Migration to 2.0 Problem -- RedirectUrisSignOut

Working on migrating our application to a@e 2.0 to look further at #81 and other features, and run into a roadblock.  The demonstration stack for 2.0 that illustrates how to define Cognito UserPool etc. in the parent stack works fine but ...
I've pulled the Cognito User Pool and other related artifacts into the main stack, and successfully created all artifacts until we get to the calls to the nested a@e stack.  In creating the framework I see:
Embedded stack arn:aws:cloudformation:us-east-1:REDACTED:stack/ae200d-LambdaEdgeProtection-L97QEYQVDZLR/4cb7b300-ef9e-11ea-ace7-126c97cb5bc1 was not successfully created: Cannot export output RedirectUrisSignOut. Exported values must not be empty or whitespace-only.
My call to the nested stack which worked fine in 1.2 has changed only in minor ways ... I've added parameters for the UserPoolArn and UserPoolClientId I've created in the parent stack, just as the a@e example for 2.0 does.  The failing call looks like this:
  LambdaEdgeProtection:
    Type: AWS::Serverless::Application
    DependsOn: UserPoolDomain
    Properties:
      Location:
        ApplicationId: arn:aws:serverlessrepo:us-east-1:520945424137:applications/cloudfront-authorization-at-edge
        SemanticVersion: 2.0.0
      Parameters:
        CreateCloudFrontDistribution: "false"
        HttpHeaders: !Ref HttpHeaders
        UserPoolArn: !GetAtt UserPool.Arn
        UserPoolClientId: !Ref UserPoolClient

A visit through the code shows that RedirectUrisSignOut is mainly referenced in src/cfn-custom-resources/user-pool-client/index.ts and in the main template, suggesting that maybe I've got the dependencies wrong, but they seem obvious ... an explicit depends on the UserPoolDomain, and implicit ones for the UserPoolClient and UserPool.Arn.  All we're really doing here is adding the HttpHeaders parameter from the main template.
Another possibility -- because this example does not use custom domains, but just relies on the CloudFront URL, as does the example, is some problem with the sentinel values -- but I left them alone, as they are in the example.
Any idea what might be going on?

Looking closely at the auth@edge 2.0 code, I think it can go wrong if you:

set parameter CreateCloudFrontDistribution to false
AND
do not provide a value for parameter AlternateDomainNames

Which is indeed the scenario you're in, looking at that piece of CFN you pasted.
You can unblock yourself by providing AlternateDomainNames or by setting CreateCloudFrontDistribution to true.
Meanwhile, I will fix the code, to make this scenario work again too.
Question: is this just a test or do you actually want to deploy like this? Because in this scenario you always have to manually update the redirect URI's in the User Pool Domain, after doing the deployment.

It would be good in certain kinds of deploy to both create the cloudfront in the top level stack using CreateCloudFrontDistribution to false and not provide a value for Alternate Domain names.  The hope was that in bringing both the UserPool and the Cloudfront inside the top level CFN stack I could avoid a circular dependency by creating the CloudFront (thus making its entry point available) then using the entry point for a redirect URI in the User Pool.  Obviously I didn't get that far.
This isn't our most common deploy -- the mode is to use an AlternateDomainName -- but it's a common testing scenario for a quick setup that doesn't require a certificate and domain, and a required scenario for an agency or customer that does not have control over their domains or certificates..
Do you suppose there's any way this can happen?  In a worst case we can update the UserPool's redirects by hand I guess.  In Semantic 1.2 that's possible but it's looking like maybe not possible in 2.0 with both the CloudFront and the UserPool in the top CFN stack?

Unfortunately it looks like a@e needs the Cloudfront default URL, and CloudFront needs to know the URLs of the a@e lambdas so there is still a circularity.

Yes that can only be solved by a custom resource in the top level stack. But the custom resource implementation can be borrowed from a@e, so it will be simple actually. But the a@e custom resource handler arn needs to be made a stack output, so you can refer to it (a 1 min change to a@e)

Funny, I was out walking the dog and the same idea occurred to me.  There's already a LambdaCodeUpdateHandler lambda in a@e that fills the architectural function that would be required in a custom resource, since the LambdaCodeUpdateHandler  adjusts the JSON in the other lambdas for changes in headers and the like!
That would be a great solution ... and I hope it's something you might do.  I'm seeing it like this -- just to get it on paper:

CloudFront and UserPool related resources can live in main stack
a@e will tolerate an absent AlternateDomainName and a false CreateCloudFrontDistribution, and if nothing more is done, manual intervention on the user pool will be required, similar to 1.2.  That's the part of the discussion that restores the scenario present in 1.2 but not in 2.0

In addition, we can add functionality to significantly make the stacks more independent as you suggest:

In the top level stack a@e is invoked before CloudFront, and yields the outputs CloudFront needs for its behaviours, same as always
The a@e lambdas that need to know the URL of the CloudFront application refactor that value into JSON for ease of modification if it isn't there already
The existing LambdaCodeUpdateHandler is enhanced to allow modifying the CloudFront URL wherever it appears
LambdaCodeUpdateHandler's Arn is made available as an a@e stack output so it can be invoked from the top level stack
The top level stack contains a  new custom resource dependent on CloudFront that invokes the enhanced LambdaCodeUpdateHandler with the CloudFront URL

Is that what you had in mind?  Is that possible?  If so I'd be happy to test it out.
R.

Funny, I was out walking the dog and the same idea occurred to me.

LOL!
Yeah that's it in principle––but I mean the UserPoolClientUpdate custom resource to be exact. I need to have a step back to see how this resource is used now and if the plan really makes sense, but I think it does. I'll keep you posted.
If you wanna do it by the way, that's fine too. I can provide guidance while you code the PR (if you need it)

Better you than me if you're willing ... I'm pretty snowed on the app itself, and don't have any experience compiling a SAM module.

This should be it: #83

OK you should now be able to add a resource like this to the top-level stack:
  UserPoolClientUpdate:
    Type: Custom::UserPoolClientUpdate
    Condition: UpdateUserPoolClient
    Properties:
      ServiceToken: !GetAtt LambdaEdgeProtection.Outputs.UserPoolClientUpdateHandler
      UserPoolArn: <your arn, or grab from Auth@Edge stack>
      UserPoolClientId: <your client id, or grab from Auth@Edge stack>
      CloudFrontDistributionDomainName: <your CloudFront domain>
      RedirectPathSignIn: "/parseauth"
      RedirectPathSignOut: "/"
      AlternateDomainNames: []
      OAuthScopes: <your scopes>

v2.0.1 in the SAR

It must be about a million o'clock in NE -- thanks!  I'll test it right away

Brilliant ... as we're in different time zones (I think), I'll give you preliminary results which are:

My two test scenarios build and deploy.  The first use case has no custom resource and I adjust the Cognito URIs by hand, the second uses the callback.
Both build and complete without error after a little fiddling on my side on the top level CFN
Both give an error from the lambdas that I don't understand at this point:
 Error: [Cognito] invalid_request: invalid_scope [log region: us-east-1]

The only things in cloudtrail I immediately see seem to relate to parseAuth creating logs ...
  "eventTime": "2020-09-07T21:52:50Z",
    "eventSource": "logs.amazonaws.com",
    "eventName": "CreateLogStream",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "<IP_ADDRESS>",
    "userAgent": "awslambda-worker/1.0 rusoto/0.42.0 rust/1.45.2 linux",
    "errorCode": "ResourceNotFoundException",
    "errorMessage": "The specified log group does not exist.",
    "requestParameters": {
        "logGroupName": "/aws/lambda/us-east-1.ae201nocustom-LambdaEdgeProtectio-ParseAuthHandler-S6CI0U5A5ZVZ",
        "logStreamName": "2020/09/07/[1]35bbd71f99a34f9a8f1c4b2537020c06"
    },

for scenario 1 (no custom) and
 "eventTime": "2020-09-07T21:55:19Z",
    "eventSource": "logs.amazonaws.com",
    "eventName": "CreateLogStream",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "<IP_ADDRESS>",
    "userAgent": "awslambda-worker/1.0 rusoto/0.42.0 rust/1.45.2 linux",
    "errorCode": "ResourceNotFoundException",
    "errorMessage": "The specified log group does not exist.",
    "requestParameters": {
        "logStreamName": "2020/09/07/[1]1b33630fb1d14708be678dc689047831",
        "logGroupName": "/aws/lambda/us-east-1.ae201customb-LambdaEdgeProtection-ParseAuthHandler-OT6ZOK55QK6B"
    }

for scenario 2 (custom resource)
These may be unrelated.  I'll dig in more in the AM, but wanted to give you early feedback as this looks very promising

Oh yeah, I think it's something about the log group creation.  the URL of the fail says clearly the problematic lambda is parseAuth: https://d8whov6mdjadw.cloudfront.net/parseauth?error_description=invalid_scope&state=eyJub25jZSI6IjE1OTk1MTU1NjRUaHAuQlM5Nm5wRUtuT0RYeiIsInJlcXVlc3RlZFVyaSI6Ii8ifQ&error=invalid_request .  When I navigate to CLoudwatch Events I see:

So maybe something funky with the group creation ... is there somewhere I should have specified a region now that we are no longer tied to us-east-1?

The log group error might be a red herring––the real error looks to be "invalid_scope"
How are you passing the scopes to the custom resource? It expects them here as a list of strings (not as a CommaDelimitedList):
UserPoolClientUpdate:
    Type: Custom::UserPoolClientUpdate
    Condition: UpdateUserPoolClient
    Properties:
      ServiceToken: !GetAtt LambdaEdgeProtection.Outputs.UserPoolClientUpdateHandler
      UserPoolArn: <your arn, or grab from Auth@Edge stack>
      UserPoolClientId: <your client id, or grab from Auth@Edge stack>
      CloudFrontDistributionDomainName: <your CloudFront domain>
      RedirectPathSignIn: "/parseauth"
      RedirectPathSignOut: "/"
      AlternateDomainNames: []
      OAuthScopes: ["profile", "openid", "email", "phone", "aws.cognito.signin.user.admin"]

That list needs to be the same as what you passed to Auth@Edge (if you did not pass anything it needs to be the same as the Auth@Edge default). But then it is probably easier to not provide the scopes when invoking the custom resource––and keep the ones from auth@edge. So, this should also work:
UserPoolClientUpdate:
    Type: Custom::UserPoolClientUpdate
    Condition: UpdateUserPoolClient
    Properties:
      ServiceToken: !GetAtt LambdaEdgeProtection.Outputs.UserPoolClientUpdateHandler
      UserPoolArn: <your arn, or grab from Auth@Edge stack>
      UserPoolClientId: <your client id, or grab from Auth@Edge stack>
      CloudFrontDistributionDomainName: <your CloudFront domain>
      RedirectPathSignIn: "/parseauth"
      RedirectPathSignOut: "/"
      AlternateDomainNames: []

Well, not having a lot of luck here.
Originally, I was passing scopes like this to both the UserPoolClient and the UserPoolClientUpdate:
      AllowedOAuthScopes:
        - phone
        - email
        - openid
        - profile

and the stack deployed, but the run failed, as noted.
Substituting the corrected string format in both the UserPoolClient and the UserPoolClientUpdate allowed for a deploy, but I get the identical error on scope.
Adding the additional scope parameter aws.cognito.signin.user.admin fixed that problem.  Wonder what it does.
So, once I got past the scope error I was able to log into Cognito and change my username, but then encountered a new error in parseAuth:
Sign-in issue
We can't sign you in because of a technical problem

 Error: Failed to exchange authorization code for tokens: Error: Request failed with status code 400 [log region: us-east-1]

Here are the two stanzas as they currently are ... note that the parameter names are different which seems to be required ... AllowedOAuthScopes for the UserPoolClient and OAuthScopes for UserPoolClientUpdate.  Making them the same fails at deploy.
UserPoolClient:
 UserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref UserPool
      PreventUserExistenceErrors: ENABLED
      GenerateSecret: true
      AllowedOAuthScopes: ["profile", "openid", "email", "phone", "aws.cognito.signin.user.admin"]
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthFlows:
        - code
      SupportedIdentityProviders:
        - COGNITO
      CallbackURLs:
        - https://example.com/will-be-replaced
      LogoutURLs:
        - https://example.com/will-be-replaced

UserPoolClientUpdate:
  UserPoolClientUpdate:
    Type: Custom::UserPoolClientUpdate
    Condition: UpdateUserPoolClient
    Properties:
      ServiceToken: !GetAtt LambdaEdgeProtection.Outputs.UserPoolClientUpdateHandler
      UserPoolArn: !GetAtt UserPool.Arn
      UserPoolClientId: !Ref UserPoolClient
      CloudFrontDistributionDomainName: !GetAtt CloudFrontDistribution.DomainName
      RedirectPathSignIn: "/parseauth"
      RedirectPathSignOut: "/"
      AlternateDomainNames: []
      OAuthScopes: ["profile", "openid", "email", "phone", "aws.cognito.signin.user.admin"]

By the way, the scenario 1 (no custom resource, just cloudfront=false and no alternate domain) also fails, this time with an unspecified error after login password entered to cognito:
https://auth-3f673eb0-f150-11ea-a7c2-0a3fc8cbcb75.auth.us-east-1.amazoncognito.com/error

Mmm :|
Can you paste your entire CFN template here, I'll try to reproduce

Preparing a stripped version as the original accesses buckets, etc.

Got it:
# Copyright 2020 eGlobalTech, a Tetratech Company

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  Sample stack for custom user pool

Parameters:
  AlternateDomainNames:
    Type: CommaDelimitedList
    Description: "Optional custom domain name for the CloudFront distribution.  Must manually point the custom name's A record to CloudFront URL as an alias after deploy."

  ACMCertificate:
    Type: String
    Description: "Only if using an alternate domain name. ARN for a us-east-1 ACM certificate in this account.  Leave blank if no alternate domain name"

  AllowedCIDRList:
    Type: CommaDelimitedList
    Description: "CAUTION!  Blank allows internet access to GUI.  Comma delimited list of IPV4 CIDR addresses allowed to access jmpr Console"

  Installer:
    Type: String
    Description: Who is installing this application, used for tags

  PriceClass:
    Type: String
    Description: CloudFront price class, e.g. PriceClass_200 for most regions (default), PriceClass_All for all regions (the default), PriceClass_100 least expensive (US, Canada, Europe), or PriceClass_All
    Default: PriceClass_100

  SemanticVersion:
    Type: String
    Description: Semantic version of the back end
    Default: 2.0.1

  HttpHeaders:
    Type: String
    Description: The HTTP headers to set on all responses from CloudFront. Defaults are illustrations only and contain a report-only Cloud Security Policy -- adjust for your application
    Default: >-
      {
        "Strict-Transport-Security": "max-age=31536000; includeSubdomains; preload",
        "Referrer-Policy": "same-origin",
        "X-XSS-Protection": "1; mode=block",
        "X-Frame-Options": "DENY",
        "X-Content-Type-Options": "nosniff"
      }

  BucketNameParameter:
    Type: String
    Description: A legal bucket name.  Must not exist.

Conditions:
    IsCommercial: !Equals [ 'aws', !Ref "AWS::Partition" ]
    HasAlternateDomainName: !Not [!Equals [ '', !Join [ "", !Ref AlternateDomainNames ] ] ]
    EnableWAF: !Not [!Equals [ '', !Join [ "", !Ref AllowedCIDRList ] ] ]
    UpdateUserPoolClient: !Equals [ "true", "true" ]

Resources:

  ApplicationBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName:
        Ref: BucketNameParameter
      VersioningConfiguration:
         Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      CorsConfiguration:
        CorsRules:
          -
            AllowedOrigins:
              - !Sub
                  - "https://${DomainName}"
                  - {DomainName: !Select [0, !Ref AlternateDomainNames ] }
            AllowedMethods:
              - POST
              - GET
              - PUT
              - DELETE
              - HEAD
            AllowedHeaders:
              - "*"
      Tags:
          -
            Key: "OWNER"
            Value: "egt-labs"
          -
            Key: "APPLICATION"
            Value: "jmpr"
          -
            Key: "PATH"
            Value: {"Fn::Join": ["", ["/", {"Ref": "AWS::StackName"}, "-installer/"]]}
          -
            Key: "INSTALLER"
            Value: !Ref Installer

  CloudFrontOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub '${BucketNameParameter}-OAI'

  S3AccessPolicyForOAI:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: ApplicationBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              CanonicalUser:
                Fn::GetAtt: [ CloudFrontOriginAccessIdentity , S3CanonicalUserId ]
            Action: "s3:GetObject"
            Resource: !Sub "${ApplicationBucket.Arn}/*"

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases:
          !If
            - HasAlternateDomainName
            - !Ref AlternateDomainNames
            - !Ref AWS::NoValue
        ViewerCertificate:
          !If
            - HasAlternateDomainName
            - AcmCertificateArn: !Ref ACMCertificate
              SslSupportMethod: sni-only
              MinimumProtocolVersion: TLSv1.2_2018
            - !Ref AWS::NoValue

        WebACLId:
          !If
            - EnableWAF
            - !GetAtt WebACL.Arn
            - ""

        CacheBehaviors:
          - PathPattern: /parseauth
            Compress: true
            ForwardedValues:
              QueryString: true
            LambdaFunctionAssociations:
              - EventType: viewer-request
                LambdaFunctionARN: !GetAtt LambdaEdgeProtection.Outputs.ParseAuthHandler
            TargetOriginId: dummy-origin
            ViewerProtocolPolicy: redirect-to-https
          - PathPattern: /refreshauth
            Compress: true
            ForwardedValues:
              QueryString: true
            LambdaFunctionAssociations:
              - EventType: viewer-request
                LambdaFunctionARN: !GetAtt LambdaEdgeProtection.Outputs.RefreshAuthHandler
            TargetOriginId: dummy-origin
            ViewerProtocolPolicy: redirect-to-https
          - PathPattern: /signout
            Compress: true
            ForwardedValues:
              QueryString: true
            LambdaFunctionAssociations:
              - EventType: viewer-request
                LambdaFunctionARN: !GetAtt LambdaEdgeProtection.Outputs.SignOutHandler
            TargetOriginId: dummy-origin
            ViewerProtocolPolicy: redirect-to-https
        DefaultCacheBehavior:
          Compress: true
          ForwardedValues:
            QueryString: true
          LambdaFunctionAssociations:
            - EventType: viewer-request
              LambdaFunctionARN: !GetAtt LambdaEdgeProtection.Outputs.CheckAuthHandler
            - EventType: origin-response
              LambdaFunctionARN: !GetAtt LambdaEdgeProtection.Outputs.HttpHeadersHandler
          TargetOriginId: protected-origin
          ViewerProtocolPolicy: redirect-to-https
        Enabled: true
        Origins:
          - DomainName: example.org # Dummy origin is used for Lambda@Edge functions, keep this as-is
            Id: dummy-origin
            CustomOriginConfig:
              OriginProtocolPolicy: match-viewer
          - DomainName: !Sub "${ApplicationBucket}.s3.amazonaws.com"
            Id: protected-origin
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}"
        CustomErrorResponses:
            - ErrorCode: 404
              ResponseCode: 200
              ResponsePagePath: /index.html
        PriceClass: !Ref PriceClass
        DefaultRootObject: index.html
      Tags:
        -
          Key: "OWNER"
          Value: "egt-labs"
        -
          Key: "APPLICATION"
          Value: "jmpr"
        -
          Key: "PATH"
          Value: {"Fn::Join": ["", ["/", {"Ref": "AWS::StackName"}, "-installer/"]]}
        -
          Key: "INSTALLER"
          Value: !Ref Installer

  IPWhiteList:
    Type: AWS::WAFv2::IPSet
    Condition: EnableWAF
    Properties:
      Name: {"Fn::Join": ["", [{"Ref": "AWS::StackName"}, "-jmprIPWhiteList"]]}
      Description: "IP V4 Set for addresses allowed to access GUI"
      Addresses: !Ref AllowedCIDRList
      IPAddressVersion: "IPV4"
      Scope: CLOUDFRONT
      Tags:
          -
            Key: "OWNER"
            Value: "egt-labs"
          -
            Key: "APPLICATION"
            Value: "jmpr"
          -
            Key: "PATH"
            Value: {"Fn::Join": ["", ["/", {"Ref": "AWS::StackName"}, "-installer/"]]}
          -
            Key: "INSTALLER"
            Value: !Ref Installer

  WebACL:
    Condition: EnableWAF
    Type: "AWS::WAFv2::WebACL"
    Properties:
      Name:
        {"Fn::Join": ["", [{"Ref": "AWS::StackName"}, "-jmprWebACL"]]}
      Description: "ACL to control web access to jmpr console"
      DefaultAction:
        Block: {}
      Scope: CLOUDFRONT
      VisibilityConfig:
        CloudWatchMetricsEnabled: true
        MetricName: WebAclAttempts
        SampledRequestsEnabled: true

      Rules:
        - Name: "jmprIPWhitelist"
          Priority: 0
          Action:
            Allow: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: jmprIPWhiteListMetric
          Statement:
            IPSetReferenceStatement:
              Arn: !GetAtt IPWhiteList.Arn
      Tags:
          -
            Key: "OWNER"
            Value: "egt-labs"
          -
            Key: "APPLICATION"
            Value: "jmpr"
          -
            Key: "PATH"
            Value: {"Fn::Join": ["", ["/", {"Ref": "AWS::StackName"}, "-installer/"]]}
          -
            Key: "INSTALLER"
            Value: !Ref Installer

  CognitoIdentityPool:
    Type: "AWS::Cognito::IdentityPool"
    Properties:
      IdentityPoolName: !Sub ${BucketNameParameter}-Identity
      AllowUnauthenticatedIdentities: false
      CognitoIdentityProviders:
        - ClientId: !Ref UserPoolClient
          # ProviderName: !Sub 'cognito-idp.${AWS::Region}.amazonaws.com/${LambdaEdgeProtection.Outputs.UserPoolId}'
          ProviderName: !Sub
            - cognito-idp.${AWS::Region}.amazonaws.com/${userpool}
            - { userpool: !Ref UserPool }
          # ProviderName: !Sub
          #   - 'cognito-idp.${AWS::Region}.amazonaws.com/${userpool}'
          #   - { userpool: !Ref UserPoolClient }
          # ProviderName: !Sub 'cognito-idp.${AWS::Region}.amazonaws.com/${!Ref UserPool}'

  # Create a role for unauthorized acces to AWS resources.
  # Present only for illustration or possible future use.  Not assigned to pool
  CognitoUnAuthorizedRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Federated: "cognito-identity.amazonaws.com"
            Action:
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals:
                "cognito-identity.amazonaws.com:aud": !Ref CognitoIdentityPool
              "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": unauthenticated
      Policies:
        - PolicyName: "CognitoUnauthorizedPolicy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "mobileanalytics:PutEvents"
                  - "cognito-sync:*"
                Resource: "*"
      Tags:
          -
            Key: "OWNER"
            Value: "egt-labs"
          -
            Key: "APPLICATION"
            Value: "jmpr"
          -
            Key: "PATH"
            Value: {"Fn::Join": ["", ["/", {"Ref": "AWS::StackName"}, "-installer/"]]}
          -
            Key: "INSTALLER"
            Value: !Ref Installer

  # Create a role for authorized acces to AWS resources. Control what your user can access. This example only allows Lambda invokation
  # Only allows users in the previously created Identity Pool
  CognitoAuthorizedRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Federated: "cognito-identity.amazonaws.com"
            Action:
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals:
                "cognito-identity.amazonaws.com:aud": !Ref CognitoIdentityPool
              "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": authenticated
      Policies:
        - PolicyName: "BasicCognito"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "mobileanalytics:PutEvents"
                  - "cognito-sync:*"
                  - "cognito-identity:*"
                Resource: "*"
        - PolicyName: "jmprExecution"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "lambda:InvokeFunction"
                Resource: "*"
        - PolicyName: "jmprS3"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "s3:*"
                Resource: "*"
      Tags:
          -
            Key: "OWNER"
            Value: "egt-labs"
          -
            Key: "APPLICATION"
            Value: "jmpr"
          -
            Key: "PATH"
            Value: {"Fn::Join": ["", ["/", {"Ref": "AWS::StackName"}, "-installer/"]]}
          -
            Key: "INSTALLER"
            Value: !Ref Installer

  # Assigns the roles to the Identity Pool
  IdentityPoolRoleMapping:
    Type: "AWS::Cognito::IdentityPoolRoleAttachment"
    Properties:
      IdentityPoolId: !Ref CognitoIdentityPool
      Roles:
        authenticated: !GetAtt CognitoAuthorizedRole.Arn

  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: !Ref AWS::StackName
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true
      UsernameAttributes:
        - email

  UserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref UserPool
      PreventUserExistenceErrors: ENABLED
      GenerateSecret: true
      AllowedOAuthScopes: ["profile", "openid", "email", "phone", "aws.cognito.signin.user.admin"]
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthFlows:
        - code
      SupportedIdentityProviders:
        - COGNITO
      CallbackURLs:
        # Ideally you would put your real callback URL's here, pointing to your custom domain name––the custom
        # domain name that you would also supply as AlternateDomainNames to the cloudfront-authorization-at-edge stack below.
        # However, if you just want to use the CloudFront domain name, use the sentinel value as below, to avoid a circular dependency.
        # This sentinal value will be replaced automatically by the cloudfront-authorization-at-edge stack, with the CloudFront domain name
        - https://example.com/will-be-replaced
      LogoutURLs:
        # Ideally you would put your real logout URL's here, pointing to your custom domain name––the custom
        # domain name that you would also supply as AlternateDomainNames to the cloudfront-authorization-at-edge stack below.
        # However, if you just want to use the CloudFront domain name, use the sentinel value as below, to avoid a circular dependency.
        # This sentinal value will be replaced automatically by the cloudfront-authorization-at-edge stack, with the CloudFront domain name
        - https://example.com/will-be-replaced

  UserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      Domain: !Sub
        - "auth-${StackIdSuffix}"
        - StackIdSuffix: !Select
            - 2
            - !Split
              - "/"
              - !Ref AWS::StackId
      UserPoolId: !Ref UserPool

  LambdaEdgeProtection:
    Type: AWS::Serverless::Application
    DependsOn:
      - UserPoolDomain
    Properties:
      Location:
        ApplicationId: arn:aws:serverlessrepo:us-east-1:520945424137:applications/cloudfront-authorization-at-edge
        SemanticVersion: !Ref SemanticVersion
      Parameters:
        CreateCloudFrontDistribution: "false"
        HttpHeaders: !Ref HttpHeaders
        UserPoolArn: !GetAtt UserPool.Arn
        UserPoolClientId: !Ref UserPoolClient

  UserPoolClientUpdate:
    Type: Custom::UserPoolClientUpdate
    Condition: UpdateUserPoolClient
    Properties:
      ServiceToken: !GetAtt LambdaEdgeProtection.Outputs.UserPoolClientUpdateHandler
      UserPoolArn: !GetAtt UserPool.Arn
      UserPoolClientId: !Ref UserPoolClient
      CloudFrontDistributionDomainName: !GetAtt CloudFrontDistribution.DomainName
      RedirectPathSignIn: "/parseauth"
      RedirectPathSignOut: "/"
      AlternateDomainNames: []
      OAuthScopes: ["profile", "openid", "email", "phone", "aws.cognito.signin.user.admin"]
      ```

Only stack parms needed are the bucket name and stack name

I've found the culprit: in your template change GenerateSecret to false and redeploy and 🎉 it works.
Or, leave it to true, but disable SPA mode then for Auth@Edge: EnableSPAMode = false
I'll update the docs to point this out clearly (and fix the reuse example which was wrong).
Note: I found the cause by setting LogLevel to "debug" for Auth@Edge and checking what happened in parseAuth logs.

Thanks!  That's great news!  Starting testing now.  Some interesting questions:

It looks like generateSecret is optional and allows the deployer to generate a secret on the client that the SPA can check to avoid impersonators.  Am I right in guessing that the a@e doesn't use that feature yet, which is why it fails?  It sounds useful at some point, but it's unclear how the SPA would know what to check the generated secret against, unless perhaps the UserPoolClient returned it on deploy as a configuration for the SPA.  Is that right?
What does it mean to run as EnableSPAMode as false when in fact you're a SPA.  I worry about that one
Where do you set the LogLevel on Auth@Edge?  How come you get parseAuth logs and I just get the complaint about no log group?

Testing away, exciting!

Updated this example: example-serverless-app-reuse/reuse-with-existing-user-pool.yaml
About your Q's:

It looks like generateSecret is optional and allows the deployer to generate a secret on the client that the SPA can check to avoid impersonators. Am I right in guessing that the a@e doesn't use that feature yet, which is why it fails? It sounds useful at some point, but it's unclear how the SPA would know what to check the generated secret against, unless perhaps the UserPoolClient returned it on deploy as a configuration for the SPA. Is that right?
What does it mean to run as EnableSPAMode as false when in fact you're a SPA. I worry about that one

Have a read of this: SPA mode or Static Site mode?
For SPAs it's not useful to have a Client Secret, as anyone can do "view source" and see it.

Where do you set the LogLevel on Auth@Edge? How come you get parseAuth logs and I just get the complaint about no log group?

It's a param to the app, just as CreateCloudFrontDistribution and EnableSPAMode: https://github.com/aws-samples/cloudfront-authorization-at-edge/blob/78867bbe30ddc83fae4fc98f7766e2089f3c95d7/template.yaml#L122-L131
To find the logs you have to go through hoops a bit, as Lambda@Edge logs get their own special log groups, in the region where they end up running (the "normal" log group of the Lambda would not show anything). Easiest way to find them is to go to the CloudFront monitoring dashboard, find the function invocations and jump to the log in the right region there.

Thanks, makes sense.  I took SPA mode too literally I think.  For whatever reason I do not see the updates to example-serverless-app-reuse/reuse-with-existing-user-pool.yaml in the master branch.
Continuing testing

Still an issue on the final test.  Works like this:

Run the template without the custom resource present, but corrected to set generateSecret to false
Successful build
UserPool client obviously has the default and unusable URLs
Manually adjust the URLs in the appClient settings in Cognito, e.g. https://dxxxxxxxx.cloudfront.net/parseauth and https://dxxxxxxxx.cloudfront.net
Create a user
Log in as user , prompted for change password, enter changed password
See:
cognito auth URL of the form `https://auth-xxx.auth.us-east-1.amazoncognito.com/error

This doesn't look like it's coming from the lambdas, rather from Cognito
This scenario works in the 1.2 version
Not critical for us now that we have the custom resource but might be worth a look

I can't reproduce this error. For me deploying the below template, and after deployment changing the redirect URL's, works fine.
So what is different in your case?

Check your browser's address bar––Cognito puts error message (like "redirect mismatch") there sometimes.
Check that your user pool has a value (either false or true) for "AllowAdminCreateUserOnly" (even though it is not a required field according to CloudFormation docs, I've seen it be an issue if not specified)

# Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  TODO

Parameters:
  EnableSPAMode:
    Type: String
    Description: Set to 'false' to disable SPA-specific features (i.e. when deploying a static site that won't interact with logout/refresh)
    Default: "true"
    AllowedValues:
      - "true"
      - "false"
  OAuthScopes:
    Type: CommaDelimitedList
    Description: The OAuth scopes to request the User Pool to add to the access token JWT
    Default: "phone, email, profile, openid, aws.cognito.signin.user.admin"
  PriceClass:
    Type: String
    Description: The price class of the CloudFront distribution
    Default: PriceClass_100

Conditions:
  GenerateClientSecret: !Equals
    - EnableSPAMode
    - "false"

Resources:
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: !Ref AWS::StackName
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true
      UsernameAttributes:
        - email
  UserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref UserPool
      PreventUserExistenceErrors: ENABLED
      GenerateSecret: !If
        - GenerateClientSecret
        - true
        - false
      AllowedOAuthScopes: !Ref OAuthScopes
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthFlows:
        - code
      SupportedIdentityProviders:
        - COGNITO
      CallbackURLs:
        # Replace
        - https://example.com/will-be-replaced
      LogoutURLs:
        # Replace
        - https://example.com/will-be-replaced
  UserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      Domain: !Sub
        - "auth-${StackIdSuffix}"
        - StackIdSuffix: !Select
            - 2
            - !Split
              - "/"
              - !Ref AWS::StackId
      UserPoolId: !Ref UserPool
  ApplicationBucket:
    Type: AWS::S3::Bucket
  CloudFrontOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "${ApplicationBucket}-OAI"
  S3AccessPolicyForOAI:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: ApplicationBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              CanonicalUser:
                Fn::GetAtt: [CloudFrontOriginAccessIdentity, S3CanonicalUserId]
            Action: "s3:GetObject"
            Resource: !Sub "${ApplicationBucket.Arn}/*"
          - Effect: "Allow"
            Principal:
              CanonicalUser:
                Fn::GetAtt: [CloudFrontOriginAccessIdentity, S3CanonicalUserId]
            Action: "s3:ListBucket"
            Resource: !GetAtt ApplicationBucket.Arn
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        # Aliases: <your alternate domain names, also pass these to the serverless stack below>
        # ViewerCertificate: <the config for your HTTPS certificate>
        CacheBehaviors:
          - PathPattern: /parseauth
            Compress: true
            ForwardedValues:
              QueryString: true
            LambdaFunctionAssociations:
              - EventType: viewer-request
                LambdaFunctionARN: !GetAtt MyLambdaEdgeProtectedSpaSetup.Outputs.ParseAuthHandler
            TargetOriginId: dummy-origin
            ViewerProtocolPolicy: redirect-to-https
          - PathPattern: /refreshauth
            Compress: true
            ForwardedValues:
              QueryString: true
            LambdaFunctionAssociations:
              - EventType: viewer-request
                LambdaFunctionARN: !GetAtt MyLambdaEdgeProtectedSpaSetup.Outputs.RefreshAuthHandler
            TargetOriginId: dummy-origin
            ViewerProtocolPolicy: redirect-to-https
          - PathPattern: /signout
            Compress: true
            ForwardedValues:
              QueryString: true
            LambdaFunctionAssociations:
              - EventType: viewer-request
                LambdaFunctionARN: !GetAtt MyLambdaEdgeProtectedSpaSetup.Outputs.SignOutHandler
            TargetOriginId: dummy-origin
            ViewerProtocolPolicy: redirect-to-https
        DefaultCacheBehavior:
          Compress: true
          ForwardedValues:
            QueryString: true
          LambdaFunctionAssociations:
            - EventType: viewer-request
              LambdaFunctionARN: !GetAtt MyLambdaEdgeProtectedSpaSetup.Outputs.CheckAuthHandler
            - EventType: origin-response
              LambdaFunctionARN: !GetAtt MyLambdaEdgeProtectedSpaSetup.Outputs.HttpHeadersHandler
          TargetOriginId: protected-origin
          ViewerProtocolPolicy: redirect-to-https
        Enabled: true
        Origins:
          - DomainName: example.org # Dummy origin is used for Lambda@Edge functions, keep this as-is
            Id: dummy-origin
            CustomOriginConfig:
              OriginProtocolPolicy: match-viewer
          - DomainName: !Sub "${ApplicationBucket}.s3.amazonaws.com"
            Id: protected-origin
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}"
        CustomErrorResponses:
          - ErrorCode: 404
            ResponseCode: 200
            ResponsePagePath: /index.html
        PriceClass: !Ref PriceClass
        DefaultRootObject: index.html
  MyLambdaEdgeProtectedSpaSetup:
    Type: AWS::Serverless::Application
    DependsOn: UserPoolDomain
    Properties:
      Location:
        ApplicationId: arn:aws:serverlessrepo:us-east-1:520945424137:applications/cloudfront-authorization-at-edge
        SemanticVersion: 2.0.1
      Parameters:
        UserPoolArn: !GetAtt UserPool.Arn
        UserPoolClientId: !Ref UserPoolClient
        EnableSPAMode: !Ref EnableSPAMode
        CreateCloudFrontDistribution: false
        OAuthScopes: !Join
          - ","
          - !Ref OAuthScopes
Outputs:
  WebsiteUrl:
    Description: URL of the CloudFront distribution that serves your SPA from S3
    Value: !Sub "https://${CloudFrontDistribution.DomainName}"

Thanks, Otto.  I've gone back to that install after doing nothing to it over the weekend, and it is now working!  Very peculiar that it stabilized without action.  Let's pass over this particular rabbit-hole and I'l raise it again if it becomes an issue.  Looks like 2.01 is now a going concern ... will work on some of the cookie injection magic it brings.


support ISODep

support ISODep, but android only

Cool! Thank you for this.
I am currently away until Tuesday, but I will take a look at it when I get back.


official repo?

curious/puzzled. Would google really release their model in pytorch? Is this the official implementation of Memorizing Transformers?
(btw, great work!)

https://twitter.com/ChrSzegedy/status/1589492667247132672?s=20&t=1VqJB9gI-yAmv2wM6VoYiQ https://github.com/google-research/meliad


Fix wrong init dependency on markup extensions

This will fix the bug that markdown parser has been initialized before customerize markdown extensions load.

Tests fail

Codecov Report

:exclamation: No coverage uploaded for pull request base (master@5f05aa1). Click here to learn what that means.
The diff coverage is 100%.

@@            Coverage Diff            @@
##             master    #7038   +/-   ##
=========================================
  Coverage          ?   41.47%
=========================================
  Files             ?      442
  Lines             ?    59575
  Branches          ?        0
=========================================
  Hits              ?    24706
  Misses            ?    31643
  Partials          ?     3226

Impacted Files
Coverage Δ

modules/markup/markup.go
81.15% <100%> (ø)

routers/init.go
68.49% <100%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5f05aa1...e04058c. Read the comment docs.

@lafriks fixed

@lunny please send backport


describeInstances always returns an error

Description:
The describeInstances is not working. I'm getting this error:
Error occurred while accessing the XML payload of the response

Affected Product Version:
Ballerina 0.990.3
OS, DB, other environment details and versions:
Ubuntu 18.04.1 LTS
Steps to reproduce:
Use example code for amazonEC2Client->describeInstances

I printed the response. That's what I see:
Response: {statusCode:401, reasonPhrase:"Unauthorized", server:"AmazonEC2", resolvedRequestedURI:"", cacheControl:null}

I think that the problem is with the authorization header. When I get the generated header from the generateSignature function and I manually test it I get:
<?xml version="1.0" encoding="UTF-8"?>
<Response><Errors><Error>AuthFailure<Message>AWS was not able to validate the provided access credentials</Message></Error></Errors><RequestID>599f35cf-8bf3-4222-8771-3cb455932bf5</RequestID></Response>

I could be wrong but my current theory is that it's not generated properly.

@zinderic
Since we couldn't be able to reproduce this issue with our AWS credentials, in order to check further could you please make sure that,

The provided credentials are valid (ACCESS_KEY_ID, SECRET_ACCESS_KEY, REGION).
Did you face the same issue with other Amazon ec2 operations?
Make sure is to set correct system time and Date

@Biruntha
It seems that my credentials and region are OK because I can run this without issues with same credential file (~/.aws/credentials) :
aws ec2 describe-instances --instance-ids i-03a6bab94d5089ce7

But when I run the sample app it fails:
import ballerina/io;
import wso2/amazonec2;

amazonec2:AmazonEC2Configuration amazonec2Config = {
    accessKeyId: "removed but it was the one from the credentials file",
    secretAccessKey: "removed but it was the one from the credentials file",
    region: "removed but it was the one from the credentials file"
};

amazonec2:Client amazonEC2Client = new(amazonec2Config);

public function main() {

   var describeInstancesResponse = amazonEC2Client->describeInstances("i-03a6bab94d5089ce7");
   if (describeInstancesResponse is amazonec2:EC2Instance[]) {
       io:println("Instance descriptions: ", describeInstancesResponse);
   } else {
       io:println("Error: ", describeInstancesResponse.detail().message);
   }
}

I haven't went so far as testing other things. I wanted to start with your sample app from the README.md file first.

I did some more testing.

Generated static credentials in IAM and use them from my laptop and from AWS VM. - passed
Generated IAM role to pre-authenticate a VM and tested code on it. - failed
Authenticated to AWS via Okta (I have an account with such integration) and use temporary (expiring) key pair. - failed

So, it does work for the standard case with normally generated IAM credentials. But there are corner cases like the IAM role. One can use IAM role and attach it to a VM. Then code running on this VM is authorized to do anything the role permits with no authentication. It's already pre-authenticated via internal to the VM endpoint - <IP_ADDRESS>.
The 3rd test was the one I initially did. Using services such as Okta one can integrate with IAM and have users getting temporary keys. Those don't seem to be playing nice with this library for some reason even so they look the same as the one I generated statically in IAM. The difference is that they expire.

@zinderic
We are trying to reproduce this issue. Could you be able to provide detailed steps for case 2 and 3 about to create IAM role to pre-authenticate and how to authenticate to AWS via Okta?

@Biruntha
Case 3 should have something to do with expiring keys. I use Okta in my organization but that should not matter really. See here:
https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html
There is a section called "Use Temporary Security Credentials (IAM Roles) Instead of Long-Term Access Keys"
I'll give you steps for case 2. OK, let's say we'll use the region in Ireland (eu-west-1) for this test.

Go to IAM Roles:

https://console.aws.amazon.com/iam/home?region=eu-west-1#/roles

Click "Create role"

Select the EC2 service

Select the AdministratorAccess policy

Set tags if you want to, give roll name and finish

Go to EC2 instances

https://eu-west-1.console.aws.amazon.com/ec2/v2/home?region=eu-west-1#Instances:sort=tag:Name

Select the EC2 instance you're using for tests
Click Actions -> Instance Settings -> Attach/Replace IAM Role
Select the name of the IAM role you created and apply it

That's it. Now you should be able to call EC2 API from the EC2 instance you attached the AdministratorAccess role to. You can test it via awscli, something like:
aws ec2 describe-instances --instance-ids i-03a6bab94d5089ce7
There should be no need for ~/.aws folder with credentials. You might need to set also "--region eu-west-1" of whatever region you're using. If you have http_proxy / https_proxy you should have the no_proxy variable set as well with at least the value of <IP_ADDRESS> which is the metadata endpoint where IAM gets called for authentication.

@zinderic
Thanks for the response.
I have tried to reproduce the case 2 by following the steps as you have mentioned. In addition to that, I have created a user with "AmazonEC2FullAccess" policy and obtained the ACCESS_KEY_ID, SECRET_ACCESS_KEY for that user. Using those credentials, I have tested the describeInstances method in ec2 connector and it is working for me without any issues.
So, In order to check this issue further, I have written sample client programs in the following ways to test describeInstances method:

Client 1 - Written a simple java client [1] to call describeInstances API method using AWS SDKs. Here, this SDK automatically sign the AWS requests for you.
Client 2 - Written a custom code [2] to send HTTP requests to AWS to call describeInstances API, and included the code [3] to sign the AWS requests based on the steps provided in the Amazon doc [4].

Could you please test the above sample clients and will you be able to provide result of the above two cases?
Please note that, update the credentials with your values for [5] & [6].
[1] https://github.com/Biruntha/AmazonEC2_Examples/blob/master/AWS_EC2_Example1/src/main/java/com/aws/ec2/DescribeInstance.java
[2] https://github.com/Biruntha/AmazonEC2_Examples/blob/master/AWS_EC2_Example2/src/main/java/com/aws/ec2/DescribeInstanseTest.java
[3] https://github.com/Biruntha/AmazonEC2_Examples/blob/master/AWS_EC2_Example2/src/main/java/com/aws/ec2/AWSSignatureV4Generator.java
[4] https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
[5] https://github.com/Biruntha/AmazonEC2_Examples/blob/master/AWS_EC2_Example1/src/main/java/com/aws/ec2/DescribeInstance.java#L16-L19
[6] https://github.com/Biruntha/AmazonEC2_Examples/blob/master/AWS_EC2_Example2/src/main/java/com/aws/ec2/DescribeInstanseTest.java#L20-L23

@Biruntha
yes, I could test that but that's again case 1. Just a different spin off. We'll already signed off that as working. I'll try to elaborate a bit more here so let me know if I make any sense (or not :)).
If we have a root account and generate tokens or if we make IAM user and generate tokens it doesn't matter since those are the same type. Same case. What differs in the approach I described is the following:

No ACCESS_KEY_ID and SECRET_ACCESS_KEY are used.
EC2 instance by itself runs the code and is authorized to use  AmazonEC2FullAccess role.
IAM role is used instead of IAM user with keys.

I think the main area in my steps is around the role. If you review those steps again you'll see that it doesn't create user. It creates a role. That role gets attached to a running EC2 instance and it authorizes it to use whatever the role policy defines. That's a different case than using ACCESS_KEY_ID and SECRET_ACCESS_KEY and it's more or less standard approach because those keys could leak and we should always guard them. But if we assign role to EC2 instance there are no keys anywhere :) That's the beauty of this approach.

@zinderic
I haven't tried out this scenario before.
Will you be able to point me any Amazon doc to follow up this?

@Biruntha
Sure, the mechanism is explained here:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
The steps I provided above were tested and based on this documentation.

@zinderic, Thanks for the info.
As per this doc [1], I have created an EC2 instance, assigned the created role, created a key pair to login to an instance and downloaded the public key as .pem file.
Then connected to EC2 instance using SSH [2]. Got the temporary authentication credentials for the role that was associated with the created EC2 instance by running the command [3] from inside the EC2 instance. I got the example credentials output as in [4]. Using the AccessKeyId, SecretAccessKey from the response [4], I could be able to reproduce the error [5] as you got. As per this [6], after setting the securityToken into the request header [7] I could be able to run describeInstances successfully.
In order to sign AWS request, we need to pass access keys (access key ID, secret access key). In addition to that, If we are using temporary security credentials, the signature calculations require a security token [8].
Please note that as per this doc [9], Applications, AWS CLI, and Tools for Windows PowerShell commands that run on the instance can then get automatic temporary security credentials from the instance metadata. we do not have to explicitly get the temporary security credentials—the AWS SDKs, AWS CLI, and Tools for Windows PowerShell automatically get the credentials from the EC2 instance metadata service and use them.
But If we're making direct HTTPS API requests to AWS, we can sign those requests with the temporary security credentials that you get from the AWS Security Token Service (AWS STS). To do this, we need to use the access key ID and secret access key that we receive from AWS STS the same way you would use long-term credentials to sign a request. we also need to add the session token that we receive from AWS STS into the API request.
Is this the approach you are expecting?
[1] https://www.guru99.com/creating-amazon-ec2-instance.html
[2]
chmod 400 /path_to_key/my_key.pem
ssh -i /path_to_key/my_key.pem user_name@public_dns_name
[3] curl http://<IP_ADDRESS>/latest/meta-data/iam/security-credentials/role_name
[4]
{
"Code" : "Success",
"LastUpdated" : "2019-05-09T04:48:50Z",
"Type" : "AWS-HMAC",
"AccessKeyId" : "ASIASCCNQxxxxxxxxxxxxxPRPCN7C7",
"SecretAccessKey" : "44FixxxxxxxxxxxxTAj6iVEuChimtNpZezRBgUpX3rum6e",
"Token" : "AgoJb3JpZ2luX2VjEFxxxxxxxxxxxxxxxxdKNWdXNvS/70Q72PuhHuWeM8iLhemeioKYVgzMvipGjtOKw2gL3+pJUC0C7dgHvQHwc/7eGAnHPmPx+3jFFtMZ0SfUtJ0GOKxk=",
"Expiration" : "2019-05-09T11:07:06Z"
}
[5]
AuthFailureAWS was not able to validate the provided access credentials977ace28-c22a-4674-bedc-791a1ca4293c
[6] https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#UsingTemporarySecurityCredentials
[7] https://github.com/Biruntha/AmazonEC2_Examples/blob/master/AWS_EC2_Example2/src/main/java/com/aws/ec2/DescribeInstanseTest.java#L32
[8] https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html#auth-methods-intro
[9] https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html

Yes, that's exactly my point. In the end I would expect that end user experience should be just like when using the AWS CLI. For example Terraform also does that - if there is an instance profile it automatically authenticates. I guess there is some check being made in the background calling IAM, grabbing the temporary keys, signing them with token, etc. But the user doesn't feel a think.
Your findings in regard to the exact IAM endpoint and the need to sign the request with the temporary security credentials that you get from the AWS Security Token Service (AWS STS) are very interesting. It seems that this is the missing thing. With this change we should be able to get to the behavior I would expect to see and get to the pattern I see implemented in tools within the same ecosystem.

This issue is fixed with PR [1] and the connector version 0.8.9. You can find it in the Ballerina central [2].
[1] https://github.com/wso2-ballerina/module-amazonec2/pull/17
[2] https://central.ballerina.io/wso2/amazonec2


feat: add 2 new image_classification tasks for MobileNetEdgeTPUv2 model

Closes #719
This is how the app looks with 2 new tasks:

version name scheme: should we call it Classification V2 (after model name) or V3.1 (align with the app version)? Let's discuss this in main mobile working group.

we can move the two mobilenet edgetpu models to the end of the list later

Let's call it V2 (not V2.0).

The accuracy test of image_classification_offline_v2 failed on Pixel 6 with Pixel backend because the accuracy is 0.
But image_classification_v2 on Pixel 6 passed the test.
Other backends (TFLite, Core ML) also passed the test.
@freedomtan Do you have an idea what can be the reason for this?

The accuracy test of image_classification_offline_v2 failed on Pixel 6 with Pixel backend because the accuracy is 0. But image_classification_v2 on Pixel 6 passed the test. Other backends (TFLite, Core ML) also passed the test.
@freedomtan Do you have an idea what can be the reason for this?

Yes, I ran into the same problem on Pixel 7 before. It seems you have to reduce the batch size to a much smaller one. I guess it’s a bug or limitation of EdgeTPU.

Yes, I ran into the same problem on Pixel 7 before. It seems you have to reduce the batch size to a much smaller one. I guess it’s a bug or limitation of EdgeTPU.

Thank you. Reducing the batch size worked.

let's rebase this one and create an 4.0 branch.

Let's rebase this to current master branch and make the model path local (local://) and without checksum, so that it's easier to test new models (we may get more than one model to test).

@freedomtan

Let's rebase this to current master branch

Done

and make the model path local (local://) and without checksum, so that it's easier to test new models (we may get more than one model to test).

Each vendor should add a new benchmark_setting to its setting file like this, and can set its own path to local for testing.
benchmark_setting {
  benchmark_id: "image_classification_v2"
  framework: "TFLite"
  delegate_choice: {
    delegate_name: "CPU"
    accelerator_name: "cpu"
    accelerator_desc: "CPU"
    model_path: "https://github.com/mlcommons/mobile_models/raw/anh/add-MNEdgeTPU-V2-L/v3_1/tflite/mobilenet-edgetpu-v2-L_fp32.tflite"
    model_checksum: "4b7ce0a82f8eaa542404d2ab2ee4e575"
  }
}

benchmark_setting {
  benchmark_id: "image_classification_offline_v2"
  framework: "TFLite"
  delegate_choice: {
    delegate_name: "CPU"
    accelerator_name: "cpu"
    accelerator_desc: "CPU"
    batch_size: 2
    model_path: "https://github.com/mlcommons/mobile_models/raw/anh/add-MNEdgeTPU-V2-L/v3_1/tflite/mobilenet-edgetpu-v2-L_fp32.tflite"
    model_checksum: "4b7ce0a82f8eaa542404d2ab2ee4e575"
  }
}

Or should I remove the checksum and set the path to local for tflite_settings_android.pbtxt?

@freedomtan

Let's rebase this to current master branch

Done

we need max_duration for new benchmark items.
diff --git a/flutter/assets/tasks.pbtxt b/flutter/assets/tasks.pbtxt
index 5a113ca..d7cf0be 100644
--- a/flutter/assets/tasks.pbtxt
+++ b/flutter/assets/tasks.pbtxt
@@ -221,6 +221,7 @@ task {
   name: "Image Classification v2"
   min_query_count: 1024
   min_duration: 60
+  max_duration: 600
   max_throughput: 1000
   max_accuracy: 1.0
   scenario: "SingleStream"
@@ -257,6 +258,7 @@ task {
   name: "Image Classification v2 (Offline)"
   min_query_count: 24576
   min_duration: 0
+  max_duration: 600
   max_throughput: 2000
   max_accuracy: 1.0
   scenario: "Offline"

we need max_duration for new benchmark items.

Done. max_duration does not work in Offline scenario, so I set it to zero.

@mohitmundhragithub and @AhmedTElthakeb for some new models, we need different preprocessing, I have a hack based on this one,  https://github.com/mlcommons/mobile_app_open/commit/1d9e1e9aed2008754d5749b702380df67a1e2af6

@mohitmundhragithub and @AhmedTElthakeb for some new models, we need different preprocessing, I have a hack based on this one, 1d9e1e9

this is for which model?
I think MobileNetEdgeTPUv2 model was working fine... no?

@freedomtan to send PRs for different input sizes for new models (with different preprocessing). 224x224, 256x256, 384x384

To check why iOS Tests and android-test-pixel failed with no matching backend found.

Should we merge this to submission-v4.0 branch first? And then after the submission, we merge submission-v4.0 into master.

Should we merge this to submission-v4.0 branch first? And then after the submission, we merge submission-v4.0 into master.

I am fine with either way. Let's discuss it in the meeting.

let's merge this to submission-v4.0 first, and back to master when we have good qualcomm backend for the classification V2.
change order of test as @mohitmundhragithub suggested.


Update documentation for v32

Review existing documentation for correctness

installation instructions
usage instructions
API usage information

make sure the Changelog is complete
are there any Upgrade instructions

User-

Using the UI and API
Explain how to use API via openAPI documentation
A Table to show endpoint what to query it with and what you can expect from the output.
Explain WebUI

Search by vulnerabilities and packages
PURL or fragment of PURL
Drill on details and all the thing shown on the package details page.

Developer -
Move importer and improver to CONTRIBUTING section
Local Instance -

Installation
API usage


How do I change the dot color of specific events?

I'm trying to have each different event have a different colored dot based on what kind of event it is. How can I change the color of a specific event?

I'm trying to have each different event have a different colored dot based on what kind of event it is. How can I change the color of a specific event?

I had the same problem but kind of "hacked" it by implementing
func calendar(_ calendar: FSCalendar, imageFor date: Date) -> UIImage?
where I return a UIImage in the shape of a dot that has the correct color for that date.

I'm trying to have each different event have a different colored dot based on what kind of event it is. How can I change the color of a specific event?

I had the same problem but kind of "hacked" it by implementing
func calendar(_ calendar: FSCalendar, imageFor date: Date) -> UIImage?
where I return a UIImage in the shape of a dot that has the correct color for that date.

Thanks so much for the help, the images trick is working for me but how did you solve the issue of having multiple events on one day? I tried playing around with the func calendar(_ calendar: FSCalendar, appearance: FSCalendarAppearance, imageOffsetFor date: Date) -> CGPoint { function, but I couldn't figure out how to space out the two images when there are two events, right now they're overlapping.


[17.11] backport Add containerd static compile

To address:

https://github.com/moby/moby/issues/35349 containerd binaries no longer static

Backport fix:

https://github.com/moby/moby/pull/35350 Add containerd static compile

With cherry-pick of git commit https://github.com/moby/moby/pull/35350/commits/007db06:
$ git cherry-pick -s -x -Xsubtree=components/engine 007db06

cherry-pick went in clean

Test failures (on ppc64le) seem related to disk space availability (there's none of it)
Also:   net.sf.json.JSONException: A JSONObject text must begin with '{' at character 0 of

https://jenkins.dockerproject.org/job/docker-ce-pr-ppc64le/83/console

Looks like all tests passed on the ppc64le build before it gave error on out of disk space:
01:07:53.979 [DockerSuite] OK: 1167 passed, 73 skipped
01:07:53.979 [DockerSuite] PASS

Forgoing the s390x tests for now because they may need to be rebuilt. Need to get the x86_64 builds for downstream products to work.


RNAseq won't render output in safari

When I try to look at the output in the workspace browser I can doubleclick on the job result, the URL changes, but the result is not shown.
Path is<EMAIL_ADDRESS>[Error] TypeError: Not enough arguments
	replaceState
	go (/js/3.5.8/p3/layer/core.js:195:274)
	(anonymous function) (/js/3.5.8/p3/layer/core.js:95:112)
	f (dojo.js:97:127)
	emit (dojo.js:88:366)
	emit (dojo.js:89:449)
	emit (dojo.js:95:285)
	publish (dojo.js:94:444)
	(anonymous function) (/js/3.5.8/p3/layer/core.js:624:328)
	(anonymous function) (dojo.js:58:507)
	dispatchEvent
	emit (dojo.js:89:428)
	(anonymous function) (/js/3.5.8/p3/layer/core.js:641:88)
	(anonymous function) (dojo.js:88:141)

It seems that the job object was simply empty in this case.
For the link provided the job object is empty in chrome and safari.
This works if the job object is populated:
<EMAIL_ADDRESS>Workshop/RNA-Seq/Acinetobacter_AMR_treatments


runtime(java): Recognise text blocks

Also, accept as valid the space escape sequence \s.
Also, consistently use the claimed javaDebug prefix for
syntax group definitions kept under g:java_highlight_debug.
Since javaStringError is commented out for its generality,
let's comment out javaDebugStringError, its copy, as well.
References:
https://openjdk.org/jeps/378
https://docs.oracle.com/javase/specs/jls/se17/html/jls-3.html#jls-3.10.7
Closes #10910.

thanks!


Add github CI workflow

Fixes BLUI-5563.

Changes proposed in this Pull Request:

add github CI workflow
remove circleCI config
stop building in circleCI
revert blui colors package back to 3.1.1

Screenshots / Screen Recording (if applicable)

To Test:

make small commit to see job run and remove commit
https://github.com/etn-ccis/blui-react-themes/actions/runs/8484364014

Any specific feedback you are looking for?

All checks passed https://github.com/etn-ccis/blui-react-themes/pull/93/commits/89c3835a244803ba1a992da4fb3f3b442ffe45bf


xdg_utils: missing/impure runtime dependencies

The xdg-open script uses which to find executables, but which is not one of its dependencies.

Yes, it also uses grep and some coreutils, and maybe more. I didn't look too closely.

i had this in my nixpkgs forgot to push it upstream. anyway here it is ... not sure if this is all.

Can we close this issue?

I suppose, until some more deps are found...


Proposal: Informing external standards/integrators of important changes/tickets asking for community input

Background/Context
Every once in a while tickets are opened for PHP_CodeSniffer with proposals which impact external standards and/or external tooling integrating with PHP_CodeSniffer.
In the run up to a new major, this may happen more often. Similarly, it will happen a little more often in the next few months while I'm finding my feet and working through some of the maintenance backlog.
These tickets can be proposals for new features, proposals for breaking changes, or other big changes.
These tickets will often be labelled with the Type: meta label, the Type: breaking change label and will always initially get a Status: waiting for opinions label.
Some examples of tickets like this in the past are:

squizlabs/PHP_CodeSniffer#3041
squizlabs/PHP_CodeSniffer#3489
squizlabs/PHP_CodeSniffer#3784
squizlabs/PHP_CodeSniffer#3932

And some current examples:

#3
#30
#164
#165
#184
#199
Upcoming: proposal about adding type declarations to public API methods in PHPCS 4.0 (parameter) / 5.0 (return).

Typically, these type of tickets can benefit from the input of external standards maintainers / tooling integrators, whether it is to make sure that a certain impact/use is not overlooked or to measure support for a proposal.
Up to now, I've often semi-randomly added some people in a cc list to these tickets, often based on who came to mind and/or who I'd seen as recently active or based on the history of affected code.
I never meant to exclude people or offend by forgetting to mention someone and apologize if anyone has felt bypassed in the past. This was never my intention.
Along the same lines, I never intended to bother people who don't want to be bothered with these type of tickets.
Going forward, I'd like to take the "randomness" out of the equation.
Proposal
I'm proposing to add a community-cc-list.md file to the .github folder with a list of GitHub handles of people who would like to be informed of these type of tickets.
That list will then be used, when appropriate, to ping the right people on a ticket.
As the list will be in a simple markdown file in the repo, anyone can add themselves to the list and/or remove themselves at any time via a PR.
PRs adding/removing other people to/from the list will only be merged if the people being added/removed leave a comment on the PR consenting to it.
Now, you may already watch this repo. In that case, being on or off this list will not directly impact you as GH will only send you one notification anyway. You may still choose to be on the list anyway.
So, I'm hoping this will be the last time I'm using a "random" list of people to cc:
/cc @kukulich @wimg @weierophinney @GaryJones @dingo-d @klausi @photodude @Potherca @webimpress @fredden @michalbundyra @sirbrillig @othercorey @greg0ire @dereuromark @umherirrender @stronk7 @Ocramius @anomiex @derrabus
Open question
Should there be one list ? Or should there be two separate lists, one for external standards maintainers, one for integrators ?
Action plan
I'll be opening the PR to add the file in a moment and will leave this proposal and the PR open for the next two weeks or so.
If you want to be on the initial list, just leave a comment on this ticket or on the PR and I will make sure to include your handle before merging the PR.
If there are any concerns about this proposal, please raise them by leaving a comment.

Typically, these type of tickets can benefit from the input of external standards maintainers / tooling integrators, whether it is to make sure that a certain impact/use is not overlooked or to measure support for a proposal.

Agreed.

I'm proposing to add a community-cc-list.md file to the .github folder with a list of GitHub handles of people who would like to be informed of these type of tickets.

@jrfnl you could also add these people to a limited scope/access group, that becomes pingable under @PHPCSStandards/group-name, FYI. Obiviously, this requires someone with admin access to add/remove people, but somebody would merge .github changes anyway, so... :shrug:

I'm proposing to add a community-cc-list.md file to the .github folder with a list of GitHub handles of people who would like to be informed of these type of tickets.

@jrfnl you could also add these people to a limited scope/access group, that becomes pingable under @PHPCSStandards/group-name, FYI. Obiviously, this requires someone with admin access to add/remove people, but somebody would merge .github changes anyway, so... 🤷

@Ocramius IIRC that would require people to become members of the PHPCSStandards organization though before they could be added to such a group ? Or am I mis-remembering this ?
Seems simpler to allow this to work via PRs. That way, when the pool of people who can merge PRs will grow, anyone with merge access can handle these type of requests, no need to always get an admin involved.

Looks good to me and I would be happy to be on the list :)

Count me in as well 👍

@Ocramius IIRC that would require people to become members of the PHPCSStandards organization though before they could be added to such a group ? Or am I mis-remembering this ?

Yes, correct, but the notification flow allows for easier pings.
Anyway, happy to be on the list with either approach, just proposed something that worked well in other orgs :-)

@Ocramius IIRC that would require people to become members of the PHPCSStandards organization though before they could be added to such a group ? Or am I mis-remembering this ?

Yes, correct, but the notification flow allows for easier pings.
Anyway, happy to be on the list with either approach, just proposed something that worked well in other orgs :-)

@Ocramius Appreciated. I may well look into this at some point in the future anyway, but let's start with the md file approach.
@kukulich, @greg0ire @Ocramius I've added all three of you to the initial list in PR #228 now.

As always, happy to contribute where and when I can ;-)

You can add me, sure :) Although we mostly work on the same codebase so I'm usually in the loop about the changes 😄

I'd like to be included on the list too. Thanks.

@wimg @dingo-d @asispts I've added you to the initial list in PR #228 now.

This makes sense. While I am currently "watching" this repository, I do get different notifications when mentioned versus just watching. I'd like to be on this new "sometimes CC'd" list.

@fredden Added!

I'm happy to be on the list, if nothing else than as backup for @Ocramius for Laminas-related CS!

Or should there be two separate lists, one for external standards maintainers, one for integrators ?

I think one list is ok, after all both "collectives" share interests on breaking changes, new features... BTW, count me on (no matter I'm just an avid reader and "opinionator" :-)

I'm happy to be on the list as well. Thank you for this idea!

Happy to be added.

I'm really happy to see so many enthousiastic reactions to this proposal. Please also feel invited to already have a look at the open issues listed above and leave an opinion if you have one.
@weierophinney @stronk7 @sirbrillig @GaryJones I've added you to the initial list in PR https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/228 now.

I've just merged the PR with the initial list based on who consented to be on the list in this issue/the PR.
Any updates as of now, can be made by whomever wants to be added/removed from the list by submitting a PR.

Side comment, I've not found it... maybe it would be worth adding this to the contributing docs, so people can know about the existence of the cc list and make requests via PR as suggested above?
Hope I'm not missing anything, have quick-greped trying to find if this was written down anywhere...
Ciao :-)


finish the implementation and documentation of verbose and permissive namespaces

These will not be a part of the library.


Deprecate package on NPM

Mark the package as deprecated on NPM so new users are less likely to start using a deprecated package.
Also release 1 final build so that the readme is updated on npm so it shows to use vue-chartjs
https://docs.npmjs.com/deprecating-and-undeprecating-packages-or-package-versions
https://www.npmjs.com/package/vue-chart-3

Hello @victorgarciaesgi, It would be fantastic if you could implement this issue.


":/Scoop/apps/gow/current/bin/bash.exe": E:Scoopappsnavi2.23.0navi.exe: command not found

Describe the bug
A clear and concise description of what the bug is.
To Reproduce
navi
Try to download default scheatsheets
Expected behavior
A clear and concise description of what you expected to happen.
Screenshots

Versions:

OS: Windows
PowerShell

I described a workaround for this problem in #794
It enables almost all previewing capabilities of navi when using bash on windows
The workaround can probably also be used for other shells when the environment variables are set correctly


Cannot install extension behind NTLM proxy (Windows)

When I try to install the extension, I get the error:
connect ETIMEDOUT ip:443

Duplicate of #69


⚠ PrivateHD has degraded performance

In 66bddf4, PrivateHD ($PHD) experienced degraded performance:

HTTP code: 200
Response time: 3009 ms

Resolved: PrivateHD performance has improved in d735652.


fix(coverage): update istanbul-lib-instrument to v6 to fix vulnerable dependency

Update @vitest/coverage-istanbul package's dependency range for istanbul-lib-instrument so that new major is allowed. This requires releasing new version of @vitest/coverage-istanbul.

https://github.com/istanbuljs/istanbuljs/releases/tag/istanbul-lib-instrument-v6.0.0

Also updates istanbul-lib-report to new patch version. This does not require releasing as semver range already allows end users to update their transitive dependencies.

https://github.com/istanbuljs/istanbuljs/releases/tag/istanbul-lib-report-v3.0.1

Ref. https://github.com/vitest-dev/vitest/discussions/3786

The failing test-browser-windows (edge, webkit) seems unrelated.


Add Rollbar stream integration

Add Rollbar stream integration
Code enhancements

I still have to update from upstream repo.

conztanz/ctz-bunyan master merged in khezen/ctz-bunyan rollback
conflict resolved


Implement Color32 arithmetic

Implement improvements to combine and mix Color32:

Implement std::ops::Add trait
Implement std::ops::Sub trait
Implement lerp function
Implement merge function (interpolate at 50%)

To give some feedback about the algorithm choosen refer to this
https://stackoverflow.com/questions/726549/algorithm-for-additive-color-mixing-for-rgb-values

It depends on what you want, and it can help to see what the results are of different methods.
If you want
Red + Black        = Red
Red + Green        = Yellow
Red + Green + Blue = White
Red + White        = White
Black + White      = White
then adding with a clamp works (e.g. min(r1 + r2, 255)) This is more like the light model you've referred to.

I'm sorry, but I don't think any of these operations makes any sense on colors with premultiplied alpha.


Crosscheck simulation with matlab

Tests with this branch show identical results between pyveg and the matlab script. Other changes:

Add functionality to save plant biomass array as matlab file
Clean up pattern generation script

#57

Changes are straightforward so I'm going to merge this.


metasploit: 6.2.26 -> 6.2.27

Description of changes
Update to latest upstream release 6.2.27

Things done

Built on platform(s)

[x] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[ ] aarch64-darwin

[ ] For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
[ ] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[x] Tested basic functionality of all binary files (usually in ./result/bin/)
22.11 Release Notes (or backporting 22.05 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module
[ ] (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes

[x] Fits CONTRIBUTING.md.

Result of nixpkgs-review pr 201928 run on x86_64-linux 1

3 packages built:

metasploit
msfpc
social-engineer-toolkit


Fix error in token response can be None

Fix error in token response can be None for OAuth2 client, which then should be treated as success

DO NOT SEND ANY SECURITY FIX HERE. Please read "Security Reporting" section
on README.

What kind of change does this PR introduce? (check at least one)

[x] Bugfix
[ ] Feature
[ ] Code style update
[ ] Refactor
[ ] Other, please describe:

Does this PR introduce a breaking change? (check one)

[ ] Yes
[x] No

[x] You consent that the copyright of your pull request source code belongs to Authlib's author.

Can you provide a real case for this issue? Which service has such a problem? Can it be fixed by compliance hook?

Hi, yes this can be fixed fit compliance hook. thanks for pointing out.


Not getting the choices?

Hello,
I don't know if I'm reading this wrong somehow, but for some reason, when I try to make a favorite picker, it just doesn't work.
Here's what I have changed from the base html, as instructed:
https://i.gyazo.com/651f76d7c1ad03fde115a5a6339f5541.png
And here's what shows up.
https://i.gyazo.com/cd03ba6ba16ba78dc0ef04b0ed193080.png
Any idea what I'm doing wrong?

You've left out the \ in front of the apostrophe in "The Dragon's Neck" - that's probably it.


Use page.rel helper from kaminari instead of complex conditional logic

I noticed in the page partial for a few themes, we can replace some of these conditionals we have for calculating the rel by simply deferring to the rel pagination helper in kaminari instead which does the exact same logic.
This makes these partials much cleaner and more aligned with the page partial that comes from kaminari itself.

Nice! This seems like an easy win. Would you mind updating other templates as well?

Oops your right, looks like I missed a few. Will add the other templates as well and update PR 👍

The other templates should be updated now. Sorry about that! 😄

Thanks! The #rel method isn't available in older versions of Kaminari, but usually people tend to use this repo on a new project, so it should be good.

👍


stub methods for globals and other globals might clash

The minifier seems to put stub methods for globals and globals into different namespaces. However, they are on the same object.
(I'm in the process of adding a test).
/cc @herhut-ggl

I have written a work-around for me, but I'm sure it is not 100% correct. It might serve as a starting point for a real fix, though.
https://codereview.chromium.org/1244103002

Turns out that the full emitter doesn't use the name of the parameter-stub and is thus safe.
I have changed the other emitter to do the same.
The given name is, however, not good (since it wouldn't work when used). I will see if I can just null the name.

I created a CL that sets the name to null for parameter stubs of static functions:
https://codereview.chromium.org/1252543002


Handle unused control arguments(index, bool) in replace

Replace should unify the subprocedure with unused control arguments.
Currently, it does not handle unused buffer arguments (what does it even
mean when the buffer argument was tensor or window) ?

Don't bother force pushing, because we're going to squash the commits anyway. Having the history around is helpful for review.

This all looks fine.  The code before this change was definitely buggy/inconsistent.


Update Release guide with new github release guidance.

Update Guidance to incorporate the Github Release into the validation process.

The main change is that once the RC is ready, we publish the pre-release page (no longer draft, not yet latest).
Includes linking to the Github Release page from the Vote email template.
This allows review of the Github Release description during validation and vote, and public access to the pre-release assets.
Update contributor one-liner to produce comma separated names instead of newline separated names. This avoids the list of names dominating the blog post content.
Emphasizes updating the GitHub release with the final release tag, not simply leaving it as the RC forever.

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

[ ] Mention the appropriate issue in your description (for example: addresses #123), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment fixes #<ISSUE NUMBER> instead.
[ ] Update CHANGES.md with noteworthy changes.
[ ] If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.
To check the build health, please visit https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md
GitHub Actions Tests Status (on master branch)

See CI.md for more information about GitHub Actions CI or the workflows README to see a list of phrases to trigger workflows.

R: @Abacn
This formalizes the small changes I did for the 2.59.0 release, which worked well.


Remove markdown with meta tags

⚠⚠⚠ Since we do not accept all types of pull requests and do not want to waste your time. Please be sure that you have read pull request rules:
https://github.com/louislam/uptime-kuma/blob/master/CONTRIBUTING.md#can-i-create-a-pull-request-for-uptime-kuma
Tick the checkbox if you understand [x]:

[x] I have read and understand the pull request rules.

Description
Fixes https://github.com/louislam/uptime-kuma/issues/4739
If you use markdown for the “description” on the status page, the md will also appear in meta=desc.
Type of change

Please delete any options that are not relevant.

Bug fix (non-breaking change which fixes an issue)

Checklist

[x] My code follows the style guidelines of this project
[x] I ran ESLint and other linters for modified files
[x] I have performed a self-review of my own code and tested it
[x] I have commented my code, particularly in hard-to-understand areas (including JSDoc for methods)
[x] My changes generates no new warnings
[x] My code needed automated testing. I have added them (this is optional task)

Screenshots (if any)
Please do not use any external image service. Instead, just paste in or drag and drop the image here, and it will be uploaded automatically.

@CommanderStorm
We are truly sorry. We do not know what test cases are being run internally, but CodeQL pointed out a security risk and we have reverted the code.

(the codeql check is a false positive)


Make sure the reinstate deferrals respects the transaction

Context
A candidate has been sent a reinstated_offer email for a course they deferred on. However the date should have been a year later.
Changes proposed in this pull request
Before this change the code was sending the email BEFORE the transaction were committed to the DB, which made the old course option object to be used in the mail content. Moving out of the transaction make the mailer to respect the commit transaction first
Guidance to review

Does it send the right email content when confirming a deferral (for a pending conditions application!) in the review app?

Link to Trello card
https://trello.com/c/QJnWSXaJ/1008-investigate-incorrect-start-date-for-the-deferred-course-email

 Investigate incorrect start date for the deferred course email


[Test Example] Contribute rail-viperx dataset

Dataset is hosted here: https://huggingface.co/datasets/youliangtan/rlds_test_viperx_ds

Auto generated stats with state action plots and videos ☝


value of input field does not change when back button is pressed

The problem is that when i'm pressing back button in chrome the value of input field is changed in inspector but the value is not changed in browser window. This does not happen in edge i dont know why.
here you can see that the value in inspector and browser are different.

here is the code. I checked in this project too but this project too have this problem.

sir please reply. If the problem is not clear you can comment i will then try to upload a video link to explain the problem.

below is the link to the video on youtube you can see that the program is working fine in edge but not in chrome and opera.
video - https://youtu.be/zRPRMa4f_hk
project file - https://drive.google.com/file/d/13Q7gxc-fvzkvftk769Qy51u60_Pxd4IU/view?usp=sharing

ok it was not a problem with code. In case you face the same issue add autocomplete = "off" to form element.


No autocomplete for roles

Sanity check

[X] I certify that the redhat.ansible extension is in use and the language of the document in this bug report shows up as Ansible

Summary
When I'm trying to import role at the play level (according to documentation https://docs.ansible.com/ansible/latest/user_guide/playbooks_reuse_roles.html#using-roles-at-the-play-level), there is no autocomplete available, see screenshots:

while the roles are present in roles/ directory near the playbook.
(second screenshot demonstrates strings suggestion window which is shown when no LSP-specific suggestions available)
Extension version
0.13.59
VS Code version
1.70.2
Ansible Version
ansible [core 2.13.3]
  config file = /home/igormahov/dev/ansible/miem/collection/ansible.cfg
  configured module search path = ['/home/igormahov/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.10/site-packages/ansible
  ansible collection location = /home/igormahov/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.10.6 (main, Aug  3 2022, 17:39:45) [GCC 12.1.1 20220730]
  jinja version = 3.1.2
  libyaml = True

OS / Environment
Arch Linux
Relevant log output
No response

Adding to this, autocomplete for role is great, autocomplete for role arguments as made available by argument_specs.yml would be awesome!

any updates?


Bug: 100 lambdas causes an IntendationError

Describe the bug
This will never happen in real code but it's funny
Example program
λλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλλ

Try it
Expected Output
0, I think? That's what 99 of them does anyways
Other things

I don't know enough about Vyxal to answer any of the questions it's asking here (flags, forced evaluation, etc). I was just messing around.

WHAT

you cannot escape

I don't think there's an easy fix to this :p

There's always going to be some form of this issue, as it's a skill issue on python's end. The only fix would be switching away from transpilation, which is basically version 3.


Bug: stdButton ButtonClicked-Event giving an error (and close doesn't close)

Using:
wxUiEditor 1.2.9 on Debian12
Python 3.11.2
wxPython Version: 4.2.2
Description:

When using stdBtn on a wxDialog, I want to use "Close" and "Ok" buttons. Ok works, but "Close" doesn't work. When I add a custom Event method under Events -> CloseButtonClicked e.g. "on_close_btn" it will generate wrong code.
Steps to reproduce:

Create a new project
add a wxFrame with Standard Buttons
Click on "stdBtn" Properties, uncheck "Cancel" and check "Close"
go to Events and add "on_close_btn" to CloseButtonClicked
Click on Python-Tab to check code
see self.Bind(wx.EVT_BUTTON, self.on_close_btn, wx.ID_CLOSE)
will generate a runtime error:
File "/dlgbase.py", line 82, in init
self.stdBtn_Close.Bind(wx.EVT_BUTTON, self.on_close_btn, wx.ID_CLOSE)
File ".../myenv/lib/python3.11/site-packages/wx/core.py", line 1480, in _EvtHandler_Bind
assert source is None or hasattr(source, 'GetId')
^^^^^^^^^^^^^^

Quickfix:
instead of using parameter "wx.ID_CLOSE" it should use the button "self.stdBtn_Close" so the line will be:
self.Bind(wx.EVT_BUTTON, self.on_close_btn, self.stdBtn_Close)
I'm not an export on wx or python but this is how it works for me.
Of course it would also be great if a "close" button already closes the Dialog without additional steps. It is already registered as Cancel button by "self.stdBtn.SetCancelButton(self.stdBtn_Close)" but this could also be a wx issue...

Python
If the window isn't known, then the correct form of the bind call would be:
self.Bind(wx.EVT_BUTTON, self.on_close_button, id=wx.ID_CLOSE)

that infers a source=None
In this case, since the button window is known, it should indeed be used instead of the id, which allows the id to be used elsewhere with a different event handler.
Ruby
We already create a local _ok_btn so it would make sense to create a local button for any other button that needs an event handler. That would allow us to call evt_button directly instead of Bind().
It might also make sense to use the same naming convention used for Python: _std_btn_close instead of _close_btn

I checked, and no, self.stdBtn.SetCancelButton(self.stdBtn_Close) does not automatically call the wxWidgets code to close the dialog in Python. I also tried removing that call entirely, since if the button is not set in C++ then the default functionality is called, but wxPython insists I set the CancelButton or it won't show up at all.
In the incoming PR that fixes this, if you haven't added the event handler yet, it will show up in the commented event handlers with the necessary call to close the dialog. That makes copying/pasting the event a bit easier...


arch-riscv: Add senvcfg CSR

This commit adds the senvcfg control status register, which fixes the 6.11.3 kernel crash documented in issue 1674. I have not added a bitfield and its implementation in isa.cc only uses setMiscRegNoEffect, so this implementation is missing some components.

Specific things that should change before merging:

We should only support writing FIOM, not the other bitfileds. If the other bitfileds (i.e., the bitfields that the manual says "will be furnished by the forthcoming extension...") are written we should panic with an appropriate error so we can fix it later.
This should probably not be a setMiscRegNoEffect but we should use the normal setMiscReg function (I believe).
We should make sure to raise an illegal instruction exception if the bits marked WPRI are modified. I think it's an illegal instruction, but you'll have to look at the other implementations to see.

I don't believe we need to change the implementation of atomics or fence instructions because I believe they already have the same ordering for memory and I/O space implied. I.e., gem5 takes an conservative approach. However, we might need to read the senvcfg in the fence and atomic instruction implementations. I think that we can skip that for now, but it is a true dependence that may need to be enforced.
Thanks for picking this up Erin, and great job getting started on it! Everything that I said above you couldn't figure out without a lot more background on RISC-V and gem5's implementation. Again, great job!

@rogerchang23424 Feedback on this would be greatly appreciated!

@powerjg: I implemented the bitfields according to the RISCV spec and added panics/warnings based on what you said above, but it looks like the instruction that accesses senvcfg tries to write to the CBZE bitfield, which causes a panic. How should I proceed?

it looks like the instruction that accesses senvcfg tries to write to the CBZE bitfield

Then the panic worked as expected! Let's figure out how to implement that :)
Here's the definition: https://github.com/riscv/riscv-CMOs/blob/8e8a8e01e1e2761579eaaa0f1c0f0c1efac9eddb/cmobase/csr_state.adoc#L51


why relu is missing after quantize_static?

Hi,
I found out that relu is missing after quantize_static.

this graph is the beginning part of resnet50,  it has relu after add operator. why is missing? did you fuse add and relu  together?

yes, it is fused into the re-quant logic.


Fix firstOnly in branched resultset

Fixes #742

Good catch, I am able to see the problem with your example gist in #742 and that does seem to be a bug you have fixed.
Would you be able to add a simple unit test to ensure this doesn't break in the future?
Thanks

I added the example gist as tests. not sure if dynamicview.spec is the correct file -- if not please advise where best to move them.

Great! Thank you.


Waves cause  with CSS clip-path to disappear/change size

Expected Behavior
When using a <div> with a CSS clip-path and the waves effect (see this CodePen on Chrome), clicking more than once on the <div> will cause the waves effect to be applied however many times the button was clicked.
Current Behavior
When using a <div> with a CSS clip-path and the waves effect (see this CodePen on Chrome), clicking more than once on the <div> will cause it to resize or disappear, depending on the window and element size.
Possible Solution
Turning off the overflow seems to stop the divs from resizing - but of course, that comes with its own problems.
Steps to Reproduce (for bugs)
With Chrome:
See this CodePen
Your Environment

Chrome (macOS, Android In-App WebView, and Windows-tested bug)

^


Autocomplete for topic to send to

We should offer autocompletion in the topic input of the compose box. (When that topic input exists, i.e. for interleaved narrows.)
This is a step on the way to:

#149

and an element we'll almost surely want in any UX solution we choose there.
Not to be confused with autocomplete for mentioning a topic inside the content of a message:

#124

I've reviewed this task, and I believe it's one step up compared to my previous contributions. I am confident I can tackle it effectively.
To address this, I propose the following steps:

Implementing a new API call to retrieve data from https://chat.zulip.org/json/users/me/:stream_id/topics
Modifying the widget structure to incorporate autocomplete functionality, similar to the message compose input
Developing a view model and a controller similar to those used for the compose input

I am keen to take on this task and intend to start by creating an initial prototype before requesting formal assignment.

@Khader-1 Sounds good! Please go ahead.

This data structure is likely a thing that will end up being used for other things. stream_topic_history.ts in the Zulip web app may be a useful reference. There are some messy/subtle problems with how it tries to live-update, detailed in https://github.com/zulip/zulip/pull/29015, so a lot of the current complexity is wrong. But specifically the logic in stream_topic_history_util.ts might be a helpful reference for how the web app does fetch-on-demand these data, and caches it.
(It can take like 0.5s to get a response in a stream with thousands of topics).

Thanks Tim!
For a solution for this issue, I think I'd be happy with a version where the list of topics for a given stream is only cached for the lifetime of a given autocomplete interaction — that is, for the lifetime of a given topic input field.
In particular that avoids most of the complexity of maintaining the data structure, because it's OK if it doesn't stay accurately in sync in subtle edge cases (and really it's 95% OK if it doesn't get updated at all), because not many changes will happen during its lifetime.
The main cost is that 0.5s lag to get the list of topics. But we'd have that anyway the first time a user goes to compose in a given stream, so I'm not sure there's a huge difference between that and every time.
Hmm, though I guess one benefit of keeping it around longer is that we could be more eager about fetching it — like when you view a given stream narrow, rather than when you start composing. Then you might rarely actually see the 0.5s latency.

In any case: for when we do tackle this data structure (as part of this issue or later), see also RecentDmConversationsView. That's our efficient data structure for maintaining the list of your recent DM conversations; I think one wants basically the same data structure for that as for topics in a stream. (The event handling will be a bit different, though, and the event handling we have already for DMs is likely incomplete anyway.)
So I'd want to factor that out into a somewhat more generic list-of-recent-conversations data structure, with RecentDmConversationsView as a wrapper around that, and then add the recent-topics-per-stream data structure as another such wrapper.


feat(allocator): introduce FromIn and IntoIn traits.

#3890
#4088  👈
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @rzvxa and the rest of your teammates on  Graphite