/node_modules/bluebird/js/main/promise.js:697:14)
    at Async._drainQueue (node_modules/on-core/node_modules/bluebird/js/main/async.js:123:16)
    at Async._drainQueues (node_modules/on-core/node_modules/bluebird/js/main/async.js:133:10)
    at Async.drainQueues (node_modules/on-core/node_modules/bluebird/js/main/async.js:15:14)

:+1:

+1

test this please

:+1:

+1


set-default-repositories-type-to-sources: MutationObserver.observe: Argument 1 is not an object.

Please ensure:

[X] The bug is caused by Refined GitHub. It doesn't happen if I disable the extension.
[X] The bug happens after clearing extension cache. The "Clear cache" button below can also be found at the bottom of the options page.

Example URLs
http://localhost:8080/
https://dev.to/stevepryde/create-a-desktop-app-in-rust-using-tauri-and-yew-2bhe
Extension version
22.3.3
Browser(s) used
Firefox 98.0
Description
❌ toggle-files-button 22.3.3 GHE → TypeError: MutationObserver.observe: Argument 1 is not an object.
    observeElement simplified-element-observer.ts:14
    init toggle-files-button.tsx:40
    runFeature index.tsx:167
    setupPageLoad index.tsx:188
    add index.tsx:267
    async* toggle-files-button.tsx:48
    <anonymous> refined-github.js:10404
    <anonymous> refined-github.js:10405
❌ clean-repo-tabs 22.3.3 GHE → TypeError: undef[i](webpack:///source/features/index.tsx)ned has no properties
    unhideOverflowDropdown more-dropdown-links.tsx:38
    init clean-repo-tabs.tsx:108
    runFeature index.tsx:167
    setupPageLoad index.tsx:188
    add index.tsx:267
    async* clean-repo-tabs.tsx:113
    <anonymous> refined-github.js:10404
    <anonymous> refined-github.js:10405
❌ clean-repo-tabs 22.3.3 GHE → TypeError: undef[i](webpack:///source/features/index.tsx)ned has no properties
    unhideOverflowDropdown more-dropdown-links.tsx:38
    init clean-repo-tabs.tsx:108
    runFeature index.tsx:167
    setupPageLoad index.tsx:188
    add index.tsx:267
    async* clean-repo-tabs.tsx:113
    <anonymous> refined-github.js:10404
    <anonymous> refined-github.js:10405
❌ clean-repo-tabs 22.3.3 GHE → TypeError: undef[i](webpack:///source/features/index.tsx)ned has no properties
    unhideOverflowDropdown more-dropdown-links.tsx:38
    init clean-repo-tabs.tsx:108
    runFeature index.tsx:167
    setupPageLoad index.tsx:188
    add index.tsx:267
    async* clean-repo-tabs.tsx:113
    <anonymous> refined-github.js:10404
    <anonymous> refined-github.js:10405
❌ clean-repo-tabs 22.3.3 GHE → TypeError: undef[i](webpack:///source/features/index.tsx)ned has no properties
    unhideOverflowDropdown more-dropdown-links.tsx:38
    init clean-repo-tabs.tsx:108
    runFeature index.tsx:167
    setupPageLoad index.tsx:188
    add index.tsx:267
    async* clean-repo-tabs.tsx:113
    <anonymous> refined-github.js:10404
    <anonymous> refined-github.js:10405

❌ clean-repo-tabs 22.3.3 GHE → TypeError: undefined has no properties
    unhideOverflowDropdown more-dropdown-links.tsx:38
    init clean-repo-tabs.tsx:108
    runFeature index.tsx:167
    setupPageLoad index.tsx:188
    add index.tsx:267
    async* clean-repo-tabs.tsx:113
    <anonymous> refined-github.js:10404
    <anonymous> refined-github.js:10405

Include in this issue:

[ ] Screenshots/video/gif demonstrating the bug, if it’s visual
[X] Console errors, if any

The example URLs you provided have nothing to do with GitHub. Please provide some GitHub URLs so we can try to reproduce this.
Also it seems you're using GitHub Enterprise? Fyi we don't support older versions of GHE.


Daylite 6.2 has wrong checksum; there's also a newer version

The daylite cask is both broken (bad checksum) and outdated (the current version is 6.2.2). Installing the current cask fails with:
$ brew cask install daylite
==> Satisfying dependencies
==> Downloading https://download.marketcircle.com/daylite/daylitedma62.dmg
######################################################################## 100.0%
==> Verifying checksum for Cask daylite
==> Note: running "brew update" may fix sha256 checksum errors
Error: Checksum for Cask 'daylite' does not match.

Expected: e4229c3cacabddb74008e774420c2e3912138bce16f95b84d63ae1178ad3d696
Actual:   4a2637c9d60cd36c699eb192eda448da73de42665008e9336c5f12d2e23d1cb9
File:     /Users/foo/Library/Caches/Homebrew/Cask/daylite--6.2.dmg

To retry an incomplete download, remove the file above.
Error: Install incomplete.

The web site's download link of https://www.marketcircle.com/daylite/download/6/daylitedma/ downloads daylitedma622.dmg instead.

Updating a Cask

https://github.com/caskroom/homebrew-cask/pull/38184


Refactor conversation-activity-filter

#5408

Update to GitHub's new list style (refer to the native issue filter dropdown)

Refactor to only process all timeline items once, and let the browser hide items for us
This should speed up the feature theoretically and simplify the code a bit

Refactor to remove global currentSettings
This makes code cleaner and also fixed a bug that on minor bug fix pages, the initial state of the button inside the sticky header is wrong:

Test URLs

https://github.com//refined-github/refined-github/pull/5253
Minor bug fix pages: https://github.com//refined-github/refined-github/issues/4008

Screenshot

Before
After

No good 🥲 with the shortcut being added we probably have to keep the global state...
...somewhere. Maybe on the DOM.

Maybe on the DOM.

It's already there ;)

Can you also add a white-space: nowrap on summary to avoid this?

Let's merge this if it works as expected, including when new comments pop in.

The feature correctly responds to newly resolved comments, but not to resolved reviews (the page needs to be reloaded).
https://user-images.githubusercontent.com/46634000/158339148-7389ac1f-e070-45f8-910b-68f601c3eb67.mp4

comments that are loaded by clicking "Load more"

Yes those are hidden properly. Actually, I was thinking of extending the feature to automatically click "Load more" buttons when a filter is activated, since they end taking more space than they're saving when every resolved comment is hidden.

Can you also add a white-space: nowrap on summary to avoid this on small windows?

I already fixed that, no need for white-space: nowrap.


Allowing RC4 cipher in order for older phones to connect

Hard to see actual change, only thing was removing ! before RC4

nice! does this fix things?!

Yes, this allows the Nokia phones to connect

wild


replace eggs with particles

Current/Expected Behavior
how do I make sure that the weapon does not shoot eggs, but various particles?
Steps To Reproduce
1
Log File
11
Anything else?
No response

Join the discord for support.
To use particles, you need to purchase WeaponMechanicsCosmetics.


Using Infinityfree to upload NFT image links

The webside still hasnt generated... says allow 72 hours. Do I have to wait 72 hours, and do I really need this link for the pngs to upload or will they upload without that link? Like will it pull the png for opensea from the code or from the link/website? Also, for the website that i put for the uri, do i just put https://[the website name I made]/htdocs ?? Lastly, how do I upload all 20,000 files (10000 pngs and 10000 json) to the folder?

Alright. My website just finished setting up and I can now access it. I still am having trouble with the following: what link do I put in the code uri and how do I transfer all 20000 files?

Actually just figured out the link. Now just gotta find out how to upload all 20000 files..


Fails to build

Seems like you're missing a Makefile.am in src/plugins?
tsdgeos@xps:~/Little-CMS:master$ make
Making all in src
make[1]: Entering directory '/home/tsdgeos/Little-CMS/src'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/home/tsdgeos/Little-CMS/src'
Making all in include
make[1]: Entering directory '/home/tsdgeos/Little-CMS/include'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/home/tsdgeos/Little-CMS/include'
Making all in utils/tificc
make[1]: Entering directory '/home/tsdgeos/Little-CMS/utils/tificc'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/home/tsdgeos/Little-CMS/utils/tificc'
Making all in utils/transicc
make[1]: Entering directory '/home/tsdgeos/Little-CMS/utils/transicc'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/home/tsdgeos/Little-CMS/utils/transicc'
Making all in utils/linkicc
make[1]: Entering directory '/home/tsdgeos/Little-CMS/utils/linkicc'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/home/tsdgeos/Little-CMS/utils/linkicc'
Making all in utils/jpgicc
make[1]: Entering directory '/home/tsdgeos/Little-CMS/utils/jpgicc'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/home/tsdgeos/Little-CMS/utils/jpgicc'
Making all in utils/psicc
make[1]: Entering directory '/home/tsdgeos/Little-CMS/utils/psicc'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/home/tsdgeos/Little-CMS/utils/psicc'
Making all in testbed
make[1]: Entering directory '/home/tsdgeos/Little-CMS/testbed'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/home/tsdgeos/Little-CMS/testbed'
make[1]: Entering directory '/home/tsdgeos/Little-CMS'
make[2]: Entering directory '/home/tsdgeos/Little-CMS/plugins/fast_float'
make[2]: *** No rule to make target 'all'.  Stop.
make[2]: Leaving directory '/home/tsdgeos/Little-CMS/plugins/fast_float'
make[1]: *** [Makefile:910: all-local] Error 2
make[1]: Leaving directory '/home/tsdgeos/Little-CMS'
make: *** [Makefile:476: all-recursive] Error 1

Hopefully fixed

Nope, it's worse now

Since i can reopen i'll open a new issue iguess


"Non-complaint" typo on report

Describe the bug
"compliant" is spelt complaint in the report below.

Expected behavior
Text to say "compliant".
Environment (please provide the following information about your setup):

Testrun v2.0

This has been fixed and merged into dev. This will be released in v2.1.


For prod builds remove angular debug symbols

Needs to be done in code.  Egghead video and others referenced the setting.....

https://docs.angularjs.org/guide/production

Enabled ng-strict-di


Cursor strategy meta has empty from and to strings in meta

Example response:
{
  "meta": {
    "page": {
      "per-page": 100,
      "from": "",
      "to": "",
      "has-more": false
    }
  },
  "links": {
    "first": "/api/v1/foobars?filter%5Bcompleted%5D=0&page%5Blimit%5D=100",
    "prev": "/api/v1/foobars?filter%5Bcompleted%5D=0&page%5Blimit%5D=100"
  },
  "data": []
}

In the meta, the from and to are empty strings, but should either be null or not exist. (Check what the page strategy does and align with that.)

Page strategy uses null.

Also noticed that the prev link should not be there as there cannot be a previous page. The first link is legit though as the first page will just be empty.


Fixed library not being named correctly on Windows with ZLIB_COMPAT

See #533.
This change gets rid of LIBNAME1 and LIBNAME2 and just sets the output name of the library directly based on platform using set_target_properties.

Rebased

Codecov reported on GH before all checks completed..

codecov edits its comment if more data is made available or a new change is pushed :)
And it actually seems to work now :)

Wouldn't this change break naming on linux, where we want it named libz when in compat mode?

It still contains set_target_properties(${ZLIB_INSTALL_LIBRARIES} PROPERTIES OUTPUT_NAME z${SUFFIX})


[Documentation Request] - Please go into more detail on TOR usage

The front page at www.sparrowwallet.com lists "Built in Tor" as a feature, but then TOR is only sparingly mentioned in the rest of the documentation, and only when configuring a private electrum server with a .onion address. But then searching through github issues, I see that other connections like connections to mempool and coingecko are sent out over TOR.  It would be nice to get a clear statement about when the "Built in TOR" is used, and what "Built in TOR" means.
I'm switching from Wasabi Wallet, which has its own "built in tor" client, making all of its connections over the TOR network by default, without any additional configuration.
The questions I'd like to see answered are:

Is there an actual built in TOR proxy server/client? Or does "Built in Tor" just mean "Support for a user specified TOR proxy"?
Do I need to specify a .onion electrum server for TOR to be used?
When using a public server from the built in drop down list, if I do not specify a proxy server, will "Built in TOR" automatically be used for all of my connections? Including to my chosen public electrum server, mempool, coingecko, DNS, or any other server accessed by the sparrow wallet?
If I specify a non-TOR generic SOCKS proxy (like for my VPN provider), will the "built in TOR" establish a tunnel over that connection? Or is TOR disabled at that point? Or does the software make the assumption that any proxy server entered IS a tor proxy, and therefore capable of resolving .onion addresses without launching the built in TOR proxy?
Thanks.

PS. I understand this isn't a support forum, and while I'd love to get an answer here and now, most importantly I think it would be helpful to other users going forward if TOR usage was more clear in documentation.

This is covered in the documentation as an FAQ: https://sparrowwallet.com/docs/faq.html#how-does-the-proxy-support-work.
Sparrow does not make the use of Tor mandatory, since the Tor network can be unreliable, and IMO it is unwise to unconditionally tie access to your funds to an unreliable network, however beneficial it is to your privacy.
To answer your questions:

Is there an actual built in TOR proxy server/client?

Yes.

Do I need to specify a .onion electrum server for TOR to be used?

Yes, if you don't configure an external Tor proxy.

When using a public server from the built in drop down list, if I do not specify a proxy server, will "Built in TOR" automatically be used for all of my connections?

No. If you want this behaviour, configure an external Tor proxy.

If I specify a non-TOR generic SOCKS proxy (like for my VPN provider), will the "built in TOR" establish a tunnel over that connection? Or is TOR disabled at that point?

The internal Tor is disabled. Most VPN configuration these days is not done via a proxy.
The TLDR of all this is that users who have more stringent security and privacy requirements should run an external Tor proxy and configure it in Sparrow. Ideally, a Tor proxy should be a long lived process for better connectivity, while a Bitcoin wallet should only be run as necessary for better security.

I've added another FAQ here, which should clarify this: https://sparrowwallet.com/docs/faq.html#does-sparrow-require-tor

I believe the proxy implementation may be deeply flawed.
When only the tor socks5 proxy is available sparrow fails:
Test Connection:
Could not connect:

Failed to resolve address: ****************

So it appears DNS doesn't just leak but is never torified.
socks5 has address resolution as part of the protocol...

@voidastro4 Electrum server connections are (required to be) long-lived TCP connections. For the purpose of limiting resource usage on public servers, Sparrow does not open a new connection for every wallet. As noted in the documentation, I recommend running your own server for better privacy. Sparrow offers several options to achieve this.


plants_utils_eia860 introduces NA values which get dropped

In some cases, plants or utilities may have missing attributes in their entity tables. E.g. there are several thousands plants that have no state.  This can create issues when we're constructing the denormalized output tables, and result in data rows getting dropped, maybe unnecessarily.
For example, in fuel_receipts_costs_eia923() after merging in the results of plants_utils_eia860 there are 11,040 records that lack a utility_id_eia, most of which also happen to lack a state value. To ensure that the output table is usable and has all the IDs that downstream data products expect, these records are dropped, but this means that 11,040 FRC records with fuel delivery data are missing from the output table, even though they do have the plant, date, and fuel type information that's more fundamental to this table.
In creating the database views which replace the output tables, we should be more careful with these kinds of merges, and ensure that we aren't introducing null values we don't need to introduce, and are keeping as many of these data records as we can.
This caused problems / confusion in issue #1343

Is it possible to try and fill in the state values? I've seen this problem crop up a few times where date_merge (or a normal merge) is performed on the output tables and the subsequent dropna removes a lot of previously valid records. Seems like we have a few of these imputation problems we could work on in the future.


Availability of OPRF?

OPRFs can be useful primitives in privacy-preserving protocols.
Does this library contain any OPRF implementations? If not, are there plans to include some in the future?
In particular, I'm looking for a verifiable threshold OPRF with committed inputs that can be composed with other primitives. For example, I'd like to be able to prove that for a given value pid, I posses a credential for a value id (i.e., a signature sig = SIGN(id) from a credential issuer) and that OPRF(id) = pid, without revealing id.

Hi,

Does this library contain any OPRF implementations? If not, are there plans to include some in the future?

No.

I'd like to be able to prove that for a given value pid, I posses a credential for a value id (i.e., a signature sig = SIGN(id) from a credential issuer) and that OPRF(id) = pid, without revealing id.

If this is the exact requirement, then pid is what's called a pseudonym and you can use SyRA for this. The user's sig is what SyRA calls "user secret key" which contains user's unique attribute id and the user generates a pseudonym using his sig and a public value Z given by the verifier as pseudonym(sig, Z) and a proof that the inputs to pseudonym were infact sig and Z without revealing sig or id. Note that pseudonym is not randomized and depends only on sig and Z so the user cant create a different pseudonym from the same sig and Z.
Technically pseudonym is not an OPRF, since the user learns Z but doesn't look like that's your requirement.
You can combine this construction with schemes like BBS+ to get anonymous credentials with attributes where the BBS+ credential has other user attributes and the issuer, in addition to BBS+ signature, gives a  SyRA signature.
You said threshold OPRF. Which part of would you want to thresholdize, SIGN?

Hi, thx for the reply, will definitely have a look at SyRA.
Threshold OPRF because of the following. (Also wanted to ask whether this is a problem with respect to SyRA.)
So in my setting, the user id id certified in the credential is low entropy (you can consider this a passport number, which is essentially guessable). Still we want to hide it when proving eligibility (the application I have in mind is voting). Furthermore, the mapping from id to pid should be deterministic (there should be exactly one pid for a corresponding id), so that we can check if somebody voted twice. Still pid should not leak id. An OPRF can generate pid from id such that this holds as long as the OPRF key is not leaked. If the OPRF is evaluated by just a single party, then this party knows the key and could identify id from pid simply by evaluating the OPRF itself. Hence, I'd thought the solution to this problem would be to thresholdize the OPRF, so that no single party actually knows the OPRF key.
Does that make sense?

Had a look at SyRA. This looks very promising for my use case.
One differentiation though, I think, is that in SyRA the issuer plays a central role. If I understand correctly, credentials issued by different issuers cannot be mixed.
For example, I could not allow voters who received their credential from different issuers, to vote on the same poll.
Is my understanding correct?

So in my setting, the user id id certified in the credential is low entropy (you can consider this a passport number, which is essentially guessable). Still we want to hide it when proving eligibility (the application I have in mind is voting). Furthermore, the mapping from id to pid should be deterministic (there should be exactly one pid for a corresponding id), so that we can check if somebody voted twice. Still pid should not leak id.

This is achieved by SyRA.

An OPRF can generate pid from id such that this holds as long as the OPRF key is not leaked.

I should have mentioned before but when using SyRA as (O)PRF, id is the PRF key. But if the user want's to secret share id (seems impractical as all share holders have to be invoked on each usage of the credential), the current proving protocol won't work.

I could not allow voters who received their credential from different issuers, to vote on the same poll.

You mean if a single voter got multiple credentials, one from each issuer, then correct. Their pseudonyms (or PRF output) on same id will be different thus counting as different votes.
If you can share more details about your use-case, like what conditions must be met to get a credential, can issuers collaborate, etc, I can think a bit more

Read further into the paper. Another noticeable difference: In SyRA, the user private key is chosen by the issuer. Hence, if the issuer is compromised, it could generate signatures on behalf of the user.
(For that reason, thresholdizing the issuer seems absolutely necessary. As far as I can see, the thresholdized issuer protocol has not been implemented yet, correct?)
In my imagined design, the user secret key is chosen by the user and not revealed to anyone. Generating a pseudonym is a separate step. Compromising the pseudonym issuer would only compromise anonymity, but not allow voting on behalf of the user.
I'll write up a few more details below on what I have in mind. (Note that I have not been able to come up with a concrete and efficient realization of the protocol so far, but I think it's theoretically possible.)

Target application: anonymous voting
Involved parties: User/Voter (U), Credential Issuer (CI), Poll Organizer (PO), Append-only Public Bulletin Board (B)
Step 1: U proves identity and obtains credential from CI
U convinces CI of identity id
U chooses secret key sk
U requests credential cred for (id, sk) from CI, which is a partially blind signature for on (id, sk) where sk is blinded. (This can be realized using BBS.)
Step 2: U obtains poll id from PO
U and PO evaluate pid = OPRF(id), where PO holds OPRF key.
U obtains a proof pi of correct evaluation.
(Something like this can be realized using BLS, but there is a catch, see below.)
Step 3: U publishes vote on B
U signs vote v using sk and creates a proof pi_vote for the following:

VerifyCred(cred, (id, sk)) = 1
VerifyPid(id, pid) = 1
VerifyVote(sk, v) = 1
U publishes (pi_vote, v, pid) on B.
Anybody can verify that the voter is eligible by checking pi_vote and detect double-voting by checking for duplicate pid.
(Generating a proof of knowledge of a signature that has been created using a secret key contained in a credential shouldn't be too hard using known techniques. What I currently don't know is how to connect the OPRF proof with the rest of the two statements. Afaik, BLS can used as a verifiable OPRF (and is easy to thresholdize), but correct evaluation can only be verified if the input is revealed. I don't know how to make this work for committed inputs to the OPRF. I.e., we want to prove that for some commitment, the result of evaluating the OPRF on the committed value is correct, and there are certain relations of that committed input value to other inputs of the protocol (like there is a credential for that input).)

(For that reason, thresholdizing the issuer seems absolutely necessary. As far as I can see, the thresholdized issuer protocol has not been implemented yet, correct?)

Correct, it hasn't been. But I discussed with one of the SyRA authors to add it but the implementation is going to be different than the one in the paper.

 And I don't think you need sk (see below)

Step 2: U obtains poll id from PO
U and PO evaluate pid = OPRF(id), where PO holds OPRF key.

Before PO generates pid, it needs to check if U has a cred with id.
And in your first comment, were you meaning to thresholdize PO?

Step 3: U publishes vote on B
U creates a signature sig on vote v using sk.
U then creates a proof pi_vote for the following:

sk isn't needed as pi_vote can just be the proof of knowledge of signature in cred with the same id as used in generation of pid and v is just included in the challenge thus forming a signature over v. The same idea of getting a Schnorr signature from Schnorr's identification protocol.
Also note that a malicious PO cannot vote as it does not have cred but it surely can break anonymity of voter if using SyRA as it is.
Finally, I need to look more into the OPRF with desired property. Will get back to you on this.

I found an OPRF with committed inputs in this paper which allows oblivious evaluation of DY PRF on a committed input. Its described in steps 1 and 2 of the protocol in Fig 4 of the paper. m in that figure would correspond to id of the cred. The challenge is that OPRF input (m) in this case belongs to a group of composite order where id from group belongs to a prime order group likely of different sizes so I don’t know of a protocol to prove equality among them. This paper might help but haven’t looked enough. Once U has the PRF output, creating a signature of knowledge of the OPRF input on vote v can be done using known techniques.
Also in practice, PO might organize several polls, each with a new poll id and its permission to U to vote, which you call pid and represent with an OPRF. It should be comprised of both the poll id poll_id and user id id. So PO's OPRF should be a Partially Oblivious PRF (POPRF) where the POPRF's public and private inputs will be poll_id and id respectively. I considered this OPRF, with the construction described in section 4 and tried making it accept committed inputs by treating hash function H1 as scalar multiplication with a public parameter (PRF output is H(id)^{1/(sk + poll_id)} = G*id*{1/(sk + poll_id)}) but proving the equality of PRF’s private input with cred while voting didn’t work for low entropy values (can provide more details if interested).
So ideally you are looking at a POPRF with committed inputs.

Correct, it hasn't been. But I discussed with one of the SyRA authors to add it but the implementation is going to be different than the one in the paper.

Nice to hear. Looking forward to that. Mind outlining what's the differences?

Do you assume CI can't be malicious, i.e. issue cred with different id to same U. And I don't think you need sk (see below)
I now realize that there is a strong trust assumption on my CI as well. (I've created the design a while ago, so have to remind myself of the details...) My use case idea revolves around usage of the active authentication feature of digital passports. Basically, the goal is to turn a regular passport into a versatile digital credential. And the CI's job is to create that binding. Obviously, if the CI is not trustworthy, it could just issue credentials for any identity of its choice. Ideally, the CI is therefore also thresholdized or running in a TEE. Nevertheless, I wanted to ensure that the CI does not learn user secrets in any case. User secret keys of honest users should never leave the user device.

Before PO generates pid, it needs to check if U has a cred with id. And in your first comment, were you meaning to thresholdize PO?

You are right. I missed that point. Otherwise, anyone could check whether pid = OPRF(id) for other id's and thereby reveal identities.

sk isn't needed as pi_vote can just be the proof of knowledge of signature in cred with the same id as used in generation of pid and v is just included in the challenge thus forming a signature over v. The same idea of getting a Schnorr signature from Schnorr's identification protocol. Also note that a malicious PO cannot vote as it does not have cred but it surely can break anonymity of voter if using SyRA as it is.

You are right. Technically sk isn't needed if we keep the credential secret. However, as outlined above, I wanted that the CI does not learn user secrets in the honest case. If we want this property (that the CI doesn't learn the credential), regular BBS does not suffice, right? We would have to use some form of BBS blind signatures, correct?
Moreover, i thought it might have practical benefits if the user secret is a "regular" secret key instead of the full credential.

I found an OPRF with committed inputs in this paper which allows oblivious evaluation of DY PRF on a committed input. Its described in steps 1 and 2 of the protocol in Fig 4 of the paper. m in that figure would correspond to id of the cred. The challenge is that OPRF input (m) in this case belongs to a group of composite order where id from group belongs to a prime order group likely of different sizes so I don’t know of a protocol to prove equality among them. This paper might help but haven’t looked enough. Once U has the PRF output, creating a signature of knowledge of the OPRF input on vote v can be done using known techniques.

Thanks for digging out that paper. It looks like an interesting approach.

Also in practice, PO might organize several polls, each with a new poll id and its permission to U to vote, which you call pid and represent with an OPRF. It should be comprised of both the poll id poll_id and user id id. So PO's OPRF should be a Partially Oblivious PRF (POPRF) where the POPRF's public and private inputs will be poll_id and id respectively.

The way I imagined it is that the PO uses a different OPRF key for each poll. This way, the pseudonyms are automatically scoped. The corresponding verification key can be considered as the unique global poll id.

Overall, I need to reevaluate my design in comparison to SyRA, which I haven't been aware of.
There seem to be the following core differences:

SyRA

One third party component: CI
User pseudonyms are derived from real id, CI key, public poll context: pid = Derive(id, k_CI, poll_ctx).
The CI generates the user secret.

OPRF approach

Two third party components: CI, PO
User pseudonyms are derived from real id, PO poll key: pid = Derive(id, k_PO).
The user secret never leaves the user device.

Because the pid is not bound to the CI with the OPRF approach, users who obtained their credentials from different CIs can still vote on the same poll. In a way, the credential issuance is more decoupled from the application layer.

Nice to hear. Looking forward to that. Mind outlining what's the differences?

It will be based on OT based multiplication, likely this one since we already do that for threshold BBS+ and SyRA signature has similar structure.

If we want this property (that the CI doesn't learn the credential), regular BBS does not suffice, right? We would have to use some form of BBS blind signatures, correct?
Moreover, i thought it might have practical benefits if the user secret is a "regular" secret key instead of the full credential.

It doesn't matter that the CI learns the credential since the any usage of cred doesn't reveal the signature and CI couldn't learn it even after interacting with PO or any verifier. But I see that you might have other uses of sk, like creating a pseudonym based on sk where the use-case permits.

The way I imagined it is that the PO uses a different OPRF key for each poll. This way, the pseudonyms are automatically scoped. The corresponding verification key can be considered as the unique global poll id.

This works in a very simple deployment where the verification key can just be published on bulletin board (BB).
If the BB has a significant publishing cost, you pay that for each poll. And if you have multiple concurrent polls, you need the BB to store multiple keys and "know" the correct one for verification so a bit more complex logic. And if the PO role is thresholdized, then they need to run a DKG for each poll.

SyRA
One third party component: CI
User pseudonyms are derived from real id, CI key, public poll context: pid = Derive(id, k_CI, poll_ctx).
The CI generates the user secret.

By user secret, you mean id? And you are implying the CI can know how user voted? And thresholdizing CI solves this issue?
Is the role PO not mandatory in your use-case?

Because the pid is not bound to the CI with the OPRF approach, users who obtained their credentials from different CIs can still vote on the same poll.

That would be true for SyRA as well if there are multiple CIs and they issue without checking if others issued as well.

What signature are you referring to here?

I was referring to the SyRA signature (what SyRA calls user secret key) and optionally BBS signature (when you have other attributes besides id). During voting, user proves knowledge of these 2 signatures in zero knowledge.

For generating vote signatures, the user certainly needs to hold some secret. What is that secret comprised of in your proposal?

The above 2 signatures.

I wouldn't think it needs to be particularly more costly to publish it in comparison to publishing a context string when using SyRA?

SyRA public keys are certainly bigger than a context string but depending on your exact workflow it might not matter.

The main purpose of the CI is to certify the real user id and tie it to some secret so that later things can be signed / authenticated in relation to that id.

Got it.

The poll organizer (PO) would be mandatory. It can be thought of as the party / committee hosting the poll.

And its acceptable for CI to play that role as well (when using SyRA)?

I meant that the other way around. In SyRA, one cannot check whether two pseudonyms from different CIs belong to the same real world user.

I meant the same thing. All CIs have to keep a shared state of user ids they have issued to.

With the OPRF approach, the (with high probability) 1-to-1 mapping between real identity and pseudonym holds across CIs.

Because there is only 1 PO?
I think we CI was a threshold type role, above problems are solved as there is only a single secret key and no single CI learns which user-id requested? Does the user need to prove something to CI before getting a credential?

The poll organizer (PO) would be mandatory. It can be thought of as the party / committee hosting the poll.

And its acceptable for CI to play that role as well (when using SyRA)?

I think it might work as well. The setup would change a bit. Like every application using the anonymous voting service would have to run their own CI (instead of their own PO). The downside is that real user identification is then at the application level, and users have to trust the application that they verify theirs users correctly.

I meant that the other way around. In SyRA, one cannot check whether two pseudonyms from different CIs belong to the same real world user.

I meant the same thing about SyRA. All CIs have to keep a shared state of user ids they have issued to.

Hm, why do CI's have to keep track of their users? I thought the SyRA CI is stateless? When I receive usk1 from CI1, and usk2, and generate sig1 and sig2, respectively, there is no way to check whether sig1 and sig2 belong to the same real user (i.e., are a duplicate vote)?

With the OPRF approach, the (with high probability) 1-to-1 mapping between real identity and pseudonym holds across CIs.

Because there is only 1 PO?

I meant per PO / poll. The point is that it doesn't matter if I use cred1 from CI1 or cred2 from CI2. The resulting pid (w.r.t. to a given poll) will be the same.

I think we CI was a threshold type role, above problems are solved as there is only a single secret key and no single CI learns which user-id requested? Does the user need to prove something to CI before getting a credential?

User should prove his real identity to the CI (e.g., using the passport's Active Authentication protocol), so that the CI can create a digital, verifiable credential for it.

What signature are you referring to here?

I was referring to the SyRA signature (what SyRA calls user secret key) and optionally BBS signature (when you have other attributes besides id). During voting, user proves knowledge of these 2 signatures in zero knowledge.

For generating vote signatures, the user certainly needs to hold some secret. What is that secret comprised of in your proposal?

The above 2 signatures.

Not sure if I'm getting it. Are you suggesting to combine my approach with SyRA?

I think it might work as well. The setup would change a bit. Like every application using the anonymous voting service would have to run their own CI (instead of their own PO).

Can the POs trust the CI to issue "valid" credentials?
This is how I imagine it.

Every user has a unique user id like passport number in your case.
There are a bunch of trusted CIs to issue "valid" credentials, i.e. they do the background check and don't issue to same user id twice. Hence the shared (among CIs) database where they store the user ids to which they have issued.
PS: There might be a way to storing the database of issued user ids in plain by using the idea of Oblivious accumulators which are accumulators that hide the members from everyone. And since they describe a trapdoorless setting, you can imagine the bulletin board enforcing that only CIs can write to it. Before requesting a credential, user proves non-membership of its id in the accumulator and after issuing CI updates the accumulator without any other CI learning the user-id. But I haven't looked at that construction and generally accumulators are expensive, with non-membership checks being more.
The credential doesn't have to be voting specific, they can have broader usage and thus have other attributes like name, city, etc.
The credentials have a SyRA signature (user secret key) on the unique user id but can contain a BBS signature if the credential contains other attributes than just user id. So C1 and C2 are 2 valid credentials: C1 = (id, sig_syra) and C2 = (id, name, city, ..., sig_syra, sig_bbs) where  sig_bbs is a BBS sig on (id, name, city, ...)
PO creates a poll with a unique context and broadcasts it on the bulletin board.
To vote, users create a pseudonym using SyRA signature (and optionally BBS) and corresponding proof and send these to the bulletin board.

Hm, why do CI's have to keep track of their users? I thought the SyRA CI is stateless? When I receive usk1 from CI1, and usk2, and generate sig1 and sig2, respectively, there is no way to check whether sig1 and sig2 belong to the same real user (i.e., are a duplicate vote)?

I explained above but its to mitigate the duplicate voting problem you mentioned.

I meant per PO / poll.

Ok. That's what i was looking for.

Not sure if I'm getting it. Are you suggesting to combine my approach with SyRA?

Yes but only if needed. I explained above.

In any case, thanks a lot for your plenty comments so far. Appreciate it a lot!

Thank you. Its been a very helpful discussion. Thanks for introducing me to OPRFs :)

I realize that it's not that easy to follow what I write since it's now scattered across several posts. I have started writing up my design in a LaTex document. Might share that for a more fruitful discussion, once it's ready.

Sure.

Hi @matthiasgeihs . Sorry but I forgot to share that the threshold SyRA implementation has been added here.

@lovesh Very cool, thx for letting me know. Had other priorities in the meantime, but this motivates me to pick this up again 👍


Refactor E2E tests: Approve Create and Edit Requests (Private Cloud)

Description:
Rewrite Create and Edit Requests Approvals in Private Cloud E2E tests with new universal steps.

First PR on this: https://github.com/bcgov/platform-services-registry/pull/4171
Second (final) PR on this: https://github.com/bcgov/platform-services-registry/pull/4183


New step: compress

This compresses the request body. Gzips the request body and sets the appropriate request header.
Usage:
Req.post!(url, body: "foo", compress: :gzip)

Closing in favour of PR.


Fix CONTRIBUTING.md bad link

issue #8
https://github.com/sss63232/CopyUrlToMD/blame/master/CONTRIBUTING.md#L36
get bad link (410)
Follow the discussion, change the commit guide to Conventional Commits and add the badge to README.md.

Thanks!


support easy inversion of selection

similar to the toggle selectAll button

An easy way would be to add the Invert Selection option to the column menu.


Added Moore Voting Algorithm Implmentation

Added Moore Voting Algorithm Implementation with required comments under search directory

Can you check my Pull request


When creating a transaction, I can only choose one currency

When creating a transaction, I can only choose one currency.

Is this not a better view?

I took a look in the code and saw you can switch if you have conversion rates in the database. Maybe it is nicer to show the lower screenshot if you don't have any conversion rates and use the upper (maybe a little redesign) if you do have conversion rates.

Hi @sebastiaanspeck yes good idea to adapt the design depending on conversion rates availables.
If you want you can do it. Otherwise i think this week end i will work a little on this project (i want to test yarn install with matice from my github repo), if you want i can make your suggest in the same time

As shown in the screenshots, I have the design almost ready, so expect a PR soon.Met vriendelijke groet,Sebastiaan SpeckOn 9 Nov 2022, at 13:21, RocketC31 @.***> wrote:
Hi @sebastiaanspeck yes good idea to adapt the design depending on conversion rates availables.
If you want you can do it. Otherwise i think this week end i will work a little on this project (i want to test yarn install with matice from my github repo), if you want i can make your suggest in the same time
—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: @.***>

When having no conversion rates:

When having multiple currencies (with conversion rate):

Maybe style the select the same way as the text/searchable (rounded corners)


chore: Rename controllers constructors to NewController

Fixes #N/A
Description
This PR removes the calls that built the specific controller types when we were supporting both alpha and beta and replaces it with a call to just make NewController
How was this change tested?
make presubmit
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Pull Request Test Coverage Report for Build<PHONE_NUMBER>

24 of 30 (80.0%)  changed or added relevant lines in 6 files are covered.
12 unchanged lines in 5 files lost coverage.
Overall coverage decreased (-0.1%) to 79.439%

Changes Missing Coverage
Covered Lines
Changed/Added Lines
%

pkg/controllers/nodeclaim/consistency/controller.go
4
5
80.0%

pkg/controllers/nodeclaim/disruption/controller.go
4
5
80.0%

pkg/controllers/nodeclaim/lifecycle/controller.go
4
5
80.0%

pkg/controllers/nodeclaim/termination/controller.go
4
5
80.0%

pkg/controllers/nodepool/counter/controller.go
4
5
80.0%

pkg/controllers/nodepool/hash/controller.go
4
5
80.0%

Files with Coverage Reduction
New Missed Lines
%

pkg/controllers/nodeclaim/consistency/controller.go
1
60.71%

pkg/controllers/nodeclaim/disruption/controller.go
1
53.73%

pkg/controllers/nodeclaim/lifecycle/controller.go
1
71.93%

pkg/controllers/disruption/drift.go
2
79.1%

pkg/controllers/provisioning/scheduling/preferences.go
7
86.67%

Totals

Change from base Build<PHONE_NUMBER>:
-0.1%

Covered Lines:
7963

Relevant Lines:
10024

💛  - Coveralls

/lgtm


Reverse animation for exit transitions?

Is there a way to do any of the available animation in reverse? Say you want to "slideOutLeft" to do an exit animation.  How to achieve this?

Yes, you have to use code for that. So use animateTo() instead of animate().
Thanks! Meng
On Sat, Jul 4, 2015 at 4:26 AM, alkait<EMAIL_ADDRESS>wrote:

Is there a way to do any of the available animation in reverse? Say you want to "slideOutLeft" to do an exit animation.  How to achieve this?
Reply to this email directly or view it on GitHub:
https://github.com/MengTo/Spring/issues/78

Hi,
Could you please explain when we have to use animateTo(). I want to show hide a SpringView. Show with a animation, hide with same animation but reverse, please help.

Sure, here’s the code:
layer.animation = “slideLeft”
layer.animateTo()
—
animate() would slide right to left.
animateTo() would slide left to right.
Thanks! Meng
On Mon, Jul 27, 2015 at 4:43 PM, paultan1080<EMAIL_ADDRESS>wrote:

Hi,
Could you please explain when we have to use animateTo(). I want to show hide a SpringView. Show with a animation, hide with same animation but reverse, please help.
Reply to this email directly or view it on GitHub:
https://github.com/MengTo/Spring/issues/78#issuecomment-125336731

Ah Thanks, works like charm!


Do not nest the oob endpoints under the connection topic

You can also use it for connectionless exchanges

Sorry can you formulate that differently please? I'm not sure I get what you mean

@TimoGlastra ?

So instead of /generic/connections/oob/create-invitation and /generic/connections/oob/accept-invitation we have  /generic/oob/create-invitation and  /generic/oob/accept-invitation

ah alright thx for clarifying

@morrieinmaas please add the OOB endpoints under the out-of-band API collection tag.


fix(syntax): Fix missing , in config.lua

Missing comma in config causing catppuccin to fail to load

Thanks but it's already been fixed :)


Create ramdisk

When start to create a Ramdisk not work and terminal finish jailbreak. iPhone X iOS 15.6 reboot.

Can I please have more context? What PC operating system (and version if applicable), screenshots of the error when running with --debug

I have this same issue

Can I please have more context? What PC operating system (and version if applicable), screenshots of the error when running with --debug

Linux 22.04
With -- debug
tried with -- debug and the result is
download succeeded
usb_timeout: 5
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:06 ECID:000E4DEC38B8402E IBFL:3C SRTG:[iBoot-33<IP_ADDRESS>.23]
Found the USB handle.
Stage: RESET
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:06 ECID:000E4DEC38B8402E IBFL:3C SRTG:[iBoot-33<IP_ADDRESS>.23]
Found the USB handle.
Stage: SPRAY
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:06 ECID:000E4DEC38B8402E IBFL:3C SRTG:[iBoot-33<IP_ADDRESS>.23]
Found the USB handle.
Stage: SETUP
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:06 ECID:000E4DEC38B8402E IBFL:3C SRTG:[iBoot-33<IP_ADDRESS>.23]
Found the USB handle.
Stage: PATCH
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:06 ECID:000E4DEC38B8402E IBFL:3C SRTG:[iBoot-33<IP_ADDRESS>.23] PWND:[gaster]
Found the USB handle.
Now you can boot untrusted images.
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Found the USB handle.
usb_timeout: 5
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:06 ECID:000E4DEC38B8402E IBFL:3C SRTG:[iBoot-33<IP_ADDRESS>.23] PWND:[gaster]
Found the USB handle.
Now you can boot untrusted images.
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Found the USB handle.
main: Starting...
iOS 14 iBoot detected!
getting get_debug_enabled_patch() patch
getting get_sigcheck_patch() patch
applying patch=0x180032bf0 : 000080d2
applying patch=0x180032c44 : 000080d2
applying patch=0x180034750 : 200080d2
main: Writing out patched file to work/iBSS.patched...
main: Quitting...
none
main: Starting...
iOS 14 iBoot detected!
getting get_boot_arg_patch(rd=md0 debug=0x2014e -v wdt=-1  ) patch
getting get_debug_enabled_patch() patch
getting get_unlock_nvram_patch() patch
getting get_sigcheck_patch() patch
applying patch=0x180032bf0 : 000080d2
applying patch=0x180032c44 : 000080d2
applying patch=0x18001f8a8 : 000080d2c0035fd6
applying patch=0x18001f8f8 : 000080d2c0035fd6
applying patch=0x18006be6c : 000080d2c0035fd6
applying patch=0x180034750 : 200080d2
applying patch=0x180035cac : 183e5430
applying patch=0x1800de46d : 72643d6d64302064656275673d30783230313465202d76207764743d2d31202000
applying patch=0x180039060 : 1f2003d5
main: Writing out patched file to work/iBEC.patched...
main: Quitting...
none
krnl
main: Starting...
Kernel: Adding AMFI_get_out_of_my_way patch...
get_amfi_out_of_my_way_patch: Entering ...
get_amfi_out_of_my_way_patch: Kernel-7195 inputted
get_amfi_out_of_my_way_patch: Found entitlements too small str loc at 0x40c7ee
get_amfi_out_of_my_way_patch: Found entitlements too small str ref at 0x11ac270
get_amfi_out_of_my_way_patch: Patching AMFI at 0x11a86e8
main: Writing out patched file to work/kcache.patched...
main: Quitting...
krnl
dtre
rtsc
rdsk
fwrite: No space left on device
error: WRITE
error: Invalid argument
[-] An error occurred
ubuntu@ubuntu:~/Downloads/palera1n$


improve ByteBuffer documentation regarding CoW on slices

Motivation:
We got a very valid question on Twitter
(https://twitter.com/karim_elna/status/989516133421199361) regarding
ByteBuffers 'sharing storage'. Our docs almost sound like a ByteBuffer
and its slices share storage even after a write. Especially given that
this is a difference to Netty, we should document this better.
Modifications:
Added clarifying documentation.
Result:
Hopefully the docs are more clear now.

@swift-nio-bot test this please


Update custom checkboxes and radio buttons to support directly setting the label background color.

Adding a background class to the label will change the background color of the checkbox or radio button.

Completed.


Hope there will be more detailed README.md

Dear contributors, I am very happy to meet such a valuable project. As a newbie to bazel, I hope that the README.md can include more brief explanations or links, such as what BUILD and WORKSPACE are used for, such as what does --config elinux_armhf  mean and is it a fixed writing in this project ? Thanks in advance !

Thanks for your time. I will add more detailed very soon. By that time, feel free to explore some official examples here and maybe this brief tutorial is good for beginner.
For Chinese player, maybe this blog is a good start.

Thanks for your sharing, it is helpful !


chore(userspace/falco): make source matching error more expressive

What type of PR is this?
/kind cleanup
Any specific area of the project related to this PR?
/area engine
What this PR does / why we need it:
Which issue(s) this PR fixes:
Special notes for your reviewer:
Does this PR introduce a user-facing change?:
chore(userspace/falco): make source matching error more expressive

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: jasondellaluce
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS [jasondellaluce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

/milestone 0.36.0

LGTM label has been added.  Git tree hash: 10d33817fa261ecbd43544871ac515d115eade67

@jasondellaluce: The provided milestone is not valid for this repository. Milestones in this repository: [0.35.1, 0.36.0, 0.37.0]
Use /milestone clear to clear the milestone.

In response to this:

/milestone v0.35.1

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: Andreagit97, FedeDP, jasondellaluce
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS [Andreagit97,FedeDP,jasondellaluce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment


Blockchain

Should consider adding blockchain to provide a distributed system where authorisation can happen anywhere without the need of a centralised server

Very interesting. Can you elaborate or point us to relevant research?

Nice writeup @adi-ads
http://www.3pillarglobal.com/insights/introduction-to-blockchain-technology
The linked IBM proof of concept for blockchain powered-IoT using BitTorrent, Ethereum, and TeleHash is seriously fascinating.

Just to keep all this stuff in one place, we talked to @kumavis yesterday about Ethereum, MetaMask, and blockchain in general.
@kumavis also provides an intense explanation of blockchain related concepts in a Software Engineering Daily podcast.

 Wondering how we can connect metamask.io identities to anvil users...


Metafunctions are not SFINAE-friendly in the usual sense

The way CallableTraits makes traditional metafunctions SFINAE-friendly does not meet what's normally expected from SFINAE-friendly metafunctions. When we say a metafunction is SFINAE-friendly, we usually mean it does not have a nested ::type alias when it would normally fail. This has the nasty effect that code such as the following does not have the intended effect:
template <typename T>
struct GetFunctionType
  : boost::mpl::eval_if<std::is_function<T>,
      boost::callable_traits::function_type<T>,
      boost::mpl::identity<T>
    >
{ };

The intended behavior is that if the condition is not satisfied, then function_type<T> would not be instantiated, and hence no error would happen. This can also be a compile-time performance bug, since we often assume that no work is done when we only mention a template, without instantiating it. However, we would get a hard error while trying to instantiate the default template parameter for function_type, which happens when we only mention function_type<T> (hence when creating the list of bases), not when we try to get its nested ::type alias.
Full reproduction:
#include <boost/mpl/identity.hpp>
#include <boost/mpl/eval_if.hpp>
#include <boost/callable_traits/function_type.hpp>
#include <type_traits>
#include <iostream>

template <typename T>
struct GetFunctionType
  : boost::mpl::eval_if<std::is_function<T>,
      boost::callable_traits::function_type<T>,
      boost::mpl::identity<T>
    >
{ };

template <typename T, typename FunctionType = typename GetFunctionType<T>::type>
void f(T) { std::cout << "I can get the function type!" << std::endl; }

void f(...) { std::cout << "I can't get the function type!" << std::endl; }

int main() {
  f(0);
}

Error message:
In file included from [...]/include/boost/callable_traits/function_type.hpp:12:
In file included from [...]/include/boost/callable_traits/detail/core.hpp:12:
In file included from [...]/include/boost/callable_traits/detail/utility.hpp:13:
[...]/include/boost/callable_traits/detail/sfinae_errors.hpp:33:9: error: no type named 'type' in
      'boost::callable_traits::error::parameters<boost::callable_traits::cannot_determine_parameters_for_this_type_>::_'
        using sfinae_try = typename BOOST_CLBL_TRTS_DISJUNCTION(
        ^~~~~
[...]/include/boost/callable_traits/detail/utility.hpp:55:1: note: in instantiation of template type alias 'sfinae_try' requested here
using try_but_fail_if_invalid = sfinae_try<T,
^
[...]/include/boost/callable_traits/function_type.hpp:24:1: note: in instantiation of template type alias 'try_but_fail_if_invalid' requested
      here
using function_type_t = //see below
^
[...]/include/boost/callable_traits/function_type.hpp:31:35: note: in instantiation of template type alias 'function_type_t' requested here
template<typename T, typename U = function_type_t<T>>
                                  ^
[...]/dyno/test/interface_macro.cpp:79:31: note: in instantiation of default argument for 'function_type<int>' required here
      boost::callable_traits::function_type<T>,
                              ^~~~~~~~~~~~~~~~
[...]/dyno/test/interface_macro.cpp:84:56: note: in instantiation of template class 'GetFunctionType<int>' requested here
template <typename T, typename FunctionType = typename GetFunctionType<T>::type>
                                                       ^
[...]/dyno/test/interface_macro.cpp:85:6: note: in instantiation of default argument for 'f<int>' required here
void f(T) { std::cout << "I can get the function type!" << std::endl; }
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[...]/dyno/test/interface_macro.cpp:90:3: note: while substituting deduced template arguments into function template 'f' [with T = int, FunctionType = (no value)]
  f(0);
  ^

Fixed via 16f6e2b. Since we already have good SFINAE test coverage (we test SFINAE-ability for both lazy and eager traits using the same macro, I did not add test cases for SFINAE laziness. The above mpl::eval_if example works anecdotally.
Tests passed on AppVeyor for MSVC and Travis](https://travis-ci.org/badair/callable_traits/builds/279083882) for GCC and Clang.
The above CI links are from my personal fork, because the Boost CI queue is painfully long.

I'll let this sit on the develop branch for a bit so I can see if I broke the docs anywhere.


about  model ensemble

The options of decoder does not have the usage of model ensemble .
Does someone implement it ?
And can you share the code or the experience to implement it?
Thanks!

W_0 = utils.weight_variable([FLAGS.z_dim, 64 * GEN_DIMENSION / 2 * IMAGE_SIZE / 16 * IMAGE_SIZE / 16],

NameError: name 'utils' is not defined

It would be great if someone adds this.


Add new By locator extras and wait conditions

Changes have been made to incorporate new By locator features as well as additional wait condition functionality.
For By locators, these include:

ByAll that can be used in place of a By locator to locate elements that match all of the provided By locators. This is useful when you want to find an element that matches multiple criteria, such as a button that has a specific text.

RemoteWebElement element = app.FindElement(new ByAll(By.TagName("button"), ByExtras.Text("Send Message")));

ByNested that can be used in place of a By locator to locate elements that are nested by a sequence of locators. This is useful when you want to find an element that is nested within other elements, such as a button that is inside a form, inside an ID'd element.

RemoteWebElement element = app.FindElement(new ByNested(By.Id("PersonContainer"), By.TagName("form"), By.TagName("button")));

New wait conditions include:

ElementIsVisible to wait for an element to be visible with a specific locator at the driver
ElementIsVisibleInElement to wait for an element to be visible with a specific locator within another element
ElementIsVisibleInElementWrapper to wait for an element to be visible with a specific locator within an element wrapper
ElementIsVisibleInPage to wait for an element to be visible with a specific locator within a page object
ElementIsNotVisible to wait for an element to be hidden (not visible) with a specific locator at the driver
ElementIsNotVisibleInElement to wait for an element to be hidden (not visible) with a specific locator within another element
ElementIsNotVisibleInElementWrapper to wait for an element to be hidden (not visible) with a specific locator within an element wrapper
ElementIsNotVisibleInPage to wait for an element to be hidden (not visible) with a specific locator within a page object
FrameAvailableToSwitchTo to wait for a frame within the driver to be available and then switching the driver context to that frame

All WaitUntil methods within the platform have been updated to incorporate a retry mechanism, as well as supporting wait conditions that return values other than Booleans. These methods have also been update to return the result of the condition also.
PR checklist

[x] Have Legerity sample tests been added or updated, run locally, and all pass
[x] Have added or updated support for platform specific element wrappers been reflected in the Page Object Generator
[x] Have code styling rules been run on all new source file changes
[x] Have relevant articles in the docs been added or updated for all new source file changes
[ ] Have major breaking changes been made and are documented

Other information

This includes breaking changes. Is this expected to be part of the v1 release?

@tom-made that's correct 😄


SubmitQueue: Add ability to filter on PRs and Historic decisions in URL

http://submit-queue.k8s.io/#?prDisplay=eparis&historyDisplay=17235
will open the web page already filtered with the PR tab showing those
oppened by eparis and the hsitory tab will show only pr 17235 (no matter
who openned it)

LGTM


Reduce dt bold weight to 500.

Supports https://github.com/puppetlabs/puppet-docs/pull/632
CC @nfagerlund

Hmm. Instead of hardcoding, let's unify all font weights using variables; make it easier to swap the font implementation stuff later. I did it in a half-assed way before, so I'll just finish the job (on top of this existing commit).


Missing LICENSE

Nice work! I'm considering porting this to MLX, but I wonder if I can copy parts of your code. Could you please add a license to this repo?
Thanks

Done. Thanks!

Thank you!
On Wed, Dec 27, 2023, 1:33 PM John (Zhiyao) Ma @.***>
wrote:

Closed #10 https://github.com/johnma2006/mamba-minimal/issues/10 as
completed.
—
Reply to this email directly, view it on GitHub
https://github.com/johnma2006/mamba-minimal/issues/10#event-11346639757,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AACHO2AQL6KHWS5KTKSTXXTYLRSYNAVCNFSM6AAAAABBELSGWKVHI2DSMVQWIX3LMV45UABCJFZXG5LFIV3GK3TUJZXXI2LGNFRWC5DJN5XDWMJRGM2DMNRTHE3TKNY
.
You are receiving this because you authored the thread.Message ID:
@.***>


If generated VirtualService already exists update it

Only if spec has changed

this doesn't quite work, it is updating the vritualservice every minute

Codecov Report

Merging #51 into master will decrease coverage by 0.29%.
The diff coverage is 78.12%.

@@            Coverage Diff            @@
##           master      #51     +/-   ##
=========================================
- Coverage   56.63%   56.34%   -0.3%
=========================================
  Files           9        9
  Lines        1333     1340      +7
=========================================
  Hits          755      755
- Misses        446      452      +6
- Partials      132      133      +1

Impacted Files
Coverage Δ

pkg/controller/router.go
83.16% <78.12%> (-2.99%)
:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 6f2a22a...0c0ebae. Read the comment docs.

is there an easy way to compare the full spec?

Yes with cmp.Diff here is an example https://github.com/stefanprodan/flagger/blob/master/pkg/controller/deployer.go#L168

I'll refactor the Virtual Service update for the next release.


[JENKINS-28733] fix

fixes an issue when URI's details were not shown on some pages

Thank you for a pull request! Please check this document for how the Jenkins project handles pull requests

@manolo My team is interested in seeing this change integrated, as well as some of the other pending pull requests.  Are you still the maintainer?

do you guys know how can I manually install this PR? it seems this project does not has maintainer anymore

@carlosmmelo Retriggered the build on CI. You will be able to download the artifact from CI once the build finishes


Login page error messages

In order to ensure the completeness of our authentication implementation, we must provide clear error messages! We have great validation for login and registration, and exceptional error messages for the registration form. Now, all we need is error messages for the login page.
Let's include these ones:

[ ] Password incorrect
[ ] User does not exist
[ ] Catch all error: login failed

We can use our registration form errors as an example for this.

Starting on this...


feature-003/FAT12_driver_implemented

FAT driver implemented in bootloader based on test with fat.c
Now boot loads kernel, and kernel prints message
"Hello world from KERNEL!"

Pull request merged with bypass protection, since I couldn't assign myself as reviewer.


Snowplow SDK using deprecated NSURLConnection API in SPEmitter

In SPEmitter.m: https://github.com/snowplow/snowplow-objc-tracker/blob/master/Snowplow/SPEmitter.m#L316-L333, we noticed that you're using the old NSURLConnection API with a method that was deprecated in iOS 9.

NSURLConnection has been superseded by NSURLSession.
The sendEventWithRequest method you are using was deprecated 2 years ago (iOS 9).

Why are you using a deprecated API instead of conditionally using URLSession for newer versions of iOS?
Thanks for your time!

Yep, this needs updating.

Any ETA on that? This is about to ship into production for a client of ours.

No ETA currently

Alright - thank you.

Fixed on PR #478


ingress gateway is not updated when secret is removed

Is this the right place to submit this?

[X] This is not a security vulnerability or a crashing bug
[X] This is not a question about how to use Istio

Bug Description
Hi,
I think I found an issue that Ingress Gateway is not updated when the secret is removed from kubernetes secrets. This issue seems to me as a bug.
The issue can be described as follows:
For Simple TLS traffic through Ingress Gateway a secret with certificates is created and it is mounted to Ingress Gateway using Gateway resource. When a request is sent through the Ingress Gateway traffic is passing as expected.
When the secret is deleted from Kubernetes secret, the traffic is expected to NOT PASS through the Ingress Gateway. However, in the tests I have observed that even though the secret is removed, the traffic is continuing to pass through the Ingress Gateway.
The reason is that Istiod is not updating Ingress Gateway with the empty/not found secret.
The reproduction steps are as follows:

Create secret
kubectl create -n istio-system secret tls httpbin-credential --key=httpbin.example.com.key --cert=httpbin.example.com.crt
Apply httpbin

apiVersion: v1
kind: ServiceAccount
metadata:
  name: httpbin
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  labels:
    app: httpbin
    service: httpbin
spec:
  ports:
  - name: http
    port: 8000
    targetPort: 80
  selector:
    app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
      version: v1
  template:
    metadata:
      labels:
        app: httpbin
        version: v1
      annotations:
        sidecar.istio.io/inject: "true"
    spec:
      serviceAccountName: httpbin
      imagePullSecrets:
      - name: armdocker
      containers:
      - image: docker.io/kong/httpbin
        imagePullPolicy: IfNotPresent
        name: httpbin
        ports:
        - containerPort: 80

Apply the following Gateway and VirtualService Resources

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: httpbin-credential
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - "*"
  gateways:
  - httpbin-gateway
  http:
  - route:
    - destination:
        port:
          number: 8000
        host: httpbin

The "httpbin-credential" secret is in active status in Ingress Gateway

istioctl pc secrets istio-ingressgateway-75547ff498-jgh5g
RESOURCE NAME                       TYPE           STATUS     VALID CERT     SERIAL NUMBER                               NOT AFTER                NOT BEFORE
default                             Cert Chain     ACTIVE     true<PHONE_NUMBER>1525841046938231364134988081      2023-06-14T09:15:54Z     2023-06-13T09:13:54Z
kubernetes://httpbin-credential     Cert Chain     ACTIVE     true           0                                           2024-06-12T09:27:13Z     2023-06-13T09:27:13Z
ROOTCA                              CA             ACTIVE     true<PHONE_NUMBER>61750071063118506127200108662     2123-04-09T09:38:18Z     2023-05-03T09:38:18Z

Send a curl request through the Ingress Gateway
curl -v -HHost:httpbin.example.com --resolve "httpbin.example.com:$SECURE_INGRESS_PORT:$INGRESS_HOST" --cacert certs/example.com.crt "https://httpbin.example.com:$SECURE_INGRESS_PORT/status/418"
See that the request is successful.
Delete secret kubectl delete secret -n istio-system httpbin-credential
The log in Istiod shows

2023-06-13T09:31:50.559584Z     info    ads     Push debounce stable[12] 1 for config Secret/istio-system/httpbin-credential: 100.232554ms since last change, 100.232347ms since last push, full=false
2023-06-13T09:31:50.559699Z     info    ads     XDS: Incremental Pushing:2023-06-13T09:16:07Z/5 ConnectedEndpoints:2 Version:2023-06-13T09:16:07Z/5
2023-06-13T09:31:50.564708Z     warn    ads     failed to fetch key and certificate for kubernetes://httpbin-credential: secret istio-system/httpbin-credential not found

The "httpbin-credential" secret is STILL in active status in Ingress Gateway.

istioctl pc secrets istio-ingressgateway-75547ff498-jgh5g
RESOURCE NAME                       TYPE           STATUS     VALID CERT     SERIAL NUMBER                               NOT AFTER                NOT BEFORE
default                             Cert Chain     ACTIVE     true<PHONE_NUMBER>1525841046938231364134988081      2023-06-14T09:15:54Z     2023-06-13T09:13:54Z
kubernetes://httpbin-credential     Cert Chain     ACTIVE     true           0                                           2024-06-12T09:27:13Z     2023-06-13T09:27:13Z
ROOTCA                              CA             ACTIVE     true<PHONE_NUMBER>61750071063118506127200108662     2123-04-09T09:38:18Z     2023-05-03T09:38:18Z

Send curl request as in the step 5, it will be seen that it is still successful.
`

Moreover, I see that problem when the content of secret is removed. In that case the log gives me the following:
 warn    ads     failed to fetch key and certificate for kubernetes://httpbin-credential: found keys "tls.crt" and "tls.key", but they were empty
I expected that when the secret is removed the mounted secret from Ingress Gateway would be removed as well and Ingress Gateway does not letting the traffic through the Ingress Gateway.
I am wondering if that is the expected behavior of Istio or is it a bug that needs to be resolved.
Best regards
Version
$ istioctl version
client version: 1.17.2
control plane version: 1.17.2
data plane version: 1.17.2 (2 proxies)

Additional Information
No response
Affected product area

[ ] Ambient
[ ] Docs
[ ] Installation
[X] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[X] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
[ ] Upgrade
[ ] Multi Cluster
[ ] Virtual Machine
[ ] Control Plane Revisions

The sa token secrets seem not been care.
You can refer the code comment of:https://github.com/istio/istio/blob/b00feaeea727657d84b1eb8e4c81ef8610dc8807/pilot/pkg/credentials/kube/secrets.go#L79
func NewCredentialsController(kc kube.Client) *CredentialsController {
	// We only care about TLS certificates and docker config for Wasm image pulling.
	// Unfortunately, it is not as simple as selecting type=kubernetes.io/tls and type=kubernetes.io/dockerconfigjson.
	// Because of legacy reasons and supporting an extra ca.crt, we also support generic types.
	// Its also likely users have started to use random types and expect them to continue working.
	// This makes the assumption we will never care about Helm secrets or SA token secrets - two common
	// large secrets in clusters.
	// This is a best effort optimization only; the code would behave correctly if we watched all secrets.
	fieldSelector := fields.AndSelectors(
		fields.OneTermNotEqualSelector("type", "helm.sh/release.v1"),
		fields.OneTermNotEqualSelector("type", string(v1.SecretTypeServiceAccountToken))).String()
	secrets := kclient.NewFiltered[*v1.Secret](kc, kclient.Filter{
		FieldSelector: fieldSelector,
	})

	return &CredentialsController{
		secrets:            secrets,
		sar:                kc.Kube().AuthorizationV1().SubjectAccessReviews(),
		authorizationCache: make(map[authorizationKey]authorizationResponse),
	}
}

Hi @rokkiter,
Thank you for your answer. Can you please elaborate why do you think that the issue is about SA secrets?
Here the problem is about mounting secret into the Gateways not into the httpbin pod. And when the mounted secret is deleted using kubectl delete secret -n istio-system httpbin-credential, this is not reflected to the Gateway. As a result gateway still behaves like there is still a secret.
Best regards,
Onur

@calikonur wondering if anything is flagged STALE in istioctl proxy-status or any related errors in istioctl analyze -A.  A STALE state could be preventing ingress gateway from receiving any new XDS configs from istiod.
Could be a bug in istiod SDS.  Also possible that as long as the Gateway crd is in place, istiod isn't pushing the appropriate LDS

Hi @GregHanson ,
Sorry for late answer, I was taking some days off.
I checked the logs you wanted.
Nothing is flagged as STALE after I delete the secret, please see the following:
NAME                                                   CLUSTER        CDS        LDS        EDS        RDS        ECDS         ISTIOD                      VERSION
httpbin-5bbb578587-pqndf.istio-system                  Kubernetes     SYNCED     SYNCED     SYNCED     SYNCED     NOT SENT     istiod-5d75b47b8b-j6cs6     1.17.2
istio-ingressgateway-75547ff498-hwbhc.istio-system     Kubernetes     SYNCED     SYNCED     SYNCED     SYNCED     NOT SENT     istiod-5d75b47b8b-j6cs6     1.17.2```

For istioctl analyze I get the following.

istioctl analyze -A
Error [IST0101] (Gateway istio-system/httpbin-gateway) Referenced credentialName not found: "httpbin-credential"
Warning [IST0002] (CustomResourceDefinition rbacconfigs.rbac.istio.io) Deprecated: Custom resource type rbac.istio.io RbacConfig is removed
Warning [IST0002] (CustomResourceDefinition servicerolebindings.rbac.istio.io) Deprecated: Custom resource type rbac.istio.io ServiceRoleBinding is removed
Warning [IST0002] (CustomResourceDefinition serviceroles.rbac.istio.io) Deprecated: Custom resource type rbac.istio.io ServiceRole is removed
Info [IST0102] (Namespace default) The namespace is not enabled for Istio injection. Run 'kubectl label namespace default istio-injection=enabled' to enable it, or 'kubectl label namespace default istio-injection=disabled' to explicitly mark it as not needing injection.
Info [IST0102] (Namespace crds) The namespace is not enabled for Istio injection. Run 'kubectl label namespace crds istio-injection=enabled' to enable it, or 'kubectl label namespace crds istio-injection=disabled' to explicitly mark it as not needing injection.
Info [IST0135] (Pod istio-system/httpbin-5bbb578587-pqndf) Annotation "sidecar.istio.io/inject" has been deprecated in favor of the "sidecar.istio.io/inject" label and may not work in future Istio versions.
Error: Analyzers found issues when analyzing all namespaces.
See https://istio.io/v1.17/docs/reference/config/analysis for more information about causes and resolutions.

Best regards,
Onur

Hi,
Is there any opinion how to resolve this problem?

Deleting a secret is ignored by Envoy. I would say that is "working as intended" but maybe that is too strong.... its at least "working as implemented"

Hi @howardjohn ,
So does that mean currently we can not do anything to change this behavior from Istio side?
Should a ticket towards Envoy be created for this issue?
Isn't it a problem that ingress gw lets TLS traffic to pass although there is no secrets?
Best regards,
Onur

Should a ticket towards Envoy be created for this issue?

No, its intended behavior from Envoy and its fixable in Istio with a code change if we need to

Hi,
Is sending a PR with a fix for this issue would be acceptable? If not what is the reason that this issue is considered as an intended behavior and not a bug?

The issue I am concerned with is the difference between "Secret was removed" vs "Secret never existed" vs "Caller doesn't have permission to access the secret". How we distinguish those on the control plane, and how it impacts the data plane. Its plausible there is a good solution here but it isn't obvious to me; my gut feeling is that its hard to get the desired behavior for 'secret never existed' and your desired behavior for secret removal.
Answering that should come before a PR

Its not clear to me how that would solve this problem. Secrets are already kind of "delta" even with SotW

In SotW, when a secret is removed this information is not conveyed to the client, right? If delta functionality would have been used  this information would be shared with the client by the Envoy Manager.

I am actually not entirely sure you can remove it now that I think about it. In other types (EDS, RDS), as far as I know, even an explicit DELETE operation (in delta) is ignored if its stilled referenced by a parent (Listener/cluster). I am not sure if the same applies to secret

It's also worth pointing out that deleting secrets (and nothing else that depends on them) is not really good operational practice.
If you need to get rid of a bad secret, you should rotate it. Deleting a still-referenced secret without rotating is never the correct thing to do in a production environment.


Change how/where we define hooks to custom scripts

Today we use a combination of the .yml file and scripts specified in bin to customize the installation behavior. Instead of having a set of conventions for the scripts in bin, I wonder if we should consolidate everything into the .yml file, so that users explicitly define the scripts they want to run.
For example, instead of a few code blocks like this in the buildpack:
postSetupScript=bin/post-setup.sh
# run post-setup script
if [ -f "$postSetupScript" ]; then

  debug "Calling $postSetupScript $TARGET_SCRATCH_ORG_ALIAS $STAGE"
  sh "$postSetupScript" "$TARGET_SCRATCH_ORG_ALIAS" "$STAGE"
fi

We'd put the definition of post setup in the .yml:
sfdx.yml:
...
post-setup-script: bin/post-setup.sh
...

And then we'd grab that value out of the yml file and use it in postSetupScript.
The reason I like this it it puts all of the configuration into a single place and let's us create a default that's inclusive of all the available overrides.

@cwallsfdc Curious as to your thoughts.
I also think this would make it really powerful for https://deploy-to-sfdx.com.


implement inline installation of Gratipay Everywhere plugin for browser

https://developers.google.com/chrome/web-store/docs/inline_installation

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Closing in light of our decision to shut down Gratipay.
Thank you all for a great run, and I'm sorry it didn't work out! 😞  💃


changes login to use go API

Modifies the ORT login to use the API rather than the old UI code.

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/trafficcontrol-PR/2197/
Test PASSed.

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/trafficcontrol-PR/2198/
Test FAILed.

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/trafficcontrol-PR/2199/
Test PASSed.


Implicit custom attribute name, moduleId

Hi, in the starter kit, blur-image attribute was not decorated with custom attribute explicitly. How did Aurelia figure out that this class is for blur-image attribute
Also I think it needs to be stated clear in Aurelia documentations Routing that moduleId is the file name. I took me awhile to realize this and it may be an annoyance for anyone who wishes to learn Aurelia.

I agree about clearly explaining that "moduleId" means the path to the file. It was initially confusing for me too.

The convention is that the suffix "CustomAttribute" will tell the Aurelia template compiler what the class functions as.
With regard to "moduleId", that is an industry standard term going back about 7 years. It does not have to refer to a file path at all actually. It's literally an id that is used to lookup a module. That said, it typically corresponds to a file because that is convenient. But the module loader is free to interpret the id in any way it sees fit at runtime. We'll try to clarify this a bit more in the upcoming router docs.


[Project] Partial payment processor fee refunds

In some rare case, payment processors are only returning part of the fees. We want to be able to cover that.

This week

[ ] Implement tests in https://github.com/opencollective/opencollective-api/pull/10205

This week

[ ] Complete PR and put it for review


add new class CL_0011020 neural progenitor cell

closes #48

Hi Nicole, I've merged this with the neuroblasts branch - as closely related  and need to co-ordinate.  Once finished we can merge the pull  request on  neuroblasts, do closing this one.


DCD: Clicking on DG4 Save button when there is an existing date resets the date

Cancelled - handled by issue 445


When the path of applicationUrl is changed, "MSB3026" will be occurs at Auto-build

Hi, i use the Blazor Auto-build feature in the following conditions, i will get an error while building the hosted server.
(this problem is less important because the client works correctly)
Phenomenon
The MSB3026 warning occurs and the build takes longer than usual.
How to reproduce
Based on Blazor (ASP.NET Core hosted).
ASP.NET Core 2.1 used.

Add fetchdata to the end of applicationUrl in launchSettings.json at ***.Server project.
Start without debugging(Ctrl+F5) at ***.Server.
Wait for browser loading.
Make changes to a portion of Pages/fetchdata.cshtml in ***.Client project.
Reload on the browser.

Repro repository
https://github.com/azutake/BlazorMsb3026Problem
reproduction commit: https://github.com/azutake/BlazorMsb3026Problem/commit/06fcf823e7840e72f5bc4a35874e1ac11c22cd93
Environment

Microsoft Visual Studio Professional 2017 (15.8.5)
ASP.NET Core Blazor Language Services (15.7.10384)
.NET Core SDK (2.1.300)

Thanks for reporting this, and for providing the clear repro steps.
This is a very surprising bug, but I can repro it. In fact I can repro it in a plain ASP.NET Core web application without involving Blazor at all. I'll follow up by reporting this to the relevant people who work on the VS tooling for ASP.NET Core, since it's not Blazor-specific.


Add GPO from SpaceDock

Also extends CTTP KSP compatibility (texture pack only)
Closes #5657

CTTP update is included. It is supposed to test the change as a whole, but this doesn't always work.


Error JsonConfig Error: Property display.percentX has been changed to display.percent.x

I use the following code in the zshrc config file to launch fastfetch.
if [[ -o interactive ]]; then     fastfetch --load-config examples/11.jsonc fi
After updating version 2.2.0, I encountered an error.
JsonConfig Error: Property display.percentXhas been changed todisplay.percent.x
Can someone help me fix the error?

Oops, I forgot to change the presets
A hot fix release will be cut in a few days if no other issues found. But before that, you have to modify the file manually. :%s/"percentType": 9/"percent": { "type": 9 }/g in vim should work


Find all the unicode chars with zero encoding len

See https://github.com/huggingface/tokenizers/issues/1077


[OFFICIAL] Generated Issue: Error

Please fill out the details below.
Summary:
Steps to reproduce:
Additional Details
Jikan Parser Version: v4.0.2@4df99e0df5a4adf2b92e7c6fc663de8fd4b9c325
PHP: 8.0.19
Redis: Connected
Exception: Error
Code: 0
Message: Call to undefined method Jikan\MyAnimeList\MalClient::getRecentReviews()
Trace: /var/www/jikan-rest/app/Http/Controllers/V4DB/ReviewsController.php on line 76
Request: GET /v4/reviews/anime

@irfan-dahir I've fixed this one last week, will be in my next PR.

#346 fixes this

Resolved


Removes special chars that may cause errors

This caused the error that I discussed in the issue

The text in <pointy brackets> is meant to be replaced by your own internal codename, or your input (not while executing, just manually when you download it). Sorry if that wasn't clear.

Thanks.


This commit also fixes a linting issue that was hidden
because tests were not being run.
Connects https://github.com/rcbops/rpc-openstack/issues/2142

Looks good. The flake8 should be fixed that way.

recheck_cit_swift
recheck_cit_xenial


stacked option for radar chart

Feature Proposal
A stacked option in radar chart for easier usage like the line/bar chart.
The line and bar chart has an option; options.scales.x.stacked: true. A radar chart can stack, but not as easy as setting a boolean. https://www.chartjs.org/docs/latest/samples/area/radar.html
It would be much more convenient to use options.scales.r.stacked: true for the radar chart, just like the line / bar chart
Possible Implementation
Add the option stacked to the scale of radar chart.
options.scales.r.stacked: boolean

Hi @enwi,
I'm interested in working on this issue. However, before I submit a pull request, could you please provide more specific guidance on where in the codebase I should make the changes for options.scales.r.stacked? This will help me ensure that my contribution aligns with your vision for the feature.
Thank you!

@RipulHandoo I think you mentioned the wrong person there 😉

Please assign this issue to me.


Unable to call class methods

Take example:
class Person extends Validated(schema) {
  input() {
   return this.name
  }
}

new Person({ name: "test" }).input()

It just returns an error that says TypeError: (intermediate value).input is not a function
Any help on this would be great!

@dml0031
I can't believe I missed this until you reported it to me. I really appreciate you.
Thanks to you, I think I've fixed the issue and now the class method should work.

Appreciate your response and quick fix! Thank you. Appears to be all good now!


Ressource load failed using npm start

Just after cloning the repo I launched the command npm start and it launched the app in electron.
Nevertheless, I have a error in the console :
file:///[...]/scripts/app.angular.min.js Failed to load resource: net::ERR_FILE_NOT_FOUND
This problem isn't showing when I use grunt build and launch the "dist" app.
Could you fix this or tell me what to do?
FYI: I'm building on windows.

This is expected, and as you said won't happen once built.
The app.angular.min.js is a compilation of all the other JS files that is created during the build,
to ease the debugging this file is not created when simply running electron with npm start and the app will be loading the .js files independently instead.

I ended up switching grunt task so that this unneeded file during dev wouldn't be loaded.


clrVerticalNavCollapsed

How do you start with a collapsed view instead of showing full navbar inside a clrVerticalNavCollapsed?

@mickeyevers77: Could you please file the issue again using the issue template? The issue template is provided to you when you open a new issue. Please make sure to attach a stackblitz or a screenshot which describes the issue. Without these details its difficult for us to triage the issue.
Thanks!


linux-raspberrypi-5.4: bump SRCREV to fix raspberrypi3-64 builds

fixes:
https://github.com/raspberrypi/linux/issues/3885

Signed-off-by: Martin Jansa<EMAIL_ADDRESS>

Should have included this in commit message, but adds just these 5 commits:
git log --oneline 69b14a2e6d4e840c7609370dbf0bac847c3bb15c..31d364af258ff9754a1a9c7d8ea532da962797bd
31d364af258f Revert "usb/dwc2: Set correct state on gadget disconnect"
dcfe54515fb2 configs: Restore SND_PCM_OSS=m
d3443cc70d63 overlays: Add sd3078 to the i2c-rtc overlay
019423d9d60c configs: Add CONFIG_RTC_DRV_SD3078=m
6e776e6b0487 SQUASH: USB: gadget: f_hid: remove more spam

Merged as part of https://github.com/agherzan/meta-raspberrypi/pull/740/commits


Text under the -VisibleMeetingUpdateProperties parameter.

The text under VisibleMeetingUpdateProperties parameter says "There are three scenarios where meeting update messages" but there are 4 bullet point scenarios. It's a minor point, I know, thought I'd flag it

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 23add0a6-bb9c-15d2-a6eb-351ae0564522
Version Independent ID: 8056b3ee-4fab-3a5c-935b-a9d0e9ad82a4
Content: Set-OrganizationConfig (ExchangePowerShell)
Content Source: exchange/exchange-ps/exchange/Set-OrganizationConfig.md
Service: exchange-powershell
GitHub Login: @chrisda
Microsoft Alias: chrisda

@scottbutton, fixed. In the future, you too can make fixes like this yourself without opening an Issue first. For instructions, see https://github.com/MicrosoftDocs/office-docs-powershell/blob/master/README.md.
Thanks for the feedback.
Closing


feat: 815 seedlot review table for tsa admin

Description
Closes #815
Changelog
New

Created new API call to TSC admin endpoints
Added new variable to authentication context to check if user is admin or not
Added new columns to seedlot tables and the logic to display them when necessary

Changed

Nothing :)

Removed

Nothing :)

How was this tested?

[ ] 🧠 Not needed
[x] 👀 Eyeball
[ ] 🤖 Added tests

What gif/image best describes this PR or how it makes you feel?

Thanks for the PR!
Deployments, as required, will be available below:

Frontend
Backend
Oracle-API

Please create PRs in draft mode.  Mark as ready to enable:

Analysis Workflow

After merge, new images are deployed in:

Merge Workflow

You should win a badge for the great skills on gifs choice

On the new Review Seedlots screen, there is no endpoint to search for seedlots by their status.

I suggest we create a separate task to implement the endpoint and then update the new screen.


make unmarshal api safer by copying initial buffer and adding an Unsa…

…fe api

Codecov Report

Merging #4 into master will decrease coverage by 5.11%.
The diff coverage is 8.88%.

@@            Coverage Diff             @@
##           master       #4      +/-   ##
==========================================
- Coverage   87.89%   82.78%   -5.12%
==========================================
  Files          18       19       +1
  Lines        1314     1400      +86
==========================================
+ Hits         1155     1159       +4
- Misses        119      201      +82
  Partials       40       40

Impacted Files
Coverage Δ

decode_unsafe.go
0% <0%> (ø)

decode.go
93.88% <100%> (+0.13%)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3d991e9...c59a4b5. Read the comment docs.


Use PHP 7.0 or 7.1 typehints?

@Paradinight referenced me here from
https://github.com/bcit-ci/CodeIgniter/pull/5341#issuecomment-347300338
Is there any need for typehints and/or bumping to PHP 7.1?

I'd love to go ahead and push this to 7.1 minimum, especially after seeing the gophp7.1 push.
Would love the help on that.


Make unit tests failing

Only doing session.Query<Article, ArticlesByDay>(x => x.DayOfYear == 305) doesn't do an auto flush.


Tests for In this section

This test would catch #1801 and could be expanded wagtail pages to include #1673 as well
Additions

Test for the secondary Nav

Testing

gulp test:acceptance --sauce=false --windowSize=610,700

Review

@anselmbradford
@sebworks
@jimmynotjim

Notes

Any browser test with JS is failing on IE8, including this one, do we have a way to deal with those tests? @anselmbradford, I think you might have brought this up in chat?

Checklist

[ ] Changes are limited to a single goal (no scope creep)
[ ] Code can be automatically merged (no conflicts)
[ ] Code follows the standards laid out in the front end playbook
[ ] Passes all existing automated tests
[ ] New functions include new tests
[ ] New functions are documented (with a description, list of inputs, and expected output)
[ ] Placeholder code is flagged
[ ] Visually tested in supported browsers and devices
[ ] Project documentation has been updated (including the "Unreleased" section of the CHANGELOG)

@KimberlyMunoz You can do the same as we do for the stylesheets -> https://github.com/cfpb/cfgov-refresh/blob/flapjack/test/browser_tests/spec_suites/homepage.js#L31-L35

I'm getting
Failures:
1) The Bureau Page (mobile) should show the hide button after clicked
  Message:
    Expected false to be true.

But it's weird because I can see the hide button after it opens. Maybe we need a bit of a timeout here to wait?

This is ready for review again!

0 Failures, lets merge this thing.


Silk Moths invasive species

When a nest is placed overland silk moth's spawn continuously and never return to the nest.

The nest was on a high elevation, they fluttered down to a swamp at much lower elevation and took residence.
They went on an exploration across the swamp to spread their mothy ways.
The nests pointed this direction never made any silk.

Looks like you have problems with biome registry, you need to check fabricDynamicRegistry.dat in world data folder, all biome entries should have unique ID

Moths from nests have a check if they are far away from nest, and they should return to it after some time

Now they will try to return into nest more frequently and will detect it on larger distance

Fixed in 0.12.5


[MODIFIED] src/main.rs removed if branch on function run_filter_command

Moin nice tool you got there 👍🏻

Hey! Thanks for contributing, your PR's look good, I'll merge them later :)

Btw in case you wonder why this crate is so slim: Most of the logic is handled by the te language implementation
https://github.com/schulke-214/te