Add CSR autosigning to kubevirt

What this PR does / why we need it:
In order to provide valid certificates to all our components, this PR copies and adjust the autoapprover controller for certificates from k8s. The approver watches sigining requests. Once it gets one, it checks if the requestor has access to the fictional certificatesigningrequests/kubevirt subresource. If yes, then it autosigns it if the common name and the orcanization in the request have a kubevirt.io:system prefix.
The cluster role which allows access to the fictional subresource looks like this:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubevirt.io:system:certificates.k8s.io:certificatesigningrequests:kubevirt
rules:
- apiGroups:
  - certificates.k8s.io
  resources:
  - certificatesigningrequests/kubevirt
  verbs:
  - create

Service accounts which need access can be added like this:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubevirt.io:system:bootstrap
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubevirt.io:system:certificates.k8s.io:certificatesigningrequests:kubevirt
subjects:
- kind: ServiceAccount
  name: kubevirt-controller
  namespace: kubevirt
- kind: ServiceAccount
  name: kubevirt-handler
  namespace: kubevirt
- kind: ServiceAccount
  name: kubevirt-apiserver
  namespace: kubevirt

virt-handler
virt-handler requests certificates on every start and uses a certificate manager to rotate certificates once the used certificate gets close to being expired. It does not care about reusing certificates. It just requests a new one on every start, because it will get a new IP on every start and we need a certificate which matches the IP.
virt-handler uses the certificate for:

authentication and encryption for migrations between two virt-handlers
providing valid certificate on it's rest API where for instance prometheus can scrape metrics

virt-controller
virt-controller requests a new certificate on every start too. Every virt-controller instance therefore has it's own valid certificate which matches its podIP.
virt-controller uses the certificate for:

providing valid certificate on it's rest API where for instance prometheus can scrape metrics

virt-api
virt-api uses the certificate for:

providing valid certificate on it's rest API where for instance prometheus can scrape metrics
authentication with the apiserver and itself when it acts as aggregated apiserver. The apiserver expects a certificate for the service it connects to. This means that we can use the serviceaccount CA and still be sure that only virt-api sits behind the service.

certificatesigningrequest cleanup
All components except virt-api use certificates in an ephemeral way. Once they start they request a new certificate. Old certificatesigningrequests are however not building up. k8s contains a CRS cleaner which will delete approved or denied requests after an hour. Pending requests will be deleted after 24 hours.
Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #1632 once the PR is done
Special notes for your reviewer:
Release note:

NONE

@davidvossel FYI

@davidvossel have now all pieces together. Working on tests now. It already contains securing migrations.

/hold
tests are missing.

@davidvossel I guess it would also make sense to have two types of certificates which require different rbac permissions, so that e.g. a virt-api certificate can't be used to connect to a virt-handler.

Question. Why not depend on cert-manager? I've had pretty good luck with it for provisioning all sorts of certs for user workload and plumbing up k8s webhooks. I'm already deploying it on my clusters, so it would be simpler for those of us that are using it to not have another system to have to manage.

https://cert-manager.readthedocs.io/en/latest/

Question. Why not depend on cert-manager? I've had pretty good luck with it for provisioning all sorts of certs for user workload and plumbing up k8s webhooks.

We are interested in certificates which are valid for all service-accounts (namely seen as valid by this ca: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt). Do you have an example on how I can sign CSRs with certificates of a specific form with it?

I'm already deploying it on my clusters, so it would be simpler for those of us that are using it to not have another system to have to manage.

It is part of the operator which you will soon need anyway, you should not notice it, if we properly test it.

Question, there looks like there is a bunch of copied code from the kubernetes signing service (all the files with the kubernetes copyright message), what are the plans on keeping that up to date with kubernetes as it evolves, in particular what if a CVE is discovered in that code (how do we know it affects us)

We have two things here, the certificat controller sceleton, which does not contain security sensitive logic. This one may contain errors, but  that would only result in delays when waiting for certificates to be signed (e.g. an update miss, or the other extreme would be being rate-limited). It is a standard controller without any surprises, like the others which we have in kubevirt.
The security critical part is the approver itself, which is based on the one from k8s but heavily modified. It could, if there are issues, sign wrong certificates. It comes with the usual responsibilities (bad), but there will very likely be no match with k8s CVEs.

in particular what if a CVE is discovered in that code

And of course we heavily depend on client-go, which we should update on  a regular bases.

I'm still in the process of reviewing. I just wanted to point out one isolated CI failure.
â€¢ Failure [16.198 seconds]
Infrastructure
/root/go/src/kubevirt.io/kubevirt/tests/infra_test.go:51
  Prometheus Endpoints
  /root/go/src/kubevirt.io/kubevirt/tests/infra_test.go:61
    should provide a valid certificate
    /root/go/src/kubevirt.io/kubevirt/vendor/github.com/onsi/ginkgo/extensions/table/table.go:92
      on virt-controller [It]
      /root/go/src/kubevirt.io/kubevirt/vendor/github.com/onsi/ginkgo/extensions/table/table_entry.go:46

      Expected success, but got an error:
          <*errors.errorString | 0xc00098b6e0>: {
              s: "failed to forward ports, timed out",
          }
          failed to forward ports, timed out

      /root/go/src/kubevirt.io/kubevirt/tests/infra_test.go:88

Having permission to sign CSRs seems like risky business to me. Someone with permission to create a CSR (but not sign) and exec into our pod could basically become system:admin. Do any other projects do this?

Only the operator has the right to do that, and the operator checks if the right component asks for a signed cert, and if the cert has the expected form.
In general the whole cluster bootstrapping is done this way.

Using a cluster-signed cert for prometheus is nice, but having all this infrastructure for it seems a little "extra" to me (barring security concerns above). What is the threat model there? With a self-signed cert, we are vulnerable to man in the middle. If someone snoops our stats is that a big deal? The prometheus UI is insecure by default. Someone could modify our stats. Okay. What's the worst thing that could happen because of that? Maybe use a self-signed cert for default but give users the ability to replace it with signed certs? How are other projects dealing with this?

It is less about prometheus per-se. Simply all endpoints exposed should provide a valid cert nowadays, so that you know with whom you talk. It just happens that some of our components right now only expose prometheus endpoints. Every component with a service account has access to the cluster CA, which means that everyone can check if the certificates are valid or not.

Regarding the virt-handler to virt-handler TLS communication: I think I see one problem with the current implementation. You really only want virt-handlers talking to each other, right? But as far as I can tell, they'll accept connections from any client with a cluster cert. At a minimum, you should validate the name associated with the cert. Which means it may be best that the virt-handler not use the same cert for server and client communications (typically best practice in my experience). I would also not bother with the cluster CA here as we have control of both sides of the communication and we don't care about (don't want!) other components dialing in securely.

Yes I should validate the name, I actually thought I do, thanks. It does not change much if I have different certs for client and server purposes. The private key for the cert of a component is in the pod of the component. If you manage to get access you would have both certs. What I should differentiate is between virt-handler and ordinary services on the signing level.

Lastly, I assume when you say that there is no way to rotate certs for virt-api, you mean without a little downtime?

Yes, but I was wrong there, I will soon update the PR.

Having permission to sign CSRs seems like risky business to me. Someone with permission to create a CSR (but not sign) and exec into our pod could basically become system:admin. Do any other projects do this?

Oh wait, did not fully parse your sentence the first time. That is not the case. A certificate is bound to a service account. So the apiserver and other kube components see on the certifcate to which user the certificate belongs. If you manage to create a certificate in the form like the apiserver expects it, so that you can use it for authentication, then you only get exactly the same permissions like the service-account. But you already have the access token for the service account in the cluster anyway, if you can do exec.

Oh wait, did not fully parse your sentence the first time. That is not the case. A certificate is bound to a service account. So the apiserver and other kube components see on the certifcate to which user the certificate belongs. If you manage to create a certificate in the form like the apiserver expects it, so that you can use it for authentication, then you only get exactly the same permissions like the service-account. But you already have the access token for the service account in the cluster anyway, if you can do exec.

Still not detailed enough. Our signer checks if the common name starts with kubevirt.io:system and the group is kubevirt.io:system, so it can't sign something like system:admin. That means that there are not certificates in the component which would have privileges, or a matching service account name. If however service account name and common name would match, and i would have exatcly the expected from for apiserver authentication you would at max get the rights of the service account.

The prometheus UI is insecure by default. Someone could modify our stats. Okay. What's the worst thing that could happen because of that? Maybe use a self-signed cert for default but give users the ability to replace it with signed certs? How are other projects dealing with this?

Here let me highlight, that if I am able to somehow inject scrape targets into the system-monitor chain (which we are at the end integrated with), it is very easy to do something like DOS attacks. You can basically deliberately disable monitoring, which can have interesting side-effects in fully automated systems which try to heal or scale themselves. Nowadays you want to know with whom you talk.

not use the same cert for server and client communications (typically best practice in my experience)

On thinking about it again, for virt-handler it does not make any difference, but for the other components it does. Let me separate them.

@mhenriks @davidvossel did the following changes now:

cluster services only have a cert which can be uses for servers
virt-handler now verifies if the client certificate is really from another virt-handler
the certificate approver now differentiates between service accounts and what they are allowed to request
virt-api now also uses the certificate manager. It eliminates the need for our secret for storing certs. The apiserver only connects to the aggregation service, if the server certificate from the extension service is valid for the service name.

Still not detailed enough. Our signer checks if the common name starts with kubevirt.io:system and the group is kubevirt.io:system, so it can't sign something like system:admin.

I understand that our code will not sign a CSR with a CN of admin.  My concern is someone could exec into the pod (or get a shell through some sort of security flaw) and sign an admin CSR they created them self.  Perhaps this is unlikely, but it would be catastrophic.  There is no way to revoke certs.  Would have to replace all existing certs.
Basically, security/usability is always a trade off.  I personally think the risk of signing cluster certs could outweigh the benefits.  From Kubernetes docs:

A Word of Warning on the Approval Permission
The ability to approve CSRs decides who trusts who within the cluster. This includes who the Kubernetes API trusts. The ability to approve CSRs should not be granted broadly or lightly. The requirements of the challenge noted in the previous section and the repercussions of issuing a specific certificate should be fully understood before granting this permission. See here for information on how certificates interact with authentication.

Perhaps on OpenShift it makes mores sense to integrate with this stuff for prometheus services:  https://docs.okd.io/latest/dev_guide/secrets.html#service-serving-certificate-secrets

I am not sure if you are aware of it, but signers are rbac based. To get an admin cert signed by k8s you need the k8s bootstrap rbac permissions, you also need our kubevirt rbac permission to get our certs signed. The k8s and kubevirt signers check these permissions, and of course our service accounts don't have it.

And indeed that would be catastrophic otherwise, no matter if it would be unlikely or not.

Perhaps on OpenShift it makes mores sense to integrate with this stuff for prometheus services:

This works only for OpenShift and would require us to solve the certificate rotation in our code instead of using the client-go library. Further we have no influence at the exact Form of the certificate. E.g. getting a certificate with pod ip (a lot of traffic is pod to pod and not pod to service) , only specific DNS names, and so on.

Question. Why not depend on cert-manager? I've had pretty good luck with it for provisioning all sorts of certs for user workload and plumbing up k8s webhooks.

We are interested in certificates which are valid for all service-accounts (namely seen as valid by this ca: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt).

Why? In the description above for the needs of virt-handler, virt-controller and virt-api, I don't see where it must be the serviceaccount ca? That can be bad as it would couple two security subsystems that don't seem to need each other. Did I miss something?

Do you have an example on how I can sign CSRs with certificates of a specific form with it?

Which specific form do you need? Mostly you use the Issuers and Certificate objects:
https://docs.cert-manager.io/en/latest/reference/issuers.html
https://docs.cert-manager.io/en/latest/reference/certificates.html
Issuers allow you to setup your own ca's or point at external ones like letsencrypt.
Certificates then generate the csr/private keys, work with an issuer to get a signed cert, and place the cert/key in a secret.

I'm already deploying it on my clusters, so it would be simpler for those of us that are using it to not have another system to have to manage.

It is part of the operator which you will soon need anyway, you should not notice it, if we properly test it.

-1. just because its hidden, doesn't mean that its good to have two parallel implementations of security code. As a user that cares about security, I still need to audit to some level every implementation that goes into my clusters.

Why? In the description above for the needs of virt-handler, virt-controller and virt-api, I don't see where it must be the serviceaccount ca? That can be bad as it would couple two security subsystems that don't seem to need each other. Did I miss something?

Since kubevirt is a k8s addon and not an arbitrary application it is tied to k8s. You want to rotate certs with the k8s-wide default. You should be able to integrate it with existing cluster-level metrics prometheus, which is differerent than app-level prometheus, and you should not have to setup your own cert-signing and rotation system for that. It is error-prone. We can validate that it works here with a k8s provided system.

-1. just because its hidden, doesn't mean that its good to have two parallel implementations of security code.

In general agreed, the benefit is not that it is hidden. The benefit is that there is no extra mechanism compared to the k8s bootstrapping and rotation mechanism. CSR is there anyway from k8s. Are you deliberately disabling it? It is normally used by the k8s infra. In contrast to cert-manager it is there already. CSRs work always the same way for all clusters. It is the way to get certs in a unified way for infrastructure (an kubevirt is infrastructure).
What if the next user comes with another certificate managing mechanism? How should we verify that users have a secure setup? How should users do that? How should we tie us into the certificate rotate policy of a k8s cluster? Why would you want different settings for kubevirt than for the k8s cluster itself?

As a user that cares about security, I still need to audit to some level every implementation that goes into my clusters.

With CSRs we get an integrated and tested way for cert signing, rotation, integration with other infra components and we can issue very fine-grained certficates in a simple way (e.g. tls servers which are only valid on this very pod IP). I for instance also expect that kubevirt only assigns RBAC permissions to components that are needed. I don't expect that I have to do extra setup that rbac is setup for kubevirt the right way. Given, rbac is a little bit easier to discover and to review, but in both cases we can't assume that every admin can understand and correctly setup all these low-level details for his/her preferred system. Luckily CSRs are always there.

Issuers allow you to setup your own ca's or point at external ones like letsencrypt.

Can I create an issuer which creates certificates for pod IPs? Can I rotate them tied together with the k8s rotate policy?

Why? In the description above for the needs of virt-handler, virt-controller and virt-api, I don't see where it must be the serviceaccount ca? That can be bad as it would couple two security subsystems that don't seem to need each other. Did I miss something?

Since kubevirt is a k8s addon and not an arbitrary application it is tied to k8s. You want to rotate certs with the k8s-wide default. You should be able to integrate it with existing cluster-level metrics prometheus, which is different than app-level prometheus, and you should not have to setup your own cert-signing and rotation system for that. It is error-prone. We can validate that it works here with a k8s provided system.

So the main concern is around metrics gathering?
Configuring prometheus with two ca's rather then one is not a huge lift I think.
If its just to validate endpoints, I think its a much grater risk to tie serviceccount creation/signing code with general certificate issuance.
cert-manager provides automatic certificate rotation. I think even by default.

-1. just because its hidden, doesn't mean that its good to have two parallel implementations of security code.

In general agreed, the benefit is not that it is hidden. The benefit is that there is no extra mechanism compared to the k8s bootstrapping and rotation mechanism. CSR is there anyway from k8s. Are you deliberately disabling it? It is normally used by the k8s infra. In contrast to cert-manager it is there already. CSRs work always the same way for all clusters. It is the way to get certs in a unified way for infrastructure (an kubevirt is infrastructure).

This is fair. At minimal I think it would be better not to share the CA though in that case. The service account ca is used to authenticate workloads to k8s's api. This use case seems different then that.
The more k8s clusters I deploy though the harder it has been for me to avoid pluming it up to letsencrypt or something similar to get certificates for workload. Which means its more of a given these days.

What if the next user comes with another certificate managing mechanism?

There can always be more implementations. Thats why you try and work towards a standard/generic implementation like cert-manager to standardize an api so that people can stop reinventing the wheels. The same argument was made a while ago for k8s. Why target just k8s's api when someone could provide a mesos or whatever? :) The answer is, plugin that other certificate managing mechanism as an issuer in cert-manager. the api is agnostic.

How should we verify that users have a secure setup? How should users do that? How should we tie us into the certificate rotate policy of a k8s cluster? Why would you want different settings for kubevirt than for the k8s cluster itself?

I don't think everyone agree's k8s's built in certificate signing plumbing is the most secure and I believe some don't use it. I don't think it gives you the guarantees you are assuming it does. I do use it myself. Just playing devils advocate.

As a user that cares about security, I still need to audit to some level every implementation that goes into my clusters.

With CSRs we get an integrated and tested way for cert signing, rotation, integration with other infra components and we can issue very fine-grained certficates in a simple way (e.g. tls servers which are only valid on this very pod IP). I for instance also expect that kubevirt only assigns RBAC permissions to components that are needed. I don't expect that I have to do extra setup that rbac is setup for kubevirt the right way. Given, rbac is a little bit easier to discover and to review, but in both cases we can't assume that every admin can understand and correctly setup all these low-level details for his/her preferred system. Luckily CSRs are always there.

Yes/no. Your having to implement a whole parallel version of it to get it. So, its not just there. But I get what you are saying.

Issuers allow you to setup your own ca's or point at external ones like letsencrypt.

Can I create an issuer which creates certificates for pod IPs? Can I rotate them tied together with the k8s rotate policy?

pod ip's, yeah. https://docs.cert-manager.io/en/latest/reference/api-docs/index.html ipAddresses field.
k8s rotate policy, not sure. Validity time should be an issuer configuration option.
one other possibility while we're discussing it. For some of the use case, spire might be a fit too. its under the cncf: https://spiffe.io/spire/

@kfox1111
How would you feel about us providing two paths for kubevirt cert management?  One where the operator perforce csr approval as Roman is doing here. Then another where it's a "bring your own certs" type scenario where the operator does not have csr approval permissions.
With the latter, the admin would have to tell the operator up front where the cert secrets for each component (virt-handler, virt-controller, virt-api) are located.  Those certs could be managed by cert-manager, or whatever else. It's just up to the admin installing kubevirt to wire that up appropriately in that case.
For others who are comfortable assuming the risk associated with the KubeVirt csr auto-approve, they can opt into us managing that for them.

Yeah, if the internal code to do the csr stuff can be shut off entirely and there is a documented/tested way to bring your own certs, I'm cool with that. Ideally these wouldn't be two different code paths. The internal provisioning would provision it the same way external provisioning would work, so it wouldn't be 2x the code or one path that doesn't get tested frequently/gets broken.

Yeah, if the internal code to do the csr stuff can be shut off entirely and there is a documented/tested way to bring your own certs, I'm cool with that.

Yes that would be the plan.

Ideally these wouldn't be two different code paths. The internal provisioning would provision it the same way external provisioning would work, so it wouldn't be 2x the code or one path that doesn't get tested frequently/gets broken.

It would be mostly the same code. Yes testing that in CI is definitely part of it.

It would be mostly the same code. Yes testing that in CI is definitely part of it.

just fyi, we already have a functional test that is messing with re-deploying the operator with different parameters and re-installing kubevirt, so there's a precedence for functionally testing things at this level already.

/remove-lifecycle rotten


new option for a column wrapper

could you add a option to specify the individual column wrapper.  something like -colwrap ":" or even -colwrap "" to ingore.   We have an issue with the conversion now where if double quotes are contained in the data but that do not completely wrap the data then the row does not properly parse with the -colsep option.
Also, I noticed that number fields when coverted get an exclamation point as to say they should be number but the are actually not being treated that way.

Can you show example file / template that show this problem?

I'm closing. No response for long time


Investigate tagging and add github action for versioning and npm

@HunnySajid will investigate and implement

@HunnySajid please provide a summary of your findings

@HunnySajid will use the main branch as the latest and tag a dev release each time a PR is accepted to main.
We will manually tag/branch for RC and Stable releases.

https://github.com/WebOfTrust/polaris-web/pull/2
Inorder to run through the workflows we have to add following variables
Add NPM_PACKAGE_NAME & NPM_TOKEN in:
Settings > Secrets & Variables > Repository Variables
Settings > Secrets & Variables > Repository Secrets
respectively

@HunnySajid what do we have left to complete this?


TLS handshake failed

Sun Dec 18 02:21:46 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
Sun Dec 18 02:21:46 2016 Windows version 6.2 (Windows 8 or greater) 64bit
Sun Dec 18 02:21:46 2016 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.09
Sun Dec 18 02:21:46 2016 MANAGEMENT: TCP Socket listening on [AF_INET]<IP_ADDRESS>:25341
Sun Dec 18 02:21:46 2016 Need hold release from management interface, waiting...
Sun Dec 18 02:21:46 2016 MANAGEMENT: Client connected from [AF_INET]<IP_ADDRESS>:25341
Sun Dec 18 02:21:46 2016 MANAGEMENT: CMD 'state on'
Sun Dec 18 02:21:46 2016 MANAGEMENT: CMD 'log all on'
Sun Dec 18 02:21:46 2016 MANAGEMENT: CMD 'hold off'
Sun Dec 18 02:21:46 2016 MANAGEMENT: CMD 'hold release'
Sun Dec 18 02:21:46 2016 WARNING: Your certificate is not yet valid!
Sun Dec 18 02:21:46 2016 Control Channel Authentication: tls-auth using INLINE static key file
Sun Dec 18 02:21:46 2016 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Sun Dec 18 02:21:46 2016 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Sun Dec 18 02:21:46 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Dec 18 02:21:46 2016 UDPv4 link local: [undef]
Sun Dec 18 02:21:46 2016 UDPv4 link remote: [AF_INET]<IP_ADDRESS>:1194
Sun Dec 18 02:21:46 2016 MANAGEMENT: >STATE:1482024106,WAIT,,,
Sun Dec 18 02:21:46 2016 MANAGEMENT: >STATE:1482024106,AUTH,,,
Sun Dec 18 02:21:46 2016 TLS: Initial packet from [AF_INET]<IP_ADDRESS>:1194, sid=c6fffc0e 4c5088f1
Sun Dec 18 02:21:46 2016 VERIFY ERROR: depth=1, error=certificate is not yet valid: CN=ChangeMe
Sun Dec 18 02:21:46 2016 OpenSSL: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Sun Dec 18 02:21:46 2016 TLS_ERROR: BIO read tls_read_plaintext error
Sun Dec 18 02:21:46 2016 TLS Error: TLS object -> incoming plaintext read error
Sun Dec 18 02:21:46 2016 TLS Error: TLS handshake failed
Sun Dec 18 02:21:46 2016 SIGUSR1[soft,tls-error] received, process restarting
Sun Dec 18 02:21:46 2016 MANAGEMENT: >STATE:1482024106,RECONNECTING,tls-error,,
Sun Dec 18 02:21:46 2016 Restart pause, 2 second(s)
Sun Dec 18 02:21:48 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Dec 18 02:21:48 2016 UDPv4 link local: [undef]
Sun Dec 18 02:21:48 2016 UDPv4 link remote: [AF_INET]<IP_ADDRESS>:1194
Sun Dec 18 02:21:48 2016 MANAGEMENT: >STATE:1482024108,WAIT,,,
Sun Dec 18 02:21:49 2016 MANAGEMENT: >STATE:1482024109,AUTH,,,
Sun Dec 18 02:21:49 2016 TLS: Initial packet from [AF_INET]<IP_ADDRESS>:1194, sid=b60c4eb5 99b13093
Sun Dec 18 02:21:49 2016 VERIFY ERROR: depth=1, error=certificate is not yet valid: CN=ChangeMe
Sun Dec 18 02:21:49 2016 OpenSSL: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Sun Dec 18 02:21:49 2016 TLS_ERROR: BIO read tls_read_plaintext error
Sun Dec 18 02:21:49 2016 TLS Error: TLS object -> incoming plaintext read error
Sun Dec 18 02:21:49 2016 TLS Error: TLS handshake failed
Sun Dec 18 02:21:49 2016 SIGUSR1[soft,tls-error] received, process restarting
Sun Dec 18 02:21:49 2016 MANAGEMENT: >STATE:1482024109,RECONNECTING,tls-error,,
Sun Dec 18 02:21:49 2016 Restart pause, 2 second(s)
Sun Dec 18 02:21:51 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Dec 18 02:21:51 2016 UDPv4 link local: [undef]
Sun Dec 18 02:21:51 2016 UDPv4 link remote: [AF_INET]<IP_ADDRESS>:1194
Sun Dec 18 02:21:51 2016 MANAGEMENT: >STATE:1482024111,WAIT,,,
Sun Dec 18 02:21:51 2016 MANAGEMENT: >STATE:1482024111,AUTH,,,
Sun Dec 18 02:21:51 2016 TLS: Initial packet from [AF_INET]<IP_ADDRESS>:1194, sid=7c277811 d50b1a33
Sun Dec 18 02:21:51 2016 VERIFY ERROR: depth=1, error=certificate is not yet valid: CN=ChangeMe
Sun Dec 18 02:21:51 2016 OpenSSL: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Sun Dec 18 02:21:51 2016 TLS_ERROR: BIO read tls_read_plaintext error
Sun Dec 18 02:21:51 2016 TLS Error: TLS object -> incoming plaintext read error
Sun Dec 18 02:21:51 2016 TLS Error: TLS handshake failed
Sun Dec 18 02:21:51 2016 SIGUSR1[soft,tls-error] received, process restarting
Sun Dec 18 02:21:51 2016 MANAGEMENT: >STATE:1482024111,RECONNECTING,tls-error,,
Sun Dec 18 02:21:51 2016 Restart pause, 2 second(s)

The certificate can't be verified, can you try to reinstall OpenVPN using the script ?

I did twice now, I can not remember experiencing this issue before (with older scripts).
Using Debian 7.

And which client are you using ?

OpenVPN Default Client i guess.

tried using asus merlin as well.
Dec 19 02:10:31 openvpn[1003]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Dec 19 02:10:31 openvpn[1003]: Socket Buffers: R=[122880->122880] S=[122880->122880] Dec 19 02:10:31 openvpn[1003]: UDPv4 link local: [undef] Dec 19 02:10:31 openvpn[1003]: UDPv4 link remote: [AF_INET]<IP_ADDRESS>:1194 Dec 19 02:10:31 openvpn[1003]: TLS: Initial packet from [AF_INET]<IP_ADDRESS>:1194, sid=6d928852 19c0370c Dec 19 02:10:31 openvpn[1003]: VERIFY ERROR: depth=1, error=certificate is not yet valid: CN=ChangeMe Dec 19 02:10:31 openvpn[1003]: OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed Dec 19 02:10:31 openvpn[1003]: TLS_ERROR: BIO read tls_read_plaintext error Dec 19 02:10:31 openvpn[1003]: TLS Error: TLS object -> incoming plaintext read error Dec 19 02:10:31 openvpn[1003]: TLS Error: TLS handshake failed Dec 19 02:10:31 openvpn[1003]: SIGUSR1[soft,tls-error] received, process restarting Dec 19 02:10:31 openvpn[1003]: Restart pause, 2 second(s) Dec 19 02:10:33 openvpn[1003]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Dec 19 02:10:33 openvpn[1003]: Socket Buffers: R=[122880->122880] S=[122880->122880] Dec 19 02:10:33 openvpn[1003]: UDPv4 link local: [undef] Dec 19 02:10:33 openvpn[1003]: UDPv4 link remote: [AF_INET]<IP_ADDRESS>:1194 Dec 19 02:10:33 openvpn[1003]: TLS: Initial packet from [AF_INET]<IP_ADDRESS>:1194, sid=c7dc7c46 7ba56fad Dec 19 02:10:33 openvpn[1003]: VERIFY ERROR: depth=1, error=certificate is not yet valid: CN=ChangeMe Dec 19 02:10:33 openvpn[1003]: OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed Dec 19 02:10:33 openvpn[1003]: TLS_ERROR: BIO read tls_read_plaintext error Dec 19 02:10:33 openvpn[1003]: TLS Error: TLS object -> incoming plaintext read error Dec 19 02:10:33 openvpn[1003]: TLS Error: TLS handshake failed Dec 19 02:10:33 openvpn[1003]: SIGUSR1[soft,tls-error] received, process restarting Dec 19 02:10:33 openvpn[1003]: Restart pause, 2 second(s)

And here is a screenshot of my router settings @Angristan http://i.imgur.com/bgaomsj.png

OpenVPN Default Client i guess.

What ? Which device and OS ?
You should have said it's your router. Maybe the OpenVPN client used is not compatible. Try to remove the tls 1.2 line from the config files

I also tried using Windows 10. I'm trying different services, none seem to work.
Here is a full log: http://pastebin.com/duRuYn78

That's obviously a problem with the certificate. Did you modify the client configuration ?

I did not modify anything, i literally just clicked enter during the entire installation then grabbed the certificate. @Angristan

Certificate, i mean the client.ovpn and put it in C:\Program Files\OpenVPN\config like I have with all other installations. I have never experienced this issue before.
I'm starting to think it's my server, but seems rather weird if it would be. Debian 7.

That's really weird, I can't see what's wrong. I you try to add a client certificate, and then connect with it, do you have the problem ?

I think the issue might occur from my server, so instead of spamming this github with issues I'll close it then come back when I have a solution @Angristan

@Octolus can I (we?) know why you think it comes with the server?
Is the server a fresh install?

@Octolus If you happen to have the issue again, please check if there is errors at the setup

It is a fresh install yes @Kcchouette i went to install Softether VPN instead and it seems to work fine. Had to enable secure nat in that one, it had that TLS error. After enabling "secure nat" within Softether it worked.

I also get error when setup my OVH VPS the log similar with the one @Octolus post. There is similar problem with Nyr original code. I solved this problem by correcting system and hardware time on my VPS.
The details can be accessed here: https://github.com/Nyr/openvpn-install/issues/158

Indeed : "certificate is not yet valid".


Add support for hikari cp, upgrade c3p0 library, break static dependencies

Replaces #20
Add a connection provider for HikariCP
Update to latest C3p0
Break static dependecies on C3p0 so that it isn't required on the class path even if you're not using it
Also addresses minor concerns in #19

how can i activate the hikaricp pool in my quartz.properties?

@stefanwendelmann  If you are still looking for an answer, we recently switched quartz to use Hikaricp and do it as below (we use Spring for IoC)
//Create the datasource
  @Bean(destroyMethod = "close")   @DependsOn("flyway")   public HikariDataSource hikariDataSource() {     HikariConfig config = new HikariConfig();     config.setJdbcUrl(env.getProperty("database.url", "jdbc_url....."));     config.setDriverClassName("driver class name...");     config.setUsername(env.getProperty("database.username", "username..."));     config.setPassword(env.getProperty("database.password", "password..."));     config.setMinimumIdle(env.getProperty("database.connectionPool.size.min", Integer.class, 5));     config.setMaximumPoolSize(env.getProperty("database.connectionPool.size.max", Integer.class, 10));     config.setMetricRegistry(metricRegistry);     config.setAutoCommit(false);     return new HikariDataSource(config);   }
And then inject the datasource as below
`
@Bean
@Profile(value = {"prod"})
public SchedulerFactoryBean schedulerFactoryBean(DataSource hikariDataSource,
PlatformTransactionManager transactionManager) {
SchedulerFactoryBean schedulerFactoryBean = new SchedulerFactoryBean();
setSchedulerParameters(hikariDataSource, transactionManager, schedulerFactoryBean);
return schedulerFactoryBean;

}`

On Mon, Aug 21, 2017 at 8:48 AM, Stefan<EMAIL_ADDRESS>wrote:

how can i activate the hikaricp pool in my quartz.properties?

Stefan, try adding the following:
org.quartz.dataSource.myDS.connectionProvider.class=org.quartz.utils.HikariCpPoolingConnectionProvider
If you need more example, see
org.quartz.utils.HikariCpPoolingConnectionProviderTest
--Zemian

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/quartz-scheduler/quartz/pull/126#issuecomment-323735963,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AVOkkDbPm17Bo6dyZGQ5Mv4SipCjdIxMks5saXykgaJpZM4M-X-l
.

My project already uses Hikari CP.  When I upgraded Quartz from 2.2.2 to 2.3.0, it started breaking in strange ways.  It was very difficult for me to track down the problem.
It turns out that this is because Quartz now includes dependence on HikariCP-java6-2.3.13, but I want to be using the more recent, java8 version, HikariCP-2.7.2.
I suppose I can add an "exclusion" when importing Quartz via Maven and then manually add my own version of Hikari.  But will this break Quartz?

For those who still have issues with HirakiCP, you can see https://github.com/quartz-scheduler/quartz/issues/294 for solutions.


Switch over target on which server is open for

Hi @avanderhoorn, I'm your friendly neighborhood .NET Foundation Pull Request Bot (You can call me DNFBOT). Thanks for your contribution!
You've already signed the contribution license agreement. Thanks!
We will now validate the agreement and then real humans will evaluate your PR.
TTYL, DNFBOT;

:shipit:

Merged.


Static Asset Handling not returning the correct path

Describe the bug
I am using Vite with my Vue project.
I am trying to link an image with a dynamic url path, received as a prop.
The image is a svg file, located in the directory /src/assets/icons.
As described at the bottom of the guide, I wrote this code:
<template>
  <img :src="url" :class="'noselect ' + (clickable ? 'clickable' : '')" :alt="icon">
</template>

<script setup>
import { computed } from 'vue';

const { icon } = defineProps({
  icon: {
    type: String,
    required: true
  },

  clickable: {
    type: Boolean,
    default: false
  }
});

const url = computed(() => new URL(`../../assets/icons/${icon}.svg`, import.meta.url).href);
</script>

(Ignore the immediate deconstruction and reactivity break of props, this is just a test)
After building the project, the final URL retrieved from inspecting the HTML is this:
http://localhost:3000/[object%20Object]
There seems to be an issue with converting the path when using a string template. With a string literal, this issue does not appear.
This issue does not appear in development, only after building the project.
In vite.config.js, I've set the build.target and optimizeDeps.esbuildOptions.target to "es2020".
(Furthermore, there is a typo at the very last word of the last yellow box in the linked guide: "partten" instead of "pattern")
Reproduction
https://stackblitz.com/edit/vite-sex4fy?file=src/App.vue
System Info
System:
    OS: Linux 5.17 Artix Linux
    CPU: (4) x64 Intel(R) Core(TM) i3-6100 CPU @ 3.70GHz
    Memory: 1.89 GB / 7.73 GB
    Container: Yes
    Shell: 5.1.16 - /bin/bash
  Binaries:
    Node: 14.19.2 - /usr/bin/node
    Yarn: 1.22.18 - /usr/bin/yarn
    npm: 8.5.5 - /usr/bin/npm
  Browsers:
    Brave Browser: <IP_ADDRESS>
    Firefox: 100.0
  npmPackages:
    @vitejs/plugin-vue: ^2.3.1 => 2.3.1
    vite: ^2.9.6 => 2.9.6

Used Package Manager
npm
Logs
No response
Validations

[X] Follow our Code of Conduct
[X] Read the Contributing Guidelines.
[X] Read the docs.
[X] Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
[X] Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to https://github.com/vuejs/core instead.
[X] Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
[X] The provided reproduction is a minimal reproducible example of the bug.

after update vite version, it can work well. https://stackblitz.com/edit/vite-44nvna?file=package.json

I did as well... could it be that the issue appears because I'm building the dist directory one level up? This is my vite.config.js
import { fileURLToPath, URL } from 'url'
import { defineConfig } from 'vite'
import vue from '@vitejs/plugin-vue'
import svgLoader from 'vite-svg-loader'

// https://vitejs.dev/config/
export default defineConfig({
  plugins: [vue(), svgLoader()],
  resolve: {
    alias: {
      '@': fileURLToPath(new URL('./src', import.meta.url)),
      'D#': fileURLToPath(new URL('./src/components/desktop', import.meta.url)),
      'M#': fileURLToPath(new URL('./src/components/mobile', import.meta.url)),
      'U#': fileURLToPath(new URL('./src/components/ui', import.meta.url)),
      'S#': fileURLToPath(new URL('./src/stores', import.meta.url)),
    }
  },

  css: {
    preprocessorOptions: {
      sass: {
        additionalData: `
          @use "/src/assets/sass/variables" as *
        `
      }
    }
  },

  build: {
    outDir: "../dist",
    target: "es2020",
    emptyOutDir: true
  },

  optimizeDeps: {
    esbuildOptions: {
      target: "es2020"
    }
  }
})

Is also appear?

I figured it out. The issue arose because I was only referencing files in the assets folder with template strings, but Vite only puts in the final dist directory the files that are directly referenced. Moving these files to the public directory and using absolute path fixed this.

I figured it out. The issue arose because I was only referencing files in the assets folder with template strings, but Vite only puts in the final dist directory the files that are directly referenced. Moving these files to the public directory and using absolute path fixed this.

can you share the code how you figured it out?

I figured it out. The issue arose because I was only referencing files in the assets folder with template strings, but Vite only puts in the final dist directory the files that are directly referenced. Moving these files to the public directory and using absolute path fixed this.

can you share the code how you figured it out?

I don't have the code anymore as I just placed the assets in the public folder, but I figured it out by manual testing: by specifying a static path (i.e, without string template syntax with backticks), then the asset was correctly handled by Vite and put in the assets folder. When using template syntax, Vite didn't pull any of the assets because they were never directly referenced in the entire codebase, so that lead me into thinking that the template syntax only works for assets that are already pulled in by something else, and doesn't work if that's not the case.


Check margin of dt code

https://docs.typo3.org/typo3cms/CoreApiReference/ApiOverview/Mail/Index.html#smtp

The 5px margin should be removed for non-bordered styles.

Fixed in https://github.com/TYPO3-Documentation/t3SphinxThemeRtd/commit/dbf0b3eee7f4a8e4471b3038dd3f08e74f3959b4


download with cookie file issue

Please follow the guide below

You will be asked some questions and requested to provide some information, please read them carefully and answer honestly
Put an x into all the boxes [ ] relevant to your issue (like that [x])
Use Preview tab to see how your issue will actually look like

Make sure you are using the latest version: run youtube-dl --version and ensure your version is 2<IP_ADDRESS>. If it's not read this FAQ entry and update. Issues with outdated version will be rejected.

[x] I've verified and I assure that I'm running youtube-dl 2<IP_ADDRESS>

Before submitting an issue make sure you have:

[x] At least skimmed through README and most notably FAQ and BUGS sections
[x] Searched the bugtracker for similar issues including closed ones

What is the purpose of your issue?

[x] Bug report (encountered problems with youtube-dl)
[ ] Site support request (request for adding support for a new site)
[ ] Feature request (request for a new functionality)
[ ] Question
[ ] Other

The following sections concretize particular purposed issues, you can erase any section (the contents between triple ---) not applicable to your issue

If the purpose of this issue is a bug report, site support request or you are not completely sure provide the full verbose output as follows:
Add -v flag to your command line you run youtube-dl with, copy the whole output and insert it here. It should look similar to one below (replace it with your log inserted between triple ```):
youtube-dl --no-cache-dir --cookies ~/Downloads/cookies.txt --print-traffic --dump-pages --verbose https://www.permaskills.net/opening-credits/
[debug] System config: []
[debug] User config: []
[debug] Command-line args: [u'--no-cache-dir', u'--cookies', u'/Users/REDACTED_USER/Downloads/cookies.txt', u'--print-traffic', u'--dump-pages', u'--verbose', u'https://www.permaskills.net/opening-credits/']
[debug] Encodings: locale UTF-8, fs utf-8, out UTF-8, pref UTF-8
[debug] youtube-dl version 2<IP_ADDRESS>
[debug] Python version 2.7.10 - Darwin-15.6.0-x86_64-i386-64bit
[debug] exe versions: ffmpeg 3.1.3, ffprobe 3.1.3
[debug] Proxy map: {}
[generic] opening-credits: Requesting header
send: u'HEAD /opening-credits/ HTTP/1.1\r\nAccept-Language: en-us,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nConnection: close\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0) Gecko/20150101 Firefox/47.0 (Chrome)\r\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\nHost: www.permaskills.net\r\nCookie: aelia_cs_selected_currency=USD; _icl_current_language=en; wp_woocommerce_session_REDACTED_SESSION=0c0083348774aaaf2bf5d23f5476779e%7C%7C1473230243%7C%7C1473226643%7C%7Cc7751da811dbf96efaa7d7cdad749892; CookieInfo=accepted; _sp_id.5f60=d0ade15174846918.1472473356.21.1473160800.1473154299; _sp_ses.5f60=*\r\n\r\n'
reply: 'HTTP/1.1 404 Not Found\r\n'
header: Date: Tue, 06 Sep 2016 11:21:40 GMT
header: Server: Apache
header: Set-Cookie: _icl_current_language=en; expires=Wed, 07-Sep-2016 11:21:40 GMT; path=/
header: Set-Cookie: aelia_cs_selected_currency=USD; expires=Wed, 07-Sep-2016 11:21:40 GMT; path=/
header: X-Pingback: https://www.permaskills.net/V1/xmlrpc.php
header: Expires: Wed, 11 Jan 1984 05:00:00 GMT
header: Cache-Control: no-cache, must-revalidate, max-age=0
header: Pragma: no-cache
header: Vary: Accept-Encoding,User-Agent
header: Content-Encoding: gzip
header: Content-Length: 20
header: Connection: close
header: Content-Type: text/html; charset=UTF-8
WARNING: Could not send HEAD request to https://www.permaskills.net/opening-credits/: HTTP Error 404: Not Found
[generic] opening-credits: Downloading webpage
send: u'GET /opening-credits/ HTTP/1.1\r\nAccept-Language: en-us,en;q=0.5\r\nAccept-Encoding: *\r\nConnection: close\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0) Gecko/20150101 Firefox/47.0 (Chrome)\r\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\nHost: www.permaskills.net\r\nCookie: aelia_cs_selected_currency=USD; _icl_current_language=en; wp_woocommerce_session_REDACTED_SESSION=0c0083348774aaaf2bf5d23f5476779e%7C%7C1473230243%7C%7C1473226643%7C%7Cc7751da811dbf96efaa7d7cdad749892; CookieInfo=accepted; _sp_id.5f60=d0ade15174846918.1472473356.21.1473160800.1473154299; _sp_ses.5f60=*\r\n\r\n'
reply: 'HTTP/1.1 404 Not Found\r\n'
header: Date: Tue, 06 Sep 2016 11:21:41 GMT
header: Server: Apache
header: Set-Cookie: _icl_current_language=en; expires=Wed, 07-Sep-2016 11:21:42 GMT; path=/
header: Set-Cookie: aelia_cs_selected_currency=USD; expires=Wed, 07-Sep-2016 11:21:42 GMT; path=/
header: X-Pingback: https://www.permaskills.net/V1/xmlrpc.php
header: Expires: Wed, 11 Jan 1984 05:00:00 GMT
header: Cache-Control: no-cache, must-revalidate, max-age=0
header: Pragma: no-cache
header: Vary: Accept-Encoding,User-Agent
header: Connection: close
header: Transfer-Encoding: chunked
header: Content-Type: text/html; charset=UTF-8
ERROR: Unable to download webpage: HTTP Error 404: Not Found (caused by HTTPError()); please report this issue on https://yt-dl.org/bug . Make sure you are using the latest version; type  youtube-dl -U  to update. Be sure to call youtube-dl with the --verbose flag and include its complete output.
  File "/usr/local/bin/youtube-dl/youtube_dl/extractor/common.py", line 394, in _request_webpage
    return self._downloader.urlopen(url_or_request)
  File "/usr/local/bin/youtube-dl/youtube_dl/YoutubeDL.py", line 1998, in urlopen
    return self._opener.open(req, timeout=self._socket_timeout)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 437, in open
    response = meth(req, response)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 550, in http_response
    'http', request, response, code, msg, hdrs)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 475, in error
    return self._call_chain(*args)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 409, in _call_chain
    result = func(*args)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 558, in http_error_default
    raise HTTPError(req.get_full_url(), code, msg, hdrs, fp)

Traceback (most recent call last):
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/runpy.py", line 162, in _run_module_as_main
    "__main__", fname, loader, pkg_name)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/runpy.py", line 72, in _run_code
    exec code in run_globals
  File "/usr/local/bin/youtube-dl/__main__.py", line 19, in <module>
  File "/usr/local/bin/youtube-dl/youtube_dl/__init__.py", line 434, in main
  File "/usr/local/bin/youtube-dl/youtube_dl/__init__.py", line 427, in _real_main
  File "/usr/local/bin/youtube-dl/youtube_dl/YoutubeDL.py", line 506, in __exit__
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/_MozillaCookieJar.py", line 118, in save
    f = open(filename, "w")
IOError: [Errno 13] Permission denied: u'/Users/REDACTED_USER/Downloads/cookies.txt'

Description of your issue, suggested solution and other information
Using the same cookies.txt file with both youtube-dl and curl I noticed that:

curl's request is successful (HTTP status 200 and page downloaded)
youtube-dl requests fails (HTTP status 404)
youtube-dl is not sending the cookie wordpress_logged_in_REDACTED_SESSION which is probably why the server is rejecting the request as if the client is not authenticated
The cookies.txt is read-only to prevent youtube-dl to overwrite the file (hence the last error youtube-dl is reporting)

Nothe that I've replaced some sensitive data with the REDACTED text.
Please let me know if you need more information.
Thank you!
cookies.txt contents:
# HTTP Cookie File
# To download this content click here, press return (Mac only) or copy and paste into a cookies.txt file.
# It can be then used by wget and other standard complaint tools.

* Connected to www.permaskills.net (<IP_ADDRESS>) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: www.permaskills.net
* Server certificate: COMODO RSA Domain Validation Secure Server CA
* Server certificate: COMODO RSA Certification Authority
* Server certificate: AddTrust External CA RootREDACTED
> GET /opening-credits/ HTTP/1.1
> Host: www.permaskills.net
> User-Agent: curl/7.43.0
> Accept: */*
> Cookie: CookieInfo=accepted; _icl_current_language=en; _sp_id.5f60=d0ade15174846918.1472473356.21.1473160800.1473154299; _sp_ses.5f60=*; aelia_cs_selected_currency=USD; wordpress_logged_in_REDACTED_SESSION=REDACTED%7C1473246938%7Choha9754IixUWiPSTU5T8xoGUVk6e0UBQtoIqfI00uj%7C170e0688f71a9acd757b8cb4e06abc1f17c7c2316973ccc3464939b10ef6798e; wp_woocommerce_session_REDACTED_SESSION=0c0083348774aaaf2bf5d23f5476779e%7C%7C1473230243%7C%7C1473226643%7C%7Cc7751da811dbf96efaa7d7cdad749892
>
< HTTP/1.1 200 OK
< Date: Tue, 06 Sep 2016 11:20:59 GMT
< Server: Apache
* Replaced cookie _icl_current_language="en" for domain www.permaskills.net, path /, expire<PHONE_NUMBER>
< Set-Cookie: _icl_current_language=en; expires=Wed, 07-Sep-2016 11:20:59 GMT; path=/
* Replaced cookie aelia_cs_selected_currency="USD" for domain www.permaskills.net, path /, expire<PHONE_NUMBER>
< Set-Cookie: aelia_cs_selected_currency=USD; expires=Wed, 07-Sep-2016 11:20:59 GMT; path=/
< X-Pingback: https://www.permaskills.net/V1/xmlrpc.php
< Expires: Wed, 11 Jan 1984 05:00:00 GMT
< Cache-Control: no-cache, must-revalidate, max-age=0
< Pragma: no-cache
< Link: <https://www.permaskills.net/?p=986>; rel=shortlink
< Vary: Accept-Encoding,User-Agent
< Transfer-Encoding: chunked
< Content-Type: text/html; charset=UTF-8

wordpress_logged_in* cookies are discarded because they have expiry time = 0 and considered expired (0 < now).

Is there a workaround for this?

Set non-expired expiry time.

It's working, thanks :)


Quick Explorer collides with Title Bar

When you have a rather deep tree, the Obsidian title bar gets mangled:

It might need to move down a line worth of space to avoid colliding with the title bar.

This can be worked around with CSS, e.g.:
div#quick-explorer {
    background-color: var(--background-modifier-cover) !important;
}

It's not the default because some themes don't play well with an explicit setting of the title bar background color.

If you're on Obsidian 0.15.6 or higher, the new 0.1.33 update to Quick Explorer now relocates the title to the right, out of the way from the Quick Explorer UI, and shortens it to exclude the note name.


Using nav flex-column inside (tab-content > tab-pane) show both content at first time.

exemple.txt
When you put a nav flex-column inside a tab-pane from another nav flex-column for the first time you switch from nav B to nav A it will show both content.
I'm not sure if it's related to #23976
How to reproduce

Open the page, after it is open, click on the PROFILE nav, it will show "B B B B"
Now click on the HOME nav, and it will show both content panel.
Notice that the fade effect stop working after the first switch.

Only happens at first time, if you click on PROFILE and HOME it will works fine.
It not happens if you remove the inner nav.
There is an very simple example page attached.

Fixed by https://github.com/twbs/bootstrap/pull/23087
Available in our next release


Add docsify and json schemas for momitoring specs

Description
The goal of these changes is to automate the generation of a static webpage for the documentation and to formally define the event format for the monitoring specification using JSON schemas.
Changes made

Moved all articles and documentation files under the /public directory to facilitate static page generation.
Integrated Docsify to automatically generate a static webpage from the markdown files under the /public directory.
Added necessary GitHub Actions to automate the deployment of the static documentation site. This includes: publishing the documentation to GitHub Pages and generating previews for pull requests.
Added JSON schemas to the monitoring specification.

@jboix quick question, what is the added value of generating a static website, isn't the git repo enough?

@amtins Good question! I think the static website brings some added value. For one, it makes navigation easier, so you can quickly find what you're looking for without digging through folders. Plus, the homepage gives us a chance to present the project in a way that's a bit more polished and marketable. Something like this:

I asked the team before starting but if you have any thoughts or concerns we can discuss about it.


Add edit link to message telling users they already created a review

Is your feature request related to an existing functionality? Please describe.
Right now if a user goes back to the review creation page for a given submission after they already created a review, they see the message You have already posted a review for this submission:

One of our users requested that there be a convenient link to edit that review shown as part of that message.  It seems like a reasonable idea so I wanted to see if it would fit for Hypha.
Describe the solution you'd like
My initial suggestion was inspired by the user request: simply having a link to the view page of the user's review would do the trick.
However, I also want to propose: redirect to the review instead of showing the message.  This would still convey that the user's review already exists, and would render the "edit" link (that already exists), and would show the review content.
The first is more simple and more explicit; the second could possibly be a better user experience (but then again it's possible it would be surprising in ways I'm not imagining)
Describe alternatives you've considered
I also considered having the redirect be automatic, but felt there is value in the user being reminded that they had already submitted the review.
It might also be useful to have a link to edit the review, instead of just view.  Or even provide links for both.  I don't have opinions on this; I originally planned edit because that was the user's request but decided view was a more generally useful link.  I could see a use case for being able to jump to the published review directly.
Additional context
I can open a PR for this.
Priority

Low priority (annoying, would be nice to not see)

Affected roles

Staff
Reviewers

Ideal deadline
I'll open a local patch as needed, so no urgency at the Hypha level

@slifty a PR would be awesome. Thank you! 💯

It's the page at /apply/submissions/<ID>/review/, e.g. the create a review form, not /apply/submissions/<ID>/reviews/<ID>, the view a review page.

Thank you for clarifying and flagging this issue! Look forward to seeing any PR you eventually settle on 💯
FYI - there's an 'Update draft' button in /apply/submissions/<ID>/reviews/ that sounds like what you need...

However, I also want to propose: redirect to the review instead of showing the message. This would still convey that the user's review already exists, and would render the "edit" link (that already exists), and would show the review content.

I think this is an ideal UX via minimal 'clicks' to see what was done previously but the first option re. edit link redirect certainly gets the job 'done' so to speak.
I think one UX problem is while there are edit/update draft links and button that can be found (and therefore not 'blocking' editing/updating draft) they aren't easily found and non-intuitive.
For the first option I think you can add a 'Edit review' button or text link under the text 'You have already posted a review for this submission' but I would also add text: 'You can update and save your review after editing'
I'm trying to find the page where you get the message 'You have already posted a review for this submission' and I can't activate it 🤔  when you say 'user goes back' @slifty do you mean click the back button on their browser? or navigates back to the review section in the project and attempts to 'send a new review' or is this happening when they've 'sent' or 'submitted' a review and then go back to 'edit draft'?

@Erioldoesdesign I'm not entirely sure what action the user takes to get there, but if you navigate to /apply/submissions/<ID>/reviews/ (where ID is the ID of a submission) after publishing a review, you should see the message.

I'm not entirely sure what action the user takes to get there, but if you navigate to /apply/submissions//reviews/ (where ID is the ID of a submission) after publishing a review, you should see the message.

Will test this tomorrow! 🙇

Started to test this and did not see the page + message you reference @slifty
But also got some internal server errors when I deleted reviews and tried to 'start from scratch' @frjo
Video here: https://drive.google.com/drive/u/1/folders/13nxMBvbOWgARqZFTd7InwVPjU9FhIOkB


miss projects dir

hi, do you forget upload the projects dir?  when i  run your code,  I find something error.

@encichou hi, can you provide a detailed error information?

@encichou This is my code error, I'll fix it as soon as possible.

Hi, have you solved this problem yet, I'm experiencing the same problem that

Hi, have you solved this problem yet, I'm experiencing the same problem too


dependencyTree doesn't work in sbt 1.1.6 version

addSbtPlugin("net.virtual-void" % "sbt-dependency-graph" % "0.9.0")

sbt.version = 1.1.6

My project is multi sbt project.
when i used command project {subProjectId} then dependencyTree,it run out
sbt:ouros_jobs> project api
[info] Set current project to ouros_api (in build file:/Users/skinny/ZAData/ouros/)
[ouros_api] $ dependencyTree
[info] Updating ProjectRef(uri("file:/Users/skinny/ZAData/ouros/"), "api")...
[info] Done updating.
[warn] Found version conflict(s) in library dependencies; some are suspected to be binary incompatible:
[warn] 	* com.google.guava:guava:22.0 is selected over {12.0.1, 19.0}
[warn] 	    +- com.typesafe.play:play_2.11:2.6.12                 (depends on 22.0)
[warn] 	    +- com.google.inject:guice:4.1.0                      (depends on 19.0)
[warn] 	    +- org.apache.hbase:hbase-common:1.2.0                (depends on 12.0.1)
[warn] 	    +- org.apache.hbase:hbase-client:1.2.0                (depends on 12.0.1)
[warn] 	* org.scala-lang.modules:scala-java8-compat_2.11:0.8.0 is selected over 0.7.0
[warn] 	    +- com.typesafe.play:play-ahc-ws-standalone_2.11:1.1.6 (depends on 0.8.0)
[warn] 	    +- com.typesafe.play:play_2.11:2.6.12                 (depends on 0.7.0)
[warn] 	    +- com.typesafe.akka:akka-actor_2.11:2.5.11 ()        (depends on 0.7.0)
[warn] 	    +- com.typesafe.play:play-streams_2.11:2.6.12         (depends on 0.7.0)
[warn] 	* com.typesafe.akka:akka-stream_2.11:2.5.11 is selected over {2.5.9, 2.4.20}
[warn] 	    +- com.typesafe.play:play-streams_2.11:2.6.12         (depends on 2.5.11)
[warn] 	    +- com.typesafe.akka:akka-http-core_2.11:10.0.11 ()   (depends on 2.4.20)
[warn] 	    +- com.typesafe.play:play-ws-standalone_2.11:1.1.6    (depends on 2.5.9)
[warn] 	* com.typesafe.akka:akka-actor_2.11:2.5.11 is selected over 2.4.20
[warn] 	    +- com.typesafe.play:play_2.11:2.6.12                 (depends on 2.5.11)
[warn] 	    +- com.typesafe.akka:akka-stream_2.11:2.5.11 ()       (depends on 2.5.11)
[warn] 	    +- com.typesafe.akka:akka-slf4j_2.11:2.5.11 ()        (depends on 2.5.11)
[warn] 	    +- com.typesafe.akka:akka-parsing_2.11:10.0.11 ()     (depends on 2.4.20)
[warn] Run 'evicted' to see detailed eviction warnings
[error] scala.MatchError: 1.0 (of class java.lang.String)
[error] 	at net.virtualvoid.sbt.graph.DependencyGraphSettings$.$anonfun$ivyReportForConfig$8(DependencyGraphSettings.scala:56)
[error] 	at scala.Function1.$anonfun$compose$1(Function1.scala:44)
[error] 	at sbt.internal.util.$tilde$greater.$anonfun$$u2219$1(TypeFunctions.scala:39)
[error] 	at sbt.std.Transform$$anon$4.work(System.scala:66)
[error] 	at sbt.Execute.$anonfun$submit$2(Execute.scala:263)
[error] 	at sbt.internal.util.ErrorHandling$.wideConvert(ErrorHandling.scala:16)
[error] 	at sbt.Execute.work(Execute.scala:272)
[error] 	at sbt.Execute.$anonfun$submit$1(Execute.scala:263)
[error] 	at sbt.ConcurrentRestrictions$$anon$4.$anonfun$submitValid$1(ConcurrentRestrictions.scala:174)
[error] 	at sbt.CompletionService$$anon$2.call(CompletionService.scala:37)
[error] 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
[error] 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
[error] 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
[error] 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
[error] 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
[error] 	at java.lang.Thread.run(Thread.java:748)
[error] (Compile / moduleGraph) scala.MatchError: 1.0 (of class java.lang.String)
[error] Total time: 10 s, completed 2018-6-5 16:26:31```

when i used command dependencyTree for another sub project,it run out
[info] Set current project to ouros_jobs (in build file:/Users/skinny/ZAData/ouros/)
sbt:ouros_jobs> dependencyTree
[error] scala.MatchError: 1.0 (of class java.lang.String)
[error] 	at net.virtualvoid.sbt.graph.DependencyGraphSettings$.$anonfun$ivyReportForConfig$8(DependencyGraphSettings.scala:56)
[error] 	at scala.Function1.$anonfun$compose$1(Function1.scala:44)
[error] 	at sbt.internal.util.$tilde$greater.$anonfun$$u2219$1(TypeFunctions.scala:39)
[error] 	at sbt.std.Transform$$anon$4.work(System.scala:66)
[error] 	at sbt.Execute.$anonfun$submit$2(Execute.scala:263)
[error] 	at sbt.internal.util.ErrorHandling$.wideConvert(ErrorHandling.scala:16)
[error] 	at sbt.Execute.work(Execute.scala:272)
[error] 	at sbt.Execute.$anonfun$submit$1(Execute.scala:263)
[error] 	at sbt.ConcurrentRestrictions$$anon$4.$anonfun$submitValid$1(ConcurrentRestrictions.scala:174)
[error] 	at sbt.CompletionService$$anon$2.call(CompletionService.scala:37)
[error] 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
[error] 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
[error] 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
[error] 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
[error] 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
[error] 	at java.lang.Thread.run(Thread.java:748)
[error] (Compile / moduleGraph) scala.MatchError: 1.0 (of class java.lang.String)
[error] Total time: 1 s, completed 2018-6-5 16:28:12

how to make this command work?

Hi @JustYuxinWu. Thanks for the report (and sorry for the delay). Can you post an example project exhibiting the problem? It seems for your project sbtVersion is set to "1.0" instead of to the full sbt version. In my tests the plugin still seems to work with sbt 1.1.6.
Can you post the output of show sbtVersion?

You are right.
I have set the sbtVersion to 1.0 somewhere else, witch caused this issue.
Sorry for wasting your time and I will close this issue later.
Thanks for you help 🙏

Glad, you solved it :)


How to set up HTTPS access via IP on macOS?

“How to set up HTTPS access via IP on macOS? I've searched through the website's documentation, but couldn't find any information on this topic.”

Sorry no idea how this is related to Perfetto at all. The UI is a purely static site, if you're looking to host it yourself you can use any off the shelf HTTP server and put HTTPS layer in that.


/home/public/anaconda3/bin/python -u ../../tools/test.py --snapshot model.pth --dataset VOT2018 --config config.yaml

/home/public/anaconda3/bin/python -u ../../tools/test.py --snapshot model.pth --dataset VOT2018 --config config.yaml
but:ModuleNotFoundError: No module named 'pysot'

you may need to export PYTHONPATH  as mentioned in environment setup section

ok,but
self.img_names[0]= /home/cbl/PycharmProjects/pysot-master/testing_dataset/VOT2018/ants1/color/00000001.jpg
loading VOT2018:   0%|                                                | 0/60 [00:00<?, ?it/s, ants1]Traceback (most recent call last):
File "/home/cbl/PycharmProjects/pysot-master/tools/test.py", line 221, in
main()
File "/home/cbl/PycharmProjects/pysot-master/tools/test.py", line 56, in main
load_img=False)
File "/home/cbl/PycharmProjects/pysot-master/toolkit/datasets/init.py", line 32, in create_dataset
dataset = VOTDataset(**kwargs)
File "/home/cbl/PycharmProjects/pysot-master/toolkit/datasets/vot.py", line 119, in init
load_img=load_img)
File "/home/cbl/PycharmProjects/pysot-master/toolkit/datasets/vot.py", line 31, in init
init_rect, img_names, gt_rect, None, load_img)
File "/home/cbl/PycharmProjects/pysot-master/toolkit/datasets/video.py", line 29, in init
assert img is not None, self.img_names[0]
AssertionError: /home/cbl/PycharmProjects/pysot-master/testing_dataset/VOT2018/ants1/color/00000001.jpg
what is the matter?

@HugoFeng

Please check whether /home/cbl/PycharmProjects/pysot-master/testing_dataset/VOT2018/ants1/color/00000001.jpg exists.

/home/cbl/PycharmProjects/pysot-master/testing_dataset/VOT2018/ants1/color/00000001.jpg is not exit.
how I set the  /home/cbl/PycharmProjects/pysot-master/testing_dataset/VOT2018/?
the code cannot produce the  /home/cbl/PycharmProjects/pysot-master/testing_dataset/VOT2018/ants1/color/00000001.jpg?

@lb1100

Please refer to Download testing datasets

@ StrangerZhang
can you say the detail of it ,I have download it


Formik with EXPO SDK 39

🐛 Bug report
Current Behavior
Just updated to SDK 39 - and updated Formik also to 2.1.5. This gives me a warning ("Reacy.createElement: type is invalid") and two Component Exceptions (both "Element type is invalid") from Formik's code. This is just a small formik test program that worked in SDK37/2.1.4. Anybody with SDK39/Formik experiences?

Expected behavior
This should show a minimal login screen with a submit button made just for testing. This worked with SDK 37 and Formik 2.1.4.
Reproducible example

Suggested solution(s)
No solution or workaround found
Additional context
None
Your environment
{
"main": "node_modules/expo/AppEntry.js",
"scripts": {
"start": "expo start",
"android": "expo start --android",
"ios": "expo start --ios",
"web": "expo start --web",
"eject": "expo eject"
},
"dependencies": {
"expo": "^39.0.0",
"expo-status-bar": "~1.0.2",
"formik": "^2.1.5",
"react": "16.13.1",
"react-dom": "16.13.1",
"react-native": "https://github.com/expo/react-native/archive/sdk-39.0.0.tar.gz",
"react-native-web": "~0.13.7"
},
"devDependencies": {
"@babel/core": "^7.8.6",
"babel-preset-expo": "^8.3.0"
},
"private": true
}

A different example seems to work, so I am closing this for now.

@ph-sw what different example? what was different? I am having the same issue.


feat: basic handling for RValue::Len, following AeneasVerif/charon#209

This PR fixes aeneas following AeneasVerif/charon#209.
I added some "Unhandled Len" fatal errors for non-trivial cases.

That looks good, can you run make update-charon-pin on your end and commit the result?

I did it for you


AddThread without creating a log

Hey! I have a question to discuss.
Some background:
In anytype when you sign in to the existing account on a new device you generate the new libp2p identity and recover(AddThread) the rest of threads using the info in the derived ThreadsDB. Now imagine an account with 1000 threads, but 50% of them changes very rarely(with a high chance they may be never changed on some devices). As a result, if you did sign in many times in the past you will have a lot of empty useless thread logs.
So what we have:

Currently it is not possible to add an existing thread (using net.AddThread) with a ReadKey but without a Log. https://github.com/textileio/go-threads/blob/5d09258e40a4e008cab2d4de9bbeb6ffd5357054/net/net.go#L341-L345
As a result user needs to create an empty log even in case it has no plans to write some records there yet(or maybe even never)
Still, an empty-head log with valid addresses on a thread increases the chances other peers will be able to pull the rest of logs via your node
On the other side creating logs in a lazy mode can be the first step in preparation for read-write permissions and the ability to change these permissions in time. And we will probably need another way for read-only users to add their addresses to the thread
And last option, we can just follow the goal that go-threads outgoing/incoming requests should not linearly scale with a number of threads. This means grouping requests by peer IDs instead, which in turn means empty logs make no sense if we have non-empty logs of the same peers in other threads.

Should we allow AddThread without a log now or it's better to postpone this discussion after the read-write ACL?

Hi Anton! Great idea. I believe we used to lazy-create logs in the way you describe, but that behavior was changed for some reason. Sleuthing threw the commit history, I honestly can't remember why. I have a feeling it was related to using the a thread node from the JS client. Does this ring any bells @carsonfarmer ?
tl;dr, sounds like a good idea to add that back now.

Hmmm, I think it was something to do with our multi-tenant setup, and "joining" threads that were already locally available on the remote node? Either way, it seems like the constraint could be relaxed? But we will defs have to test this before deploying anything. I'll have to dig in to be sure. It might also have something to do with differentiating between a thread "owner" (the node owns the thread and has full private key support) vs thread "users" (only have a log, but the private key isn't available locally).


Make Template Responsive

Issue Type:

[x] Bug Report
[ ] Feature Request
[ ] Documentaion

Describe the bug
There is a folder named Admin Dashboard in the Cool-Front-End-Templates repo. Make that template fully responsive.
Screenshots

Desktop view

Mobile View

@juberiya1ajaz any update? Make the PR as soon as possible

Can you assign me this under GSSoC'22 ?

can you assign me this project?

Assigned

okk

@PraveenaPulagam Make PR.


Observability, Monitoring and Autoscaling when running with Loom enabled

This is more of a general question around Loom, but I'm thinking particularly about Javalin at the moment. With the replacement of the ThreadPool in Jetty it is not possible anymore to use the utilization of the threadpool as an indication of Javalin being at capacity in I/O heavy workloads (and yes, this is not a good indicator all the time).
That makes it hard to decide when a service needs to be scaled up or out.
Is there any other obvious indicator that I am missing, or are we back to Heap/CPU/network utilization and saturation? Obviously I am in search of the one boolean I can expose for autoscaling and the rest is magic ;-)

Pretty much... yes. At this moment, we can consider Loom thread-pool as a black box that may cover drawbacks of blocking impls, but there's a cost of having no control over this process. I didn't check for a while what's going on with tooling around Loom, but for now we're in phase where frameworks just add support for it, fancy tooling will be probably a part of the second phase when some people that decided to use it on production will try to look for any kind of monitoring possibilities. In terms of Loom used as main http thread-pool, we have an issue related to that (https://github.com/javalin/javalin/issues/1778), but I didn't have time to take a look at it, because atm I'm not using it as well.

Our current Loom ThreadPool is a bit ... special:
private class LoomThreadPool(name: String) : ThreadPool {
    private val executorService = getExecutorService(name)
    override fun join() {}
    override fun getThreads() = 1
    override fun getIdleThreads() = 1
    override fun isLowOnThreads() = false
    override fun execute(command: Runnable) {
        executorService.submit(command)
    }
}

I guess we could at least keep track of the number of threads. We could also time the Runnables to see how long they take to execute on average 🤔

@spinscale are you interested in doing anything here?

I'll move this into the other loom issue too.


[turborepo] error installing depencies from pruned lock file

What version of Turborepo are you using?
1.6.3
What package manager are you using / does the bug impact?
Yarn v1
What operating system are you using?
Mac
Describe the Bug
In my docker file I have the following step:
RUN turbo prune --scope=$APP_NAME --docker
This generates the .out directory with the following structure

/yarn.lock
/json/
/full/

I then copy the yarn.lock + json and install dependencies with these steps:
COPY --from=builder /app/out/json/ .
COPY --from=builder /app/out/yarn.lock ./yarn.lock
RUN yarn install --production --frozen-lockfile

I get the following error:
error Your lockfile needs to be updated, but yarn was run with --frozen-lockfile.
Looks like prune is not correcctly pruning the yarn.lock
Expected Behavior
Dependencies can be installed with yarn install --production --frozen-lockfile without error.
yarn.lock should match package.json
To Reproduce
install dependencies from pruned repo with docker flag.
Reproduction Repo
No response

I'm running into the npm equivalent of this over in npm land.
COPY --from=pruner /app/out/json/ .
COPY --from=pruner /app/out/package-lock.json ./package-lock.json
RUN --mount=type=cache,target=/root/.npm \
  --mount=type=secret,id=npmrc,target=/root/.npmrc \
  npm ci --no-audit --no-fund --prefer-offline

which results in
#18 [builder  8/12] RUN --mount=type=secret,id=npmrc,target=/root/.npmrc   npm ci --no-audit --no-fund --prefer-offline
#18 sha256:55bf88e06459432be0618ed1ad56c8f11a7c3c95727718aa617f3026dac17123
#18 6.535 npm notice
#18 6.535 npm notice New major version of npm available! 8.19.2 -> 9.1.1
#18 6.535 npm notice Changelog: <https://github.com/npm/cli/releases/tag/v9.1.1>
#18 6.535 npm notice Run `npm install -g<EMAIL_ADDRESS>to update!
#18 6.535 npm notice
#18 6.556 npm ERR! code EUSAGE
#18 6.584 npm ERR!
#18 6.584 npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
#18 6.584 npm ERR!
#18 6.584 npm ERR! Missing<EMAIL_ADDRESS>from lock file
#18 6.584 npm ERR! Missing<EMAIL_ADDRESS>from lock file
#18 6.584 npm ERR! Missing<EMAIL_ADDRESS>from lock file
...

The list of missing dependencies keeps going for 245 (all?) of my dependencies.
I'm using node:18-alpine as my base image.

I did some more digging and determined that the pruned lockfile created by turbo prune is identical to a lockfile generated by npm install with npm@9 (which also uses lockfileVersion 3). So I'm super baffled but my issue doesn't seem a result of turbo prune spitting out the wrong npm lockfile, at least.
The issue I'm seeing with npm still seems too similar to what is being described with yarn to be a coincidence but I'm not sure what to check next.

Okay some folks I work with and it does appear that the npm issue, while likely still related, isn't the same issue as the yarn issue.
I've opened #2739 to track the npm issue.
@JamesAlexanderHill I tried to reproduce the yarn issue here: https://github.com/keawade/turbo-wat/tree/yarn but it appears to either be something else or not as directly translatable to the npm issue I ran into. Feel free to fork that repo/branch if you're looking to create a reproduction repo.

Hi @JamesAlexanderHill, could you provide a reproduction? If that's not possible, getting at least the original and pruned lockfile would me debug the issue.

@chris-olszewski I've hit the same issue and it appears to have been triggered by our use of yarn resolutions on immer and having deps on multiple [major] versions of immer.
Our repo currently only has a single package which I am pruning to (trying to prepare for soe apps to be added and don't want CI installing all the deps just to publish the lib).
in root package.json..
  "resolutions": {
    "immer": "^9.0.6",
  }

in root yarn.lock
"immer@npm:^9.0.6":
  version: 9.0.16
  resolution: "immer@npm:9.0.16"
  checksum: e9a5ca65c929b329da7a3b7beccf7984271cda7bdd47b2cab619eac3277dcd56598c211b55cc340786b6eff0c06652ac018808d9fd744443f06882364dece6bc
  languageName: node
  linkType: hard

immer@npm does not appear in the pruned yarn.lock
Running yarn install in the pruned repo adds immer to the yarn.lock.
When I remove the resolutions entry for immer both our root yarn.lock and the pruned yarn.lock contain the following entries for immer and running yarn install in the pruned repo does not modify it..
"immer@npm:8.0.1":
  version: 8.0.1
  resolution: "immer@npm:8.0.1"
  checksum: 63d875c04882b862481a0a692816e5982975a47a57619698bc1bb52963ad3b624911991708b2b81a7af6fdac15083d408e43932d83a6a61216e5a4503efd4095
  languageName: node
  linkType: hard

"immer@npm:^8.0.4":
  version: 8.0.4
  resolution: "immer@npm:8.0.4"
  checksum: 9d3b28df1ac5bf6918c611e71c15bdb136588c21a3431100448f21325fef9b055cc9a44fe8b023f0c5ecbc66a2ba38f403c9a67d581f613b49d0e4ff15564f79
  languageName: node
  linkType: hard

"immer@npm:^9.0.7":
  version: 9.0.16
  resolution: "immer@npm:9.0.16"
  checksum: e9a5ca65c929b329da7a3b7beccf7984271cda7bdd47b2cab619eac3277dcd56598c211b55cc340786b6eff0c06652ac018808d9fd744443f06882364dece6bc
  languageName: node
  linkType: hard


Can't log in (GUI) and cannot update anymore (CLI): GooglePlayException

I don't know yet where to look further (yet), but I realized that roughly around the moment when Google released the Play Services 9.x shortly after I started into having issues with Raccoon in CLI mode which always. Currently on CLI get the following message when trying to update:
com.akdeniz.googleplaycrawler.GooglePlayException: Error=UNKNOWN_ERR
[....]
at de.onyxbits.raccoon.App.main(App.java:83)

In GUI mode all I get with a fresh raccon is that it cannot log into the account anymore. I checked that the account(s) in use could indeed still log into web portals of the play store so they should be OK.
The library you are using in raccoon in order to talk to the Play Store doesn't seem to have gotten much love lately so possibly Google made some breaking changes lately.
If I can provide you with additional debug messages I'm happy to help - I'd be interested in hearing if the issue is reproducible other than on my Linux (OpenJDK 8) and Windows (Oracle JRE 8) system I tested on.

v3.6 should fix the problem.
Am Freitag, den 27.05.2016, 01:45 -0700 schrieb Mathieu Simon:

I don't know yet where to look further (yet), but I realized that
roughly around the moment when Google released the Play Services 9.x
shortly after I started into having issues with Raccoon in CLI mode
which always. Currently on CLI get the following message when trying
to update:
com.akdeniz.googleplaycrawler.GooglePlayException: Error=UNKNOWN_ERR
[....]
at de.onyxbits.raccoon.App.main(App.java:83)
In GUI mode all I get with a fresh raccon is that it cannot log into
the account anymore. I checked that the account(s) in use could indeed
still log into web portals of the play store so they should be OK.
The library you are using in raccoon in order to talk to the Play
Store doesn't seem to have gotten much love lately so possibly Google
made some breaking changes lately.
If I can provide you with additional debug messages I'm happy to help

I'd be interested in hearing if the issue is reproducible other than
on my Linux (OpenJDK 8) and Windows (Oracle JRE 8) system I tested on.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

Thank you very much - I just read your blogpost this day and wanted to say thank you - and those who helped as you mentioned there - for the "Jelly Bean"-style workaround. I know it's likely not the best fix, but I can confirm that for now this works and hope you can focus on your pressing deadlines you have to meet. I'd say it's not worth in keeping this bug open.


Adjust layout with button, when keyboard is active

I have gone through these following points

[ x ] Check latest documentation: https://docs.nativebase.io/
[ x ] Check for existing open/closed issues for a possible duplicate before creating a new issue: https://github.com/GeekyAnts/NativeBase/issues
[ x ] Use the latest NativeBase release: https://github.com/GeekyAnts/NativeBase/releases
[ x ] Check examples from NativeBase KitchenSink https://github.com/GeekyAnts/NativeBase-KitchenSink

Issue Description
On my app, I have short forms where the button stay on bottom of screen. But, when keyboard is active and input are on focus, my button need fit in near the form (inputs).
Below have the print of screen rendered:

And below is the print screen when the input is in focus, and my button doesn't fit near the form:

What I need:

Have any prop of keyboard-aware-scroll-view, where I can make my button fit near the form ? How can I do that ?
Tks !

@RenanNeitzel The above issue is not related to any of the native base component, but an issue with keyboard-aware-scroll-view. So you can post the same in keyboard-aware-scroll-view.

I couldn't adjust the button the right way because my flexbox style was forcing the button to always keep down with 'justifyContent:' space-between ''.
I solved this problem with the nativeEvent 'keyboardWillShow' and 'keyboardWillHide' method.
Thank you for your help !

Hi @RenanNeitzel , latest version of Native base has been released.
Native Base 2.13.12


[BYOC][ACL] Improved pooling support

This patch adds support for various pooling operators, namely: average pool 2d, global max pool 2d, global average pool 2d and l2 pooling (an equivalent combination of relay operators).
For fp32:

nn.avg_pool2d
nn.global_max_pool2d
nn.global_avg_pool2d
power(2) + nn.avg_pool2d + sqrt -> L2 pooling (only supports fp32)

For uint8:

cast + nn.avg_pool2d + cast
nn.global_max_pool2d
cast + nn.global_avg_pool2d + cast

Tests updated to reflect these changes.
cc @comaniac @zhiics @mbaret @Leo-arm

Thanks @lhutton1 @comaniac


move wormhole conversion for CCE-MEM interface into bp_tile and bp_clint

regress.v passes,  currently running regress_beebs.v and atomic queue demos

looks good to me

atomic queue demos look good (2, 4, 8, and 16-core ); beebs regressions passing (a couple tests still running, but no failures yet, so expecting to pass)


Emit stats for JWT and RBAC filter in Envoy

Describe the feature request
The current default stats emitted by Envoy are configured to "cluster_manager,listener_manager,server,cluster.xds-grpc,wasm" at https://github.com/istio/istio/blob/88a2bfb3bd8e0010229ee66befc4e56b326c2a3a/pkg/bootstrap/config.go#L50
We should also include the stats of the Envoy JWT and RBAC filter to give better telemetry data for RequestAuthentication and AuthorizationPolicy.
Example stats:
http.inbound_<IP_ADDRESS>_80.jwt_authn.allowed: 4
http.inbound_<IP_ADDRESS>_80.jwt_authn.cors_preflight_bypassed: 0
http.inbound_<IP_ADDRESS>_80.jwt_authn.denied: 0
http.inbound_<IP_ADDRESS>_80.rbac.allowed: 2
http.inbound_<IP_ADDRESS>_80.rbac.denied: 2
http.inbound_<IP_ADDRESS>_80.rbac.shadow_allowed: 0
http.inbound_<IP_ADDRESS>_80.rbac.shadow_denied: 0

One option is to use the regex (or suffix matching if there are concerns about the regex performance) to filter out all the jwt_authn and rbac stats.
Enabling this by default at least allows the user to check the metrics at http://localhost:15000/stats.
cc @mandarjog @douglas-reid @bianpengyuan @howardjohn for comments.
Describe alternatives you've considered
Let the user to manually configure the stats, this works for custom stats but not that great for the first-class Istio APIs, which should be enabled by default.
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[x] Extensions and Telemetry
[x] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Additional context

This sgtm, as long as only inbound HCM generates those stats, not every HCM (which is going to be quite a lot more).
On the other note, if you want to tell people to start to rely on these stats for monitoring, the format of the stats becomes an API and you'd need to maintain backward compatibility.  Essentially this means HCM name change will need an upgrade notes.

What are we changing the format to and why?
If we don’t want people to parse it, we should go back to using a sha or something like that which cannot possibly be relied on.
If the port is available in the new format, we can change the tag extraction expression and still offer a reasonable Prometheus output. We should still mention that this is not an official api, but not change it every release.

Should extract “allowed,denied,shadow*” as values for the result or a decision dimension. Is “inbound_filterchain_tag” right? It could be listener or more abstract like “context”
Ex:
envoy_http_rbac{context="inbound_<IP_ADDRESS>_80", decision=“allowed”} 1

does Envoy support extracting multiple parts from the metric as tags? The doc says:
The first capture group identifies the portion of the name to remove.
The second capture group (which will normally be nested inside the first) will designate the value of the tag for the statistic.
If no second capture group is provided, the first will also be used to set the value of the tag.
All other capture groups will be ignored.

And currently I only want to extract the denied counter, the allowed counter is not accurate if both DENY and ALLOW actions are used because we currently insert 2 RBAC filters, each RBAC filter can add the allow counter separately.


Update to stac-fastapi and stac-fastapi-pgstac v2.4.8

Description
This includes advertising STAC API v1.0.0 🎉
Type of change
Please delete options that are not relevant.

[x] New feature (non-breaking change which adds functionality)

How Has This Been Tested?
I ran scripts/test and got what appears to be an unrelated failure:
pccommon/tests/test_timeouts.py ....                                                                                [ 18%]
pccommon/tests/test_tracing.py ......                                                                                [ 45%]
pccommon/tests/test_utils.py .                                                                                [ 50%]
pccommon/tests/config/test_mosaic_info.py ..                                                                                [ 59%]
pccommon/tests/config/test_render_config.py ....F....                                                                                [100%]

========================================================================== FAILURES ===========================================================================
___________________________________________________________________ test_get_render_config ____________________________________________________________________

    def test_get_render_config() -> None:
        config = get_render_config("naip")
>       assert config
E       assert None

I ran scripts/format and got what appears to be an unrelated error:
#0 2.152 E: Repository 'http://security.debian.org/debian-security stable-security InRelease' changed its 'Codename' value from 'bullseye-security' to 'bookworm-security'

Checklist:
Please delete options that are not relevant.

[x] I have performed a self-review
[ ] Changelog has been updated
[ ] Documentation has been updated
[ ] Unit tests pass locally (./scripts/test)
[ ] Code is linted and styled (./scripts/format)

Marking as draft to wait on https://github.com/stac-utils/stac-fastapi-pgstac/pull/44.

Ready for review after stac-fastapi-pgstac v2.4.9 release.


Ignore this PR. This is just to check triggers from PR validations

Ignore this PR.
Seems like PRs are not triggering CI pipelines.....

/azp run

/azp run

/azp run

/azp run

/AzurePipelines help

/azp list

/azp run

/azp run


Feature/show image of selected user

Description:
Need to show an image of the assignee while searching and assigning a task on the create task page.

Closing as this issue is being addressed #439


Make header matching case-insensitive, tolerate multiple headers, internal whitespace

Updates CheckSPNEGONegotiate to:

check all headers with the given name, not just the first
match "Negotiate" prefix case-insensitively
normalize token (removes internal whitespace, pads to multiple of 4 chars) before base64 decoding

Adds tests for header matching
fixes #41
fixes #42

Overall looks good; just some minor feedback! Very sorry for the delay in reviewing this.

Sure, I'll update in a bit

addressed comments

LGTM; thanks for the contribution!


Links aren't accessible in editors

I discovered this problem while working on https://github.com/microsoft/vscode/issues/172262

Turn on VoiceOver
Turn on accessibility mode if it's not enabled automatically
Have some weblinks in an editor or markdown document
use the VO key (find this in VoiceOver settings) + Cmd + L to go to link and continue to press that until there are no links. You'll see some scm view links are detected, but none in the editors 🐛

Probably reproes with NVDA on windows
https://user-images.githubusercontent.com/29464607/216364628-052ea91b-eb45-44f7-a24a-9c272d1c82af.mov

Maybe that's what the Open Link command is meant to fix? If so, it's not discoverable

maybe we could indicate when a user is within a link with a new accessibility signal?

We should add the signal and also figure out a way to make Open Link discoverable


Setup dynamic paths in i18n to recognize multiple paths

This is my i18n.json file and I want to setup my settings.json to be used under any URL like /settings/about, /settings/about/password, etc. like I can do with common "*" but without having to specify "/settings", "/settings/about", etc. Is there any way to make a regex pattern?
{
  "locales": ["en", "es", "jp"],
  "defaultLocale": "en",
  "pages": {
    "*": ["common"],
    "/recent": ["recent"],
    "/login": ["login"],
    "/register": ["register"],
    "/recover_password": ["recover_password"],
    "/settings": ["settings"],
    "/settings/account": ["settings"]
  }
}
What would be nice is to do something like this:
{
  "locales": ["en", "es", "jp"],
  "defaultLocale": "en",
  "pages": {
    "*": ["common"],
    "/recent": ["recent"],
    "/login": ["login"],
    "/register": ["register"],
    "/recover_password": ["recover_password"],
    "/settings/*": ["settings"],
  }
}

Yes!! It is!! You can do it in this way:
{
  "locales": ["en", "es", "jp"],
  "defaultLocale": "en",
  "pages": {
    "*": ["common"],
    "/recent": ["recent"],
    "/login": ["login"],
    "/register": ["register"],
    "/recover_password": ["recover_password"],
-    "/settings/*": ["settings"],
+    "rgx:^/settings": ["settings"],
  }
}

Example: https://github.com/vinissimus/next-translate/blob/1.0.2/examples/complex/i18n.js#L9

Thanks! this would be helpful on the readme!

It is, in the configuration section 😊


no commit history available in rebase dashboard

As you can see, I have a new repo and I'd like to squash the last two commits (added a line of a's and b's). The commit history shows up in log, but not in the rebase dashboard. Am I doing something wrong?

You will need to define the rebase base by pressing the f key.

When I try f and I use ref as base it would be nice if it offered me a selection. Even so, I enter "c246ac8" it complains about unclean state because I have two files not staged (I'm not tracking them). After, I delete them, I can then see the two subsequent commits. But when I try to squash I get an error.
`/usr/local/bin/git log -1 --format=%h%n%H%n%s%n%an%n%ae%n%at%x00%B%x00%x00%n c246ac87417c5e71aaca26f4c3ee8481daffdef6~1..c246ac87417c5e71aaca26f4c3ee8481daffdef6` failed with following output:

fatal: ambiguous argument 'c246ac87417c5e71aaca26f4c3ee8481daffdef6~1..c246ac87417c5e71aaca26f4c3ee8481daffdef6': unknown revision or path not in the working tree.
Use '--' to separate paths from revisions, like this:
'git <command> [<revision>...] -- [<file>...]'

Ai...you cannot use the first commit as the base. We should make it clear though...

Okay, what about:

easy way to select base commit
complaints about unclean state because of unstaged files?

#532 is working on it.
You need to stash or stage the changes before any rebase actions. It is of no difference to the regular git routine. But however, we can make it more automatous by stashing the changes and poping it after the rebase action.

Okay, thanks.


1.20.2 crash with iris, sodium, nvidium etc

Minecraft Version
1.20.2
ModLoader
Fabric
Shimmer version
Shimmer-fabric-1.20.1-0.2.3
Modpack info or mod list(please reduce mod range)
sodium, iris, indium, nvidium
The latest.log file and hs_err_pidXXX if exists
https://pastebin.com/trQbSjmT
optifine , Rubidium , flywheel or any rendering related mods. mod version is required.

indium-1.0.27+mc1.20.1
iris-mc1.20.2-1.6.10
nvidium-0.2.5-beta
sodium-fabric-mc1.20.2-0.5.3

Issue description
crashes
Steps to reproduce
No response
Other information
No response

See #88 for Sodium info + As far as I know Shimmer never worked on 1.20.2 despite Modrinth page saying otherwise.

@MikiP98 ok, seems we have little to do but wait until the creator handles the crash in the next update 😏