[Bug] Traefik takes as Certificate main name, a random san name!

Welcome!

[X] Yes, I've searched similar issues on GitHub and didn't find any.
[X] Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What did you do?
### Example 1:
[tls.stores]
  [tls.stores.default.defaultGeneratedCert]
    resolver = "lets-encrypt"
    [tls.stores.default.defaultGeneratedCert.domain]
      main = "jordan.de"
      sans = ["jordan.de", "kalista.de", "*.jordan.de", "*.kalista.de"]

### Example 2:
[http.routers.kerio-web-jordan]
  rule = "Host(`mail.jordan.de`)"
  entrypoints = ["websecure"]
  service = "kerio-srv-web"
  [http.routers.kerio-web-jordan.tls]
    certResolver = "lets-encrypt"
    [[http.routers.kerio-web-jordan.tls.domains]]
        main = "mail.jordan.de"
        sans = ["mail.jordan.de", "jordan.de", "mail.srv.jordan.de"]

What did you see instead?
### ACME Store:
### Example 1:
This is the result of Example 1 above:
      {
        "domain": {
          "main": "*.jordan.de",
          "sans": [
            "*.kalista.de",
            "jordan.de",
            "jordan.de",
            "kalista.de"
          ]
        },
        "certificate": .....

### Example 2:
This is the result of Example 2 above:
      {
        "domain": {
          "main": "mail.srv.jordan.de"
        },
        "certificate": ...

I am using both examples in my config together and i am expecting that traefik generates and uses 2 separate certificates.
Instead, traefik combines them and uses the general certificate for everything, for example: mail.jordan.de
and only a separate certificate for mail.srv.jordan.de
The bigger issue is, that traefik doesn't my defined -> main = "mail.jordan.de"
What version of Traefik are you using?
2.9.5
What is your environment & configuration?
I wrote everything above!
If applicable, please paste the log output in DEBUG level
No response

I have found a workaround, but i think i found also the next bug:
[tls.stores]
  [tls.stores.jordan.defaultGeneratedCert]
    resolver = "lets-encrypt"
    [tls.stores.jordan.defaultGeneratedCert.domain]
      main = "jordan.de"
      sans = ["*.jordan.de"]

  [tls.stores.kalista.defaultGeneratedCert]
    resolver = "lets-encrypt"
    [tls.stores.kalista.defaultGeneratedCert.domain]
      main = "kalista.de"
      sans = ["*.kalista.de"]

[http.routers.kerio-web-jordan]
  rule = "Host(`mail.jordan.de`)"
  entrypoints = ["websecure"]
  service = "kerio-srv-web"
  [http.routers.kerio-web-jordan.tls]
    certResolver = "lets-encrypt"
    [[http.routers.kerio-web-jordan.tls.domains]]
        main = "mail.jordan.de"
        sans = ["mail.jordan.de", "jordan.de", "mail.srv.jordan.de"]

This results in:
        "Store": "default"
      },
      {
        "domain": {
          "main": "*.jordan.de",
          "sans": [
            "jordan.de"
          ]
        },
        "certificate": ......

        "Store": "default"
      },
      {
        "domain": {
          "main": "*.kalista.de",
          "sans": [
            "kalista.de"
          ]
        },
        "certificate": .......

        "Store": "default"
      },
      {
        "domain": {
          "main": "mail.jordan.de",
          "sans": [
            "mail.jordan.de",
            "jordan.de",
            "mail.srv.jordan.de"
          ]
        },
        "certificate": ......

So i have separate certificates, as i wanted.
But there is a bug:
I defined as store name in the config jordan and kalista
But the certificate store name is "Store": "default"
However, i got it working for me and hope that helps someone either!

Hello @Ramalama2,
Indeed, there is still a restriction in the way to manage the stores in Traefik as mentioned in the documentation:

Any store definition other than the default one (named default) will be ignored, and there is therefore only one globally available TLS store.

I hope it answers your question.
I close the issue, feel free to reach out to us if you want to re-open it.

Hello @Ramalama2,
Indeed, there is still a restriction in the way to manage the stores in Traefik as mentioned in the documentation:

Any store definition other than the default one (named default) will be ignored, and there is therefore only one globally available TLS store.

I hope it answers your question. I close the issue, feel free to reach out to us if you want to re-open it.

Hey @nmengin thanks for the reply, i though anyway that no one would reply on this.
The main "Bug" is still there, with Sans and the Main name.
The issues afterwards, are not a big deal.
Actually i found a nice workaround that i wanted to describe here for others. Which makes the bug on the second/third post obsolete.
However, the first one with the sans as name should be fixed 🙈

Hello @Ramalama2,
Thank your for the feedback, I'd like to have more information about your us case.

The main "Bug" is still there, with Sans and the Main name.

Could you explain why it's a problem? Indeed, the Main domain and the SANs are inspected during the TLS handshake, so whatever the order, your TLS certificate is valid.

So i have separate certificates, as i wanted.

Why is it important to you?
Indeed, when Traefik handles a TLS connection, it checks every domain from each certificate put into the TLS store to validate the connection. So, whatever the certificate contains your domain, Traefik validates it.

Hi @nmengin
Thanks for taking it seriously:-)
For the first, you're actually right, for the functionality of traefik it doesn't make a difference if the -main is one of the san names.
But there are 2 reasons that makes it a little confusing.

cert-dumper looks at the json files and export what is defined as main name.
The documentation, what i mean is, if -main and -sans doesn't make a difference in the config, why it should be there? Then those could be simply combined into -domains or something like that.

For the second question "why i wanted them separated".
I share the certificates with my Mailserver.
Using a wildcard certificate in a Mailserver is not recommended. Some mailservers add a score because of that.

So i need an mydomain.tld + mail.mydomain.tld certificate for the Mailserver
And an mydomain.tld + *.mydomain.tld for my "catchall, priority 1" webserver behind traefik.

For 1, mail.domain.tld is proxied to my Mailserver Webinterface and additionally that same certificate is used on the Mailserver itself through cert-dumper.
(The Mailserver exposes exchange services and smtp with that certificate) (Kerio connect)
Then i have cloud.mydomain.tld + cloud.otherdomain.tld behind traefik (nextcloud docker container).
But here traefik uses sometimes *.mydomain.tld instead of the cloud.mydomain.tld certificate.

which is tbh not a big deal either

However, the biggest issue is mydomain.tld:
This gets routed through "catchall priotity 1" to the nginx webserver described as point 2 above.
But sometimes for mydomain.tld traefik uses the "mydomain.tld + mail.mydomain.tld" certificate instead of "mydomain.tld + *.mydomain.tld" certificate.
The problem with that is, that people that are visiting mydomain.tld, just need to look into the certificate and they will know what else im hosting behind the proxy.
And that information could be used to attack the services.
It was a simple description, but i have a lot more services and domain names and certificates.
I think tbh, it would be actually a lot easier if i post my configs, as they are pretty simple and more understandable.
On the other side, i got it actually working as i wanted. So this isn't a huge deal either.
But what i made feels more like some workarounds for everything, that will definitively break in the future 😂

traefik.toml
[global]
  checkNewVersion = true
  sendAnonymousUsage = false

[entryPoints]
  [entryPoints.web]
    address = ":80"
    [entryPoints.web.http.redirections.entryPoint]
      to = "websecure"
      scheme = "https"

  [entryPoints.websecure]
    address = ":443"

[providers.docker]
  endpoint = "unix:///var/run/docker.sock"
  exposedByDefault = false
   watch = true
   network = "web"

[providers.file]
  filename = "traefik_dynamic.toml"
  directory = "traefik.d"
  watch = true

[log]
  level = "ERROR"

[api]
  dashboard = true

[certificatesResolvers.wildcard-storage.acme]
  email =<EMAIL_ADDRESS>  storage = "/certs/acme-wildcard.json"
  [certificatesResolvers.wildcard-storage.acme.dnsChallenge]
    provider = "ovh"
    delayBeforeCheck = 10

[certificatesResolvers.default-storage.acme]
  email =<EMAIL_ADDRESS>  storage = "/certs/acme-default.json"
  [certificatesResolvers.default-storage.acme.dnsChallenge]
    provider = "ovh"
    delayBeforeCheck = 10

[certificatesResolvers.internal-storage.acme]
  email =<EMAIL_ADDRESS>  storage = "/certs/acme-internal.json"
  [certificatesResolvers.internal-storage.acme.dnsChallenge]
    provider = "ovh"
    delayBeforeCheck = 10

traefik.d/certs.toml
[tls.options]
  [tls.options.default]
    minVersion = "VersionTLS12"

[tls.stores]
  [tls.stores.jordan.defaultGeneratedCert]
    resolver = "wildcard-storage"
    [tls.stores.jordan.defaultGeneratedCert.domain]
      main = "jordan.de"
      sans = ["*.jordan.de"]

  [tls.stores.kalista.defaultGeneratedCert]
    resolver = "wildcard-storage"
    [tls.stores.kalista.defaultGeneratedCert.domain]
      main = "kalista.de"
      sans = ["*.kalista.de"]

  [tls.stores.pupsi.defaultGeneratedCert]
    resolver = "wildcard-storage"
    [tls.stores.pupsi.defaultGeneratedCert.domain]
      main = "pupsi.de"
      sans = ["*.pupsi.de"]

traefik.d/middlewares.toml
[http.middlewares]

  [http.middlewares.rate-limit.rateLimit]
    average = 100
    burst = 50

  [http.middlewares.rfc1918.ipWhiteList]
    sourceRange = ["<IP_ADDRESS>/24", "<IP_ADDRESS>/24", "<IP_ADDRESS>/24", "<IP_ADDRESS>/24"]

  [http.middlewares.authelia.forwardAuth]
    address = "http://authelia:9091/api/verify?rd=https://auth.jordan.de"
    trustForwardHeader = true
    authResponseHeaders = ["Remote-User", "Remote-Groups", "Remote-Name", "Remote-Email"]

  [http.middlewares.nextcloud-redirect.redirectRegex]
    permanent = true
    regex = "https://(.*)/.well-known/(card|cal)dav"
    replacement = "https://${1}/remote.php/dav/"

  [http.middlewares.nextcloud-headers.headers]
      accessControlMaxAge = 100
      hostsProxyHeaders = ["X-Forwarded-Host"]
      stsSeconds = 155520011
      stsIncludeSubdomains = true
      stsPreload = true
      forceSTSHeader = true
      customFrameOptionsValue = "SAMEORIGIN"
      referrerPolicy = "same-origin"
      [http.middlewares.nextcloud-headers.headers.customResponseHeaders]
        X-Frame-Options = "SAMEORIGIN"

  [http.middlewares.chain-authelia.chain]
    middlewares = [ "rate-limit", "authelia"]

  [http.middlewares.chain-authelia-rfc1918.chain]
    middlewares = [ "rate-limit", "rfc1918", "authelia"]

  [http.middlewares.chain-nextcloud.chain]
    middlewares = [ "nextcloud-headers", "nextcloud-redirect"]

traefik.d/routers.toml
[http.routers.api]
  rule = "Host(`proxy.srv.jordan.de`)"
  entrypoints = ["websecure"]
  middlewares = ["chain-authelia-rfc1918@file"]
  service = "api@internal"
  priority = 40
  [http.routers.api.tls]
    certResolver = "internal-storage"

[http.routers.kerio-web-jordan]
  rule = "Host(`mail.jordan.de`)"
  entrypoints = ["websecure"]
  service = "kerio-srv-web"
  priority = 90
  [http.routers.kerio-web-jordan.tls]
    certResolver = "default-storage"
    [[http.routers.kerio-web-jordan.tls.domains]]
        main = "mail.jordan.de"
        sans = ["mail.jordan.de", "mail.srv.jordan.de"]

[http.routers.kerio-web-kalista]
  rule = "Host(`mail.kalista.de`)"
  entrypoints = ["websecure"]
  service = "kerio-srv-web"
  priority = 90
  [http.routers.kerio-web-kalista.tls]
    certResolver = "default-storage"

[[http.services.kerio-srv-web.loadBalancer.servers]]
  url = "http://<IP_ADDRESS>:8800"

Docker Labels:
Authelia Container
-l traefik.enable=true \
-l traefik.http.routers.authelia.rule="Host(\`auth.jordan.de\`)" \
-l traefik.http.routers.authelia.priority=100 \
-l traefik.http.routers.authelia.entrypoints=websecure \
-l traefik.http.routers.authelia.middlewares="rate-limit@file" \
-l traefik.http.routers.authelia.tls.certresolver=default-storage \
-l traefik.http.services.authelia.loadbalancer.server.port=9091 \

Nextcloud Container
-l traefik.enable=true \
-l traefik.http.routers.nextcloud.rule="Host(\`cloud.jordan.de\`,\`cloud.kalista.de\`)" \
-l traefik.http.routers.nextcloud.priority=80 \
-l traefik.http.routers.nextcloud.entrypoints=websecure \
-l traefik.http.routers.nextcloud.middlewares="chain-nextcloud@file" \
-l traefik.http.routers.nextcloud.tls.certresolver=default-storage \
-l traefik.http.services.nextcloud.loadbalancer.server.port=80 \

Nginx Container:
traefik.enable=true \
-l traefik.http.routers.nginx.rule='HostRegexp(`{domain:.+}`)' \
-l traefik.http.routers.nginx.priority=1 \
-l traefik.http.routers.nginx.entrypoints=websecure \
-l traefik.http.routers.nginx.tls.certresolver=wildcard-storage \
-l traefik.http.services.nginx.loadbalancer.server.port=80 \

Maybe that is easier to understand with the configs.
I have a lot more docker containers tho, but didn't wated to spam here.
Don't see this please as if i try to get help or something, its just a reply with trying to "Visualize" why separate certificates would be nice.
And why -main and -sans should work as expected and not random.
Thanks @nmengin really appriciated what you do here :-)
I played with nginx proxy manager some days ago, mainly because i need to use multiple dns challange accounts for different domains, but ugh there are so much other bugs xD
So traefik is actually hella amazing, just a bit limiting here xD
However, just wanted to thank you for this amazing project and your time.
Actually, if you dont want to bother, you dont need to reply, as my issues are actually not thaaat important.
Cheers


Unable to use input or element; is this by design?

Looking at the source, I'm not sure if this is by design or not. Consider the following:
class LoginPage
  include Watirsome

  element :name, id: 'name'
  # input :name, id: 'name'
  # text_field :name, id: 'name'
end

Watirsome.settable << :input
Watirsome.settable << :element

browser = Watir::Browser.new
browser.goto('http://localhost:9292/practice')
page = LoginPage.new(browser)
page.name_element.set 'admin'

This does not work. I get the error:
in `extract_selector': expected Hash or (:how, 'what'), got ["admin"]

The exact same thing happens with the input line if you comment it out and change the last line above to page.name_input.set 'admin'. Only the third commented line in the class works.
I then tried these variations (using = rather than set):
page.name_input = 'admin'
page.name_element = 'admin'

In both cases, I get the error:
undefined method `name_input=' for #<LoginPage:0x007f977538fd60> (NoMethodError)

I realize it works with the text_field setting and I can just do that. But I'm not sure if the other approaches should work. In particular, I thought element in Watir-WebDriver could stand in for any element at all.

If you plan to just call #set on element, you don't need to modify Watirsome.settable at all. The reason why it fails for you is probably because watir-webdriver doesn't have #set method on all elements.
You could try smth like this:
class LoginPage
  include Watirsome

  element :name, id: 'name'
  input :name, id: 'name'
end

browser = Watir::Browser.new
browser.goto('http://localhost:9292/practice')
page = LoginPage.new(browser)
page.name_element.send_keys 'admin'
page.name_input.send_keys 'admin'

Just call #send_keys on elements.
If you still want to use settable accessor, it should work with something like this (though I advise to use the first option):
# be sure to call it before login page is required
Watirsome.settable << :input
Watirsome.settable << :element

class LoginPage
  include Watirsome

  element :name1, id: 'name'
  input :name2, id: 'name'
end

browser = Watir::Browser.new
browser.goto('http://localhost:9292/practice')
page = LoginPage.new(browser)
page.name1 = 'admin'
page.name2 = 'admin'


General doubt no issue

Hey! I was trying few things on the code, do you think its posible to modify players position?

It looks like it would be, if you send a actor_update to the player you want to move with an actor_update that has the players actor ID

Seems to work fine, but when it teleports the player it resets back its position where it was instantly, maybe its because of how client sided its managed hm

Would it be possible to send a packet to the client that changes their position, or does the game need to be modded to support such info?


Dpad UI movement not working

As the title says, I can't use the DPad to navigate the inventory despite having the bindings set up for it.

i've been having the exact same issue, and it is really annoying as using the dpad for the inventory is very important to me.

I do, I'll have to test that out today

Is this still a problem?


How can i add a custom sized image at the top of the navigation layout

I want to place an image at the top of the navigation layout.I know how to do it but that takes the whole part of the top navigation layout.I want  the image to be of only a certain size and have some flexibility on positioning it at the top.For example a circular or rectangular custom sized image that takes only certain part of the top navigationlayout and not whole.I am attaching the screenshot and also part of the code:
:
name: "main"
lid1:lid1
NavigationLayout:
    id:lid1
    MDNavigationDrawer:

        NavigationDrawerSubheader:
            text:'Menu'
        NavigationDrawerIconButton:
            icon:'information'
            text:'About'
            on_release:
                app.root.current='ABOUT'
                root.manager.transition.direction = "left"
        NavigationDrawerIconButton:
            icon:'account'
            text:'Author'
            on_release:
                app.root.current='AUTHOR'
                root.manager.transition.direction = "left"

        NavigationDrawerIconButton:
            icon:'file-video'
            text:'Demo'

on_release:
app.root.current='DEMO'
root.manager.transition.direction = "left"

@atheistrepublic I do not understand what you want.

I want something like this

Your code is deprecated! Similar constructions are not used in KivyMD version 0.103.0!

https://github.com/HeaTTheatR/KivyMD/wiki/Components-Navigation-Drawer#using-mdnavigationdrawer-has-changed

Thanks


Request for clarification on how sessions are handled during key rollover

From the documentation I understand that only one key can be active at a time. In the scenario where someone authenticates against key A, gets token, then the key rollover happens so that key B is active does the session authenticated with key A remain valid and if so for how long?

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: ed6bf22d-ad0e-b873-f772-04be8d28d76a
Version Independent ID: 58005060-12f3-5d76-f0ac-d59f6806a229
Content: Policy keys overview - Azure Active Directory B2C
Content Source: articles/active-directory-b2c/policy-keys-overview.md
Service: active-directory
Sub-service: b2c
GitHub Login: @msmimart
Microsoft Alias: mimart

@erikanderson
Thanks for your feedback! We will investigate and update as appropriate.

@erikanderson Which session are you referring to? Is it the OWIN session (ASP.NET)?

Since I have not heard from you I will proceed to close this thread. Please ask a new question in Microsoft Q&A or create a new issue if needed.

Sorry for not responding to this. I was thinking about it the wrong way. B2C doesn't provide session management, just the authorization code or token which shouldn't be affected by a key rollover


VlcContext.StartupOptions missing

How can I change StartupOptions of VLC control? In one of my projects I'm using older version of Vlc.DotNet library to play video on multiple screens (windows) by wall filter:
VlcContext.StartupOptions.AddOption("--vout-filter=wall");
VlcContext.StartupOptions.AddOption("--wall-cols=2");
VlcContext.StartupOptions.AddOption("--wall-rows=2");

How can I achieve this behaviour now? Is there any method to set StartupOptions???

+1 for this. It's a nightmare trying to debug my option strings without the logging console.

When I use Play method, the second parameter is string array for Options, I use ":" instead "--". eg: ":start-time=10", ":vout-filter=wall"...

You need to initialize VlcMediaPlayerOptions before the initialization of your control. Play() 's second option is made for passing options that are specific to the media.


fix: stats and gorm upgrade

fixes https://github.com/evcc-io/evcc/issues/15472

🆙 gorm upgrade
🧹 simplify sql query code
✅ reenabled skipped tests (not sure why they were disabled)

The actual issue with the gorm update was a behaviour change in .Scan which we call multiple times with the same reference for populating different parts of the result. Switched to single value assignment to circumvent this.

The actual issue with the gorm update was a behaviour change in .Scan which we call multiple times with the same reference for populating different parts of the result

Thats unexpected for a bugfix release. Is this documented or did you open an issue?

Thats unexpected for a bugfix release. Is this documented or did you open an issue?

No, just fixed our issue.

Wäre schön noch ein Issue aufzumachen- sonst ändert sich das demnächst wieder unerwartet zurück?

 Scheint, als ob das Resetting gewolltes Verhalten ist.
https://github.com/go-gorm/gorm/pull/7061


Only receiving GARTrackingStatePaused for garSession

Hello,
I've been struggling to get the cameraGeospatialTransform from the garFrame in my own app. I've gone back and reviewed the sample ARCore app (Obj-C version) and can receive the transform data properly there.  Please see the init code below.
func initialize() {
  self.scnView = ARSCNView(frame: self.frame)
  self.scnView?.translatesAutoresizingMaskIntoConstraints = false
  self.scnView?.automaticallyUpdatesLighting = true
  self.scnView?.autoenablesDefaultLighting = true
  self.scnView?.debugOptions = [
          .showFeaturePoints,
          .showWorldOrigin
      ]
  self.arKitSession = self.scnView?.session
  self.arKitSession?.delegate = self

  self.arConfig = ARWorldTrackingConfiguration()
  self.arConfig?.worldAlignment = .gravity

  if let config = arConfig {
          self.arKitSession?.run(config, options: .removeExistingAnchors)
          self.setupGARsession()
  }
}

private func setupGARsession() {
    do {
        self.garSession = try GARSession(
            apiKey: "<omitted>", bundleIdentifier: Bundle.main.bundleIdentifier ?? "<omitted>"
        )
        guard
            self.garSession?.isGeospatialModeSupported(GARGeospatialMode.enabled) == true
        else {
            throw NSError(domain: "Geospatial not supported", code: 0)
        }
        garSession?.delegate = self
        garSession?.delegateQueue = .main

        var error: NSError? = nil
        var config = GARSessionConfiguration()
        config.geospatialMode = .enabled

        self.garSession?.setConfiguration(config, error: &error)

        if error != nil {
            throw NSError(domain: error?.localizedDescription ?? "config error", code: 0)
        }

        if let lastCoordinate = viewModel.currentLocation?.coordinate {
            checkVPS(currentLocation: lastCoordinate)
        }
    } catch {
        Debug.log(.error, message: "Error initializing google AR session with error: \(error)")
        debugLabel.text = "Error initializing google AR session with error: \(error.localizedDescription)"
    }
}

func checkVPS(currentLocation: CLLocationCoordinate2D) {
    garSession?.checkVPSAvailability(coordinate: currentLocation) { availability in
        self.viewModel.vpsAvailability = availability

        if availability != .available {
            DispatchQueue.main.async {
                self.debugLabel.text = self.vpsAvailabilityString(availability)
            }
        }
    }
}

func session(_ session: ARSession, didUpdate frame: ARFrame) {
    if #available(iOS 16.0, *) {
        if frame.camera.trackingState != .normal { return }
    }

    guard let coordinate = viewModel.currentLocation?.coordinate else { return }
    guard self.viewModel.vpsAvailability == .available else {
        checkVPS(currentLocation: coordinate)
        return
    }
        self.gAR_frame = try! garSession?.update(frame)
        useGpsOrVps(nil)
}

The useGpsOrVps func check for earthState and trackingState but the tracking always returns as GARTrackingStatePaused any help is welcome, thanks.

Referencing this Swift version example: https://github.com/sinano1107/swift-geospatialapi-example/tree/main , the garSession goes from earthState enabled, localizationState is set to preTracking but then on the next frame update the earthState is no longer enabled.

My issue was that we often have to use GPS location simulation and after turning off location simulation, I began receiving coordinates. I suppose the assumption is that you won't be using the geospatialTransform if you aren't in the area where you plan to use it.


[Improvement] Add copyright check for new files

What would you like to be improved?
We should add a check script to check the copyright of new files.
How should we improve?
We can add a ci task to check  every new file whether has the copyright 2024. For every new file, we can use git to get them.

Can i work on this? Please tell me what is to be done here.

Close since we have the rat plugin in Gradle


Azure-SkuId

We currently have no way to isolate MCA datasets, unsure what needs to be done knowing that we are working on Enterprise Agreements (EA).
Same issue for #203


Add Clams to App Store

Name:  Clams
URL: https://clams.tech/
Description: Accounting platform
Icon: https://clams.tech/favicon.png

Instructions:
In Clams

Download and open Clams on MacOS, Windows or Linux
Click on "+ Add Connection" and select NWC (Nostr Wallet Connect)

In Alby Hub
3. Click Connect to Clams
4. Set app's wallet permissions (read only recommended)
In Clams
5. Add a label and paste the connection secret from Alby Hub
6. Click "Connect" and then "Save"

I can actually go through and add few more apps

A simple structure of the App Store would help a lot like we have for getalby.com/discover
cc @stackingsaunter


.where is (sometimes) changing Type to Collection

Prerequisites

[X] Write a descriptive title.
[X] Make sure you are able to repro it on the latest released version
[X] Search the existing issues.
[X] Refer to the FAQ.
[X] Refer to Differences between Windows PowerShell 5.1 and PowerShell.

Steps to reproduce
.where is changing the object type to System.Collections.ObjectModel.Collection1[[System.Management.Automation.PSObject, System.Management.Automation, Version=<IP_ADDRESS>0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]]` and trying to call a method on it at least sometimes fails because of this.
# let $db be an object of type [Microsoft.SqlServer.Management.Smo.Database]

# Code that failed just now (but worked previously without error for (at least until now) unknown reasons).
$db.FileGroups.Where{$true}.Files.Where{$true}.Rename('new_name')

$db.FileGroups.Where{$true}.Files.Where{$true}.GetType().FullName
# System.Collections.ObjectModel.Collection`1[[System.Management.Automation.PSObject, System.Management.Automation, Version=<IP_ADDRESS>0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]]

# Interestingly when I now send it through the pipe to an Select-Object it doesn't modify the type.
($db.FileGroups.Where{$true}.Files.Where{$true} | Select-Object).GetType().FullName
# Microsoft.SqlServer.Management.Smo.DataFile

# But even though the type is destroyed this way PowerShell still shows us that the Rename function should exist.
# But as seen in the error attached below it not always is.
$db.FileGroups.Where{$true}.Files.Where{$true}.Rename
#OverloadDefinitions
#-------------------
#void Rename(string newname)
#void IRenamable.Rename(string newname)

# Trying to do an explicit type cast:
([Microsoft.SqlServer.Management.Smo.DataFile]$db.FileGroups.Where{$true}.Files.Where{$true}).Rename('new_name')
# Throws this error:
# InvalidArgument: Cannot convert the "System.Collections.ObjectModel.Collection`1[System.Management.Automation.PSObject]" value of type "System.Collections.ObjectModel.Collection`1[[System.Management.Automation.PSObject, Sy
stem.Management.Automation, Version=<IP_ADDRESS>0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]]" to type "Microsoft.SqlServer.Management.Smo.DataFile".

Expected behavior
.where and plain "Select-Object" not changing the type.

Actual behavior
Types change

Error details
Exception             :
    Type                        : System.Management.Automation.RuntimeException
    ErrorRecord                 :
        Exception             :
            Type    : System.Management.Automation.ParentContainsErrorRecordException
            Message : Method invocation failed because [System.Collections.ObjectModel.Collection`1[[System.Management.Automation.PSObject, System.Management.Automation, Version=<IP_ADDRESS>0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35]]] does not contain a method named 'Rename'.
            HResult : -2146233087
        CategoryInfo          : InvalidOperation: (:) [], ParentContainsErrorRecordException
        FullyQualifiedErrorId : MethodNotFound
        InvocationInfo        :
            ScriptLineNumber : 5
            OffsetInLine     : 19
            HistoryId        : -1
            ScriptName       : C:\Users\user\Desktop\script\main.ps1
            Line             : $db.FileGroups.Where{

            PositionMessage  : At C:\Users\user\Desktop\script\main.ps1:5 char:19
                               +                   $db.FileGroups.Where{
                               +                   ~~~~~~~~~~~~~~~~~~~~~
            PSScriptRoot     : C:\Users\user\Desktop\script
            PSCommandPath    : C:\Users\user\Desktop\script\main.ps1
            CommandOrigin    : Internal
        ScriptStackTrace      : <Removed>
    WasThrownFromThrowStatement : True
    TargetSite                  :
        Name          : CheckActionPreference
        DeclaringType : System.Management.Automation.ExceptionHandlingOps, System.Management.Automation, Version=<IP_ADDRESS>0, Culture=neutral, PublicKeyToken=31bf3856ad364e35
        MemberType    : Method
        Module        : System.Management.Automation.dll
    Message                     : Method invocation failed because [System.Collections.ObjectModel.Collection`1[[System.Management.Automation.PSObject, System.Management.Automation, Version=<IP_ADDRESS>0,
Culture=neutral, PublicKeyToken=31bf3856ad364e35]]] does not contain a method named 'Rename'.
    Data                        : System.Collections.ListDictionaryInternal
    Source                      : System.Management.Automation
    HResult                     : -2146233087
    StackTrace                  :
   at System.Management.Automation.ExceptionHandlingOps.CheckActionPreference(FunctionContext funcContext, Exception exception)
   at System.Management.Automation.Interpreter.ActionCallInstruction`2.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
CategoryInfo          : InvalidOperation: (:) [], RuntimeException
FullyQualifiedErrorId : MethodNotFound
InvocationInfo        :
    ScriptLineNumber : 5
    OffsetInLine     : 19
    HistoryId        : -1
    ScriptName       : C:\Users\user\Desktop\script\main.ps1
    Line             : $db.FileGroups.Where{

    PositionMessage  : At C:\Users\user\Desktop\script\main.ps1:5 char:19
                       +                   $db.FileGroups.Where{
                       +                   ~~~~~~~~~~~~~~~~~~~~~
    PSScriptRoot     : C:\Users\user\Desktop\script
    PSCommandPath    : C:\Users\user\Desktop\script\main.ps1
    CommandOrigin    : Internal
ScriptStackTrace      : <removed>

Environment data
Name                           Value
----                           -----
PSVersion                      7.4.0
PSEdition                      Core
GitCommitId                    7.4.0
OS                             Microsoft Windows 10.0.17763
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           <IP_ADDRESS>
WSManStackVersion              3.0

Visuals
No response

The intrinsic .Where() method:

never changes the type of elements in its input
always wraps its results in a [System.Collections.ObjectModel.Collection[psobject]] collection, even with just one result object (notably even when you use the 'First' option to explicitly request a single object only).

Arguably, calling Select-Object without any arguments should never have been allowed syntactically, but it's too late to change that.
Such a call is an effective no-op (however, due to the use of the pipeline, all output objects receive the mostly-but-not-always-invisible [psobject] wrappers, as discussed in #5579).
In cases where .Where() returns a single-element collection, sending it through the pipeline implicitly sends just that one element itself, given that the collection is auto-enumerated in the pipeline, as most IEnumerables are.
You shouldn't expect to be able to cast [System.Collections.ObjectModel.Collection[psobject]] to a non-collection type (even if that type is that the collection's only element's type), and this applies to other collection (list-like) types too; for instance, [int] $i = @(42) fails as well.
If you expect only one result object, you can simply apply [0] to the .Where() call to extract it.
If you have a strict mode version in effect that prevents access to non-existing collection (list) elements, use .Where(...) | Select-Object -First 1 to avoid errors if the result collection is empty.

Such a call is an effective no-op, well because of the pipe it is not...
The core issue here is that powershell partially thinks that function exists (regardless of the type), but then still fails to actually call it.

well because of the pipe it is not...

Yes - I was referring to the Select-Object call, not to the pipeline behavior in general (which is also explained in my previous comment).

The core issue here is that powershell partially thinks that function exists

In case you're referring to the .Rename() method: it is found and invoked due to member-access enumeration, on every element of the collection returned by .Where().

In case you're referring to the .Rename() method: it is found and invoked due to member-access enumeration, on every element of the collection returned by .Where().

Then there is something wrong with the specific type here. As it is not invoked but fails with the above exception. But adding either a noop Select-Object, and/or manually iterating the list using .foreach always works. Where as relying on the member-access enumeration does not.

I don't have access to a populated [Microsoft.SqlServer.Management.Smo.Database] instance, but one possible explanation is that the collection returned by .Where() contains only a single element that is $null:
# -> "Method invocation failed because [System.Collections.ObjectModel.Collection`1[...]]
# does not contain a method named 'ToUInt16'"
($null).Where({ $true }).ToUInt16($null)

The error message is somewhat unfortunate, however.
The one you get when there is a $null value among other, non-null values is only slightly better:
# -> "InvalidOperation: You cannot call a method on a null-valued expression."
 (42, $null).Where({ $true }).ToUInt16($null)

Note that, unlike in the pipeline, no partial results are reported - the entire operation fails, even though (42).ToUInt16($null) in isolation would succeed.

So - unless your exception has yet another cause - I'd say the only actionable thing here is to ask for the member-access enumeration error messages to be improved.

I don't think this is the same error, as I can ensure you that the input was not $null in the case where the error occurred.

So when the call fails, what do $db.FileGroups.Where{$true}.Files and Get-Member -InputObject $db.FileGroups.Where{$true}.Files return?

A single "Microsoft.SqlServer.Management.Smo.DataFile" object. But it also sometimes succeeds. I wasn't able to find what exactly is different when it fails to when it succeeds. I had it fail and succeed using the same command within the same powershell just to two different times before...

If you can find a reliably reproducible case, I suggest creating a new, properly framed issue.
From what I can tell, the only way to reproduce your symptom is to make .Where() return an empty collection, suggesting a $null-valued input object (or an input object that is an empty enumerable), so I suspect the real problem is with $db.FileGroups.Where{$true}.Files intermittently evaluating to $null.
If your expectation is for the .Where() call to only ever return one object, use [0] before the .Rename() call (or pipe to Select-Object -First 1), which will make it obvious when the problem is lack of input.

Separately, I've created a request to improve the error messages related to member-access enumeration:

#21051

Thanks, maybe the improved error message will help to better debug this issue in the future.
At the moment it is kinda impossible to debug, as even a very simple test case sometimes works and sometimes doesn't.
I had this exact code in use for a few months now and it always worked. Even with the same data. But today I got a bug report for it failing.
I just replaced it with a combination of piping through Select-Object and then also calling the enumerator explicitly.
It works so far, but considering that there is no real consistency to it, it's probably impossible at this point to narrow it down more.
What I got so far:

Same command worked in the past, now doesn't (extra checked git blame, and that code didn't change in a while; Also it is scoped into a script block that doesn't use any global variables and only gets the sqlinstance and strings passed in).
The error occurs on different computers, so it's not just something local (these two weren't in the same domain and also not using the same sql server nor strings for the database rename).
It only occurs with these specific object types. At least I didn't get the error when trying the get-item example.
When just waiting and reexecuting the same command, within the same powershell window, after 30-60 minutes may yield different results (feels like re-rolling the dice).

So maybe the better error message will help. Or someone else that is able to reproduce this issue can provide some feedback.


Add the purpose section to the pull request template

Is your feature request related to a problem? Please describe.

We haven't added a section to link the relevant GitHub issue in the PR template

Describe the solution you'd like

Add the following section at the top in the PR template

Purpose
The purpose of this PR is to fix #

Refer to this PR template

Are you working on it?
No

@tharindu37 can you work on this?

@anjula-sack Sure


Reason for the hash in the URL?

Hey, love the project, but was wondering why you chose to have URL scheme like http://localhost:3000/#/list as opposed to http://localhost:3000/list.
It's a pretty simple change, but I was wondering if you had any thoughts around it.
Anybody wanting to make the change, go to index.js and change the line
import createHistory from 'history/lib/createHashHistory';

to
import { createHistory } from 'history';

Becouse this boilerplate not have server-side rendering with express :( We will fix it in future)


Update backstage-community packages with CLI

Hey, I just made a Pull Request!
Closes #25276
:heavy_check_mark: Checklist

[X] A changeset describing the change and affected packages. (more info)
[ ] Added or updated documentation
[X] Tests for new functionality and regression tests for bug fixes
[ ] Screenshots attached (for UI changes)
[X] All your commits have a Signed-off-by line in the message. (more info)

Can this be re-opened and reviewed please?

@darylgraham @bforbis sorry this slipped through the net whilst I was out on holiday - will get round to reviewing this whilst I'm catching up! :pray:


Update README.md

Found a few spelling errors.. :)

Thanks for you contribution!

You got it. Really cool project!!


Still not using GPU. Throws errors 'torch.ao' module not found.

I tried deep-daze and I switched out torch for the directml pytorch, it just throws multiple pop up boxes at me and then says:
ModuleNotFoundError: No module named 'torch.ao'
I have an okay grip on what I'm doing but I just want to be able to use my gpu! None of the versions of directml have worked at all for me!

I can get screenshots of the pop up boxes if needed

https://imgur.com/a/dyLye2l Here we are! The 3 pop up boxes!

@Adele101 @smk2007 - can you respond, since this is related to PyTorch, not DirectML?

Hi @DillFrescott, It looks like a issue that the torchvison version doesn't match pytorch-directml. Can you try build torchvision from source with your installed torch-directml.

Hi @dillfrescott, torch-directml has moved to a plugin model. Check out the latest release here: torch-directml. The plugin model resolved many of the dependency issues that could cause issues like you saw above. Please take a look and reactivate if you still face any issues using torch.nn with DirectML.
Thanks!

The new package still isn't using my amd gpus. I installed it properly.

@dillfrescott: Want to reopen it? (I don't work on PyTorch, but I see Sheil asked to reactivate if it still had issues)

My issue is that it's not translating Cuda calls in the code it seems like. I couldn't really find any information on whether it's supposed to do that or not.

If it's supposed to be translating them and isn't I guess we should re open this issue

@smk2007 is away. Maybe @linnealovespie would know potential causes? "ModuleNotFoundError: No module named 'torch.ao'"


Update pi colors

Pull Request Test Coverage Report for Build 126

42 of 42 (100.0%)  changed or added relevant lines in 2 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage increased (+0.02%) to 98.112%

Totals

Change from base Build 124:
0.02%

Covered Lines:
2079

Relevant Lines:
2119

💛  - Coveralls


[BUG] Steve does not pass through the warning HTTP response header for Pod creation requests

To support PSAs in the UI, we want to be able to show the warnings when a pod is created that violates a policy (when the policy is set to warn). The warning in the case is returned in the HTTP response Warning header.
e.g. using kubectl:
I1026 10:17:33.559293   68477 request.go:1154] Request Body: {"apiVersion":"v1","kind":"Pod","metadata":{"name":"nginx","namespace":"test"},"spec":{"containers":[{"image":"nginx","name":"nginx","ports":[{"containerPort":80}]}]}}
I1026 10:17:33.559567   68477 round_trippers.go:463] POST https://<IP_ADDRESS>:42239/api/v1/namespaces/test/pods?fieldManager=kubectl-create&fieldValidation=Strict
I1026 10:17:33.559595   68477 round_trippers.go:469] Request Headers:
I1026 10:17:33.559610   68477 round_trippers.go:473]     Accept: application/json
I1026 10:17:33.559694   68477 round_trippers.go:473]     Content-Type: application/json
I1026 10:17:33.559715   68477 round_trippers.go:473]     User-Agent: kubectl/v1.25.3 (linux/amd64) kubernetes/434bfd8
I1026 10:17:33.569440   68477 round_trippers.go:574] Response Status: 201 Created in 9 milliseconds
I1026 10:17:33.569608   68477 round_trippers.go:577] Response Headers:
I1026 10:17:33.569812   68477 round_trippers.go:580]     X-Kubernetes-Pf-Prioritylevel-Uid: 44a18f9b-30fb-4b1e-903a-2aeaf0766cf2
I1026 10:17:33.569897   68477 round_trippers.go:580]     Content-Length: 2064
I1026 10:17:33.569968   68477 round_trippers.go:580]     Date: Wed, 26 Oct 2022 10:17:33 GMT
I1026 10:17:33.570032   68477 round_trippers.go:580]     Audit-Id: 5df0e610-a410-46c2-87bf-4138f4ff5699
I1026 10:17:33.570100   68477 round_trippers.go:580]     Cache-Control: no-cache, private
I1026 10:17:33.570145   68477 round_trippers.go:580]     Content-Type: application/json
I1026 10:17:33.570266   68477 round_trippers.go:580]     Warning: 299 - "would violate PodSecurity \"restricted:latest\": allowPrivilegeEscalation != false (container \"nginx\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container \"nginx\" must set securityContext.capabilities.drop=[\"ALL\"]), runAsNonRoot != true (pod or container \"nginx\" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container \"nginx\" must set securityContext.seccompProfile.type to \"RuntimeDefault\" or \"Localhost\")"
I1026 10:17:33.570332   68477 round_trippers.go:580]     X-Kubernetes-Pf-Flowschema-Uid: 1169dc7f-5866-4db7-bbb2-83411fb968a1
I1026 10:17:33.570641   68477 request.go:1154] Response Body: {"kind":"Pod","apiVersion":"v1","metadata":{"name":"nginx","namespace":"test","uid":"4bdacd71-2a1f-4a34-90c6-51bba51fde33","resourceVersion":"23369","creationTimestamp":"2022-10-26T10:17:33Z","managedFields":[{"manager":"kubectl-create","operation":"Update","apiVersion":"v1","time":"2022-10-26T10:17:33Z","fieldsType":"FieldsV1","fieldsV1":{"f:spec":{"f:containers":{"k:{\"name\":\"nginx\"}":{".":{},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":80,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:enableServiceLinks":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}}}]},"spec":{"volumes":[{"name":"kube-api-access-4kqfk","projected":{"sources":[{"serviceAccountToken":{"expirationSeconds":3607,"path":"token"}},{"configMap":{"name":"kube-root-ca.crt","items":[{"key":"ca.crt","path":"ca.crt"}]}},{"dow [truncated 1040 chars]
Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

When we use the Steve API to create a pod by POSTing to /v1/pods, we do not get the warning header returned in the response.
The warning header needs to be passed through the Steve requests.

@samjustus - Sending this your way for Neo to look at.

@samjustus why does this need a PRD?

@nwmac
@cbron would like to see Will's PRD so we know all the moving parts related to PSAs

@samjustus I don't think this is specific to PSAs - but we will need this to show warnings when the PSA to warn and there is a violation.

Small update, mostly for my own rubber ducking...
In our client that makes the call to k8s, we currently don't set any WarningHandler, which leads us to just ignore warnings that come back on calls that we make.  We may have the option to create our own WarningHandler and maybe somehow include that warning in our response, but I've yet to find a way to make that happen.  So far, I've only managed to get the warning sent to stderr/out as a log entry, but that's obviously not useful for this scenario.
The WarningHandler interface, which seems to be the prescribed way to go about this doesn't seem to fit what we're looking to do here.
// WarningHandler is an interface for handling warning headers
type WarningHandler interface {
	// HandleWarningHeader is called with the warn code, agent, and text when a warning header is countered.
	HandleWarningHeader(code int, agent string, text string)
}

The handler bit seems to get executed at the time the k8s api call returns and before our code has a chance to handle things.
So far, I have not found a place in our code where that header is available for us to grab and stick in our response.
I will consult @cmurphy

https://github.com/kubernetes/client-go/blob/master/dynamic/simple.go#L112 appears to be where the warning header is available, but it is left out of the response, which is only the table object in our case.  I'm not seeing any option available to get the k8s response headers out.  I suppose we could make our own version of this, but maybe there is a better way.

I've posed a question to the client-go gh:  https://github.com/kubernetes/client-go/issues/1185

Based on a kube slack conversation, it sounds like warninghandler is the only option if we want to stick with client-go built-in bits.  Unfortunately, I can't think of a way to make those handlers useful in our context.  If we do need to implement this, I think our remaining option would be to implement our own version of the dynamicResourceClient.
Any thoughts on this @cbron or @cmurphy

One last comment on this for now.  I suppose it would be possible for us to create our own one-off http Client/Request and submit those requests "manually".  Seems a little awkward to forego all the upside of client-go for this case though.  Maybe there is another way to query for these "warning" situations.

Is there a change we could contribute to https://github.com/kubernetes/client-go/blob/master/dynamic/simple.go to let us use WarningHandler from dynamicResourceClient?

I'm not sure if a WarningHandler there would get us what we're looking to do..  Maybe some sort of change that would return more than just the resultant object, but we'd have to do it in a backwards-compatible way.  We should talk more about which options we might have here.  Maybe we can come up with something--sure seems like it would be a useful upstream contrib, but I suppose our use of client-go may be a bit different than most.

The returned APIObject now has a field "Warnings" where the warning headers, if any, will reside.

To test this via curl, you can do the following <adding in your own bearer_token where indicated):
#create namespace
kubectl create namespace testnamespace
#add the restricted label to that namespace
kubectl label --overwrite ns testnamespace pod-security.kubernetes.io/warn=restricted

curl -v -k '<rancher or steve>/v1/pods'   -H 'accept: application/json'   -H 'accept-language: en-US,en;q=0.9'   -H 'content-type: application/yaml'   -H 'cookie: R_PCS=light; R_LOCALE=en-us; R_REDIRECTED=true; R_SESS=<your bearer token>'   --data-raw $'apiVersion: v1\nkind: Pod\nmetadata:\n  name: nginx\n  namespace: testnamespace\nspec:\n  containers:\n    - image: nginx\n      name: nginx\n      ports:\n        - containerPort: 80\n'   --compressed

In the output, you should see a header that looks like the following
< warning: 299 - would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
You could also change the namespace label value to baseline or privileged.  For the nginx pod example, I don't think you'll see the warning header since that example doesn't violate either of those PSA levels.

@crobby I am trying to generate a warning by creating/editing a Pod which has a Namespace with PSA Warning and any level combination, but I got no warning or mention anywhere. Any hint?

@cnotv Have you tried the example I gave below?
If you have, what do you get for kubectl describe ns <yournamespace

Since I'm developing the UI I'll use that, mind you? 😄
This is my scenario:

I get an error (wall) in that case, but not a warning.

When you first create the pod, add the port.  Not sure you can modify it on the fly.

Now it let me create it, but still no warning, just like before.

which version of Rancher are you testing with?

It should be the latest one or around that.
Rancher	v2.7-8062f1e3ab7bff870dfab195ff699a308644168a-head

Dashboard Card: https://github.com/rancher/dashboard/issues/7875

I'll create a new instance of Rancher, so we get it right for sure.

As mentioned by @nwmac , using 'Privilege Escalation' to 'Yes' generates the issue.
Rancher has been installed from scratch due corruption in the last update, prior this test.

I have validated this issue on v2.7-623addd2b1f055e7da84f74e130b7a92c4b2599e-head
All the test cases were passed and closing this ticket.
Below test cases were executed as part of the validations:

Validated with different user types :

Admin
Standard
Auth Provider (OpenLDAP)

Validated with different cluster types :

Local
RKE1
RKE2
EKS

Validated with different ranchers types :

Docker
HA

Reproducible Steps:

Login to rancher
Create a cluster
Create a Project
Create a Name Space
Add the restricted label to that namespace kubectl label --overwrite ns testnamespace pod-security.kubernetes.io/warn=restricted
Run this command
curl -v -k '<rancher or steve>/k8s/clusters/clustername/v1/pods'   -H 'accept: application/json'   -H 'accept-language: en-US,en;q=0.9'   -H 'content-type: application/yaml'   -H 'cookie: R_PCS=light; R_LOCALE=en-us; R_REDIRECTED=true; R_SESS=<your bearer token>'   --data-raw $'apiVersion: v1\nkind: Pod\nmetadata:\n  name: nginx\n  namespace: testnamespace\nspec:\n  containers:\n    - image: nginx\n      name: nginx\n      ports:\n        - containerPort: 80\n'   --compressed
Check for the warning message

Warning message displayed as:
warning: 299 - would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")


Use -- to separate download name and version.

[x] Have you followed the guidelines in our Contributing document?
[x] Have you checked to ensure there aren't other open Pull Requests for the same change?
[x] Have you added an explanation of what your changes do and why you'd like us to include them?
[ ] Have you written new tests for your changes? Here's an example.

[x] Have you successfully run brew tests with your changes locally?

Use -- to separate the name and version for cached downloads. Cask download strategies and VCS strategies are already using this, as well as patches.

How will this effect existing entries in the cache?

The compatibility layer will rename them if accessed, and brew cleanup already uses a regex which also matches the old pattern.

@reitermarkus I think it would be good to have some sort of migration which avoids having to redownload anything (particularly SCM checkouts which can be a bit slow).

particularly SCM checkouts which can be a bit slow

The SCM strategies are already using -- as separator, so these aren't affected.

Gotcha 👍. Still think a brew update migration might be nice if it's possible.

Added the migration to brew update instead of compat. There is also the migrate_legacy_cache_if_necessary method, should we reduce this to just delete the legacy cache? I don't think the files in the legacy cache are relevant anymore.

Last thing: can you have a read of https://github.com/Homebrew/brew/issues/568 before merging and just make sure there's no way that this will or can help with any of the issues described there. Thanks again and 🚢 when ready!

The migration seems to have resulted in double -- when - is part of the name. For example, I now have a file
reattach--to--user--namespace--2.7.tar.gz

But fetching it again with brew fetch -s reattach-to-user-namespace results in
reattach-to-user-namespace--2.7.tar.gz

and the previously cached item is not found.
Also, bump-formula-pr seems to be downloading with double hyphen. For example, I just ended up with firebase--cli--4.0.3.tgz in my cache when opening https://github.com/Homebrew/homebrew-core/pull/30824

I think this may have broken the use of hard links in test-bot https://github.com/Homebrew/homebrew-test-bot/blob/59c69a1bbc8f29daacd8b2d58c851a062a35c88c/cmd/brew-test-bot.rb#L781
The bottle file name hard linked into the cache won't be the same as what you'd get from a download so I don't think there will be a cache hit.


ChrisJr4Eva87

[Enter feedback here]

Document details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: 3d3bcf99-60c3-876c-c421-3351e507a81b
Version Independent ID: c906978e-acf2-462c-d7ff-20221872a793
Content: Primary Refresh Token (PRT) and Azure AD - Azure Active Directory - Microsoft Entra
Content Source: articles/active-directory/devices/concept-primary-refresh-token.md
Service: active-directory
Sub-service: devices
GitHub Login: @MicrosoftGuyJFlo
Microsoft Alias: joflore

Chris Jr Williams aka ChrisJr4Eva87 C x ♓

@ChrisJr4Eva87
Thanks for your feedback! We will investigate and update as appropriate.
It would be great if you could add a link to the documentation you are following for these steps? This would help us redirect the issue to the appropriate team. Thanks!

@ChrisJr4Eva87
We are going to close this thread as resolved but if there are any further questions regarding the documentation, please tag me in your reply and we will be happy to continue the conversation


runtime: ill-fated GC outcome in spiky/bursty scenarios

Motivation
The Go GC machinery leaves the door open to several ill-fated scenarios, that have been reported in other issues. The one closest to what I'm describing here (and providing a reproduction for) is https://github.com/golang/go/issues/10064.
Imagine the Go program has 64GiB available memory. The last garbage collection resulted in an live set of 54GiB. With the default GOGC=100 value, the pacer will schedule a collection once another 54GiB have been allocated, or in the next 2 minutes, whichever happens first.
If there's a rapid spike of heap allocation due to program mode change (e.g. a database compaction, which is how my team discovered this), such that it amounts to more than 10GiB, an OOM panic will occur.
And that appears to be reasonable behaviour, if those 10GiB are effectively retained / reachable / in scope.
However, what's not reasonable is that the same will occur even if 9.90GiB of those 10GiB have been released / become unreachable. For example, the program underwent 99 iterations of this logic, in under 2 minutes from the last GC:

allocate a 100MiB slice, populate it.
flush it to disk.
syntactically the slice goes out of scope (becomes unreachable).

The next iteration (100th) will cause the go runtime to expand the heap beyond its available memory, and that will cause an OOM panic. Instead, I would've expected the runtime to detect the impending OOM, and instead choose to run a forced GC.
The above scenario is greatly simplifying things, of course.
Reproduction harness
I built a reproduction harness here: https://github.com/raulk/trampoline/.
This program creates a cgroup and enforces the memory limit indicated by the -limit parameter (default: 32MiB). The cgroup's swap memory value is set to the same value, to prevent the program from using any swap. (IMPORTANT: make sure the right cgroup options are enabled to enforce this caging; check README for more info).
The program will then allocate a byte slice of size 90% of the configured limit (+ slice overhead). This will simulate a spike in heap usage, and will very likely induce GC at around 30MiB (with the default limit value).
Of course, the exact numbers are dependent on many conditions, and thus non-deterministic. Could be less or more in your setup, and you may need to tweak the limit parameter.
Given the default value of GOGC=100, the GC pacer will schedule to run when the allocated heap amounts to 2x of the live set at GC mark phase end. In my setup, this clocks in at 60MiB. Of course, that's beyond our 32MiB limit.
Next, the program releases the 90% byte slab, and allocates the remaining 10%. With the default limit value, it releases 30198988 bytes to allocate 3355443 bytes (obviating slice headers).
At that point, the program has enough unused heap space that it could reclaim and assign to the new allocation. But unfortunately, GC is scheduled too far out, and the Go runtime does not run GC as a last resource before going above its limit. Therefore, instead of reusing vacant, resident memory, it decides to expand the heap and goes beyond its cgroup limit, thus triggering the OOM killer.
The gist here is that the Go runtime had 9x times (roughly) as much memory free as it needed to allocate, but it was not capable of reclaiming it in time.
Discussion & ideas

I'm not sure if it's at all possible to implement a reactive GC trigger, i.e. trap a failure in malloc and then force a GC run before trying to allocate again. I don't think it is, because most OS will use virtual memory with overcommit modes, so the malloc won't fail. I guess it's not possible either to trap the SIGKILL sent by the OOM killer; it induces immediate program termination.

For large heaps, I think the go runtime should automatically regulate the GC percentage, reducing it as it the heap increases in size.  Maybe also regulate the forced GCs frequency accordingly, to make it adaptable.

Workaround
We'll probably end up setting up a memory watchdog, initialized with a user-configured memory limit (à la JVM -Xmx). As the heap grows, we'll probably reduce GOGC dynamically by calling debug.SetGCPercent. As the heap approaches the limit, we'll trigger GC more aggressively and manually.
Related issues
https://github.com/golang/go/issues/42430 (gc pacer problems meta-issue)
https://github.com/golang/go/issues/14735 (throttling heap growth)
https://github.com/golang/go/issues/16843 (mechanism for monitoring heap size)
https://github.com/golang/go/issues/10064 (GC behavior in non-steady mode)
https://github.com/golang/go/issues/9849 (make max heap size configurable)

cc @aclements @mknyszek @dvyukov

FWIW I still think that growing heap more carefully is a good idea. Number of times heap grows is limited, so it can't incur permanent negative performance effect. #10064 #14735

This sounds like exactly the problem SetMaxHeap is intended to solve. See #42430 #29696.

I would say it's related, but also somewhat orthogonal. I can see how SetMaxHeap helps in server environment. But, say, I am compiling lots of beefy Go code on my not super beefy laptop, there are lots of parallelism and lots of compiler/linker/vet/test invocations. Frequently it badly freezes my machine, sometimes I need to hard reboot even. I am not sure who/how will set SetMaxHeap for all these subprocesses and what will be the limits. But if Go processes would be overall more careful consuming large amounts of memory, it may help.

@dvyukov  Sure that's a problem as well, but not the OP's problem. He has and knows a hard limit.
The difficulty I see in your scenario is how we would know. I don't see how a Go process can reliably tell that it is "using too much memory" until mmaping new memory fails. We could run a GC at that point, sure. But we never get a mmap failure in your scenario: the OS is stealing all the available memory, paging out your window manager, etc., in order to satisfy our requests. How do we know the OS is "trying too hard" and we should back off?

@raulk Thanks for the report! From my perspective (and I agree with Keith), this boils down to more evidence suggesting we should have a configurable maximum heap. You mention that you think GOGC should go down when the heap size goes up; I want to note that this is effectively what a maximum heap size achieves. In a world of containers, I think this makes a lot of sense.
@dvyukov We're reasonably careful about heap growths nowadays since we'll eagerly return memory to the OS in that case, but you still run into trouble with the amount of memory needed doubling (which is independent of "heap growth" as far as the runtime's meaning (i.e. (*mheap).grow), so I don't think just being careful on heap growths is enough.
Your example of lots of Go processes is a real issue, but I think it's also somewhat orthogonal to this issue which seems to be focused on a server application (@raulk correct me if I'm wrong). Unfortunately, Go generally doesn't play well with co-tenants (ironically it's usually worse if they're all Go code too, because the idle GC will try to eat up GOMAXPROCS CPUs). I'm think optimistically limiting GOGC during a live heap increase (like you suggest in #10064 and #14735) might help that a bit (maybe even more than a bit in some cases, and could be worth doing; not trying to make a judgement about that here), but it doesn't directly address the co-tenancy problem.

The overall idea is to grow heap slower. #10064 describes scenario where we can non-deterministically grow heap 2x of what it could be otherwise.

@mknyszek @randall77 I think I agree with your assessments here. I believe mmap would succeed when expanding the heap beyond the hard limit. But when the process effectively writes to the mapped memory, that's when it would become backed by physical memory and it would summon the OOMKiller. There might be ways that one can interrogate the OS about the limits in force, but this would be hugely platform dependent.
I think the most deterministic way of achieving sympathy here is through SetMaxHeap, although I do want to note that Go still has a fragmentation problem, as it does not perform compaction in its effort to be zero copy. So one could still get into fragmentation-based ill-fated scenarios, even if memory was freed in a timely manner.
The reason why I suggested decreasing GOGC as we approach the max heap is that if one doesn't do that, GC pacing becomes entirely reactive instead of proactive. For example, if I have a 64GiB max heap, my previous live set was 32GiB, with the default GOGC we wouldn't run GC proactively until another 32GiB have been allocated, which is obviously too late (or until the 2min timer fires).
That said, SetMaxHeap would trigger GC as the allocated heap approaches the 64GiB cap. I'm not familiar with the details on how that's implemented, but I'm assuming it will do so closer to the last mile (e.g. 90% of max heap?).
If that's the case, we would have had this timeline, potentially:

gc @ 32GiB
gc @ 62GiB (triggered by max heap supervisor)
gc @ 63GiB (triggered by max heap supervisor)
gc @ 64GiB (triggered by max heap supervisor)

Instead, if one decreases GOGC inversely proportional to the remaining until max heap, you could get a much balanced pattern, for example:

gc @ 32GiB (GOGC=>50)
gc @ 48GiB (GOGC=>25)
gc @ 60GiB (GOGC=> 12.5)
gc @ 62GiB (triggered by max heap supervisor)
gc @ 63GiB (triggered by max heap supervisor)
gc @ 64GiB (triggered by max heap supervisor)

If it's useful, I tried https://go-review.googlesource.com/c/go/+/227767 with my program, and it did not help. I received the notification, but for some reason it still OOM'ed.

I think the most deterministic way of achieving sympathy here is through SetMaxHeap, although I do want to note that Go still has a fragmentation problem, as it does not perform compaction in its effort to be zero copy. So one could still get into fragmentation-based ill-fated scenarios, even if memory was freed in a timely manner.

Nice observation about fragmentation. This is something that has come up already recently, and going forward I think anything like SetMaxHeap that lands should:

Account for fragmentation by making the limit an actual memory limit and not a heap usage limit.
Eagerly return memory to the OS to stay under that limit.

The reason why I suggested decreasing GOGC as we approach the max heap is that if one doesn't do that, GC pacing becomes entirely reactive instead of proactive.

The way SetMaxHeap currently works is closer to the former timeline, but the exact GC trigger point is set according to a feedback loop as usual. Personally, I'm not sure I see the value in the latter timeline, since you're not really gaining anything, you're just GCing more frequently. Plus, when you start bumping up against the limit, you want to give the GC as much runway as possible, especially if you're allocating heavily, to avoid actually passing the maximum (the max is actually a soft maximum because otherwise you end up with GC death spirals).

In case it's useful, I tried https://go-review.googlesource.com/c/go/+/227767 with my program, and it did not help. I received the notification, but for some reason it still OOM'ed, even if I forced a manual GC inside the notification consumer.

All feedback in this space is useful. :) The notification system for SetMaxHeap isn't supposed to be used for triggering a GC manually; the notification suggests the runtime is already aware that it needs to do something. It's supposed to be for having your application drop work (like a web server dropping requests or client connections). In practice, it's hard to use unless it's built deeply into your web framework already (be that net/http or something else), and even then it's not trivial to implement either. I don't think the notification system is something that we're going to carry forward at this time (at least not tied to any kind of heap limit).

The overall idea is to grow heap slower. #10064 describes scenario where we can non-deterministically grow heap 2x of what it could be otherwise.

@dvyukov Yeah, I think I get it. Almost like making the heap goal itself an EWMA or something. I think I can see the value in that. The cliff that's dependent on timing is a bit of a problem and it would be nice to smooth that out.

@raulk It sounds like you might have introduced a workaround initially, but I'm curious if the Go 1.19 GOMEMLIMIT soft memory limit was able to address the problem you originally reported here?


3scale Mixer Adapter doesn't report any adapter metrics

In the "Mixer Dashboard" in Grafana we can see several adapters reporting some metrics (dispatch count, and success/error for dispatches). We should investigate why the 3scale Mixer Adapter doesn't show any kind of metric, and try to fix that.
Screenshot:

----- Update 17/10/2018
Seems clear from Prometheus targets that Istio Mixer is exposing a prometheus /metrics endpoint:

Checking the source code, we can see the implementation here:
https://github.com/istio/istio/blob/master/mixer/pkg/server/monitoring.go
------ update 18/10/2018
After asking Istio devels, looks like the mixer dispatching metrics for our adapter should be reported... trying to get more info there. (Bug in our code or mixer?)
------ Update 22/10/2018
We need to check if mixer reports for dynamic adapters the dispatch metrics. Those metrics are not enough for monitoring the actual state of the adapter, we should expose a Prometheus endpoint with internal adapter stats.
Related to #18

Update: After digging in to this a bit it appears that mixer does report some metrics for the 3scale adapter. However as in the above image, there are no data points visible for the individual adapter.
Having gone into the Grafana dashboard and checking the Prometheus query for these graphs, it looks like:

Running the same query within Prometheus itself does in fact show some data points. Screenshots of the two are shown:

There is also a regex run on the handler name which is going to result in inconsistent labelling across graphs compared to the built in adapter with the out of process. Naming conventions are, for example,handler="threescale.handler.istio-system" handler="handler.stdio.istio-system" respectively. However I am not entirely sure that is the source of the missing datapoints. I am also not entirely sure how to progress this issue any further.
@jmprusi @unleashed @mikz open to suggestions on what to do next here?

Should be fixed now in https://github.com/istio/installer/pull/190


[iPad][iOS] Some functions of Scribble doesn't work (text deletion, space insertion)

Scrible doesn't work on all flutter channels stable 3.7.6, beta 3.8.0-10.1.pre, and last master version. Tested on iPadOS 16.0 and 16.3.1. On stable and master you can write text, but features such as text deletion, space insertion and others don't work. On beta channel text writing with scribble doesn't work.
import 'package:flutter/cupertino.dart';
import 'package:flutter/material.dart';

void main() {
  runApp(const MyApp());
}

class MyApp extends StatelessWidget {
  const MyApp({
    super.key,
  });

  @override
  Widget build(BuildContext context) {
    return MaterialApp(
      title: 'Flutter Demo',
      theme: ThemeData(
        primarySwatch: Colors.blue,
      ),
      home: Scaffold(
        appBar: AppBar(),
        body: Container(
          height: double.infinity,
          width: double.infinity,
          color: CupertinoColors.lightBackgroundGray,
          child: Center(
            child: CupertinoTextField(
              scribbleEnabled: true,
              textAlign: TextAlign.center,
            ),
          ),
        ),
        resizeToAvoidBottomInset: false,
      ),
    );
  }
}

There are some fixes recently related to the scribble function and are available on the master channel now. But as your description, some functions don't work. Can you please provide a recorded video along with Steps to reproduce this?
Also, please provide the output of flutter doctor -v as well. Thank you!

@huycozy
$ flutter doctor -v
[✓] Flutter (Channel beta, 3.8.0-10.1.pre, on macOS 13.0 22A380 darwin-x64, locale en-GB)
    • Flutter version 3.8.0-10.1.pre on channel beta at /Users/admin/Programs/flutter
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision 1a0a03a41d (3 weeks ago), 2023-02-16 22:03:58 -0600
    • Engine revision 639e313f99
    • Dart version 3.0.0 (build 3.0.0-218.1.beta)
    • DevTools version 2.21.1

[✓] Android toolchain - develop for Android devices (Android SDK version 32.1.0-rc1)
    • Android SDK at /Users/admin/Library/Android/sdk
    • Platform android-33, build-tools 32.1.0-rc1
    • ANDROID_HOME = /Users/admin/Library/Android/sdk
    • Java binary at: /Applications/Android Studio.app/Contents/jre/Contents/Home/bin/java
    • Java version OpenJDK Runtime Environment (build 11.0.12+0-b1504.28-7817840)
    • All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 14.2)
    • Xcode at /Applications/Xcode.app/Contents/Developer
    • Build 14C18
    • CocoaPods version 1.11.3

[✓] Chrome - develop for the web
    • Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

[✓] Android Studio (version 2021.2)
    • Android Studio at /Applications/Android Studio.app/Contents
    • Flutter plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/6351-dart
    • Java version OpenJDK Runtime Environment (build 11.0.12+0-b1504.28-7817840)

[✓] IntelliJ IDEA Ultimate Edition (version 2022.3.2)
    • IntelliJ at /Applications/IntelliJ IDEA.app
    • Flutter plugin version 72.1.4
    • Dart plugin version 223.8617.8

[✓] VS Code (version 1.75.1)
    • VS Code at /Applications/Visual Studio Code.app/Contents
    • Flutter extension version 3.58.0

[✓] Connected device (3 available)
    • iPhone (Evgeniy) (mobile) • e76e0fcd66228b1dafcb0709786bbd6ca0792fb8 • ios            • iOS 15.7.1 19H117
    • macOS (desktop)           • macos                                    • darwin-x64     • macOS 13.0 22A380 darwin-x64
    • Chrome (web)              • chrome                                   • web-javascript • Google Chrome 110.0.5481.177

[✓] HTTP Host Availability
    • All required HTTP hosts are available

• No issues found!

https://user-images.githubusercontent.com/35203503/223460418-b3570467-e5c9-4e70-bca4-aaef78948163.MP4

@huycozy
$ flutter doctor -v
[✓] Flutter (Channel master, 3.9.0-1.0.pre.74, on macOS 13.0 22A380 darwin-x64, locale en-GB)
    • Flutter version 3.9.0-1.0.pre.74 on channel master at /Users/admin/Programs/flutter
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision bee84a122d (4 hours ago), 2023-03-07 06:35:29 -0500
    • Engine revision 4e6cbe0fc2
    • Dart version 3.0.0 (build 3.0.0-300.0.dev)
    • DevTools version 2.22.2

[✓] Android toolchain - develop for Android devices (Android SDK version 32.1.0-rc1)
    • Android SDK at /Users/admin/Library/Android/sdk
    • Platform android-33, build-tools 32.1.0-rc1
    • ANDROID_HOME = /Users/admin/Library/Android/sdk
    • Java binary at: /Applications/Android Studio.app/Contents/jre/Contents/Home/bin/java
    • Java version OpenJDK Runtime Environment (build 11.0.12+0-b1504.28-7817840)
    • All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 14.2)
    • Xcode at /Applications/Xcode.app/Contents/Developer
    • Build 14C18
    • CocoaPods version 1.11.3

[✓] Chrome - develop for the web
    • Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

[✓] Android Studio (version 2021.2)
    • Android Studio at /Applications/Android Studio.app/Contents
    • Flutter plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/6351-dart
    • Java version OpenJDK Runtime Environment (build 11.0.12+0-b1504.28-7817840)

[✓] IntelliJ IDEA Ultimate Edition (version 2022.3.2)
    • IntelliJ at /Applications/IntelliJ IDEA.app
    • Flutter plugin version 72.1.4
    • Dart plugin version 223.8617.8

[✓] VS Code (version 1.75.1)
    • VS Code at /Applications/Visual Studio Code.app/Contents
    • Flutter extension version 3.58.0

[✓] Connected device (3 available)
    • iPad (Evgeniy) (mobile) • 00008020-001029592629402E • ios            • iOS 16.3.1 20D67
    • macOS (desktop)         • macos                     • darwin-x64     • macOS 13.0 22A380 darwin-x64
    • Chrome (web)            • chrome                    • web-javascript • Google Chrome 110.0.5481.177

[✓] Network resources
    • All expected network resources are available.

• No issues found!

https://user-images.githubusercontent.com/35203503/223463043-2754f62f-b16f-48a4-baea-c519a68d80e6.MP4

Thanks for providing more information. It seems it works on the latest master channel, right? (I don't have the such device so I can not test this right now). If so, feel free to close the issue as it's fixed.

@huycozy No, it doesn't work. Only text recognition seems to work, but features such as text deletion, space insertion and others don't work. This features demonstrated in iPad Settings -> Apple Pencil -> Try scribble.

Thanks for confirming this on the latest channels. I can see the wrong behavior in your videos. Labeling the issue for the team's attention.

Looks like a duplicate of https://github.com/flutter/flutter/issues/121868


fixes for 0.6

This gets the tests passing on julia master.

Remove the Associative supertype. NamedTuples don't quite act like other Associative types; in particular they don't iterate key=>value pairs, so I just removed the declaration for now.
Remove slice, which was deprecated. It can just be a method of getindex.
Update macro for change in parsing of =>.
The tricky bit: NamedTuples makes new types at runtime, and the world counter generally prevents their constructors from being called, since those methods are added too late. My fix for this is to define a fixed set of constructors to be shared by all NamedTuples (since they all have very similar behavior of just copying arguments to fields), and suppress generation of default constructors. I have specializations for 0-5 arguments, and a generated function for others.

Thanks for looking into this!!

The tricky bit: NamedTuples makes new types at runtime, and the world counter generally prevents their constructors from being called, since those methods are added too late. My fix for this is to define a fixed set of constructors to be shared by all NamedTuples (since they all have very similar behavior of just copying arguments to fields), and suppress generation of default constructors. I have specializations for 0-6 arguments, and a slow fallback for any number of arguments. Could possibly be a generated function instead.

This worries me a lot. If NT creation for anything with more than 6 arguments is slow now, it would almost certainly make the whole Query design obsolete... Any chance that you might be able to add the generated function approach to this PR? And I assume that would give us back the same performance that we have right now for any number of arguments?

Yeah, fair point. I switched the fallback to a generated function. Still works perfectly well, and one often needs generated functions for NamedTuples anyway.

I switched the fallback to a generated function. Still works perfectly well, and one often needs generated functions for NamedTuples anyway.

Fantastic, thanks a lot!

Looks like this needs a rebase against #16 which was just merged.

Rebased.

Could we tag a version before this gets merged? This PR will make things julia 0.6 only, would be nice to have a tagged version that has everything before that.

Is it possible to get this to work on 0.5 with the help of Compat.jl? I see an abstract type NamedTuple end and a where NT<:NamedTuple which are problematic, the rest of the diff looks OK for 0.5...

Yes I suppose so.

It seems you need at least this patch. (I maybe wrong because my local julia build is broken and I didn't check it on nightly) and then you need to do something about UnionAll in gen_namedtuple_ctor_body... If that's not possible, it would be nice to merge this after tagging so that the same @NT syntax works on both release and nightly.
diff --git a/src/NamedTuples.jl b/src/NamedTuples.jl
index 7d91b49..f829407 100644
--- a/src/NamedTuples.jl
+++ b/src/NamedTuples.jl
@@ -1,7 +1,9 @@
 __precompile__()
 module NamedTuples

-abstract type NamedTuple end
+using Compat
+
+@compat abstract type NamedTuple end

 Base.keys( t::NamedTuple ) = fieldnames( t )
 Base.values( t::NamedTuple ) = [ getfield( t, i ) for i in 1:nfields( t ) ]
@@ -67,7 +69,7 @@ escape( e::Expr ) = esc( e )
 escape( e::Symbol ) = esc( e )
 escape( e ) = e

-function trans( ::Type{ParseNode{:(=)}}, expr::Expr)
+function trans( ::Union{Type{ParseNode{:(=)}}, Type{ParseNode{:kw}}}, expr::Expr)
     (sym, typ ) = trans( expr.args[1])
     return (sym, typ, escape( expr.args[2] ))
 end
@@ -133,7 +135,7 @@ function gen_namedtuple_ctor_body(n::Int, args)
 end

 # constructor for all NamedTuples
-@generated function (::Type{NT})(args...) where NT<:NamedTuple
+@generated function (::Type{NT}){NT<:NamedTuple}(args...)
     n = length(args)
     aexprs = [ :(args[$i]) for i = 1:n ]
     return gen_namedtuple_ctor_body(n, aexprs)
@@ -142,7 +144,7 @@ end
 # specialized for certain argument counts
 for n = 0:5
     args = [ Symbol("x$n") for n = 1:n ]
-    @eval function (::Type{NT})($(args...)) where NT<:NamedTuple
+    @eval function (::Type{NT}){NT<:NamedTuple}($(args...))
         $(gen_namedtuple_ctor_body(n, args))
     end
 end

Thanks @shashi . I now have a version here that works on 0.5 and 0.6.
@mdcfrancis Could you tag current master as the last version that works with 0.4, then we can merge this?

Yes I'll do that - I had to rebuild my Julia envs

I have tagged v2.0.0 which is the last version which can run on 0.4 https://github.com/JuliaLang/METADATA.jl/pull/8154 - I'll then merge this request and tag as v3.0.0 which will require Julia 0.5-

https://github.com/JuliaLang/METADATA.jl/pull/8172

https://github.com/JuliaLang/METADATA.jl/pull/8173
Thanks for the 0.6 changes @JeffBezanson and @shashi for the back port to 0.5


AA: Fixing redundant forcing of current user and allowing ssh to pick username based on host

Tested and works with and without the username

Thanks!


tmp: introduce code smells

Hi @pascalgrimaud
Sorry for the last PR, too late reply to you.
you can see the changes in this PR: https://github.com/zhyd1997/jhipster-lite/pull/4/files
Ignore src folder changes.

Hi @pascalgrimaud
Sorry for the last PR, too late reply to you.
you can see the changes in this PR: https://github.com/zhyd1997/jhipster-lite/pull/4/files
Ignore src folder changes.

Sorry,  I don't understand your comment and your last changes :-D
It contains 34 commits, which are related to CSS.

See changes in red rectangle part:

You can copy build.yml file from SonarCloud to avoid errors.

Something wrong at Sonarcloud:

the analysis in main branch was replaced by another one: https://sonarcloud.io/summary/overall?id=jhipster_jhipster-lite
the 2 pull requests are here, but with false positive: https://sonarcloud.io/project/pull_requests_list?id=jhipster_jhipster-lite

@zhyd1997 : with your change, we can't run local Sonar analysis with additional custom arguments, that's the problem

@pascalgrimaud
Let me submit a PR!

@zhyd1997 : I created this ticket to follow the issue -> https://github.com/jhipster/jhipster-lite/issues/6133
You can link your other pull requests to this one. And yes, you can try PR and introduce some code smells to see if it works. I activate the config at Sonarcloud so all the pull requests should be decorated by a Sonarcloud comment

Hi

@pascalgrimaud
I need the information here:

@zhyd1997 : have a look at https://github.com/jhipster/jhipster-lite/blob/main/.github/workflows/github-actions.yml#L81

Yes, it looks nice @zhyd1997 ! Thanks a lot.
I'll have a close look on this after my day work :)


Update the figure links

Pull Request Test Coverage Report for Build<PHONE_NUMBER>
Details

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 42.529%

Totals

Change from base Build<PHONE_NUMBER>:
0.0%

Covered Lines:
37

Relevant Lines:
87

💛  - Coveralls

Pull Request Test Coverage Report for Build<PHONE_NUMBER>
Details

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 42.529%

Totals

Change from base Build<PHONE_NUMBER>:
0.0%

Covered Lines:
37

Relevant Lines:
87

💛  - Coveralls


Tweak intro animations

Nicer animation easings
Animate the background in as well (just a simple fade in, with the modal)
Disable animations if the user indicates they prefer reduced motion (info here)

Merged all of this except the modal timing function change (which was too quick and looked a bit jerky when resources were loading slowly). Thanks!


🐛 BUG: wrangler publish - 413 Request Entity Too Large

What version of Wrangler are you using?
2.0.8
What operating system are you using?
Windows
Describe the Bug
I upgraded my Workers Sites project from Wrangler v1 to v2(.0.8). I replaced my .toml file with an all command line implementation:
wrangler publish "workers-site\index.js" --name="dev-site" --compatibility-date="2022-06-05" --routes="www.dev-site.dev/*" --routes="dev-site.dev/*" --site="dist" --minify
Wrangler starts up and starts reading/uploading many files without issue. Then it hangs at a particular file every time, and a 413 Request Entity Too Large HTTP error is encountered:

That version\index.html file is only 32 bytes.
This site uploaded without issue using Wranger v1. It is only after upgrading to v2 that this problem has started occurring.

Oh darn sorry about that. Could you tell me what the size of the folder you're uploading is?

@threepointone 151 MB (349 files, 61 folders)
I am aware of the KV value size limits and I do not go past that, hence Wrangler v1 having no issues.

Ok this is probably something we should fix on our side, looks like the bulk upload endpoint might have a limit, so we might have to split and batch this into multiple calls. Sorry!

@threepointone I figured that's what it was. I'm surprised that no one has run into this yet!

I'm surprised too!! I'll verify it during the week.

@threepointone On a side note, did I specify the routes correctly in the command line? Couldn't find an example of specifying a string array.
Additionally, is --minify needed or is that the default?

You've specified multiple routes correctly, that is indeed the right way to do it. And minify isn't the default (yet), so you're good.
I'm working on configuration / flags docs soon, and I'll make it a point to specify this.

This is released in<EMAIL_ADDRESS>let us know if you see any further issues! And thank you for your patience!

It does work for me now in 2.0.11, thanks!


Add cesantarosa/a.txt

Add my school so that future student developers can obtain a jetbrains license.

@evairx Thank you for your patience while waiting for a review and processing your request. Pull request merged.


BinExport is trowing an exception

BinExport is trowing an exception (in binexport/function.py) when using the following code:
    p = qbindiff.Program(qbindiff.LoaderType.binexport, './firmware3v3.bin.BinExport')
    q = qbindiff.Program(qbindiff.LoaderType.binexport, './bootloader-apploader.axf.BinExport')
    differ = qbindiff.QBinDiff(p, q)
    differ.register_feature_extractor(qbindiff.features.BBlockNb, 1.0)
    matches = differ.compute_matching()
    ...

we get this error:
  File "binexport/function.py", line 174, in graph
    _ = self.blocks  # Load the CFG
  File "functools.py", line 981, in __get__
    val = self.func(instance)
  File "binexport/function.py", line 141, in blocks
    for bb_idx in self._pb_fun.basic_block_index:
AttributeError: 'NoneType' object has no attribute 'basic_block_index'

Which can be patched with the following (in binexport/function.py):
137  # Add a sanity check to prevent error, for yet unknown reason _pb_fun may be undefined
138  if self._pb_fun == None:
139    return bblocks

Fixed in #8.
Feel free to open the issue again if the problem is still present.


Use From instead of "2" methods

Patch dolly glam to use same version as Bevy
Use From instead of methods with "2" in the name through the DollyTransform type (Fix #23)
Simplify code by using the prelude more extensively
Simplify code by using the type alias pub type DollyTransformType = dolly::transform::Transform<RightHanded>;
Add doc tests to CI
Run clippy for examples
Fix clippy warnings for examples
Simplify code by using vector shorthands in 2D cam move example
Simplify camera spawning in examples (Fix #24)

Ready for review :)

Very nice 👍 it looks good, I've posted two questions in the review above

I think you missed clicking on the "Submit review" button on the upper right, because I don't see anything yet 😉

I think you missed clicking on the "Submit review" button on the upper right, because I don't see anything yet wink

Yes I'm sorry, I'm still learning to use github 😅

Woah, nice work on the PR, the ergonomics are way better now! :)


Password Protect OAuth Token Related Methods

Can we get a password parameter added to all of the http related call that use OAuth related tokens?
The key.json and/or local keychain concept it too easy to exploit.
Adding a password parameter to the various CLI methods would allow for the use of local encryption without exposing an org to a hacked Admin/Dev machine.
Yes, it would be possible to grab the password via a key logger, but simple password protection would be a significant security improvement over the current CLI.

@mshanemc  You could use this idea to allow us to have access to the refresh token. If the developer pass the password parameter, or an ENV variable called SFDX_PWD is available, then print the refreshToken in the output of sfdx auth:list --json.

@AllanOricil
Bravo!

I just thought about it again. It will never be secure. If a hacker access your computer he is able to retrieve any ENV variables you have there. He would still be able to get access to your orgs through sfdx. That was the reason I also closed that feature requesting access to the refresh token.
But, it would be nice to have control over it, knowing the risks.

@Allan we need to figure out credentials management.
Sharing OAuth tokens is a fail for the IAM Designer exam. This vulnerability affects AWS and Azure CLI too.
The CLI is gonna get banned once CISO leadership realizes the vulnerabilities it introduces.
Some options are:

Password protect each command that requires a token to execute a web request
Create a shell (like sqlcmd or pwsh) that requires a password for connecting to local resources
Enable some feature like https://github.com/99designs/aws-vault
Move the key.json file and/or local alias json files to a user defined directory and have them write  a custom bat file which will copy the files to ~/.sfdx and then delete after command execution

Copy file back to  ~/.sfdx
Run commands
Delete ~/.sfdx files

Have users add another layer of encryption on top of the user_name.json files

Decrypt ~/.sfdx  files using password
Run commands
Encrypt ~/.sfdx files using password


Module Positioning all over the place

Hi There
I used this template a few years ago & it worked great,
a lot of improvements since including improved Joomla
so after installing the latest Joomla & Lightning template
as well as sample data, it no longer looks as good as it did

was the 20/20 logo not included now in the zip file? - is that what's thrown the positioning out?
It used to look like the picture below after being at this stage (which was fantastic)

Hi @M4dKiwi, did you install the lightning sample data plugin too?
Can you also let me know what versnio of Joomla and browser you're using?

ahhh ha , that was the issue, was using the Joomla sample data
thank you, I've fixed the problem
you've always been great at keeping in touch & improving the template
loving it!  - can close this now
SOLVED !


Replace gomock

Gomock seems to be causing bizarre issues under potentially race-y conditions, and travis has been failing intermittently for seemingly no reason, which @LynxHack has been running into
Seems to not be uncommon:

Yeah I am not a big fan of gomock. The generated code often have problems with I turned on go test -race

https://github.com/docker/infrakit/issues/187#issuecomment-251630471 - we use the race test as well
Alternative that was brought up:
https://github.com/maxbrunsfeld/counterfeiter


fanric-java-sdk how to use Taking ledger snapshots and using them to join channels

fanric-java-sdk how to use Taking ledger snapshots and using them to join channels

Joining channels using snapshots uses the peer CLI commands, as described in the Fabric documentation. The SDK does not support joining channels using snapshots.


Basic functionality

[x] clone module from https://github.com/dfch/biz.dfch.PS.Cumulus.Utilities
[x] setup basic PoSH module
[x] import https://github.com/dfensgmbh/biz.dfch.CS.Appclusive.Api
[x] setup basic nuspec
[x] publish basic nuspec package

Released v0.0.1 on NuGet


Fix config parameters & clean up the project

I noticed that the playerVars were always empty. So I fixed that, it now works.
Also I did the following changes:

Create a model for the parameters instead of using a dictionary
move enums and structs out of the SwiftYouTubePlayer.swift file
make the config parameters all optional

Have fun testing it all & merging it if you want to 🙂

Thanks for contributing!


enhance soomth upgrade, for issue 1397

Issues associated with this PR
currently:
已讨论，几个方案：

[ ] 1. 支持配置的自动dump
[x] 2. 静态配置添加15001的listen配置
[x] 3. new mosn通过old mosn传递过来的运行时配置来启动

but:
i test one case in my scene. maybe, my pr will be more error.
Solutions
You should show your solutions about the issues in your PR, including the overall solutions, details and the changes. At this time, Chinese is allowed to describe these.
UT result
Unit Test is needed if the code is changed, your unit test should cover boundary cases, corner cases, and some exceptional cases. And you need to show the UT result.
Benchmark
If your code involves the processing of every request, you should give the Benchmark Result.
Code Style

Make sure Goimports has run
Show Golint result

for issue #1397


Use native fs.copyFile when available and no progress listeners were added

Will likely be faster on most systems. Need to detect and use it when possible.
Ref: https://github.com/nodejs/node/pull/15034

IssueHunt Summary

Sponsors (Total: $20.00)

 issuehunt ($20.00)

Become a sponsor now!
Or submit a pull request to get the deposits!
Tips

Checkout the Issuehunt explorer to discover more funded issues.
Need some help from other developers? Add your repositories on IssueHunt to raise funds.

👍 PR welcome

The problem is that there is no (sane) way to observe progress ATM.

We can introduce a threshold size for files that need to be progress-tracked and/or only emit 1 progress event for files copied by fs.copyFile (final one, with 100% progress)
Use watchers for progress tracking, but this only adds more overhead than solved by using fs.copyFile
Forget about it for now

It's still useful for the sync method which doesn't have progress reporting.

@YurySolovyov We could use the native method and fall back to the JS one if the progress event is subscribed to. And as Kevin said, the sync method could still benefit, and it is probably the one that will benefit the most from a native implementation.

Are you ok if I add it only for sync method at first?

Go ahead 👍

I'd re-open it and maybe change title because async code path still remains.
New title may sound something like:
Use node  >= 8.5 native fs.copyFile when available and no progress listeners were added.

We can now do this without a check as we target Node.js 8. The behavior should be added to the docs though.

@issuehunt has funded $20.00 to this issue.

Submit pull request via IssueHunt to receive this reward.
Want to contribute? Chip in to this issue via IssueHunt.
Checkout the IssueHunt Issue Explorer to see more funded issues.
Need help from developers? Add your repository on IssueHunt to raise funds.

Done: https://github.com/sindresorhus/copy-file/releases/tag/v11.0.0