cipher failures in master 2019-08-03

With recent code from master branch PKIX-SSH rekey tes fail when is used aes{128|256}-gcm.
Last know good version is from 2019-07-13.
Issue is not investigated yet, i.e. dunno why OpenSSL code pass internal tests.

Possibly related to #9512?

mattcaswell wrote:

Possibly related to #9512?

Above issue is not related. Patch does not change anything.
Issue is still not investigated yet. In client failure logs is printed
'padding error: need 260 block 16 mod 4' ..
Roumen

Probably an edge case that is not tested.
Let me know if you have any more info.

Same situation as of today.
Simplified test case is just following command: ./ssh o<EMAIL_ADDRESS>...
Unfortunately build of pkix-ssh against master is partially blocked by #9522 .
Failed function call is this one https://gitlab.com/secsh/pkixssh/blob/master/cipher.c#L479 .
Now is easy to reconstruct sample:

get the sample code from https://github.com/openssl/openssl/blob/master/demos/evp/aesgcm.c
update some variables:
IV:

static const unsigned char gcm_iv[] = {
    0x99
};

In consequence ciphertext:
static const unsigned char gcm_ct[] = {
    0xf7, 0x26, 0x44, 0x13, 0xa8, 0x4c, 0x0e, 0x7c, 0xd5, 0x36, 0x86, 0x7e,
    0xb9, 0xf2, 0x17, 0x36
};

and tag:
static const unsigned char gcm_tag[] = {
    0x54, 0x90, 0x40, 0x72, 0x52, 0x4d, 0x01, 0x31, 0x31, 0x13, 0xe8, 0x63,
    0x47, 0x75, 0x41, 0xe3
};

Remark: values are from 1.1.1 (Stable).
Build and run against master ....

I tried putting this data into evpcipt.txt and it reports that the ivlen is bad (as it should).
That demo program is very dodgy and does no error checking. Debugging the demo code showed that it gets an error when setting a bad iv length.

Shane wrote:

I tried putting this data into evpcipt.txt and it reports that the ivlen is bad (as it should).
That demo program is very dodgy and does no error checking. Debugging the demo code showed that it gets an error when setting a bad iv length.

Sorry using demo code was not good idea - does not match real case.
Please Ignore it.
The line where code fail is correct. But writing test case is big challenge.
Please find attached "0003-INPROGRESS-use-ERR_raise.patch" that allows
pkix-ssh code to be build against master.
Regards,
Roumen Petrov

Download URL:
https://roumenpetrov.info/tests/0003-INPROGRESS-use-ERR_raise.patch as
github mail remove attached file.

Hmm, pkix-ssh builds fine against master unless if OpenSSL is build with --api=3.0.0.
Remark: OpenSSL  build with --api=3.0.0 and error management impact is subject of another issues for instance #9756. PKIX-SSH will be updated when is clarified new error functionality.
I try to extract OpenSSL errors after failed function call but errors list is empty!
No error management in providers!? :(

No error management in providers!? :(

Not entirely true. However, the providers currently rely entirely on error tables from the libcrypto code.
This will change

I am a bit tied up with other work at the moment, I will try this out later in the week.

what should my config look like?
./configure --with-ssl-dir=openssl_extern/openssl
I get..
checking OpenSSL header version... 3.0.0 (OpenSSL 3.0.0-dev xx XXX xxxx)
checking OpenSSL library version... not found
configure: error: OpenSSL library not found.

I guest that team members found what is missing with aes-gcm provider implementation.

I guest that team members found what is missing with aes-gcm provider implementation.

Does that mean this issue is fixed?

I got distracted by other things, so never got back to this one..
Only a few small changes have happened in gcm, so I dont know why it would be working now?
Is it working now?

It may have been fixed because #10106 is fixed...

Richard Levitte wrote:

It may have been fixed because #10106 is fixed...

No.Restoring ctrl() will shows more precise failure - provider lack some
GCM specific control commands.
I'm busy with other task ... I could provide later...
Roumen

Let review result of:
$ grep -r EVP_CTRL_GCM crypto/ providers/ include/
crypto/evp/evp_enc.c:    case EVP_CTRL_GCM_SET_IV_FIXED:
crypto/evp/e_aria.c:    case EVP_CTRL_GCM_SET_IV_FIXED:
crypto/evp/e_aria.c:    case EVP_CTRL_GCM_IV_GEN:
crypto/evp/e_aria.c:    case EVP_CTRL_GCM_SET_IV_INV:
crypto/evp/e_aria.c:                            EVP_CTRL_GCM_IV_GEN : EVP_CTRL_GCM_SET_IV_INV,
crypto/evp/e_aes.c:    case EVP_CTRL_GCM_SET_IV_FIXED:
crypto/evp/e_aes.c:    case EVP_CTRL_GCM_IV_GEN:
crypto/evp/e_aes.c:    case EVP_CTRL_GCM_SET_IV_INV:
crypto/evp/e_aes.c:    if (EVP_CIPHER_CTX_ctrl(ctx, enc ? EVP_CTRL_GCM_IV_GEN
crypto/evp/e_aes.c:                                     : EVP_CTRL_GCM_SET_IV_INV,
crypto/evp/e_aes.c:    case EVP_CTRL_GCM_SET_IV_FIXED:
crypto/evp/e_aes.c:    case EVP_CTRL_GCM_IV_GEN:
crypto/evp/e_aes.c:    case EVP_CTRL_GCM_SET_IV_INV:
crypto/evp/e_aes.c:    if (EVP_CIPHER_CTX_ctrl(ctx, ctx->encrypt ? EVP_CTRL_GCM_IV_GEN
crypto/evp/e_aes.c:                                              : EVP_CTRL_GCM_SET_IV_INV,
include/openssl/evp.h:# define         EVP_CTRL_GCM_SET_IVLEN          EVP_CTRL_AEAD_SET_IVLEN
include/openssl/evp.h:# define         EVP_CTRL_GCM_GET_TAG            EVP_CTRL_AEAD_GET_TAG
include/openssl/evp.h:# define         EVP_CTRL_GCM_SET_TAG            EVP_CTRL_AEAD_SET_TAG
include/openssl/evp.h:# define         EVP_CTRL_GCM_SET_IV_FIXED       EVP_CTRL_AEAD_SET_IV_FIXED
include/openssl/evp.h:# define         EVP_CTRL_GCM_IV_GEN             0x13
include/openssl/evp.h:# define         EVP_CTRL_GCM_SET_IV_INV         0x18

So in evp_enc.c EVP_CTRL_GCM_SET_IV_FIXED could be replaced with EVP_CTRL_AEAD_SET_IV_FIXED, right?
Question is how provider implement EVP_CTRL_GCM_IV_GEN and EVP_CTRL_GCM_SET_IV_INV.
Secure shell code uses EVP_CTRL_GCM_IV_GEN .

Ahh yeah ok..
EVP_CIPHER_CTX_ctrl() is missing some translations that it needs to do..
I will add them today..

See PR #10173

This issue is for aes*gcm but now master has other failures... :(
For instance try-ciphers test hang on first test:

=== run test try-ciphers.sh ...
.../regress/try-ciphers.sh: warning: line 8: `...` obsolete, use $(...)
.../regress/try-ciphers.sh: warning: line 10: `...` obsolete, use $(...)
.../regress/try-ciphers.sh: warning: line 25: `...` obsolete, use $(...)
test try ciphers: cipher 3des-cbc mac hmac-sha1

So in evp_enc.c EVP_CTRL_GCM_SET_IV_FIXED could be replaced with EVP_CTRL_AEAD_SET_IV_FIXED, right?

They are defined as the same thing - so either one will work.. And yes ccm handles it .
cipher_ccm uses OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED.
EVP_CIPHER_CTX_ctrl() does the translation from a CTRL to a OSSL_CIPHER_PARAM

Shane wrote:

So in evp_enc.c EVP_CTRL_GCM_SET_IV_FIXED could be replaced with EVP_CTRL_AEAD_SET_IV_FIXED, right?

They are defined as the same thing - so either one will work.. And yes ccm handles it .
cipher_ccm uses OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED.
EVP_CIPHER_CTX_ctrl() does the translation from a CTRL to a OSSL_CIPHER_PARAM

Let FOO is equal to COMMON and BAR also is equal to COMMON.
So based on above comment developer could use in code randomly either
FOO, or BAR, or COMMON. It will work.
This is not model that I will use. I would like such style to be
discouraged.
Regards,
Roumen Petrov
P.S. for protocol COMMON is already used:
$ grep -n EVP_CTRL_AEAD //evp*.c
crypto/evp/evp_enc.c:1099:    case EVP_CTRL_AEAD_SET_IVLEN:
crypto/evp/evp_enc.c:1117:    case EVP_CTRL_AEAD_GET_TAG:
crypto/evp/evp_enc.c:1119:    case EVP_CTRL_AEAD_SET_TAG:
crypto/evp/evp_enc.c:1123:    case EVP_CTRL_AEAD_TLS1_AAD:

I wonder how to proceed with this issue. Look like that gcm is corrected (see above for number). Unfortunately  correction cannot be tested in third party software as the test fail in another cipher before gcm :(
Dunno why OpenSSL test suite do not catch those failures.

Is this still an issue?

Richard Levitte wrote:

Is this still an issue?

It seems to aes{128|256}-gcm is fixed in another issue (PR). I have just
one remark - code to use more common AEAD *(1) macros instead GSM
(2) . Code will work in both cases but (1) is more readable.
Unfortunately cipher test start to fail for another cipher ( see
previous comment
https://github.com/openssl/openssl/issues/9524#issuecomment-541802481 ).
I'm not sure when I could test current master.
Roumen

Ciphers tests still hang with master 2019-12-14 .

As expected no change.
For functional point of view issue does not differ from previous report (#8895) : broken serialization and deserialization.
Case is not covered by OpenSSL regression test. Simple check was used to test previous report. Now I have no idea what exacty is broken.
For sure if after some encryption/description operation, serialization and deserialization of chiper&mac, next opeation will fail.

@petrovr, I'm not familiar enough with pkix-ssh to figure out how to start looking more deeply into the code to figure out what's wrong and why, and it's not easy to see clearly what programs are run when and how.  If you have an easy recipe for me to run one test program in gdb, that would be awesome.

Richard Levitte wrote:

@petrovr, I'm not familiar enough with pkix-ssh to figure out how to start looking more deeply into the code to figure out what's wrong and why, and it's not easy to see clearly what programs are run when and how.  If you have an easy recipe for me to run one test program in gdb, that would be awesome.

PKIX-SSH (unlike another implementation) allows "privilege separation" (
https://github.com/openssl/openssl/issues/8895#issuecomment-509313858 )
to be disabled from configuration. If is disabled in cipher tests case
"hang" disappear. In this case we will see failures with gsm (out of
scope to this post).
So what this mean - serialization and deserialization error .
After authentication unprivileged process sends "packet state" (1)
function newkeys_to_blob from  packet.c and exists.
	if ((r = cipher_get_keyiv(cc, enc->iv, enc->iv_len)) != 0)
		return r;
...
	if ((r = sshbuf_put_cstring(b, enc->name)) != 0 ||
	    (r = sshbuf_put_u32(b, enc->enabled)) != 0 ||
	    (r = sshbuf_put_u32(b, enc->block_size)) != 0 ||
	    (r = sshbuf_put_string(b, enc->key, enc->key_len)) != 0 ||
	    (r = sshbuf_put_string(b, enc->iv, enc->iv_len)) != 0)

Remark: Function cipher_get_keyiv calls EVP_CIPHER_CTX_* if "key"
functionality is managed by OpenSSL code.
Daemon starts new child process and "packet state" is deserialized(2)
with data from (1) - function newkeys_from_blob from packet.c.
	if ((r = sshbuf_get_cstring(b, &enc->name, NULL)) != 0 ||
	    (r = sshbuf_get_u32(b, (u_int *)&enc->enabled)) != 0 ||
	    (r = sshbuf_get_u32(b, &enc->block_size)) != 0 ||
	    (r = sshbuf_get_string(b, &enc->key, &keylen)) != 0 ||
	    (r = sshbuf_get_string(b, &enc->iv, &ivlen)) != 0)
		goto out;

Same for mac if applicable.
Let see in previous sample in this comment -
https://github.com/openssl/openssl/issues/8895#issuecomment-509319798 .
Currently with master issue is similar - IV was zero (issue #8895) and
now dump is with original(initial) IV.
It seems to me all ciphers are impacted - the ssh test try-ciphers fail
for all [cipher,mac] pairs (for some test hang, for other fail, for
aes-gsm fix is in a separate issue).
Let me quote part of my previous comment "For sure if after some
encryption/description operation, serialization and deserialization of
chiper&mac, next operation will fail"
Let imagine following test:
0) producer and consumer are initialized with same keys iv and etc.

producer encrypts "sample text" and sent (store to file, etc.)
consumer decrypts text
consumer gets cipher state and initialize new cipher instance with
the state.
producer encrypts "sample text" and sent (store to file, etc.)
consumer decrypts text using "new" cipher instance - expected is
correct decryption.

Above test is similar to ssh processes.
Regards,
Roumen Petrov

I am working on a project where I have to integrate both OpenSSL & OpenSSH and I have been experiencing a similar symptom to what it is most recently described here. I can SSH into my system if it's AESGCM, but not with AESCTR. I know I'm saying OpenSSH and not PKIX-SSH, but it has a lot of the same code and so far as things are described many of the same mechanisms (privilege separation, trying to marshal across the cipher state, etc.)
I've been trying to debug-by-printf (ugh) this situation from OpenSSH side, and I think I have some idea of what happened.
I added some tracing to the cipher_init() and cipher_crypt() routines, along with the serialization / de-serialization routines mentioned above by @petrovr. I discovered that cipher_init() was getting called with some IV, then cipher_crypt() would get called a handful of times, then the same IV as shown in cipher_init() eventually got marshaled across in the blob. At first I actually thought this is what I SHOULD be seeing. Now I am less certain.
In OpenSSH, there is an EVP_CIPHER_CTX_get_iv() routine. This overlaps with an OpenSSL routine of the same name, of course... so with the right defines / configuration it calls into the OpenSSL one instead. But looking at the OpenSSH routine is instructive...
int
EVP_CIPHER_CTX_get_iv(const EVP_CIPHER_CTX *ctx, unsigned char *iv, size_t len)
{
	if (ctx == NULL)
		return 0;
	if (EVP_CIPHER_CTX_iv_length(ctx) < 0)
		return 0;
	if (len != (size_t)EVP_CIPHER_CTX_iv_length(ctx))
		return 0;
	if (len > EVP_MAX_IV_LENGTH)
		return 0; /* sanity check; shouldn't happen */
	/*
	 * Skip the memcpy entirely when the requested IV length is zero,
	 * since the iv pointer may be NULL or invalid.
	 */
	if (len != 0) {
		if (iv == NULL)
			return 0;
# ifdef HAVE_EVP_CIPHER_CTX_IV
		memcpy(iv, EVP_CIPHER_CTX_iv(ctx), len);
# else
		memcpy(iv, ctx->iv, len);
# endif /* HAVE_EVP_CIPHER_CTX_IV */
	}
	return 1;
}

It seems, at least to me, that the above is meant to get the running IV and not the original IV.
However, the OpenSSL routine by the same name introduced in 3.0.0 I believe is returning the original IV. The running IV is available in EVP_CIPHER_CTX_get_iv_state().

Update: Switching the OpenSSH call to EVP_CIPHER_CTX_get_iv() instead to be EVP_CIPHER_CTX_get_iv_state() fixed the problem as observed in my setup.

@jwalch - what you are saying make sense to me. This is a real clash of namespaces here.
EVP_CIPHER_CTX_get_iv() in openssl is the original iv, so that is a problem.

@jwalch - what you are saying make sense to me. This is a real clash of namespaces here.
EVP_CIPHER_CTX_get_iv() in openssl is the original iv, so that is a problem.

We still have a chance to rename ours before beta...

We still have a chance to rename ours before beta...

I thought of making that suggestion. On one hand, you CAN and it fixes the issue without any change being necessary on OpenSSH side. On the other hand, they sort of asked for it with the way they set up the detection of symbols and configuration defines... IMO, they really should not have assumed that a EVP_CIPHER_CTX_get_iv(), which didn't exist in 1.0.2 or 1.1.1 AFAIK, if eventually defined by OpenSSL would have the behavior they wanted. Seems like it would have been better to get a multiple definition error than to have this crazy run-time issue... IDK, maybe way back when or during development of some release OpenSSL had defined a EVP_CIPHER_CTX_get_iv() that did in fact return running IV...

Oh, I think I've misread the history. It seems EVP_CIPHER_CTX_get_iv() is a LibreSSL construct. Go figure.

@openssl/omc is a function name clash with LibreSSL a concern?

@openssl/omc is a function name clash with LibreSSL a concern?

We should make it easy to switch from LibreSSL to OpenSSL. So if we have the opportunity to the name things in a sensible way that allows that, I tend to think that we should.

Our previous (1.1.1) function names were EVP_CIPHER_CTX_original_iv for the original IV and EVP_CIPHER_CTX_iv for the running IV.  Maybe we should simply switch back to them...

Our previous (1.1.1) function names were EVP_CIPHER_CTX_original_iv for the original IV and EVP_CIPHER_CTX_iv for the running IV. Maybe we should simply switch back to them...

That would be a really bad idea, since the function signature is different.

EDIT: ... or for using get more consistently, have EVP_CIPHER_CTX_get_original_iv for the original IV and EVP_CIPHER_CTX_get_iv for the running IV. Incidently, that would make them compatible with LibreSSL, as I understand it. This these are new names in 3.0, we have the freedom to adjust appropriately.

I would be okay with that.  IIRC I went with the _get_iv/_get_iv_state names because previous discussions had leaned strongly towards reserving the "iv" term for the actual initial vector

... previous discussions had leaned strongly towards reserving the "iv" term for the actual initial vector

Considering IV literally means "initialization vector", I hope that's not too surprising :wink:
That being said, I can see that the changed stance is more trouble than it's worth, so I don't mind changing it back (even though I gave it a good fight earlier)

Ah, something I forgot was the semantics.  The const unsigned char * returning functions are deprecated in favor of "fill my buffer" style functions (EVP_CIPHER_CTX_get_iv and EVP_CIPHER_CTX_get_iv_state), which I do think are a better fit for the future.
That gave me pause...

So should we just rename our _get_iv() to _get_initial_iv()?

A)

PKIX-SSH uses a model that ensures compatibility with different cryptographic library and versions.
Goal of "EVP compat" model is to uses most recent API.
For instance PKIX-SSH 2 years before OpenBSD managed secsh PKIX-SSH support 1.1.1 API.
Also model ensures compatibility with ancient OpenSSL releases like 0.9.7 with zero maintenance cost.
On other side OpenBSD still uses deprecated in 0.9.8 functionality and mechanically requires more recent releases of cryptographic library.
So @jwalch comment is not for this issue.
In particular case PKIX-SSH uses function cipher_get_keyiv uses EVP_CIPHER_CTX_iv (part of API 1.1).
As result @jwalch comment is applicable to this issue. It is up to OpenBSD to resolve failure.

B)

PKIX-SSH fully support Android.
For instance you could get it from user applications: SecureBox with TermOnePlus as terminal or "SecureBox Pro" with integrated terminal and user interface.
Side effect is that privilege separation is still configuration option.
Privilege separation does not make sense in Android user application.
OpenBSD does drops configuration for privilege separation.

C)

Serialisation issue impacts following regression tests: integrity, rekey and try-ciphers. Mostly identical between both secsh implementation.
PKIX-SSH fips-try-ciphers is out of scope - OpenBSD lack support and OpenSSL fips in master is different.
If PKIX-SSH regression tests are modified do not use privilege separation above tests pass.
This work-around is non recommended for production use.

D)

It is clear that OpenSSL team fail to provide reliable code for more then one year. Also this issue shows that OpenSSL lack strong regression tests.
Status of 2020-08-28 (last tested, one year and 25 days after report):
integrity<EMAIL_ADDRESS>fail, other ?
rekey: lot of failures
try-ciphers: ssh failed with mac hmac-sha1 cipher<EMAIL_ADDRESS>Dunno if chacha20-poly1305 is related to serialisation.

Please do not hijack issue. One day serialisation will be fixed.
I hope with added relevant tests.
Hint: for instance issue #8895 was to get right IV just after initialisation while this is more related to get IV after operation.

So should we just rename our _get_iv() to _get_initial_iv()?

... or to _get_original_iv(), to reflect the old name?  (also "initial IV" sounds a bit like "CD disk" :wink:)

As alredy pointed in my prevous comment function name clash is not appicable to this report.

Hint: for instance issue #8895 was to get right IV just after initialisation while this is more related to get IV after operation.

Thanks for that hint

Please do not hijack issue.

shrug
No good deed goes unpunished, I suppose. Will file a new issue. Sorry I couldn't parse this bug report...

=== run test rekey.sh ...
client rekey KexAlgorithms=diffie-hellman-group1-sha1
client rekey KexAlgorithms=diffie-hellman-group14-sha1
client rekey KexAlgorithms=diffie-hellman-group14-sha256
client rekey KexAlgorithms=diffie-hellman-group16-sha512
client rekey KexAlgorithms=diffie-hellman-group18-sha512
client rekey KexAlgorithms=diffie-hellman-group-exchange-sha1
client rekey KexAlgorithms=diffie-hellman-group-exchange-sha256
client rekey KexAlgorithms=ecdh-sha2-nistp256
client rekey KexAlgorithms=ecdh-sha2-nistp384
client rekey KexAlgorithms=ecdh-sha2-nistp521
client rekey KexAlgorithms=curve25519-sha256
client rekey<EMAIL_ADDRESS>client rekey Ciphers=3des-cbc
client rekey Ciphers=aes128-cbc
client rekey Ciphers=aes192-cbc
client rekey Ciphers=aes256-cbc
client rekey Ciphers=aes128-ctr
client rekey Ciphers=aes192-ctr
client rekey Ciphers=aes256-ctr
client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey MACs=hmac-sha1
client rekey MACs=hmac-sha1-96
client rekey MACs=hmac-sha2-256
client rekey MACs=hmac-sha2-512
client rekey MACs=hmac-md5
client rekey MACs=hmac-md5-96
client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>diffie-hellman-group1-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha256
client rekey<EMAIL_ADDRESS>diffie-hellman-group16-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group18-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp384
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp521
client rekey<EMAIL_ADDRESS>curve25519-sha256
client rekey<EMAIL_ADDRESS><EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>diffie-hellman-group1-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha256
client rekey<EMAIL_ADDRESS>diffie-hellman-group16-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group18-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp384
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp521
client rekey<EMAIL_ADDRESS>curve25519-sha256
client rekey<EMAIL_ADDRESS><EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>diffie-hellman-group1-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha256
client rekey<EMAIL_ADDRESS>diffie-hellman-group16-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group18-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp384
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp521
client rekey<EMAIL_ADDRESS>curve25519-sha256
client rekey<EMAIL_ADDRESS><EMAIL_ADDRESS>client rekeylimit 16
client rekeylimit 1k
client rekeylimit 128k
client rekeylimit 256k
client rekeylimit default 5
client rekeylimit default 10
client rekeylimit default 5 no data
client rekeylimit default 10 no data
server rekeylimit 16
server rekeylimit 1k
server rekeylimit 128k
server rekeylimit 256k
server rekeylimit default 5 no data
server rekeylimit default 10 no data
rekeylimit parsing
ok rekey

This is what I get when I run the pkixssh test against the current master. So apparently the original issue should be now fixed.
Unless you disagree @petrovr I'd recommend closing this issue and opening new issues if there are further issues that you see with OpenSSL master in regards to pkixssh tests.

=== run test rekey.sh ...
client rekey KexAlgorithms=diffie-hellman-group1-sha1
client rekey KexAlgorithms=diffie-hellman-group14-sha1
client rekey KexAlgorithms=diffie-hellman-group14-sha256
client rekey KexAlgorithms=diffie-hellman-group16-sha512
client rekey KexAlgorithms=diffie-hellman-group18-sha512
client rekey KexAlgorithms=diffie-hellman-group-exchange-sha1
client rekey KexAlgorithms=diffie-hellman-group-exchange-sha256
client rekey KexAlgorithms=ecdh-sha2-nistp256
client rekey KexAlgorithms=ecdh-sha2-nistp384
client rekey KexAlgorithms=ecdh-sha2-nistp521
client rekey KexAlgorithms=curve25519-sha256
client rekey<EMAIL_ADDRESS>client rekey Ciphers=3des-cbc
client rekey Ciphers=aes128-cbc
client rekey Ciphers=aes192-cbc
client rekey Ciphers=aes256-cbc
client rekey Ciphers=aes128-ctr
client rekey Ciphers=aes192-ctr
client rekey Ciphers=aes256-ctr
client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey MACs=hmac-sha1
client rekey MACs=hmac-sha1-96
client rekey MACs=hmac-sha2-256
client rekey MACs=hmac-sha2-512
client rekey MACs=hmac-md5
client rekey MACs=hmac-md5-96
client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>diffie-hellman-group1-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha256
client rekey<EMAIL_ADDRESS>diffie-hellman-group16-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group18-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp384
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp521
client rekey<EMAIL_ADDRESS>curve25519-sha256
client rekey<EMAIL_ADDRESS><EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>diffie-hellman-group1-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha256
client rekey<EMAIL_ADDRESS>diffie-hellman-group16-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group18-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp384
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp521
client rekey<EMAIL_ADDRESS>curve25519-sha256
client rekey<EMAIL_ADDRESS><EMAIL_ADDRESS>client rekey<EMAIL_ADDRESS>diffie-hellman-group1-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group14-sha256
client rekey<EMAIL_ADDRESS>diffie-hellman-group16-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group18-sha512
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha1
client rekey<EMAIL_ADDRESS>diffie-hellman-group-exchange-sha256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp256
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp384
client rekey<EMAIL_ADDRESS>ecdh-sha2-nistp521
client rekey<EMAIL_ADDRESS>curve25519-sha256
client rekey<EMAIL_ADDRESS><EMAIL_ADDRESS>client rekeylimit 16
client rekeylimit 1k
client rekeylimit 128k
client rekeylimit 256k
client rekeylimit default 5
client rekeylimit default 10
client rekeylimit default 5 no data
client rekeylimit default 10 no data
server rekeylimit 16
server rekeylimit 1k
server rekeylimit 128k
server rekeylimit 256k
server rekeylimit default 5 no data
server rekeylimit default 10 no data
rekeylimit parsing
ok rekey

This is what I get when I run the pkixssh test against the current master. So apparently the original issue should be now fixed.
Unless you disagree @petrovr I'd recommend closing this issue and opening new issues if there are further issues that you see with OpenSSL master in regards to pkixssh tests.

Hi,
Tomáš Mráz wrote:

=== run test rekey.sh ...
client rekey KexAlgorithms=...
... ...
rekeylimit parsing
ok rekey

Good news.

This is what I get when I run the pkixssh test against the current master. So apparently the original issue should be now fixed.
Unless you disagree @petrovr I'd recommend closing this issue and opening new issues if there are further issues that you see with OpenSSL master in regards to pkixssh tests.

Does team plan to add more tests on this area? If so this could closed automatically by respective commit.
If I'm not wrong tests only check initialization - done is result of a previous report. OpenSSL itself does not use serialization, in particular case current IV. Is result tests does not cover regression in this area. With internal test PR will not pass regression test.
Personally I did not plan to test any more with master until official release.
Regards,
Roumen Petrov
P.S.
Every time when I thy tests fail. Last time was with an engine where creation of pkcs12 files fail. This prevent my to test quite simple functionality and also will fail in PKIX-SSH where regression tests produce pkcs12 files for third software.
I prefer to work on modernisation on PKIX-SSH - to minimize direct use of RSA, DSA and etc. keys and to use only PKEY. It was started long time ago and now is almost finished for identities(keys) - still used in key "creation" but I guess that this could be changed easily to "provider" like interface.
But there is number of other functionality that still needed to be changed. Work on key exchange is not even stated.
Due to current state of master (not functional in last 1.5 years) I have to change my plans. Support for providers is planed for next major OpenSSL release (3.1 or 4.0)
From my point of view is too late to support 3.0.
Now my plans include only to minimize "deprecation" warnings with code refactor and to replace with exiting not yet deprecated functionality.

Hi,
Tomáš Mráz wrote:

=== run test rekey.sh ...
client rekey KexAlgorithms=...
... ...
rekeylimit parsing
ok rekey

Good news.

This is what I get when I run the pkixssh test against the current master. So apparently the original issue should be now fixed.
Unless you disagree @petrovr I'd recommend closing this issue and opening new issues if there are further issues that you see with OpenSSL master in regards to pkixssh tests.

Does team plan to add more tests on this area? If so this could closed automatically by respective commit.
If I'm not wrong tests only check initialization - done is result of a previous report. OpenSSL itself does not use serialization, in particular case current IV. Is result tests does not cover regression in this area. With internal test PR will not pass regression test.
Personally I did not plan to test any more with master until official release.
Regards,
Roumen Petrov
P.S.
Every time when I thy tests fail. Last time was with an engine where creation of pkcs12 files fail. This prevent my to test quite simple functionality and also will fail in PKIX-SSH where regression tests produce pkcs12 files for third software.
I prefer to work on modernisation on PKIX-SSH - to minimize direct use of RSA, DSA and etc. keys and to use only PKEY. It was started long time ago and now is almost finished for identities(keys) - still used in key "creation" but I guess that this could be changed easily to "provider" like interface.
But there is number of other functionality that still needed to be changed. Work on key exchange is not even stated.
Due to current state of master (not functional in last 1.5 years) I have to change my plans. Support for providers is planed for next major OpenSSL release (3.1 or 4.0)
From my point of view is too late to support 3.0.
Now my plans include only to minimize "deprecation" warnings with code refactor and to replace with exiting not yet deprecated functionality.

Unfortunately it is not clear to me, how the additional test-case should look like. There is the test_evp_iv() in evp_extra_test.c that is supposed to check that the running (updated) IV parameter is properly updated after the encryption call. Isn't that sufficient?

Unfortunately it is not clear to me, how the additional test-case should look like. There is the test_evp_iv() in evp_extra_test.c that is supposed to check that the running (updated) IV parameter is properly updated after the encryption call. Isn't that sufficient?

Hi,
Tomáš Mráz wrote:

Unfortunately it is not clear to me, how the additional test-case should look like. There is the test_evp_iv() in evp_extra_test.c that is supposed to check that the running (updated) IV parameter is properly updated after the encryption call. Isn't that sufficient?

I see - test_evp_iv() it is quite new :
From 440b852a0f79ac4a7e101606a7c32d212e06d203 Mon Sep 17 00:00:00 2001
From: Benjamin Kaduk<EMAIL_ADDRESS>Date: Fri, 19 Jun 2020 20:42:29 -0700
Subject: [PATCH] Add tests for new EVP_CIPHER_CTX IV accessors
Quick review shows that test is limited. It does not test all ciphers.
In files like evpciph_*.txt IV is listed but content lack "Next IV". Is it not "current"/"updated" IV?
Regards
Roumen Petrov

Hi,
Tomáš Mráz wrote:

Unfortunately it is not clear to me, how the additional test-case should look like. There is the test_evp_iv() in evp_extra_test.c that is supposed to check that the running (updated) IV parameter is properly updated after the encryption call. Isn't that sufficient?

I see - test_evp_iv() it is quite new :
From 440b852a0f79ac4a7e101606a7c32d212e06d203 Mon Sep 17 00:00:00 2001
From: Benjamin Kaduk<EMAIL_ADDRESS>Date: Fri, 19 Jun 2020 20:42:29 -0700
Subject: [PATCH] Add tests for new EVP_CIPHER_CTX IV accessors
Quick review shows that test is limited. It does not test all ciphers.
In files like evpciph_*.txt IV is listed but content lack "Next IV". Is it not "current"/"updated" IV?
Regards
Roumen Petrov

Yes, but it at least tests all the relevant modes of aes-128. The evp_test that uses the evpciph_*.txt does not support checking the updated IV. I've opened a new issue #14047 for that as this issue is quite convoluted and IMO the base problem is now resolved.


Sessions

How do you provide session IDs with output bindings?

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: 1752a37b-b40a-5613-3416-fd604b281dbc
Version Independent ID: f088004f-f80e-ba5c-e08e-c76ac395c809
Content: Azure Service Bus output bindings for Azure Functions
Content Source: articles/azure-functions/functions-bindings-service-bus-output.md
Service: azure-functions
GitHub Login: @ggailey777
Microsoft Alias: glenga

@smolattack
Thanks for your feedback! We will investigate and update as appropriate.

@smolattack Session are not supported in Function python service bus output binding.
You can use the Azure service bus SDK for python to write messages to session enabled service bus queue. You can refer to this example.
I will go ahead and close this issue. Feel free to tag me in if you have any queries or concerns.


0.9.7 touches .session files

Describe the bug
As soon as a project is opened, all the .session files get their modification date/time changed to the current time.
Expected behavior
I expect .session files only to be modified by changes I carry out within lameta.
Desktop (please complete the following information):

OS: macOS 10.14.6 (Mojave)
Version: lameta-Mac-0.9.7-beta

Additional context
Apart from the false indication that the .session files have been modified, if a project is mirrored to (and shared via) the cloud then there is needless uploading and downloading of the apparently modified files.

Yeah, I don't like this much either. On cloud synchronization... it might not mater. For sure Dropbox only transfers actual changes. Google Drive transfers all or nothing, but even then, it uses a hash of the contents to decide (though public documentation on this is murky).

We use https://cloudstor.aarnet.edu.au/ which does seem to transfer the files; and also wouldn't Time Machine re-copy them.


System.TypeLoadException : Method 'get_LineCount' in type 'lexer@289' from assembly 'FSharp.CodeFormat

I did a paket update:

And now I get this when running the documentation tests:

Is there something I need to fix?

I saw this before and I thought @tomaspetricek said that we we need to pin a dependency (IIRC the powetools). But I would like to see the pin happen directly in FSF so that it solves it for everyone.

Lock FSharpVSPowerTool to 1.7.0, see #294  #277.
I think this is already fixed in master, there is just no NuGet release with the fix (jet).

Ok what is missing? Why can't we just release this fixed version on nuget?

Humm, I'm not even referencing FSharpVSPowerTool directly, should I?

@ovatsus Either that or stay on an older FSharp.Formatting version
@forki: We need to ask @tpetricek, but I would assume he wants to look over the open PRs or do some further testing or just has not found the time to do it :).
It's a bit sad that the next release will probably break everyone who locked the powertools version again. Does paket throw an error if FSharp.Formatting is locked to 1.8 and the dependencies file is locked to 1.7 or will it simply use 1.7?

No normally you shouldn't. That's why I'd like to see a new fsf package. But in order to get your current issue fixed: Yes you need to add the powetools to the dependencies file and pin the version.
Or you revert the update and wait a bit.

@matthid: it will not throw. It will just not update since it tries to unify all requirements. That means it will install the latest fsf that's compatible to your pinned powertools version. That means it might never update again -  until you remove the pin.

BTW, that paragraph should be on Paket docs

(and the output of paket should maybe log when it doesn't get the latest of some package because of a pin of a dependent package)

Good idea. I created two issues

Great, thanks!

Sorry everyone for the delay…
@tpetricek not only had to do some testing, but also had to do one talk in Prague, another at F# eXchange, move to Cambridge, do F# trainings & various other stuff. Oh, and he also didn’t have internet at home…
In any case, new version of F# Formatting with all the fixes should now be released!
From: matthid<EMAIL_ADDRESS>Sent: Sunday, April 19, 2015 12:56 PM
To: tpetricek/FSharp.Formatting
Cc: Tomas Petricek
Subject: Re: [FSharp.Formatting] System.TypeLoadException : Method 'get_LineCount' in type 'lexer@289' from assembly 'FSharp.CodeFormat (#301)
@ovatsus https://github.com/ovatsus  Either that or stay on an older FSharp.Formatting version
@forki https://github.com/forki : We need to ask @tpetricek https://github.com/tpetricek , but I would assume he wants to look over the open PRs or do some further testing or just has not found the time to do it :).
It's a bit sad that the next release will probably break everyone who locked the powertools version again. Does paket throw an error if FSharp.Formatting is locked to 1.8 and the dependencies file is locked to 1.7 or will it simply use 1.7?
—
Reply to this email directly or view it on GitHub https://github.com/tpetricek/FSharp.Formatting/issues/301#issuecomment-94269952 .  https://github.com/notifications/beacon/AAdoJZRaJdHXQCGcL6WxiLKZaJzmiSeMks5oA49ggaJpZM4EDst3.gif


Error: expected argument 'protection' to 'Mutex.new' to be Mutex::Protection, not (Mutex::Protection | Symbol)

There was a problem expanding macro 'new_rb_func'
Code in macro 'wrap_constructor_function_with_keyword_args'
13 | __temp_81 = Anyolite::Macro.new_rb_func do
^
Called macro defined in lib/anyolite/src/implementations/mruby/Implementation.cr:7:5
7 | macro new_rb_func(&b)
Which expanded to:

5 | __temp_85 = Anyolite::Macro.load_kw_args_into_vars(nil, [protection : Protection = :checked], __temp_84, __temp_82)
6 | __temp_86 = Anyolite::Macro.convert_regular_args(_rb, __temp_82, nil, options: {:context => Mutex, :block_arg_number => nil, :block_return_type => nil, :store_block_arg => false, :type_vars => [] of ::NoReturn, :type_var_names_annotation => nil, :type_var_names => nil})
7 | __temp_87 = Mutex.new(protection: Anyolite::Macro.convert_from_ruby_to_crystal(_rb, __temp_85.values[0], protection : Protection = :checked, options: {:context => Mutex, :block_arg_number => nil, :block_return_type => nil, :store_block_arg => false, :type_vars => [] of ::NoReturn, :type_var_names_annotation => nil, :type_var_names => nil}, debug_information: "Mutex.new - [protection : Protection = :checked]"))
^
Error: expected argument 'protection' to 'Mutex.new' to be Mutex::Protection, not (Mutex::Protection | Symbol)

Overloads are:

Mutex.new(protection : Protection = :checked)

Can you specify how exactly you encountered this error?
Based on the debug information from the error message it seams you wanted to wrap the Mutex class.
If this is the case, the problem results from the Crystal implementation, which uses def initialize(@protection : Protection = :checked) as the constructor for Mutex.
For some reason, Crystal accepts symbols as a default argument for the enum Protection, while the same syntax throws an error in Anyolite, when the symbol is passed as an argument to Mutex.new.
I don't think this can be fixed in Anyolite itself, but Anyolite supports a workaround for cases like this:
@[Anyolite::SpecializeInstanceMethod(initialize, [protection : Protection = :checked], [protection : Protection = Mutex::Protection::Checked])]
@[Anyolite::AddBlockArgInstanceMethod(synchronize, 0, Nil)]
class Mutex
end

This snippet essentially prepares the Mutex class for usage with Anyolite by internally changing the default argument of initialize to an actual instance of Protection (so the compiler does not complain about the symbol) and by informing Anyolite that the synchronize method requires a block as an argument.

Generally related for cases, where a Crystal module or class requires modification to work with Anyolite:
https://github.com/Anyolite/anyolite/wiki/Code-guidelines-and-workarounds
https://github.com/Anyolite/anyolite/wiki/Limitations-and-solutions
https://github.com/Anyolite/anyolite/wiki/Passing-block-arguments

Did the snippet fix the problem or is there still something not working?

Closing this for now.
If the issue still arises despite of the given fix, just comment here again.


Releasing model weights

Are you planning to release trained model weights?

We will release the model weights trained on LibriSpeech next week.

Model weights trained on LibriSpeech have been released in soundstorm.


Annotations module loader

Before:
There were two different ModuleLoaders: QueryDiscoveryModuleLoader and EventModuleLoader.
After:
Deleted both of them and Using GenericClassLoader to load the modules.

@goru97 You should add your ssh key to your github profile so that your commits show up your gravatar.

Apart from the nit picks, I like this PR. :+1:

+1 assuming the merge conflicts get resolved and the _ in the endpoint name gets fixed in other PR.

Closed in favor of #493


Dependency test is still failing

It's currently marked as an expected failure but I couldn't find an issue about this, so I created one.

Thanks, I noticed this too. I think we need Glenn to take a look. I'm really not sure what the assertion that's failing means.

"Assigned" to Glen. Glen, please see this as an invitation to contribute, not a mandate, of course.

This test was originally written to reproduce some fairly subtle jobtree (er, toil) bugs that were driving me nuts while developing progressive cactus.  These bugs were fixed long ago by Ben as far as I remember.  I'll take a look to see what's going on now this week.

In sprint planning it was decided to remove this test.


Add a license

There is no license file, so it is unclear what permissions downstream projects have.

Thanks for raising this issue, I added the license now: https://github.com/kasiaMarek/TyRE/commit/5ad08fedd515d42058387a73c513abe996677c39.


Add directories as folder references

Adding specific directories as Folder References would be really nice feature.
I'm referring to the thing below:

That's a good one @ImLaufderZeit 😛

Yeah, that's a good feature. Given that the groups are synced to disk anyway though, I thought it would be less important, because as far as I know the only downside to using groups as opposed to folder references is that you have to manually manage them, but that isn't an issue with XcodeGen. Would specific problem would this solve for you?
I could imaging it maybe looking like this:
targets:
    - name: MyTarget
    - sources:
        - path: MyTarget
          name: MyTarget
          type: group
       - path: ../MyDirectory
          type: folderReference

This would add an optional name property (that defaults to the directory name), and an optional type (which would default to group). Sources could still be written as an array of strings that use the defaults, or you could specific this more verbose form with more flexibility. And a single source string would still be allow as it is now for simple cases (sources: MyTarget)
Using the more verbose form would mean you could potentially define an excludes: */*.uglyFiles for group types as well
What do you think?

@yonaskolb, that sounds just awesome.

... Given that the groups are synced to disk anyway though, ..... Would specific problem would this solve for you?

Well, in fact, if #24 has been solved - there is no problem, exactly as you say.

Resolves in #151


Page title

Original conversation relating to this in HMRC slack: https://hmrcdigital.slack.com/archives/community-ux/p1485950134000025
As reccomended bny Chris Moore to Phil Sherry
[page title] - [section name] - [service name] - GOV.UK
[page title] should mirror h1 on that page.

Page titles get passed to google analytics, therefore, it's important that they don't contain any personal information.

Discussion Summary from the hackday

On the GOV.UK Design System backlog.

Is the same format used for page titles on internal HMRC services? (I've heard in the past that we shouldn't add "- GOV.UK" on internal services but haven't seen any official guidance

Hi @sophie-still my suggestion is that we should change our page title guidance to exclude 'GOV.UK' from internal page titles. I'll look into making the amend.


feat: 2fa verification supporting

TRELLO_TICKET
Description

[ ] Added creation of OTP
[ ] Added verification of OTP

Type of change

[ ] Bug fix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
[ ] This change requires a documentation update

 OTP Verification


Every lint is considered a "warning"

tslint version: 5.12.0
typescript version:  3.1.6
typescript-tslint-plugin version: 0.2.1
vscode-typescript-tslint-plugin version: 0.2.1
Expected:
Errors should be kept intact from tslint, showing red underlines.
tslint.alwaysShowRuleFailuresAsWarnings is disabled.
Actual:
Every lint is considered a "warning" in vscode, showing green underlines. Even explicitly specifying a lint as an error in tslint.json doesn't work:
"typedef": {"options": ["call-signature"], "severity": "error"},

Running tslint --project . correctly lists lints with "severity": "error" as an error.

Has this patch ever been released? Using the latest extension and this still appears to be an issue.


Middlewares are not preprocessed with Vite?

I use import aliases in solid-start project, and all the server code is working correctly with import aliases (or vite-tsconfig-paths), but middleware is failing to run with
[vite] Error when evaluating SSR module /src/middleware.ts: failed to import "#/server/auth/user-session"
|- Error: Cannot find module '#/server/auth/user-session' imported from solid-start-next/packages/web/src/middleware.ts'
    at nodeImport...

Appeared after 0.2.1 update.

This should be fixed in Start 0.5.1. This was on Solid Start's part I believe. API routes weren't pre-processing the middleware.


Include MultiheadAttention module in C# API

We need the MultiheadAttention module by itself for some types of models.
Although MultiheadAttention is part of the transformer modules, it is also needed separately (i.e. outside of transformer) for some models.

It seems TorchSharp TorchText is now making critical progress.

@fwaris is there a plan to include unit tests and examples for MultiHeadAttention?

I have a unit test that is passing. It exercises the basic functionality.
I am working on porting the Temporal Graph Network model which requires MHA. Once done, I can create an example also.

@fwaris:
This is a good addition to TorchSharp, and we really value your contribution.
We're in the middle of moving this repository to a different organization (Xamarin is not the right long-term place for it), where we will have a proper Contributor License Agreement for all contributions, internal and external.
Therefore, we will hold off on merging this PR for a little bit.

An update: this repo will be moved to the .NET Foundation organization, after which we will have the CLA and can accept the contribution.

@fwaris, I would like to get this in and then do a NuGet release with it, so I'm going to merge the PR and address the requested changes in another PR.

thanks. I will rebase and make the request changes as another PR

thanks. I will rebase and make the request changes as another PR

@fwaris, there's no need. I already made the changes and they are in main now.

@fwaris  We are attempting to visualize MultiheadAttention  module within the transformer architecture. You input is appreciated.
:-)  I still looking forwards to your tests and samples on MultiheadAttention :-)

day job is keeping me very busy but I intend to complete the TGN model port (see above) port in the next few weeks. Only a few modules left to port.

@fwaris take your time. Thx for valuable voluntary contribution :-)


[BUG] At least 1 OpenSearchCon NA page has incorrect language at the bottom

Describe the bug
This page: https://opensearch.org/events/opensearchcon/2024/north-america/capture-the-flag.html
it's about the capture the flag event, but the language at the bottom is referencing the Open Source Connections paid training.
Expected behavior
I would expect some other language that Graylog has approved, or none at all, in this spot.
Screenshots
No response
To Reproduce
Go to the page linked in this issue and scroll to the bottom and read the text :)
Additional Details
Plugins
Please list all plugins currently enabled.
Screenshots
If applicable, add screenshots to help explain your problem.
Host/Environment (please complete the following information):

OS: [e.g. iOS]
Version [e.g. 22]

Additional context
Add any other context about the problem here.

Solved with #3178


Lax Node version in package.json

Currently, our Node version in package.json (bumped to 10 in #554) is very specific, and we should lax it a bit.
The proposed version is "node": ">=10.9.0 <11.0.0"

PR: #771


Add Database Setup

Changes

Add docker postgres start and stop scripts
Add database migrations

Please Review: @sagersmith8

+1 looks pretty good, could we maybe put them in their own folder though?

 Design Database


Changed includes to joins so .select() can still be used

I noticed that .select() cannot be used with a cancan loaded query, as .includes() actually renames the columns. If .includes() is changed to .joins(), you get the same result with the ability to use custom selects.

You dont get the same result. This is a hard problem a lot of people are trying to tackle.
Using joins performs an inner join, and thus can't be used with queries or logic that expect something similar to an outer join.

You may want to contribute to this: https://github.com/CanCanCommunity/cancancan/pull/238


Possibility to matching brackets in PHP files / or PHP language mode

It's possible to matching brackets in HTML code in PHP file or file which are in PHP language mode? In this same way as it is on HTML file / language mode

Same here

@MPMachado I don't think there's going to be a good way to support this so I ended up using the Hilighter extension and writing some regex for it. Here's mine:
   // PHP Tag
      "(<\\?php)((.|\n|\r)*?)(\\?>)": [
        {
          "borderWidth": "1px 0 0px 4px",
          "borderStyle": "solid",
          "borderColor": "#9075ac",
          "borderRadius": "0px",
          "backgroundColor": "rgba(33, 24, 28, 0.6)",
          "color": "#9075ac",
          "fontStyle": "bold",
          "fontWeight": "bold",
        },

        {
          "backgroundColor": "rgba(26, 18, 26, 0.4)",
          "borderWidth": "0px 0px 1px 0",
          "borderStyle": "solid",
          "borderColor": "#9075ac",
          "borderRadius": "0px",
        },

        {
          "borderWidth": "0px 4px 1px 0",
          "borderStyle": "solid",
          "borderColor": "#9075ac",
          "borderRadius": "0px",
          "backgroundColor": "rgba(15, 21, 31, 0.45)",
          "color": "#9075ac"
        },
      ],

It won't pair your current php tags but it does help visually see how stuff is structured.


[Editor] Enable multithread processing for the editor log.

Should improve editor responsiveness when large amount of messages are printed in the rapid succession.

Why's this a draft? I see a needs testing tag; what should be tested, exactly? I fail to see a case where this may fail, supposing that RichTextLabel's threaded mode is stable.

It likely needs testing in a real world situation, i.e. when errors are spammed by the engine while running a project. This can be simulated by calling push_error("...") in _process().

This should wait until threaded processing is fixed (https://github.com/godotengine/godot/pull/77157 or https://github.com/godotengine/godot/pull/77234).

Thanks!


nixos/rootston: Use an attribute set and the new keyboard configuration format

Motivation for this change
Rootston has a new preferred configuration format for the keyboard. E.g. with sway it works with environment variables like this:
export XKB_DEFAULT_LAYOUT=de,us
export XKB_DEFAULT_VARIANT=nodeadkeys
export XKB_DEFAULT_OPTIONS=grp:alt_shift_toggle,caps:escape

But the new preferred way is via the INI configuration file:
[keyboard]
layout=de,us
variant=nodeadkeys
options=grp:alt_shift_toggle,caps:escape

Because the keyboard section is already specified in the default configuration:
[keyboard]
meta-key=Logo

It probably makes sense to use an attrset instead. As a result config and extraConfig can be merged automatically and converted to the INI configuration format.
Things done

[x] Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
Built on platform(s)

[x] NixOS
[ ] macOS
[ ] other Linux distributions

[ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[ ] Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
[x] Tested execution of all binary files (usually in ./result/bin/)
[x] Fits CONTRIBUTING.md.

@gnidorah: Do you have an opinion on this approach? It makes it possible to extend and override the default configuration with extraConfig but it is probably a bit confusing (attrset vs INI), doesn't support comments (only within the Nix code), and doesn't look as nice in the configuration.nix man page (lib.generators.toPretty doesn't really help either).

Closing this PR due to 9db699e4a3cc307de51d9b90a1746e6b115efbbc and the linked issue. It was probably a bad idea from me to add this module in the first place (I thought it would be useful, but upstream stated that rootston isn't supposed to be packaged and we don't even have a module for Weston - I'll eventually remove this module). - Apologies


[TC-OO-2.3] Commands Failing OffWithEffect , OnWithRecallGlobalScene and OnWithTimedOff

Summary :
As per test plane the commands  OffWithEffect , OnWithRecallGlobalScene and OnWithTimedOff are to be send from the TH and should return a successful status, however when we try to use these commands in the YAML test scripts they seem to always fail, please refer attached screenshots and logs
Test plan Screenshot:

Spec Screenshot :

Log file and YAML execution Screenshot :
oo_2_3.txt

P3

We expect this is an issue in the DUT app, removing SDK requirements for test harness

@raju-apple @manjunath-grl What are the actual steps to reproduce here?

This issue was created by me using a account that i had to delete due to access issues, I will continue to follow these issues with my current id.

All 3 commands are working fine

@manjunath-grl so issue can be closed?

Yes. lets close this issue

Can be closed. Issue is resolved


Validate GID != 0

[!WARNING]
This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

Current dependencies on/for this PR:

main

PR #186

PR #187

PR #189   👈

This stack of pull requests is managed by Graphite.


new release needed ?

Hi @jrsquared, is it possible to publish a new release on npm with this fix that you recently merged on master db12de3aaf7c652edd0ecaab4c0235f576581248 thanks !

Released v.4.5.4, let me know if it works


fix php notice

$parsed_url['path'] is readed even if it's not instantiated.
The PR adds the variable instantiation if needed.

@edubacco Thanks for catching that. It sounds like parse_url doesn't return the path portion if the URL doesn't have a path and doesn't end with '/'. Can you update the PR to use a simple ternary operator? right now this tool does not require PHP 7 and I don't want to break backwards compatibility at this moment.

Hi @nicholasio, yes the problem is related to parse_url. I've pushed the edit to support php 5.6


cargo-pgx: 0.5.0 -> 0.5.3

Automatic update generated by nixpkgs-update tools. This update was made based on information from https://repology.org/metapackage/cargo-pgx/versions.
meta.description for cargo-pgx is: "Cargo subcommand for ‘pgx’ to make Postgres extension development easy"
meta.homepage for cargo-pgx is: "https://github.com/tcdi/pgx/tree/v0.5.1/cargo-pgx"
meta.changelog for cargo-pgx is: ""
Updates performed

Rust version update

To inspect upstream changes
Impact

Checks done (click to expand)

built on NixOS
The tests defined in passthru.tests, if any, passed
found 0.5.1 with grep in /nix/store/w2ha18hkxkvjg52y43m9cdnqqmnip1a5-cargo-pgx-0.5.1
found 0.5.1 in filename of file in /nix/store/w2ha18hkxkvjg52y43m9cdnqqmnip1a5-cargo-pgx-0.5.1

Rebuild report (if merged into master) (click to expand)

1 total rebuild path(s)

1 package rebuild(s)

First fifty rebuilds by attrpath
cargo-pgx

Instructions to test this update (click to expand)

Either download from Cachix:
nix-store -r /nix/store/w2ha18hkxkvjg52y43m9cdnqqmnip1a5-cargo-pgx-0.5.1 \
  --option binary-caches 'https://cache.nixos.org/ https://nix-community.cachix.org/' \
  --option trusted-public-keys '
  nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
  cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
  '

(The Cachix cache is only trusted for this store-path realization.)
For the Cachix download to work, your user must be in the trusted-users list or you can use sudo since root is effectively trusted.
Or, build yourself:
nix-build -A cargo-pgx https://github.com/r-ryantm/nixpkgs/archive/3a873d95b5cc942d2c5335f3de9ea3aa89ffbde7.tar.gz

After you've downloaded or built it, look at the files and if there are any, run the binaries:
ls -la /nix/store/w2ha18hkxkvjg52y43m9cdnqqmnip1a5-cargo-pgx-0.5.1
ls -la /nix/store/w2ha18hkxkvjg52y43m9cdnqqmnip1a5-cargo-pgx-0.5.1/bin

Pre-merge build results
We have automatically built all packages that will get rebuilt due to
this change.
This gives evidence on whether the upgrade will break dependent packages.
Note sometimes packages show up as failed to build independent of the
change, simply because they are already broken on the target branch.
Result of nixpkgs-review run on x86_64-linux 1

1 package built:

cargo-pgx

Maintainer pings
cc @typetetris for testing.

Automatic update generated by nixpkgs-update tools. This update was made based on information from https://repology.org/metapackage/cargo-pgx/versions.
meta.description for cargo-pgx is: "Cargo subcommand for ‘pgx’ to make Postgres extension development easy"
meta.homepage for cargo-pgx is: "https://github.com/tcdi/pgx/tree/v0.5.3/cargo-pgx"
meta.changelog for cargo-pgx is: ""
Updates performed

Rust version update

To inspect upstream changes
Impact

Checks done (click to expand)

built on NixOS
The tests defined in passthru.tests, if any, passed
found 0.5.3 with grep in /nix/store/d9ilx871fx7cldlvc1v15r82z89nvx35-cargo-pgx-0.5.3
found 0.5.3 in filename of file in /nix/store/d9ilx871fx7cldlvc1v15r82z89nvx35-cargo-pgx-0.5.3

Rebuild report (if merged into master) (click to expand)

1 total rebuild path(s)

1 package rebuild(s)

First fifty rebuilds by attrpath
cargo-pgx

Instructions to test this update (click to expand)

Either download from Cachix:
nix-store -r /nix/store/d9ilx871fx7cldlvc1v15r82z89nvx35-cargo-pgx-0.5.3 \
  --option binary-caches 'https://cache.nixos.org/ https://nix-community.cachix.org/' \
  --option trusted-public-keys '
  nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
  cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
  '

(The Cachix cache is only trusted for this store-path realization.)
For the Cachix download to work, your user must be in the trusted-users list or you can use sudo since root is effectively trusted.
Or, build yourself:
nix-build -A cargo-pgx https://github.com/r-ryantm/nixpkgs/archive/117c7160502d3f28c912d6a4e846eea81df61cda.tar.gz

After you've downloaded or built it, look at the files and if there are any, run the binaries:
ls -la /nix/store/d9ilx871fx7cldlvc1v15r82z89nvx35-cargo-pgx-0.5.3
ls -la /nix/store/d9ilx871fx7cldlvc1v15r82z89nvx35-cargo-pgx-0.5.3/bin

Pre-merge build results
We have automatically built all packages that will get rebuilt due to
this change.
This gives evidence on whether the upgrade will break dependent packages.
Note sometimes packages show up as failed to build independent of the
change, simply because they are already broken on the target branch.
Result of nixpkgs-review run on x86_64-linux 1

1 package built:

cargo-pgx

Maintainer pings
cc @typetetris for testing.


update avanier.studio

xoka, Devine. this is Josh (work profile lol). just wanted to update my webring entry :)

np :) thanks!


Ionic 3: Update SQLite documentation

Bug Report
Ionic Info
✔ Gathering environment info - done!

Ionic:

   ionic (Ionic CLI)  : 4.1.2 (/usr/lib/node_modules/ionic)
   Ionic Framework    : ionic-angular 3.9.2
   @ionic/app-scripts : 3.2.0

Cordova:

   cordova (Cordova CLI) : 8.0.0
   Cordova Platforms     : android 7.0.0
   Cordova Plugins       : cordova-plugin-ionic-keyboard 2.1.2, cordova-plugin-ionic-webview 2.1.4, (and 5 other plugins)

System:

   Android SDK Tools : 26.1.1 (/home/another/Android/Sdk)
   NodeJS            : v10.10.0 (/usr/bin/node)
   npm               : 6.4.1
   OS                : Linux 4.15

Describe the Bug
Following the SQLite plugin usage instructions found at https://ionicframework.com/docs/native/sqlite/ drives to an error.
Steps to Reproduce
Started a new project with ionic start sqlitetest blank.
Followed the instructions found in the documentation mentioned before and added this code to the default home.ts:
import { Component } from '@angular/core';
import { NavController } from 'ionic-angular';
import { SQLite, SQLiteObject } from '@ionic-native/sqlite';

@Component({
  selector: 'page-home',
  templateUrl: 'home.html'
})
export class HomePage {
  constructor(public navCtrl: NavController, private sqlite: SQLite) {}

  ionViewDidLoad() {
    console.log('EXECUTING ionViewDidLoad');

    this.sqlite
      .create({
        name: 'data.db',
        location: 'default'
      })
      .then((db: SQLiteObject) => {
        db.executeSql('create table danceMoves(name VARCHAR(32))', {})
          .then(() => console.log('Executed creation SQL'))
          .catch(e => console.log('Error executing creation SQL: ' + JSON.stringify(e)));
      })
      .catch(e => console.log('Error opening DB: ' + JSON.stringify(e)));
  }
}

Executed ionic cordova emulate android -lc and got a typescript error:

Related Code
I tried removing that offending parameter {} since it's optional. I executed it again and got these log messages:
[app-scripts] [19:22:04]  build finished in 4.94 s
[app-scripts] [19:22:06]  console.log: Angular is running in the development mode. Call enableProdMode() to enable the production
[app-scripts]             mode.
[app-scripts] [19:22:06]  console.log: EXECUTING ionViewDidLoad
[app-scripts] [19:22:06]  console.log: OPEN database: data.db
[app-scripts] [19:22:06]  console.log: OPEN database: data.db - OK
[app-scripts] [19:22:06]  console.log: Ionic Native: deviceready event fired after 1119 ms
[app-scripts] [19:22:06]  console.log: Error executing creation SQL: {"rows":{"length":0},"rowsAffected":0}

Finally, I tried to change that parameter to [], uninstalled the app, redeployed it, and it worked:
[cordova]  INSTALL SUCCESS
[cordova]  LAUNCH SUCCESS
[app-scripts] [19:24:39]  console.log: Angular is running in the development mode. Call enableProdMode() to enable the production
[app-scripts]             mode.
[app-scripts] [19:24:39]  console.log: EXECUTING ionViewDidLoad
[app-scripts] [19:24:39]  console.log: OPEN database: data.db
[app-scripts] [19:24:39]  console.log: OPEN database: data.db - OK
[app-scripts] [19:24:39]  console.log: Ionic Native: deviceready event fired after 1072 ms
[app-scripts] [19:24:39]  console.log: Executed creation SQL

Expected Behavior
The documentation is obsolete and I think SQLite is a pretty important plugin so it should be updated.
Additional Context
I'm opening this issue because I started a project before and I couldn't make SQLite work, so finally I had to change my app to use ionic-storage instead, despite its way of working isn't optimal for the application I'm currently developing. Please, update the documentation so no other programmer has the same problem I had.

I don't know if you're aware but you can make ionic-storage use SQLite when running on actual devices by simply adding the SQLite plugin.
From the docs:
"When running in a native app context, Storage will prioritize using SQLite, as it's one of the most stable and widely used file-based databases, and avoids some of the pitfalls of things like localstorage and IndexedDB, such as the OS deciding to clear out such data in low disk-space situations.
First, if you'd like to use SQLite, install the cordova-sqlite-storage plugin:
ionic cordova plugin add cordova-sqlite-storage"

@torsorensen I know it. It's not that what I'm talking about. With SQLite you can send queries to de DB and receive a filtered set of records. But with ionic-storage you only have a key-value style of saving and retrieving elements.

Actual Ionic Native issues live here: https://github.com/ionic-team/ionic-native/issues/

try changing the {} to []
{} is not a known datatype


Wrong type inferred on after reducing array of unknown

Bug Report

🔎 Search Terms
reduce, infer, unknown
🕗 Version & Regression Information

This is the behavior in every version I tried, and I reviewed the FAQ for entries about unknowns

⏯ Playground Link
Playground link with relevant code
💻 Code

const a1: unknown[] = [];
// here b should be of type Record<string, unknown> but it's unknown
const b1 = a1.reduce(x => x, {} as Record<string, unknown>);

const a2: any[] = [];
// here b should be of type Record<string, unknown> but it's any
const b2 = a2.reduce(x => x, {} as Record<string, unknown>);

const a3: number[] = [];
// it works ok with any other type
const b3 = a3.reduce(x => x, {} as Record<string, unknown>);

const a4: number[] = [];
// also it works with explicit type arguments
const b4 = a4.reduce<Record<string, unknown>>(x => x, {});

🙁 Actual behavior
Variables b1 and b2 are unknown and any respectively
🙂 Expected behavior
Variables b1 and b2 are Record<string, unknown>

TypeScript also doesn't look very smart when I use generic.
declare const arr: unknown[]

function foo<T extends string>() {
    const a = arr.reduce(acc => acc, {} as Record<T, string>)
    //    ^?
    const b = arr.reduce<Record<T, string>>(acc => acc, {})
...

Playground Link


Load FundingForm properly in reconfig

What does this PR do and why?

After redoing the V2ProjectContext, the fundingForm on the reconfig was no longer loading upcoming stuff. Fixed this (Closes #827 )
Hide upcoming tab and reword 'Reconfigure upcoming' -> 'Reconfigure' when duration is zero:

(Closes #828 )

Minor spelling mistake fixes brought to my attention by translators

Acceptance checklist

[ ] I have evaluated the Approval Guidelines for this PR.
[ ] I have tested this PR in all supported browsers.

MEERRRGGGGING


Confusing error message when passing a traced value to numpy.split

In the following code a traced value is passed to the num_or_indices parameter of numpy.split:
api.jit(lambda idx: np.split(np.zeros((6,2)), idx)(2)

The error messages include a chain of exceptions, neither of which :
IndexError: tuple index out of range

len() of unsized object

TypeError: Abstract value passed to `bool`, which requires a concrete value. The function to be transformed can't be traced at the required level of abstraction. If using `jit`, try using `static_argnums` or applying `jit` to smaller subfunctions instead.

Will change the error message to:
TypeError: In jax.numpy.split argument 2: tracer value encountered where a concrete value is expected.
Use `functools.partial` or transformation parameters such as `static_argnums` for `jit` to preserve the concrete value during JAX tracing.
See `https://jax.readthedocs.io/en/latest/jaxpr.html#tracer_must_be_concrete`.
Encountered value: Traced<ShapedArray(float32[], weak_type=True):JaxprTrace(level=-1/1)>


Trainer::XCResult: Remove ObjC Method Prefix and Suffix when sanitizing

Checklist

[x] I've run bundle exec rspec from the root directory to see all new and existing tests pass
[x] I've followed the fastlane code style and run bundle exec rubocop -a to ensure the code style is valid
[ ] I see several green ci/circleci builds in the "All checks have passed" section of my PR (connect CircleCI to GitHub if not)
[x] I've read the Contribution Guidelines
[x] I've updated the documentation if necessary.
[ ] I've added or updated relevant unit tests.

Motivation and Context
When matching failures, the identifier from ActionTestMetadata is compared against the testCaseName in TestFailureIssueSummary. Both strings are sanitised prior to comparison, but -[ and ] from the testCaseName are not removed. The comparison CrashTestTests_testExample == __CrashTestTests_testExample_ returns false and the failure is not recorded.
Resolves #22087
Description
The sanitizer in ActionTestMetadata.find_failure was updated to remove the ObjC method prefix and suffix, if present.
Testing Steps
See original CrashTest.zip in GitHub issue.

CI is broken at Setting Ruby version to 3.1.2 configuration stage.

I encountered the same issue months ago an opened an alternate PR at the time. See #21990.


Adding custom messaging during action steps

I wanted to try to add documentation for my new developers to explain what files are being added/modified during the action step. What i'm looking to have is this:
Adding necessary configuration files:
[SUCCESS] add <path>
[SUCCESS] add <path>

Modify your contents here:
[SUCCESS] add <path>
[SUCCESS] add <path>

Updating some other things you don't need to touch:
[SUCCESS] modify <path>

I was attempting to use the customActions for this, but it would print messages like this:
[SUCCESS] function Adding necessary configuration files:
[SUCCESS] add <path>
[SUCCESS] add <path>

Any thoughts on what I could do here?

I think at the very least, it would make sense to remove the function prefix that gets added to the customActionFunction message. 👍

@amwmedia I am going  to take a look into this.

You know, I was just thinking... what if we added the ability to just put strings into the actions array? So a list of actions could include strings instead of objects that would be pushed to the screen as the actions are run. That could provide some valuable documentation for what new new files are and how to they should be used.

I think it is a great idea, description property can be added to explain the purpose of the action.
If description property is added what is going to be the default where the property is specified.

I'd need something like that too, and a custom action fits my needs (I just skip a line for a bit more clarity). My problem is that some of my action take a while to finish but all the logging is batched to the end. That means that the user has no feedback of anything that's happening until all actions have finished, is there a way around that?

Thanks for the input. Sorry for the delay, I've been out of town for the last week.
I'd be open to either option here. I'm a little partial to the callback approach because it's very simple to understand, though I agree with your sentiment that this is kind of what generators are designed to do. I would only be concerned that the resulting code might not be quite as maintainable, but I'm willing to be proved wrong. 🙂
Overall, I think making the logging asynchronous is important, especially because custom action functions can return a Promise and take as long as they need.
We could also bring in something like ora to polish up the output experience.

Templating from answers would be nice to have.  I solved it this way:
        function thingCreated (answers) {
            const msg = 'thing created at {{place}}/{{id}}/';
            return plop.renderString(msg, answers);
        }

Pure strings are also nice.  Perhaps pure strings could always be assumed to run through plot.renderString?

Great call out! I'll definitely make sure that's added in.

released in v2.2.0


0.8 client oauth utils

Adds utilities for managing auth popups
This adds an openLoginPopup util function that takes a URL and opens an OAuth window (or whatever URL you give it) in a popup.  It also creates a global authAgent EventEmitter on the main page, which can be used to receive data from the popup after OAuth redirects.

Dang.  Those tests pass locally.  I didn't touch the failing ones.  This is probably due to adding the -jsdom stuff to the mocha tests for the new client stuff.  What I should probably do, instead, is setup the feathers-authentication-client repo to start with version 0.8 and move this stuff over to that repo.

This has been moved into its own repo: https://github.com/feathersjs/feathers-authentication-popups


USER STORY: Creator-page place holder

As an app developer, I will want to create a creator's page for when they successfully login they will be routed to their own page to use on the app.
Issues:

[ ] Create a placeholder creator's page
[ ] Creators are routed to the creator's page when successfully logged in

I have made the placeholder creator's page but I have technical issue with my gpg key as it is being skipped or not registering when trying to commit via VS code as I currently cannot commit anything to my branch as I'm troubleshooting the issue.

@krayzieeddi Did the issue get resolved? Please reach out to @Seiyaroo or I on Slack if you continue to have problems with this. There is some material we have available for this depending on what the specific commit issue is in terms of the gpg key.

Currently not yet but i will have time this weekend to troubleshoot
further. Worst case I'll contact Nicklas or BC.
On Fri, Jan 19, 2024 at 3:21 PM taylorpapke @.***>
wrote:

@krayzieeddi https://github.com/krayzieeddi Did the issue get resolved?
Please reach out to @Seiyaroo https://github.com/Seiyaroo or I on Slack
if you continue to have problems with this. There is some material we have
available for this depending on what the specific commit issue is in terms
of the gpg key.
—
Reply to this email directly, view it on GitHub
https://github.com/SeattleColleges/belindas-closet-nextjs/issues/146#issuecomment-1901284531,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/APGPIC6RT7W6Z64E3FQL7ULYPL5XTAVCNFSM6AAAAABCBLPXPCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMBRGI4DINJTGE
.
You are receiving this because you were mentioned.Message ID:
@.***>


cursor style

Description
i want to change the cursor style in website there we are using a normal cursor  I added screenshots.if you  don't like the cursor style which I chosen I will modify according to your wish please give label hacktoberfest and gssoc ext
Screenshots
from
https://github.com/user-attachments/assets/bafb93a0-f2e7-42e7-ae12-9dc073f712df
to
https://github.com/user-attachments/assets/611323f6-925f-45d9-b744-20e45e1c6d17
Checklist

[X] I have checked the existing issues
[X] I have read the Contributing Guidelines
[X] I'm a GSSoC'24-Extd contributor
[X] I'm a Hacktoberfest'24 contributor
[X] I am willing to work on this issue (optional)

Hello @abhi200446, this is a very good feature, but according to our website, it will not look good. Try to find any other bugs or features, which I am happy to assign to you. Thank you!

Please don't forget to give our repository a star and let me know once you've done it.

Hey, I just starred the repository

if u wish i want to add discord at the social media section please assign me to do my first contribution @pr


Is it possible to increase the ecj's jvm memory limit?

Hey there, thanks for creating this plugin.
Is there a way to increase the java memory limit when loading ecj? Thanks.

Hmmm, looks like I can just keep using the JavaCompile task and add some jvmArgs on forkOptions.
tasks.withType<JavaCompile> {
    options.forkOptions.jvmArgs =  listOf("-Xms2048m", "-Xmx4096m")
}

It seems worked.

By the way, I was trying to speed up the build by increasing more memory, but I guess I am actually CPU bounded. The ecj compiling works much slower if I just use the usual javac compiler. Not sure if there is some good way can speed things up.

Hi @liufuyang, as you already found out, you can configure ECJ just like you would configure javac in Gradle.

By the way, I was trying to speed up the build by increasing more memory, but I guess I am actually CPU bounded. The ecj compiling works much slower if I just use the usual javac compiler. Not sure if there is some good way can speed things up.

From my experience, the compilation speed heavily depends on the program. For example, ECJ is significantly better at compiling methods with many (dozens) overloads. In the past javac had some issues with generic bounds in some edge-cases, but since most of these are fixed now, I rarely use ECJ anymore.

Aha, that is nice to know. Thank you so much. And yes I suppose in our case it would be ideal if we could also use javac. However the project is large and many old code lines give errors when complied with javac. Perhaps one day we can fix all the places and make our code compiler agnostic :)


Add support for Microtek Solar Grid Tie 3.3KW-M11

this is rebranded Sofa inverter in India
grid tied single phase 1 PV
configs are based on sofar_lsw3 since logger stick is running LSW3_15_FFFF_1.0.89R firmware
product page

Do you have any issues w/ sofar_lsw3.yaml (2MPPT instead of 1MPPT)?

Configuring number of MPPT feature is done and will be part of next release so there is no need of "duplicate of sofar_lsw3.yaml".
You can you use it and in the device configuration select number of trackers: 1
😉


Report additional fields in validation stream:

The HardenedValidations amendment introduces additional fields in validations:

sfValidatedHash, if present, is the hash the of last ledger that the validator considers to be fully validated.
sfCookie, if present, is a 64-bit cookie (the default implementation selects it randomly at startup but other implementations are possible), which can be used to improve the detection and classification of duplicate validations.
sfServerVersion, if present, reports the version of the software that the validator is running. By surfacing this information, server operators gain additional insight about variety of software on the network.

If merged, this commit fixes #3797 by adding the fields to the validations stream as shown below:

sfValidateHash as validated_hash: a 256-bit hex string;
sfCookie as cookie: a 64-bit integer as a string; and
sfServerVersion as server_version: a 64-bit integer as a string.

Type of Change

[ ] Bug fix (non-breaking change which fixes an issue)
[X] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
[ ] Refactor (non-breaking change that only restructures code)
[ ] Tests (You added tests for code that already exists, or your new feature included in this PR)
[X] Documentation Updates
[ ] Release

Tagging @wilsonianb's who originally opened #3797.

Code looks good. Can we add a unit test for this?

I'll check.

This pull request has been sitting for a while.
The request was for unit tests, so I added to a preexisting test to see if I could un-stall the pull request: https://github.com/scottschurr/rippled/commit/eeb1d41ec11f9dec742b9598326b6bc4fe1d2889  Consider adding that unit test or something like it.  You are welcome to cherry-pick that one if you'd like.
The code itself looks good to me.  I'll thumbs up once the test is added.

I'm terribly sorry I'm not sure how a pull request was created but I didnt
submit it.
On Wed, May 12, 2021, 12:05 PM Scott Schurr @.***>
wrote:

This pull request has been sitting for a while.
The request was for unit tests, so I added to a preexisting test to see if
I could un-stall the pull request: @.***
https://github.com/scottschurr/rippled/commit/eeb1d41ec11f9dec742b9598326b6bc4fe1d2889
Consider adding that unit test or something like it. You are welcome to
cherry-pick that one if you'd like.
The code itself looks good to me. I'll thumbs up once the test is added.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/ripple/rippled/pull/3802#issuecomment-839945601, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/ANGXHFZRKLL6477GS2WHX73TNKYPHANCNFSM4Z7CMR5Q
.

@nbougalis, this pull request has been sitting untended for close to two months.  It's missing unit tests, which I believe you can cherry-pick from here: https://github.com/scottschurr/rippled/commit/eeb1d41ec11f9dec742b9598326b6bc4fe1d2889
I know that a) you're really busy, b) you're working with only one hand, and c) this pull request is not your highest priority.
If you would like I can take over this pull request and shepherd it through the process so we can get this code into develop.  Let me know if that would be helpful.


Access to the path '/mnt/mediaStorage/data/movies/Interstellar (2014)/trickplay' is denied

I use Proxmox with Jellyfin, Radarr, Sonarr etc in a separate priviliged LXC.
I installed the Jellyscrub and Intro Skipper Plugin (incase it matters). First Jellyscrub didnt inject the script correctly so I did it manually but I figured that it still didn't work.
So I checked the logs and get errors in every folder that "trickplay" is trying accessing to. Every show and movie.
"/mnt/mediaStorage" is added through a mountpoint, the folders are created on the proxmox shell itself. (Up to the point of "/shows" and "/movies")
EDIT: I changed the setting to save it not in the same directory as the media files., but it still does not work. Logfiles arent showing any errors anymore tho...
[2024-01-20 03:16:58.164 +01:00] [INF] Creating trickplay files at 320 width, for "/mnt/mediaStorage/data/movies/Interstellar (2014)/Interstellar (2014).mkv" [ID: ab8d9137-5469-c57b-ed0f-26c64d14dc59] [2024-01-20 03:16:58.165 +01:00] [INF] /usr/lib/jellyfin-ffmpeg/ffmpeg -loglevel error -init_hw_device vaapi=va:,kernel_driver=i915,driver=iHD -init_hw_device qsv=qs@va -filter_hw_device qs -hwaccel vaapi -hwaccel_output_format vaapi -autorotate 0 -i file:"/mnt/mediaStorage/data/movies/Interstellar (2014)/Interstellar (2014).mkv" -autoscale 0 -an -sn -vf "fps=1/10,setparams=color_primaries=bt709:color_trc=bt709:colorspace=bt709,scale_vaapi=w=320:h=180:format=nv12:extra_hw_frames=24,hwmap=mode=read,format=nv12" -threads 0 -c:v mjpeg -f image2 "/var/cache/jellyfin/temp/94a21b8d1f2f4653986181c08f2038de/img_%08d.jpg" [2024-01-20 03:16:58.165 +01:00] [INF] Setting generation process priority to BelowNormal [2024-01-20 03:24:06.284 +01:00] [ERR] Error while creating BIF file System.UnauthorizedAccessException: Access to the path '/mnt/mediaStorage/data/movies/Interstellar (2014)/trickplay' is denied.  ---> System.IO.IOException: Permission denied
EDIT: Had a permission issue with HWA but I got it right. Still got errors:
[2024-01-20 23:04:52.670 +01:00] [INF] Creating trickplay files at 320 width, for "/mnt/mediaStorage/data/shows/Reacher/Staffel 2/Reacher - S02E01 - ATM.mkv" [ID: 71cb3f8b-bc89-5481-6ba7-fa96ca591785] [2024-01-20 23:04:52.695 +01:00] [INF] /usr/lib/jellyfin-ffmpeg/ffmpeg -loglevel error -threads 0 -autorotate 0 -i file:"/mnt/mediaStorage/data/shows/Reacher/Staffel 2/Reacher - S02E01 - ATM.mkv" -an -sn -vf

I haven't used Proxmox containers personally but the permission issue is likely due to a misconfiguration on the attached volume (e.g. container only has read permission in Proxmox) or the jellyfin container is running as a user that does not have permission at a filesystem level. For instance, linuxserver.io containers by default run processes as non-root users, so it may be that the movie files are owned by a separate user from the one running jellyfin. You should be able to check by attaching a terminal to the jellyfin container and doing ls -la /mnt/mediaStorage/data/shows/ and then ps aux to see if the users/groups match up.
As for your second edit, those are just info logs about generation. If you look for shows that have logged "trickplay generation complete for..." and go to them in jellyfin do you not see previews? If so, make sure that you have cleared your browser cache & cookies for the jellyfin website as the client script may not be running.

I haven't used Proxmox containers personally but the permission issue is likely due to a misconfiguration on the attached volume (e.g. container only has read permission in Proxmox) or the jellyfin container is running as a user that does not have permission at a filesystem level. For instance, linuxserver.io containers by default run processes as non-root users, so it may be that the movie files are owned by a separate user from the one running jellyfin. You should be able to check by attaching a terminal to the jellyfin container and doing ls -la /mnt/mediaStorage/data/shows/ and then ps aux to see if the users/groups match up.
As for your second edit, those are just info logs about generation. If you look for shows that have logged "trickplay generation complete for..." and go to them in jellyfin do you not see previews? If so, make sure that you have cleared your browser cache & cookies for the jellyfin website as the client script may not be running.

The folders are owned but root:root
drwxrwxrwx 4 root root 4096 Jan 20 19:47  . drwxrwxrwx 6 root root 4096 Jan 19 11:10  .. drwxr-xr-x 3 root root 4096 Jan 20 19:47  Reacher drwxr-xr-x 5 root root 4096 Jan 19 22:53 'The Simpsons'
And PID of Jellyfin is 1299
ellyfin    1299  0.0  3.2 4356876 268492 ?      Ssl  00:02   1:35 /usr/bin/jell
Changing ownership of the storage path to 1299 would probably break sonarr/radarr, tho I'm not sure.

I haven't used Proxmox containers personally but the permission issue is likely due to a misconfiguration on the attached volume (e.g. container only has read permission in Proxmox) or the jellyfin container is running as a user that does not have permission at a filesystem level. For instance, linuxserver.io containers by default run processes as non-root users, so it may be that the movie files are owned by a separate user from the one running jellyfin. You should be able to check by attaching a terminal to the jellyfin container and doing ls -la /mnt/mediaStorage/data/shows/ and then ps aux to see if the users/groups match up.
As for your second edit, those are just info logs about generation. If you look for shows that have logged "trickplay generation complete for..." and go to them in jellyfin do you not see previews? If so, make sure that you have cleared your browser cache & cookies for the jellyfin website as the client script may not be running.

The folders are owned but root:root drwxrwxrwx 4 root root 4096 Jan 20 19:47 drwxrwxrwx 6 root root 4096 Jan 19 11:10  drwxr-xr-x 3 root root 4096 Jan 20 19:47 Reacher drwxr-xr-x 5 root root 4096 Jan 19 22:53 'The Simpsons'
And PID of Jellyfin is 1299 jellyfin 1299 0.0 3.2 4356876 268492 ? Ssl 00:02 1:35 /usr/bin/jell
Changing ownership of the storage path to 1299 would probably break sonarr/radarr, tho I'm not sure. But is it still needed if I opt out the settings to save the BIF file in the same directory of the media?
I do not see any previews, only the default 5 min intervall previews, tho sometimes the smaller box of probably jellyscrub pops up, not shows a grey picture.

It's not needed if you're storing it in the jellyfin metadata folders.

I haven't used Proxmox containers personally but the permission issue is likely due to a misconfiguration on the attached volume (e.g. container only has read permission in Proxmox) or the jellyfin container is running as a user that does not have permission at a filesystem level. For instance, linuxserver.io containers by default run processes as non-root users, so it may be that the movie files are owned by a separate user from the one running jellyfin. You should be able to check by attaching a terminal to the jellyfin container and doing ls -la /mnt/mediaStorage/data/shows/ and then ps aux to see if the users/groups match up.
As for your second edit, those are just info logs about generation. If you look for shows that have logged "trickplay generation complete for..." and go to them in jellyfin do you not see previews? If so, make sure that you have cleared your browser cache & cookies for the jellyfin website as the client script may not be running.

The folders are owned but root:root drwxrwxrwx 4 root root 4096 Jan 20 19:47 drwxrwxrwx 6 root root 4096 Jan 19 11:10  drwxr-xr-x 3 root root 4096 Jan 20 19:47 Reacher drwxr-xr-x 5 root root 4096 Jan 19 22:53 'The Simpsons'
And PID of Jellyfin is 1299 jellyfin 1299 0.0 3.2 4356876 268492 ? Ssl 00:02 1:35 /usr/bin/jell
Changing ownership of the storage path to 1299 would probably break sonarr/radarr, tho I'm not sure. But is it still needed if I opt out the settings to save the BIF file in the same directory of the media?
I do not see any previews, only the default 5 min intervall previews, tho sometimes the smaller box of probably jellyscrub pops up, not shows a grey picture.

It's not needed if you're storing it in the jellyfin metadata folders.

Omg I'm dumb. I needed to inject the script manually and I did before the opening  tag instead of the closing  tag.
I placed it at the right side, ran a BIF Generating Job to besure and it works after around 5-10 Seconds into a video. I guess I would have never looked at it, because I thought I placed it at the right place.
Now the script is not at the end of the  tag but in the middle of the body tag, along with a


Two errors about token limits and rate per minute limits in autogen_agentchat_groupchat_research, agentchat_teaching

I got this error in notebook/autogen_agentchat_groupchat_research.ipynb
error:
Rate limit reached for default-gpt-4 in organization org-dRcLOmvP4zyFH42QuipEteyV on tokens per min. Limit: 40000 / min. Please try again in 1ms. Contact us through our help center at help.openai.com if you continue to have issues.
got it too, in notebook/agentchat_teaching.ipynb
error :
InvalidRequestError: This model's maximum context length is 8192 tokens. However, your messages resulted in 9297 tokens. Please reduce the length of the messages.
Please modify the code so that it works even if it is only used as an OPENAI API, or provide a guide to apply for an AZURE API KEY.

#131 #156 #195

We are closing this issue due to inactivity; please reopen if the problem persists.


Can't pass empty int slices

I have a IntSliceVar flag called groups. I can't seem to be able to pass empty slices in any way:
If I use --groups=[],
Error: invalid argument "[]" for "--groups" flag: strconv.Atoi: parsing "[]": invalid syntax
If I use --groups="",
Error: invalid argument "" for "--groups" flag: strconv.Atoi: parsing "": invalid syntax
Is there another syntax I'm missing?
This is part of a command-line program that uses cobra but I believe the problem to be within pflag (even though the error handling, that is printing the above errors and returning before I can get to my command handler, appears to be within cobra).

What is the use-case here? Why do you need to pass in an empty integer? That would just be 0 wouldn't it?

It's not an empty integer, it's an empty integer slice.

Oh right. I misread. I'm still curious what the use-case is. Why do you need to pass in an empty slice? Can you not set empty slice as a default and avoid passing in the flag at all?

The use case is implementing the following interface on a command to edit a resource:

Absence of flag: the field is not edited at all
Presence of flag with empty slice: the field is edited to become the empty list
Presence of flag with non-empty slice: the field is edited to become the passed list

Happy to deliver a PR with implementation if dev team agrees this feature is welcome :-)


Enable testing with file DB and fix bug in connection handling

I noticed that the tests are only run against a :memory: database. This PR modifies the tests according to the dbt documentation to add testing profiles, allowing to switch between an in-memory and file-backed DuckDB backend (memory is kept as the default). The test can be run using a file by running pytest --profile file.
This change surfaces a bug in the Environment class, where the connection is prematurely closed due to the handles counting. I think that the Environment.close(cursor) behaviour is unwanted both for memory as file databases, which would make the handle counting unneeded as well. I simplified the implementation, fixing the issue, but I'm not sure if the handle counting served another purpose?
I suppose the tox.ini and github workflows should be updated as well to include the second testing path, but I'll let you review these changes first. Thanks!

Happy to help! Should I update the tox and workflow, or how do you want to proceed?

Realizing it's pretty late in Belgium, gonna go the merge-and-chatgpt-it route


Add support for Star Projector SK20 on Tuya CBU module.

I bought a new Star Projector SK20.
Here is its dump.
ltchiptool_bk72xx_2024-11-05_14-44-59.zip

And I wanted to flash it as in this article https://github.com/M4GNV5/esphome-SK20-Nebula-Light. But I couldn't even switch the device to AP mode. I tried many times and in different ways to turn it on, but I didn't succeed. After searching for additional information, I found that this behavior is not only mine, but also other people, for example here https://github.com/tuya-cloudcutter/tuya-cloudcutter/issues/668. As a result, I decided to reflash it via a cable. Having opened the projector, I found that it is on the Tuya CBU module, and has a different schematic board. I couldn't read the firmware without unsoldering the module, perhaps I made a mistake and did not swap the TX - RX pins as in the ltchiptool documentation. As a result, I unsoldered the module and was able to read the installed firmware, and successfully reflashed it to the basic ESPHome firmware. Now I am creating a firmware config for the excellent operation of this device.
The installed firmware on the device in SmartLife was "Main module: V2.0.2", "Microcontroller module: V2.0.2"

I think without disassembling it is possible to determine that you have a model on the Tuya CBU chip by the button LED, it always lights up when the power is on, and the device cannot switch to AP mode, it only blinks with a fast signal. If you disassemble the device, it looks like this.

It would be great if, based on the firmware analysis, you could tell how to switch the device to AP mode, and whether it is possible to flash it via Tuya Cloudcutter. Well, if not, then let the community know about it.

Added as Tuya Generic SK20 Star Projector v2.0.2
This device appears to requires either 10x power cycles or a 10 second button press to change between pairing modes, unsure which.

So I have SK23, and it also running CBU.
I had to solder my UART/TTL adapter and change some pins.
My version of software mostly works, but I have a feeling that not everything is ported properly.
https://github.com/Flumeded/esphome-SK23-Nebula-Light
Visually your board looks the same as mine in SK23, so firmware might be the same, as well as pinout

So I have SK23, and it also running CBU. I had to solder my UART/TTL adapter and change some pins. My version of software mostly works, but I have a feeling that not everything is ported properly.
https://github.com/Flumeded/esphome-SK23-Nebula-Light
Visually your board looks the same as mine in SK23, so firmware might be the same, as well as pinout

I looked at your yaml file. Yes, I have the same pinout as you. And what about your reset button, what exactly does not work? I am currently working on an extended firmware for my SK20. I have implemented such functionality as additional scenes, support for button multiclick, with sending events to Home Assistant (such as single, double click, hold and release hold), support for a locally running timer with the ability to configure from Home Assistant, support for restoring the last selected scene and additional sensors. When I finish, I will create a repository and post my developments.

AP mode worked for me with:

Power
7 second hold until it is off
7 second hold again

source:
https://community.home-assistant.io/t/tuya-smart-galaxy-projector/354691/19?u=ajfriesen