Looking better

Since you deleted the previous issue,
It looks a lot better now, but there are some minor nits left:
My copyright was explained as:
 Authored by Alex Hultman, 2018-2019.
 Intellectual property of third-party.

This still stands, and you cannot simplify it to just:
 Authored by Alex Hultman, 2018-2019.

There's also requirements of prominently stating the files are not original:

You must cause any modified files to carry prominent notices stating that You changed the files; and

A simple way of doing so is to simply write a comment about what git commit it derives from and what project, or anything like that. The point is to clearly separate any derivatives from its root, while still properly attributing the root itself.
Here's an example of how another fork does it:
This software is based on uWebSockets 0.14 which has ZLIB license
make sure to check /src/LICENSE.

For the code provided by cWS:

MIT License

Copyright (c) 2018 cWS

[...]

This is how another fork does it:
ZLIB License

Copyright (c) 2017 Marko Biškup

Parts of the code are based on software developed as µWebSockets,
Copyright (c) 2016 Alex Hultman and contributors.

You need to clearly distance yourself from the original and state changes. Other than this, go for it.

You'll also have to change the wording "Authored by Phara0h" to something accurate like "Modified by [...]". You did not author anything of those files, you modified some include guards.

You'll also have to change the wording "Authored by Phara0h" to something accurate like "Modified by [...]". You did not author anything of those files, you modified some include guards.

Nowhere in http://www.apache.org/licenses/LICENSE-2.0 says I need to comply with that request.

Well did you originally create the work? To author something, that's to originally create something.
Anyways, you're not complying with
4b:

You must cause any modified files to carry prominent notices stating that You changed the files; and

You did not clarify that you modified the files, so it could make a lot of sense to change "Authored by" to "Modified by" so that you comply with 4b,
but you can do it any way to want to - if you really think it makes sense to write your own name as "author" to something you just copied, fine.  Nobody is going to buy that you did, anyways.

Btw, if you want to play ugly games, there's quite a bit of source code in here that's not licensed:
All examples lack Apache License; build.c lacks license, Makefile lacks license, any many others. You'll have to remove those entirely, they are not licensed for redistribution / modification.
I can DMCA this repo solely based on those files. This game can really be played ugly if you like to.

If you look in the repo, you can see nothing is licensed in tests, benchmarks, examples, helpers, misc -> the only folder that holds any Apache License 2.0 banner is in src, so you can start by removing everything that you haven't taken from src. You have no license to redistribute anything there.
Also, you're still not complying with 4b, and still not 4c. You have cut away "Intellectual property of third party".
You can begin by fixing this, and we can talk later. This is so far a very simple case.

Btw, if you want to play ugly games, there's quite a bit of source code in here that's not licensed:
All examples lack Apache License; build.c lacks license, Makefile lacks license, any many others. You'll have to remove those entirely, they are not licensed for redistribution / modification.
I can DMCA this repo solely based on those files. This game can really be played ugly if you like to.

Not required to be at a per-file base. Your license at the root counts for everything under it.

Nope. I am the owner of my work and I know exactly what I have licensed and not. You can even read this here:
http://www.apache.org/licenses/LICENSE-2.0#apply
There is nothing in the license saying what it applies to. If you have questions to what I have licensed, you can ask me. The author and owner of intellectual rights.
Do you know how long I've thought about this exact scenario, kid? I know all the rules and all terms of service. You're arguing about things you didn't create or decide - you can either simply follow my instructions or keep splitting hair and try to miscredit things. I can tell you now that if you play things easy, I will play it easy - I have no interest in what you do here, as long as you don't miscredit my work. Play it hard, I'll play it two times as hard. It's very simple. I currently have all the laws in the world on my side and I'll flick that DMCA button like a cherry if you refuse to comply.


Cleanup

The Specification, Design and Presentation directories probably won't be needed anymore, just like the QA document.
Maybe move them to a single folder instead if we want to keep them around for whatever reason?
Maybe we want to rename the QA and implementation folders to something like src/ and test/ since this is not PSE anymore?
Further cleanup before we start working on the static generation might also go in here, comment if anything comes to your mind that needs tidying.

Apparently we can't do much about the security errors Dependanbot reports:
- tar
- The latest possible version of tar that can be installed is 6.1.0.
- The earliest fixed version is 6.1.9.
- json-schema
-<EMAIL_ADDRESS>requires<EMAIL_ADDRESS>via a transitive dependency on<EMAIL_ADDRESS>-<EMAIL_ADDRESS>requires<EMAIL_ADDRESS>via a transitive dependency on<EMAIL_ADDRESS>-<EMAIL_ADDRESS>requires<EMAIL_ADDRESS>via a transitive dependency on<EMAIL_ADDRESS>- url-parse
- The latest possible version of url-parse that can be installed is 1.5.1.
- The earliest fixed version is 1.5.2.
ansi-html was dismissed because no patched version is available and ansi-regex was apparently already patched.


Could not find gem 'rubyXL (= 3.3.29) java'  with aspace-import-excel v2.1.17 on AS 2.6.0

Upgraded ArchivesSpace from 2.3.2 to 2.6.0 on a RHEL 6.8 machine.  Current environment is:
openjdk version "1.8.0_111"
OpenJDK Runtime Environment (build 1.8.0_111-b15)
OpenJDK 64-Bit Server VM (build 25.111-b15, mixed mode)
$ ruby -v; gem -v
ruby 1.8.7 (2013-06-27 patchlevel 374) [x86_64-linux]
1.3.7
The aspace-import-excel plugin seems incompatible, due to a gem issue.
Initially AS would not start accepting connections. In the log file was:
[!] There was an error parsing Gemfile: You cannot specify the same gem twice with different version requirements.
You specified: pry (>= 0) and pry (~> 0.11.3). Bundler cannot continue.
I disabled the plugin, the https://github.com/harvard-library/aspace-import-excel spreadsheet importer, and it ArchivesSpace started.
Yesterday, I then downloaded the most recent version of aspace-import-excel-master, and received a slightly different message:
Jun 18, 2019 6:14:20 PM org.eclipse.jetty.server.handler.ContextHandler$Context log
WARNING: ERROR: initialization failed
org.jruby.rack.RackInitializationException: Could not find gem 'rubyXL (= 3.3.29) java' in any of the gem sources listed in your Gemfile.
$ more aspace-import-excel/Gemfile
ASpaceGems.setup if defined? ASpaceGems
source 'http://rubygems.org'
gem 'rubyXL', "3.3.29", :require => false
archivesspace@archivesspace:~/archivesspace-v2.6.0/archivesspace/plugins$ more aspace-import-excel/VERSION
v2.1.17
archivesspace@archivesspace:~/archivesspace-v2.6.0/archivesspace/plugins$
Is there anything I can do to get this plugin operational?
Thanks

Hi,
We're looking into this, and will get back to you --- hopefully by late this afternoon.
Sorry you're having this problem.

Hi @tomadams,
Just curious - when you updated the plugin, did you re-run the initialize script:
scripts/initialize-plugin.sh aspace-import-excel

Your second error looks very much like the version of RubyXL in the current plugin just not being installed.

I did not initially run the initialization script.
Upon running the initization script, I see:
$ scripts/initialize-plugin.sh aspace-import-excel
ERROR:  SSL verification error at depth 2: certificate has expired (10)
ERROR:  Certificate /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA expired at 2014-01-28T12:00:00Z
ERROR:  SSL verification error at depth 2: certificate has expired (10)
ERROR:  Certificate /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA expired at 2014-01-28T12:00:00Z
ERROR:  SSL verification error at depth 2: certificate has expired (10)
ERROR:  Certificate /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA expired at 2014-01-28T12:00:00Z
ERROR:  Could not find a valid gem 'bundler' (= 1.16.1), here is why:
Unable to download data from https://rubygems.org/ - certificate verify failed (https://api.rubygems.org/specs.4.8.gz)
ERROR:  SSL verification error at depth 2: certificate has expired (10)
ERROR:  Certificate /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA expired at 2014-01-28T12:00:00Z
Gem::GemNotFoundException: can't find gem bundler (>= 0.a)
find_spec_for_exe at uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/rubygems.rb:271
activate_bin_path at uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/rubygems.rb:299
 at ../../gems/bin/bundle:23

That sounds, unfortunately, like an issue outside the application - I would retry it tomorrow, I can't imagine that the rubygems SSL cert expiring would pass unnoticed for long.

https://guides.rubygems.org/ssl-certificate-update/
It's also worth looking at this, actually - it might be a cert included with rubygems, rather than the cert on the server.


Improve services health check

The Shipshape CLI fails every other time due to this error:
0625 20:40:50.884702    1312 shipshape.go:227] Error making service call: received an error from calling run: service needs to be called with triggered categories and/or a repo root with a valid .shipshape file with the event manual
May just be that the health check needs to wait longer.

Can we repro this?

I still see this error:
HTTP client did not become healthy: service did not respond before timeout: HTTP failure: Post http://localhost:10007/: dial tcp [::1]:10007: getsockopt: connection refused
This output is from running the CLI tests, and doesn't happen at every run. The failure wasn't there on the second run.

Running the old CLI tests, or the new ones? I still cannot repro.

ping?

I got this for the first time:
--- FAIL: TestChangingDirs (17.89s)
shipshape_test.go:210: ParentDir: Failure on service call; err: HTTP client did not become h
ealthy: service did not respond before timeout: HTTP failure: Post http://localhost:10007/: dial tcp
[::1]:10007: getsockopt: connection refused


chore: bdd-spring-1574261652 to 0.0.1

chore: Promote bdd-spring-1574261652 to version 0.0.1

[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by:
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approvers:
If they are not already assigned, you can assign the PR to them by writing /assign  in a comment when ready.
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment


Jenkinsfile: provision VMs with k8s 1.9 and 1.10

Fixes: 378b45d153a3 ("test: add k8s 1.13 to test framework")
Signed-off-by: André Martins<EMAIL_ADDRESS>

This change is

test-me-please

Coverage decreased (-0.007%) to 44.003% when pulling 95fa729c0b40da440e33e964edd3250c9d552c9d on pr/fix-jenkins-default-vms into<PHONE_NUMBER>d9b40e4a7d1c378afb55a28edf792c on master.

test-missed-k8s


[Test] Cover nonce rollbacks

We need to cover various rollback scenarios with graceful handling of contract failures, especially concerning nonces. Nonce should only be rolled back for the root authorized calls, but not for the child contract failures.

That's actually duplicate of #935


How to animate line draw in custom painter in Flutter?

I want to animate the line drawing in custom painter canvas. So far what I can do is create two circles at two points and then create a line between those two points. But I don't know how to animate the line as if it is going from one point to the other. I have tried something but I can't make it work. Please check the code and suggest me if you have any idea.
import 'package:flutter/material.dart';
import 'dart:math' as math;

class ProgressMonitorAnimation extends StatefulWidget {

  @override
  State<StatefulWidget> createState() => _ProgressMonitorAnimationState();
}

class _ProgressMonitorAnimationState extends State<ProgressMonitorAnimation> with TickerProviderStateMixin {

  double _progress = 0.0;
  Animation<double> animation;

  @override
  void initState() {

    var controller = AnimationController(duration: Duration(milliseconds: 3000), vsync: this);

    animation = Tween(begin: 1.0, end: 0.0).animate(controller)..addListener(() {

        setState(() {
          _progress = animation.value;
        });
      });

    controller.forward();

    super.initState();
  }

  @override
  Widget build(BuildContext context) {

    return Transform(
      alignment: Alignment.center,
      transform: Matrix4.rotationX(math.pi),
      child: CustomPaint(
        foregroundPainter: ProgressPainter(_progress),
      ),
    );
  }
}

class ProgressPainter extends CustomPainter {

  double _progress;

  ProgressPainter(this._progress);

  @override
  void paint(Canvas canvas, Size size) {

    final Paint circlePainter = Paint()..color = Colors.green;
    final Paint linePainter = Paint()..color = Colors.black..strokeWidth = 4..strokeCap = StrokeCap.round;

    canvas.drawCircle(Offset(0.0, 30.0 * 3), 10.0, circlePainter);
    canvas.drawCircle(Offset(15.0 * 2, 80.0 * 3), 10.0, circlePainter);

    canvas.drawLine(Offset(0.0 / (_progress * 10), 30.0 * 3), Offset((30.0 * 3) + (15.0)  / (_progress * 15) * 2, (80.0 * 3) / (_progress * 15)), linePainter);
  }

  @override
  bool shouldRepaint(CustomPainter oldDelegate) => true;
}

Hi @imsajib02 ,
It seems you are asking for assistance on personal code. Please see https://flutter.dev/community for resources and asking questions like this, you may also get some help if you post it on Stack Overflow and if you need help with your code, please see https://www.reddit.com/r/flutterhelp/
Closing, as this isn't an issue with Flutter itself. If you disagree, please write in the comments and I will reopen it.
Thank you


Shared object build

Adding shared object builds of gRPC and Faabric

LGTM, but there seems to be a problem with the tests.


arch: ramfunc region has padding after __ramfunc_load_start when none should be present

Describe the bug
When code is located within the __ramfunc section and additional linker sections are defined in the RAM region prior to __ramfunc, functions are not correctly copied into the __ramfunc region in RAM.
This can be observed on the RT595, building tests/arch/arm/arm_sw_vector_relay/
Note the disassembly for the code located at __ramfunc_load_start:
(gdb) x/20i &__ramfunc_load_start
   0x1800a94c:  movs    r0, r0
   0x1800a94e:  movs    r0, r0
   0x1800a950:  movs    r0, r0
   0x1800a952:  movs    r0, r0
   0x1800a954:  movs    r0, r0
   0x1800a956:  movs    r0, r0
   0x1800a958:  movs    r0, r0
   0x1800a95a:  movs    r0, r0
   0x1800a95c:  movs    r0, r0
   0x1800a95e:  movs    r0, r0
   0x1800a960:  movs    r0, r0
   0x1800a962:  movs    r0, r0
   0x1800a964:  movs    r0, r0
   0x1800a966:  movs    r0, r0
   0x1800a968:  ldr     r3, [pc, #20]   ; (0x1800a980)
   0x1800a96a:  ldr     r2, [pc, #24]   ; (0x1800a984)
   0x1800a96c:  ldr     r1, [r3, #32]
   0x1800a96e:  cmp     r1, r2
   0x1800a970:  it      ne
   0x1800a972:  strne   r2, [r3, #32]

In RAM, it is expected the symbol __ramfunc_start will point to the first function in the __ramfunc region. However, the padding region visible in the disassembly means this is not the case.
This only occurs when sections are defined prior to the __ramfunc region in the RAM region, like so:
 . = 0x30040000;
 . = ALIGN(_region_min_align);
 _image_ram_start = .;
  .vt_pointer (NOLOAD) :
  {
          *(.vt_pointer_section)
          *(".vt_pointer_section.*")
  } > RAM
.ramfunc : ALIGN_WITH_INPUT
{
__ramfunc_start = .;
. = ALIGN(_region_min_align);

This is because the ALIGN statement introduces padding prior to __ramfunc_start

This was fixed with Zephyr SDK 0.16.5


Fix some windows warnings (C4244 and C4305)

🦟 Bug fix
Fixes part of #1870
Summary
This PR fixes some warnings (C4244 and C4305) happening in ign-gazebo6 windows
Reference build: https://build.osrfoundation.org/job/ign_gazebo-ign-6-win/166/
Checklist

[ ] Signed all commits for DCO
[ ] Added tests
[ ] Updated documentation (as needed)
[ ] Updated migration guide (as needed)
[ ] Consider updating Python bindings (if the library has them)
[ ] codecheck passed (See contributing)
[ ] All tests passed (See test coverage)
[ ] While waiting for a review on your PR, please help review another open pull request to support the maintainers

Note to maintainers: Remember to use Squash-Merge and edit the commit message to match the pull request summary while retaining Signed-off-by messages.

signoffs don't work correctly when applying code suggestions, so you'll have to follow the instructions here to rebase your commits with signoffs to fix the DCO error.

@osrf-jenkins retest this please

FYI: Commit https://github.com/gazebosim/gz-sim/pull/1874/commits/0a996781d47504f4083fab7dc4c0a93889138adf fixes optical_tactile_plugin.cc test. I did kind of a backport from https://github.com/gazebosim/gz-sim/commit/0a84abe41c78e7a626828d0a59f593d6f1793d8b.

Homebrew test regressions are known issues reported here: https://github.com/gazebosim/gz-sim/issues/1867


Feedback on Authentication use-cases: UC1, 2, 3, 7 & 8

Description
Please use this issue thread to capture any feedback on the Authentication use-cases:

UC001-Bootstrap-role-for-component
UC002-Expose-APIs-for-Component
UC003-Discover-dependent-APIs-for-Component
UC007-Authentication-external
UC008-Authentication-internal

On UC007:

The proposed flow makes the API gateway responsible for checking the validity of the token. The component itself doesn't check the validity of the token. I am under the impression that this is a violation of the 'zero-trust' principle. A component should not trust a token that was not validated by the component itself.
ODA will need to support both system-user based scenarios and human user based scenarios. It is quite obvious that when a ProductOrderManagement component updates a ProductInventory component, no human user is involved. When a webGUI is used to update a customer record the situation is more complex. The webapplication is probably allowed to update customer records. But that is not necessarily the case for every user of that application. Also here we seem to be violating the zero-trust principle. Even if a human user is allowed to make the update, the PartyManagment component will want to know which Human-User made the change so that this information is available for auditing purposes.
The flow should also specify that when a valid token is provided but it doesn't contain the appropriate role the response should be 403 Forbidden.

On UC008:

Just like UC007 this use case will also require an access management flow. Permission should be given by assigning the role to the system user. There is potentially scope for more automation. The distribution of key could potentially be handled by an operator.
Also in this use case a human-user based scenario is possible. One of the components might provide a user interface used by humans. In that case a passthrough seems not unlogical.

On UC001:

Based on previous discussions the flow should probably use TMF672 UserRole instead of TMF669 PartyRole.
Currently the User "seccon" is created in "myrealm". Is it not better to create a less generic realm like "oda" or "canvas"

For UC007, we mention pass-through authorisation. We need to expand that so that the concept is understood. Broadly there are two models we could use, and we are proposing to prove out the first:

Every system checks that their users are authorised to perform an action and no user information is passed through to another system. This means that, for example, a customer accessing their account information via an API or portal is authorised by that front end to access both the front end itself and information related to their account. Any request to a back end system that is not related to their account will not be attempted by the front end. In turn, the front end has access to many customer accounts, and therefore the front end has broad access authorisation to the back end. This is a simple model, but places quite a heavy burden of trustworthy authorisation with individual systems.
Every system passes user information to other systems for those systems to perform their own authorisation checks. This means that, for example, a customer accessing their account information via an API or portal is authorised by that front end to access the front end only, and when requests to the back end are made details of the user are passed through so that the back end can perform its own authorisation checks on both the front end and the user. Any request to a back end system that is not related to their account may still be passed by the front end, but the back end will refuse the request on the basis that although the front end is authorised to make the request the actual customer is not authorised to see the information requested. This model is more complex: as an example, it requires all systems to know of all possible users and has the potential to overload the identity management platform with repeated requests for authorisation verification from multiple systems for the same request.

On UC001
Secrets - Identity

Create and assign a role specifically to access the secret for the deployment/statefulset
Mutating operator for dynamically adding the secret.
Rotate Secrets
If aiming for zero security we should aim for encryption at rest or even the use of Vaults

We need to clarify terms In my understanding, a role in a component may be more like a Permission, mainly about their exposed business API, along with supplemental APIs like security and configuration. Permissions are allowances for performing different operations on the resources exposed by the APIs, such as read (GET), create (POST), update (PATCH), etc. These permissions may need to be defined in advance.
I don't aim to have roles defined in the component. I don't think there's such a thing as an administrator of TMSC001; that concept has no business meaning tome. It's up to the Enterprise to decide its roles based on internal business processes. Typically, these roles will be composed of several permissions across many components. Usually, an identity will be associated with one or more of these roles. However, these roles should be managed in the IDM in a centralized manner, among other things, for security auditing.

On UC003
Agree on not allowing components to query dependencies.
Maybe even check in with the operator if any permission is requested on installation
Said that the manual solution proposed poses too many burdens to operation.
1.- It's a manual process in a dynamic components landscape.
2.- Timing became important. Once you deploy a component you have to update the dependent ones...
3.- How does Ops know what to update? We are talking about a spreadsheet? Many components may have a dependency on a third component. Forgotten one can lead to loss of service
A more ops friendly will be to declare the dependencies with "preferences" in the form of labels (e.g oda.tmforum/vendor, oda.tmforum/api, and so)  and let the operator fulfil that, based on those intends , and inject a config map with the resolved dependencies

On UC007
The use case described requires maintaining n-credential pairs, corresponding to the number of dependent API calls needed. Same need than UC001 but multiply
Internal calls should only occur as part of the process required by an externally exposed API.
Once an external call made by an individual user (Identity) is authorized, all other necessary permissions should be granted automatically. For example, if a user has the right to create a Service Order, all related internal calls should be authorized regardless of the number or chain of components involved (e.g., component A depends on component B, which depends on component C). This process may be asynchronous.
To enhance security, we can implement measures like mutual TLS (mTLS) and network policies to restrict access to allowed systems only. Assigning roles to internal components may make the system fragile, as changes to an internal role could disrupt the authorization process.
Using mTLS authentication and a set of network policies, we can allow call flows only between authorized systems.
In some cases, pass-through authorization might be necessary, perhaps for regulatory compliance. However, this approach can be challenging, especially when defining roles and permissions in Identity and Access Management (IAM). Security teams need to know not only which role to assign but also the implications of that role, including any associated third-party roles/permissions. This level of technical knowledge may be beyond the scope of security personnel.

On UC007
the concept of having a system role for a website may not be entirely clear. Additionally, implementing a Client Credentials Flow for a website that authorizes as the site itself might not be the safest approach for web apps. This is because storing the clientId and secret in the browser could expose them to potential theft and misuse. Furthermore, adhering to best practices such as rotating these credentials could become challenging, as they might be present in multiple browsers.
In essence, following what Okka said  a web app can be viewed as a user-friendly interface for interacting with APIs and the data they provide. The individual, or Resource Owner, utilizes a Client (web app) acting on their behalf in a User Agent (browser) to access the ODA Component OpenAPI (Resource Server).

Nowhere is stated how to configure the API Gateway with the right roles and resources if someone decide to add the security checks on that point
a new operator? Maybe implement TMF672 UserRole in the Component to feed the Permission and Resources into the API Gateway
I can think of several scenarios

API Gateway not checking anything just doing routing
API Gateway just checking Authentication, checking that the token presented is valid
API Gateway doing a full authorization

On UC001 Secrets - Identity

Create and assign a role specifically to access the secret for the deployment/statefulset
Mutating operator for dynamically adding the secret.
Rotate Secrets
If aiming for zero security we should aim for encryption at rest or even the use of Vaults

We need to clarify terms In my understanding, a role in a component may be more like a Permission, mainly about their exposed business API, along with supplemental APIs like security and configuration. Permissions are allowances for performing different operations on the resources exposed by the APIs, such as read (GET), create (POST), update (PATCH), etc. These permissions may need to be defined in advance.
I don't aim to have roles defined in the component. I don't think there's such a thing as an administrator of TMSC001; that concept has no business meaning to me. It's up to the Enterprise to decide its roles based on internal business processes. Typically, these roles will be composed of several permissions across many components. Usually, an identity will be associated with one or more of these roles. However, these roles should be managed in the IDM in a centralized manner, among other things, for security auditing.

For your four bullet points, these are all valid and we will capture these as features in the BDD to drive the design.
For the roles versus permissions, this is an interesting point and we should make a decision about whether a component exposes the permissions against its APIs (and allows the SRE team to group these permissions into roles appropriate for the organization), or whether a component vendor does the groupings of permissions into roles and exposes these. We have an existing issue to change from PartyRole to UserRole - before we make this change we should decide on adopting permissions vs roles. I suggest we raise it at the weekly governance call and get the perspectives of the different contributors.

Have been watching these comments with great interest as similar comment coming up as part of the work on TMF-SF001: ODA Security: Identity and Access Management (IAM): Stage 1 and 2 Specifications (TAC-525). Few observation (General comments first more specific points later) . I think we will need multiple mechanism including both OAuth 2 Authorization Code Flow. Client Credential flows The challenge is where to apply each mechanism,

We need a clear statement of user stories use cases as there are multiple actors with different interests/needs.   SF001 added User Stories in section 5.2.1 for two  actors:
- An ODA Component,
- As a party (Operator Role/ Security Role) Day 0 Day1 Day3 use cases
- These may not be complete
We need a threat assessment for each component covering the consequence of allow bad actors invoke opertins asn reuests that they should not and the privacy threat of extracting information that should not been visible or use for inappropriate processing (GDPR).
The ODA Security and Privacy team has published prior work IG1187 ODA Enterprise Risk Assessment v2.0.0 which sets out a Threat and mitigation methodology
the ODA security and privacy team is about to start work on Zero trust impacts on ODA / ODA Components
It is clear that Different component have different risk profiles and  in conjunction with IG1187 and a set of mechanism identified in ODA CA that we need a ODA component security assessment checklist so component designers can select the correct mechanism to mitigate specific component risks
Catalyst proposal  ODA COMPASS (Component privacy and security) zero trust was intended to address the need for checklists.
[ will put the specific in the next post as this is getting to TLDR]

Detailed comments
We need to support both something pragmatic for the the lab to support testing but also  need the lab to investigate the options for Security mechanisms and where to apply

Roles permissions  UC001 Currently I understand that the proposal is that the individual components define the roles that can access them and the associated permissions including access to attribute for GDPR purpooses. rles can be asociae with people and devices /app/components. This makes sense as only the component designer is going to know what roles make sense to it ( i.e. set of roles might be different for each component based on what it does . For example looking at the product catalog 41 functions only  a few ~4 are to do with browsing and searching  the catalog, the rest are administering and managing Product specifications and their lifecycle, analytics, security roles, etc.

Secrets UC003 Comments  are good nd getting lab input on what mechanism might be used would be good outcome. This also came up as a candidate best practice guide for the ODA Sec and Privacy team to support zero trust.

UC007 the Zero trust work in ODA Sec shows we will need encryption between component ( there are a few industry guidebooks for Kubernetes that make this point. Service mesh is one way of centralising the required interconnections permission and dependencies ( for components )  that than doing pair wise for component ( Not this might mean stating that client credential flow is not prefeed approach in a k8S solution .  Passthrough is about Authorisation Code Flow to support ultimately a human uses . think Oauth 2 relying Party entity has a model that can be applied here.

Side note in putting together SFO1 https://projects.tmforum.org/wiki/pages/viewpage.action?pageId=221382600 I had to reverse engineer earlier version of these ODACA use case to explicitly show relationship to Oauth 2 entities and whether they are are hosted in the Component or the canvas. I plan to update these reverse engineered material to align with revised ODAACA UC sequence charts,

UC007 Browser Secrets - good point  However I thought Authorization Code Flow is intended to alleviate that need so we probably ned to go to a deeper level of analysis.
API Gateway  In zero trust the notion is to enforce at every component however in current practise API Gateways are also used to define static perimeters. Likely we need some deeper analysis on API gateway security functionality as we probably have to support legacy approaches whilst moving to Zero trust ( to minimise lateral movement) . We did get an interesting proposal from DT in the ODA Sec & Privacy team about Zero trust and legacy applications which we may propose s a best practice. I suspect that we'll need to cover all three of the options identified by Gustavo.

On UC001 Secrets - Identity

Create and assign a role specifically to access the secret for the deployment/statefulset
Mutating operator for dynamically adding the secret.
Rotate Secrets
If aiming for zero security we should aim for encryption at rest or even the use of Vaults

We need to clarify terms In my understanding, a role in a component may be more like a Permission, mainly about their exposed business API, along with supplemental APIs like security and configuration. Permissions are allowances for performing different operations on the resources exposed by the APIs, such as read (GET), create (POST), update (PATCH), etc. These permissions may need to be defined in advance.
I don't aim to have roles defined in the component. I don't think there's such a thing as an administrator of TMSC001; that concept has no business meaning to me. It's up to the Enterprise to decide its roles based on internal business processes. Typically, these roles will be composed of several permissions across many components. Usually, an identity will be associated with one or more of these roles. However, these roles should be managed in the IDM in a centralized manner, among other things, for security auditing.

For your four bullet points, these are all valid and we will capture these as features in the BDD to drive the design.
For the roles versus permissions, this is an interesting point and we should make a decision about whether a component exposes the permissions against its APIs (and allows the SRE team to group these permissions into roles appropriate for the organization), or whether a component vendor does the groupings of permissions into roles and exposes these. We have an existing issue to change from PartyRole to UserRole - before we make this change we should decide on adopting permissions vs roles. I suggest we raise it at the weekly governance call and get the perspectives of the different contributors.

I believe it is important that we align on the terminologies used for a correct understanding.
Based on TMF672:

Entitlement: a particular action allowed for a particular function
UserRole: A collection of entitlements (exposed by a component?)
Permission: Given by an individual (granter) to another individual (user) to get access to a set of his owned manageable assets

In my understanding this means that a component doesn't have to be forced to expose fine grained entitlements on each managable asset. But instead can group a number of these entitlements in a UserRole. These UserRoles can be used for  RBAC (Role Based Access Control). Permissions are then maintained in the canvas (Keycloak) were an "ODA Admin" grants a Permission to an individual or to another Component.
This is my first attempt at mapping the TMF entities on Keycloak functionality.

Maybe some of our problems is trying to use our ODA flavour terminology for a domain that has its own (and one complicated)
Keycloak uses permission almost as synonymous of entitlement
Splitting the role Authorization Server in OAUTH2 between Keycloak (for example) and the ODA component(that it's already the Resource Server), that sharing of responsibilities could lead to inconsistencies, we wider the attack surface, we have n(components)+1 implementations of a Resource Server using different tech stacks so that a vulnerability may compromise the whole.
Having said that, I'm far from being an expert in the field and understanding its subtleties.
Maybe it'll end up being some Byzantine discussion because of the meaning of the words. We would need specialized advice on the field and then try to find the best way to fit our terminology/APIs into that.

The difficulty with security is that we will need to allign existing TM Forum concepts with security concepts from OAuth.
Here is a first attempt based on David's figure 1 in (SFO01 https://projects.tmforum.org/wiki/pages/viewpage.action?pageId=221382600)

Authorisation Resource Server: This is the OAuth name for the Core Function of an ODA component.
Authorisation Resource Owner: This is by definition a Party. Therefore it doesn't really seem to be part of the component. In my interpretation this seems to be the Data Owner of an entity as defined in Data governance principles. It is the party that decide who gets permission to act on an entity. That would mean that the permission is what is documented in keycloak and as such the Resource Owner belongs more to the Canvas in my view.
Authorisation Role Definition: Roles are defined in the Security Function of the ODA component. UC001 describes the communication of these roles to canvas. The roles that are being defined seem more alligned to linux groups than to Business role represented by PartyRoles.The puml diagram for UC001 should use UserRole instead of PartyRole.
Authorisation Policy Enforcement Point (PEP): This is the Security Function that protects the Resource Server. It acts on a JWT-token received with a OpenAPI request that contains a set of claims. For a RBAC (Role Based Access Control) one of the claims should contain the UserRole given to the canvas. ODA-CA needs to take a decision on which claim contains this information. The JWT-token will typically also have claims for the client application (calling component) and the relying party. In case of RBAC these would be used for auditing purposes (and should be documented in the Notifications generated by the component)

Koen Agree mostly with you observations. Would note that exactly where the resource server is depends a bit on where the trust boundaries are set; and these are different for current network perimeter based solution and Zero Trust (ZT) solution which are likely to be closer to the individual components of K8S cluster level.  Given the proposition for ZT is risk based control the answer might be different for different components e.g those with PII and those without. IMHO we need a checklists for component and canvas designers with recommendation on what mechanisms should be selected based on risk assessment. However for ODA CA exploring the option and identifying the pro and cons ( complexity computational intensity etc ) would be a valuable outcome.

Just a note on updates to https://projects.tmforum.org/wiki/pages/viewpage.action?pageId=221382600)  I updated teh ODACA UC001 and UC003 scenarios to align with what has been posted here as of 12 April 2023 . I have material to add UCC007 and UC008 into SF01 once I get a a clear hour to edit it. Note SF 001 tries to relate these ODA-CA implementation oriented sequences  to OAUTH Entities/Roles as per Koen's observation above. It has  has a first pass at the security services that have to be exposed between those Oauth entities which will allow us to document features for the BDD

I am sharing some thoughts about the current implementation. Now, through a security operator, different components create a client within a realm and create roles for that component within the client. That means there will be N clients if there are N components.
Assuming that various users (human or not) are already registered in Keycloak (either directly or federated with an external system like Active Directory), this approach has several issues:

Multiple credentials: If component X needs to access component Y, it must be provided with credentials for the associated client Y. If it needs to access component Z, it also needs credentials for client Z. More dependencies lead to more credentials.

Roles and permissions restrictions: Roles and permissions in Keycloak clients are restricted to that specific client. There are ways to bypass this, such as using role_mappers to customize roles, but this requires coding and managing component additions and removals and is not considered a best practice due to potential security issues.

Token exchange: Tokens could be exchanged based on the proposed standard RFC 8693 OAuth 2.0 Token Exchange. However, the component must know the target client, which adds complexity to the implementation.

Latency issues: Regardless of the chosen solution, latency problems may arise due to multiple re-authentications required in requests.

Role and permission modifications: Allowing roles and permissions to be modified at the component level implies a need for synchronization with Keycloak. Adding more concerns to the security operator

Human users: The situation may be worse for human users using the authorization flow due to multiple re-authentications.

That leads to a scenario where we have to do probably too many things on the security operator or hand over too many unrelated pieces to the human operator expecting him to figure out how to set it all up.

Gustavo some  good points. A few other considerations.

Current practice of physical Network perimeter security using  API gateway between red and Green Zone is known to be poor at inhibiting lateral movement of malicious actors once in the green Zone.

At the  other end Zero trust suggest 'never trust always verify' whcih implies for ODA  every component has to be secured  and all access verified at the per component level . This encounters all the scaling points that you identify.

HOWEVER increasingly Governments are apply pressure and regulation to adopt zero trust principles ( In UK this is already in law, and other territories such as US Canada and Australia are going down this is path too.

This suggest that an API gateway might protect a group or zone  of ODA component( Including case of  just one).

The level of granularity can only be decided  by a risk assessment of impact of lateral movement  between the ODA components in such a zone.  The ODA Security And Privacy project has some  work on Enterprise risk assessment IG1187 of ODA components.

IMHO architecturally this means we need to support IAM mechanism that can be applied to either single ODA component or small groups/zones of ODA component. The design need to be done on a risk assessment balanced against the implementations cost such as you mention . Looking at some of the regulation there will be cases where individual component need to be secure.

On the point Role and permission modifications: Allowing roles and permissions to be modified at the component level implies a need for synchronization with Keycloak. My understanding of the proposal is that each component has an API that can provide all the roles recognised by the Component ( we'll need to live with Roles and permissions in Keycloak clients are restricted to that specific client for the moment).

What would help is to document design and implementions checklists to help designers and implementer work out the balance between verifying at component level - which IMHO would be the default stance - and relaxing to group/ Zone of components based on a systematic risk assessment of lateral movement.

I agree mostly (if not all) with you, Dave. A few more thoughts:

Increasingly, we are going to be under pressure of more and more security regulations, not just for PII regulation but for being part of the set of critical infrastructures that every government is worried about
None of the balances between convenience and stringent security come without a cost.
I tend to think that we have to restrict Canvas role to feed whatever is going to do the dirty duty and set up the pipelines correctly, e.g. ensuring that every actor has the right configuration, all the connections are done through TLS providing certificates, and so
I think no commercial solution for identity management such as Keycloak, Okka  is going to fulfil our requirements just with configuration, but my knowledge in this field is limited, and I hope to be surprised
Getting to a security solution that comes out in an emergent way from the aggregation of  security of (interchangeable) components or groups/zones of  them, with dependencies among themselves, It will be a tough challenge
So probably we should try to focus on an absurdly minimal MVP, learn in the process and iterate

Hi, I have some questions about the security apis for oda on UC001 and UC008..., can anyone help me?

UC001 said that the bootstrap process of canvas will create a system user for component to call other apis, how to get this user&password for the component? how to assign roles for this user?
The security operator will sync roles to IAM from PartyRole API, who created these roles  and who will use these roles? I could not find these roles assigned to users in canvas
thanks

We have curated some of this  ODA CA work in to a draft ODA Canvas service at the logical level  see IG1330 at  https://projects.tmforum.org/wiki/pages/viewpage.action?pageId=256319200
We are in the next sprint planning to address the concrete stage 3 API specifications

Item#1 work  by Ferenc Heckler is looking at Kubernetes secrets. Thread is at https://github.com/tmforum-oda/oda-canvas/pull/83/files/96aa40044088dac7671993a8284dc8d7ef5aee6d..2a818dafcf0c41450d674fda2ccbd584496b722f

Item#2 The design of ODA component should define the roles they recognise and put them the component  YAML metadata and behind a User Roles and permissions Service such as being implemented in  TMF672 (User) roles and permissions API . Note we need identities not just  for parties but devices and ODA components for which different OAuth2 Flows are required.

You might also wan to look at the draft work on Digital Identityhttps://projects.tmforum.org/wiki/display/AP/TMFXXX+Digital+Identity+Access+Control+API+Suite+Profile+v1.0.0

Closing this issue as it was only to capture input into Authentication


Write custom warnings for XGA

Should have done this from the start, in the same way I wrote custom exceptions. Currently I'm just using UserWarnings I think, so users can't specifically disable particular warnings in the way they should be able to

Consider using the logging module instead?


Retrieving most recent document returns incorrect documents

`var cursor = db.find({name: 'session'}).sort({timestamp:-1}).limit(1);
cursor.exec(
function(err, docs) {
if(!err && !(docs == null) && docs.length > 0) {
console.log("docs.length: " + docs.length);
docs.forEach(function(d) {
console.log("d._id: " + d._id + " d.array: " + JSON.stringify(d.array));
event.sender.send('labelContents', d.array);
});
} else {
event.sender.send('labelContents', null);
console.log("error: " + err);
}
}
);`
Problem is simple to understand: I insert new documents and expect to return the most recently added document from the datastore. Instead I receive a document from a later time. Here is my output. Notice the IDs do not match from most recent insert:
`Inserted session with ID fvNHKyS6G0j5x1xN
Inserted session with ID cla0VItr8nDxbvON
returning latest: d._id: 2hwVJ14rkT98gLIA d.array: []
Inserted session with ID kDLOapyhuJWTcdhK
returning latest: d._id: 2hwVJ14rkT98gLIA d.array: []
Inserted session with ID eprACGQFAzzYEJ2p
Inserted session with ID Zxv3NaiUZ2EqyCe1
Inserted session with ID IDljMKPhLg83fbJO
Inserted session with ID 07a68T6YVwIPkOFD
returning latest d._id: Zxv3NaiUZ2EqyCe1 d.array: [...redacted...]`
Using Nedb 1.8.0

I have also tried using {$natural: -1} and {x: -1} both with similar results

I've found a work around by adding a timestamp property to each document I insert and sorting by that. This does not mean that the sort issue is resolved in the library.

@TheMaverickProgrammer: How would you ever expect this to work without the timestamp property being present on documents?

@JamesMGreene MongoDB includes timestamps. This library claimed to be analogous to MongoDB.

@TheMaverickProgrammer: I've never encountered automatically included timestamp fields in MongoDB, other than if you sort by documents' ObjectIds.  If I'm mistaken, please link me to some documentation as I'd be interested to learn more.
As for NeDB, the analog would be:
var db = new Datastore({ inMemoryOnly: true, timestampData: true });
db
  .find({ name: 'session' })
  .sort({ createdAt: -1 })        // OR `.sort({ updatedAt: -1 })` to sort by last modification time
  .limit(1)
  .exec(function(err, docs) {
    /* ... */
  });


PhantomJS doesn't feel well (You need to include some adapter that implements karma.start method!)

On Travis CI with 0.13.6 I get with Node.js (with io.js it is ok) the following message:
You need to include some adapter that implements karma.start method!
Locally it is ok.
Reference:

https://travis-ci.org/albertosantini/argo/jobs/74189986
https://github.com/karma-runner/karma/issues/1544#issuecomment-127924225

P.S.: Locally on Windows 10 box.

I get the same error locally, and so far I have figured out that it works with Chrome, but fails on headless phantomjs

@arty-name what node version are you running, and what phantomjs-launcher and phantomjs version?

@Dignifiedquire,
node --version
v0.12.7
"karma-phantomjs-launcher": "0.2.0"
"phantomjs": "1.9.17"

Same problem here:
Debian 8.1
node v0.12.7
<EMAIL_ADDRESS><EMAIL_ADDRESS>

Does anyone see this issue consistently, or just sometimes? Because on travis I was able to get rid of the issue after the fifth test run or so. (Which doesn't give me any more ideas as to what the actual problem is :( )
@coderbyheart @arty-name any public code I could look at?

It looks like I am facing similar problem. I am trying to setup Karma, Mocha, Chai and PhantomJS but I keep receiving this error:

jkochman@spaceship:~/Work/MTViewCenter2$ karma start
05 08 2015 14:57:28.688:DEBUG [plugin]: Loading karma-* from /home/jkochman/Work/MTViewCenter2/node_modules
05 08 2015 14:57:28.691:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-chai.
05 08 2015 14:57:28.692:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-chrome-launcher.
05 08 2015 14:57:28.696:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-firefox-launcher.
05 08 2015 14:57:28.697:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-mocha.
05 08 2015 14:57:28.698:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-phantomjs-launcher.
05 08 2015 14:57:28.723:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-requirejs.
05 08 2015 14:57:28.763:INFO [karma]: Karma v0.13.6 server started at http://localhost:9876/
05 08 2015 14:57:28.767:INFO [launcher]: Starting browser PhantomJS
05 08 2015 14:57:28.767:DEBUG [temp-dir]: Creating temp dir at /tmp/karma-44042
05 08 2015 14:57:28.770:DEBUG [launcher]: /home/jkochman/Work/MTViewCenter2/node_modules/phantomjs/lib/phantom/bin/phantomjs /tmp/karma-44042/capture.js
05 08 2015 14:57:28.881:DEBUG [web-server]: serving: /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/client.html
05 08 2015 14:57:28.895:DEBUG [web-server]: serving: /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/karma.js
05 08 2015 14:57:28.925:DEBUG [karma]: A browser has connected on socket ESN93SgZ9uM3wcjNAAAA
05 08 2015 14:57:28.928:DEBUG [web-server]: upgrade /socket.io/?EIO=3&transport=websocket&sid=ESN93SgZ9uM3wcjNAAAA
05 08 2015 14:57:28.997:INFO [PhantomJS 1.9.8 (Linux 0.0.0)]: Connected on socket ESN93SgZ9uM3wcjNAAAA with id 44042
05 08 2015 14:57:28.998:DEBUG [launcher]: PhantomJS (id 44042) captured in 0.234 secs
05 08 2015 14:57:29.003:DEBUG [web-server]: serving: /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/context.html
PhantomJS 1.9.8 (Linux 0.0.0) ERROR
  You need to include some adapter that implements __karma__.start method!

05 08 2015 14:57:29.050:DEBUG [karma]: Run complete, exiting.
05 08 2015 14:57:29.051:DEBUG [launcher]: Disconnecting all browsers
05 08 2015 14:57:29.061:DEBUG [launcher]: Process PhantomJS exited with code 0
05 08 2015 14:57:29.062:DEBUG [temp-dir]: Cleaning temp dir /tmp/karma-44042

If I add another browser like Chrome or Firefox it's running ok. I don't understand why there are two 'PhantomJS 1.9.8 (Linux 0.0.0): Executed 1 of 1 SUCCESS (0.041 secs / 0.001 secs)' lines though:

jkochman@spaceship:~/Work/MTViewCenter2$ karma start
05 08 2015 14:59:34.099:DEBUG [plugin]: Loading karma-* from /home/jkochman/Work/MTViewCenter2/node_modules
05 08 2015 14:59:34.102:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-chai.
05 08 2015 14:59:34.103:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-chrome-launcher.
05 08 2015 14:59:34.107:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-firefox-launcher.
05 08 2015 14:59:34.108:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-mocha.
05 08 2015 14:59:34.109:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-phantomjs-launcher.
05 08 2015 14:59:34.134:DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-requirejs.
05 08 2015 14:59:34.171:INFO [karma]: Karma v0.13.6 server started at http://localhost:9876/
05 08 2015 14:59:34.175:INFO [launcher]: Starting browser Chrome
05 08 2015 14:59:34.175:DEBUG [temp-dir]: Creating temp dir at /tmp/karma-55000399
05 08 2015 14:59:34.175:DEBUG [launcher]: google-chrome --user-data-dir=/tmp/karma-55000399 --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate http://localhost:9876/?id=55000399
05 08 2015 14:59:34.181:INFO [launcher]: Starting browser PhantomJS
05 08 2015 14:59:34.182:DEBUG [temp-dir]: Creating temp dir at /tmp/karma-26205044
05 08 2015 14:59:34.185:DEBUG [launcher]: /home/jkochman/Work/MTViewCenter2/node_modules/phantomjs/lib/phantom/bin/phantomjs /tmp/karma-26205044/capture.js
05 08 2015 14:59:34.306:DEBUG [web-server]: serving: /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/client.html
05 08 2015 14:59:34.319:DEBUG [web-server]: serving: /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/karma.js
05 08 2015 14:59:34.357:DEBUG [karma]: A browser has connected on socket 3muEwILnWOTT9zTHAAAA
05 08 2015 14:59:34.373:DEBUG [web-server]: upgrade /socket.io/?EIO=3&transport=websocket&sid=3muEwILnWOTT9zTHAAAA
05 08 2015 14:59:34.434:INFO [PhantomJS 1.9.8 (Linux 0.0.0)]: Connected on socket 3muEwILnWOTT9zTHAAAA with id 26205044
05 08 2015 14:59:34.435:DEBUG [launcher]: PhantomJS (id 26205044) captured in 0.263 secs
05 08 2015 14:59:34.441:DEBUG [web-server]: serving: /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/context.html
05 08 2015 14:59:34.444:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/chai/chai.js
05 08 2015 14:59:34.446:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/karma-chai/adapter.js
05 08 2015 14:59:34.448:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/mocha/mocha.js
05 08 2015 14:59:34.450:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/karma-mocha/lib/adapter.js
05 08 2015 14:59:34.450:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/test-main.js
05 08 2015 14:59:34.451:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/test/test.spec.js
PhantomJS 1.9.8 (Linux 0.0.0): Executed 1 of 1 SUCCESS (0.041 secs / 0.001 secs)
05 08 2015 14:59:34.529:DEBUG [launcher]: Process PhantomJS exited with code 0
05 08 2015 14:59:34.530:DEBUG [temp-dir]: Cleaning temp dir /tmp/karma-26205044
05 08 2015 14:59:35.038:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/client.html
05 08 2015 14:59:35.048:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/karma.js
05 08 2015 14:59:35.125:DEBUG [karma]: A browser has connected on socket zS6D9KPF8OZCBj2IAAAB
05 08 2015 14:59:35.135:DEBUG [web-server]: upgrade /socket.io/?EIO=3&transport=websocket&sid=zS6D9KPF8OZCBj2IAAAB
05 08 2015 14:59:35.147:DEBUG [web-server]: serving: /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/favicon.ico
05 08 2015 14:59:35.150:INFO [Chrome 44.0.2403 (Linux 0.0.0)]: Connected on socket zS6D9KPF8OZCBj2IAAAB with id 55000399
05 08 2015 14:59:35.151:DEBUG [launcher]: Chrome (id 55000399) captured in 0.979 secs
05 08 2015 14:59:35.164:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/context.html
05 08 2015 14:59:35.169:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/chai/chai.js
05 08 2015 14:59:35.171:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/karma-chai/adapter.js
05 08 2015 14:59:35.172:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/mocha/mocha.js
05 08 2015 14:59:35.177:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/karma-mocha/lib/adapter.js
05 08 2015 14:59:35.178:DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/test-main.js
PhantomJS 1.9.8 (Linux 0.0.0): Executed 1 of 1 SUCCESS (0.041 secs / 0.001 secs)
Chrome 44.0.2403 (Linux 0.0.0): Executed 1 of 1 SUCCESS (0.009 secs / 0.001 secs)
TOTAL: 2 SUCCESS
05 08 2015 14:59:35.229:DEBUG [karma]: Run complete, exiting.
05 08 2015 14:59:35.230:DEBUG [launcher]: Disconnecting all browsers
05 08 2015 14:59:35.797:DEBUG [launcher]: Process Chrome exited with code 0
05 08 2015 14:59:35.797:DEBUG [temp-dir]: Cleaning temp dir /tmp/karma-55000399

It also works if I downgrade Karma to 0.12.37 (tried 0.13.4):

jkochman@spaceship:~/Work/MTViewCenter2$ karma start
DEBUG [plugin]: Loading karma-* from /home/jkochman/Work/MTViewCenter2/node_modules
DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-chai.
DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-chrome-launcher.
DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-firefox-launcher.
DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-mocha.
DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-phantomjs-launcher.
DEBUG [plugin]: Loading plugin /home/jkochman/Work/MTViewCenter2/node_modules/karma-requirejs.
DEBUG [watcher]: Resolved files:
	/home/jkochman/Work/MTViewCenter2/node_modules/chai/chai.js
	/home/jkochman/Work/MTViewCenter2/node_modules/karma-chai/adapter.js
	/home/jkochman/Work/MTViewCenter2/node_modules/mocha/mocha.js
	/home/jkochman/Work/MTViewCenter2/node_modules/karma-mocha/lib/adapter.js
	/home/jkochman/Work/MTViewCenter2/test/test.spec.js
INFO [karma]: Karma v0.12.37 server started at http://localhost:9876/
INFO [launcher]: Starting browser PhantomJS
DEBUG [temp-dir]: Creating temp dir at /tmp/karma-84303543
DEBUG [launcher]: /home/jkochman/Work/MTViewCenter2/node_modules/phantomjs/lib/phantom/bin/phantomjs /tmp/karma-84303543/capture.js
DEBUG [web-server]: serving: /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/client.html
DEBUG [web-server]: serving: /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/karma.js
DEBUG [web-server]: upgrade /socket.io/1/websocket/1wdsyb1J3mcOT2vp9VqC
DEBUG [karma]: A browser has connected on socket 1wdsyb1J3mcOT2vp9VqC
INFO [PhantomJS 1.9.8 (Linux 0.0.0)]: Connected on socket 1wdsyb1J3mcOT2vp9VqC with id 84303543
DEBUG [launcher]: PhantomJS (id 84303543) captured in 0.378 secs
DEBUG [web-server]: serving: /home/jkochman/Work/MTViewCenter2/node_modules/karma/static/context.html
DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/chai/chai.js
DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/karma-chai/adapter.js
DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/mocha/mocha.js
DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/node_modules/karma-mocha/lib/adapter.js
DEBUG [web-server]: serving (cached): /home/jkochman/Work/MTViewCenter2/test/test.spec.js
PhantomJS 1.9.8 (Linux 0.0.0): Executed 1 of 1 SUCCESS (0.044 secs / 0.001 secs)
DEBUG [karma]: Run complete, exiting.
DEBUG [launcher]: Disconnecting all browsers
DEBUG [launcher]: Process PhantomJS exited with code 0
DEBUG [temp-dir]: Cleaning temp dir /tmp/karma-84303543

Karma config:

// Karma configuration
// Generated on Wed Aug 05 2015 13:45:25 GMT+0200 (CEST)

module.exports = function(config) {
  config.set({

    // base path that will be used to resolve all patterns (eg. files, exclude)
    basePath: '',

    // frameworks to use
    // available frameworks: https://npmjs.org/browse/keyword/karma-adapter
    frameworks: ['mocha', 'chai'],

    // list of files / patterns to load in the browser
    files: [
      {pattern: 'test/**/*.spec.js', included: true}
    ],

    // list of files to exclude
    exclude: [
    ],

    // preprocess matching files before serving them to the browser
    // available preprocessors: https://npmjs.org/browse/keyword/karma-preprocessor
    preprocessors: {
    },

    // test results reporter to use
    // possible values: 'dots', 'progress'
    // available reporters: https://npmjs.org/browse/keyword/karma-reporter
    reporters: ['progress'],

    // web server port
    port: 9876,

    // enable / disable colors in the output (reporters and logs)
    colors: true,

    // level of logging
    // possible values: config.LOG_DISABLE || config.LOG_ERROR || config.LOG_WARN || config.LOG_INFO || config.LOG_DEBUG
    logLevel: config.LOG_DEBUG,

    // enable / disable watching file and executing tests whenever any file changes
    autoWatch: false,

    // start these browsers
    // available browser launchers: https://npmjs.org/browse/keyword/karma-launcher
    browsers: ['PhantomJS'],

    // Continuous Integration mode
    // if true, Karma captures browsers, runs the tests and exits
    singleRun: true
  })
}

Same issue here,
node: 0.12.7
karma: 0.13.6
karma-phantomjs-launcher: 0.2.0
Just noticed the issue, my test ran and eveything worked as expected the first time (singleRun: true, autoWatch: false). Then I ran them a second time and I couldn't get it to work again since. I get this error too:
 PhantomJS 1.9.8 (Linux 0.0.0) ERROR
 You need to include some adapter that implements __karma__.start method

However I didn't get the issue yet when i am using karma with (singleRun: false, autoWatch: true), does anyone have ?

@Dignifiedquire, I was getting this error quite reliably, but the code is not public, sorry

Okay, I need some more details from you guys please, as I still can't reproduce this anywhere on my machines, could you please install the latest<EMAIL_ADDRESS>and use the debugger as described here, set karma log level to debug and let me know what the output on the console, as well as in the opened debuger in the log is please.

I'll try to debug using this asap. Also I'm using karma-mocha v0.1.10, maybe it's relevant ? I assume you don't ?

No, but I just tried with<EMAIL_ADDRESS>it was working fine with it for me

So I have tried the debug configuration and as soon as I put debug: true in it starts working fine. I comment the debug: true out, and it fails again.
Config:
{
    logLevel: 'DEBUG',
    browsers: ['PhantomJS_custom'],
    customLaunchers: {
        'PhantomJS_custom': {
            base: 'PhantomJS',
            options: {
                windowName: 'my-window',
                settings: {
                    webSecurityEnabled: false
                }
            },
            flags: ['--load-images=true'],
            //debug: true
        }
    },

    phantomjsLauncher: {
        // Have phantomjs exit if a ResourceError is encountered (useful if karma exits without killing phantom)
        exitOnResourceError: true
    }
}

Log of failure:
05 08 2015 16:38:47.987:DEBUG [config]: autoWatch set to false, because of singleRun
05 08 2015 16:38:47.989:DEBUG [plugin]: Loading plugin karma-jasmine.
05 08 2015 16:38:47.990:DEBUG [plugin]: Loading plugin karma-coverage.
05 08 2015 16:38:48.007:DEBUG [plugin]: Loading plugin karma-phantomjs-launcher.
05 08 2015 16:38:48.027:DEBUG [plugin]: Loading plugin karma-chrome-launcher.
05 08 2015 16:38:48.031:DEBUG [plugin]: Loading plugin karma-firefox-launcher.
05 08 2015 16:38:48.032:DEBUG [plugin]: Loading plugin karma-safari-launcher.
05 08 2015 16:38:48.033:DEBUG [plugin]: Loading plugin karma-junit-reporter.
05 08 2015 16:38:48.036:DEBUG [plugin]: Loading plugin karma-html-reporter.
05 08 2015 16:38:48.046:DEBUG [plugin]: Loading plugin karma-spec-reporter.
05 08 2015 16:38:48.049:DEBUG [plugin]: Loading plugin karma-fixture.
05 08 2015 16:38:48.050:DEBUG [plugin]: Loading plugin karma-json-fixtures-preprocessor.
05 08 2015 16:38:48.051:DEBUG [plugin]: Loading inlined plugin (defining launcher:PhantomJS_custom).
05 08 2015 16:38:48.100:INFO [karma]: Karma v0.13.6 server started at http://localhost:9876/
05 08 2015 16:38:48.116:INFO [launcher]: Starting browser PhantomJS
05 08 2015 16:38:48.117:DEBUG [temp-dir]: Creating temp dir at /tmp/karma-17726920
05 08 2015 16:38:48.119:DEBUG [launcher]: /home/treguben/dev/here.com/node_modules/phantomjs/lib/phantom/bin/phantomjs --load-images=true /tmp/karma-17726920/capture.js
05 08 2015 16:38:48.218:DEBUG [web-server]: serving: /home/treguben/dev/here.com/node_modules/karma/static/client.html
05 08 2015 16:38:48.226:DEBUG [web-server]: serving: /home/treguben/dev/here.com/node_modules/karma/static/karma.js
05 08 2015 16:38:48.245:DEBUG [karma]: A browser has connected on socket EIVNkwuOyie7GgKNAAAA
05 08 2015 16:38:48.248:DEBUG [web-server]: upgrade /socket.io/?EIO=3&transport=websocket&sid=EIVNkwuOyie7GgKNAAAA
05 08 2015 16:38:48.307:INFO [PhantomJS 1.9.8 (Linux 0.0.0)]: Connected on socket EIVNkwuOyie7GgKNAAAA with id 17726920
05 08 2015 16:38:48.308:DEBUG [launcher]: PhantomJS (id 17726920) captured in 0.208 secs
05 08 2015 16:38:48.312:DEBUG [web-server]: serving: /home/treguben/dev/here.com/node_modules/karma/static/context.html
PhantomJS 1.9.8 (Linux 0.0.0) ERROR
  You need to include some adapter that implements __karma__.start method!

05 08 2015 16:38:48.357:DEBUG [karma]: Run complete, exiting.
05 08 2015 16:38:48.357:DEBUG [launcher]: Disconnecting all browsers
05 08 2015 16:38:48.361:DEBUG [launcher]: Process PhantomJS exited with code 0
05 08 2015 16:38:48.361:DEBUG [temp-dir]: Cleaning temp dir /tmp/karma-17726920

Log of successful fun in case you need it:
05 08 2015 16:38:20.750:DEBUG [config]: autoWatch set to false, because of singleRun
05 08 2015 16:38:20.753:DEBUG [plugin]: Loading plugin karma-jasmine.
05 08 2015 16:38:20.754:DEBUG [plugin]: Loading plugin karma-coverage.
05 08 2015 16:38:20.770:DEBUG [plugin]: Loading plugin karma-phantomjs-launcher.
05 08 2015 16:38:20.789:DEBUG [plugin]: Loading plugin karma-chrome-launcher.
05 08 2015 16:38:20.794:DEBUG [plugin]: Loading plugin karma-firefox-launcher.
05 08 2015 16:38:20.795:DEBUG [plugin]: Loading plugin karma-safari-launcher.
05 08 2015 16:38:20.796:DEBUG [plugin]: Loading plugin karma-junit-reporter.
05 08 2015 16:38:20.798:DEBUG [plugin]: Loading plugin karma-html-reporter.
05 08 2015 16:38:20.809:DEBUG [plugin]: Loading plugin karma-spec-reporter.
05 08 2015 16:38:20.811:DEBUG [plugin]: Loading plugin karma-fixture.
05 08 2015 16:38:20.813:DEBUG [plugin]: Loading plugin karma-json-fixtures-preprocessor.
05 08 2015 16:38:20.814:DEBUG [plugin]: Loading inlined plugin (defining launcher:PhantomJS_custom).
05 08 2015 16:38:20.862:INFO [karma]: Karma v0.13.6 server started at http://localhost:9876/
05 08 2015 16:38:20.878:INFO [launcher]: Starting browser PhantomJS
05 08 2015 16:38:20.878:DEBUG [temp-dir]: Creating temp dir at /tmp/karma-80480871
05 08 2015 16:38:20.881:DEBUG [launcher]: /home/treguben/dev/here.com/node_modules/phantomjs/lib/phantom/bin/phantomjs --load-images=true --remote-debugger-port=9000 --remote-debugger-autorun=yes /tmp/karma-80480871/capture.js
05 08 2015 16:38:20.884:INFO [phantomjs.launcher]: ACTION REQUIRED:
05 08 2015 16:38:20.884:INFO [phantomjs.launcher]:
05 08 2015 16:38:20.885:INFO [phantomjs.launcher]:   Launch browser at
05 08 2015 16:38:20.885:INFO [phantomjs.launcher]:   http://localhost:9000/webkit/inspector/inspector.html?page=2
05 08 2015 16:38:20.885:INFO [phantomjs.launcher]:
05 08 2015 16:38:20.885:INFO [phantomjs.launcher]: Waiting 15 seconds ...
05 08 2015 16:38:20.974:DEBUG [phantomjs.launcher]: Launch the debugger page at http://localhost:9000/webkit/inspector/inspector.html?page=2
Waiting 15 seconds for debugger page to launch...

05 08 2015 16:38:35.986:DEBUG [phantomjs.launcher]: Launching page http://localhost:9876/?id=80480871...

05 08 2015 16:38:35.994:DEBUG [web-server]: serving: /home/treguben/dev/here.com/node_modules/karma/static/client.html
05 08 2015 16:38:36.002:DEBUG [web-server]: serving: /home/treguben/dev/here.com/node_modules/karma/static/karma.js
05 08 2015 16:38:36.024:DEBUG [karma]: A browser has connected on socket ZAs_vF1-u5Cgk-ghAAAA
05 08 2015 16:38:36.027:DEBUG [web-server]: upgrade /socket.io/?EIO=3&transport=websocket&sid=ZAs_vF1-u5Cgk-ghAAAA
05 08 2015 16:38:36.079:INFO [PhantomJS 1.9.8 (Linux 0.0.0)]: Connected on socket ZAs_vF1-u5Cgk-ghAAAA with id 80480871
05 08 2015 16:38:36.080:DEBUG [launcher]: PhantomJS (id 80480871) captured in 15.218 secs
    <snip>serving a bunch of files</snip>
PhantomJS 1.9.8 (Linux 0.0.0): Executed 26 of 26 SUCCESS (0.092 secs / 0.304 secs)
05 08 2015 16:38:36.533:DEBUG [karma]: Run complete, exiting.
05 08 2015 16:38:36.533:DEBUG [launcher]: Disconnecting all browsers
05 08 2015 16:38:36.534:DEBUG [coverage]: Writing coverage to /home/treguben/dev/here.com/tests/results/frontend_coverage/PhantomJS 1.9.8 (Linux 0.0.0)
05 08 2015 16:38:36.573:DEBUG [launcher]: Process PhantomJS exited with code 0
05 08 2015 16:38:36.574:DEBUG [temp-dir]: Cleaning temp dir /tmp/karma-80480871
05 08 2015 16:38:36.578:DEBUG [reporter.junit]: JUnit results written to "/home/treguben/dev/here.com/tests/results/frontend/PhantomJS_1.9.8_(Linux_0.0.0)/jasmine-test-results.xml".

Done, without errors.

So I have tried the debug configuration and as soon as I put debug: true in it starts working fine. I comment the debug: true out, and it fails again.

Okay, that might actually help me :) it looks like this issue is a race condition due to the changes I made in https://github.com/karma-runner/karma/commit/96e33dc18b0041d78a3f2abb3b97c4e372c125ef
Let's see if I can fix that

Okay, so please try out this pr https://github.com/karma-runner/karma/pull/1546, you can install it by running
$ npm i Dignifiedquire#1545-race-agains-phantom
$ cd node_modules/karma
$ npm i -g grunt-cli # If you don't already have grunt instaled
$ grunt build
$ cd ../..

Seems to work for me

Seems to work for me

:) I'll wait for one more confirm and then release it

Though for some reasons, I had to git clone your fork, checkout your branch instead of using npm install. The 'client' folder is missing with npm install and as a result static/karma.js is an 'empty' build when I follow your steps

@kketch thanks, I had some typo in the npm install command I think, I've updated the installation details to use git, to ensure it works

In my case it doesn't run the tests anymore with your karma version.
$ PATH="./node_modules/phantomjs/bin/phantomjs:$PATH" ./node_modules/karma/bin/karma start --browsers PhantomJS_custom test/karma/karma.conf.js
05 08 2015 17:41:55.419:DEBUG [plugin]: Loading karma-* from /home/m/www/finturanode/node_modules
05 08 2015 17:41:55.422:DEBUG [plugin]: Loading plugin /home/m/www/finturanode/node_modules/karma-browserstack-launcher.
05 08 2015 17:41:55.482:DEBUG [plugin]: Loading plugin /home/m/www/finturanode/node_modules/karma-chrome-launcher.
05 08 2015 17:41:55.486:DEBUG [plugin]: Loading plugin /home/m/www/finturanode/node_modules/karma-coverage.
05 08 2015 17:41:55.650:DEBUG [plugin]: Loading plugin /home/m/www/finturanode/node_modules/karma-jasmine.
05 08 2015 17:41:55.651:DEBUG [plugin]: Loading plugin /home/m/www/finturanode/node_modules/karma-phantomjs-launcher.
05 08 2015 17:41:55.671:DEBUG [plugin]: Loading inlined plugin (defining launcher:PhantomJS_custom).
05 08 2015 17:41:55.697:DEBUG [watcher]: Excluded file "/home/m/www/finturanode/bower_modules/jquery.inputmask/dist/jquery.inputmask.bundle.js"
05 08 2015 17:41:55.729:DEBUG [watcher]: Excluded file "/home/m/www/finturanode/bower_modules/intl-tel-input/build/js/intlTelInput.js"
05 08 2015 17:41:55.729:DEBUG [watcher]: Excluded file "/home/m/www/finturanode/bower_modules/intl-tel-input/lib/libphonenumber/build/utils.js"
05 08 2015 17:41:55.744:WARN [watcher]: All files matched by "/home/m/www/finturanode/bower_modules/jquery.inputmask/dist/jquery.inputmask.bundle.js" were excluded.
05 08 2015 17:41:55.745:WARN [watcher]: All files matched by "/home/m/www/finturanode/bower_modules/intl-tel-input/build/js/intlTelInput.js" were excluded.
05 08 2015 17:41:55.745:WARN [watcher]: All files matched by "/home/m/www/finturanode/bower_modules/intl-tel-input/lib/libphonenumber/build/utils.js" were excluded.
05 08 2015 17:41:55.769:INFO [karma]: Karma v0.13.6 server started at http://localhost:9876/
05 08 2015 17:41:55.779:INFO [launcher]: Starting browser PhantomJS
05 08 2015 17:41:55.779:DEBUG [temp-dir]: Creating temp dir at /tmp/karma-77071060
05 08 2015 17:41:55.782:DEBUG [launcher]: /home/m/www/finturanode/node_modules/phantomjs/lib/phantom/bin/phantomjs --load-images=true --remote-debugger-port=9000 --remote-debugger-autorun=yes /tmp/karma-77071060/capture.js
05 08 2015 17:41:55.786:INFO [phantomjs.launcher]: ACTION REQUIRED:
05 08 2015 17:41:55.786:INFO [phantomjs.launcher]:
05 08 2015 17:41:55.786:INFO [phantomjs.launcher]:   Launch browser at
05 08 2015 17:41:55.786:INFO [phantomjs.launcher]:   http://localhost:9000/webkit/inspector/inspector.html?page=2
05 08 2015 17:41:55.786:INFO [phantomjs.launcher]:
05 08 2015 17:41:55.786:INFO [phantomjs.launcher]: Waiting 15 seconds ...
05 08 2015 17:41:55.864:DEBUG [phantomjs.launcher]: Launch the debugger page at http://localhost:9000/webkit/inspector/inspector.html?page=2
Waiting 15 seconds for debugger page to launch...

05 08 2015 17:42:10.873:DEBUG [phantomjs.launcher]: Launching page http://localhost:9876/?id=77071060...

05 08 2015 17:42:10.888:DEBUG [web-server]: serving: /home/m/www/finturanode/node_modules/karma/static/client.html
05 08 2015 17:42:10.902:DEBUG [web-server]: serving: /home/m/www/finturanode/node_modules/karma/static/karma.js
05 08 2015 17:42:55.802:WARN [launcher]: PhantomJS have not captured in 60000 ms, killing.
05 08 2015 17:42:55.810:DEBUG [launcher]: Process PhantomJS exited with code 0
05 08 2015 17:42:55.810:DEBUG [temp-dir]: Cleaning temp dir /tmp/karma-77071060
05 08 2015 17:42:55.817:INFO [launcher]: Trying to start PhantomJS again (1/2).
05 08 2015 17:42:55.818:DEBUG [launcher]: Restarting PhantomJS
05 08 2015 17:42:55.818:DEBUG [temp-dir]: Creating temp dir at /tmp/karma-77071060
05 08 2015 17:42:55.820:DEBUG [launcher]: /home/m/www/finturanode/node_modules/phantomjs/lib/phantom/bin/phantomjs --load-images=true --remote-debugger-port=9000 --remote-debugger-autorun=yes /tmp/karma-77071060/capture.js --remote-debugger-port=9000 --remote-debugger-autorun=yes /tmp/karma-77071060/capture.js
05 08 2015 17:42:55.825:INFO [phantomjs.launcher]: ACTION REQUIRED:
05 08 2015 17:42:55.825:INFO [phantomjs.launcher]:
05 08 2015 17:42:55.825:INFO [phantomjs.launcher]:   Launch browser at
05 08 2015 17:42:55.825:INFO [phantomjs.launcher]:   http://localhost:9000/webkit/inspector/inspector.html?page=2
05 08 2015 17:42:55.825:INFO [phantomjs.launcher]:
05 08 2015 17:42:55.826:INFO [phantomjs.launcher]: Waiting 15 seconds ...
05 08 2015 17:42:55.958:DEBUG [phantomjs.launcher]: Launch the debugger page at http://localhost:9000/webkit/inspector/inspector.html?page=2
Waiting 15 seconds for debugger page to launch...

05 08 2015 17:43:10.972:DEBUG [phantomjs.launcher]: Launching page http://localhost:9876/?id=77071060...

05 08 2015 17:43:10.975:DEBUG [web-server]: serving (cached): /home/m/www/finturanode/node_modules/karma/static/client.html
05 08 2015 17:43:10.984:DEBUG [web-server]: serving (cached): /home/m/www/finturanode/node_modules/karma/static/karma.js

@coderbyheart  I experimented the same behavior, and this was because I installed karma through npm install, in this case you may have a failed build of static/karma.js like me. Follow the updated steps above (using git clone instead of npm install) and I think you should be fine.

Awesome. Works!
05 08 2015 17:51:33.264:INFO [karma]: Karma v0.13.6 server started at http://localhost:9876/

$ npm list | grep phantom
│ ├──<EMAIL_ADDRESS>extraneous
│ ├──<EMAIL_ADDRESS>extraneous
├─┬<EMAIL_ADDRESS>├─┬<EMAIL_ADDRESS>

Released as 0.13.7
Thanks everyone for all the help!

With 0.13.7, for me, it is ok locally on Windows 10 and Travis CI.
Good job. Thanks folks.

Thanks for fixing this so quickly!

I've seen the same error message for 0.13.7 and 0.13.10.
... % npm list | grep phantom                                       :(
├─┬<EMAIL_ADDRESS>└─┬<EMAIL_ADDRESS>
... % npm list | grep karma
├─┬<EMAIL_ADDRESS>├─┬<EMAIL_ADDRESS>├──<EMAIL_ADDRESS>├─┬<EMAIL_ADDRESS>├─┬<EMAIL_ADDRESS>
The Error goes like:
06 01 2016 09:51:27.830:INFO [karma]: Karma v0.13.7 server started at http://localhost:9876/
06 01 2016 09:51:27.838:INFO [launcher]: Starting browser PhantomJS
06 01 2016 09:51:27.839:DEBUG [temp-dir]: Creating temp dir at /tmp/karma-8049600
06 01 2016 09:51:27.840:DEBUG [launcher]: /home/malte/workspace/glx-smartgy-frontend_portal/node_modules/phantomjs/lib/phantom/bin/phantomjs /tmp/karma-8049600/capture.js
06 01 2016 09:51:27.964:DEBUG [web-server]: serving: /home/malte/workspace/glx-smartgy-frontend_portal/node_modules/karma/static/client.html
06 01 2016 09:51:27.972:DEBUG [web-server]: serving: /home/malte/workspace/glx-smartgy-frontend_portal/node_modules/karma/static/karma.js
06 01 2016 09:51:28.002:DEBUG [karma]: A browser has connected on socket oZco5FFbyFTwV_wfAAAA
06 01 2016 09:51:28.006:DEBUG [web-server]: upgrade /socket.io/?EIO=3&transport=websocket&sid=oZco5FFbyFTwV_wfAAAA
06 01 2016 09:51:28.068:INFO [PhantomJS 1.9.8 (Linux 0.0.0)]: Connected on socket oZco5FFbyFTwV_wfAAAA with id 8049600
06 01 2016 09:51:28.068:DEBUG [launcher]: PhantomJS (id 8049600) captured in 0.238 secs
06 01 2016 09:51:28.073:DEBUG [web-server]: serving: /path/to/node_modules/karma/static/context.html
06 01 2016 09:51:28.075:DEBUG [web-server]: serving (cached): /path/to/node_modules/karma-systemjs/lib/adapter.js
PhantomJS 1.9.8 (Linux 0.0.0) ERROR
  You need to include some adapter that implements __karma__.start method!

06 01 2016 09:51:28.122:DEBUG [karma]: Run complete, exiting.
06 01 2016 09:51:28.124:DEBUG [launcher]: Disconnecting all browsers
06 01 2016 09:51:28.128:DEBUG [launcher]: Process PhantomJS exited with code 0
06 01 2016 09:51:28.128:DEBUG [temp-dir]: Cleaning temp dir /tmp/karma-8049600

For me it looks quite similar to @arty-name's debug output. But it might be related to our use of systemjs.

I'm getting this error with karma 0.13.19, OSX 10.10.5, with a very simple karma.conf.js and a very simple test file.
// karma.conf.js

module.exports = function (karmaConfig) {
  karmaConfig.set({

    browsers: ['Chrome'],

    files: [
      'src/test.js'
    ],

    preprocessors: {
      // normally, with karma-webpack
      // '**/*': ['webpack']
    }
  });
}

// src/test.js

/*
some commented out tests...
*/

console.log('tests loaded');

// Error appears even when this file is empty

The error:
26 01 2016 17:48:44.173:WARN [karma]: No captured browser, open http://localhost:9876/
26 01 2016 17:48:44.186:INFO [karma]: Karma v0.13.19 server started at http://localhost:9876/
26 01 2016 17:48:44.198:INFO [launcher]: Starting browser Chrome
26 01 2016 17:48:45.118:INFO [Chrome 47.0.2526 (Mac OS X 10.10.5)]: Connected on socket /#Yst37oxFOulgnqbAAAAA with id 5510292
Chrome 47.0.2526 (Mac OS X 10.10.5) LOG: 'tests loaded'

Chrome 47.0.2526 (Mac OS X 10.10.5) ERROR
  You need to include some adapter that implements __karma__.start method!

I'll look into the code and see if I can find something

@mhintz you need to include a testing framework like mocha, jasmine or qunit, that's what the error is about.

Aha, thanks! I had been including the karma-unexpected plugin, but that looks like it's terribly outdated. I'm working on a fork now.

I'm not having luck with chrome:
Chrome 49.0.2623 (Mac OS X 10.10.4) ERROR
You need to include some adapter that implements karma.start method!

I'm getting the same error ( karma.start method!) with below,
"karma": "1.3.0",
"karma-browserify": "^5.0.5",
"karma-chrome-launcher": "2.0.0",
"karma-coffee-preprocessor": "^1.0.0",
"karma-coverage": "~1.1.0",
"karma-jasmine": "1.0.2",
"karma-junit-reporter": "^1.1.0",
"karma-phantomjs-launcher": "1.0.2",
"merge-stream": "^1.0.0",
"phantomjs-prebuilt": "2.1.12",
Debug output is as follows:
[exec] 02 10 2016 21:22:28.479:DEBUG [web-server]: serving: /path/node_modules/karma/static/context.js
[exec] PhantomJS 2.1.1 (Mac OS X 0.0.0) ERROR
[exec]   You need to include some adapter that implements karma.start method!
[exec] PhantomJS 2.1.1 (Mac OS X 0.0.0): Executed 0 of 0 ERROR (1.005 secs / 0 secs)


pacaur -Ss sagemath -r exits with status 1

Consider the following search queries:
pacaur -Ss sagemath -r
pacman -Ss sagemath

They both yield the same results, however, pacaur exits with status 1, while pacman exits with status 0.  Is this intentional?  I believe that pacaur should exit with status 1 if and only if the search didn't match anything.

Not intentional. Thanks for the report.

Just discovered this myself.
Seems to happen only where there are no matching AUR packages.

@blueyed: I thought the same; however, there are matching AUR packages, try pacaur -Ss sagemath -a.

Yes, but with -r you are skipping this: so the exit code is 1 in case AUR was not searched or nothing was found there.  I typically only use pacaur -Ss.

The same happens for the following:
pacman -Qu exits with status 1
pacaur -Qu exits with status 0
Please let me know if you'd like me to report this as a separate issue.

Thanks for the report.

Fixed in 78f880505aab33be27c0e8f65fc3523ce333cbef.


Immutable repo

The sample AccountRepo made use of a mutable map which leaks outside the method scope and Task for effect.
Here's an alternative approach which makes use of immutable maps and a less powerful monad.
Might this be useful? I started out with the free section. I can maybe further edit other parts that makes use of mutable maps if necessary.

If I understand correctly the AccountRepoStateInterpreter uses the State monad instead of the mutable Map that AccountRepoMutableInterpreter uses. As I mentioned in the text, usage of the mutable Map is definitely not meant for production usage. But makes a simple and intuitive case for testing and explaining to the newcomer.
However I like the example that you have written. Is it ok if I include it as an exercise in the chapter ? The solution will not be there in the book but will be there in an accompanying branch of the online code repository. And obviously there will be proper attribution in the book for your contribution.
Please let me know ASAP as the final draft of the book is scheduled to leave my server next week. I can make this a last minute addition.
And a couple of things -

I have a few small observations on the code which I will write inline
Can you please make the PR against the branch freec-scalaz-7.2.x which has the latest version of the code based on scalaz 7.2 and the latest drop of akka-streams ?

Thanks a lot for the contribution.

Exercise -- sounds great. Whatever you think is best. :) Just hoping to contribute. Your book has been immensely helpful for me from the first MEAP. Eagerly awaiting the final release.
An approach similar to this has been quite helpful for me in testing. I try to avoid writing code against the Task monad, which can blow up at every step with an exception and is sometimes is hard to backtrack, I prefer to code against less powerful ones such as State in this example, possibly with some combination of Write that's much easier to debug. Also, no need for the mutable part which feels like a cheat. ;)
Closing this for now, and replacing it with one against freec-scalaz-7.2.x shortly.


python312Packages.marimo: 0.8.3 -> 0.8.7

Automatic update generated by nixpkgs-update tools. This update was made based on information from passthru.updateScript.
meta.description for python312Packages.marimo is: Reactive Python notebook that's reproducible, git-friendly, and deployable as scripts or apps
meta.homepage for python312Packages.marimo is: https://github.com/marimo-team/marimo
meta.changelog for python312Packages.marimo is: https://github.com/marimo-team/marimo/releases/tag/0.8.7
Updates performed

Ran passthru.UpdateScript

To inspect upstream changes
Impact
Checks done

built on NixOS
The tests defined in passthru.tests, if any, passed
found 0.8.7 with grep in /nix/store/a68l8waivahl62613wr4y98p2pnx7hix-python3.12-marimo-0.8.7
found 0.8.7 in filename of file in /nix/store/a68l8waivahl62613wr4y98p2pnx7hix-python3.12-marimo-0.8.7

Rebuild report (if merged into master) (click to expand)

4 total rebuild path(s)

4 package rebuild(s)

First fifty rebuilds by attrpath

marimo
python311Packages.marimo
python312Packages.marimo

Instructions to test this update (click to expand)

Either download from Cachix:
nix-store -r /nix/store/a68l8waivahl62613wr4y98p2pnx7hix-python3.12-marimo-0.8.7 \
  --option binary-caches 'https://cache.nixos.org/ https://nix-community.cachix.org/' \
  --option trusted-public-keys '
  nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
  cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
  '

(The Cachix cache is only trusted for this store-path realization.)
For the Cachix download to work, your user must be in the trusted-users list or you can use sudo since root is effectively trusted.
Or, build yourself:
nix-build -A python312Packages.marimo https://github.com/r-ryantm/nixpkgs/archive/d0ac07f516fbe997cbb47e1ff4550e32fafd6c43.tar.gz

Or:
nix build github:r-ryantm/nixpkgs/d0ac07f516fbe997cbb47e1ff4550e32fafd6c43#python312Packages.marimo

After you've downloaded or built it, look at the files and if there are any, run the binaries:
ls -la /nix/store/a68l8waivahl62613wr4y98p2pnx7hix-python3.12-marimo-0.8.7
ls -la /nix/store/a68l8waivahl62613wr4y98p2pnx7hix-python3.12-marimo-0.8.7/bin

Pre-merge build results
We have automatically built all packages that will get rebuilt due to
this change.
This gives evidence on whether the upgrade will break dependent packages.
Note sometimes packages show up as failed to build independent of the
change, simply because they are already broken on the target branch.
Result of nixpkgs-review run on x86_64-linux 1

4 packages built:

marimo (python312Packages.marimo)
marimo.dist (python312Packages.marimo.dist)
python311Packages.marimo
python311Packages.marimo.dist

Maintainer pings
cc @akshayka @dmadisetti for testing.

[!TIP]
As a maintainer, if your package is located under pkgs/by-name/*, you can comment @NixOS/nixpkgs-merge-bot merge to automatically merge this update using the nixpkgs-merge-bot.

Add a :+1: reaction to pull requests you find important.

updated in https://github.com/NixOS/nixpkgs/pull/338730


add logos for dark mode

In dark mode the logos still have a light background, to make it nicer we can add logos with a dark background to be displayed in dark mode.

fixed in #83


Send user back to oauth flow after login

Telescoping on https://github.com/chromaui/addon-visual-tests/pull/91
Relies on https://github.com/chromaui/chromatic/pull/7724 - ensure that after login the dialog doesn't auto close, instead it redirects you back to where you wanted to go (granting permission).

📦 Published PR as canary version: 0.0.81--canary.100.ecefb0c.0

:sparkles: Test out this PR locally via:
npm install<EMAIL_ADDRESS># or
yarn add<EMAIL_ADDRESS>

Apologies @tevanoff this branch got messed up as I responded to feedback. I've fixed it up via merging in https://github.com/chromaui/addon-visual-tests/pull/91 and checked my QA instructions do work! Thanks.


Multi colour OS images

What would you like to see added to CrabFetch?
I'd love to have multi colour os images
What use would this be?
Colourful images are much prettier to look at :)
Feature compatibility with fastfetch would be also great as I try to oxidize my sw stack
Additional Comments
So pretty

Not so pretty

Gonna see if I can rework this into a full redo of the ASCII coloring system, as it's too limiting for this to be a reality for now

Yes, I've seen that is is simplistic, just wanted to add a tracking issue


Reminder names are shared across sender_id

Rasa Core version: master
Python version:
Operating system (windows, osx, ...):
Issue:
Reminder names are shared across sender_id, so if one user sets a reminder with certain name, and another user sets it as well later, then only the second user gets this reminder
Content of domain file (if used & relevant):

@Ghostvv is this still a bug?

let's call it a design feature


grayscale  images, is its loss  normal?

,I use 64*64 grayscale images (not RGB) of Chinese characters, When training after a period of training the g_loss is a lot of bigger than d_loss,  is it  normal?

You can check the samples that are generated while the training is going on. Usually the d_loss and g_loss does have different scale with my code (this doesn't happen usually with others paper and code I guess). But if the loss doesn't converge or diverge, the samples are pretty good.

I am very puzzled, I put the celeba into gray, g_loss converge, and I used the mnist grayscale image test is also normal. Is it the problem of my pictures, the Chinese picture is generated using matlab,It is too strange.


Asynchronous JDBC

For example, can ormlite adapt to working with this library: https://github.com/jasync-sql/jasync-sql
But in general, how much work would it take to transform the library to both sync and async?

Hrm.  Interesting.  The idea is to have a thread pool and return futures for any operations that block?

Well, that's one way to do it since the current JDBC blocks.
Another way I thought about would be a combination of a thread pool and query queue. Although there will be limited number of threads (maybe per CPU threads), the query queue can grow to include thousands of queries.
And of course, there are Kotlin's coroutines -- could be also adapted to work in Java.
Finally, Oracle talked about ADBA back in 2016 (https://github.com/oracle/oracle-db-examples/tree/master/java/AoJ) so I suppose asynchronousity is, or will be, a reality soon enough.

Coroutines are a great way to tackle this issue, I think, and luckily there's a pure Java implementation for it: https://github.com/esoco/coroutines

I really don't want to add that as a dependency @noordawod .  Is there something we can do to simulate it?  What are the pattern(s) that we are trying to support?

If not coroutines, then I guess an Executor with a query queue. It should be straightforward as the existing code doesn't change, but we add a new ormlite-jdbc-async that orchestrates the asynchronousity. What do you think?
About patterns: I would say callback-based pattern at this point, the easiest.


Support Import from IPNS Paths

Is your feature request related to a problem? Please describe.
I've got DNSLink set up with one of my domains and I use it across multiple machines. If I want to add files to it through the WebUI I usually just add the domain as a directory in Files, modify it, and then update the DNSLink to the new hash. When I add the domain to Files, however, it only accepts hashes. Trying to enter /ipns/fake.example.domainname doesn't work.
On a similar, but more minor, note, the bar at the top for entering hashes to get information on also doesn't support IPNS.
Describe the solution you'd like
Entering /ipns/fake.example.domainname should automatically resolve the appropriate hash and then fail if it can't resolve it, rather than simply not working at all.
Describe alternatives you've considered
I generally run ipfs resolve /ipns/<domain name> manually to get the hash, or I go to the domain in a browser and copy the hash manually.
Additional context
Trying to add something to Files:

Trying to get information about an entry:

Yes, Add to MFS from /ipns/ will save me a time during my daily workflow. Its important enhancement.

closing in favor of https://github.com/ipfs/ipld-explorer-components/issues/400