vendor: update ciao

This new version of ciao has support for VFIO hotplug
directly on pci.0 or on a PCI(E) bridge.
shortlog:
faba87e qmp: Add support for hot plugging VFIO devices on PCI(E) bridges
51ce599 ciao-controller: remove duplicate volume creation paths
1e98990 testutil: Bump sleep times in verify.sh
427fefa ciao-controller: Remove unused volume code
1382a13 workload_bat: Add container workload tests
de0dd64 ciao-controller: Fix a crash in instance creation
2f2a140 Revert "ciao-{controller,launcher,scheduler}: log panics to glog"
fecb4f7 payloads, configuration: remove CNCI admin password field
2ebf459 ciao-deploy: Remove setting of admin CNCI password
2394387 ciao-controller: Remove CNCI password
d75d8b0 workload_bat: Add testing for privileged containers
3a4ff41 tenant_bat: Add testing for tenant permissions
e1bb505 bat: Update for new permissions fields
b4a296d ciao-controller: Check privileged container permissions
dff07a8 ciao-cli, client: Enable privileged container permission for tenant
4a1ad8e ciao-controller: Add tenant permissions
6bfe51b bat, ciao-cli: Expose privileged container control to users
bdabf6b ciao-launcher: Implement privileged containers
19497e1 payloads: Add privileged field to workload requirements
cfe55bf ciao-controller: Update instance name regexp
9f416af datastore: Add unit test coverage of new image resolving
c470b18 ciao-cli, bat: change service field in yaml to type
e000a5e ciao-cli/bat: Use more generic term for source in workloads
67091bf workload_bat: update tests to use new image name source
f6920ee ciao-controller: Resolve source for image ID into a name
fad952f datastore: Add support for retrieving images by name
34e7923 ciao-controller: Rename types.StorageResource.SourceID to Source
fbb077f ciao-controller: Update instance creation code to use new error
b38a9fd ciao-controller: Enforce name regex check in controller
557b3f4 ciao-cli: enforce image name regexp in ciao-cli
f9a142c ciao-deploy: Update image names to match requirements
e818275 ciao-controller: Remove instance volume code
60bbd15 ciao-cli: Remove instance volume controls
ab50c1a ciao-deploy: Set groups appropriately for the master node
aeba29c ciao-deploy: Don't error out if user already exists
ce1e6d9 ciao-deploy: Ensure docker service is running on launcher nodes
cff797e ciao-deploy: Ensure tools' parent directories are present
04f823b ciao-deploy: Check in the cleanup.sh script
555cfc0 ciao-deploy: Enable systemd unit files
1cebbb1 ciao-deploy: Add unit file for osprepare
6708eab ciao-launcher: Add --osprepare and --roles options
2adae65 ciao-scheduler: Add --osprepare option
78bdb6e ciao-controller: Add --osprepare option
979eeb7 ciao-deploy: Set ciao user home dir and shell
dc0f457 ciao-deploy: Copy controller HTTPs certs
53d66bf ciao-deploy: Split up InstallToolsAndCerts
e1ac271 ciao-launcher: Run qemu processes as non-root
0f01fcf networking: Support queues for tap devices
32f0998 ciao-launcher: Run xorriso as non-root
f1b3b23 ciao-deploy: Run launcher as root with limited caps
264a91d ciao-deploy: Specify user for node child processes
c1a0782 ciao-launcher: Process child process user information
e39b026 configuration: Add the ChildUser configuration option
3e82087 qemu: Add a SysProcAttr parameter to CreateCloudInitISO
43c50ac qemu: Add a SysProcAttr parameter to LaunchCustomQemu
612864f ciao-deploy: Run ciao processes as non-root
c9db89b ciao-controller: Remove debug installation dependencies
b581508 osprepare: Remove cephfs as a core dependency
7aaa175 SingleVM: Make verify.sh run on non-prestine clusters
f58f8bc vendor: Revendor github.com/vishvananda/netlink
4f23452 ciao-launcher: Log docker network creation failures
32e72f3 ciao-launcher: Fix log messages in process_stats.go
22e4da6 ciao-launcher: Ensure VNICs get cleaned up after launch failure
f03aa1a ciao-launcher: Remove all files during hard-reset
a86aab3 BAT: Fix a race condition in TestInstanceLimited
5bbaf60 Revert "ciao-deploy: use a generic base clear image for building cnci."
208f740 ciao-deploy: use a generic base clear image for building cnci.
702b331 ciao-{controller,launcher,scheduler}: log panics to glog
dc1a92a bat: Add BAT testing of node ID/hostname workload requirements
86c08ef bat, ciao-cli: Update to reflect new node ID and hostname scheduling
d0aee2a payloads, ciao-scheduler: Allow scheduling by hostname and node id
7e7e331 payloads, ciao-launcher: Send hostname with Ready event
aa07149 ciao-cli, bat: Expose workload requirements to user
db5dcaf ciao-controller: Use payload.WorkloadRequirements in types.Workload
88d1321 ciao-vendor: Copy assembly language files
0c860c9 ciao-controller: Initialise workloads correctly on restart
8c4c6c1 payloads, ciao-{controller, scheduler, launcher}: simplify start payload
d21f575 ciao-controller: Don't allow missing instances to be deleted
dd8a0dd ciao-controller: Mark instances as missing when node is deleted
73d0b66 ciao-controller: Make state transition function a receiver on type
8e53145 ciao-scheduler: remove unused NetworkNode selection code
264203b payloads, ciao-controller: Remove StopFailure
38f80f4 payloads, ciao-controller: Remove unused Restart and RestartFailure
5ecb4a8 payloads: remove unused physical network resource
96d9e8e payloads: remove EstimatedResources from start payload
5aa9803 qemu: Add function to hotplug vfio device
486afac ciao-controller: confirm tenant in base HTTP handler
75bd5df ciao-deploy: Don't upload images as admin for BAT
37c329d testutil: Add a semaphore build script
1e6e7f0 sqlite3db: Fix minor coding style issues
a5385a2 ciao-controller: remove "public" pseudo tenant for workloads
b43b1eb datastore: rename updateWorkload() to addWorkload() and simplify
c0db14f ciao-controller: Store and retrieve workload visibility in database
813a3c5 sqlite3db: Remove tenantID contraint from workload table
6a49592 ciao-controller: Fix reporting level for instance deleted events
9891cb1 ciao-controller: Delete image metadata and data
8224e3d ciao-deploy: Fix missing \n in output
7429faa ciao-controller: refactor startWorkload to reduce complexity.
95b1aed Networking: Add vhost fd support
80c6cc5 ciao-deploy: set TasksMax in systemd service file
73833c2 ciao-controller: start instances in parallel
097a875 ciao-controller: switch to pool allocation for tenantIPs
f2c405e ciao-controller: rework tenant IP allocation
65be72a ciao-controller: report errors properly when setting logDirFlag value
0071afa ciao-controller: add a little logging for image errors
61b3344 ciao-controller: flush log buffer on exit
6f2cf2a Restrict subnet-bits value to a range between 12-30
6b617db singlevm: update the location of verify.sh
fc67855 ciao-deploy: enable mem/disk limits by default
a9e2cff ciao-controller: Remove incorrect closure of request body
dbe75d9 ciao-controller: sqlitedb: initialize Instance StateChange
731e77f ciao-controller: Fix testServersActionStart to wait for DELETE event
68b0dd7 ciao-controller: errcheck: modify unit tests to handle errors
eb83201 ciao-controller: Log whenever a request generates an error
0493ced ciao-controller: errcheck: Ensure all errors are handled or swallowed
77e8c8e ciao-controller: Ensure that instance errors are logged
018c866 datastore: errcheck: Ensure all errors are correctly handled
bbed5b9 client: simplify returned type for quotas
9a7b502 client: split client library by API (& legacy)
171014b ciao-cli: Move client code to it's own package
5b228e3 ciao-cli: Ensure required fields and receivers are exported
692a492 ciao-cli: Split volume client and command handling
40d9fff ciao-cli: split client/command trace functionality
87b016b ciao-cli: Split client/command code for tenants
a0683ae ciao-cli: split quotas functionality
489ebce ciao-cli: split node functionality into client and command code
dd0ac20 ciao-cli: split workload functionality
4638327 ciao-cli: split instance functionality out
45f32a2 ciao-cli: create helper functions for GET/DELETE/POST and parsing
148cf25 ciao-cli: split client code out for image manipulation
4e555a6 ciao-cli: split client code for external IPs
9508a90 ciao-cli: split event code for list and delete
0a3a983 ciao-cli: with a single HTTP endpoint remove unnecessary API
545458d ciao-cli: Improve error handling in core client code
93f436a ciao-cli: remove scopedToken (residual from keystone)
3218b43 ciao-cli: ensure that the field named controllerURL really is a URL
f7aa79c ciao-cli: validate that controllerURL and client certficate are set
ac555b5 ciao-cli: move core client code to new struct
c69798f ciao-controller: do not allow subnet bits to be modified if active instances
fixes #498
Signed-off-by: Julio Montes<EMAIL_ADDRESS>

Wow, now that's a comprehensive commit message! :smile:
lgtm.
Note: the CI is freaking out due to https://github.com/clearcontainers/runtime/pull/835 not having landed yet.

LGTM


[agrifood/azure-agrifood-farming] Fixed typos

Description
closes https://github.com/Azure/azure-sdk-for-python/issues/22591
Please add an informative description that covers that changes made by the pull request and link all relevant issues.
If an SDK is being regenerated based on a new swagger spec, a link to the pull request containing these swagger spec changes has been included above.
All SDK Contribution checklist:

[x] The pull request does not introduce [breaking changes]
[x] CHANGELOG is updated for new features, bug fixes or other significant changes.
[x] I have read the contribution guidelines.

General Guidelines and Best Practices

[x] Title of the pull request is clear and informative.
[x] There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

[x] Pull request includes test coverage for the included changes.

Force merge, as the cspell job was ok


Fix Notification typo, calculate interval

Change Notifcation to Notification to fix ReferenceError and make
notifications work
Change setInterval(..., 5 * 60 * 1000) to setTimeout, and set the timeout
to a calculated number of milliseconds so that the page is updated when the
repo actually changes, rather than 5 minutes after the page loaded. Fall back
to a 1 minute interval if the repo hasn't updated on time.

Motivation
The update check happens 5 minutes after the page is loaded, regardless of
when the last commit happened. This can lead to nearly 10 minutes before the
first refresh happens.
Changes

[x] Ensured that you have rebased your branch with this repo's latest master branch.
[x] Ensured that changes to auto-generated files have not been committed; in particular, *.html, *.csv and *.json files.

Thank you!


Removed sizing for mobile and scaled down to 1/3 for contributors

For issue #762

closes https://github.com/decompme/decomp.me/issues/762


More granular query methods with predicate function and/or props

It would be great to be able to do more granular searches by passing a props or function argument to query methods):
// Given the following tree:
<div>
  <Widget title="First" count="10" active />
  <Widget title="Second" count="20"/>
  <Widget title="Third" count="30"/>
</div>

tree.findComponent('Widget', { title: 'First' });
// => <Widget title="First" .../>

tree.findComponent('Widget', { active: false });
// => <Widget title="Second" .../>

tree.findComponent('Widget', (props) => props.count > 25);
// => <Widget title="Third" .../>

On a related note, it would be nice if there was an everySubTreeLike method analogous to findComponentLike and more "plural" methods to return multiple nodes/components e.g. findNodes/findComponents(Like)/whathaveyou.

Hi!
Thanks for the feedback.
The current inconsistent APIs are mostly a result of evolution from the original API and various holes we found via internal use. Every time I added a feature I kept backwards-compatibility with the previous stuff.
I'm not entirely sure that all the existing APIs make sense.
I like the idea of being able to pass a filter function as well.
There's also a semi-hidden chai plugin you can require as skin-deep/chai, which can lead to some nicer assertions.
At the moment there's 3 different families:

subTree - get another SkinDeep object by CSS selector
findNode - get a node by CSS selector
findComponent - get a node by component/props

And currently subTree has the every variant, and component has the like variant.
This seems a bit muddled - internally the implementation is all just a single tree-walk function which takes a predicate - so any combination of the above is pretty doable.
We could just expand all 3 flavours so they support all the variants, but ideally I'd like to trim down a bit.

Here's some stats from our 3 internal testsuites - I'll ask around the office as well and see what people think.
grep -hriEo 'findComponent(like)?|(every)?subTree|findNode' -- test | sort | uniq -c | sort -n

   4 findComponent
  10 everySubTree
  36 findComponentLike
  45 subTree
  86 findNode

   2 subTree
   5 findComponentLike
 101 findNode

   2 findComponentLike
   2 subTree
  63 findNode

The skew towards findNode is likely because that was the original API, rather than it being any better.

Thanks, that's good info. I agree that the API could use some refinement.
One thing about my use case is that my app has very few ids or classNames (we use react-css-modules, so we have mostly styleNames), so I found findNode to be of limited utility.

We've actually been putting in specific classes for our end-to-end selenium tests, and then hooking some unit tests of those, eg .qa-login-button. We're starting to move away from this for unit tests towards more subTree and findComponent based approaches.

One thing I've noticed we do a lot is findNode('ComponentName') and then assert on props - this doesn't help if you have many components, but does give better errors if there's one.

We had a chat internally, current thinking is to trim down to

everySubTree
everySubTreeLike
subTree
subTreeLike

And expand these so they all take a selector as the first argument, and a props object / predicate as the second argument.

Summary of current plan

[ ] Expand subTree functions to accept (selector, props | predicate).
[ ] Add (every)subTreeLike functions
[ ] Allow passing an array as a selector
[ ] Expose props on the SkinDeep object
[ ] Add deprecation warnings to every non subTree function

That sounds great!

I'm working on writing up notes for a v1.0 API - what do people think about changing subTree to do what subTreeLike currently does, and adding a subTreeExact function?
The idea is to change the API to push users towards loose selectors over strict ones.
/cc @jrunning @hoegrammer @foiseworth @donabrams @hartzis

A possible approach would be to use the fact that the new API will accept a function as the second argument for the overloading:
// match subset of props
tree.subTree('Component', { some: 'prop' });

// match exact props
tree.subTree('Component', sd.exact({exact: 'props'}));

I've posted a draft of introduction and overview docs for what would become the 1.0 API: https://github.com/glenjamin/skin-deep/tree/one-point-oh

Definitely agree with the change to subTree to match functionality of subTreeLike, and everything else you're proposing in the docs for 1.0!
Have you thought about dropping support for react 0.13 when jumping to v1.0?

I thought about dropping 0.13, but we've not upgraded at work yet, and the compat layer is quite thin so I'll probably keep it.
Might do 0.99 and save 1.0 for when 0.13 drops


Help

This works perfectly except files approx 1GB+
When i try to upload large files, it just fails at onerror event, it can not go to onload function.
I'm guessing it is beacuse readAsArrayBuffer(file) is trying to read/load large file into script or browser so can you please improve the script and make readAsArrayBuffer reads files as blob or slice or anything that makes this script let upload larger files(GBs).

I would like that modification too


[Testing] limit mmdet to 2.x

Description
Temporarily, we shall refine mmdet to 2.x before we need extra support.
Test Options

[x] fast test
[ ] full test - HPO
[ ] full test - NAS
[x] full test - compression

Checklist

[ ] test case
[ ] doc

How to test

Errors happen in the azure pipeline only. I cannot reproduce these errors locally...

no need for this


prometheus: measure pending rather than queued time

Measure the time a job has been pending on the queue (ready to be dequeued), rather than
how long it has been on the queue altogether. This will give us a measure for when we need
more workers.
Also record job types as osbuild rather than osbuild:x86_64.

Just as q ; would we ever add architecture as a separate label then?

I think we should :)

Something was up with CI last night btw :/ I think the easiest way to restart the hting is just amend/no-edit & repush.

I split out the queue time fix in https://github.com/osbuild/osbuild-composer/pull/2649, I do think splitting out the jobtype architecture to a label in the metrics  is a good idea, but for that the queries need to change first.

I'm unlikely to have time to finish this up, feel free to take it over / consider it an RFE, if anyone is interested to finish up the remaining piece. I'll close this for now though, as it has mostly landed.


Restic with insecure TLS support

Description
QNAP QuObjects is an "s3 compliant" service on QNAP nas machine.
It can be configured as using tls, but it use a self-signed certificate. Restic can use it but requires "--insecure-tls" argument to use it. Yet k8up doesn't allow to pass that argument to restic.
It can also but used as http, but then restic use a minio compatibility mode which doesnt suit QuObjects and restic fail with "The Content-MD5 you specified was invalid".
Additional Context
No response
Logs
using tls:
1.6723221876801217e+09  INFO    k8up.restic.restic.RepoInit.restic.stderr       Fatal: create repository at s3:https://s3.rennes.home:8443/solidite failed: client.BucketExists: Get "https://s3.rennes.home:8443/solidite/?location=": x509: certificate is not valid for any names, but wanted to match s3.rennes.home

using plain http:
1.6723222329661973e+09  INFO    k8up.restic.restic.RepoInit.restic.stderr       Fatal: create key in repository at s3:http://s3.rennes.home:80/solidite failed: client.PutObject: The Content-MD5 you specified was invalid

Expected Behavior
Using restic command-line it works :
export RESTIC_REPOSITORY="s3:https://s3.rennes.home:8443/solidite"
restic init --insecure-tls
created restic repository 493e88aa9c at s3:https://s3.rennes.home:8443/solidite
....
Please provide a way to propagate that --insecure-tls to restic
Steps To Reproduce
No response
Version of K8up
v2.5.2
Version of Kubernetes
v1.25.3+k3s1
Distribution of Kubernetes
k3s

Hi @sebt3
Thanks for opening this issue and the interest and sorry for the late response.
I've allowed myself to change the title to a generic feature request where one can specify to ignore TLS verification. However, TLS verification being enabled by default is by design and the skipping verification is not a bug.
As of now, there's no possibility to backup to a Restic repository with a self-signed certificate. You might be able to backup using an alternative backend, e.g. non-TLS backend (http) or using the Restic REST server without TLS.

It can also but used as http, but then restic use a minio compatibility mode which doesnt suit QuObjects and restic fail with "The Content-MD5 you specified was invalid".

Just extending up this. I'm not sure what exactly you mean with minio compatibility mode.
Restic is indeed using the S3 client by Minio, regardless if TLS is enabled or not. See here: https://github.com/restic/restic/blob/f5f13f6648528906e1ce73a5b0773a2a0f0a1509/internal/backend/s3/s3.go#L28. So, I'm not entirely convinced if a --insecure-tls flag is actually going to solve your "Content-MD5" issue with QNAP even with TLS.

As of now, there's no possibility to backup to a Restic repository with a self-signed certificate. You might be able to backup using an alternative backend, e.g. non-TLS S3 backend (http) or using the Restic REST server without TLS.
I went that road : installed minio on my NAS using the qpkg alternative store, and got backup working even before oping this issue ;)

So, I'm not entirely convinced if a --insecure-tls flag is actually going to solve your "Content-MD5" issue with QNAP even with TLS, it sounds more like QNAP "QuObjects" itself is actually the incompatible part (or it is working but the error is completely unrelated to QNAP/Minio).
I was more speculating than anything but since QuOjbects is close source, i'll side with your guess.

Still, being able to propagate restic specific arguments (including --insecure-tls) would be a great addition to k8up

@sebt3
I'm chaning the issue a bit so that it's about a more generic "Allow Passing Additional Flags to Restic" use-case.

How about using a similar environment variable as $BACKUP_RESTIC_OPTIONS, let's say $BACKUP_RESTIC_FLAGS and adding those flags to the command?

How about using a similar environment variable as $BACKUP_RESTIC_OPTIONS, let's say $BACKUP_RESTIC_FLAGS and adding those flags to the restic command?

This would totally solve my problem, and could be a answer to this one : https://github.com/k8up-io/k8up/issues/317
I need to exclude the "lost+found" folder from the backup because i use longhorn volume.
i would like the pass the "--exclude /**/lost+found" flag...

@hugosxm how did you manage to use BACKUP_COMMAND_RESTIC to set --exclude? I can't figure it out :confused:


DOSBox Manifest

Adding DOSBox to repo ( Hoping there's no duplicate on this one :) )
Microsoft Reviewers: Open in CodeFlow

Honestly it might be better if this was replaced with joncampbell123/dosbox-x instead. It's far more maintained and supports more hardware.


Solves nil pointer dereference

When calling (NetconfServiceProvider).GetConfig with an empty EntityCollection panics cause of a nil pointer dereference. Adding these if-guards seems to solve the problem.

Correct, that's the right way to do it. That was just a quick fix of mine, should have thought about it


Allow webpack 2 rc

Fixes this warning:

warning Incorrect peer dependency<EMAIL_ADDRESS>

Current coverage is 85.84% (diff: 100%)

Merging #308 into master will not change coverage

@@             master       #308   diff @@
==========================================
  Files             4          4
  Lines           332        332
  Methods          68         68
  Messages          0          0
  Branches         71         71
==========================================
  Hits            285        285
  Misses           47         47
  Partials          0          0

Powered by Codecov. Last update 8232a3e...d0560e7

@cesarandreu you might want to relax the version, as of now there is a 2.2.0-rc.1 version.

@bondz ^2.2.0-rc.0 will catch the new rc.1 version

@tleunen, cool. I did not know that :) Just waiting to have this merged.

The extract-text-plugins need to be upgraded to webpack 2 rules config so we can't merge it yet.

What needs to be done? @sokra

duplicate of https://github.com/webpack/extract-text-webpack-plugin/pull/306

@bondz @sokra looks like it's just a doc fix as this package works fine on the RC for me.

Here's the PR for that fix: https://github.com/webpack/extract-text-webpack-plugin/pull/312/files

@graingert :+1

https://github.com/webpack/extract-text-webpack-plugin/commit/cbd4690856707cbaaade1e960bfb2aef044cdeb3

@cesarandreu This has been fixed in #cbd4690

Just found this most fantastic workaround until a release is pushed:
npm install --save-dev webpack/extract-text-webpack-plugin#cbd4690

@maintainers, could you please close this PR as the change is already merged?

@maintainers, could you please close this PR as the change is already merged?

Done.


support easyllm

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.

internlm 8b -> internlm 7b

ok


hits wrong API endpoint

Hello
I tried to set up this
I have gate running go vcs.domain.com and gitea-kanban on cm.domain.com
I added cars to vcs to allow cm
but now I get this error a 404 when trying to connect here
https://vcs.domain.com/api/v1/kanban/filters?token=7a621a2267457b1dcf5923b69d2cc69843279
that api endpoint doesnt exist.
any tips? what am I doing wrong
thanks

The kanban depends on gitea fork:
https://github.com/gigforks/gitea/tree/iyo_integration
which includes integration with itsyou.online, so it won't work with the normal gitea binaries


test(eth-jsonrpc): Added a python end-to-end testing subproject

Added a python end-to-end testing subprojec, integrated it into the normal testing flow, tested ethereum json-rpc.
This change introduces the infrastructure and testing framework for writing powerful high-level scenarios that test complex multi-node behaviors. It is based on ethereum json-rpc api (via web3.py client library), and at the moment the test scenarios there touch upon almost every method of the api.
The hope is that this will become a foundation for future work on end-to-end testing, as it is too tedious and slow to write this kind of tests in C++, plus this allows a better separation of labor, enabling dedicated testing engineers that need not know C++.

@Taraxa-project/ledger
I added the facility to treat the test failure as warning like we discussed on the meeting: https://github.com/Taraxa-project/taraxa-node/pull/953/files#diff-7d0eccc9cdd9d058e15201d554287664eded6bc96a22e0e3822e3b40fca587dcR8


Events List - View Past Events Toggle

When you are in the current term on the events list and click the toggle View Past Events to be on, then you go to previous terms and the toggle stays on. However, when you are in the current term and toggle View Past Events off, then there it automatically sets the toggle in the past terms off without the option of turning it on. In the past terms, the toggle should always be on.

 Events List - View Past Events Toggle


Prove claims in fixed order

The backend is not consistent about the order in which claims are proved. Claims should be proved in the order they are written in the specification.

The solution in #2199 doesn't work because the claims are simplified and then sorted again. I would propose that to solve this issue, the claim simplification step would keep a mapping from the original claim to the simplified (conjunction of) claims. Then, the backend will be made to prove the simplified claims, but in the order of the original claims.

This is blocking #2174.


MGDOBR-1022: add processing error dashboard

MGDOBR-1022
PR owner checklist
Please make sure that your PR meets the following requirements:

[x] Your code is properly formatted according to this configuration.
Run mvn clean verify -DskipTests so that imports are correctly set.
[x] Your commit messages are clear and reference the JIRA issue e.g: "[MGDOBR-1] - $clear_explanation_of_what_you_did"
[x] The layers in the kustomize folder have been updated accordingly.
[x] All new functionality is tested
[x] Pull Request title is properly formatted: MGDOBR-XYZ Subject
[x] Pull Request contains link to the JIRA issue
[x] Pull Request contains link to any dependent or related Pull Request
[x] Pull Request contains description of the issue
[x] Pull Request does not include fixes for issues other than the main ticket

PR reviewer(s) checklist

[ ] Check if code and Github action workflows have been modified and if the modification is safe
[ ] If the modification is safe, add the safe to test label

How to trigger pipelines and use the bots:

Run the end to end pipeline
Annotate the pull request with the label: safe to test. If you want to run the pipeline again, remove and add it again.

Rebase the pull request
Comment with: /rebase.

Deploy BOT
Comment with `/deploy <dev,stable> when the PR has been merged to deploy to a target environment.

It seems the queries would not working properly if there is more than one pod running for the manager. Could you double check?

It seems the queries would not working properly if there is more than one pod running for the manager. Could you double check?

It should be ok now, please take a look @r00ta. Thanks.


Style2Paints V4 can still be used

I've managed to find the web app working in the wayback internet archive
https://web.archive.org/web/20181108204853/http://s2p.moe/
If anyone is interested in an offline version, I managed to get the HTML files and put them here (might have missing files) : https://github.com/FreezyChan/s2p-V4-browser-recover
(If the creators want me to take down the HTML files from Github, Feel free to answer this thread and I'll take them down as soon as possible)

Edit: Just realized it doesnt works correctly. This thread is being closed


clear SecretManager cache when workload is updated/removed

part of https://github.com/istio/ztunnel/issues/729

@GregHanson: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

test_ztunnel
73a2d907187a74d58c16a2c3244eeb9dc6ad8ace
link
true
/test test

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

I am not sure we want to trigger it here, the cert is shared by multiple pods

Not only that, but if users are using the default service account all the pods in their namespace, the cert could be shared by multiple workloads.

the logic could be moved to WorkloadStore, potentially adding another index by_identity which could keep track of workloads by their identity, and know to clear the identity from SecretManager when all workloads for an identity are removed.  @howardjohn @keithmattix thoughts?

Is there a bug caused by not clearing the cache? Do we anticipate a perf bump from clearing the certs? Or is the motivation from a security aspect of ztunnel not holding any more certs than it needs to? The last option is the only one that's compelling to me so far tbh

there's a few outlined in https://github.com/istio/ztunnel/issues/351#issuecomment-1434804006
but there is also the case where a root cert rotation is performed.  All workloads get pushed via WDS as a full push update - but the SecretManager is never notified so the cache is stale until ztunnel pods are restarted or the certs expire

Clearing a cert has a very very high cost. It can easily take >1s of CPU time, and some CAs have a per-cert cost (I have seen 50c a cert). We need to be very cautious about when we request one/delete one

We need to be very cautious about when we request one/delete one

I'm not sure how to improve this on a FullPush scenario in the event of something like a root cert rotation - unless we modify the WDS API to signal a cert/identity change?

A full push should not trigger certificate rotation, they are completely
unrelated concepts.
On Fri, Nov 17, 2023 at 1:31 PM Greg Hanson @.***>
wrote:

We need to be very cautious about when we request one/delete one
I'm not sure how to improve this on a FullPush scenario in the event of
something like a root cert rotation - unless we modify the WDS API to
signal a cert/identity change?
—
Reply to this email directly, view it on GitHub
https://github.com/istio/ztunnel/pull/730#issuecomment-1817132898, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAEYGXMYDR25OKLWWOCBEO3YE7JSVAVCNFSM6AAAAAA7QJ3BZGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMJXGEZTEOBZHA
.

Since clearing a secret maybe a costy op, i think maybe we can do a lazy clear.  We can do it when rotating, that could be an appropriate point

Ideally we need a way to actually instruct ztunnel to proactively do cache invalidation for its certs.
If we had SDS this would be relatively straightforward, but since we don't we will probably have to modify WDS.

Since clearing a secret maybe a costy op, i think maybe we can do a lazy clear. We can do it when rotating, that could be an appropriate point

Are you thinking only clearing and the secret whenever the workload is serve as a source or target of a traffic flow?

@linsun Nope, i am thinking about lazy clearing it when we need to refresh it, so we can reduce the lock time, concern from @howardjohn https://github.com/istio/ztunnel/pull/730#issuecomment-1817118784

I think @hzxuzhonghu's proposed method should handle the identity removal as needed.
For cert invalidation, on a root cert rotation for example, I agree with Ben's proposal for modifying the WDS API.  @ilrudie proposed adding the certificate serial number as a field to the Workload API, which could be used for signaling the secret cache in ztunnel that the existing certs for that identity need to be invalidated

I think @hzxuzhonghu's proposed method should handle the identity removal as needed.
For cert invalidation, on a root cert rotation for example, I agree with Ben's proposal for modifying the WDS API. @ilrudie proposed adding the certificate serial number as a field to the Workload API, which could be used for signaling the secret cache in ztunnel that the existing certs for that identity need to be invalidated

Root cert rotation is different from intermediate cert got updated. Which scenario are you after? I thought it is for intermediate cert.
Q for identity removal here, do remove identity + add the new identity when ztunnel refresh the cert as part of the 24 hour validity duration?

@ilrudie proposed adding the certificate serial number as a field to the Workload API, which could be used for signaling the secret cache in ztunnel that the existing certs for that identity need to be invalidated

Any concerns with this approach? I think @GregHanson is working on POC this.  Would certificate serial number be strong enough here? cc @istio/wg-security-maintainers @hzxuzhonghu @howardjohn @keithmattix

The xDS control plane only knows the serial number in demo setups. We cannot assume XDS and CA are the same or have visibility into each other.

The xDS control plane only knows the serial number in demo setups. We cannot assume XDS and CA are the same or have visibility into each other.

I don't agree that is only for demo setups!  If users were following our docs to plugin intermediate CA certs into Istiod, Istiod know the CA cert serial number. I believe in recent istiod, there is no restart needed for istiod to pick up the updated intermediate CA certs.
I do agree with your statement that XDS and CA may not be the same where istiod may not be the CA where cert manager or spire is the CA. In this case, I think it is reasonable to assume the updated intermediate CA certs by picked up by the spire agent or wait till ztunnel refreshes the cert as part of the 24 hour validity duration.

by picked up by the spire agent

SPIRE is not the only way for users to integrate Istio with an external PKI. cert-manager (through istio-csr) and Kubernetes CSR are both supported options where istiod never sees the minted leaf certs. Generally, I think we should be wary of any solution that assumes that the thing generating the WDS payload is the thing providing the certs.

by picked up by the spire agent

SPIRE is not the only way for users to integrate Istio with an external PKI. cert-manager (through istio-csr) and Kubernetes CSR are both supported options where istiod never sees the minted leaf certs. Generally, I think we should be wary of any solution that assumes that the thing generating the WDS payload is the thing providing the certs.

Agreed spire is not the only way, i was giving it as an example. For public cloud, I agree, users probably won't be looking into plugin intermediate CA certs into Istiod, but I can see it being used for on prem. Istiod as a CA or plugin external CA both are supported scenarios of Istio.

Not a PKI expert here but IMO...

Root cert rotation should not actually trigger new certificates to be minted. This is both expensive and unsafe. Correct way to rotate a root is to distribute the new roots and then start moving new certificates over, then removing the old one. You cannot just atomically swap the old and new, nor just atomically move everything over to 'new' even keeping 'old'.
Eventually you do need to mint certificates with 'new'. Is 12hr short enough for this, or do we need something between "instant" and "12hr"? 12hr seems fine to me... plus you can always force it w/ restart
Our current root cert distribution with istiod is broken/wrong, as its coupled to signing

Root cert rotation should not actually trigger new certificates to be minted.

@howardjohn same opinion when it's a change in an intermediate cert update?

Root cert rotation should not actually trigger new certificates to be minted.

@howardjohn same opinion when it's a change due to an intermediate cert update?

Yes, if you immediately get a new cert, a workload will then send request to with the cert. The server may not have the new intermediate yet and not trust it?

@GregHanson can you pls update the github issue with the behaviors of sidecars and ztunnel on intermediate cert changes?  I think that will help everyone understand and decide if this is acceptable.

ztunnel
sidecar

intermediate cert changes picked up immediately?
NO
NO

intermediate cert changes picked up at 12 hour refresh interval
YES
YES

pick up root cert changes immediately?
NO
YES (feature flag & PCDS)

also not a PKI expert, but my thoughts are if there is an error after root cert or intermediate cert change - do you really want to wait up to 12 hours to find out about it?  I guess right now the only way to sanity check is as John said, to perform selective restarts of pods to force the reload.

Not a PKI expert here but IMO...

Root cert rotation should not actually trigger new certificates to be minted. This is both expensive and unsafe. Correct way to rotate a root is to distribute the new roots and then start moving new certificates over, then removing the old one. You cannot just atomically swap the old and new, nor just atomically move everything over to 'new' even keeping 'old'.

You always need to distribute a replacement root before you do anything, but things downstream of the root CA have no control over how rapidly the replaced root cert will be invalidated - they may be told how rapidly but they don't have control over it, and that's by design.
Istiod doesn't really have control over how or when root certs or rotated (beyond the reasonable assumption that it should be able to obtain a new one before the old one is revoked), and really should only care about its intermediate certs. Istio is at most an intermediate CA in terms of responsibility.

Eventually you do need to mint certificates with 'new'. Is 12hr short enough for this, or do we need something between "instant" and "12hr"? 12hr seems fine to me... plus you can always force it w/ restart
Our current root cert distribution with istiod is broken/wrong, as its coupled to signing

The time duration istio has to perform this is (time you get replacement cert from your CA) + (time until the old cert is revoked, which the CA can tell you). I don't really know as Istio itself needs to have a duration configuration for this.

I suggest separating root cert update with clearing a cert while a pod deleted. Otherwise it is too diverged

closing for now since the implementation will require further design work


Subscription scopes doesn't work

Cashier Version: 11.2
Laravel Version: 7.0
PHP Version: 7.3.11
Database Driver & Version: sqlite 3.29 & mysql 8

Description:
Hi, I found a bug using Subscription's scopes.
All scopes are overwritten by scope-named method (active overwrite scopeActive.. etc.)
Other users experienced similar issues: https://laracasts.com/discuss/channels/general-discussion/error-when-calling-scope-deprecated-non-static-method?page=0
Steps To Reproduce:
\Laravel\Cashier\Subscription::active()->count()

results:
ErrorException
Non-static method Laravel\Cashier\Subscription::active() should not be called statically

I tried also to call \Laravel\Cashier\Subscription::scopeActive()->count() but the result is simliar.
It is the same for ALL scope methods.
One suggestion (that brokes back-compatibility, but these methods never worked) is to rename all scope-named method with a is prefix. (eg. isActive isIncomplete).
I found a tricky fix here https://laravel.io/forum/non-static-method-should-not-be-called-statically-for-scopes

$users = User::whereHas('subscriptions', function ($query) {
    $query->whereName('gold')->active();
})->get();

https://github.com/laravel/cashier/pull/609
I'll try to document these when I get back from vacation.

The bug remains. These scopes are not usable directly with the Subscription model.

@joke2k did you even read the example I posted above? There's no bug here.

@driesvints yes, I read it and thank you.
But in my opinion, the bug exists and it is with wrong naming of scope and the scope-named methods.
https://laravel.com/docs/7.x/eloquent#local-scopes
If I read that Subscription has a scopeActive I'm expecting to use it as Subscription::active() receiving an error (like I did), and in Laravel this is a bug.
You propose to use whereHas on User model and could work but that is not the same (returning User instead Subscription, not necessary join, need to collect all subscriptions and flatten in order to use them... ).
btw, put a lebel "wontfix" to this issue


How to handle Incognito Mode?

For extension developers, Firefox now fully supports the value not_allowed for the manifest incognito key.  As with Chrome, specifying not_allowed in the manifest will prevent the extension from running or receiving events from private windows.
– https://blog.mozilla.org/addons/2019/03/26/extensions-in-firefox-67/

I think IPFS Companion shouldn't work with incognito mode. I think if a site uses IPFS, IPFS Companion will request it with the local gateway which (as far as I know of) has no concept of incognito mode so it will store and seed those sites or their content until gc runs (which again is still disabled by default (isn't it?)) and thus potentially leak that the site has been visited while incognito mode isn't supposed to store content locally.
Personally I have disallowed IPFS Companion from running in Firefox private windows, because it makes testing sites loading content from IPFS easier than opening a different browser for it and lately that has been the only time when I seldom use private windows (if I really wanted something to be private I would use Tor Browser).

@Mikaela  I agree, due to fingerprinting surface we should disable it in Incognito for now. Would you be up for making a PR that adds proper key to manifest.common.json?

Enhanced Privacy Controls in Firefox 67 landed in stable channel.

_https://hacks.mozilla.org/2019/05/firefox-67-dark-mode-css-webrender/:_

I tested this and disabling Companion in incognito using controls provided by the browser works as expected, so old users can do it manually until https://github.com/ipfs-shipyard/ipfs-companion/pull/705 lands.


Config

Hi, where do I tell it which logs to monitor?

Hey @acosonic, it has been a long time but hopefully I have good news!
I've enriched the application quite a bit since you posted this (very 1st!) issue, especially in the last few days. I've taken the time to document the requirements as much as possible, while simplifying the whole flow.
Have a look at both getting started and running it sections on the README.
It might seem like a lot to get through to fire-up the application, but that's just me elaborating on each step.
Thank you for pointing this out! 🙌  It helped me realise that my instructions - and the application itself - needed simplification...


Add an ignore list, or a function that will be called on each url

Is your feature request related to a problem?
We use a bunch of redirects with Cloudflare as some-short of a link shortener. eg /s/discord redirects to https://discord...
So a lot of our links in our md pages are [Discord](/s/discord), That way we can change the URL without having to touch all the files.
This makes validator error out.
Describe the solution you'd like
Provide a way to "override" the result of the validation per url.
Either ignore list of a function that will be called per url.
Describe alternatives you've considered
Creating "dumb" pages in docs/ eg docs/s/discord.md
Additional Context
No response

Thanks for your feedback :raised_hands:
Interesting, this is not something I considered before. Small question as I am not familiar with: do Cloudflare redirects work locally?

Thanks for your feedback :raised_hands:
Interesting, this is not something I considered before. Small question as I am not familiar with: do Cloudflare redirects work locally?

Nope, it only works when you hit their servers

Thanks for your feedback 🙌
Interesting, this is not something I considered before. Small question as I am not familiar with: do Cloudflare redirects work locally?

Nope, it only works when you hit their servers

That's interesting. This makes me wonder if these links should not be external so they work both in prod and dev environments? 🤔 Is the expected experience to get a 404 locally?

I suppose yes.
Which is probably why I thought to have the ignore list / func, instead of trying to handle those somehow.
Do you have anything else in mind?

My thinking at the moment is that is they were external links, this plugin would automatically ignore them, and they would work both locally and in production (which I think is a better experience because it just works and you can actually see when you make a mistake).
(just to be sure, my questions are not to dismiss the idea, more to understand the exact problem and see if an ignore list is really the better approach as it can open a can of worms)

I could use full urls like https://example.com/s/discord, which should make validation ignore them, but I like to have them as /s/discord, so I dont like to hardcode the domain on a bunch of places.

Thanks for the feedback and answering my questions.
v0.8.0 now includes an exclude option:
export default defineConfig({
  integrations: [
    starlight({
      plugins: [
        starlightLinksValidator({
          exclude: ['/social/discord', '/social/twitter'],
        }),
      ],
    }),
  ],
})

Awesome!
Thanks


Incorrect shadow and light handling (broken shadows)

Hi! First of all thanks for this nice framework!

I put this under Mind AR and the shadows are messed up.
If I try to do with Mind AR:
-There is no shadow in the case of directional light.
-In the case of point light, if I set certain parameters irrationally high, some ugly shadow appears, otherwise nothing.
Looking at your code, you control the camera matrix directly in the scene, according to my guess, the shadow and light management module is not in sync with this, so it gets messed.
Based on experiments, everything is too big, so in the case of a 3D engine, the unit is 1 meter. If I hold the marker about 30 cm from the camera, I expect a distance of 0.3, but instead it is about 3000. The large size may also be correlated to the original pixel resolution of the marker, 2000-3000 pixels, I don't know.
I think the shadow rendering is optimized for a range of 10-100 meters and also uses the parameters from the camera. According to my assumption, direct matrix overwriting also affects shadow management.
Source code snippet with directional light source, no shadows visible:
<a-camera position="0 0 0" look-controls="enabled: false"></a-camera>
<a-entity id="example-target" mindar-image-target="targetIndex: 0">
        <a-box position="0 0 0.2" rotation="0 0 0" color="#4CC3D9" scale="0.1 0.1 0.1" shadow="cast:true; receive:true;"></a-box>
        <a-plane position="0 0 0" rotation="0 0 0" width="10" height="10" color="#FFFFF" shadow="cast:true; receive:true;"></a-plane>
        <a-entity light="type:directional; castShadow:true;" position="1 1 5"></a-entity>
</a-entity>

Source code snippet with point light source, distance parameter is huge: 100000, has shadows, but is highly pixelated:
<a-camera position="0 0 0" look-controls="enabled: false"></a-camera>
<a-entity id="example-target" mindar-image-target="targetIndex: 0">
        <a-box position="0 0 0.2" rotation="0 0 0" color="#4CC3D9" scale="0.1 0.1 0.1" shadow="cast:true; receive:true;"></a-box>
        <a-plane position="0 0 0" rotation="0 0 0" width="10" height="10" color="#FFFFF" shadow="cast:true; receive:true;"></a-plane>
        <a-entity light="type: point; intensity: 0.75; distance: 100000; castShadow:true;" position="1 1 5"></a-entity>
</a-entity>

I am also attaching some pictures. What could be done?

Directional light in A Frame inspector mode:

Point light in A Frame inspector mode:

This workaround seems to work:
Mr. @hiukim do you have an idea?
    <a-entity light="type: ambient; intensity: 0.5;"></a-entity>

    <a-entity id="example-target" mindar-image-target="targetIndex: 0">
      <a-light
      id="light"
      type="directional" position="0 1 1" rotation="0 0 0"
      target="#directionaltarget"
      light="
        type: directional;
        castShadow: true;
        intensity: 0.4;
        shadowBias: -0.0005;
        shadowMapHeight: 2048;
        shadowMapWidth: 2048;
        shadowCameraFar: 5000;
        shadowCameraLeft: -2000;
        shadowCameraRight: 2000;
        shadowCameraTop: 2000;
        shadowCameraBottom: -2000;
        shadowCameraVisible: false;
        shadowRadius: 8;
      "></a-light>
      <a-entity id="directionaltarget" position="0.1 0 -1"></a-entity>
      <a-box position="0 0 0.2" rotation="0 0 0" color="#4CC3D9" scale="0.1 0.1 0.1" shadow="cast:true; receive:true;"></a-box>
        <a-plane position="0 0 0" rotation="0 0 0" width="10" height="10" color="#FFFFF" shadow="cast:true; receive:true;"></a-plane>
    </a-entity>

I don't know for sure.  my two cents: yes I think It's possible that because the camera matrix is very unusual and the distance of the augmented objects is of a different magnitude than the one expected for the shadow so it got weird pixelation.


Kubernetes

Closes #116
Depends on #220
Open to PRs/patches! I'm still very new to Kubernetes, so please shout at me if you see any issues.

FWIW: https://twitter.com/kelseyhightower/status/963413508300812295?lang=en

Oh yeah, I definitely know. I think running postgres, redis, etc. in kubernetes should be an option here, but we should also allow it to work with externally hosted services (like RDS).

One solution I've come up with for projects is to instead provide a
pgbouncer+pgpool interface.
It still doesn't "scale" like kube expects to scale, but at least it
doesn't delete data when you scale 0.
On Fri, Jun 7, 2019, 1:03 PM Zac Anger<EMAIL_ADDRESS>wrote:

Oh yeah, I definitely know. I think running postgres, redis, etc. in
kubernetes should be an option here, but we should also allow it to work
with externally hosted services (like RDS).
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/entropic-dev/entropic/pull/204?email_source=notifications&email_token=AACRXWOFW2XRXZLETKZUFMTPZK5JTA5CNFSM4HVZIQCKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODXG3KHI#issuecomment-500020509,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AACRXWIBLNASI64QD67NNFDPZK5JTANCNFSM4HVZIQCA
.

I'll be honest, I'm a total postgres noob, but I'll take your word for it. Is that something we should consider adding?

You want pgbouncer if you expect a lot of connections. You want pgpool if
you have a LOT more reads than writes.
On Fri, Jun 7, 2019, 6:01 PM Zac Anger<EMAIL_ADDRESS>wrote:

I'll be honest, I'm a total postgres noob, but I'll take your word for it.
Is that something we should consider adding?
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/entropic-dev/entropic/pull/204?email_source=notifications&email_token=AACRXWOHPGC4UGNSYPE2HYLPZMAFRA5CNFSM4HVZIQCKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODXHJZ3A#issuecomment-500079852,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AACRXWIT5FDIN45BMGXAQ6DPZMAFRANCNFSM4HVZIQCA
.

@krainboltgreene I ended up removing Postgres from this entirely, since that seems like a decision admins should make (I know I'll end up just using RDS).

There've been a lot of changes today, so I need to give this another full test both locally and in my test cluster, but I think it's done enough to ask for a review.

That's pretty much how I feel about it. I am not a DBA and don't want to be one, and (maybe I'll end up being wrong about this, but) I don't think the target admin type user here is a DBA, or even an ops person. It's probably someone who cares about Node a lot, and may or may not have any database or operations experience.

I know quite a bit about this surface of application development and I would love to do a pair review to transfer the knowledge.

If I understand the misc/k8s directly I believe the current ecosystem leans towards using helm to do this job. Many many people will expect to be able to helm install entropic.

I thought about using Helm, but with Helm 3 coming soon I didn't know if it would be worth doing things twice. Once Entropic is more stable I think it would make sense to try to get charts into the official helm/charts repo, though.

Agreed, and not having helm shouldn't stop this PR.

Why are you converting to yaml here? The Kubernetes api accepts json too, but does recommend yaml. As this project is really against yaml, why not just keep it as json?
https://kubernetes.io/docs/concepts/configuration/overview/

Write your configuration files using YAML rather than JSON. Though these formats can be used interchangeably in almost all scenarios, YAML tends to be more user-friendly.

Good point. I was converting them to YAML because that's much more common, but it shouldn't really matter since it's already uncommon to write them in JS. I think I'll change that.

Some things took priority this week, but I should have this finished up this weekend.

@ceejbot @chrisdickinson @toddself (GH needs an @/moderators, @/maintainers, something like that) I did this in JS because writing out loads of yaml by hand is a PITA, but now I'm wondering if that might seem odd to someone who just wants to get this up and running. How do you feel about the JS generating JSON? It would only take a second to just change that to yaml, not sure which would be more approachable.

Thanks for reviewing, @1stvamp! I've merged this in 6373162.

Thanks @1stvamp and @chrisdickinson!


gh-1657 - Added implementations for schema loader tests.

Added example implementations for the loader tests. This is currently a work in progress.

Codecov Report

:exclamation: No coverage uploaded for pull request base (develop@92d8849). Click here to learn what that means.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             develop    #1660   +/-   ##
==========================================
  Coverage           ?   68.05%
  Complexity         ?      501
==========================================
  Files              ?      306
  Lines              ?     9414
  Branches           ?     1239
==========================================
  Hits               ?     6407
  Misses             ?     2523
  Partials           ?      484

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 92d8849...3a7423e. Read the comment docs.

Closing to split into smaller issues.


Add ext-oracle definition to entity definitions

Relevant information
Add ext-oracle entity type as part of the SAP entities definitions. This was proposed with the first batch of SAP entities, but not put in as we didn't have Oracle data collected then. Now we have worked out to collect metrics for ORACLE based on  customer request, it's time to add it.
Checklist

[x ] I've read the guidelines and understand the acceptance criteria.
[ x] The value of the attribute marked as identifier will be unique and valid.
[ x] I've confirmed that my entity type wasn't already defined. If it is I'm providing an
explanation above.

LGTM
@edyu002 we have an existing oracle definition https://github.com/newrelic/entity-definitions/tree/main/definitions/infra-oracledbinstance
I would suggest you to check if that fits with your use case to avoid a new type.
If that's not the case lets us know and we will merge this one

We'd like this request get merged first.
We have looked at the infra-oracledbinstance definition in the process. There are 2 issues for us to use it: 1. As the data sources are different, metrics measured are not the same. 2. For infra domain types, we can not define entity detail UI based on data source. So we won't be able to see Oracle data in entity UI detail screen.
We are trying to re-use infra-host by simulating OTel metrics, which is simpler, but still waiting infra team to finish their support for open-telemetry to show the UI. In addition, a recent entity definition change on infra-host has broken our simulation . Our first customer installation is coming at 4/8 and they are using Oracle, we have to get Oracle support in before that.
To use infra-oracle may require some in-depth discussions and coordinations, and may impact architecture of the infra entities. For the long term, we will be happy to work with all the involved teams to explore the possibility of merging the entities.

LGTM
@edyu002 we have an existing oracle definition https://github.com/newrelic/entity-definitions/tree/main/definitions/infra-oracledbinstance
I would suggest you to check if that fits with your use case to avoid a new type.
If that's not the case lets us know and we will merge this one

We found it's not feasible to use infra-oracledbinstance for now. We'd like to get this pull request merged.


section for referencing Chessie as a GitHub dep from Paket

PR from a train

You also need to modify paket.references in order to github link a file. Could you please add this as well?

yeah my bad, there it is

It was taught thought, no wifi in Polish trains - hope It builds cause i couldnt check ;)


Additional policy metadata not saved

Issue Template
Prerequisites

[x] I am running the latest version
[x] I checked the documentation and found no answer
[x] I checked to make sure that this issue has not already been filed

Context

Module Version: 2.6.0
Terraform Version: 1.2.3
AzureRM Provider Version: 3.10.0

    "metadata": {
      "version": "1.0.0",
      "category": "Batch",
      "propertyA": "A",
      "propertyB": "B
    },

Expected Behavior
Anything included in the 'metadata' object should be saved to the policy definition
Current Behavior
Any additional metadata besides 'version' and 'category' won't be saved in the policy definition.  In the above snippet, 'propertyA' and 'propertyB' won't be saved.
Possible Solution
I think the problem lies here: https://github.com/gettek/terraform-azurerm-policy-as-code/blob/531e5425c6d4584cbeac8c1019cc2a93629f0ffb/modules/definition/variables.tf#L100
local.category and local.version will always be populated due to the logic on lines 91 and 92.  Since they will be populated, the coalesce function on line 100 will always return the 2nd argument, which is the merge of category and version.  The 3rd argument (the metadata in the policy file itself) will never get used.  This is assuming you don't provide a var.policy_metadata variable.
Also, I tried putting all the metadata into the var.policy_metadata variable instead, but then got an error about not all objects being the same type in the coalesce function, I guess because category and version are strings and policy_metadata is an object.
Failure Information (for bugs)

Steps to Reproduce

Write a policy definition with additional metadata
Deploy it using the 'definitions' module
observe that only 'category' and 'version' fields of the metadata are present in the policy definition when viewed in the Azure portal.

Hi @timwebster9, I have tried to recreate this issue with no luck could you please paste a snippet of your metadata. The module  uses the jsonencode() function so no need for additional wrappers; here is the code I tested:
module "whitelist_regions" {
  source              = "..//modules/definition"
  policy_name         = "whitelist_regions"
  display_name        = "Whitelist Azure Regions"
  policy_category     = "General"
  management_group_id = data.azurerm_management_group.org.id

  policy_metadata = {
    version   = "1.0.0"
    category  = "Batch"
    propertyA = "A"
    propertyB = "B"
  }
}

Plan Output:
# module.whitelist_regions.azurerm_policy_definition.def will be created
  + resource "azurerm_policy_definition" "def" {
      + description         = "Whitelist Regions"
      + display_name        = "Whitelist Azure Regions"
      + id                  = (known after apply)
      + management_group_id = "/providers/Microsoft.Management/managementGroups/policy_dev"
      + metadata            = jsonencode(
            {
              + category  = "Batch"
              + propertyA = "A"
              + propertyB = "B"
              + version   = "1.0.0"
            }
        )

Definition as viewed in the portal:
    "metadata": {
      "category": "Batch",
      "propertyA": "A",
      "propertyB": "B",
      "version": "1.0.0",
      "createdBy": "zzzzzz",
      "createdOn": "2022-06-21T21:32:04.7388749Z",
      "updatedBy": null,
      "updatedOn": null
    },

Thanks @timwebster9 the fallback will be moved to its correct position within coalesce() in the next release

thanks @gettek.  If we need to supply custom metadata, what approach do you recommend?:

put the entire metadata object in the policy .json file
put the entire metadata object in var.policy_metadata
populate var.policy_category and var.policy_version, and the custom metadata in the .json file or var.policy_metadata?

I'd put common ones in the definition.json, anything you parse into var.policy_metadata will intentionally override these at runtime after this fix, as well as var.assignment_metadata if the attributes need to be different at assignment or omit to use the same.


Climbing Stairs

Problem Link
https://leetcode.com/problems/climbing-stairs/
Coding platform
Leetcode
Programming language

[x] C
[x] C++
[ ] Java
[ ] Python

I want to solve this problem in C++ and Java

Hi, @greenblade29  I would like to solve this issue in java.

Hi, @greenblade29 I would like to solve this issue in java.

OK then, you can get it assigned and use Java. I will code in C++ then

Please assign me this problem in C++

@weirdrag08 Try to add new issues

I can do this in C , I got 100% faster for this code

@Abhinav0909 Check your PR.

@Nivedita967 I have updated it. Please do have a check.


[PLC] [Builtins] Changed unlifting ot lists to a straightforward one

Can't believe I spent that much time thinking about a trivial problem. We can easily unlift recursive structures provided we know how to sensibly unlift sums and products (which we don't currently, we use unsafePerformIO there, but this is surely an easier task than the one that we had previously).

Nice!


chore: add volunteer Giuliano1993

@codewithvoid that should be fixed right now. Let me know if any more edit is needed. Thank you!


Bitbucket webhook secret is not matched correctly

Describe the bug
When sending a webhook from Bitbucket to the OPAL server with an secret configured then the the response on the request is an 401,  No secret was provided!. This is unexpected as the configuration looks correct.
To Reproduce

run OPAL server with the following config:
OPAL_POLICY_REPO_WEBHOOK_SECRET=secret (in our case this is a UUID)
OPAL_POLICY_REPO_WEBHOOK_PARAMS={"secret_header_name":"x-hook-uuid","secret_type":"token","secret_parsing_regex":"(.*)","event_header_name":"X-Event-Key","push_event_value":"repo:push"}
OPAL_POLICY_REPO_URL=repo-url
send a webhook request to /webhook with the following headers:
--header 'X-Event-Key: repo:push'
--header 'x-hook-uuid:  secret'
response is 401 No secret was provided!

I have added some extra log statements in the code and I can see that it can find the header and does get the value from the header. Also in the step where it does the regex matching I see that it gets the secret correctly. It is then put on the first place of the matches array. But then this statement tries to get the second item of the array: secret = matches[1] if len(matches) > 0 else None which is empty.
Expected behavior
I would expect that it would be able to match the secret in the webhook request with the secret that is configured in the server.
Screenshots
no screenshots
OPAL version

Version: 0.4.0

Hi @rstarre  - you are correct this is defiently a bug; thank you for reporting this, and sorry for the inconvenience.
I'll have a PR to fix this and the tests for this tomorrow.
In the meanwhile as a stop-gap solution - I can suggest you use a regex that contains another empty match-group-  i.e. "()(.*)" instead of "()"


Checkbox does not update when 'checked' property is set to state property

Environment

OS: Windows 10
Node: v12.4.0
NPM: 6.9.0
YARN: 1.15.2
react-advanaced-form: 1.7.2

What
Current behavior
Please describe how it behaves at the moment.
I am trying to update the 'checked' property in a form after an async operation. However the checked property does not seem to change. I have reproduced this problem in this sample and it's without async (so not important). Here is the code: https://codesandbox.io/s/musing-elion-iic9q?fontsize=14
What am I doing wrong?
Expected behavior
When the state value is true it should show the checkbox as checked and when the state value is false it should show it as unchecked.
Why
Why do you think the issue occurs?
At first I thought it's about async and it has an issue with this, but after the bug reproduction which does not use async i realized that it's not that. I couldn't figure out why so far.
How
Steps to reproduce the issue (ideally, link to the repository/sandbox).
https://codesandbox.io/s/musing-elion-iic9q?fontsize=14

This is a saved sample code. https://codesandbox.io/embed/cranky-edison-zso5c

Hello, @gabrielaradu. Thanks for reporting that!
I'm sorry to hear that you've experience this issue. That appears to be an old problem with how checkboxes are handled in general. If you are interested, I will provide more technical details below.
Original mention:
https://github.com/kettanaito/react-advanced-form/blob/9744b79b0c7de915d543f26b4aab64eaee6dfd82/src/components/createField.jsx#L142-L144
Technical details

In order to determine a proper update logic for a field, the library checks if a field is controlled or uncontrolled (those two use different update cycles described here)
The original implementation marks a field as controlled only if it has a value prop. With checkboxes that won't work, since their value is stored in the checked property, and that is the property that determines if a checkbox is controlled

However, there is a technical implication due to the lack of such thing as initialChecked, an analog to initialValue for value of an uncontrolled input. There is no prop-level flag to determine if a checkbox is controlled or not: both controlled and uncontrolled checkbox use checked as a value holding prop.
What to do?
That being said, there is a workaround how to operate with the checkbox value. There is a method on Form called setValues(). It allows to set values of a single or multiple fields at a given point of time.
In your case you would need to set the value of the checkbox1 field depending on your state. Here's a draft:
constructor() {
  // Creating a ref to store the Form
  this.formRef = React.createRef()
}

// button click handler
changedState = () => {
  this.formRef.current.setValues({
    checkbox1: nextValue
  })
}

// render part
<Form ref={this.formRef}>

The sandbox with the working scenario: https://codesandbox.io/s/raf-controlled-checkbox-qdv1k
Please let me know if that helped. Feel free to ask any questions or communicate issues/suggestions. Always happy to hear both.

Also, if you have an idea how to handle controlled checkboxes, please share it here. I'm (passively) working on a rewrite of this library and this is one of the things it needs to cover. Thanks.

I'm closing this since there is no better solution than the one suggested above.
Still let me know whether that helps, and in case you have any issues. Thanks.

Sorry for this late reply. It took me a while to understand the way this works, I was/am learning React.js and JavaScript. I understand now what you said and keep using this with controlled components (it fits my requirements). Thank you a lot for your detailed response.

@gabrielaradu No worries! I'm glad it was helpful. Once more my apologies for the inconvenience.


Create SonarCloud GitHub Action

Codecov Report

:exclamation: No coverage uploaded for pull request base (minimize-bundle@2f078b3). Click here to learn what that means.
The diff coverage is n/a.

@@                Coverage Diff                 @@
##             minimize-bundle      #37   +/-   ##
==================================================
  Coverage                   ?   46.77%
==================================================
  Files                      ?       51
  Lines                      ?     1178
  Branches                   ?      344
==================================================
  Hits                       ?      551
  Misses                     ?      626
  Partials                   ?        1

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2f078b3...e1d5eba. Read the comment docs.


Putting devCredits, devBanner, devToons(planned) all together in one frontend

Just a random idea. How about putting devSomething collabs into one frontend?
Maybe we can host with devRant.com later time.

im fine with that.

i own the devrant community github account..... so we could use that.

What is the account?

Check my new collab. It's a mess because I am tired but it has a link...


Support for other json derived content types

I noticed there's no way to configure or allow the client/server generator to allow to support more than just the traditional application/json encoder.
Just on the Akka MediaTypes singleton there are these 3, e.g.:

application/json-patch+json
application/merge-patch+json
application/problem+json

I'm more than happy to open a PR, but wanted to see if this is something in the scope of this library.
Ref:
https://github.com/guardrail-dev/guardrail/blob/9646130eaa7c344b58a93a5f8cdf7ac6a883a0ac/modules/codegen/src/main/scala/com/twilio/guardrail/generators/Scala/AkkaHttpGenerator.scala#L195

I think that'd be a reasonable thing to support (I assume you actually have a use case that needs this?).  I think what we'd need to do is push this up a little higher into the ContentType enum, but change that to a case class so it can store the actual content-type desired, not just generic application/json.  That way it'd make it easier to add support to all the generators, not just akka-http.

@kelnos yes, I have a use case for application/problem+json, the ideal would be to just ref application/*+json.
But yes, allowing to set custom content types would allow for interesting stuff, like using yaml or xml.

Either way, I opened a PR to hopefully jump-start some progress on this, given that Akka supports these content types, I hope it's not much of a problem to add it as hardcoded to guardrail for now.
https://github.com/guardrail-dev/guardrail/pull/1120

Just a brief update in case someone is struggling with this issue, a quick and dirty hack is to add some logic to the httpClient function the client has as a dependency. HttpRequest => Future[HttpResponse]
private def ensureContentType(response: HttpResponse) = {
    response.headers.map {
      case contentType: ContentType =>
        if (contentType.contentType().mediaType == MediaTypes.`application/problem+json`) {
          ContentType.create(WithFixedCharset(MediaTypes.`application/json`))
        } else {
          contentType
        }
      case header => header
    }
  }

implicit val httpClient: HttpRequest => Future[HttpResponse] = { request =>
  httpExt.singleRequest(request).map { response =>
     response.withHeaders(ensureContentType(response))
  }
}


using ./prototxt/face_solver.prototxt & ./prototxt/face_train_test.prototxt but not converge

As I don't have enough GPU memory, I set iter_size: 8 in face_solver.prototxt and batch_size: 32 in face_train_test.prototxt, after 30000 iter it didn't converge on CASIA-Webface. I am confused that if I have done anything wrong.
Thanks in advanced.

Oh it needs two-step train strategy.


zrok: 0.4.2 -> 0.4.5

Automatic update generated by nixpkgs-update tools. This update was made based on information from passthru.updateScript.
meta.description for zrok is: Geo-scale, next-generation sharing platform built on top of OpenZiti
meta.homepage for zrok is: https://zrok.io
Updates performed

Ran passthru.UpdateScript

To inspect upstream changes

Release on GitHub

Compare changes on GitHub

Impact

Checks done (click to expand)

built on NixOS
The tests defined in passthru.tests, if any, passed
found 0.4.5 with grep in /nix/store/q712j795dx5nxr3mr173hqrijmfyr712-zrok-0.4.5
found 0.4.5 in filename of file in /nix/store/q712j795dx5nxr3mr173hqrijmfyr712-zrok-0.4.5

Rebuild report (if merged into master) (click to expand)

1 total rebuild path(s)

1 package rebuild(s)

First fifty rebuilds by attrpath
zrok

Instructions to test this update (click to expand)

Either download from Cachix:
nix-store -r /nix/store/q712j795dx5nxr3mr173hqrijmfyr712-zrok-0.4.5 \
  --option binary-caches 'https://cache.nixos.org/ https://nix-community.cachix.org/' \
  --option trusted-public-keys '
  nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
  cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
  '

(The Cachix cache is only trusted for this store-path realization.)
For the Cachix download to work, your user must be in the trusted-users list or you can use sudo since root is effectively trusted.
Or, build yourself:
nix-build -A zrok https://github.com/r-ryantm/nixpkgs/archive/0837ab431d4fab9a97890479465777ff7ecb777f.tar.gz

After you've downloaded or built it, look at the files and if there are any, run the binaries:
ls -la /nix/store/q712j795dx5nxr3mr173hqrijmfyr712-zrok-0.4.5
ls -la /nix/store/q712j795dx5nxr3mr173hqrijmfyr712-zrok-0.4.5/bin

Pre-merge build results
We have automatically built all packages that will get rebuilt due to
this change.
This gives evidence on whether the upgrade will break dependent packages.
Note sometimes packages show up as failed to build independent of the
change, simply because they are already broken on the target branch.
Result of nixpkgs-review run on x86_64-linux 1

1 package built:

zrok

Maintainer pings
cc @bennyandresen for testing.

Result of nixpkgs-review pr 250070 run on aarch64-darwin 1


notify: 1.0.2 -> 1.0.4

Automatic update generated by nixpkgs-update tools. This update was made based on information from passthru.updateScript.
meta.description for notify is: "Notify allows sending the output from any tool to Slack, Discord and Telegram"
meta.homepage for notify is: "https://github.com/projectdiscovery/notify"
meta.changelog for notify is: ""
Updates performed

Ran passthru.UpdateScript

To inspect upstream changes

Release on GitHub

Compare changes on GitHub

Impact

Checks done (click to expand)

built on NixOS
The tests defined in passthru.tests, if any, passed
found 1.0.4 with grep in /nix/store/dq0fyng1pfwyqxn775yi8z8wccsfj3a7-notify-1.0.4
found 1.0.4 in filename of file in /nix/store/dq0fyng1pfwyqxn775yi8z8wccsfj3a7-notify-1.0.4

Rebuild report (if merged into master) (click to expand)

1 total rebuild path(s)

1 package rebuild(s)

First fifty rebuilds by attrpath
notify

Instructions to test this update (click to expand)

Either download from Cachix:
nix-store -r /nix/store/dq0fyng1pfwyqxn775yi8z8wccsfj3a7-notify-1.0.4 \
  --option binary-caches 'https://cache.nixos.org/ https://nix-community.cachix.org/' \
  --option trusted-public-keys '
  nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
  cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
  '

(The Cachix cache is only trusted for this store-path realization.)
For the Cachix download to work, your user must be in the trusted-users list or you can use sudo since root is effectively trusted.
Or, build yourself:
nix-build -A notify https://github.com/r-ryantm/nixpkgs/archive/87a4ac8b53384dd5c8b382c096213016b1ed27ee.tar.gz

After you've downloaded or built it, look at the files and if there are any, run the binaries:
ls -la /nix/store/dq0fyng1pfwyqxn775yi8z8wccsfj3a7-notify-1.0.4
ls -la /nix/store/dq0fyng1pfwyqxn775yi8z8wccsfj3a7-notify-1.0.4/bin

Pre-merge build results
We have automatically built all packages that will get rebuilt due to
this change.
This gives evidence on whether the upgrade will break dependent packages.
Note sometimes packages show up as failed to build independent of the
change, simply because they are already broken on the target branch.
Result of nixpkgs-review run on x86_64-linux 1

1 package built:

notify

Maintainer pings
cc @HanEmile for testing.

Result of nixpkgs-review pr 194813 run on x86_64-linux 1

1 package built:

notify


Hardware accelerated network packet processing?

Is there a way to offload the network packet processing from the CPU? We have a system using around 20 cameras connected to a server via a 100Gbit Intel NIC. Packet processing alone takes up about 50% of the CPU. There are many strategies for offloading this networking processing as detailed here. Does Basler and gst-plugin-pylon support any of them?
I assume NVMM alone does not help here, as the CPU still does the header stripping, which is then fed into GPU memory.

Hi @andrewseddon ,
for your intel NIC we have nothing ready yet. ( at the moment we can acellerate on NVIDIA NICs )
RDMA support will come but is not available now.
The mentioned zero copy stragegies listed in your document also has limitations if the camera count gets larger.
To check, if your current setup would be capable to handle full zero-copy, can you show the output
ethtool -l <interface_name>

Channel parameters for enp129s0f0np0:
Pre-set maximums:
RX:		32
TX:		32
Other:		1
Combined:	32
Current hardware settings:
RX:		0
TX:		0
Other:		1
Combined:	32
This is on our Intel 810 NIC. But we are happy to switch to NVIDIA NIC's if you have a means to accelerate packet processing on them. Would you recommend something like the ConnectX-6 Dx ?

One easy option to accelerate on Nvidia NIC is to use https://docs.nvidia.com/networking/display/xliov3402
xlio is a LD_PRELOAD library that will accelerate the UDP receive without code changes.
For our work on rdma.
Do you only need the video data on the GPU? ( Nvidia GPU direct)
or do you also want to access the data in CPU memory?

Great, I'll give that a go! We could work with either GPU or CPU memory. Right now, we just do H264 compression and have tested CPU and GPU-based compression - both work great.


gfxrecon-info misspells VkStructureType

I ran across this using the SDK 1.2.182 version of gfxrecon-info:
$ which gfxrecon-info
/home/papillo/sdks/<IP_ADDRESS>/x86_64/bin/gfxrecon-info
$ gfxrecon-info --version
gfxrecon-info version info:
  GFXReconstruct Version 0.9.8 (10eb94f)
  Vulkan Header Version 1.2.182
$ gfxrecon-info /media/nas/smb_traces/vulkan/GFXR/tcubumes-mesa/vulkaninfo/vulkaninfo_20210928T101152.gfxr
[gfxrecon] ERROR - Failed to decode pNext value with unrecognized VkStructurType =<PHONE_NUMBER>
[gfxrecon] ERROR - Failed to decode pNext value with unrecognized VkStructurType =<PHONE_NUMBER>
File did not contain any frames

The top-of-dev gfxrecon-info does not provoke the same pNext error, but the source shows that vkStructurType is still misspelled in the generator:
$ git grep vkStructurType
framework/generated/generated_decode_pnext_struct.cpp:                GFXRECON_LOG_ERROR("Failed to decode pNext value with unrecognized VkStructurType = %d", (*sType));
framework/generated/vulkan_generators/decode_pnext_struct_generator.py:        write('                GFXRECON_LOG_ERROR("Failed to decode pNext value with unrecognized VkStructurType = %d", (*sType));', file=self.outFile)

This probably won't take more than 30 minutes to fix.  Let's squeeze out a little time and get this in.

Closed by #614


[tool_crash] _CastError: (#0      _validateMetadataMap (package:flutter_tools/src/flutter_project_metadata.dart:58:33))

Command
flutter create mdc_100_series

Steps to Reproduce

...
...
...

Logs
_CastError: (#0      _validateMetadataMap (package:flutter_tools/src/flutter_project_metadata.dart:58:33))
#0      _validateMetadataMap (package:flutter_tools/src/flutter_project_metadata.dart:58:33)
#1      new FlutterProjectMetadata (package:flutter_tools/src/flutter_project_metadata.dart:99:11)
#2      CreateBase.determineTemplateType (package:flutter_tools/src/commands/create_base.dart:221:9)
#3      CreateCommand._getProjectType (package:flutter_tools/src/commands/create.dart:170:29)
#4      CreateCommand.runCommand (package:flutter_tools/src/commands/create.dart:210:41)
#5      FlutterCommand.verifyThenRunCommand (package:flutter_tools/src/runner/flutter_command.dart:1342:12)
<asynchronous suspension>
#6      FlutterCommand.run.<anonymous closure> (package:flutter_tools/src/runner/flutter_command.dart:1183:27)
<asynchronous suspension>
#7      AppContext.run.<anonymous closure> (package:flutter_tools/src/base/context.dart:150:19)
<asynchronous suspension>
#8      CommandRunner.runCommand (package:args/command_runner.dart:209:13)
<asynchronous suspension>
#9      FlutterCommandRunner.runCommand.<anonymous closure> (package:flutter_tools/src/runner/flutter_command_runner.dart:281:9)
<asynchronous suspension>
#10     AppContext.run.<anonymous closure> (package:flutter_tools/src/base/context.dart:150:19)
<asynchronous suspension>
#11     FlutterCommandRunner.runCommand (package:flutter_tools/src/runner/flutter_command_runner.dart:229:5)
<asynchronous suspension>
#12     run.<anonymous closure>.<anonymous closure> (package:flutter_tools/runner.dart:62:9)
<asynchronous suspension>
#13     AppContext.run.<anonymous closure> (package:flutter_tools/src/base/context.dart:150:19)
<asynchronous suspension>
#14     main (package:flutter_tools/executable.dart:94:3)
<asynchronous suspension>

[✓] Flutter (Channel stable, 3.0.3, on Microsoft Windows [版本 10.0.19043.1766], locale zh-CN)
    • Flutter version 3.0.3 at D:\flutter
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision 676cefaaff (2 weeks ago), 2022-06-22 11:34:49 -0700
    • Engine revision ffe7b86a1e
    • Dart version 2.17.5
    • DevTools version 2.12.2

[!] Android toolchain - develop for Android devices (Android SDK version 30.0.3)
    • Android SDK at D:\Android\sdk
    • Platform android-32, build-tools 30.0.3
    • Java binary at: D:\Android\Android Studio\jre\bin\java
    • Java version OpenJDK Runtime Environment (build 11.0.11+9-b60-7590822)
    ! Some Android licenses not accepted.  To resolve this, run: flutter doctor --android-licenses

[✓] Chrome - develop for the web
    • Chrome at C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

[✗] Visual Studio - develop for Windows
    ✗ Visual Studio not installed; this is necessary for Windows development.
      Download at https://visualstudio.microsoft.com/downloads/.
      Please install the "Desktop development with C++" workload, including all of its default components

[✓] Android Studio (version 2021.1)
    • Android Studio at D:\Android\Android Studio
    • Flutter plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/6351-dart
    • Java version OpenJDK Runtime Environment (build 11.0.11+9-b60-7590822)

[✓] VS Code, 64-bit edition (version 1.68.1)
    • VS Code at C:\Program Files\Microsoft VS Code
    • Flutter extension version 3.44.0

[✓] Connected device (3 available)
    • Windows (desktop) • windows • windows-x64    • Microsoft Windows [版本 10.0.19043.1766]
    • Chrome (web)      • chrome  • web-javascript • Google Chrome 103.0.5060.114
    • Edge (web)        • edge    • web-javascript • Microsoft Edge 103.0.1264.44

[✓] HTTP Host Availability
    • All required HTTP hosts are available

! Doctor found issues in 2 categories.

Flutter Application Metadata
No pubspec in working directory.

Hi @zhangjian78, this issue was initially reported in https://github.com/flutter/flutter/issues/104021 and has since been fixed by https://github.com/flutter/flutter/pull/104022.
The fix is available on the beta and master channels.
Per our triage policy, I'll be closing this as it has already been fixed on the master channel.
If you run into this issue on either the beta channel or master channel, kindly file a new issue.
Thank you


Entra ID icon(s)

We're missing some Entra ID icons after the great rename from "Azure AD" to "Entra ID".

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: 6624d44c-f9f6-02f8-2c67-0f0637fed62e
Version Independent ID: 9346a8ff-bab5-be2c-9dc1-d546fda1efa9
Content: Azure icons - Azure Architecture Center
Content Source: docs/icons/index.md
Service: architecture-center
GitHub Login: @Zimmergren
Microsoft Alias: tozimmergren

Hey @o-l-a-v . When you say "some Entra ID icons", do you have any details about which ones are missing so we can address this quicker and get a new release?
Meanwhile I'll ping internally to see if we have updated or new icons to add to the pack for Entra ID.
Thanks!

@Zimmergren
The Entra icon to be able to replace Azure AD in architecture diagrams is the one I can think of right now.

As a design idea, I created new Entra ID icons for my Periodic table refresh for B2B, B2C and DDS based on the same theme and style of the old icons. Happy to share the SVG versions for your team to use @Zimmergren

Hey @o-l-a-v,
We recently updated the Azure Icons download pack with the official Microsoft Entra ID icon.
#please-close


Remove jtreg duplicated crypto call

Based on the experience (hopefully correct!)  simplifying cryptotest runner
https://ci.adoptium.net/view/Test_grinder/job/Grinder/9093

From the grinder console output jtreg.jar are actually downloaded twice. One is downloaded by build.xml the other one is downloaded by run.sh.  Can run.sh update to only download if no jtreg.jar exist?

From the grinder console output jtreg.jar are actually downloaded twice. One is downloaded by build.xml the other one is downloaded by run.sh. Can run.sh update to only download if no jtreg.jar exist?

I had removed the build's download of jtreg. https://ci.adoptium.net/view/Test_grinder/job/Grinder/9150/

No, by removing this call and depending on the test material being added, in this case 'cryptotest', to fetch 'some unknown/untracked version of jtreg' we lose the ability to reproduce the exact same test material. We also set a bad precedent for other tests coming in the future that it is okay to pull in extra untracked dependencies and glut the test machines of anyone using AQAvit.

Sure!
Cuple of question on this topic.:

getJtreg ant target (which I foolhardily  removed) is getting tarball and  unpacking it?  The path is (TEST_RESROOT)$(D)jtreg$(D) ?

what is the version of this jtreg? Can that be controlled? Is jdk-version dependent?
I'm intentionally pulling binary which contains https://github.com/openjdk/jtreg/commit/8c105f2953edac0881819131f5f6836bda06ef25  which is not yet tagged as release. Can that be obtained?
the change is superimportant especially for ssl tests (and well for anything shell based)  to have any reasonable output in traces
the change is unlikely to bubble to older relases.

Where I  absolutely agree with what you wrote, few things I would like to understand:

foreign repo is cloned anyway, there can be anything.  Eg until recently there was in tree copy of jtreg.
the repo (any repo) can, and is pulling other stuff. So why to forbid this exact dependence?
the owner of the suite, should - as they know best - ensure what version of depndencies to pull.

in case of jtreg, as generic runner this is futile sentence as jtreg.jar is pretty compatible, and have sense to be shared.
I had bad experience (maybe erroneous) with to new jtregs used on some ancient tests. That ended in having jdk8 frozen on older jtreg branch. Maybe that is no longer necessary, especially here, but the risk is there.

The jtreg that gets pulled and used certainly depends on the JDK version, and AQAvit will pull the 'right one' based on JDK_VERSION.
If we are assessing which foreign repos to include into AQAvit, one criteria would be that they integrate well into the system we have in place.  My bad for not seeing that you were pulling your own copy of jtreg, that was a failure to review closely during my reviews.
When dovetailing into AQAvit, the point is to centralize functionality.  If contributors still want to have the option to download a bespoke version of jtreg, then that can be controlled through an option passed to the test suite.  Of the ~10 companies using the tests being added into AQAvit, the expectation is to know what is being downloaded onto their test machines and that the AQAvit project does some vetting/verification of those dependencies.

https://ci.adoptium.net/view/Test_grinder/job/Grinder/9160

The jtreg that gets pulled and used certainly depends on the JDK version, and AQAvit will pull the 'right one' based on JDK_VERSION.

cool! There is also https://ci.adoptium.net/view/Dependencies/job/dependency_pipeline/lastSuccessfulBuild/artifact/jtreg/jtregtip.tar.gz ; any way to pull this?

If we are assessing which foreign repos to include into AQAvit, one criteria would be that they integrate well into the system we have in place. My bad for not seeing that you were pulling your own copy of jtreg, that was a failure to review closely during my reviews.

It is only on those ssl/crypto runner PRs. At it is impossibel to see without properly reading thre run.sh.
Also I guess I shold have highlight it, as in my own runner I'm setting JTREG_HOME for my runs, not wanting it to download anything. But then this was pushed away by my overrated love to in https://github.com/openjdk/jtreg/commit/8c105f2953edac0881819131f5f6836bda06ef25
Kudos for @sophia-guo  for noticing that!

When dovetailing into AQAvit, the point is to centralize functionality. If contributors still want to have the option to download a bespoke version of jtreg, then that can be controlled through an option passed to the test suite. Of the ~10 companies using the tests being added into AQAvit, the expectation is to know what is being downloaded onto their test machines and that the AQAvit project does some vetting/verification of those dependencies.

I agree for sure. Can it be subject of discussion for some very special cases and deps?  but this is absolutely not that case.

When does this openjdk/jtreg@8c105f2 land into an official tagged/versioned release of jtreg? If it is super-important, then it will be important that its into an official version, that we can then plan to pick up.

No idea. Jtreg release is random AFAICT.  Maybe around jdk24? And wq can be sure it will not reach the 6.* branch...  Any possibility to build our fork in the dependency_pipeline ? To prevent misunderstanding -  I do not recommend that, I do not insists on that,  I do not want you to do that. Especially not on short run:) It is really just idea!

There is also https://ci.adoptium.net/view/Dependencies/job/dependency_pipeline/lastSuccessfulBuild/artifact/jtreg/jtregtip.tar.gz ; any way to pull this?

Yes, let's plan to add jtreg tip to the list of ones that can be used with AQAvit testing, in that way it satisfies both our needs.

TYVM! Can this go in in meantime?  (+5136 and maybe 5129 :)

There is now a failure in OpenJ9 builds which I assume is caused by this change.
https://github.com/eclipse-openj9/openj9/issues/19164
21:44:11  Test results: passed: 32
21:44:11  Report written to /Users/jenkins/workspace/Test_openjdk11_j9_extended.functional_aarch64_mac_Nightly_testList_0/aqa-tests/functional/security/Crypto/CryptoTest/test.1710553196/jdk/JTreport/html/report.html
21:44:11  Results written to /Users/jenkins/workspace/Test_openjdk11_j9_extended.functional_aarch64_mac_Nightly_testList_0/aqa-tests/functional/security/Crypto/CryptoTest/test.1710553196/jdk/JTwork
21:44:11  ~/workspace/Test_openjdk11_j9_extended.functional_aarch64_mac_Nightly_testList_0/aqa-tests/TKG/output_17105515401191/CryptoTests_0
21:44:11  readlink: illegal option -- f
21:44:11  usage: readlink [-n] [file ...]
21:44:11  Missing tests.log!
21:44:11  -----------------------------------
21:44:11  CryptoTests_0_FAILED

Failed differently on zlinux.
https://openj9-jenkins.osuosl.org/job/Test_openjdk17_j9_extended.functional_s390x_linux_Nightly_testList_0/682
23:05:51  Error:  cryptotest/CryptoTest.java
23:05:51  Test results: passed: 31; error: 1
23:05:51  Report written to /home/jenkins/workspace/Test_openjdk17_j9_extended.functional_s390x_linux_Nightly_testList_0/aqa-tests/functional/security/Crypto/CryptoTest/test.1710557092/jdk/JTreport/html/report.html
23:05:51  Results written to /home/jenkins/workspace/Test_openjdk17_j9_extended.functional_s390x_linux_Nightly_testList_0/aqa-tests/functional/security/Crypto/CryptoTest/test.1710557092/jdk/JTwork
23:05:51  Error: Some tests failed or other problems occurred.
23:05:51  ~/workspace/Test_openjdk17_j9_extended.functional_s390x_linux_Nightly_testList_0/aqa-tests/TKG/output_17105480336205/CryptoTests_0
23:05:51  renamed '/home/jenkins/workspace/Test_openjdk17_j9_extended.functional_s390x_linux_Nightly_testList_0/aqa-tests/functional/security/Crypto/CryptoTest/test.1710557092.tar.gz' -> './test.1710557092.tar.gz'
23:05:51  -----------------------------------
23:05:51  CryptoTests_0_FAILED

There is now a failure in OpenJ9 builds which I assume is caused by this change.

Issue introduced by this change https://github.com/rh-openjdk/CryptoTest/pull/63
using readlink -f which must not be present in all versions of readlink on all machines
https://www.gnu.org/software/coreutils/manual/html_node/readlink-invocation.html#readlink-invocation

Created https://github.com/adoptium/aqa-tests/issues/5151 with the plan to pin to specific versions of these test materials so we are not at the mercy of random changes.

Excluded the test on OpenJ9 amac, zlinux via https://github.com/adoptium/aqa-tests/pull/5153


Translate dynamically rendered strings

Bundles and settings come with a displayName, which is rendered in the UI, e.g. here https://github.com/owncloud/ocis-settings/blob/a828816458d634851251f20ce7b2c83f22ba8c52/ui/components/SettingsBundle.vue#L4
As transifex works by extracting strings from the templates, these displayNames will not be visible in any translation files. We need to investigate, how to make e.g. the displayName translatable.

@kulmann this is an old issue that was transferred from the archived ocis-settings repo a few weeks ago.
Please close if no longer relevant.

We did not figure out yet, how to solve this. Still relevant.

I guess the easiest option is for the UI to assume the string is translated already, so it can be shown as it is. This means that the translation should happen in the server.
One problem to take into account is how the language is chosen. Taking into account the mobile clients might be configured in a different language, I guess the clients will need a way to send which language the messages should be translated to.
As far as I know, this is how it's implemented in OC10.
An alternative could be to provide a translation service so the UI can ask for the translation there, but this seems quite complex taking into account that it's easy for the translations to de-sync when the original string is in a different service.


Manual sync

Codecov Report
Attention: 43 lines in your changes are missing coverage. Please review.

Comparison is base (a52670a) 56.13% compared to head (9680eca) 56.16%.
 Consider uploading reports for the commit 3c3f064 to get more accurate results

Files
Patch %
Lines

...tensions/exposition/source/directives/cors/CORS.ts
0.00%
25 Missing :warning:

libraries/concise/source/expressions/range.js
58.53%
17 Missing :warning:

extensions/exposition/source/directives/index.ts
0.00%
1 Missing :warning:

:exclamation: Your organization needs to install the Codecov GitHub app to enable full functionality.
Additional details and impacted files
@@            Coverage Diff             @@
##              dev     #510      +/-   ##
==========================================
+ Coverage   56.13%   56.16%   +0.02%
==========================================
  Files         318      319       +1
  Lines       10405    10464      +59
  Branches     1260     1266       +6
==========================================
+ Hits         5841     5877      +36
- Misses       4564     4587      +23

Flag
Coverage Δ

unit
56.16% <61.26%> (+0.02%)
:arrow_up:

Flags with carried forward coverage won't be shown. Click here to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.