bluealsa fails to start

First off, thank you for this piece of software... I think it's great.  There is one issue that we have yet to solve in an acceptable manner.  If we put an init script to start bluez-alsa right after the init script to start bluetoothd bluealsa fails to start and we have a device that won't produce audio.  I can move the bluez-alsa init script later, and sometimes it works and sometimes it does not.  I am assuming this is because something in bluetoothd has not finished initializing.  Is there a way that bluez-alsa can query bluetoothd to find out if it is ready to run so that the init script will successfully start bluealsa every time?

Some logs would be nice.... I'm not able to reproduce, aka works for me.

Except that the bluethootd is running, you need to have the device connected (ex. bluetoothctl connect)
you device autoconnect on system start?

On 2018-02-19 16:39, Pro-pra wrote:

Except that the bluethootd is running, you need to have the device
connected (ex. bluetoothctl connect)
you device autoconnect on system start?
--
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub [1], or mute the
thread [2].

Links:
[1] https://github.com/Arkq/bluez-alsa/issues/81#issuecomment-366827748
[2]
https://github.com/notifications/unsubscribe-auth/AhtyGOe-QkNF5gXpLzYeOaWsi37j1H0Jks5tWgZFgaJpZM4RbqIH

Arkq,
Thank you for your reply.  What we had was the bluetoothd start with an
init script, and tried to start bluez-alsa with an init script after.
Apparently there has to be some time before starting bluez-alsa because
the hci device doesn't become ready very fast in bluetoothd.   Our
solution was to add a udev rule to wait for hci0 to become available
then to start bluez-alsa.  It would seem that this issue should be
closed with a resolved status.
Thanks again,
Tom

was to add a udev rule to wait for hci0 to become available

please post udev rule for wait hci0, it's intresting

where the bluez-alsa.sh script is a standard rc script....
Initialize bluetooth audio when hci0 becomes available
KERNEL=="hci0", SUBSYSTEM=="bluetooth", ACTION=="add", RUN+="/etc/init.d//bluez-alsa.sh start"

There might be a "systemd way" to do this, as systemd units can depend on not only services and targets, but als devices. I tried to add something like
After=sys-subsystem-bluetooth-devices-hci0.device

to /lib/systemd/system/bluealsa.service, but somehow this did not work. Maybe someone with more systemd expertise than me can have a look at this?
Also, I added a systemd script that starts a bluealsa-aplay process listening on all devices:
[Unit]
Description=BlueALSA player
Requires=bluealsa.service
After=bluealsa.service
Wants=bluetooth.target sound.target

[Service]
Type=simple
User=root
ExecStartPre=/bin/sleep 2
ExecStart=/usr/bin/bluealsa-aplay --pcm-buffer-time=250000 00:00:00:00:00:00
Restart=on-failure

[Install]
WantedBy=graphical.target

(Also, the sleep 2 feels somewhat ugly but is necessary, as the unit does not seem to wait for bluealsa to be fully available...)

Well, this is an imbeded system, and we're also kind of anti-systemd, so
the udev method was the best way for us
Thanks,
Tom
On 2018-02-23 16:43, Nico Kaiser wrote:

There might be a "systemd way" to do this, as systemd units can depend
on not only services and targets, but als devices. I tried to add
something like
After=sys-subsystem-bluetooth-devices-hci0.device
to /lib/systemd/system/bluealsa.service, but somehow this did not
work. Maybe someone with more systemd expertise than me can have a
look at this?
Also, I added a systemd script that starts a bluealsa-aplay process
listening on all devices:
[Unit]
Description=BlueALSA player
Requires=bluealsa.service
After=bluealsa.service
Wants=bluetooth.target sound.target
[Service]
Type=simple
User=root
ExecStartPre=/bin/sleep 2
ExecStart=/usr/bin/bluealsa-aplay --pcm-buffer-time=250000
00:00:00:00:00:00
Restart=on-failure
[Install]
WantedBy=graphical.target
(Also, the sleep 2 feels somewhat ugly but is necessary, as the unit
does not seem to wait for bluealsa to be fully available...)
--
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub [1], or mute the
thread [2].

Links:
[1] https://github.com/Arkq/bluez-alsa/issues/81#issuecomment-368171444
[2]
https://github.com/notifications/unsubscribe-auth/AhtyGOv5DGYTGJw_diFQCIxyWFlM1cQKks5tX00LgaJpZM4RbqIH

It seems to be resolved. Closing.


$PROFILE_OPT empty when working with assumed roles

Hi,
I'm trying to get Prowler working with assumed roles when executing the ./prowler -c checkXX -M html -p awsProfileWithSwitchRole -r region -A targetAccountId -R AssumedRole from my local machine. The issue is that I get 'Unable to locate credentials. You can configure credentials by running "aws configure".' and 'parse error: Invalid numeric literal at line 2, column 7' error messages.
From what we've found so far we can say the following things:

The 'Unable to locate credentials. You can configure credentials by running "aws configure".' errors are not handled in include/assume_role
The 'assume_role()'-function gets executed multiple times. The first time it gets executed correctly, but the executions after that execute it with the '$PROFILE_OPT' variable empty.
With the provided hotfix (https://gist.github.com/toniblyx/f93e68c58e766be3be09a861d19ec718), no errors are shown, but the checks are executed on the 'awsProfileWithSwitchRole'-account and not on the 'targetAccountId'-account (as it should).

Thanks for reporting this issue and discuss it over Discord as well @DB-Vincent.

I'm having the same issue and I found out that the latest version that works with assume_role seems to be prowler-2.3.0-18122020.
I did a diff on the two include/assume_role files: they are a bit different but I think something else is involved (credentials_report file for sure) and I was not able to fix the latest version

Thanks @halfluke that is a very helpful finding. I'll give it a look and see what is going on but please feel free to add here possible fixes if you find them.

I can confirm, prowler-2.3.0-18122020 works on my machine.

@halfluke as per @DB-Vincent finding, can you test it by making this change in prowler file? line 136, from this:
     p )
        PROFILE=$OPTARG
        ;;

to this:
     p )
        PROFILE=$OPTARG
        AWS_PROFILE=$OPTARG
        ;;

Not sure if this is the best way to solve the issue, however I have to diff 2.3 and latest to see what changes added this bug.

my gut feeling says that could be when I added the feature of reneweing temporary credentials...

I feel obligated to mention that this is just a work around and that this probably isn't best practice. But it's a start!

it doesn't seem to work either... I spent some hours trying to troubleshoot but no luck tbh
with change in line 136 + gist hotfix for assume_role file:
Date: Thu Nov 25 06:59:02 AM EST 2021
Access Denied trying to describe regions! Review permissions as described here: https://github.com/toniblyx/prowler/#requirements-and-installation
with change in line 136 only:
Date: Thu Nov 25 06:53:01 AM EST 2021
parse error: Invalid numeric literal at line 2, column 7
parse error: Invalid numeric literal at line 2, column 7
parse error: Invalid numeric literal at line 2, column 7
parse error: Invalid numeric literal at line 2, column 7
Generating AWS IAM Credential Report... -  []
WARNING! Generate credential report unsuccessful
A csv file is generated with the correct account name but it has only one line...

Ok, I have tested this diff in my environment and it is working fine for this command ./prowler -g cislevel1 -M html -p<PHONE_NUMBER>2_AWSAdministratorAccess -r us-east-1 -A<PHONE_NUMBER>1 -R ProwlerExecRole
diff --git a/include/assume_role b/include/assume_role
index 95bd3e0..7445e51 100644
--- a/include/assume_role
+++ b/include/assume_role
@@ -58,6 +58,10 @@ assume_role(){
       textFail "The requested DurationSeconds exceeds the MaxSessionDuration set for the role ${PROWLER_ROLE}"
       EXITCODE=1
       exit $EXITCODE
+    elif [[ "$(grep ExpiredToken $TEMP_STS_ASSUMED_FILE)" ]]; then
+      textFail "ExpiredToken error with role: ${PROWLER_ROLE} and AWS Profile settings: $PROFILE_OPT"
+      EXITCODE=1
+      exit $EXITCODE
     fi

     # assume role command
@@ -76,8 +80,10 @@ assume_role(){
     fi

     # The profile shouldn't be used for CLI
-    PROFILE=""
-    PROFILE_OPT=""
+    if [[ $PROFILE == 'default' ]]; then
+        PROFILE=""
+        PROFILE_OPT=""
+    fi

Could you guys test it? Don't change anything in prowler file code.

sorry but... what do I change in assume_role?

grab it from here, it is easier :) https://gist.github.com/toniblyx/8d4e5e2420b2185332ab35af067f8470

Access Denied trying to describe regions! Review permissions as described here: https://github.com/toniblyx/prowler/#requirements-and-installation
and if I comment out get_regions in the main prowler file:
Generating AWS IAM Credential Report... -  []
WARNING! Access Denied trying to generate credential report
the regions error is handled differently in Prowler 2.3.0.xxxx: I still get it but the script proceeds
I bet the real problem is the second one: the newest versions try to generate credentials report for the CALLER account, not for the "assumed role" account. I think you dont notice because you have permissions on the caller account as well... but I don't in my environment

are you replacing that file in the latest release from master branch? Can you share the exact command you are running. when running aws sts get-caller-identity that principal can assume the role properly and that assumed role has enough permissions? It sounds more like a permissions issue. Deploy this template in the target account and it will help you to make sure that prowler has the right permissions https://github.com/toniblyx/prowler/blob/master/iam/create_role_to_assume_cfn.yaml

can you share what permission do you have in the source account? I'll try to replicate

unfortunately it's on a client account that I cannot change. The role I assume has SecurityAudit in the target account. The keys I have are for a user that can "switch role" and assume the role I need to audit the target account.
It is a sort of permission issue... but in prowler 2.3.0 it works :)
With the 2.3.0 version of Prowler I have:
└─# ./prowler -p profile -A targetaccount -R roleinthetargetaccount -g cislevel1 -M csv,mono
An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
_
_ __  _ __ _____      | | ___ _ __
| ' | '/ _ \ \ /\ / / |/ _ \ '|
| |) | | | () \ V  V /| |  / |
| ./||  ___/ _/_/ ||___||v2.3.0-18122020
|| the handy cloud security tool
Date: Thu Nov 25 11:18:15 AM EST 2021
This report is being generated using credentials below:
AWS-CLI Profile: [Profile] AWS API Region: [us-east-1] AWS Filter Region: [all]
AWS Account: [xxxxx] UserId: [xxxxxxxxxxxx]
Caller Identity ARN: [arn:aws:iam::CALLER_ACCOUNT:user/USER_IN_THE_CALLER_ACCOUNT]
5.0 CIS Level 1 - CIS only - [cislevel1] ***************************

ok, the source account has permissions only to assume a role targed account. I have to test that, also remember that with SecurityAudit role only Prowler may be unable to make all checks.

oh and yes, I replaced the file of the gist in the latest release of course. I had reached that point with my experiments.
Perhaps also @DB-Vincent  has a similar configuration and limitation of permissions but... did you check if with your "fix" prowler actually runs the credential reports (and the CIS benchmark) on the source instead of the target?
I asked /job-function/ViewOnlyAccess permission on the target as well but I can see a terraform policy is attached to my role instead... clients!

@toniblyx I just tested this in my environment, and I do not get any error messages. However, the checks get executed on the awsProfileWithSwitchRole and not the targetAccount.

ok, I could finally replicate that case in the latest version and seen that initial credentials are unset that is why assume role works first then gets unset due to a bug in the reload credentials logic.

Just to clarify for other users. This bug, initially only affects to those users running Prowler manually in account A that assumes a role in account B by using a custom profile set up in thir own ~/.aws/credentials. For those using EC2 instance or containers with a role attached it does not affect them.

great stuff, i was not able to figure out the "unset" part and the fact that I also have limited permissions mixed things up. But you are the author for a reason :)

Hi @DB-Vincent,
Can you execute it again with the following assume_role file?
#!/usr/bin/env bash

# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy
# of the License at http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software distributed
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
# specific language governing permissions and limitations under the License.

# both variables are mandatory to be set together
assume_role(){
    if [[ -z $ROLE_TO_ASSUME ]]; then
        echo "$OPTRED ERROR!$OPTNORMAL - Both Account ID (-A) and IAM Role to assume (-R) must be set"
        exit 1
    fi
    # if not session duration set with -T, then will be 1h.
    # In some cases you will need more than 1h.
    if [[ -z $SESSION_DURATION_TO_ASSUME ]]; then
        SESSION_DURATION_TO_ASSUME="3600"
    elif [[ "${SESSION_DURATION_TO_ASSUME}" -gt "43200" ]] || [[ "${SESSION_DURATION_TO_ASSUME}" -lt "900" ]]; then
        echo "$OPTRED ERROR!$OPTNORMAL - Role session duration must be more than 900 seconds and less than 4300 seconds"
        exit 1
    fi

    # temporary file where to store credentials
    TEMP_STS_ASSUMED_FILE=$(mktemp -t prowler.sts_assumed-XXXXXX)

    # check if role arn or role name
    if [[ $ROLE_TO_ASSUME == arn:* ]]; then
        PROWLER_ROLE=$ROLE_TO_ASSUME
    else
        PROWLER_ROLE=arn:${AWS_PARTITION}:iam::$ACCOUNT_TO_ASSUME:role/$ROLE_TO_ASSUME
    fi

    #Check if external ID has bee provided if so execute with external ID if not ignore
    if [[ -z $ROLE_EXTERNAL_ID ]]; then
        # assume role command
        if ! $AWSCLI $PROFILE_OPT sts assume-role --role-arn $PROWLER_ROLE \
            --role-session-name ProwlerAssessmentSession \
            --region $REGION_FOR_STS \
            --duration-seconds $SESSION_DURATION_TO_ASSUME > $TEMP_STS_ASSUMED_FILE
        then
            EXITCODE=1
            exit $EXITCODE
        fi
    else
        if ! $AWSCLI $PROFILE_OPT sts assume-role --role-arn $PROWLER_ROLE \
            --role-session-name ProwlerAssessmentSession \
            --duration-seconds $SESSION_DURATION_TO_ASSUME \
            --region $REGION_FOR_STS \
            --external-id $ROLE_EXTERNAL_ID > $TEMP_STS_ASSUMED_FILE
        then
            EXITCODE=1
            exit $EXITCODE
        fi
    fi

    # The profile shouldn't be used for CLI
    PROFILE=""
    PROFILE_OPT=""

    # set env variables with assumed role credentials
    export AWS_ACCESS_KEY_ID=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.AccessKeyId')
    export AWS_SECRET_ACCESS_KEY=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.SecretAccessKey')
    export AWS_SESSION_TOKEN=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.SessionToken')
    export AWS_SESSION_EXPIRATION=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.Expiration | sub("\\+00:00";"Z") | fromdateiso8601')
    cleanSTSAssumeFile
}

cleanSTSAssumeFile() {
    rm -fr "${TEMP_STS_ASSUMED_FILE}"
}

to resume: in my environment with limited permission for the caller account:
hotfix https://gist.github.com/toniblyx/f93e68c58e766be3be09a861d19ec718
and hotfix https://gist.github.com/toniblyx/8d4e5e2420b2185332ab35af067f8470:
Generating AWS IAM Credential Report... -  []
WARNING! Access Denied trying to generate credential report  -> it tries to evaluate the CALLER account, not the "assumed" one
Latest assume_role above:
Unable to locate credentials. You can configure credentials by running "aws configure".
Can't  the same logic as in Prowler 2.3.0.xxx , re-implemented in the current version?

My fix (no PR yet but let me know if you wish):
The assume_role renewal logic in 'prowler' file:
Function to execute the check
execute_check() {
if [[ $ACCOUNT_TO_ASSUME ]]; then
# Following logic looks for time remaining in the session and review it
# if it is less than 600 seconds, 10 minutes.
CURRENT_TIMESTAMP=$(date -u "+%s")
SESSION_TIME_REMAINING=$(expr $AWS_SESSION_EXPIRATION - $CURRENT_TIMESTAMP)
echo $SESSION_TIME_REMAINING
MINIMUM_REMAINING_TIME_ALLOWED=600
if (( $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING )); then
echo SUKA
unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
unset AWS_SESSION_TOKEN
assume_role
fi
fi
if (( $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING )); then

instead of
if [[ $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING ]]; then
fixes the "time remaining" comparison check
added extra variable in include/aws_profile_loader:
FILE_OPT_BAK=$PROFILE_OPT
Set default region by aws config, fall back to us-east-1
my assume_role file:
!/usr/bin/env bash
Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente

Licensed under the Apache License, Version 2.0 (the "License"); you may not
use this file except in compliance with the License. You may obtain a copy
of the License at http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed
under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
CONDITIONS OF ANY KIND, either express or implied. See the License for the
specific language governing permissions and limitations under the License.
both variables are mandatory to be set together
assume_role(){
echo ASSUMING
echo PROF $PROFILE
echo PROF_OPT_BAK $PROFILE_OPT_BAK
echo PROF_OPT $PROFILE_OPT

PROFILE_OPT=$PROFILE_OPT_BAK

echo PROF_OPT $PROFILE_OPT
if [[ -z $ROLE_TO_ASSUME ]]; then
    echo "$OPTRED ERROR!$OPTNORMAL - Both Account ID (-A) and IAM Role to assume (-R) must be set"
    exit 1
fi
# if not session duration set with -T, then will be 1h.
# In some cases you will need more than 1h.
if [[ -z $SESSION_DURATION_TO_ASSUME ]]; then
    SESSION_DURATION_TO_ASSUME="3600"
elif [[ "${SESSION_DURATION_TO_ASSUME}" -gt "43200" ]] || [[ "${SESSION_DURATION_TO_ASSUME}" -lt "900" ]]; then
    echo "$OPTRED ERROR!$OPTNORMAL - Role session duration must be more than 900 seconds and less than 4300 seconds"
    exit 1
fi

# temporary file where to store credentials
TEMP_STS_ASSUMED_FILE=$(mktemp -t prowler.sts_assumed-XXXXXX)
# check if role arn or role name
if [[ $ROLE_TO_ASSUME == arn:* ]]; then
    PROWLER_ROLE=$ROLE_TO_ASSUME
else
    PROWLER_ROLE=arn:${AWS_PARTITION}:iam::$ACCOUNT_TO_ASSUME:role/$ROLE_TO_ASSUME
fi

#Check if external ID has bee provided if so execute with external ID if not ignore
if [[ -z $ROLE_EXTERNAL_ID ]]; then
    # assume role command
    $AWSCLI $PROFILE_OPT sts assume-role --role-arn $PROWLER_ROLE \
        --role-session-name ProwlerAssessmentSession \
        --region $REGION_FOR_STS \
        --duration-seconds $SESSION_DURATION_TO_ASSUME > $TEMP_STS_ASSUMED_FILE
else
    $AWSCLI $PROFILE_OPT sts assume-role --role-arn $PROWLER_ROLE \
        --role-session-name ProwlerAssessmentSession \
        --duration-seconds $SESSION_DURATION_TO_ASSUME \
        --region $REGION_FOR_STS \
        --external-id $ROLE_EXTERNAL_ID > $TEMP_STS_ASSUMED_FILE
fi
echo $TEMP_STS_ASSUMED_FILE

# The profile shouldn't be used for CLI
PROFILE=""
PROFILE_OPT=""

# set env variables with assumed role credentials
export AWS_ACCESS_KEY_ID=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.SessionToken')
export AWS_SESSION_EXPIRATION=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.Expiration | sub("\\+00:00";"Z") | fromdateiso8601')
echo $AWS_ACCESS_KEY_ID
echo $AWS_SESSION_TOKEN
echo $AWS_SESSION_EXPIRATION
cleanSTSAssumeFile

#The profile shouldn't be used for CLI
#PROFILE=""
#PROFILE_OPT=""

}
cleanSTSAssumeFile() {
rm -fr "${TEMP_STS_ASSUMED_FILE}"
}
You can remove the 'echo' that I left for debugging purposes. The wrong comparison with [[ ]] would refresh assume_role for each check, but you should see that the whole process now works in all cases (single and multiple assume_role). Hopefully.

Really good catch @halfluke !!!! 👏👏👏👏👏
Please open a PR with all of theses changes 🙏

I will do. Just running one more time, a complete run with all the extras.
It looks all fixed to me: when the remaining time for the temporary credentials is less than 600, it calls assume_role again, but first restores the original profile, because if you call assume_role while impersonating the role again, you get a Permission Denied error. And of course after each assume_role you have to ensure that the temporary credentials exported in environment variables are used instead of the profile, otherwise you run prowler on the caller account and not the target (and if you do not have permissions on the caller account you get access denied again)

Really really good!!!!
Impressive 👏👏

I've just tested @halfluke's setup and I can confirm it also works on my machine. Seems like the issues is solved with those fixes.

Awesome work @halfluke, thanks a lot for the effort put here to you all! Let me know if you can send the PR, I'm going to test it here as well.

Hi yes I will submit the PR today or tomorrow... unless you notice something wrong in your test?

I can't manage to make it work but re-testing it again, feel free to send the PR and I'll keep my tests, probably I didn't do the copy/paste correctly

ok I will submit the PR today. Perhaps check if you added
PROFILE_OPT_BAK=$PROFILE_OPT
to aws_profile_loader
and
PROFILE_OPT=$PROFILE_OPT_BAK
at the beginning of assume_role()

quick question @halfluke the role or user of the profile you are using, what actions have allowed? I'm testing with a role that has only sts:assumerole and getting Access Denied trying to describe regions do you get the same?

nope, that was one of the problems but it works now. That's I put some echo to debug it, and I get:
REGIONS_init
eu-north-1 ap-south-1 eu-west-3 eu-west-2 eu-west-1 ap-northeast-3 ap-northeast-2 ap-northeast-1 sa-east-1 ca-central-1 ap-southeast-1 ap-southeast-2 eu-central-1 us-east-1 us-east-2 us-west-1 us-west-2
REGIONS_end
It should work when you run it on the target account
Not sure of the permissions of my user in the caller account only as I cannot read them ( sts:assumerole for sure)
The role I assume in the target account has the following

I have merged @halfluke suggestions into the latest branch in 2.7 to test. Once is all right I´ll remove echoes in code.

I can confirm that the 2.7 branch works in my environment.

awesome, it is working fine for me as well so far. Thanks!

did you find out what your problem with regions was? In the end after all the time it took me, I've noticed that the changes I made are really minimal: the [[ -> (( comparison and a backup of profile_opt to be restored when we re-assume a role :-)

yep, it was a really good catch @halfluke! The region issue is fixed now as far as I can see, still testing with different options.

This issue has been fixed. Anything related or additional please open a new issue for better handling.

Hi,
Can you please clarify in which version of prowler it is fixed?
Thanks
From: Toni de la Fuente @.>
Sent: 14 January 2022 07:15
To: toniblyx/prowler @.>
Cc: halfluke @.>; Mention @.>
Subject: Re: [toniblyx/prowler] $PROFILE_OPT empty when working with assumed roles (Issue #938)
Closed #938 https://github.com/toniblyx/prowler/issues/938 .
—
Reply to this email directly, view it on GitHub https://github.com/toniblyx/prowler/issues/938#event-5894421464 , or unsubscribe https://github.com/notifications/unsubscribe-auth/AICGELAVQGUJHJMMRKP4IGTUWAHTLANCNFSM5IS3ODAQ .
Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675  or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub .
You are receiving this because you were mentioned.  https://github.com/notifications/beacon/AICGELFPLEZSUI2CQWXSQJDUWAHTLA5CNFSM5IS3ODA2YY3PNVWWK3TUL52HS4DFWZEXG43VMVCXMZLOORHG65DJMZUWGYLUNFXW5KTDN5WW2ZLOORPWSZGPAAAAAAK7KW55Q.gif Message ID: @.*** @.***> >

branch 2.7. That will be the next release, it is the devel branch at this point.
git clone --branch 2.7 https://github.com/toniblyx/prowler


Add DTLS wrapper for sol_socket & update OIC client/server

This series adds a DTLS (Datagram Transport Layer Security) layer on top of sol_socket. The idea is that, regardless of the underlying socket implementation (be it standard POSIX sockets, RIOT, etc.), DTLS will be available for Soletta users without we having to implement it for each and every supported platform.
I chose the TinyDTLS library for the implementation simply because it's small and used by IoTivity, which we keep a close eye on due to the need to be compatible with their OIC implementation, and also for the fact that it's indeed a tiny library, as far as a DTLS implementation goes, which fits Soletta use cases very well.
To accomplish this, sol_socket has been virtualized. The standard implementation merely forwards calls to the system's socket APIs, while the DTLS version does its magic in TinyDTLS, which in turn sends and receives encrypted data using the native socket implementation.
The CoAP implementation had to be slightly changed as well, to pass a pointer to the server struct to the handler callbacks. This was required by the changes in the OIC server implementation in order to respond requests with the right channel.
OIC servers and clients were changed, and now they're aware of DTLS. Changes at the OIC API level should be (sans very small details) transparent. The OIC implementation for provisioning, transfer methods, and whatnot are still not compatible with IoTivity, but work on that will soon follow.
Many thanks to (in no particular order) @vcgomes, @rchiossi and @otaviobp for the help in debugging this contraption.

@edersondisouza commented on Nov 3, 2015, 11:39 AM GMT-2:

Cool. And the fact that buffer.data is incremented doesn't mean that it leaks? Or two or more sol_socket_dtls_recvmsg on the same data would result on invalid free when reading the last block?

Yup. Fixed here to create a new buffer on short reads.

@bdilly commented on Nov 3, 2015, 1:59 PM GMT-2:

@lpereira why do we need more retries on dtls?
Don't you think these constants deserve documentation?
ACK_TIMEOUT_MS 2345
MAX_RETRANSMIT_UDP 4
MAX_RETRANSMIT_DTLS 8
Are they defined on coap specification? Were they adopted from other projects? Are they random? Should they be set by API or build config in the future?

The ack timeout, I believe, was chosen empirically. It doubles every time there's a re-transmission failure. Maybe @vcgomes can shed a light here.
As for the MAX_RETRANSMIT tries: maybe that's not needed for CoAP on top of DTLS. I've changed that for testing purposes and forgot it was there. This has been since removed from my local branch.

+1. also tested the oic samples and they look ok

I've got some questions about these commits, but overall it's good.
I didn't test it, but looks like @otaviobp double checked it and everything is working fine.
So my suggestion to merge it, since there are dependency issues, is to let it disabled by default and document such issues. Later, when we have a good to go upstream tinydtls we could enable it by default.

I agree that is better to make it disabled by default. There are also some things that needed to be fixed before using it for real, like creds_init implementation. I would like to have a list somewhere (besides having TODO/FIXME in the code) of "must do" items.

I've merged with proposed changes. It's default off. Thanks for the review!


localtime returns wrong when the year is larger than 2038

e.g.<PHONE_NUMBER> is 2060-02-29 1:0:0 and localtime should return tm_year==160 but it returns tm_year==24

This is the year 2038 problem (see https://en.wikipedia.org/wiki/Year_2038_problem).  On my system, which is x86_64 GNU/Linux, a C program does not have this problem, but a Lua program does.
Here is a C script:
#!/usr/bin/tcc -run

#include <stdio.h>
#include <time.h>

int main (int argc, char ** argv)
{
	time_t sec;
	struct tm *t;

	sec =<PHONE_NUMBER>;
	t = gmtime(&sec);
	printf("%ld seconds --> %i years \n", sec, t->tm_year);

	sec =<PHONE_NUMBER>;
	t = gmtime(&sec);
	printf("%ld seconds --> %i years \n", sec, t->tm_year);
}

and its output is:

2147483647 seconds --> 138 years
2147483648 seconds --> 138 years

Here is a Lua program:
#!/usr/bin/env lua

pt=require 'posix.time'

sec =<PHONE_NUMBER>
yrs = pt.gmtime(sec).tm_year
print(string.format("%i seconds --> %i years", sec, yrs))

sec =<PHONE_NUMBER>
yrs = pt.gmtime(sec).tm_year
print(string.format("%i seconds --> %i years", sec, yrs))

and its ouput is

2147483647 seconds --> 138 years
2147483648 seconds --> 1 years


[Feature Request] suggests that select components can customize the icon of rotation.

Existing Component
是
Component Name
Select
Description
我们需要修改select的转动icon，但是发现转动的icon是写死在select组件里的，希望能修改icon

Sorry, we have no plan to support this.


AutoRest: Explore migration to Project Reactor for next major release

Project Reactor is JDK 8 based and presents a number of convenience APIs to support JDK 8 developers (ability to move to streams, create optionals, etc). It is also built upon reactive streams and supports operator fusion, etc and has been benchmarked to be extremely fast. Additionally, it provides a reactor-netty project that can provide a backpressure-ready network engine.
It would be good to have this issue track the discussion around moving to use this for the next generation for AutoRest output. The alternative, RxJava 2.x, is also a viable option, but it lacks the improved JDK 8 support and is not as advanced as project reactor is.

Assign this explicitly to @anuchandy who as a lot of thinking already on this

v4 is based on project reactor now.


use dump/raw or dump/norm

Hi，
As we all know that there is raw and norm in dump dir, What's the difference between use dump/raw to train and use dump/norm to train. I also tried to use dump/raw to train my own model, and it worked not bad. So I have two questions:

In your code, I see that you use the dump/norm to train, did norm have a better performance in training pwg than raw? or is there any other reason for that?
If I use your pre-trained model in resume to train my own dataset, should I use norm rather than raw?

raw: the raw mel-spectrogram
norm: the mel-spectrogram normalized with the statistics of the training data

In your code, I see that you use the dump/norm to train, did norm have a better performance in training pwg than raw? or is there any other reason for that?

In my experience, using normalized features make it more robust to the input features.
Maybe if the input is clean, the performance is almost the same.
But if the input is mismatched with the natural features (e.g. voice conversion, TTS), the normalized model will give more stable output.

If I use your pre-trained model in resume to train my own dataset, should I use norm rather than raw?

No. Please use norm calculated with the pretrained model's stats.
You can do it by --pretrain option.
https://github.com/kan-bayashi/ParallelWaveGAN/blob/53d14969089b3d3229fe6bfce221234f25a9d836/egs/template_single_spk/voc1/run.sh#L40

raw: the raw mel-spectrogram
norm: the mel-spectrogram normalized with the statistics of the training data

In your code, I see that you use the dump/norm to train, did norm have a better performance in training pwg than raw? or is there any other reason for that?

In my experience, using normalized features make it more robust to the input features.
Maybe if the input is clean, the performance is almost the same.
But if the input is mismatched with the natural features (e.g. voice conversion, TTS), the normalized model will give more stable output.

If I use your pre-trained model in resume to train my own dataset, should I use norm rather than raw?

No. Please use norm calculated with the pretrained model's stats.
You can do it by --pretrain option.
https://github.com/kan-bayashi/ParallelWaveGAN/blob/53d14969089b3d3229fe6bfce221234f25a9d836/egs/template_single_spk/voc1/run.sh#L40

Got it! Thank you for your detailed reply!

raw: the raw mel-spectrogram
norm: the mel-spectrogram normalized with the statistics of the training data

In your code, I see that you use the dump/norm to train, did norm have a better performance in training pwg than raw? or is there any other reason for that?

In my experience, using normalized features make it more robust to the input features.
Maybe if the input is clean, the performance is almost the same.
But if the input is mismatched with the natural features (e.g. voice conversion, TTS), the normalized model will give more stable output.

If I use your pre-trained model in resume to train my own dataset, should I use norm rather than raw?

No. Please use norm calculated with the pretrained model's stats.
You can do it by --pretrain option.
https://github.com/kan-bayashi/ParallelWaveGAN/blob/53d14969089b3d3229fe6bfce221234f25a9d836/egs/template_single_spk/voc1/run.sh#L40
If you specify it, the statistics calculation stage is skipped and copy the pretrained model's statistics.
https://github.com/kan-bayashi/ParallelWaveGAN/blob/53d14969089b3d3229fe6bfce221234f25a9d836/egs/template_single_spk/voc1/run.sh#L106-L107

Sorry, one more question. What's the difference between "resume" and "pretrain"? I used to use "resume" to  resume training, but I never use "pretrain" before.

resume will load model, optimizer, and scheduler state but pretrain will load only model parameters.

resume will load model, optimizer, and scheduler state but pretrain will load only model parameters.

Thanks!


Added compatibility in the podspec to watchOS, macOS and tvOS

The library is basically the same across the platforms.
I edited the podspec to add the support to the other platforms and made some small changes to don't show the local notifications on platform different than iOS

Praw


Please confirm these before moving forward

[X] I have searched for my issue and not found a work-in-progress/duplicate/resolved issue.
[X] I have not been informed if the issue is resolved in a preview version of the winget client.

Category of the issue
Installation issue.
Brief description of your issue
This is a dead and deprecated package and should warn users at its description.
Look at that: https://bitbucket.org/vinay.sajip/pylauncher/issues/14/installer-forgot-to-add-pyexe-dir-to-path
Steps to reproduce
look at description...
Actual behavior
There is no info at package description. The creator of Python Launcher says that it is deprecated because CPython installer contains it in itself.
Expected behavior
It should say "[DEPRECATED]" at the beginning of description or give an information for that deprecation issue.
Environment
[winget --info]
Windows Package Manager v1.3.2691
Copyright (c) Microsoft Corporation. All rights reserved.

Windows: Windows.Desktop v10.0.19045.2364
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.18.2691.0

Logs: %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir

Links
---------------------------------------------------------------------------
Privacy Statement   https://aka.ms/winget-privacy
License Agreement   https://aka.ms/winget-license
Third Party Notices https://aka.ms/winget-3rdPartyNotice
Homepage            https://aka.ms/winget
Windows Store Terms https://www.microsoft.com/en-us/storedocs/terms-of-sale

Screenshots and Logs
No response

I guess we can use InstallationNotes manifest field to warn user of the deprecation post-install. Can you suggest a suitable message for this scenario?

@mdanish-kh - I think any deprecation message would be fine, if you still wanted to take care of this

#151997

Couldn't find an official deprecation announcement in the repo. Went with more or less the same words the developer of the package used in bitbucket.org/vinay.sajip/pylauncher/issues/14/installer-forgot-to-add-pyexe-dir-to-path


Ninepatch corners are scaled down if they are smaller than the texture you use

Godot version:
3.2 beta4
This was working fine in 3.1
Edit: after further investigation it might not be a regression after all, but i think i changed from a 10x10 pixels texture to 20x20 pixels
Issue description:
Edited 04.01.2020, after further investigation:
I found the issue is related to all ninepatches. The problem is that if the texture you get the ninepatch from , is larger than the ninepatch you draw, everything is scaled down including the corners and borders outside the patch margin. This happens even if the patch margins are smaller than the drawn rectangle / 2.
It should be possible to scale down the center and borders only, and not the corners.
The current workaround i found is to use a texture that is as small as possible (smaller than the rect you draw to), to avoid downscaling.
As you can see in the pictures i made a stylebox that has a 4 pixel wide brown border, and some orange in the center. But when I add it to a button as a focus stylebox, the border gets squashed into 3 pixel size.
In the popup panel i add it as a hover stylebox, the issue appears again, and it even gets squashed down to 2 pixel ( 50% downscaling) with in some cases. This produces very bad results with pixel art assets.

Steps to reproduce:
Here is the texture i used for stylebox.

Updated the issue. Might not be regression after all. I am not familiar with the engine enough to track the code further than VisualServer::get_singleton()->canvas_item_add_nine_patch() which is called from StyleBoxTexture and popup_menu

On second thought this is probably working as intended. Closing it


Questions regarding export of heat network

Summary
An external user contacted me because with a default export to ETM-SA he has significant heat deficits.
He has two questions:

Why is the heating demand not fulfilled with the standard export from ETM to ETM-SA?
How to reconvert to emission reduction (in ETM) after scaling up the heat sources in ETM-SA?

To this I add the following question:

How is the required capacity of the heat sources calculated? Based on total required heat? Or is it taken into account that usually during winter the load is higher? In that case capacity should be higher than average load and I would expect smaller heat deficits.

Details
This ETM scenario is scaled to 1000 households, it has district heating with 100% biogas CHP, both for hot water and for space heating.
The export to ETM-SA gives this LES. With 2.12 CHP plants with a capacity of 1111.1 kW:

The standard setting (export to ETM-SA and standard profiles) give a heat deficit during the winter months:

After using an aggregated profile for hot water (which is more realistic), the heat deficits can be balanced by scaling up the biogas CHP by roughly a factor 2.

My guess is that this is simply due the differences in the way things are modelled in the ETM and ETM-SA.

In ETM-SA there is a capacity, number of units, and an explicit demand profile which must be met for every 15-minutes (or else there is a deficit).

In the ETM / ETEngine there's an "amount" of heat demand which must be met during the year. There is no profile; it must simply output 50.87PJ before the year is up. The ETM determines that – with a capacity of 1.11MW – 2.12 units are required to do this.

I suspect the deficit is due to the ETM assuming demand can be met constantly throughout the year, but the ETM-SA profile is anything but equal.
I think the correct thing to do is to manually increase the number of CHPs until demand is met; I'm not sure what else we can do.

How to reconvert to emission reduction (in ETM) after scaling up the heat sources in ETM-SA?

I'm not sure what this means. 😕

Thanks @antw.

How to reconvert to emission reduction (in ETM) after scaling up the heat sources in ETM-SA?

I'm not sure what this means. 😕

The question originates from the effect on the scenario (e.g. CO2 emissions), when the ETM-SA analysis shows that the capacity from ETM is not sufficient.
I think the answer to that is that the increased capacity in ETM-SA does not influence the outcome of the ETM scenario. Because the demand which is supplied is the same. This is true as long as no "must-run" source is used.

I can see the logic behind the calculation of the required capacity from a modelling point of view. On the other hand, from a user point of view, I think it is unsatisfactory that a standard export leads to deficits.
A possible solution to this is to make sure that with a standard profile the heat demand can be supplied by the source. @ChaelKruip what's your opinion?

A possible solution to this is to make sure that with a standard profile the heat demand can be supplied by the source. @ChaelKruip what's your opinion?

What is the 'standard profile'? I think this is a bigger theme: How do we align the energy picture of ETM with the load picture of ETM-SA?


Thread sniffer to catch the traffic for ongoing openthread connection

Hello Team,
I have created an Openthread network where border routers, other routers, and end devices(nRF52840) are there. I just want to sniff the IPv6 packets on this Openthread network. Can anyone guide or send a link?
I have also checked that the nRf52840 USB dongle can be used for sniffing but I think it will work on the BLE protocol and in my case, I am only going to use thread, not BLE.
Thanks in advance,
Hardik

See:

https://openthread.io/guides/pyspinel/sniffer
https://openthread.io/guides/pyspinel/sniffer-extcap

Thanks @jwhui, I will check those links. Also, can you please confirm the below statement?
The nrf52840 USB dongle is used as a sniffer only in the case of BLE, is it correct? What If I flash it with thread only binary, so will I be able to sniff the thread packets?

The nrf52840 USB dongle is used as a sniffer only in the case of BLE, is it correct? What If I flash it with thread only binary, so will I be able to sniff the thread packets?

Yes. Both nRF52840 DK and USB Dongle can be used as a Thread sniffer.
BTW, Make sure to use USB_trans -DOT_BOOTLOADER=USB when building firmware for USB Dongle. Please check https://github.com/openthread/ot-nrf528xx/blob/main/src/nrf52840/README.md#nrf52840-dongle-support-pca10059 for more details.

Closing stale issue.


Problem of understanding the transformations of the outputs

Hi,
I'm trying to implement YOLOv3 with guidance of this project and struggle to unterstand the following transformations in the decode_netout function.
https://github.com/experiencor/keras-yolo3/blob/master/yolo3_one_file_to_detect_them_all.py
 netout[..., :2] = _sigmoid(netout[..., :2])
 netout[..., 4:] = _sigmoid(netout[..., 4:])
 netout[..., 5:] = netout[..., 4][..., np.newaxis] * netout[..., 5:]
 netout[..., 5:] *= netout[..., 5:] > obj_thresh

According to https://towardsdatascience.com/yolo-v3-object-detection-53fb7d3bfe6b the output of the each of the three detection scales should contain 3 boxes * (4+1+80)=255 values.
So, every box size should contain 85 values, the fist 4 the position (x, y), height and weight, the 5th the objectness score and the rest 80 classes one-hot encoded.
[x, y, h, w] [s] [c1, c2, .., c80]
Could someone please explain what's happening here? Shouldn't we use sigmoid over the first 4 and the objectness score?
Thanks in advance :)

I have the same question, does anyone can help explain？

@oli37 have you solve this question？


Feat(front): solutions details [MARXAN-606]

Solutions details
Overview

GET SCENARIO SOLUTIONS

5 MOST-DIFFERENT SOLUTIONS
Non API atm, it shows a fake hook and fake splice

TABULAR DATA FOR SPECIFIC SOLUTION
When solution is selected on table, solution details will be shown on solution sidebar.
Best one would be default one

Designs
Details
Solutions table
Test View solution detail
set status="completed" on ScenarioItem or remove /edit on browser url
Feature relevant tickets
MARXAN-606

readOnly on Scenario Detail hides some features that we can disscuss better if needs


Error in the isntall

62 26928   62 16942    0     0  43777      0 --:--:-- --:--:-- --:--:-- 43777
curl: (23) Failed writing body (855 != 1413)
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

its problem with your curl lib. try update curl package.


Link to create map

To support some clients, we want to develop a link that will route the user directly into the map drawing page. This will automatically create a map in the user's account when they follow it. Since the link will bypass the create map page, it should include parameters that define the things a user would select on the create map page, e.g. region, number of districts, etc.
Note, this does not handle the case where the user is unauthenticated, which will be handled in a separate task.
AC:

For a given region (project definition?) we can create a link that will route a user directly into the map drawing page.
Following the link automatically creates a map with the specified parameters in the user's account

Just to give some extra context/clarification here: the "link" being referred to would be something like e.g.: https://app.districtbuilder.org/create-project?regionConfig=123&mapName=MyMap&numDistricts=12. This link would be placed on a partner's website, so a user can click on it and it will automatically create a map for them and direct them to it (if they're logged in). In the example above, I used the existing create-project route, since I think that may be a good fit, but if we want to create a new route for this, that would also work.

Note: we're discussing some changes to this. Likely it won't be using a modal, and will instead use the existing login/register page. More details to follow.


Record classes/functions declared as isolated files instead of PSR in composer

Right now only classes defined by PSR-0 or PSR-4 are extracted from composer.json
We should also extract the ones defined by 'files'
"autoload": {
  "files": [
     "src/SomeClass.php",
     "src/functions.php"
  ],
  "psr-4": {
    "Source\\Namespace\\": "FooBar"
  }
}

Reference: https://github.com/carlosas/phpat/issues/159#issuecomment-932731980

PHPat has been rebuilt as a PHPStan extension (v0.10). This feature is now included 🙂


Correction link

If you click on "Machine learn", it was not working, not going to the section :dancers:

O_O good job. could you please also rename the link so it corresponds with category title 'Machine Learning and Data Science'
Thanks

sure


gerrit: init at 2.14.3

Motivation for this change
Add a new version control and code review application to nixpkgs. Will follow up with a NixOS module.
Things done

[x] Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
Built on platform(s)

[x] NixOS
[x] macOS
[x] Linux

[x] Tested execution of all binary files (usually in ./result/bin/)
[x] Fits CONTRIBUTING.md.

this even avoid copying: abdd0bbf4e0b0fdb83b46e12275c03b5d0b97f9d


Remove noisy Slack alerting for test upgrade-provider jobs

AS part of the pulumi-terraform-bridge release validation
Maintainers now run https://github.com/pulumi/pulumi-terraform-bridge/blob/master/.github/workflows/update-providers-test.yml
This generates a LOT of PRs that try to upgrade providers to a pre-release bridge version.
These PRs make noise in #provider-upgrade-publish-status
The ideal outcome here is that these helper PRs do not alert into #provider-upgrade-publish-status .
They are kind of expected to fail sometimes as they're part of testing, not production; similarly success notification is not meaningful as the PRs may send a success notification but actually fail tests.

Fixes in #1012


squash PRs on merge?

I'd set the default action when merging PRs to squash the commits to the main branch. That way it's way easier to scan and review the commit tree, and there are no intermediate commits like "fix lint" etc.

Done. Thanks for the proposal.


RTL support

hi,
your sidebar-menu is great, can you include please RTL? and it will display as well in right not only on left?
thanks

do you mean place the sidebar-menu on right?

yes, it will at the right at the same time li's will be right to left. this will support hebrew, arabic and other RTL languages.
thank you

you can change template icons class pull-right to pull-left

see the attached screenshot, perhaps it could help
thank you

add sidebar-menu-rtl class for rtl direction, use sidebar-menu-rtl instead of sidebar-menu, and also you should change arrow class pull-right to pull-left

hi, works perfectly now, thank you so much

ok. fixed


MD013 : Issue with MarkdownLint Configuration Ignoring Line Length Exceeding 80 Words

I've encountered while configuring MarkdownLint to ignore line length exceeding 80 words. Despite following the official documentation's guidance, the line length issue persists, and I seek assistance in resolving it.
Here's the current configuration I've set up:
 ---
# MarkdownLint YAML configuration file
#   https://github.com/DavidAnson/markdownlint-cli2?tab=readme-ov-file#markdownlint-cli2yaml
#   https://github.com/DavidAnson/markdownlint-cli2/blob/main/test/markdownlint-cli2-yaml-example/.markdownlint-cli2.yaml

config:
  # MD013/line-length: https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md013.md
  line-length:
    tables: false # Do not complain about wide tables generated by Terraform Docs

# Fix any fixable errors
fix: true

# Define glob expressions to ignore
ignores:
  # MarkdownLint detects this file as a '.markdown' file
  - "**/.markdownlint-cli2.yaml"

I've integrated this configuration into the pre-commit setup as follows:
  - repo: https://github.com/DavidAnson/markdownlint-cli2
    rev: v0.12.1
    hooks:
      - id: markdownlint-cli2
        args:
          - extern/make/.config/.markdownlint-cli2.yaml

Despite these settings, MarkdownLint continues to flag lines exceeding 80 characters, contrary to my intent to ignore this rule. I'm uncertain where the misconfiguration lies and would appreciate any guidance or adjustments you could provide to resolve this issue effectively.

The pre-commit configuration above is using "args" to say the YAML configuration file should be linted (and nothing else). You probably want to use the --config option and pass a glob like "**/*.md". Once that problem is fixed, the "ignores" override you have should no longer be necessary and the other configuration should be applied as expected.

This tool shows what it's doing at the beginning of its output. You can see that in your bottom snippet as something that looks like this: Finding: --config=extern/make/.config/.markdownlint-cli2.yaml .gitlab/issue_templates/Default.md ...
That tells us the syntax for "--config" was wrong because "=" should not be used there. The pre-commit syntax you show above looks reasonable to me, but I do not use pre-commit. In my own smoke test for pre-commit integration, I use this syntax and it seems to behave as expected: args: [--config, configuration/.markdownlint-cli2.jsonc]


Documentation: todo

Give an example of how to parameter and use restarts.

Add doc on SMF.nogoodRecording*

Ok, I think having an issue for that is not necessary.


support for --chain-file and --fullchain-file commands to create respective files

This program is amazing. However there are these commands I just wish were baked in it. I normally have to make these files manually as they are required in many projects. I think it'd be great if mkCert allowed generation of these files using cli arguments:
# create chain file
$ cat cert-file.pem > chain.pem
$ cat "$(mkcert -CAROOT)/rootCA.pem" >> chain.pem
# create fullchain file
$ cat cert-file.pem > fullchain.pem
$ cat chain.pem >> fullchain.pem

https://community.letsencrypt.org/t/public-and-private-keys/25493/3?u=emahuni
This is how I make these files where needed, but it'd be simple to implement and great to have mkcert do this for us through:
$ mkcert localhost --chain-file chain.pem --fullchain-file fullchain.pem

or also produce them together with the default files (cert and key) based on the domain if these arguments are not specified:
$ mkcert localhost

Your commands create fullchain as cert+cert+root, while https://community.letsencrypt.org/t/public-and-private-keys/25493/3?u=emahuni says fullchain is just cert+root. The confusion might be due to the fact that LE certs will have an intremediate root, so fullchain in cert+intermediate+root, while mkcert signs directly from the root.

actually I think you mis-read that. it says:
"fullchain.pem is a concatenation of cert.pem and chain.pem in one file"
which is cert+chain that is similar to cert+cert+root since chain is cert+root.
fullchain is exacly as you said: cert+intermediate+root. The intermediate here is cert.
"chain.pem contains the intermediate certificate, " + the root at the end.
This is exactly what my commands are doing up there. In fact I have been using them like this and they work without any issues in many programs. Nginx, freeswitch, fusionpbx, php projects, nodejs frameworks etc.

The intermediate from mkcert here is cert

There is no intermediate at all, which is why

chain = root
fullchain = cert + chain = cert + root

It's very likely clients will ignore the duplicate certificate if you build cert+cert+root, but I suggest you try cert+root, I am also sure it will also work. If not I'd be curious to know what software that is.
Anyway, I still think that these files are easy enough to put together in the most appropriate way for each case, so mkcert doesn't need the extra options.

Why not make it easy for users if it is easy to do? Add the easy-peasy arguments as proposed:
mkcert localhost --chain-file chain.pem --fullchain-file fullchain.pem
How many hours will go wasted as users have to recall the order and debate whether cert+root will do or cert+cert+root is necessary?

+1 - just ran into this issue. Please add the option to save us the headache of figuring out how to put a fullchain together.

+1 - just ran into this issue.

+1 - reopen

+1 vote for this


Revert "Revert "move from pandas-datareader and morningstar to IEX""

Reverts plotly/dash-stock-tickers-demo-app#23
This should work now, not all dependencies were being installed. May conflict with your #26, but live data is always more fun than static data!

Thanks for the PR @timkpaine but we would like to leave this repo using local data.

@bcdunbar no worries!


input validation paterns

If I read e.g. a JSON file as input, or some -p variables, what is the best way for me to validate what I have and produce meaningful errors to the user? I suppose I can just write it myself and throw exceptions, but it would tedious and I wish I didn't have to write too much code, or if there was a documented patter that I could copy instead of having to invent something.

It is Javascript so you could use for instance:

superstruct
typescript-is
yup
ajv

I guess to me it's be handy if I could declare parameters with a schema of some sort, and get validation from just calling param.String("foo", "bar", "(bar|foo)").
Another thing that does trip me up right now is that when I read YAML or JSON in TypeScript, I cannot assert it agains a particular type and non-optional fields come out as undefined.


Use multiple hooks as AND condition

How to execute method only if all hooks conditions is True?
For example
@hook(AFTER_SAVE, when='foo', was='bar')
@hook(AFTER_SAVE, when='something', is_now='value')
def my_method(self):
pass
I tested this, but my_method runs when only one of the hook condition is True as OR condition

Sorry, didn't check the documentation with Utility Methods


for network parameters

Hello, as for experiment on Salinas Valley data, the network parameter [310 100] performs bad,  how to tune the depth and number of neurons in each layer ?

How large is your dataset? What kind of architecture are you using? What is the training/test cost and error rate correspondingly?

Closing since there is no more response.


hey there ,  i an do some amazing changes in your websit , it's makes looks great .   Update README.md

Please mark as invalid and spam, this is an obvious attempt to get a free t-shirt by 'contributing'(hacktoberfest)
This will also ban the user for trying to abuse the system by doing marginal effort


web demo does not work

The website demo does not work, showing "Timeout! Please wait a few minutes and retry.", can you fix it?

I encountered the same problem, have you solved it?

The website demo does not work, showing "Timeout! Please wait a few minutes and retry.", can you fix it?

I encountered the same problem, have you solved it?

For me, wait a seconds. it works. So i close the issue.
---Original---
From: @.>
Date: Thu, Oct 26, 2023 17:18 PM
To: @.>;
Cc: @.>;"State @.>;
Subject: Re: [THUDM/CogVLM] web demo does not work (Issue #47)
The website demo does not work, showing "Timeout! Please wait a few minutes and retry.", can you fix it?
I encountered the same problem, have you solved it?
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you modified the open/close state.Message ID: @.***>


Lock screen action makes Pock inactive on next login

Describe the bug
I've set up Pock to work on 3/4 of the touch bar and showing the dock applications.
Then, I've set up the lock screen icon on the touch bar default set on the right.

Click the lock button
Re-authenticate
Now the dock applications are not shown anymore
Instead you see the default touch bar (app dependent)
To restore, close and reopen Pock

Versions:

macOS version: [12.6 (*required)]
Pock version:  [0.9.0-22  (*required)]

Another option to restore is to double click on the CTRL button.

having the same issue except that no need to restart, enough open pock preferences or one of some other its ui windows


refactor: Properly namespace all components / Examples fixup

Achieves consistency between using the overall library and using the
components a la carte.

Refactor / Rename all components in source code / tests / docs /
examples
Fix up checkbox examples to use form field instead of old checkbox
wrapper, which has been removed. Noticed when scanning examples to
ensure namespacing didn't break anything.
Add README for material-design-lite and vue example

Resolves #4837
[#131998891]

Gmail<EMAIL_ADDRESS>


API Version 2021-04-01 is not support in AzureCloud or AzureUSGovernment

I received a customer support ticket for API version 2021-04-01 not being support in either AzureCloud or AzureUSGovernment for the ResourceManagementClient module of the SDK,
An example of the Error being received is:

Azure Cloud

azure.core.exceptions.HttpResponseError: (NoRegisteredProviderFound) No registered resource provider found for location 'eastus' and API version '2021-04-01' for type 'workspaces'. The supported api-versions are '2015-03-20, 2015-11-01-preview, 2017-01-01-preview, 2017-03-03-preview, 2017-03-15-preview, 2017-04-26-preview, 2020-03-01-preview, 2020-08-01, 2020-10-01, 2021-06-01, 2021-03-01-privatepreview, 2021-12-01-preview'. The supported locations are 'eastus, westeurope, southeastasia, australiasoutheast, westcentralus, japaneast, uksouth, centralindia, canadacentral, westus2, australiacentral, australiaeast, francecentral, koreacentral, northeurope, centralus, eastasia, eastus2, southcentralus, northcentralus, westus, ukwest, southafricanorth, brazilsouth, switzerlandnorth, switzerlandwest, germanywestcentral, australiacentral2, uaecentral, uaenorth, japanwest, brazilsoutheast, norwayeast, norwaywest, francesouth, southindia, koreasouth, jioindiacentral, jioindiawest, canadaeast, westus3, swedencentral'.
Code: NoRegisteredProviderFound
Message: No registered resource provider found for location 'eastus' and API version '2021-04-01' for type 'workspaces'. The supported api-versions are '2015-03-20, 2015-11-01-preview, 2017-01-01-preview, 2017-03-03-preview, 2017-03-15-preview, 2017-04-26-preview, 2020-03-01-preview, 2020-08-01, 2020-10-01, 2021-06-01, 2021-03-01-privatepreview, 2021-12-01-preview'. The supported locations are 'eastus, westeurope, southeastasia, australiasoutheast, westcentralus, japaneast, uksouth, centralindia, canadacentral, westus2, australiacentral, australiaeast, francecentral, koreacentral, northeurope, centralus, eastasia, eastus2, southcentralus, northcentralus, westus, ukwest, southafricanorth, brazilsouth, switzerlandnorth, switzerlandwest, germanywestcentral, australiacentral2, uaecentral, uaenorth, japanwest, brazilsoutheast, norwayeast, norwaywest, francesouth, southindia, koreasouth, jioindiacentral, jioindiawest, canadaeast, westus3, swedencentral'.

Azure US Government

Can you please onboard the API since it is called out in the Github article as Default?
https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/resources/azure-mgmt-resource/azure/mgmt/resource/resources/_resource_management_client.py#L59

Per Issue: https://github.com/Azure/azure-sdk-for-python/issues/24961 this needs to be owned by the Service itself. The attempt is to execute a list operation for a Log Analytics Workspace by Resource ID

Hello All, Can I please get assistance in getting this in front of the appropriate parties to Resolve? Thank you in Advance as the support case for this issue has been open for 60 days.
Yes, the customer can work-around by specifying another API version, but should they have to if a Default API version is specified and not showing as supported?
Thank you in Advance

Service team has already been involved. So removing the CXP attention label.
@maertendMSFT Could you please look into this ask and provide an update ?


Add favorite summit feature

Added new Endpoints which are required for https://github.com/manuelkasper/sotlas-frontend/pull/12

GET /users/me
POST /users/me/settings
GET /users/me/tags
GET /users/me/summits/tags
GET /users/me/summit/:association/:code
POST /users/me/summit

@ttomasini Thanks, this is now “live” on the server.


Could you NOT deprecate Segmented

Hi. Thank you again for your work and making it public.
I've noticed a deprecation notice on Segmented. Could you keep it? Even though it's indeed close to buttons in function - it has a different design & feel. Love it for enums in forms. Buttons feel more like a control element by design, rather then just a flag/selector.

@nicedouble Thank you!


Error when mousing over any item

I get this error whenever I mouse over an item in my bags or equipped.
Message: ...e\AddOns\StatWeightScore\StatWeightScore_Options.lua:227: attempt to index a nil value
Time: 01/05/15 21:03:26
Count: 1
Stack: (tail call): ?
[C]: ?
...e\AddOns\StatWeightScore\StatWeightScore_Options.lua:227: in function SetupSpecWeightOptions' ...e\AddOns\StatWeightScore\StatWeightScore_Options.lua:357: in function func'
Interface\FrameXML\UIDropDownMenu.lua:748: in function `UIDropDownMenuButton_OnClick'
[string ":OnClick"]:1: in function <[string ":OnClick"]:1>
Locals: (*temporary) = "LeftButton"
(*temporary) = false
(*temporary) =  defined =[C]:-1

this shouldn't happen when hovering over items.
can you post your config (located at WTF/Account/<account_name>/SavedVariables/StatWeightScore.lua)?

I think I found the problem. You probably used the import feature and there is a stat that doesn't map to the addon stats. Not sure which one it is, so please send me the config so I can update it. In the meantime I will add a fix to prevent this behavior.

http://pastebin.com/nX0pv4cf
Looks like it's probably wohdps (weapon offhand dps) It's fairly important to fury warriors and I think also enhancement shamans. Would you consider adding this stat?

Yes, I will add it. Only issue will be weapons that are one-hand (not specifically mainhand or offhand). I will need to display mainhand score and offhand score, and compare them to respective equipped items. But it shouldn't be a big problem.

This is what i got:
Offhand score will display only if

offhand DPS stat is specified
and at least one one-handed weapon is equipped

since i think it's useless to compare one-hand to two-hand weapons directly. it will not be role of this addon to help you decide between 2h and dual wield. (everyone should make this decision before deciding what weights to use). Casters will need to add up onehand+offhand vs staff.

closing this for now. new version is up. please check it out, and create a new issue if there is any additional feedback.


Question: Why not use different Dockerfiles?

Hello,
I have a short question, maybe there is a good reason for this. Why does this repository use only the Debian Dockerfile and not the different Dockerfiles for NGINX and PHP-FPM? This would be much more structured. For example, you could read the logs of the individual services separately and restart services separately.
Thanks,
felixoi

We had things split out more at one point, but there were issues with shared volumes and a few other things so we just rolled it all into the single container + external DB.
We essentially are following the "one purpose" per container method here, similar to other popular Docker images such as wordpress.

@djdefi would you accept PR to fix that?


Linearize fake server request business logic

/domain @samandmoore
/platform @samandmoore
/cc @DeProdigy @coreyja
This should deal with corruption that occurred in assignments when the chrome extension parallelized writes, as well as help avoid errors when a read operation overlaps with a halfway-completed write operation.

<<domainlgtm platformlgtm
this is great.

<<domainlgtm platformlgtm
this is great.


Apply AutoPlugin to all Test configurations

With the move to build.sbt and away from Build.scala there will be no easy way to apply settings to all user-defined configurations.
With Build.scala this was never pretty, but a workaround was possible such that a method could be called explicitly with the list of Configurations to enable.
e.g. this could take the form of a method in AutoPlugin which will always be called inConfig for all configurations that are enabled for that Project that derive from Test (possibly even for Test also).
I feel this is a blocker for 1.0.

Why is this not similarly achievable in build.sbt?
Alternatively put, how is this related to the removal of the Build trait?

Hmm. Yeah, I guess it is still possible to call out.
OK, then I retract this being a blocker for 1.0 but it would certainly be an improvement of the AutoPlugin API and be another reason for people to move over.

Maybe the method could be called projectTestSettings, as opposed to projectSettings ?

@eed3si9n can this please be considered for the 1.0 milestone? It's one of the main reasons I don't like autoplugins (typically I end up having to manually add settings for IntegrationTests, defeating the effort of writing everything as an auto plugin in the first place).
Suggested interface projectConfigSettings(config: Configuration): Seq[Setting[_]] called for everything except Compile (which is handled by projectSettings).

As suggested in #2580, can derived task (https://gist.github.com/eed3si9n/bf561bce36ca72b5f659) work here?

not really, it is too much of a hack (and I couldn't even get it to work for IntegrationTest)

even being able to get at the Seq[Configuration] outside of a Setting context would be really useful for this.

@eed3si9n the reason derived task is no good is because the Seq[Configuration] needs to be obtained outside of a task assignment. We basically need a customConfigs method like this customConfigs(project).flatMap(projectSettings) outside of a Setting context.

doh! @dwijnand just pointed out that this sits on Project so I have a workaround for manual addition of settings.

another possible impl could be configSettings which gets called per config, wrapped in inConfig already.

will be solved by  https://github.com/sbt/sbt/issues/2899


After a long time, the window pops up and does not respond

Does this issue occur when all extensions are disabled?: Yes/No

VS Code Version:1.66.0 (user setup)
OS Version:Windows_NT x64 10.0.19043

Steps to Reproduce:
1.Open multiple windows
2.wait

Does this issue occur when all extensions are disabled?: Yes/No

/needsMoreInfo (see above)


Benny/opensea sync

Changes:

Added upsert funcs for ensuring that we do not create duplicates and only add or update what's necessary when grabbing info from open sea
Added func that will use opensea_id as a baseline to find out which ones have already been added

Considerations:

Is opensea_id always going to be the most definitive field to see which nfts need to be added versus updated?

incredible work on this PR!

Is opensea_id always going to be the most definitive field to see which nfts need to be added versus updated?

i believe so, given that this is a sync pipeline that is specialized for opensea. we can explore longer term solutions after v1


Time stamp last change for each section?

I'm wondering if it would be useful to add an additional column that keeps track of the last change to a section.  Ideally this would only update when there is an actual change, not each time the section is "updated".
This can be useful for keeping track of changes -- it would be easy to filter by date to get recent changes.
For now I'm imagining that we would only store the time stamp -- we can use external tools to do the filtering.

I’m tempted to move this to high since I think it will be super easy (famous last words) and useful for seeing the evolution of a schedule.

I think this feature could have some major implications to the workflow and understanding of the app. Before we work on this, we should discuss the feature set and requirements.

Is this something that would only be viewable in the exported spreadsheet or also in the app?

Also, when importing a spreadsheet, you would you expect to see the time stamp?

It could be missing on upload.  Missing values could either be left missing or populated with the current date/time.
For now I was thinking only to have it available in the export, but I could imagine ways to use it in the app as well (highlighting most recent changes, for example.)


Try1

Requirements

[x] You have completed your website.
[x] The website is reachable.
[x] The CNAME record doesn't contain https:// or /.
[x] There is sufficient information at the owner field.
[x] There is no NS Records (Enforced as of Sepetember 4th, 2024)

Description

It is just for pleasure in displaying the sonnets of Shakespeare within a 4D spectrum of pages.
Just trying to get index.html to display first in the Try1 branch. I have guessed that it should be in the repo folder..../poetry. Other files will use cgi.
Link to Website

https://localplayer.dev/hyperways

I have read the CLA Document and I hereby sign the CLA

recheck


upgrade package copy-webpack-plugin, move to devDependency

Jira issue link: link

check applicable boxes

[ ] I have made tests to match the user stories
[ ] This code does not require tests that match user stories

Coverage remained the same at 66.452% when pulling 906a48d9f0dc1a2fe23571e83295b5d2eefc5db3 on hotfix/vulnerability-copy-webpack-plugin into 2c7231e7c27fd3eaef7d038f7b8a2107e8f33a29 on develop.


On Delete call, Delete Cloudformation Stack

EksCTL creates the cloudformation for the eks cluster. The delete API should just delete the eksctl cloudformation, and then the CDK pipeline.

Rudimentary example working from PR https://github.com/jonahjones777/eksboot/pull/15

https://github.com/jonahjones777/eksboot/pull/17 finished the case for Cluster Autoscaling


rm vre-hub image

This image is not used after all, and if later on, it should be placed in the vre repo under the folder "containers".

@goseind I merged too fast, sorry (also to cancel the automatic building of the images that I'm currently changing too). But, we would need at some point a jupyterhub image on the VRE, right ? Are we still using the escape-cluster one ?

No, we don't need it atm and in the future unless we want to change the config of it somehow. And no, we're using the default one provided by Jupyter, so all good 🟢


'extras_require' requirements cannot include environment markers

I just upgraded to the latest setuptools by accident, and now get following error:
 'extras_require' requirements cannot include environment markers, in 'notebook': 'enum34==1.1.6; python_version < "3.4"'

Portion of my extras_notebook_requirement file:
enum34==1.1.6; python_version < '3.4'

This is probably related to the #1081.

Can you give more information about your exact use-case? The thing is, while this was previously allowed, this would result in wheels that don't work as expected.
For example:
> cat setup.py
import sys

from setuptools import setup

setup(
    name='foo',
    extras_require={
        'test': 'barbazquux; "foobar" in sys_platform',
    },
)
> python ./setup.py -q bdist_wheel
> unzip -p dist/foo-0.0.0-py3-none-any.whl foo-0.0.0.dist-info/metadata.json | json_pp
{
   "extensions" : {
      "python.details" : {
         "document_names" : {
            "description" : "DESCRIPTION.rst"
         }
      }
   },
   "version" : "0.0.0",
   "name" : "foo",
   "summary" : "UNKNOWN",
   "metadata_version" : "2.0",
   "run_requires" : [
      {
         "extra" : "test",
         "requires" : [
            "barbazquux"
         ]
      }
   ],
   "extras" : [
      "test"
   ],
   "generator" : "bdist_wheel (0.29.0)"
}
> pip install --user dist/foo-0.0.0-py3-none-any.whl'[test]'
Processing ./dist/foo-0.0.0-py3-none-any.whl
Collecting barbazquux; extra == "test" (from foo==0.0.0)
  Could not find a version that satisfies the requirement barbazquux; extra == "test" (from foo==0.0.0) (from versions: )
No matching distribution found for barbazquux; extra == "test" (from foo==0.0.0)

As you can see, the environment marker was stripped, and barbarzquux will always be installed.

We use extras_require to define a list of dev requirements, including mypy. mypy does not install on Python 2.

The valid syntax is:
> cat setup.py
import sys

from setuptools import setup

setup(
    name='foo',
    extras_require={
        'test:"foobar" in sys_platform': ['barbazquux'],
    },
)
> python ./setup.py -q bdist_wheel
> unzip -p dist/foo-0.0.0-py3-none-any.whl foo-0.0.0.dist-info/metadata.json | json_pp
{
   "name" : "foo",
   "metadata_version" : "2.0",
   "generator" : "bdist_wheel (0.29.0)",
   "summary" : "UNKNOWN",
   "extensions" : {
      "python.details" : {
         "document_names" : {
            "description" : "DESCRIPTION.rst"
         }
      }
   },
   "version" : "0.0.0",
   "run_requires" : [
      {
         "extra" : "test",
         "requires" : [
            "barbazquux"
         ],
         "environment" : "\"foobar\" in sys_platform"
      }
   ],
   "extras" : [
      "test"
   ]
}
> pip install --user dist/foo-0.0.0-py3-none-any.whl'[test]'
Processing ./dist/foo-0.0.0-py3-none-any.whl
Installing collected packages: foo
Successfully installed foo-0.0.0

My problem wasn't with the change -- it is clearly bug fix, but with the fact that breaking change was introduced in the maintenance release.
I'd expect first deprecation warning, and then removed in follow up release.

But it does not break a valid case. It was already broken, you just did not know it because setuptools was silently allowing it.

@benoit-pierre So if I understand correctly, we will define two separate extras_require sections, one for Python 2 and one for Python 3. They will both be named test and they will both be complete lists of packages, and one or the other will be installed. Is that right?

Just to clarify, this would work as expected:
    extras_require={
        'test': ['flake8'],
        'test:python_version >= "3.4"': ['mypy'],
    },

installing both flake8 and mypy when using Python 3.4+.

@sashkab: honestly, I did not even know a syntax like 'test:python_version >= "3.4"': ['mypy'], was valid when I make the PR (I never saw it documented anywhere). Maybe I can make a new PR to automatically convert something like 'test': ['mypy; python_version >= "3.4"], to 'test:python_version >= "3.4"': ['mypy'],.

'test:python_version >= "3.4"': ['mypy'],

No, syntax was:
extras_require={
   'notebook': ["enum34==1.1.6; python_version < '3.4'"]
}

OK, but this would not work as expected, enum34 would be installed no matter the Python version. While this would have worked (and still does):
extras_require={
   'notebook: python_version < "3.4"': ['enum34==1.1.6']
}

I just tested with Python 3.6 and setuptools==33.1.1, and when installing from wheel enum34 definitively get installed too as the environment marker was stripped in the wheel metadata.

Interesting: I'm positive, that package in question wasn't installed:
.tox/py36-macos/bin (develop) $ pip list --format=columns | grep -E 'setuptools|enum34'
setuptools (33.1.1)
.tox/py36-macos/bin (develop) $ python -V
Python 3.6.1

My tox environment installs all extras.

I don't want to waist your time -- my main complain was ERROR instead of DeprecationWarning. I fixed my code to work correctly in 20 minutes, and as I did not see this reported -- reported to have a discussion.

@sashkab: thanks for reporting, see #1088 for a PR that would allow both syntax.

Thank you, @benoit-pierre!


Makefile: manually set Go parallelism

Hello @nicks,
Please review the following commits I made in branch nicks/parallelism:
6822c9a0aa4bce0cf19ef9cd083a1953d4e1c9c1 (2019-02-03 13:13:38 -0500)
Makefile: manually set Go parallelism

👏


Use as specific template name as possible

If a page is categorized into multiple categories,  try to use the most specific one, e.g. by checking if there is a owl:subClassOf, or rdf:type relation between any of the categories, and choose the most "sub-classy" of them!

Partly solved with 659efbb71ceb635bd6b6544f1b5c452c67f11086

Pretty much fixed, with 5ed837aede11fe88e9d1a7ab79b14f21638a2d6d


net: cannot resolve SRV records with compressed targets

What version of Go are you using (go version)?

$ go version
go version go1.13.3 linux/amd64

Does this issue reproduce with the latest release?
yes
What operating system and processor architecture are you using (go env)?
go env Output
$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/ubuntu/.cache/go-build"
GOENV="/home/ubuntu/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/ubuntu/mesa/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/src/go1.13.3/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/src/go1.13.3/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build085179277=/tmp/go-build -gno-record-gcc-switches"

What did you do?

package main

import (
	"context"
	"fmt"
	"net"
)

func main() {
	cname, addrs, err := net.DefaultResolver.LookupSRV(context.Background(), "kerberos", "udp", "mydc.example.com")
	if err != nil {
		panic(err)
	}
	fmt.Printf("cname=%s\n", cname)
	for _, a := range addrs {
		fmt.Printf("target=%s:\n", a.Target)
	}
}

Samba (at least 4.3.11-Ubuntu), compresses the Target fields of the SRV records. While this is against clarifying RFCs and there is much discussion of this in the patch enforcing this, it breaks resolver behavior at least against Samba and possibly other embedded servers.
IMO, this makes the resolver less robust. If the rationale is to defend against ignorant DNS proxies, I would argue the client is not the layer to make this decision.
What did you expect to see?
successful resolution
What did you see instead?
error "cannot unmarshal DNS message"

We have a number of users hitting this issue when using SRV records with the go.mongodb.org/mongo-driver library and the only good responses we have for them so far are to use non-SRV URIs (for resilience purposes, this requires specifying a very long URI that's hard to read) or using a DNS server, which many applications can't always control. Given that neither of these solutions are particularly good, can anyone give a timeline for when the change linked above might be reverted or provide another solution that we can forward to our users?

Apple's vmnet framework runs a DNS server at the gateway address which seems to have this same behavior.
Running a macOS guest with this interface (specifically, under qemu with -netdev vmnet-shared), causes TestLookupGoogleSRV to fail. Editing goLookupSRV to report the underlying error:
$ ../bin/go test -run=TestLookupGoogleSRV -v net
=== RUN   TestLookupGoogleSRV
=== PAUSE TestLookupGoogleSRV
=== CONT  TestLookupGoogleSRV
    lookup_test.go:92: backoff 1s after failure lookup google.com on <IP_ADDRESS>:53: cannot unmarshal DNS message: Target: compressed name in SRV resource data
    lookup_test.go:92: backoff 5s after failure lookup google.com on <IP_ADDRESS>:53: cannot unmarshal DNS message: Target: compressed name in SRV resource data
    lookup_test.go:92: backoff 30s after failure lookup google.com on <IP_ADDRESS>:53: cannot unmarshal DNS message: Target: compressed name in SRV resource data
    lookup_test.go:98: lookup google.com on <IP_ADDRESS>:53: cannot unmarshal DNS message: Target: compressed name in SRV resource data
--- FAIL: TestLookupGoogleSRV (36.02s)
FAIL
Socket statistical information:
(inet4, datagram, default): opened=4 connected=4 listened=0 accepted=0 closed=4 openfailed=0 connectfailed=0 listenfailed=0 acceptfailed=0 closefailed=0

FAIL    net     36.044s
FAIL

As of https://go.dev/cl/570156 this is now fixed.


Clean up unused code and ignored tests

As the title suggests, this PR cleans up some unused code and also removes tests that have @Ignore on them.
It was done by applying the unused declaration inspection to the whole codebase and then hand-picking. Manual work was needed because simply removing all of it would have broken OSGi (because IntelliJ doesn't know about activate and such being actually used) and because not all unused code is bad per se. Stuff like *Query classes with with methods, for example, and getters in general, I left as is (mostly).
I hope I didn't remove too much. Please correct me if I'm wrong. I'd rather not remove useful code, but rotten code just hinders sensible refactorings and makes the code more "static" than it needs to be.

Note that this has a few conflicts.

Conflicts are fixed now.

Skimmed the code and did some production tests. Everything seems to work as expected → merged.


Disable inlay hints when bounds are not satisfied for syntactic sugar

Example:
struct A;
let a = A?;

I would personally think inlay hints should be disabled for this type of erroneous code, it gets complex when one confuses .await? with ?.await:

They shows that something is wrong, and it is good, I think?

No, we should really treat this as an error type, since the projection doesn't actually exist. I'm not sure how to best do this, though.


Don't downgrade gcc

This is no longer necessary, and is generating some warnings on Morty.

Decided not to do this just yet.

@michal-mazurek why was this closed?


Update Code Style Guide to Include Linting Guides

As part of #346 there was a question about when nolint should be used and I provided some guidance there, but it would be good if the Code Style Guide and Code Review Guide could be updated to consider how we deal with linting.

@hasyimibhar i'll ask you question here real quick and then update our guide.
Nolints are mostly used now for existing code, to not interfere with already existing PRs. Especially lints like gocyclo and gocognit which will require a lot of effort to resolve (in most cases). So its fine to add nolints now to merge opened PRs and maybe open issue about refactoring.
For all new code though, errors from those linters responsible for code complexity should be taken as a strong advice to restructure new code. And nolints can be added only in case of strong arguments why it cannot or shouldn't be changed.

https://app.nuclino.com/Perlin/Perlin-Homebase/-Code-Style-473d34bd-c1a8-409d-b33f-0ec19ab65129

@rkeene this can be closed i guess?

Yep !


Track total minutes of close contact within a certain time frame

Feature description
Keep track of total time of close contact to infected within a certain time frame and add it to the risk evaluation.
Problem and motivation
According to CDC about 15 minutes of close contact to different people within 24 hours is equivalent to 15 minutes of consecutive contact to only one infected. It's specified as "Close Contact" on the following page.
https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/appendix.html
IMHO especially for people in jobs with a lot of short contacts like cashiers, ticket inspectors, receptionists etc. this could really add up during a day.
So if they have close contact to let's say 5 infected, 3 minutes each, they won't be notified of risk if the total time does not matter as single contacts probably where too short. Nevertheless the viral load would probably be pretty similar and so they should get notified that they are at high risk.
Is this something you're interested in working on
No

Internal Tracking ID: EXPOSUREAPP-4031

Hey @christoph-k
Thank you for the suggestion. I have forwarded your request to the developers by creating a ticket in our internal Jira (ticket ID: EXPOSUREAPP-4031). It will now be discussed by the development team and the RKI. Once we get any status updates on the issue, we will report back here on Github.
Regards,
CH

Corona-Warn-App Open Source Team