Sudo/command line only elevation?

I'm not sure this is the right place to ask about this, but I can't think of where the right place would be, so I'm just going to list my thoughts on this.

As Windows command line functionality improves to the point that the system can be used remote/headless, this is becoming more of a necessity than an annoyance. Actually, this really comes down to having an official SSH client: SSH connections have to open as Admin, potential security hole.
This is not some black magic thing or something that needs a UAC redesign or kernel work. I've experimented a little, and you can create a local service running as the system account which will give you elevated processes from the command line. I didn't pursue this any further though, because I don't have the time to commit to securing and testing the service, but I at least know it's doable.
Even if I did want to publish a fully-featured sudo service, many organizations are not going to trust a third-party utility that is that big of a potential security hole, and it's unlikely the official SSH distribution would come configured for it, so now we're back at point one again.
There is auto-elevation built into UAC, but only for the Windows publisher. So if this was a system utility, it's not even necessary to run it as a separate service.
I think for the vast majority of users, this is entirely unnecessary, and I'd be fine with something that's enabled as a part of dev mode or when installing SSH. Those two cases do need it though.
With WSL now we have a weird [restricted token, elevated token] x [regular account, root] scenario going on, where you have to be in the right kind of command prompt to get the correct privileges. If we had Windows sudo, I don't think it'd be too hard to unify it with the WSL sudo command.

Anyways, these are just my thoughts that I wanted to get out there. Happy to hear about any plans/concerns/a better place to have this discussion.

@parkovski - If that's all you can ask for, I fear for your imagination :D ;)

Hey now. I can ask for chocolate and berries to be a healthy diet or for politicians to stop pitting people against each other, but realistically all I'm gonna get is command line elevation.

Chocolate isn't healthy? Pfffft!

Uh oh, my cover's blown :(

This will likely depend on ConPTY or something, as it’s currently impossible to get the STDOUT, STDERR or STDIN of an elevated process from a non‑elevated process :( (I know as I tried to implement a sudo cmdlet for PowerShell).

We need a full sudo, not just a "run as admin in terminal".
Sudo allows to run arbitrary commands as arbitrary users, following it's configuration.

Not terminal related, but I have a pretty good PowerShell sudo that has been working well for me in Windows.
Edit your profile:
PS > notepad $PROFILE

Add the following sudo function:
function sudo {
    Start-Process -Verb RunAs -FilePath "pwsh" -ArgumentList (@("-NoExit", "-Command") + $args)
}

Then invoke in your shell. Supports cmdlets, executables, anything that could normally be typed into a PS prompt:
PS > sudo Remove-Item .\test.txt  # Remove a file
PS > sudo Copy-Item .\test.txt C:\  # Copy a file
PS > sudo net start w3svc  # Start IIS

If you want to pass in a variable or expression that will be evaluated at run time, rather than pre-evaluated, wrap it in braces. For example:
PS > $myvar = "a"
PS > sudo echo $myvar  # $myvar is pre-evaluated, so the command reads: sudo echo "a"
PS > sudo { $PSVersionTable }  # with braces, $PSVersionTable is not evaluated until it is run as administrator

Remove "-NoExit" from the sudo function if you'd prefer to have the administrator window close when complete.

@vsalvino Thanks, but this still requires UAC which is a no-go for some use cases (ssh). Unfortunately the only real solution to this is going to require a pretty decent amount of work.

It is very easy to implement the sudo implementation of the shared terminal. For example, I have developed  Privexec (Run the program with the specified permission level Trust Installer, System, MIC, AppContainer ...) to support the process of starting the administrator rights and can wait.

wsudo -A -w pwsh

But the difficulty is that Windows RunAs does not support inheriting standard output.
So how to implement a sudo program, after creating a new process, enables the privileged process to inherit the existing terminal?
WIP
Linux sudo internal
Windows sudo design and ideas

Thanks for sharing your detailed thoughts @fcharlie. It turns-out that when considering a sudo-like feature as part of an operating system like Windows, that there are a lot of edge cases, and threat model issues to sift through and resolve. Providing a sudo-like capability requires a great deal of care to make sure that one doesn't, for example, accidentally introduce a weakness or vulnerability into the system, while also ensuring that the solution provides sufficient utility and behaves as users would expect.
Do bear with us - we will be taking a more detailed look into this feature request in the future, once we have the resources & intent necessary to perform the detailed research and analysis.

Is there anything that the community can do to work with you to help get those resources assigned? Perhaps there's a uservoice issue which can be up-voted, etc.?

I will create a new POC (Prove Of Concept) project and push to GitHub recently.
I think sudo-like implementations in windows should be different from implementations in POSIX. So I think it is OK for this project to add some features which NSudo (https://github.com/M2Team/NSudo, the project created by myself) have.

Would having elevated profiles be something to consider in the meantime?

This will likely depend on ConPTY or something,

Did ConPTY give us what we need?

Lets be realistic, sudo is a solution but not the solution. I suspect 5-nines of sudo files contain
${USER} ALL=NOPASSWD: ALL

The Windows security model is - in principle - richer and more fine grained than the Linux model, but like the registry, it went too long without an authority to manage it.
But MS security is impossibly difficult to navigate with extant tools, because they've never thought to treat it as a graph or establish a formal control over their own introduction/use of ACLs.
And you can see this in the way that even with contemporary additions to Windows, it's very rare to see ACLs more refined than "allow"/"deny". Windows CLI tools typically require you to have the same privileges to read as to write, because no developer at MS wants to waste their time doing the code-archaeology to find the set of elsewhere-in-windows ACLs that apply to the thing they're adding.
So the notion of MS adding cli-sudo is terrifying for multiple reasons: it will be a primary vector for attacks because of people setting nopasswd: all; the lack of an MS ACL-czar will result in every MS team adding "handy", negligibly documented, weirdly interconnected/dependent ACLs with unintended side-effects that become major attack vectors; and in order to do anything that is not nopasswd: all you are going to have a thousand line config file so complex and confusing that you will wish it just xml and yaml with some jinja templates and a slab of ruby for good effect to make it easier to read.
We're talking about a system that has the fine granularity of 'Full Control, Read & Execute, List contents, Read, Write, Special Permissions', and yet resorts to an orthogonal ACL system for ACL configuration which has a setting Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Accounts : Administrator Account Status which is disabled by default and in whose explanation text explicitly states:

TL;DR: Windows 10 security systems are excellent, Windows 10 security baggage is the devil's own least favorite sex toy and Windows 10 cli sudo is likely to be the equivalent of typing "thisisunsafe" into a Chrome window telling you that the site you're trying to access is unsafe...

@bgshacklett

Re: "Is there anything that the community can do to work with you to help get those resources assigned"

Nothing right now - any supported solution in this space will require OS plumbing. We do continue to track this ask though, and are driving a series of conversations. Stay tuned.

#2200 was closed as a duplicate of this issue but I don't really see that specific request - the ability to run Terminal as another user - being discussed on here. Is anyone actively looking into that issue as part of this issue, and if not, why was #2200 closed? Frankly, the inability to run Terminal as my admin account renders it functionally useless for my day to day job, and I find it unlikely that there's only a few of us impacted this way. I understand that this largely a limitation of UWP/Store apps as a whole, but that just makes me wonder why this was built as a Store app to begin with.

@dadpolice You can run Terminal elevated with Admin rights by right clicking and hitting "Run as Administrator":

HOWEVER, note that elevation is not the same as running as a different user - when you run elevated, you still run with your identity, but with additional (Admin) rights.

@bitcrazed I am aware of that. I am talking about running as a different user account, the specific issue that was raised in #2200, closed as "duplicate," yet appears to be completely ignored in this discussion.

Yeah, sorry - that's not a supported scenario for modern/UWP apps.
Could you describe your use-case - why you want to run Terminal from one user account as a different user identity?

@bitcrazed I have a standard, unprivileged user account that I use to log into my computer, plus an admin account that I use to manage various environments. If "run as" isn't supported in UWP apps then Terminal will never be usable to me. It's unclear why you chose to make this a UWP app.

Is it necessary for the Terminal to run as another user or do you just need to be able to run Administrative commands from PowerShell or your preferred shell? Most built-in PowerShell cmdlets support passing in other credentials which can be retrieved easily with -Credential $(Get-Credential). Worst case, if a command doesn't directly support passing in credentials, using Invoke-Command as a wrapper, with explicit credentials is another option.

It's not "necessary" but it's far nicer from a convenience perspective to simply have a PowerShell window running under my admin credentials and use it when necessary, rather than adding -Credential or Invoke-Command to every single command I run. The "workaround" here is to just not use Terminal if it doesn't support basic features.

@dadpolice Could I ask what you're trying to achieve by running a standard user account and then running some apps under the identity of an admin? This is basically what UAC has provided since Vista, but with smoother UX, and better OS & Tool support.

@bitcrazed You misunderstand. What I refer to as my "admin account" is not used for administrator privileges on my local device. It's used for managing servers/applications/environments/etc. that my standard account does not have access to. This is not an uncommon use case.

Again, what does having your "admin" account separate from your logged-in user account give you? Not saying its wrong or uncommon, trying to understand your use case.
Whilst this kind of setup was common on XP, it is now increasingly rare - I've not seen someone do this in > 10 years now.

It limits the rights my main account has so that if that account is compromised an attacker can do less damage with it. This is absolutely not rare, I have several friends and relatives who work in IT at other companies and they all have the same or similar setups.

@dadpolice do you mix match the (your) admin account with administrative privileges?
You can do all administrative stuff with administrative privileges via UAC. You do not need THE administrator account for that.

Simple restrict your user account rights and use UAC (elevated privileges) and do admin stuff with this. The administrative account is not necessary for that.

@DoCode I don't think you understand the use case I am describing.

@dadpolice ok. Sorry!

@DoCode I have the same setup as @dadpolice at my workplace.
The admin account has Domain Admin permissions, that means it has full permissions to hundreds of machines and company resources so it's not the kind of login you use for day to day computer use.
A simple example would be ransomware which if run from my domain admin account could encrypt the data of every computer on the network without even requiring elevation which is a massive risk.
Thus I have a regular account which is a local machine admin and my domain admin account which I only use when managing other computers/servers.

@dafzor thanks for your explanation! Now I understand your use cases!

@dadpolice - Again, you're manually doing what UAC provides: UAC removes the admin rights from your user token, even if you're a local admin. Then when you run a process "elevated"/admin-mode, the admin rights are added (if you pass/accept UAC prompts).
Thus, even if malware was to try to attack your user account, it wouldn't be able to do admin-only things on your machine because you'll need to manually permit it to do so.
Where this use-case IS more common is in an enterprise / online-services environment as described by @dafzor in which you might want to run a separate account with domain-admin rights from which you administer (potentially) many machines/environments.
But in such environments, it's generally wise not to use runas since you'd be running a tool from a potentially lower integrity environment (your local non-admin desktop) under the identity of an account with considerable power and rights.
For example, imagine you ran Terminal (or any other app) in your std. user environment as domain/admin and that app was subjected to keyboard/mouse input injection attacks, etc. from malware running in your std. user account.
If you're going to need to use a domain admin or similar type of broad-rights account, it'd be wise to consider instead using a Secure Access Environment via Remote Desktop. For example, a Secured Terminal Services machine that's HEAVILY monitored, restricted, and protected with biometric/smart-card etc. access.

@bitcrazed Rich, the use case I am trying to describe is virtually identical to what @dafzor explained. The only difference would be that my secondary account is not literally a domain admin but simply is granted access to machines/environments that my primary account does not have access to. UAC is completely irrelevant to this discussion.
I'm not going to keep arguing with you about this use case because it is incredibly common and it's not going away any time soon. If you weren't aware of this then you have completely failed to grasp the needs of the enterprise users this application is supposed to serve. If Run As support is never going to be add to Terminal, just say that, I have no problem with not using Terminal. It's not going to kill me to keep using PowerShell.exe as I always have.

I'm not going to keep arguing with you about this use case because it is incredibly common

In a way, it's equivalent to the following pseudo function:
Function ElevatedExecute-Command {   Param([String] $Username = "Administrator", [String] $Command, [String] $Credential)   if (!$Credential) {     $Credential = Get-Credential $Username   }   Invoke-Command -Computer LocalHost -Credential $Credential $Command }
And, it's basically how everything, everywhere, that isn't in a container, is done.
sudo rm -rf bitcrazed

Please do not delete my PM. I will have to restore him from a backup. 😄

For example, imagine you ran Terminal (or any other app) in your std. user environment as domain/admin and that app was subjected to keyboard/mouse input injection attacks, etc. from malware running in your std. user account.

If you're going to need to use a domain admin or similar type of broad-rights account, it'd be wise to consider instead using a Secure Access Environment via Remote Desktop. For example, a Secured Terminal Services machine that's HEAVILY monitored, restricted, and protected with biometric/smart-card etc. access.

What protection is in place which prevents the afore-mentioned keyboard/mouse injection attacks from passing through an RDP session?

I'm just gonna chime in here in support of exactly what @dadpolice is trying to say. I came here looking for the answer to this exact issue, which is the ability to run as different user for Terminal the way I do with Powershell everyday. This is EXTREMELY common, and we have internal enterprise stuff which checks that you are logged in with you admin (NOT LOCAL ADMIN - domain administrative) account. So you run as different user a powershell prompt. It's been this way for many years, and is not going away any time soon. We have local User management tools that have been built that also requires this for helpdesk people, who run these tools as their helpdesk admin account.
I'm genuinely surprised there seems to be so much confusion over this as its been standard behavior in Enterprises for as long as I've been in IT (over 15 years). So if Terminal will never support this, please just let us know - but as someone who's been digging into UWP development as well, this will greatly limit the usability of UWP in the Enterprise if  it won't support such a standard operation.

as someone who's been digging into UWP development as well, this will greatly limit the usability of UWP in the Enterprise if it won't support such a standard operation.

@bitcrazed Make sure the store team hears this ask. This is something that we can't solve on our own, put we can certainly try and push the store team on.

Appreciate everyone's feedback here. Don't get me wrong though: I have seen and used this pattern for almost 20 years too, but I've seen it decline in use considerably over the last several years.
@bgshacklett The RDP client has various layers of protection to prevent arbitrary keyboard and mouse injection attacks, and features like enforceable biometric/security-device multi-factor authentication, enforced session timeout, etc. to protect/reduce-impact from a variety of attacks.
Alas, the limitation we're primarily facing is that UWP apps don't support Runas

Now, all this said, you're right that the Terminal as it stands today doesn't support runas scenarios, and we should explore whether we can.
I've created issue #4217 to track the runas ask. We'll discuss with a bunch of teams internally - UWP runtime team, security, etc. and see what we can come up with. We'll update #4217 once we have some info to share.

The proposal is well written and fully supported. Now you can only use Runas in Windows Terminal to elevate permissions in a new window, which is very inconvenient in both PowerShell and Windows Terminal. Sudo in Linux is very simple and convenient, I hope it can be unified with this experience.

Is it possible to piggyback on SSH for a sudo/elevated prompt type of feature? Currently, from Windows Terminal you can use SSH to create a new session to localhost as an administrator inside the terminal. I use this daily, and it avoids UAC.
To do this,

Enable SSH Client and Server on your machine
(Optional) Configure the shell you want to use for SSH connections
Open Windows Terminal (un-elevated as a normal user)
SSH localhost

^ Assumes your account is an administrator, if not you can just SSH as an admin user.

@JustABearOz

^ Assumes your account is an administrator, if not you can just SSH as an admin user.

won't this method give full admin access to the user?
how do one restrict certain commands to execute/not execute  like sudo?

@ecovio1 @JustABearOz

^ Assumes your account is an administrator, if not you can just SSH as an admin user.

won't this method give full admin access to the user?
how do one restrict certain commands to execute/not execute like sudo?

Yes, this allows user processes running at medium IL to run elevated commands by either redirecting input to the Windows Terminal window (to send commands through SSH), or opening the SSH process and controlling it directly. These attacks are mitigated for elevated windows and processes by UIPI and process object security, respectively.

Yeah, through SSH you technically can do anything you could do through UAC approval but you're not in an interactive session, so while you have permissions to do this, you can't just type "ssh someapp.exe" and have the GUI pop up, you'd have to make a shim that switches into the interactive session first.
Kinda seems like SSH is not a security hole in itself, but loopback SSH is, whereas on Linux it isn't 😕 .

Could we utilize the COM elevation Moniker for this?
Alternatively, the security assessments for partially elevating an application clearly already exist over there.
Maybe someone within Microsoft could also leverage this to create a similar native API?
It would also help in many other cases where only specific actions require elevation. So instead of starting elevated and dropping privileges, an application could start as Invoker and only request elevation for specific features (Although I could have sworn that such an API for "on-demand elevation" already exists, I couldn't find any documentation regarding it right now).
And as a horrible workaround:
We could use the com elevation moniker to run code that:

Further elevate to system by impersonating e.g. lsass (as we run as admin we can clone the primary token)
Now that we've access to SeTcbPrivilege privilege we could perform a token swap on the calling thread (not the whole process)

@agowa338
"Per-command On-Demand Elevation With UAC GUI" already exist.
two quick example --

windows date and time syncing.
third party apps - like Composer.exe the php package manager itself.
running composer self-update on a medium IL command line shell invokes that "Per-command On-Demand Elevation With UAC" and doesn't open a new window.

The ask here is "GUI Less  -- Per-command On-Demand Elevation" as the current form of UAC requires GUI.
so that, one could type sudo ssh someapp.exe inside a medium IL command line shell only using password and have that someapp.exe running with High IL.
Current SSH Loopback achieves that but it needs to implement --

Sudoers type of file/reg entries     so that not every user can elevate every single commands/exe(s).
"UAC Secure Desktop" like command line-ish mechanism so that the password can't be spied on while typing.

@Sylveon's solution seems the cleanest one. https://github.com/microsoft/terminal/issues/1032#issuecomment-850556267
What it is : Modifying the OS's UIPI.
Benefit : Removes injection issues, Allows mixed elevation under one HWND.  Also Doesn't break existing apps by pulling App Manifest. (much like longPathAware.)

How about having "Drop elevation" profile option (in case Windows Terminal runs as admin)? Does it make security hole too?

@ChGen That's just bad usability and bad security practice. It's against the concept of least privilege.

@agowa338 , thank you for clarification.

I have, in the meantime, been making use of gsudo (https://github.com/gerardog/gsudo), and it covers all of my use cases. I'm not sure how it'd work in remote connection cases so this is probably still worthwhile, but it's been helpful enough for me that I'm surprised it hasn't been mentioned here previously.

I have implemented a lightweight POSIX-style Sudo implementation for Windows.
It makes user possible to use elevated console apps in non-elevated consoles.
For safety, the implementation uses the UAC for elevation and don't support credential cache. It also don't use homemade Windows service and any IPC infrastructures.
Introduction: https://github.com/M2Team/NanaRun/blob/0b6d760e18594d427658bbf9b88ce6b351f01fbd/ReadMe.md#minsudo
Implementation: https://github.com/M2Team/NanaRun/blob/916efdf31eb941ef605878fe75cf63f2937bd0e7/MinSudo/MinSudo.cpp
Maybe the implementation can help you.
Kenji Mouri

Once again, I have to officially state that anything that's sudo-like is a security hole on Windows. Period. Use at your own risk. Any malicious application can send keystrokes to any unelevated window. Running anything like sudo in a non-admin window creates an opportunity for malicious.exe to run commands in your terminal with elevated privileges, just by calling SendMessage.
If we ever did ship something like sudo inbox, it would only be due to us figuring out a way to prevent that.

@zadjii-msft not necessarily. There are ways to have a security boundary within a single windows desktop. We could use AppContainer for that. https://docs.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation

Process Isolation
Sandboxing the application kernel objects, the AppContainer environment prevents the application from influencing, or being influenced by, other application processes. This prevents a properly contained application from corrupting other processes in the event of an exception.

Window Isolation
Isolating the application from other windows, the AppContainer environment prevents the application from affecting other application interfaces.

Any malicious application can send keystrokes to any unelevated window.

@zadjii-msft It is also possible for malicious applications to inject arbitrary keystrokes into any elevated window. For example, a malicious application malicious.exe running at medium IL can use the undocumented ITipInvocation.Toggle() method to programmatically show the Touch Keyboard, whose HWND is hosted by TextInputHost.exe. Since TextInputHost.exe is running at low IL, malicious.exe can send input messages (mouse clicks) to TextInputHost.exe in order to "press" virtual keys. These keystrokes are then forwarded to the currently focused window, even if it is elevated (and running at high IL). This way, any medium-IL process can inject keyboard input into any window running at high IL.
If I understand the official documentation correctly, UIPI and Same-desktop Elevation are not a security boundary and, hence, the behaviour described above is not considered a security vulnerability. Interestingly though, the second on-screen keyboard in Windows, osk.exe, mitigates such input injection by running at an IL slightly above Medium (S-1-16-8208), which prevents medium-IL processes (S-1-16-8192) from sending input to this virtual keyboard.
The situation for mixed elevation in Windows Terminal or sudo for Windows seems to be very similar to that of the on-screen keyboard(s), maybe you could ask the respective team how they accepted/mitigated/solved it?

@zadjii-msft not necessarily. There are ways to have a security boundary within a single windows desktop. We could use AppContainer for that. https://docs.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation

Process Isolation
Sandboxing the application kernel objects, the AppContainer environment prevents the application from influencing, or being influenced by, other application processes. This prevents a properly contained application from corrupting other processes in the event of an exception.

@agowa338 I think the documentation is a bit unclear in this paragraph. Applications that run inside of an AppContainer can still be sent input messages by medium-IL processes. You can run the following experiment to test this with Windows PowerShell on Windows 11:
# Adapted from https://devblogs.microsoft.com/scripting/provide-input-to-applications-with-powershell/
Add-Type -AssemblyName Microsoft.VisualBasic
Add-Type -AssemblyName System.Windows.Forms
calc.exe
Start-Sleep -Seconds 2
[Microsoft.VisualBasic.Interaction]::AppActivate("Calculator")
[System.Windows.Forms.SendKeys]::SendWait("1{ADD}2=")

Even though CalculatorApp.exe runs inside of an AppContainer, it accepts input messages from powershell.exe, which runs at medium IL (and not inside of an AppContainer).

Just for completeness and because it is kinda related.
https://github.com/Kudaes/Elevator

Microsoft Windows IS NAKED IN PUBLIC !
UAC ? Security ? What was that ?
https://github.com/Kudaes/Elevator/
elevator.zip

Once again, I have to officially state that anything that's sudo-like is a security hole on Windows. Period. Use at your own risk.

@zadjii-msft thanks for the warning - I understand that you do not want to allow mixed elevation due to this concern.
What I don't understand is why it still works in Windows 10 (Windows Terminal 1.15.2874.0) but fails in Windows 11 (WT 1.15.2875.0).
Under Windows 10 I can use gsudo to elevate a tab and still have non-elevated tabs in the same terminal. In Windows 11 this doesn't work. On the other hand the Ctrl-Click option to open an elevated profile only works in the Windows 11 version although the hover text showing the 3 keyboard options is still displayed.

The problem mentioned in my previous comment seem to be caused by a third party program - Admin by request - and not by Windows 11 directly.

I've created issue #4217 to track the runas ask. We'll discuss with a bunch of teams internally - UWP runtime team, security, etc. and see what we can come up with. We'll update #4217 once we have some info to share.

It's pretty frustrating that the remaining canonical issue has been locked for discussion and ignored for over 2 years as a draconian punishment applied to everyone just because one user couldn't keep his tongue in check.

It's pretty frustrating that the remaining canonical issue has been locked for discussion

Did you have something material to add? I would be glad to unlock it for further discussion. However: it definitely feels like we covered all possible opinions over there. :smile:

I don't personally have the knowledge to contribute anything to the discussion, other than my desire to see the feature implemented. In fact I'm barely able to understand why this has been considered a lost cause. I'd have to read through it yet again but what I've taken away from it over the years is that Terminal has effectively considered the issue "wontfix" due to the design choice of chaining itself to the MS store installation mechanics.
Maybe I'm off base, but the point is, it wouldn't matter if I or anyone else did have something to contribute because there's no way to do so, aside from spinning up new issues or spilling over into others as I've regrettably done here.
If the issue is in fact dead then perhaps it should be closed. Either way, if there's not going to be any further discussion allowed, at the very least it would be appreciated to see a summary of the decision and reasoning in the final post, so that it's clear to everyone where the issue stands. To be clear I'm not necessarily saying we're owed this, or that it wasn't warranted to shut down the toxicity presented.

Yes, given that OS Windows since Windows 7 by default doesn't use strict UAC prompt policy, it's really strange that so much security concerns around Terminal being user-friendly with elevated admin. tabs (and by user, here's mostly advanced users, not average Windows user). I'm thinking on making some custom profiles with gsudo like apps...

I have implemented a lightweight POSIX-style Sudo implementation for Windows.
It makes user possible to use elevated console apps in non-elevated consoles.
For safety, the implementation uses the UAC for elevation and don't support credential cache. It also don't use homemade Windows service and any IPC infrastructures.
Introduction: https://github.com/M2Team/NanaRun/blob/0b6d760e18594d427658bbf9b88ce6b351f01fbd/ReadMe.md#minsudo Implementation: https://github.com/M2Team/NanaRun/blob/916efdf31eb941ef605878fe75cf63f2937bd0e7/MinSudo/MinSudo.cpp
Maybe the implementation can help you.
Kenji Mouri

the moment anything uses UAC (which requires GUI in it's current form), it can't be used in command line only mode. thus we are back to square one.
the only ways that've been proposed so far to implement "a true command line only elevation mechanism"/sudo are :

change the UAC implementation itself in the OS, so that it supports command line only elevation without requiring GUI, in a secure manner.
using the author @parkovski's Windows Service mechanism and extending on that. https://github.com/microsoft/terminal/issues/146#issue-310659300.
@sylveon's modifying the OS's UIPI. https://github.com/microsoft/terminal/issues/146#issuecomment-1013730679.
a combination of the above three.

regardless of whatever paths the Windows team comes up with; End of the day, It's a must have feature for Devs.

@mominshaikhdevs
I don't think any elevation implementations that need to enter the password in the console meet the security requirement.
POSIX's sudo implementation can be easily bypassed automatically via pipe without any explicit notice to users if some malicious implementations know the password. I don't think it can meet the security goal for the Windows team.
I think the password authentication must be finished on a separate desktop from a separate session. We need to recall the reason that Microsoft introduced the secure desktop to show the UAC window for receiving the user credentials. (There are some historic lessons. Many malicious implementations are really good at emulating the user inputs.)
Kenji Mouri

Actually I don't mid secure prompts in separate desktop session in UAC-style. I do mind, that I can't continue my work in the same window or at least in near tab. This feature is missing for me as advanced user/IT specialist. But on the same time, Windows by default allows elevations without prompts for "safe" apps for whole public, including all not so experienced users...

@mominshaikhdevs

It requires that the Windows team implements "UAC's Secure Desktop" like feature but for a completely command lineish way/without any GUI prompt.

In my opinion, no way to achieve that. Even the terminal can do that, but other 3rd-party apps that utilize the console pipe can't.
Unless we input the random credential token with a short time expiration instead of the password in the console, and get that token in the secure desktop.
Kenji Mouri

I think Windows can introduce something like two-factor authentication which using the time-based one-time password (TOTP; specified in RFC 6238) and HMAC-based one-time password (HOTP; specified in RFC 4226).
It may prevent some malicious emulate the user inputs easily and users can use Microsoft Authenticator on their mobiles to know the one time password.
Kenji Mouri

actually anything is possible, if you think it hard enough and own/have access to the Windows Security source code.
Brand New APIs from the Windows team is required.

actually anything is possible, if you think it hard enough and own/have access to the Windows Security source code.
Brand New APIs from the Windows team is required.

It's not possible even have the Windows source code due to the design of pipe and console, and they need to keep the compatibility.
Kenji Mouri

If the thing is possible, they already implement it before, lol.
Kenji Mouri

Hey there! Since there are so many people subscribed to this thread (and I'm sorry to be notifying them again) I'm going to lock it for now. If you want to talk about the potential implementation details for a "sudo for Windows"-like project, feel free to head on over to the Discussions section.
That way, we can keep this issue open for people who have subscribed for status updates. :smile:

Closing as we're shipping Sudo for Windows in Windows 11 Insider Preview Build 26052
For more discussion, you'll probably want to head to https://github.com/microsoft/sudo

@zadjii-msft Just one thing, can you say anything about the note in that announcement? What's the long term plan for server? To just have people diy patch it in? As an optional feature? With the next version bump?

NOTE: The setting for enabling Sudo may incorrectly be showing on Windows Server Insider Preview builds – this feature will not be available on Windows Server and the setting will be disabled in a future Server Insider Preview build.

@agowa I filed https://github.com/microsoft/sudo/issues/50 to track sudo on Server - I'd go engage on that thread if you have anything we can use as business justification ☺


Allow disabling of notification

Hey @EternalPhane
Awesome extension!!
Can you please provide option to disable error notification in extension options.
Thx

Hey @EternalPhane
Thx for taking time out and introducing feature
But I checkout; when I set notification to disabled; its still appearing for me.
I think doing following might help
return workspace.getConfiguration('tsfmt').get('notification') || true;
to
return workspace.getConfiguration('tsfmt').get('notification') && true;

@jas99 sry I was too busy to correct it given that final exam is coming and I still have some assignments to finish. please try it again. I believe it's fixed this time.


Steps don't work

I followed the steps to create the shared image gallery. But when I run the Azure CLI mentioned in section Create a pool from a Shared Image using the Azure CLI, I hit the following error:
Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:e62027ad-4553-484b-8fc0-f832e9a556e4
Time:2020-03-27T12:49:33.6748000Z
AuthenticationErrorDetail: The specified type of authentication SharedKey is not allowed when external resources of type Compute are linked.

Need more details about how to handle the rbac for Batch to access the shared image gallery.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: a20b49c2-2b4c-c8dd-993b-b058f0614cca
Version Independent ID: d2bef73d-2ada-4cc2-9849-d82da6e1c82b
Content: Use the Shared Image Gallery to create a custom pool - Azure Batch - Azure Batch
Content Source: articles/batch/batch-sig-images.md
Service: batch
GitHub Login: @LauraBrenner
Microsoft Alias: labrenne

Thanks for the question. We are currently investigating and will update you shortly.

@Karishma-Tiwari-MSFT the problem was caused by the authentication type I used with az batch account login. --shared-key-auth doesn't work for the shared image gallery. Must use AAD authentication. Probably add a notes in the document.

I've updated the doc.

Thanks for bringing this to our attention. We will now close this issue. If there are further questions regarding this matter, please tag me in a comment. I will reopen it and we will gladly continue the discussion.


chore(docs): Update top-level readme

#76  👈
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @refcell and the rest of your teammates on  Graphite


Cleanup pod resource limits page and script reference (CASMPET-5929)

Description
Remove script content for doc page and refer to the one installed by platform-utils.  Also add content for interpreting CPU results (https://jira-pro.its.hpecorp.net:8443/browse/CASMPET-5929).
Checklist Before Merging

[x] If I added any command snippets, the steps they belong to follow the prompt conventions (see [example][1]).
[x] If I added a new directory, I also updated .github/CODEOWNERS with the corresponding team in [Cray-HPE][2].
[x] My commits or Pull-Request Title contain my JIRA information, or I do not have a JIRA.

/backport main

/backport release/1.2

There is outstanding feedback on the 1.2 PR that seems to also apply to this branch's PR. https://github.com/Cray-HPE/docs-csm/pull/2386


Travis CI enhancement

Test against multiple major Ruby versions 2.0/2.1/2.2
Update README.md badge using SVG version

Thank you @dlackty ! :)


Add hovering effects on study materials cards

I want to add hover effects like scaling, box shadow, border radius on hovering the cards in the study materials section under JWOC'23.

@zugzwang03 you are good to go. Do share a preview in the form of a screenshot/video of the changes made.


Add support for contains authz header matcher

It would be very helpful to be able to use the HeaderMatcher_ContainsMatch so that we don't have to rely on the sort order of an array header value. For example if we use X-Forwarded-Client-Cert to match on a SAN of the cert  and the order of the names changes the authorization policies have to be updated.
Happy to push a PR if you think that this is a good change.

Partially related to https://github.com/istio/istio/issues/25021 and https://github.com/istio/istio/pull/30956. Regex should also satisfy this use case I suppose.

It seems like there's a lot of discussion around the regex support, I agree that regex would satisfy all use cases but my take from the discussions in that issue and PR is that it would be better to stick to wildcard matching rather than regex.
What do you think about reusing and combining the current logic for prefix and suffix matching by just checking if the string is wrapped with *? That way we could have contains support until the regex approach is approved and implemented

I think that makes sense. @yangminzhu ^^

pushed a PR https://github.com/istio/istio/pull/32180 for this, @yangminzhu let me know what you think, thanks!


Unexpected tunneling issues for databases with Bastion native client

Related command
az network bastion tunnel
Describe the bug
We are using the command above to tunnel the database port of our local machine to the database running on one of our VMs via Azure bastion native client.
Command-line based tools have no problems using this connection to the database. However, GUI-based tools fail after the initial connect to perform a second query. They hang when trying to connect to the database. We suspect that these tools open a second connection under the hood and that the first initial connection "blocks" the tunnel for any other connections.
We have tested multiple GUI-tools (PgAdmin, Azure Data Studio, etc.) and they all experience the same problem. Under the hood, they open a second connection, which then fails to connect. If we connect to the VM directly via public IP using a regular ssh tunnel (ssh -L ....), the tools work fine without any other configuration.
All in all, the bastion-based tunnel does not work as expected. It would be great to have the same experience like with regular SSH tunnels.
To Reproduce
Have a database ( e.g. Postgres) running on the test VM in the cloud. Postgres by default is port 5432. Open a bastion tunnel to the test VM on this port. Then use a tool like Azure Data Studio on your local machine to connect via localhost:[db_port] using the Bastion tunnel.
Expected behavior
There should be no problems with the connections blocking in our database tools.
Current workaround: Use the bastion tunnel for the ssh port of the VM. Then use a regular (open-)ssh tunnel in front of the bastion tunnel for the database port. This works fine as well, however, two tunnels are necessary and using Azure AD for logging into the VM is also more complicated.
Environment summary
Windows-10-10.0.18363-SP0
Python 3.10.4
Installer: MSI

azure-cli 2.36.0

Extensions:
ssh 1.1.1

Dependencies:
msal 1.17.0
azure-mgmt-resource 20.0.0

Additional context

Adding Service team to look into this ask.
@aznetsuppgithub Could you please provide an update on this ?

Any update on this?

@yonzhan  Any update on this?

bastion service team should take a look

I'm seeing the same issue for forwarding port 443 for HTTPS.
When using the workaround by @tbluejeans (forward SSH port, then open a "proper" SSH tunnel via openssh), I can access the web site just fine, but when forwarding port 443 via the azure cli, the browser gets stuck.
cc @matt-chan

Is there an update on this? I am wanting to provide access to a sql server DB installed on a VM in a test region to all our developers. Setting up a tunnel is successful, and connecting a single query tab from Azure Data Studio works, but when I try and connect a second tab I get an exception:
Connection Timeout Expired. The timeout period elapsed while attempting to consume the pre-login handshake
acknowledgement. This could be because the pre-login handshake failed or the server was unable to respond back in time.
The duration spent while attempting to connect to this server was - [Pre-Login] initialization=0; handshake=15001;

I'm assuming this is the same issue as described here.
Thanks

Possibly related: https://github.com/Azure/azure-cli/issues/25023

And this (multiple connections): https://github.com/Azure/azure-cli/issues/24600

I would also add that this issue is incorrectly labeled as a feature-request. This clearly is a bug.

@yonzhan Any news on this topic?

@yonzhan just saying I ran into this issue as well recently, wondering if any news are planned to come ?

Any workaround here?

There is also this workaround : https://github.com/Azure/azure-cli/issues/24600#issuecomment-1790974526


React client example

This resolves #415 and #412.
This realizes standard client to node LSP server as React functional component.

I implemented all your review comments (also the latest ones) and renamed the example from react to react-client

Build is fixed. Btw, I updated the tsc target to ES2022 on main. I found some inconsistencies in the build configuration while working on react and angular examples

Thanks for the feedback.


Add support for Elucent's Gravel Ores mod

Shouldn't be too hard, just give them generic gravel stepsounds.
Note to self: I need to get back in on adding support for other mods here in the future.

Thanks!  I will about adding for the next dot release.

Pushed update to CurseForge that contains the support.


Add DAG to remove Flickr thumbnails

Fixes

Fixes #1816 by @krysal
Description

Flickr is the last and main provider retaining thumbnails that do not fit our requirements for showing in the Openverse UI (mostly on desktop), so here is a DAG to remove them progressively in batches. This should allow other tasks while running and advance steadily. It uses the new TaskFlow API which comes really handy for a DAG like this.
After the DAG has runs successfully, this will allow us to revert #1812 on the API side.
In minor related changes, I also exposed the port of the upstream_db for being able to use UI software like DataGrip or TablePlus, and fixed a shadowing name in the Flickr DAG.
Testing Instructions

Run the normal flicker DAG to ingest some rows.
Modify those rows to have some fake thumbnails URLs

UPDATE image SET thumbnail='https://flickr.com/fake_thumb.JPG' WHERE identifier IN (
	SELECT identifier FROM image WHERE provider='flickr' AND thumbnail IS NULL
	FETCH FIRST 50000 ROWS ONLY
);

Run the new flickr_thumbnails_removal DAG
Check in the DB the Flickr rows

-- This query should return 0
SELECT count(*) FROM image WHERE provider='flickr' AND thumbnail IS NOT NULL;

Checklist

[x] My pull request has a descriptive title (not a vague title likeUpdate index.md).
[x] My pull request targets the default branch of the repository (main) or a parent feature branch.
[x] My commit messages follow best practices.
[x] My code follows the established code style of the repository.
[ ] I added or updated tests for the changes I made (if applicable).
[x] I added or updated documentation (if applicable).
[x] I tried running the project locally and verified that there are no visible errors.
[x] I ran the DAG documentation generator (if applicable).

Developer Certificate of Origin

Developer Certificate of Origin
Developer Certificate of Origin
Version 1.1

Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
1 Letterman Drive
Suite D4700
San Francisco, CA, 94129

Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not allowed.

Developer's Certificate of Origin 1.1

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I
    have the right to submit it under the open source license
    indicated in the file; or

(b) The contribution is based upon previous work that, to the best
    of my knowledge, is covered under an appropriate open source
    license and I have the right under that license to submit that
    work with modifications, whether created in whole or in part
    by me, under the same open source license (unless I am
    permitted to submit under a different license), as indicated
    in the file; or

(c) The contribution was provided directly to me by some other
    person who certified (a), (b) or (c) and I have not modified
    it.

(d) I understand and agree that this project and the contribution
    are public and that a record of the contribution (including all
    personal information I submit with it, including my sign-off) is
    maintained indefinitely and may be redistributed consistent with
    this project or the open source license(s) involved.

I mentioned this on the popularity refresh project thread but should have also done so on #1816 -- I'm currently working on a reusable batched_update DAG that will be used by the popularity refresh DAGs, but can also be run manually for these sorts of backfills without having to spin up temporary DAGs. I plan on having that up by early next week.
The DAG I'm working on uses a slightly different approach for the batched update, which I think is slightly more optimized (about 1.3x as fast during some tests I did on a DB snapshot of production data, although I was only able to run a few tests). I suspect this update is going to be quite slow either way 😞 so any performance improvement might really add up. A full update of Flickr needs almost 50k batches, although I actually don't know how many have null thumbnails. Do you have a sense of how many need to be updated?

@stacimc By March 11, I commented on the following ratio of thumbnails availability for Flickr. Today there could be fewer since that was before my attempt to run the UPDATE manually.
+---------------+------------------+----------------------+
| provider      | thumbs_available | thumbs_not_available |
|---------------+------------------+----------------------|
| flickr        | 497009314        | 911578               |
+---------------+------------------+----------------------+

I'm eager to see the optimizations for this task. However, since it's expected to take some time either way, I would like to start as soon as possible. The DAG I created here can be started and stopped at any time without harm. We can move forward while you prepare the other DAG and it is reviewed without pressure. What do you think?

@AetherUnbound I don't think any of those reasons are strong enough to block this particular task.

We have the perfect test case for using this new process against production data with the Flickr thumbnails.

Isn't the popularity calculations backfill the main case for @stacimc's DAG?

I don't know when we'll have another opportunity to run that DAG and see how it works/behaves/formalize its process.

We need to clean the tags so that is another opportunity to try the DAG, despite being a bit more complicated due to the type of data.

It's potentially more optimized, which means the generic DAG should complete sooner.

As I said before, since it's expected to take some time either way would be better to start sooner and make progress, on what we can achieve with this DAG.

If we wait and use the generic DAG, we don't have to worry about retiring or removing this temporary DAG down the line.

It's a code change so small and easy that it shouldn't count weighing the benefit of gaining time. Tasks related to thumbnails have been delayed for too long.
However, I'll grant on waiting if you both want to use Flickr's thumbnails as a test case.

Another good reason to try this DAG is to have hard data for effective comparison. So far we have been talking about hypothetical efficiency, but no numbers have been shared. I can't tell where that is coming from until the other DAG is up for review and tried.


inconsistent expression entry for deletions

On the genotype pages for some deletion alleles the expression has "Null", whereas for other deletions there's nothing under expression. Example: compare 'n contrast http://pombase2.bioinformatics.nz/genotype/PomBase-genotype-2769 , http://pombase2.bioinformatics.nz/genotype/PomBase-genotype-13943 and http://pombase2.bioinformatics.nz/genotype/48ef5d49bc0230cb-genotype-6 (all cdc13delta, so they should also be lumped per #153).
I think we'd like "Null" to appear. I'm sure we want the appearance to be consistent for all deletion allele entries (and the same whether they're single allele or or part of multi-allele genotypes).

This is a Chado problem.  The deletions from the contig files were missing the "Null".  I've fixed that now so one of your examples is fixed now.
The 48ef5d49bc0230cb-genotype-6 is still missing the Null.  I'm trying to track that down.
Fixing these errors will make merging identical alleles work better (#577).

I've looked at this again and decided to fix it a different way.  I've changed the loader to consistently not store an expression for deletions since we can infer the "Null".  I've changed the display code to consistently show "Null" for deletions.  The changes will come through in Tuesday night's load and be visible on Wednesday.  I'll close this issue then if it all looks OK.

Looks good.
closing.


Question: Any way to start uploading while compression is in progress

I can see that this library supports both compression and background upload, which is great.
I am desperately looking for a way to start compression and upload at the same time. In a perfect world, there would be this method:
Video.compressUpload(url, fileUrl, {uploadType: UploadType.MULTIPART, httpMethod: 'POST', headers, compressionMethod: 'auto'})

It would start the compression, get a read stream of the new file and start uploading to the server. So the compression + upload process would be twice as fast as it is currently. Is this even possible? I could not find any source or a starting point to get this done cross-platform. Maybe I could hardly get it done in android but I'm a beginner on iOS.

@murat-mehmet Currently, we don't support stream, on android i just do not expose stream but it is in the code if you see native compression code, this is a feature request, if you can make it possible then I welcome you or otherwise I will do this after many of task list in my list


[GSSoC'23] Hunt Card Game Completed

PR Description 📜
Enhancement in Hunt Card Game
Fixes #2741

Mark the task you have completed ✅

[x] I follow CONTRIBUTING GUIDELINE & CODE OF CONDUCT of this project.
[x] I have performed a self-review of my own code or work.
[x] I have commented my code, particularly in hard-to-understand areas.
[x] My changes generates no new warnings.
[x] I have followed proper naming convention showed in CONTRIBUTING GUIDELINE
[x] I have added screenshot for website preview in assets/images
[x] I have added entries for my game in main README.md
[x] I have added README.md in my folder
[x] I have added working video of the game in README.md (optional)
[x] I have specified the respective issue number for which I have requested the new game.

Add your screenshots(Optional) 📸
https://github.com/kunjgit/GameZone/assets/114330097/00479ee9-11be-4208-818c-dff1d9afdc99

Thank you soo much for contributing to our repository 💗

Thank you @Avdhesh-Varshney ,for creating the PR and contributing to our GameZone 💗
Review team will review the PR and will reach out to you soon! 😇
Make sure that you have marked all the tasks that you are done with ✅.
Thank you for your patience! 😀

Thank you  @Avdhesh-Varshney , for your valuable time and contribution in our GameZone 💗.
It’s our GameZone, so Let’s build this GameZone altogether !!🤝
Hoping to see you soon with another PR again 😇
Wishing you all the best for your journey into Open Source🚀

From next time if you make a PR like this adding spacing or some type of alignment fix leads to ban you from leaderboard before the ending of this program 🚨

@gurjeetsinghvirdee
This game pictures are not shown earlier as i have already mentioned in the issue and also mentioned the alignment of the cards are not proper.
And for spacing, i have just format the code in vs code to make it readable only. Next time, i will not formatting the code.
So, please add level2 on this pr.
And requested to open a issue 2739.
Thanks for the remainder !


Missing setup.py

Hi, I would like to install this package. I have cloned the library but I can not install it because there is no setup.py. I have also checked that the files hiqfermion are .rst so I can not import functions from them.
I would like to import
from hiqfermion.ansatzes import UCCSD
from hiqfermion.drivers import MolecularData,PyscfCalculator
from hiqfermion.utils import get_fermion_operator
from hiqfermion.transforms import Transform
from hiqfermion.utils import uccsd_trotter_engine
Could you please tell me how could I do to install it in Ubuntu? Thank you!

Same problem here. After the installation of requirements.txt I still have the problem with the import of hiqfermion.
Thanks for your time!

To be clear, the source code of HiQ Fermion has not been fully released here yet. What we have put in this repo is the API document. Nevertheless, you may able to run HiQ Fermion applications on Huawei Cloud if you are in China. We expect the full release of source code to be in June. Sorry for the confusion.

Thanks for the info @i2000s


Update clone destination

The instructions don't work as-is.  It's a simple matter, presumably the repo was formerly called "acbuild".  I think it makes more sense to clone it into a dir called acbuild than to update the rest of the instructions.

Yup, you would be right. Thanks for fixing this!


Paths in demo file

Fix paths to sinogram data in the demo files so that it takes care of relative paths i.e. python demo/demo_complex.py runs without errors.

Vankat, we redid all the demo files, and we removed the sinogram data. So hopefully, the bug is fixed.

I don't think the issue is completely fixed yet.
The demo writes images into the output directory which does not exist if it is run from outside the demo directory and it leads to errors.
The demo should either write the images to the current directory or create the output directory before writing the output images.

OK, can you fix it by adding a command to create the directory?

Also the phantom.plot_image() function that is doing this writing needs to handle the "optional" arguments appropriately.  It currently crashes if you leave any of the optional arguments off.
This function can also try/except for the "writeability" of the specified output file so that it fails more gracefully.

Jordan, you understand this better than I do.
Can you fix it, and I will look at the fix so I know how to do it in the future?

Although I fixed the bug by updating the demos, I think it would be more elegant if the phantom.plot_image always creates the output folder before writing the images.

I fixed the defaults handling in phantom.plot_image().  Turns out the only thing that would fail is if you left the filename off, or if the file can't be opened for writing. Now it only tries to write if the filename argument is given, and it exits with a warning if the file can't be opened for writing.
It's possible to have plot_image() create a directory if it doesn't exist, but it still needs the exception handling because it might try to write somewhere that isn't writable.


TF400813: Resource not available for anonymous access. Client authentication required.

I am unable to get the migrator running using the following settings:
"source-connection": {
    "account": "https://myAccount.visualstudio.com/",
    "project": "OldProject",
    "access-token": "PersonalAccessTokenWithFullAccess",
    "use-integrated-auth": "false"
  },
  "target-connection": {
    "account": "https://myAccount.visualstudio.com/",
    "project": "NewProject",
    "access-token": "PersonalAccessTokenWithFullAccess",
    "use-integrated-auth": "false"
  },

I used the same PAT for the source and target connection because they are under the same account, just in a different project.
The access-token property is not available in the logging, but that may be by design.

Output:
new work items found:                      0
existing work items found:                 0
existing work items validated for phase 1: 0
existing work items validated for phase 2: 0
Waiting for query to retrieve work items to be validated...
[Info   @<IP_ADDRESS>6] Starting validation
[Info   @<IP_ADDRESS>8] Starting configuration validation
[Info   @<IP_ADDRESS>0] Starting configuration validation for: Source account permissions
[Info   @<IP_ADDRESS>1] source-post-move-tag is specified, checking write permissions on the source project
[Error   @<IP_ADDRESS>2] Unexpected error:
Microsoft.VisualStudio.Services.Common.VssUnauthorizedException: TF400813: Resource not available for anonymous access. Client authentication required.
   at Microsoft.VisualStudio.Services.Common.VssHttpMessageHandler.<SendAsync>d__17.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Common.VssHttpRetryMessageHandler.<SendAsync>d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at System.Net.Http.HttpClient.<FinishSendAsyncBuffered>d__58.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__49.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__46`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Location.Client.LocationHttpClient.<GetConnectionDataAsync>d__6.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.WebApi.Location.VssServerDataProvider.<ConnectAsync>d__41.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.WebApi.Location.VssServerDataProvider.<EnsureConnectedAsync>d__39.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.WebApi.Location.VssServerDataProvider.<GetAuthorizedIdentityAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.WebApi.VssConnection.get_AuthorizedIdentity()
   at Common.Validation.ValidationHelpers.<CheckConnection>d__5.MoveNext() in C:\dev\temp\vsts-work-item-migrator\Common\Validation\ValidationHelpers.cs:line 26
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Common.Validation.ValidateSourcePermissions.<Validate>d__5.MoveNext() in C:\dev\temp\vsts-work-item-migrator\Common\Validation\Configuration\ValidateSourceClient.cs:line 29
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Common.Validation.Validator.<ValidateConfiguration>d__6.MoveNext() in C:\dev\temp\vsts-work-item-migrator\Common\Validation\Validator.cs:line 104
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Common.Validation.Validator.<Validate>d__5.MoveNext() in C:\dev\temp\vsts-work-item-migrator\Common\Validation\Validator.cs:line 26
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at WiMigrator.CommandLine.<ExecuteValidation>d__8.MoveNext() in C:\dev\temp\vsts-work-item-migrator\WiMigrator\CommandLine.cs:line 84
[Info   @<IP_ADDRESS>4] Summary of errors and warnings:
[Error   @<IP_ADDRESS>5] Unexpected error:. TF400813: Resource not available for anonymous access. Client authentication required.. TF400813: Resource not available for anonymous access. Client authentication required.```

@simondel Is this still happening?  And what permissions did you give the token?

I gave the permission access to all scopes. It seems like the latest version on the master branch has fixed the issue for me. Thanks! I'll close this issue for now.


[3.6] Bug fix/replace create collection safety ttl with rebootid

Backport of https://github.com/arangodb/arangodb/pull/10720

http://jenkins01.arangodb.biz:8080/view/PR/job/arangodb-matrix-pr/7737/

Tests blue. Development approve was already made in https://github.com/arangodb/arangodb/pull/10720.

@KVS85 @goedderz do we have a review for this or the original?


Docs only: Adds small note about the HTML game engine used

Summary
Always seems most effective to contribute to docs as you're first encountering them for anything that was a cause of confusion.
This codebase is fantastic! Docs were very helpful. The only big question I couldn't easily answer was how it was actually being rendered on the client. Had to dig around in the DOM on the staging site plus search all the files to find it. I figured it'd be helpful to new contributors to know this up front, and link to the engine's docs.
Also seemed like a great, simple first PR

Thanks for the PR!


Gateway fails to pay despite LND paying invoice just fine

I can't get a single payment out through the gateway on mainnet but when I just use payinvoice normally, LND doesn't have a problem. Running 0.2.1-rc3 for both fedimintd & gatewayd.
Invoice
lnbc500n1pjcve32pp50vwalaqqahfmntcgnngp4dgr4hwfpwv0wspaup6elpnlfa3ddujqdqqcqzzsxqrrsssp5fyr8g355fdd9wcl8wl6e3nm9khyg5khq0wfqqkhz9q5xd2nsw78q9qyyssq74fvwpz3a4v7qg7v9mlwuwnqefyu9ertz54y0q82ntp06mm7wwekrh5znx2fgg6vmqpx74u4q807wvxeyh6p4zzuwa8lftdcvqje6wcq5hpmle

Gateway:
docker-fedimintd-1    | 2023-12-23T04:46:59.036752Z  INFO consensus: Session 371 completed
docker-gatewayd-1     | 2023-12-23T04:47:12.239810Z  INFO ln_gateway::lnd: LND Paying invoice PrunedInvoice { amount: Amount { msats: 50000 }, destination: PublicKey(028fe7cb1b6cd6bac7f5c9c4eff166fdb73a
b861595e5b7f69b099bb32091dccede5828671f691268fc4cf1937989d30aa0a6213c0117103d3e7b553455cf313), destination_features: [2, 66, 0], payment_hash: 7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0759f867f4f62
d6f24, payment_secret: [73, 6, 116, 70, 148, 75, 90, 87, 99, 231, 119, 245, 152, 207, 101, 181, 200, 138, 90, 224, 123, 146, 0, 90, 226, 40, 40, 102, 170, 112, 119, 142], route_hints: [], min_final_cltv
_delta: 80, expiry_timestamp:<PHONE_NUMBER> }
docker-lnd-1          | 2023-12-23 04:47:12.286 [ERR] RPCS: [/routerrpc.Router/TrackPaymentV2]: rpc error: code = NotFound desc = payment isn't initiated
docker-lnd-1          | 2023-12-23 04:47:12.381 [WRN] CRTR: Channel<PHONE_NUMBER>40515841 has zero cltv delta
docker-lnd-1          | 2023-12-23 04:47:12.437 [WRN] CRTR: Failed to find route for payment 7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0759f867f4f62d6f24: unable to find a path to destination
docker-lnd-1          | 2023-12-23 04:47:12.448 [ERR] CRTR: Payment 7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0759f867f4f62d6f24 failed: no_route
docker-gatewayd-1     | 2023-12-23T04:47:12.449525Z  INFO ln_gateway::lnd: LND payment failed for invoice PrunedInvoice { amount: Amount { msats: 50000 }, destination: PublicKey(028fe7cb1b6cd6bac7f5c9c4
eff166fdb73ab861595e5b7f69b099bb32091dccede5828671f691268fc4cf1937989d30aa0a6213c0117103d3e7b553455cf313), destination_features: [2, 66, 0], payment_hash: 7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0
759f867f4f62d6f24, payment_secret: [73, 6, 116, 70, 148, 75, 90, 87, 99, 231, 119, 245, 152, 207, 101, 181, 200, 138, 90, 224, 123, 146, 0, 90, 226, 40, 40, 102, 170, 112, 119, 142], route_hints: [], mi
n_final_cltv_delta: 80, expiry_timestamp:<PHONE_NUMBER> } with Payment { payment_hash: "7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0759f867f4f62d6f24", value: 50, creation_date:<PHONE_NUMBER>, fee: 0, paym
ent_preimage: "0000000000000000000000000000000000000000000000000000000000000000", value_sat: 50, value_msat: 50000, payment_request: "", status: Failed, fee_sat: 0, fee_msat: 0, creation_time_ns: 170330
6832287725893, htlcs: [], payment_index: 19, failure_reason: FailureReasonNoRoute }
docker-gatewayd-1     | 2023-12-23T04:47:12.449610Z  WARN ln_gateway::state_machine::pay: Failed to buy preimage with Payment failed: FailureReasonNoRoute for contract OutgoingContractAccount { amount:
Amount { msats: 50051 }, contract: OutgoingContract { hash: 7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0759f867f4f62d6f24, gateway_key: PublicKey(b81ca3e6ea9ed786736fa265a923ac7af71d53b6b48a40d06c759
3433f4cf18d14dc2ce8d12e3771905629cb12cb436f9f864b3f569f5b5f4ba905a3f41cf737), timelock: 823014, user_key: PublicKey(269ef76e6a62ab2776d2c578939962c4e0d03df7d75a22686bb1326674a66ae7464937e2acd81ff8fac555
9f9d130892ae7c5e2ece0f906034afedd440409e85), cancelled: false } }
docker-gatewayd-1     | 2023-12-23T04:47:12.449721Z  INFO state_machine_transition{operation_id=6348f23823871e0a73e4961fec0ca5f084aa2c68001330f11cb0e43020065761}: fedimint_client::sm::executor: Executin
g state transition
docker-gatewayd-1     | 2023-12-23T04:47:12.450541Z  INFO state_machine_transition{operation_id=6348f23823871e0a73e4961fec0ca5f084aa2c68001330f11cb0e43020065761}: fedimint_client::sm::executor: Executin
g state transition
docker-gatewayd-1     | 2023-12-23T04:47:12.450600Z  INFO state_machine_transition{operation_id=6348f23823871e0a73e4961fec0ca5f084aa2c68001330f11cb0e43020065761}: ln_gateway::state_machine::pay: Canceling outgoing contract OutgoingContractAccount { amount: Amount { msats: 50051 }, contract: OutgoingContract { hash: 7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0759f867f4f62d6f24, gateway_key: PublicKey(b81ca3e6ea9ed786736fa265a923ac7af71d53b6b48a40d06c7593433f4cf18d14dc2ce8d12e3771905629cb12cb436f9f864b3f569f5b5f4ba905a3f41cf737), timelock: 823014, user_key: PublicKey(269ef76e6a62ab2776d2c578939962c4e0d03df7d75a22686bb1326674a66ae7464937e2acd81ff8fac5559f9d130892ae7c5e2ece0f906034afedd440409e85), cancelled: false } }
docker-gatewayd-1     | 2023-12-23T04:47:12.450916Z  INFO state_machine_transition{operation_id=6348f23823871e0a73e4961fec0ca5f084aa2c68001330f11cb0e43020065761}: ln_gateway::state_machine::pay: Canceled outgoing contract OutgoingContractAccount { amount: Amount { msats: 50051 }, contract: OutgoingContract { hash: 7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0759f867f4f62d6f24, gateway_key: PublicKey(b81ca3e6ea9ed786736fa265a923ac7af71d53b6b48a40d06c7593433f4cf18d14dc2ce8d12e3771905629cb12cb436f9f864b3f569f5b5f4ba905a3f41cf737), timelock: 823014, user_key: PublicKey(269ef76e6a62ab2776d2c578939962c4e0d03df7d75a22686bb1326674a66ae7464937e2acd81ff8fac5559f9d130892ae7c5e2ece0f906034afedd440409e85), cancelled: false } } with txid c8f25df4cf81475724b154dda9ef261a5be1d27d05f35ddc0e584179144cbe6b
docker-gatewayd-1     | 2023-12-23T04:47:12.451181Z  INFO pay_invoice: ln_gateway::state_machine: Got state CancelContract(GatewayPayCancelContract { contract: OutgoingContractAccount { amount: Amount { msats: 50051 }, contract: OutgoingContract { hash: 7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0759f867f4f62d6f24, gateway_key: PublicKey(b81ca3e6ea9ed786736fa265a923ac7af71d53b6b48a40d06c7593433f4cf18d14dc2ce8d12e3771905629cb12cb436f9f864b3f569f5b5f4ba905a3f41cf737), timelock: 823014, user_key: PublicKey(269ef76e6a62ab2776d2c578939962c4e0d03df7d75a22686bb1326674a66ae7464937e2acd81ff8fac5559f9d130892ae7c5e2ece0f906034afedd440409e85), cancelled: false } }, error: OutgoingPaymentError { error_type: LightningPayError { lightning_error: FailedPayment { failure_reason: "FailureReasonNoRoute" } }, contract_id: 6348f23823871e0a73e4961fec0ca5f084aa2c68001330f11cb0e43020065761, contract: Some(OutgoingContractAccount { amount: Amount { msats: 50051 }, contract: OutgoingContract { hash: 7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0759f867f4f62d6f24, gateway_key: PublicKey(b81ca3e6ea9ed786736fa265a923ac7af71d53b6b48a40d06c7593433f4cf18d14dc2ce8d12e3771905629cb12cb436f9f864b3f569f5b5f4ba905a3f41cf737), timelock: 823014, user_key: PublicKey(269ef76e6a62ab2776d2c578939962c4e0d03df7d75a22686bb1326674a66ae7464937e2acd81ff8fac5559f9d130892ae7c5e2ece0f906034afedd440409e85), cancelled: false } }) } }) while awaiting for output of 6348f23823871e0a73e4961fec0ca5f084aa2c68001330f11cb0e43020065761
docker-gatewayd-1     | 2023-12-23T04:47:13.461044Z  INFO state_machine_transition{operation_id=6348f23823871e0a73e4961fec0ca5f084aa2c68001330f11cb0e43020065761}: fedimint_client::sm::executor: Executing state transition
docker-gatewayd-1     | 2023-12-23T04:47:13.461878Z ERROR pay_invoice: ln_gateway: Cancelled with OutgoingContractError: An error occurred while paying the lightning invoice. while paying invoice: 6348f23823871e0a73e4961fec0ca5f084aa2c68001330f11cb0e43020065761
docker-gatewayd-1     | 2023-12-23T04:47:13.461993Z ERROR pay_invoice: ln_gateway::rpc::rpc_server: error=Outgoing Payment Error OutgoingContractError: An error occurred while paying the lightning invoice.

Same LND node right after:
/ # lncli payinvoice lnbc500n1pjcve32pp50vwalaqqahfmntcgnngp4dgr4hwfpwv0wspaup6elpnlfa3ddujqdqqcqzzsxqrrsssp5fyr8g355fdd9wcl8wl6e3nm9khyg5khq0wfqqkhz9q5xd2nsw78q9qyyssq74fvwpz3a4v7qg7v9mlwuwnqefyu9ertz5
4y0q82ntp06mm7wwekrh5znx2fgg6vmqpx74u4q807wvxeyh6p4zzuwa8lftdcvqje6wcq5hpmle
Payment hash: 7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0759f867f4f62d6f24
Description:
Amount (in satoshis): 50
Fee limit (in satoshis): 50
Destination: 03cc1d0932bb99b0697f5b5e5961b83ab7fd66f1efc4c9f5c7bad66c1bcbe78f02
Confirm payment (yes/no): yes
+------------+--------------+--------------+--------------+-----+----------+--------------------+--------------------------------------------+
| HTLC_STATE | ATTEMPT_TIME | RESOLVE_TIME | RECEIVER_AMT | FEE | TIMELOCK | CHAN_OUT           | ROUTE                                      |
+------------+--------------+--------------+--------------+-----+----------+--------------------+--------------------------------------------+
| SUCCEEDED  |        0.074 |        2.848 | 50           | 1   |   822717 |<PHONE_NUMBER>56361217 | Voltage-C2->No🥈Best->⚡ STACKER.NEWS ⚡ |
+------------+--------------+--------------+--------------+-----+----------+--------------------+--------------------------------------------+
Amount + fee:   50 + 1 sat
Payment hash:   7b1ddff400edd3b9af089cd01ab503addc90b98f7403de0759f867f4f62d6f24
Payment status: SUCCEEDED

I've done this several times with different destinations, no success. I can send to another user's invoice inside the federation and I can receive via lightning. It's just that something is causing issues using the new SendPaymentV2 API. I was not seeing this on signet so I'm a bit confused what could be the problem here.
Could it be something fee related? I'm not sure how fedimint is setting max fee when making the LND request.

Okay this was user error. I originally set up the gateway with a 1 msat base fee and low ppm but I had meant 1 sat fee. After increasing this to 1000 msat, the payment went through.
I think I noticed I also had to leave federation and add it again after a config change for it to reflect in the federation. A potential improvement could be made on the gatewayd to make routing fee changes instant. I wasn't sure if leaving and adding again would keep my balance and the backup command is still unimplemented. So a bit weird changing fees right now.

I think I noticed I also had to leave federation and add it again after a config change for it to reflect in the federation

Made an issue for [this](I think I noticed I also had to leave federation and add it again after a config change for it to reflect in the federation). I believe the config change would have updated if you waited until the next time the gateway registered, which should have been within 10 minutes. This is a long time to wait though and there's no reason to wait, we should just trigger registration after making a config change.


why not support INESRT INTO .....   ON DUPLICATE KEY UPDATE  use the dynamic parameter

As i use the sharding-sphere in my old project . There is some sql segement like
insert into a (a,b) value(?,?) on duplicate key update a= ? , b = ? + b by use the PreparedStatement
then the sharding-sphere will ignore the last two question symbol , then will cause the parameter 3 not found exception .
As i go through the source code in version 3.0.1-SNAPSHOT and found there is not any logic to handle the placeholder in 'on duplicate key update' , so just support sql like insert into a (a,b) value(?,?) on duplicate key update a= VALUES(a) , b = VALUES(b) .
Does this feature will support sooner , or any consideration for the sql at the beginning.
As i have modified the code to support it .

Thank you, you are right.
like issue
Why sharding-sphere can't support this?
1、It will increase the complexity of the code
2、You can use VALUES(column) instead of it
3、We are developing antlr sql parser. when this is done, we will redesign parser engine

how i use one sql to replace the sql  'insert into a (a,b) value(?,?) on duplicate key update a= ? , b = ? + b '  by VALUES(column) ?

@RogerLuoZJ  yes, like issue


Change msmarco v2 name

Interesting. We don't actually tests the Qrels enum... we probably should.


undefined method `utc' for "2015-12-30 04:14:49 UTC":String

  #
    #   # allow_unconfirmed_access_for = nil
    #   confirmation_period_valid?   # will always return true
    #
    def confirmation_period_valid?
      self.class.allow_unconfirmed_access_for.nil? || (confirmation_sent_at && confirmation_sent_at.utc >= self.class.allow_unconfirmed_access_for.ago)
    end
    # Checks if the user confirmation happens before the token becomes invalid
    # Examples:
    #

pls see file https://github.com/vishyme/Estydemo.git


test: secure_storage.dart

Re-ran test workflow on latest commit. Proper code coverage numbers are now reported


 Would really love to be able to zoom images for better/clearer viewing.

Hi, I'm not sure I follow, what is the blog margin?

The width of the blog text on the page (the width of the column containing the text of the post). Does that help? I can send a screenshot, if it would help. :)


DSND-2404: Top level transaction description values

Describe the changes

Adds mappings for all top level description values which can come across in a delta (pre and post transform).
Includes edge cases like capital and alt_capital.
Fixes a bug where paper_filed was being set to false instead of null.
Refactors wiremock integration test.
Adds integration test for SH07 (capital description value).
Fixes bug where CountDownLatch was not reset between each integration test.

Related Jira tickets
DSND-2404
Developer check list
General

[ ] Is the PR as small as it can be?
[x] Has the Jira ticket been updated with any relevant comments?
[ ] Is the README up to date?
[x] Has the POM been updated for the latest versions of dependencies?
[x] Has the code been double-checked against main?
[x] Does the code adhere standards in this repository, including SonarQube checks?

Testing

[x] Do the code changes have unit and integration tests with code coverage > 80%?
[ ] Has the code been tested locally and/or passed the API Karate tests on Tilt?
[ ] Have mandatory manual test cases been run?
[ ] Are extra Karate tests required?
[ ] Are all the test data resources up to date?

Release preparation
Where possible, add links to the respective Jira tickets when an item is checked

[ ] Have these changes been included in a release ticket?
[ ] Are changes required to the docker-chs-development deployment or test data?
[ ] Are any changes required to the environment added to chs-configs?

Notes to the tester
Add any testing hints or instructions here.

CI: No security warnings found

CI: No security warnings found


Extension causes high cpu load

Issue Type: Performance
Extension Name: python
Extension Version: 2019.3.6352
OS Version: Linux x64 4.18.0-17-generic
VSCode version: 1.32.3

:warning: Make sure to attach this file from your home-directory: /home/vila/ms-python.python-unresponsive.cpuprofile.txt :warning:
Find more details here: https://github.com/Microsoft/vscode/wiki/Explain:-extension-causes-high-cpu-load

Duplicate of #4895


[epoch] Re-sign effects from previous epoch

This PR allows a validator to re-sign an existing effects (that were signed in a previous epoch) at a new epoch.
This allows a client to be able to form a new effect certs when querying validators about a previously finalized transaction.

I think this is ok, but maybe a better solution is to not include the epoch in the signature for effects? The reason we have epoch in the certificate sig is that we must prevent a certificate from epoch N being used in epoch N+1. Is there any similar reason for effects?

If there is no epoch in the signature for effects, then there is no way to ever verify a certified effects (because you wouldn't know the committee to verify it)


Separator component with adjustable height that defaults to 32px. Hopefully it's OK I didn't include a story

Adjustable height that defaults to 32px
Hopefully it's OK I didn't include a story 😅

Current dependencies on/for this PR:

#472  👈
main

This stack of pull requests is managed by Graphite.

publish rc

Thanks so much!!! Is this worth a story just for coverage?

Sorry, just seeing this now, will add a story


Death by letter X

What version of million are you using?
2.6.0
Are you using an SSR adapter? If so, which one?
no
What package manager are you using?
yarn
What operating system are you using?
Linux mint
What browser are you using?
firefox
Describe the Bug
Creates components that kills the app upon the usage of the letter x in p & h tags.
This code :  x Gives this message in the terminal:   now renders ~14% faster.
Similar issues appear when using p tags.
What's the expected result?
The expected result is that it just renders the normal component and that the app does not die.
Link to Minimal Reproducible Example
https://DidNotRealyUnderstandWhatToLinkHere.com
Participation

[ ] I am willing to submit a pull request for this issue.

Hello there @Alexander-Fransson , can you please provide a Stackblitz / CodeSandbox reproduction of the issue you're getting so I can help out?

Hi, sorry for the inconvenience,
I believe I made a workaround yesterday and now I’m seemingly unable to
recreate the error.
Ill remove the issue for now, but I’ve noticed it a couple of times so
maybe Ill repost it once Im able to recreate it.
If there are other issues where the terminal states that some random string
component runs faster and the screen becomes black it is probably related.
Best wishes,
Alexander Fransson
On Thu, 4 Apr 2024 at 23:20, Tobiloba Adedeji @.***>
wrote:

Hello there @Alexander-Fransson https://github.com/Alexander-Fransson ,
can you please provide a Stackblitz / CodeSandbox reproduction of the issue
you're getting so I can help out?
—
Reply to this email directly, view it on GitHub
https://github.com/aidenybai/million/issues/1012#issuecomment-2038245972,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AQXVRYLZOYYHXXUMLPQ7PDDY3W7ZFAVCNFSM6AAAAABFVYHOJSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMZYGI2DKOJXGI
.
You are receiving this because you were mentioned.Message ID:
@.***>


Custom NavBar animation looks weird in transition

Version
Tell us which versions you are using:

react-native-router-flux: v4.0.0-beta.31
react-native v0.55.4

Expected behaviour
I have a custom NavBar for  and the props of  as below:
Scene 1:
hideNavBar: true
initial: true
Scene 2:
hideNavBar: false
initial: false
I expect custom NavBar will fit the component when go back.
Actual behaviour
When I click back button, custom NavBar animation looks weird:

This is 'Scene 2' (custom NavBar with yellow arrow and white background).

The yellow background is 'Scene 1'.
My custom NavBar are gone in transition
Steps to reproduce

Create a custom NavBar
Set Scenes props as below:
Scene 1:
hideNavBar: true
initial: true

Scene 2:
hideNavBar: false
initial: false
3. Go back from Scene 2 to Scene 1.
4. The header NavBar looks weird

Please try to reproduce it with Example project and latest version 4.0.0-beta.40. Feel free to open if the issue still exists


[api] Updates using PATCH for direct properties

When an objects direct properties have been updated. We can make use of the partial updates using a PATCH request.
With direct properties i mean not REFERENCE or COLLECTION types.
In this case we don't need to send the full object but only the properties that changed. This could useful for cases where not the full object has been loaded.
Have to figure out a way to determine which update to use when.

Link to #154.


PEP8 updates

Updated the .py files in the main pysat directory.  Changes include:

removing trailing whitespace
Splitting up most of the lines that spanned too many characters
Adding docstrings when missing

On hold until #24 is merged.

Finally!  I'll merge upon a positive review @rstoneback

Coverage increased (+0.01%) to 83.384% when pulling 7ac77690022c918de433cac9e54d158c32c758f1 on PEP8 into b70c537204cffb259f855cb727f23efabcae51b5 on develop.


⚠ AGEG website (prod) has degraded performance

In 40d4e0b, AGEG website (prod) (https://www.ageg.ca/) experienced degraded performance:

HTTP code: 200
Response time: 1959 ms

Resolved: AGEG website (prod) performance has improved in aea965d.


Add RCF 2822 mail / Internet Message Format parser/generator

Any interest in supporting mail formats?
Would such contributions be accepted? Are such formats (for single emails, or mailboxes) considered in-scope for the project?

Thank you for your interest in contributing! We would definitely welcome support for mail formats, whether it’s handling individual emails or entire mailboxes. Such formats are indeed considered in-scope for the project, and contributions in this area would be greatly appreciated.
Please feel free to share your ideas or open a pull request when you’re ready. We’d be happy to review and discuss your implementation!


Appstudio update test-component-pac-bvom

Pipelines as Code configuration proposal

Pipelines as Code CI/test-component-pac-bvom-on-pull-request has successfully validated your commit.


[WIP] Save scheduler job metadata entries to env

Save scheduler job metadata entries to env so that they are available for Spark run.py.

TODO

Add unit tests
Remove the hardcoded suffix


[Question] Strategy for swing feel

Hi,
it would be nice to have a PhraseAttribute for specifying a swing feel that works something like this:
data SwingDur = En | Sn | Tn

data PhraseAttribute  =  Dyn Dynamic
                       ...
                       | Swing SwingDur Double

The double value (in range: 0.25 - 0.75) specifies how hard the swing feel should be. E.g. Swing En 0.5 means no swing at all - straight eighths. Or e.g. Swing Sn 0.6 is a slight swing on the sixteenth notes, where the first of a pair of sixteenth notes takes 60% of the duration of an eighth note and the second takes 40%.
I have been thinking about how to implement/apply this when transforming a Music value into a Performance and I think it is not completely trivial.
A first attempt:

Check if note is on the "off beat"
If "off beat" adjust time and duration according to swing setting (move the note a bit back or ahead)

Also adjust all direct previous notes (scale duration to fill or give space)

Not sure if it is this simple. There are probably a few edge cases and as always the devil lies in the detail.
However it would be great to have this feature because it can give the music a more human feel.

This is not a simple problem. In fact, Euterpea's lack of time signature representation makes it quite tricky to implement in a general sense while still making everything sound reasonable. After all, even at the phrase level, it's impossible to know what beat the phrase starts on, which affects how the swing should work. Enough assumptions need to be made that it isn't really appropriate for inclusion in the core library.
On a somewhat related side note, the strong need for awareness of metrical position in jazz (whether for swing or other reasons) means that any realistic performance handling has to take place as a another layer on top of Euterpea-style representations to allow storing extra information. This is one of the reasons I created Jazzkell, which is another small library that sits on top of Euterpea that has explicit representations for onsets and time signatures.
Regarding extra constructors, there is already a way to specify custom Control nodes (Phrase is just another kind of Control):
data Control = ... | Custom String
The custom Control can then be handled as part of a custom performance algorithm (see the playC function and the PlayParams data type).

That makes a lot of sense.
Thank you for clarifying this for me.


Standardizing functionality API

Today we discussed  retrieve_multiple, and we're kind of getting a bit lost in the complexity of the API. Here's my attempt to figure out what we need:

list all record identifiers, paged (list_record_identifiers)
list all records, paged (list_records)
get one record (retrieve_one ?)
get multiple records (retrieve_multiple ?) -- paged? probably not.
select column filtering?

API interface ideas
In  #99 I proposed using the __getitem__ interface to retrieve records. Given the above distinction between retrieve_one and retrieve_multiple we're proposing, one possibility is to allow getitem to be the one that can handle either, like this:
def retrieve_one(record_identifier: str, ...) -> dict
def retrieve_multiple(record_identifier_list: list[str], ...) -> list[dict]
def __getitem__(record_identifiers: Union[str, list[str]], ...) -> Union[dict, list[dict])

So the actual functions have strict schema for parameters and results, but getitem allows for convenience, whereby you can do either psm["xyz123md5"] or psm[["xyz123md5", "abc456md5"]].
Cursor-based pagination ideas
If we implement cursor-based paging following some google standards, we could have an interface like this:
def list_record_identifiers(page_token: str, page_size: int)
def list_records(page_token: str, page_size: int)

return value would be:
{
  total_size: 100,
  page_size: 50,
  page_token: "xyz123md5",  # maybe?
  next_page_token: "gyx456md5",
  prev_page_token: "",  # maybe?
  records: [ ... ]
}

Currently, for retrieving or selecting records, we have 10 functions:
get_one_record
get_records
list_recent_results
list_results
retrieve
retrieve_distinct
retrieve_multiple
select
select_txt
select_distinct

Some idea's from today's discussion:

select_records
select_records -> will replace select, select_txt

can take a list of tuples such that they can be used to filter e.g.
[(k,v), (k,v), (k,v)]  --> distinct columns
can check type and construct appropriate where statements

if type(k) == str:
    where(k=v)

or
if type(k) == tuple
     where( k = ("genome", "alias", "aa") ==v  )

Can potentially implement OR logic as well:
if type(v) == tuple
   .or(k=v1)
   .or(k=v2)

retrieve_one and retrieve_many
Two convenient retrieval functions which will actually use select_records:
retrieve_one -> retrieving one record
retrieve_many -> retrieving multiple records

select_distinct
select_distinct_values -> will be select_distinct, are we able to simply add .distinct to our query from select_records to get the distinct records

All of these are two be implemented on the abstract class for BOTH backends.

Ok, first pass at this, implemented:
select_records
retrieve_one
retrieve_many
All three currently return:
        records_dict = {
            "total_size": total_count,
            "page_size": limit,
            "next_page_token": next_cursor,
            "records": results,
        }

select_records is very similar to the original select function but uses cursor pagination.
Next steps:

Need to change the creation of the dynamic filter as it is not what we want based on yesterday's discussion, i.e. attempt to implement select_txt functionality as well as select_distinct

Also, I left all the original functions in place for now. Will remove them once we are happy with the newest changes.

this sounds like great progress!

PR merged, this work is now complete.


close http-connection on internal server error from broker

Motivation
By default AsyncHttpClient has Keep-alive enabled and it get connected to the bad-broker then client repeatedly fails to perform lookup requests. In that case, connection should be closed and client should be able to connect with other broker to get the request served.
eg: sometimes broker is not able to create zk-session and it keeps failing to authenticate client-request so, client should be redirected to other broker by closing client-side connection on broker's InternalServerError
WARN  c.y.p.b.a.AuthorizationManager       - Client  with Role - my-role failed to get permissions for destination - persistent://property/cluster/ns/topic-1
org.apache.zookeeper.KeeperException$SessionExpiredException: KeeperErrorCode = Session expired for /admin/policies/property/cluster/ns
:
at com.yahoo.pulsar.broker.admin.PersistentTopics.getPartitionedMetadata(PersistentTopics.java:359) [pulsar-broker-1.15.7.jar:na]

Modifications
add KeepAliveStrategy in httpClient to disable keep-alive after internalServerError.
Result
AsyncHttpClient should close the connection on InternalServerError

Could we also set the closing of the HTTP session on the server side? When Jetty catches the exception is maybe possible to force it to use Connection: close in the response itself.


build: fix package-lock

lockfiles inside of packages don't really serve a purpose and aren't automatically updated by our lerna scripts, so I think we're better off just removing them all


Add browse multiple field

As per issue #931
A (minimal) example can be found at https://github.com/chancezeus/backpack_crud_browse_multiple_example
Example CrudController with field definition can be found here https://github.com/chancezeus/backpack_crud_browse_multiple_example/blob/master/app/Http/Controllers/Admin/ExampleCrudController.php
New/extra options (besides the default ones):
multiple => boolean: turn on/off multiple mode (default on), could be used when just interested in using the mime filter
mime_types => array: visible mime prefixes (ex. ['image'] or ['application/pdf'])

This. Is. AWESOME!!
Thank you so much @chancezeus . I've thoroughly tested your field type and it works like a charm. I've just merged it into master, it will be available to everyone with a composer update, later today, after I bundle it with a few more non-breaking changes.
Really great work here, thank you! For myself and for countless other Backpack developers, who will find this useful.
Cheers!