Replace ApolloStoreSubscriber didChangeKeys with ApolloStore.Activity…

The following changes are to support the need to hook up data living presiding in separate stores into the life-cycle of the data in ApolloStore. This PR represents 1 of 2 ways I considered accomplishing this.

Implement NormalizeCache by wrapping another implementation of NormalizedCache and forwarding calls to it.
A more robust ApolloStoreSubsciber, i.e. this PR

I decided that I was submitting 2 as a PR because I believe the interface is an improvement to what is currently in main. Which is the didChangeKeys subscriber method. The didChangeKeys call corresponds to the following a call to cache.merge(records:), which is covered in this PR's implementation as the following:
  public func store(_ store: Apollo.ApolloStore,
             activity: Apollo.ApolloStore.Activity,
             contextIdentifier: UUID?) throws {
    if case .did(perform: .merge(records: let records), outcome: .changedKeys(let changedKeys)) = activity {
      self.store(store, didChangeKeys: changedKeys, contextIdentifier: contextIdentifier)
    }
  }

Example:
final class MyOtherStoreApolloStoreSubscriber: ApolloStoreSubscriber {

    private class UnsubscribeRef {
        private let _unsubscribe: () -> Void
        public init(unsubscribe: @escaping () -> Void) {
            _unsubscribe = unsubscribe
        }
        deinit {
            _unsubscribe()
        }
    }
    private lazy var unsubscribeRefs = [String: UnsubscribeRef]()

    private func subscribeToOtherStore(_ otherStoreListener: () -> Void) -> () -> Void {
        /* stuff to subscribe to my other store in here */
        return { /* stuff to unsubscribe from my other store in here */ }
    }

    private func syncMyOtherStoreWith(store: ApolloStore, records: [Apollo.CacheKey: Apollo.Record]) throws {
        for (key, record) in records {
            if unsubscribeRefs[key] == nil {
                unsubscribeRefs[key] = UnsubscribeRef(unsubscribe: subscribeToOtherStore({
                    /* stuff to handle my other store changes in here */
                })
            }
        }
    }

    public func store(_ store: Apollo.ApolloStore, didChangeKeys changedKeys: Set<Apollo.CacheKey>, contextIdentifier: UUID?) {
        // not implemented, deprecated
    }

    public func store(_ store: Apollo.ApolloStore, activity: Apollo.ApolloStore.Activity, contextIdentifier: UUID?) throws {
        switch activity {
        case .will(perform: .merge(records: let records)):
            try syncMyOtherStoreWith(store: store, records: records.storage)
        case .did(perform: .loadRecords(forKeys: _), outcome: .records(let records)):
            try syncMyOtherStoreWith(store: store, records: records)
        case .did(perform: .removeRecord(for: let key), outcome: .success):
            myOtherStoreUnsubscribeRefs.removeValue(forKey: key)
        case .did(perform: .removeRecords(matching: let pattern), outcome: .success):
            for key in unsubscribeRefs.keys {
                if key.range(of: pattern, options: .caseInsensitive) != nil {
                    unsubscribeRefs.removeValue(forKey: key)
                }
            }
        case .did(perform: .clear, outcome: .success):
            unsubscribeRefs.removeAll()
        default:
            return
        }
    }
}

Looks like testCancellingTaskThroughClientDoesNotCallCompletion might be a little flakey (i.e. is failing for unrelated reasons)

I really like the direction here @jimisaacs, thank you for pushing ahead with improvements to ApolloStoreSubsciber. Have you proved out your poc, is this direction able to satisfy all your needs?

Have you proved out your poc, is this direction able to satisfy all your needs?

Yes, I have both approaches, 1 and 2, proved out. They aren't that different, to be honest, I just figured the ApolloStoreSubscriber was the proper direction in that ApolloStore is the non-abstract object that can be subscribed to and is the thing that participates in business logic. While the cache object is a simple storage implementation specific backend to the store. In my approach 1, it implements an abstract cache that is basically like the ApolloStore for the only reason that the ApolloStoreSubscriber doesn't cover the granularity needed. With that reasoning, it would only make sense to go with approach 1, if ApolloStore was removed or merged with a composable NormalizeCache implementation.

@calvincestari what thoughts would you have on piping the RequestContext through the specific actions of loadRecords and merge? I realize that RequestContext was meant to be interceptor-specific, but it could be pretty convenient for store subscribers to receive this context too.

@calvincestari what thoughts would you have on piping the RequestContext through to specific actions of loadRecords and merge? I realize that RequestContext was meant to be interceptor-specific, but it could be pretty convenient for store subscribers to receive this context too.

I think that's blurring the lines a bit too much. You're correct that it is available to the interceptors because they process requests via the interceptor chain. The store subscriber events are only indirectly related to the request context and there are other times the subscriber event wouldn't have any request context; ultimately this doesn't feel like a good change.

@calvincestari any word on this PR? I realize I have a workaround locally by implementing our own NormalizedCache, but I'd like to eventually go back to using ApolloStoreSubscriber.

@calvincestari any word on this PR? I realize I have a workaround locally by implementing our own NormalizedCache, but I'd like to eventually go back to using ApolloStoreSubscriber.

My apologies @jimisaacs, I had the assumption that there was still work to be done in this PR but I've just taken a brief look through it now again and I'm not sure why I had that assumption. I'll pick this up first thing tomorrow morning for a final review.

I'd also like to give @BobaFetters and @AnthonyMDev an opportunity for any last review too before we merge.

LGTM!

If we reach consensus on the approach here, I'm happy to make the relevant changes to this PR to wrap it up!

With the proposed implementation, if we want to add new delegate activities in the future, it's actual a breaking change. Anyone who has implemented the delegate exhaustively (switching on the enum cases w/no default case) is going to have compilation errors if we add a new case to the enum. Whereas adding new methods to the delegate protocol with default no-op implementations would not be breaking and is purely additive.

This is a really great callout I hadn't considered. Good catch @AnthonyMDev!

@AnthonyMDev @Iron-Ham
I would separate the concerns of the design, from whether it is a breaking change. I personally think the current design is very unclear, as does my Android counterpart while using the Apollo-Kotlin version of this. The didChangeKeys is a confusing API that I question whether it is being used for anything other than the internal watcher implementation. Meaning I understand that it is a breaking change but question how much breaking a change this change has to be as it is.
Now in terms of a new design...
I think performance implications are negligible when compared to invocation of default delegate methods. We are talking about a simple stack with static types.
The enum design just felt more ergonomic given the amount of information it can convey with less method surface area. Meaning the enum represents 10 additional delegate methods. Now I completely understand the point of view of needing to handle the enum for your single case versus implementing the appropriate method. I just felt that the tradeoff was worth it given that something subscribing to a store probably has to at least consider all the cases, which is inherently what an enum is for. If I'm alone there I can move to the additional delegate methods.
If the consensus is to move to 10 additional delegate methods with empty default implementations I'll do it. Though in terms of breaking changes, I do think it's worth considering what is lacking around the didChangeKeys design and would probably still push for depreciating it for a clearer method.

I would separate the concerns of the design, from whether it is a breaking change.

Believe me, I would prefer we could do that all the time as well... but every time we have decided to make minor breaking changes to provide a better API surface, we've gotten a lot of negative feedback from the community about it. It's fine to do when you're building for your own internal software, but with distributed open source packages, it becomes a pain point for a lot of people.

The didChangeKeys is a confusing API that I question whether it is being used for anything other than the internal watcher implementation.

Yeah, ApolloStoreSubscriber was an internal protocol that was only being used by the watcher. We made it public because your team requested it. But it was never a fully featured API designed for public consumption I the first place.

I think performance implications are negligible when compared to invocation of default delegate methods. We are talking about a simple stack with static types.

Agreed, performance certainly is not the primary concern here. It was just an additional note. We're more concerned with designing something resilient to breaking changes in the future. I'm also thinking about the design concern brought up in this comment.

I just felt that the tradeoff was worth it given that something subscribing to a store probably has to at least consider all the cases...

I actually don't think that's necessarily true. I think that many users will only care about one or two of these cases and ignore the rest.

If the consensus is to move to 10 additional delegate methods with empty default implementations I'll do it.

I'm not a huge fan of a delegate with 10 methods either, but I think we're prioritizing the trade-offs in the direction of non-breaking changes & clarity vs. ergonomics. I'd love to come up with a more robust API here, but I'm not sure if there is a better alternative without a major overhaul of the ApolloStore. Which is something we want to do eventually, but for now at least, this might be the way to go.

I do think it's worth considering what is lacking around the didChangeKeys design and would probably still push for depreciating it for a clearer method.

Can you be more specific about what you think is lacking here? I'm not clear on what's missing. There are a couple of improvements I can think of:

Allowing you to observe changes only to specific keys that you provide. Which is kind of possible now with a GraphQLQueryWatcher I guess, but it's not the intended use case.
Allowing you to apply transformations to the data before it is written into the cache. Though this opens up an entirely different can of worms.

@AnthonyMDev

Believe me, I would prefer we could do that all the time as well... but every time we have decided to make minor breaking changes to provide a better API surface, we've gotten a lot of negative feedback from the community about it. It's fine to do when you're building for your own internal software, but with distributed open source packages, it becomes a pain point for a lot of people.

I understand what it means to maintain open source, the comment is about maintaining that separation for the benefit of the discussion here, not to ignore the concern altogether. For example, in the current approach it can be done without being a breaking change with a default delegate method.

Yeah, ApolloStoreSubscriber was an internal protocol that was only being used by the watcher. We made it public because your team requested it. But it was never a fully featured API designed for public consumption I the first place.

Really? Well then, this is news to me 😬 🦶 😶 . Do you know where, whom asked for this?

I actually don't think that's necessarily true. I think that many users will only care about one or two of these cases and ignore the rest.

I am in disagreement with you here, but it's probably over a nuance of the meaning of "consideration". Either I "consider" what methods to implement or not, or  I "consider" what enum cases to handle or not. The enum approach enforces that consideration, the default delegate method approach does not. This is all I meant.

I'm not a huge fan of a delegate with 10 methods either, but I think we're prioritizing the trade-offs in the direction of non-breaking changes & clarity vs. ergonomics. I'd love to come up with a more robust API here, but I'm not sure if there is a better alternative without a major overhaul of the ApolloStore. Which is something we want to do eventually, but for now at least, this might be the way to go.

In terms of "trade-offs in the direction of non-breaking changes & clarity vs. ergonomics", I still disagree that an enum approach prioritizes breaking changes, as I can add a default method just as easily to this approach as to the 10 method one. Though if you think 10 methods prioritizes clarity over ergonomics, we can probably debate that for a while, I just don't think I'm not going to die on any hill for an enum or anything here 😜. I can see what the 10 method approach looks like, though I wonder, do you prefer updating this PR or creating a new one?

Can you be more specific about what you think is lacking here? I'm not clear on what's missing. There are a couple of improvements I can think of:

I think the naming is confusing and doesn't convey what it does. "Did change keys" intuitively means to me that something could have been added, removed, or updated, i.e. "change" is an ambiguous term for CRUD. When I was originally looking at understanding it, and assuming that the reason of change included more, it felt like it was missing conveying the "reason" in the method call. So then when I got to that point, I considered trying to add the "reason" to the call, and realized when looking at the code that it was only covering "merge" (i.e. create/update/write), and wasn't called for when something is removed (via pattern or not), cleared, or simply read from cache.

Regarding the question of creating a updating PR or creating a new one, I'm leaning toward just creating a new one. PRs can get pretty confusing with multiple passes of large sweeping changes + discussion over them.

@jimisaacs happy to chat through your use-case (via email, Slack, GitHub, etc.: whatever your preference – my personal email is directly available on my GitHub profile) and see where GitHub and Netflix alignments (and differences) can help inform the design of this API.
For us, the pain points I'm currently feeling are around optimistic state and query watchers. A user may take a number of actions in rapid succession that trigger both an optimistic update of the cache (or in memory model) as well as a network mutation. The network mutation often returns some fragment which includes the updated keys (and often other related keys that are part of a given fragment). If these mutations are being executed on a single model (or a list of models), we end up in an inconsistent state given that our UI is driven by cache updates.
My assumption is that we can handle this generically with any of the following options:

Given a version of your proposed changes (or something like it), a custom ApolloStoreSubscriber type which has hooks for whether we want to apply a given cache data state.
Some changes to how data is written to the cache to keep track of optimistic state (complicated, lots of pitfalls)
Some layer that tracks a set of mutations within a given context to defer updates to our models on a field-level for a given set of cache-key changes (possible today, perhaps not generically applicable? I'm going to explore this to some extent next week).

@Iron-Ham before going offline, can you clarify

If these mutations are being executed on a single model (or a list of models), we end up in an inconsistent state given that our UI is driven by cache updates.

I'm not sure how the single model or list of models inherently causes an inconsistent state?

I'm not sure how the single model or list of models inherently causes an inconsistent state?

I'm happy to clarify – the mutations responses return the expected values of a single optimistic update – but not a chain of optimistic updates that may have fired before the response returns.
To illustrate:

I rapidly execute five actions (ActionA, ActionB, etc), each with an optimistic update and a mutation (which in the case of a successful mutation, returns the optimistic value).
At this point, I have five stacked optimistic mutations in the UI.
ActionB returns first, with a model state that does not include the optimistic updates of actions A, C, D, or E. This data is written to the cache, which wipes away the optimistic state of the four other actions. At this point, the user has gone from a state of all five actions being committed to the UI, to four of them wiped away.
As each mutation returns, one of the user's optimistic states returns to the UI (and to the data state).
After all mutations return, the UI is now "correct" again, and the data now matches the optimistic state.

This isn't dissimilar to the challenges of an online multiplayer game: The client is inputting actions faster than the server can confirm them. Unlike a multiplayer game, we are committing the intermediate states to the application's data state as opposed to performing a periodic sync/confirmation.
It's an interesting problem to solve for, and one that doesn't have a great built-in solution currently. I'll be dedicating some time to it next week.

@jimisaacs - what's the current state of this PR, are you waiting on anything from us or are there changes to be made to it?

I'm going to close this PR since it seems to have stagnated. If work continues though please re-open it.


crash game

after update to 5.11 to fix 5.10 crash,
i have some crashes (closing brut game).
I remain available for any information

Was it unexpected close ?

yes and without message like in 5.10

Hi, thanks for making an issue - can you give any more info on how you caused the crash?

after patch 5.10 with 5.11, the game suddenly closes without warning.
The last time was in soosc during a fight. After in fowsc during a run, sometimes map changing.
The players in the group always see me logged in and when I restart the game, gw sometimes (not always) reports an error code 007 and if I validate I go back to the outpost. Now I cut my connection to simulate a network failure, restart the game that can't connect, close the game again, restart my connection, and restart the game. With this (long) manipulation I manage (sometimes) to return to the game with a loss of connection reported to the players of the game.
PS: sorry for my rough English

What language do you run the game in?

in french
is it better to start it in English?

I run mine in English but I don't think that matters no ?

i'm trying and i go back to you

same
1st crash today.
error message when reload game : disconnect

2nd crash today (without admin mode)
i copied details of the report
crash_gw.txt

I have the exact same issue. Crash as soon as I load in Toolbox. Exact same error as above.

i abandon, same crash.
i donwgrade to 5.09, last stable for me

How do you downgrade?

I've had a look at the above gw_crash.txt file, but without more info this bug I can't fix this - I need to know from each of you:

Language that you were playing with at the time (not sure if this is a factor yet)
Copy of ArenaNet.log in Documents/Guild Wars folder
Copy of your %localappdata%/gwtoolboxpp/GWToolbox.ini files
Copy of any .dmp files in Documents/Guild Wars folder
Copy of any .dmp files in %localappdata%/gwtoolboxpp/crashes

Its a good idea to send these files directly to me on Discord rather than on Github, but when I get them through I'll take another look

I am happy to send them to you. I can't even upload the .ini file on here because GitHub flags it as "not supported". Which person are you on Discord? I'll DM you through there.

Jon [SNOW]#1816

Fixed 5.12


Work around broken build dependencies in our dependenices.

Checklist
GitHub

[ ] I've given this PR a concise, self-descriptive, and meaningful title
[x] I've linked relevant issues in the PR body
[ ] I've applied the relevant labels to this PR
[ ] I've assigned a reviewer

PR contents

[ ] I've consulted ivadomed's internal developer documentation to ensure my contribution is in line with any relevant design decisions
[ ] I've added relevant tests for my contribution
[ ] I've updated the relevant documentation for my changes, including argparse descriptions, docstrings, and ReadTheDocs tutorial pages

Description
As discovered by @ahill187, I believe some of our dependencies are mis-packaged: they are written using the special cython and numpy build tools for high-performance extension modules, but they have forgotten to declare that fact in their setup.py's.
In order to work around this, add cython and numpy to our build dependencies.
Also, I imported the other tricky dependency workaround from SCT: https://github.com/neuropoly/spinalcordtoolbox/blob/82132c4c0ca4bd1fa07247288c2df614f0a5277c/requirements.txt#L28-L34
Linked issues
#728

Pull Request Test Coverage Report for Build 692192528

0 of 0   changed or added relevant lines in 0 files are covered.
2 unchanged lines in 1 file lost coverage.
Overall coverage increased (+3.8%) to 79.676%

Files with Coverage Reduction
New Missed Lines
%

ivadomed/transforms.py
2
87.01%

Totals

Change from base Build 684441200:
3.8%

Covered Lines:
5755

Relevant Lines:
7223

💛  - Coveralls

Something is mad about python 3.6. I'm unclear why. Here's the log: https://github.com/ivadomed/ivadomed/runs/2207116706?check_suite_focus=true#step:4:135
I dropped it to get the tests passing.

Maybe... this can go in? Since python3.6 is End of Life soon?


Following adaptation for sampler other than RW

Hello,
I have seen that you can follow the adaptation process of the RW sampler by using cmcmc$samplerFunctions[[idx]]$getScaleHistory() and cmcmc$samplerFunctions[[idx]]$getAcceptanceHistory().
I suppose it is not yet possible (but maybe scheduled at some point?) to get similar information for other samplers such as slice for instance ?
I have some nodes for which the RW adaptation decreases greatly the scale to keep acceptance rate high enough, which produces some highly autocorrelated samples. So I wanted to try other samplers (currently the slice) to see if it could ease the process and I was curious to see if there was a similar process during the adapatation phase for the slice samplers (but maybe you would have other suggestions for such cases).
As a side question, If I have general question about nimble and its use, I suppose I should go to the google groups for that?
Thanks in advance,
Rémi

Hi Rémi, yes please post your question(s) on our Google group.  We'd like to keep the Github issues for known bugs/issues.


rrdtool.js TypeError: opts.data is undefined

with luci-app-statistics_git-20.113.70804-9d02ef1_all ...  can't display processor statistics it is stuck on "loading data" ... debugging on the browser shows that opts.data is undefined on rrdtool.js

Hmm. I think that the CPU related pages work ok for me.
CPU load (processor) and system load load ok with (git-20.119.49022-81effc1) / OpenWrt SNAPSHOT r13136-ad27c133eb.
Which page exactly?
Which router & architecture?
Normal master build?
Test with other browser, clear browser cache  etc.

WRT3200ACM - own build from master; on two browsers (firefox & chrome) same issue
I am able to display data for other plugins like wifi,entropy ... sensors.
Navigating to Statistics -> Graphs -> Processor
debuggin on Edge I get a slightly different msg but one is pointing to undefined/null reference
HTTP400: BAD REQUEST - The request could not be processed by the server due to invalid syntax.
(XHR)GET - https://<IP_ADDRESS>:18443/ubus/?1588400740595
SCRIPT5007: SCRIPT5007: Unable to get property 'types' of undefined or null reference
graphs (54,1)
20: Unable to get property 'types' of undefined or null reference
rrdtool.js (53,1)

For me the processor (CPU) tab works quite normally on WRT3200ACM with
LuCI Master (git-20.119.49022-81effc1)
OpenWrt SNAPSHOT r13136-ad27c133eb

I will close this, as it does not seem to be a global bug.
If you figure out any details, feel free to add here.
Ps.

(XHR)GET - https://<IP_ADDRESS>:18443/ubus/?1588400740595

I assume that you know that 192.169.x.x is not a private IP addressing area, but common routable internet.
https://en.wikipedia.org/wiki/Private_network


[TIR] Refactor MakePackedAPI to target dependent stage.

Previously MakePackedAPI was in the target independent stage,
but never the less requires the device_type information that will be
binded at a later target dependent stage.
The previous implementation was due to the limitation of LoweredFunc
which can not carry buffer_map info(so they have to be lowered right away).
This is no longer the case after the unified IR refactor.
This PR migrates MakePackedAPI to a target dependent stage
and removes the un-necessary BindDevice pass.

cc @areusch @yzhliu @jroesch @ZihengJiang


UKI: Enroll keys during setup

This card is a tracker for UEFI Setup mode implementation (to enroll SB keys automatically as part of the installation process)
Follow-up of https://github.com/kairos-io/kairos/issues/1151

Is this even possible?
You boot, go to bios and add the keys there, which are on the livecd/rootfs/uki EFI.
Otherwise you cannot boot if secureboot is enabled. And if you disabke it so you can boot our uki EFI file.... Not even sure if you can modify the keys when it's disabled.
In any case if you insert a key from user space you still need to get into something like mokmanager to confirm the installation I think.
This is something to discuss further because I don't understand the implications or it this is even possible as presented.

seems talos can: https://www.talos.dev/v1.5/talos-guides/install/bare-metal-platforms/secureboot/#generating-the-keys

Also arch: https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot (search for Setup mode)

Interesting! Although removing the keys in order to make it on setup mode scares me 🤣
This means we also have to bundle the Microsoft keys with our db, interesting. I think there are a few python tools that can bundle keys...

this is done


Topic1

some keys are together, especially the firsts

Good work but needs some improvements. Continue working on next items but come back in few days with the required changes. Consider this study topic as not closed.


Add MOM6 to GEOS

A plug for MOM6.
Modifications to GuestOcean_GridComp so that both MOM5 and MOM6 are supported and user can switch between the two at run time.

NOTE:

Sea ice model presently used (CICE4) is untouched.
Requires FMS version xanadu (or later)

Pull request from @aerorahul https://github.com/GEOS-ESM/GEOSgcm_GridComp/pull/56
consolidates all of the above changes from various branches.
This issue is being created retroactively, following a conversation with @tclune to be "compliant" with https://github.com/GEOS-ESM/GEOSgcm_GridComp/wiki/Zero-diff-changes

This work of adding the coupler code was finished and is now in debug mode.


New branch "manage_clock" failing tests

@jprotze Not sure if you saw it but your new branch is failing the tests, if you join to Salck (https://pruners.slack.com/messages/archer-travisci/) you'll see the TravisCI channel for Archer, anyway here's the link: https://travis-ci.org/PRUNERS/archer/builds/203203366.

This branch depends on modified compiler-rt:
https://github.com/PRUNERS/compiler-rt/tree/manage_clock
How do I deactivate travis for this branch?

I see, I'll take a look, no worries for now.

New approach should deliver better results and uses only upstream TSan annotations
Tests run "successful"


IR-467: Enable Azure MSI authentication

This PR enables Azure MSI authentication, which will be utilized in the managed service - ARO HCP.
Fixes IR-467

Hi @bryan-cox, I think you also need to update the move-blobs command: https://github.com/openshift/cluster-image-registry-operator/blob/master/cmd/move-blobs/main.go#L317
We're planning to get rid of it, but until then I think you might not be able to run the registry on clusters configured with the new config without changing it as well.

Hi @bryan-cox, I think you also need to update the move-blobs command: https://github.com/openshift/cluster-image-registry-operator/blob/master/cmd/move-blobs/main.go#L317 We're planning to get rid of it, but until then I think you might not be able to run the registry on clusters configured with the new config without changing it as well.

Hey @flavianmissi - I think it should still work because of this. wdyt?

/retest-required

Ah yes good point @bryan-cox! I think you are correct.
How are you planning to test this btw? I think we might need your QE's help to get access to an ARO HCP cluster 🤔
cc @xiuwang
/retest

Hi @flavianmissi , hypershift qe tell me I can use hypershift to provision an azure cluster with this code version by myself. I will design case and try to test.

Hey @flavianmissi 👋🏻 - is there a good Slack channel to ask for review for this PR?
Looks like all the tests are passing 🙌🏻

we hangout at #forum-ocp-imageregistry, but I'll be the one reviewing your PR :)
what kind of priority are we dealing with here? can this wait till next week?

we hangout at #forum-ocp-imageregistry, but I'll be the one reviewing your PR :) what kind of priority are we dealing with here? can this wait till next week?

Thanks for reviewing!
We will need this in 4.16 though we are expecting to backport similar MSI work 😅 . So if we don't get it in by branching this week, we'll just need to backport it once its reviewed (which is fine with me).

The code looks fine so I won't hold you because a code review.
/lgtm
Is this something we need image registry docs to write about? Or is it cover in some other docs?
And does your team have someone from PX involved in this effort? We can tag this px-approved ourselves but it's always good to get someone from their side involved, even if only for awareness.
The only other label required (besides docs-approved and px-approved) is qe-approved, and our QE already on it so we're good on that end.

The code looks fine so I won't hold you because of a code review. /lgtm Is this something we need image registry docs to write about? Or is it covered in some other docs? And does your team have someone from PX involved in this effort? We can tag this px-approved ourselves but it's always good to get someone from their side involved, even if only for awareness. The only other label required (besides docs-approved and px-approved) is qe-approved, and our QE already on it so we're good on that end.

Yeah we should have someone on our team cover the PX involved as this is part of a larger effort on integrating MSI with ARO HCP.

I linked out docs contact to the Jira ticket as well.

could you ask your folks to label the PR with the docs and px-approved in that case @bryan-cox ? Thanks!

/label docs-approved

/label px-approved

/assign @xiuwang

Hi @bryan-cox , can you have a look at https://issues.redhat.com/browse/OCPBUGS-34332 ? Xiujuan (image registry QE) found it while testing this PR.

putting this on hold until we can figure out the bug (see my previous comment).
/hold

Hey 👋🏻 - sorry for the delay in responding, I'm trying to wrap my head around how to test this. There was an issue in CNO blocking related traffic that may also be affecting this.

Hey @flavianmissi and @xiuwang - would it be possible to continue on with this PR to get it merged now that the issues have been worked through?

Hi @bryan-cox, thanks for the reminder!
From my end everything still looks good to go. I'll remove the hold so that when QE labels it the bot can merge the PR automatically.
/hold cancel

/label qe-approved

/retest


Sonic boom per npc

Right now it appears that one sonic boom is added for each NPC that is created, even if the NPC is not in the scene.

Fixed.


⚠ Bofrost.fr has degraded performance

In 211e1aa, Bofrost.fr (https://www.bofrost.fr) experienced degraded performance:

HTTP code: 200
Response time: 862 ms

Resolved: Bofrost.fr performance has improved in d7ea301 after 6 minutes.


samba: 4.7.6 -> 4.7.9

Version 4.7.9 is a security release. The versions 4.7.7 & 4.7.8 contain
numerous bug fixes.
This fixes a couple of security related issues:

https://www.samba.org/samba/security/CVE-2018-10858.html
https://www.samba.org/samba/security/CVE-2018-10918.html
https://www.samba.org/samba/security/CVE-2018-10919.html
https://www.samba.org/samba/security/CVE-2018-1139.html

Changelogs for the version upgrades can be found below.

https://www.samba.org/samba/history/samba-4.7.7.html
https://www.samba.org/samba/history/samba-4.7.8.html
https://www.samba.org/samba/history/samba-4.7.9.html

(cherry picked from commit 67ea2c0ffe9a39111b780ce2995eb46c68d26cce)
Motivation for this change
Things done

[X] Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
Built on platform(s)

[X] NixOS
[ ] macOS
[ ] other Linux distributions

[X] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[ ] Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
[ ] Tested execution of all binary files (usually in ./result/bin/)
[ ] Determined the impact on package closure size (by running nix path-info -S before and after)
[X] Fits CONTRIBUTING.md.

Success on x86_64-linux (full log)
Attempted: samba
Partial log (click to expand)
strip is /nix/store/k8b9hqv58dd1z0j4ikak24ykndcm91s6-binutils-2.28.1/bin/strip
stripping (with command strip and flags -S) in /nix/store/am5pgwxd6cy3l6kf5ypq6yv0329sgz67-samba-4.7.9-dev/lib
patching script interpreter paths in /nix/store/am5pgwxd6cy3l6kf5ypq6yv0329sgz67-samba-4.7.9-dev
checking for references to /build in /nix/store/am5pgwxd6cy3l6kf5ypq6yv0329sgz67-samba-4.7.9-dev...
shrinking RPATHs of ELF executables and libraries in /nix/store/gd74ckgfvpsjlccdhm5id0qx7i6qqf4f-samba-4.7.9-man
gzipping man pages under /nix/store/gd74ckgfvpsjlccdhm5id0qx7i6qqf4f-samba-4.7.9-man/share/man/
strip is /nix/store/k8b9hqv58dd1z0j4ikak24ykndcm91s6-binutils-2.28.1/bin/strip
patching script interpreter paths in /nix/store/gd74ckgfvpsjlccdhm5id0qx7i6qqf4f-samba-4.7.9-man
checking for references to /build in /nix/store/gd74ckgfvpsjlccdhm5id0qx7i6qqf4f-samba-4.7.9-man...
/nix/store/54937n3s2b9xpgakyg7c7a49i4njydvy-samba-4.7.9

Success on aarch64-linux (full log)
Attempted: samba
Partial log (click to expand)
strip is /nix/store/hy39vplmzpwckvzxgyhr54dwz0mnfv2p-binutils-2.28.1/bin/strip
stripping (with command strip and flags -S) in /nix/store/656vxgzazgjw1b6k3jkgc1k3aqhxijmj-samba-4.7.9-dev/lib
patching script interpreter paths in /nix/store/656vxgzazgjw1b6k3jkgc1k3aqhxijmj-samba-4.7.9-dev
checking for references to /build in /nix/store/656vxgzazgjw1b6k3jkgc1k3aqhxijmj-samba-4.7.9-dev...
shrinking RPATHs of ELF executables and libraries in /nix/store/9zn6a498638hdadx55wnjlqn8y4j3276-samba-4.7.9-man
gzipping man pages under /nix/store/9zn6a498638hdadx55wnjlqn8y4j3276-samba-4.7.9-man/share/man/
strip is /nix/store/hy39vplmzpwckvzxgyhr54dwz0mnfv2p-binutils-2.28.1/bin/strip
patching script interpreter paths in /nix/store/9zn6a498638hdadx55wnjlqn8y4j3276-samba-4.7.9-man
checking for references to /build in /nix/store/9zn6a498638hdadx55wnjlqn8y4j3276-samba-4.7.9-man...
/nix/store/cr2f07vhj7ky543m093ii849ghxazss6-samba-4.7.9

No attempt on x86_64-darwin (full log)
The following builds were skipped because they don't evaluate on x86_64-darwin: samba
Partial log (click to expand)

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

@GrahamcOfBorg test samba

Success on x86_64-linux (full log)
Attempted: tests.samba
Partial log (click to expand)
server: exit status 0
client: running command: sync
client: exit status 0
test script finished in 18.63s
cleaning up
killing server (pid 596)
killing client (pid 613)
vde_switch: EOF on stdin, cleaning up and exiting
vde_switch: Could not remove ctl dir '/build/vde1.ctl': Directory not empty
/nix/store/932wlwkhhv1fclm1hcqr820s0fjv22xc-vm-test-run-samba

Success on aarch64-linux (full log)
Attempted: tests.samba
Partial log (click to expand)
client: exit status 0
server: running command: sync
server: exit status 0
test script finished in 49.42s
cleaning up
killing client (pid 647)
killing server (pid 627)
vde_switch: EOF on stdin, cleaning up and exiting
vde_switch: Could not remove ctl dir '/build/vde1.ctl': Directory not empty
/nix/store/czsbjdhgrxgkwxal728kgx3liblaplfk-vm-test-run-samba


Add a section describing a Time Server compromise

Solves #45
This pr adds a description of the consequences of a Time Server compromise. I didn't add much detail about how to recover from this attack, as I felt it is well described on the Key Management page, but I can add a section if others disagree.

Thanks @pattivacek and @jhdalek55! I updated the pr with your suggestions.

@allencain @iramcdonald @trishankatdatadog Is this sufficient?

Hi,
LGTM
I just carefully read the whole thread in the issue.  I like the level of
detail and agree with
Marina that we should put recovery text inline in this update.
Cheers,

Ira

Ira McDonald (Musician / Software Architect)
Chair - SAE Trust Anchors and Authentication TF
Co-Chair - TCG Trusted Mobility Solutions WG
Co-Chair - TCG Metadata Access Protocol SG
Chair - Linux Foundation Open Printing WGSecretary - IEEE-ISTO Printer
Working GroupCo-Chair - IEEE-ISTO PWG Internet Printing Protocol WGIETF
Designated Expert - IPP & Printer MIBBlue Roof Music / High North
Inchttp://sites.google.com/site/blueroofmusic
http://sites.google.com/site/blueroofmusichttp://sites.google.com/site/highnorthinc
http://sites.google.com/site/highnorthincmailto<EMAIL_ADDRESS>blueroofmusic@gmail.com(permanent) PO Box 221  Grand Marais, MI 49839
906-494-2434
On Thu, Feb 18, 2021 at 1:59 PM Lois Anne DeLong<EMAIL_ADDRESS>wrote:

@allencain @iramcdonald https://github.com/iramcdonald
@trishankatdatadog https://github.com/trishankatdatadog Is this
sufficient?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/uptane/deployment-considerations/pull/101#issuecomment-781565550,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AE33UO2XMST6UPSIMTRBR2LS7VPP3ANCNFSM4XY6T3LQ
.

Any objections if I merge this? It has been reviewed by three of us.

Closes Issue #45


How to login with facebook

Hi guys,
I made the local strategy but now I want to use Facebook strategy.
I added the facebook login, clientId, clientSecret in place and when I'm going to localhost:3030/auth/facebook the callback now has the access_token http://localhost:3030/auth/facebook/callback?code=generated_code&state=true#_=_ but I'm not logged in the app.

terminal output
Feathers application started on localhost:3030
error: (400) Route: /auth/facebook/callback?code=generated_code&state=true - user validation failed
info: BadRequest: user validation failed
    at Object.construct (/user/feathers-test/node_modules/babel-cli/node_modules/babel-polyfill/node_modules/core-js/modules/es6.reflect.construct.js:22:24)
    at BadRequest.ExtendableBuiltin (/user/feathers-test/node_modules/feathers-errors/lib/index.js:21:28)
    at BadRequest.FeathersError (/user/feathers-test/node_modules/feathers-errors/lib/index.js:99:87)
    at new BadRequest (/user/feathers-test/node_modules/feathers-errors/lib/index.js:139:79)
    at errorHandler (/user/feathers-test/node_modules/feathers-mongoose/lib/error-handler.js:23:25)
    at run (/user/feathers-test/node_modules/babel-cli/node_modules/babel-polyfill/node_modules/core-js/modules/es6.promise.js:89:22)
    at /user/feathers-test/node_modules/babel-cli/node_modules/babel-polyfill/node_modules/core-js/modules/es6.promise.js:102:28
    at flush (/user/feathers-test/node_modules/babel-cli/node_modules/babel-polyfill/node_modules/core-js/modules/_microtask.js:14:5)
    at doNTCallback0 (node.js:408:9)
    at process._tickDomainCallback (node.js:378:13)

@catalinmiron any chance you can post a link to your project somewhere?

It's just on my local machine. I got it working usign NeDB.. but no luck usign MongoDB.

I think it might be related to this issue https://github.com/feathersjs/feathers-authentication/issues/107.

@catalinmiron If you can push your mongo example to a github repo that would be super helpful.

there's nothing fancy, just the yo feather with facebook login and mongoDB. I haven't changed the app.js or something else. Just the basic boilerplate. What I'm asking is that should this work by default or should I add some code to this boilerplate in order to achieve FB(other oAuth) working?

@catalinmiron it should work just fine. I'll double check it, We haven't set up automated tests for the OAuth stuff yet because we need to be careful we don't publish keys. You created a facebook app and everything? When you went to /auth/facebook it redirected and prompted you for authorization and you authorized your app?

Yes, the setup is done right. Once the callback like `localhost:3030/auth/facebook/callback?code={{access_token}} I got the Oh no! Something went wrong in the browser and the following error in terminal
Feathers application started on localhost:3030
error: (400) Route: /auth/facebook/callback?code=generated_code&state=true - user validation failed
info: BadRequest: user validation failed
[...]

 I was able to reproduce it. It's because your mongoose model src/services/user/user-model.js is expecting an email and password value. Make your model look like this:
'use strict';

// user-model.js - A mongoose model
//
// See http://mongoosejs.com/docs/models.html
// for more of what you can do here.

const mongoose = require('mongoose');
const Schema = mongoose.Schema;

const userSchema = new Schema({
  facebookId: { type: String },
  facebook: { type: Schema.Types.Mixed },
  createdAt: { type: Date, 'default': Date.now },
  updatedAt: { type: Date, 'default': Date.now }
});

const userModel = mongoose.model('user', userSchema);

module.exports = userModel;

restart your server and it will work.
We need to fix this and have 3 options:

don't make those fields required and set the OAuth fields on the user according to the provider's chosen
don't add email and password fields to the model automatically when not using local auth
document it somewhere (probably the OAuth guide that is yet to be complete)

Maybe a combination of those. I'm going to rename this issue. Sorry about that @catalinmiron!


TD3

Implemented the TD3 algorithm into the AgileRL library. In doing this, I have made the following modifications:

agilerl/algorithms/td3.py --> script to implement the TD3 class
agilerl/hpo/mutations.py --> edited script to include the TD3 algorithm
agilerl/utils/utils.py --> edited script to include the TD3 algorithm
benchmarking.py --> small edit to append max_actions HP if user selects TD3 algorithm (note: this file may be different in other areas to the current main branch as tests were previously run on TD3)
agent_test.py --> I have included a new script to test a single agent in isolation, in my opinion, it may be helpful to include this script as a code snippet under the 'Example' section for each algorithm in the documentation as I think it improves on the existing snippet (but of course if you think otherwise no worries). It is also helpful as an out of the box solution for a user to quickly test how a single algorithm trains without HPO
demo.py --> added device agnostic code and changed "device" argument of functions from "cuda" to "device" to allow seamless use for users without GPUs

In addition to this, I noticed two minor errors in the existing DDPG algorithm and I have adjusted the code as follows:

line 223 --> changed from self.critic to self.critic_target
line 235 --> included the (1-dones) into the Bellman equation

Nice work on TD3! Couple of changes needed before merging please:

Ruff linting fails. Could you please check with ruff and implement the fixes?
Could you create a docs file for TD3 in docs/api/algorithms (this can copy the style of DDPG, DQN, etc)?

Thanks!

Nice work on TD3! Couple of changes needed before merging please:

Ruff linting fails. Could you please check with ruff and implement the fixes?
Could you create a docs file for TD3 in docs/api/algorithms (this can copy the style of DDPG, DQN, etc)?

Thanks!

Hey Nick,
Of course, I will make those changes now!


Operator projects using the removed APIs in k8s 1.22 requires changes.

Problem Description
Kubernetes has been deprecating API(s), which will be removed and are no longer available in 1.22. Operators projects using these APIs versions will not work on Kubernetes 1.22 or any cluster vendor using this Kubernetes version(1.22), such as OpenShift 4.9+. Following the APIs that are most likely your projects to be affected by:

apiextensions.k8s.io/v1beta1: (Used for CRDs and available since v1.16)
rbac.authorization.k8s.io/v1beta1: (Used for RBAC/rules and available since v1.8)
admissionregistration.k8s.io/v1beta1 (Used for Webhooks and available since v1.16)

Therefore, looks like this project distributes solutions via the Red Hat Connect with the package name as runtime-component-operator-certified and does not contain any version compatible with k8s 1.22/OCP 4.9. Following some findings by checking the distributions published:

runtime-component-operator.v0.7.0: this distribution is using APIs which were deprecated and removed in v1.22. More info: https://kubernetes.io/docs/reference/using-api/deprecation-guide/#v1-22. Migrate the API(s) for CRD: (["runtimecomponents.app.stacks"])

NOTE: The above findings are only about the manifests shipped inside of the distribution. It is not checking the codebase.
How to solve
It would be very nice to see new distributions of this project that are no longer using these APIs and so they can work on Kubernetes 1.22 and newer and published in the Red Hat Connect collection. OpenShift 4.9, for example, will not ship operators anymore that do still use v1beta1 extension APIs.
Due to the number of options available to build Operators, it is hard to provide direct guidance on updating your operator to support Kubernetes 1.22. Recent versions of the OperatorSDK greater than 1.0.0 and Kubebuilder greater than 3.0.0 scaffold your project with the latest versions of these APIs (all that is generated by tools only). See the guides to upgrade your projects with OperatorSDK Golang, Ansible, Helm or the Kubebuilder one. For APIs other than the ones mentioned above, you will have to check your code for usage of removed API versions and upgrade to newer APIs. The details of this depend on your codebase.
If this projects only need to migrate the API for CRDs and it was built with OperatorSDK versions lower than 1.0.0 then, you maybe able to solve it with an OperatorSDK version >= v0.18.x < 1.0.0:

$ operator-sdk generate crds --crd-version=v1
INFO[0000] Running CRD generator.
INFO[0000] CRD generation complete.

Alternatively, you can try to upgrade your manifests with controller-gen (version >= v0.4.1) :
If this project does not use Webhooks:

$ controller-gen crd:trivialVersions=true,preserveUnknownFields=false rbac:roleName=manager-role  paths="./..."

If this project is using Webhooks:

Add the markers sideEffects and admissionReviewVersions to your webhook (Example with sideEffects=None and admissionReviewVersions={v1,v1beta1}: memcached-operator/api/v1alpha1/memcached_webhook.go):

Run the command:

$ controller-gen crd:trivialVersions=true,preserveUnknownFields=false rbac:roleName=manager-role webhook paths="./..."

For further info and tips see the blog.
Thank you for your attention.

Hi, would we have any update on this?
See that we are very close to the release data and fix the projects seems not very hard. See how to fix it in the first comment. Then, would be great to be able to check a new version of your project distributed which is compatible with 4.9.

@camilamacedo86 We are about to release a new version of the Runtime Component Operator. It'll be available on a new channel. Would the existing users (version 0.7.0) be able to upgrade to the new version by simply switching the channel in the Subscription? Is there anything else we need to do (i.e. set something in the CSV) to make that possible? Thank you!

Hi @leochr that depends on how you configure your bundle.
If you are using the upgrade graph accordingly then OLM will be able to upgrade automatically.
More info: https://v0-18-z.olm.operatorframework.io/docs/concepts/olm-architecture/operator-catalog/creating-an-update-graph/

Closing as completed. RCO 0.8.0+ added support for this.


support context.Context on request

What's this PR do?
Append ScreenshotWithContext method to url2png.Client to support context.Context on HTTP request.
Where should the reviewer start?
url2png.go
How should this be manually tested?
TEST_KEY=TEST_KEY TEST_SECRET=TEST_SECRET go test --race ./...

This all looks good, but I don't have an API key for url2png right now. Any chance you could post the output of go test? I'd be happy to merge after seeing a successful test run :)

Oh, hold on. I can't merge things here anymore. Maybe @jessta or @nelix can press the important buttons when the time comes!

Thanks for your review.
Here is the output of go test.
$ TEST_KEY=xxxxxxxxxxxxxxxx TEST_SECRET=xxxxxxxxxxxxxxxxxxx go test -v ./...
=== RUN   TestScreenshot
=== RUN   TestCancel
=== RUN   TestBadURL
--- PASS: TestCancel (0.00s)
--- PASS: TestBadURL (0.59s)
--- PASS: TestScreenshot (0.91s)
PASS
ok  	github.com/wacul/url2png	0.920s

Hi @kyoh86, looks good to me. Thanks for the contribution.


Commas's will cause errors when displaying Collections

Entering a comma in the data fields when adding a Collection will cause errors when displaying.
Cause: prettytables cannot determine the delimiter.

Changed the delimiter to '~' from ','
Comma's are way to common to be used as a delimiter in descriptions.


New-TssSession 0.50.1 uses winauthwebservices even for credential

Verified issue does not already exist?
No
What error did you receive
New-TssSession uses winauthwebservices even for credential.
In version 0.42.0 it works as expected.

PS C:\Users\User> $global:POITSSSession = New-TssSession @paramNewTssSession -ErrorAction Stop -Verbose
VERBOSE: Provided command parameters: New-TssSession -SecretServer: -Credential:CredentialObject -ErrorAction:Stop -Verbose:$True
VERBOSE: SecretServer host: https://Myinstance.secretservercloud.eu/
VERBOSE: Performing the operation "Requesting OAuth2 token from https://Myinstance.secretservercloud.eu/ with URI of [https://Myinstance.secretservercloud.eu/oauth2/token]" on target "https://Myinstance.secretservercloud.eu/".
VERBOSE: Performing the operation POST  with: username=[User4connection]&password=[hidden]&grant_type=password
WARNING: Issue authenticating to [https://Myinstance.secretservercloud.eu/]
{"error":"Login failed."}
At C:\Program Files\WindowsPowerShell\Modules\Thycotic.SecretServer\0.50.1\functions\authentication\New-TssSession.ps1:162 char:25
+                         throw $_.Exception
+                         ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (:) [], Exception
    + FullyQualifiedErrorId : {"error":"Login failed."}

PS C:\Users\User> $global:POITSSSession

SecretServer        : https://Myinstance.secretservercloud.eu/
SecretServerVersion :
ApiVersion          : api/v1
WindowsAuth         : winauthwebservices
ApiUrl              : https://Myinstance.secretservercloud.eu/winauthwebservices/api/v1
AccessToken         :
RefreshToken        :
TokenType           : WindowsAuth
ExpiresIn           : 0
StartTime           : 16.08.2021 08:45:29
TimeOfDeath         : 01.01.0001 00:00:00
Take                :<PHONE_NUMBER>

Please run the command using -Verbose
No response
Provide a test case or steps to reproduce
PS C:\Users\User> $paramNewTssSession

Name                           Value
----                           -----
SecretServer                   https://Myinstance.secretservercloud.eu
Credential                     System.Management.Automation.PSCredential

PS C:\Users\User> Get-Module Thycotic.SecretServer

ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Script     0.50.1     Thycotic.SecretServer               {Start-TssLog, Stop-TssLog, Write-TssLog, Add-TssEventPipeline...}

PS C:\Users\User> $global:POITSSSession = New-TssSession @paramNewTssSession -ErrorAction Stop
WARNING: Issue authenticating to [https://Myinstance.secretservercloud.eu/]
{"error":"Login failed."}
At C:\Program Files\WindowsPowerShell\Modules\Thycotic.SecretServer\0.50.1\functions\authentication\New-TssSession.ps1:162 char:25
+                         throw $_.Exception
+                         ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (:) [], Exception
    + FullyQualifiedErrorId : {"error":"Login failed."}

PS C:\Users\User> $global:POITSSSession

SecretServer        : https://Myinstance.secretservercloud.eu/
SecretServerVersion :
ApiVersion          : api/v1
WindowsAuth         : winauthwebservices
ApiUrl              : https://Myinstance.secretservercloud.eu/winauthwebservices/api/v1
AccessToken         :
RefreshToken        :
TokenType           : WindowsAuth
ExpiresIn           : 0
StartTime           : 16.08.2021 08:45:29
TimeOfDeath         : 01.01.0001 00:00:00
Take                :<PHONE_NUMBER>

PS C:\Users\User> Remove-Module Thycotic.SecretServer
PS C:\Users\User> Import-Module Thycotic.SecretServer -RequiredVersion 0.42.0
PS C:\Users\User> $global:POITSSSession = New-TssSession @paramNewTssSession -ErrorAction Stop
PS C:\Users\User> $global:POITSSSession

SecretServer        : https://Myinstance.secretservercloud.eu/
SecretServerVersion : 10.9.000064
ApiVersion          : api/v1
ApiUrl              : https://Myinstance.secretservercloud.eu/api/v1
AccessToken         : [hidden]
RefreshToken        : [hidden]
TokenType           : bearer
ExpiresIn           : 1199
StartTime           : 16.08.2021 08:58:46
TimeOfDeath         : 16.08.2021 09:18:45
Take                :<PHONE_NUMBER>

Expected behavior
Use webservices instead of winauthwebservices as in older, working versions.
What Edition of Secret Server?
Cloud Subscription
What version of Secret Server
11.0
What PowerShell host was used when producing this error
Windows PowerShell (powershell)
PowerShell Host Version
Name                           Value

PSVersion                      5.1.14393.4530
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14393.4530
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           <IP_ADDRESS>

The verbose output shows that it is using OAuth2 authentication. It takes the credential provided and creates the body object with grant_type = 'password'.

VERBOSE: Performing the operation "Requesting OAuth2 token from https://Myinstance.secretservercloud.eu/ with URI of [https://Myinstance.secretservercloud.eu/oauth2/token]" on target "https://Myinstance.secretservercloud.eu/".

My Script has been working befor upgrading the Module to the new version.
The old version is still working!
The issue is that it connects to and returns winauthwebservices event though a crendtial Object is passed.
It's PSCredential in this form
UserName                     Password

svcTSS   System.Security.SecureString

I am unable to replicate the issue you are seeing. The logical workflow of New-TssSession has not been changed since version 0.33.1, what is in 0.42.0 still exists as-is in 0.50.1, and in the release pushed out yesterday (0.51.0).
The only way it sets IWA is if a specific parameter is provided:
https://github.com/thycotic-ps/thycotic.secretserver/blob/5dfa43e57c686b9070aed7c5397e4ff3ab04a7f1/src/functions/authentication/New-TssSession.ps1#L116-L118
A small mention, the use of Remove-Module Thycotic.SecretServer will not completely remove the module from your PowerShell session now that it uses a binary library. The cleanest way with testing between versions will be to restart your PowerShell session.

I'm not able to reproduce this in the latest release. I would recommend a few things to try out:

In a new PowerShell session try the below (based on your example):
Import-Module Thycotic.SecretServer -MinimumVersion 0.51.0
$poitsssession = New-TssSession @paramNewTssSession
$poitsssession | select TokenType

If that still returns the Windows Auth being used verify your $PSDefaultParameterValues is not trying to default the UseWindowsAuth parameter.

You can open the module directory in VS Code (with PowerShell ext) and then add a breakpoint on line 105 of the New-TssSession.ps1 file. Start the debugger and run your example code and you will be able to step through the code line by line.

In the next release (0.52.0) I am adding more verbose output to New-TssSession to help troubleshoot this a bit more. In version 0.48.0 the module had the PowerShell classes converted to a C# library but logically that command has stayed the same since Windows Auth support was added in v0.30.0 on February 2, 2021.


List copied file types in copy_dirs

Q
A

Issue Type
Feature Request

Deployer Version
-

Local Machine OS
-

Remote Machine OS
-

Description
It would be nice to have an option to set just some file types to copy in copy_dirs directive. For example:
set('copy_dirs', [
    'dist/*.js',
    'dist/*.css'
]);

Don't know, maybe copy_files would be better with allowing concrete files as well (eg dist/abcd.css).

I think copy_files is better here:
set('copy_files', [
    'dist/*.js',
    'dist/*.css'
]);

PR (#1392) added with copying file by file:
set('copy_files', [
     'dist/file1.txt',
     'dist/file2.txt',
     'dist/css/main.css'
]);

@fabkow It is slightly different than what this issue is about as it does not support * syntax, but at least good basement for future resolve. :-)

Can you add support for *?

If I could, I would. I use deployer at work, so from time to time there is a time gap to help improving underlying open-source libraries, but the time is not now. :-)

Closing as looks like nobody really interesting in such feature.


Adding new calculator leads to error on Android

Plugin Version or Commit ID
v0.12.0
Unity Version
2021.3.16f1
Your Host OS
Windows 10 Pro
Target Platform
Android
Description
Hello, i added LandmarksToTensor calculator.
I add the depedencies on the BUiLD file, and i rebuild the package again.
I also made sure the resources needed is in the StreamingAssets folder.
Everything works fine in Editor.
When I built it on Android, it leads to an error FAILED_PRECONDITION and it said the LandmarksToTensor is not defined.
Error Log:
Error parsing text-format mediapipe.CalculatorGraphConfig: 199:60: Extension "mediapipe.LandmarksToTensorCalculatorOptions.ext" is not defined or is not an extension of "mediapipe.CalculatorOptions".
Do you have any clue about this?
Thanks in advance.
Code to Reproduce the issue
No response
Additional Context
No response

Please share the differences with this project and provide the replication steps. While I can think of some possibilities, to answer your question, I need sufficient information to reproduce the same issue on my machine.

Sorry, I haven't built the --android arm64 back then.
It's going well right now!


[Config] Add vscode.css and reset.css for configurationSettings webview

these make webivew looks better and more comfortable
ONE-vscode-DCO-1.0-Signed-off-by: sunjin an<EMAIL_ADDRESS>

from #58

I'm working on to enable format checker for css ; https://github.com/Samsung/ONE-vscode/pull/113/checks?check_run_id=3630196896
and got these warnings...
reset.css
1: warning at line 2, col 5
The box-sizing property isn't supported in IE6 and IE7.
    box-sizing: border-box;

reset.css
2: warning at line 6, col 3
The universal selector (*) is known to be slow.
  *,

reset.css
3: warning at line 7, col 3
The universal selector (*) is known to be slow.
  *:before,

reset.css
4: warning at line 8, col 3
The universal selector (*) is known to be slow.
  *:after {

reset.css
5: warning at line 9, col 5
The box-sizing property isn't supported in IE6 and IE7.
    box-sizing: inherit;

reset.css
6: warning at line 12, col 3
Rule doesn't have all its properties in alphabetical order.
  body,

reset.css
7: warning at line 27, col 3
Rule doesn't have all its properties in alphabetical order.
  img {

As these are warnings so I could go with this but is it possible to correct them? or we don't have to worry about these?

I think VS Code is build with with a Chrome browser built-in so IE 6, 7 is not our consideration. and webview is small page so it might ok with universal selector. but I'll fix order of properties as alphabetical.

@SJ12896 , @llFreetimell is on vacation today. If you feel you need a review from him, we can wait till next Monday or remove him from the reviewer list.

@mhs4670go , you just landed the PR. was there talking through other channels?

Draft: (#117)


Missing words in System.Collections.Concurrent description

In https://docs.microsoft.com/en-us/dotnet/api/index?view=netframework-4.7.2 the description for System.Collections.Concurrent says ”…should be used in place of the corresponding types in the and namespaces…”.
This should be “…should be used in place of the corresponding types in the System.Collections and System.Collections.Generic namespaces…”

Duplicate of #637


Update SoundCloud SDK usage

Looks like there's a new version of the SDK now, and it's on NPM!
https://developers.soundcloud.com/docs/api/sdks#basic
https://www.npmjs.com/package/soundcloud

Will this include support for the SoundCloud iframe embed? It would be great to have a config parameter which supports the embed to keep their brand styling intact!

I'm having second thoughts about using the npm package. It's good that they have released it, but doesn't make sense to include in the bundle if apps may not even be playing Soundcloud songs. I'll keep this issue open as a reminder to update to version 3 of the SDK at some point.
@oyeanuj, similar to my point in https://github.com/CookPete/react-player/issues/11, ReactPlayer is supposed to be a non-opinionated, lightweight, stateless wrapper for video/audio SDKs and not much more. The idea is for developers to provide whatever external controls they need and just feed props into the player.

I just had a play with the new SDK and it seems very buggy, as well as not supporting things like track duration and load progress information. I'll close this for now until the SDK improves, as there is nothing forcing us to upgrade yet.


:sparkles: Add support for the new libhal-arm-mcu

Note to self: just use the arch flag to determine if arm-mcu should be used. No need to concern ourselves with the exact platform, just the arch is enough.


Upon provider pod crash/restart, MR deletion leaves orphaned external resources on cloud provider

Resource deletion and orphaned resources on cloud provider
What happened?
Hello, I created a benchmark to perform tests with thousands of GCP objects. During the MR deletion part of my benchmark, sometimes (less than 1% of managed resources) the MR is deleted from K8s cluster but not the external resource from GCP. The benchmark has been made on the GCP provider, but I think the root cause is in the upjet framework generator. GCP provider in version v0.37, upjet version v0.11.0-rc.0.
> Here a link to the my Run N°4: 4000 RecordSets: Create, shutdown then Delete.
On this run, I have created 4000 RecordSets MRs. Then, wait for the MR object to be in ready state. Scale K8s cluster to 0 worker node, then scale back to 1 worker node. After requesting deletion of all RecordSets some of then are been deleted from Kubernetes, but not from GCP console.

Top diagram: Number of API calls reveiced by GCP for the DNS API endpoints. Botton diagram: CPU usage of the worker node
The CPU consumption of the node is 60%, meaning 10vCPU usage for the provider. During my other benchmark the provider has never been able to consume more than 10vCPU. This means that it is problably already consuming the maximum amount of available CPU time.
For example the object recordset.dns.gcp.upbound.io/benchmarksix10 is missing the Terraform deletion log. This object is still present on GCP console. Object recordset.dns.gcp.upbound.io/benchmarksix11 is correctly deleted and not present anymore on GCP console.

Please find the complete log export (exported from GCP Logs Explorer):

benchmarksix10.csv, benchmarksix10.json
benchmarksix11.csv, benchmarksix11.json

For the object benchmarksix10 this two logs are missing:
2023-10-11T15:49:08Z DEBUG events Successfully requested deletion of external resource [...]
2023-10-11T15:49:08Z DEBUG provider-gcp Successfully requested deletion of external resource [...]

> Here a link to the my Run N°6: 2000 Buckets. The run deploy 2000 Bucket at (1 rq/s), and then request delete buckets delete. Same behavior as the run n°4: Bucket deleted from K8s but not from GCP

Correctly deleted in GCP and K8s: bucketbenchone1929.csv, bucketbenchone1929.json
Not deleted in GCP: bucketbenchone1928.csv, bucketbenchone1928.json

For the object bucketbenchone1928, this log is present:
2023-10-20T17:30:44Z INFO provider-gcp Failure limit has been exceeded [...]

Expected behavior ?
When requesting deletion of an object in K8s/Crossplane, the provider should wait the deletion confirmation from GCP/Terraform. Here problably the terraform destroy logic have not finish correctly but the object was deleted anyway.
How can we reproduce it?
The project benchmark_gcp_18-10-2023 contains a description of how I build my Crossplane environment (installation, configuration and script)s:

Date: 18/10/2023
Platform: Google Cloud Platform (GCP), GKE Cluster Standard
Version: K8s: 1.27.3-gke.100, Crossplane: v1.13, provider-gcp-dns:v0.37.0
Setting: Default, with Crossplane ControllerConfig: --debug and --enable-management-policies
Compute Machine type: e2-highcpu-16 (16vCPU/16Go)

Hi @arfevrier,
Thank you for the detailed analysis & reports. I see the following messages in the logs related to the benchmarksix10 resource:
"2023-10-11T15:48:59Z\tDEBUG\tprovider-gcp\tSuccessfully deleted managed resource\t{\"controller\": \"managed/dns.gcp.upbound.io/v1beta1, kind=recordset\", \"request\": {\"name\":\"benchmarksix10\"}, \"uid\": \"0eb1ea8a-3814-4322-aa6e-bc3ce30d2868\", \"version\": \"6629296\", \"external-name\": \"projects/sbx-31371-7bnts707l94ejkf4dv7n/managedZones/telco-zone-dns/rrsets/benchmarksix10.telco.orange.com./A\", \"deletion-timestamp\": \"2023-10-11 15:48:58 +0000 UTC\"}"

"2023-10-11T15:51:44Z\tDEBUG\tprovider-gcp\tCannot get managed resource\t{\"controller\": \"managed/dns.gcp.upbound.io/v1beta1, kind=recordset\", \"request\": {\"name\":\"benchmarksix10\"}, \"error\": \"RecordSet.dns.gcp.upbound.io \\\"benchmarksix10\\\" not found\"}"

Do you have an idea on why the provider could not find the external resource (the external resource in this context is the actual set of Google Cloud DNS records)? Looks like the managed resource (RecordSet.dns with name benchmarksix10 actually acquired a deletion timestamp) and when the provider observes the external resource and it can no longer find it (e.g., a 404 is returned), it removes the finalizer on the managed resource (MR, a Kubernetes Custom Resource that adheres to the Crossplane resource model), which in turn removes the object from the etcd store, i.e., actually deletes the object marked for deletion.
One explanation is for what happened to benchmarksix10, because as you mentioned the  Successfully requested deletion of external resource logs are missing for this MR, it was marked for deletion (i.e., it acquired the deletion timestamp because, for example, you asked for the deletion of the MR with kubectl) and when the provider had a chance to reconcile the resource, it observed that the resource no longer exists (and hence the \"RecordSet.dns.gcp.upbound.io \\\"benchmarksix10\\\" not found\" log message above) and because the corresponding external resource is no longer found, the finalizer is removed, in which case the object is actually deleted.
But then the external resource must have been deleted by an external entity (than the provider) and what I understand this is not the case.
Another more dangerous case is the provider loses the track of the external resource.  In this specific case for the RecordSet.dns resource, the external-name configuration is config.IdentifierFromProvider, which means all the information to relate the MR to the external resource is available in the external-name annotation (with the key crossplane.io/external-name). This external-name configuration is the most stable one although it can result in unnormalized MR APIs (an API quality issue) but this could still be an external-name configuration issue. The reasoning goes as follows: The external-resource is provisioned successfully, the MR transitions to the Ready == True, Synced == True state, upon further reconciliations the external-name annotation's value is updated and when the resource is observed with the updated external-name, it can no longer be found (and if it has acquired the deletion timestamp, it's ready for garbage collection and is garbage collected by Kubernetes). But such an external-name change would also be affecting non-deleted MRs of kind RecordSet.dns: Non-deleted ones would also not find their corresponding external resources and thus attempt to reprovision  them, causing a name conflict and resulting in Synced == False states with a reason like a record set with the given name already exists. This is something similar you observed in #305 with pod restarts. My understanding is that we are facing different symptoms here.
Looking at the underlying Terraform provider's documentation, I see the following:
The provider treats this resource as an authoritative record set. This means existing records (including the default records) for the given type will be overwritten when you create this resource in Terraform. In addition, the Google Cloud DNS API requires NS records to be present at all times, so Terraform will not actually remove NS records during destroy but will report that it did.

I don't have experience with GCP DNS recordsets but could this maybe related to our observations? At first sight, it does not seem related, at least for the benchmarksix10 resource because what we have observed is the lack of provider's attempt to make the deletion call (the lacking successfully requested deletion of external resource log) but could it be related to the "although MRs are deleted the external resources are there" part of the discussion?

Hi @ulucinar,
Thank you for your comment.
I’m not sure to understand why you have said the “provider could not find the external resource”. There is no such information printed in the log. The end of log for the benchmarksix10 resource look more like this:
2023-10-11T15:48:59Z\tDEBUG\tprovider-gcp\tSuccessfully deleted managed resource\t
2023-10-11T15:51:44Z\tDEBUG\tprovider-gcp\tReconciling\t
2023-10-11T15:51:44Z\tDEBUG\tprovider-gcp\tCannot get managed resource\t

Successfully deleted managed resource: Here we are on the line reconciler.go#L998 of the reconcile loop. This mean the finalizer have been removed from the resource (on line 981). The resource has no more finalizer and K8s is going finally delete the resource. Because the resource have been modified, this will start a new reconcile loop. We see the new reconcile loop at 2023-10-11T15:51:44 Reconciling. Of course, the resource doesn't exist anymore (Cannot get managed resource) because the finalizer have been removed in previous reconcile loop.
That’s why I think we need to understand what happen before this Successfully deleted managed. I've just seen that the benchmarksix10 and benchmarksix11 objects have no Terraform deletion log. Maybe it's linked to your comment: "Terraform will not actually remove NS records during destroy but will report that it did."
BUT! We don't have the "Successfully requested deletion of external resource". Because we should enter the if condidition here reconciler.go#L942, but there is no "Cannot delete external resource" or "Successfully requested deletion of external resource" meaning the observation.ResourceExists is false.
The external resource doesn't exist ? How this observation is done ? Because there is no log of Terraform refresh. The provider never perform a Terraform refresh after the restart of the provider at 15:40 (CET).
If we look at the Observe function external_nofork.go#L451 the only way to return ResourceExists=false without error is this condition:
if meta.WasDeleted(mg) && n.opTracker.IsDeleted() {
		return managed.ExternalObservation{
			ResourceExists: false,
		}, nil
	}

We can take a look also on the GCP Bucket issue. You can see on the log that the Bucket bucketbenchone1928 is deleted, but the audit log at the end show that my browser can still get access to the bucket.
With this bucketbenchone1928 bucket we have multiple time the log "Successfully requested deletion of external resource" but it comes with Terraform TTL error:
2023-10-20T17:30:44Z\tDEBUG\tevents\tcannot schedule a native provider during observe: c1545cfc-393b-4e22-857e-ce8108abdbb3: cannot schedule native Terraform provider process, please consider increasing its TTL


Expand Niconico Video support

Niconico Video has two quality levels for a video, "normal" and "economy" (Japlish for "low"). Currently, using youtube-dl -F on a Niconico Video link only brings up one video quality:
format code  extension      resolution note
0            unknown_video  unknown

Expanding youtube-dl's functionality to include video quality would be nice. The url for the video file changes by having "low" added as a suffix (http://smile-fnl41.nicovideo.jp/smile?m=1097445.24697low vs.
http://smile-fnl41.nicovideo.jp/smile?v=1097445.24697) (Economy mode can be forced by appending ?eco=1 to the end of a Niconico URL, for what it's worth)
It should be noted that normal users who don't pay up for a premium account may get the economy quality automatically from JST 6:00 PM to 2:00 AM on normal days, and JST 12:00 PM to 2:00 AM on Saturdays, Sundays, and holidays. If this affects youtube-dl's behavior of automatically getting the highest quality, the file size in bytes can be found in "size_high" (for normal quality) and "size_low" (for economy) at http://ext.nicovideo.jp/api/getthumbinfo/$VIDEO-ID (for example, http://ext.nicovideo.jp/api/getthumbinfo/sm1097445 for http://www.nicovideo.jp/watch/sm1097445)

I even had nico force low quality on my paid premium account the other day, and ended up having to reschedule all my downloads for the middle of the day on a work day to get around it.
If I had a way to fail a download in eco mode it would be really convenient. I know I can see it in advance with -F but the last time I was downloading 200+ videos and didn't know whether it was going to cross into economy mode half way through.


LND crash on boot

Background
We have a casa node user who's lnd instance is crashing on boot. It looks like it is happening even before lnd is unlocked. Meaning, as soon as the lnd container starts running.
We are going to recover the funds for this user via SCB. I'm assuming there is a database corruption somewhere. I wanted to drop the error logs in here on the off chance that it would be helpful.
 If so, do you know what version it upgraded from? If you have an SCB, then it would seem the user was at least on 0.6?
It does look like db corruption tho, SCB will probably be the best path forward. Will continue to comb through and see if we can gleam anything

Woops. This user has not updated to 0.7.1 yet, they were consistently running 0.7.0.
Originally, bitcoind was corrupted and we had to resync bitcoind data from the cloud. While bitcoind was corrupted lnd was online and spinning on this unable to query estimater as seen below.
 8827: 2019-08-23T09:35:25Z lnd UNKNOWN[3258] 2019-08-23 09:35:24.986 [ERR] LNWL: unable to query estimator: -28: Loading block index...
 8828  2019-08-23T09:35:52Z bitcoind UNKNOWN[30386] : Error opening block database.
 8829  2019-08-23T09:35:52Z bitcoind UNKNOWN[30386] Please restart with -reindex or -reindex-chainstate to recover.

Then we turned off bitcoind and lnd resynced bitcoind to (-1k blocks from head) and restarted lnd. Maybe lnd was corrupted because we started it while bitcoind was behind where it was prior to the chainstate corruption?

Maybe lnd was corrupted because we started it while bitcoind was behind where it was prior to the chainstate corruption

This scenario wouldn't cause this kind of corruption.
Are bitcoind and lnd sharing the same disk? Could've been a disk issue given that both bitcoind and lnd were corrupted.

Are bitcoind and lnd sharing the same disk? Could've been a disk issue given that both bitcoind and lnd were corrupted.

Yes, they are on the same spinning disk HDD. It's certainly possible.

Will go ahead and close this then. Keep in mind that the channels will be closed as part of the recovery process. Feel free to comment/reopen if you run into any issues.


problem with serverlist

Hi
I get info I dont have any servers, but I create a list base on instruction
https://marketplace.visualstudio.com/items?itemName=humy2833.ftp-simple#user-content-config-setting-example
and ftp-simple extention works correctly
mac user

Hi. In the server configuration, is the 'type' parameter set to 'sftp'?
I filtering all entries in ftp-simple config by 'type': 'sftp'.
If the type is sftp, I'll test in the emulator under Mac and try to fix this problem in the next few days.
If not, I can add a setting to enable 'ftp' in the server list.
Thanks for the issue.

Of course, I had to skip this and I had ftp. I'm sorry for trouble. Works great


Fixes FromJson issue with single column table

            JsonElement propBag = document.RootElement;

Not related to your changes, but can you remove this unused line?

Refers to: src/libraries/Microsoft.PowerFx.Json/FormulaValueJSON.cs:31 in 1a27ea3. [](commit_id = 1a27ea313ff45266b12cf1e2ccb2714418e1b351, deletion_comment = False)

            JsonElement propBag = document.RootElement;

removed.

In reply to:<PHONE_NUMBER>

Refers to: src/libraries/Microsoft.PowerFx.Json/FormulaValueJSON.cs:31 in 1a27ea3. [](commit_id = 1a27ea313ff45266b12cf1e2ccb2714418e1b351, deletion_comment = False)

✅ No public API change.

✅ No public API change.


[Compatibility] The Graveyard support

I suggest adding mob icons to the map

XP doesn't add any icons, its better for those to be in resource packs
contact the owner of that mod to make a resource pack. or contact : https://modrinth.com/resourcepack/icon-xaeros to request icons be added to their resource pack


typo: organziation -> organization

@nschonni : Thanks for your contribution! The author, @markingmyname, has been notified to review your proposed change.

@Jak-MS : Thanks for your contribution! The author, @markingmyname, has been notified to review your proposed change.


 Love it!
I noticed that the applications.<name>.name option has no effect on anything, as far as I can tell. The question is really whether this option is needed, since the name can easily be tweaked using nix string interpolation (e.g. applications.${env}-foo = { ... }.

Thanks for the issue and I'm glad you like the project :)
I think the option can be useful if you want to force change the name of an application that was already defined in another module. I added this option initially before I had implemented any unit tests and then forgot to make sure it works as expected.
I hope I can take some time to fix this soon.

Ah, yes I see. I'll PR if I fix it first :)

The fix was simpler than I expected so I could quickly fix it. I created a new release v0.5.0 including this bug fix. Thanks for the report!

Thanks for fixing it so quickly @arnarg!


How to change Alphabetical order?

How could I change the alphabetical ordering to any sorting I want?
Is it in "js" script?

Yes, you can definitely do this in better-filter-widget.js


Is this project dead?

I see there has been no commits in the last 3 years

This project is no longer under development or fully supported by Real Serious Games. However, we're open to outside contributors if you or anyone else wants to take up the torch.

Looks like this fork is a bit more recent. Not sure if the fork is actively maintained but it seems to be ahead at least

any reason not to try to get those commits merged?

@Borningstar do you or maybe @RoryDungan have any insight to share why this codebase is not longer actively supported? Have you moved away from maybe Unity, UGUI or the MVVM approach in favor of something else? Just curious!


dac_override while accessing container resources

Hi, i am getting dac_override while accessing host's resources via container using Kuberentes with Crio and the runtime below is Runc
type=AVC msg=audit(1508225461.145:6412): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225461.145:6413): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225462.128:6414): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225462.128:6415): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225462.820:6416): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225462.820:6417): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225463.506:6423): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225463.506:6424): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225464.086:6425): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225464.086:6426): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225464.793:6436): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225464.793:6437): avc:  denied  { dac_override } for  pid=13929 comm="bash" capability=1  scontext=system_u:system_r:carts-db_t:s0:c0 tcontext=system_u:system_r:carts-db_t:s0:c0 tclass=capability
type=AVC msg=audit(1508225474.107:6488): avc:  denied  { execmem } for  pid=14275 comm="java" scontext=system_u:system_r:carts_t:s0:c0 tcontext=system_u:system_r:carts_t:s0:c0 tclass=process

What could be the cause, am i missing something from the setup?

ping @rhatdan

I don't know where the policy for carts-db_t comes from or carts_t.
dac_override is being caused by you running bash and it trying to write /root/.bash_history, UID=0 is not allowed to write in this directory without DAC_OVERRIDE.  So whoever wrote carts-db_t needs to either add it or dontaudit it.  This should not really prevent bash from doing its thing.
Similarly carts_t needs execmem, which is used for something that modifies memory and then executes it. Java apps always need it, so whoever wrote carts_t policy needs to add this.  Neither of these are issues of CRI-O.

@rhatdan I made these policies myself, thanks for the feedback will add these rules. Though when i apply same policies on docker runtime these policies work fine. Is there any particular reason for this? Closing the issue anyway.

Make sure when running in docker they are actually happening, I would guess. IE cat /proc/self/current/attr
To see if the SELinux policy type is applied.
The DAC_OVERRIDE would only happen on a Fedora/RHEL based root.  IE root has the following permissions.
ls -ld /root
dr-xr-x---. 1 root root 43 Oct 16 21:45 /root
Note how noone is allowed to write to this directory, which is causing the DAC_OVERRIDE.
The execmem should be the same issue.  Unless thier is a code path java had not hit?
Anyways cool that you are trying to write SELinux rules for this.

@rhatdan Got it, thanks a lot for the feedback it's very helpful.


EVA-2924 - Adding case to detect structural variants during validation

@sundarvenkata-EBI I have still kept this in the eload_validation.py. As we were discussing, whenever we will have a more concrete code maybe we can run through nextflow and check the whole VCF for the SV and also extract the SVs as you suggested in the config file. We can deal with this in a new ticket then.


Add RV Dumpstation Icon

Add RV Dumpstation Icon

@tpcolson this will be there in our new update which should be coming soon... I'll let you know when it is out there.

@tpcolson is this the symbol you're referring to?
https://github.com/nationalparkservice/npmap-symbol-library/blob/gh-pages/svg-set-comprehensive/sanitary-disposal-station-black-32.svg

Closing this; pretty sure Tom was looking for the sanitary disposal station symbol back in April.


Bug 1880856: operator/network: update docs on iptablesSyncPeriod

In older releases, it was sometimes necessary for users to tweak kube-proxy's iptablesSyncPeriod to strike the right balance between "recovering from errors promptly" and "not causing errors constantly and totally breaking everything". With the rewrite of iptables monitoring in kube 1.18 this is no longer necessary, and modifying iptablesSyncPeriod is no longer particularly useful, so this updates the API docs to indicate that. (I've filed an openshift-docs PR too.)
In theory this could be backported as far as 4.3 but it's probably not worth bothering.
/cc @juanluisvaladas
/assign @knobunc

/lgtm

/lgtm
@knobunc I cannot approve


Standardized way to signal audio track language?

While the spec does talk a bit about the ordering being used to identify the language of an audio stream, I do think that some way to tag an audio stream with a language would be beneficial.
Adding three bytes for an ISO country code or something somewhere would be super nice and might prevent potential vendor-specific order-magic.

the "General Guidelines" section of the Multitrack section says

While this document doesn't prescribe specific encoding rules or manifest metadata, it aims to guide you through the complexities of leveraging multitrack features.

this suggests that things like language mappings for audio tracks and angle/bitrate/whatever mappings for video tracks might go in a separate "manifest" or other metadata.
onMetaData doesn't seem to account for multitrack yet. an enhanced onMetaData message that accounts for multiple tracks might also be a good place to describe what all the tracks in the stream are for.

also to draw attention to this important paragraph in the Multitrack section:

It's important to note that multitrack support is designed to augment, not
replace, the option of using multiple streams for streaming. While both multiple
streams and multitrack can potentially address the same use cases, the choice
between them will depend on the specific capabilities of your RTMP implementation
and requirements. In certain cases, multitrack may not be the most efficient
option.

it has always been possible to send multiple tracks simultaneously using multiple streams in the same RTMP connection. also note that stream names can be more interesting than just letters and numbers. a stream name could itself look like a path name
BigBuckBunny/audio/en-us

or have "query parameters"
BigBuckBunny?type=audio&lang=en-us

the meaning of stream names, including things that look like path parts or query parameters, is entirely the prerogative of the server/service, and might even have different meanings depending on whether you're publishing or playing (just like track IDs). for example, my tcserver  uses stream name query parameters to adjust the real-time transmission treatments of stream messages for play, and the preemption precedence for publish.

note that we now support onMetadata for multiple tracks https://github.com/veovera/enhanced-rtmp/issues/37


Bindings for FormData

I took a look at https://developer.mozilla.org/en-US/docs/Web/API/FormData and it seems binding this will involve writing some tricky bindings like iterators, Blobs, and so on.
@glennsl do you have any suggestions for this? Or maybe I can play around with it a bit and see what I come up with.

Yeah, that's a tricky one. There's been some attempt at adding it to bs-fetch too: https://github.com/reasonml-community/bs-fetch/pull/14
At the very least I think the formData and blob types should be added to Dom in bs-platform, to avoid needing bs-webapi as a dependency of bs-fetch for eaxmple. (And there's a few more types here that could be brought over then too, like image).
I also think Bob had some thoughts about iterator support in BuckleScript a few years ago. I don't know if he's thought any more about that, but might be worth asking.


Feature/max header size

Description
This PR add support for validating max header size.
Fixes #5
Type of change

[x] New feature (non-breaking change which adds functionality)
[x] This change requires a documentation update

How Has This Been Tested?
see unit test.
Checklist:

[x] My code follows the style guidelines of this project
[x] I have performed a self-review of my own code
[x] I have commented my code, particularly in hard-to-understand areas
[x] My changes generate no new warnings
[x] I have added tests that prove my fix is effective or that my feature works
[x] New and existing unit tests pass locally with my changes

thanks


Optional dependencies of dependencies incorrectly included on classpath

It appears that the gluonfx maven plugin is adding optional dependencies of dependencies to the classpath, when it should only be including those if they are explicit separate dependencies. Per the maven documentation on optional dependencies:

If a user wants to use functionality related to an optional dependency, they have to redeclare that optional dependency in their own project.

It appears that the functionality is included by gluonfx even in the absence of a redeclaration.
This application was created using the Gluon Mobile Eclipse plugin (single view project). The versions of the various dependencies and plugins have been updated to their latest versions. I added logback-classic 1.2.8 as a dependency, which in turn has groovy as an optional dependency. Notably, it does NOT redeclare the groovy dependency. Yet groovy-2.4.0.jar ends up on the classpath. (Note this example does not actually use logback for anything; it is just included in the pom.)
In my real application, this caused an issue because there was another dependency (picocli) that checked for the presence of groovy and executed a different code path if it was present. This
I have tried building with these JDKs:

Gluon GraalVM <IP_ADDRESS> JDK 17 (windows)
Gluon GraalVM <IP_ADDRESS> JDK 11 (linux targeting android)
Gluon GraalVM <IP_ADDRESS> JDK 17 (linux targeting android)

(Note that as of logback-classic 1.2.9, groovy is no longer an optional dependency and thus this problem goes away for this dependency. However, this was a convenient way to demonstrate the issue.)
Reproducing the issue
There is a reproducer here: https://github.com/marinier/gluonfxoptionaldependencytest
This is a maven project, so on windows I do this from a VS Native 64-bit Prompt:
mvn gluonfx:build

One of the first things that is printed is the classpath; near the end you can see groovy-2.4.0.jar is included.
[Mon Feb 14 16:50:53 EST 2022][INFO] [SUB] 'C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\classes;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\logback-classic-1.2.8.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\logback-core-1.2.8.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\charm-glisten-6.0.6.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\display-4.0.13-desktop.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\display-4.0.13.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\lifecycle-4.0.13-desktop.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\lifecycle-4.0.13.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\statusbar-4.0.13.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\storage-4.0.13-desktop.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\storage-4.0.13.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\util-4.0.13.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\javafx.base.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\javafx.controls.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\javafx.graphics.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\slf4j-api-1.7.32.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\activation-1.1.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\janino-3.0.6.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\groovy-2.4.0.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\mail-1.4.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\activation.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\javax.servlet-api-3.1.0.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\deps\commons-compiler-3.0.6.jar;C:\Users\bob.marinier\.m2\repository\com\gluonhq\substrate\0.0.52\substrate-0.0.52.jar;C:\Users\bob.marinier\git\gluonfxoptionaldependencytest\target\gluonfx\x86_64-windows\gvm\tmp\classpathJar.jar;C:\Users\bob.marinier\graalvm-svm-java17-windows-gluon-<IP_ADDRESS>-Final\lib\svm\library-support.jar' \

Did you try excluding the not wanted transitive dependencies from the project's pom?

No, but the point is that I shouldn't have to. Optional dependencies are supposed to be explicitly included, not explicitly excluded.
https://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html
The particular dependency that affected me (logback) has a newer version that no longer includes the problematic dependency, so I don't need a workaround -- this bug isn't holding me up or anything. I'm just reporting it so you can address it whenever you see fit. Optional dependencies aren't very common, but it's possible that it could reduce the classpath, and hence the build time, for some projects.