Power portal extension in dev ops fails on Power Portal Download task

Hi. I have been struggling with this for couple of hours now. When I execute dev ops pipeline it fails on the task of downloading portal.

Extension is being installed successfully, connection is verified with "who am I".
The details of the errors on the task:

The portion that was cut on the screenshot:
"Sorry, the app encountered a non recoverable error and will need to terminate. The exception details have been captured and will be forwarded to the development team, if telemetry has been enabled. Exception Id: 2c3cfa5d-7676-493d-810d-529054d8a0ac, Exception Type: System.ArgumentNullException"
When command is tested in VS Code it works fine. The portal id is correct.
I found similar problem here:
https://powerusers.microsoft.com/t5/Power-Apps-Pro-Dev-ISV/Error-when-using-Microsoft-Power-Platform...
I have tried the last suggestion and it is still not executing properly.
I hope someone is able to assist me.
Kind Regards
Piotr
PS: I can share full logs for failed pipeline with the person who will be taking look into the issue. Please message me.

@PiotrMichalski1987 thank you for reporting, the exceptionId you specified should be enough for the Power Pages team to start investigating and fix.
Looking at the call stack, I assume there's missing data in the exported site, causing the ArgumentNullException:
0 {"assembly":"mscorlib, Version=<IP_ADDRESS>","method":"System.IO.Path.Combine","level":0,"line":0}
1 {"assembly":"bolt.module.paportal, Version=<IP_ADDRESS>","method":"bolt.module.paportal.PortalDataExporter.ExportDataForAdxEntities","level":1,"line":0}
2 {"assembly":"bolt.module.paportal, Version=<IP_ADDRESS>","method":"bolt.module.paportal.PortalDataExporter.ExportDataForAllEntities","level":2,"line":0}
3 {"assembly":"bolt.module.paportal, Version=<IP_ADDRESS>","method":"bolt.module.paportal.PortalDataExporter.DownloadData","level":3,"line":0}
4 {"assembly":"bolt.module.paportal, Version=<IP_ADDRESS>","method":"bolt.module.paportal.verbs.PAPortalDownloadVerb.Execute","level":4,"line":0}

AB#2989636
CC: @ameyaapte1

Thank you for quick response.
Kind Regards
Piotr

@PiotrMichalski1987 one possible work around, after I took a closer look at your screenshot:
Your download task has the "Download path" task input property assigned with: c:\paportal
While this might work locally, this can and is problematic in an Azure DevOps build agent's context, since tasks are generally expected to only access paths within the drive that holds the repository. Best practice for tasks is to NOT specify specific OS drives (e.g. c:\ in your example), but instead use relative paths (which are assumed relative to the repo's src directory), or use predefined AzDO variabled (https://learn.microsoft.com/en-us/azure/devops/pipelines/build/variables?view=azure-devops&tabs=yaml#build-variables-devops-services) like $(Build.SourcesDirectory) or similar.

I have tried to follow best practice as suggested (thank you for the link) and modified my task:

However, the error still persists:

[Exception Id: 12cdc9d4-7405-402a-aefc-53d0e0afbd02, Exception Type: System.ArgumentNullException]

@PiotrMichalski1987 The folder $(Agent.WorkFolder) would not be my first choice, since that folder is not guaranteed to be writable and can also risk clobbering folders that the build agent requires; from the docs:

Note: This directory is not guaranteed to be writable by pipeline tasks (eg. when mapped into a container)

I'd recommend e.g. $(Build.SourcesDirectory)\downloads or similar. But at least on my Az DevOps pipeline, writing to Agent.WorkFolder does work, so my error hypothesis is, the NullRef is caused by pot. inconsistent data in your Power Pages within your website.
But to state the obvious, this should still not cause a FastExit error, but instead at least return a more actionable error message.
CC: @ameyaapte1 @MrRishabhJain

Thank you for looking into the issue and trying to solve the problem and also for all suggestions. I have just tried to use $(Build.SourcesDirectory)\downloads :

Sadly the same exception is being thrown.
The difference I see now is that red error messages are missing text:

The website that I have created is standard Power Portal with two custom pages, it is PWA enabled, contains chatbot and requires AD authentication.
The only strange behaviour I have noticed about it is that when I modify value in Portal Management app to disable redirect to profile page after authentication it is still redirecting to profile page.
I did some extra tests, and I can confirm, I am able to execute the CLI on Visual Studio Code for the same website without any problems.
Additionally, I have tried to download different portal on the same environment and effect after executing pipeline is the same.

Is there anything else you would like to know about the portal that could potentially help, or you would like me to check anything?
Kind Regards
Piotr

@PiotrMichalski1987 we were unable to pin down the issue with the stack trace found in the telemetry. Requesting you to please share your log file with us.

Hello,
@davidjenni
The version of the extension installed for VS Code is :

When executing pac tools the result is following:

The version info on the task PowerPlatformDownloadPaportal is:

Power platform installer and "who am I" are using the same version as above 2.0.8 .
Yes, you are right, the authentication method differs. On VS Code I have used interactive username/password authN , when creating authentication profiles. On DevOps I needed to create Power Platform Service Connection using the form below to be able to authenticate when requesting access:
@MrRishabhJain I am attaching logs to this message,
logs_1244.zip

@davidjenni The logs provided by Piotr are missing the PAC CLI logs. Can you help us with the steps to extract these logs from the pipeline run?

@PiotrMichalski1987 @MrRishabhJain
The pac CLI can be located using an existing pipeline variable: $(POWERPLATFORMTOOLS_PACCLIPATH)\pac\tools\logs (this path assumes a Windows build agent).
Piotr, please add a task after the Power Portal Download task, with the green marked properties set:

or in yaml:
- task: PublishPipelineArtifact@1
  displayName: 'Publish pac CLI logs'
  inputs:
    targetPath: '$(POWERPLATFORMTOOLS_PACCLIPATH)\pac\tools\logs'
    artifact: 'pac-cli-logs'
  continueOnError: true
  condition: always()

@davidjenni @MrRishabhJain
pac-cli-logs.zip
Hello, I have updated yaml file and I am attaching the artifact produced to this message


[TSan] Do not report benign race on _swiftEmptyArrayStorage

A previous commit [1] identified and fixed a benign race on
_swiftEmptyArrayStorage.  Unfortunately, we have some code duplication
and the fix was not applied to all the necessary places.  Essentially,
we need to ensure that the "empty array storage" object that backs many
"array like types" is never written to.
I tried to improve the test to capture this, however, it is very
finicky.  Currently, it does not go red on my system even when I remove
the check to avoid the benign race in Release mode.
Relevant classes: Array, ArraySlice, ContiguousArray, ArrayBuffer,
ContiguousArrayBuffer, SliceBuffer.
[1] b9b4c789f32ccd968c0cb7d64f364d819deb3096
rdar://55161564

@swift-ci please test

Also: it might be worth to reduce/remove this code duplication, if possible.

@swift-ci please test

Build failed
Swift Test Linux Platform
Git Sha - 381dcc24fcf8c77d2d0132ea8f194221ea776e99

Build failed
Swift Test OS X Platform
Git Sha - 381dcc24fcf8c77d2d0132ea8f194221ea776e99

@swift-ci Please test Linux platform

I'm a bit late, but this looks good, thanks!


feat(forge test): add --account <some_account> flag to access wallet inside tests

Component
Forge, Cast
Describe the feature you would like
Given that cast supports wallet imports: https://github.com/foundry-rs/foundry/issues/1869, is it possible to get the wallet private key using forge when running tests, instead of putting them in the .env file? For example, via some cheatcode that enables us to get the wallet and obtain the private key?
For reference, deploying via forge script already supports this:
$ forge script script/DeploySimpleStorage.s.sol --rpc-url $SEPOLIA_RPC_URL --broadcast --account <some_account>

But forge test does not. Maybe something like the following would be great:
$ forge test --fork-url $SEPOLIA_RPC_URL --account <some_account>

And then in tests, we can use:
vm.getAccount().privateKey

instead of
vm.envUint("PRIVATE_KEY")

to obtain the private key for deploying onto testnet fork for testing.
Additional context
Original discussion: https://github.com/Cyfrin/foundry-full-course-f23/discussions/1733
Reference: https://github.com/foundry-rs/foundry/issues/6034

there's a similar issue https://github.com/foundry-rs/foundry/issues/8225, going to close this and track in 8225. thank you


Extend docs about Blazor WebAssembly perf

Implements https://github.com/dotnet/aspnetcore/issues/25356
Note: I have added xref and ::: moniker markers in various places - hope I got that right.

Review note: most of the diff here is misleading, because in fact I replaced the first half of the doc with a greatly expanded set of content. I retained the second part (about optimizing download size, linking, etc.), so that aspect of the diff is valid.

Versioning ranges look good.
I'll perform the usual pass after @pranavkm signs off and ping u back to review the grammar+style updates.

Ping to @pranavkm for review on this. Or if you prefer not to review that's fine, but please let us know so we can merge this :)

@SteveSandersonMS This is awaiting some final bits :point_up:, then I'll make a quick pass on it and merge.

@guardrex I've responded to the points above, so over to you to pick final phrasings (and merge). Thanks!

Long doc ... I've reached the midway point. I'll pick back up after lunch. We'll have this merged by EOD.


Budgie-Desktop

Project description
Budgie is a Desktop Environment
Metadata

homepage URL: https://github.com/BuddiesOfBudgie/budgie-desktop
source URL: https://github.com/BuddiesOfBudgie/budgie-desktop
license: gpl2
platforms: linux

Duplicate of #190192.


Reorganize the Charon files into subfolders

Partially done by https://github.com/AeneasVerif/charon/pull/161

That's good enough for me. We'll reorganize more as needed. Reopen if there's something specific you'd like.

This looks good to me.


fix: Bug fixes for Neth and React Example

Description

Fixed keystore bug for Neth.
Fixed types for react example.

Checklist:

[x] I have performed a self-review of my own code
[x] I have commented my code, particularly in hard-to-understand areas
[x] I have made corresponding changes to the documentation
[x] My changes generate no new warnings

Type of change.

[x] FIX - a PR of this type patches a bug.
[ ] FEATURE - a PR of this type introduces a new feature.
[ ] BUILD - a PR of this type introduces build changes.
[ ] CI - a PR of this type introduces CI changes.
[ ] DOCS - a PR of this type introduces DOCS improvement.
[ ] STYLE - a PR of this type introduces style changes.
[ ] REFACTOR - a PR of this type introduces refactoring.
[ ] PERFORMANCE - a PR of this type introduces performance changes.
[ ] TEST - a PR of this type adds more tests.
[ ] CHORE - a PR introduces other changes than the specified above.

Thanks for syncing the changes in this PR. Please let me know if there's anything else. You can also reach directly via TG @mattlock
@DamirSQA @kujtimprenkuSQA


<<<<<<< HEAD 18.40-git-201703301354

When i updated to latest git version i can now read
<<<<<<< HEAD 18.40-git-201703301354 in the version file. It will also show
Theme version    Authentic Theme <<<<<<< HEAD
When i try to manually do a pull i get this message:
authentic-theme$ git pull
M       README.md
M       authentic-lib.pm
M       extensions/file-manager/file-manager-lib.pm
M       extensions/file-manager/file-manager.js
U       extensions/file-manager/file-manager.min.js
A       theme-update.sh
M       unauthenticated/css/authentic.css
U       unauthenticated/css/authentic.min.css
U       unauthenticated/css/bundle.min.css
U       version
Pull is not possible because you have unmerged files.
Please, fix them up in the work tree, and then use 'git add/rm <file>'
as appropriate to mark resolution, or use 'git commit -a'.

That is something you should Google.
From now on, use  ./theme-update.sh to update the theme from Git.

But it can't be my fault if there are CONFLICTS? I even did a git reset --hard but that didn't worked.

It was totally messing up my terminal because i was running it from inside the authentic-theme folder. Maybe you should update your script and prevent it from running if i try to run it from inside the authentic-theme folder?

And correct me if i'm wrong, your script will update even if you don't have any new updates?

You don't need to have .Git directory inside after all. Script will delete it for you.
What terminal did you use? I expected things happening from doing things from with the directory that is deleted. But in my case there was no errors. Try adding to the script cd .. will it solve the problem?
Do you want me to run pull on new updates instead of clone?
I will make blue more bluish.

Yes, it doesn't check anything. It just force updates. Theme will do checking.

Actually you should run the script to preserve subshell:
. ./theme-update.sh
I will post an update tomorrow after more testing. It will stop causing errors even if you run it from inside the changed directory.

Actually, no again. There is better way. I'm about to publish the updated script.

https://github.com/qooob/authentic-theme/commit/118cfe4abb438bd979eb99f5a5987be28e24db18

Didn't you change the color for Pulling in latest changes for? Dark blue on black background is hard to read :(

I actually did and just double checked it. It's not that dark. It's lite in my terminal?


[release-1.22] Fix race (#51364)

Please provide a description of this PR:
Manually cherry pick

@hzxuzhonghu: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

lint_istio_release-1.22
72d4374e5227d69fe250f57aef56a145773cc52d
link
true
/test lint

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Fix https://github.com/istio/istio/issues/51382


Implemented iter() for Set.

Added iter() for Bool, Complex, Float and Int.
Added Set_Iterator and implemented iter() for Set.

Before the iter() method
Exception in thread "main" AttributeError: 'int' object has no attribute '__iter__

but it should give
TypeError: 'int' object is not iterable

So I changed to give correct errors.

This is what I get on Python for Int:
>>> x = 5
>>> x.__iter__()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
AttributeError: 'int' object has no attribute '__iter__'
>>> iter(x)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
TypeError: 'int' object is not iterable

You can verify this result for the other datatypes. It looks like __iter__() should return AttributeError instead of TypeError.
Also, org.Python.iter() seems like it's already implementing the conversion from AttributeError to TypeError.


Allocator size cost benchmark

Could you add the output from the benchmark?

Could you add the output from the benchmark?

Here ya go!  (it is also in the Jira ticket)
$ srun -N1-1 --exclusive ./bin/allocator_memory_cost_benchmark --help
Benchmark the memory overhead per allocation of an Allocator
Usage: /usr/WS2/martymcf/src/benchmark.umpire/build/./bin/allocator_memory_cost_benchmark [OPTIONS]

Options:
  -h,--help                   Print this help message and exit
  -a,--use-allocator TEXT REQUIRED
                              Specify Allocator to use: Host, Quick, or malloc
  -n,--num-allocations UINT:INT in [0 - 100000000] REQUIRED
                              Specify number of allocations to perform
  --no_introspection          Disable introspection
  --show_process_mem_info     Display process memory details

$ srun -N1-1 --exclusive ./bin/allocator_memory_cost_benchmark -a malloc -n $((64*1024*1024))
67108864 4-byte allocs from malloc uses 2.00 gigabytes of memory, costing 31.00 bytes, and 35.8131 nanoseconds per allocation

``
$ srun -N1-1 --exclusive ./bin/allocator_memory_cost_benchmark -a malloc -n $((6410241024)) --show_process_mem_info
67108864 4-byte allocs from malloc
VmExe Total{652.00 kilobytes}, Baseline{652.00 kilobytes}, Cost{0.00 bytes}, or {0.00 bytes}/allocation
VmPTE Total{5.05 megabytes}, Baseline{1.05 megabytes}, Cost{4.00 megabytes}, or {0.00 bytes}/allocation
VmRSS Total{2.50 gigabytes}, Baseline{513.55 megabytes}, Cost{2.00 gigabytes}, or {31.00 bytes}/allocation
VmStk Total{144.00 kilobytes}, Baseline{144.00 kilobytes}, Cost{0.00 bytes}, or {0.00 bytes}/allocation
VmHWM Total{2.50 gigabytes}, Baseline{513.55 megabytes}, Cost{2.00 gigabytes}, or {31.00 bytes}/allocation
VmData Total{2.50 gigabytes}, Baseline{512.28 megabytes}, Cost{2.00 gigabytes}, or {31.00 bytes}/allocation
VmSize Total{2.51 gigabytes}, Baseline{527.07 megabytes}, Cost{2.00 gigabytes}, or {31.00 bytes}/allocation
VmLib Total{3.91 megabytes}, Baseline{3.91 megabytes}, Cost{0.00 bytes}, or {0.00 bytes}/allocation
VmPeak Total{2.51 gigabytes}, Baseline{783.07 megabytes}, Cost{1.75 gigabytes}, or {27.00 bytes}/allocation
Memory Usage HSM Total{2.50 gigabytes}, Baseline{513.55 megabytes}, Cost{2.00 gigabytes}, or {31.00 bytes}/allocation

Also, this may be a dumb question so bear with me, but why are the options Host, Quick, or malloc? Host seems like the resource, HOST, Quick seems like an allocation strategy (Quickpool), and malloc seems like the std function - which all seem like different things, so how can this comparison be done? I feel like I'm missing some context.

Good question.  These names are intended to indicate different kinds of allocator where:
"malloc" - use the raw system call (no Umpire)
"Host" - use the Umpire device allocator (no strategies)
"Quick" - use the Umpire QuickPool strategy
I'm happy to change the names if it will help.  Let me know if you have any suggestions.

Also, this may be a dumb question so bear with me, but why are the options Host, Quick, or malloc? Host seems like the resource, HOST, Quick seems like an allocation strategy (Quickpool), and malloc seems like the std function - which all seem like different things, so how can this comparison be done? I feel like I'm missing some context.

Good question. These names are intended to indicate different kinds of allocator where:
"malloc" - use the raw system call (no Umpire) "Host" - use the Umpire device allocator (no strategies) "Quick" - use the Umpire QuickPool strategy
I'm happy to change the names if it will help. Let me know if you have any suggestions.

Ok, that makes sense. I understand the comparison. The only other question I have is why you name the second one "Host" when we are using the Umpire "device" allocator? I think the other names are fine though. (We have what each allocator name means/is meant to show documented somewhere in the JIRA right? I could see myself forgetting this in a couple months lol)

Also, this may be a dumb question so bear with me, but why are the options Host, Quick, or malloc? Host seems like the resource, HOST, Quick seems like an allocation strategy (Quickpool), and malloc seems like the std function - which all seem like different things, so how can this comparison be done? I feel like I'm missing some context.

Good question. These names are intended to indicate different kinds of allocator where:
"malloc" - use the raw system call (no Umpire) "Host" - use the Umpire device allocator (no strategies) "Quick" - use the Umpire QuickPool strategy
I'm happy to change the names if it will help. Let me know if you have any suggestions.

Ok, that makes sense. I understand the comparison. The only other question I have is why you name the second one "Host" when we are using the Umpire "device" allocator? I think the other names are fine though. (We have what each allocator name means/is meant to show documented somewhere in the JIRA right? I could see myself forgetting this in a couple months lol)

The only reason that I steered away from using DEVICE was because this is really intended to be a HOST-only benchmark. The memory statistics being gathered are all host-centric. I think we would need a different benchmark for devices.

I think that sounds very reasonable. Then the other thing I'm confused about is why "Host" doesn't then just give us a host allocator -- update: I checked this and on line 105, you do grab the HOST resource but you call it "device_allocator". Is there a reason for that?

Also, this may be a dumb question so bear with me, but why are the options Host, Quick, or malloc? Host seems like the resource, HOST, Quick seems like an allocation strategy (Quickpool), and malloc seems like the std function - which all seem like different things, so how can this comparison be done? I feel like I'm missing some context.

Good question. These names are intended to indicate different kinds of allocator where:
"malloc" - use the raw system call (no Umpire) "Host" - use the Umpire device allocator (no strategies) "Quick" - use the Umpire QuickPool strategy
I'm happy to change the names if it will help. Let me know if you have any suggestions.

Ok, that makes sense. I understand the comparison. The only other question I have is why you name the second one "Host" when we are using the Umpire "device" allocator? I think the other names are fine though. (We have what each allocator name means/is meant to show documented somewhere in the JIRA right? I could see myself forgetting this in a couple months lol)

The only reason that I steered away from using DEVICE was because this is really intended to be a HOST-only benchmark. The memory statistics being gathered are all host-centric. I think we would need a different benchmark for devices.

I think that sounds very reasonable. Then the other thing I'm confused about is why "Host" doesn't then just give us a host allocator -- update: I checked this and on line 105, you do grab the HOST resource but you call it "device_allocator". Is there a reason for that?

Good points.  I fixed the variable naming and I updated the help as follows:
$ srun -N1-1 --exclusive ./bin/allocator_memory_cost_benchmark --help
Benchmark the memory overhead per allocation of an Allocator
Usage: /usr/WS2/martymcf/src/benchmark.umpire/build/./bin/allocator_memory_cost_benchmark [OPTIONS]

Options:
  -h,--help                   Print this help message and exit
  -a,--use-allocator TEXT REQUIRED
                              Specify Allocator to use: 'Host', 'Quick', or 'malloc'.
                              When 'malloc' is specified, use the raw system call (no Umpire).
                              When 'Host' is specified, use HOST Umpire resource allocator.
                              When 'Quick' is specified, use the Umpire Quickpool allocator.

  -n,--num-allocations UINT:INT in [0 - 100000000] REQUIRED
                              Specify number of allocations to perform
  --no_introspection          Disable introspection
  --show_process_mem_info     Display process memory details

Thanks Marty!

Thanks Marty!

Does this mean you approve?  Care to click the button? :-)

@davidbeckingsale, this one is ready too


Update abbrs.xlsx

Updated bullets to be USAF (2022Q4) approved. Also included formatting and sorting.

flight plan flt → pln (row 29) is incorrect, it should be flight plan → flt pln →

@Ephellon The problem with the current layout is if this is approved it will be used for all users, including those not under AFGSC. It would be beneficial if @ckhordiasma was able to make the Load Common Abbrvs a drop-down list that had multiple.
I also have a feeling that @ckhordiasma didn't add the complete abbreviations list as he would not want to have people assume it is always correct.

Okay, I can redo it for the new bullet list (uniform across all MAJCOMs)

@Matthewenderle I agree, don't want the default to be a Majcom specific one but maybe a drop-down would be good, will look into that. @Ephellon I can add the one you linked too as the one from Air University

Closing this older PR. Would maybe consider having a dropdown for MAJCOM specific abbreviations or something.


What's the meaning of 'yolt_docker_name' ?

nvidia-docker build -t yolt yolt_docker_name /path_to_yolt/docker

I agree, the instructions are really vague


search page is not working

Search from nav bar works.
Search from here: https://amy.software-carpentry.org/workshops/search/ does not.

This is because the form uses POST instead of GET method. Easy to fix.


Add secure methods for Update/Delete tool operations

Coverage decreased (-0.2%) to 68.045% when pulling 04e6a2c8459071a0237c66cf644ea2795912b8e3 on security15 into 501b9235ece1523ec9d3fcdccbb010fd8f7a41fa on master.


2023/05/19 20:21:07.463055 server.go:1928: [Error] HERTZ: HTTP2: write response body error when serving <IP_ADDRESS>:63047: http: request method or response status code does not allow body

cannot set "consts.StatusNotModified"
how do set status not modified correctly?
using h2 and latest hertz.
how do i "delete" response body then? if the below is correct?
func CtxStatusNotModified(ctx *app.RequestContext) {
	ctx.SetStatusCode(consts.StatusNotModified)
	//with or without below line doesnt work
	//ctx.Response.Header.Set("Cache-Control", "no-transform")
}

func CtxStatusNotModified(ctx *app.RequestContext) {
	ctx.SetStatusCode(consts.StatusNotModified)
	ctx.Response.ResetBody()
	//with or without below line doesnt work
	//ctx.Response.Header.Set("Cache-Control", "no-transform")
}

Please optimize the title to accurately reflect the gist of a problem, rather than being a log.

Please give more information by following the issue template, help us better understand the problem.

It seems to be an issue with the http2 repository.

@rogerogers @Duslia
what more information do you need? i think @Duslia will know and can solve this.
try doing this, return this will get error with h2 usage.
basically you cant return statusnotmodified without showing errors. because somehow it is setting the body or something when no body was set at all.
func CtxStatusNotModified(ctx *app.RequestContext) {
	ctx.SetStatusCode(consts.StatusNotModified)
	//with or without below line doesnt work
	//ctx.Response.Header.Set("Cache-Control", "no-transform")
}

oops, i think i should use
ctx.Response.SetStatusCode(consts.StatusNotModified)
right? :D
will close this after testing. sorry

@li-jin-gou @Duslia @rogerogers
problem is still around whether i put ctx.SetStatusCode or ctx.Response.SetStatusCode or whatever
pls check the title and test what i mean. thx

@Duslia ,  line 1922 gives 1928 error if ctx Status return code is 304 notmodified for:
https://github.com/hertz-contrib/http2
pls check. not sure how u would like to resolve this. maybe if status 304 (or all other statuses that does not have body) dont set body?
pls help fix this. thx
// Run on its own goroutine.
func (sc *serverConn) runHandler(rw *responseWriter, reqCtx *app.RequestContext, handler app.HandlerFunc) {
        didPanic := true
        defer func() {
                var err error

                defer func() {
                        if reqCtx.IsEnableTrace() {
                                Record(reqCtx.GetTraceInfo(), stats.ServerHandleFinish, err)
                        }
                }()

                if didPanic {
                        e := recover()
                        sc.writeFrameFromHandler(FrameWriteRequest{
                                write:  handlerPanicRST{rw.rws.stream.id},
                                stream: rw.rws.stream,
                        })
                        // Same as net/http:
                        if e != nil && e != http.ErrAbortHandler {
                                const size = 64 << 10
                                buf := make([]byte, size)
                                buf = buf[:runtime.Stack(buf, false)]
                                err = fmt.Errorf("HTTP2: panic serving %v: %v\n%s", sc.conn.RemoteAddr(), e, buf)
                                hlog.SystemLogger().Error(err.Error())
                        }
                        return
                }

                if writer := reqCtx.Response.GetHijackWriter(); writer != nil {
                        writer.Finalize()
                        return
                }

                rw.WriteHeader(reqCtx.Response.StatusCode())
                err = writeResponseBody(rw, reqCtx)
                if err != nil {
                        sc.writeFrameFromHandler(FrameWriteRequest{
                                write:  handlerPanicRST{rw.rws.stream.id},
                                stream: rw.rws.stream,
                        })
                        hlog.SystemLogger().Errorf("HTTP2: write response body error when serving %v: %v", sc.conn.RemoteAddr(), err)
                        return
                }

                rw.handlerDone()
        }()
        if reqCtx.IsEnableTrace() {
                Record(reqCtx.GetTraceInfo(), stats.ServerHandleStart, nil)
        }
        handler(rw.rws.stream.baseCtx, reqCtx)

        didPanic = false
}

Please follow the template and fill in the questions as others have done to help understand the questions and the issue will not be actively closed and refer to https://github.com/cloudwego/hertz/issues

@li-jin-gou close this and reopened as you have suggested


Add instruction to enable LDAP auth

I see LDAP only in user_guide.md
Probably it is related to  django-auth-ldap

Hi @lupin-de-mid ,
create settings.py file and add content below. Replace all <...> on something which is specific for your LDAP server configuration. Read django_auth_ldap documentation for more details about different parameters.
Inside docker-compose.override.yml you need to define DJANGO_SETTINGS_MODULE: settings inside environment section for cvat container. It will replace default cvat.settings.production settings file.
from cvat.settings.production import *

# add custom apps here
import ldap
from django_auth_ldap.config import LDAPSearch, NestedActiveDirectoryGroupType

DJANGO_AUTH_TYPE = 'LDAP'
AUTH_LOGIN_NOTE = '''

    For successful login please make sure you are member of cvat_users group

'''

# Baseline configuration.
AUTH_LDAP_SERVER_URI = "ldap://<ldap-host>:<ldap-port>"

# Credentials for LDAP server
AUTH_LDAP_BIND_DN = "<username>"
AUTH_LDAP_BIND_PASSWORD = "<password>"

# Set up basic user search
AUTH_LDAP_USER_SEARCH = LDAPSearch("<params>",
    ldap.SCOPE_SUBTREE, "(sAMAccountName=%(user)s)")

# Set up the basic group parameters.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch("<params>",
    ldap.SCOPE_SUBTREE, "(objectClass=group)")
AUTH_LDAP_GROUP_TYPE = NestedActiveDirectoryGroupType()

# Populate the Django user from the LDAP directory.
AUTH_LDAP_USER_ATTR_MAP = {
    "first_name": "givenName",
    "last_name": "sn",
    "email": "mail",
}

AUTH_LDAP_ALWAYS_UPDATE_USER = True

# Cache group memberships for an hour to minimize LDAP traffic
AUTH_LDAP_CACHE_GROUPS = True
AUTH_LDAP_GROUP_CACHE_TIMEOUT = 3600
AUTH_LDAP_AUTHORIZE_ALL_USERS = True

# Keep ModelBackend around for per-user permissions and maybe a local
# superuser.
AUTHENTICATION_BACKENDS += ['django_auth_ldap.backend.LDAPBackend']

AUTH_LDAP_ADMIN_GROUPS = [
    'CN=cvat_admin,<params>',
]

AUTH_LDAP_ANNOTATOR_GROUPS = [
    'CN=data_annotation,<params>',
]

AUTH_LDAP_USER_GROUPS = [
    'CN=cvat_users,<params>',
]

AUTH_LDAP_OBSERVER_GROUPS = [
    'CN=cvat_users,<params>',
]

@lupin-de-mid , let me know if it doesn't work for you. Could you please help us and contribute some documentation based on your experience and my hints?

Hi @nmanovic, i'll try this week
Is it nesessary to provide groups in ldap?
I prefer manage permissions by cvat itself and use LDAP only for AUTH

Hi @nmanovic, i'll try this week
Is it nesessary to provide groups in ldap?
I prefer manage permissions by cvat itself and use LDAP only for AUTH

It is necessary because it is how CVAT will determine if the user has admin, user, annotator or observer roles. In case of basic authorization you do it manually in admin panel. In case of LDAP, admin panel can not be used anymore for specifying roles (you can but such settings will be reseted after LDAP cache is reinitialized) as far as I remember.

I guess I need a little extra help here.  Where should I put this "settings.py" file? I put it in /cvat/cvat/settings/ but I get an error "ImportError: No module named 'settings'" when I try to build the container.  Thanks.

I used a very similar configuration to the one presented above and I confirm it's working

Where should I put the settings.py file to be picked up by build via docker-compose?

I used a very similar configuration to the one presented above and I confirm it's working
@rcbop Can you describe the detail ?

I install CVAT through helm, how should I configure LDAP?

Hi @lupin-de-mid ,
create settings.py file and add content below. Replace all <...> on something which is specific for your LDAP server configuration. Read django_auth_ldap documentation for more details about different parameters.
Inside docker-compose.override.yml you need to define DJANGO_SETTINGS_MODULE: settings inside environment section for cvat container. It will replace default cvat.settings.production settings file.
from cvat.settings.production import *

# add custom apps here
import ldap
from django_auth_ldap.config import LDAPSearch, NestedActiveDirectoryGroupType

DJANGO_AUTH_TYPE = 'LDAP'
AUTH_LOGIN_NOTE = '''

    For successful login please make sure you are member of cvat_users group

'''

# Baseline configuration.
AUTH_LDAP_SERVER_URI = "ldap://<ldap-host>:<ldap-port>"

# Credentials for LDAP server
AUTH_LDAP_BIND_DN = "<username>"
AUTH_LDAP_BIND_PASSWORD = "<password>"

# Set up basic user search
AUTH_LDAP_USER_SEARCH = LDAPSearch("<params>",
    ldap.SCOPE_SUBTREE, "(sAMAccountName=%(user)s)")

# Set up the basic group parameters.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch("<params>",
    ldap.SCOPE_SUBTREE, "(objectClass=group)")
AUTH_LDAP_GROUP_TYPE = NestedActiveDirectoryGroupType()

# Populate the Django user from the LDAP directory.
AUTH_LDAP_USER_ATTR_MAP = {
    "first_name": "givenName",
    "last_name": "sn",
    "email": "mail",
}

AUTH_LDAP_ALWAYS_UPDATE_USER = True

# Cache group memberships for an hour to minimize LDAP traffic
AUTH_LDAP_CACHE_GROUPS = True
AUTH_LDAP_GROUP_CACHE_TIMEOUT = 3600
AUTH_LDAP_AUTHORIZE_ALL_USERS = True

# Keep ModelBackend around for per-user permissions and maybe a local
# superuser.
AUTHENTICATION_BACKENDS += ['django_auth_ldap.backend.LDAPBackend']

AUTH_LDAP_ADMIN_GROUPS = [
    'CN=cvat_admin,<params>',
]

AUTH_LDAP_ANNOTATOR_GROUPS = [
    'CN=data_annotation,<params>',
]

AUTH_LDAP_USER_GROUPS = [
    'CN=cvat_users,<params>',
]

AUTH_LDAP_OBSERVER_GROUPS = [
    'CN=cvat_users,<params>',
]

this file in settings.py?  and it's path is /home/django/settings.py in container？

from cvat.settings.production import *

I put the settings.py file in the container's /home/django/ directory.it cannot log in with an LDAP account.
Any other places to configure?

Ok this information is pretty far out of date. Configuration settings, environment variables and flow have all changed from 2.x. Here is what I did to get it to work.
We need override several settings in the ./cvat/settings/base.py that isn't listed here.
Make a docker-compose.override.yml in your ./cvat/ folder (where your docker-compose.yml file is).
version: '3.3'

services:
  cvat:
    environment:
      DJANGO_SETTINGS_MODULE: settings
    volumes:
      - ./settings.py:/home/django/settings.py:ro

Create a settings.py file in your ./cvat folder (same directory as above)
Key things we need to override in settings.py are
IAM_TYPE = 'LDAP'
and
DJANGO_AUTH_LDAP_GROUPS
Here is my full working settings.py file (with my LDAP services redacted)
from cvat.settings.production import *

# add custom apps here
import ldap
from django_auth_ldap.config import LDAPSearch, GroupOfNamesType, NestedActiveDirectoryGroupType

IAM_TYPE = 'LDAP'
AUTH_LOGIN_NOTE = '''

    For successful login please make sure you are member of cvat_users group

'''

# Baseline configuration.
AUTH_LDAP_SERVER_URI = "<redacted>"

# Credentials for LDAP server
AUTH_LDAP_BIND_DN = "<redacted>"
AUTH_LDAP_BIND_PASSWORD = "<redacted>"

# Set up basic user search
AUTH_LDAP_USER_SEARCH = LDAPSearch("<redacted>",
    ldap.SCOPE_SUBTREE, "(uid=%(user)s)")

# Set up the basic group parameters.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch("<redacted>",
    ldap.SCOPE_SUBTREE, "(objectClass=groupofnames)")
AUTH_LDAP_GROUP_TYPE = GroupOfNamesType()

# Populate the Django user from the LDAP directory.
AUTH_LDAP_USER_ATTR_MAP = {
    "first_name": "givenName",
    "last_name": "sn",
    "email": "mail",
}

AUTH_LDAP_ALWAYS_UPDATE_USER = True

# Cache group memberships for an hour to minimize LDAP traffic
AUTH_LDAP_CACHE_GROUPS = True
AUTH_LDAP_GROUP_CACHE_TIMEOUT = 3600
AUTH_LDAP_AUTHORIZE_ALL_USERS = False

# Keep ModelBackend around for per-user permissions and maybe a local
# superuser.
AUTHENTICATION_BACKENDS += ['django_auth_ldap.backend.LDAPBackend']

# example 'cn=cvat_admin,cn=groups,cn=accounts,dc=example,dc=com'
AUTH_LDAP_ADMIN_GROUPS = [
    'cn=<redacted>,
]

AUTH_LDAP_WORKER_GROUPS = [
    'cn=<redacted>,
]

AUTH_LDAP_USER_GROUPS = [
    'cn=<redacted>,
]

AUTH_LDAP_BUSINESS_GROUPS = [
    'cn=<redacted>,
]
DJANGO_AUTH_LDAP_GROUPS = {"admin": AUTH_LDAP_ADMIN_GROUPS, "business": AUTH_LDAP_WORKER_GROUPS, "user": AUTH_LDAP_USER_GROUPS, "worker":AUTH_LDAP_BUSINESS_GROUPS}

Three notable changes IAM_TYPE = 'LDAP', AUTH_LDAP_GROUP_TYPE = GroupOfNamesType() (I'm using FreeIPA so we have to use GroupOfNames), and DJANGO_AUTH_LDAP_GROUPS = {"admin": AUTH_LDAP_ADMIN_GROUPS, "business": AUTH_LDAP_WORKER_GROUPS, "user": AUTH_LDAP_USER_GROUPS, "worker":AUTH_LDAP_BUSINESS_GROUPS}.
DJANGO_AUTH_LDAP_GROUPS admin, business, user, worker is coming from IAM_ROLES = [IAM_ADMIN_ROLE, 'business', 'user', 'worker'] in ./cvat/settings/base.py in the code it "matches" based on the keywords in IAM_ROLES. The AUTH_LDAP_ADMIN_GROUPS, AUTH_LDAP_WORKER_GROUPS, AUTH_LDAP_USER_GROUPS , AUTH_LDAP_BUSINESS_GROUPS  need to be added to DJANGO_AUTH_LDAP_GROUPS list depending on your groups. If you want to add more groups, just add more here. Hopefully this helps someone else for v2.x+. This works for me for CVAT v2.1.

@vaskokj
Hello,
The writeup you gave has been invaluable to me getting authentication with Active Directory, but I am unable to get group mappings to work. Are you sure DJANGO_AUTH_LDAP_GROUPS is valid? I cannot find any reference to this variable on google other than this exact issue.
I am able to authenticate, but users with the proper group assigned in the domain do not get elevated in CVAT.
Attached I have snippet of how I have groups set up
AUTH_LDAP_ADMIN_GROUPS = [
    'cn=Domain Admins,cn=Users,dc=ad.dc=example,dc=com',
]

AUTH_LDAP_BUSINESS_GROUPS = [
    'cn=Domain Admins,cn=Users,dc=ad,dc=example,dc=com',
]

AUTH_LDAP_USER_GROUPS = [
    'cn=Users,dc=ad,dc=example,dc=com',
]

AUTH_LDAP_WORKER_GROUPS = [
    'cn=Users,dc=ad,dc=example,dc=com',
]

DJANGO_AUTH_LDAP_GROUPS = {
    "admin": AUTH_LDAP_ADMIN_GROUPS,
    "business": AUTH_LDAP_BUSINESS_GROUPS,
    "user": AUTH_LDAP_USER_GROUPS,
    "worker": AUTH_LDAP_WORKER_GROUPS,
}

The assumption is that Domain Admins are elevated to admin in CVAT but this does not appear to be the case.

@RyanHir Here is a less redacted version of that section.
# Keep ModelBackend around for per-user permissions and maybe a local
# superuser.
AUTHENTICATION_BACKENDS += ['django_auth_ldap.backend.LDAPBackend']

AUTH_LDAP_ADMIN_GROUPS = [
    'CN=cvat_admin,cn=groups,cn=accounts,dc=example,dc=com',
]

AUTH_LDAP_WORKER_GROUPS = [
    'CN=cvat_worker,cn=groups,cn=accounts,dc=example,dc=com',
]

AUTH_LDAP_USER_GROUPS = [
    'CN=cvat_users,cn=groups,cn=accounts,dc=examples,dc=com',
]

AUTH_LDAP_BUSINESS_GROUPS = [
    'CN=cvat_business,cn=groups,cn=accounts,dc=example,dc=com',
]
DJANGO_AUTH_LDAP_GROUPS = {
    "admin": AUTH_LDAP_ADMIN_GROUPS,
    "worker": AUTH_LDAP_WORKER_GROUPS,
    "user": AUTH_LDAP_USER_GROUPS,
    "business":AUTH_LDAP_BUSINESS_GROUPS
}

One other thing to check would be the group search section. You might be failing to find your groups depending on where you are searching.
# Set up the basic group parameters.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch("cn=groups,cn=accounts,dc=example,dc=com",
    ldap.SCOPE_SUBTREE, "(objectClass=groupofnames)")
AUTH_LDAP_GROUP_TYPE = GroupOfNamesType()

I did end up having to change AUTH_LDAP_GROUP_TYPE. Since you are using AD you might need https://django-auth-ldap.readthedocs.io/en/latest/reference.html#django_auth_ldap.config.ActiveDirectoryGroupType. See the list of options here from django. https://django-auth-ldap.readthedocs.io/en/latest/reference.html#django_auth_ldap.config.ActiveDirectoryGroupType
Also double check your SCOPE_SUBTREE. Running a query on the users and groups and getting all of their options should give you want you need to search for in this config.
I will note that the permissions that this enables is extremely vague. I never could find a good clear understanding of what permissions each one of these items gives you.
Hopefully this helps.

@vaskokj I have recreated a config as close to what you have with FreeIPA, but I am still unable to get CVAT group assignment to work. I even deleted all volumes to ensure CVAT accounts are being recreated. ldapsearch is showing that the user is correctly assigned to be a member of cn=cvat_admins,cn=groups,cn=accounts,dc=ipa,dc=example,dc=com.
# We are overlaying production
from cvat.settings.production import *

# Custom code below
import ldap
from django_auth_ldap.config import LDAPSearch
from django_auth_ldap.config import GroupOfNamesType

# Notify CVAT that we are using LDAP authentication
DJANGO_AUTH_TYPE = 'LDAP'

# Talking to the LDAP server
AUTH_LDAP_SERVER_URI = "ldap://ipa.example.com" # IP Addresses also work
ldap.set_option(ldap.OPT_REFERRALS, 0)

# Authenticating with the LDAP server
AUTH_LDAP_BIND_DN = "CN=cvat_bind,CN=Users,CN=Accounts,DC=ipa,DC=example,DC=com"
AUTH_LDAP_BIND_PASSWORD = "SuperSecurePassword^21"

AUTH_LDAP_USER_SEARCH = LDAPSearch(
    "CN=Users,CN=Accounts,DC=ipa,DC=example,DC=com",
    ldap.SCOPE_SUBTREE,
    "(uid=%(user)s)"
)

AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
    "CN=Groups,CN=Accounts,DC=ipa,DC=example,DC=com",
    ldap.SCOPE_SUBTREE,
    "(objectClass=groupOfNames)"
)

# Mapping Django field names to FreeIPA attributes
AUTH_LDAP_USER_ATTR_MAP = {
    "user_name": "uid",
    "first_name": "givenName",
    "last_name": "sn",
    "email": "mail",
}

# Group Management
AUTH_LDAP_GROUP_TYPE = GroupOfNamesType()

# Register Django LDAP backend
AUTHENTICATION_BACKENDS += ['django_auth_ldap.backend.LDAPBackend']

# Map FreeIPA groups to Django/CVAT groups.
AUTH_LDAP_ADMIN_GROUPS = [
    'CN=cvat_admins,CN=Groups,CN=Accounts,DC=ipa,DC=example,DC=com',
]
AUTH_LDAP_BUSINESS_GROUPS = [
    'CN=cvat_managers,CN=Groups,CN=Accounts,DC=ipa,DC=example,DC=com',
]
AUTH_LDAP_WORKER_GROUPS = [
    'CN=Groups,CN=Accounts,DC=ipa,DC=example,DC=com',
]
AUTH_LDAP_USER_GROUPS = [
    'CN=Groups,CN=Accounts,DC=ipa,DC=example,DC=com',
]

DJANGO_AUTH_LDAP_GROUPS = {
    "admin": AUTH_LDAP_ADMIN_GROUPS,
    "business": AUTH_LDAP_BUSINESS_GROUPS,
    "user": AUTH_LDAP_USER_GROUPS,
    "worker": AUTH_LDAP_WORKER_GROUPS,
}

I believe the issue is with CVAT itself, I opened an issue earlier when I was working with Active Directory documentation cvat-ai/cvat#40

@RyanHir
I had the same problem. Users could authenticate but it wasn't pulling the groups properly. Same symptoms, I could have missed something in my config here, but it might be a difference in our environments (e.g. FreeIPA vs AD).
What I did to debug the issue is add log statements into this piece of code https://github.com/openvinotoolkit/cvat/blob/develop/cvat/apps/iam/signals.py#L34 to see what CVAT thought each user was in.

@vaskokj
I do not think it is an issue of environments, as I can recreate this on both FreeIPA and AD. I will look into adding logs.

Fair enough. Can you check your cn=Users,dc=ad.dc=example,dc=com to make sure you are pulling your cn properly? cn being uid vs users vs accounts, etc.?

Whoops, that was a typo. I corrected that earlier, but forgot to put that down. From the best I can tell, I am pulling the correct properties.

I found after putting logs that DJANGO_AUTH_TYPE needs to be replaced with IAM_TYPE. And I later discovered that in my config, the group name was incorrect cvat_admin vs cvat_admins.

@RyanHir Glad you figured it out. I missed that too in your question but looks like I had it in my comment https://github.com/openvinotoolkit/cvat/issues/311#issuecomment-1146163794. This section of code is really sketch and probably needs to be reevaluated.

Thanks to everyone else in this thread.
In case it helps others I've successfully integrated this with authentik using the below settings.py:
"""LDAP authentication override for CVAT

See:
* https://github.com/opencv/cvat/issues/311 for helpful information with cvat
* https://version-2024-2.goauthentik.io/docs/providers/ldap/ for canonical authentik reference
* https://django-auth-ldap.readthedocs.io/en/latest/authentication.html for Django LDAP docs
"""
import os
from cvat.settings.production import *

# add custom apps here
import ldap
from django_auth_ldap.config import LDAPSearch, GroupOfNamesType, NestedActiveDirectoryGroupType

# ========================
# AUTHENTIK
#
# You can find this info from the `LDAP Provider` page in authentik once you have created it
# ========================
BASE_DN: str = os.environ.get("BASE_DN","ou=cvat,dc=ldap,dc=goauthentik,dc=io")  # also called `Search base` in authentik
USERS_DN: str = os.environ.get("USERS_DN",f"ou=users,{BASE_DN}")
GROUPS_DN: str = os.environ.get("GROUPS_DN",f"ou=groups,{BASE_DN}")
AUTH_LDAP_BIND_DN: str = os.environ.get("BIND_DN",f"cn=akadmin,{USERS_DN}")  # Credentials for LDAP server
AUTH_LDAP_BIND_PASSWORD: str = os.environ.get("AUTH_LDAP_BIND_PASSWORD")  # Credentials for LDAP server
if not AUTH_LDAP_BIND_PASSWORD:
    raise Exception("AUTH_LDAP_BIND_PASSWORD environment variable not found.")
# ========================

IAM_TYPE = 'LDAP'
AUTH_LOGIN_NOTE = '''

    For successful login please make sure you are member of cvat_users group

'''

# Baseline configuration.
AUTH_LDAP_SERVER_URI = os.environ.get('AUTH_LDAP_SERVER_URI', 'ldap://authentik_ldap:3389')
if not AUTH_LDAP_SERVER_URI:
    raise Exception("AUTH_LDAP_SERVER_URI environment variable not found.")
ldap.set_option(ldap.OPT_REFERRALS, 0)  # disable referrals

# Set up basic user search
AUTH_LDAP_USER_SEARCH = LDAPSearch(USERS_DN,
    ldap.SCOPE_SUBTREE, "(cn=%(user)s)")

# Set up the basic group parameters.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch(GROUPS_DN,
    ldap.SCOPE_SUBTREE, "(objectClass=groupofnames)")
AUTH_LDAP_GROUP_TYPE = GroupOfNamesType()

# Populate the Django user from the LDAP directory.
AUTH_LDAP_USER_ATTR_MAP = {
    "user_name": "cn",
    "first_name": "cn",
    "last_name": "sn",
    "email": "mail",
}

AUTH_LDAP_ALWAYS_UPDATE_USER = True

# Cache group memberships for an hour to minimize LDAP traffic
AUTH_LDAP_CACHE_GROUPS = True
AUTH_LDAP_GROUP_CACHE_TIMEOUT = 3600
AUTH_LDAP_AUTHORIZE_ALL_USERS = False

# Keep ModelBackend around for per-user permissions and maybe a local
# superuser.
AUTHENTICATION_BACKENDS += ['django_auth_ldap.backend.LDAPBackend']

# example 'cn=cvat_admin,cn=groups,cn=accounts,dc=example,dc=com'
# change your cn to match whatever groups you have in your LDAP
AUTH_LDAP_ADMIN_GROUPS = [
    f'cn=cvat_admins,{GROUPS_DN}'
]

AUTH_LDAP_WORKER_GROUPS = [
    f'cn=cvat_workers,{GROUPS_DN}'
]

AUTH_LDAP_USER_GROUPS = [
    f'cn=cvat_users,{GROUPS_DN}'
]

AUTH_LDAP_BUSINESS_GROUPS = [
    f'cn=cvat_managers,{GROUPS_DN}'
]

DJANGO_AUTH_LDAP_GROUPS = {
    "admin": AUTH_LDAP_ADMIN_GROUPS,
    "business": AUTH_LDAP_WORKER_GROUPS,
    "user": AUTH_LDAP_USER_GROUPS,
    "worker":AUTH_LDAP_BUSINESS_GROUPS
}

The docker-compose-ldap.override.yaml I used on top of the basic one provided in the repository (note the external ldap network that my authentik outpost is connected to). Note you'll need to use a .env file to pass through the necessary environment variables to the settings.py above.
You'll run this with a command similar to docker-compose -f cvat/docker-compose.yml -f docker-compose-dev.override.yaml -f docker-compose-ldap.override.yaml up (where I'm using both some development environment overrides as well as the LDAP one finally).
# file: docker-compose-ldap.override.yaml
services:
  cvat_server:
    env_file: .env
    environment:
      DJANGO_SETTINGS_MODULE: settings
    volumes:
      - ../settings.py:/home/django/settings.py:ro
    networks:
      ldap:

networks:
  ldap:
    name: ldap
    external: true

And then finally the additional LDAP service I needed to add in my authentik docker-compose file.
# file: authentik/docker-compose.yaml
services:
  ...
  # LDAP Outpost
  authentik_ldap:
    env_file: .env
    image: ghcr.io/goauthentik/ldap
    hostname: ldap.${ROOT_DOMAIN}
    # Optionally specify which networks the container should be
    # might be needed to reach the core authentik server
    networks:
      - default
      - ldap
    ports:
      - 389 # 389:3389 | LDAP server
      - 636 # 636:6636 | LDAP SSL server
      - 9300 # Metrics server
    environment:
      AUTHENTIK_HOST: http://auth.${ROOT_DOMAIN}
      AUTHENTIK_INSECURE: "true"
      AUTHENTIK_TOKEN: ${LDAP_TOKEN}
      AUTHENTIK_DEBUG: true # unset/false in production


Add Trivy image scanning

I am +1 this, its my PR but not my code 🤷
I am sure we can refine things, but we should just do this to see how we are looking.

Converting to draft while I get this back in shape and start addressing comments

We're back in business folks.
I've set off a few example workflows:
this one pushing only 'clean images'
this one pushing both clean and vulnerable images, and 'failing' on seed builds but skipping it and continuing with overcloud builds
To be honest, we could already to with a bit of a refactor. It's probably sensible to use the trivy action rather than run it manually, but this way works for now and improvements can come in another PR.

Current changes still untested

Same deal as before, two test workflows. One pushing dodgy images, one not:
Only pushing clean images
Pushing everything

From meeting: print out a list of dirty images if we fail.

Test of the latest changes to print out a list of failed pushes & scans -> https://github.com/stackhpc/stackhpc-kayobe-config/actions/runs/8141944049/job/22250383251

From meeting: print out a list of dirty images if we fail.

Done

That's enough fiddling. Ready for review again. All images are building now which is nice: https://github.com/stackhpc/stackhpc-kayobe-config/actions/runs/8174658638


Making an interface for the Driver

Reasons for doing this:

The code is more complete, every type used except the GraphDatabase is an interface
It is easier to make code that can pass an IDriver instance to a class and then make unittests for this class.
In the future, it could be possible to have different driver implementations that the GraphDatabase returns depending on settings etc. - without breaking existing client code.

It is a reasonable change. I will try to look into the red test build tomorrow. It seems a server problem to me. I thought the build will recover itself, but I 'd better double check it tomorrow.

I was super confused by the test failure in DriverAuthSteps. It turns out the bug is we forget to change to IDriver there. Then I rebase the PR and get this one.


[Bug]: settings menu close button only triggers a close when click directly on icon and not entire button

Description
Encountered an error when attempting to close the settings menu by clicking on the close menu button. The hover state indicates that the button is active and clicking triggers a ripple effect, but the menu does not close. This is likely due to the listener being set on the wrong element.
Related Issues
None.
Questions
No.
Demo
No response
Reproduction
-   open the settings menu.
-   try closing the menu without explicitly clicking on the `x` icon.

Expected Results
The menu should close.

Actual Results
The close button ripples, but does not close.

Environments
Firefox, Chrome, Safari, Microsoft Edge, Internet Explorer, Other Browser
Browser Version
No response
Node.js / npm Version
No response
Platform
No response
Checklist

[X] Read and understood the Code of Conduct.
[X] Searched for existing issues and pull requests.

This has been addressed.


Update for FirebaseAuthUI

This updates the authentication quickstart to use FirebaseAuthUI. There were a few modifications needed to make the quickstart run smoothly again after updating to FirebaseAuthUI. These modifications included but was not limited to:

update the gradle version of the project
set the minimum android version to 19 (required for auth ui)
update cocoapods to their latest version
remove the login page as firebase ui provides its own page
implement routing for forgotten password etc...
add a profile screen
update cleartext security rules so using firebase emulators on the latest android version work well

In other quickstarts we usually have a dedicated screen for Firebase UI. And we still demo the regular auth flows in other screens (one method per screen, see quickstart-android as an example). Do we want to do the same for Flutter?

LGTM

@thatfiredev good point, I think we can have a follow up PR adding a non-FFUI screen.

we have an issue to track:
https://github.com/firebase/quickstart-flutter/issues/13


Question: how to mark service as safe

Dear,
Not really an issue but something that is unclear to me. I'm currently developing a self-hosting service which listens to a certain port using TopShelf. Once installed on a client's computer, it happens that the Windows Defender deletes the service. We can opt to add an exception to the Windows Defender but I was wondering if signing the assembly would do the trick for being safe for all virus scanners?
If so, is there a tutorial/blog on how to do it? Can't find anything searching the internet...
Kind regards,
Kevin Cocquyt

Quit writing Malware?

Joking, but seriously, why would Defender delete it? I've never seen this happen on my machine.

It's something our client informed us on. That the folder where the service was located (exe) from where it was installed got deleted and he asked us if we could create some sort of exception for our service. Dunno really what to do with it or why it would be an issue but apparently for some, it is.

Sounds like an issue with their Malware detection software, that's where exceptions are usually specified.
Maybe some type of code signing on the EXE?


Fix(1220): border styles

What kind of change does this PR introduce?
Bug fix related to #1220

Other information:

Applied new styling rules for table-default using Tailwind CSS utilities.
Improved code readability and maintainability by centralizing table styles in index.css.

Thanks @anasKhafaga Looks good!


Update script.js for count down timer

Js for countdown timer  #1059

Hii.. @nikohoffren
Have a look.

Merged

This is an automated message from Fork, Commit, Merge [BOT].

Thank you for your contribution! Your pull request has been merged. The files have been reset for the next contributor.
What's next?
If you're looking for more ways to contribute, I invite you to check out my other projects. Just click here to find more. These projects contain real issues that you can help resolve. You can also check out the Influences section in the README to find more projects similar to this one.
Also please leave a star to this project if you feel it helped you, i would really appreciate it.
I look forward to seeing your contributions!


memcached: 1.4.20 -> 1.4.32 for CVE-2016-8704, CVE-2016-8705, CVE-201…

Motivation for this change
https://lwn.net/Vulnerabilities/705214/
https://github.com/NixOS/nixpkgs/issues/20078
Things done

[x] Tested using sandboxing
(nix.useSandbox on NixOS,
or option build-use-sandbox in nix.conf
on non-NixOS)
Built on platform(s)

[x] NixOS
[ ] OS X
[ ] Linux

[x] Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
[x] Tested execution of all binary files (usually in ./result/bin/)
[x] Fits CONTRIBUTING.md.

…6-8706
https://lwn.net/Vulnerabilities/705214/

Apparently, there is a 1.4.33 release that fixes another issue (see here). Maybe use that version ?


Ctrl+s saves/overwrites the wrong content to the wrong file - Can cause lost work

VSCode Version: Code 1.12.2 (19222cdc84ce72202478ba1cec5cb557b71163de, 2017-05-10T13:20:36.315Z)
OS Version: Windows_NT ia32 10.0.15063
Extensions:

Extension
Author
Version

python
donjayamanne
0.6.3

intellij-idea-keybindings
k--kato
0.2.10

python
tht13
0.2.3

I've lost my work twice in a few days because of this, so I hope this is addressed quickly if it turns out it's not just me. The potential bug is best explained by describing steps to reproduce.
Steps to Reproduce:

Open a file in a separate VSCode window, make some changes then save changes
Open a new file (Ctrl+N) that opens in a new tab in the same VSCode window
Make changes to the new unsaved and untitled file
Without saving the new file, go back to original file, make more changes
Save the changes with Ctrl+S

Unexpectedly, the "Save as..." window appears. When this happened to me the second time I wondered if I had the wrong file/tab open when pressing Ctrl+S, but I could see that I had the correct tab open/selected behind the "Save as..." window.

There's no reason to rename the file, so save it with the same path/name as before

A dialog asking to confirm overwriting the existing file appears.

Confirm overwriting.

Upon confirming, a few things happen:

The open/selected tab disappears
The previously unsaved file is now displayed
The unsaved file has now been saved with whatever specified in the "Save as..." window
If the same path/name as the original file was specified, the original file has now been overwritten
Ctrl+Z history from the original file has been wiped, removing the last hope for retrieving the lost file contents

@JoakimNil the bug here is that Ctrl+S shows the save dialog, which is unexpected. Can you share your keybindings.json file with me? Could it be you have Ctrl+S associated with "Save All"?
Another thing to try is to see if it reproduces with extensions disabled:
I wonder if this issue is being caused by an installed extension. Can you try to run VS Code without extensions? From the command line (NOT the integrated terminal in Code), execute: code --disable-extensions and try your steps again to see if it reproduces. If you see it is an issue with the extension, please file it against the extension repository itself.

Thank you for the suggestion - I did in fact have Ctrl + S associated with "Save all" - in addition to "Save". I imported the keymap from IntelliJ (where Ctrl+S = "Save all" by default), so I assume that's how that happened. The problem is gone after removing the "Save all" keybinding.

@waderyan fyi on the intellij keybinding issue.


Is there any way to restrict update propagation

In my setup I have read/write clients. Both may access document and its changes, but updates form 'read' clients should not be applied on document and propagated.
Is there a way to achieve this now? Or may it be a feature request 😉?

I m not sure maybe something like this:
https://github.com/mk45/y-socket.io/commit/036ca45500ff82bc24c9a3e825c7f6ba47eb577a
I will be grateful for Your opinion. I can make pull request later

Hello, I find the functionality you are looking for interesting and the code you suggest as well. However, I have carried out tests implementing said suggestion and I have realized that it does not consider certain things, for your suggestion to work correctly I think that the implementation that you suggest should also be done for the client side both in socket events and in events through broadcast channel. Without considering this, there is a difference between the client and server document, since the server does what you want (not apply the update) but the client:

On the one hand, if you have the use of broadcast channel enabled, it transfers the change anyway (in case the same document is being used in more than one tab).

On the other hand, in case the broadcast channel is not being used (or it is being used but the update restriction implementation in the previous point has already been implemented) the client applies the change locally, but since the server rejects the update, the other clients connected to the document do not receive the change, which is perfect, the problem is that the client that made the rejected edition, since it already applied the change locally, is left with a state that differs from the state of the server, which results in in a false sense of editing to the user, which can be annoying to your user experience.

Currently as this package does not have a robust permissions system, the simplest thing for now is to "lock" the edit fields in the view so that the read-only user has no way to apply changes to the document (I know the latter is not is best, as it is always good for data security to have server-side validation). However, if you want to make an implementation that considers the points mentioned above, go ahead, I will gladly receive your contribution.
On the client side you could add a booleand that specifies if it is a read-only client and then in the provider validate that if it is a read-only client it does not apply the update locally or something similar and in this way I think you could achieve what you are looking for simple and complete way.
I hope I have been of help to you, I am attentive to your comments.
PS: It is planned that in version 2.0 of the package, this functionality will be considered along with others, but it would be for a medium/long term, due to the low availability that my work leaves me, for which I apologize.

Thank You for your reply and describing details about Your concerns.
I believe that credential information are obtained during some login proces so frontend have the knowledge about user restrictions and permissions. I planned to do as You said and make fields read-only on frontend but I must not thrust the frontend in my current setup.
The only part left is what You mentioned earlier: "It is always good for data security to have server-side validation". I guess I won't have enough time to make client part implementations, but I'll try to test proposed changes directly and fix its issues. I'll let You know if I have anything more to share or ask

hi , i made a version with read,write permission handler in auth level , and when i tested in my project, will send pull request for this feature.
https://github.com/amirrezasalimi/y-socket.io
https://github.com/ivan-topp/y-socket.io/compare/main...amirrezasalimi:y-socket.io:main
tnx for y-socket @ivan-topp


Documentation on reporting function signatures

This adds some documentation on how to write function doc-strings so they can be parsed by inspect.signature and thus be displayed in applications like IPython.

I also fixed a few typos on the go. Please let me know if there's anything you'd like me to change!
 In the long run, we might want to add some special syntax that is more idiomatic to Rust and rewrite it to CPython syntax in the proc macro.
Edit: We could also auto-generate this stuff -- all required information is probably already available for the sake of passing the arguments to Python etc..

cc: @konstin
I don't know so much about this feature.

Thank you, great to see improvements on the documentation!
We can take that even further, for which I've created #305.


Adding logo to images required to build the pdf from tex

@ta-oliver I've added logo to images that is essential to create pdfs from tex file.

@ta-oliver can you please provide the following images required for tex file ChangeRelationship.

Market_ResearchSeries_360_380.pdf
Market_ResearchValue_360_380.pdf
Allocation_MarketSeries_360_380.pdf
Allocation_ResearchValue_360_380.pdf

Above mentioned pdfs are not included in images folder that you've provided or in the images directory.

trading_rule_std_graphs.zip
Please find attached.

Hi @fhashim ,
The LevelRegression has a mismatch between file name and file title? This is probably not a new problem, but does it affect many of the files?

Hello @ta-oliver
I will rectify the name mismatch. Apart from this file following files also have name mismatch

DifferentialAverages should be renamed as  DifferentialMovingAverages
MovingAverageMomentum should be renamed as  DifferentialMovingAverageMomentum
LogitWeightingOfResearchDifferential  should be replaced with ProportionalWeighting and  ProportionalWeighting to be renamed as LogitWeightingOfResearchDifferential.
RollingPriceCombinationRegression to be renamed as RollingPriceChangeRegression.
MovingAverages should be discarded and MovingAverageRule should be renamed as MovingAverage.

@ta-oliver please review the above changes.

@ta-oliver I've ran all the tex files to check if they compile successfully. All the tex files are can be compiled without errors. In case where there were any errors I've rectified those tex files.
However, I would suggest recompiling the tex file and replace generated PDFs with the current ones as I've observed that though the tex file compiled successfully but the PDFs present didn't matched with the PDFs generated using current tex files. I've listed few of them

StaticCombinationRegression
StaticDifferenceRegression
StaticLogDifferenceRegression

All the above mentioned files were not updated as per their current tex files. I've updated them now. However, in case if there is a minute difference it would be difficult to identify by just looking at the PDFs of compiled tex files and PDFs currently present. Hence I would like to update all PDFs in folder with the PDFs generated after compiling the current tex files. @ta-oliver please comment on this. thanks

@fhashim - a full update sounds good for consistency.

Hello @ta-oliver
I will rectify the name mismatch. Apart from this file following files also have name mismatch

DifferentialAverages should be renamed as  DifferentialMovingAverages
MovingAverageMomentum should be renamed as  DifferentialMovingAverageMomentum
LogitWeightingOfResearchDifferential  should be replaced with ProportionalWeighting and  ProportionalWeighting to be renamed as LogitWeightingOfResearchDifferential.
RollingPriceCombinationRegression to be renamed as RollingPriceChangeRegression.
MovingAverages should be discarded and MovingAverageRule should be renamed as MovingAverage.

@ta-oliver please review the above changes.

@ta-oliver can you also make comment on the above. thanks

@ta-oliver can you also make comment on the above. thanks

Aligning sounds good. Are there specific cases you want to check with me or okay to proceed?

@ta-oliver can you also make comment on the above. thanks

Aligning sounds good. Are there specific cases you want to check with me or okay to proceed?

@ta-oliver Just wanted to confirm if it is fine to make the changes. I will make the changes and update PDFs as per their respective tex files. Once done I will push all the commit to this branch which can be merged with main branch and we can close this branch.

If there is something you are not sure is a good idea I'm happy to discuss, but fixing mismatches sounds good. Eventually it could be good to talk to users about the current files and see if any helpful clarifications could be added (e.g. more equation, diagrams or text), once we have comprehensive coverage.

@ta-oliver just wanted to confirm if I can proceed. I will fix the mismatches.


Bug: Middleware Authentication Fails When postLogoutRedirectURL is Undefined

Prerequisites

[X] I have searched the repository’s issues and Kinde community to ensure my issue isn’t a duplicate
[X] I have checked the latest version of the library to replicate my issue
[X] I have read the contributing guidelines
[X] I agree to the terms within the code of conduct

Description:
There's an edge-case bug in the authMiddleware found in src/authMiddleware/authMiddleware.js where the middleware authentication fails with a TypeError if the postLogoutRedirectURL environment variable is not set. This results from the trimTrailingSlash function being called with an undefined value.
Happy to do any of the suggested fixes, just wanted to check before submitting. Or we could just close with RTFM of setting the value of course (I was testing and took it out)
Steps to Reproduce:

Ensure the postLogoutRedirectURL environment variable is not set.
Run the application and trigger the authMiddleware by browsing to a directory that encompassed by the matcher

Expected Behaviour:
The middleware should handle the absence of postLogoutRedirectURL gracefully, either by falling back to a default value or by providing a clear error message indicating that the postLogoutRedirectURL configuration is missing.
Actual Behavior:
A TypeError: Cannot read properties of undefined (reading 'charAt') error is thrown, stemming from the trimTrailingSlash function.
Suggested Fix:
There are several ways to address this issue:

Input Validation:

Perform a check for undefined before calling trimTrailingSlash.

const logoutUrl = config.postLogoutRedirectURL ? trimTrailingSlash(config.postLogoutRedirectURL) : undefined;

Configuration Validation:
Fail the configuration load if postLogoutRedirectURL is not set, providing a clear error message to the developer.

Default Value: Provide a default value for postLogoutRedirectURL in case it's not set.

Error Handling: Enhance error handling within trimTrailingSlash to cope with undefined inputs gracefully.

Library URL
https://github.com/kinde-oss/kinde-auth-nextjs
Library version
1.8.21
Operating system(s)
macOS
Operating system version(s)
Mac OS 14.0
Further environment details
No response
Reproducible test case URL
No response
Additional information
No response

Thanks for raising @thesampaton , we'll put a fix in for this shortly

Hey @thesampaton this should be resolved now in latest version - thanks again for flagging

Awesome thanks, sorry the PR to do the fix from previous comment was on my list but I was smaaaaashed this week


Automated Package Upgrade

:tada: This PR is included in version 25.3.151 :tada:
The release is available on:

npm package (@latest dist-tag)
GitHub release

Your semantic-release bot :package::rocket:


Add automatic page breaks in HTML and text functions

It'd be helpful if we could calculate the end of a page with HTML rendering functions. This would have to take some kind of page margin.

Lack of automatic page breaks in HTML is probably the only reason why we are not using this plugin. Would be great to have!

+1

+1

I'm copying this from another comment, but you can sort of do this:
For people coming here later trying to figure this out, the <!-- ADD_PAGE --> option no longer seems to exist. You have a couple of choices here now. You can add pagesplit to your options in the call to addHTML like so:
pdf.addHTML($(modalID).get(0), {pagesplit: true}, callback);

The pagesplit option will just break anywhere it pleases, which might be in the middle of a line of text so this might not be desirable in all cases. Alternatively, you can manually paginate your document by nesting the callback like so:
pdf.addHTML($(elementSelector).get(0), function(){
    pdf.addPage();
    pdf.addHTML($(differentElementSelector).get(0), function(){
        pdf.save("plan.pdf");
    });
});

I would suggest recursion if that gets too deep. The above will add an element, terminate the page, add another element, and then save the PDF in that state.

We are closing this issue, because we will not support any longer fromHTML and addHTML.
Explaination:
We are working on a new html2pdf plugin, which will be based on html2canvas and our context2d plugin. This should lead to more reliable results for your projects. And it will give us the time to focus on the core functionality of pdf-generation because we will not use our energy for writing/supporting/extending 2 html plugins. If you still want to use addHTML or fromHTML you can still use jsPDF 1.4.1.
Best Regards

Hi Arasabbasi, Please help to suggest me a link to follow for html2pdf plugin usage in angularjs for exporting whole html page or part of html page to PDF. Thanks.

My Code:
const doc = jsPDF();
doc.addHTML(document.getElementById('exportContainer'), 10, 10, {
pagesplit: true,
margin: {
top: 10,
right: 10,
bottom: 10,
left: 10,
useFor: 'page'
}
}, function () {
doc.save("test.pdf")
});
Web Display:

Exported As:

@arasabbasi Please look in above code, web and exported page. Page is not exported properly in multiple pages. Right columns in the table are exported to next page.
@arasabbasi Please help to suggest me a link to follow for html2pdf plugin usage in angularjs for exporting whole html page or part of html page to PDF. Thanks.


Type check falsely succeeds with --n_cores x where x > 1

First a few version infos:
Z3 version 4.4.1
fstar.exe --version
F* <IP_ADDRESS>
platform=Linux_x86_64
compiler=OCaml 4.05.0
date=2018-05-17T23:34:58+00:00
commit=743819b90

Here's what I did:

Type checked some fst file which opens some modules and used --n_cores 4 as well as an --include ... option on fstar.
Type check succeeds (while it obviously shouldn't from looking at the code!).
Did exactly the same with --n_cores 1 (explicitly and implicitly - didn't notice any difference).
Type check fails (as expected).

The wrong behavior is reproducible, also with --n_cores 2 and 3 (probably anything greater than 1).
Unfortunately, I can't just post the actual code I was working on, but I'll try to get some kind of minimal working example to illustrate the problem and post it here. Maybe interesting: The part of the code expected to fail is the "definition" of a lemma (such as: my_lemma a b c = ()).
Here's the command line log (with some names changed, but you get the idea):
$ fstar.exe --include ../../modules --n_cores 4 System.fst
Verified module: System (5760 milliseconds)
All verification conditions discharged successfully

$ fstar.exe --include ../../modules --n_cores 3 System.fst
Verified module: System (5808 milliseconds)
All verification conditions discharged successfully

$ fstar.exe --include ../../modules --n_cores 2 System.fst
Verified module: System (5743 milliseconds)
All verification conditions discharged successfully
Thread 5 killed on uncaught exception Sys_error("Bad file descriptor")
Raised by primitive operation at file "pervasives.ml", line 403, characters 7-32
Called from file "src/batInnerIO.ml", line 381, characters 16-41
Called from file "src/batInnerIO.ml", line 215, characters 16-34
Called from file "src/batInnerIO.ml", line 311, characters 12-26
Called from file "src/batInnerIO.ml", line 317, characters 4-10
Called from file "src/basic/ml/FStar_Util.ml", line 217, characters 14-39
Called from file "thread.ml", line 39, characters 8-14

$ fstar.exe --include ../../modules --n_cores 1 System.fst
<dummy>(0,0-0,0): (Warning 282) Expected Z3 commit hash "1f29cebd4df6", got "Z3 version 4.4.1"
Please download the version of Z3 corresponding to your platform from:
https://github.com/FStarLang/binaries/tree/master/z3-tested
and add the bin/ subdirectory into your PATH

System.fst(108,47-108,49): (Error 19) could not prove post-condition (see also System.fsti(120,9-120,67))
Verified module: System (3750 milliseconds)
1 error was reported (see above)

Here's a minimal example :)
module F
let _ = assert False

$ ./bin/fstar.exe F.fst  --n_cores 7
Verified module: F (59 milliseconds)
All verification conditions discharged successfully

I also get those crashes if I tweak the number a bit. So yeah, this is badly broken. Thanks a lot for reporting it.

Well, that was fast :) Thanks for the example, I'm not that familiar with F* yet, so I probably wouldn't have started with such a small example.

--n_cores is not part of any of our regression suites. So, sadly, I'm not surprised it has regressed to the point of unsoundness.
We tend to exploit parallelism in large projects by spawning many F* processes in parallel, rather than having each F* process spawn multiple Z3's.
Is it worth retaining and maintaining this feature?
@wintersteiger, you may be interested, since you also worked on this.

Not sure if maybe @shaolintl would still be interested in still looking at this.

We discussed this in today's F* call, and the main problem with this feature is that it adds serious nondeterminism in the SMT proving process, so a proof that works with --n_cores k can fail with --n_cores k' or without --n_cores. The consensus in our call was that if no one is using this feature and no one has the cycles to maintain it we should remove it.

(even if it's sad for all the work that went into implementing this feature: #146)

I suppose we could force ourselves to actually use it by default in interactive mode, to see whether it's really fit for everyday use. Of course, that means fixing this bug first. If it's as easy as I suspect it is, I can probably fix it soon, but overall I don't have much time to donate at the moment.
I suspect that we would have to fix some of the non-determinism to make it really usable. That may be quite a lot of work, although perhaps the same behaviour as with --z3reset would be acceptable. The non-determinism in which verification condition fails could be resolved by artificially waiting for as many results as necessary to identify the earliest failing verification condition.

I dread reports of proofs succeeding in interactive mode with --n_cores and failing on the command line without it ... or vice versa.
I wonder how important this is for interactive mode anyway: typically, we feed one top-level term at a time, which typically produces (with two_phase_tc) a single SMT query. So, there's no opportunity for parallelism in this usage.
It may improve verification times when feeding more than one top-level term at a time interactively, but the variation in Z3 queries that it would produce makes me think that the maintenance cost of this feature will be very high.

If this was easy to bring back this I could try to run some experiments and report on the speedup. Looking at #146, the only numbers we had back then were an 1.5x speedup on f-omega.fst using 4 cores.

For this type of question it would be awesome if we instrumented some of our F*/Emacs-modes to keep a history of all intermediate queries for some period of time, as a testable and benchmarkable representation of interactive proof work.

So what do we do for the time being? Disable it, deprecate it with a warning, only allow it when also passing --experimental (or something)?
Regarding the non-determinism: it would go away if we spawned a new process per query, right? I know that's slow, but isn't that mostly due to the time it takes Z3 to process the context from previous modules? Can't that be somehow cached at the Z3 level, perhaps into a file? (Or by forking the process, maybe?) If something like this could work, it might improve stability even without parallelism.
In higher-level terms: if this feature cannot be made absolutely bulletproof by design, I would argue against it.

I'm very pessimistic about getting this feature working to a point where we can eliminate the nondeterminism from small variations in SMT queries fed to Z3. I am in favor of removing the feature.

(Adding a label.)

I'm okay with this feature getting removed for eliminating the current inconsistency and (alleged) nondeterminism, as well as for gaining some maintainability.
Most proof assistants have long been reluctant to parallel processing, but it seems that Isabelle's great user experience based on parallel processing (https://www.sciencedirect.com/science/article/pii/S1571066112000291) is where most are heading now, including for instance Coq: https://coq.inria.fr/refman/addendum/parallel-proof-processing.html
I think F* will eventually get there too, even if the process is not easy or monotonic.

@catalin-hritcu I think this issue still stands (the PR wasn't merged).


Redirect Scheme middleware not redirecting page from http to https

Do you want to request a feature or report a bug?

Bug

What did you do?

I configured my routers to have a chain middleware that consists of a redirectscheme middleware and a headers middleware (that contains a strict-transport-security header).
What did you expect to see?
Upon visiting an http page, I am not automatically redirected to the https version as I should be.
What did you see instead?
Output of traefik version: (What version of Traefik are you using?)

Version:      2.1.3
Codename:     cantal
Go version:   go1.13.6
Built:        2020-01-21T17:30:29Z
OS/Arch:      linux/amd64

What is your environment & configuration (arguments, toml, provider, platform, ...)?
https://github.com/starcraft66/infrastructure/blob/master/roles/tdude.traefik/templates/docker-compose.yml.j2
https://github.com/starcraft66/infrastructure/blob/master/roles/tdude.traefik/templates/http.toml.j2
https://github.com/starcraft66/infrastructure/blob/master/roles/tdude.traefik/templates/traefik.toml.j2
docker-compose with configuration labels for an example service:
https://github.com/starcraft66/infrastructure/blob/master/roles/tdude.matrix/templates/docker-compose.yml.j2
Ouput of curl on http and https pages
root@sapling:/opt/traefik# curl -I http://nerdsin.space
HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Fri, 07 Feb 2020 04:53:04 GMT
Content-Length: 19

root@sapling:/opt/traefik# curl -I https://nerdsin.space
HTTP/2 200
accept-ranges: bytes
content-type: text/html
date: Fri, 07 Feb 2020 04:53:09 GMT
etag: "5e2ed12f-1123"
last-modified: Mon, 27 Jan 2020 12:01:51 GMT
server: nginx
strict-transport-security: max-age=315360000; includeSubDomains; preload
content-length: 4387

Screenshot of dashboard:

Hi! I'm Træfiker :robot: the bot in charge of communication regulation.
Thanks for your interest in Traefik!
We dedicate the issue tracker to bug reports and feature requests only. My advanced AI has spotted that your issue might be a configuration problem or relates to something that doesn't look like a bug.
To confirm this, please join our Community Forum and reach out to us on the Traefik section.
In case I'm wrong (well, that would be embarrassing :sweat_smile:), my developers will re-open the issue and fix me!
In the meantime, you can double check Traefik's documentation.


iPad support

I’m trying to use the demo with iPad 2018 but it’s not working

Could be related to https://github.com/alyssaxuu/flowy/issues/6

Yep, I am aware of the issue. Click events & getting the cursor position work differently in mobile. Working on it!

Added full mobile support.


Preview server doesn't reload stylesheets when a Sass partial changes

My Sass files are organized into a bunch of partials, which I assemble using Sass' @import feature (I don't use Sprockets' weird require thing). However, middleman server won't reload my styles when I update a partial - I have to quit and restart the server to see the right thing. This makes it really hard to iterate on styles.
This pull request includes a failing test case - I'm not sure right away how to fix it.

Noticed this too. Seems like something introduced recently.

Added a test for the Sprockets version too, which also fails.


Add future merge commands support

What has been done

Added future merge commands support
Covered RobinCommand with tests

How to test

Merge PR
Leave a comment on PR with allowed commands (e.g. /robin merge --dry-run)
Make sure action build passes and no warning printed to console

Robin helps only when he has been explicitly asked via \`/robin\` command.
            See https://github.com/vgaidarji/github-actions-pr-merger/tree/master#usage

/robin merge --dry-run

/robin no-such-command


How to get playlist information using link?

Hello! I'm excited with your project, because it really simple, quickly and powerful, but i found a small bug. I think when playlist's ID includes underscore or dash then PlaylistsSearch doesn't work properly.
For example: when i try to find this playlist:
'https://www.youtube.com/playlist?list=PLrxcNWZXdQ2nRZvJcLoQpJhUBrPVOBbll' - it works perfectly, but when i try find this one:
'https://youtube.com/playlist?list=OLAK5uy_nHcJWdK2mi8vKVRco3MfQuH12938KF-hQ' or
'https://www.youtube.com/playlist?list=OLAK5uy_mRdEfaPOzXui_tyud3VE_vAHDqCiPOyDw' - i have no results =(
Can you fix it PLEASE ?)

Hi there!
Nice to meet you, I appreciate your feedback for the library.
First of all, if you are not aware that PlaylistsSearch should be used to search for playlists i.e. by passing search query (not link).
As you are "searching" with the link itself, so that confuses YouTube itself.
So, I assume what you're trying to do is to get playlist information (i.e. videos etc. in it) using its link. If I got your problem correctly, then searching probably isn't the best solution. And there isn't any functionality to get playlist information using link in this library yet (like Video.get).
If you want, I can try to implement something like Playlist.get(<link>) to get playlist information using its link.
For playlist https://youtube.com/playlist?list=OLAK5uy_nHcJWdK2mi8vKVRco3MfQuH12938KF-hQ:
This result is shown.
For playlist 'https://www.youtube.com/playlist?list=OLAK5uy_mRdEfaPOzXui_tyud3VE_vAHDqCiPOyDw:
This playlist is shown.
You may confirm yourself that both pages show No results found, so there is nothing on my part that I can do.
Thankyou.
Let me know.

I got it, Thanks for answer! I really want to be able to use something like "Playlist.get ()" in the near future. Can you implement it please ?)

Hi again 👋🏽! Can you say how soon you will make "Playlist.get ()" and is it even possible? Thanks for the answer 🙏🏽)

Hey there!
Playlist class is here, to get playlist information using link.
It has three methods:

get to get all the information about playlist.
getInfo to get only information.
getVideos to get videos in the playlist.

Thankyou.
I know, I'm late.
I had a busy schedule this week.
Here are few examples to help you.
And if you really like the project, consider supporting it.

Hi again 👋🏽! Can you say how soon you will make "Playlist.get ()" and is it even possible? Thanks for the answer 🙏🏽)

It took me time to figure out the way. Sorry for the delay.

@markegor,
Get the latest version with:
pip3 install youtube-search-python==1.4.1


No Empty Conveyors crash

Also using 'Debris Melts to Debris' after in the load order.  I've gotten this crash message occasionally - the game highlights both these mods as possibly related.
NullReferenceException
NoEmptyConveyors.NoEmptyConveyorsPatch.Postfix (System.Int32 __state) (at :0)
(wrapper dynamic-method) SimTemperatureTransfer.SimTemperatureTransfer.DoOreMeltTransition_Patch3(int)
Game.StepTheSim (System.Single dt) (at :0)
Game.UnsafeSim200ms (System.Single dt) (at :0)
Game.SimEveryTick (System.Single dt) (at :0)
Game.Update () (at :0)
Build: U37-484114-SD

Hi, I am not able to replicate this bug. Can you tell me what situations this bug happens - certain materials, certain temperatures, on or off the conveyor etc. Also, do you have any other mods which change temperature/material mechanics or add new materials? Using DLC or no? The error report unfortunately doesn't really have much info.
Thanks!

Thanks for your attention :)  Sorry, I didn't have a lot of info at the
time.  I'm running Spaced Out, a lot of mods, but no others I think would
deal with temperature/material mechanics.  One thing to note is that when
this has happened, if I had the 'TPS Counter' mod active as well, it would
also be flagged by the game as being possibly related (
https://steamcommunity.com/sharedfiles/filedetails/?id=2565985958 ).  I
don't think I've ever had a crash with only 'Debris Melts to Debris'
enabled.
At the time this last crash occurred, I think the only thing that might
have been on a conveyor changing state was solid hydrogen.
I'll enable both mods again and try to keep track of things if it happens
again.
On Mon, Nov 8, 2021 at 7:14 AM DoctorFeelGoodMD @.***>
wrote:

Hi, I am not able to replicate this bug. Can you tell me what situations
this bug happens - certain materials, certain temperatures, on or off the
conveyor etc. Also, do you have any other mods which change
temperature/material mechanics or add new materials? Using DLC or no? The
error report unfortunately doesn't really have much info.
Thanks!
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/DoctorFeelGoodMD/OxygenNotIncluded-Mods/issues/1#issuecomment-963092291,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AGZ7KJLJ443QE3TYXPRWSVLUK65J5ANCNFSM5HRLOEHA
.
Triage notifications on the go with GitHub Mobile for iOS
https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675
or Android
https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.


game of life unit test

Test that takes a hardcoded grid state and checks if the grid is in the expected state after 1 and 2 dispatches

Note: I expect any proper test to fail as the GOL example seems to have some odd behaviour, so there are probably some minor off by one mistake somewhere :)

Commit with initial (too basic to close issue) test: 51f9c60


Optionally pass the database configuration parameters on Rbac constructo...

Possibility to programmatically pass on the database configuration.
Just pass the parameters into the constructor, falls back to default configuration variables (same as those in database.config file).
This change was made with regard of compatibility with existing version.

Thank you very much!!!
Please let me review these changes and how they relate to current PR's and discussion and I'll get back to you shortly :-)

@jburns131 bump

Please, also, add ability tp change role/user/permision 'id' column names.
For instance, 'role_id', instead of default 'RoleID'.
Thanks.

what good will that do? a use case scenario please. It is possible and existed in the initial code base but was removed because of bloat.

On Oct 4, 2015, at 12:03 PM, sillyh4ck3r<EMAIL_ADDRESS>wrote:
Please, also, add ability tp change role/user/permision 'id' column names.
For instance, 'role_id', instead of default 'RoleID'.
Thanks.
—
Reply to this email directly or view it on GitHub https://github.com/OWASP/rbac/pull/63#issuecomment-145362948.

I had some troubles integrating rbac with php-activerecord in a case like this:

class User extends ActiveRecord\Model {
	static $table_name = 'users';
	static $has_many = array (
		array ('roles', 'through' => 'userroles',),
		array ('userroles', 'class_name' => 'UserRole',),
	);
}

If I defined 'foreign_key' => 'UserID' on for 'roles', the SQL would generate
with an INNER JOIN that uses ON rbac_roles.id = rbac_userroles.role_id
WHERE UserID=?
I needed that role_id to be RoleID.
To get around this, I changed the column names in the respective tables and
edited the rbac.php to reflect those changes.  With this workaround, I don't
need to specify 'foreign_key' in my model attributes.
Also, I have added foreign key constraints on the relations tables. (Not
relevant to my original request, though, it helps a bit.)
AbiusX wrote:

what good will that do? a use case scenario please. It is possible and existed in the initial code base but was removed because of bloat.

On Oct 4, 2015, at 12:03 PM, sillyh4ck3r<EMAIL_ADDRESS>wrote:
Please, also, add ability tp change role/user/permision 'id' column names.
For instance, 'role_id', instead of default 'RoleID'.
Thanks.
—
Reply to this email directly or view it on GitHub https://github.com/OWASP/rbac/pull/63#issuecomment-145362948.

Reply to this email directly or view it on GitHub:
https://github.com/OWASP/rbac/pull/63#issuecomment-145379153

I think that’s a good enough solution.
To dynamically fetch column names in every call, makes a lot of bloat and performance overhead.

On Oct 4, 2015, at 3:26 PM, sillyh4ck3r<EMAIL_ADDRESS>wrote:
I had some troubles integrating rbac with php-activerecord in a case like this:

class User extends ActiveRecord\Model {
static $table_name = 'users';
static $has_many = array (
array ('roles', 'through' => 'userroles',),
array ('userroles', 'class_name' => 'UserRole',),
);
}

If I defined 'foreign_key' => 'UserID' on for 'roles', the SQL would generate
with an INNER JOIN that uses ON rbac_roles.id = rbac_userroles.role_id
WHERE UserID=?
I needed that role_id to be RoleID.
To get around this, I changed the column names in the respective tables and
edited the rbac.php to reflect those changes. With this workaround, I don't
need to specify 'foreign_key' in my model attributes.
Also, I have added foreign key constraints on the relations tables. (Not
relevant to my original request, though, it helps a bit.)
AbiusX wrote:

what good will that do? a use case scenario please. It is possible and existed in the initial code base but was removed because of bloat.

On Oct 4, 2015, at 12:03 PM, sillyh4ck3r<EMAIL_ADDRESS>wrote:
Please, also, add ability tp change role/user/permision 'id' column names.
For instance, 'role_id', instead of default 'RoleID'.
Thanks.
—
Reply to this email directly or view it on GitHub https://github.com/OWASP/rbac/pull/63#issuecomment-145362948.

Reply to this email directly or view it on GitHub:
https://github.com/OWASP/rbac/pull/63#issuecomment-145379153

—
Reply to this email directly or view it on GitHub https://github.com/OWASP/rbac/pull/63#issuecomment-145379606.


[CROSSDATA-512] [ELASTICSEARCH] Upgrade to 2.3

Description
This PR allows to work with Elasticsearch 2.3
The dependency of the elastic4s has been upgraded from 1.7 to 2.3
Testing

[x] Unit, integration tests: UTs & ITs working. In the CD environment might not work given that Elasticsearch 1.7 is still present.

Documentation

[x] Changelog update
[x] Documentation link: https://stratio.atlassian.net/wiki/display/CROSSDATA1x4/Sql+-+Elasticsearch

LGTM


Using std::size_t instead of unsigned

While building the Coverity package I got a few template errors, like:
/mantella/test/../include/mantella0_bits/optimise.hpp:152:24: note:   template argument deduction/substitution failed:
/mantella/test/../include/mantella0_bits/optimise.hpp:194:73: note:   mismatched types 'long unsigned int' and 'unsigned int'
   const auto&& result = mant::optimise(problem, optimiser, {{-3.2, 4.1}});

The main reason is, that std::array expect std::size_t, while we define the numbers to be unsigned.

Fixed by cd4c1305080a759d2eb750be193ac392fc3767b4


Make Sig block puzzles in underport possible

So a couple options here we can spawn the blocks in easier spots, add more time before blocks explode, or just solve the puzzles in some other way (rings?)


PowerShell output color gets stuck when there is an error

This is autogenerated. Please review and update as needed.
Describe the bug
Command Name
az boards query Extension Name: azure-devops. Version: 0.18.0.
Errors:
In this case, there was a character error in a WIQL query, though I'm unsure what the issue actual was.

Unable to encode the output with cp1252 encoding. Unsupported characters are discarded.

To Reproduce:
Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

Create any WIQL that will cause an error.
az boards query --wiql={}

Expected Behavior
Running the query will cause an error, that is output in yellow.
The command prompt should be its normal color after that. Currently, though, it will be in yellow as well after the error output.
Environment Summary
Windows-10-10.0.19041-SP0
Python 3.6.8
Installer: MSI

azure-cli 2.15.1 *

Extensions:
azure-devops 0.18.0

Additional Context

At least as a workaround, it appears I can fix this with a call to [Console]::ResetColor().


Revert "Update README.md"

Reverts zio/zio-dynamodb#139 due to the failure on release workflow https://github.com/zio/zio-dynamodb/actions/runs/3863058830

@khajavi the end game is to have a series/2.x as the default branch and a series/1.x as well. I made changes to include all your documentation changes from master to series/2.x but ran into CI build problems so I have reverted master as the default and will try the documentation changes again in a new in series/2.x branch with proper PR that hopefully you can review.

@@googley42 Thank you!
Please ping me whenever that PR is ready for review.
Anyway, are you going to merge this PR?

yes you are right this can't be merged due to CI failure - I just wanted to explain the recent activity. I will close this PR if that's OK with you

Yes, please!

closed due to CI build problems


[SASS-3114] Added service-manager related scripts.

Description
I've added a few scripts which might make the management of the services easier.
Add a link to the relevant story in Jira
SASS-3114
Checklist PR Reviewer
Before Reviewing

[ ]  Have you pulled the branch down?
[ ]  Have you assigned yourself to the PR?
[ ]  Have you moved the task to “in review” on JIRA?
[ ]  Have you checked to ensure all dependencies are up to date?
[ ] Have you checked to ensure its been rebased against the current version of main?

Whilst Reviewing

[ ]  Have you run the journey tests?
[ ]  Have you looked at the JIRA story to make sure all Acceptance Criteria has been met?

After Reviewing

[ ] Have you checked for merge conflicts or any changes in the current main that may affect the current pull request? i.e. does it need another rebase?
the current pull request?
[ ]  Have you checked to make sure there are no builds in the pipeline before you merge?
[ ]  Have you moved the task to “in pipeline” on Jira?

Checklist PR Raiser
Before creating PR

[ ]  Have you run the journey tests?
[ ]  Have you addressed warnings where appropriate?
[ ]  Have you rebased against the current version of main?

This is for illustration only. Please do not merge.