Credentials from ec2 role - instance metadata

It would be awesome if this client worked with ec2 roles, pulling credentials from instance metadata. Even better would be to use the default credentials chain that the amazon-developed clients use :)

That definitely sounds cool, but I'm a bit confused about what you mean by "pulling credentials from instance metadata". Can you link to some AWS documentation related to what you mean? As far as roles are concerned, this client definitely works with roles in the sense that it uses regular IAM tokens. You can assign those tokens to any role(s) you like, and those restrictions / permissions will apply to those keys.
As far as default credentials go, I'm a bit confused there too. How can I possibly embed tokens in this library that will work with everyone's account?

The way it works is, when launching a new ec2, you assign it a role, then the client library, when making a service request, first calls the identity metadata service to retrieve temporary aws credentials to use for the service request.
Here is a high level doc that talks about IAM roles. Step 5 is if particular interest.
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
Here is a doc on contacting the identity metadata service
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials
Newer aws clients tend to use a "default credential provider chain" which looks for credentials in various places from least to most expensive. IIRC it is.....

Explicitly provided credentials
Environment variables
Identity metadata service

I've been pretty absorbed in aws in several languages lately so please do let me know if you have any questions on this stuff :)

Here are java docs that talk about the default credential provider chain
http://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/auth/DefaultAWSCredentialsProviderChain.html

Ah ok that's cool. We can definitely do this. My initial sense is that it in your mix config you could do something like:
config :ex_aws,
    access_key_id: Instance.meta("role")["AccessKeyId"],
    secret_access_key: Instance.meta("role")["SecretAccessKey"]

Ignoring the question of exactly what module would be responsible for holding the meta-data fetching stuff (using Instance for the moment) does that seem like a useful approach? Obviously it isn't something where we want to be making the request every time the keys are used, so by putting it in the config it would get pulled at the start of runtime and then cached in the config.

On a further reading of the docs, it looks like something more along the lines of
config :ex_aws,
  access_key: [instance_meta: "role"]

Could be used. Thoughts?

Actually, the credentials provided by the instance metadata service are only temporary credentials which are automatically rotated by the metadata service. Here's an excerpt from the docs:

These security credentials are temporary and we rotate them automatically. We make new credentials available at least five minutes prior to the expiration of the old credentials.

Since the service lives on the local EC2, it's not super expensive to retrieve them, although I suppose you could have a background process updating them periodically. The typical approach I've seen is to just to call the instance metadata before each request though, since it's not that expensive.
If we wanted to mimic the AWS-developed java client's credential provider chain directly, the approach would be:

Check for keys in AWS environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_KEY), using those credentials if present
Check for keys in system properties (this would likely be Application.get_env() since that is the closest thing to java system properties).
Check for existence of credential profiles file (~/.aws/credentials), use credentials from there if present
Lastly, if no credentials were found at any of the above, fall back to using the instance profile credentials from the ec2 metadata service

This approach is nice because it allows you to easily override credentials. Honestly though, once you've used IAM roles and the EC2 metadata service, it's hard to use anything else. It's just so convenient and safe when you're deploying to EC2 or elastic beanstalk.

Ha, sorry, I totally missed the key_refresh edit. That could definitely work.
My typical approach is to use env vars for dev environments and then IAM roles via ec2 metadata in prod environments.
I'm not sure I could get this working as-is with an OTP release since this...
config :ex_aws,
  access_key_id: System.get_env("AWS_ACCESS_KEY_ID"),
  secret_access_key: System.get_env("AWS_SECRET_ACCESS_KEY")

...is evaluated at compile time, not run time. For OTP releases (built with exrm) with won't work.
Phoenix works around this like so:
config :ex_aws,
  access_key_id: {:system, "AWS_ACCESS_KEY_ID"},
  secret_access_key: {:system, "AWS_SECRET_ACCESS_KEY"}

Then ex_aws would need to match the tuple and execute the function at run-time. Alternatively, if the chain were hard-coded then it's just a matter of using the option that works best for the developers needs. This is how erlcloud works, although iirc, it only checks (1) credentials passed directly to functions, (2) env vars, (3) ec2 instance metadata.

If I were writing this, I'd probably just hard-code the default credential provider chain (long-term that could be a mix configuration setting where you specify a callback module which defines the chain if extra configuration were desired) to stay as close to the official aws library as possible.
I'm super excited about ex_aws btw! I'll be happy to move away from erlcloud and stop translating char lists to binaries and back. Thanks for writing ex_aws! :)

I'm happy to hear you're finding this useful! Good point about the releases. I think I'm going to stick with an explicit configuration over an implicit one, for the same reason that I don't by default look at the system env right now. AWS keys can wield a lot of power, and since Mix has such an easy to use central configuration system, the cost of explicitness is very low. Nonetheless I definitely want to make it easy to specify whether to use a file, system env, or instance credentials.
The overhead for requesting the instance meta-data is indeed low, on the order of a couple ms. On the one hand, most requests to other AWS services will take longer than that. On the other hand, caching the result in ETS and refreshing it periodically with a genserver is trivial. I think I'll work on getting the instance meta-data keys working, and then optimize with ETS.

This is on the TODO shortlist, definitely a feature I want to use.

Sounds awesome to me! :)
On Wed, May 13, 2015, 11:47 PM Ben Wilson<EMAIL_ADDRESS>wrote:

This is on the TODO shortlist, definitely a feature I want to use.
—
Reply to this email directly or view it on GitHub
https://github.com/CargoSense/ex_aws/issues/30#issuecomment-101900640.

Great progress on the library!
Hope to see the instance metadata support too, since we are using it with IAM roles so we don't have to worry about access keys during deployment etc.
I did write a wrapper on top of erlcloud and part of it was using explicit config in every API call. Since I didn't want to worry about expiring credentials, i went with the genserver updater process fetching credentials and writing whole config to ETS table. The gist below contains that part of the code. Note that it hasn't been used in production yet, but seems to work on elastic beanstalk dev installation pretty reliably. Hope it's useful.
https://gist.github.com/jannekai/fb3135f39a1c7c48a5da
I do agree with @stocks29 that supporting the provider chain would be nice. It might even be nice to allow extending the whole configuration setting with by defining a :config_provider setting and calling the configured concrete implementation. With one or maybe two concrete implementations most users probably wouldn't need to do any custom coding either.
https://gist.github.com/jannekai/b0f6151ba780089edeff

This is extremely helpful stuff thank you! What would be the value you would specify as config_provider? Something like:
defmodule Config.Provider.Default do
   def get do
      # check mix config
      # then check ENV
      # then check instance meta
   end
end

config :ex_aws,
  config_provider: Config.Provider.Default

I should add that one of the challenges in doing this that has contributed to its delay has been my desire to keep configuration like this on a per client basis, and allow configurable http clients and JSON parsers. So for example some level of configuration parsing needs to happen for a given client prior to obtaining keys to determine what http client / codecs will be used in order to make instance meta-data requests. Totally doable, but it's required a bit of extra thought in order to enable.

OK! So here's what I have in #35 as of right now, and I may declare this good enough for the time being unless there's functionality I'm missing somehow. The following works:
# In mix config
config :ex_aws,
  access_key_id: {:role, "MyRole"},
  secret_access_key: {:role, "MyRole"}

# Also works
config :ex_aws,
  access_key_id: [{:system, "SYSTEM_ENV_VAR_ID"}, {:role, "MyRole"}],
  secret_access_key: [{:system, "SYSTEM_ENV_VAR_SECRET"}, {:role, "MyRole"}]

# which is exactly equivalent to
config :ex_aws,
  access_key_id: [system: "SYSTEM_ENV_VAR_ID", role: "MyRole"}],
  secret_access_key: [system: "SYSTEM_ENV_VAR_SECRET", role: "MyRole"]

The latter will try the system environment and if those fail, will grab the role. I know that there's a bit of redundancy in that you have to specify the role twice, I'll spend some time thinking about that. OTOH it provides a very easy way to setup the desired behaviour of "try these env keys, otherwise fallback to this role".
I've moved away from the idea of having a provider module, because that's basically what a client IS. If you want fancy configuration options, you can just do:
defmodule MyDynamo do
  use ExAws.Dynamo.Client

  def config do
    %__MODULE__{}
    |> ExAws.Config.get  # sets defaults
    |> my_fancy_overrides
  end
end

Then you do MyDynamo.list_tables or whatever else you want to do.
In any case, are there any use cases not covered by the config via tuples, config via list of tuples, or config via client modules?

Looks to me like this will work although I don't believe it is necessary to provide a role name since each EC2 can only have 1 role assigned to it and the role name can be automatically discovered by going to this endpoint first "http://<IP_ADDRESS>/latest/meta-data/iam/security-credentials/". The downside to explicitly specifying the role name in the config here is you'll have to change it if/when you change the role name. So if you wanted to deploy to two instances with two different roles, you'd have to have different configuration for each.
If you added a provider module, you could pretty easily support a provider chain with the way the config works, like the example below.
# in config.exs
config :ex_aws,
  access_key_id: ExAws.Config.CredentialProvider.default_access_key_provider_chain(),
  secret_access_key: ExAws.Config.CredentialProvider.default_secret_key_provider_chain()

# in ExAws.Config.CredentialProvider
def default_access_key_provider_chain() do
    [system: "AWS_ACCESS_KEY_ID", role: "MyRole"}]
end
def default_secret_key_provider_chain() do
    [system: "AWS_SECRET_ACCESS_KEY", role: "MyRole"]
end

While I don't think it's a huge problem, since the access and secret keys are treated separately, if you typically used IAM roles but wanted to temporarily override with environment variables and you fat-fingered one of the env vars when setting them, you could end up pulling, for example, the access key from an env var and the secret key from metadata which obviously wouldn't work and could be very difficult to diagnose. If you were to treat them as a pair, you could add validation checks to ensure that both pieces are coming from the same source.
I'm not sure exactly how that would look though. Perhaps something like this?
config :ex_aws,
  credentials: [
    {:environment, "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"},
    :role,
    {:static, "actual-access-key", "actual-secret-key"}]

Just my 2 cents. Hopefully this is helpful :)

$ curl http://<IP_ADDRESS>/latest/meta-data/iam/security-credentials/
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

  <title>404 - Not Found</title>

404 - Not Found

Ah if you can determine the role programmatically then I won't require it to be passed in. I'm not too worried about people fat fingering the environment variables, 99% of the time they're just copying it from the readme anyway. How about:
config :ex_aws,
  access_key_id: [{:system, "SYSTEM_ENV_VAR_ID"}, :role],
  secret_access_key: [{:system, "SYSTEM_ENV_VAR_SECRET"}, :role]

I'm not sure I get the value of having a separate module is to hold that list. ExAws.Config has a bunch of defaults, but I don't include methods to retrieve AWS keys there, instead preferring that people set that in their mix config. If they're gonna be pasting something in mix config, I'm not clear on the value of having them paste something like:
config :ex_aws,
  access_key_id: ExAws.Config.CredentialProvider.default_access_key_provider_chain(),
  secret_access_key: ExAws.Config.CredentialProvider.default_secret_key_provider_chain()

vs
config :ex_aws,
  access_key_id: [{:system, "AWS_ACCESS_KEY_ID"}, :instance_role],
  secret_access_key: [{:system, "AWS_SECRET_ACCESS_KEY"}, :instance_role]

Just consistency between different language clients and convenience in lieu of the default being (no config) being the default provider chain.
Honestly, it would be my preference that the default, without specifying any config, matched the default provider chain of other languages since it is super convenient. It would be nice if you only had to specify the config if you wanted to override. This is currently how erlcloud works as well.
If it isn't the no-config default, the benefit of modularizing it is if amazon decides to change it, the default_* functions could be updated to keep in sync, assuming the new behavior is even nicer. Then those that upgrade get the newer behavior for free instead of having to manually update their configs.
It's also familiar for folks coming from official amazon clients so less barrier to entry although it wouldn't be a high hurdle.
Just my 2 cents. I'm happy just seeing the IAM role stuff. Default provider chain would just be icing on the cake :)

Good arguments. You've convinced me that having the AWS standard defaults pre-configured is a good idea, so per this branch it will no longer be required that anyone put anything in their mix config at all provided they're already setting the aforementioned ENV variables, or are running on an instance with a role configured.
I'm still gonna avoid having folks explicitly call a module, but that provider pattern now sits nicely with other defaults inside ExAws.Config.Defaults.
Gonna test on an instance to make sure it actually works then merge into master.
Thanks for your input!


updated appcode-eap (2016.1.2-RC)

Changes to a cask
Editing an existing cask

[x] Commit message includes cask’s name (and new version, if applicable).
[x] brew cask audit --download {{cask_file}} is error-free.
[x] brew cask style --fix {{cask_file}} left no offenses.

Amends #1941.


Fail to sync with Google Drive

:speaking_head: Foreword

Thank for taking the time to fill this bug report fully. Without it we may not be able to fix the bug, and the issue may be closed without resolution.

And thank you for writing the Super Productivity app :slightly_smiling_face:
:ghost: Brief Description
I already am using Super Productivity on my laptop and wanted to use it on my Android as well. I receive an error when trying to configure synchronization via Google Drive.
Steps To Reproduce
Steps to reproduce the behavior:

Start the app;
Go to 'Settings';
Scroll down to 'Sync & Export' session;
Expand the 'Sync' panel;
Select GoogleDrive as the Sync Provider;
Tap 'Save';
A dialog should appear to select the Google account. Select the desired Google account to use;
See the error Google Drive: Error while creating sync file. [object Object].

:police_car: Expected behavior
The synchronization configuration working.

Hey there! Thanks for reporting this! I am a bit stuck with this. Currently, progress is tracked here (though this repo might be the actual right place for it...):
https://github.com/johannesjo/super-productivity/issues/434

This should work now with the latest release.


don't  scroll down chat when scrolled up

fixes #241
Desired behaviour:
On New message:

If the chat has not been scrolled up (or only a few pixels), the chat scrolls down like before
if the chat has been scrolled up, a blue indicator is shown and the chat does not scroll down.

When the indicator is shown:

clicking the indicator scrolls down the chat and the indicator hides
scrolling down manually also hides the indicator

https://user-images.githubusercontent.com/44805696/150636383-6371f2c9-02fd-4f2a-b172-86fa0c8bd9c6.mp4

probably shouldn't be too proud of this :D


WFLY-17202 Upgrade SmallRye Fault Tolerance to 6.1.0

Resolves
https://issues.redhat.com/browse/WFLY-17202

@kabir ping also please see https://issues.redhat.com/browse/WFLY-17202?focusedCommentId=21236046&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-21236046


fix: vatid field rename to vat_id

Renamed vatid field in Quotation, Sales Invoice & Sales Order to vat_id

Hi @wojosc  please review and merge


Feat: Polkadot v1.4 to v1.5 upgrade

Description
This PR is upgrading Runtime's and Node's dependencies from Polkadot-SDK release v1.4.0 to v1.5.0
Notes
Relevant upgrade's notes and comments.

Performed the migration of the FRAME pallet pallet_nomination_pools.
Updated the node/client file to replace the usage of sp_api with sc_client_api::backend.
Migrated from pallet_contracts_primitives to pallet_contracts across multiple files.
Breaking changes (low impact)

Rework the event system of sc-network
Staking: chill_other takes stash instead of controller

Kindly refer to the official Polkadot release report for further details: Polkadot v1.5.0
Polkadot release analysis : Polkadot v1.5.0 analysis

Process

[x] Bump workspace dependencies
[x] Fix issues
[x] Bump spec_ver for both testnet and mainnet Runtime.
[x] Bump node version if there were changes in the node. TBD

Codebase Upgrade Acceptance Criteria

[x] cargo check passes
[x] cargo test passes
[x] cargo build on -- release profile correctly builds
[x] try-runtime and runtime-benchmarks features compile
[x] Single node spinned up from binary works and generates blocks
[x] Zombienet network with 2 peers spawned with block-production config file generates blocks.

Runtime & Node Upgrade Acceptance Criteria

[x] Runtime upgrade works on Zombienet

[x] Node upgrade works on Zombienet

[x] Runtime upgrade works on Chopsticks

[x] Testnet
[x] Mainnet

[x] Try-runtime passes with no pending migrations

[x] Testnet
[x] Mainnet

<!--- PR TEMPLATE CONTENT STARTS HERE -->
Types of Changes
Please select the branch type you are merging and fill in the relevant template.
<!--- Check the following box with an x if the following applies: -->

[ ] Hotfix
[ ] Release
[x] Fix or Feature

Fix or Feature
<!--- Check the following box with an x if the following applies: -->
Types of Changes
<!--- What types of changes does your code introduce? -->

[ ] Tech Debt (Code improvements)
[ ] Bug fix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to change)
[x] Dependency upgrade (A change in substrate or any 3rd party crate version)

Migrations and Hooks
<!--- Check the following box with an x if the following applies: -->

[ ] This change requires a runtime migration.
[ ] Modifies on_initialize
[ ] Modifies on_finalize

Checklist for Fix or Feature
<!--- All boxes need to be checked. Follow this checklist before requiring PR review -->

[x] Change has been tested locally.
[ ] Change adds / updates tests if applicable.
[ ] Changelog doc updated.
[x] spec_version has been incremented.
[ ] network-relayer's events have been updated according to the blockchain events if applicable.
[ ] All CI checks have been passed successfully

Checklist for Hotfix
<!--- All boxes need to be checked. Follow this checklist before requiring PR review -->

[ ] Change has been deployed to Testnet.
[ ] Change has been tested in Testnet.
[ ] Changelog has been updated.
[ ] Crate version has been updated.
[ ] spec_version has been incremented.
[ ] Transaction version has been updated if required.
[ ] Pull Request to dev has been created.
[ ] Pull Request to staging has been created.
[ ] network-relayer's events have been updated according to the blockchain events if applicable.
[ ] All CI checks have been passed successfully

Checklist for Release
<!--- All boxes need to be checked. Follow this checklist before requiring PR review -->

[ ] Change has been deployed to Devnet.
[ ] Change has been tested in Devnet.
[ ] Change has been deployed to Qanet.
[ ] Change has been tested in Qanet.
[ ] Change has been deployed to Testnet.
[ ] Change has been tested in Testnet.
[ ] Changelog has been updated.
[ ] Crate version has been updated.
[ ] Spec version has been updated.
[ ] Transaction version has been updated if required.
[ ] All CI checks have been passed successfully

@Aideepakchaudhary As you mentioned, it has started failing from Polkadot 1.5.0 onwards, so it seems related to a specific version. Could you please identify the cause?

I have fixed the github CI. Please validate once

@metricaez @Aideepakchaudhary

CodeExecutor was improved by removing NativeElseWasmExecutor as a part of this
https://github.com/paritytech/polkadot-sdk/pull/2521.
Hi @ayushmishra2005 ,we'll integrate these changes in the stable branch: https://github.com/Cerebellum-Network/blockchain-node/pull/455


There are not examples on how to run command line options like --pretty or --multipass

I just tried the next config, but pretty: true won't do nothing, so what is the correct syntax to pass those options? thanks in advance.
development: {
			options: {
				pretty: true,
				plugins: [
					{minifyStyles: false}
				]
			},
			files: [{
				expand: true,
				cwd: '<%= path.src.root %>',
				src: ['**/*.svg'],
				dest: '<%= path.dev.root %>'
			}]
		}

The provided options are passed directly to SVGO. I cannot answer questions on how it works from there on.


explorer: rule creator: text area picks up rich text during paste

when pasting monospaced text in from another program, the rule creator style gets messed up:

foo bar baz


Implement Checkmate and Stalemate

The random game play needs to display checkmate positions and stalemate positions.

This PR appears to have fixed the problem where during random play one player would end up in check but this would not be recognised.
Random games now seem to play through until the move limit is reached, or a checkmate or stalemate occurs.


Event to resize columns should stop propagation

Problem Description
If I have a react-table which is resizable on a drag&drop elements (or any element that listen to events for that matter), it gets triggered when I try to resize the a column, which can get quickly annoying.
Maybe a event.stopPropagation() could fix that.
Codepen
http://codepen.io/anon/pen/LyJpjJ?editors=0010

Yep, that needs to happen :) We'll get on it.

This is unfortunately impossible until the react event handling api's become more robust. Simply put, because we must listen for the cursor/touch up/end events at the document level (so you can drag anywhere on the screen to resize), the synthetic react event has actually already moved up the component tree to reach your onClick. The only way to possibly solve this would be to conditionally add fake up/end end events on every single react table component that would listen for this strange post-resize onClick event, stop its propagation, then remove the listener.
Unfortunately I've spent the last 3 hours trying to solve this using the above method and many others with no avail.  It appears there are many other devs who are disappointed in this edge case with react. :(

Yes, this would be a nice feature if there is any possibility.

Can't you do this?
// ...
<tbody>
  {table.getRowModel().rows.map((row) => (
    <tr
      key={row.id}
      onClick={(e) => {
        e.stopPropagation(); // 🫷
        return row.getToggleSelectedHandler()(e);
      }}
    >
// ...

Or am I misunderstanding the situation?


fix: 3x shadow database start timeout

What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
What is the current behavior?
Please link any relevant issues here.
What is the new behavior?
Feel free to include screenshots if it includes visual changes.
Additional context
Add any other context or screenshots.

Pull Request Test Coverage Report for Build<PHONE_NUMBER>

1 of 2 (50.0%)  changed or added relevant lines in 2 files are covered.
5 unchanged lines in 1 file lost coverage.
Overall coverage decreased (-0.03%) to 56.685%

Changes Missing Coverage
Covered Lines
Changed/Added Lines
%

internal/db/diff/diff.go
0
1
0.0%

Files with Coverage Reduction
New Missed Lines
%

internal/gen/keys/keys.go
5
12.31%

Totals

Change from base Build<PHONE_NUMBER>:
-0.03%

Covered Lines:
4990

Relevant Lines:
8803

💛  - Coveralls


Partial migration to avoid SQL exceptions

Task/Issue URL: https://app.asana.com/0/488551667048375/1203298219744166/f
Description
See full context in asana task
Steps to test this PR
Test production app update

[ ] install from develop
[ ] enable AppTP
[ ] open apps that attempt tracking
[ ] In this branch, modify LIMIT 10000 in VpnDatabase line `1671 to some number below the number of tracking attempts, eg. you have 20 tracking attempts blocked, configure the limit to be for instance 15
[ ] build and update from this branch
[ ] launch app and verify in AppTP activity screen that attempt count is the number set in the limit above

Test migration

[ ] install from <IP_ADDRESS>-nightly
[ ] enable AppTP
[ ] open apps that attempt tracking
[ ] In this branch, modify LIMIT 10000 in VpnDatabase line `1671 to some number below the number of tracking attempts, eg. you have 20 tracking attempts blocked, configure the limit to be for instance 15
[ ] build and update from this branch
[ ] launch app and verify the vpn_tracker db table migration is performed correctly and in AppTP activity screen that attempt count is the number set in the limit above

Test fresh install

[ ] Fresh install from this branch
[ ] enable AppTP
[ ] open apps that attempt tracking
[ ] verify tracking attempts are blocked correctly

Current dependencies on/for this PR:

develop

PR #2488   👈

This comment was auto-generated by Graphite.


How do I customize and initialize a database

If I need to execute init. SQL to initialize the database I need when the database is created, what should I do? In addition, why does the database refuse me to use root -h to log in to the sample-leader
| %         | radondb_metrics  |
| %         | radondb_operator |
| %         | radondb_repl     |
| %         | root             |
| <IP_ADDRESS> | root             |
| localhost | mysql.infoschema |
| localhost | mysql.session    |
| localhost | mysql.sys        |
| localhost | root             |
+-----------+------------------+
10 rows in set (0.00 sec)
mysql> show grants for root\G;
*************************** 1. row ***************************
Grants for root@%: GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE, CREATE ROLE, DROP ROLE ON . TO root@% WITH GRANT OPTION
*************************** 2. row ***************************
Grants for root@%: GRANT APPLICATION_PASSWORD_ADMIN,AUDIT_ADMIN,BACKUP_ADMIN,BINLOG_ADMIN,BINLOG_ENCRYPTION_ADMIN,CLONE_ADMIN,CONNECTION_ADMIN,ENCRYPTION_KEY_ADMIN,FLUSH_OPTIMIZER_COSTS,FLUSH_STATUS,FLUSH_TABLES,FLUSH_USER_RESOURCES,GROUP_REPLICATION_ADMIN,INNODB_REDO_LOG_ARCHIVE,INNODB_REDO_LOG_ENABLE,PERSIST_RO_VARIABLES_ADMIN,REPLICATION_APPLIER,REPLICATION_SLAVE_ADMIN,RESOURCE_GROUP_ADMIN,RESOURCE_GROUP_USER,ROLE_ADMIN,SERVICE_CONNECTION_ADMIN,SESSION_VARIABLES_ADMIN,SET_USER_ID,SHOW_ROUTINE,SYSTEM_USER,SYSTEM_VARIABLES_ADMIN,TABLE_ENCRYPTION_ADMIN,XA_RECOVER_ADMIN ON . TO root@% WITH GRANT OPTION
Database Login Commands
bash-4.4$ mysql -h sample-leader.default -uroot -pAa@123123123
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1045 (28000): Access denied for user<EMAIL_ADDRESS>(using password: YES)

Customized init.sql (wip)
Access to root user remotely is not safe. At present, root@%is for Operator only. If you need to use super users remotely, you can create an additional super user

Hello developers
@runkecheng
1、https://github.com/radondb/radondb-mysql-kubernetes/releases/download/v2.2.0/mysql_v1alpha1_mysqlcluster_mysql8.yaml
Whether this file supports database initialization?
2、Customized init.sql (wip) Could you give me some guidance?
3、persistence If I don't use PVC, I just want to use the local HostPath support

Hello developers @runkecheng 1、https://github.com/radondb/radondb-mysql-kubernetes/releases/download/v2.2.0/mysql_v1alpha1_mysqlcluster_mysql8.yaml Whether this file supports database initialization? 2、Customized init.sql (wip) Could you give me some guidance? 3、persistence If I don't use PVC, I just want to use the local HostPath support

For 1,2: We are developing this feature, It is expected to be supported in the next version
For hostpath: It is not conflicting to use both hostpath and PVC. You can use the local-hostpath storageclass of OpenEBS(refer https://openebs.io/docs/user-guides/localpv-hostpath)

Regarding the first and second points, I am looking forward to your support as soon as possible, which will be more flexible. For the third point, I will take your advice. Thank you very much. @runkecheng


BigUint(0) bug fixed (encode_base127)

Hello! First of all, I am really grateful for your sharing this useful library.
I accidentally found this bug while encoding oid(<IP_ADDRESS>.10) (which is secp256k1) into DER format. I added a small fix for encode_base127 function so that it returns a vector with one 0 byte when BigUint(0) was given.

Perfect. Thanks!


geometry_experimental: 0.5.8-0 in 'jade/distribution.yaml' [bloom]

Increasing version of package(s) in repository geometry_experimental to 0.5.8-0:

upstream repository: https://github.com/ros/geometry_experimental.git
release repository: https://github.com/ros-gbp/geometry_experimental-release.git
distro file: jade/distribution.yaml
bloom version: 0.5.19
previous version for package: 0.5.7-0

geometry_experimental

No changes

tf2
* change from default argument to overload to avoid linking issue #84 <https://github.com/ros/geometry_experimental/issues/84>
* remove useless Makefile files
* Remove unused assignments in max/min functions
* change _allFramesAsDot() -> _allFramesAsDot(double current_time)
* Contributors: Jon Binney, Kei Okada, Tully Foote, Vincent Rabaud

tf2_bullet
* remove useless Makefile files
* fix ODR violations
* Contributors: Vincent Rabaud

tf2_geometry_msgs
* remove useless Makefile files
* tf2 optimizations
* add conversions of type between tf2 and geometry_msgs
* fix ODR violations
* Contributors: Vincent Rabaud

tf2_kdl
* remove useless Makefile files
* fix ODR violations
* Contributors: Vincent Rabaud

tf2_msgs
* remove useless Makefile files
* Contributors: Vincent Rabaud

tf2_py

No changes

tf2_ros
* fix deadlock #79 <https://github.com/ros/geometry_experimental/issues/79>
* break out of loop if ros is shutdown. Fixes #26 <https://github.com/ros/geometry_experimental/issues/26>
* remove useless Makefile files
* Fix static broadcaster with rpy args
* Contributors: Paul Bovbel, Tully Foote, Vincent Rabaud

tf2_sensor_msgs
* ODR violation fixes and more conversions
* Fix keeping original pointcloud header in transformed pointcloud
* Contributors: Paul Bovbel, Tully Foote, Vincent Rabaud

tf2_tools
* remove useless Makefile files
* Contributors: Vincent Rabaud

Hold for simultaneous geometry release.


Allow configuration of redirect following

Default value is now DefaultClientConfigImpl.DEFAULT_FOLLOW_REDIRECTS
(false), it was true before (because it's true by default in HttpClient)
Also fixed the setting of connectTimeout and readTimeout who were equal
to zero before.
fixes gh-691

@snussbaumer NP. When I get a bit more time, I'll add some comments. We'll need you to make some changes. Have you signed the contributors agreement?

@spencergibb : I've just signed the contributors agreement. NP for the changes, go ahead !

Closed via 0ddfb42d4df41132774459bcd1eebfa5e9bd5408


Fixing audio latency

Hi, to fix audio latency..
I was thinking perhaps have the audio stream running a separate ffmpeg program rather than combined?

Hello,
I tried multiple approaches such as manually running two instances of ffmpeg (one for the video and one for the audio), but I was not able to fix the issue (and I don't believe that the Golang exec.Command function is affecting this). Additionally, I'm not entirely sure if it's directly related to the ffmpeg configuration or if it's due to some buffering in the WebRTC communication, or maybe both (and I'm still quite inexperienced when it comes to debugging this kind of issue).


[New] jsx-boolean-value: add inverse option for always/never

Fixes #1249

ping for reviews :-)

@yannickcr @lencioni @EvNaverniouk if you have a chance to review this that'd be appreciated :-)

@lencioni updated per your comments; i'll merge tomorrow if there's no other issues.


Dart does not throw error if parameter of incorrect type is passed to the function.

Dart SDK Version: 2.0.0_dev.68.0
OS: Windows 10
The following sample code example declares a function with <X extends int> parameter and than calls it with the String argument:
testme<X extends int>(X x) {}
main() { testme("incorrect param"); }

It expectidly fails with dartanalyzer - indeed, String does not extend int:
Analyzing test.dart...
  error - Couldn't infer type parameter 'X'.

Tried to infer 'String' for 'X' which doesn't work:
  Type parameter 'X' declared to extend 'int'.
The type 'String' was inferred from:
  Parameter 'x' declared as     'X'
                but argument is 'String'.

Consider passing explicit type argument(s) to the generic.

 at test.dart:2:10 - strong_mode_could_not_infer
1 error found.

However, this incorrectly passes with dart - any errors and warning. I believe dart should throw a error here too.
Please note that this is similar with the issue #33597 which is about function return parameter. There dartanalyzer does not throw a compiler error (and dart throws it as expected) and the situation is a mirror with one described here.

Seems to be a missing error from the front-end. Likely know already, but they'll know which bug is the canonical one.

The missing check against bounds is covered by https://github.com/dart-lang/sdk/issues/33308


Color mode serialize methods should return same color with different format

For example, to_rgb shouldn't return the actual ColorModes::Rgb instance. It should return a new Color with a format of :rgb (or the same instance if the format is already :rgb).
This will require the current implementations to be private helpers for assisting the string serializers (i.e. to_rgb_s).

Never mind. Not in favor of this idea.


Use external prop-types package

Hi!
I'm using react-stepzilla, but I'm encountering these warnings:
Warning: Accessing PropTypes via the main React package is deprecated. Use the prop-types package from npm instead.

They're pretty trivial, but they're messing up my CI runs.
I checked the source and noticed that stepzilla is importing PropTypes from react, which is in the process of being moved into that external package.
I can put up a PR if you'd like!

@dmcclory the latest version of React moved PropTypes to its own package:
https://facebook.github.io/react/blog/2017/04/07/react-v15.5.0.html
I'll probably bump up the packages React version today and try and push a new version of StepZilla.

@dmcclory I've upgraded to 15.5.4 and pulled out PropTypes to use prop-types npm.
This should dig rid of the warning messages for you now. Please let me know if you have any other issues.
New build has been published to npm, so make sure you update to v4.5.0

@dmcclory closing as I've not heard anything and assume it worked.


feat: byob: secure upload attestation and public download Action

closes https://github.com/slsa-framework/slsa-github-generator/issues/1571

No delegator diff change?

apparently not.. because I changed the exact same lines in both workflows so they match.

No delegator diff change?

apparently not.. because I changed the exact same lines in both workflows so they match.

And I'm obviously wrong. pre-submit is failing :-)

I marked the delegator pre-submit as required in branch protection settings.


Field trait

Split from #45
Define Field trait which represents mathematical Field
https://en.wikipedia.org/wiki/Field_(mathematics)

trait_alias! macro is intended to replace this RFC
https://github.com/rust-lang/rfcs/blob/master/text/1733-trait-alias.md


Several minor updates

Added a link to more documenation about collecting on Linux machines.
Updated logic so that /OnlyProviders will collect addtion events if the user asks for stacks on those events (there was logic but it was geared to old syntax).
Fix a bug with creating large data that might exceed 4GB (happened with some large heap dumps).
Fixed bug where /CpuCounters argument was lost if PerfView had to elevate.

Codecov Report

Merging #279 into master will increase coverage by <.01%.
The diff coverage is 33.33%.

@@            Coverage Diff             @@
##           master     #279      +/-   ##
==========================================
+ Coverage   24.35%   24.35%   +<.01%
==========================================
  Files         197      197
  Lines      112414   112419       +5
  Branches    11215    11217       +2
==========================================
+ Hits        27378    27380       +2
- Misses      85009    85012       +3
  Partials       27       27

Flag
Coverage Δ

#2015
24.35% <33.33%> (ø)
:arrow_up:

#2017
24.35% <33.33%> (ø)
:arrow_up:

#Debug
15.81% <0%> (-0.01%)
:arrow_down:

#Release
14.9% <0%> (-0.01%)
:arrow_down:

Impacted Files
Coverage Δ

src/FastSerialization/StreamReaderWriter.cs
75.52% <25%> (-0.23%)
:arrow_down:

src/PerfView/CommandLineArgs.cs
11.07% <33.33%> (+0.22%)
:arrow_up:

src/PerfView/CommandProcessor.cs
16.09% <50%> (+0.02%)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8baa65b...ecfed12. Read the comment docs.


Conditional Kernel Version Check for BPFtrace Programs

Is your feature request related to a problem? Please describe.
As the Linux kernel evolves, certain kernel features, functions, or probes may change, be deprecated, or removed. This can lead to BPFtrace programs that rely on specific kernel features to break over time, particularly those relying on kprobes. For example, the kprobe:tcp_drop was removed in Linux kernel version 5.19, breaking the tcp_drops script (see #1895).
Projects like Pixie, which use BPFtrace for dynamic tracing, need the ability to deploy different BPFtrace programs based on the kernel version of the nodes in a cluster.
Describe the solution you'd like
Introduce a conditional check in BPFtrace that allows programs to be deployed only if the target system's kernel version matches a specified range. This would enable users to write BPFtrace programs that are compatible with multiple kernel versions and ensure that only the appropriate version of the program is deployed on each node.
For example, a user could write two versions of a BPFtrace program, one for kernel versions up to 5.18 and another for kernel versions 5.19 and above. The BPFtrace runtime would then check the kernel version of the target system and deploy the appropriate version of the program.
The syntax for specifying the kernel version range could be similar to the following:
@kernel(>=5.19)
{
  // BPFtrace program for kernel versions 5.19 and above
}

@kernel(<5.19)
{
  // BPFtrace program for kernel versions up to 5.18
}

Integrating a conditional kernel version check into BPFtrace would provide a more robust and flexible way to deploy BPFtrace programs in heterogeneous environments with varying kernel versions.
Describe alternative solutions or features you've considered
An alternative solution would be to handle the kernel version check externally, before deploying the BPFtrace program. However, this would require additional tooling and complexity for the user and would not be as seamless as having the kernel version check integrated into BPFtrace.

Agreed that feature probing is more robust. Distros do backports all the time without necessarily bumping the version code.
Perhaps something like weak symbols for probes might make sense. In that a failure to attach is silent. Not sure if we'd want to support multiple weak attachments to the same probe, though. Perhaps needs to be fleshed out.

Perhaps something like weak symbols for probes might make sense. In that a failure to attach is silent. Not sure if we'd want to support multiple weak attachments to the same probe, though. Perhaps needs to be fleshed out.

Just for reference, we're doing something similar with wildcarded and multi-attachpoint probes now, although not silently. If there are multiple attachpoints for a probe and some of them don't exist, we show a warning and still attach to the rest. If there is a single attachpoint, we fail hard if it doesn't exist.


replace topic post id to slug?

how can i rewrite url by replacing topic post id to subject slug ? Any idea ??

I have the same problem in replacing slug... please help me

The implementation of this feature needs to write a lot of code.


Class definition of Contextual Bandit

https://github.com/SforAiDl/genrl/blob/b2f1ae4185045fc30c113144670f38f9d49b9983/genrl/classical/bandit/contextual_bandits.py#L8
Should this be Base Class for a Contextual Bandit

I'm guessing changing the above was left, from this (the classical bandit)
https://github.com/SforAiDl/genrl/blob/b2f1ae4185045fc30c113144670f38f9d49b9983/genrl/classical/bandit/bandits.py#L8
Not sure. Was a little confused about the difference between the contextual and non-contextual bandits

Yeah, it's just a typo in this case. To put it in the simplest terms, Multi-Armed Bandits (normal ones) don't consider the state of the environment into decision taking. Contextual Bandits do.
Multi-Armed Bandit Policy:
https://github.com/SforAiDl/genrl/blob/b2f1ae4185045fc30c113144670f38f9d49b9983/genrl/classical/bandit/policies/base.py#L76
Contextual Bandit Policy:
https://github.com/SforAiDl/genrl/blob/b2f1ae4185045fc30c113144670f38f9d49b9983/genrl/classical/bandit/contextual_policies/base.py#L75

Can we close this? @Devanshu24

Multi-Armed Bandits (normal ones) don't consider the state of the environment into decision taking. Contextual Bandits do.

Correct, so to make an analogy the number of arms is the action_space dimension of the environment
But I couldn't understand why are there multiple bandits(not referring to arms) in the Contextual Bandits base class
If I look at the eps greedy policy of both of them

Classical
https://github.com/SforAiDl/genrl/blob/b2f1ae4185045fc30c113144670f38f9d49b9983/genrl/classical/bandit/policies/epsgreedy.py#L60

Contextual
https://github.com/SforAiDl/genrl/blob/b2f1ae4185045fc30c113144670f38f9d49b9983/genrl/classical/bandit/contextual_policies/epsgreedy.py#L63

Meaning the context is acting as the state in the lookup table.
However how are we utilising the multiple bandits, I did find there is something called the curr_bandit but didn't understand how it was being used

The Contextual Bandits problem is a little different from the normal MAB setting. Think of it as a player playing a MAB but instead there are multiple bandits and you're only playing them one bandit at a time. This is useful in settings like for example when you want to recommend ads to users. Each user is a different MAB (you have only n number of ads to show) and there are some different number of users. Refer to the MAB chapter in Sutton and Barto if you need a clarification.
The curr_bandit basically tells you which n-armed bandit you're actually playing with. The actions are the same each time you play but the action space may have different meanings (like for example a different set of the same number of ads).
@threewisemonkeys-as could give better "context" maybe :p

To add to this, the reason for doing  action = np.argmax(self.quality[context]) is that in classical bandits algorithms you just have a lookup table. So in contextual bandit policies you are basically solving multiple independent MABs. Its a simple extension to the single bandit problem which are being solved by the regular bandit polcies. As Sampreet said _curr_bandit is being used by the bandit class to keep track of which bandit is being played. Every time a step is taken, the _curr_bandit is updated randomly.
All of this might seem a little redundant, since we just have a lookup table in the end. However in real life your context size might be huge so lookup tables are not feasible and you need a more powerful contextual bandit solving algorithm. A simple one can be having a fed forward neural network which takes the context as input and outputs a suitable action. Now this is very different from the simple single MAB problem that the bandit_policies are solving. You can check out section 1 and 2 of this paper to get a better idea.

Thanks a lot, Atharv and Sampreet!
I'll go through the papers and chapter once to get a better insight
I'll close this issue, if I have any other queries about the theory I'll contact via Slack
Thanks again!


No audio in calls at all on apollon (Mi 10T Pro)

As the title says, no audio at all when calling on apollon.
I cant hear the caller, the caller cant hear me.
Even if i dont install the caller features, they still get installed and audio breaks
rom: ArrowOS Android 12 experimental

this will be fixed on next build

It should work now on v1.8, if doesn't feel free reopen or create new issue


chore: let @typescript-eslint/no-floating-promises ESLint rule pass

Summary of changes
This is just the relevant parts of the code changes from #6325 instead of also tackling eslint-config changes.

Added void operator to Promises that are not being awaited. Used await on finally retry in test.

Details
When enabling the typescript-eslint rules contained in "plugin:@typescript-eslint/recommended-requiring-type-checking" I tried to improve code quality by addressing some of the issues raised when enabling the type checked linting rules.
This change specifically resolves issues raised with the typescript-eslint error: no-floating-promises.

error  Promises must be awaited, end with a call to .catch, end with a call to .then with a rejection handler or be explicitly marked as ignored with the void operator  @typescript-eslint/no-floating-promises

Testing Strategy:

I opened up my windows machine and ran this script (with the additional eslint rules enabled from #6325):
yarn lint
yarn test:primary
npx playwrite install
yarn test
yarn build --tsc

The specific rule configuration was:
  "@typescript-eslint/no-floating-promises": [
    "error",
    { ignoreVoid: true, ignoreIIFE: true },
  ],

#6325 was closed w/o merging in favor of #6248 , so (I think) this PR is obsolete now. @ngbrown let me know if there's a reason to reopen it.

@pcattori This made code changes that #6248 didn't make, specifically the fix to withApp.ts#L39 is a test runtime behavior improvement.
There were no eslint rule changes in this pull request. I think this pull request should be re-opened.

@MichaelDeBoey just checking in, is there anything else left on this PR?
I'm working on the other recommended typed rules from typescript-eslint and saw this one is still hanging around.

I've rebased the branch, re-ran the no-floating-promises rule, and updated where there were new errors.

Sorry it looks like this has new conflicts 😬 .  I merged dev in locally but don't have access right to push to your fork

@brophdawg11 I re-resolved the conflicts and made sure formatting was applied to components.tsx this time.
Because I forked into a separate org, to organize my GitHub forks, I don't have the option to enable maintainers to push to the branch. I didn't realize that was a drawback at the time.


Map does not update view after removing layers

I am using the leaflet extension of the heatmap.js library to draw some layers on a map. I initialize the map with
  var baseLayer = L.tileLayer(
          'http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png',{
            attribution: 'Map data © OpenStreetMap contributors, CC-BY-SA, Imagery © CloudMade',
            maxZoom: 18
          }
        );

      var map = new L.Map('map', {
          center: new L.LatLng(42.38,- 71.12),
          zoom: 13,
          layers: [baseLayer]

        });

Then, I add a layer:
mylayer.addTo(map);

After the user enters an input, I remove the layer:
 map.removeLayer(heatmapLayer);

However, the view of the map does not update. Is there a method to redraw the map with the removed layer? Thanks!

Can you publish a fiddle/codepen/playground that displays this behaviour?

@IvanSanchez
Ah, I figured out this issue! We can use layer groups (as shown in this excellent
tutorial) to show exactly the layers that we want!


Update to OTel 1.9 and other deps

Issue #, if available:
Description of changes:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Codecov Report

Merging #118 (7696c17) into main (5d89f4c) will increase coverage by 73.91%.
The diff coverage is n/a.

@@             Coverage Diff             @@
##             main     #118       +/-   ##
===========================================
+ Coverage        0   73.91%   +73.91%
- Complexity      0       15       +15
===========================================
  Files           0        3        +3
  Lines           0       46       +46
  Branches        0        5        +5
===========================================
+ Hits            0       34       +34
- Misses          0        8        +8
- Partials        0        4        +4

Impacted Files
Coverage Δ

...metry/javaagent/providers/AwsTracerConfigurer.java
62.50% <0.00%> (ø)

...elemetry/awspropagator/AwsCompositePropagator.java
87.87% <0.00%> (ø)

...emetry/javaagent/providers/AwsAgentProperties.java
0.00% <0.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5d89f4c...7696c17. Read the comment docs.

Yeah waiting on a 1.9.1 patch for upstream


Fix: instead of using environment.ts .prod.ts, use process.env variables

We can store secrets in process.env & for deployment on github secrets and ci/cd pipeline uses these secrets in github to fetch from there and use in the yaml file.
We can change the references from environment.OpenAI_Key .... in the code to use process.env.OpenAI_Key ?
Does this makes and is it doable?

Let's just have production: true/false there, and use the .env file for secret keys.

A real bummer that angular doesn't directly support it
Environment variables are a way to store values that can be accessed across different parts of your application. They are useful because they allow developers to avoid hard-coding sensitive information like API keys or other credentials, and instead store them securely in a separate location.
React and Angular are both popular frontend JavaScript frameworks that allow developers to build complex web applications. Both React and Angular support the use of environment variables, but there are some differences in how they handle them.
In React, environment variables can be defined in a .env file at the root of your project. These variables are automatically loaded into your application and can be accessed using process.env.VARIABLE_NAME. React relies on a tool called 'Create React App' (CRA) which makes use of Webpack under the hood for transpiling and bundling, this allows access to the environment variable at build time (when code is compiled and shipped to users).
On the other hand, Angular provides a similar way to define environment variables, but they must be defined manually in a configuration file (typically named environment.ts or environment.prod.ts). These files expose an object containing key-value pairs that can be accessed throughout the app via dependency injection. Unlike React, Angular doesn't rely on Webpack directly as it has its own build system based on Gulp and Rollup, which offers less flexibility to incorporate environment variables from the system.
The reason why accessing environment variables using process.env does not work with Angular is due to the difference in how Webpack and Angular's build system process the code. Webpack is able to dynamically replace environment variables with their actual values at build time, whereas Angular's build system compiles the TypeScript and then uses its own configuration files. Since the Angular build system doesn't have access to Node.js global variables like process.env, it can't replace them with their actual values.
To summarize, while both React and Angular support the use of environment variables, they handle them differently due to differences in how they build and compile the code. While React benefits from Webpack's dynamic build system that is able to replace process.env at build time, Angular has a more manual approach using dependency injection through configuration files.

We can close this too, unless you have some inputs for using environment files.


Make Stackdriver metrics exporter watch Stackdriver Secret

Follow-up to enhance #824
Goal is to have this in by Nov 15, 2019.
Expected Behavior
The metrics Stackdriver exporter can support reading a k8s Secret to configure the Stackdriver client with for authentication.
When the specified Stackdriver Secret for Stackdriver metrics exporter changes (same name/namespace, but is modified in-place), the Stackdriver exporter should be re-created with the new Secret for authenticating to Stackdriver.
Actual Behavior
Stackdriver exporter continues on with the original Secret until the next metrics ConfigMap update that triggers an exporter update.
Steps to Reproduce the Problem

Run Knative on GKE
Add a GCP service account credential as a k8s Secret named "stackdriver-service-account-key" to "knative-serving" namespace
Set "metrics.backend-destination" in "config-observability" to "stackdriver"
Set "metrics.stackdriver-use-secret" in "config-observability" to "true"
Check the container logs for a "knative-serving" namespace Knative controller, see that the metrics exporter has updated and the config includes "stackdriver" and "true"
Update the k8s Secret however you feel
Check the same container logs, see there is no new metrics exporter update.

/assign @anniefu

Closing this issue since it will become obsolete with the new metrics plan to use the opencensus agent exporter to export to the OpenCensus collector service: https://github.com/knative/pkg/blob/master/metrics/README.md


Fix OpenShift example

Fixes https://github.com/GoogleCloudPlatform/kubernetes/issues/4997
This example requires OpenShift merges: https://github.com/openshift/origin/pull/2015
I think an interesting use case driven from this example is the common need to take a set of files and bundle them into a secret.  We have an experimental command that does this in OpenShift, but it is useful, and would be probably of general value to Kubernetes.
/cc @smarterclayton you should hopefully see this is much simpler now.

/cc @deads2k

Another use case brought up by this:
It's very difficult to use TLS on service accounts today.  The signer cert has to be kept separate from the infrastructure, you have to generate the cert after the service is created (to get both the DNS name and the portalIP), and it's a lot of manual steps.
After seeing how we could do auto secret generation from the service account, I'm inclined to replicate that solution for service certificates.
A user in a namespace would create a secret with a name or annotation matching a service name and a secret.type "ServiceTLSCertificate".  A controller (that has access to a signing cert for a CA that pods in the cluster can trust) would see that secret was created and fill out a cert for the service portalIP and DNS named by the secret's annotation.  Any pods in that service could then mount that secret and have a cert automatically generated.  The consumers of the service could get the CA for the service from DNS (which could automatically add the CA to DNSSEC via skydns).

Any chance we can merge this now?
https://github.com/openshift/origin/pull/2055 merged so the updated Docker images should have no more problems doing WATCH against Kubernetes resources.

Stop breaking travis

Boilerplate is wrong

Just like @eparis to change boilerplate text and mess up my PRs, this should be all set now ;-)

LGTM, will merge on green

I like stomping on people's PRs!

All known flakes.


Custom input select for temperature/ventilation mode

Is your feature request related to a problem? Please describe.
No way to set ventilation/temperature -mode using input select in HA
Describe the solution you'd like
Implement custom inout select
Describe alternatives you've considered
Additional context
Inspo: https://github.com/ThermIQ/thermiq_mqtt-ha/blob/91799864a2ee61a6e31711e2c60c34e2007bbc99/custom_components/thermiq_mqtt/input_select.py

Any progress on this? It's a wanted feature 😁

Any progress on this? It's a wanted feature 😁

Not sure this is a good idea. Seems that the input_select keeps it's own state in HA somehow which complicates things, and input selects are not really good UX anyways imho. Feel free to dive into the thermiq implementation and do a PR if you wan't.
At some point i had envisioned some kind of dashboard bundled with the integration, feel free to dive into that too.
You can do a enitity card that calls the set_ventilation_mode service until then:
https://community.home-assistant.io/t/call-service-button-from-lovelace/168656/7

I use the default settings and all works great for me, this is my card. It's a stock image and is just a representation. I have automations that are connected to temperature and humidity so the ftx will adjust to those conditions. Boost after shower and such.

I use the default settings and all works great for me, this is my card. It's a stock image and is just a representation. I have automations that are connected to temperature and humidity so the ftx will adjust to those conditions. Boost after shower and such.

Sweet! Is it possible to bundle something like this with the integration you think?

I use the default settings and all works great for me, this is my card. It's a stock image and is just a representation. I have automations that are connected to temperature and humidity so the ftx will adjust to those conditions. Boost after shower and such.

Care to share the yaml? I found the image as well. Neat.
Been playing with trying to get animations to work for fans and rotor, no luck sofar :P

Care to share the yaml? I found the image as well. Neat. Been playing with trying to get animations to work for fans and rotor, no luck sofar :P

Hello, yes.
This card is built up of custom:stack-in-card, custom:mushroom, and custom:button-card (this is the one for animating icons)
  - type: horizontal-stack
    cards:
      - type: custom:button-card
        entity: switch.saleryd_hrv_away_mode
        name: Away
      - type: custom:button-card
        name: Boost
        entity: switch.saleryd_hrv_boost_mode
        state:
          - value: 'on'
            color: lightblue
            styles:
              icon:
                - animation: rotating 2s linear infinite
          - value: 'off'
            styles:
              icon:
                - animation: rotating 6s linear infinite

The boost icon is revolving even when off, but when activated it changes color and goes faster.
  - type: horizontal-stack
    cards:
      - type: custom:button-card
        tap_action:
          action: call-service
          service: saleryd_hrv.set_temperature_mode
          target: {}
          data:
            value: 0
        icon: mdi:thermometer-chevron-up
        entity: sensor.saleryd_hrv_target_temperature
        state:
          - value: '21'
            color: light blue
          - value: '19'
            color: rgba(68,115,158)
          - value: '16'
            color: rgba(68,115,158)
        name: 21°C

Set temp icons calls the service for the 3 available temperatures.
This could/ probably should be tidied up, it was a year since I got the Saleryd machine and added the integration.

Thanks for sharing.
Getting there slowly, will play with colors later :)

Still figuring out how to bundle frontend controls with integration.
Made a minimal example in https://github.com/bj00rn/ha-saleryd-ftx/pull/31
Have a look at the alias section to define entities for extra sensors

Well we are on the right path here :P this is my initial draft in a ow so tired state after work and putting kids to bed... Will try to smooth things out later

Do you have a power meter connected to the FTX? Could you try latest release 3, and confirm the that the heater power calculation is correct? Seems a bit low to me. Fans seem to be rated at around 182W at 100%, heater is 900W at 100% and the system is rated at 1100W nominal.

@bj00rn hope this helps
Also it was calibrated using a dumb meter

Yea no sorry @bj00rn  the % does not translate to an active power.
Please redo the change : )
The percentage must mean how long the heater is "ON" for a cycle if I am to guess.
The heater turns full throttle i'd guess'timate and is on for 29% of an cycle which appears to be something in the neighbourhood of 4½-5h

@Fettkeewl thanks! A bit more complicated than I imagined then 😪.

@Fettkeewl after some thought i still feel like the power in W is relevant here, since it would correspond to an estinated average heater power over a cycle of any given length.
Example: If 100% equates to 800W constant power. 50% would be 800W at 50% of a cycle = an avarage of 400W over the cycle.

@bj00rn Can you atleast readd the previous sensor? =) I liked it better! And its visible on the Saleryds own webpage
so I for one would want to have it around 🗡

@bj00rn Can you atleast readd the previous sensor? =) I liked it better! And its visible on the Saleryds own webpage so I for one would want to have it around 🗡

Which one do you mean I should readd? The one that was constant 800W? I renamed heater_temperature_percent -> heater_ power_percent. And added new sensor heater_power, that replaced the constant 800W.

My bad missed it, wanted the percentage sensor back 🙏

fixed by #57


[sil-cloner]  Fix a bug related to remapping of opened existentials during SIL function cloning

Also take the opportunity to simplify the code and tighten the assertions.
The commit does not contain a test-case, because it is kind of difficult to provide a reduced one.
The patch is by @slavapestov. I just tested it on a very big test-case to see that it fixes the bug.

@swift-ci please smoke test

This PR is the extended version of the #7789

@swift-ci please smoke test

@swift-ci please smoke test

@swift-ci please smoke test

@swift-ci please smoke test

@swift-ci please smoke test

@swift-ci please smoke test


Dynamic Uploader connection

Hello. During huge data migration from the Whisper to ClickHouse I've recognized that the connection to CH is permanent. Because of that, we have an unbalanced loading: only one of 8 CH nodes under an LB receives all data and then redistribute it with a sharding key.
Implementing a mechanism to recognize shouldn't be a hard task, but I'm not sure about the overhead for a new connection per insert. Maybe, implement a config parameter for it?

I assume that the carbon-clickhouse and the graphite-clickhouse are on the same server as the clickhouse. In this configuration, you can use external load balancers for write (carbon-c-relay) and read (carbonapi)

Implementing a mechanism to recognize shouldn't be a hard task, but I'm not sure about the overhead for a new connection per insert. Maybe, implement a config parameter for it?

Overhead will be very small and optional parameter is not required. PR are welcome

Solved with 56fceb9


Update nordvpn to 3.4.0

After making all changes to the cask:

[x] brew cask audit --download {{cask_file}} is error-free.
[x] brew cask style --fix {{cask_file}} left no offenses.
[x] The commit message includes the cask’s name and version.

Requesting someone look over this — NordVPN is doing things in a bit of a strange way, and I'm not sure what the best way to update this cask is. The direct link on their website links to https://downloads.nordcdn.com/apps/macos/generic/NordVPN-OpenVPN/latest/NordVPN.dmg, which is version 3.3.11 of the app, but, through the app, version 3.4.0 is downloaded from https://downloads.nordcdn.com/apps/macos/generic/NordVPN-OpenVPN/latest/NordVPN.zip (notice the different file extension).
The version number isn't included in the url, but it is part of the downloaded zip (the package installer is located in Release_#{version}/NordVPN.sparkle_guided.pkg), which makes me think that perhaps it makes sense to keep the version, rather than just using latest.
Thoughts?


Remove redundant queue seek on song play

Seeking to the correct initial track is already handled by the startPosition parameter.
I tested this locally and couldn't see any change in behaviour, but I'm guessing you added it for a reason - feel free to close without merging if it's necessary.

Thanks!
When I first built the player, the startPosition parameter didn't seem to have any effect. I just tested with your removal, and it seems to behave as expected now.


update file-type dependency version #83

Hey, sorry that no one ever took a look at your PR 😢
This is a breaking change, I will publish a new major version soon with all dependencies bumped...


kvClient.GetValue: error: Method not found

Is this client match the testnet contract version?

Thank you... you are right, so, is there a official kv node endpoint? Or do I still have to run a kv node myself?

Usually, users create key-value stream databases on the top of storage layer according to their needs, and then maintain KV nodes to monitor their own KV streams.
For more about how the KV works and how to run a KV node, please refer to following documents:
https://docs.0g.ai/0g-doc/docs/0g-storage/k-v-store
https://docs.0g.ai/0g-doc/run-a-node/storage-kv

Thank you


Support for method call syntax in call expressions

Currently doing something like
call GetThing()->takething()

is broken, it generates the following syntax tree
call_statement [0, 0] - [0, 15]
  call_expression [0, 5] - [0, 15]
    function: identifier [0, 5] - [0, 13]
ERROR [0, 15] - [0, 28]
  keyword [0, 17] - [0, 26]

I tried fixing it by defining call_expression as the following:
call_expression: ($) =>
  prec(
    PREC.CALL,
    sep1(
      seq(
        field("function", $._expression),
        "(",
        commaSep($._expression),
        ")"
      ),
     "->"
    )
  ),

But that seems to only recognises two calls like call foo()->bar() and not the ones after it in call foo()->bar()->baz()
->baz() shows up as an ERROR node.

Actually just moving the rule into another rule seems to cause a conflict
    _method_expression: ($) =>
      seq(
        field("function", $._expression),
        "(",
        optional(commaSep1($._expression)),
        ")"
      ),

    call_expression: ($) => prec(PREC.CALL, $._method_expression),

Should be fixed by https://github.com/vigoux/tree-sitter-viml/pull/125.

Ah, I must've missed it


Fixing opensearch helmchart conditions when there is only cluster_manager role specified to nodes

Description
As new opensearch role for nodes was introduce helmchart templates should be adjusted. I Fixed opensearch helmchart conditions when there is no master role specified to nodes.
Issues Resolved
[List any issues this PR will resolve. You should likely open an issue if one does not already exist.]
Check List

[x] Commits are signed per the DCO using --signoff

For any changes to files within Helm chart directories:

[x] Helm chart version bumped
[x] Helm chart CHANGELOG.md updated to reflect change

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@TheAlgo @DandyDeveloper have you had a chance to take a look on that PR? :)

@TheAlgo @DandyDeveloper @peterzhuamazon @prudhvigodithi Can you please review this PR?

Hey @MindAwakeBodyAsleep thanks for the contribution, the condition added LGTM, but can you please share the issue you are facing ?
Thank you

This seems only a change for 2.x+ as 1.x does not have cluster_manager term.
So no backport.
@prudhvigodithi

Hey @MindAwakeBodyAsleep just following back, can you please take care of the previous comments and we can merge this PR.
Thank you

Hey @MindAwakeBodyAsleep just following back, can you please take care of the previous comments and we can merge this PR, also I do see some conflicts can you please fix them as well?
Thank you

@MindAwakeBodyAsleep Checking for the comments on the PR. Thanks

Looks stalled, closing, please feel free to finish and reopen.
[Catch All Triage - 1, 2, 3, 4]

Glad I received the email notification on this, I had completely forgotten about this and wanted to keep tabs on it. Since the original author didn't seem to follow through, I created a new PR that covers all inclusive language changes: https://github.com/opensearch-project/helm-charts/pull/560

Thanks @Phenix66.


Track: Create a versioned site for lsd for both docs and theme

xref:

https://github.com/lsd-rs/lsd/issues/602
https://github.com/lsd-rs/lsd/issues/968#issuecomment-1932779557

TODOs:

[x] Create a repo for the site https://github.com/lsd-rs/lsd-rs.github.io
[ ] Choose a tool and theme with versions for the site, it should be better to fit both docs and themes(personally prefer using hugo)
[ ] Create the docs site
[ ] Create the theme site

It might also be helpful to copy the existing docs versioning disclaimer to directly above the config.yml snippet. Like others who have commented on other linked issues and PRs, I missed the text box when searching the readme. (And even once I read it, it didn't initially click that it applied to the configuration settings.) Having it appear alongside the config.yml sample would have been a big help, though.


css writing-mode with rtl, ltr, bdo & unicode-bidi values

css writing-mode seems to be missing?

This issue was imported from Google Moderator
Moderator votes: +38
Issue added by Jim on 2014-05-05
To vote this issue up or down, simply include +1 or -1 in your comment.

+1

+1

needs writing-mode +1

+1

+1

+1

Tracking browser support for unicode-bidi: embed; and unicode-bidi: isolate; etc would be very useful.

:+1:

+1!!!

+1

+1

+1

+1

Support for the property is now available at http://caniuse.com/#feat=css-writing-mode
Information for rtl, ltr, bdo & unicode-bidi is still to come, so leaving this issue open until that's available.

+1

I believe that this issue should be closed

@mik-laj nope:

Information for rtl, ltr, bdo & unicode-bidi is still to come, so leaving this issue open until that's available.


Typescript compilation fails with v2.4.1

I see this error when building with v2.4.1, it works fine with 2.3.4
TypeScript error: node_modules/@cycle/dom/lib/MainDOMSource.d.ts(6,22): Error TS2420: Class 'MainDOMSource' incorrectly implements interface 'DOMSource'.
Types of property 'select' are incompatible.
Type '(selector: string) => DOMSource' is not assignable to type '<S extends DOMSource>(selector: string) => S'.
Type 'DOMSource' is not assignable to type 'S'.

There are some changes the way interfaces works in TS ≥ 2.4.
Probably means that this line needs to be updated

TypeScript v2.4 is a breaking change, so I'll rename this issue as an enhancement, it's not Cycle's fault that compilation fails.

Will @ntilwalli  skipLibCheck compiler option help?

@whitecolor Thanks.  I'm back on 2.3.4 but I'll try that out when I get a chance.


added GPLv2 license

as per the directions in the README :)

poke?

As @puffnfresh said in #10, this isn't really supported anymore as GitHub provides their own version of this feature.
http://choosealicense.com/

ah, thanks.


Can properties be a real object?

The properties object given as the second parameter of definitionFn has an api using get to get hold of the Observables inside.  Is there a reason that properties can't be a plain Javascript object with the properties on it?
I ask because I am experimenting with using cycle-react with Typescript, and one of the nice things is having a well defined interface for component properties, but of course this only works with real objects.

Ah, ignore this.  I just figured out that its a BehaviourSubject (and now I understand why!), so I can type it as a Rx.BehaviorSubject, where P is the property type.

Exactly.
In addition, I think it's better to type it as Rx.Observable<P> since you're not going to modify the properties' state by using subjects.
Also, we're going to improve the documentation, soon. Sorry that didn't make it clear on how to build components in Cycle-React :p

Thanks for your response.  I am still pretty confused about which bits of the framework want Observables and which dont.  For example, right now I am trying to make a super-simple example to try and understand things, where the top-level model is made up of a loaded json file, and a constant value.
I'm very unclear as to what the model function is supposed to return.  Since this is going to encapsulate the state of the whole app it needs to have lots of sub-models.  Should it return a single Observable containing this app state, or should it return an object containing one Observable per bit of state (i.e. per sub-model)?
And when this model (or parts of it) eventually make it into a component, should it still be an Observable or does it get re-wrapped automatically in the h function?
There is some very strange code below (I know it doesn't work and the types are all confused, but its just to show the kind of direction I was going in).
Help!
applyToDOM('#app', (interactions: any) => view(model(intent(interactions))));

function view(model$: Rx.Observable<Model>) {
	return model$
		.map(model => model.course$)
		.defaultIfEmpty(null)
		.do((x: any) => { console.log("Got a change:"); console.log(x); })
		.map((x: any) => h('div', {}, 'Test test'));
}

interface Model {
	course$: Rx.Observable<Course>
	other$: Rx.Observable<number>
}
function model(intentions: any) {
	// A stream to load some json
	const course$ = Rx.Observable
		.fromPromise(fajax.get('content/menu.json'))
		.map<Course>(result => result.body.courses[0])
		.shareReplay(1);

	// The number 1!
	const other$ = Rx.Observable.just(1);

	// This returns a single observable containing the Model (which obviously doesn't work because the Model expects an object containing observables)
	return Rx.Observable.combineLatest(
		course$,
		other$,
		(course$, other$) => ({ course$, other$ })
	)
}

function intent(interactions: any) {
	return { }
}

I'm very unclear as to what the model function is supposed to return. Since this is going to encapsulate the state of the whole app it needs to have lots of sub-models. Should it return a single Observable containing this app state, or should it return an object containing one Observable per bit of state (i.e. per sub-model)?

I think both are ok. But, I would prefer having different observables for different sub-models. And combines them by using combineLatest for the View.

And when this model (or parts of it) eventually make it into a component, should it still be an Observable or does it get re-wrapped automatically in the h/component function?

Cycle-React itself doesn't wrap your values into observables automatically. And I think you should send the plain value instead of observable to components because it makes more sense. You defines the component class by creating an observable, and use the component by sending values into its props. For example:
https://github.com/pH200/cycle-react/blob/master/examples/many/many-component.js
https://github.com/pH200/cycle-react/blob/master/examples/many/many-view.js
And I can't understand what's the question here from your example code. We can obviously have a model that is a single observable.


[BUG] Get-PnPFile fails with "File does not exist" after the Entra ID app was removed and I created a local tenant app

Notice
Many bugs reported are actually related to the PnP Framework which is used behind the scenes. Consider carefully where to report an issue:

Are you using Invoke-PnPSiteTemplate or Get-PnPSiteTemplate? The issue is most likely related to the Provisioning Engine. The Provisioning engine is not located in the PowerShell repo. Please report the issue here: https://github.com/pnp/pnpframework/issues.
Is the issue related to the cmdlet itself, its parameters, the syntax, or do you suspect it is the code of the cmdlet that is causing the issue? Then please continue reporting the issue in this repo.
If you think that the functionality might be related to the underlying libraries that the cmdlet is calling (We realize that might be difficult to determine), please first double check the code of the cmdlet, which can be found here: https://github.com/pnp/powershell/tree/master/src/Commands. If related to the cmdlet, continue reporting the issue here, otherwise report the issue at https://github.com/pnp/pnpframework/issues

Reporting an Issue or Missing Feature
Please confirm what it is that your reporting
After creating a Tenant app to replace the removed MS Entra ID multi-tenant app the call to Get-PnPFile always fails with "File does not exist error" even when the file does exist. The new app registration has the following permissions consented:
SharePoint:
AllSites.FullControl
AllSites.Manage
AllSites.Read
AllSites.Write
TermStoreReadWrite.All
User.Read.All
Expected behavior
Please describe what output you expect to see from the PnP PowerShell Cmdlets
The expected behavior is the Get-PnPFile will return the stream handle for the file
Actual behavior
Please describe what you see instead. Please provide samples of output or screenshots.
The Get-PnPFile function throws a 404 "File does not exist" error
Steps to reproduce behavior
Please include complete script or code samples in-line or linked from gists
Create new app registration with the permissions outlined above and use the new app for authentication
What is the version of the Cmdlet module you are running?
(you can retrieve this by executing Get-Module -Name "PnP.PowerShell" -ListAvailable)
ModuleType Version    Name                                ExportedCommands

Manifest   1.12.0     PnP.PowerShell                      {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Add-PnPSiteClassification, Copy-PnPFolder...}
Manifest   1.10.0     PnP.PowerShell                      {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Copy-PnPFolder, Export-PnPClientSidePage...}
Which operating system/environment are you running PnP PowerShell on?

[X ] Windows
[ ] Linux
[ ] MacOS
[ ] Azure Cloud Shell
[ ] Azure Functions
[ ] Other : please specify

Can you please update to the latest version 2.12 or the nightly builds , test and let us know ? 1.12 is almost 2 years old and not supported anymore.


toISOString shouldn't return "Invalid Date" when called on a invalid moment

Because ISO dates are typically not used for direct human consumption and rather as a data interchange format, returning the string "Invalid Date" isn't very useful.  Throwing a RangeError (which the native JS date object does) or returning null or would be more useful.
Description of the Issue and Steps to Reproduce:
create an invalid moment object (e.g. moment(null) or moment("0000-00-00"))
call toISOString on the invalid moment
see the string 'Invalid Date' is returned
Environment:
Chrome on Fedora

I think returning null is probably reasonable here.

Closed in favor of #3710


Copying audio only works after opening original stream once

go2rtc version: 1.6.0
config:
streams:
  camera_01:
    - rtsp://<IP_ADDRESS>/Streaming/Channels/101
  # Used to discard audio track, workaround for:
  # https://github.com/AlexxIT/go2rtc/issues/198
  camera_03_internal:
    - rtsp://<IP_ADDRESS>/Streaming/Channels/301
  camera_03:
    - rtsp://<IP_ADDRESS>:8554/camera_03_internal?video
    - rtsp://<IP_ADDRESS>:8554/camera_01?audio

Basically, I want to copy the audio from camera_01 to camera_03, discarding the existing audio from camera_03 (https://github.com/AlexxIT/go2rtc/issues/198).
However, when I first try to stream camera_03, there is no audio. But if I stream camera_01, and unmute the audio, now audio starts working with camera_03 too.
https://github.com/AlexxIT/go2rtc/assets/29582865/a86bee78-97ee-4e2c-a511-44a5bc51e8ec

Is problem relevant on 1.6.2?

Testing, one sec.

Yes, the exact same problem happens with 1.6.2.

Just to update, this still happens on 1.7.0, my config is now:
  # Copy audio from camera_03 to camera_01:
  camera_01:
    -<EMAIL_ADDRESS>    - rtsp://<IP_ADDRESS>:8554/camera_03?audio
  camera_03:
    -<EMAIL_ADDRESS>

It seems that when streaming camera_01, it does not automatically open the stream to camera_03.

One workaround I found was to add the camera_03 from go2rtc to Home Assistant, and enable the preload option, so that go2rtc keeps a stream to it always open.

I did not test explicitly, but with things like #media=video I think this now works as expected.


"NET::ERR_CERT_AUTHORITY_INVALID" in Chrome on macOS

My computer is running macOS version "10.14.5 (18F132)". I'm testing in Chrome version "75.0.3770.142 (Official Build) (64-bit)". Chrome was updated recently, i.e. yesterday, from an unknown earlier version (tho fairly recent I think).
Several days ago mkcert seemed to be working as expected. Today I get the error mentioned in the title.
I was able to get it working again by manually adding the certificate to my "login" "Certificates" in the Keychain Access app by following the steps in this answer to the following Super User question:

ssl - How do I deal with NET:ERR_CERT_AUTHORITY_INVALID in Chrome? - Super User

This might be related to this recently opened issue:

"Certificate is not standards compliant" on macOS Catalina · Issue #174

sane problem here!

Same problem

In my case works on MacOS (Mojave) but not on Ubuntu 1

Please say more about how you're doing your testing @daquinoaldo - and this is mkcert v1.4.0 true?
BTW, I'm quite sure this is a dup of https://github.com/FiloSottile/mkcert/issues/174 and this one should be closed.

My experience testing on Ubuntu 19.04 is that both Chromium and Firefox accept the not-before-June-1 certs generated by mkcert v1.4.0. @daquinoaldo if you look at the "Not-valid-before" in your browser's presentation of the cert and it was generated by v1.4.0, you should see May 31, 2019 or June 1, 2019, depending on your timezone.

@rfay sorry, my fault: I changed laptop and I forgot to install libnss3-tools.

@rfay I'm less sure this a duplicate of #174 – for one the error is different. The error I observed seems more 'severe'.

I use the Chrome official build on macOS quite successfully with mkcert on macOS.  Daily. And wasn't having any trouble with v1.3.0. I wonder what this is.

I'm having this issue on macOS 10.14.6 in Safari, Chrome and Firefox after a fresh install of macOS. None of the suggested fixes work for me.

@mrtimp Please confirm that you are using mkcert v1.4.0, and you ran mkcert -install and then created new certs with mkcert v1.4.0?

Apologies @rfay, turned out that I wasn't mounting the newly created certificates into my container, it was using the certificates from a previous install.  Once I spotted that the serial number on the certificate didn't match I knew where the issue was.
Cheers for the prompt reply :-)

I don't have any idea what this would be due to. It looks like it hasn't been happening much recently though? If anyone is still experiencing this, please post exact Chrome, macOS, and mkcert versions, as well as the error screenshot.

@FiloSottile This is happening for me using mkcert v1.4.0, Chrome Version 78.0.3904.87 (Official Build) (64-bit), on MacOS Catalina v10.15.

@rushi If you still need to proceed, try to Enable this flag
chrome://flags/#allow-insecure-localhost

@FiloSottile Unfortunately I'm having the same issue with mkcert v1.4.0, Chrome 78.0.3904.97 (Official Build) (64-bit), on MacOS Mojave 10.14.6

@osadchiynikita Your tip sounded promising but unfortunately didn't do the trick for me. Thanks though.

same here

mkcert 1.4.1 (brew)
mac os catalina 10.15.1
Chrome 78.0.3904.108 (64bit) (+Firefox, Firefox Dev, Chrome Canary, ...)

@FiloSottile This is happening for me using mkcert v1.4.0, Chrome Version 78.0.3904.87 (Official Build) (64-bit), on MacOS Catalina v10.15.

My problem was resolved and it was user error. Bad configuration in Apache

I still haven't been able to ever reproduce this.
Here's some more info that might help if anyone who's encountering this wants to report it:

output of security dump-trust-settings and security dump-trust-settings -d
screenshot of the certificate viewer (click on the lock > click on "Certificate")
output of cat "$(mkcert -CAROOT)/rootCA.pem"

I had the same error, then tried all over again and it worked. It turned out the first time I created the certs (mkcert mydomain.com xxx) with sudo (Which obviously did not find the CA)

Closing as this has not occurred in a while. I suspect these were various forms of operational issues where the root did not end up installed, or the certificate did not end up loaded in the web server.
If anyone were to encounter this error again, please open a new issue and provide the details listed here:
https://github.com/FiloSottile/mkcert/issues/180#issuecomment-653149738

I had the same error, then tried all over again and it worked. It turned out the first time I created the certs (mkcert mydomain.com xxx) with sudo (Which obviously did not find the CA)

Yep, I was having 2 issues:

I was using sudo

I was creating the certs in /home/me/code/ssl  while the local CA is sittiing at /home/me/.local/share/mkcert

Generating the certs in /home/me without sudo and the copy them to /home/me/code/ssl works great.

I am also having this issue on Ubuntu 16.04. I've tried doing the above, but maybe I'm doing something wrong since I might not be using it for its intended purpose.
Essentially, I have a NUC that I use as a server, and I have my laptop.
I'm running some services on my NUC and am proxying them behind traefik.
I am using Pihole as my DNS provider, and configured it so that nuc.lan points me to my traefik instance.
On my NUC, I have installed mkcert (libnss3-tools) and didn't use sudo when I ran:
mkcert -install. I just ran it again and am seeing:
The local CA is already installed in the system trust store! 👍
The local CA is already installed in the Firefox and/or Chrome/Chromium trust store! 👍

Then I ran:
mkcert nuc.lan '*.nuc.lan' localhost <IP_ADDRESS> ::1
The following files are created:

nuc.lan+4-key.pem
nuc.lan+4.pem

Then in my Traefik I set my TLS certificates to be the ones that mkcert created:
tls:
  certificates:
    - certFile: /etc/certs/htpc.lan+4.pem
      keyFile: /etc/certs/htpc.lan+4-key.pem

In my browser(s), I see some variation of the same thing:
Issued by: mkcert eitan@nuc (Eitan R)
"eitan@nuc (Eitan R)" certificate is not trusted.

Am I missing something here?

@CodyEddings I am having the same issue, where did you run mkcert -install ? inside command prompt? I am using Ubuntu 20.04 as a local apache server

@CodyEddings that command solves my problem on Windows, thanks.
@wkdcode-liam run it on the command prompt. If you are using docker, don't generate the certs on the container, generate on your local OS and use a volume to mount the certificates on the  container

i use nginx in wsl2 localy. Got same error. It is fixed when:

install mkcert on windows (powershell)
mkcert -install (powershell)
mkcert example.com (powershell)
copy certs from windows in wsl and use them in nginx

tks @Valikkun, you solved my problem!

I had also faced the same issue, however, I had not run the mkcert -install command before creating the certificate.

For those who use Windows Subsystem for Linux (WSL)
Today, I found the same issue, and the tips from @Valikkun helped me understand the problem.
When we use a Linux environment inside Windows, we need to remember that it’s just a module, so it’s necessary to create a trusted certificate in the base OS (Windows) and share it, as @FiloSottile says here.

(PowerShell) install mkcert on Windows
(PowerShell) Run mkcert -install
(PowerShell) Run mkcert localhost or any other domain
(PowerShell) Run mkcert -CAROOT to get the location of the root CA inside Windows
(Bash) Run mkcert -CAROOT to get the location of the root CA inside WSL
(Bash) cp -r <WIN_CAROOT_FOLDER> <LINUX_CAROOT_FOLDER>
(Bash) Run mkcert -install

After that, all secure!

My issue was with Next.js using HTTPS during development, being unable to validate the SSL certificates inside WSL.
  "scripts": {
    "dev": "next dev --experimental-https --experimental-https-key ./certificates/localhost-key.pem --experimental-https-cert ./certificates/localhost.pem",
    "build": "next build",
    "start": "next start"
  },


Update @tanstack/virtual to the latest version

Resolves #204
Resolves #121

@vitPinchuk Please add demonstrated dashboard to verify Stack overflow issue.

@vitPinchuk Please add demonstrated dashboard to verify Stack overflow issue.

I updated the dashboard I was using. It is Performance 10k.
And I repeated the steps from the issue description over time, going to settings or displaying the panels in view mode. After upgrading to 3.10.8, the Stack overflow issue could not be reproduced


[REP] AWS accelerators trn1_inf support

Details
This enhancement proposal briefly talks about AWS accelerators (Trainium/Inferentia) support on Ray.
Related
33504

Will take a first round review this weekend!

looks there are two main questions:

should we use a different resource name other than GPU?

this is mainly because ray train code are expected no code change if GPU is available. it seems not the case for AWS’s accelator (requries code change). If we want to stick with GPU, we should have a way to differentiate nvidia GPU from other xla accelators.

does all xla devices follow the same pytorch API?

this is somewhat related to the previous question. I assume it's the case, and we should make sure the API works out of box for other xla devices, like TPU

Thanks for the initial review.

+1 to that, I'm open for adding new predefined resource-type if aws_accelerators doesn't fit as GPU. The only counterpart to that is per this docs we treat any other accelerator as GPU.
AWS expects users to install a custom built torch_xla. Implies, torch_xla_neuron may not support some of the APIs but the package follows all the API standards listed by open-source torch-xla.

looks there are two main questions:

should we use a different resource name other than GPU?

this is mainly because ray train code are expected no code change if GPU is available. it seems not the case for AWS’s accelator (requries code change). If we want to stick with GPU, we should have a way to differentiate nvidia GPU from other xla accelators.

does all xla devices follow the same pytorch API?

this is somewhat related to the previous question. I assume it's the case, and we should make sure the API works out of box for other xla devices, like TPU

@scv119 Checking if we got enough quorum on adding num_neuron_cores as pre-defined resource? Thanks


Very Basic 'How to Use' Accuracy example is not runnable if I only install PyTorch; error may relate to multi-dispatch behaviour

Describe the bug
I try to run example in doc of 'How to use', I only install np and torch in my env.
from mmeval import Accuracy
import numpy as np

accuracy = Accuracy()
labels = np.asarray([0, 1, 2, 3])
preds = np.asarray([0, 2, 1, 3])
accuracy(preds, labels)
# {'top1': 0.5}

And I got the error msg:
Patch `plum.type.TypeMeta` with singleton failed, raise error: module 'plum.type' has no attribute 'TypeMeta'. The multiple dispatch speed may be slow.
Patch plum Type with hash value cache failed, raise error: cannot import name 'Dict' from 'plum.parametric' (/anaconda/envs/onemodel/lib/python3.8/site-packages/plum/parametric.py). The multiple dispatch speed may be slow.
Traceback (most recent call last):
  File "test_mmeval.py", line 8, in <module>
    accuracy(preds, labels)
  File "/anaconda/envs/onemodel/lib/python3.8/site-packages/mmeval/core/base_metric.py", line 105, in __call__
    self.add(*args, **kwargs)
  File "/anaconda/envs/onemodel/lib/python3.8/site-packages/mmeval/metrics/accuracy.py", line 191, in add
    corrects = self._compute_corrects(predictions, labels)
  File "/anaconda/envs/onemodel/lib/python3.8/site-packages/plum/function.py", line 419, in __call__
    return self._f(self._instance, *args, **kw_args)
  File "/anaconda/envs/onemodel/lib/python3.8/site-packages/plum/function.py", line 342, in __call__
    self._resolve_pending_registrations()
  File "/anaconda/envs/onemodel/lib/python3.8/site-packages/plum/function.py", line 220, in _resolve_pending_registrations
    signature = extract_signature(f, precedence=precedence)
  File "/anaconda/envs/onemodel/lib/python3.8/site-packages/plum/signature.py", line 187, in extract_signature
    for k, v in typing.get_type_hints(f).items():
  File "/anaconda/envs/onemodel/lib/python3.8/typing.py", line 1264, in get_type_hints
    value = _eval_type(value, globalns, localns)
  File "/anaconda/envs/onemodel/lib/python3.8/typing.py", line 270, in _eval_type
    return t._evaluate(globalns, localns)
  File "/anaconda/envs/onemodel/lib/python3.8/typing.py", line 518, in _evaluate
    eval(self.__forward_code__, globalns, localns),
  File "<string>", line 1, in <module>
NameError: name 'oneflow' is not defined

Indicating oneflow is not defined.
And I use my debugger try to debug, and found the problem is in accuracy.py L248
@overload  # type: ignore
@dispatch
def _compute_corrects(  # type: ignore
    self, predictions: Union['oneflow.Tensor', Sequence['oneflow.Tensor']],
    labels: Union['oneflow.Tensor',
                  Sequence['oneflow.Tensor']]) -> 'oneflow.Tensor':

when the dispatch try to decorate the _compute_corrects related to oneflow.
And I go deeper to dispatch, found that in dispatcher.py L176,
try:
    module = importlib.import_module(module_name)
    resolved_type = getattr(module, module_attr_basename)
except Exception as e: #L176
    if importable_name not in self._unimportable_types:
        logger.debug(
            f"Unimportable: '{importable_name}', raise error: {e}.")
        resolved_type = type(importable_name, (), {})
        self._unimportable_types[importable_name] = resolved_type
    else:
        resolved_type = self._unimportable_types[importable_name]
return resolved_type

this except should have caught the ModuleNotFoundError and solve this, but the error is not caught and I totally have no idea why.
Reproduction

What command or script did you run?

from mmeval import Accuracy
import numpy as np

accuracy = Accuracy()
labels = np.asarray([0, 1, 2, 3])
preds = np.asarray([0, 2, 1, 3])
accuracy(preds, labels)
# {'top1': 0.5}

plum-dispatch released its 2.0.0 version, which breaks something. We have temporarily fixed this issue in PR #108 and you can  reinstall plum-dispatch < 2.0 to solve this for now.
We will try to figure it out and  adapt to plum-dispatch >= 2.0.0 in the future.


Make network_config_path an Option

Closes #5611.

don

Ah! Actually that was what I was thinking about. The only occurrence of it I saw was to create the directory. Good to hear that it will finally be used.


Add instructions to install "vagrant-disksize" plug-in

Add instructions to install "vagrant-disksize" plug-in in order to avoid "Unknown configuration section 'disksize'." error in Vagrantfile.

Thanks for the contribution!


Bash, C, C++, C#, Java, Ruby, Coffeescript,

Great work!
Why not try some new way of printing hello world? Like via some emojis 😉


Test check_event_allowed

Should be functionally equivalent to https://github.com/matrix-org/synapse-dinsic/blob/dd19126ae1fdd0f92ab8e550dd9d96f63568d9c5/tests/rest/client/test_room_access_rules.py#L236-L856
The only difference with the existing tests in synapse-dinsic is that it doesn't test things around the room's visibility in the room directory, that's because I plan on adding tests for that in a separate PR.

Heads up while replying to a comment in #4 I realised there's no test around history visibility, so I added one in https://github.com/vector-im/synapse-room-access-rules/pull/3/commits/74e9d0b5bdb724a50badfcaaf8c4ae69408b33f4. It shouldn't add much review load though.