Sort archived rooms using Unix epoch

Details
Uses the Unix epoch to sort archived rooms, since the mix of -Infinity and a string date confuses the sort function, since:
_.sortBy(['2022-01-01 12:12:12.123', -Infinity, '2022-01-01 12:12:12.123'] returns [ "2022-01-01 12:12:12.123", null, "2022-01-01 12:12:12.123" ]
Fixed Issues
$ https://github.com/Expensify/App/issues/13072
Tests

Login to the App
Send a message to 3 different users
Create a Workspace + > New Workspace
Verify that you see the auto-generated chats, i.e. #admins, #12878
Delete the Workspace Workspace > three dots menu > Delete Workspace
Send a message to 3 additional different users
Try to create a new chat + > New Chat
Verify that in "Recents" you see the last 5 users messaged in order from most to last recent message

[x] Verify that no errors appear in the JS console

Offline tests
Same as above
QA Steps
Same as tests

[ ] Verify that no errors appear in the JS console

PR Author Checklist

[x] I linked the correct issue in the ### Fixed Issues section above
[x] I wrote clear testing steps that cover the changes made in this PR

[x] I added steps for local testing in the Tests section
[x] I added steps for the expected offline behavior in the Offline steps section
[x] I added steps for Staging and/or Production testing in the QA steps section
[x] I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
[x] I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
[x] I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).

[x] I included screenshots or videos for tests on all platforms
[x] I ran the tests on all platforms & verified they passed on:

[x] iOS / native
[x] Android / native
[x] iOS / Safari
[x] Android / Chrome
[x] MacOS / Chrome
[x] MacOS / Desktop

[x] I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
[x] I followed proper code patterns (see Reviewing the code)

[x] I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick)
[x] I verified that comments were added to code that is not self explanatory
[x] I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
[x] I verified any copy / text shown in the product was added in all src/languages/* files
[x] I verified any copy / text that was added to the app is correct English and approved by marketing by adding the Waiting for Copy label for a copy review on the original GH to get the correct copy.
[x] I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
[x] I verified the JSDocs style guidelines (in STYLE.md) were followed

[x] If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
[x] I followed the guidelines as stated in the Review Guidelines
[x] I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
[x] I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
[x] I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
[x] I verified that if a function's arguments changed that all usages have also been updated correctly
[x] If a new component is created I verified that:

[x] A similar component doesn't exist in the codebase
[x] All props are defined accurately and each prop has a /** comment above it */
[x] The file is named correctly
[x] The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
[x] The only data being stored in the state is data necessary for rendering and nothing else
[x] For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
[x] Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
[x] All JSX used for rendering exists in the render method
[x] The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions

[x] If a new CSS style is added I verified that:

[x] A similar style doesn't already exist
[x] The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(themeColors.componentBG)

[x] If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
[x] If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
[x] I have checked off every checkbox in the PR author checklist, including those that don't apply to this PR.

PR Reviewer Checklist
The reviewer will copy/paste it into a new comment and complete it after the author checklist is completed

[ ] I have verified the author checklist is complete (all boxes are checked off).
[ ] I verified the correct issue is linked in the ### Fixed Issues section above
[ ] I verified testing steps are clear and they cover the changes made in this PR

[ ] I verified the steps for local testing are in the Tests section
[ ] I verified the steps for expected offline behavior are in the Offline steps section
[ ] I verified the steps for Staging and/or Production testing are in the QA steps section
[ ] I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
[ ] I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
[ ] I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).

[ ] I checked that screenshots or videos are included for tests on all platforms
[ ] I included screenshots or videos for tests on all platforms
[ ] I verified tests pass on all platforms & I tested again on:

[ ] iOS / native
[ ] Android / native
[ ] iOS / Safari
[ ] Android / Chrome
[ ] MacOS / Chrome
[ ] MacOS / Desktop

[ ] If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
[ ] I verified proper code patterns were followed (see Reviewing the code)

[ ] I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
[ ] I verified that comments were added to code that is not self explanatory
[ ] I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
[ ] I verified any copy / text shown in the product was added in all src/languages/* files
[ ] I verified any copy / text that was added to the app is correct English and approved by marketing by adding the Waiting for Copy label for a copy review on the original GH to get the correct copy.
[ ] I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
[ ] I verified the JSDocs style guidelines (in STYLE.md) were followed

[ ] If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
[ ] I verified that this PR follows the guidelines as stated in the Review Guidelines
[ ] I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
[ ] I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
[ ] I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
[ ] I verified that if a function's arguments changed that all usages have also been updated correctly
[ ] If a new component is created I verified that:

[ ] A similar component doesn't exist in the codebase
[ ] All props are defined accurately and each prop has a /** comment above it */
[ ] The file is named correctly
[ ] The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
[ ] The only data being stored in the state is data necessary for rendering and nothing else
[ ] For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
[ ] Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
[ ] All JSX used for rendering exists in the render method
[ ] The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions

[ ] If a new CSS style is added I verified that:

[ ] A similar style doesn't already exist
[ ] The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(themeColors.componentBG)

[ ] If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
[ ] If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
[ ] I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Web
![web](https://user-images.githubusercontent.com/22219519/204363398-4bc44540-daf3-4bde-a351-4060bc43615e.png)

Mobile Web - Chrome

Mobile Web - Safari
![safari](https://user-images.githubusercontent.com/22219519/204363426-bd7000bb-b497-479a-80e2-9a9c37644422.png)

Desktop

iOS

Android

PR Reviewer Checklist

[x] I have verified the author checklist is complete (all boxes are checked off).
[x] I verified the correct issue is linked in the ### Fixed Issues section above
[x] I verified testing steps are clear and they cover the changes made in this PR

[x] I verified the steps for local testing are in the Tests section
[x] I verified the steps for expected offline behavior are in the Offline steps section
[x] I verified the steps for Staging and/or Production testing are in the QA steps section
[x] I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
[x] I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
[x] I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).

[x] I checked that screenshots or videos are included for tests on all platforms
[x] I included screenshots or videos for tests on all platforms
[x] I verified tests pass on all platforms & I tested again on:

[x] iOS / native
[x] Android / native
[x] iOS / Safari
[x] Android / Chrome
[x] MacOS / Chrome
[x] MacOS / Desktop

[x] If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
[x] I verified proper code patterns were followed (see Reviewing the code)

[x] I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
[x] I verified that comments were added to code that is not self explanatory
[x] I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
[x] I verified any copy / text shown in the product was added in all src/languages/* files
[x] I verified any copy / text that was added to the app is correct English and approved by marketing by adding the Waiting for Copy label for a copy review on the original GH to get the correct copy.
[x] I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
[x] I verified the JSDocs style guidelines (in STYLE.md) were followed

[x] If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
[x] I verified that this PR follows the guidelines as stated in the Review Guidelines
[x] I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
[x] I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
[x] I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
[x] I verified that if a function's arguments changed that all usages have also been updated correctly
[x] If a new component is created I verified that:

[x] A similar component doesn't exist in the codebase
[x] All props are defined accurately and each prop has a /** comment above it */
[x] The file is named correctly
[x] The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
[x] The only data being stored in the state is data necessary for rendering and nothing else
[x] For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
[x] Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
[x] All JSX used for rendering exists in the render method
[x] The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions

[x] If a new CSS style is added I verified that:

[x] A similar style doesn't already exist
[x] The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(themeColors.componentBG)

[x] If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
[x] If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
[x] I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Not emergency. GH actions was failing on PR reviewer checklist even though it was present.

🚀 Cherry-picked to staging by @chiragsalian in version: 1.2.32-2 🚀

platform
result

🤖 android 🤖
success ✅

🖥 desktop 🖥
success ✅

🍎 iOS 🍎
success ✅

🕸 web 🕸
success ✅

@Expensify/applauseleads please QA this PR and check it off on the deploy checklist if it passes.

🚀 Deployed to production by @luacmartins in version: 1.2.32-2 🚀

platform
result

🤖 android 🤖
success ✅

🖥 desktop 🖥
success ✅

🍎 iOS 🍎
failure ❌

🕸 web 🕸
success ✅

🚀 Deployed to production by @luacmartins in version: 1.2.32-2 🚀

platform
result

🤖 android 🤖
success ✅

🖥 desktop 🖥
success ✅

🍎 iOS 🍎
success ✅

🕸 web 🕸
success ✅

🚀 Cherry-picked to staging by https://github.com/AndrewGable in version: 1.3.28-2 🚀

platform
result

🤖 android 🤖
success ✅

🖥 desktop 🖥
success ✅

🍎 iOS 🍎
success ✅

🕸 web 🕸
success ✅

@Expensify/applauseleads please QA this PR and check it off on the deploy checklist if it passes.

🚀 Deployed to production by https://github.com/AndrewGable in version: 1.3.28-5 🚀

platform
result

🤖 android 🤖
success ✅

🖥 desktop 🖥
success ✅

🍎 iOS 🍎
success ✅

🕸 web 🕸
success ✅


Requires Review: Displays Nepali number system

@cliftonmcintosh

@pratimakandel
There is a small merge conflict. Can you please resolve the conflict by merging Code4Nepal:dev into your branch?

@cliftonmcintosh
I just did it! Let me know if it is fixed.

@pratimakandel
Thank you for the update. I am having trouble running your dev branch in order to verify the changes. When I check it out and try to load data using cat sql/*.sql | psql -U wazimap_np -W wazimap_np , the data load fails with
(1 row)

SET
SET
SET
ALTER TABLE
DROP TABLE
SET
SET
CREATE TABLE
ALTER TABLE
ERROR:  missing data for column "geo_level"
CONTEXT:  COPY population, line 1719: ""
ALTER TABLE

Here are the steps I have taken:

start with a fresh database by:

dropping the wazimap_np database
creating the wazimap_np database
granting permissions on that database to the wazimap_np user

run python manage.py migrate
run cat sql/*.sql | psql -U wazimap_np -W wazimap_np

Is there something out of sync between Code4Nepal:dev and pratimakandel:dev?

@cliftonmcintosh
What about now? My dev branch is up-to-date and I ran the following commands, I could successfully run the server with my branch

@pratimakandel
Thank you. It looks good.
Yes, I can run in docker now after updating to your latest update. I have confirmed that the number formatting has been updated. One interesting thing is that the old format continues to be present in the tables that are opened up in the profile view (with the "Show data" link) and the table views (like http://localhost:8000/data/table/?table=AGRICULTURE_LAND_USE&geo_ids=province-6,country-NP&primary_geo_id=province-6#valueType|estimate). I have no idea how to change those and would not suggest that that be changed as part of this PR.

@cliftonmcintosh
Great!! I completely forgot about the show data section. But I can look at it and see of there is a way.
Thanks.

@pratimakandel
https://beta.nepalmap.org has been updated with your changes. Thank you!


Events page is 500

https://gratipay.com/~whit537/events/
But I'm not seeing it in Sentry?

Seems to be only on production?

Hit this under https://github.com/gratipay/inside.gratipay.com/issues/1110#issuecomment-313436926 (slack).

E.g.: https://sentry.io/gratipay/gratipay-com/issues/271315249/

Even in the db:
gratipay::DATABASE=> SELECT * FROM events WHERE type = 'participant' AND payload->>'id' = '495913' order by ts desc;
ERROR:  unsupported Unicode escape sequence
DETAIL:  \u0000 cannot be converted to text.
CONTEXT:  JSON data, line 1: {"values": {"email":...
gratipay::DATABASE=> SELECT * FROM events WHERE type = 'participant' AND payload->>'id' = '1453' order by ts desc;
ERROR:  unsupported Unicode escape sequence
DETAIL:  \u0000 cannot be converted to text.
CONTEXT:  JSON data, line 1: {"values": {"email":...
gratipay::DATABASE=>

That's a NULL value? https://stackoverflow.com/questions/31671634/handling-unicode-sequences-in-postgresql

This is still freaking annoying for support.


Remove the separate thread pool for the aggregate actors and add a small utility to ...

Remove separate thread pool for the aggregate actors and add a small utility to detect blocked execution contexts

Codecov Report

Merging #26 (ef5b0fb) into main (b10509c) will decrease coverage by 0.00%.
The diff coverage is 78.84%.

:exclamation: Current head ef5b0fb differs from pull request most recent head c74c509. Consider uploading reports for the commit c74c509 to get more accurate results

@@            Coverage Diff             @@
##             main      #26      +/-   ##
==========================================
- Coverage   76.52%   76.52%   -0.01%
==========================================
  Files         160      161       +1
  Lines        2773     2824      +51
  Branches       72       72
==========================================
+ Hits         2122     2161      +39
- Misses        651      663      +12

Impacted Files
Coverage Δ

.../surge/internal/utils/ExecutionContextProber.scala
78.43% <78.43%> (ø)

...a/surge/internal/persistence/PersistentActor.scala
96.07% <100.00%> (ø)

...health/windows/actor/HealthSignalWindowActor.scala
91.20% <0.00%> (-1.10%)
:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b10509c...c74c509. Read the comment docs.


nixos/bepasty: Kind of modernize the module

Switch to Python 3 which fixes bepasty not being found (and requires a
patch to work which is already on bepasty master)
Remove the enable option
Hardcode directories and let systemd manage permissions
Sandbox the service using systemd
Switch to a dynamic user and run nothing as root (except for preStart)
Allow users to set permissions without adding them to the store
(extraConfigFile)
Make assertion more clear

Motivation for this change
Things done

[x] Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
Built on platform(s)

[x] NixOS
[ ] macOS
[ ] other Linux distributions

[ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[ ] Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
[x] Tested execution of all binary files (usually in ./result/bin/)
[ ] Determined the impact on package closure size (by running nix path-info -S before and after)
[ ] Assured whether relevant documentation is up to date
[x] Fits CONTRIBUTING.md.

@GrahamcOfBorg build bepasty

@GrahamcOfBorg build bepasty

@dasJ After a quick review it looks like this will make existing installs lose all data if custom directories were specified. Is this correct?

@aanderse Yes, it's a a little downside. On the upside, systemd will manage the permissions of the directory and make the path writable in the sandbox.

@dasJ You might want to consider keeping the dataDir and workDir option around but adding a warning that the options are deprecated. This way existing installs could be automatically migrated. In a few NixOS releases the options could eventually be removed. If you do this then no one will lose any data, or have to do any migration work.

@aanderse The problem is: How do I ensure the directories are owned by the proper user and have the proper permissions?

I assume some scripts could be written to take the existing dataDir and workDir values which aren't null and move the data to the appropriate spot, but I haven't looked into it in depth.


Add missing body tag

@iiegor Thanks for that! Merry Christmas :santa:

Thanks, you too! :christmas_tree: :gift:


allow admins to flag stories as NSFW

:arrow_up: :arrow_down: :question: :checkered_flag:

Hah that works, lgtm


Sidecar SDS/file watcher stops working after first renewal

Bug description
The Istio sidecar stops monitoring secret-mounted certificates after a single (successful) renewal per secret
[ ] Docs
[ ] Installation
[X] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[X] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
[ ] Upgrade
Expected behavior
File watcher keeps monitoring the configured files/certificates indefinitely, even after a renewal
Steps to reproduce the bug

Deploy a mesh-external workload (no sidecar)
Create client certificate secrets

kubectl create secret tls sleep-credential --key=certs1/client.NAMESPACE.svc.cluster.local.key --cert=certs1/client.NAMESPACE.svc.cluster.local.crt -o yaml --dry-run --save-config | kubectl apply -n NAMESPACE -f -
kubectl create secret generic sleep-credential-cacert --from-file=cacert=certs1/cluster.local.crt -o yaml --dry-run --save-config | kubectl apply -n NAMESPACE -f -

Deploy client pod with userVolume(Mount) annotations

sidecar.istio.io/inject: "true"
sidecar.istio.io/userVolume: '{"client-secret":{"secret":{"secretName":"sleep-credential"}},"ca-secret":{"secret":{"secretName":"sleep-credential-cacert"}}}'
sidecar.istio.io/userVolumeMount: '{"client-secret":{"mountPath":"/etc/sleep/client_certs/client.example.com","readOnly":true},"ca-secret":{"mountPath":"/etc/sleep/ca_certs/example.com"}}'

Create DR to originate TLS for "external" TLS workload

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: my-nginx
spec:
  host: my-nginx.NAMESPACE.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: MUTUAL
        clientCertificate: /etc/sleep/client_certs/client.example.com/tls.crt
        privateKey: /etc/sleep/client_certs/client.example.com/tls.key
        caCertificates: /etc/sleep/ca_certs/example.com/cacert

File watcher is created

2021-06-06T14:25:04.819680Z	info	ads	ADS: new connection for node:sidecar~<IP_ADDRESS>~sleep-686d7cbf6c-n5jnw.tra-123992636410~tra-123992636410.svc.cluster.local-3
2021-06-06T14:25:04.819853Z	info	cache	adding watcher for file certificate /etc/sleep/ca_certs/example.com/cacert
2021-06-06T14:25:04.819882Z	info	cache	read certificate from file	resource=file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-06T14:25:04.819910Z	info	sds	SDS: PUSH	resource=file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-06T14:25:04.820262Z	info	ads	ADS: new connection for node:sidecar~<IP_ADDRESS>~sleep-686d7cbf6c-n5jnw.tra-123992636410~tra-123992636410.svc.cluster.local-4
2021-06-06T14:25:04.820619Z	info	cache	adding watcher for file certificate /etc/sleep/client_certs/client.example.com/tls.crt
2021-06-06T14:25:04.820657Z	info	cache	read certificate from file	resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
2021-06-06T14:25:04.820698Z	info	sds	SDS: PUSH	resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key

Test connection (optional)
Renew cert/secret (either one, does not matter which)

kubectl create secret tls sleep-credential --key=certs2/client.NAMESPACE.svc.cluster.local.key --cert=certs2/client.NAMESPACE.svc.cluster.local.crt -o yaml --dry-run --save-config | kubectl apply -n NAMESPACE -f -

Cert update is detected

2021-06-06T14:26:34.275107Z	info	cache	event for file certificate /etc/sleep/client_certs/client.example.com/tls.crt : REMOVE, debouncing
2021-06-06T14:26:34.375619Z	info	cache	file certificate /etc/sleep/client_certs/client.example.com/tls.crt changed with event REMOVE, pushing to proxy
2021-06-06T14:26:34.375713Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-06T14:26:34.376354Z	info	cache	read certificate from file	resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
2021-06-06T14:26:34.376439Z	info	sds	SDS: PUSH	resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key

Renew cert again (here I simply roll back the old cert):

kubectl create secret tls sleep-credential --key=certs1/client.NAMESPACE.svc.cluster.local.key --cert=certs1/client.NAMESPACE.svc.cluster.local.crt -o yaml --dry-run --save-config | kubectl apply -n NAMESPACE -f -

Cert update is NOT detected

Version (include the output of istioctl version --remote and kubectl version --short and helm version --short if you used Helm)
Istio 1.10.0
k8s v1.18.19
How was Istio installed?
Helm
Environment where the bug was observed (cloud vendor, OS, etc)
Minikube

Bonus:
Renewing the CA and client certificates individually seems to work (once), but renewing both at approx. the same time results in only ONE "SDS: PUSH" message and the effective configuration uses mismatching certificates (one new, one old), producing 503 responses.
$ kubectl create secret tls sleep-credential --key=certs2/client.NAMESPACE.svc.cluster.local.key --cert=certs2/client.NAMESPACE.svc.cluster.local.crt -o yaml --dry-run --save-config | kubectl apply -n NAMESPACE -f -
$ kubectl logs -n NAMESPACE sleep-686d7cbf6c-n5jnw -c istio-proxy --since=10s -f
2021-06-06T14:26:34.275107Z	info	cache	event for file certificate /etc/sleep/client_certs/client.example.com/tls.crt : REMOVE, debouncing
2021-06-06T14:26:34.375619Z	info	cache	file certificate /etc/sleep/client_certs/client.example.com/tls.crt changed with event REMOVE, pushing to proxy
2021-06-06T14:26:34.375713Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-06T14:26:34.376354Z	info	cache	read certificate from file	resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
2021-06-06T14:26:34.376439Z	info	sds	SDS: PUSH	resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
$ kubectl create secret generic sleep-credential-cacert --from-file=cacert=certs2/cluster.local.crt -o yaml --dry-run --save-config | kubectl apply -n NAMESPACE -f -
$ kubectl logs -n NAMESPACE sleep-686d7cbf6c-n5jnw -c istio-proxy --since=10s -f
2021-06-06T14:30:25.260524Z	info	cache	event for file certificate /etc/sleep/ca_certs/example.com/cacert : REMOVE, debouncing
2021-06-06T14:30:25.360955Z	info	cache	file certificate /etc/sleep/ca_certs/example.com/cacert changed with event REMOVE, pushing to proxy
2021-06-06T14:30:25.361085Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-06T14:30:25.361454Z	info	cache	read certificate from file	resource=file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-06T14:30:25.361571Z	info	sds	SDS: PUSH	resource=file-root:/etc/sleep/ca_certs/example.com/cacert

$ kubectl create secret tls sleep-credential --key=certs2/client.NAMESPACE.svc.cluster.local.key --cert=certs2/client.NAMESPACE.svc.cluster.local.crt -o yaml --dry-run --save-config | kubectl apply -n NAMESPACE -f -
$ kubectl create secret generic sleep-credential-cacert --from-file=cacert=certs2/cluster.local.crt -o yaml --dry-run --save-config | kubectl apply -n NAMESPACE -f -
$ kubectl logs -n NAMESPACE sleep-77fdf484cc-k4tqp -c istio-proxy --since=10s -f
2021-06-06T17:23:59.167754Z	info	cache	event for file certificate /etc/sleep/ca_certs/example.com/cacert : REMOVE, debouncing
2021-06-06T17:23:59.168055Z	info	cache	event for file certificate /etc/sleep/client_certs/client.example.com/tls.crt : REMOVE, debouncing
2021-06-06T17:23:59.268845Z	info	cache	file certificate /etc/sleep/ca_certs/example.com/cacert changed with event REMOVE, pushing to proxy
2021-06-06T17:23:59.268902Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-06T17:23:59.269246Z	info	cache	read certificate from file	resource=file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-06T17:23:59.269334Z	info	sds	SDS: PUSH	resource=file-root:/etc/sleep/ca_certs/example.com/cacert

https://github.com/istio/istio/pull/33173
https://github.com/istio/istio/pull/33142
Should fix both the issues

Thanks! Will the changes be cherry-picked to release-1.10?
I have cherry-picked 2385cbd and 1b58a55 on top of tag 1.10.0, and renewing client+CA certs together now works once. But updating the secrets for a second or third time (still) seems to have no effect:
2021-06-07T12:41:30.213738Z     info    cache   event for file certificate /etc/sleep/ca_certs/example.com/cacert : REMOVE, pushing to proxy
2021-06-07T12:41:30.213828Z     info    ads     XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-07T12:41:30.214042Z     info    cache   read certificate from file      resource=file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-07T12:41:30.214144Z     info    sds     SDS: PUSH       resource=file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-07T12:41:30.214630Z     info    cache   event for file certificate /etc/sleep/client_certs/client.example.com/tls.crt : REMOVE, pushing to proxy
2021-06-07T12:41:30.214661Z     info    ads     XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-07T12:41:30.315201Z     info    cache   read certificate from file      resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
2021-06-07T12:41:30.315286Z     info    sds     SDS: PUSH       resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key

But updating the secrets for a second or third time (still) seems to have no effect:

Do you have logs for that?

Do you have logs for that?

That's what I meant to show: There are simply no additional (related) logs beyond the first update (at least with info log level). None.
If you can tell me which logging params/values to use, I can try to get you more logs...

Ok. If there are no logs then events might not be generated. If there are events, the current log lines should come.
@howardjohn For any additional thoughts?

 I expect you are testing on master?
I am not really familiar with building an entire "base-Istio" package, so I have only...

Compiled pilot-agent from master e983567

$ pilot-agent version
version.BuildInfo{Version:"1.11-dev", GitRevision:"e983567d5ac2158838bbdd55318a129605f8566c", GolangVersion:"go1.16.4", BuildStatus:"Clean", GitTag:""}

Build a proxyv2 image with it

FROM istio/proxyv2:1.10.0
COPY pilot-agent /usr/local/bin/

Deployed regular Istio 1.10.0
Deployed my workload using the custom proxyv2 image via sidecar.istio.io/proxyImage annotation

And I still don't see SDS updates beyond the first one.
Would I need to use a custom pilot image as well? Or use the latest master-based helm charts?
In either case, a backport to 1.10 IMO would be required. Could you maybe test your changes on 1.10 and, if they work, initiate the cherry-pick?

We are testing on master. In any case - I think backporting them to 1.10 does not harm

Do you have any suggestions how to move forward with this?
Are there (semi) official images (on a public registry) that I could use to test on master?
I have no problem reproducing the issue on latest release 1.10.1, and my previous attempt (building pilot-agent from master and plugging it into proxyv2:1.10.0) also showed the issue.
I have a bash script that reproduces the issue in my environment, maybe you can take it for a spin?
It's rather lengthy I am afraid. I hope it's ok to post it here...!?
Install Istio:
$ git checkout 1.10.1
$ helm install --namespace istio-system --create-namespace istio-base manifests/charts/base
$ helm install --namespace istio-system istiod manifests/charts/istio-control/istio-discovery --set global.hub="docker.io/istio" --set global.tag="1.10.1" --set global.jwtPolicy=first-party-jwt --set meshConfig.accessLogFile=/dev/stdout

Create script and manifest files:
mkdir issue33293
cd issue33293
cat <<'EOF' > cert_renew_test.sh
#!/bin/bash
#set -x
set -e

function cleanup {
  kubectl delete --namespace "${1}" --filename nginx.yaml
  kubectl delete --namespace "${1}" --filename nginx_dr_se_vs.yaml
  kubectl delete --namespace "${1}" --filename sleep.yaml
  kubectl delete secret --namespace "${1}" nginx-credential nginx-credential-cacert sleep-credential sleep-credential-cacert
  kubectl delete namespace "${1}"
  rm -rf certs{1,2,3}
}
function fail {
  # Get proxy log
  kubectl logs --namespace "${1}" "${2}" -c istio-proxy
  cleanup "${1}"
  echo "test failed"
  exit 1
}
function generateCerts {
  mkdir -p "${1}"
  rm -f "${1}/*"
  # Generate root CA key and certificate
  openssl req -x509 -sha256 -new -nodes -newkey rsa:2048 -days 1 -keyout "${1}/rootCAKey.key" -out "${1}/rootCACert.crt" -subj "/CN=example.com/O=example organization"
  # Generate nginx CSR and sign using CA
  openssl req -newkey rsa:2048 -nodes -keyout "${1}/nginx.key" -out "${1}/nginx.csr" -subj "/CN=nginx.example.com/O=nginx organization"
  openssl x509 -req -sha256 -in "${1}/nginx.csr" -CA "${1}/rootCACert.crt" -CAkey "${1}/rootCAKey.key" -CAcreateserial -days 1 -out "${1}/nginx.crt"
  # Generate sleep CSR and sign using CA
  openssl req -newkey rsa:2048 -nodes -keyout "${1}/sleep.key" -out "${1}/sleep.csr" -subj "/CN=sleep.example.com/O=sleep organization"
  openssl x509 -req -sha256 -in "${1}/sleep.csr" -CA "${1}/rootCACert.crt" -CAkey "${1}/rootCAKey.key" -CAcreateserial -days 1 -out "${1}/sleep.crt"
}
function applyCertificates {
  kubectl create secret tls nginx-credential --key="${1}/nginx.key" --cert="${1}/nginx.crt" -o yaml --dry-run=client | kubectl apply --namespace $NAMESPACE -f -
  kubectl create secret tls sleep-credential --key="${1}/sleep.key" --cert="${1}/sleep.crt" -o yaml --dry-run=client | kubectl apply --namespace $NAMESPACE -f -
  kubectl create secret generic nginx-credential-cacert --from-file=cacert="${1}/rootCACert.crt" -o yaml --dry-run=client | kubectl apply --namespace $NAMESPACE -f -
  kubectl create secret generic sleep-credential-cacert --from-file=cacert="${1}/rootCACert.crt" -o yaml --dry-run=client | kubectl apply --namespace $NAMESPACE -f -
}
function localFileMatchesRemoteFile {
  localFile=$1
  namespace=$2
  pod=$3
  container=$4
  remoteFile=$5
  localSum="$(md5sum "${localFile}")"
  remoteSum="$(kubectl exec --namespace "${namespace}" "${pod}" --container "${container}" -- md5sum "${remoteFile}")"
  if [ "${localSum%% *}" == "${remoteSum%% *}" ]; then
    return 0
  else
    return 1
  fi
}

# Create namespace for test
NAMESPACE="cert-renew-test"
kubectl delete namespace "${NAMESPACE}" --ignore-not-found
kubectl create namespace "${NAMESPACE}"
kubectl label namespace "${NAMESPACE}" istio-injection=enabled --overwrite=true

# Generate first certificate set and create secrets from them for nginx and sleep
generateCerts "certs1"
applyCertificates "certs1"

# Deploy nginx server
kubectl create configmap --namespace "${NAMESPACE}" nginx-configmap --from-file=nginx.conf
kubectl apply --namespace "${NAMESPACE}" -f nginx.yaml
kubectl apply --namespace "${NAMESPACE}" -f nginx_dr_se_vs.yaml
kubectl rollout status deployment --namespace "${NAMESPACE}" nginx --timeout 60s
NGINX_POD=$(kubectl get pod --namespace "${NAMESPACE}" --selector run=nginx --output jsonpath='{.items..metadata.name}')
NGINX_SVC_IP=$(kubectl get service --namespace "${NAMESPACE}" nginx --output jsonpath='{.spec.clusterIP}')

# Deploy sleep pod with sidecar and DNS Proxy feature to allow faking FQDN nginx.example.com
# Also create DR, SE and VS to auto-upgrade HTTP to mTLS
kubectl apply --namespace "${NAMESPACE}" -f sleep.yaml
kubectl rollout status deployment --namespace "${NAMESPACE}" sleep --timeout 60s
SLEEP_POD=$(kubectl get pod --namespace "${NAMESPACE}" -l app=sleep -o jsonpath={.items..metadata.name})

# Query nginx server from istio-proxy via HTTPS using explicit certs
for ((i=0; i<6; i++)); do
  status="$(kubectl exec --namespace "${NAMESPACE}" "${SLEEP_POD}" --container istio-proxy -- curl --silent --output /dev/null --write-out "%{http_code}" --max-time 5 --cacert /etc/sleep/ca_certs/example.com/cacert --cert /etc/sleep/client_certs/client.example.com/tls.crt --key /etc/sleep/client_certs/client.example.com/tls.key --resolve "nginx.example.com:443:${NGINX_SVC_IP}" https://nginx.example.com/)"
  if [ "${status}" -eq 200 ]; then
    break
  fi
  echo "Wait 5s for nginx to become reachable (outside the service mesh) ..."
  sleep 5
done
if [ $i -eq 6 ]; then
  echo "Error: Nginx is (still) not reachable (outside the service mesh)"
  fail "${NAMESPACE}" "${SLEEP_POD}"
fi

# Query nginx server from sleep via plain HTTP (istio-proxy TLS origination)
for ((i=0; i<6; i++)); do
  status="$(kubectl exec --namespace "${NAMESPACE}" "${SLEEP_POD}" --container sleep -- curl --silent --output /dev/null --write-out "%{http_code}" --max-time 5 http://nginx.example.com/)"
  if [ "${status}" -eq 200 ]; then
    break
  fi
  echo "Wait 5s for nginx to become reachable (inside the service mesh) ..."
  sleep 5
done
if [ $i -eq 6 ]; then
  echo "Error: Nginx is (still) not reachable (inside the service mesh)"
  fail "${NAMESPACE}" "${SLEEP_POD}"
fi

# Renew both nginx and sleep certificates twice
for certs in certs{2,3}; do
  # Generate new certificate set and update the secrets
  generateCerts "${certs}"
  applyCertificates "${certs}"

  # Wait for kubelet to sync the updated certificates into the pods
  for ((i=0; i<12; i++)); do
    if localFileMatchesRemoteFile "${certs}/sleep.key" "${NAMESPACE}" "${SLEEP_POD}" "istio-proxy" "/etc/sleep/client_certs/client.example.com/tls.key" \
    && localFileMatchesRemoteFile "${certs}/sleep.crt" "${NAMESPACE}" "${SLEEP_POD}" "istio-proxy" "/etc/sleep/client_certs/client.example.com/tls.crt" \
    && localFileMatchesRemoteFile "${certs}/rootCACert.crt" "${NAMESPACE}" "${SLEEP_POD}" "istio-proxy" "/etc/sleep/ca_certs/example.com/cacert" \
    && localFileMatchesRemoteFile "${certs}/nginx.key" "${NAMESPACE}" "${NGINX_POD}" "nginx" "/etc/nginx/certs/tls.key" \
    && localFileMatchesRemoteFile "${certs}/nginx.crt" "${NAMESPACE}" "${NGINX_POD}" "nginx" "/etc/nginx/certs/tls.crt" \
    && localFileMatchesRemoteFile "${certs}/rootCACert.crt" "${NAMESPACE}" "${NGINX_POD}" "nginx" "/etc/nginx/certs/cacert"; then
      break
    fi
    echo "Wait 10s for kubelet to sync the updated certificates into the pods ..."
    sleep 10
  done
  if [ $i -eq 12 ]; then
    echo "Error: Updated certificates have (still) not been synced into the pods"
    fail "${NAMESPACE}" "${SLEEP_POD}"
  fi

  # Query nginx with mismatching certificates
  for ((i=0; i<6; i++)); do
    status="$(kubectl exec --namespace "${NAMESPACE}" "${SLEEP_POD}" --container sleep -- curl --silent --output /dev/null --write-out "%{http_code}" --max-time 5 http://nginx.example.com/)"
    if [ "${status}" -eq 503 ]; then
      break
    fi
    echo "Wait 5s updated certificates to become active in sleep pod ..."
    sleep 5
  done
  if [ $i -eq 6 ]; then
    echo "Error: Updated certificates have (still) not become active in sleep pod"
    fail "${NAMESPACE}" "${SLEEP_POD}"
  fi

  # Reload nginx certificates
  kubectl exec --namespace "${NAMESPACE}" "${NGINX_POD}" -- service nginx reload

  # Query nginx server with updated client and server certs
  for ((i=0; i<6; i++)); do
    status="$(kubectl exec --namespace "${NAMESPACE}" "${SLEEP_POD}" --container sleep -- curl --silent --output /dev/null --write-out "%{http_code}" --max-time 5 http://nginx.example.com/)"
    if [ "${status}" -eq 200 ]; then
      break
    fi
    echo "Wait 5s updated certificates to become active in nginx pod ..."
    sleep 5
  done
  if [ $i -eq 6 ]; then
    echo "Error: Updated certificates have (still) not become active in nginx pod"
    fail "${NAMESPACE}" "${SLEEP_POD}"
  fi
done

cleanup
echo "test successful"
EOF
chmod +x cert_renew_test.sh
cat <<'EOF' > nginx.conf
error_log stderr info;

events{
}

http {
  log_format main '$remote_addr - $remote_user [$time_local]  $status "$request" $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"';
  access_log /dev/stdout;

  server {
    listen 443 ssl;
    listen [::]:443 ssl;

    root /usr/share/nginx/html;
    index index.html;

    server_name nginx.example.com;
    ssl_certificate /etc/nginx/certs/tls.crt;
    ssl_certificate_key /etc/nginx/certs/tls.key;
    ssl_client_certificate /etc/nginx/certs/cacert;
    ssl_verify_client on;
  }
}
EOF
cat <<'EOF' > nginx.yaml
apiVersion: v1
kind: Service
metadata:
  name: nginx
  labels:
    run: nginx
spec:
  ports:
  - port: 443
    protocol: TCP
  selector:
    run: nginx
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
spec:
  selector:
    matchLabels:
      run: nginx
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        run: nginx
        sidecar.istio.io/inject: "false"
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 443
        volumeMounts:
        - name: nginx-config
          mountPath: /etc/nginx
          readOnly: true
        - name: nginx-certs
          mountPath: /etc/nginx/certs
          readOnly: true
      volumes:
      - name: nginx-config
        configMap:
          name: nginx-configmap
      - name: nginx-certs
        projected:
          sources:
          - secret:
              name: nginx-credential
          - secret:
              name: nginx-credential-cacert
EOF
cat <<'EOF' > nginx_dr_se_vs.yaml
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: nginx
spec:
  hosts:
  - nginx.example.com
  ports:
  - name: http
    number: 80
    protocol: HTTP
  - name: https
    number: 443
    protocol: HTTP
  resolution: DNS
  endpoints:
  - address: nginx
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx
spec:
  hosts:
  - nginx.example.com
  http:
  - match:
    - port: 80
    route:
    - destination:
        host: nginx.example.com
        port:
          number: 443
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: nginx
spec:
  host: nginx.example.com
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: MUTUAL
        clientCertificate: /etc/sleep/client_certs/client.example.com/tls.crt
        privateKey: /etc/sleep/client_certs/client.example.com/tls.key
        caCertificates: /etc/sleep/ca_certs/example.com/cacert
EOF
cat <<'EOF' > sleep.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sleep
  name: sleep
spec:
  selector:
    matchLabels:
      app: sleep
  template:
    metadata:
      annotations:
        proxy.istio.io/config: |
          proxyMetadata:
            ISTIO_META_DNS_CAPTURE: "true"
            ISTIO_META_DNS_AUTO_ALLOCATE: "true"
        sidecar.istio.io/inject: "true"
        # I tested with proxy image based off 1.10.1 but with pilot-agent built from master
        #sidecar.istio.io/proxyImage: "<private registry>/proxyv2:1.10.1-1b58a55-2385cbd"
        sidecar.istio.io/userVolume: '{"client-secret":{"secret":{"secretName":"sleep-credential"}},"ca-secret":{"secret":{"secretName":"sleep-credential-cacert"}}}'
        sidecar.istio.io/userVolumeMount: '{"client-secret":{"mountPath":"/etc/sleep/client_certs/client.example.com","readOnly":true},"ca-secret":{"mountPath":"/etc/sleep/ca_certs/example.com"}}'
      labels:
        app: sleep
    spec:
      containers:
      - command:
        - /bin/sleep
        - 3650d
        image: pstauffer/curl
        name: sleep
EOF

The script is run by ./cert_renew_test.sh and it will create a namespace cert-renew-test.
It will then deploy with one set of certs, test, renew to a second set of certs, test and renew+test one last/third time.
In my environment and running Istio 1.10.1, the test fails during first renewal. After cherry-picking 2385cbd and 1b58a55 on top of 1.10.1, the test fails during the second renewal.

Can confirm the issue also occurs as described on a basic/clean KIND cluster:
$ kind create cluster --image kindest/node:v1.21.1
$ helm install --namespace istio-system --create-namespace istio-base manifests/charts/base
$ helm install --namespace istio-system istiod manifests/charts/istio-control/istio-discovery --set global.hub="docker.io/istio" --set global.tag="1.10.1"
$ cert_renew_test.sh

https://gcsweb.istio.io/gcs/istio-build/dev/1.11-alpha.97d8df38eb725dc8acaaa9fceb714968d32dfe54 - These have latest master images. Please test and share logs. If you are not seeing the events log - I suspect the correct file events are not generated from your test.

https://gcsweb.istio.io/gcs/istio-build/dev/1.11-alpha.97d8df38eb725dc8acaaa9fceb714968d32dfe54 - These have latest master images. Please test and share logs. If you are not seeing the events log - I suspect the correct file events are not generated from your test.

Thanks, that was very helpful! I did not know about the mentioned dev builds being this easy to find and use...
I deployed in KIND as follows:
$ git checkout 97d8df38eb725dc8acaaa9fceb714968d32dfe54
HEAD is now at 97d8df38eb Fix regression when using custom transport_socket envoyfilter (#33386)
$ helm install --namespace istio-system --create-namespace istio-base manifests/charts/base
$ helm install --namespace istio-system istiod manifests/charts/istio-control/istio-discovery --set global.hub="gcr.io/istio-testing" --set global.tag="1.11-alpha.97d8df38eb725dc8acaaa9fceb714968d32dfe54"

And I am attaching test.log and bug-report.tar.gz here.
You will find that kubelet has synced the new certificates into the pod (script log shows this) but pilot-agent does not pick up on them (no SDS logs even after 10+ minutes)

Can you enable debug log and start the server? you can set this annotation on the pod you are trying
"sidecar.istio.io/agentLogLevel: cache:debug,default:debug"
I suspect REMOVE is causing it not to be watching again
2021-06-14T09:54:00.079459Z	info	cache	event for file certificate /etc/sleep/ca_certs/example.com/cacert : REMOVE, pushing to proxy
2021-06-14T09:54:00.079514Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-14T09:54:00.079548Z	info	cache	event for file certificate /etc/sleep/client_certs/client.example.com/tls.crt : REMOVE, pushing to proxy

Please let me know if you need more logs than these:
...
2021-06-14T11:25:02.568054Z	info	FLAG: --log_output_level="cache:debug,default:debug"
...
2021-06-14T11:25:04.688569Z	info	cache	event for file certificate /etc/sleep/client_certs/client.example.com/tls.crt : REMOVE, pushing to proxy
2021-06-14T11:25:04.688641Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-14T11:25:04.789126Z	debug	cache	already watching file for /etc/sleep/client_certs/client.example.com/tls.crt
2021-06-14T11:25:04.789197Z	info	cache	read certificate from file	resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
2021-06-14T11:25:04.789272Z	info	ads	SDS: PUSH for node:sleep-86dc9bb554-zl24b.tra-123057573233 resources:1 size:2.9kB resource:file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
2021-06-14T11:26:32.058076Z	info	cache	event for file certificate /etc/sleep/ca_certs/example.com/cacert : REMOVE, pushing to proxy
2021-06-14T11:26:32.058171Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-14T11:26:32.058500Z	debug	cache	already watching file for /etc/sleep/ca_certs/example.com/cacert
2021-06-14T11:26:32.058528Z	info	cache	read certificate from file	resource=file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-14T11:26:32.062175Z	info	ads	SDS: PUSH for node:sleep-86dc9bb554-zl24b.tra-123057573233 resources:1 size:1.3kB resource:file-root:/etc/sleep/ca_certs/example.com/cacert
### Second renewal happens now, but nothing happens...

2021-06-14T11:25:04.789126Z	debug	cache	already watching file for /etc/sleep/client_certs/client.example.com/tls.crt
Because of this watcher is not created I think
https://github.com/istio/istio/pull/33413 - Can you try this?

Sure.. It seems to have broken it a little more unfortunately:
2021-06-14T11:56:30.486959Z	info	FLAG: --log_output_level="cache:debug,default:debug"
...
2021-06-14T11:56:30.486995Z	info	Version 1.11-dev-0d5b26325c24d2d069c62a46271a4c9c9871efe6-Clean
...
2021-06-14T11:57:39.068444Z	debug	cache	removing file /etc/sleep/ca_certs/example.com/cacert from file certs
2021-06-14T11:57:39.068688Z	info	cache	event for file certificate /etc/sleep/ca_certs/example.com/cacert : REMOVE, pushing to proxy
2021-06-14T11:57:39.068771Z	debug	cache	removing file /etc/sleep/client_certs/client.example.com/tls.crt from file certs
2021-06-14T11:57:39.068852Z	info	cache	event for file certificate /etc/sleep/client_certs/client.example.com/tls.crt : REMOVE, pushing to proxy
### nothing else after this

Ok. Got it. Let me take a look.

Sorry. Can you try the updated commit ?

Jackpot! I tried with 4 renewals (only showing 2) and it seems to work now... :-)
2021-06-14T14:09:43.718800Z	info	Version 1.11-dev-48da501231cca2bd18e8cbfafc3e0fdf38646d76-Clean
...
2021-06-14T14:09:46.408341Z	info	cache	event for file certificate /etc/sleep/client_certs/client.example.com/tls.crt : REMOVE, pushing to proxy
2021-06-14T14:09:46.408442Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-14T14:09:46.408535Z	info	cache	event for file certificate /etc/sleep/ca_certs/example.com/cacert : REMOVE, pushing to proxy
2021-06-14T14:09:46.408591Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-14T14:09:46.408768Z	info	cache	adding watcher for file certificate /etc/sleep/ca_certs/example.com/cacert
2021-06-14T14:09:46.408805Z	info	cache	read certificate from file	resource=file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-14T14:09:46.408911Z	info	ads	SDS: PUSH for node:sleep-74c6695b4b-zknpw.tra-123843715854 resources:1 size:1.3kB resource:file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-14T14:09:46.509669Z	info	cache	adding watcher for file certificate /etc/sleep/client_certs/client.example.com/tls.crt
2021-06-14T14:09:46.509745Z	info	cache	read certificate from file	resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
2021-06-14T14:09:46.509864Z	info	ads	SDS: PUSH for node:sleep-74c6695b4b-zknpw.tra-123843715854 resources:1 size:2.9kB resource:file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
### Second renewal
2021-06-14T14:10:57.032846Z	info	cache	event for file certificate /etc/sleep/ca_certs/example.com/cacert : REMOVE, pushing to proxy
2021-06-14T14:10:57.032956Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-14T14:10:57.034713Z	info	cache	event for file certificate /etc/sleep/client_certs/client.example.com/tls.crt : REMOVE, pushing to proxy
2021-06-14T14:10:57.034776Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-14T14:10:57.035754Z	info	cache	adding watcher for file certificate /etc/sleep/ca_certs/example.com/cacert
2021-06-14T14:10:57.035840Z	info	cache	read certificate from file	resource=file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-14T14:10:57.036053Z	info	ads	SDS: PUSH for node:sleep-74c6695b4b-zknpw.tra-123843715854 resources:1 size:1.3kB resource:file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-14T14:10:57.136361Z	info	cache	adding watcher for file certificate /etc/sleep/client_certs/client.example.com/tls.crt
2021-06-14T14:10:57.136657Z	info	cache	read certificate from file	resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
2021-06-14T14:10:57.136905Z	info	ads	SDS: PUSH for node:sleep-74c6695b4b-zknpw.tra-123843715854 resources:1 size:2.9kB resource:file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key

Thanks for testing. While you have environment, can you please test my final commit?

Thank you for providing a solution!
The last one still seems good:
2021-06-14T14:32:38.695823Z	info	Version 1.11-dev-41ddf6b33224b09983195153c88fab906a333ced-Clean
...
2021-06-14T14:32:40.851163Z	info	cache	event for file certificate /etc/sleep/client_certs/client.example.com/tls.crt : REMOVE, pushing to proxy
2021-06-14T14:32:40.851244Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-14T14:32:40.851270Z	debug	cache	removing file /etc/sleep/client_certs/client.example.com/tls.crt from file certs
2021-06-14T14:32:40.951872Z	info	cache	adding watcher for file certificate /etc/sleep/client_certs/client.example.com/tls.crt
2021-06-14T14:32:40.951932Z	info	cache	read certificate from file	resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
2021-06-14T14:32:40.952054Z	info	ads	SDS: PUSH for node:sleep-578b8c94bd-xrm8c.tra-123752856572 resources:1 size:2.9kB resource:file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
2021-06-14T14:33:49.058471Z	info	cache	event for file certificate /etc/sleep/ca_certs/example.com/cacert : REMOVE, pushing to proxy
2021-06-14T14:33:49.058545Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-14T14:33:49.058697Z	debug	cache	removing file /etc/sleep/ca_certs/example.com/cacert from file certs
2021-06-14T14:33:49.059081Z	info	cache	adding watcher for file certificate /etc/sleep/ca_certs/example.com/cacert
2021-06-14T14:33:49.059583Z	info	cache	read certificate from file	resource=file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-14T14:33:49.059884Z	info	ads	SDS: PUSH for node:sleep-578b8c94bd-xrm8c.tra-123752856572 resources:1 size:1.3kB resource:file-root:/etc/sleep/ca_certs/example.com/cacert
### Second renewal
2021-06-14T14:35:13.076935Z	info	cache	event for file certificate /etc/sleep/client_certs/client.example.com/tls.crt : REMOVE, pushing to proxy
2021-06-14T14:35:13.077311Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-14T14:35:13.077486Z	debug	cache	removing file /etc/sleep/client_certs/client.example.com/tls.crt from file certs
2021-06-14T14:35:13.077696Z	info	cache	event for file certificate /etc/sleep/ca_certs/example.com/cacert : REMOVE, pushing to proxy
2021-06-14T14:35:13.077748Z	info	ads	XDS: Incremental Pushing:0 ConnectedEndpoints:4 Version:
2021-06-14T14:35:13.077809Z	debug	cache	removing file /etc/sleep/ca_certs/example.com/cacert from file certs
2021-06-14T14:35:13.079047Z	info	cache	adding watcher for file certificate /etc/sleep/ca_certs/example.com/cacert
2021-06-14T14:35:13.079106Z	info	cache	read certificate from file	resource=file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-14T14:35:13.079237Z	info	ads	SDS: PUSH for node:sleep-578b8c94bd-xrm8c.tra-123752856572 resources:1 size:1.3kB resource:file-root:/etc/sleep/ca_certs/example.com/cacert
2021-06-14T14:35:13.180182Z	info	cache	adding watcher for file certificate /etc/sleep/client_certs/client.example.com/tls.crt
2021-06-14T14:35:13.180317Z	info	cache	read certificate from file	resource=file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key
2021-06-14T14:35:13.180714Z	info	ads	SDS: PUSH for node:sleep-578b8c94bd-xrm8c.tra-123752856572 resources:1 size:2.9kB resource:file-cert:/etc/sleep/client_certs/client.example.com/tls.crt~/etc/sleep/client_certs/client.example.com/tls.key

If you are going to merge this, please also include it (and any other related/necessary changes) for 1.10 and earlier releases if they are affected (where there is still active support). I believe I had a successful repro in 1.9 the other day, for example, so this should be checked IMO.

We have already cherry picked the other fixes to 1.10. Thanks for testing.


Actions_reducers

In this project ,
Actions and reducers added

The PR should be opened from the dev branch into the main branch,
Here you have to merge action into dev then create another PR from the dev branch into the main branch.
Thank you


Fail to build from sources with ld --as-needed

leveldb fails to build from sources with the linking flag '--as-needed' enabled.

The attached patch solves the issue (and set the correct GCC linking order).

Original issue reported on code.google.com by<EMAIL_ADDRESS>on 29 Nov 2011 at 11:33
Attachments:

0101-as_needed.patch

I've rewritten the patch against the latest snapshot: 36a5f8e

Original comment by<EMAIL_ADDRESS>on 5 Dec 2011 at 5:17
Attachments:

0101-as_needed.patch

The bugref was wrong, attaching the revised patch.

Original comment by<EMAIL_ADDRESS>on 29 Nov 2011 at 11:36
Attachments:

0101-as_needed.patch

Sorry, this got dropped on the floor.

Could you take a moment to e-sign the contributor license agreement
at http://code.google.com/legal/individual-cla-v1.0.html
so that I can incorporate your patches.  Email me when you have done so.

Thanks very much.
<EMAIL_ADDRESS>

Original comment by<EMAIL_ADDRESS>on 16 Oct 2012 at 4:45

Forgot to add $(LIBS) to the linking flags to the shared library.
The attached patch fixes it.

Original comment by<EMAIL_ADDRESS>on 13 Apr 2012 at 9:47
Attachments:

0101-as_needed.patch

Any news on this bug?

Original comment by<EMAIL_ADDRESS>on 13 Oct 2012 at 4:17

Again, refreshed patch is attached.

Original comment by<EMAIL_ADDRESS>on 13 Apr 2012 at 12:14
Attachments:

0101-as_needed.patch

Fixed in 1.7.0.

Original comment by<EMAIL_ADDRESS>on 16 Oct 2012 at 11:35

Changed state: Fixed


PrometheusWriter formatting errors.

Software versions
DesignSpark.ESDK 0.0.4
aq-device commit 946d84bb1fdd63d531def5ca7a6888647f6e294d
Errors
Mar 21 19:01:59 airquality python3[497]: 2022-03-21 19:01:59,826 [ERROR] PrometheusWriter prometheusUpdateThread_aqpublic: Could not format data, reason 'instance'
Mar 21 19:01:59 airquality python3[497]: 2022-03-21 19:01:59,864 [ERROR] PrometheusWriter prometheusUpdateThread_private: Could not format data, reason 'instance'
Mar 21 19:01:59 airquality python3[497]: 2022-03-21 19:01:59,864 [ERROR] PrometheusWriter prometheusUpdateThread_private: Could not format data, reason 'instance'
Mar 21 19:06:59 airquality python3[497]: 2022-03-21 19:06:59,930 [ERROR] PrometheusWriter prometheusUpdateThread_aqpublic: Could not format data, reason 'instance'
Mar 21 19:06:59 airquality python3[497]: 2022-03-21 19:06:59,964 [ERROR] PrometheusWriter prometheusUpdateThread_private: Could not format data, reason 'instance'
Mar 21 19:06:59 airquality python3[497]: 2022-03-21 19:06:59,964 [ERROR] PrometheusWriter prometheusUpdateThread_private: Could not format data, reason 'instance'
Mar 21 19:12:00 airquality python3[497]: 2022-03-21 19:12:00,040 [ERROR] PrometheusWriter prometheusUpdateThread_aqpublic: Could not format data, reason 'instance'
Mar 21 19:12:00 airquality python3[497]: 2022-03-21 19:12:00,040 [ERROR] PrometheusWriter prometheusUpdateThread_aqpublic: Could not format data, reason 'instance'
Mar 21 19:12:00 airquality python3[497]: 2022-03-21 19:12:00,062 [ERROR] PrometheusWriter prometheusUpdateThread_private: Could not format data, reason 'instance'
Mar 21 19:12:00 airquality python3[497]: 2022-03-21 19:12:00,062 [ERROR] PrometheusWriter prometheusUpdateThread_private: Could not format data, reason 'instance'

Incorrect key names in config file, issue #16 has been opened in response to this.


Inconsistency in Ensemble.fit_generator() argument

Description
The Ensemble.fit_generator() method's argument validation_generator is inconsistent with Keras Model.fit_generator()'s argument validation_data. This means that one can't simply add a line model = Ensemble(model, n_estimators=n_estimators, n_predictions=n_predictions) to a workflow to use model ensembles instead of a single model, one also needs to modify the call to model.fit_generator() method.
The desired behaviour is to have Ensemble.fit_generator(validation_data=...), so that one can use the same model.fit_generator() call, regardless of whether model is a single Keras model or an Ensemble object.
Done Checklist (Bug)

[ ] Bug fixed
[ ] Branch and Pull Request build on CI
[ ] Branch and Pull Request pass unit tests on CI
[ ] Peer Code Review Performed
[ ] Code well commented
[ ] CHANGELOG.md updated

@PantelisElinas I believe this has been fixed recently?

Hi @youph this issue was solved as part of issue #413.
This one can be closed now.
Regards,
P.


Feature resend decide ss

Please make sure these boxes are checked, before submitting a new PR.

[x] You ran the local CI checker with ./check.sh with no errors
[x] You reference which issue is being closed in the PR text (if applicable)
[ ] You updated the OmniPaxos book (if applicable)

Issues
Completes Issue #68  by resending the decides of StopSigns.
Breaking Changes

The trait function Storage::set_stopsign(&mut self, s: StopSign) -> StorageResult<()>'s signature changes to Storage::set_stopsign(&mut self, s: Option<StopSign>) -> StorageResult<()>.

Other Changes

Fixed AcceptSync bugs by changing how Stopsign's and Snapshots are created.

@kevin-harrison since we are changing when we consider a StopSign decided, we might as well fix a related issue which is that currently, we don't know if a StopSign is decided when we perform read(). Perhaps we can add a decided: bool flag in the LogEntry::StopSign variant here.

@kevin-harrison since we are changing when we consider a StopSign decided, we might as well fix a related issue which is that currently, we don't know if a StopSign is decided when we perform read(). Perhaps we can add a decided: bool flag in the LogEntry::StopSign variant here.

Do you prefer changing the enum to StopSign(StopSign, u64) and the user has to check with the decided index to determine if its decided. Or do you prefer doing it for the user by the enum into two cases DecidedStopSign(StopSign) and UndecidedStopSign(StopSign)


HAZEL lacks a 2D sequence frame animation system and a state machine system.

Is your feature request related to a problem? Please describe
HAZEL lacks a 2D sequence frame animation system and a state machine system. I hope it can be added in the future because Godot also has these contents. It is not 3D, but 2D, and sprite characters can perform actions. I don't want to see a static image of a rabbit moving.
Describe the solution you'd like
I hope it can load sequence frames and keep bouncing forward.
Describe alternatives you've considered
none
Additional context
none

Make it yourself.


Fixes point not detected in polygon

This fixes some cases where a path was not being found. Specifically when a point was close to the edge it was detected as an Edge and not as part of the polygon. This test was quick heavy handed which caused a lot of false positives.
Most of the failures in mentioned in https://github.com/vleue/polyanya/issues/45 were caused by this.

This value of epsilon currently set works well with the example meshes, but will fail with meshes at a smaller scale, which is what you're getting.
I think changing the value has some small perf impact. Ideally instead of it being a const, it should be possible to set it like delta as the correct value will depend on the mesh.
A value of delta / 10 would be a good default, in your case that would be 1e-3, is that small enough for your mesh?

It will be a bigger change but I can make it. I assumed the EPSILON value was based on the precision of the type rather than for performance reasons. The cpp implementation uses 1e-8.
I assume the performance implication is just less points being classified as edges and an edge uses less expansions?
For the change, should I just change     fn side(self, line: (Vec2, Vec2)) -> EdgeSide { to take the epsilon value and pass it through from where we have the delta?

I assume the performance implication is just less points being classified as edges and an edge uses less expansions?

I think so
Could be worth running the benches on another computer than mine, could you try running them on yours? cargo bench on main then on your PR

I assumed the EPSILON value was based on the precision of the type rather than for performance reasons. The cpp implementation uses 1e-8.

Maybe https://doc.rust-lang.org/std/primitive.f32.html#associatedconstant.EPSILON would actually make sense instead of another "magic" value

I ran the benchmarks with 1e-6 as a baseline. Changing it back to 1e-2 most of the benches were within error except for these two which "regressed" (most likely just noise).
is in mesh Vec2(135.0, 360.0)
                        time:   [120.07 ns 120.98 ns 121.96 ns]
                        change: [+1.3456% +2.5911% +3.8709%] (p = 0.00 < 0.05)
                        Performance has regressed.
...
is not in mesh Vec2(726.0, 470.0)
                        time:   [369.50 ns 369.86 ns 370.20 ns]
                        change: [+1.2981% +1.9975% +2.7468%] (p = 0.00 < 0.05)
                        Performance has regressed.

Changing it to f32::EPSILON again most were the same but these were changed

Ok, I did a clean bench with 1e-2 as the base and another as f32::EPSILON. It didn't find any regressions so I think any changes in performance are just noise from running the test (positive and negative).

Ok, I think this is probably the best I can get it outside being variable but that will have its own issues. f32::EPSILON is the "machine epsilon" which means it is the smallest unit that can be represented by a f32. I tested with this and it "works" in that it always gives the correct left or right result. However it also never returns an EDGE unless the line is very specific as in the tests.
To account for this, I added a more complicated line to test against. This failed for the f32::EPSILON as well as 1e-6. This makes sense as each calculation in the pipeline multiplies the error. 1e-5 does work but I am not sure how much room that leaves for user calculation on the values. 1e-4 seems the "safe" option and should be accurate for all float operations.
For reference, the default in the cpp implementation is 1e-8 and the EPSILON for an f64 is 1e-16 so plenty of margin there.


Github.com

I thought this was just Adblocking .... not UI customizing. I guess it's not high screen res compatible

Thanks for reporting this, the upcoming 2.8 major update should resolve this issue completely.

This will be fixed in 2.8.


Create data for the test environment

The test environment currenlty wipes all data whenever we deploy. By default, there is no data after a fresh wipe. We should add some meaningful test data so that users can jump directly to testing later workflows (ie: reporting).
We now have two business bceid accounts for the test environment. We should choose one to have data pre-populated so that the registration workflows can be skipped & a tester can immediately go into testing reporting, or some of the later registration workflows. The other account can remain without any default data associated so that the early registration workflows can be tested.
In order to do this, we should create fixtures that create the following data after a deploy is complete:

an approved admin from the bceid account for an operator
an SFO operation with a boro id
an LFO operation with a boro id
facilities for the operations above

@dleard I was recommended to use this to potentially anonymyze data https://www.pgflo.io/
Supposedly it's a new tool

Here are some alternative options we can consider if we ever feel like doing this in Django 😄:
dj-anonymizer
django-anon
django-gdpr-assist
django-obfuscate


fix(build): Update contributing.md and fix npm ci

Description of your changes
fix(build): Update contributing.md and fix npm ci
Changes:

Update CONTRIBUTING.md to use npm ci
Fix CONTRIBUTING.md based on markdown lint recommended fixes
Setup project references

closes #415
How to verify this change
git clean -fdx; npm ci
Related issues, RFCs
#415
PR status
Is this ready for review?: YES
Is it a breaking change?: NO
Checklist

[X] My changes meet the tenets criteria
[X] I have performed a self-review of my own code
[X] I have commented my code where necessary, particularly in areas that should be flagged with a TODO, or hard-to-understand areas
[X] I have made corresponding changes to the documentation
[X] My changes generate no new warnings
[X] The code coverage hasn't decreased
[X] I have added tests that prove my change is effective and works
[X] New and existing unit tests pass locally and in Github Actions
[X] Any dependent changes have been merged and published in downstream module
[X] The PR title follows the conventional commit semantics

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@dreamorosi would you have time to look at this ?

ok sure @dreamorosi i would have assume most people keep their npm version up to date now. But at least for now we should signal that npm ci will have less side effects

@flochaz  - is there something wrong with this PR?


Is there suggested Web Receiver code for speaker application

Hi,
We'd like to implement this in a speaker. Is there a suggested Web Receiver code for speaker application.

Hello, thank you for your interest in integrating with the cast ecosystem. By default cast receivers support audio only playback. No special considerations are needed when developing the receiver application with regards to audio only content. Please see the overview guide for how to create your first cast receiver here: https://developers.google.com/cast/docs/web_receiver/basic . Also be sure to check out the  cast receiver codelab here: https://developers.google.com/cast/codelabs . If you want your receiver app to be castable to audio only devices ensure that you check the Supports casting to audio-only devices box during the registration process as mentioned here: https://developers.google.com/cast/docs/registration#register_your_application

Please reopen the issue if you need more assistance.


[Bug]: Missing description in JSON schema

What happened?
The following JSON schema properties are missing the description field.

[ ] data-source.options
[ ] runtime.rest.path
[ ] runtime.graphql.path
[ ] runtime.host.authentication
[ ] runtime.host.authentication.jwt
[ ] runtime.host.authentication.jwt.audience
[ ] runtime.host.authentication.jwt.issuer

Here are some starters, but you could be clearer than me:

data-source.options: Additional configuration options specific to the selected database type.
runtime.rest.path: The URL path prefix for REST API endpoints.
runtime.graphql.path: The URL path prefix for GraphQL API endpoints.
runtime.host.authentication: Configuration settings for authenticating API requests.
runtime.host.authentication.jwt: Settings for JSON Web Token (JWT) based authentication.
runtime.host.authentication.jwt.audience: The intended audience of the JWT, usually the API or service the token is meant for.
runtime.host.authentication.jwt.issuer: The entity that issued the JWT, typically your server's identity.

Version
https://raw.githubusercontent.com/Azure/data-api-builder/main/schemas/dab.draft.schema.json
What database are you using?
Azure SQL
What hosting model are you using?
Local (including CLI)
Which API approach are you accessing DAB through?
REST, GraphQL
Relevant log output
No response
Code of Conduct

[X] I agree to follow this project's Code of Conduct

I tried to extract the list into a table to help.

Status
Property Path
Description

⚠
additionalProperties.version
-

data-source.description
Data source information

data-source.database-type.description
Database used in the backend

data-source.connection-string.description
Connection string for the selected database type

⚠
data-source.options
-

data-source-files.description
Names of runtime configuration files referencing additional databases.

⚠
data-source-files.default
-

runtime.description
Runtime configuration settings

runtime.rest.description
Global REST endpoint configuration

⚠
runtime.rest.path.default
-

runtime.rest.enabled.description
Allow enabling/disabling REST requests for all entities.

runtime.rest.request-body-strict.description
Does not allow extraneous fields in request body when set to true.

runtime.graphql.description
Global GraphQL endpoint configuration

⚠
runtime.graphql.allow-introspection
-

⚠
runtime.graphql.path.default
-

runtime.graphql.enabled.description
Allow enabling/disabling GraphQL requests for all entities.

runtime.host.description
Global hosting configuration

runtime.host.mode.description
Set if running in Development or Production mode

runtime.host.cors.description
Configure CORS

⚠
runtime.host.cors.origins.default
-

runtime.host.cors.allow-credentials.description
Set value for Access-Control-Allow-Credentials header

runtime.host.authentication.description
-

⚠
runtime.host.authentication.jwt.audience
-

⚠
runtime.host.authentication.jwt.issuer
-

entities.description
Entities that will be exposed via REST and/or GraphQL

entities.source.description
The object in the backend database that is mapped to the entity

⚠
entities.rest.path
-

⚠
entities.rest.methods
-

entities.rest.enabled.description
Allow enabling/disabling REST requests this specific entity.

⚠
entities.graphql.type
-

⚠
entities.graphql.operation
-

entities.graphql.enabled.description
Allow enabling/disabling GraphQL requests for this specific entity.

entities.mappings.description
Define mappings between database fields and GraphQL and REST fields

⚠
entities.relationships.cardinality
-

⚠
entities.relationships.target.entity
-

⚠
entities.relationships.source.fields
-

⚠
entities.relationships.target.fields
-

entities.relationships.linking.object.description
The database object used for supporting the M:N relationship

⚠
entities.relationships.linking.source.fields
-

⚠
entities.relationships.linking.target.fields
-

entities.permissions.description
Permissions assigned to this object

⚠
entities.permissions.role
-

⚠
entities.permissions.actions
-

⚠
$defs.singular-plural.singular
-

⚠
$defs.singular-plural.plural
-

Is this a json schema validation issue? or a necessary fix to address ease of use and make schema file more informative for json linters? I ask because @abhishekkumams has #1782 PR submitted to address json schema violations.


Unable to update the game

Hey, I can't check for update on the Android app, it shows an error and do nothing

Same issue on 2 phones with different Android versions. Thanks !

Nvm, by downloading the latest apk everything's fine !


Integration documentation fixes

Added screenshots for Errbot and Capistrano integration in documentation in static folder
Fixes: #32462

Is it intended that this switches to the dark theme?

Also, do not mark this “Fixes: #32462” as this is just one part of many.

ok


ta_ema broken. Promise.all() not being used correctly.

System information

Have I written custom code (as opposed to using zenbot vanilla): yes
OS Platform and Distribution (e.g., Linux Ubuntu 16.04): windows 10
Zenbot version (commit ref, or version): 49ab7582 (march 8th)
Zenbot branch: unstable
NodeJS version: v8.9.4
Exact command to reproduce (include everything): node ./scripts/genetic_backtester/darwin.js --selector=gdax.LTC-USD --use_strategies=ta_ema --days 5 --population 3
Did I make any changes to conf-sample.js?: yes

Describe the problem
Command above produces 3 consecutive errors (below) and then the second error before darwin exits.
Source code / Error logs
TypeError: Cannot read property 'selector' of undefined
at processOutput (E:\Users\Travis\Documents\Code\zenbot-unstable\scripts\genetic_backtester\darwin.js:501:24)
...
TypeError: Cannot read property 'replace' of undefined
at generateCommandParams (E:\Users\Travis\Documents\Code\zenbot-unstable\scripts\genetic_backtester\darwin.js:1130:24)
Solution

The result of Promise.all() is an array. It is being treated as if it is an object.  Actually the first element [0] of the result is the object expected, the result of ta_ema.
After fixing 1, there are still intermittent "Cannot read property 'selector' of undefined" errors which cause darwin to get stuck on a sim and it never completes.  The solution to this is to put the rest of the body of onPeriod into the Promise.all().then() block to make sure its being executed after ta_ema completes.  This is illustrated by:
Promise.all([console.log('1')]).then(() => console.log('2')); console.log('3');
which produces output: 1 3 2 and shows that Promise.all() isn't blocking.

Here is a working portion of strategies/ta_ema/strategy.js lines replacing lines 51-81.
    // wait for promise to be resolved
    // we add all maybe we need more indicators
    Promise.all([ta_ema(s, s.options.trend_ema)])
      .then(([result1]) => {
        if (result1 && result1.outReal) {
          s.period.trend_ema = result1.outReal
        }
      })
      .then(result => {
        // calculate ema rate
        if (s.period.trend_ema && s.lookback[0] && s.lookback[0].trend_ema) {
          s.period.trend_ema_rate = (s.period.trend_ema - s.lookback[0].trend_ema) / s.lookback[0].trend_ema * 100
        }

        if (typeof s.period.trend_ema_stddev === 'number') {
          if (s.period.trend_ema_rate > s.period.trend_ema_stddev) {
            if (s.trend !== 'up') {
              s.acted_on_trend = false
            }
            s.trend = 'up'
            s.signal = !s.acted_on_trend ? 'buy' : null
            s.cancel_down = false
          } else if (!s.cancel_down && s.period.trend_ema_rate < s.period.trend_ema_stddev * -1) {
            if (s.trend !== 'down') {
              s.acted_on_trend = false
            }
            s.trend = 'down'
            s.signal = !s.acted_on_trend ? 'sell' : null
          }
        }
        cb()
      })
      .catch(err => {
        console.error(err)
        cb()
      })

Sorry I'm still working on being able to use git and make a pull request.

@DeviaVir @Haehnchen  I wanted to make sure you see this since you guys worked on #1383 .
Also, I was wrong.  Darwin is still getting stuck once in a while (around 1 in every 100 sims hang).  There is no error, just 1 less thread running and I have to manually kill that process so that darwin can continue.

Also, i forgot that I had made a change to /lib/ta_ema.js line 60:
} else resolve()

Otherwise, the sim hangs at startup and never progresses.
After this change I am able to run the command

node zenbot.js sim gdax.LTC-USD --period_length=29m --min_periods=26 --markdown_buy_pct=1.271754225045159 --markup_sell_pct=1.8058192494168712 --order_type=taker --sell_stop_pct=9 --buy_stop_pct=21 --profit_stop_enable_pct=0 --profit_stop_pct=9 --trend_ema=33 --oversold_rsi_periods=42 --oversold_rsi=27 --backtester_generation=2 --strategy=ta_ema --days=2

Now I get output showing it completed and made 3 trades.


v0.8.6_06: Color scale is not appearing according to the option.

SEVERITY: Major
MODULE:  Pop by Age Chart
Platform: Nexus 5(6.0) / Chrome
RELEASE: v0.8.6
STEPS TO REPRODUCE:

Navigate to the URL: http://static.gapminderdev.org/vizabi/release/v0.8.6/preview/popbyage.html
“Pop-by-Age Chart” page will be loaded.
Tap on “Color” icon and pop-up will appear.
Select “Geo name” or “Region” from dropdown.
Note that respective color scale is not appeared.

ACTUAL RESULTS:
Color scale is not appearing according to the option.
EXPECTED RESULTS:
Color scale should be appearing according to the option.
SCREENSHOT:

Related to #884

https://github.com/Gapminder/vizabi/pull/904

closed by https://github.com/Gapminder/vizabi/commit/aed7c868f5c4d9f0287a1b9fa3fc570597662dea


Add option tokenPath to Vault (cluster)issuer

The Vault (cluster)issuer does not allow to read a token from local filesystem, while it does not take care about renewing Vault tokens itself: https://github.com/cert-manager/cert-manager/issues/5437
This means that we have to take care of renewing the Vault token. HashiCorp provides excellent means by running a vault-agent side-container (https://www.vaultproject.io/docs/platform/k8s/injector). In this setup, cert-manager and vault-agent share a volume mount on the local file system, and the agent keeps renewing the token before it's TTL expires.
The problem is that cert-manager does not provide an option for reading the vault token from the filesystem. This PR adds the option tokenPath that reads the token from the filesystem.
Signed-off-by: Andrej van der Zee<EMAIL_ADDRESS>Does this PR introduce a user-facing change?
Added option in Vault (cluster)issuer for reading Vault token from filesystem.

Signed-off-by: Andrej van der Zee<EMAIL_ADDRESS>

/assign @joshvanl

we have to make this feature cluster-issuer only because of security implications (accessing token file of other issuer)
not sure if this is possible in the current design


register

@JuliaRegistrator register()

@JuliaRegistrator register()

@JuliaRegistrator register()

@JuliaRegistrator register

@JuliaRegistrator register branch=master

@JuliaRegistrator register branch=#master

Error while trying to register: "Branch #master not found"

@JuliaRegistrator register branch=#main

Error while trying to register: "Branch #main not found"

Error while trying to register: "Branch #main not found"


just: 1.3.0 -> 1.4.0

https://github.com/casey/just/blob/master/CHANGELOG.md#140---2022-8-08
Things done

Built on platform(s)

[ ] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[x] aarch64-darwin

[ ] For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
[ ] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[ ] Tested basic functionality of all binary files (usually in ./result/bin/)
22.11 Release Notes (or backporting 22.05 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module
[ ] (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes

[ ] Fits CONTRIBUTING.md.

Result of nixpkgs-review pr 185817 run on x86_64-darwin 1

2 packages built:

dogdns
just


[bug] read from multiple s3 regions

Apache Iceberg version
None
Please describe the bug 🐞
Problem
I want to read files from multiple s3 regions. For example, my metadata files are in us-west-2 but my data files are in us-east-1. This is not possible currently.
Context
Reading a file in pyarrow requires a location and a file system implementation, fs. For example, location="s3://blah/foo.parquet" and fs=S3FileSystem.
https://github.com/apache/iceberg-python/blob/0cebec48833f75eeca02b1a965112615b1cbc1c8/pyiceberg/io/pyarrow.py#L404-L419
The fs is used to access the files in s3. And is initialized with the given S3_REGION according to the S3 configuration.
https://github.com/apache/iceberg-python/blob/0cebec48833f75eeca02b1a965112615b1cbc1c8/pyiceberg/io/pyarrow.py#L347-L365
This means only 1 S3 region is allowed.
Possible Solution
Create multiple instances of S3FileSystem, one for each region. And fetch the corresponding instance based on location. pyarrow.fs.resolve_s3_region(bucket) can determine the correct region

Maybe similar issue for GCS/Azure, since we only cached 1 instance of each FileSystem

Hey @kevinjqliu, I will happy to work on this task. Thanks

@danhphan assigned to you! LMK if you have any questions

Thanks @kevinjqliu , I'm reading the code base.
Can you please give me an example of expected unit-tests for the feature if possible? For instance, if we create the follow s3_fileio with "s3.region": "us-east-1" in the session_properties. Then we create an input_file on s3 bucket of warehouse, which is actually located in "eu-central-1" region, what should be the expected results?
session_properties: Properties = {
    "s3.endpoint": "http://localhost:9000",
    "s3.access-key-id": "admin",
    "s3.secret-access-key": "password",
    "s3.region": "us-east-1",
    "s3.session-token": "s3.session-token",
    **UNIFIED_AWS_SESSION_PROPERTIES,
}

s3_fileio = PyArrowFileIO(properties=session_properties)
print(s3_fileio.properties['s3.region']) #--> us-east-1

filename = str(uuid.uuid4())
input_file = s3_fileio.new_input(location=f"s3://warehouse/{filename}")
print(pyarrow.fs.resolve_s3_region('warehouse')) #--> eu-central-1

output_file = s3_fileio.new_output(location=f"s3://foo/{filename}")
print(pyarrow.fs.resolve_s3_region('foo')) #--> us-east-1

I'm thinking may be in the def _initialize_fs(self, scheme: str, netloc: Optional[str] = None) -> FileSystem in your above comments, we can assign the value for "region" in client_kwargs based on the value of netloc (or s3 bucket), but not sure if it is the right direction.
Like: "region": pyarrow.fs.resolve_s3_region(netloc),
 def _initialize_fs(self, scheme: str, netloc: Optional[str] = None) -> FileSystem:
     if scheme in {"s3", "s3a", "s3n"}:
         from pyarrow.fs import S3FileSystem

         client_kwargs: Dict[str, Any] = {
             "endpoint_override": self.properties.get(S3_ENDPOINT),
             "access_key": get_first_property_value(self.properties, S3_ACCESS_KEY_ID, AWS_ACCESS_KEY_ID),
             "secret_key": get_first_property_value(self.properties, S3_SECRET_ACCESS_KEY, AWS_SECRET_ACCESS_KEY),
             "session_token": get_first_property_value(self.properties, S3_SESSION_TOKEN, AWS_SESSION_TOKEN),
             "region": get_first_property_value(self.properties, S3_REGION, AWS_REGION),
         }

Thank you.

what should be the expected results?

Given 2 files in different regions, I want to read them transparently without knowing which region they belong.
Currently, we create a single PyArrow FS for S3 that is region-specific. We can create many region-specific PyArrow FS or create them on the fly.
pyarrow.fs.resolve_s3_region can help determine which region to use. However, we cannot currently override the endpoint for minio in tests. apache/arrow#43713

Yes @kevinjqliu , seems that I still not able to fully understand the requirement for this change.
I think I will need more time to read the codes, and may be try some simpler tasks first, to learn more on the codebase.
Un-assign me on the task for now if anyone can help me to do it. Thank you.

Hey @kevinjqliu , can I work on this issue if it is still needs to be worked on? Thanks!

yes! assigned to you


Header is obstructive on smaller screens

Describe the bug
Since the addition of the domestos branding users have reported that they are almost unable to see the map.
To Reproduce
I'm not having much luck reproducing these examples in the devtools :-(
Expected behavior
The header should have a special representation on smaller devices
Screenshots
See attatched screenshots from social media

Smartphone (please complete the following information):
Precise reported versions aren't available

where are comments from? Public source of email? I like a good source of feedback, even bitching.
overlaps with #314 - hadn't realised it was this bad, with our logo covering several lines rather than shrinking as a graphic, too. The Domestos Blog is really the wrong shape for the space - lots of white above and below 'proudly sponsored by'

@gailramster I'd assumed you were in the original email thread :-(
I've forwarded it to you.

@falconx suggest this treatment on very small screens:

This is approved and will also fix 314


drivers/wireless: Change the enum of nrf24l01_datarate_t to the upper case

Summary
Found by https://github.com/apache/incubator-nuttx/pull/6226
Impact
Minor
Testing
Need merge with https://github.com/apache/incubator-nuttx-apps/pull/1164

Either way is fine for me, what's your opinion @pkarashchenko ?

If there is an exception for units (Hz) then probably we can add exception for other units like (bps, us, ms, ns). But that will mean that we will add exception for each new unit we introduce in code.

We already have things like
#  define SX127X_CMN_PARAMP_PARAMP_250us  (4 << SX127X_CMN_PARAMP_PARAMP_SHIFT)

and
#  define SX127X_CMN_PLL_BW_75kHz         (0 << SX127X_CMN_PLL_BW_SHIFT)

in the code. And despite that KHz and MHz seem to be acceptable the kHz seems to be not. We can try to legitimize those cases via nxstyle exceptions.

I think it would look weird if we uppercased all of the standard units and their prefixes.  This will lead to confusions.

I think it would look weird if we uppercased all of the standard units and their prefixes.  This will lead to confusions.

Ok, I add a suffix white list to handle these cases, please review again.

Can we add more entries to the list?
If I remember correctly we once changed a macro that had mA to MA, which is funny to say the least. :)

Can we add more entries to the list? If I remember correctly we once changed a macro that had mA to MA, which is funny to say the least. :)

all these macros end with MA now.

Can we add more entries to the list? If I remember correctly we once changed a macro that had mA to MA, which is funny to say the least. :)

Now we can add exception and rename back :)


Calculator doesn't adhere to Bodmas or Pemdas rules

Scientific Mode
Unless I am doing something wrong, if we look at the following math equation
8/2(2+2) = ?
If we follow the principle of BODMAS and PEMDAS, this should equate to
8/2x4
This then equates to
8/8
which equals 1
So why does the calculator not follow these BODMAS and PEMDAS rules, when giving an answer? As far back as I have been using Windows, the calculator has never followed these rules.
When entering this into the Calculator one has to enter it
8 / 2 x ( 2 + 2 )
and it still gives the answer as 16, and not the correct answer 1,
And it will not work with
8/2(2+2)

This has been discussed before, Scientific mode should follow BODMAS, but Standard mode performs each operation in succession
#1464 #1212 #1436 #138

This is your friendly Microsoft Issue Bot. I've seen this issue come in and have gone to tell a human about it.

This has been discussed before, Scientific mode should follow BODMAS, but Standard mode performs each operation in succession
#1464 #1212 #1436 #138

This is Scientific mode, that was the first thing I stated!

This has been discussed before, Scientific mode should follow BODMAS, but Standard mode performs each operation in succession
#1464 #1212 #1436 #138

This is Scientific mode, that was the first thing I stated!

Ah ok, then it may not be totally related to the other issues.  I think I have seen this mentioned before though.  I think its an issue with how the Calculator handles input, when you enter a number and open the brackets, it ignores the number...
https://user-images.githubusercontent.com/7389110/122587244-81002500-d055-11eb-9bf1-43e311175410.mp4

But you are also ignoring the rest of what I said as well!

Here is another very basic PEMDAS example not working correctly in the calculator on Scientific Mode.
18÷(8-2×3)
The answer is obviously 9. yet the calculator says it is 4!

Does it?

And another
(4×3÷6+1)×3^2
The answer should be 27, I am not sure how the calculator is breaking this down, but the correct way is
Step 1- First, we need to multiply 4 by 3 in the given expression, (4×3÷6+1)×3^2, we get,  (12÷6+1)×3^2
Step 2- Now, we need to divide 12 by 6 inside the bracket, so, we get, (2+1)×3^2
Step 3- Remove parentheses after adding 2 and 1, we get, 3×3^2
Step 4- Solve exponent, i.e 3^2, which is 9, 3×9
Step 5- Multiply 3 by 9 to get the final answer, which is, 3×9= 27
∴ (4×3÷6+1)×3^2= 27.

Does it?

Under PEMDAS 9 is incorrect!

According to order of operations, multiplication/division are performed sequentially left-to-right (not multiplication first, followed by division).
So the expected output of the original expression 8/2(2+2) is 16, which is what I am seeing in scientific mode:

For the second example, the expected output of 18÷(8-2×3) is 9, which is what I am seeing in scientific mode:

And for the third example, the expected output of (4*3/6+1)*3^2 is 27, which is what I am seeing in scientific mode:

I am not able to reproduce any violations of order of operations when expanding the expressions, so I am going to close this as no repro. Due to #1498, some input may be ignored under certain circumstances, so I suspect you may be encountering this issue.


Branding?

I wonder what kind of branding is possible with Harbor and how to accomplish this?
E.g. what files to edit change logo?
Thanks.

Thanks. However, this requires me to rebuild the product. I am looking for similar options for an already built product.  How to accomplish this?

@bergtwvd
we do NOT support that way yet. If you want to brand new logo, re-building code is the only supporting way so far.

No other thing to discuss, close this issue now.

Reopen for more discussion

@bergtwvd
If we implement the configurable rebranding like you described as a commercial enhancement, will your organization accept that and pay for it?

No, I won't be able to get this funded.  I guess you have to shelve this on the list of feature requests 😃

@bergtwvd Got it. It may be a long time waiting. ^_^
I'll close this issue. If needed, let's raise a new detailed one for tracking.


Apply kernarg optimization to Triton

Apply kernarg optimization to Triton

How does the performance (FA and GEMM) look like before and after this PR?


split out mapreduce and blocks interface

This PR fixes all deprecated syntax and also removes the mapreduce implementation in HDFS.jl. HDFS.jl thus becomes a pure wrapper over libhdfs. It can probably also be renamed as LibHDFS.jl in line with other similar packages.
The mapreduce implementation needs some more cleanup and then can be put out as a separate package.

This is compatible with both Hadoop 1.x and 2.x since it just wraps libhdfs.
However the recent Hadoop versions also support a protobuf based protocol which allows us to have a pure Julia implementation of HDFS client. We can have a separate package(s) for that and few others of interest in the Hadoop 2.x stack.