Is it possible to filter subitems using FastItemAdapter?

I have an expandable list with category as parent and individual item as subitem. I want to filter out subitems on search. Is it possible?

This is sadly not possible as they are not a real part of the main set.
You might be able to achieve something like this using the recursive helper methods but it is not included out of the box


Parameterized FQDN support

Today we hardcode the way we do fqdn generation in external-dns. It always comes in a format of:
serviceName.stackName.envrionmentName.rootDomain

there are use cases when it needs to be parameterized. We should allow:

arbitrary separator
hardcoded values for fqdn parts
metadata keys

more on the format can be found in discussion to this PR: https://github.com/rancher/external-dns/pull/41
@janeczku @vincent99

https://github.com/rancher/external-dns/pull/47

To validate:

Deploy Route 53 v0.6.0 stack from rancher/rancher-catalog:qa specifying a custom name template using placeholders and static text (see README of the template).
Check that the records get created with the expected names

@janeczku I validated this upgrade on master image (24 Oct) using the test cases you specified in the PR and it worked as expected.


Specify single target

How can I send a noitification to a specific target device given a specific FCMToken?
How can I specify the target in the request?
Can I send a notification to a group of targets at the same time?

You have to use the Token property for sending to a specific device. See the example at:

https://github.com/bytefish/FcmSharp/blob/master/FcmSharp/Examples/CSharp/FcmSharp.Example/Program.cs

As far as I can see in the Firebase documents, there is no way to define Device Groups like in the Legacy Google Cloud Messaging API. Let me know if you find a way with the Firebase Cloud Messaging API, I don't know if it is possible.

Thanks


Feature/scroll page dots

Option to show/hide page dots
Option to show/hide survey title
Added Scroll for Page dots for handling more pages (dots)

This PR is unnecessary. You can customize by using SurveyConfiguration and builder
s.SurveyConfiguration(
  titleBuilder: (BuildContext context, s.Elementbase element, Widget child)=>child,
  ...
  child: s.SurveyWidget(
    survey: s.surveyFromJson(survey),
    builder: (context)=>SurveyLayout( stepperBuilder : (BuildContext context, int pageCount, int currentPage)=>YourStepperBuilder),
    onChange: (v) {
      print(v);
    },
    onSubmit: (v) {
      print(v);
    },
  )
)

It's not recommend to use DotStepper when there are too many pages, you may use style like https://pub.dev/packages/flutter_web_pagination


Logs now have menu options, and can write to file as well as print to stdout.

[Current coverage][cc-pull] is 62.62%

Merging [#33][cc-pull] into [master][cc-base-branch] will decrease coverage by 0.04%

@@             master        #33   diff @@
==========================================
  Files            21         21
  Lines          1768       1822    +54
  Methods           0          0
  Messages          0          0
  Branches          0          0
==========================================
+ Hits           1108       1141    +33
- Misses          660        681    +21
  Partials          0          0

Powered by Codecov. Last updated by [c08a680...3e3489b][cc-compare]
[cc-base-branch]: https://codecov.io/gh/CyberReboot/vent/branch/master?src=pr
[cc-compare]: https://codecov.io/gh/CyberReboot/vent/compare/c08a680547bfa060d026ad9e8258020327e4e95d...3e3489bfbc35f65df82081c96df56ebc500f5a49?src=pr
[cc-pull]: https://codecov.io/gh/CyberReboot/vent/pull/33?src=pr


MOG883: update design password-reset page

updating buttons design to vivy-next

this change is meant to affect all buttons and not just the password-reset page, right?

this change is meant to affect all buttons and not just the password-reset page, right?

I don't think another repo is using this one as dependency...


translate:tasks/telemetry/distributed-tracing

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: fleeto
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

content_zh/OWNERS [fleeto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

/lgtm

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: fleeto, rootsongjc
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

content_zh/OWNERS [fleeto,rootsongjc]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment


Support for Membership Screening feature

Ref: https://github.com/discord/discord-api-docs/pull/2396

Types will be added to the types branch.


[Resolved] Site Down - Thursday Dec 10th 22:40 UTC

Edit:  The site is now backup...not sure if you want the Issue still "Open" in order to look at logs or anything.  Close it if you want.

The NaturalCrit site is down.  As is Reddit, so couldn't report it there.
Here is the error:
An error occurred in the application and your page could not be served. If you are the application owner, check your logs for details. You can do this from the Heroku CLI with the command
heroku logs --tail

I didn't see anything particular in the logs, so I just rebooted and it seems to be alive again.
There is an ongoing issue with Herokus servers for the last 6 hours ago and that may have triggered something, but I'm not sure.
We haven't posted any changes for a few days so I don't think it's anything we did, but I appreciate the quick notice so I could fix it.


Application.ls Refactoring

Promisified route and state initialisers and running them in sequence.
Collapsed all the state initialisers into one, to DRY the code in each of the 3 render methods an Application has (form, to-string, clientside).
No longer use component state (setState)
All in all, easier to read and fixes https://github.com/redbadger/reflex/issues/22

Ancient PR


(vendor) Fortio update to 1.0.0

Ran
dep ensure --update istio.io/fortio

To pick up fortio 1.0.0

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: ldemailly
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS [ldemailly]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: ldemailly, rkpagadala
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS [ldemailly]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment


feat: Count the number of pairs of Nats whose lcm is n

This result is central to controlling the error term in my formalisation of the Selberg sieve. Specifically to count the number of terms in a sum.

[x] depends on: #10668

bors r+


HTTPS endpoint in databag

Bug Description
Even after tls is enabled the http endpoint is provided in the databag. This is not the behavior I would expect.
Applications related to traefik need to be aware of when HTTPS is enabled so that they can advertise that endpoint.
I would be happy to open a PR with a fix for this, if we reach an agreement on the behavior of the charm.
To Reproduce
I did the following steps to deploy my charms, but simpler deployments can probably be found:
juju deploy traefik-k8s traefik-public
juju deploy kratos --channel edge --trust
juju deploy tls-certificates-operator
juju deploy postgresql-k8s --channel edge --trust

juju config tls-certificates-operator ca-common-name=demo.ca.local generate-self-signed-certificates=true

juju integrate kratos postgresql-k8s
juju integrate kratos:public-ingress traefik-public
juju integrate traefik-public tls-certificates-operator

The contents of the databag can be seens by running:
juju show-unit kratos/0

Environment
This was tested using juju=3.1.2 and microk8s=v1.27.1 with the metallb plugin to provide an ip address to traefik.
Relevant log output
- relation-id: 8
    endpoint: admin-ingress
    related-endpoint: ingress
    application-data:
      ingress: |
        url: http://<IP_ADDRESS>:80/test-kratos
    related-units:
      traefik-admin/0:
        in-scope: true
        data:
          egress-subnets: <IP_ADDRESS>/32
          ingress-address: <IP_ADDRESS>
          private-address: <IP_ADDRESS>

Additional context
No response

Closed in favor of #177


Spanner tests expect message exception

related #1225
spanner tests check exception messages.

Codecov Report

Merging #1263 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##             master   #1263   +/-   ##
========================================
  Coverage      67.4%   67.4%
  Complexity     1339    1339
========================================
  Files           193     193
  Lines          5500    5500
  Branches        557     557
========================================
  Hits           3707    3707
  Misses         1556    1556
  Partials        237     237

Flag
Coverage Δ
Complexity Δ

#unittests
67.4% <ø> (ø)
1339 <ø> (ø)
:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update eddc9a1...b289c9c. Read the comment docs.


Support SSL for Kyuubi thrift binary connection

Why are the changes needed?

Support SSL for kyuubi thrift binary conenction.
How was this patch tested?

[ ] Add some test cases that check the changes thoroughly including negative and positive cases if possible

[ ] Add screenshots for manual tests if appropriate
Will add screenshot for IT.

[ ] Run test locally before make a pull request

Codecov Report

Merging #3658 (8b20810) into master (d410443) will increase coverage by 0.15%.
The diff coverage is 48.05%.

@@             Coverage Diff              @@
##             master    #3658      +/-   ##
============================================
+ Coverage     51.73%   51.89%   +0.15%
  Complexity       13       13
============================================
  Files           482      484       +2
  Lines         26980    27198     +218
  Branches       3763     3788      +25
============================================
+ Hits          13958    14114     +156
- Misses        11663    11713      +50
- Partials       1359     1371      +12

Impacted Files
Coverage Δ

...apache/kyuubi/service/TBinaryFrontendService.scala
48.88% <4.76%> (-38.87%)
:arrow_down:

...in/scala/org/apache/kyuubi/config/KyuubiConf.scala
97.34% <100.00%> (-0.01%)
:arrow_down:

...kyuubi/engine/spark/session/SparkSessionImpl.scala
61.53% <0.00%> (-9.05%)
:arrow_down:

...apache/kyuubi/engine/JpsApplicationOperation.scala
77.41% <0.00%> (-3.23%)
:arrow_down:

...ache/kyuubi/engine/flink/FlinkProcessBuilder.scala
71.42% <0.00%> (-2.35%)
:arrow_down:

...src/main/scala/org/apache/spark/ui/EngineTab.scala
68.75% <0.00%> (-1.99%)
:arrow_down:

...rg/apache/kyuubi/engine/spark/SparkSQLEngine.scala
75.90% <0.00%> (-1.88%)
:arrow_down:

...rg/apache/kyuubi/server/api/v1/AdminResource.scala
89.74% <0.00%> (-1.17%)
:arrow_down:

...in/scala/org/apache/kyuubi/sql/KyuubiSQLConf.scala
99.01% <0.00%> (-0.99%)
:arrow_down:

.../org/apache/kyuubi/session/KyuubiSessionImpl.scala
75.78% <0.00%> (-0.81%)
:arrow_down:

... and 15 more

:mega: We’re building smart automated test selection to slash your CI/CD build times. Learn more

thanks, merging to master


3rd Party Library “cordova-plugin-ms-azure-mobile-apps” not getting recognized in my Ionic 2 app

Ionic version:  (check one with "x")
[X ] 2.0.0
I'm submitting a ...  (check one with "x")
[X ] bug report
Current behavior:
I added "cordova-plugin-ms-azure-mobile-apps" library/module to my project and after importing "WindowsAzure" from it, I wrote the following line of code to connect to my Microsoft Azure Mobile Apps Backend:
pushClient = new WindowsAzure.MobileServiceClient('https://myazuremobileapp.azurewebsites.net');
I run my app using "ionic serve" to run it in my Chrome browser. At this point, I get a Runtime Error as below:
**
Runtime Error
Cannot find module "cordova-plugin-ms-azure-mobile-apps"
Stack
Error: Cannot find module "cordova-plugin-ms-azure-mobile-apps"
    at Object.<anonymous> (http://localhost:8100/build/main.js:114165:7)
    at __webpack_require__ (http://localhost:8100/build/main.js:20:30)
    at Object.<anonymous> (http://localhost:8100/build/main.js:29990:72)
    at __webpack_require__ (http://localhost:8100/build/main.js:20:30)
    at Object.<anonymous> (http://localhost:8100/build/main.js:114006:79)
    at __webpack_require__ (http://localhost:8100/build/main.js:20:30)
    at Object.<anonymous> (http://localhost:8100/build/main.js:29966:100)
    at __webpack_require__ (http://localhost:8100/build/main.js:20:30)
    at Object.<anonymous> (http://localhost:8100/build/main.js:113629:71)
    at __webpack_require__ (http://localhost:8100/build/main.js:20:30)
**

The same happens on my Android phone when run the app on phone using "ionic run android". I get the same exact error.
Expected behavior:
If all goes well, the "client" object/variable should have reference to my Microsoft Azure Mobile Apps Backend. Then using that reference I can register my phone for receiving Push Notifications.
Steps to reproduce:

Create a base Ionic 2 project as ionic start azuretestapp sidemenu --v2 --ts

Add the required plugin using following command: (You can use npm install --save also for the same)

        ionic plugin add cordova-plugin-ms-azure-mobile-apps --save

In the base project, in app.component.ts file, write following import statement:
 import { WindowsAzure } from 'cordova-plugin-ms-azure-mobile-apps';

Add a variable in MyApp class as below:

           pushClient: any = null;

In the base project, in app.component.ts file, add the following in initializeApp() method:

         this.pushClient = new WindowsAzure.MobileServiceClient('https://myazuremobileapp.azurewebsites.net');

The complete initializeApp() method should look like this:
          initializeApp() {
              this.platform.ready().then(() => {
               // Okay, so the platform is ready and our plugins are available.
               // Here you can do any higher level native things you might need.
              StatusBar.styleDefault();
              Splashscreen.hide();

              this.pushClient = new WindowsAzure.MobileServiceClient('https://myazuremobileapp.azurewebsites.net');
          });
  }

Run command "ionic serve" and you will get the error in your browser window.

Other information:
After trying to fix this for 2 days now, I believe this is Ionic 2 specific problem. I am saying this because I am successfully able to use the same "cordova-plugin-ms-azure-mobile-apps" from a regular HTML/JavaScrip project.
The Stacktrace is:
**
Runtime Error
Cannot find module "cordova-plugin-ms-azure-mobile-apps"
Stack
Error: Cannot find module "cordova-plugin-ms-azure-mobile-apps"
    at Object.<anonymous> (http://localhost:8100/build/main.js:114165:7)
    at __webpack_require__ (http://localhost:8100/build/main.js:20:30)
    at Object.<anonymous> (http://localhost:8100/build/main.js:29990:72)
    at __webpack_require__ (http://localhost:8100/build/main.js:20:30)
    at Object.<anonymous> (http://localhost:8100/build/main.js:114006:79)
    at __webpack_require__ (http://localhost:8100/build/main.js:20:30)
    at Object.<anonymous> (http://localhost:8100/build/main.js:29966:100)
    at __webpack_require__ (http://localhost:8100/build/main.js:20:30)
    at Object.<anonymous> (http://localhost:8100/build/main.js:113629:71)
    at __webpack_require__ (http://localhost:8100/build/main.js:20:30)
**

I have also posted this issue on Stackoverflow, here is the link with complete description:
http://stackoverflow.com/questions/42016964/3rd-party-library-cordova-plugin-ms-azure-mobile-apps-not-getting-recognized-i
Ionic info: (run ionic info from a terminal/cmd prompt and paste output below):
Your system information:

 ordova CLI: 6.5.0
Ionic Framework Version: 2.0.0
Ionic CLI Version: 2.2.1
Ionic App Lib Version: 2.2.0
Ionic App Scripts Version: 1.0.0
ios-deploy version: Not installed
ios-sim version: Not installed
OS: Windows 7
Node Version: v6.9.4
Xcode version: Not installed

This issue was moved to driftyco/ionic-app-scripts#707


[Enhancement] se titlecase usage note in Step-by-Step guide

tl;dr

please add information on the -n switch for se titlecase to the Step-by-Step Guide;
relevant location is @ line 183 of the page code.

The last project I attempted gave me, for the first time, chapter titles in ALL CAPS.
I have an editor¹ that makes it very simple to filter selected text through an external command, so used se titlecase for this. It was so annoying to have selected the text between the <h3>...</h3> tags, only to have the closing tag shunted on to the next line for every chapter title.
I thought it was a glitch, so looked at the code on Github and ... discovered there is a --no-newline -n switch! Wonderful! (I note, too, this is nicely explained in the --help text.)
Given that the use case as presented in the S-b-S guide is for chapter titles, would it be worth alerting producers to this at that point? That would have helped me. At least there were only 28 chapters ... not 80. :wink:
¹ That was Textadept, but I've since worked out how to manage this in VS Codium (assigned to shortcut key) which I normally use for SE projects.

Sure, you create a pull request to mention that if you like.

Pull request created - I'm confident you can improve my wording! Hope this helps. / David


Some awesome feedback from robjama

[x] Spacing between play options (next, previous, play/pause) and text
[x] New favicon (might need design work)
[x] Give heading on the landing more weight ( I increased the font-size)
[x] Add home and book icon
[ ] Change from recitations to recriters

@ahmedre point number 5 is a db change, not sure if I can do that locally or you'll have to do a n update on the db.


add tests, small bugfix in exception handling

Coverage increased (+1.7%) to 100.0% when pulling aef9d68a584cc67c2bb54cc3af37969bf2366145 on tests into 3df548fc554ea230fe41dc32a61af2d1e27b2b14 on master.


Let cdi extension inject EntityManager and EntityManagerFactory not only into CDI Producer

As of today the jpa-unit cdi-extension handles CDI Producer only. That is, the jpa-unit cdi-extension cannot cope with situations, where the code under test injects EntityManaget or EntityManagetFactory directly (by using e.g. @PersistenceContext annotation). In such situation the developer has to inject the EntityManaget or EntityManagetFactory created by the jpa-unit by hand (e.g. by using a corresponding setter or reflection) in the test setup method. The jpa-unit cdi-extension is even not needed in such cases. It would be however helpful, if the cdi-extension would support such cases as well, thus eliminating the need of manual setup.

Is there any suggestion on how to get around that problem?


Add header files to exclusion list in ObjectiveGit.modulemap

Fixes #588, for Xcode 10.0 with latest objective-git (0.14.2).
Based on #523.

Looks good to me, thanks for the PR !

Great, thanks for merging!


jssrc2cpg: Replace IOUtils.readLinesInFile with Files.readString

Is there any catch on doing this? EDIT: I suppose BOM wouldn't be handled. Will rework that.
Fixes: #2601

EDIT: I suppose BOM wouldn't be handled. Will rework that.

Yes, exactly. IOUtils.readLinesInFile does quite a lot w.r.t. to BOM handling and strange UTF8 encoding.


Realvictorprm codelensfixes

Oh geez what's happening here? If you want to take over my PR please talk to me before and don't just submit.


KeyError: 'switches'

Hello,
I am having the following error when I call s.switch('on', device_id, 0):
Traceback (most recent call last):
  File "/tmp/test.py", line 14, in <module>
    s.switch('on', device_id, 0)
  File "/usr/local/lib/python2.7/dist-packages/sonoff/sonoff.py", line 246, in switch
    params = { 'switches' : device['params']['switches'] }
KeyError: 'switches'

Looking at the device object, I see:
 u'params': {u'fwVersion': u'1.6.0',
             u'rssi': -51,
             u'staMac': u'68:C6:3A:A3:8B:B4',
             u'startup': u'off',
             u'switch': u'off'},

There is no 'switches' key  in 'params'

It works if I use s.switch('on', device_id, None) instead

It seems that we get that error if the switch is not an outlet type.


[docs] TypeScript withStyles decorating

[x] This is a v1.x issue (v0.x is no longer maintained).
[x] I have searched the issues of this repository and believe that this is not a duplicate.

Expected Behavior

Cleaner verbiage. Possible rewordings:
"Applying withStyles as a function works as expected:"
or
"[...] withStyles can't be used as a decorator (@withstyles()) in TypeScript."
Current Behavior

The TypeScript "Decorating components" section of the docs (minus example):
Applying the withStyles(styles) decorator as a function works as expected:
// Example here
Unfortunately due to a current limitation of TypeScript decorators, withStyles can't be used as a decorator in TypeScript.
Context

This confused me because my mental definition of decorator is "a callable that returns a callable", which fits in with the first sentence and heading. However, the second sentence seems to follow the TypeScript language's conception of decorator, which appears to consider the "@decorator()" syntax part of what makes a decorator a decorator.
The example added to my confusion, but this might just be me. Specifically the use of anonymous components. I initially thought that I had to write things this way, because I had never seen one before.

@pelotom What do you think?

I’m certainly open to wording improvements that would make it clearer. Would you like to open a PR, @swpease?


Vexu/routez has been archived

https://github.com/catdevnull/awesome-zig/commit/907881165e073d7ecfc5197e87d72de85bdee838


Open URI in new window

Hello,
I am using your plugin to open specific workspaces/
Do you think it would be possible to add an argument to the URI that would open a workspace (from the same vault) in a new window? (so that I can have two workspaces of the same vault open at the same time? Or is this not possible due to obsidian limitations?)
Best,
Rhydderch

I don't think workspaces work that way. They save the window configuration as well. So it's not possible to load a workspace in a specific window. Or am I missing something?

Closing because of no response. Just comment if you have still problems, and I'm open to reopen the issue.


feat(apk): Created a new Android APK

PR related to this trello task --> https://trello.com/c/PsnAIhTr

:tada: This PR is included in version 1.6.0 :tada:
The release is available on:

npm package (@latest dist-tag)
GitHub release

Your semantic-release bot :package::rocket:


Apply global_1level_cut at each level

Currently, in adiar/internal/algorithms/reduce.h we accumulate all the edges that have been tainted by a node being suppressed (via. Reduction Rule 1). These edges are then added to the maximum at the very end of the algorithm.
Essentially, we over-approximate the cut in the graph by thinking the tainted edges as spanning level -∞ to ∞ next to the untainted DAG. Yet, it is sound and much closer to the DAG's structure if we instead only think the tainted edges from level i as spanning level i to ∞.

[x] Extend the node_writer with the possibility to add on-top of the current maximum (rather than taking the maximum).
[x] Design one or more unit tests in test/adiar/internal/algorithms/test_reduce.cpp, where the globally counted tainted edges are quite deep in the DAG and hence are (partially?) dominated by levels further above.
[x] Rename global_1level_cut to tainted_1level_cut and have it only live inside __reduce_level(...). At the end of processing the level, add tainted_1level_cut to the maximum cut in the node_writer (after having taking the maximum with local_1level_cut).

Closed with 5428ca9ce3648721dfe693342d40e39a392a025d


channels closing when watching k8s objects for events

This generates a log message like Failed watching K8S objects of type apps/v1, Resource=deployments. This shouldn't happen. Please report a bug at: https://github.com/windmilleng/tilt/issues, and then tilt stops watching objects of that type.
This is discussed a bit more here. It's worth noting the first line of that comment supposing it's CRD-specific is evidently wrong, as users have observed this affecting Deployment. This was committed as it was since no one else was able to reproduce the problem.

This was addressed by #1797


test on Node 10,12

Codecov Report

Merging #4 into master will decrease coverage by 0.05%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master       #4      +/-   ##
==========================================
- Coverage   94.52%   94.46%   -0.06%
==========================================
  Files          32       32
  Lines        1681     1681
  Branches      405      405
==========================================
- Hits         1589     1588       -1
- Misses         92       93       +1

Impacted Files
Coverage Δ

lib/chai/utils/overwriteProperty.js
90.9% <0%> (-4.55%)
:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d4d8d4a...db98f7d. Read the comment docs.


Crashing during priority queue preparation

First of all, congratulations for your publication! This is are high quality results! :)
The issue:
The execution crashes during the Priority queue preparation. I don't know if it is due some logic error in the procedure or some inconsistencies with the libigl internal structures and how it reads the OBJ. The code crashes at the following line:
cost_and_placement.cpp#L106
The error is the following:
libc++abi.dylib: terminating with uncaught exception of type std::out_of_range: unordered_map::at: key not found
To replicate:
Use the following OBJ 3D model of a Tractor:
Tractor Model
On a side note, it seems like there is a weird non deterministic behavior with libigl... the assertions and runtime errors show up randomly, specially if running in a debugger or release, the same line of code yields different errors.

@vsantosu did you find a solution to this?

@sinclairzx81  sadly not... I think it has to do with the dependency library (libiGL). Something changed and I was unable to figure out a fix to make it work. This is a great solution, but like all academic projects there are no man power to maintain it :(
On a side note, I recall reading the libIGL source code and there was a decimater included, perhaps this technique will be included in the library itself at some point.

@vsantosu thanks for the insights :) i might take a deeper dive into this and see if i can figure something out. But yeah, this project is pretty great, the UV seam awareness is a top feature of this particular library, curious about other approaches for clean UV preservation.

@sinclairzx81 I have look into it many times. From all the techniques(planar, remeshing, quadric edge collapse) this one is the best based on many samples I tried, I wish it where more stable.

Hi,
Any update regarding this issue?
I still haven't be able to process any obj other than the one provided as example in the repo

I think I may have a solution -- a lot of OBJ files have 3 UVS--such as the ones produced by Cinema4D --which is valid though they actually seem to only use the first 2 values as the 3rd is always zero.  In any case

Goto the ReadOBJ.cpp file, and to insert the line
    Count = 2;

just before Line 131,
       std::vector<Scalar > tex(count);

You need to do this because the decimation function requires the UVs to have exactly 2 columns and OBJ can legally have 3.  By Explicitly setting it to 2 you are tossing the third value which appears to always be zero in files I’ve seen, anyway.
Similarly, OBJ files can legally have NO UVs but the library can't handle that, so make sure they have UVs assigned.


The plugin doesn't work with Bootstrap v4.0.0-alpha.6

The plugin doesn't work correctly with v4.0.0-alpha.6.
The accordion is shown in addition to the tabs on big viewport sizes and the tabs don't hide on small viewport sizes.
Can someone help me?

Can confirm this plugin does not work in Bootstrap 4

Any prospect for this working in Bootstrap 4?  I am not having any luck finding a responsive tabs plugin for v4.

@phlpedr would you be willing to post page source for a sample page?  I cannot get this to work.

Any update on this? will it work with bootstrap 4?

Hi,
I have made some changes for latest Bootstrap 4.0.0
responsive-tabs.js.zip
And used this to show and hide between sm and md.
        (function($) {             fakewaffle.responsiveTabs(['sm','md']);         })(jQuery);

@malasaad82 I have try your code with bootstrap v4.1.2. and it is working good. Just does create one issue. It does display only fist collapse content in accordion (responsive mode). It does not display other collapse content. can you please any fixed. I have try but no luck.

@harnishdesign, can you post a simple example of how you got this to work with bootstrap v4.1.2?

@malasaad82  and @harnishdesign  Did you guys ever get the data-parent working? Using your edited script - I cannot open only one at a time - like if one is open the rest are closed etc like how data-parent should work.  Just can't get it working on this script. Thanks

Nevermind. I got ti working now. Thanks!

Any alternative plugins for Bootstrap 5?


I am getting this when i run my app on real device using personnel account nonpaid

dyld: Library not loaded: @rpath/Alamofire.framework/Alamofire
Referenced from: /private/var/containers/Bundle/Application/B88AA768-39EC-4297-BF80-2259A9A7A7B3/UPaisa.app/UPaisa
Reason: no suitable image found.  Did find:
/private/var/containers/Bundle/Application/B88AA768-39EC-4297-BF80-2259A9A7A7B3/UPaisa.app/Frameworks/Alamofire.framework/Alamofire: code signature invalid for '/private/var/containers/Bundle/Application/B88AA768-39EC-4297-BF80-2259A9A7A7B3/UPaisa.app/Frameworks/Alamofire.framework/Alamofire'

Sorry, we use our GitHub project for bug reports and feature requests. In the future, you should open questions like this on Stack Overflow.
Cheers. 🍻

From our Contribution Guidelines
Asking Questions
We don't use GitHub as a support forum. For any usage questions that are not specific to the project itself, please ask on Stack Overflow instead. By doing so, you'll be more likely to quickly solve your problem, and you'll allow anyone else with the same question to find the answer. This also allows maintainers to focus on improving the project for others.


"Cosmești", "Cosmeștii-Vale", "Băltăreți", "Furcenii Noi", "Furcenii Vechi" and "Satu Nou" are listed in the drop-down menu

Description:
""Cosmești", "Cosmeștii-Vale", "Băltăreți", "Furcenii Noi", "Furcenii Vechi" and "Satu Nou" are listed in the drop-down menu alongside its corresponding county and commune, according to the law
Precondition:
The website is up an running.

Step 1
Type "Cosmești" in the search bar.

Expected results
The location is listed in the drop-down menu as "Sat Cosmești, GALAȚI (Cosmești)".

Step 2
Press "x" button.

Expected results
The location was deleted from the search bar.

Step 3
Type "Cosmeștii-Vale" in the search bar.

Expected results
The location is listed in the drop-down menu as "Sat Cosmeștii-Vale, GALAȚI (Cosmești)".

Step 4
Press "x" button.

Expected results
The location was deleted from the search bar.

Step 5
Type "Băltăreți" in the search bar.

Expected results
The location is listed in the drop-down menu as "Sat Băltăreți, GALAȚI (Cosmești)".

Step 6
Press "x" button.

Expected results
The location was deleted from the search bar.

Step 8
Press "x" button.

Expected results
The location was deleted from the search bar.

Step 10
Press "x" button.

Expected results
The location was deleted from the search bar.

Step 11
Type "Satu Nou" in the search bar.

Expected results
The location is listed in the drop-down menu as "Sat Satu Nou, GALAȚI (Cosmești)".


Support out of distribution detection metrics

If an OOD enabled model is deployed, model mesh metrics should capture the two additional metrics that these models generate as part of the inferencing metrics.

OOD enabled model will produce in a single output tensor:

Original model inferencing output
OOD score

We would need output transformation to separate 1 from 2 and logging to record the input/output and OOD scores (e.g., in OpenShift logging and/or Prometheus). These are generic functionalities that should be useful for things beyond OOD.

Hi, @mudhakar @taneem-ibrahim , just to add more details on OOD (model certainty) enablement and deployment.

To get an certainty enabled model, the certainty container will take in the original model and a in-distribution (normal) dataset, then the output is a modified model which will be stored at user-specified location. The modified model is capable of generating the original model inference output and a certainty score.
The modified model can be deployed just like a regular model (right diagram). To take advantage of the certainty score, an output transformation can be used to extract the score; then the certainty score can be logged into Prometheus or other relevant services for model monitoring, dashboarding, etc.

Per a discussion with @njhill and @ckadner, the best path forward is to have an output transformer (similar to post-processing transformer in k-serve) native to model-mesh, without requiring k-serve controller.

@nirmdesai @mudhakar After further discussion with @njhill and @ckadner , sounds like our fastest way to get integrated would be to add a custom post processor as part of OOD for now until we have kserve-raw or serverless available in ODH.

A proposal for the post-processing transform

Hi @nirmdesai Is the kserve proxy (rest server) here replicating functionality similar to this?

@taneem-ibrahim: Just to be precise, we are not going to use K-Serve transformer framework (shown in the link you shared) in implementing K-Serve Proxy.
However, the implementation of our K-Serve Proxy will look similar to a typical pre-/post processor function shown in the example above.
Also, the deployment flow will be different from the link you shared wherein the transformer is deployed along with InferenceService creation. In our case, you would first create an InferenceService as you would normally, and on top of that deploy the proxy container. Then you would use the Proxy APIs for inferences instead of using the InferenceService APIs for inferencing.
cc: @mudhakar , @daw3rd , @spacew

Hello @taneem-ibrahim @nirmdesai @mudhakar @spacew @daw3rd  cc: @njhill @ckadner
In regards to a proxy service for transforming model output for a certainty-enabled model, below is a diagram demonstrating the interaction for a modelmesh proxy server deployed on the openshift to the same cluster as where RHODS is hosted. Note that in the deployment, we also deploy a Prometheus service for logging the model-certainty metrics overtime as generated by the modelmesh proxy service - both are packaged via helm install, however, if a Prometheus instance already exists, this can be removed.
Please share feedback or comments on the deployment and sequence steps, as well as the endpoint for reaching the modelmesh proxy.

Copying discussions I've had on Slack:
I think TrustyAI can provide a lot of the capabilities that the modelmesh-proxy is aiming to provide, which would provide the advantage of not needing to add another component into the mix
TrustyAI within ODH/RHODS is a service that intercepts modelmesh inputs and output payloads and then sends metrics computed on that input/output data (e.g., fairness metrics) to Prometheus. If we defined a metric that simply grabbed the certainty scores from the model output payload and emitted them to Prometheus as a metric, it'd be a really simple way of doing what you're trying to do.
As a PoC, I've done exactly that and got an OOD model deployed in modelmesh and sending the OOD metrics to Prometheus within OpenDataHub:


Use bools

This PR refactors to have "false" and "true" parameters become actual booleans. There's a potential backwards compatability issue with this PR, if someone using the library were already using those param values as strings. However, in my opinion this seems like a pretty minor issue, and it's better to make the parameters clearer going forward. It's likely the case that some users (currently using these param values) are already expecting the values to be actual booleans, in which case this PR would fix bugs in their code.

There's a potential backwards compatability issue with this PR, if someone using the library were already using those param values as strings.

Yeah, I'm getting the feeling more and more that there are some places where the code isn't actually that consistent and reasonable, but changing it would mean that we have to give up Backwards Compatibility at least partially. On the other hand, I wouldn't like to have the inconsistent solutions in the codebase all the time because of that.
What would you think about trying to clean up the code a bit (potentially also with some breaking changes) and just assume that the next version we release will be a major version? This way we could get rid of the constraint of backwards compatibility and thus bad solutions (like wrong data types) at least a little bit (although this also has disadvantages of course).

@kieferro Thanks for the feedback! I think that general approach for backwards compatability makes sense. Since we'll probably have a month or two until we can publish on pypi, now seems like as good a time as any to fix up inconsistencies. We should probably still try to avoid backwards compatibility conflicts where possible, but in cases where the code is likely to confuse users, that makes sense to update.


cookie.parse did not to be executed

hi I upgrade to the latest version[1.0.1] but there's something problem. I didn't see what's difference between the older version, but I saw IS_NODE always true both in browser or node environment. It might be the problem why cookie.parse wasn't executed.
https://github.com/thereactivestack/react-cookie/blob/master/src/cookie.js#L13

Same problem here with cookie.load. I think the first check in the referenced line is wrong; for Node environments I would assume document is undefined, since document is a browser thing.

@dmeenhuis yes. that's the part what i confused.

The 1.0 version has no major API change, but it's a rewrite with import and since it is widely used in production, I though it was time to bump to 1.0.
I'll fix this real quick.

This is broken in 0.4.9 too.

Should be fixed in 1.0.2

@eXon I've test it in 1.0.2, but the this statement is not going to work.
typeof module !== 'undefined' && module.exports;

because module is defined by webpack environment.

@eXon I've test it in 1.0.2 but it's not working in webpack environment.
BTW I've found an npm package called is-node that has a different implementation of is-node :
!!(typeof process !== 'undefined' && process.versions && process.versions.node)

I've tried it and it seems to be working

@echaouchna should be fixed in 1.0.3 sorry about that. thank for the tip

Now it's working
Thank you

Hello @eXon, i still have this issue :(
i use<EMAIL_ADDRESS>on a my server express it's ok, but on a browser IS_NODE is true
see this console.log() (a log for the lib is-node it's present too):
/* node */
react-cookie:(typeof document === "undefined"),  true
react-cookie:(process && process.env && process.env.NODE_ENV === "test"),  false
react-cookie:IS_NODE,  true
is-node: (!!(typeof process !== "undefined" && process.versions && process.versions.node)),  true

/* browser */
react-cookie:(typeof document === "undefined"),  false
react-cookie:(process && process.env && process.env.NODE_ENV === "test"),  true
react-cookie:IS_NODE,  true
is-node: (!!(typeof process !== "undefined" && process.versions && process.versions.node)),  false

please consider the solution of the lib is-node, thx


Close button doesn't contrast well in Notifications

Hey man! Your update looks freaking amazing and is the material UI that I always wanted! This is now my theme of choice!
Issue is that the close button on notifications looks a bit too dim IMO. Can't get a screencap cause they disappear too quickly and I don't know how to get a notification to test.

You can paste this snippet in the dev console:
atom.notifications.addInfo("Test Notification", { dismissable: true });
atom.notifications.addError("Test Notification", { dismissable: true });
atom.notifications.addFatalError("Test Notification", { dismissable: true });
atom.notifications.addWarning("Test Notification", { dismissable: true });
atom.notifications.addSuccess("Test Notification", { dismissable: true });

Yes, it looks much better now. Thanks! Again, great theme!


Remove duplicate data structure for editor export features

It's a bit weird to have this data stored twice in two different data structures. This PR makes it so that there is only one, the HashSet one. It's converted to Vector where needed.

This duplicate vector was added by @reduz in d3c1f2a7f69, so he should probably review. The main question is whether it's slow enough to reconstruct every time you export to warrant caching it.

needs rebase

Thanks!


[cli] add slide panel when clicking a cell

it should have min and max width in the props

done with #82


Create a Random size/color rectangle generator

Make sure to follow all rules
github.com/shubham7668/WebDev#rules

@shubham7668 ,I have read the rules, Can  I add my project?

Yes go ahead

@shubham7668 ,I have read the rules, Can I add my project?

I have read the rules and I want to contribute to this project as a Part of hacktoberfest
add me as a contributor .

Hey @Rish-it this issue is already fulfilled(Only unique projects allowed)
Kindly create another issue if you want to contribute & mention me i will assign that for you

@shubham7668 sir ,please add hacktoberfest label ,else it will not be counted, my merged pr is not reflected yet in my profile, so , please add label of hacktoberfest

@shubham7668 sir ,please add hacktoberfest label ,else it will not be counted, my merged pr is not reflected yet in my profile, so , please add label of hacktoberfest

Actually, it does not matter(in reflecting)
But i have added let see if it works


cannot import name '_compare_version' from 'torchmetrics.utilities.imports

🐛 Bug

To Reproduce
Steps to reproduce the behavior...

Code sample

Expected behavior

Environment

TorchMetrics version (and how you installed TM, e.g. conda, pip, build from source):
Python & PyTorch Version (e.g., 1.0):
Any other relevant information such as OS (e.g., Linux):

Additional context

Hi @liguge, thanks for raising this issue.
_compare_version has been moved to https://github.com/Lightning-AI/utilities which contains many utilities functions used in all lightning products. The package is automatically installed as a dependency of torchmetrics.
Please update your import to
from lightning_utilities.core.imports import compare_version

Thanks.
Closing issue.

Ok, how do I update the import?

issue has been worked out


Inconsistent range strips

Strips(the line that representing the date range) are not rendering right. I put different start date and same end date of two different notes so the strips should start at different location and end at same but it is not happening.

I'm actually having trouble getting the timeline to render anything but the red color strips. Even though there are several events that don't have ranges(i.e., One Day), and others that have a range of two days but are going straight down to the bottom of the timeline, and overlapping.
I have attached a quick snap of my timeline and some example Frontmatter. I am using Fantasy Calendar, so I am using fc-date/fc-end instead of aat-event-start-date and aat-event-end-date.

Unsure why the strip is assuming the first event in the timeline spans the whole timeline, as well as there is a clear overlap of rendered strips when another even spans more than one day.

It might be bound to your theme / plugin ?
If you wouldn't mind upoading a .zip of the vault where this is happening it would help me a lot
Are you on mobile ?

I am viewing this on PC. Mobile seems to share the same problem; the colored strips are extending beyond their frontmatter event dates.
XethgnurVaultShare.zip
I also switched between ITS and the default themes; no change to the rendered color strips.
And I disabled Styling Settings plugin, as that would be the only other plugin i can think of that would be affecting Vault appearances; no change either.
I hope this helps; I've really loved the plugin overall and just found it unfortunate the color strips aren't cooperating.

It appears as though the color bars treating each unique event as a tick for its given length instead of comparing if events are sharing a range within a given date range.
So, if I have an event that spans "4 days", the color bars extend through 4 events, even if they don't share a "day" based on date format settings. They also seem to disregard each other if there is overlap and only render red, which I think is technically working as intended; its just that the timeline is acting on the number of events for a given length, and not the given range in the date format, because I do not currently have overlapping time ranges.

Pushed #58 and tagged as the latest release
Your case should display itself without overlaping, but the main range consistency issue this issue raises is still up for fixing

I have a problem with colored time strips not behaving right too
No matter what i do, the second from the bottom always ends up spanning down to the end, when it should stop right before the last one, and it happens regardless of the fact of evets being put in one note, or not

I'm also facing the same issue. In the following screenshot you can see that the green strip instead of ending after green, orange and yellow strips, ends siginifcantly before them. It adds confusion as those strips are the crucial feature that allows me to understand how things are fitting together.

@Xkonti Thanks for reporting this
I'm a little overwhelmed by my day job recently so this will take a bit of time to get to
If you feel like helping me out I would love getting my hand on every case of innacuracy people come into.
A .zip of the vault would do just perfectly

@April-Gras Sorry about the delay. You can find the trimmed version of the vault here: IssueVault.zip
The timeline is located in World/Timelines/Timeline of politics.md


I am not able to create nanoserver and server with ltsc2022 tag

Following the guide microsoft-windows-server , I am not able to pull the windows containers with "ltsc2022" tag:
> docker image pull mcr.microsoft.com/windows/nanoserver:ltsc2022
ltsc2022: Pulling from windows/nanoserver
no matching manifest for windows/amd64 10.0.19045 in the manifest list entries

or
> docker pull mcr.microsoft.com/windows/server:ltsc2022
ltsc2022: Pulling from windows/server
no matching manifest for windows/amd64 10.0.19045 in the manifest list entries

While 1809 tag works for the nanoserver:
> docker image pull mcr.microsoft.com/windows/nanoserver:1809
1809: Pulling from windows/nanoserver
fe57e9b10127: Pull complete
Digest: sha256:18161f2add9622768033bacf4f069d6d618a734aa9587c6d213fc15d99bcb057
Status: Downloaded newer image for mcr.microsoft.com/windows/nanoserver:1809
mcr.microsoft.com/windows/nanoserver:1809

Also, other tags listed here are not working, Are the tags updated?

Working using a Windows Server 2022 host.
I was hitting this
> docker image pull mcr.microsoft.com/windows/nanoserver:ltsc2022
ltsc2022: Pulling from windows/nanoserver
546fcac75d6a: Pull complete
Digest: sha256:786a24be2bd1945bee9701f95a71d8573ace8641c112dc27206f826bef0229c1
Status: Downloaded newer image for mcr.microsoft.com/windows/nanoserver:ltsc2022
mcr.microsoft.com/windows/nanoserver:ltsc2022


fix(shared): export error tips

This is not an issue caused by Vue and this is definitely not the right fix.


What do I need to run on server?

When I run npm start command and open browser with localhost:3000 shows example site flawlessly. However, when I run npm run deploy and upload to a remote server, the page shows <noscript /> tag. Should I setup anything on the remote server to run this?
I am pretty sure this is a great starter kit, but since it doesn't work on remote, I cannot go further.
Thanks for your help.

You should just be able to point your web server at the dist folder and re-route any non-index routes to the root index.html file. It's not recommended, but you should be able to run:
NODE_ENV=production npm start

Which will start the Koa server without any of the webpack middleware but it will serve the compiled dist folder. If that isn't working then there is indeed an error somewhere.

So I need to run Koa server on the remote? Is it possible to use this starter kit w/o remote (or local) Koa server?

You do not need to run an app server (Koa, Express) for the app to work. You do need some sort of web server to serve the static files (Nginx) that are compiled to dist, but that's all.
Here's some info about using other local servers: https://github.com/davezuko/react-redux-starter-kit/issues/581

So you need something in the server such as Nginix to make dist work on remote server?

You can use whatever you want, Apache, Nginx, anything. All you have to do is point all incoming route requests to your compiled /dist folder, so that the index.html in the root of the directory is served.
Unfortunately I'm very weak with Apache, but I imagine there's a fairly easy way to do this with the .htaccess file. If you'd prefer you could spin up the koa server (NODE_ENV=production npm start) and then point all incoming requests to localhost:3000 and that also should work, it will just be a bit slower than serving static files with a web server.

Could anyone put an example on running the compiled /dist folder on nginx of apache?
In nginx if I use try_files $uri$args $uri$args/ /index.html; for redirecting to the root page the web seems to be working ok. However when pressing F5 the web content is found but is not rendered.
That's it using Chrome developers tools it can be seen that the contents are loading correctly (If I do not put that redirection on nginx I only get a 404) but justs renders blank page.
If I run the sudo npm run dev:no-debug (sudo for binding to 80 port) it works well, but that's not production mode.
Someone has succeded?

Thanks for all your help. I finally figured it out. The problems that I had was I did put the outputs from /dist folder in subfolder inside my server; for example, I put all exported files under mydomain.com/example/app so the react-router didn't know the basepath.
All I had to do was running BASENAME='/example/app' npm run deploy command and react-router will set the base path properly.
Thanks again for your kind help and time.


Add more logging for segment reloading status.

Description
Add more logging to indicate the status of segment reloading. The segment reload involves multiple steps and conditions. We found it is hard to track the status for operation like segment reloading to populate derived columns.
A good description should include pointers to an issue or design document, etc.
Upgrade Notes
Does this PR prevent a zero down-time upgrade? (Assume upgrade order: Controller, Broker, Server, Minion)

[ ] Yes (Please label as backward-incompat, and complete the section below on Release Notes)

Does this PR fix a zero-downtime upgrade introduced earlier?

[ ] Yes (Please label this as backward-incompat, and complete the section below on Release Notes)

Does this PR otherwise need attention when creating release notes? Things to consider:

New configuration options
Deprecation of configurations
Signature changes to public methods/interfaces
New plugins added or old plugins removed

[ ] Yes (Please label this PR as release-notes and complete the section on Release Notes)

Release Notes
If you have tagged this as either backward-incompat or release-notes,
you MUST add text here that you would like to see appear in release notes of the
next release.
If you have a series of commits adding or enabling a feature, then
add this section only in final commit that marks the feature completed.
Refer to earlier release notes to see examples of text
Documentation
If you have introduced a new feature or configuration, please add it to the documentation as well.
See https://docs.pinot.apache.org/developers/developers-and-contributors/update-document

Codecov Report

Merging #6754 (1c73af5) into master (50a4531) will increase coverage by 23.14%.
The diff coverage is 8.33%.

:exclamation: Current head 1c73af5 differs from pull request most recent head 3dcbd83. Consider uploading reports for the commit 3dcbd83 to get more accurate results

@@              Coverage Diff              @@
##             master    #6754       +/-   ##
=============================================
+ Coverage     42.98%   66.13%   +23.14%
- Complexity        7       12        +5
=============================================
  Files          1408     1409        +1
  Lines         68554    68556        +2
  Branches       9907     9906        -1
=============================================
+ Hits          29468    45337    +15869
+ Misses        36600    20009    -16591
- Partials       2486     3210      +724

Flag
Coverage Δ
Complexity Δ

integration
?
?

unittests
66.13% <8.33%> (?)
0.00 <0.00> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 50a4531...3dcbd83. Read the comment docs.


kernel: workq: unify submit APis

We can just do a runtime check for submitting to a workqueue,
it doesn't depend on whether the target queue is running in
user mode or not.
Signed-off-by: Andrew Boie<EMAIL_ADDRESS>

Codecov Report

Merging #11748 into master will increase coverage by <.01%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master   #11748      +/-   ##
==========================================
+ Coverage    48.2%   48.21%   +<.01%
==========================================
  Files         280      280
  Lines       43323    43318       -5
  Branches    10374    10372       -2
==========================================
- Hits        20886    20884       -2
+ Misses      18289    18288       -1
+ Partials     4148     4146       -2

Impacted Files
Coverage Δ

include/kernel.h
98.5% <100%> (+4.06%)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3c4bb10...f2b5f8d. Read the comment docs.

Hold off on merging this -- I think I can do even better by unifying the k_queue_alloc_append and k_queue_append APIs

Adding DNM label -- doing some testing to ensure I haven't missed any cases where this could be a security issue.

OK, I need to close this. I can't make the allocation decision for k_queue based on what mode the caller is running in. This introduces a security problem for the case where we are working with queues with data that user mode threads have access.
The problem is when a supervisor thread enqueues an item. Any user threads consuming that item will have access to the entire data item. With the variants that do an allocation, this is no problem because the queue linked list is allocated in private memory and user threads which might have access to the item won't be able to tamper with the linked list pointers before it gets removed from the queue.
But if you don't allocate, then the private kernel pointers are stored within the item itself. While it sits in the queue, before it is consumed, this information could be tampered with. So we really need to provide supervisor mode with the ability to also enqueue with an allocation.
This transitively affects adding to a workqueue whose work items have user mode access, these also need to always be enqueued with an allocation for the same reasons above.


doq bug

unbound -V
Version 1.22.0

Configure line: --enable-subnet --with-libevent --without-pthreads --without-solaris-threads --with-ssl --enable-dnscrypt --with-libhiredis --enable-cachedb --enable-tfo-client --enable-tfo-server --enable-ipset --with-ssl=/usr/local/openssl-3.0.15-quic1 --with-libngtcp2=/usr/local/ngtcp2-1.8.1 LDFLAGS=-Wl,-rpath -Wl,/usr/local/ngtcp2-1.8.1/lib --prefix=/usr/local
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.0.15+quic 3 Sep 2024
Linked modules: dns64 cachedb subnetcache ipset respip validator iterator
DNSCrypt feature available
TCP Fastopen feature available

#######################################################
./unbound -c /usr/local/etc/unbound/unbound.conf -dd -vvvv
[1731685084] unbound[3135312:0] notice: Start of unbound 1.22.0.
[1731685084] unbound[3135312:0] debug: creating udp4 socket <IP_ADDRESS> 5353
[1731685084] unbound[3135312:0] debug: creating tcp4 socket <IP_ADDRESS> 5353
[1731685084] unbound[3135312:0] debug: creating udp4 socket <IP_ADDRESS> 854 doq
[1731685084] unbound[3135312:0] debug: creating tcp4 socket <IP_ADDRESS> 854 tls
[1731685084] unbound[3135312:0] debug: setup TCP for SSL service
[1731685084] unbound[3135312:0] debug: creating udp4 socket <IP_ADDRESS> 5353
[1731685084] unbound[3135312:0] debug: creating tcp4 socket <IP_ADDRESS> 5353
[1731685084] unbound[3135312:0] debug: creating udp4 socket <IP_ADDRESS> 854 doq
[1731685084] unbound[3135312:0] debug: creating tcp4 socket <IP_ADDRESS> 854 tls
[1731685084] unbound[3135312:0] debug: setup TCP for SSL service
[1731685084] unbound[3135312:0] debug: module config: "subnetcache validator iterator"
[1731685084] unbound[3135312:0] debug: chdir to /usr/local/etc/unbound
[1731685084] unbound[3135312:0] debug: chroot to /usr/local/etc/unbound
[1731685084] unbound[3135312:0] debug: drop user privileges, run as root
[1731685084] unbound[3135312:0] debug: switching log to stderr
[1731685084] unbound[3135312:0] debug: Forward zone server list:
[1731685084] unbound[3135312:0] info: DelegationPoint<.>: 0 names (0 missing), 1 addrs (0 result, 1 avail) parentNS
[1731685084] unbound[3135312:0] debug:    ip4 <IP_ADDRESS> port 35354 (len 16)
[1731685084] unbound[3135312:0] debug: no config, using builtin root hints.
[1731685084] unbound[3135312:0] notice: init module 0: subnetcache
[1731685084] unbound[3135312:0] warning: subnetcache: serve-expired is set but not working for data originating from the subnet module cache.
[1731685084] unbound[3135312:0] warning: subnetcache: prefetch is set but not working for data originating from the subnet module cache.
[1731685084] unbound[3135312:0] debug: send-client-subnet: ::0/0
[1731685084] unbound[3135312:0] debug: send-client-subnet: <IP_ADDRESS>/0
[1731685084] unbound[3135312:0] debug: subnetcache: option registered (8)
[1731685084] unbound[3135312:0] notice: init module 1: validator
[1731685084] unbound[3135312:0] debug: validator nsec3cfg keysz 1024 mxiter 150
[1731685084] unbound[3135312:0] debug: validator nsec3cfg keysz 2048 mxiter 150
[1731685084] unbound[3135312:0] debug: validator nsec3cfg keysz 4096 mxiter 150
[1731685084] unbound[3135312:0] notice: init module 2: iterator
[1731685084] unbound[3135312:0] debug: target fetch policy for level 0 is 3
[1731685084] unbound[3135312:0] debug: target fetch policy for level 1 is 2
[1731685084] unbound[3135312:0] debug: target fetch policy for level 2 is 1
[1731685084] unbound[3135312:0] debug: target fetch policy for level 3 is 0
[1731685084] unbound[3135312:0] debug: target fetch policy for level 4 is 0
[1731685084] unbound[3135312:0] debug: EDNS known options:
[1731685084] unbound[3135312:0] debug:   Code:    Bypass_cache_stage: Aggregate_mesh:
[1731685084] unbound[3135312:0] debug:   edns-cli YES                 NO
[1731685084] unbound[3135312:0] debug: total of 59447 outgoing ports available
[1731685084] unbound[3135312:0] debug: start threads
[1731685084] unbound[3135312:0] debug: libevent 2.1.12-stable uses epoll method.
[1731685084] unbound[3135313:1] debug: libevent 2.1.12-stable uses epoll method.
[1731685084] unbound[3135313:1] error: doq: error for cert file: /etc/nginx/conf.d/crt.crt
[1731685084] unbound[3135313:1] error: doq: error in SSL_CTX_use_certificate_chain_file crypto error:80000002:system library::No such file or directory
[1731685084] unbound[3135313:1] error: and additionally crypto error:10080002:BIO routines::system lib
[1731685084] unbound[3135313:1] error: and additionally crypto error:0A080002:SSL routines::system lib
[1731685084] unbound[3135313:1] error: could not create doq comm_point
[1731685084] unbound[3135313:1] debug: comm_point_close of 9: event_del
[1731685084] unbound[3135313:1] debug: close fd 9
[1731685084] unbound[3135313:1] error: can't create commpoint
[1731685084] unbound[3135313:1] debug: comm_point_close of 10: event_del
[1731685084] unbound[3135312:0] error: doq: error for cert file: /etc/nginx/conf.d/crt.crt
[1731685084] unbound[3135312:0] error: doq: error in SSL_CTX_use_certificate_chain_file crypto error:80000002:system library::No such file or directory
[1731685084] unbound[3135312:0] error: and additionally crypto error:10080002:BIO routines::system lib
[1731685084] unbound[3135312:0] error: and additionally crypto error:0A080002:SSL routines::system lib
[1731685084] unbound[3135312:0] error: could not create doq comm_point
[1731685084] unbound[3135312:0] debug: comm_point_close of 5: event_del
[1731685084] unbound[3135312:0] debug: close fd 5
[1731685084] unbound[3135312:0] error: can't create commpoint
[1731685084] unbound[3135312:0] debug: comm_point_close of 6: event_del
[1731685084] unbound[3135313:1] error: could not create listening sockets
[1731685084] unbound[3135313:7259b60] fatal error: Could not initialize thread
[1731685084] unbound[3135312:0] error: could not create listening sockets
[1731685084] unbound[3135312:0] fatal error: Could not initialize main thread

Unbound has a chroot feature, and it is enabled by default. In the log it also has logged that it chrooted, to /usr/local/etc/unbound. The file not found failures are for files not in the chroot directory. If those files are copied into the chroot it could work. Chroot can also be disabled, with the "" value. In the documentation,
https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#unbound-conf-chroot .
For the rest it looks okay. It is starting doq service on 854.

Unbound has a chroot feature, and it is enabled by default. In the log it also has logged that it chrooted, to /usr/local/etc/unbound. The file not found failures are for files not in the chroot directory. If those files are copied into the chroot it could work. Chroot can also be disabled, with the "" value. In the documentation, https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#unbound-conf-chroot .
For the rest it looks okay. It is starting doq service on 854.

I copied the certificate file to the /usr/local/etc/unbound folder and the problem persisted

Unbound will still look for the whole path inside the chroot. You now have two different options. You either:

change the configuration option to tls-service-pem: "/crt.crt" for example, or
use the chroot path in the configuration option, then Unbound would understand that it is inside the chroot, like tls-service-pem: "/usr/local/etc/unbound/crt.crt".

Both options have the same effect; Unbound will expect to find the crt.crt file in the root directory inside the chroot.
If you still face issues, posting your configuration file may shed some more light.

Unbound will still look for the whole path inside the chroot. You now have two different options. You either:

change the configuration option to tls-service-pem: "/crt.crt" for example, or
use the chroot path in the configuration option, then Unbound would understand that it is inside the chroot, like tls-service-pem: "/usr/local/etc/unbound/crt.crt".

Both options have the same effect; Unbound will expect to find the crt.crt file in the root directory inside the chroot. If you still face issues, posting y

After testing the two methods you gave with DOQ enabled, the bug still exists. But it is normal to turn on DOT alone.

our configuration file may shed some more light.

But it is normal to turn on DOT alone.

I see the issue.
TLS certificates and keys are read before the chroot. But the DoQ TLS context is created after the chroot. To work around the issue, you need to copy the certificates and keys inside the chroot directory and use relative names for the options:
tls-service-key: "key.key"
tls-service-pem: "crt.crt"

That will work for DoT which reads the files before the chroot, and also for DoQ which reads the files after the chroot.
I believe the correct solution to this is to create the DoQ TLS context also before the chroot is applied for consistency with the other TLS options.

I see the issue. TLS certificates and keys are read before the chroot. But the DoQ TLS context is created after the chroot. To work around the issue, you need to copy the certificates and keys inside the chroot directory and use relative names for the options:
tls-service-key: "key.key"
tls-service-pem: "crt.crt"

That will work for DoT which reads the files before the chroot, and also for DoQ which reads the files after the chroot.
I believe the correct solution to this is to create the DoQ TLS context also before the chroot is applied for consistency with the other TLS options.

[1732020895] unbound[3786069:0] notice: Start of unbound 1.22.0.
[1732020895] unbound[3786069:0] debug: creating udp4 socket <IP_ADDRESS> 5353
[1732020895] unbound[3786069:0] debug: creating tcp4 socket <IP_ADDRESS> 5353
[1732020895] unbound[3786069:0] debug: creating udp4 socket <IP_ADDRESS> 854 doq
[1732020895] unbound[3786069:0] debug: creating tcp4 socket <IP_ADDRESS> 854 tls
[1732020895] unbound[3786069:0] debug: setup TCP for SSL service
[1732020895] unbound[3786069:0] debug: creating udp4 socket <IP_ADDRESS> 5353
[1732020895] unbound[3786069:0] debug: creating tcp4 socket <IP_ADDRESS> 5353
[1732020895] unbound[3786069:0] debug: creating udp4 socket <IP_ADDRESS> 854 doq
[1732020895] unbound[3786069:0] debug: creating tcp4 socket <IP_ADDRESS> 854 tls
[1732020895] unbound[3786069:0] debug: setup TCP for SSL service
[1732020895] unbound[3786069:0] debug: module config: "subnetcache iterator"
[1732020895] unbound[3786069:0] error: error for cert file: crt.crt
[1732020895] unbound[3786069:0] error: error in SSL_CTX use_certificate_chain_file crypto error:80000002:system library::No such file or directory
[1732020895] unbound[3786069:0] error: and additionally crypto error:10080002:BIO routines::system lib
[1732020895] unbound[3786069:0] error: and additionally crypto error:0A080002:SSL routines::system lib
[1732020895] unbound[3786069:0] fatal error: could not set up listen SSL_CTX

The only solution at the moment is to disable chroot, that is, add chroot:""

Did you copy the files in /usr/local/etc/unbound?

I could reproduce the issue when hitting the chroot problem, but with the following minimal configuration it works for me here with and without chroot. The key.key and crt.crt files are in the chroot directory.
server:
	interface: <IP_ADDRESS>@854
	interface: <IP_ADDRESS>@854
	quic-port: 854
        tls-port: 854
	tls-service-key: key.key
	tls-service-pem: crt.crt

I see that you have a couple configuration files. Just to rule it out, can you make sure you are using the correct one?

I could reproduce the issue when hitting the chroot problem, but with the following minimal configuration it works for me here with and without chroot. The key.key and crt.crt files are in the chroot directory.
server:
	interface: <IP_ADDRESS>@854
	interface: <IP_ADDRESS>@854
	quic-port: 854
        tls-port: 854
	tls-service-key: key.key
	tls-service-pem: crt.crt

I see that you have a couple configuration files. Just to rule it out, can you make sure you are using the correct one?

I run it according to the configuration you gave, but the problem still exists. I only have one configuration, and the file name with -t is used by me to test this problem separately, otherwise I will be disconnected from the Internet.

I am running out of ideas; not sure what is different in your case now.
How are the file permissions in the directory? Can you show the output of ls -al?

I am running out of ideas; not sure what is different in your case now. How are the file permissions in the directory? Can you show the output of ls -al?

ls -al
total 36
drwxr-xr-x 2 root root 4096 Nov 19 20:53 .
drwxr-xr-x 3 root root 4096 Nov 15 22:10 ..
-rwxr-xr-x 1 root root 6333 Nov 16 18:57 crt.crt
-rw-r--r-- 1 root root   77 Nov 19 19:10 forward.conf
-rwxr-xr-x 1 root root 1703 Nov 16 18:57 key.key
-rw-r--r-- 1 root root 3402 Nov 19 19:00 unbound.conf
-rw-r--r-- 1 root root    8 Nov 19 21:02 unbound.pid
-rw-r--r-- 1 root root 3342 Nov 19 21:29 unbound-t.conf

I assume Unbound drops privileges and uses user unbound from the default option of username: unbound.
Then I expect the issue to now be "Permission denied" instead of the previous "No such file or directory".
In that case, issuing
sudo chown root:unbound key.key crt.crt

should solve it.

I assume Unbound drops privileges and uses user unbound from the default option of username: unbound. Then I expect the issue to now be "Permission denied" instead of the previous "No such file or directory". In that case, issuing
sudo chown root:unbound key.key crt.crt

should solve it.

My unbound uses root privileges. I executed sudo chown root:root key.key crt.crt, but the same error message still appears.

I added the unbound user but it still doesn't work. Here is the error:

root@debian12:/usr/local/sbin# ./unbound -c /usr/local/etc/unbound/unbound-t.conf -dd -vvvv
[1732279191] unbound[4104649:0] notice: Start of unbound 1.22.0.
[1732279191] unbound[4104649:0] debug: creating udp4 socket <IP_ADDRESS> 53533
[1732279191] unbound[4104649:0] debug: creating tcp4 socket <IP_ADDRESS> 53533
[1732279191] unbound[4104649:0] debug: creating udp4 socket <IP_ADDRESS> 855 doq
[1732279191] unbound[4104649:0] debug: creating tcp4 socket <IP_ADDRESS> 855 tls
[1732279191] unbound[4104649:0] debug: setup TCP for SSL service
[1732279191] unbound[4104649:0] debug: creating udp4 socket <IP_ADDRESS> 53533
[1732279191] unbound[4104649:0] debug: creating tcp4 socket <IP_ADDRESS> 53533
[1732279191] unbound[4104649:0] debug: creating udp4 socket <IP_ADDRESS> 855 doq
[1732279191] unbound[4104649:0] debug: creating tcp4 socket <IP_ADDRESS> 855 tls
[1732279191] unbound[4104649:0] debug: setup TCP for SSL service
[1732279191] unbound[4104649:0] debug: module config: "subnetcache iterator"
[1732279191] unbound[4104649:0] fatal error: user 'unbound' does not exist.
root@debian12:/usr/local/sbin# useradd -r unbound
root@debian12:/usr/local/sbin# ./unbound -c /usr/local/etc/unbound/unbound-t.conf -dd -vvvv
[1732279223] unbound[4105312:0] notice: Start of unbound 1.22.0.
[1732279223] unbound[4105312:0] debug: creating udp4 socket <IP_ADDRESS> 53533
[1732279223] unbound[4105312:0] debug: creating tcp4 socket <IP_ADDRESS> 53533
[1732279223] unbound[4105312:0] debug: creating udp4 socket <IP_ADDRESS> 855 doq
[1732279223] unbound[4105312:0] debug: creating tcp4 socket <IP_ADDRESS> 855 tls
[1732279223] unbound[4105312:0] debug: setup TCP for SSL service
[1732279223] unbound[4105312:0] debug: creating udp4 socket <IP_ADDRESS> 53533
[1732279223] unbound[4105312:0] debug: creating tcp4 socket <IP_ADDRESS> 53533
[1732279223] unbound[4105312:0] debug: creating udp4 socket <IP_ADDRESS> 855 doq
[1732279223] unbound[4105312:0] debug: creating tcp4 socket <IP_ADDRESS> 855 tls
[1732279223] unbound[4105312:0] debug: setup TCP for SSL service
[1732279223] unbound[4105312:0] debug: module config: "subnetcache iterator"
[1732279223] unbound[4105312:0] error: error for cert file: crt.crt
[1732279223] unbound[4105312:0] error: error in SSL_CTX use_certificate_chain_file crypto error:80000002:system library::No such file or directory
[1732279223] unbound[4105312:0] error: and additionally crypto error:10080002:BIO routines::system lib
[1732279223] unbound[4105312:0] error: and additionally crypto error:0A080002:SSL routines::system lib
[1732279223] unbound[4105312:0] fatal error: could not set up listen SSL_CTX

root@debian12:/usr/local/sbin# ./unbound -c /usr/local/etc/unbound/unbound-t.conf -dd -vvvv
[1732279724] unbound[4108063:0] notice: Start of unbound 1.22.0.
[1732279724] unbound[4108063:0] debug: creating udp4 socket <IP_ADDRESS> 53533
[1732279724] unbound[4108063:0] debug: creating tcp4 socket <IP_ADDRESS> 53533
[1732279724] unbound[4108063:0] debug: creating udp4 socket <IP_ADDRESS> 855 doq
[1732279724] unbound[4108063:0] debug: creating tcp4 socket <IP_ADDRESS> 855 tls
[1732279724] unbound[4108063:0] debug: setup TCP for SSL service
[1732279724] unbound[4108063:0] debug: creating udp4 socket <IP_ADDRESS> 53533
[1732279724] unbound[4108063:0] debug: creating tcp4 socket <IP_ADDRESS> 53533
[1732279724] unbound[4108063:0] debug: creating udp4 socket <IP_ADDRESS> 855 doq
[1732279724] unbound[4108063:0] debug: creating tcp4 socket <IP_ADDRESS> 855 tls
[1732279724] unbound[4108063:0] debug: setup TCP for SSL service
[1732279724] unbound[4108063:0] debug: module config: "subnetcache iterator"
[1732279724] unbound[4108063:0] debug: chdir to /usr/local/etc/unbound
[1732279724] unbound[4108063:0] debug: chroot to /usr/local/etc/unbound
[1732279724] unbound[4108063:0] debug: drop user privileges, run as unbound
[1732279724] unbound[4108063:0] debug: switching log to stderr
[1732279724] unbound[4108063:0] debug: Forward zone server list:
[1732279724] unbound[4108063:0] info: DelegationPoint<.>: 0 names (0 missing), 1 addrs (0 result, 1 avail) parentNS
[1732279724] unbound[4108063:0] debug:    ip4 <IP_ADDRESS> port 11000 (len 16)
[1732279724] unbound[4108063:0] debug: no config, using builtin root hints.
[1732279724] unbound[4108063:0] notice: init module 0: subnetcache
[1732279724] unbound[4108063:0] warning: subnetcache: serve-expired is set but not working for data originating from the subnet module cache.
[1732279724] unbound[4108063:0] warning: subnetcache: prefetch is set but not working for data originating from the subnet module cache.
[1732279724] unbound[4108063:0] debug: send-client-subnet: ::0/0
[1732279724] unbound[4108063:0] debug: send-client-subnet: <IP_ADDRESS>/0
[1732279724] unbound[4108063:0] debug: subnetcache: option registered (8)
[1732279724] unbound[4108063:0] notice: init module 1: iterator
[1732279724] unbound[4108063:0] debug: target fetch policy for level 0 is 3
[1732279724] unbound[4108063:0] debug: target fetch policy for level 1 is 2
[1732279724] unbound[4108063:0] debug: target fetch policy for level 2 is 1
[1732279724] unbound[4108063:0] debug: target fetch policy for level 3 is 0
[1732279724] unbound[4108063:0] debug: target fetch policy for level 4 is 0
[1732279724] unbound[4108063:0] debug: EDNS known options:
[1732279724] unbound[4108063:0] debug:   Code:    Bypass_cache_stage: Aggregate_mesh:
[1732279724] unbound[4108063:0] debug:   edns-cli YES                 NO
[1732279724] unbound[4108063:0] debug: total of 59447 outgoing ports available
[1732279724] unbound[4108063:0] debug: start threads
[1732279724] unbound[4108063:0] debug: libevent 2.1.12-stable uses epoll method.
[1732279724] unbound[4108064:1] debug: libevent 2.1.12-stable uses epoll method.
[1732279724] unbound[4108064:1] error: doq: error for cert file: /usr/local/etc/unbound/crt.crt
[1732279724] unbound[4108064:1] error: doq: error in SSL_CTX_use_certificate_chain_file crypto error:80000002:system library::No such file or directory
[1732279724] unbound[4108064:1] error: and additionally crypto error:10080002:BIO routines::system lib
[1732279724] unbound[4108064:1] error: and additionally crypto error:0A080002:SSL routines::system lib
[1732279724] unbound[4108064:1] error: could not create doq comm_point
[1732279724] unbound[4108064:1] debug: close fd 9
[1732279724] unbound[4108064:1] error: can't create commpoint
[1732279724] unbound[4108063:0] error: doq: error for cert file: /usr/local/etc/unbound/crt.crt
[1732279724] unbound[4108063:0] error: doq: error in SSL_CTX_use_certificate_chain_file crypto error:80000002:system library::No such file or directory
[1732279724] unbound[4108063:0] error: and additionally crypto error:10080002:BIO routines::system lib
[1732279724] unbound[4108063:0] error: and additionally crypto error:0A080002:SSL routines::system lib
[1732279724] unbound[4108063:0] error: could not create doq comm_point
[1732279724] unbound[4108063:0] debug: close fd 5
[1732279724] unbound[4108063:0] error: can't create commpoint
[1732279724] unbound[4108064:1] error: could not create listening sockets
[1732279724] unbound[4108064:f4a43b50] fatal error: Could not initialize thread
[1732279724] unbound[4108063:0] error: could not create listening sockets
[1732279724] unbound[4108063:0] fatal error: Could not initialize main thread

Unbound complains that user unbound does not exist because Unbound wants to drop privileges from root to unbound which is the default secure configuration.
If you don't want that you need to configure username: "" for Unbound to stay the same user as the one that invoked the command.
Apart from that can you also paste the output of the following commands?
cat /usr/local/etc/unbound/unbound-t.conf
ls -al /usr/local/etc/unbound

Unbound complains that user unbound does not exist because Unbound wants to drop privileges from root to unbound which is the default secure configuration. If you don't want that you need to configure username: "" for Unbound to stay the same user as the one that invoked the command.
Apart from that can you also paste the output of the following commands?
cat /usr/local/etc/unbound/unbound-t.conf
ls -al /usr/local/etc/unbound

cat /usr/local/etc/unbound/unbound-t.conf
server:
    verbosity: 0
   #chroot:""
    interface: <IP_ADDRESS>@53533
    interface: <IP_ADDRESS>@855
   #interface: ::0@854
   #interface: ::0@5353

    tls-port: 855
    quic-size: 8m
    quic-port: 855
    tls-service-key: "/usr/local/etc/unbound/key.key"
    tls-service-pem: "/usr/local/etc/unbound/crt.crt"

    username: ""
    do-ip4: yes
    do-ip6: no
    do-udp: yes
    do-tcp: yes
    prefer-ip6: no

    num-threads: 2
    msg-cache-slabs: 2
    rrset-cache-slabs: 2
    key-cache-slabs: 2

    aggressive-nsec: yes
    hide-trustanchor: yes
    hide-version: yes
    hide-identity: yes
    harden-glue: yes

    unwanted-reply-threshold: 1000000
    rrset-roundrobin: yes
    qname-minimisation: yes
    minimal-responses: yes
    access-control: <IP_ADDRESS>/0 allow

    max-ecs-tree-size-ipv4: 50000000
    max-ecs-tree-size-ipv6: 50000000
    do-not-query-localhost: no
    so-rcvbuf: 16m
    so-sndbuf: 16m
    so-reuseport: yes
    rrset-cache-size: 64m
    neg-cache-size: 32m
    msg-cache-size: 50m
    msg-buffer-size: 65552
    key-cache-size: 64m
    outgoing-range: 4096
    outgoing-port-permit: 32768
    num-queries-per-thread: 8192
    outgoing-num-tcp: 2048
    incoming-num-tcp: 4096
    jostle-timeout: 300
    cache-min-ttl: 60
    cache-max-ttl: 1800

   ###prefetches

    prefetch: yes
    prefetch-key: yes
    serve-expired: yes
        serve-expired-ttl: 600
        serve-expired-client-timeout: 60
        serve-expired-client-timeout: 1800

    harden-glue: yes
    harden-large-queries: yes
    harden-dnssec-stripped: yes
    harden-algo-downgrade: yes
    harden-short-bufsize: yes

    max-udp-size: 4096
    edns-buffer-size: 1232
    edns-tcp-keepalive: yes
    edns-tcp-keepalive-timeout: 120000

    client-subnet-zone: "."
    send-client-subnet: <IP_ADDRESS>/0
    send-client-subnet: ::0/0
    max-client-subnet-ipv6: 56
    max-client-subnet-ipv4: 24
    client-subnet-always-forward: yes
    #module-config: "subnetcache validator cachedb iterator"
    #module-config: "subnetcache validator iterator"
    module-config: "subnetcache iterator"
    #root-hints: "/usr/local/etc/unbound/trust/root.hints"
    #auto-trust-anchor-file: "/usr/local/etc/unbound/trust/root.key"
    tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"

   # fast server
    fast-server-num: 3
    fast-server-permil: 900

    include: "/usr/local/etc/unbound/forward.conf"

#cachedb:
   #backend: "redis"
   #redis-server-host: <IP_ADDRESS>
   #redis-server-port: 6379
   #redis-server-path: "/usr/local/etc/unbound/keydb.sock"
   #redis-timeout: 5000
   #redis-expire-records: no

#server:
#    statistics-interval: 0
#    extended-statistics: yes
#    statistics-cumulative: no

#remote-control:
#control-enable: yes
#control-interface: <IP_ADDRESS>
# control-port: 8953
# server-key-file: "/usr/local/etc/unbound/trust/unbound_server.key"
# server-cert-file: "/usr/local/etc/unbound/trust/unbound_server.pem"
# control-key-file: "/usr/local/etc/unbound/trust/unbound_control.key"
# control-cert-file: "/usr/local/etc/unbound/trust/unbound_control.pem"

root@debian12:/usr/local/sbin# ls -al /usr/local/etc/unbound
total 52
drwxr-xr-x 2 root root 4096 Nov 22 20:59 .
drwxr-xr-x 3 root root 4096 Nov 15 22:10 ..
-rwxr-xr-x 1 root root 6333 Nov 16 18:57 crt.crt
-rw-r--r-- 1 root root   78 Nov 19 21:53 forward.conf
-rwxr-xr-x 1 root root 1703 Nov 16 18:57 key.key
-rw-r--r-- 1 root root 3402 Nov 19 19:00 unbound.conf
-rw------- 1 root root 2484 Nov 22 20:59 unbound_control.key
-rw-r----- 1 root root 1501 Nov 22 20:59 unbound_control.pem
-rw-r--r-- 1 root root    8 Nov 22 21:01 unbound.pid
-rw------- 1 root root 2484 Nov 22 20:59 unbound_server.key
-rw-r----- 1 root root 1549 Nov 22 20:59 unbound_server.pem
-rw-r--r-- 1 root root 3388 Nov 22 21:01 unbound-t.conf

You need to configure:
    tls-service-key: "key.key"
    tls-service-pem: "crt.crt"

I am really confused.
You share an output earlier that mentions (emphasis mine):
[1732279724] unbound[4108063:0] notice: Start of unbound 1.22.0.
[1732279724] unbound[4108063:0] debug: creating udp4 socket <IP_ADDRESS> 53533
[1732279724] unbound[4108063:0] debug: creating tcp4 socket <IP_ADDRESS> 53533
[1732279724] unbound[4108063:0] debug: creating udp4 socket <IP_ADDRESS> 855 doq
[1732279724] unbound[4108063:0] debug: creating tcp4 socket <IP_ADDRESS> 855 tls
**[1732279724] unbound[4108063:0] debug: setup TCP for SSL service**
[1732279724] unbound[4108063:0] debug: creating udp4 socket <IP_ADDRESS> 53533
[1732279724] unbound[4108063:0] debug: creating tcp4 socket <IP_ADDRESS> 53533
[1732279724] unbound[4108063:0] debug: creating udp4 socket <IP_ADDRESS> 855 doq
[1732279724] unbound[4108063:0] debug: creating tcp4 socket <IP_ADDRESS> 855 tls
**[1732279724] unbound[4108063:0] debug: setup TCP for SSL service**
[1732279724] unbound[4108063:0] debug: module config: "subnetcache iterator"
[1732279724] unbound[4108063:0] debug: chdir to /usr/local/etc/unbound
[1732279724] unbound[4108063:0] debug: chroot to /usr/local/etc/unbound
[1732279724] unbound[4108063:0] debug: drop user privileges, run as unbound
...
**[1732279724] unbound[4108064:1] error: doq: error for cert file: /usr/local/etc/unbound/crt.crt**
[1732279724] unbound[4108064:1] error: doq: error in SSL_CTX_use_certificate_chain_file crypto error:80000002:system library::No such file or directory
[1732279724] unbound[4108064:1] error: and additionally crypto error:10080002:BIO routines::system lib
[1732279724] unbound[4108064:1] error: and additionally crypto error:0A080002:SSL routines::system lib
**[1732279724] unbound[4108064:1] error: could not create doq comm_point**

And your latest output mentions (emphasis mine):
**[1732281260] unbound[4117775:0] error: error for cert file: crt.crt**
[1732281260] unbound[4117775:0] error: error in SSL_CTX use_certificate_chain_file crypto error:80000002:system library::No such file or directory
[1732281260] unbound[4117775:0] error: and additionally crypto error:10080002:BIO routines::system lib
[1732281260] unbound[4117775:0] error: and additionally crypto error:0A080002:SSL routines::system lib
**[1732281260] unbound[4117775:0] fatal error: could not set up listen SSL_CTX**

The first output fails when it tries to create the DoQ ssl context. This happens after the chroot and privilege drop.
The second output fails when it tries to create the listening ssl context. This happens before the chroot and privilege drop.
Looking at the outputs, for the first one if you would replace the filename to just crt.crt it would have worked. For the second one I am not sure what is happening anymore.
Having both of those outputs does not make sense and it indicates that something is going wrong between invocations and the configuration. In the future could you please always paste the configuration you are using together with the whole log output?

Unbound 抱怨用户unbound不存在，因为 Unbound 想要放弃权限，root这unbound是默认安全配置。如果您不想这样，您需要配置username: ""Unbound 以保持与调用命令的用户相同的用户。
除此之外，您还可以粘贴以下命令的输出吗？
cat /usr/local/etc/unbound/unbound-t.conf
ls -al /usr/local/etc/unbound

cat /usr/local/etc/unbound/unbound-t.conf
server:
    verbosity: 0
   #chroot:""
    interface: <IP_ADDRESS>@53533
    interface: <IP_ADDRESS>@855
   #interface: ::0@854
   #interface: ::0@5353

    tls-port: 855
    quic-size: 8m
    quic-port: 855
    tls-service-key: "/usr/local/etc/unbound/key.key"
    tls-service-pem: "/usr/local/etc/unbound/crt.crt"

    username: ""
    do-ip4: yes
    do-ip6: no
    do-udp: yes
    do-tcp: yes
    prefer-ip6: no

    num-threads: 2
    msg-cache-slabs: 2
    rrset-cache-slabs: 2
    key-cache-slabs: 2

    aggressive-nsec: yes
    hide-trustanchor: yes
    hide-version: yes
    hide-identity: yes
    harden-glue: yes

    unwanted-reply-threshold: 1000000
    rrset-roundrobin: yes
    qname-minimisation: yes
    minimal-responses: yes
    access-control: <IP_ADDRESS>/0 allow

    max-ecs-tree-size-ipv4: 50000000
    max-ecs-tree-size-ipv6: 50000000
    do-not-query-localhost: no
    so-rcvbuf: 16m
    so-sndbuf: 16m
    so-reuseport: yes
    rrset-cache-size: 64m
    neg-cache-size: 32m
    msg-cache-size: 50m
    msg-buffer-size: 65552
    key-cache-size: 64m
    outgoing-range: 4096
    outgoing-port-permit: 32768
    num-queries-per-thread: 8192
    outgoing-num-tcp: 2048
    incoming-num-tcp: 4096
    jostle-timeout: 300
    cache-min-ttl: 60
    cache-max-ttl: 1800

   ###prefetches

    prefetch: yes
    prefetch-key: yes
    serve-expired: yes
        serve-expired-ttl: 600
        serve-expired-client-timeout: 60
        serve-expired-client-timeout: 1800

    harden-glue: yes
    harden-large-queries: yes
    harden-dnssec-stripped: yes
    harden-algo-downgrade: yes
    harden-short-bufsize: yes

    max-udp-size: 4096
    edns-buffer-size: 1232
    edns-tcp-keepalive: yes
    edns-tcp-keepalive-timeout: 120000

    client-subnet-zone: "."
    send-client-subnet: <IP_ADDRESS>/0
    send-client-subnet: ::0/0
    max-client-subnet-ipv6: 56
    max-client-subnet-ipv4: 24
    client-subnet-always-forward: yes
    #module-config: "subnetcache validator cachedb iterator"
    #module-config: "subnetcache validator iterator"
    module-config: "subnetcache iterator"
    #root-hints: "/usr/local/etc/unbound/trust/root.hints"
    #auto-trust-anchor-file: "/usr/local/etc/unbound/trust/root.key"
    tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"

   # fast server
    fast-server-num: 3
    fast-server-permil: 900

    include: "/usr/local/etc/unbound/forward.conf"

#cachedb:
   #backend: "redis"
   #redis-server-host: <IP_ADDRESS>
   #redis-server-port: 6379
   #redis-server-path: "/usr/local/etc/unbound/keydb.sock"
   #redis-timeout: 5000
   #redis-expire-records: no

#server:
#    statistics-interval: 0
#    extended-statistics: yes
#    statistics-cumulative: no

#remote-control:
#control-enable: yes
#control-interface: <IP_ADDRESS>
# control-port: 8953
# server-key-file: "/usr/local/etc/unbound/trust/unbound_server.key"
# server-cert-file: "/usr/local/etc/unbound/trust/unbound_server.pem"
# control-key-file: "/usr/local/etc/unbound/trust/unbound_control.key"
# control-cert-file: "/usr/local/etc/unbound/trust/unbound_control.pem"

root@debian12:/usr/local/sbin# ls -al /usr/local/etc/unbound
total 52
drwxr-xr-x 2 root root 4096 Nov 22 20:59 .
drwxr-xr-x 3 root root 4096 Nov 15 22:10 ..
-rwxr-xr-x 1 root root 6333 Nov 16 18:57 crt.crt
-rw-r--r-- 1 root root   78 Nov 19 21:53 forward.conf
-rwxr-xr-x 1 root root 1703 Nov 16 18:57 key.key
-rw-r--r-- 1 root root 3402 Nov 19 19:00 unbound.conf
-rw------- 1 root root 2484 Nov 22 20:59 unbound_control.key
-rw-r----- 1 root root 1501 Nov 22 20:59 unbound_control.pem
-rw-r--r-- 1 root root    8 Nov 22 21:01 unbound.pid
-rw------- 1 root root 2484 Nov 22 20:59 unbound_server.key
-rw-r----- 1 root root 1549 Nov 22 20:59 unbound_server.pem
-rw-r--r-- 1 root root 3388 Nov 22 21:01 unbound-t.conf

This is my configuration. I just changed a few ports and certificate paths. If you don’t believe me, you can compile a test yourself.

Testing this doq bug will cause my dns to be completely interrupted, so I copied a separate copy for testing. During the test, I also modified some configurations but could not solve the problem. The only way to solve this problem is to disable chroot:""

It's not that I don't believe you, it's just that with all the changes in the configuration file I want to be certain how Unbound complains for a given configuration :)
With the above configuration you pasted, changing the filenames to just key.key and crt.crt (so that they are relative paths to the current directory) works with both chroot enabled and disabled. I just tried it locally.
I am not sure why Unbound reports that the files are not there.
Is that an off-the-self default debian 12 installation?

It's not that I don't believe you, it's just that with all the changes in the configuration file I want to be certain how Unbound complains for a given configuration :)
With the above configuration you pasted, changing the filenames to just key.key and crt.crt (so that they are relative paths to the current directory) works with both chroot enabled and disabled. I just tried it locally.
I am not sure why Unbound reports that the files are not there. Is that an off-the-self default debian 12 installation?

I compiled and installed

I tried on a fresh debian machine and can reproduce the issue. Does it solve itself if you explicitly specify
server:
    ...
    directory: /usr/local/etc/unbound
    ...

in the configuration file? And the files referenced as just key.key and crt.crt? This seems to work here with and without chroot.

I tried on a fresh debian machine and can reproduce the issue. Does it solve itself if you explicitly specify
server:
    ...
    directory: /usr/local/etc/unbound
    ...

in the configuration file? And the files referenced as just key.key and crt.crt? This seems to work here with and without chroot.

The problem was solved, but a new problem arose. It prompted error: SSL_read syscall: Connection reset by peer
[1733144068] unbound[982585:1] debug: iter_handle processing q with state QUERY RESPONSE STATE
[1733144068] unbound[982585:1] info: query response was ANSWER
[1733144068] unbound[982585:1] debug: iter_handle processing q with state FINISHED RESPONSE STATE
[1733144068] unbound[982585:1] info: finishing processing for www.google.com.hk. A IN
[1733144068] unbound[982585:1] debug: prepending 1 rrsets
[1733144068] unbound[982585:1] debug: mesh_run: iterator module exit state is module_finished
[1733144068] unbound[982585:1] debug: subnetcache[module 0] operate: extstate:module_wait_module event:module_event_moddone
[1733144068] unbound[982585:1] info: subnetcache operate: query www.google.com.hk. A IN
[1733144068] unbound[982585:1] debug: subnetcache: Authority indicates no support
[1733144068] unbound[982585:1] debug: reply has edns subnet (null)
[1733144068] unbound[982585:1] debug: mesh_run: subnetcache module exit state is module_finished
[1733144068] unbound[982585:1] debug: comm point stop listening 16
[1733144068] unbound[982585:1] debug: comm point start listening 16 (120000 msec)
[1733144068] unbound[982585:1] debug: query took 0.038422 sec
[1733144068] unbound[982585:1] info: mesh_run: end 0 recursion states (0 with reply, 0 detached), 0 waiting replies, 2 recursion replies sent, 0 replies dropped, 0 states jostled out
[1733144068] unbound[982585:1] info: average recursion processing time 0.032071 sec
[1733144068] unbound[982585:1] info: histogram of recursion processing times
[1733144068] unbound[982585:1] info: [25%]=0 median[50%]=0 [75%]=0
[1733144068] unbound[982585:1] info: lower(secs) upper(secs) recursions
[1733144068] unbound[982585:1] info:    0.016384    0.032768 1
[1733144068] unbound[982585:1] info:    0.032768    0.065536 1
[1733144068] unbound[982585:1] debug: cache memory msg=33773 rrset=33690 infra=8425 val=0 subnet=42856
[1733144068] unbound[982585:1] debug: svcd callbacks end
[1733144068] unbound[982585:1] debug: close of port 62838
[1733144068] unbound[982585:1] debug: close fd 17
[1733144068] unbound[982585:1] debug: comm point stop listening 16
[1733144068] unbound[982585:1] debug: comm point start listening 16 (120000 msec)
[1733144068] unbound[982585:1] **error: SSL_read syscall: Connection reset by peer**
[1733144068] unbound[982585:1] debug: close fd 16

Hi @liang-hiwin, the fix for the DoQ ssl context creation is part of the master branch now.
Could you pull that and revert your configuration to your initial one? With the absolute paths like tls-service-pem: "/usr/local/etc/unbound/crt.crt?
Then I am reopening the issue because it seems you are having some SSL connection issues then? Which client do you use for communicating to Unbound over DoQ? Does it print any useful output?

Hi @liang-hiwin, the fix for the DoQ ssl context creation is part of the master branch now. Could you pull that and revert your configuration to your initial one? With the absolute paths like tls-service-pem: "/usr/local/etc/unbound/crt.crt?
Then I am reopening the issue because it seems you are having some SSL connection issues then? Which client do you use for communicating to Unbound over DoQ? Does it print any useful output?

I pulled the latest version, and it's working fine now. There is no error message for the SSL certificate.


[FEATURE] EOA password allows to input special characters

Is your feature request related to a problem? Please describe.
EOA password doesn't allow to input special characters at the moment.
On the other hand, RSA passphrase allows them.
It would be better to enable to input some special characters for EOA password as well.
Describe the solution you'd like
Allow special characters (like *+.()?[]^$-|!#%&"',/:;<=>@_`{}~) for EOA password.

The following regular expressions are allowed for passphrases, for EOA and personal information encryption keys (RSA keys) respectively.
EOA_PASSWORD_PATTERN = \
    os.environ.get("EOA_PASSWORD_PATTERN") or \
    "^[a-zA-Z0-9]{8,20}$"
PERSONAL_INFO_RSA_PASSPHRASE_PATTERN = \
    os.environ.get("PERSONAL_INFO_RSA_PASSPHRASE_PATTERN") or \
    "^[a-zA-Z0-9 \*\+\.\\\(\)\?\[\]\^\$\-\|!#%&\"',/:;<=>@_`{}~]{8,}$"

The default settings are as above and can be controlled by environment variables.
We understood that the suggestion you gave us is to align all allowed characters in the passphrase, so we will check the feasibility first.


[sw, mask_rom/ROM_EXT] TODOs and open questions

These are some of the questions that have materialised from #3836 , and I expect that this list will grow.

[ ] rom_ext_boot signature (what information should be passed from Mask ROM to ROM_EXT)

[ ] Mask ROM -> ROM_EXT handover. Which peripherals should be re-configured, and which should retain their configuration

[ ] Is the way we are handling current "return" of "noreturn" function correct, or does it need to change?

...
  while (true) {
    wait_for_interrupt();
  }
}

[ ] What Ibex registers should be cleared before the handover (if any)?

[ ] When should the Ibex icache be enabled?

[ ] Possibly dedup parts of the CRT code, see comment.

Please feel free to add other items directly to this issue!

@alphan @lenary @gkelly @mcy @jon-flatley

In answer to some of these:

A lot of handover stuff we do need to clarify and design, and haven't done so yet. This is a good place to collect issues around that.
Handling noreturn functions is currently incorrect - we should power off the device rather than a WFI loop, but I'm not sure we know how to power down the device from software yet, so a wfi loop is fine today.

Marking this issue as obsolete. @alphan please reopen if you have any concerns.


[BUG] TTS seems to be bad at aborting

Are you doing anything with signals?
killing TTS when it contiguously failing is very hard.

Can't reproduce. Use REQUIRED to ensure early bail-out