DetectOnly for one vhost

Hello, guys! Could you please tell me how to make DetectOnly for specific rule to  one virtual host  in apache. I can't find any in documentation. The problem is I don't want to use  SecRuleRemoveById because I want to log possible attacks. If I just use it I don't see any logs.

@fernal9301 Do you mean DectectionOnly mode like mentioned here? https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#secruleengine I'm not sure if you can turn on DetectionOnly for a specific rule but you write your rule in such a way that it is not disruptive (i.e. don't use block, deny, drop, proxy, redirect, allow) but still log out when the rule matches using https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#log

I clarify. I've got a redmine, and cant upload any files to tasks. When I review logs I saw couple rules worked  f.ex id:920420, id:xxxxxx, id:xxxxxx.
What I need. I need to disable particular rule 920420  for one Virtualhost but log it, and continue process request by other rules. I made a custom conf file -> and include it in virtualhost config
<VirtualHost *:443>
...
        Include /opt/modsecurity/etc/testdomain.ru/RuleSetTest.conf
...
</VirtualHost>

Content of RuleSetTest.conf

SecRuleUpdateActionById 920420 "chain,log,pass,status:200"

I tried to update action, so it can pass through rule with id:920420 and go further but it doesn't work this way.
original 920420:
#
# Restrict which content-types we accept.
#
SecRule REQUEST_METHOD "!^(?:GET|HEAD|PROPFIND|OPTIONS)$" \
  "phase:request,\
   chain,\
   t:none,\
   block,\
   msg:'Request content type is not allowed by policy',\
   rev:'2',\
   ver:'OWASP_CRS/3.0.0',\
   maturity:'9',\
   accuracy:'9',\
   id:920420,\
   severity:'CRITICAL',\
   logdata:'%{matched_var}',\
   tag:'application-multi',\
   tag:'language-multi',\
   tag:'platform-multi',\
   tag:'attack-protocol',\
   tag:'OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED',\
   tag:'WASCTC/WASC-20',\
   tag:'OWASP_TOP_10/A1',\
   tag:'OWASP_AppSensor/EE2',\
   tag:'PCI/12.1'"
     SecRule REQUEST_HEADERS:Content-Type "^([^;\s]+)" \
       "chain,\
        capture"
          SecRule TX:0 "!^%{tx.allowed_request_content_type}$" \
            "t:none,\
             ctl:forceRequestBodyVariable=On,\
             setvar:'tx.msg=%{rule.msg}',\
             setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\
             setvar:tx.%{rule.id}-OWASP_CRS/POLICY/CONTENT_TYPE_NOT_ALLOWED-%{matched_var_name}=%{matched_var}"

What works great is the SecRuleRemoveById 920420 but no log  at all it's silently pass.

You can do this through SecRule or SecRuleRemoveById. For example:
SecRule SERVER_NAME "myredmine.com" "id:1,phase:1,pass,nolog,ctl:ruleRemoveTargetById=xxxxxxx"

One thing should be noted here that you have to include this rule BEFORE the xxxxxx rule it is removing.

If I understand you right , I need to do smth like that:
Just add  in my custom .conf file
SecRuleUpdateActionById 920420 "chain,log,pass,status:200"
SecRule SERVER_NAME "testdomain.ru" "id:1,phase:1,pass,nolog,ctl:ruleRemoveById=920420"

Right?

I did it this way
config for Virtualhost
<VirtualHost *:443>
...
        Include /opt/modsecurity/etc/testdomain.ru/RuleSetTest.conf
...
</VirtualHost>

Content of /opt/modsecurity/etc/testdomain.ru/RuleSetTest.conf
SecRule SERVER_NAME "testdomain.ru"
  "id:920420,\
   phase:1,\
   pass,\
   log,\
   msg:'Request content type is not allowed by policy',\
   ctl:ruleRemoveById=920420"

So, just replace id:1 with  id or a rule ( so I can see in my logs rule_id ) and  nolog replace with log, and add msg - from original 920420 rule
Log looks like this:

--36df9076-H--
Message: Warning. Pattern match "testdomain.ru" at SERVER_NAME. [file "/opt/modsecurity/etc/testdomain.ru/RuleSetTest.conf"] [line "1"] [id "920420"] [msg "Request content type is not allowed by policy"]
Apache-Handler: proxy-server
Stopwatch:<PHONE_NUMBER>458764 54418 (- - -)
Stopwatch2:<PHONE_NUMBER>458764 54418; combined=3204, p1=257, p2=2628, p3=88, p4=153, p5=78, sr=24, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.8.0 (http://www.modsecurity.org/); OWASP_CRS/3.0.0.
Server: Apache/2.4.10 (Debian)
Engine-Mode: "ENABLED"

--36df9076-Z--

Any comments, I did it right or not?
Thanks  bostrt, void-id  for your help!

By the way I've got another question about the rule scope. If I just add rule in virtualhost config like that:

<VirtualHost *:443>
...
        Include /opt/modsecurity/etc/testdomain.ru/RuleSetTest.conf
...
</VirtualHost>

Then if I don't write SERVER_NAME "testdomain.ru"   for match, but add other info. What will be result impact?  All clients (Virtualhosts) will impact this rule or only Virtualhost where I include this rule.

The Issue stays the same. Previous solution doesn't work as I want. I don't want remove rule by id
My question is how to change action in one rule for particular domain(vhost)? Is it possible to match
not by SERVERNAME, f.ex. but by rule id?

Hi @fernal9301,
Some configurations are global, some not. Ideally you need to put the rules for an specific vhost within its configuration. The configuration merge process will put the configuration on its compartments, make it valid for the vhost only.


Update FTP links for publications

[ ] Hillary[PMID:32641083]
[ ] Gabryszewski[PMID:32650023]
and maybe Ellinghaus[PMID:32558485]


IndexOutOfBoundsException when generating REALTIME inverted index

After migrating from 0.8.0 to 0.9.2 we started to see the receive the following exception for some of our high volume REALTIME tables:
java.lang.IndexOutOfBoundsException: Index 317 out of bounds for length 151
  at jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:64) ~[?:?]
  at jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Preconditions.java:70) ~[?:?]
  at jdk.internal.util.Preconditions.checkIndex(Preconditions.java:248) ~[?:?]
  at java.util.Objects.checkIndex(Objects.java:372) ~[?:?]
  at java.util.ArrayList.get(ArrayList.java:459) ~[?:?]
  at org.apache.pinot.segment.local.realtime.impl.invertedindex.RealtimeInvertedIndexReader.add(RealtimeInvertedIndexReader.java:59) ~[pinot-all-0.9.2-jar-with-dependencies.jar:0.9.2-3e5e5aca07ad796d453add80a2b2b1bf1d654cf1]
  at org.apache.pinot.segment.local.indexsegment.mutable.MutableSegmentImpl.addNewRow(MutableSegmentImpl.java:580) ~[pinot-all-0.9.2-jar-with-dependencies.jar:0.9.2-3e5e5aca07ad796d453add80a2b2b1bf1d654cf1]
  at org.apache.pinot.segment.local.indexsegment.mutable.MutableSegmentImpl.index(MutableSegmentImpl.java:491) ~[pinot-all-0.9.2-jar-with-dependencies.jar:0.9.2-3e5e5aca07ad796d453add80a2b2b1bf1d654cf1]
  at org.apache.pinot.core.data.manager.realtime.LLRealtimeSegmentDataManager.processStreamEvents(LLRealtimeSegmentDataManager.java:524) [pinot-all-0.9.2-jar-with-dependencies.jar:0.9.2-3e5e5aca07ad796d453add80a2b2b1bf1d654cf1]
  at org.apache.pinot.core.data.manager.realtime.LLRealtimeSegmentDataManager.consumeLoop(LLRealtimeSegmentDataManager.java:420) [pinot-all-0.9.2-jar-with-dependencies.jar:0.9.2-3e5e5aca07ad796d453add80a2b2b1bf1d654cf1]
  at org.apache.pinot.core.data.manager.realtime.LLRealtimeSegmentDataManager$PartitionConsumer.run(LLRealtimeSegmentDataManager.java:568) [pinot-all-0.9.2-jar-with-dependencies.jar:0.9.2-3e5e5aca07ad796d453add80a2b2b1bf1d654cf1]
  at java.lang.Thread.run(Thread.java:829) [?:?]

Another similar example:
java.lang.IndexOutOfBoundsException: Index 3021 out of bounds for length 27

Digging into the stack trace a bit this method appears to operate on the assumption that the dictId is either the next index in the underlying ArrayList and should be added, or it's already a valid index and could be used to get(dictId).
When this assumption is not met then an IndexOutOfBoundsException is thrown and the table stops consuming from that partition.
Note: No table configurations were made between the version upgrades.

Can you please check if there are other errors of Caught exception while transforming the record: ... which is not caused by IndexOutOfBoundsException? Based on the code, I think the IndexOutOfBoundsException can happen when some of the previous records are not indexed properly

I haven't reproduced this stack trace but I think this may be fixed by #8211

@richardstartin This is related to my comment about RealtimeInvertedIndexReader under your PR


Fix differential drive motion model

Proposed changes
Going over the math a few times, it doesn't seem to me that the rotation variance computation distributes over rotation composition. Not with those nonlinear max, min, abs operations in between.
Type of change

[x] 🐛 Bugfix (change which fixes an issue)
[ ] 🚀 Feature (change which adds functionality)
[ ] 📚 Documentation (change which fixes or extends documentation)

Checklist

[x] Lint and unit tests (if any) pass locally with my changes
[ ] I have added tests that prove my fix is effective or that my feature works
[x] I have added necessary documentation (if appropriate)
[x] All commits have been signed for DCO

Additional comments
Not sure how to write a test for this. Would a formal proof (that rotation_variance(a) * rotation_variance(b) != rotation_variance(a * b)) do?

Going over the math a few times, it doesn't seem to me that the rotation variance computation distributes over rotation composition. Not with those nonlinear max, min, abs operations in between.

I totally agree that that operation most definitely is not distributive.
However, I have broader concerns regarding the rotation_variance() function itself. From what I gather it's meant to bring the 2nd/3rd quadrant rotation values that result from first_rotation when moving backwards because $\Delta x$ is negative (and square the value at the same time).
But that seems to be done at the end of all the math. By then, we already calculated the second rotation using the pre-adjustment first rotation, and it's not obvious to me that that can be fixed by moving second rotation back into 1st/4th quadrant too afterwards.
Not having gone through t all the math in Prob. Robotics, the definitions of $\delta_{rot1}$ and $\delta_{rot2}$ seem very straightforward (the aperture angles between the end/star pose and the direction between the end/start pose, range $-\pi$ to $\pi$). Maybe we should just do the quadrant adjustment once when calculating first $\delta_{rot1}$ the first time; that should take care of $\delta_{rot2}$ right away.

Additional comments
Not sure how to write a test for this. Would a formal proof (that rotation_variance(a) * rotation_variance(b) != rotation_variance(a * b)) do?

From this code we don't really have good observability to the results of this function, which would be the best way to test this. Given that the parameters are private you can only test by generating samples of the distribution and comparing it, which is not ideal.
I think it's worth either

providing observability to the distribution parameter values through getters for testing's sake (not a fan),
better yet, architecting this differently so that the actual code that does this critical calculation is in an external function/class that can be tested independently, feeding in pose and last_pose, and getting the distribution parameters at the other end, like we do with calculate_covariance() in the estimation mixin.

In this last scenario update_motion() would just call this function to calculate the distribution parameters, and manage the mixin last_pose_ state.

FWIW, we have tests that generate samples and assert distribution parameter values, no need to provide observability to the internal state.
https://github.com/Ekumen-OS/beluga/blob/9de0417ce9c5d0a22af021b16bc9a44ed665da2d/beluga/test/beluga/motion/test_differential_drive_model.cpp#L151

Good point. Bears asking why that test in insensitive to this fix then.
In that test, the translation distance is zero, so first_rotation would be zero and the result both after and before the change would be the same, right?.

In that test, the translation distance is zero, so first_rotation would be zero and the result both after and before the change would be the same, right?.

Right, I would imagine a new test where all parameters but translation_noise_from_rotation are zero, and we set a move that requires two rotations. I volunteer to give it a shot tonight if it helps.


jirafeau: init at 4.1.1 + module

Motivation for this change
Adds a package for Jirafeau and a module for configuring and running Jirafeau.
Things done

[x] Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
Built on platform(s)

[x] NixOS
[ ] macOS
[ ] other Linux distributions

[x] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[ ] Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
[ ] Tested execution of all binary files (usually in ./result/bin/)
[ ] Determined the impact on package closure size (by running nix path-info -S before and after)
[x] Ensured that relevant documentation is up to date
[x] Fits CONTRIBUTING.md.

@GrahamcOfBorg test jirafeau

It appears that the test passes for ofborg and it still passes for me locally.


[DO-NOT-MERGE][WIP] Investigating SPARK-30541 flaky test failure

DO NOT MERGE.
As title says, this PR is to trigger Jenkins builds to see DelegationTokenSuite fails, and get error messages which could be some hints to investigate.

Resolved via #27877.


[BEAM-10475]Add WithShardedKey variation of GroupIntoBatches transform in Python SDK.

The added variation of transform accepts the same parameters as the existing transform but output iterables with ShardedKey ,  See #13208 for changes for Java SDK.

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

[ ] Choose reviewer(s) and mention them in a comment (R: @username).
[ ] Format the pull request title like [BEAM-XXX] Fixes bug in ApproximateQuantiles, where you replace BEAM-XXX with the appropriate JIRA issue, if applicable. This will automatically link the pull request to the issue.
[ ] Update CHANGES.md with noteworthy changes.
[ ] If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.

GitHub Actions Tests Status (on master branch)

See CI.md for more information about GitHub Actions CI.

@reuvenlax

R: @boyuanzz

This LGTM. I will wait for python precommit to pass.
Does this need to wait on the java change at all? (E.g. do you expect more api changes in the java pr?)

This LGTM. I will wait for python precommit to pass.

Thanks a lot for the prompt review!

Does this need to wait on the java change at all? (E.g. do you expect more api changes in the java pr?)

I don't think so.

OK. Merging this. Please update if something relevant comes from the Java PR. (/cc @robertwb)


Student Acceptance

Create a field in the Student model as "accepted" (Datetime). After a year of the acceptance, the Student must be switched to Expired ("CADUCADO").

For this feature, I will try to use the status attribute in Student. I will try for it to change to Caducado when a year has passed.


Resolve Solidity paths in sol!

Custom types are Solidity paths, and currently we panic if it's longer than 1 ident.

This is now implemented
sol! {
    interface I {
        struct S {
            uint x;
        }
    }
    function func(I.S memory stuff);
}

let _ = funcCall { stuff: I::S { x: U256::ZERO } };


Discrepancy in "Mutations" section within App Tutorial

What version of Remix are you using?
N/A
Steps to Reproduce
Hey folks,
I'm going through your stellar App Tutorial and loving it. However, I spotted what appears to be a small discrepancy.
Once validation has been added in, the second paragraph after the screenshot says: "First I want you to notice that I've added an ActionData type so we could get some type safety". However, there is no ActionData type in the code example, only an actionData value.
Furthermore, the fourth paragraph states: "The badRequest helper function is important because it gives us typechecking that ensures our return value is of type ActionData, while still returning the accurate HTTP status, 400 Bad Request, to the client. If we just return the ActionData value, that would result in a 200 OK response, which isn't suitable since the form submission had errors."
However, the code example for the badRequest helper uses a generic type T, not the elusive ActionData type.
A small thing, but I had to double check a couple of times to make sure I hadn't missed anything (I sure hope I haven't actually missed anything).
Anyways loving Remix so far, keep up the great work!
Expected Behavior
I expected to see the ActionData type in the code examples
Actual Behavior
I didn't see the ActionData type in the code examples

Thank you for filling this issue @larister 🙏🏼
You were totally right, we forgot to remove references to ActionData when we leveraged type inference introduced in 1.6.5.
See the release notes here: https://github.com/remix-run/remix/releases/tag/remix%401.6.5 to learn more about this.
Should be fixed by #5292, if you want to give it a look.


Main OutlineEffect got a bug fix for EraseRenderer

See line 194 of OutlineEffect.cs: https://github.com/cakeslice/Outline-Effect/commit/781625ee21cd46d646fd8e6b4975398d294f0edf

Sorry, I didn't see this earlier!
Is it just line 194 that matters?

Looks like there are some stuff commented out too around lines 338 and 351. Hard to tell if that's all with all the formatting changes.

Yeah, merging the fix will be tricky. If someone makes a PR for it I'd be happy to merge, but frankly I'm just too busy with other things to do it myself.

I experienced this bug. Line 194 was enough to fix it.


GEODE-4318: Ensure that passwords are correctly redacted in the gfsh history file

Remove redact method in GfshHistory in favor of
ArgumentRedactor.redact

Co-authored-by: Jens Deppe<EMAIL_ADDRESS>Co-authored-by: Donal Evans<EMAIL_ADDRESS>Thank you for submitting a contribution to Apache Geode.
In order to streamline the review of the contribution we ask you
to ensure the following steps have been taken:
For all changes:

[ ] Is there a JIRA ticket associated with this PR? Is it referenced in the commit message?

[ ] Has your PR been rebased against the latest commit within the target branch (typically develop)?

[ ] Is your initial contribution a single, squashed commit?

[ ] Does gradlew build run cleanly?

[ ] Have you written or updated unit tests to verify your changes?

[ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?

Note:
Please ensure that once the PR is submitted, check Concourse for build issues and
submit an update to your PR as soon as possible. If you need help, please send an
email to<EMAIL_ADDRESS>

@Petahhh For your review


Move from Travis CI to GH actions

We want to move from Travis CI to GH actions due to a change in its policies. The configuration for GH Actions should cover the same that Travis does, that is:

[x] Common check on Linux. Build and tests for versions: 8.10,  8.8,  8.6,  8.4,  8.2, 8.0, 7.10
[x] Common check on OSX. Build and tests for versions: 8.10
[x] Bundle the project and create a release in GH based on a given tag.

Thanks a lot @fefi95 for the contributions. I'm closing this issue now.


tf_grouping_g.cu.o: No such file or directory

tf_sampling_g.cu.o does not exist either.

Hi @Tantoyy, were you able to solve this issue?


GSD Request

--- GSD JSON ---
{
  "vendor_name": "Linux",
  "product_name": "Kernel",
  "product_version": "versions from v4.14 to before v5.4.170",
  "vulnerability_type": "unspecified",
  "affected_component": "unspecified",
  "attack_vector": "unspecified",
  "impact": "unspecified",
  "credit": "",
  "references": [
    "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d25adbeb0cdb860fb39e09cdd025e9cfc954c5ab",
    "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=831de271452b87657fcf8d715ee20519b79caef5"
  ],
  "extended_references": [
    {
      "type": "commit",
      "value": "d25adbeb0cdb860fb39e09cdd025e9cfc954c5ab",
      "note": "introduced"
    },
    {
      "type": "commit",
      "value": "831de271452b87657fcf8d715ee20519b79caef5",
      "note": "fixed"
    }
  ],
  "reporter": "joshbressers",
  "reporter_id": 1692786,
  "notes": "",
  "description": "sctp: use call_rcu to free endpoint\n\nThis is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven.\nThis ID is fixed in Linux Kernel version v5.4.170 by commit 831de271452b87657fcf8d715ee20519b79caef5, it was introduced in version v4.14 by commit d25adbeb0cdb860fb39e09cdd025e9cfc954c5ab. For more details please see the references link."
}
--- GSD JSON ---

This issue has been assigned GSD-2022-1000031


Update Golang version to 1.17

Is your feature request related to a problem? Please describe.
No, update of oldest supported version of Golang.
Describe the solution you'd like

Update to Golang 1.17
Describe alternatives you've considered

N/A
Additional context

1.18 will be released in Feb after which 1.16 will no longer be supported.

Is it a possibility to wait with this update till 1.18 released?

We could do that or just merge the PR I have and open a new ticket to add 1.18 to our testing matrix, etc

I'm with @vmatyusGitHub on this one. As of today golang has two stable version 1.17 and 1.6 and 1.18 is still marked as unstable: https://go.dev/dl/
Merging the PR  makes sdk not compatible with 1.16, so we'll essentially only support 1.17
…/github.com/IBM/cloudant-go-sdk on  242-update-golang [?] $ go mod tidy
go mod tidy: go.mod file indicates go 1.17, but maximum supported version is 1.16

I'd prefer us to sit on the merging this PR till 1.18 goes stable, so we are on minimal supported version, not on maximum one.

Sound good, let's wait until the release of 1.18.

1.18 release now expected this month.

d) Set typecheck package as disabled till compatibility got not corrected.
But I personally vote for b), after the lint correction published it will work fine, it will be fixed in 2-4 weeks. 🤞 Can we wait that much?

I'm fine with holding off for a couple weeks until it's fixed.  I'm also fine with merging what we have (just 1.17) and then adding in 1.18 once it's fixed.
@mojito317 FYI

I'm also fine with merging what we have (just 1.17) and then adding in 1.18 once it's fixed.

Agree. Let's keep 1.16 and 1.17 for now and update the mod to 1.17.
After create an issue to update to 1.18 after the lint have a released fix. Even the PR can be prepared and can be moved under the Blocked coloumn.

Ok I'd be fine with that.  @eiri @mojito317 wdyt?

I think we can't bump mod to 1.17 and keep 1.16 at the same time go mod tidy will just block install on 1.16.

@eiri @mojito317 PR is now green after updating golang linter to latest version: https://github.com/IBM/cloudant-go-sdk/pull/245


Invoice Email Design Fix

Notion card
NA
Summary

Design Fixes for Invoice email
Add PNG icons as SVG is not supported by most email client
Update design to use tables and float instead of flex.

Preview

Local Opeaner

Macbook Mail Client

Gmail Browser Client

Type of change
Please delete options that are not relevant.

[ ] Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

Checklist:
NA

As I was testing it using localhost as domain the Saeloun logo is not rendering in Gmail Browser Client in above images.
It should not be the case if we are in Staging or Production environment.
Although I have tried to use properties which have high support still The Layout may vary depending on mail service provider (Gmail, AOL, Outlook etc) and on their respective client (Browser, Desktop, Android)


Draw each pose landmark in a different colour

Is there a landmark_drawing_spec that can draw each of the 33 landmarks in a different colour?

Hi @Sahil-RB ,
Below are the default Drawing specs for color. You can change the color with python implementation as per your business requirement!
(48, 255, 48) For Green color
def get_default_pose_landmarks_style() -> Mapping[int, DrawingSpec]:
"""Returns the default pose landmarks drawing style.
Returns:
A mapping from each pose landmark to its default drawing spec.
"""
pose_landmark_style = {}
left_spec = DrawingSpec(
color=(48, 255, 48), thickness=_THICKNESS_POSE_LANDMARKS)
right_spec = DrawingSpec(
color=(48, 255, 48), thickness=_THICKNESS_POSE_LANDMARKS)


Some packages throw warning upon clean install

Hi,
first of all, thank you for the development of rig.
I am only starting to use it, but I hope that it will turn out to be as helpful as it seems that it can be :)
tl;dr
I installed rig and rstudio following the instructions from https://ivelasq.rbind.io/blog/macos-rig/ on a MacBook Pro M1 Pro with Ventura 13.1.
I did a first install and followed the instructions, i.e., installing via brew and then running rig add release.
I further set up my R development environment according to the instructions with usethis, etc.
However, I ran into the problem that some packages threw a warning that they could not be updated, specifically boot, foreign, Matrix, nlme, and survival, and these packages reside under /Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library
My question is now:
What have I been doing wrong or missed?
More details below!
I tried a few things via the RStudio Console, ultimately resorting to rig remove release to go back to a blank slate and see where I screwed up.
cedric.laczny:/Users/cedric.laczny/ $ rig remove release                                                                        [10:13:35]
[INFO] Running `sudo` for removing R versions. This might need your password.
Password:
[WARN] Removing default version, set new default with rig default <version>
[INFO] Removing /Library/Frameworks/R.framework/Versions/4.2-arm64
[INFO] Updating R-* quick links (as needed)

A new rig add release gives me:
$ rig add release                                                                [10:17:08]
[INFO] Running `sudo` for adding new R versions. This might need your password.
Password:
[INFO] arm64-R-4.2.2-arm64.pkg is cached at /tmp/rig/arm64-R-4.2.2-arm64.pkg
[INFO] Running installer
[INFO] > installer: Package name is R 4.2.2 for macOS (ARM64)
[INFO] > installer: Installing at base path /
[INFO] > installer: The install was successful.
[INFO] Forgetting installed versions
[INFO] Fixing permissions
[INFO] Updating R-* quick links (as needed)
[INFO] Adding R-release alias to R 4.2-arm64
[INFO] Setting default CRAN mirror
[INFO] Installing pak for R 4.2-arm64 (if not installed yet)

When I then open Rstudio.app and type update.packages() into the Console, I am getting:
Warning: package 'boot' in library '/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library' will not be updated
Warning: package 'foreign' in library '/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library' will not be updated
Warning: package 'Matrix' in library '/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library' will not be updated
Warning: package 'nlme' in library '/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library' will not be updated
Warning: package 'survival' in library '/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library' will not be updated

.libPaths() gives me:
[1] "/Users/cedric.laczny/Library/R/arm64/4.2/library"
[2] "/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library"

and Sys.getenv("R_LIBS_USER") gives me:
[1] "/Users/cedric.laczny/Library/R/arm64/4.2/library"

I then renamed my user-level R library to have this also clean.
Running update.packages() then gives me:
boot :
 Version 1.3-28 installed in /Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library
 Version 1.3-28.1 available at https://cloud.r-project.org
Update? (Yes/no/cancel) y
foreign :
 Version 0.8-83 installed in /Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library
 Version 0.8-84 available at https://cloud.r-project.org
Update? (Yes/no/cancel) Yes
Matrix :
 Version 1.5-1 installed in /Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library
 Version 1.5-3 available at https://cloud.r-project.org
Update? (Yes/no/cancel) Yes
nlme :
 Version 3.1-160 installed in /Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library
 Version 3.1-161 available at https://cloud.r-project.org
Update? (Yes/no/cancel) Yes
survival :
 Version 3.4-0 installed in /Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library
 Version 3.5-0 available at https://cloud.r-project.org
Update? (Yes/no/cancel) Yes
Warning in install.packages(update[instlib == l, "Package"], l, repos = repos,  :
  'lib = "/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library"' is not writable
Would you like to use a personal library instead? (yes/No/cancel)

  There is a binary version available but the source version is later:
         binary source needs_compilation
survival  3.4-0  3.5-0              TRUE

Do you want to install from sources the package which needs compilation? (Yes/no/cancel)
trying URL 'https://cloud.r-project.org/bin/macosx/big-sur-arm64/contrib/4.2/boot_1.3-28.1.tgz'
Content type 'application/x-gzip' length 629022 bytes (614 KB)
==================================================
downloaded 614 KB

trying URL 'https://cloud.r-project.org/bin/macosx/big-sur-arm64/contrib/4.2/foreign_0.8-84.tgz'
Content type 'application/x-gzip' length 339479 bytes (331 KB)
==================================================
downloaded 331 KB

trying URL 'https://cloud.r-project.org/bin/macosx/big-sur-arm64/contrib/4.2/Matrix_1.5-3.tgz'
Content type 'application/x-gzip' length 5249185 bytes (5.0 MB)
==================================================
downloaded 5.0 MB

trying URL 'https://cloud.r-project.org/bin/macosx/big-sur-arm64/contrib/4.2/nlme_3.1-161.tgz'
Content type 'application/x-gzip' length 2394611 bytes (2.3 MB)
==================================================
downloaded 2.3 MB

The downloaded binary packages are in
	/var/folders/mv/zv136yrd1_ng4d2w899qj4g0lgzc4c/T//RtmpM5sWqC/downloaded_packages
installing the source package ‘survival’

trying URL 'https://cloud.r-project.org/src/contrib/survival_3.5-0.tar.gz'
Content type 'application/x-gzip' length 6274897 bytes (6.0 MB)
==================================================
downloaded 6.0 MB

* installing *source* package ‘survival’ ...

[...]
installing to /Users/cedric.laczny/Library/R/arm64/4.2/library/00LOCK-survival/00new/survival/libs
** R
** data
*** moving datasets to lazyload DB
** inst
** byte-compile and prepare package for lazy loading
** help
*** installing help indices
*** copying figures
** building package indices
** installing vignettes
** testing if installed package can be loaded from temporary location
** checking absolute paths in shared objects and dynamic libraries
** testing if installed package can be loaded from final location
** testing if installed package keeps a record of temporary installation path
* DONE (survival)

The downloaded source packages are in
	‘/private/var/folders/mv/zv136yrd1_ng4d2w899qj4g0lgzc4c/T/RtmpM5sWqC/downloaded_packages’

Calling update.packages() again, gives me, again:
Warning: package 'boot' in library '/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library' will not be updated
Warning: package 'foreign' in library '/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library' will not be updated
Warning: package 'Matrix' in library '/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library' will not be updated
Warning: package 'nlme' in library '/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library' will not be updated
Warning: package 'survival' in library '/Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library' will not be updated

In summary, I am unsure what I have missed/did wrong.
Moreoever, I somehow guess that the five packages here in question do have an update, which is what triggers this warning.
 I guess you get the warning because you can't update packages in a read only library. But that is fine, you can install newer versions of these packages into the user library, and pak does this automatically:
❯ pak::pkg_status("boot")[, c("library", "package", "version")]
# A data frame: 2 × 3
  library                                                              package version
* <chr>                                                                <chr>   <chr>
1 /Users/gaborcsardi/Library/R/arm64/4.2/library                       boot    1.3-28.1
2 /Library/Frameworks/R.framework/Versions/4.2-arm64/Resources/library boot    1.3-28

If you really want to update packages in the system library, start R as the root user, and call
update.packages(lib.loc = .Library)

Thank you. I seem to recall that this is what I did in the past, but it still complained about the older system libraries, which was puzzling to me.
So basically, having the same library but in different versions ...
Will check this again and let you know.


Feature/sc 5682 refactoring page objects news

Description
refactor news.js
Links to Tickets or other pull requests

Changes

Deployment

New Repos, NPM pakages or vendor scripts

Approval for review

[ ] All points were discussed with the ticket creator, support-team or product owner. The code upholds all quality guidelines from the PR-template.

Notice: Please remove the WIP label if the PR is ready to review, otherwise nobody will review it.

Link to Definiton of Done
More and detailed information on the definition of done can be found on Confluence

Retry DeepCode


doc(adr-5): adr for edc usage scenarios

this adr describes recommendations of EDC usage scenarios within bpdm solution together with value-added-service

Fine for me.


self contained examples

do you have some self contained examples / rendering lying around ?

Unfortunately I do not have any of the examples rendered at the moment.  All the examples in the example directory are self contained.  I hope to come back to LaTeXGrapher and improve it significantly, but in the mean time, I've been doing any graphing that I need directly in Haskell with Diagrams.  For example, a piecewise plot:
Code: https://gist.github.com/fryguybob/32adf80cf1dc1181344c3ce99acb5efb
Plot:  http://www.cs.rochester.edu/u/ryates/temp/plot-gist.pdf
We hope to also include much more support for 3D diagrams.  For example:
http://imgur.com/p8ULM8D
When I do get around to this again, I will be sure to make some renderings of the examples!

I forgot to link to the diagrams package:  http://projects.haskell.org/diagrams/

very good to know, thank you. I toyed around with Diagrams which is impressive.
PS : I am looking specifically in commutative diagrams, with a fair bit of 3D.
Not sure there is anything better than tikzcd


Discussion about the difference with reference implementation

It is really awesome work for understanding the computing pattern of mamba2 model. But i notice that you mentioned that

The model's output logits follow the same distribution as the reference implementation but are not numerically equivalent.

Could you please give some hint on why the outputs are not numerically equivalent? Is there any modification or difference of model architecture or computing pattern with the reference implementation? If not, what caused different output? Since in John Ma's mamba-minimal repo it mentioned that it has equivalent output logits as the original mamba, i wonder why this inplemention would lead to non-equivalent output logits. Looking forward to your kind answer.

I would be surprised if mamba-minimal actually produced output that is bit-level equivalent to the reference implementation. In general, floating point calculations are very sensitive to the tiniest of changes, even different patch versions of PyTorch would give different results due to new optimizations.


[Blockchain] Understanding layer 2 blockchain

Proposed title of article
Understanding layer 2 blockchain
Proposed article introduction
Since the release of Bitcoin, blockchains have continued to grow and gain popularity rapidly over the years. People have used the technology in the wide areas apart from just implementing the payments systems. The reason is that blockchain technology is decentralized and highly secure.
It is evident that no single blockchain technology can provide decentralization, security and scalability in achieving the optimal functionality, most tend to sacrifice dome of the elements. A good example is between the Bitcoin and Etherum which competes in terms of scalability, security and decentralization. In order to gain more popularity solutions like layer 2 protocols have appeared in the recent years.
In the proposed article we will cover in more details what is layer 2 blockchain, how it works and why is it needed in the blockchain network.
Key takeaways
At the end of the article the learner will ne able to understand:

the concept of layet 2 blockchain
different layer 2 blockchain solutions currently used in the blockchain network
the reasons why layer 2 blockchains are implemented in the blockchain ecosystem

Article quality
The proposed article provides in-depth knowledge and exploration of the layer 2 blockchain and give examples of where it is currently used, unlike the similar articles online which tend to concentrate more on comparisons between layer 1 and layer 2 blockchains and hence missing out on vital details.
References
N/A

Good afternoon and thank you for submitting your topic suggestion.
Your topic form has been entered into our queue and should be reviewed (for approval) as soon as a content moderator is finished reviewing the ones in the queue before it.

Good topic @martha-ngugi - approved.


Domain discovery (identity brokering) doesn't work

Describe the bug
I'm trying to set up domain discovery so that organizations can have different branding/IDPs but keeping a single login page.
I followed the guide on identity brokering, but I can't get ZITADEL to show the correct login page after entering the username.
To Reproduce
I created the following resources (n.b.: private_labeling_setting and user_login)
terraform {
  required_providers {
    zitadel = {
      source  = "zitadel/zitadel"
      version = "1.0.0-alpha.8"
    }
  }
}

resource "zitadel_org" "main_org" {
  name = "Main Org"
}

resource "zitadel_project" "main_project" {
  depends_on = [zitadel_org.main_org]

  org_id = zitadel_org.main_org.id

  name                     = "main-project"
  project_role_assertion   = true
  project_role_check       = true
  has_project_check        = true
  private_labeling_setting = "PRIVATE_LABELING_SETTING_ALLOW_LOGIN_USER_RESOURCE_OWNER_POLICY"
}

resource "zitadel_application_oidc" "application_oidc" {
  depends_on = [zitadel_org.main_org, zitadel_project.main_project]

  org_id     = zitadel_org.main_org.id
  project_id = zitadel_project.main_project.id

  name                        = "webapp"
  redirect_uris               = ["http://localhost:8080"]
  response_types              = ["OIDC_RESPONSE_TYPE_CODE"]
  grant_types                 = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"]
  post_logout_redirect_uris   = ["http://localhost:8080"]
  app_type                    = "OIDC_APP_TYPE_WEB"
  auth_method_type            = "OIDC_AUTH_METHOD_TYPE_NONE"
  version                     = "OIDC_VERSION_1_0"
  clock_skew                  = "0s"
  dev_mode                    = true
  access_token_type           = "OIDC_TOKEN_TYPE_BEARER"
  id_token_role_assertion     = true
  id_token_userinfo_assertion = true
}

variable "google_oidc_client_id" {
  type      = string
  sensitive = true
}

variable "google_oidc_client_secret" {
  type      = string
  sensitive = true
}

resource "zitadel_org_oidc_idp" "google_oidc" {
  depends_on = [zitadel_org.main_org]

  org_id               = zitadel_org.main_org.id
  name                 = "Google"
  styling_type         = "STYLING_TYPE_GOOGLE"
  client_id            = var.google_oidc_client_id
  client_secret        = var.google_oidc_client_secret
  issuer               = "https://accounts.google.com"
  scopes               = ["openid", "profile", "email"]
  display_name_mapping = "OIDC_MAPPING_FIELD_EMAIL"
  username_mapping     = "OIDC_MAPPING_FIELD_EMAIL"
  auto_register        = true
}

resource "zitadel_login_policy" "login_policy" {
  depends_on = [zitadel_org.main_org, zitadel_org_oidc_idp.google_oidc]

  org_id                        = zitadel_org.main_org.id
  allow_external_idp            = true
  allow_register                = true
  default_redirect_uri          = "localhost:8080"
  external_login_check_lifetime = "240h0m0s"
  force_mfa                     = false
  hide_password_reset           = true
  idps                          = [zitadel_org_oidc_idp.google_oidc.id]
  ignore_unknown_usernames      = true
  mfa_init_skip_lifetime        = "720h0m0s"
  multi_factor_check_lifetime   = "12h0m0s"
  multi_factors                 = ["MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION"]
  password_check_lifetime       = "240h0m0s"
  passwordless_type             = "PASSWORDLESS_TYPE_NOT_ALLOWED"
  second_factor_check_lifetime  = "18h0m0s"
  second_factors                = ["SECOND_FACTOR_TYPE_OTP", "SECOND_FACTOR_TYPE_U2F"]
  user_login                    = false
}

resource "zitadel_domain" "domain" {
  depends_on = [zitadel_org.main_org]

  org_id = zitadel_org.main_org.id

  name = "localhost.com"
}

resource "zitadel_human_user" "human_user" {
  depends_on = [zitadel_org.main_org]

  org_id = zitadel_org.main_org.id

  user_name         = "human"
  first_name        = "firstname"
  last_name         = "lastname"
  display_name      = "displayname"
  email             =<EMAIL_ADDRESS>  is_email_verified = true
  initial_password  = "Password1!"
}

Expected behaviour
ZITADEL should match the domain localhost.com and present Google as IPD (as if passing the primary domain as a scope, which works)
Screenshots

Additional context
ZITADEL 2.4.0

Hi @DavideWalder
If I understand it correct, what you try to do is at the moment not possible.
We do not have the feature to link an existing user that has a local user right now, after entering the username.
The way to do this right now, is to click on the idp (e.g Google) button on the first screen, where you now enter the username. Then the user will be redirected to the idp. After authentication he gets back to the zitadel login screen and if we find no linkt user, we will show the option to link an existing user or register a new one. If auto register we create automatically a new user.

Thanks for the explanation, this might be difficult since we need to be able to have multiple customers each with their own IDP that can't be shown to the others.
For example with might have three customers each using their own Azure AD IDP, but we can't show as login options

Google
Azure AD (customer 1)
Azure AD (customer 2)
Azure AD (customer 3)

Is this on the roadmap or is there an alternative way to do it? I can't use different URLs for different customers since customers are provisioned dynamically

At the moment what you try to achieve is only possible with the primary domain scope.
We do not have this on our roadmap right now.
This Thursday we will have an internal meeting about some topics on how to improve the login flow. We will discuss this also and I will give you feedback after.

Just to understand correctly what you try to achieve:
The user gets to the login page and enters a loginname e.g<EMAIL_ADDRESS>We can not find the user in ZITADEL but the domain customer.ch exists on an organisation.
We redirect to the branded page of the organisation
Or is is like:
The user gets to the login page and enters a loginname e.g<EMAIL_ADDRESS>The user exists in ZITADEL, we go to the next step e.g password or passwordless
We show Identity providers beneath the input field, so the user is able to link to a user in an idp

Ok, so in regard to discovery. You would be fine of doing discovery on the "username" and route the user towards an organisation based on that mechanic?
In my mind the default could be to use the domain name suffix (when using the mail) to achieve this (somewhat close as we do it already).
Or do you have more complex needs for discovery? Because in that case we might opt more for an action to achieve the logic part.
One thing that is open though is to show the IDP to the user on the org login regardless of the users state based on the org settings. Right @hifabienne @livio-a
@DavideWalder How urgent is this to you?

The flow could be:

the user is presented with the login page of the instance
the user enters its email address
discovery:

if the domain of the address matches one of the organization domains, the user will be presented with that organization's login page
if the domain doesn't match, stay with the instance settings

From what I understand, the only attribute that uniquely identifies a user across organizations is the login name (username@domain). This means that if a customer doesn't use a unique domain (for example some users might have an external email address, e.g.: @yahoo.com), the logic might be more complicated since nothing prevents an email from being reused in different organizations (this won't happen in our integration though). Same goes for the user name, which is not necessarily unique.
I don't see any other clean solution other than allowing domain discovery only for registered domains. This should not be a limitation since this feature is mostly needed for SSO customers, which have a specific domain.
Security concern:
This would allow any user to probe the login to see if a certain organization is registered (since it would trigger domain discovery). Do you see any issue associated with this?
In terms of urgency: this is currently blocking the onboarding of SSO customers (since they require a dedicated IDP)

Ok, so I think in here are two action items then:

Our "Domains" feature should be allowed to use as discovery feature based on the domainname
After the discovery the user needs to be able to register and not only login.

@hifabienne @livio-a @adlerhurst what do you think of this... my2cents are the following

Iteration of domains is fine with me... i see no way of avoiding that :grin:
We should allow register after discovery
Chjange the behaviour of domain in this direction makes sense (actually I think we should allow customers to decide if domains are used for discovery and/or suffix of usernames)

In terms of urgency: this is currently blocking the onboarding of SSO customers (since they require a dedicated IDP
Got it, we keep that in mind to raise the prio!

Ok, so I think in here are two action items then:

Our "Domains" feature should be allowed to use as discovery feature based on the domainname
After the discovery the user needs to be able to register and not only login.

@hifabienne @livio-a @adlerhurst what do you think of this... my2cents are the following

Iteration of domains is fine with me... i see no way of avoiding that 😁
We should allow register after discovery
Chjange the behaviour of domain in this direction makes sense (actually I think we should allow customers to decide if domains are used for discovery and/or suffix of usernames)

In terms of urgency: this is currently blocking the onboarding of SSO customers (since they require a dedicated IDP
Got it, we keep that in mind to raise the prio!

This sounds good to me. Probably we should extend a policy, to configure if domain discovery is allowed or not.

I created an issue to track this new feature: #4463
@DavideWalder In terms of urgency what does that mean in a timeline? When would you need this feature?

This is currently the only feature preventing us from using ZITADEL, as soon as the feature is in we can transition.

Another question related to domain discovery:
Currently, for users from customers with unique domains, I can create a username from the local part of their email address and register the company domain, so that when logging in they can use their email.
Example:
<EMAIL_ADDRESS>-> username: john.doe, organization domain: acme.com
This doesn't work if:

The user has another domain in his email address (e.g<EMAIL_ADDRESS>There customer has multiple organizations (for example for production and testing)

The only solution I see to the first case is to ask the user to login with<EMAIL_ADDRESS>The only solution I see for the second case is to create different domains such as test.acme.com or qa.acme.com, and ask the user to login as<EMAIL_ADDRESS>Am I missing something?

Another question related to domain discovery:
Currently, for users from customers with unique domains, I can create a username from the local part of their email address and register the company domain, so that when logging in they can use their email.
Example<EMAIL_ADDRESS>-> username: john.doe, organization domain: acme.com
This doesn't work if:

The user has another domain in his email address (e.g<EMAIL_ADDRESS>There customer has multiple organizations (for example for production and testing)

The only solution I see to the first case is to ask the user to login with<EMAIL_ADDRESS>The only solution I see for the second case is to create different domains such as test.acme.com or qa.acme.com, and ask the user to login as<EMAIL_ADDRESS>Am I missing something?

You can register multiple domains on an organization. So you can register acme.com aswell as yahoo.com and the user will be able to login with both loginnames.
Example: username: john.doe,  organization domain: acme.com and yahoo.com, loginname<EMAIL_ADDRESS>and<EMAIL_ADDRESS>The second case depends on your usecase. why do you need multiple organizations? Do you want them to have different users for different use cases? Or do you want them to have different authorizations? So you can solve it by having different domains or by adding the user to one organization and give them different authorizations on different organizations.

Another question related to domain discovery:
Currently, for users from customers with unique domains, I can create a username from the local part of their email address and register the company domain, so that when logging in they can use their email.
Example<EMAIL_ADDRESS>-> username: john.doe, organization domain: acme.com
This doesn't work if:

The user has another domain in his email address (e.g<EMAIL_ADDRESS>There customer has multiple organizations (for example for production and testing)

The only solution I see to the first case is to ask the user to login with<EMAIL_ADDRESS>The only solution I see for the second case is to create different domains such as test.acme.com or qa.acme.com, and ask the user to login as<EMAIL_ADDRESS>Am I missing something?

You can register multiple domains on an organization. So you can register acme.com aswell as yahoo.com and the user will be able to login with both loginnames. Example: username: john.doe, organization domain: acme.com and yahoo.com, loginname<EMAIL_ADDRESS>and<EMAIL_ADDRESS>The second case depends on your usecase. why do you need multiple organizations? Do you want them to have different users for different use cases? Or do you want them to have different authorizations? So you can solve it by having different domains or by adding the user to one organization and give them different authorizations on different organizations.

First case:
I saw that it is not possible to register the same domain with multiple organizations (and rightfully so), so that option wouldn't work since I can have @yahoo.com users in more than one organization. Still, the different login name could be an acceptable compromise on the user side.
Second case:
In our usage of ZITADEL, we keep a 1:1 relation between ZITADEL organizations and our organizations (which are isolated environments). Access to multiple organizations is modelled by authorizations, so there will only be one user (with grants on acme.com and/or test.acme.com).
As you suggested, here the best solution would be to have only one organization in ZITADEL and multiple organzations on our side. This adds a lot of complexity to the integration though (I can't use ZITADEL organizations to model access to our organizations, since they wouldn't be 1:1). I'm going to defer this issue, once again the only compromise is that users that were initially created in test.acme.com will always have to login with that domain, which is acceptable.

@hifabienne Regarding the unique organization holding all the users, this might be a viable option. I would then only create users in separate organizations when dealing with SSO, different IDPs or login settings.

@DavideWalder
I am not sure how your complete usecase looks like. There might be solutions. But without understanding the use case it is difficult to help.
What I understood is:
Organization 1: CustomerA

Users with usernames like<EMAIL_ADDRESS>--> they need SSO with an external IDP
Users with usernames like<EMAIL_ADDRESS>(any email) --> they don't need SSO with an external IDP

Organization 2: CustomerB

Users with usernames like<EMAIL_ADDRESS>--> they need SSO with an external IDP

Users with usernames like<EMAIL_ADDRESS>(any email, but could be same domain as in other organizations) --> they don't need SSO with external IDP

For the unique domains like customerA.com and customerB.com you would need domain discovery

All users will be created/imported via API in ZITADEL. They will not register within the ZITADEL login flow.

@DavideWalder
I am not sure how your complete usecase looks like. There might be solutions. But without understanding the use case it is difficult to help.
What I understood is:
Organization 1: CustomerA

Users with usernames like<EMAIL_ADDRESS>--> they need SSO with an external IDP
Users with usernames like<EMAIL_ADDRESS>(any email) --> they don't need SSO with an external IDP

Organization 2: CustomerB

Users with usernames like<EMAIL_ADDRESS>--> they need SSO with an external IDP
Users with usernames like<EMAIL_ADDRESS>(any email, but could be same domain as in other organizations) --> they don't need SSO with external IDP
For the unique domains like customerA.com and customerB.com you would need domain discovery
All users will be created/imported via API in ZITADEL. They will not register within the ZITADEL login flow.

This is correct, if I understand you suggestion correctly I could create the yahoo.com users under a single organization (common to all customers, having many associated domains), and the others under their respective organizations with the registered domains (customerA.com and customerB.com).
The only caveat is the I need to dynamically register new domains as I encounter them (since I don't know which email users are going to use). This should be easy to manage though

@hifabienne I realized now that the usage of domains is not mandatory, I can therefore disabled it with the option user_login_must_be_domain for the main organization, this solves the issue for<EMAIL_ADDRESS>

@hifabienne I realized now that the usage of domains is not mandatory, I can therefore disabled it with the option user_login_must_be_domain for the main organization, this solves the issue for<EMAIL_ADDRESS>
Yes exactly, so if I understand you right, you can solve your problems?

@hifabienne I realized now that the usage of domains is not mandatory, I can therefore disabled it with the option user_login_must_be_domain for the main organization, this solves the issue for<EMAIL_ADDRESS>
Yes exactly, so if I understand you right, you can solve your problems?

Currently testing, but it seems like it for non-SSO users. I still need to create the users in different organizations though (otherwise if one customer doesn't want to enforce MFA or similar, none can). This is not an issue though, since I can disable domain discovery in all of them (aside from SSO customers). GetUserByLoginNameGlobal is a lifesaver

So I will close this issue, feel free to reopen or open a new one if you still have some other problems


io: add Submitted and Unsubmitted

This adds support for "raw operations" to be used, and unblocks work on a more powerful builder-style API for provided buffers and attaching flags.

Gonna back this out now that I am taking a slightly different approach here.


Add translation to Spanish.

Added files neopixel-json-strings.json and neopixel-strings.json translated to Spanish.

 Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.:x: ngammarano sign nowYou have signed the CLA already but the status is still pending? Let us recheck it.

Why we can not see this Spanish translation files ??
I've published new files to spanish "es-ES" folder .


You can damage multiple walls with the spear

It's a spear, it makes a bit more sense if it was a crowbar/swing weapon.

It's hitting everything inside the arc in range.
Could put a maximum targets var on weapons to prevent hitting too many things in cases like this. This could however lead to not being able to hit an intended target. Plus I imagine it is desirable to skewer two people standing behind each other.


METRON-1810 Storm Profiler Intermittent Test Failure

This PR hopefully resolves some of the more frequent, intermittent ProfilerIntegrationTest failures.
Testing
Run the integration tests and they should not fail.
I have repeatedly run the integration tests on my laptop and have yet to see a failure.  I am also repeatedly triggering Travis CI builds on this branch to see if any failures occur there.  If I do the same with master, I can replicate the test failures.  I can't prove the problem is solved, but I am hoping this helps.
Changes

This change uses Caffeine's CacheWriter in place of the RemovalListener for profile expiration.  This is explained more in the next section.

Removed the ability to define the cache maintenance executor for the DefaultMessageDistributor.  This was only needed for testing RemovalListeners, which no longer exist.

I re-jiggered some of the integration tests to provide more information when they do fail. I removed the use of waitOrTimeout and replaced it with assertEventually.  I am also using a different style of assertion; Hamcrest-y.  These changes should provide additional information and also be more consistent with the rest of the code base.

After removing the dependency that provided waitOrTimeout, I had to rework some of the project dependencies because multiple versions ofhttpclient lib was being pulled in.  This caused the new REST function in stellar-common to blow up when a Stellar execution environment is loaded during the integration test.

Added additional debug logging for the caches including an estimate of the cache size.

RemovalListener to CacheWriter
Profiles are designed to expire and flush after a fixed period of time; the TTL.  The integration tests rely on some of the profile values being flushed by this TTL mechanism.
The TTL mechanism is driven by cache expiration. There is a cache of "active" profiles.  This cache is configured to have values timeout after they have not been accessed for a fixed period of time.  Once they timeout from the active cache, they are placed on an "expired" cache.  Messages are not applied to expired profiles, but these expired profiles hang around for a fixed period of time to allow them to be flushed.
Previously, a Caffeine RemovalListener was used so that when a profile expires from the active cache, it is placed into the expired cache. When the tests fail, it seems that the RemovalListener is not notified in a timely fashion, so the profile doesn't make it to the expired cache and so never flushes to be read by the integration test.
In Caffeine, these listeners are notified asynchronously, on a separate thread (via ForkJoinPool.commonPool()), not inline with cache reads or writes.  For running tests that depend on RemovalListeners, it is recommended to set the cache maintenance executor to something like MoreExecutors.sameThreadExecutor() so that cache maintenance is executed on the main execution thread when cleanUp is called.  This was done for the unit tests, but was not done for the integration tests.
The Caffeine Wiki mentions that when notification should be performed synchronously, which logically works for this use case, to use a CacheWriter instead.

Removal listener operations are executed asynchronously using an Executor. The default executor is ForkJoinPool.commonPool() and can be overridden via Caffeine.executor(Executor). When the operation must be performed synchronously with the removal, use CacheWriter instead.

Prior to #1270 we were using Guava for these caches.  In Guava, the default behavior is for the RemovalListeners is to run synchronously.

Warning: removal listener operations are executed synchronously by default, and since cache maintenance is normally performed during normal cache operations, expensive removal listeners can slow down normal cache function!

This explains why the integration tests have only recently started to be a problem.  This also justifies the move to using a CacheWriter.  CacheWriters operate synchronously and so restores the behavior that we had prior to #1270.
This does not negatively impact production performance because the ActiveCacheWriter only does work on a delete which occurs only rarely when a profile stops receiving messages, not on a write.  In addition, these caches are very read-heavy as in most cases the cache is only written to when a new profile is defined or on topology start-up.
Pull Request Checklist

[x] Is there a JIRA ticket associated with this PR? If not one needs to be created at Metron Jira.
[x] Does your PR title start with METRON-XXXX where XXXX is the JIRA number you are trying to resolve? Pay particular attention to the hyphen "-" character.
[x] Has your PR been rebased against the latest commit within the target branch (typically master)?
[x] Have you included steps to reproduce the behavior or problem that is being changed or addressed?
[x] Have you included steps or a guide to how the change may be verified and tested manually?
[x] Have you ensured that the full suite of tests and checks have been executed in the root metron folder via:mvn -q clean integration-test install && dev-utilities/build-utils/verify_licenses.sh

[x] Have you written or updated unit tests and or integration tests to verify your changes?
[x] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
[x] Have you verified the basic functionality of the build by building and running locally with Vagrant full-dev environment or the equivalent?

I have run it up in Full Dev successfully.
I ran all the tests in ProfilerIntegrationTest in a continuous loop on my desktop for maybe 3 or 4 hours yesterday.  Doing the same on master fails within 20 minutes or so.
I have manually triggered it in Travis 10 times.

+1, glad to see it working well.


Support Istio authentication with Casdoor

See similar as: https://www.keycloak.org/2018/02/keycloak-and-istio.html

Add name to: https://istio.io/latest/docs/concepts/security/#:~:text=ORY Hydra-,Keycloak,-Auth0

IstioCon: https://mp.weixin.qq.com/s/J3ormnpuYH45vbkN_G7mvg

@ComradeProgrammer

https://github.com/istio/istio.io/pull/10860

Done


Alter Pco2, Po2 and ph fields

Proposed Changes

Added support for decimal places for PCo2 and Po2
Increased number of decimal places to 3 for pH
Part of #8858 on FE

Merge Checklist

[ ] Tests added/fixed
[ ] Update docs in /docs
[ ] Linting Complete
[ ] Any other necessary step

Only PR's with test cases included and passing lint and test pipelines will be reviewed
@ohcnetwork/care-backend-maintainers @ohcnetwork/care-backend-admins

Summary by CodeRabbit

New Features

Enhanced precision for medical measurements by updating fields related to pco2, ph, and po2 in the daily round data model.
pco2 and po2 fields now support decimal values for improved accuracy.
Updated validation rules ensure that input values fall within specified ranges, enhancing data integrity.

These changes contribute to more reliable data entry and management in the facility application.

Closing as FHIR takes care of it.


chat command to share CoX rotation

I feel like it could be a nice qol improvement to have a chat command, something like !roto or !rotation to announce the rotation of the current Chambers of Xeric instance in chat, so if scouting in multiple worlds, rotation could be easily shared. output could be something like
Guardians - Shamans - Crabs - Muttadile - Tightrope and maybe include world?

We have support for sending layouts to parties currently, though I think not many people use it. I suppose we could do this in addition..

I'd love this. I myself dislike using the discord plugin to raids with others and rather use a command like !rotation to broadcast it in my clanchat or private message

This is basically #7736 again but we closed that due to the party raid thing.

added in #10155


Fixed Divider Transition between normal and in-menu view

Summary
resolves #770
Additional Details
Resolved by updating the transition of the divider  to hide itself from the face-up normal view only when there is at least one item of the item-group preceding/before the divider.

Whoops. Nevermind earlier comment.
Could a test be added to prevent regression?

Whoops. Nevermind earlier comment.
Could a test be added to prevent regression?

do you mean to say test like this : 3a0e07713c677eec29979b4e62652447b4cc32e1

It seems that the test passes with or without the changes to CollapsibleMenuView.jsx

It seems that the test passes with or without the changes to CollapsibleMenuView.jsx

yes, Change was just to stop divider from getting added to collapsible menu if divider was the last one to get hidden. Due to this I didn't considered adding WDIO Tests initially while opening PR.

Tested: PR #779
Resolves: Issue #770
Reviewed:

resolves issue of divider moving into menu too early.

Marking as Verified, ready for Release.

Pass

UX Review


BatchDelete fails on Linux/Ubuntu & MySql

Partial stack trace:
MySqlConnector.MySqlException (0x80004005): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''Log' AUTO_INCREMENT = 1' at line 1
   at MySqlConnector.Core.ServerSession.ReceiveReplyAsyncAwaited(ValueTask`1 task) in /_/src/MySqlConnector/Core/ServerSession.cs:line 910
   at MySqlConnector.Core.ResultSet.ReadResultSetHeaderAsync(IOBehavior ioBehavior) in /_/src/MySqlConnector/Core/ResultSet.cs:line 44
   at MySqlConnector.MySqlDataReader.ActivateResultSet(CancellationToken cancellationToken) in /_/src/MySqlConnector/MySqlDataReader.cs:line 107
   at MySqlConnector.MySqlDataReader.CreateAsync(CommandListPosition commandListPosition, ICommandPayloadCreator payloadCreator, IDictionary`2 cachedProcedures, IMySqlCommand command, CommandBehavior behavior, Activity activity, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/MySqlDataReader.cs:line 450
   at MySqlConnector.Core.CommandExecutor.ExecuteReaderAsync(IReadOnlyList`1 commands, ICommandPayloadCreator payloadCreator, CommandBehavior behavior, Activity activity, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/CommandExecutor.cs:line 56
   at MySqlConnector.MySqlCommand.ExecuteNonQueryAsync(IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/MySqlCommand.cs:line 264
   at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteNonQueryAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteNonQueryAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteNonQueryAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.RelationalDatabaseFacadeExtensions.ExecuteSqlRawAsync(DatabaseFacade databaseFacade, String sql, IEnumerable`1 parameters, CancellationToken cancellationToken)
...

The caller is quite simple:
var numDeleted = await _db.Logs
    .Where(x => x.CreatedOnUtc <= maxAgeUtc && x.LogLevelId < (int)maxLevel)
    .BatchDeleteAsync(cancelToken);

MySql is not supported.


Bogus incomplete scrape failures on restart

Bug Report
What did you do?
Restarted the Prometheus instance doing the scrapes.
What did you expect to see?
I expected the incomplete scrape to not be written to TSDB as a failure, since it was caused by Prometheus itself being shut down gracefully.
What did you see instead? Under which circumstances?
Prometheus considered the scrape failed, and triggered an alert when it came back up.
Environment

System information:
Linux 4.14.102 x86_64

Prometheus version:
prometheus, version 2.11.1 (branch: master, revision: 9856b12928dbcc9f69abc863ac0dd4bfd3673781)
build user:       builder@localhost
build date:       20190717-13:22:20
go version:       go1.12.7

Logs:
Prometheus logs showing the restart:

Jul 20 15:45:07 prom0 systemd[1]: Stopping prometheus monitoring system...
Jul 20 15:45:07 prom0 prometheus[130410]: level=warn ts=2019-07-20T15:45:07.701Z caller=main.go:496 msg="Received SIGTERM, exiting gracefully..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.701Z caller=main.go:521 msg="Stopping scrape discovery manager..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.701Z caller=main.go:535 msg="Stopping notify discovery manager..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.701Z caller=main.go:557 msg="Stopping scrape manager..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.701Z caller=main.go:517 msg="Scrape discovery manager stopped"
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.701Z caller=main.go:531 msg="Notify discovery manager stopped"
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.935Z caller=manager.go:776 component="rule manager" msg="Stopping rule manager..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.935Z caller=main.go:551 msg="Scrape manager stopped"
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.935Z caller=manager.go:782 component="rule manager" msg="Rule manager stopped"
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.957Z caller=notifier.go:602 component=notifier msg="Stopping notification manager..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.957Z caller=main.go:722 msg="Notifier manager stopped"
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.957Z caller=main.go:734 msg="See you next time!"
Jul 20 15:45:07 prom0 systemd[1]: Stopped prometheus monitoring system.
Jul 20 15:45:07 prom0 systemd[1]: prometheus.service: Consumed 4.295s CPU time
Jul 20 15:45:07 prom0 systemd[1]: Started prometheus monitoring system.
Jul 20 15:45:08 prom0 prometheus[131376]: level=info ts=2019-07-20T15:45:08.013Z caller=main.go:329 msg="Starting Prometheus" version="(version=2.11.1, branch=master,

Logs from the other Prometheus instance being scraped by the first one, showing the scrape failure:
Jul 20 15:45:10 prom1 prometheus[63212]: level=error ts=2019-07-20T15:45:10.131434661Z caller=federate.go:184 component=web msg="federation failed" err="write tcp <IP_ADDRESS>:3000-><IP_ADDRESS>:16446: write: broken pipe"

Nginx logs for the other Prometheus instance being scraped by the first one, showing the request failed because the client closed the connection:
[20/Jul/2019:15:45:07 +0000] "GET /federate?match%5B%5D=%7B__name__%3D%22up%22%7D HTTP/1.1" 499 0 "-" "Prometheus/2.11.1"
[20/Jul/2019:15:45:40 +0000] "GET /federate?match%5B%5D=%7B__name__%3D%22up%22%7D HTTP/1.1"<PHONE_NUMBER> "-" "Prometheus/2.11.1"

Image showing the metric value was 0 until the next scrape ran, 30 seconds later: https://i.ibb.co/V3xsyB0/failure.png
Does it make sense to write an incomplete scrape down as a failure when the only reason it failed is because Prometheus itself was being restarted? I think it would be best to either wait for all the scrapes to return before shutting down, or discard them and not update the metric as a failure.
This might be related to https://github.com/prometheus/prometheus/issues/1169.

Can you share the alerting rule?
On Sat 20 Jul 2019, 19:16 Thomás S. Bregolin<EMAIL_ADDRESS>wrote:

Bug Report
What did you do?
Restarted the Prometheus instance doing the scrapes.
What did you expect to see?
I expected the incomplete scrape to not be written to TSDB as a failure,
since it was caused by Prometheus itself being shut down gracefully.
What did you see instead? Under which circumstances?
Prometheus considered the scrape failed, and triggered an alert when it
came back up.
Environment

System information:
Linux 4.14.102 x86_64
Prometheus version:
prometheus, version 2.11.1 (branch: master, revision:
9856b12928dbcc9f69abc863ac0dd4bfd3673781)
build user: builder@localhost
build date: 20190717-13:22:20
go version: go1.12.7
Logs:
Prometheus logs showing the restart:
Jul 20 15:45:07 prom0 systemd[1]: Stopping prometheus monitoring system...
Jul 20 15:45:07 prom0 prometheus[130410]: level=warn ts=2019-07-20T15:45:07.701Z caller=main.go:496 msg="Received SIGTERM, exiting gracefully..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.701Z caller=main.go:521 msg="Stopping scrape discovery manager..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.701Z caller=main.go:535 msg="Stopping notify discovery manager..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.701Z caller=main.go:557 msg="Stopping scrape manager..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.701Z caller=main.go:517 msg="Scrape discovery manager stopped"
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.701Z caller=main.go:531 msg="Notify discovery manager stopped"
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.935Z caller=manager.go:776 component="rule manager" msg="Stopping rule manager..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.935Z caller=main.go:551 msg="Scrape manager stopped"
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.935Z caller=manager.go:782 component="rule manager" msg="Rule manager stopped"
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.957Z caller=notifier.go:602 component=notifier msg="Stopping notification manager..."
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.957Z caller=main.go:722 msg="Notifier manager stopped"
Jul 20 15:45:07 prom0 prometheus[130410]: level=info ts=2019-07-20T15:45:07.957Z caller=main.go:734 msg="See you next time!"
Jul 20 15:45:07 prom0 systemd[1]: Stopped prometheus monitoring system.
Jul 20 15:45:07 prom0 systemd[1]: prometheus.service: Consumed 4.295s CPU time
Jul 20 15:45:07 prom0 systemd[1]: Started prometheus monitoring system.
Jul 20 15:45:08 prom0 prometheus[131376]: level=info ts=2019-07-20T15:45:08.013Z caller=main.go:329 msg="Starting Prometheus" version="(version=2.11.1, branch=master,
Logs from the other Prometheus instance being scraped by the first one,
showing the scrape failure:
Jul 20 15:45:10 prom1 prometheus[63212]: level=error ts=2019-07-20T15:45:10.131434661Z caller=federate.go:184 component=web msg="federation failed" err="write tcp <IP_ADDRESS>:3000-><IP_ADDRESS>:16446: write: broken pipe"
Nginx logs for the other Prometheus instance being scraped by the first
one, showing the request failed because the client closed the connection:
[20/Jul/2019:15:45:07 +0000] "GET /federate?match%5B%5D=%7B__name__%3D%22up%22%7D HTTP/1.1" 499 0 "-" "Prometheus/2.11.1"
Image showing the metric value was 0 until the next scrape ran, 30 seconds
later: https://i.ibb.co/V3xsyB0/failure.png
Does it make sense to write an incomplete scrape down as a failure when
the only reason it failed is because Prometheus itself was being restarted?
I think it would be best to either wait for all the scrapes to return
before shutting down, or discard them and not update the metric as a
failure.
This might be related to #1169
https://github.com/prometheus/prometheus/issues/1169.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/prometheus/prometheus/issues/5788?email_source=notifications&email_token=ABWJG5VTZYERI4RDNBADKELQANB6RA5CNFSM4IFPKW42YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4HAOH53A,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABWJG5UNRTTQGGWXK4G3N73QANB6RANCNFSM4IFPKW4Q
.

Thank you for looking into this.
Here is the alerting rule:
- alert: Colo_Prometheus_Unreachable
  expr: sum(up{job="federate"}) without (instance) == 0
  # Wait 3m to avoid alerting on transient network issues
  for: 3m
  labels:
    notify: ops
    priority: "1"
  annotations:
    summary: Failed to scrape Prometheus in {{ $labels.colo_name }}

These are the scrape configs:
- file_sd_configs:
  - files:
    - /etc/prometheus/targets/nodes.json
  honor_labels: true
  job_name: federate
  metrics_path: /federate
  params:
    match[]:
    - '{__name__="up"}'
  scheme: https
  scrape_interval: 30s

Also, for what it's worth, I had an issue with disk space, which corrupted some things, so I had just erased the data dir right before this happened, but neglected to stop Prometheus first:
Jul 20 15:44:58: cd /var/lib/prometheus/data && rm -rf 01DFEVRXT0FHKX9FRX5HJ7HMPE 01DFGSK1WKCCQ846ME79AC167S 01DFJQFRFNDMPFP4VA7F98NKR7 01DFMNA9CT3NQYJ68MZV3BVCW5 01DFPK3HKCJM9QCZB1HER094W0 01DFRGWZ0ZBJF9XXQQB73HCHKE 01DFTEQAT8TTQJJDN1BTK4765F 01DFWCFRPJ7V03ZS059GN3VAZ1 01DFXMR0XH7VHDWTVF3NT2EEDW.tmp 01DFYA9DPRJ9WMQ0E2MVHGKY24 01DG082Z9VEY0DP0TGAZBDW3E1 01DG25W8MET6B96HQ33YXR5QQ8 01DG43N9551H41X51XNQ7KH88J 01DG61FBPME5VPDWNTS8Q5G8SM 01DG6NR5XCW79TY7485T50PZ3W 01DG79QZMDY8TCXE590MEPJXY9 01DG7ABCAQDZFWHZWWGEWA28M9 01DG7GKPWF0E0EXK67QVY7YQCQ 01DG7QFE4EFX3XG1KET6GDNDE9 lock wal
Jul 20 15:45:07: systemctl restart prometheus

Not sure if this accounts for the unwanted alert or not.

That's probably it rather than the restart itself, the alerting across
restarts logic doesn't apply with a for that short.
On Sun 21 Jul 2019, 01:02 Thomás S. Bregolin<EMAIL_ADDRESS>wrote:

Thank you for looking into this.
Here is the alerting rule:

alert: Colo_Prometheus_Unreachable
expr: sum(up{job="federate"}) without (instance) == 0
Wait 3m to avoid alerting on transient network issues
for: 3m
labels:
notify: ops
priority: "1"
annotations:
summary: Failed to scrape Prometheus in {{ $labels.colo_name }}

These are the scrape configs:

file_sd_configs:

files:

/etc/prometheus/targets/nodes.json
honor_labels: true
job_name: federate
metrics_path: /federate
params:
match[]:
'{name="up"}'
scheme: https
scrape_interval: 30s

Also, for what it's worth, I had an issue with disk space, which corrupted
some things, so I had just erased the data dir right before this happened,
but neglected to stop Prometheus first:
Jul 20 15:44:58: cd /var/lib/prometheus/data && rm -rf 01DFEVRXT0FHKX9FRX5HJ7HMPE 01DFGSK1WKCCQ846ME79AC167S 01DFJQFRFNDMPFP4VA7F98NKR7 01DFMNA9CT3NQYJ68MZV3BVCW5 01DFPK3HKCJM9QCZB1HER094W0 01DFRGWZ0ZBJF9XXQQB73HCHKE 01DFTEQAT8TTQJJDN1BTK4765F 01DFWCFRPJ7V03ZS059GN3VAZ1 01DFXMR0XH7VHDWTVF3NT2EEDW.tmp 01DFYA9DPRJ9WMQ0E2MVHGKY24 01DG082Z9VEY0DP0TGAZBDW3E1 01DG25W8MET6B96HQ33YXR5QQ8 01DG43N9551H41X51XNQ7KH88J 01DG61FBPME5VPDWNTS8Q5G8SM 01DG6NR5XCW79TY7485T50PZ3W 01DG79QZMDY8TCXE590MEPJXY9 01DG7ABCAQDZFWHZWWGEWA28M9 01DG7GKPWF0E0EXK67QVY7YQCQ 01DG7QFE4EFX3XG1KET6GDNDE9 lock wal
Jul 20 15:45:07: systemctl restart prometheus
Not sure if this accounts for the unwanted alert or not.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/prometheus/prometheus/issues/5788?email_source=notifications&email_token=ABWJG5T7IO3TYOSLKEW7T33QAOKSFA5CNFSM4IFPKW42YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD2NXQKY#issuecomment-513505323,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABWJG5TUZMCAXLZIOBCXYUDQAOKSFANCNFSM4IFPKW4Q
.

That's fair enough. Given that this wasn't the best way to erase the data and restart, and that this is somewhat of an edge case, I think we can close it. Please feel free to re-open if you think there's something worth fixing related to this.


Update flow-plugin-base, flow-server to 23.3.30

About this PR
📦 Updates

com.vaadin:flow-plugin-base
com.vaadin:flow-server

from 23.3.29 to 23.3.30
Usage
✅ Please merge!
I'll automatically update this PR to resolve conflicts as long as you don't change it yourself.
If you'd like to skip this version, you can just close this PR. If you have any feedback, just mention me in the comments below.
Configure Scala Steward for your repository with a .scala-steward.conf file.
Have a fantastic day writing Scala!

⚙ Adjust future updates
Add this to your .scala-steward.conf file to ignore future updates of this dependency:
updates.ignore = [ { groupId = "com.vaadin" } ]

Or, add this to slow down future updates of this dependency:
dependencyOverrides = [{
  pullRequests = { frequency = "30 days" },
  dependency = { groupId = "com.vaadin" }
}]

labels: library-update, early-semver-patch, semver-spec-patch, commit-count:1

Superseded by #112.


Component can't render when it's name begin with lowercase letter

Hello there,
I've just had this problem with writting my first redux app.
when I use
export default connect()(todoApp)(note that todoApp begin with lowercase t)
then it just can't render anything in my page
however, when I eventually change the code to
connect()(TodoApp)
it works fine.
does anyone know why this happen?

This is a usage question, and should be asked on StackOverflow instead.  It's also hard to give an answer without actually seeing your code.  Please go post this question on StackOverflow, and include your code in the question.

I'm gonna guess you're also changing the casing at the callsite? Because JSX treats tags starting with a lower as a literal html tag and tags starting with an upper as a component.

@jimbolla Oh,you're right, thanks


fix: memleak in timeout w/ abort signal

Hotfix for the timeout function. When provided an AbortSignal, the event listeners were not cleared which results in memory leaks for long-lived AbortSignals/Controllers, and these error logs:
(node:1) MaxListenersExceededWarning: Possible EventTarget memory leak detected. 1983 abort listeners added to [AbortSignal]. MaxListeners is 1500. Use events.setMaxListeners() to increase limit

:tada: This PR is included in version 1.7.2 :tada:
The release is available on:

npm package (@latest dist-tag)
GitHub release

Your semantic-release bot :package::rocket:


feat: support functools.partial handlers

This PR introduces functools.partial usage in order to pass arbitrary arguments to handlers.
Every handler type can easily be wrapped.
The usage can be tested as described in the docs

Thank you for the PR! I understand that the usecase is to be able to pass some context from the caller of Parser(…).iter_from(…) into the handler themselves.
At a first glance, I feel like using partials for that usecase is a hack, but I am unsure if it's a good or a bad one.
I took the time to think about this (and have improved a few things like typing on a branch of mine).
My main concern is that this would be cumbersome for nested handlers. For example, it would mean doing something like this:
# before
class Handler:
    sub_handler: SubHandler

# after
class Handler:
    def __init__(self, context):
        self.sub_handler = partial(SubHandler, context)

… and if you have a chain of handlers you would have to basically pass that context from one to the other using partial.

Now, taking a step back, the usecase of passing some data down the call chain is quite frequent, but the usual solutions may not be the best here. Below is what comes to my mind.
1. Use a global variable
Of course this works, but creates concurrency issues if you parse several XML documents in parallel.
2. Use a contextvar
Just like 1, but creates concurrency issues if you parse several XML documents in parallel in the same thread.
3. Pass variables as parameters from caller to callee
In regular code, this is maybe the most obvious choice.
def f(*args):
    ...
    g(*args)
    ...

But it is not possible because bigxml is calling the callee itself, not the user.
However, bigxml could detect a special parameter in the handler signature by its name (say bigxml_context), and automatically pass it in that case with the value that we took in the call to iter_from.
This could look like this:
@xml_handle_element("vehicles", "vehicle")
def handler(node, bigxml_context):
    if int(node.attributes["speed"]) > bigxml_context:
        yield node.text

with open("vehicles.xml", "rb") as stream:
    for vehicule in Parser(stream).iter_from(Handler, bigxml_context=150):
        print(vehicule)

4. Have caller and callee been methods of the same class instance (and store the data as an attribute on the instance)
This works if your handler is a function (by transforming it to a method), but not if it's a class.
class Handler:
    def __init__(self, speed_threshold):
        self.speed_threshold = speed_threshold

    @xml_handle_element("vehicles", "vehicle")
    def handler(self, node):
        if int(node.attributes["speed"]) > self.speed_threshold:
            yield node.text

with open("vehicles.xml", "rb") as stream:
    for vehicule in Parser(stream).iter_from(Handler(150)):
        print(vehicule)

But not being able to use class handlers is quite limiting I think.
5. Define the callee inside the caller so that it can access its scope (and use nonlocal for writing)
This works at the cost of re-defining the handlers each time you parse some XML.
def parse_stream(stream, speed_threshold):
    @xml_handle_element("vehicles", "vehicle")
    def handler(node):
        if int(node.attributes["speed"]) > speed_threshold:
            yield node.text

    yield from Parser(stream).iter_from(handler)

with open("vehicles.xml", "rb") as stream:
    for vehicule in parse_stream(stream, 150):
        print(vehicule)

It probably has some hidden side-effects, like making debugging harder.

All in all, I think the case 5 is the one that I like the most. What do you think?

Another possible answer is to implement some separation of concerns.
Instead of trying to do everything at the same time, let's the handler only extract the relevant pieces of data, and have a post-processing step afterwards deal with what is needed.
This could look like this:
@xml_handle_element("vehicles", "vehicle")
def handler(node):
    yield (node.text, int(node.attributes["speed"]))

def postprocess(items, speed_threshold):
    for vehicule, speed in items:
        if speed > speed_threshold:
            yield vehicule

with open("vehicles.xml", "rb") as stream:
    for vehicule in postprocess(Parser(stream).iter_from(handler), 150):
        print(vehicule)

I feel like this separation of concerns design makes the code easier to understand, but there may be a performance cost.


Multiverse and essentials /warp - time problem

Hi, this bug sometimes seems to occur when warping to different worlds that have different times. When warping, time does not change for the player like it should.
Let's say that World 1 has day and World 2 has night - when warping from 1 to 2, sometimes World 2 looks to me (and some players) like it was day, even tho it's not (checking /time + monsters are spawning normally and not burning). Any idea what to do?

This does not sound like a Multiverse issue, but rather a Spigot Multiworld API issue, or probably even a Minecraft Client issue.
Multiverse simply provides a command layer on top of the MultiWorld API that spigot provides, and Spigot does all the Heavy lifting, passing that information to the clients.
If you're still interested, try these:

[ ] Make sure Multiverse-Core is up to date http://ci.onarandombox.com/view/Multiverse/job/Multiverse-Core/
[ ] Make sure your Spigot version is up to date /version
[ ] Post this information if you've done the above two and you're still having issues

Closing as no comment from reporter in > 7 days. Please comment if issue persists.


Function: Publish a Git repository to a wiki - Publish-ADOPSGitWiki

Is your feature request related to a problem? Please describe.
We should have a function to publish a git repository to a wiki, Publish-AZDOPSGitWiki.
Describe the solution you'd like
It should work similar to az devops wiki create.
Additional context

@StefanIvemo Any updates on this? Anything I can help with?

Haven't had the time to start with this yet.


upgrade go to 1.8.1

Coverage decreased (-0.8%) to 84.116% when pulling 8be53177a43f40543ff157fab416dbb7c6c73565 on xyl_upgrade_go1.8.1 into fc9f6a044ebe2895bcd16f20400facb8b4fc9e94 on master.

upgrade go version to 1.8.1


Turtlebot3 does not move when published on cmd_vel through rostopic

ISSUE TEMPLATE ver. 0.3.0

Which TurtleBot3 you have?

[x ] Burger
[ ] Waffle
[ ] Waffle Pi

Which ROS is working with TurtleBot3?

[x ] ROS 1 Kinetic Kame
[ ] ROS 1 Melodic Morenia
[ ] ROS 2 Dashing Diademata
[ ] ROS 2 Eloquent Elusor
[ ] etc (PLEASE, WRITE DOWN YOUR ROS VERSION HERE)

Which SBC(Single Board Computer) is working on TurtleBot3?

[ ] Raspberry Pi 3
[ ] Intel Joule 570x
[ x] etc (Robotics Dragonboard 845c)

Which OS you installed in SBC?

[ ] Raspbian
[ ] Ubuntu MATE 16.04 or later
[ ] Ubuntu Server 18.04 or later
[x ] etc (Ubuntu 16.04 docker container. Host is linux 4.9)

Which OS you installed in Remote PC?

[ ] Ubuntu 16.04 LTS (Xenial Xerus)
[ ] Ubuntu 18.04 LTS (Bionic Beaver)
[ ] Linux Mint 18.x
[ ] Linux Mint 19.x
[ x] etc (used a single docker container (ubuntu 16.04))

Write down software version and firmware version

Software version: [linux 4.9]
Firmware version: [x.x.x]

Write down the commands you used in order

rostopic

Copy and Paste your error message on terminal

none

Please, describe detailedly what difficulty you are in

I have a issue that when published on cmd_vel through rostopic tutlebot3(burger) does not move.
My configuration:

Created 1 docker container with ubuntu 16.04 and ROS kinetic
Running ROS master and turtlebot3_core inside the same (single) container.
turtlebot3_core connects to the master
rostopic list - lists all the topics correctly
when i publish on cmd_vel, turtlebot does not move (rostopic pub -1 /cmd_vel geometry_msgs/Twist -- '[2.0, 0.0, 0.0]' '[0.0, 0.0, 1.8]')
Response on publish - publishing and latching message for 3.0 seconds

My questions:
Is it correct to run ROS master, turtlebot3_core on the same machine? and
Also use rostopic to publish to turtlebot3_core from the same container?
I do understand that the setup mentioned in the manual is different but our requirement is such that we cannot use separate SBCs(computers) for remotePC and turtlebot PC. Do you suggest that 2 containers (ubuntu 16.04) can be created one running ROS master and another turtlebot_core and then rostopic publish can be done from inside the container where ROS master is running?
Thanks in advance for your responses

@stevenpandiri
Please be aware that docker may work differently depending on its configuration.
If you have powerful SBC to run everything on board, running all the code in a single PC won't be a problem. If you are using rotopic pub -1 it will only publish the cmd_vel once so TurtleBot3 may look like it is not reacting with such short command.
Please keep track on the cmd_vel value and see if it continuously providing enough value to move the platform.
Thank you.

Thank you Will. It works in a single container, there was some loose connection with the dynamixels.
Also for the benefit of developers who have everything set fine but still unable to move their tutlebots (i.e. pushing SW1 and SW2 also dont move the turtlebot), this might help..
https://github.com/ROBOTIS-GIT/turtlebot3/issues/263
setting dynamixels:
http://emanual.robotis.com/docs/en/platform/turtlebot3/faq/#setup-dynamixels-for-turtlebot3

@stevenpandiri
When setting up the DYNAMIXEL, you should connect only one to the OpenCR at a time.
After the set up is completed, make sure that you have uploaded the TurtleBot3 core Arduino sketch to the OpenCR.
In order to provide the power to DYNAMIXEL, you should connect battery or SMPS to OpenCR and turn on the power switch near the power input terminal.
Thank you.

This issue will be closed as there wasn't recent activity. Please feel free to reopen this when needed.


Feature: Don't use d for delete

Is your feature request related to a problem? Please describe.
A similar CLI had a similar problem, in that they creators chose d as a shortcut to delete. However, the side effect was that it became too easy to accidentally delete something.
https://github.com/derailed/k9s/issues/61
Describe the solution you'd like
Allow customized key bindings? Turn "deletion" hotkey off by default, with a configuration option to allow it, while showing the user how to bind a key to it.
Describe alternatives you've considered
n/a
Additional context
n/a

Hey @ghostsquad, thanks for pointing it out, even though D key is used for deletion an Y/N prompt is shown to the user before the resource is actually deleted which should avoid accidental deletion yet customizable key binding does sound a good to have feature

ah, neat. Very smart.

closing this issue, please feel free to reopen it if you need to


[5.1][Diagnostics] Add property wrapper diagnostic for unnecessary $/'_' i…

…n member access
Detect and diagnose incorrect use of $ or _ while referencing members.
Also:

Refactor some of the logic for the original missing $ diagnostic,
so that a lot of logic can be shared between the two.

Rename the original fix and diagnostic to better reflect their purpose.

Resolves: SR-10928
Resolves: rdar://problem/51580712

@swift-ci please test


Merge hybrid CWE rules into a single CFN resource

The CWE CFN specification supports specifying both a schedule expression and an event pattern for a single CWE resource. Currently a CWE rule is generated for each CWE type.

Lambda-cfn v2 supports function configurations with both a schedule and event filter.


fix: http requests behind proxy

Replaced node-fetch with electron-fetch, because it (second) uses net module from electron so it will pick up proxy config automatically
Implements: #1

Hi @mdogadailo thanks for your contribution, I'll merge as soon as travis ci gives a success report. And added a hacktoberfest you might get involved to that event :)