[BUG] "Failed to reserve DRM plane" when running python overlay_drm.py in RPi5 Composite

Please only report one bug per issue!
I'm attempting to display the output of the Picamera2 on a DRM (Direct Rendering Manager) preview window and then output it to analog video. However, when I launch the application, I encounter the following error:
I previously inquired about this issue in the repository responsible for the kernel.  https://github.com/raspberrypi/linux/issues/5948#issuecomment-1941545899
raise RuntimeError("Failed to reserve DRM plane")
RuntimeError: Failed to reserve DRM plane

Could you advise on how to resolve this issue and what I might be doing wrong in this scenario?
Describe the bug
I'm having trouble seeing the DRM (Direct Rendering Manager) preview on an RPI5 when using the composite video output.
Hardware :
I'm using Raspberry Pi 5
Console Output, Screenshots
If applicable, any console output or screenshots that show the problem and associated error messages.
Additional context
uname -a
`Linux raspberrypi 6.6.22-v8-16k+ #1747 SMP PREEMPT Wed Mar 27 17:06:56 GMT 2024 aarch64 GNU/Linux
vcgencmd version
2024/02/16 15:28:41
Copyright (c) 2012 Broadcom
version 4c845bd3 (release) (embedded)

`cat /boot/config.txt
# For more options and information see
# http://rptl.io/configtxt
# Some settings may impact device functionality. See link above for details
# Uncomment some or all of these to enable the optional hardware interfaces
#dtparam=i2c_arm=on
#dtparam=i2s=on
#dtparam=spi=on
disable_overscan=1
# Enable audio (loads snd_bcm2835)
suddtparam=audio=on

# Additional overlays and parameters are documented
# /boot/firmware/overlays/README

# Automatically load overlays for detected cameras
camera_auto_detect=1

# Automatically load overlays for detected DSI displays
#display_auto_detect=1
#[pi4]
#dtoverlay=imx296
#dtoverlay=ov5647o
#[pi5]
#dtoverlay=imx708

# Automatically load initramfs files, if found
#auto_initramfs=1
#[pi5]
#hdmi_force_hotplug=1
#hdmi_enable_4kp60=1

[pi4]
force_turbo=1
arm_freq=1900
core_freq=600
h264_freq=600
isp_freq=600
v3d_freq=600
hevc_freq=600
#sdram_freq=3200
arm_freq_min=1900
core_freq_min=600
gpu_freq_min=600
#h264_freq_min
isp_freq_min=600
v3d_freq_min=600
#sdram_freq_min=4267
over_voltage=6
#[all]
hdmi_ignore_hotplug=1
enable_tvout=1

# Run in 64-bit mode
arm_64bit=1

# Disable compensation for displays with overscan

# Run as fast as firmware / board allows
arm_boost=1
[pi4]
# Enable DRM VC4 V3D driver on top of the dispmanx display stack
dtoverlay=vc4-fkms-v3d,composite=1

[pi5]
#dtoverlay=vc4-kms-v3d-pi5,cma-256=1,composite=1
dtoverlay=vc4-kms-v3d,composite
[all]
max_framebuffers=2
# enable serial interface
[pi4]
enable_uart=1
#dtoverlay=uart0
#dtoverlay=uart1
#dtoverlay=uart2
#dtoverlay=uart3
dtoverlay=uart4
dtoverlay=uart5
dtoverlay=disable-bt
[pi5]
enable_uart=1
dtoverlay=uart3-pi5
dtoverlay=uart4-pi5
dtoverlay=disable-bt

 cat /boot/cmdline.txt
root=PARTUUID=7d3bf79a-02 rootfstype=ext4 fsck.repair=yes rootwait cfg80211.ieee80211_regdom=UA vc4.tv_norm=PAL60 video=Composite-1:1280x720@60D

dmesg
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x414fd0b1]
[    0.000000] Linux version 6.6.22-v8-16k+ (dom@buildbot) (aarch64-linux-gnu-gcc-8 (Ubuntu/Linaro 8.4.0-3ubuntu1) 8.4.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #1747 SMP PREEMPT Wed Mar 27 17:06:56 GMT 2024
[    0.000000] KASLR enabled
[    0.000000] random: crng init done
[    0.000000] Machine model: Raspberry Pi 5 Model B Rev 1.0
[    0.000000] efi: UEFI not found.
[    0.000000] Reserved memory: created CMA memory pool at 0x0000000002000000, size 320 MiB
[    0.000000] OF: reserved mem: initialized node linux,cma, compatible id shared-dma-pool
[    0.000000] OF: reserved mem: 0x0000000002000000..0x0000000015ffffff (327680 KiB) map reusable linux,cma
[    0.000000] OF: reserved mem: 0x0000000000000000..0x000000000007ffff (512 KiB) nomap non-reusable atf@0
[    0.000000] OF: reserved mem: 0x000000003fd16780..0x000000003fd167b6 (0 KiB) nomap non-reusable nvram@0
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000000000000-0x00000000ffffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000007ffff]
[    0.000000]   node   0: [mem 0x0000000000080000-0x000000003fbfffff]
[    0.000000]   node   0: [mem 0x0000000040000000-0x00000000ffffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x00000000ffffffff]
[    0.000000] On node 0, zone DMA: 256 pages in unavailable ranges
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 14 pages/cpu s184040 r8192 d37144 u229376
[    0.000000] pcpu-alloc: s184040 r8192 d37144 u229376 alloc=14*16384
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[    0.000000] Detected PIPT I-cache on CPU0
[    0.000000] CPU features: detected: Virtualization Host Extensions
[    0.000000] CPU features: detected: Hardware dirty bit management
[    0.000000] CPU features: detected: Spectre-v4
[    0.000000] CPU features: detected: Spectre-BHB
[    0.000000] CPU features: kernel page table isolation forced ON by KASLR
[    0.000000] CPU features: detected: Kernel page table isolation (KPTI)
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: reboot=w coherent_pool=1M 8250.nr_uarts=1 pci=pcie_bus_safe snd_bcm2835.enable_compat_alsa=0 snd_bcm2835.enable_hdmi=1  smsc95xx.macaddr=D8:3A:DD:CB:12:E4 vc_mem.mem_base=0x3fc00000 vc_mem.mem_size=0x40000000  root=PARTUUID=7d3bf79a-02 rootfstype=ext4 fsck.repair=yes rootwait cfg80211.ieee80211_regdom=UA vc4.tv_norm=PAL60 video=Composite-1:1280x720@60D
[    0.000000] Dentry cache hash table entries: 524288 (order: 8, 4194304 bytes, linear)
[    0.000000] Inode-cache hash table entries: 262144 (order: 7, 2097152 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 260864
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 3809520K/4190208K available (13376K kernel code, 2222K rwdata, 4336K rodata, 5120K init, 1213K bss, 53008K reserved, 327680K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] ftrace: allocating 44583 entries in 44 pages
[    0.000000] ftrace: allocated 44 pages with 3 groups
[    0.000000] trace event string verifier disabled
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000] rcu:     RCU event tracing is enabled.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=256 to nr_cpu_ids=4.
[    0.000000]  Trampoline variant of Tasks RCU enabled.
[    0.000000]  Rude variant of Tasks RCU enabled.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=4
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GIC: Using split EOI/Deactivate mode
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 timer(s) running at 54.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xc743ce346, max_idle_ns:<PHONE_NUMBER>23 ns
[    0.000000] sched_clock: 56 bits at 54MHz, resolution 18ns, wraps every<PHONE_NUMBER>102ns
[    0.000170] Console: colour dummy device 80x25
[    0.000174] printk: console [tty0] enabled
[    0.000348] Calibrating delay loop (skipped), value calculated using timer frequency.. 108.00 BogoMIPS (lpj=216000)
[    0.000357] pid_max: default: 32768 minimum: 301
[    0.000381] LSM: initializing lsm=capability,integrity
[    0.000440] Mount-cache hash table entries: 8192 (order: 2, 65536 bytes, linear)
[    0.000453] Mountpoint-cache hash table entries: 8192 (order: 2, 65536 bytes, linear)
[    0.000801] cgroup: Disabling memory control group subsystem
[    0.001231] RCU Tasks: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1.
[    0.001260] RCU Tasks Rude: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1.
[    0.001287] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1.
[    0.001349] rcu: Hierarchical SRCU implementation.
[    0.001354] rcu:     Max phase no-delay instances is 1000.
[    0.001959] EFI services will not be available.
[    0.002034] smp: Bringing up secondary CPUs ...
[    0.002201] Detected PIPT I-cache on CPU1
[    0.002244] CPU1: Booted secondary processor 0x0000000100 [0x414fd0b1]
[    0.002431] Detected PIPT I-cache on CPU2
[    0.002463] CPU2: Booted secondary processor 0x0000000200 [0x414fd0b1]
[    0.002632] Detected PIPT I-cache on CPU3
[    0.002662] CPU3: Booted secondary processor 0x0000000300 [0x414fd0b1]
[    0.002688] smp: Brought up 1 node, 4 CPUs
[    0.002708] SMP: Total of 4 processors activated.
[    0.002713] CPU features: detected: 32-bit EL0 Support
[    0.002717] CPU features: detected: Data cache clean to the PoU not required for I/D coherence
[    0.002722] CPU features: detected: Common not Private translations
[    0.002726] CPU features: detected: CRC32 instructions
[    0.002731] CPU features: detected: RCpc load-acquire (LDAPR)
[    0.002734] CPU features: detected: LSE atomic instructions
[    0.002738] CPU features: detected: Privileged Access Never
[    0.002742] CPU features: detected: RAS Extension Support
[    0.002747] CPU features: detected: Speculative Store Bypassing Safe (SSBS)
[    0.002782] CPU: All CPU(s) started at EL2
[    0.002785] alternatives: applying system-wide alternatives
[    0.004592] devtmpfs: initialized
[    0.007469] Enabled cp15_barrier support
[    0.007480] Enabled setend support
[    0.007543] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns:<PHONE_NUMBER>100000 ns
[    0.007552] futex hash table entries: 1024 (order: 2, 65536 bytes, linear)
[    0.008311] pinctrl core: initialized pinctrl subsystem
[    0.008447] DMI not present or invalid.
[    0.008627] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.009235] DMA: preallocated 1024 KiB GFP_KERNEL pool for atomic allocations
[    0.009285] DMA: preallocated 1024 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.009337] DMA: preallocated 1024 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.009358] audit: initializing netlink subsys (disabled)
[    0.009410] audit: type=2000 audit(0.008:1): state=initialized audit_enabled=0 res=1
[    0.009529] thermal_sys: Registered thermal governor 'step_wise'
[    0.009540] cpuidle: using governor menu
[    0.009647] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[    0.009678] ASID allocator initialised with 32768 entries
[    0.009995] Serial: AMBA PL011 UART driver
[    0.010782] bcm2835-mbox 107c013880.mailbox: mailbox enabled
[    0.011095] 107d001000.serial: ttyAMA10 at MMIO 0x107d001000 (irq = 15, base_baud = 0) is a PL011 rev2
[    0.011109] printk: console [ttyAMA10] enabled
[    0.742297] raspberrypi-firmware soc:firmware: Attached to firmware from 2024-02-16T15:28:41, variant start_cd
[    0.756349] raspberrypi-firmware soc:firmware: Firmware hash is 4c845bd300000000000000000000000000000000
[    0.772180] Modules: 2G module region forced by RANDOMIZE_MODULE_REGION_FULL
[    0.779262] Modules: 0 pages in range for non-PLT usage
[    0.779264] Modules: 129412 pages in range for PLT usage
[    0.789075] bcm2835-dma<PHONE_NUMBER>.dma: DMA legacy API manager, dmachans=0x1
[    0.802009] iommu: Default domain type: Translated
[    0.806826] iommu: DMA domain TLB invalidation policy: strict mode
[    0.813125] SCSI subsystem initialized
[    0.816924] usbcore: registered new interface driver usbfs
[    0.822438] usbcore: registered new interface driver hub
[    0.827784] usbcore: registered new device driver usb
[    0.832941] pps_core: LinuxPPS API ver. 1 registered
[    0.837924] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti<EMAIL_ADDRESS>[    0.847098] PTP clock support registered
[    0.851283] vgaarb: loaded
[    0.854142] clocksource: Switched to clocksource arch_sys_counter
[    1.078925] VFS: Disk quotas dquot_6.6.0
[    1.082883] VFS: Dquot-cache hash table entries: 2048 (order 0, 16384 bytes)
[    1.089988] FS-Cache: Loaded
[    1.092914] CacheFiles: Loaded
[    1.097500] NET: Registered PF_INET protocol family
[    1.102484] IP idents hash table entries: 65536 (order: 5, 524288 bytes, linear)
[    1.111175] tcp_listen_portaddr_hash hash table entries: 2048 (order: 1, 32768 bytes, linear)
[    1.119760] Table-perturb hash table entries: 65536 (order: 4, 262144 bytes, linear)
[    1.127539] TCP established hash table entries: 32768 (order: 4, 262144 bytes, linear)
[    1.135623] TCP bind hash table entries: 32768 (order: 6, 1048576 bytes, linear)
[    1.143818] TCP: Hash tables configured (established 32768 bind 32768)
[    1.150497] MPTCP token hash table entries: 4096 (order: 2, 98304 bytes, linear)
[    1.157979] UDP hash table entries: 2048 (order: 2, 65536 bytes, linear)
[    1.164759] UDP-Lite hash table entries: 2048 (order: 2, 65536 bytes, linear)
[    1.172042] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    1.177834] RPC: Registered named UNIX socket transport module.
[    1.183780] RPC: Registered udp transport module.
[    1.188500] RPC: Registered tcp transport module.
[    1.193220] RPC: Registered tcp-with-tls transport module.
[    1.198729] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    1.205202] PCI: CLS 0 bytes, default 64
[    1.209320] kvm [1]: IPA Size Limit: 40 bits
[    1.213627] kvm [1]: GICV region size/alignment is unsafe, using trapping (reduced performance)
[    1.222385] kvm [1]: vgic interrupt IRQ9
[    1.226331] kvm [1]: VHE mode initialized successfully
[    1.231838] Initialise system trusted keyrings
[    1.236338] workingset: timestamp_bits=46 max_order=18 bucket_order=0
[    1.242820] zbud: loaded
[    1.245505] NFS: Registering the id_resolver key type
[    1.250585] Key type id_resolver registered
[    1.254781] Key type id_legacy registered
[    1.258807] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[    1.265535] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[    1.272994] F2FS not supported on PAGE_SIZE(16384) != 4096
[    1.278551] Key type asymmetric registered
[    1.282661] Asymmetric key parser 'x509' registered
[    1.287567] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 247)
[    1.295026] io scheduler mq-deadline registered
[    1.299573] io scheduler kyber registered
[    1.303603] io scheduler bfq registered
[    1.307649] irq_brcmstb_l2: registered L2 intc (/soc/interrupt-controller@7c502000, parent irq: 26)
[    1.316799] irq_brcmstb_l2: registered L2 intc (/soc/intc@7d503000, parent irq: 27)
[    1.324539] irq_brcmstb_l2: registered L2 intc (/soc/intc@7d508380, parent irq: 28)
[    1.332273] irq_brcmstb_l2: registered L2 intc (/soc/intc@7d508400, parent irq: 29)
[    1.340009] irq_brcmstb_l2: registered L2 intc (/soc/interrupt-controller@7d510600, parent irq: 30)
[    1.349137] irq_brcmstb_l2: registered L2 intc (/soc/intc@7d517b00, parent irq: 31)
[    1.391586] Serial: 8250/16550 driver, 1 ports, IRQ sharing enabled
[    1.398281] 107d50c000.serial: ttyS0 at MMIO 0x107d50c000 (irq = 33, base_baud = 6000000) is a Broadcom BCM7271 UART
[    1.409162] iproc-rng200 107d208000.rng: hwrng registered
[    1.414634] vc-mem: phys_addr:0x00000000 mem_base=0x3fc00000 mem_size:0x40000000(1024 MiB)
[    1.423149] bcm2712-iommu-cache 1000005b00.iommuc: bcm2712_iommu_cache_probe
[    1.432082] brd: module loaded
[    1.436524] loop: module loaded
[    1.439800] bcm2835-power bcm2835-power: Broadcom BCM2835 power domains driver
[    1.447167] Loading iSCSI transport class v2.0-870.
[    1.452903] usbcore: registered new device driver r8152-cfgselector
[    1.459207] usbcore: registered new interface driver r8152
[    1.464718] usbcore: registered new interface driver lan78xx
[    1.470404] usbcore: registered new interface driver smsc95xx
[    1.476228] dwc_otg: version 3.00a 10-AUG-2012 (platform bus)
[    1.482015] dwc_otg: FIQ enabled
[    1.482017] dwc_otg: NAK holdoff enabled
[    1.482018] dwc_otg: FIQ split-transaction FSM enabled
[    1.482021] Module dwc_common_port init
[    1.482143] usbcore: registered new interface driver uas
[    1.487481] usbcore: registered new interface driver usb-storage
[    1.493600] mousedev: PS/2 mouse device common for all mice
[    1.507179] rpi-rtc soc:rpi_rtc: registered as rtc0
[    1.513580] rpi-rtc soc:rpi_rtc: setting system clock to 2024-03-31T10:37:24 UTC<PHONE_NUMBER>)
[    1.522465] bcm2835-wdt bcm2835-wdt: Poweroff handler already present!
[    1.529023] bcm2835-wdt bcm2835-wdt: Broadcom BCM2835 watchdog timer
[    1.537772] sdhci: Secure Digital Host Controller Interface driver
[    1.543982] sdhci: Copyright(c) Pierre Ossman
[    1.548392] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.554260] ledtrig-cpu: registered to indicate activity on CPUs
[    1.560326] SMCCC: SOC_ID: ARCH_SOC_ID not implemented, skipping ....
[    1.566803] hid: raw HID events driver (C) Jiri Kosina
[    1.571977] usbcore: registered new interface driver usbhid
[    1.577571] usbhid: USB HID core driver
[    1.581725] hw perfevents: enabled with armv8_cortex_a76 PMU driver, 7 counters available
[    1.590118] NET: Registered PF_PACKET protocol family
[    1.595214] Key type dns_resolver registered
[    1.604489] registered taskstats version 1
[    1.608669] Loading compiled-in X.509 certificates
[    1.615847] Key type .fscrypt registered
[    1.619863] Key type fscrypt-provisioning registered
[    1.625629] brcm-pcie<PHONE_NUMBER>.pcie: host bridge /axi/pcie@120000 ranges:
[    1.632636] brcm-pcie<PHONE_NUMBER>.pcie:   No bus range found for /axi/pcie@120000, using [bus 00-ff]
[    1.641735] brcm-pcie<PHONE_NUMBER>.pcie:      MEM 0x1f00000000..0x1ffffffffb -> 0x0000000000
[    1.650042] brcm-pcie<PHONE_NUMBER>.pcie:      MEM 0x1c00000000..0x1effffffff -> 0x0400000000
[    1.658348] brcm-pcie<PHONE_NUMBER>.pcie:   IB MEM 0x1f00000000..0x1f003fffff -> 0x0000000000
[    1.666652] brcm-pcie<PHONE_NUMBER>.pcie:   IB MEM 0x0000000000..0x0fffffffff -> 0x1000000000
[    1.676127] brcm-pcie<PHONE_NUMBER>.pcie: Forcing gen 2
[    1.681300] brcm-pcie<PHONE_NUMBER>.pcie: PCI host bridge to bus 0000:00
[    1.687769] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.693277] pci_bus 0000:00: root bus resource [mem 0x1f00000000-0x1ffffffffb] (bus address [0x00000000-0xfffffffb])
[    1.703848] pci_bus 0000:00: root bus resource [mem 0x1c00000000-0x1effffffff pref] (bus address [0x400000000-0x6ffffffff])
[    1.715040] pci 0000:00:00.0: [14e4:2712] type 01 class 0x060400
[    1.721096] pci 0000:00:00.0: PME# supported from D0 D3hot
[    1.727565] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.842148] brcm-pcie<PHONE_NUMBER>.pcie: link up, 5.0 GT/s PCIe x4 (!SSC)
[    1.848809] pci 0000:01:00.0: [1de4:0001] type 00 class 0x020000
[    1.854852] pci 0000:01:00.0: reg 0x10: [mem 0xffffc000-0xffffffff]
[    1.861150] pci 0000:01:00.0: reg 0x14: [mem 0xffc00000-0xffffffff]
[    1.867446] pci 0000:01:00.0: reg 0x18: [mem 0xffff0000-0xffffffff]
[    1.873806] pci 0000:01:00.0: supports D1
[    1.877829] pci 0000:01:00.0: PME# supported from D0 D1 D3hot D3cold
[    1.894151] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.900801] pci 0000:00:00.0: BAR 8: assigned [mem 0x1f00000000-0x1f005fffff]
[    1.907969] pci 0000:01:00.0: BAR 1: assigned [mem 0x1f00000000-0x1f003fffff]
[    1.915137] pci 0000:01:00.0: BAR 2: assigned [mem 0x1f00400000-0x1f0040ffff]
[    1.922304] pci 0000:01:00.0: BAR 0: assigned [mem 0x1f00410000-0x1f00413fff]
[    1.929472] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.934455] pci 0000:00:00.0:   bridge window [mem 0x1f00000000-0x1f005fffff]
[    1.941622] pci 0000:00:00.0: Max Payload Size set to  256/ 512 (was  128), Max Read Rq  512
[    1.950105] pci 0000:01:00.0: Max Payload Size set to  256/ 256 (was  128), Max Read Rq  512
[    1.958642] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
[    1.964795] pcieport 0000:00:00.0: PME: Signaling with IRQ 38
[    1.970619] pcieport 0000:00:00.0: AER: enabled with IRQ 38
[    1.976296] rp1 0000:01:00.0: bar0 len 0x4000, start 0x1f00410000, end 0x1f00413fff, flags, 0x40200
[    1.985386] rp1 0000:01:00.0: bar1 len 0x400000, start 0x1f00000000, end 0x1f003fffff, flags, 0x40200
[    1.994654] rp1 0000:01:00.0: enabling device (0000 -> 0002)
[    2.001491] rp1 0000:01:00.0: chip_id 0x20001927
[    2.028187] macb 1f00100000.ethernet eth0: Cadence GEM rev 0x00070109 at 0x1f00100000 irq 106 (d8:3a:dd:cb:12:e4)
[    2.038596] platform 1f00110000.csi: Fixed dependency cycle(s) with /axi/pcie@120000/rp1/i2c@88000/imx708@1a
[    2.049024] dw_axi_dmac_platform 1f00188000.dma: DesignWare AXI DMA Controller, 8 channels
[    2.057593] xhci-hcd xhci-hcd.0: xHCI Host Controller
[    2.062670] xhci-hcd xhci-hcd.0: new USB bus registered, assigned bus number 1
[    2.070376] xhci-hcd xhci-hcd.0: hcc params 0x0240fe6d hci version 0x110 quirks 0x0000008000000810
[    2.079384] xhci-hcd xhci-hcd.0: irq 131, io mem 0x1f00200000
[    2.085222] xhci-hcd xhci-hcd.0: xHCI Host Controller
[    2.090295] xhci-hcd xhci-hcd.0: new USB bus registered, assigned bus number 2
[    2.097548] xhci-hcd xhci-hcd.0: Host supports USB 3.0 SuperSpeed
[    2.103720] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.06
[    2.112024] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    2.119282] usb usb1: Product: xHCI Host Controller
[    2.124178] usb usb1: Manufacturer: Linux 6.6.22-v8-16k+ xhci-hcd
[    2.130295] usb usb1: SerialNumber: xhci-hcd.0
[    2.134874] hub 1-0:1.0: USB hub found
[    2.138650] hub 1-0:1.0: 2 ports detected
[    2.142817] usb usb2: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 6.06
[    2.151122] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    2.158377] usb usb2: Product: xHCI Host Controller
[    2.163289] usb usb2: Manufacturer: Linux 6.6.22-v8-16k+ xhci-hcd
[    2.169481] usb usb2: SerialNumber: xhci-hcd.0
[    2.174036] hub 2-0:1.0: USB hub found
[    2.177809] hub 2-0:1.0: 1 port detected
[    2.182054] xhci-hcd xhci-hcd.1: xHCI Host Controller
[    2.187250] xhci-hcd xhci-hcd.1: new USB bus registered, assigned bus number 3
[    2.194954] xhci-hcd xhci-hcd.1: hcc params 0x0240fe6d hci version 0x110 quirks 0x0000008000000810
[    2.204073] xhci-hcd xhci-hcd.1: irq 136, io mem 0x1f00300000
[    2.209907] xhci-hcd xhci-hcd.1: xHCI Host Controller
[    2.214979] xhci-hcd xhci-hcd.1: new USB bus registered, assigned bus number 4
[    2.222344] xhci-hcd xhci-hcd.1: Host supports USB 3.0 SuperSpeed
[    2.228501] usb usb3: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.06
[    2.236801] usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    2.244164] usb usb3: Product: xHCI Host Controller
[    2.249060] usb usb3: Manufacturer: Linux 6.6.22-v8-16k+ xhci-hcd
[    2.255176] usb usb3: SerialNumber: xhci-hcd.1
[    2.259837] hub 3-0:1.0: USB hub found
[    2.263613] hub 3-0:1.0: 2 ports detected
[    2.267769] usb usb4: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 6.06
[    2.276185] usb usb4: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    2.283467] usb usb4: Product: xHCI Host Controller
[    2.288363] usb usb4: Manufacturer: Linux 6.6.22-v8-16k+ xhci-hcd
[    2.294663] usb usb4: SerialNumber: xhci-hcd.1
[    2.299222] hub 4-0:1.0: USB hub found
[    2.302994] hub 4-0:1.0: 1 port detected
[    2.307657] bcm2712-iommu<PHONE_NUMBER>.iommu: bcm2712_iommu_init: DEBUG_INFO = 0x20804774
[    2.316218] platform<PHONE_NUMBER>.codec: bcm2712_iommu_probe_device: MMU<PHONE_NUMBER>.iommu
[    2.324261] platform<PHONE_NUMBER>.codec: bcm2712_iommu_device_group: MMU<PHONE_NUMBER>.iommu
[    2.332529] platform<PHONE_NUMBER>.codec: Adding to iommu group 0
[    2.338394] platform<PHONE_NUMBER>.pisp_be: bcm2712_iommu_probe_device: MMU<PHONE_NUMBER>.iommu
[    2.346818] platform<PHONE_NUMBER>.pisp_be: bcm2712_iommu_device_group: MMU<PHONE_NUMBER>.iommu
[    2.355040] platform<PHONE_NUMBER>.pisp_be: Adding to iommu group 0
[    2.361104] platform<PHONE_NUMBER>.codec: bcm2712_iommu_attach_dev: MMU<PHONE_NUMBER>.iommu
[    2.369171] platform<PHONE_NUMBER>.pisp_be: bcm2712_iommu_attach_dev: MMU<PHONE_NUMBER>.iommu
[    2.377238] bcm2712-iommu<PHONE_NUMBER>.iommu: bcm2712_iommu_probe: Success
[    2.384515] bcm2712-iommu<PHONE_NUMBER>.iommu: bcm2712_iommu_init: DEBUG_INFO = 0x20804774
[    2.392853] platform axi:gpu: bcm2712_iommu_probe_device: MMU<PHONE_NUMBER>.iommu
[    2.400319] platform axi:gpu: bcm2712_iommu_device_group: MMU<PHONE_NUMBER>.iommu
[    2.407575] platform axi:gpu: Adding to iommu group 1
[    2.412705] platform axi:gpu: bcm2712_iommu_attach_dev: MMU<PHONE_NUMBER>.iommu
[    2.420008] bcm2712-iommu<PHONE_NUMBER>.iommu: bcm2712_iommu_probe: Success
[    2.427059] bcm2712-iommu<PHONE_NUMBER>.iommu: bcm2712_iommu_init: DEBUG_INFO = 0x20804774
[    2.435606] platform 1f00110000.csi: bcm2712_iommu_probe_device: MMU<PHONE_NUMBER>.iommu
[    2.443474] platform 1f00110000.csi: bcm2712_iommu_device_group: MMU<PHONE_NUMBER>.iommu
[    2.451542] platform 1f00110000.csi: Adding to iommu group 2
[    2.457257] platform 1f00144000.vec: bcm2712_iommu_probe_device: MMU<PHONE_NUMBER>.iommu
[    2.465150] platform 1f00144000.vec: bcm2712_iommu_device_group: MMU<PHONE_NUMBER>.iommu
[    2.473226] platform 1f00144000.vec: Adding to iommu group 2
[    2.478921] platform 1f00110000.csi: bcm2712_iommu_attach_dev: MMU<PHONE_NUMBER>.iommu
[    2.486811] platform 1f00144000.vec: bcm2712_iommu_attach_dev: MMU<PHONE_NUMBER>.iommu
[    2.494502] bcm2712-iommu<PHONE_NUMBER>.iommu: bcm2712_iommu_probe: Success
[    2.501637] pl011-axi 1f0003c000.serial: cts_event_workaround enabled
[    2.508266] sdhci-brcmstb 1000fff000.mmc: Got CD GPIO
[    2.508573] mmc1: CQHCI version 5.10
[    2.513417] 1f0003c000.serial: ttyAMA3 at MMIO 0x1f0003c000 (irq = 144, base_baud = 0) is a PL011 AXI
[    2.526379] pl011-axi 1f00040000.serial: cts_event_workaround enabled
[    2.532907] 1f00040000.serial: ttyAMA4 at MMIO 0x1f00040000 (irq = 145, base_baud = 0) is a PL011 AXI
[    2.542948] of_cfs_init
[    2.545430] of_cfs_init: OK
[    2.548355] clk: Disabling unused clocks
[    2.549310] mmc0: SDHCI controller on 1000fff000.mmc [1000fff000.mmc] using ADMA 64-bit
[    2.562156] uart-pl011 107d001000.serial: no DMA platform data
[    2.663947] mmc0: new ultra high speed SDR104 SDHC card at address aaaa
[    2.670837] mmcblk0: mmc0:aaaa SP32G 29.7 GiB
[    2.678207]  mmcblk0: p1 p2
[    2.681101] mmcblk0: mmc0:aaaa SP32G 29.7 GiB (quirks 0x00004000)
[    2.704680] mmc1: SDHCI controller on<PHONE_NUMBER>.mmc [1001100000.mmc] using ADMA 64-bit
[    2.718923] EXT4-fs (mmcblk0p2): mounted filesystem 4aa56689-dcb4-4759-90e6-179beae559ac ro with ordered data mode. Quota mode: none.
[    2.731015] VFS: Mounted root (ext4 filesystem) readonly on device 179:2.
[    2.742292] devtmpfs: mounted
[    2.748508] Freeing unused kernel memory: 5120K
[    2.753108] Run /sbin/init as init process
[    2.754767] mmc1: new ultra high speed DDR50 SDIO card at address 0001
[    2.757217]   with arguments:
[    2.763773]     /sbin/init
[    2.763775]   with environment:
[    2.763776]     HOME=/
[    2.763778]     TERM=linux
[    3.019054] NET: Registered PF_INET6 protocol family
[    3.024420] Segment Routing with IPv6
[    3.028117] In-situ OAM (IOAM) with IPv6
[    3.061395] systemd[1]: systemd 252.19-1~deb12u1 running in system mode (+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified)
[    3.094248] systemd[1]: Detected architecture arm64.
[    3.121035] systemd[1]: Hostname set to <raspberrypi>.
[    3.398850] systemd[1]: Queued start job for default target multi-user.target.
[    3.426817] systemd[1]: Created slice system-getty.slice - Slice /system/getty.
[    3.450472] systemd[1]: Created slice system-modprobe.slice - Slice /system/modprobe.
[    3.474462] systemd[1]: Created slice system-serial\x2dgetty.slice - Slice /system/serial-getty.
[    3.498448] systemd[1]: Created slice system-systemd\x2dfsck.slice - Slice /system/systemd-fsck.
[    3.522317] systemd[1]: Created slice user.slice - User and Session Slice.
[    3.546253] systemd[1]: Started systemd-ask-password-wall.path - Forward Password Requests to Wall Directory Watch.
[    3.574358] systemd[1]: Set up automount proc-sys-fs-binfmt_misc.automount - Arbitrary Executable File Formats File System Automount Point.
[    3.602230] systemd[1]: Reached target integritysetup.target - Local Integrity Protected Volumes.
[    3.626205] systemd[1]: Reached target slices.target - Slice Units.
[    3.646177] systemd[1]: Reached target swap.target - Swaps.
[    3.666180] systemd[1]: Reached target veritysetup.target - Local Verity Protected Volumes.
[    3.690307] systemd[1]: Listening on systemd-fsckd.socket - fsck to fsckd communication Socket.
[    3.714223] systemd[1]: Listening on systemd-initctl.socket - initctl Compatibility Named Pipe.
[    3.738422] systemd[1]: Listening on systemd-journald-audit.socket - Journal Audit Socket.
[    3.762294] systemd[1]: Listening on systemd-journald-dev-log.socket - Journal Socket (/dev/log).
[    3.786295] systemd[1]: Listening on systemd-journald.socket - Journal Socket.
[    3.812386] systemd[1]: Listening on systemd-udevd-control.socket - udev Control Socket.
[    3.838257] systemd[1]: Listening on systemd-udevd-kernel.socket - udev Kernel Socket.
[    3.862312] systemd[1]: dev-hugepages.mount - Huge Pages File System was skipped because of an unmet condition check (ConditionPathExists=/sys/kernel/mm/hugepages).
[    3.902265] systemd[1]: Mounting dev-mqueue.mount - POSIX Message Queue File System...
[    3.927103] systemd[1]: Mounting sys-kernel-debug.mount - Kernel Debug File System...
[    3.951029] systemd[1]: Mounting sys-kernel-tracing.mount - Kernel Trace File System...
[    3.974250] systemd[1]: auth-rpcgss-module.service - Kernel Module supporting RPCSEC_GSS was skipped because of an unmet condition check (ConditionPathExists=/etc/krb5.keytab).
[    3.993436] systemd[1]: Starting fake-hwclock.service - Restore / save the current clock...
[    4.019427] systemd[1]: Starting keyboard-setup.service - Set the console keyboard layout...
[    4.043476] systemd[1]: Starting kmod-static-nodes.service - Create List of Static Device Nodes...
[    4.071335] systemd[1]: Starting<EMAIL_ADDRESS>- Load Kernel Module configfs...
[    4.095280] systemd[1]: Starting<EMAIL_ADDRESS>- Load Kernel Module dm_mod...
[    4.111800] device-mapper: ioctl: 4.48.0-ioctl (2023-03-01) initialised<EMAIL_ADDRESS>[    4.146339] systemd[1]: Starting<EMAIL_ADDRESS>- Load Kernel Module drm...
[    4.175553] systemd[1]: Starting<EMAIL_ADDRESS>- Load Kernel Module efi_pstore...
[    4.199472] systemd[1]: Starting<EMAIL_ADDRESS>- Load Kernel Module fuse...
[    4.213812] fuse: init (API version 7.39)
[    4.223403] systemd[1]: Starting<EMAIL_ADDRESS>- Load Kernel Module loop...
[    4.251385] systemd[1]: Starting systemd-fsck-root.service - File System Check on Root Device...
[    4.262362] systemd[1]: Starting systemd-journald.service - Journal Service...
[    4.277504] systemd[1]: Starting systemd-modules-load.service - Load Kernel Modules...
[    4.289049] systemd[1]: Starting systemd-udev-trigger.service - Coldplug All udev Devices...
[    4.300752] i2c_dev: i2c /dev entries driver
[    4.301506] systemd[1]: Mounted dev-mqueue.mount - POSIX Message Queue File System.
[    4.316936] systemd[1]: Mounted sys-kernel-debug.mount - Kernel Debug File System.
[    4.327344] systemd[1]: Mounted sys-kernel-tracing.mount - Kernel Trace File System.
[    4.338131] systemd[1]: Finished fake-hwclock.service - Restore / save the current clock.
[    4.349201] systemd[1]: Started systemd-journald.service - Journal Service.
[    4.780982] EXT4-fs (mmcblk0p2): re-mounted 4aa56689-dcb4-4759-90e6-179beae559ac r/w. Quota mode: none.
[    4.844536] systemd-journald[145]: Received client request to flush runtime journal.
[    5.479052] rpi-gpiomem 107d508500.gpiomem: window base 0x107d508500 size 0x00000040
[    5.479157] rpi-gpiomem 107d508500.gpiomem: initialised 1 regions as /dev/gpiomem1
[    5.479205] rpi-gpiomem 107d517c00.gpiomem: window base 0x107d517c00 size 0x00000040
[    5.479247] rpi-gpiomem 107d517c00.gpiomem: initialised 1 regions as /dev/gpiomem2
[    5.479274] rpi-gpiomem 107d504100.gpiomem: window base 0x107d504100 size 0x00000020
[    5.479307] rpi-gpiomem 107d504100.gpiomem: initialised 1 regions as /dev/gpiomem3
[    5.479334] rpi-gpiomem 107d510700.gpiomem: window base 0x107d510700 size 0x00000020
[    5.479368] rpi-gpiomem 107d510700.gpiomem: initialised 1 regions as /dev/gpiomem4
[    5.479492] rpi-gpiomem 1f000d0000.gpiomem: window base 0x1f000d0000 size 0x00030000
[    5.479534] rpi-gpiomem 1f000d0000.gpiomem: initialised 1 regions as /dev/gpiomem0
[    5.517878] input: pwr_button as /devices/platform/pwr_button/input/input0
[    5.520227] drm-rp1-vec 1f00144000.vec: bcm2712_iommu_of_xlate: MMU<PHONE_NUMBER>.iommu
[    5.520656] mc: Linux media interface: v0.10
[    5.521110] drm-rp1-vec 1f00144000.vec: rp1vec_platform_probe
[    5.522309] [drm] forcing Composite-1 connector on
[    5.559495] [drm] Initialized v3d 1.0.0 20180419 for<PHONE_NUMBER>.v3d on minor 1
[    5.566310] [drm] Initialized drm-rp1-vec 1.0.0 0 for 1f00144000.vec on minor 0
[    5.566432] drm-rp1-vec 1f00144000.vec: [drm] User-defined mode not supported: "1280x720": 60 74440 1280 1336 1472 1664 720 721 724 746 0x20 0x6
[    5.606056] drm-rp1-vec 1f00144000.vec: rp1vec_pipe_enable
[    5.606064] drm-rp1-vec 1f00144000.vec: rp1vec_hw_setup: in_fmt='XR24' mode=704x432i [011] tvstd=0
[    5.606328] Console: switching to colour frame buffer device 88x27
[    5.629912] videodev: Linux video capture interface: v2.00
[    5.639505] drm-rp1-vec 1f00144000.vec: [drm] fb0: drm-rp1-vecdrmf frame buffer device
[    5.650962] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[    5.662406] Loaded X.509 cert<EMAIL_ADDRESS>577e021cb980e0e820821ba7b54b4961b8b4fadf'
[    5.662751] Loaded X.509 cert<EMAIL_ADDRESS>3abbc6ec146e09d1b6016ab9d6cf71dd233f0328'
[    5.664096] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[    5.666380] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[    5.692932] rp1-cfe 1f00110000.csi: bcm2712_iommu_of_xlate: MMU<PHONE_NUMBER>.iommu
[    5.693311] rp1-cfe 1f00110000.csi: DW dphy Host HW v1.20
[    5.693325] rp1-cfe 1f00110000.csi: PiSP FE HW v0.1
[    5.696376] pispbe<PHONE_NUMBER>.pisp_be: bcm2712_iommu_of_xlate: MMU<PHONE_NUMBER>.iommu
[    5.696492] pispbe<PHONE_NUMBER>.pisp_be: pispbe_probe: HW version:  0x02252700
[    5.696496] pispbe<PHONE_NUMBER>.pisp_be: pispbe_probe: BatchStatus: 0x00000000
[    5.696499] pispbe<PHONE_NUMBER>.pisp_be: pispbe_probe: Status:      0x00000000
[    5.696501] pispbe<PHONE_NUMBER>.pisp_be: Register nodes for group 0
[    5.696567] rp1-cfe 1f00110000.csi: found subdevice /axi/pcie@120000/rp1/i2c@88000/imx708@1a
[    5.696652] pispbe<PHONE_NUMBER>.pisp_be: input device node registered as /dev/video20
[    5.704049] rpivid_hevc: module is from the staging directory, the quality is unknown, you have been warned.
[    5.734650] brcmfmac: F1 signature read @0x18000000=0x15264345
[    5.735109] rpivid<PHONE_NUMBER>.codec: bcm2712_iommu_of_xlate: MMU<PHONE_NUMBER>.iommu
[    5.738005] pispbe<PHONE_NUMBER>.pisp_be: tdn_input device node registered as /dev/video21
[    5.738482] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip BCM4345/6
[    5.742210] rpivid<PHONE_NUMBER>.codec: Device registered as /dev/video19
[    5.743925] pispbe<PHONE_NUMBER>.pisp_be: stitch_input device node registered as /dev/video22
[    5.744395] usbcore: registered new interface driver brcmfmac
[    5.748260] pispbe<PHONE_NUMBER>.pisp_be: hog_output device node registered as /dev/video23
[    5.748402] pispbe<PHONE_NUMBER>.pisp_be: output0 device node registered as /dev/video24
[    5.748508] pispbe<PHONE_NUMBER>.pisp_be: output1 device node registered as /dev/video25
[    5.748601] pispbe<PHONE_NUMBER>.pisp_be: tdn_output device node registered as /dev/video26
[    5.760730] pispbe<PHONE_NUMBER>.pisp_be: stitch_output device node registered as /dev/video27
[    5.794450] pispbe<PHONE_NUMBER>.pisp_be: config device node registered as /dev/video28
[    5.811667] pispbe<PHONE_NUMBER>.pisp_be: Register nodes for group 1
[    5.826540] pispbe<PHONE_NUMBER>.pisp_be: input device node registered as /dev/video29
[    5.826621] pispbe<PHONE_NUMBER>.pisp_be: tdn_input device node registered as /dev/video30
[    5.885579] vc4-drm axi:gpu: bcm2712_iommu_of_xlate: MMU<PHONE_NUMBER>.iommu
[    5.903020] pispbe<PHONE_NUMBER>.pisp_be: stitch_input device node registered as /dev/video31
[    5.911970] pispbe<PHONE_NUMBER>.pisp_be: hog_output device node registered as /dev/video32
[    5.913507] vc4-drm axi:gpu: bound 107c580000.hvs (ops vc4_hvs_ops [vc4])
[    5.913642] vc4-drm axi:gpu: bound 107c500000.mop (ops vc4_txp_ops [vc4])
[    5.913717] brcmfmac_wcc: brcmf_wcc_attach: executing
[    5.913718] vc4-drm axi:gpu: bound 107c501000.moplet (ops vc4_txp_ops [vc4])
[    5.920547] brcmfmac: brcmf_c_process_txcap_blob: no txcap_blob available (err=-2)
[    5.920831] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Nov  1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60
[    5.930493] pispbe<PHONE_NUMBER>.pisp_be: output0 device node registered as /dev/video33
[    5.933537] ieee80211 phy0: brcmf_cfg80211_reg_notifier: Firmware rejected country setting
[    5.934029] pispbe<PHONE_NUMBER>.pisp_be: output1 device node registered as /dev/video34
[    5.934795] pispbe<PHONE_NUMBER>.pisp_be: tdn_output device node registered as /dev/video35
[    5.935008] [drm] Initialized vc4 0.0.0 20140616 for axi:gpu on minor 2
[    5.935024] vc4-drm axi:gpu: [drm] Cannot find any crtc or sizes
[    5.963677] pispbe<PHONE_NUMBER>.pisp_be: stitch_output device node registered as /dev/video36
[    5.979123] pispbe<PHONE_NUMBER>.pisp_be: config device node registered as /dev/video37
[    6.142471] imx708 6-001a: camera module ID 0x0302
[    6.145716] rp1-cfe 1f00110000.csi: Using sensor imx708_wide for capture
[    6.145838] rp1-cfe 1f00110000.csi: Registered [rp1-cfe-csi2_ch0] node id 0 successfully as /dev/video0
[    6.145881] rp1-cfe 1f00110000.csi: Registered [rp1-cfe-embedded] node id 1 successfully as /dev/video1
[    6.145922] rp1-cfe 1f00110000.csi: Registered [rp1-cfe-csi2_ch2] node id 2 successfully as /dev/video2
[    6.145954] rp1-cfe 1f00110000.csi: Registered [rp1-cfe-csi2_ch3] node id 3 successfully as /dev/video3
[    6.145987] rp1-cfe 1f00110000.csi: Registered [rp1-cfe-fe_image0] node id 4 successfully as /dev/video4
[    6.146023] rp1-cfe 1f00110000.csi: Registered [rp1-cfe-fe_image1] node id 5 successfully as /dev/video5
[    6.146057] rp1-cfe 1f00110000.csi: Registered [rp1-cfe-fe_stats] node id 6 successfully as /dev/video6
[    6.146107] rp1-cfe 1f00110000.csi: Registered [rp1-cfe-fe_config] node id 7 successfully as /dev/video7
[    6.497449] Adding 3146784k swap on /var/swap.  Priority:-2 extents:119 across:28003616k SS
[    7.076295] macb 1f00100000.ethernet eth0: PHY [1f00100000.ethernet-ffffffff:01] driver [Broadcom BCM54213PE] (irq=POLL)
[    7.076305] macb 1f00100000.ethernet eth0: configuring for phy/rgmii-id link mode
[    7.078967] pps pps0: new PPS source ptp0
[    7.079026] macb 1f00100000.ethernet: gem-ptp-timer ptp clock registered.
[    7.108911] brcmfmac: brcmf_cfg80211_set_power_mgmt: power save enabled
[   15.169963] systemd[852]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
[   19.557506] pl011-axi 1f0003c000.serial: no DMA platform data
[   19.557568] pl011-axi 1f00040000.serial: no DMA platform data
[   22.117364] drm-rp1-vec 1f00144000.vec: [drm] User-defined mode not supported: "1280x720": 60 74440 1280 1336 1472 1664 720 721 724 746 0x20 0x6
[   54.089289] drm-rp1-vec 1f00144000.vec: [drm] User-defined mode not supported: "1280x720": 60 74440 1280 1336 1472 1664 720 721 724 746 0x20 0x6
[   61.403661] drm-rp1-vec 1f00144000.vec: [drm] User-defined mode not supported: "1280x720": 60 74440 1280 1336 1472 1664 720 721 724 746 0x20 0x6
[   61.476027] source of link 'rp1-cfe-fe_config':0->'pisp-fe':1 is not a V4L2 sub-device, driver bug!
[   61.476051] rp1-cfe 1f00110000.csi: Using a link rate of 900 Mbps

Hi, thanks for the report. I don't have the right hardware to do any work on this, but am happy to do my best to help if we can establish what it is that needs fixing. Can I assume you have checked out the latest version of Picamera2, and have added your local version to your PYTHONPATH?
If you run the most basic example
from picamera2 import Picamera2
picam2 = Picamera2()
picam2.start(show_preview=True)

can you say exactly where it is going wrong, and what the immediate cause of the error is? Thanks!

Hello. thanks for the answer.
I use    picamera2 0.3.16
I tried the most basic example that you sent me and got this

It is important that this does not work only if you combine the output.
For example, if I take an HDMI converter then RCA, then since Linux works with HDMI for DRM output, then there are no problems

Presumably your application is using one of the 32bpp "XRGB8888" type of output formats, which would translate into something like pykms.PixelFormat.XRGB8888, and this is being rejected. Do you know what kind of pixel format this display will accept, one of the 24bpp ones perhaps?

Also https://github.com/raspberrypi/rpicam-apps/blob/70894c0c46855955442284aba9dedb66d8d4bfbf/preview/drm_preview.cpp#L90 I also tried to run this code in C++ but I get “No suitable enabled connector found” due to the fact that count_connectors turns out to be empty

Presumably your application is using one of the 32bpp "XRGB8888" type of output formats, which would translate into something like pykms.PixelFormat.XRGB8888, and this is being rejected. Do you know what kind of pixel format this display will accept, one of the 24bpp ones perhaps?

Well, this display works with what the analog output gives it. in this case pal.

OK, this is totally beyond my understanding (I know basically nothing about DRM or KMS). @6by9 Does any of this mean anything to you?

We previously talked about this and this is what he wrote to me.
https://github.com/raspberrypi/linux/issues/5948#issuecomment-1942096270

I tried changing the format in drm_preview.py from AB24 to XR24, but still failed

OK, this is totally beyond my understanding (I know basically nothing about DRM or KMS). @6by9 Does any of this mean anything to you?

As discussed previously, Picamera2 (and rpicam-apps) are assuming they're running against vc4 as the DRM renderer, and hence have a wide choice of formats, scaling, and planes.
RP1 for DSI, DPI, and VEC (and also most SPI displays) only have a single primary plane, and only support XRGB8888, XBGR8888, RGB888, BGR888, and RGB565 formats. Asking for any other format or requiring an overlay plane will fail.
Picamera2 and rpicam-apps need to fall back to using the primary plane in the absence of a suitable overlay plane, and ensure that their pixel format choice is supported by the DRM device.

drm_preview.zip
Ok, if I understood you correctly, I tried to make the changes you say. I attached the file in a zip archive. now that line has passed, but it breaks below

Hmm, so it seems to be failing to create a pykms.DmabufFramebuffer. I assume you've tried a different format or two. Perhaps this kind of display doesn't support dmabufs? It would be nice if there was a way to know that. Maybe we need to allocate a pykms.DumbFramebuffer instead and copy the image into that (though it will involve lots of pixel copying...)?
@6by9 Does the above sound plausible, do you think?

OK, that's interesting. I don't have any means of reproducing this behaviour, unfortunately. @ArtemKorr Can you check your image dimensions match the display exactly?

OK. When I set the photo size to be the same as my display (704*432) I don’t get any errors.. But I don’t see the image on the screen either

I guess you're sure that the image actually does contain something? (Perhaps you are able to save it as a JPEG and view it somewhere else?)

This is a live stream from a camera... but the camera is working. shoots, so the images must contain something exactly

Ok I found a bug in myself. I decided to remove the frame size by default. Now everything works

Great glad it's working! I'd like to get these changes packaged into a PR that can be merged into our code base, so that in future this will "just work" for everyone, and you won't need special code edits of your own.
Would you be able to commit your changes and post your tree to a Github fork of Picamera2? Then I can tidy them up a bit and make sure I haven't broken anything else. Then I'll create a PR which can be merged. I'd be extremely grateful if you'd have a moment to test that PR before I finally merge it. Would that be OK? Thanks very much for your help with this issue.

Well, I'll make up a PR in the next day or so, and maybe you could give it a try just to check that I've fixed your issue correctly. That would be great!

FKMS is deprecated.
vc4-kms-v3d when rendering through vc4 (the composition hardware for HDMI, DSI, DPI, and VEC on Pi0-4, and for HDMI on Pi5) allows lots of options that currently picamera2 assumes are present.
With the RP1 outputs, or with other random DRM drivers (eg SPI displays, DisplayLink USB devices, etc), those features aren't available. Picamera2 needs to handle these situations properly.
It also really wants a mechanism for passing in dev_path when creating the card, so you can choose which display device to render to (https://github.com/tomba/pykms/blob/master/kms/card.py#L24)
Largely the PR is to make sure that nothing gets missed out from what works for you. I'm trying to get it working on an SPI display at present, but with limited success.


More sentences crash processors

This seems to have problems unrelated to the other ones:
<img data-cke-saved-src=”https://ichef-1.bbci.co.uk/news/624/cpsprodpb/A28E/production/_96741614_f2f1e164-0deb-4b81-a586-66ac3804fe66.jpg” src=”https://ichef-1.bbci.co.uk/news/624/cpsprodpb/A28E/production/_96741614_f2f1e164-0deb-4b81-a586-66ac3804fe66.jpg” datasrc=”https://ichef-1.bbci.co.uk/news/320/cpsprodpb/A28E/production/_96741614_f2f1e164-0deb-4b81-a586-66ac3804fe66.jpg” class=”responsive-image__img js-image-replace” alt=”MSNBC Public Relations tweets: ” it’s=”” a=”” sad=”” day=”” for=”” america=”” when=”” the=”” president=”” spends=”” his=”” time=”” bullying,=”” lying=”” and=”” spewing=”” petty=”” personal=”” attacks=”” instead=”” of=”” doing=”” job.

False alarm.  It was failing the numbers check and was thrown out.

However, it crashes the present webapp, so there must be something more that is problematic about it.

The problem is that it fails in HexaDecoder.decode(...).  For each loop it throws the exception that is ignored (https://github.com/clulab/processors/blob/2c3b3f75992bc95cfe3d5640cb0bc1c5174bffcd/library/src/main/scala/org/clulab/processors/hexatagging/HexaDecoder.scala#L59) and so the dependencies don't get filled in.  The webapp and other applications should be prepared for this, but perhaps it also shouldn't be happening.


try out table-driven Visitor::element and Visitor::attribute to reduce code size

Try out the approach to reduce the per-type overhead of these methods described in the README:
Currently static-xml-derive writes explicit generated code.
E.g., with this type:
#[derive(Deserialize, Serialize)]
struct Foo {
    known_field: String,
    #[static_xml(flatten)]
    unknown_fields: xmltree::Element,
}

The Deserialize macro produces code roughly as follows:
const ELEMENTS: &[ExpandedNameRef; 1] = &[
    ExpandedNameRef { local_name: "known_field", namespace: "" },
];

impl Deserialize for Foo {
    fn deserialize(element: ElementReader<'_>) -> Result<Self, VisitorError> {
        let mut builder = FooVisitor {
            known_field: <String as DeserializeField>::init(),
            unknown_fields: <XmlTree as DeserializeField>::init(),
        };
        element.read_to(&mut builder)?;
        Self {
            known_field: <String as DeserializeField>::finalize(builder.known_field)?,
            unknown_fields: <XmlTree as DeserializeField>::finalize(builder.unknown_fields)?,
        }
    }
}

pub struct FooVisitor {
    known_field: <String as DeserializeField>::Builder,
    unknown_fields: <xmltree::Element as DeserializeFlatten>::Builder,
}

impl ElementVisitor for FooVisitor {
    fn element<'a>(
        &mut self,
        child: ElementReader<'a>
    ) -> Result<Option<ElementReader<'a>>, VisitorError> {
        match find(&child.expanded_name(), ELEMENTS) {
            Some(0usize) => {
                ::static_xml::de::DeserializeFieldBuilder::element(&mut self.known_field, child)?;
                return Ok(None);
            }
            _ => delegate_element(&mut [&mut self.unknown_fields], child),
        }
    }
}

I believe this is close to the minimal size with this approach. Next I'd like to experiment with a different approach in which the Visitor impl is replaced with a table that holds the offset within FooVisitor of each field, and a pointer to an element function. The generated code would use unsafe, but soundness only has to be proved once in the generator, and this seems worthwhile if it can achieve significant code size reduction.

I just realized that on stable Rust, it's currently impossible to calculate offsets within structures from a const context => no compiled-in struct (de)serialization tables. That's disappointing. Plan:

I'm going to try using nightly with memoffset's unstable_const feature as a proof-of-concept and see what sizes are possible.
If that goes well, I'll also try generating them at runtime with once_cell and see how much bloat this adds back. I suppose I could even decide between compile-time or runtime with a feature flag or something.

It looks like folks are working on stabilizing this stuff; I hope that trade-off doesn't last long.

There's another problem I didn't anticipate: some schemas have cycles. Here's a trivial one (a type that refers directly back to itself):
#[derive(PartialEq, Debug, Serialize, Deserialize)]
#[static_xml(prefix = "tt", namespace = "tt: http://www.onvif.org/ver10/schema")]
pub struct Transport {
    // Defines the network protocol for streaming, either UDP=RTP/UDP,
    // RTSP=RTP/RTSP/TCP or HTTP=RTP/RTSP/HTTP/TCP
    #[static_xml(prefix = "tt", rename = "Protocol")]
    pub protocol: TransportProtocol,

    // Optional element to describe further tunnel options. This element is
    // normally not needed
    #[static_xml(prefix = "tt", rename = "Tunnel")]
    pub tunnel: Vec<Transport>,
}

The type vtable for transport (which should know how to deserialize it) needs to refer to the struct table for transport (with per-field information), which needs to refer back to the type vtable to know how to deserialize the tunnel field.
Rust understandably doesn't let me generate consts which have Rust references in a cycle. E.g., the following won't compile.
struct Foo(&'static Foo);

const A: Foo = Foo(&B);
const B: Foo = Foo(&A);

Similarly, producing the vtable from a once_cell::sync::Lazy and evaluating fields' lazy cells recursively can't possibly work, and the docs say this:

It is an error to reentrantly initialize the cell from f. The exact outcome is unspecified. Current implementation deadlocks, but this may be changed to a panic in the future.

I guess I can build these in a lazy cell, have them to reference the lazy cell itself (not using its Deref), and then dereference when actually accessing the field.
Or something like building a (mutex-guarded) hash map keyed by std::any::TypeId but that's probably not any better and raises the question of what fills it.

I think this might be a dead end. :-( The problem is that I don't see a way to generate the vtables at compile-time (for the reasons described above), and the code to generate them more than cancels out the gains of the table-driven approach.
[slamb@slamb-workstation ~/git/crates/onvif-rs]$ cargo bloat --release --example camera --filter schema
   Compiling static-xml v0.1.0 (/home/slamb/git/static-xml/static-xml)
   Compiling xsd-types v0.1.0 (/home/slamb/git/crates/xsd-parser-rs/xsd-types)
   Compiling static-xml-derive v0.1.0 (/home/slamb/git/static-xml/static-xml-derive)
   Compiling schema v0.1.0 (/home/slamb/git/crates/onvif-rs/schema)
   Compiling onvif v0.1.0 (/home/slamb/git/crates/onvif-rs/onvif)
    Finished release [optimized] target(s) in 36.51s
    Analyzing target/release/examples/camera

File .text     Size  Crate Name
0.0%  0.0%   1.7KiB schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
0.0%  0.0%   1.2KiB schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
0.0%  0.0%   1.2KiB schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
0.0%  0.0%   1.2KiB schema schema::soap_envelope::Fault::is_unauthorized
0.0%  0.0%   1.1KiB schema schema::onvif::_::<impl static_xml::ser::Serialize for schema::onvif::StreamSetup>::write_children
0.0%  0.0%   1.1KiB schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
0.0%  0.0%     894B schema <schema::onvif::Ptzconfiguration as core::fmt::Debug>::fmt
0.0%  0.0%     885B schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
0.0%  0.0%     851B schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
0.0%  0.0%     849B schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
0.0%  0.0%     814B schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
0.0%  0.0%     802B schema schema::onvif::_::<impl static_xml::ser::Serialize for schema::onvif::Ipaddress>::write_children
0.0%  0.0%     764B schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
0.0%  0.0%     751B schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
0.0%  0.0%     734B schema schema::onvif::_::<impl static_xml::ser::Serialize for schema::onvif::MetadataConfiguration>::write_children
0.0%  0.0%     710B schema <T as static_xml::ser::SerializeField>::write
0.0%  0.0%     710B schema <T as static_xml::ser::SerializeField>::write
0.0%  0.0%     706B schema <T as static_xml::ser::SerializeField>::write
0.0%  0.0%     681B schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
0.0%  0.0%     681B schema once_cell::imp::OnceCell<T>::initialize::{{closure}}
1.0%  3.6% 132.3KiB        And 998 smaller methods. Use -n N to show more.
1.1%  4.1% 150.3KiB        filtered data size, the file size is 13.2MiB

I can improve this a little bit by using the struct for serialization as well as deserialization, but when it gets down to it, those initialize closures are just huge.

Immediately after that I realized that I can actually generate the vtable at construction time; I just need to basically launder the constant through a function. (It made sense to me at first that Rust couldn't have cycles in constant references. But then I realized functions allow this in basically every language. So now I'm wondering if the limitation is actually necessary, but I have a workaround anyway.) 520af8a implements this approach, and now total file size is ticking downward:
 File  .text     Size Crate
 5.2%  18.0% 649.3KiB std
 4.4%  15.2% 549.3KiB reqwest
 2.3%   8.0% 288.5KiB clap
 1.8%   6.0% 218.2KiB h2
 1.7%   5.7% 207.3KiB regex
 1.5%   5.3% 191.1KiB regex_syntax
 1.1%   3.8% 137.5KiB tokio
 1.0%   3.4% 124.2KiB hyper
 1.0%   3.4% 121.6KiB tracing_subscriber
 0.8%   2.9% 103.4KiB onvif
 0.7%   2.5%  88.8KiB schema
 0.7%   2.3%  84.6KiB regex_automata
 0.7%   2.3%  83.4KiB static_xml
 0.6%   2.1%  74.3KiB aho_corasick
 0.5%   1.7%  62.7KiB xml
 0.4%   1.4%  51.4KiB http
 0.4%   1.3%  46.1KiB url
 0.4%   1.2%  44.5KiB num_bigint
 0.3%   1.0%  36.8KiB idna
 0.3%   1.0%  36.3KiB chrono
 2.5%   8.8% 316.2KiB And 63 more crates. Use -n N to show more.
29.0% 100.0%   3.5MiB .text section size, the file size is 12.1MiB

so basically this is smaller on nightly; and I can use a feature flag to make it work on stable at the cost of bloat. This is sounding promising.
Major caveat: this code doesn't actually work yet. I'm going to address that next...but I don't expect it's broken in a way that totally invalidates the numbers above. And those numbers can be improved; I can shrink the tables themselves, and I can use the tables to eliminate the serialization bloat also.

Grr. I'm having a tough time with this. Making it (mostly) work did increase binary size; there were some missing bits that apparently cause significant bloat. What's more is that I'm having a tough time understanding what the bloat is. It's not in the .text segment, so cargo bloat doesn't really help. My current table-driven code has shrunk code size by 100 KiB but file size by only 30 KiB. It doesn't seem worth the unsafe and complexity of the approach so far.
[slamb@slamb-workstation ~/git/crates/onvif-rs]$ bloaty camera-debloat-0c65eb4 -- camera-main-ca51ec1
    FILE SIZE        VM SIZE
 --------------  --------------
  +6.6% +31.2Ki  +6.7% +31.2Ki    .data.rel.ro
  +3.5% +26.5Ki  [ = ]       0    .symtab
  +3.6% +23.5Ki  +3.6% +23.5Ki    .rela.dyn
  +0.9% +7.55Ki  +0.9% +7.55Ki    .rodata
  +1.5% +1.54Ki  +1.5% +1.54Ki    .eh_frame_hdr
   +11%    +768  [ = ]       0    [Unmapped]
  -0.1%    -536  -0.1%    -536    .eh_frame
  -6.5% -1.08Ki  -6.5% -1.08Ki    .got
  -0.4% -9.12Ki  [ = ]       0    .strtab
  -6.1% -9.81Ki  -6.1% -9.81Ki    .gcc_except_table
  -2.6%  -101Ki  -2.6%  -101Ki    .text
  -0.2% -30.6Ki  -0.7% -48.8Ki    TOTAL

The obvious question is: are the tables taking up a lot of space? It's a little awkward to measure how big they are, so the easiest thing I can do is make them even bigger and measure how much the file grows. Here I've added 256 bytes to the vtable for each type and 32 bytes to the vtable for each field:
[slamb@slamb-workstation ~/git/crates/onvif-rs]$ bloaty camera-debloat-0c65eb4-vtable-ballast-256-field-ballast-32 -- camera-debloat-0c65eb4
    FILE SIZE        VM SIZE
 --------------  --------------
   +11% +55.0Ki   +11% +55.0Ki    .data.rel.ro
  +0.1% +2.92Ki  [ = ]       0    .strtab
  +0.0% +1.11Ki  +0.0% +1.11Ki    .text
  +0.0%    +184  +0.0%    +184    .eh_frame
  +0.0%    +144  [ = ]       0    .symtab
  +0.0%    +120  +0.0%    +120    .rela.dyn
  +0.0%     +32  +0.0%     +32    .eh_frame_hdr
  +0.1%     +16  +0.1%     +16    .got
  +0.0%     +16  +0.0%     +16    .rodata
  -0.7%      -3  [ = ]       0    .shstrtab
  -6.3%    -480  [ = ]       0    [Unmapped]
  +0.5% +59.1Ki  +0.9% +56.5Ki    TOTAL

so the tables basically are all in .data.rel.ro (which makes sense) and are less than half of the problem. I have ideas to shrink them but it doesn't seem like that should be my priority.
I think it's more about total numbers of symbols increasing size of the .strtab and .rela.dyn. (Possibly also the .rodata and .eh_frame_hdr but those are less significant.)
[slamb@slamb-workstation ~/git/crates/onvif-rs]$ nm camera-main-ca51ec1 | wc -l
31160
[slamb@slamb-workstation ~/git/crates/onvif-rs]$ nm camera-debloat-0c65eb4 | wc -l
32286
[slamb@slamb-workstation ~/git/crates/onvif-rs]$ nm camera-main-ca51ec1 | fgrep schema | wc -l
3397
[slamb@slamb-workstation ~/git/crates/onvif-rs]$ nm camera-debloat-0c65eb4 | fgrep schema | wc -l
2219

I wish Rust had associated statics; then I wouldn't need all the vtable shims added as described in the previous comments. I could also generate one big typeid->type vtable lookup at compile time for all the known types in in a code generator that sees the whole schema at once, but not in a proc macro.
I also wish I could get rid of all these push_value and finalize_field methods, but due to Rust's clever layout of Option, I'm having trouble coming up with an alternative. Maybe I can restructure things so that the Option methods are broken out and get dropped as unused if they're not actually referenced. That'd help a lot for some schemas and maybe even make things worse for others.
Maybe it's worth combining push_value and finalize_field into one method that receives a command to execute by an enum parameter, although that's super ugly.
I suppose I could drop those symbols entirely if I didn't support std::option::Option fields but instead my own:
#[repr(C)]
enum MyOption<T> {
    None = 0,
    Some(T) = 1,
}

but I'd like to make these types feel normal.
There's also some bloat with alloc::raw_vec::RawVec<T,A>::reserve_for_push. I'm surprised they're not getting inlined into push_value and get monomorphized rather than taking the Layout as a parameter. I think I can eliminate these with some very ugly unsafe code, although I still need a per-type wrapper due to the the docs saying "The order of [Vec\'s] fields is completely unspecified", unless I assume that Vec<T> and Vec<Y> have the same layout for any T and Y. Basically I need to call into_raw_parts, do the reallocation myself with the std::alloc API, then call from_raw_parts to convert it back to a Vec.
I'm tempted to actually try changing the std library's RawVec to take the Layout as a parameter and see what it does to Rust code size and speed in general (not just for my crate).

I'm tempted to actually try changing the std library's RawVec to take the Layout as a parameter and see what it does to Rust code size and speed in general (not just for my crate).

I played with this a bit, and it's probably a dead end. RawVec::reserve_for_push calls RawVec::grow_amortized which calls set_ptr at the end. set_ptr divides the allocated length by the size of T at the end. It looks like allocators return the actual allocated size, which may be larger than the requested size, and this allows the Vec to take advantage of the excess. Anyway, division is slow, but division by a constant like 8 can be fast, so the monomorphization is accomplishing something. I tried inlining the division into the caller but the results didn't look good. I could try removing this optimization (using only the requested portion) but that probably wouldn't be great either. It seems possible to only depend on the size, not the full type, but I'm not sure how many of these types are actually the same size anyway.


Too many carousel items

Describe the bug
I have 34 Carousel Items were there should only be 5 visible
To Reproduce
Create a basic carousel (with say 5 children), then enabled infinite
This can also be seen by going to the docs and removing infinite from the JSX, the children count shrink down to just 3 instead of the many there were.
Expected behaviour
5 children that it rotates between
Screenshots

Environment
System:
OS: Windows 10 10.0.20279
CPU: (12) x64 AMD Ryzen 5 1600 Six-Core Processor
Memory: 12.31 GB / 31.95 GB
Binaries:
Node: 12.14.1 - E:\Program Files\nodejs\node.EXE
npm: 6.14.10 - E:\OneDrive\GitHub\talespire\site\node_modules.bin\npm.CMD
Browsers:
Chrome: 87.0.4280.88
Edge: Spartan (44.20279.1.0)
Internet Explorer: 11.0.20279.1
npmPackages:
@brainhubeu/react-carousel: ^1.19.26 => 1.19.26

desktop
Chrome

Same issue here :/

Same issue (-_-)

Same problem, it just keeps adding more and more items as it scrolls.


window.$nuxt

Hack is possible in console.
You can access env, $store from $nuxt.context to modify the content.

This applies to all front-end frameworks, no matter if you use pure Vue, react or whatever.


Generating configurations

Generating configurations in symbol-bootstrap and for compiling from source are different now.
Question: Will it be the same in release?

Hi @Vladimir7280 , thank you for your question.
Atm, bootstrap doesn't compile the server but you can use it to configure. You can compile server like you do regularly and use the config command from bootstrap to create the properties and keys. Then use the compiled binaries to run it.
You may need to tune the paths (like catapultAppFolder) a little bit with a custom preset but it should be fine. It will depends on where do you want to copy your server libs and binaries.
What do you mean by different configurations?

Hi @fboucquez.
Thank you for your attention.
Yes, I compiled and successfully launched the catapult server from the source codes (I did this on both x86_64 and ARM8 (Raspberry Pi 4 (4GB)).
I created configurations and everything works.
BUT, I also tested symbol-bootstrap. In various configurations.
I noticed the following differences:
the compiled server requires in the file config-node.properties :
............
maxCacheDatabaseWriteBatchSize = 5MB
maxTrackedNodes = 5'000

minPartnerNodeVersion =
maxPartnerNodeVersion =

#all hosts are trusted when list is empty
trustedHosts =
localNetworks = <IP_ADDRESS>
listenInterface = <IP_ADDRESS>

[localnode]

..........

But, the symbol-bootstrap creates a configuration config-node.properties
........
maxCacheDatabaseWriteBatchSize = 5MB
maxTrackedNodes = 5'000

# all hosts are trusted when list is empty
trustedHosts = <IP_ADDRESS>, <IP_ADDRESS>
localNetworks = <IP_ADDRESS>, <IP_ADDRESS>

[localnode]
......

without parameter
minPartnerNodeVersion =
maxPartnerNodeVersion =
trustedHosts =
without these parameters, catapult.server will not start. He demands them.

It seems you have a version mismatch between bootstrap and server. What's your bootstrap version? Are you compiling the server from main or from a tag?
Bootstrap 0.2.x should be compatible with the following server tag:
https://github.com/nemtech/catapult-server/tree/v<IP_ADDRESS>
Bootstrap 0.3.x (in dev) will be compatible with v<IP_ADDRESS> currently in development

YES!
Copyright (c) Jaguar0625, gimre, BloodyRookie, Tech Bureau, Corp.
catapult version: <IP_ADDRESS> 5c52fbaf [main]

&
symbol-bootstrap/0.2.1 linux-x64 node-v12.20.0

But I was compiling from main.  Strange
!!!Thank you very much for your answer!!!
(I'm still waiting for a new version of SDK, the current one does not support the network type 128 (private test))

Cool, let us know how PI is going. Keen to add support eventually.
New networks types are in alpha/dev ready to be released once we finish 10.0.4 support and the feature we want to implement


include self-signed root CA in chain

Signed-off-by: Aron Parsons<EMAIL_ADDRESS>What this PR does / why we need it:
Currently, cert-manager explicitly excludes self-signed CA certificates from the secrets it generates, even when the operator opts to include their self-signed CA certificate in the issuer secret.  It is critical to include the full CA chain so that mutual TLS authentication and verifying the whole chain work with the in-cluster secrets, versus having to include the root CA in every pod that needs it (which differs per container image and is a huge PITA to maintain).
The choice to exclude these certificates was made as part of https://github.com/jetstack/cert-manager/pull/1077.
All the details below, including current behavior and the behavior when this PR is applied.  Hopefully not too much detail, and I have commentary in between the command output to create the full story.
ClusterIssuer:
$ k -n certs describe clusterissuer
Name:         ca-issuer
Namespace:
Labels:       app=certs
              chart=certs-2019.0.6
              heritage=Tiller
              release=certs
Annotations:  flux.weave.works/antecedent: certs:helmrelease/certs
API Version:  certmanager.k8s.io/v1alpha1
Kind:         ClusterIssuer
Metadata:
  Creation Timestamp:  2019-08-02T03:49:04Z
  Generation:          2
  Resource Version:    56512
  Self Link:           /apis/certmanager.k8s.io/v1alpha1/clusterissuers/ca-issuer
  UID:                 78e42b26-b4d8-11e9-b8f0-566fac170003
Spec:
  Ca:
    Secret Name:  ca-key-pair
Status:
  Conditions:
    Last Transition Time:  2019-08-02T03:49:06Z
    Message:               Signing CA verified
    Reason:                KeyPairVerified
    Status:                True
    Type:                  Ready
Events:
  Type    Reason           Age                From          Message
  ----    ------           ----               ----          -------
  Normal  KeyPairVerified  65s (x3 over 70s)  cert-manager  Signing CA verified

Root Certificate:
$ k -n certs get secret ca-keyca\.crt}' | base64 -dta.t
-----BEGIN CERTIFICATE-----
MIIFWDCCA0CgAwIBAgIUOIcIPkkuCKUN/vgeQadDicdQI98wDQYJKoZIhvcNAQEN
BQAwRDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJhcDEbMBkG
A1UEAxMSc3RhY2stYm9vdHN0cmFwIENBMB4XDTE5MDczMDE2NDUwMFoXDTI5MDcy
NzE2NDUwMFowRDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJh
cDEbMBkGA1UEAxMSc3RhY2stYm9vdHN0cmFwIENBMIICIjANBgkqhkiG9w0BAQEF
AAOCAg8AMIICCgKCAgEAzSNyYrMCb5r5RYsomUE5ylqHZpD8edLFwMMqMHCg9OEv
S0Qs3zvIuI1BcAIS4X29ZWR/yXnrlf0yLzRrOos7xSk+DuQLGBvOWkPb8Vtm54qi
NWxSxDBhE7MRkwbxz6SZMTC2uGHg2qhijHONsFxoOun2m0dAbM/TV4OXlrn+/ME/
U5VkN4bWpMMO+Gt9wqZ8DKfJlmMDgk4tJPP20Q8VhdIC5cNDOL6tg4s5yr1N31Gr
OJvX5Wm7zSi27BALaeeT4XIo7DiNLn68y23Gz8Z7FZyUtCfB04tGH5L3B+2eGhi+
fHmSFyzdWvykn3iHZPmUIqnj2TaTG5u/audhWpniKNmGWKUodaSPrv4h9+ziSvDe
b/m89FRALFICouiDWr8FwsYx8++ph43tGlU8YcLk2UphGizjG7n1L8D8P8eu939N
Hmwl1AUOhzjZzwz/p7jg0PlM3bcUrVtRNcKbih0PxX+AzuKNrJn3NuJK8IaFHFA2
lcEu+f6Al/Urb5RQEngTJTdm35XXJwyoPzP9Zd5tKm+znIKbZCIB8u3Mg5xGcDOj
GJq4E3OCKJgTkFzgDJT4mr0ynHJdYkN4q0VOYl5MTKmEil0VS6e25yMW5iuMI9DZ
uBxgYymI3rC4Di9i9yPty5TWMJ3airtDx9HA4ZPKC4wwVzbgRKbp9of6sLXu358C
AwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
BBYEFGOVswbzmN5tT8HkQp/Ba38BrIqPMA0GCSqGSIb3DQEBDQUAA4ICAQBLaY80
Zmmd0cfP1Fw/IDkRTh/2hl7KA3AWw7EeKa+cynI/mXOQsjmWODhUFacj9yTLimC0
mt4afCwhSvI6LqeR94LAAvGB1o8pvkZYvMt4MZdLhPW2TCBAuvcnr08JDznNBkp3
JAXvQc0CVzKvQuCmOjibuhxiVhjywXtv0SRY4sUo+6jU7rtbFxeCeGVVZkwTGQlh
j//sA6gTT7qO4uMRUnAjqDeKlyAQN8408PVIdfYUni78ApHNhiIYElKX9fw3F8Ok
VSD4QARmxd1lIMf91CTCCxdqYx63NrBvuHH3WFnKdoGinl5VwAS4NWCx0ikyNaEU
c1lQFAGf+AJFu7WPUqQdAa4SyplKmZfn6dF/qymbPX7H/C9hY7vnwGM30mkHe5rp
JJNUFwLOV5oH+K2rg4V5WZBiYfiW3ILXA678hFGbfO/4n//c+20ssg4SD8MjZSMI
GRqBrlmTUrtAng+cK7TARTO+bWa/IcQg4LXRnDK7S0N8poE2MxBWvaGboleM7eDW
TuOENhK0Ri0/ngphOs/cNEsCiARhtW6ImJa5Un9Aq7uiusel6B1+8lPxTl9+BFqz
R7Aw680c2FgPiTJVTikTvqk8XEsSPFIi/B2uHXprb1y975MBfYp9HVC7h8IaaN3x
F5YWgysI6xZWCS9JfVwqqZ6U+ATvoBchJ0F+NA==
-----END CERTIFICATE-----

$ k -n certs get secret ca-key-pair -ojsonpath='{.data.ca\.crt}' | base64 -d | openssl x509 -text | grep -e Issuer: -e Subject: -e CA:TRUE
        Issuer: C=US, O=stack-bootstrap, CN=stack-bootstrap CA
        Subject: C=US, O=stack-bootstrap, CN=stack-bootstrap CA
                CA:TRUE

Intermediate Certificate:
$ k -n certs get secret ca-keytls\.crt}' | base64 -data.c
-----BEGIN CERTIFICATE-----
MIIFxjCCA66gAwIBAgIULooy6Qv0Gb5z9s+oO/nd1X+KRTgwDQYJKoZIhvcNAQEN
BQAwRDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJhcDEbMBkG
A1UEAxMSc3RhY2stYm9vdHN0cmFwIENBMB4XDTE5MDczMDE2NDUwMFoXDTI0MDcy
ODE2NDUwMFowUTELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJh
cDEoMCYGA1UEAxMfc3RhY2stYm9vdHN0cmFwIEludGVybWVkaWF0ZSBDQTCCAiIw
DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANg3y0DNuK/l1nAxg0bZs36oFf7k
UoePwAupqy6tpYFy6qJvaJrZZv6FKJweFWIjhdabIxbIoadYYo12yExtywOJzXx+
Nr6zEAI9pqKtO+s1XbnTeM1h6A9uL7KSquHS48v5cKVR0JYtkSJ/NXGlW1f5n/Ew
T1xU4BDPBtdxKd2ZG8gsqPKKQ6LDWhJkhKchfcz+Hs0K117lO4NnZzsrUOlJyTBS
Izp61SfjMsdiQjkEqBUIJ9M2XcS/FXS/T8Eue5D8NKG7CyNCAvF+te+rOjYglfyQ
lmKePoLmWGZNjJfmy6UgPn/0+XsnN06+TbSTwAEAyXXOg9OaDThDSPWt27MBq+fT
KvPh00BEIOWjsbFSTNfwdmCJ9Qm6j4CBn+ODQi7S89cSQwJltMQk5IcmedLmjUjf
YF5FMupN9h6RAo3pkFczgaFDqdVKnr9h0ffG5fNvuoVN8KKOWqSxalvsS6UKDqoI
Uzx/AI8uRHTCQAT+tw9KvSTU+xYFzfMEsbxX7xclk6UArGjDLdzzFPcQMu1jZmND
ei+JXUCqXaU+sraVC5SPUDSg9xbYqF7blnjXt7wwcd6/hp6QoKoOfi7ThLrZsbYq
qnUkzdNYmfx9e4fXNTwO+HwdZbRwDlzStK1Wd0+UI2366xf4nSJzd+uwgJtAaB0O
Do5rkaugJNAViEu7AgMBAAGjgaIwgZ8wDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB
/wQIMAYBAf8CAQAwHQYDVR0OBBYEFM+c5ZTruGloPirCpqKTNOQDf21NMB8GA1Ud
IwQYMBaAFGOVswbzmN5tT8HkQp/Ba38BrIqPMDkGA1UdHwQyMDAwLqAsoCqGKGh0
dHBzOi8vc3RhY2stYm9vdHN0cmFwL2FwaS92MS9jZnNzbC9jcmwwDQYJKoZIhvcN
AQENBQADggIBALl2UYfbC5cCsgTOOHa9+ZZ9TrjKc3dEIW1dRrj2L5aE/g3OXNe+
8037C2Gcfg5FCxzEr+KpwMgixxD4+XIdKYEuDkSaVGfBr2DIBnKADic/+4CqQGgP
nYwIAjGcz2QeZQvbeX77W+pZDMGb4SBzwc+Ji+kICfRPjlHEHDS8iP5TBnr/uQe/
S1/DQvQdmS9w8j7v0XJA7kH7ROCI9RANLtf7/mi7g4tThyELdYMjzsiGUjInA1Uv
ykTCuAxRHUqtXDe3v8O03n1hzAEcQms7LxtJCiKtzPLjppdWfvIwxDj1wtf8AOzB
lhM3YYJE1Ms5cMnQAvvI0OYvAiNoHi3qU8r9fsXyLmr4PVVvAfUIaC0L02PRoCFX
fjzcAAO/JPk+kBoQRL1ZaCgfmyLU+3QafEjgHLgvE9PLO9jKLMJGH8MxlKoEZhmg
PPx5JR2gUFDUrDJU058kEYurOzBzfw83HpiGyrStR/hCJCr8eBz/E/v43pIbzWp1
QkfZK3UCiLk8Q7D3Uw45N4t0NcJvl8zUH+5Q4vBgsdJFvqc0H+bXnmrsHmc9lW0z
LftUwk4S5A+LP2u97UP0crqiNQKiFRoOSz4tFEEb4CI7tnmgtss4w1Y7Lfhu7RxR
X+kUW/zT3ctX67FZ+3cdoGK/rWgbdhJTsjPCkGYWge/K1BjWnWP4W9L7
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFWDCCA0CgAwIBAgIUOIcIPkkuCKUN/vgeQadDicdQI98wDQYJKoZIhvcNAQEN
BQAwRDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJhcDEbMBkG
A1UEAxMSc3RhY2stYm9vdHN0cmFwIENBMB4XDTE5MDczMDE2NDUwMFoXDTI5MDcy
NzE2NDUwMFowRDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJh
cDEbMBkGA1UEAxMSc3RhY2stYm9vdHN0cmFwIENBMIICIjANBgkqhkiG9w0BAQEF
AAOCAg8AMIICCgKCAgEAzSNyYrMCb5r5RYsomUE5ylqHZpD8edLFwMMqMHCg9OEv
S0Qs3zvIuI1BcAIS4X29ZWR/yXnrlf0yLzRrOos7xSk+DuQLGBvOWkPb8Vtm54qi
NWxSxDBhE7MRkwbxz6SZMTC2uGHg2qhijHONsFxoOun2m0dAbM/TV4OXlrn+/ME/
U5VkN4bWpMMO+Gt9wqZ8DKfJlmMDgk4tJPP20Q8VhdIC5cNDOL6tg4s5yr1N31Gr
OJvX5Wm7zSi27BALaeeT4XIo7DiNLn68y23Gz8Z7FZyUtCfB04tGH5L3B+2eGhi+
fHmSFyzdWvykn3iHZPmUIqnj2TaTG5u/audhWpniKNmGWKUodaSPrv4h9+ziSvDe
b/m89FRALFICouiDWr8FwsYx8++ph43tGlU8YcLk2UphGizjG7n1L8D8P8eu939N
Hmwl1AUOhzjZzwz/p7jg0PlM3bcUrVtRNcKbih0PxX+AzuKNrJn3NuJK8IaFHFA2
lcEu+f6Al/Urb5RQEngTJTdm35XXJwyoPzP9Zd5tKm+znIKbZCIB8u3Mg5xGcDOj
GJq4E3OCKJgTkFzgDJT4mr0ynHJdYkN4q0VOYl5MTKmEil0VS6e25yMW5iuMI9DZ
uBxgYymI3rC4Di9i9yPty5TWMJ3airtDx9HA4ZPKC4wwVzbgRKbp9of6sLXu358C
AwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
BBYEFGOVswbzmN5tT8HkQp/Ba38BrIqPMA0GCSqGSIb3DQEBDQUAA4ICAQBLaY80
Zmmd0cfP1Fw/IDkRTh/2hl7KA3AWw7EeKa+cynI/mXOQsjmWODhUFacj9yTLimC0
mt4afCwhSvI6LqeR94LAAvGB1o8pvkZYvMt4MZdLhPW2TCBAuvcnr08JDznNBkp3
JAXvQc0CVzKvQuCmOjibuhxiVhjywXtv0SRY4sUo+6jU7rtbFxeCeGVVZkwTGQlh
j//sA6gTT7qO4uMRUnAjqDeKlyAQN8408PVIdfYUni78ApHNhiIYElKX9fw3F8Ok
VSD4QARmxd1lIMf91CTCCxdqYx63NrBvuHH3WFnKdoGinl5VwAS4NWCx0ikyNaEU
c1lQFAGf+AJFu7WPUqQdAa4SyplKmZfn6dF/qymbPX7H/C9hY7vnwGM30mkHe5rp
JJNUFwLOV5oH+K2rg4V5WZBiYfiW3ILXA678hFGbfO/4n//c+20ssg4SD8MjZSMI
GRqBrlmTUrtAng+cK7TARTO+bWa/IcQg4LXRnDK7S0N8poE2MxBWvaGboleM7eDW
TuOENhK0Ri0/ngphOs/cNEsCiARhtW6ImJa5Un9Aq7uiusel6B1+8lPxTl9+BFqz
R7Aw680c2FgPiTJVTikTvqk8XEsSPFIi/B2uHXprb1y975MBfYp9HVC7h8IaaN3x
F5YWgysI6xZWCS9JfVwqqZ6U+ATvoBchJ0F+NA==
-----END CERTIFICATE-----

$ k -n certs get secret ca-key-pair -ojsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -text | grep -e Issuer: -e Subject: -e CA:TRUE
        Issuer: C=US, O=stack-bootstrap, CN=stack-bootstrap CA
        Subject: C=US, O=stack-bootstrap, CN=stack-bootstrap Intermediate CA
                CA:TRUE, pathlen:0

I have the root CA appended to tls.crt as per https://github.com/jetstack/cert-manager/issues/1067 indicates that it should be included in the secrets created by the issuer.
Requesting a certificate issues it, but the full chain is not included in tls.crt, just the intermediate CA.  This prevents verifying the full chain by only referencing the secret values.
Certificate Request:
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: ztest
spec:
  secretName: ztest
  duration: 24h
  renewBefore: 12h
  dnsNames:
  - foo.example.com
  issuerRef:
    name: ca-issuer
    kind: ClusterIssuer

Details of ca.crt in the created secret:
$ k -n certs get secret ztest -ojsonpath='{.data.ca\.crt}' | base64 -d
-----BEGIN CERTIFICATE-----
MIIFxjCCA66gAwIBAgIULooy6Qv0Gb5z9s+oO/nd1X+KRTgwDQYJKoZIhvcNAQEN
BQAwRDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJhcDEbMBkG
A1UEAxMSc3RhY2stYm9vdHN0cmFwIENBMB4XDTE5MDczMDE2NDUwMFoXDTI0MDcy
ODE2NDUwMFowUTELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJh
cDEoMCYGA1UEAxMfc3RhY2stYm9vdHN0cmFwIEludGVybWVkaWF0ZSBDQTCCAiIw
DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANg3y0DNuK/l1nAxg0bZs36oFf7k
UoePwAupqy6tpYFy6qJvaJrZZv6FKJweFWIjhdabIxbIoadYYo12yExtywOJzXx+
Nr6zEAI9pqKtO+s1XbnTeM1h6A9uL7KSquHS48v5cKVR0JYtkSJ/NXGlW1f5n/Ew
T1xU4BDPBtdxKd2ZG8gsqPKKQ6LDWhJkhKchfcz+Hs0K117lO4NnZzsrUOlJyTBS
Izp61SfjMsdiQjkEqBUIJ9M2XcS/FXS/T8Eue5D8NKG7CyNCAvF+te+rOjYglfyQ
lmKePoLmWGZNjJfmy6UgPn/0+XsnN06+TbSTwAEAyXXOg9OaDThDSPWt27MBq+fT
KvPh00BEIOWjsbFSTNfwdmCJ9Qm6j4CBn+ODQi7S89cSQwJltMQk5IcmedLmjUjf
YF5FMupN9h6RAo3pkFczgaFDqdVKnr9h0ffG5fNvuoVN8KKOWqSxalvsS6UKDqoI
Uzx/AI8uRHTCQAT+tw9KvSTU+xYFzfMEsbxX7xclk6UArGjDLdzzFPcQMu1jZmND
ei+JXUCqXaU+sraVC5SPUDSg9xbYqF7blnjXt7wwcd6/hp6QoKoOfi7ThLrZsbYq
qnUkzdNYmfx9e4fXNTwO+HwdZbRwDlzStK1Wd0+UI2366xf4nSJzd+uwgJtAaB0O
Do5rkaugJNAViEu7AgMBAAGjgaIwgZ8wDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB
/wQIMAYBAf8CAQAwHQYDVR0OBBYEFM+c5ZTruGloPirCpqKTNOQDf21NMB8GA1Ud
IwQYMBaAFGOVswbzmN5tT8HkQp/Ba38BrIqPMDkGA1UdHwQyMDAwLqAsoCqGKGh0
dHBzOi8vc3RhY2stYm9vdHN0cmFwL2FwaS92MS9jZnNzbC9jcmwwDQYJKoZIhvcN
AQENBQADggIBALl2UYfbC5cCsgTOOHa9+ZZ9TrjKc3dEIW1dRrj2L5aE/g3OXNe+
8037C2Gcfg5FCxzEr+KpwMgixxD4+XIdKYEuDkSaVGfBr2DIBnKADic/+4CqQGgP
nYwIAjGcz2QeZQvbeX77W+pZDMGb4SBzwc+Ji+kICfRPjlHEHDS8iP5TBnr/uQe/
S1/DQvQdmS9w8j7v0XJA7kH7ROCI9RANLtf7/mi7g4tThyELdYMjzsiGUjInA1Uv
ykTCuAxRHUqtXDe3v8O03n1hzAEcQms7LxtJCiKtzPLjppdWfvIwxDj1wtf8AOzB
lhM3YYJE1Ms5cMnQAvvI0OYvAiNoHi3qU8r9fsXyLmr4PVVvAfUIaC0L02PRoCFX
fjzcAAO/JPk+kBoQRL1ZaCgfmyLU+3QafEjgHLgvE9PLO9jKLMJGH8MxlKoEZhmg
PPx5JR2gUFDUrDJU058kEYurOzBzfw83HpiGyrStR/hCJCr8eBz/E/v43pIbzWp1
QkfZK3UCiLk8Q7D3Uw45N4t0NcJvl8zUH+5Q4vBgsdJFvqc0H+bXnmrsHmc9lW0z
LftUwk4S5A+LP2u97UP0crqiNQKiFRoOSz4tFEEb4CI7tnmgtss4w1Y7Lfhu7RxR
X+kUW/zT3ctX67FZ+3cdoGK/rWgbdhJTsjPCkGYWge/K1BjWnWP4W9L7
-----END CERTIFICATE-----

k -n certs get secret ztest -ojsonpath='{.data.ca\.crt}' | base64 -d | openssl x509 -text | grep -e Issuer: -e Subject: -e CA:TRUE
        Issuer: C=US, O=stack-bootstrap, CN=stack-bootstrap CA
        Subject: C=US, O=stack-bootstrap, CN=stack-bootstrap Intermediate CA
                CA:TRUE, pathlen:0

Details of tls.crt in the created secret:
$ k -n certs get secret ztest -ojsonpath='{.data.tls\.crt}' | base64 -d
-----BEGIN CERTIFICATE-----
MIIEaTCCAlGgAwIBAgIQFh0ah86olry9hjS7wLLXjzANBgkqhkiG9w0BAQsFADBR
MQswCQYDVQQGEwJVUzEYMBYGA1UEChMPc3RhY2stYm9vdHN0cmFwMSgwJgYDVQQD
Ex9zdGFjay1ib290c3RyYXAgSW50ZXJtZWRpYXRlIENBMB4XDTE5MDgwMjAzNTM0
M1oXDTE5MDgwMzAzNTM0M1owMTEVMBMGA1UEChMMY2VydC1tYW5hZ2VyMRgwFgYD
VQQDEw9mb28uZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDgc+MPvTtKt1yMgqXge7o7XnuL5g85sPcC1jhCI3JfpttDyiFnoi4/ci5Z
sZtexm+0DE0JZqAlxFP7BRQdDJVfciz/o0vZhkZ+p6RqtSzVQMyhFjUWZet5mM4i
kQvFf+Gx1bU6hyrfV6RP3BLA962Q3iw5ytUSSAa6c3gGc/IpW/Ic2BRWm1Tc9CtF
SHXBfMdjh0UNmRudNRAg+GRv6zPmTkbH51z1ujqMeUAGAUO9qvx+dDEUjhLZW43g
6NVZTjkZkvT49EHXp6G2FHRYXj4qJmYSxyagso4AcS/UA+0iJbu+qxS2nnZl39h8
vRtBNg6Kiq8/d+vzVOAeSu91goENAgMBAAGjXTBbMA4GA1UdDwEB/wQEAwIFoDAM
BgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFM+c5ZTruGloPirCpqKTNOQDf21NMBoG
A1UdEQQTMBGCD2Zvby5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAgEAClPX
k+EzcN+70YsH2ZgNd0dpk4QfidsnBwoPh16V0EjCPtwKvd9kr46UpCIJWNCxrCyP
5CJlSvbRmIED/N0ZPf5+sE9+lOY8xn2EneYXGWbpa3eFflJL9y9q8plLeL68o3i7
k2svRvTuPPWcM3hzzl0QMrgH2svzT76p4UHICZFFPy0Rn+Rpy7b+0TMacoaqrLYx
jFr7c5x/x5DgLcUOXxK4cE/i58iEiR4E7rq9DZvfoyJ4VhGDnPaI51Ov1kALAKgn
igx/wY4uA73/Whl/DI4IazPHyZ2GBM/66G4V59i1O+/+Wc3H5dIoMrQHRJzqxa5F
tRzyilGDX82C5O0FTVspsHyPB5nfJpOu+QBZWPOcG3AcCcZ/dxU+c3RXmSFgLNwI
Xvbdutljmh0s1VJyCE3jBXBxTuAGKlyZWQN9JHJL1x0mDhpW+YIBiUFlDeEHN37/
EUyhb8qKmgjsnMzRe/Mlj8UbRr68deVyeM6H+YGtp6bWr3meUnv5MWOABkwMlvYQ
d8rc1lKElKkPVbqxMQ7G6e3dmmSTTWiKAFawDOzhEgA1Se8GgZHbmj7vnd0e8kIt
QP3bNO9Kjpysqn6z4ke+A+3rpkMdWAxp28Tx7NNGAcdGmhXXat8VbIsieUW6gb5T
8hcmk2q7oZCsdniVsaF5CSqemkk/nGPqf/VYM84=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFxjCCA66gAwIBAgIULooy6Qv0Gb5z9s+oO/nd1X+KRTgwDQYJKoZIhvcNAQEN
BQAwRDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJhcDEbMBkG
A1UEAxMSc3RhY2stYm9vdHN0cmFwIENBMB4XDTE5MDczMDE2NDUwMFoXDTI0MDcy
ODE2NDUwMFowUTELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJh
cDEoMCYGA1UEAxMfc3RhY2stYm9vdHN0cmFwIEludGVybWVkaWF0ZSBDQTCCAiIw
DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANg3y0DNuK/l1nAxg0bZs36oFf7k
UoePwAupqy6tpYFy6qJvaJrZZv6FKJweFWIjhdabIxbIoadYYo12yExtywOJzXx+
Nr6zEAI9pqKtO+s1XbnTeM1h6A9uL7KSquHS48v5cKVR0JYtkSJ/NXGlW1f5n/Ew
T1xU4BDPBtdxKd2ZG8gsqPKKQ6LDWhJkhKchfcz+Hs0K117lO4NnZzsrUOlJyTBS
Izp61SfjMsdiQjkEqBUIJ9M2XcS/FXS/T8Eue5D8NKG7CyNCAvF+te+rOjYglfyQ
lmKePoLmWGZNjJfmy6UgPn/0+XsnN06+TbSTwAEAyXXOg9OaDThDSPWt27MBq+fT
KvPh00BEIOWjsbFSTNfwdmCJ9Qm6j4CBn+ODQi7S89cSQwJltMQk5IcmedLmjUjf
YF5FMupN9h6RAo3pkFczgaFDqdVKnr9h0ffG5fNvuoVN8KKOWqSxalvsS6UKDqoI
Uzx/AI8uRHTCQAT+tw9KvSTU+xYFzfMEsbxX7xclk6UArGjDLdzzFPcQMu1jZmND
ei+JXUCqXaU+sraVC5SPUDSg9xbYqF7blnjXt7wwcd6/hp6QoKoOfi7ThLrZsbYq
qnUkzdNYmfx9e4fXNTwO+HwdZbRwDlzStK1Wd0+UI2366xf4nSJzd+uwgJtAaB0O
Do5rkaugJNAViEu7AgMBAAGjgaIwgZ8wDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB
/wQIMAYBAf8CAQAwHQYDVR0OBBYEFM+c5ZTruGloPirCpqKTNOQDf21NMB8GA1Ud
IwQYMBaAFGOVswbzmN5tT8HkQp/Ba38BrIqPMDkGA1UdHwQyMDAwLqAsoCqGKGh0
dHBzOi8vc3RhY2stYm9vdHN0cmFwL2FwaS92MS9jZnNzbC9jcmwwDQYJKoZIhvcN
AQENBQADggIBALl2UYfbC5cCsgTOOHa9+ZZ9TrjKc3dEIW1dRrj2L5aE/g3OXNe+
8037C2Gcfg5FCxzEr+KpwMgixxD4+XIdKYEuDkSaVGfBr2DIBnKADic/+4CqQGgP
nYwIAjGcz2QeZQvbeX77W+pZDMGb4SBzwc+Ji+kICfRPjlHEHDS8iP5TBnr/uQe/
S1/DQvQdmS9w8j7v0XJA7kH7ROCI9RANLtf7/mi7g4tThyELdYMjzsiGUjInA1Uv
ykTCuAxRHUqtXDe3v8O03n1hzAEcQms7LxtJCiKtzPLjppdWfvIwxDj1wtf8AOzB
lhM3YYJE1Ms5cMnQAvvI0OYvAiNoHi3qU8r9fsXyLmr4PVVvAfUIaC0L02PRoCFX
fjzcAAO/JPk+kBoQRL1ZaCgfmyLU+3QafEjgHLgvE9PLO9jKLMJGH8MxlKoEZhmg
PPx5JR2gUFDUrDJU058kEYurOzBzfw83HpiGyrStR/hCJCr8eBz/E/v43pIbzWp1
QkfZK3UCiLk8Q7D3Uw45N4t0NcJvl8zUH+5Q4vBgsdJFvqc0H+bXnmrsHmc9lW0z
LftUwk4S5A+LP2u97UP0crqiNQKiFRoOSz4tFEEb4CI7tnmgtss4w1Y7Lfhu7RxR
X+kUW/zT3ctX67FZ+3cdoGK/rWgbdhJTsjPCkGYWge/K1BjWnWP4W9L7
-----END CERTIFICATE-----

You can see that the root CA is not included in the generated secret because of this conditional: https://github.com/jetstack/cert-manager/blob/master/pkg/util/pki/csr.go#L339
I do not believe that the choice to exclude the self-signed root certificate is valid.  In the case of a self-signed CA chain, not including the root CA makes including the intermediate pointless, as the whole chain can not be verified.
Below is the output of removing that check for self-signed CAs, and shows that the full chain is included in tls.crt, as desired.  I believe this is a safe change to make, because I have explicitly included my root CA in tls.crt of the issuer so that it does get included; if someone did not want that, they would opt not to put their full CA chain to the secret.
Patched version of cert-manager and full CA chain included, as desired:
$ k -n certs get secret ztest -ojsonpath='{.data.tls\.crt}' | base64 -d
-----BEGIN CERTIFICATE-----
MIIEajCCAlKgAwIBAgIRALmzxuAKbi4Lptgiy853j8AwDQYJKoZIhvcNAQELBQAw
UTELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJhcDEoMCYGA1UE
AxMfc3RhY2stYm9vdHN0cmFwIEludGVybWVkaWF0ZSBDQTAeFw0xOTA4MDIwNDA1
MTFaFw0xOTA4MDMwNDA1MTFaMDExFTATBgNVBAoTDGNlcnQtbWFuYWdlcjEYMBYG
A1UEAxMPZm9vLmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA2+03pYc70XJD/0vnEJQq4BEE6a38cNLL3SvdSsPMU+KW3vYzYvl4zS2Z
JRJ7Ar6YF17Tj4vzKeOCjEdLwdRsqsLoCumAXnce7uGLpKUvk43jd8qWNPdEEQ4W
jaXey6QLbRpCgyqFaQNg69YgoJHkaYdcpH+FKw08KIh71MtBPfJ6EyqHACiCkXb2
8SHpZG7XizyRKDfy95uKYBlVGV1QfW4eMMOZAyEn4xr0KVoA7QbWqzac/oTu/Ctz
Lv/WMWogR8FBpD6h2s9lqrDUGeFLwtfzFESrvHmn6HNvnUU90FlvZi2zu3TvLSDM
ge7tqfzupsOmRvIdEdHnN4g1PGsfSQIDAQABo10wWzAOBgNVHQ8BAf8EBAMCBaAw
DAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBTPnOWU67hpaD4qwqaikzTkA39tTTAa
BgNVHREEEzARgg9mb28uZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADggIBAFr3
7nPne6aN67i+Agn2RvTK18CG0QlGgfCabwmE0gU9RBi1KOP0Blzudj9FX9hWIf8m
j6++R3/aPz8uaGAgtslqlWGnH1uyzSSpAr/He+M2AS3fRXG7cBFBgXOTUqtgd2Me
ppcJ0lpEbCyV3WXqU0rXASHpat4D2944yDM7e94X9ikVuPodT5WvmkcLt3maYC9B
VkKlG6plzUzrYbTjePZMVYLh+o0hcyJG7mmdYhIJJ6zmReXAFnEf6Xnw/A1nOBFD
zhU61U+he9OI1YNsoR7ihZrN2Tay6nE7J3/JUGHYcx2w19aKE7XXo2Y5AewaEmIw
FUOR9bnss1TskRHi6YVPKNFWR2RUxQi/hRzTVw3QzFwSMFjvAQWo28sdp7VgygxA
kpN8WxZ9a0wJx/ACQXZiaR0rudUqY3V207H/Afsn1urzYHwAtYgtekKmBO9ak7+O
zwpivitDSZANscS4/VtE7nA9X78zSyUmvm5vV0hixEcO4NEkZezEJgdGeAyr+95P
YXNZkRZ9BaT6/ZnCLkX4EqJuuqVWEKJgcXQNXzr8+pzSWNL9P15QOlbeKv218Dhs
00jkObrpk5lTQvbL746AzgoXHiMl6Y7ot1Y5Em9jhOR4467MbzFSBuhJGAP8AcT3
yU3dxG8mwQrzd9MxhvtPMFDHxIfL2duMJvva16yO
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFxjCCA66gAwIBAgIULooy6Qv0Gb5z9s+oO/nd1X+KRTgwDQYJKoZIhvcNAQEN
BQAwRDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJhcDEbMBkG
A1UEAxMSc3RhY2stYm9vdHN0cmFwIENBMB4XDTE5MDczMDE2NDUwMFoXDTI0MDcy
ODE2NDUwMFowUTELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJh
cDEoMCYGA1UEAxMfc3RhY2stYm9vdHN0cmFwIEludGVybWVkaWF0ZSBDQTCCAiIw
DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANg3y0DNuK/l1nAxg0bZs36oFf7k
UoePwAupqy6tpYFy6qJvaJrZZv6FKJweFWIjhdabIxbIoadYYo12yExtywOJzXx+
Nr6zEAI9pqKtO+s1XbnTeM1h6A9uL7KSquHS48v5cKVR0JYtkSJ/NXGlW1f5n/Ew
T1xU4BDPBtdxKd2ZG8gsqPKKQ6LDWhJkhKchfcz+Hs0K117lO4NnZzsrUOlJyTBS
Izp61SfjMsdiQjkEqBUIJ9M2XcS/FXS/T8Eue5D8NKG7CyNCAvF+te+rOjYglfyQ
lmKePoLmWGZNjJfmy6UgPn/0+XsnN06+TbSTwAEAyXXOg9OaDThDSPWt27MBq+fT
KvPh00BEIOWjsbFSTNfwdmCJ9Qm6j4CBn+ODQi7S89cSQwJltMQk5IcmedLmjUjf
YF5FMupN9h6RAo3pkFczgaFDqdVKnr9h0ffG5fNvuoVN8KKOWqSxalvsS6UKDqoI
Uzx/AI8uRHTCQAT+tw9KvSTU+xYFzfMEsbxX7xclk6UArGjDLdzzFPcQMu1jZmND
ei+JXUCqXaU+sraVC5SPUDSg9xbYqF7blnjXt7wwcd6/hp6QoKoOfi7ThLrZsbYq
qnUkzdNYmfx9e4fXNTwO+HwdZbRwDlzStK1Wd0+UI2366xf4nSJzd+uwgJtAaB0O
Do5rkaugJNAViEu7AgMBAAGjgaIwgZ8wDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB
/wQIMAYBAf8CAQAwHQYDVR0OBBYEFM+c5ZTruGloPirCpqKTNOQDf21NMB8GA1Ud
IwQYMBaAFGOVswbzmN5tT8HkQp/Ba38BrIqPMDkGA1UdHwQyMDAwLqAsoCqGKGh0
dHBzOi8vc3RhY2stYm9vdHN0cmFwL2FwaS92MS9jZnNzbC9jcmwwDQYJKoZIhvcN
AQENBQADggIBALl2UYfbC5cCsgTOOHa9+ZZ9TrjKc3dEIW1dRrj2L5aE/g3OXNe+
8037C2Gcfg5FCxzEr+KpwMgixxD4+XIdKYEuDkSaVGfBr2DIBnKADic/+4CqQGgP
nYwIAjGcz2QeZQvbeX77W+pZDMGb4SBzwc+Ji+kICfRPjlHEHDS8iP5TBnr/uQe/
S1/DQvQdmS9w8j7v0XJA7kH7ROCI9RANLtf7/mi7g4tThyELdYMjzsiGUjInA1Uv
ykTCuAxRHUqtXDe3v8O03n1hzAEcQms7LxtJCiKtzPLjppdWfvIwxDj1wtf8AOzB
lhM3YYJE1Ms5cMnQAvvI0OYvAiNoHi3qU8r9fsXyLmr4PVVvAfUIaC0L02PRoCFX
fjzcAAO/JPk+kBoQRL1ZaCgfmyLU+3QafEjgHLgvE9PLO9jKLMJGH8MxlKoEZhmg
PPx5JR2gUFDUrDJU058kEYurOzBzfw83HpiGyrStR/hCJCr8eBz/E/v43pIbzWp1
QkfZK3UCiLk8Q7D3Uw45N4t0NcJvl8zUH+5Q4vBgsdJFvqc0H+bXnmrsHmc9lW0z
LftUwk4S5A+LP2u97UP0crqiNQKiFRoOSz4tFEEb4CI7tnmgtss4w1Y7Lfhu7RxR
X+kUW/zT3ctX67FZ+3cdoGK/rWgbdhJTsjPCkGYWge/K1BjWnWP4W9L7
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFWDCCA0CgAwIBAgIUOIcIPkkuCKUN/vgeQadDicdQI98wDQYJKoZIhvcNAQEN
BQAwRDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJhcDEbMBkG
A1UEAxMSc3RhY2stYm9vdHN0cmFwIENBMB4XDTE5MDczMDE2NDUwMFoXDTI5MDcy
NzE2NDUwMFowRDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD3N0YWNrLWJvb3RzdHJh
cDEbMBkGA1UEAxMSc3RhY2stYm9vdHN0cmFwIENBMIICIjANBgkqhkiG9w0BAQEF
AAOCAg8AMIICCgKCAgEAzSNyYrMCb5r5RYsomUE5ylqHZpD8edLFwMMqMHCg9OEv
S0Qs3zvIuI1BcAIS4X29ZWR/yXnrlf0yLzRrOos7xSk+DuQLGBvOWkPb8Vtm54qi
NWxSxDBhE7MRkwbxz6SZMTC2uGHg2qhijHONsFxoOun2m0dAbM/TV4OXlrn+/ME/
U5VkN4bWpMMO+Gt9wqZ8DKfJlmMDgk4tJPP20Q8VhdIC5cNDOL6tg4s5yr1N31Gr
OJvX5Wm7zSi27BALaeeT4XIo7DiNLn68y23Gz8Z7FZyUtCfB04tGH5L3B+2eGhi+
fHmSFyzdWvykn3iHZPmUIqnj2TaTG5u/audhWpniKNmGWKUodaSPrv4h9+ziSvDe
b/m89FRALFICouiDWr8FwsYx8++ph43tGlU8YcLk2UphGizjG7n1L8D8P8eu939N
Hmwl1AUOhzjZzwz/p7jg0PlM3bcUrVtRNcKbih0PxX+AzuKNrJn3NuJK8IaFHFA2
lcEu+f6Al/Urb5RQEngTJTdm35XXJwyoPzP9Zd5tKm+znIKbZCIB8u3Mg5xGcDOj
GJq4E3OCKJgTkFzgDJT4mr0ynHJdYkN4q0VOYl5MTKmEil0VS6e25yMW5iuMI9DZ
uBxgYymI3rC4Di9i9yPty5TWMJ3airtDx9HA4ZPKC4wwVzbgRKbp9of6sLXu358C
AwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
BBYEFGOVswbzmN5tT8HkQp/Ba38BrIqPMA0GCSqGSIb3DQEBDQUAA4ICAQBLaY80
Zmmd0cfP1Fw/IDkRTh/2hl7KA3AWw7EeKa+cynI/mXOQsjmWODhUFacj9yTLimC0
mt4afCwhSvI6LqeR94LAAvGB1o8pvkZYvMt4MZdLhPW2TCBAuvcnr08JDznNBkp3
JAXvQc0CVzKvQuCmOjibuhxiVhjywXtv0SRY4sUo+6jU7rtbFxeCeGVVZkwTGQlh
j//sA6gTT7qO4uMRUnAjqDeKlyAQN8408PVIdfYUni78ApHNhiIYElKX9fw3F8Ok
VSD4QARmxd1lIMf91CTCCxdqYx63NrBvuHH3WFnKdoGinl5VwAS4NWCx0ikyNaEU
c1lQFAGf+AJFu7WPUqQdAa4SyplKmZfn6dF/qymbPX7H/C9hY7vnwGM30mkHe5rp
JJNUFwLOV5oH+K2rg4V5WZBiYfiW3ILXA678hFGbfO/4n//c+20ssg4SD8MjZSMI
GRqBrlmTUrtAng+cK7TARTO+bWa/IcQg4LXRnDK7S0N8poE2MxBWvaGboleM7eDW
TuOENhK0Ri0/ngphOs/cNEsCiARhtW6ImJa5Un9Aq7uiusel6B1+8lPxTl9+BFqz
R7Aw680c2FgPiTJVTikTvqk8XEsSPFIi/B2uHXprb1y975MBfYp9HVC7h8IaaN3x
F5YWgysI6xZWCS9JfVwqqZ6U+ATvoBchJ0F+NA==
-----END CERTIFICATE-----

/assign @joshvanl

I do not believe that the choice to exclude the self-signed root certificate is valid. In the case of a self-signed CA chain, not including the root CA makes including the intermediate pointless, as the whole chain can not be verified.

I'm not sure I agree - if the full CA chain is included, and you implicitly trust this full chain, you aren't really verifying anything when you validate a certificate is valid.
On your local system, a set of self signed root CA certificates are embedded as part of your distribution (i.e. on various linux distros, the ca-certificates package). This means that the certificate's presented to you by webservers do not include the root CA, as it is 'trusted' on your machine.
Likewise, distributing the root of trust to the various 'nodes' in your cluster should be a separate concern.
For what its worth, we do make the CA used to sign a Certificate available in the Secret resource, under the ca.crt key. We just exclude that ca.crt data from the certificate chain, which as far as I understand/have seen/am aware is standard practice when handling certificates 😄

On your local system, a set of self signed root CA certificates are embedded as part of your distribution (i.e. on various linux distros, the ca-certificates package).

That is fine for public certificate authorities because most existing container images have those CAs baked in, but untrue for for corporate and isolated private networks where public certificate authorities are explicitly not trusted.  At the node level, the private CA chains are distributed via configuration management tools (e.g., Puppet, custom RPMs).  At the container level, those CAs are not baked in, as containers are portable between environments and networks (e.g., your prod containers don't trust any part of your dev CA chain, isolated network1 doesn't trust isolated network2).  We rely on cert-manager to generate the certificates for these containers and provide the CA chain in ca.crt.  In a scenario with just a root certificate, and not an intermediate in the chain (e.g., root -> server-cert), this works fine because the self-signed root certificate is included in ca.crt.  But when an intermediate certificate signs the server cert, we can't rely on this mechanism.

This means that the certificate's presented to you by webservers do not include the root CA, as it is 'trusted' on your machine.
I'm not sure I agree - if the full CA chain is included, and you implicitly trust this full chain, you aren't really verifying anything when you validate a certificate is valid.

For the application serving, yes, including the full chain in tls.crt isn't right because it would have clients implicitly trust the server, and we don't want that (which makes this PR behavior invalid).  I'm coming at it from the angle of containers using the the cert-manager-generated secret for both their client certificate and using ca.crt as a source for the full CA chain, which all services in the environment will be signed with.

Likewise, distributing the root of trust to the various 'nodes' in your cluster should be a separate concern.

It's not the nodes, but the containers where including additional CA certificates is typically not accounted for in the entrypoint.  cert-manager eases the pain by including the CA in the secret key ca.crt, wherein we then have in-band distribution of the CA.

For what its worth, we do make the CA used to sign a Certificate available in the Secret resource, under the ca.crt key.

So really, the root and intermediate should be included in ca.crt if an operator chooses to include it.  Which isn't what this PR achieves, it's using the mechanism to include the root CA, which is fine for client certs but bad for server certs.
Since the issuer secret already includes the root certificate in ca.crt, perhaps we could explore a way to include that in the ca.crt field for the secrets generated by cert-manager?

Solving this another way.

And how did you actually solve this ?

+1
@knackaron how did you solve this please ?

@knackaron how did you solve this please ?

The CAs are defined once for our operator that deploys charts via Helm, and all releases inherit those values.  We then use a subchart to provide a Secret that contains our CAs (replacing the mechanism we'd rely on cert-manager to provide), then mount that in where required, and use the best mechanism available to have the applications point at those (e.g., native support to use an alternate chain, SSL_CERT_FILE).  This has worked well for us to have a unified way to provide CA chains to applications without having to bake CAs into our container images (not portable) or modify third-party container images.