EMB-150 GuardDuty findings not being published to CloudWatch Logs

https://dsdmoj.atlassian.net/browse/EMB-150

Terraform will perform the following actions:

  # module.baseline_guardduty.aws_cloudwatch_event_rule.this will be updated in-place
  ~ resource "aws_cloudwatch_event_rule" "this" {
        id             = "hmpps-sn-np-guardduty-event-rule"
        name           = "hmpps-sn-np-guardduty-event-rule"
      - role_arn       = "arn:aws:iam::437261969723:role/hmpps-sn-np-guardduty-role" -> null
        tags           = {
            "application"            = "electronic monitoring service"
            "business-unit"          = "HMPPS"
            "component"              = "Shared Networking"
            "em-sub-service"         = "hmpps"
            "environment-name"       = "hmpps-sn-np"
            "infrastructure-support" =<EMAIL_ADDRESS>            "is-production"          = "false"
            "owner"                  = "electronic monitoring programme<EMAIL_ADDRESS>            "source-code"            = "https://github.com/ministryofjustice/hmpps-electronic-monitoring-service-platform"
        }
        # (4 unchanged attributes hidden)
    }

  # module.baseline_guardduty.aws_cloudwatch_log_resource_policy.this will be created
  + resource "aws_cloudwatch_log_resource_policy" "this" {
      + id              = (known after apply)
      + policy_document = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "logs:PutLogEvents",
                          + "logs:CreateLogStream",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = [
                              + "events.amazonaws.com",
                              + "delivery.logs.amazonaws.com",
                            ]
                        }
                      + Resource  = "arn:aws:logs:eu-west-2:437261969723:log-group:/aws/events/hmpps-sn-np-guardduty-log-group:*"
                      + Sid       = "TrustEventsToStoreLogEvents"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_name     = "hmpps-sn-np-guardduty-log-group-resource-policy"
    }

  # module.baseline_guardduty.aws_iam_policy.cloudwatch will be destroyed
  - resource "aws_iam_policy" "cloudwatch" {
      - arn    = "arn:aws:iam::437261969723:policy/hmpps-sn-np-guardduty-policy" -> null
      - id     = "arn:aws:iam::437261969723:policy/hmpps-sn-np-guardduty-policy" -> null
      - name   = "hmpps-sn-np-guardduty-policy" -> null
      - path   = "/" -> null
      - policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = "logs:*"
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = "AWSEvents"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
    }

  # module.baseline_guardduty.aws_iam_role.cloudwatch will be destroyed
  - resource "aws_iam_role" "cloudwatch" {
      - arn                   = "arn:aws:iam::437261969723:role/hmpps-sn-np-guardduty-role" -> null
      - assume_role_policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "sts:AssumeRole"
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "events.amazonaws.com"
                        }
                      - Sid       = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - create_date           = "2020-10-15T08:23:45Z" -> null
      - force_detach_policies = false -> null
      - id                    = "hmpps-sn-np-guardduty-role" -> null
      - max_session_duration  = 3600 -> null
      - name                  = "hmpps-sn-np-guardduty-role" -> null
      - path                  = "/" -> null
      - tags                  = {
          - "application"            = "electronic monitoring service"
          - "business-unit"          = "HMPPS"
          - "component"              = "Shared Networking"
          - "em-sub-service"         = "hmpps"
          - "environment-name"       = "hmpps-sn-np"
          - "infrastructure-support" =<EMAIL_ADDRESS>          - "is-production"          = "false"
          - "owner"                  = "electronic monitoring programme<EMAIL_ADDRESS>          - "source-code"            = "https://github.com/ministryofjustice/hmpps-electronic-monitoring-service-platform"
        } -> null
      - unique_id             = "AROAWLTWYFE5RYZ3EVKBL" -> null
    }

  # module.baseline_guardduty.aws_iam_role_policy_attachment.cloudwatch will be destroyed
  - resource "aws_iam_role_policy_attachment" "cloudwatch" {
      - id         = "hmpps-sn-np-guardduty-role-20201015082345706400000001" -> null
      - policy_arn = "arn:aws:iam::437261969723:policy/hmpps-sn-np-guardduty-policy" -> null
      - role       = "hmpps-sn-np-guardduty-role" -> null
    }

Plan: 1 to add, 1 to change, 3 to destroy.

Terraform will perform the following actions:

  # module.baseline_guardduty.aws_cloudwatch_event_rule.this will be updated in-place
  ~ resource "aws_cloudwatch_event_rule" "this" {
        id             = "hmpps-sn-np-guardduty-event-rule"
        name           = "hmpps-sn-np-guardduty-event-rule"
      - role_arn       = "arn:aws:iam::437261969723:role/hmpps-sn-np-guardduty-role" -> null
        tags           = {
            "application"            = "electronic monitoring service"
            "business-unit"          = "HMPPS"
            "component"              = "Shared Networking"
            "em-sub-service"         = "hmpps"
            "environment-name"       = "hmpps-sn-np"
            "infrastructure-support" =<EMAIL_ADDRESS>            "is-production"          = "false"
            "owner"                  = "electronic monitoring programme<EMAIL_ADDRESS>            "source-code"            = "https://github.com/ministryofjustice/hmpps-electronic-monitoring-service-platform"
        }
        # (4 unchanged attributes hidden)
    }

  # module.baseline_guardduty.aws_cloudwatch_log_resource_policy.this will be created
  + resource "aws_cloudwatch_log_resource_policy" "this" {
      + id              = (known after apply)
      + policy_document = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "logs:PutLogEvents",
                          + "logs:CreateLogStream",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = [
                              + "events.amazonaws.com",
                              + "delivery.logs.amazonaws.com",
                            ]
                        }
                      + Resource  = "arn:aws:logs:eu-west-2:437261969723:log-group:/aws/events/hmpps-sn-np-guardduty-log-group:*"
                      + Sid       = "TrustEventsToStoreLogEvents"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_name     = "hmpps-sn-np-guardduty-log-group-resource-policy"
    }

  # module.baseline_guardduty.aws_iam_policy.cloudwatch will be destroyed
  - resource "aws_iam_policy" "cloudwatch" {
      - arn    = "arn:aws:iam::437261969723:policy/hmpps-sn-np-guardduty-policy" -> null
      - id     = "arn:aws:iam::437261969723:policy/hmpps-sn-np-guardduty-policy" -> null
      - name   = "hmpps-sn-np-guardduty-policy" -> null
      - path   = "/" -> null
      - policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = "logs:*"
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = "AWSEvents"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
    }

  # module.baseline_guardduty.aws_iam_role.cloudwatch will be destroyed
  - resource "aws_iam_role" "cloudwatch" {
      - arn                   = "arn:aws:iam::437261969723:role/hmpps-sn-np-guardduty-role" -> null
      - assume_role_policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "sts:AssumeRole"
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "events.amazonaws.com"
                        }
                      - Sid       = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - create_date           = "2020-10-15T08:23:45Z" -> null
      - force_detach_policies = false -> null
      - id                    = "hmpps-sn-np-guardduty-role" -> null
      - max_session_duration  = 3600 -> null
      - name                  = "hmpps-sn-np-guardduty-role" -> null
      - path                  = "/" -> null
      - tags                  = {
          - "application"            = "electronic monitoring service"
          - "business-unit"          = "HMPPS"
          - "component"              = "Shared Networking"
          - "em-sub-service"         = "hmpps"
          - "environment-name"       = "hmpps-sn-np"
          - "infrastructure-support" =<EMAIL_ADDRESS>          - "is-production"          = "false"
          - "owner"                  = "electronic monitoring programme<EMAIL_ADDRESS>          - "source-code"            = "https://github.com/ministryofjustice/hmpps-electronic-monitoring-service-platform"
        } -> null
      - unique_id             = "AROAWLTWYFE5RYZ3EVKBL" -> null
    }

  # module.baseline_guardduty.aws_iam_role_policy_attachment.cloudwatch will be destroyed
  - resource "aws_iam_role_policy_attachment" "cloudwatch" {
      - id         = "hmpps-sn-np-guardduty-role-20201015082345706400000001" -> null
      - policy_arn = "arn:aws:iam::437261969723:policy/hmpps-sn-np-guardduty-policy" -> null
      - role       = "hmpps-sn-np-guardduty-role" -> null
    }

Plan: 1 to add, 1 to change, 3 to destroy.

Sample GuardDuty findings are now appearing in CloudWatch Logs and HMPPS' Shared Logging S3

Sample GuardDuty findings are now appearing in CloudWatch Logs and HMPPS' Shared Logging S3


Won't Load Custom Characters

I have been trying to add a custom character for almost 5 hours now and it always crashes on the character creator thing. I have my custom character and .XML file in the right place. Why does it always crash when I type in the file directory? I also tried putting it in mods and it still crashed even then.
I cannot make a character .json file because of this bug.
It does this even when I just use the .PNG file so I don't know what the problem is. Please Help Me.

Seems to be an issue on your .xml file.


:chart_with_upwards_trend:

Adds a fork of hubot-newrelic2, for new relic goodness

A+ emoji skills. 👍


could not connect to daemon running in embedded mode

i have a Polaris 20 XL [Radeon RX 580 2048SP] and i have installed lact-0.5.0-0.amd64.debian-12.deb on bookworm [fully updated]. lact keeps telling me it can't connect to the daemon. but 'systemctl status lactd' says the following:
root@x99-debian:~# systemctl status lactd
● lactd.service - AMDGPU Control Daemon
     Loaded: loaded (/lib/systemd/system/lactd.service; enabled; preset: enabled)
     Active: active (running) since Fri 2023-11-24 11:23:54 CST; 5h 27min ago
   Main PID: 3658 (lact)
      Tasks: 1 (limit: 154352)
     Memory: 9.4M
        CPU: 55ms
     CGroup: /system.slice/lactd.service
             └─3658 lact daemon

Nov 24 11:23:54 x99-debian systemd[1]: Started lactd.service - AMDGPU Control Daemon.
Nov 24 11:23:54 x99-debian lact[3658]: 2023-11-24T17:23:54.750847Z  INFO lact_daemon::socket: listening on "/var/run/lactd.sock"
Nov 24 11:23:54 x99-debian lact[3658]: 2023-11-24T17:23:54.780546Z  INFO lact_daemon::server::handler: initialized 1 GPUs
root@x99-debian:~#

i have verified that there is a /var/run/lactd.sock so what can i do to get lact to connect to lactd so it does not run in embedded mode?

Can you run lact from the terminal to see what the exact reason that it can't connect to the daemon is? It could be a permissions issue.

running lact from the terminal shows the following:
jim@x99-debian:~$ lact
2023-11-25T12:29:04.260507Z  INFO lact_client: connecting to service at "/var/run/lactd.sock"
2023-11-25T12:29:04.260589Z  INFO lact_gui: could not connect to socket: Could not connect to daemon
2023-11-25T12:29:04.260598Z  INFO lact_gui: using a local daemon
2023-11-25T12:29:04.298492Z  INFO lact_daemon::server::handler: initialized 1 GPUs
amdgpu: amdgpu_bo_cpu_map failed. (-13)
radeonsi: can't create radeon_winsys_ctx
radeonsi: Failed to create a context.
amdgpu: amdgpu_bo_cpu_map failed. (-13)
radeonsi: can't create radeon_winsys_ctx
radeonsi: Failed to create a context.
amdgpu: amdgpu_bo_cpu_map failed. (-13)
radeonsi: can't create radeon_winsys_ctx
radeonsi: Failed to create a context.
amdgpu: amdgpu_bo_cpu_map failed. (-13)
radeonsi: can't create radeon_winsys_ctx
radeonsi: Failed to create a context.
Gsk-Message: 06:29:04.500: Failed to realize renderer of type 'GskGLRenderer' for surface 'GdkWaylandToplevel': Unable to create a GL context

Gsk-Message: 06:29:04.504: Failed to realize renderer of type 'GskGLRenderer' for surface 'GdkWaylandToplevel': Unable to create a GL context

jim@x99-debian:~$

Try editing /etc/lact/config.yaml and adding your username at the start of admin_groups. After that restart the daemon.
If it doesn't help, then please update to the test version and show what the error is like after the update

ah thank you! that has got it working. very nice piece of software. thanks again!


specify partition for one consumer in a group can not rebalance the others

I have a topic with 150 partitions [0 - 149]
And I have three consumers joinning the same group.
By default, each consumer is assigned with their own ranges.

Consumer A : [0-49]
Consumer B : [50-99]
Consumer C : [100-149]

I want consumer B only consumes a specific partition. Hence within its SetPartitionsRevokedHandler,  only a specific one is returned.
IEnumerable<TopicPartitionOffset> OnPartitionsAssigned(IConsumer<MessageKey, byte[]> consumer, List<TopicPartition> partitions)
 {
            return new TopicPartitionOffset[]
            {
                new TopicPartitionOffset(  new TopicPartition(_topic, 0), Offset.Unset),
            };
}

I expect consumer A and C would be assigned with partition [1 - 149]
I tested but it does not work in that way.   Consumer A & C are not rebalanced and they are still assigned with 50 partitions each.

Consumer A : [0-49]
Consumer C : [100-149]

Is this a bug of client?
Confluent.Kafka nuget version : 1.2.1

Apache Kafka version : 0.10
Client configuration :  EnableAutoCommit : false; AutoOffsetReset : Earliest

this is operating as intended - the partitions you assign a client to read from are independent of the assignment given to you by the consumer group. the main use case (which is uncommon) of reading from a different set of partitions than that assigned is adding an additional 'control' partition to the set assigned to you by the CG. note that the java client doesn't let you specify the two independently.
you could achieve what you want with a custom partition assignment strategy, but that's currently not supported by the non-java clients.
finally, this request is unusual - feel free to give some more color so we can understand the reasoning behind the design.

Thanks @mhowlett
Our producer sends business data to Kafka.  For business reason, the order of the message is important. Hence the producer sends messages to specific partition.
e.g. Same client's messages are put into the same partition.
As a result,  the number of messages are not distributed well.  Some partition's size is 10x-100x of others.  Hence we want to use a dedicate consumer handling that particular partition.
Manual assignment would work in this case but hard to manage (especially considering one consumer is down)

When dedicated consumer watchs on a specific partition;  Other consumers consume other partitions.
When dedicated consumer is down,  other consumers consume all partitions.

you could achieve what you want with a custom partition assignment strategy, but that's currently not supported by the non-java clients

I was just looking into whether or not we can use custom ConsumerPartitionAssignors, sounds like we can't?
Is this something that could be added to the C# library? Or, is there something more fundamentally different with the Java client that allows this? Depending on the answer/complexity, I'd be willing to take a stab at the changes, if needed.

custom partition assignors should be fairly straightforward to add. for a long time. the blocker in adding them was working out what the api should look like, but post 1.0, that is now clear. we're likely to add this feature in the near future. closing as we're tracking this internally.

+1 for custom partition assignors feature, I need that for kafka stream .net implementation. Image you have a joiner processor between KStream(topic1) and one KTable(topic2). Your stream application is scalable, so you must have the same subscription partition in one instance of your application. Without custom partition assignors, it's very complicated to that, or maybe assign partition manually but more complicated.

+1 for custom partition assignors feature, I need that for kafka stream .net implementation. Image you have a joiner processor between KStream(topic1) and one KTable(topic2). Your stream application is scalable, so you must have the same subscription partition in one instance of your application. Without custom partition assignors, it's very complicated to that, or maybe assign partition manually but more complicated.

@LGouellec - I've had a PR open for a few months at https://github.com/confluentinc/confluent-kafka-dotnet/pull/1133 with this.
If you're blocked, that might help you out until some official API comes into the picture.

+1 for custom partition assignors feature, I need that for kafka stream .net implementation. Image you have a joiner processor between KStream(topic1) and one KTable(topic2). Your stream application is scalable, so you must have the same subscription partition in one instance of your application. Without custom partition assignors, it's very complicated to that, or maybe assign partition manually but more complicated.

@LGouellec - I've had a PR open for a few months at #1133 with this.
If you're blocked, that might help you out until some official API comes into the picture.

I can't see where I can set my custom partition assignor in your PR.
I see your SetPartitioner(...) in ProducerBuilder, but my need is setting : Custom Partition Assignor (like JAVA Api) because with .net library, you just have both choice for partition assignor strategy (range ou roundrobin)

+1 for custom partition assignors feature, I need that for kafka stream .net implementation. Image you have a joiner processor between KStream(topic1) and one KTable(topic2). Your stream application is scalable, so you must have the same subscription partition in one instance of your application. Without custom partition assignors, it's very complicated to that, or maybe assign partition manually but more complicated.

@LGouellec - I've had a PR open for a few months at #1133 with this.
If you're blocked, that might help you out until some official API comes into the picture.

@ChadJessup I can't see where I can set my custom partition assignor in your PR.
I see your SetPartitioner(...) in ProducerBuilder, but my need is setting : Custom Partition Assignor (like JAVA Api) because with .net library, you just have both choice for partition assignor strategy (range ou roundrobin)

@LGouellec - you're right, sorry - I got confused on partitioners and assignors. I'm taking a look at adding assignors here real soon as a PR, but it'll probably wait on feedback on whatever happens with #1297


TextInput unexpectedly captitalized

Current Behavior
All TextInput fields are capitalized even though autoCapitalize is not set, or is set to "none"
Expected Behavior
The text in the input is not captitalized in this way.
Tamagui Version
1.29.1

Reproduction
- Create an app with `npm create tamagui@latest`
- Create a simple TextInput
- There it is

System Info
System:
    OS: macOS 13.3.1
    CPU: (8) arm64 Apple M1
    Memory: 1.51 GB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 18.15.0 - ~/.nodenv/versions/18.15.0/bin/node
    Yarn: 1.22.19 - ~/.nodenv/versions/18.15.0/bin/yarn
    npm: 9.6.7 - ~/.nodenv/versions/18.15.0/bin/npm
  Browsers:
    Chrome: 113.0.5672.126
    Firefox: 113.0.1
    Safari: 16.4

Images:

(Yes, even the placeholder is capitalized).

Ah this is due to the order of definition in the fonts.
If you set defaultFont: 'body' in your createTamagui it will fix this for now, I'm cutting a release in a minute that adds backwards compat for this to fix it automatically.

Add defaultFont and change the order of fonts like this:

Release going out now with a fix so you don't have to do this as well.


[WFLY-15826] Unable to deploy WAR with only real in login-config

Add unit test
Swap the order of the equals expression so it avoids the NPE
Remove throws declaration in private method so as to build

Thanks for submitting your Pull Request!
https://issues.redhat.com/browse/WFLY-15826

Hello, whittlec. I'm waiting for one of the admins to verify this patch with /ok-to-test in a comment.

@whittlec Thanks for adding that! If you could also squash your commits into one and include "[WFLY-15826]" in your commit message, that would be great (e.g., see the commit message format here).

@fjuma I have just triggered CI, I think we are ready for a final review.

Thanks, @whittlec!
I believe this is your first WildFly PR. Before we merge the first one we have a question:
We require that all contributions be made under the terms of the MIT License, http://www.opensource.org/licenses/mit-license.php. Do you agree to the these terms?

Yes, I'm quite happy to agree to the MIT license terms.

Thanks @whittlec!


VS Code still not launching when offline / no internet connection

There were a lot of issues related to VS Code not launching when offline / no internet connection, but all are closed. Only #7570 is opened, but you cannot comment to it. But it's not resolved, this issue still exist in the latest version and also in the insiders version. The output on code --verbose is the same many people mentioned earlier. So I reopen this issue, because it's still an issue also the original issue #7570 is already more than 2 years old.

VSCode Version: 1.28.2 / 1.29-insider
OS Version: Windows 10 1809
Node.js Version: 10.9.0

Steps to Reproduce:

Use airplane / offline mode
Try to start VS Code
VS Code is not launching (error code see below)

Does this issue occur when all extensions are disabled?: Yes
AppData\Local\Programs\Microsoft VS Code Insiders> code --verbose
dns.js:246
    this._handle = new ChannelWrap();
                   ^

Error: EFILE
    at new Resolver (dns.js:246:20)
    at dns.js:377:25
    at dns.js:431:3
    at NativeModule.compile (bootstrap_node.js:606:7)
    at NativeModule.require (bootstrap_node.js:550:18)
    at net.js:45:13
    at net.js:1730:3
    at NativeModule.compile (bootstrap_node.js:606:7)
    at NativeModule.require (bootstrap_node.js:550:18)
    at internal/child_process.js:6:13

Should fixed with electron-3.0.x but it seems not to be integrated into VS Code Insiders yet, so we have to wait how it seems


PowerShell ignores integer status codes in response JSON

If i have a function that tries to set the status code via an integer value it'll be ignored and always get 200.
Example
{
    "Status":  404,
    "Headers":  {
                    "content-type":  "application/json"
                },
    "Body":  {
                 "Hello":  "World"
             }
}

the above will ignore the set code and return everything ok to caller

whilst below when status code is declared as string
{
    "Status":  "404",
    "Headers":  {
                    "content-type":  "application/json"
                },
    "Body":  {
                 "Hello":  "World"
             }
}

will use the code and return file not found to caller

This feelt a bit inconsistent as i.e. node examples have response like this
{ status: 202, body: 'You successfully ordered more coffee!' }

PowerShell conversion of above in my head would be something like this
$result = [PSCustomObject][Ordered]@{
    'Status'    = 202
    'Body'      = 'You successfully ordered more coffee!'
} | ConvertTo-Json -Depth 5

$result | Out-File -FilePath $response -Encoding utf8

which will output
{
    "Status":  202,
    "Body":  "You successfully ordered more coffee!"
}

Checking around in the repo code it looks like intention at least in some places is expected to be either an string or int
               object statusValue;
                if ((responseObject.TryGetValue("statusCode", out statusValue, ignoreCase: true) ||
                     responseObject.TryGetValue("status", out statusValue, ignoreCase: true)) &&
                     (statusValue is int || statusValue is string))
                {
                    statusCode = (HttpStatusCode)Convert.ToInt32(statusValue);
                }

( Copy & pasted from https://github.com/Azure/azure-webjobs-sdk-script/blob/807f2390d701c273024e21ab47fef9fc3d59fe8d/src/WebJobs.Script/Binding/HttpBinding.cs#L124-L128)
Debugging the code it the actual value is actually an long

I'll submit an PR for this shortly.
Example functions:

String status code - run.ps1
Integer status code - run.ps1

PR #1136  submitted.


Native Payments SDK implementation

I implemented Klarna Native Payments SDK for flutter, there might be lacks or code style inconsistencies in implementation, I'm up for providing fixes to this PR if you give some feedbacks!
You can test the application using example application I provided under examples/payments folder.
Types of changes
What types of changes does your code introduce? Put an x in all the boxes that apply:

[ ] Bug fix (non-breaking change which fixes an issue)
[x] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist
Go over all the following points, and put an x in all the boxes that apply. If you're unsure about any of these, don't hesitate to ask.

[x] My code follows the code style of this project.
[x] My change requires a change to the documentation.
[x] I have updated the documentation accordingly.

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.

@NMGuner Should have some eyes on this to add the extra support the Klarna plugin needs to be on par with the native solution.

If I want to test this how can I do it? I tried using this PR but its using pretty old things i.e
saw flutter test and mockito dependency issue and its using android embedding v1 which is deprecated.
I tried running the payments example

getting this error in your payments example even if I use a working client token

I implemented Klarna Native Payments SDK for flutter, there might be lacks or code style inconsistencies in implementation, I'm up for providing fixes to this PR if you give some feedbacks!
You can test the application using example application I provided under examples/payments folder.
Types of changes What types of changes does your code introduce? Put an x in all the boxes that apply:

[ ]  Bug fix (non-breaking change which fixes an issue)
[x]  New feature (non-breaking change which adds functionality)
[ ]  Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist Go over all the following points, and put an x in all the boxes that apply. If you're unsure about any of these, don't hesitate to ask.

[x]  My code follows the code style of this project.
[x]  My change requires a change to the documentation.
[x]  I have updated the documentation accordingly.

Can you please guide me as how can I resolve this?


Benchmark build failure

> /tmp/stackage-build10/servant-auth-cookie-<IP_ADDRESS>$ runghc -clear-package-db -global-package-db -package-db=/home/stackage/work/builds/nightly/pkgdb Setup configure --enable-benchmarks --package-db=clear --package-db=global --package-db=/home/stackage/work/builds/nightly/pkgdb --libdir=/home/stackage/work/builds/nightly/lib --bindir=/home/stackage/work/builds/nightly/bin --datadir=/home/stackage/work/builds/nightly/share --libexecdir=/home/stackage/work/builds/nightly/libexec --sysconfdir=/home/stackage/work/builds/nightly/etc --docdir=/home/stackage/work/builds/nightly/doc/servant-auth-cookie-<IP_ADDRESS> --htmldir=/home/stackage/work/builds/nightly/doc/servant-auth-cookie-<IP_ADDRESS> --haddockdir=/home/stackage/work/builds/nightly/doc/servant-auth-cookie-<IP_ADDRESS> --flags=
Configuring servant-auth-cookie-<IP_ADDRESS>...
> /tmp/stackage-build10/servant-auth-cookie-<IP_ADDRESS>$ runghc -clear-package-db -global-package-db -package-db=/home/stackage/work/builds/nightly/pkgdb Setup build
Building servant-auth-cookie-<IP_ADDRESS>...
Preprocessing library servant-auth-cookie-<IP_ADDRESS>...
[1 of 1] Compiling Servant.Server.Experimental.Auth.Cookie ( src/Servant/Server/Experimental/Auth/Cookie.hs, dist/build/Servant/Server/Experimental/Auth/Cookie.o ) [dist/build/autogen/cabal_macros.h changed]
Preprocessing executable 'example' for servant-auth-cookie-<IP_ADDRESS>...
[1 of 1] Compiling Main             ( example/Main.hs, dist/build/example/example-tmp/Main.o ) [dist/build/autogen/cabal_macros.h changed]
Linking dist/build/example/example ...
Preprocessing benchmark 'bench' for servant-auth-cookie-<IP_ADDRESS>...
[1 of 1] Compiling Main             ( benchmarks/Main.hs, dist/build/bench/bench-tmp/Main.o )

benchmarks/Main.hs:3:1: error:
    Failed to load interface for ‘Servant.Server.Experimental.Auth.Cookie.Internal’
    Perhaps you meant
      Servant.Server.Experimental.Auth.Cookie (from servant-auth-cookie-<IP_ADDRESS>)
    Use -v to see a list of the files searched for.

@zohl, Can you fix this or a PR is desirable?

@snoyberg, thank you for the notice!
@mrkkrp, fixed, I'll reupload it to hackage in a hour.

Done.
Just to be a little more certain on my side: if I show no signal up to 23:00 UTC+03:00, feel free to submit PRs. I do monitor the situation, but I'm not pushing commits from my workplace :)


sensors: harden string parsing from BPF events

Initially found this issue by trying to fuzz parts of the handler. You can run the fuzzer with the following command:
go test -fuzz=Fuzz_parseString -run=Fuzz_parseString ./pkg/sensors/tracing/ Also added some unit test cases under Test_parseString.
Previous parsing had flaws that could make Tetragon panic or be OOM killed in certain circumstances. In reality, the string size was already bound by BPF copy_string function to 1024 but it could have theoretically returned a size of -2 as an error code which would have made it panic.
Also remove some code duplication that was rewriting the string parsing instead of using the common function.

I'm happy with this one question though just to be sure I understood this correctly.


Load image from absolute path/url

Trying to display images from URL I found it's currently not supported. I decided to download images to some tmp directory and use an absolute path as an Image src. And that's also not supported right now: https://github.com/revery-ui/revery/blob/aa2051c7c6e562b0b13acd43ff4724e02067097f/src/Draw/ImageRenderer.re#L25
The best option would be to have:
type src = Url(string) | Relative(string) | Absolute(string)

which would allow loading images from /assets, any directory and URL.
I'm willing to help with that feature but I don't know what's the best approach to download image and use it as a texture in ImageRenderer.

Regarding URL I experimented a bit with this yesterday and got a PoC working. May be happy to take a stab at it, depending on what you are seeing!
My "get-something-running" approach was to save the images to a temporary folder, escape the url from any illegal characters and then provide that path to the renderer.
Some questions I had:

Do we delete temporary cached images on application-close?
Where do we store the temporary files? Might be platform-specific

There are probably other approaches which may be more suited, just leaving this here since I at least did some experimenting! 🙂

Maybe let the user decide with Url(string, option(string)) and the second argument if None mean non-cached and Some(cachedPath) mean to save file to cachedPath. And provide cleaning functions:  cleanAll, cleanOneFile.


Bug: Language keeps resetting

What happened?
When setting the software language and closing and re-opening the window, the language seems to be set back to the default value (system) even if it looks that it is differently selected.
Provide the error message / stack trace
No response
What version of Windows are you using?
Windows 11 Business 23H2 22631.4317
What version of the app are you using?
<IP_ADDRESS>

Thanks for reporting, will fix asap.

Version 1.5.3 has now been released and the update is being rolled out. Please note that it may take up to two days for the update to be available in the Microsoft Store. I will leave this issue open until then.

Klasse


boost iostream + zlib errors

A few toolchains are failing for me on travis in a small hunter test project using boost iostream + zlib.  I vaguely recall this being fixed before.  In some cases debug variants have the problem while release builds do not.
Here is some travis output using a recent hunter .travis.yml
https://travis-ci.org/headupinclouds/hunter_sandbox/builds/130479634
I'll see what I can find.

---
Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/34260960-boost-iostream-zlib-errors?utm_campaign=plugin&utm_content=tracker%2F1032790&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1032790&utm_medium=issues&utm_source=github).

I vaguely recall this being fixed before. In some cases debug variants have the problem while release builds do not

We are not testing this case. Need to add example with IOSTREAMS_NO_BZIP2=1 arg.

Okay I've found the problem. We are reading only release "part" of ZLIB:

https://github.com/ruslo/hunter/blob/e4b0df727021fec5da45a21a617903d4145d83ab/cmake/modules/hunter_boost_component_b2_args.cmake#L83

I'm not sure Boost is flexible enough to have different libraries for Debug/Release.
@aadityakalsi you have worked with this stuff, what is your experience?
Though I think it's possible to apply workaround here. Will do.

@ruslo Are you implying that the issue is that a Debug Boost build needs a Debug ZLIB?
I believe we can query whether Boost is being built Debug or Release.
We have to decide whether Boost debug build implies that BZip2 and/or ZLIB are also built the same with build type (here Debug).

@ruslo Are you implying that the issue is that a Debug Boost build needs a Debug ZLIB?

To be accurate the issue is that we need at least something. If HUNTER_CONFIGURATION_TYPES=Debug there will be no Release ZLIB library so get_target_property(zlib_release ZLIB::zlib IMPORTED_LOCATION_RELEASE) will return *-NOTFOUND.

We have to decide whether Boost debug build implies that BZip2 and/or ZLIB are also built the same with build type (here Debug).

For now we can assume that Boost Debug should be linked with ZLIB Debug, Boost Release should be linked with ZLIB Release. Report error if it's not. In future this can be fine tuned for not the exact much but for compatible variant (i.e. use Release with MinSizeRel, it's not implemented in Hunter even for CMake part now).

Okay I've found the problem. We are reading only release "part" of ZLIB:

@ruslo : Thanks for the fix.

@headupinclouds Tests passed, fix merged to develop: https://github.com/ruslo/hunter/pull/418 will wait for https://github.com/ruslo/hunter/pull/414 test to finish and release new version. Boost 1.61.0 has compute library: http://www.boost.org/users/history/version_1_61_0.html

Released: https://github.com/ruslo/hunter/releases/tag/v0.14.22
I've made an update, let's see what'll happen:

https://travis-ci.org/ruslo/hunter_sandbox/builds/131274312

I've made an update, let's see what'll happen

Looks better, but something wrong with Android and only if host is Linux. Will take a look tomorrow.

Magic. With the exception of names of hosts and SHA1 of cache binaries build log for OSX and Linux are identical line to line but ends differently.
Linux fail (Boost can't find ZLIB):
Building the Boost C++ Libraries.

    - zlib                     : no
    - symlinks supported       : yes
    - zlib                     : no  (cached)

OSX pass (Boost can find ZLIB):
Building the Boost C++ Libraries.

    - zlib                     : yes
    - symlinks supported       : yes
    - zlib                     : yes (cached)

Boost configuration:
-- [hunter *** DEBUG *** ${TIME}] Build options:
-- [hunter *** DEBUG *** ${TIME}]   -a
-- [hunter *** DEBUG *** ${TIME}]   link=static
-- [hunter *** DEBUG *** ${TIME}]   threading=multi
-- [hunter *** DEBUG *** ${TIME}]   variant=debug,release
-- [hunter *** DEBUG *** ${TIME}]   --layout=tagged
-- [hunter *** DEBUG *** ${TIME}]   toolset=gcc-ndk
-- [hunter *** DEBUG *** ${TIME}]   --user-config=/.../Build/Boost/__iostreams/Build/boost.user.jam
-- [hunter *** DEBUG *** ${TIME}]   --with-iostreams
-- [hunter *** DEBUG *** ${TIME}]   -s
-- [hunter *** DEBUG *** ${TIME}]   NO_COMPRESSION=0
-- [hunter *** DEBUG *** ${TIME}]   -s
-- [hunter *** DEBUG *** ${TIME}]   NO_ZLIB=0
-- [hunter *** DEBUG *** ${TIME}]   -s
-- [hunter *** DEBUG *** ${TIME}]   NO_BZIP2=1
-- [hunter *** DEBUG *** ${TIME}]   -s
-- [hunter *** DEBUG *** ${TIME}]   ZLIB_INCLUDE=/.../Install/include
-- [hunter *** DEBUG *** ${TIME}]   -s
-- [hunter *** DEBUG *** ${TIME}]   ZLIB_LIBPATH=/.../Install/lib
-- [hunter *** DEBUG *** ${TIME}]   -s
-- [hunter *** DEBUG *** ${TIME}]   ZLIB_BINARY=zd
-- [hunter *** DEBUG *** ${TIME}]   linkflags= -Wl,--fix-cortex-a8 -Wl,--no-undefined -Wl,--gc-sections -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,now -Wl,-z,nocopyreloc -fPIE -pie
-- [hunter *** DEBUG *** ${TIME}]   -j
-- [hunter *** DEBUG *** ${TIME}]   4
-- [hunter *** DEBUG *** ${TIME}] ------
-- [hunter *** DEBUG *** ${TIME}] Boost user jam config:
-- [hunter *** DEBUG *** ${TIME}] ------
-- [hunter *** DEBUG *** ${TIME}] using gcc
  : ndk
  : "${ANDROID_NDK_r10e}/toolchains/arm-linux-androideabi-4.9/prebuilt/${HOST_OS}-x86_64/bin/arm-linux-androideabi-g++" -fexceptions -frtti -Wno-psabi --sysroot=${ANDROID_NDK_r10e}/platforms/android-19/arch-arm -funwind-tables -finline-limit=64 -fsigned-char -no-canonical-prefixes -march=armv7-a -mfloat-abi=softfp -mfpu=neon -fdata-sections -ffunction-sections -Wa,--noexecstack -std=c++11 -DANDROID -isystem  ${ANDROID_NDK_r10e}/platforms/android-19/arch-arm/usr/include -isystem  ${ANDROID_NDK_r10e}/sources/cxx-stl/gnu-libstdc++/4.9/include -isystem  ${ANDROID_NDK_r10e}/sources/cxx-stl/gnu-libstdc++/4.9/libs/armeabi-v7a/include -isystem  ${ANDROID_NDK_r10e}/sources/cxx-stl/gnu-libstdc++/4.9/include/backward
  : <archiver> "${ANDROID_NDK_r10e}/toolchains/arm-linux-androideabi-4.9/prebuilt/${HOST_OS}-x86_64/bin/arm-linux-androideabi-gcc-ar"
;

Okay I've found the difference in internal tests (bin.v2/config.log) that doesn't show up in default logs). Problem is about adding -lrt library on Linux host:
"/.../android-ndk/android-ndk-r10e/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/arm-linux-androideabi-g++"
"-fexceptions"
"-frtti"
"-Wno-psabi"
"--sysroot=/.../android-ndk/android-ndk-r10e/platforms/android-19/arch-arm"
"-funwind-tables"
"-finline-limit=64"
"-fsigned-char"
"-no-canonical-prefixes"
"-march=armv7-a"
"-mfloat-abi=softfp"
"-mfpu=neon"
"-fdata-sections"
"-ffunction-sections"
"-Wa,--noexecstack"
"-std=c++11"
"-DANDROID"
"-isystem"
"/.../android-ndk/android-ndk-r10e/platforms/android-19/arch-arm/usr/include"
"-isystem"
"/.../android-ndk/android-ndk-r10e/sources/cxx-stl/gnu-libstdc++/4.9/include"
"-isystem"
"/.../android-ndk/android-ndk-r10e/sources/cxx-stl/gnu-libstdc++/4.9/libs/armeabi-v7a/include"
"-isystem"
"/.../android-ndk/android-ndk-r10e/sources/cxx-stl/gnu-libstdc++/4.9/include/backward"
-L"/.../hunter/_Base/xxxxxxx/3bce312/7416caa/Install/lib"
-Wl,-R
-Wl,"/.../hunter/_Base/xxxxxxx/3bce312/7416caa/Install/lib"
-Wl,-rpath-link
-Wl,"/.../hunter/_Base/xxxxxxx/3bce312/7416caa/Install/lib"
-o
"bin.v2/standalone/ac/gcc-ndk/debug/link-static/threading-multi/zd"
-Wl,--start-group
"bin.v2/standalone/ac/gcc-ndk/debug/link-static/threading-multi/main.o"
-Wl,-Bstatic
-lzd <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< testing ZLIB is present with name 'libzd.a'
-Wl,-Bdynamic
-lrt <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< break stuff (c)
-Wl,--end-group
-g
-pthread
-Wl,--fix-cortex-a8
-Wl,--no-undefined
-Wl,--gc-sections
-Wl,-z,noexecstack
-Wl,-z,relro
-Wl,-z,now
-Wl,-z,nocopyreloc
-fPIE
-pie

/.../android-ndk/android-ndk-r10e/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/../lib/gcc/arm-linux-androideabi/4.9/../../../../arm-linux-androideabi/bin/ld: error: cannot find -lrt

works fine on OSX:
"/.../android-ndk/android-ndk-r10e/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-g++"
"-fexceptions"
"-frtti"
"-Wno-psabi"
"--sysroot=/.../android-ndk/android-ndk-r10e/platforms/android-19/arch-arm"
"-funwind-tables"
"-finline-limit=64"
"-fsigned-char"
"-no-canonical-prefixes"
"-march=armv7-a"
"-mfloat-abi=softfp"
"-mfpu=neon"
"-fdata-sections"
"-ffunction-sections"
"-Wa,--noexecstack"
"-std=c++11"
"-DANDROID"
"-isystem"
"/.../android-ndk/android-ndk-r10e/platforms/android-19/arch-arm/usr/include"
"-isystem"
"/.../android-ndk/android-ndk-r10e/sources/cxx-stl/gnu-libstdc++/4.9/include"
"-isystem"
"/.../android-ndk/android-ndk-r10e/sources/cxx-stl/gnu-libstdc++/4.9/libs/armeabi-v7a/include"
"-isystem"
"/.../android-ndk/android-ndk-r10e/sources/cxx-stl/gnu-libstdc++/4.9/include/backward"
-L"/.../hunter/_Base/xxxxxxx/3bce312/7416caa/Install/lib"
-Wl,-R
-Wl,"/.../hunter/_Base/xxxxxxx/3bce312/7416caa/Install/lib"
-Wl,-rpath-link
-Wl,"/.../hunter/_Base/xxxxxxx/3bce312/7416caa/Install/lib"
-o
"bin.v2/standalone/ac/gcc-ndk/debug/link-static/threading-multi/zd"
-Wl,--start-group
"bin.v2/standalone/ac/gcc-ndk/debug/link-static/threading-multi/main.o"
-Wl,-Bstatic
-lzd <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< testing ZLIB is present with name 'libzd.a'
-Wl,-Bdynamic
-Wl,--end-group
-g
-Wl,--fix-cortex-a8
-Wl,--no-undefined
-Wl,--gc-sections
-Wl,-z,noexecstack
-Wl,-z,relro
-Wl,-z,now
-Wl,-z,nocopyreloc
-fPIE
-pie

Will report error.
@aadityakalsi Do you know any workarounds?

Will report error

https://svn.boost.org/trac/boost/ticket/12217

This one actually is a bug because we can start Boost.iostreams + Android build on Linux host and it will not fail (!) Hence it can be saved to cache and reused producing weird link errors even if host is OSX (when binaries reused from server). I've added a "broken package" guards to prevent such scenario: https://github.com/ruslo/hunter/commit/3628c72c0df9e049e034b33602a5ecdb10588ef9
Note that when we build Boost.iostreams + Android on OSX host and upload binaries to server then they can be correctly reused on Linux host. This is a workaround for this issue.

Not a Hunter issue, closing.


[FLINK-9934] [table] Fix invalid field mapping by Kafka table source factory

What is the purpose of the change
According to the DefinedFieldMapping interface the field mapping can also contain the input fields. However, the Kafka table source factory was calling SchemaValidator#deriveFieldMapping with its own schema instead of the the input type.
Brief change log

Replace schema with type in SchemaValidator#deriveFieldMapping to avoid confusion
Adapted tests

Verifying this change
The KafkaTableSourceSinkFactoryTestBase has been extended.
Does this pull request potentially affect one of the following parts:

Dependencies (does it add or upgrade a dependency): no
The public API, i.e., is any changed class annotated with @Public(Evolving): no
The serializers: no
The runtime per-record code paths (performance sensitive): no
Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Yarn/Mesos, ZooKeeper: no
The S3 file system connector: no

Documentation

Does this pull request introduce a new feature? no
If yes, how is the feature documented? not applicable

One issue. Please copy

According to the DefinedFieldMapping interface the field mapping can also contain the input fields. However, the Kafka table source factory was calling SchemaValidator#deriveFieldMapping with its own schema instead of the the input type.

to the commit message


Vaccination Certificate in Wallet (iOS)

Feature description
Show a pass in Wallet on iOS for quick access in certain situations by just double clicking the side- / home button.
For example if in the future the case arises that you need a proof of vaccination for certain places to enter (e.g. restaurants), you could access the vaccination certificate quicker by using the wallet shortcuts than searching the CWA and opening the tab for the certificate there.

Problem and motivation
User acceptance, simplicity of use and speed of processing for entry controls increase.

Is this something you're interested in working on
No

Internal Tracking ID: EXPOSUREAPP-7811

Hello everyone,
This feature request has been declined and will not be pursued further. We have decided against this feature because of the legal restrictions and drawbacks regarding the privacy of the stored data.

Corona-Warn-App Open Source Team

If the dgca team decides to implement it, would this still be declined?

Hello everyone,
This feature request has been declined and will not be pursued further. We have decided against this feature because of the legal restrictions and drawbacks regarding the privacy of the stored data.
Corona-Warn-App Open Source Team

What’s with negative tests? If there is no name or identity?

Hello everyone,
This feature request has been declined and will not be pursued further. We have decided against this feature because of the legal restrictions and drawbacks regarding the privacy of the stored data.
Corona-Warn-App Open Source Team

Can you explain that further please?

I said this at the dcga-app too, I can't understand the decision and I'm disappointed.
And as you can see on the frequency of interaction, this feature is highly requested by iOS-users.
And so that's the point where my story with the CWA ends, and for the certificates will never begin.
I don't see me cluttering my device with multiple apps for certificates, test results and checkin, wich are basically all doing the same.
And because I don't want to support such hypercritical paternalism, where the users will not be allowed to decide on their own, if they want to take the risk.
And as you can't prevent people from finding other ways, if they want to get this into Apple Wallet, this is nothing other than paternalism.
So the only option, and the option I will recommend everyone of my friends and family, is to use third party apps for creating passes, where the passes are generated on unknown untrusted servers abroad, like somebody already mentioned above. But there is no alternative.
As for now, I'm too hoping for Luca-App or other third-party devs, and that they are more user oriented, and so there maybe could be a chance that they implement it.

I said this at the dcga-app too, I can't understand the decision and I'm disappointed.
And as you can see on the frequency of interaction, this feature is highly requested by iOS-users.
And so that's the point where my story with the CWA ends, and for the certificates will never begin.
I don't see me cluttering my device with multiple apps for certificates, test results and checkin, wich are basically all doing the same.
And because I don't want to support such hypercritical paternalism, where the users will not be allowed to decide on their own, if they want to take the risk.
And as you can't prevent people from finding other ways, if they want to get this into Apple Wallet, this is nothing other than paternalism.
So the only option, and the option I will recommend everyone of my friends and family, is to use third party apps for creating passes, where the passes are generated on unknown untrusted servers abroad, like somebody already mentioned above. But there is no alternative.
As for now, I'm too hoping for Luca-App or other third-party devs, and that they are more user oriented, and so there maybe could be a chance that they implement it.

Thanks!
Actually I avoided the Luca app completely and just used the CWA app but with that feature they could bring me in.
I still don’t understand why we have two separate apps that get paid twice.

If the dgca team decides to implement it, would this still be declined?

@jucktnich I think https://github.com/eu-digital-green-certificates/dgca-wallet-app-ios/issues/69 was declined for the same reasons, but I was not involved in making the decision, so there could be other reasons. I can ask for further details about the decision, although most of the arguments presented in the DGC issue probably also apply here.

Corona-Warn-App Open Source Team

@ezadoo

So the only option, and the option I will recommend everyone of my friends and family, is to use third party apps for creating passes, where the passes are generated on unknown untrusted servers abroad, like somebody already mentioned above. But there is no alternative.

Please do not recommend unsafe solutions on other services to others, especially if you know they are untrusted.
You can criticize our decisions as much as you want. That is totally okay and encouraged. What I think is not okay is to tell others to use a solution with even more privacy concerns because you don't agree with a decision that was made. Especially if there actually is an alternative, which is to store the certificate in the CWA.

Corona-Warn-App Open Source Team

I made now my own implentation for Apple Wallet. If CWA and CovPass would note integrate Apple Wallet, i have no other possibility.
The decission is very bad and in my opinion wrong, but that's now not my problem.

@heinezen the issue is on the dgca side in a Schrödinger's cat state

@heinezen
I don't see a problem there, it's your decision, what features you are implementing in the app.
But this is a feature that, as you can see on the interaction frequency on issues with this topic, is highly requested by iOS users.
And there are apps wich solve this issue.
That apps are not untrustworthy in general, many of them have been in the AppStore for years and have really good ratings and many users.
But as the passes have to be generated on the backend servers, as they have to be signed as a technical requirement from Apple to work in Wallet, nobody can say what really happens on this servers and that the passes are not stored there forever.
We have no hints that indicate something like that, but as the apps are closed source, you have no choice than trusting the developers.
And I personally can't and won't recommend solutions wich I personally don't use and when there are, from an feature and usability standpoint, better solutions for this topic.
And as there are no technical reasons for preventing the support for Apple Wallet, I see no reason for recommending people laborious solutions for this topic.

It's not the question if they are doing it, rather than with wich app they are doing it.
You had the chance to prevent users from doing so, by providing an official and trusted way for doing that, but you chose that you know better than the users themselves, what they need and that they are not able to choose on their own.

Reopened for documentation purposes and avoiding duplicates.

Dear all!
We have seen this in the past already: Initially declined feature requests have been reassessed afters and have been implemented eventually. So, everybody is of course invited to continue to contribute (ideas, discussion, analysis, ...) to this (and all other) issue.

Corona-Warn-App Open Source Team

Hello everyone,
In the last few days I worked on another app with wallet passes and here is how you create passes and distribute them to the user (as I understood it):

You need an template for the pass(no user data and only stored on the server) and the signing certificate from apple

Creating the pass (Only on the Server) and singing it + save it on the server

Bringing the pass to the end user through the app (Direct communication between the app and the backend; no apple servers)

saving the pass into the wallet with user interaction required. When the user has iCloud active for the wallet, the iPhone uploads the pass into iCloud(I think it is encrypted)

(Optional) Updates to the pass with APNS over Apple servers.

I don't think updates are necessary except for revoking the passes.

If you don't wanna share your data OUTSIDE the EU, you can use this one here:
https://coronapass.fabianpimminger.com
It will not store any data and will still give you the certificate for the wallet.

If you don't wanna upload your certificate, you could use my instructions:
https://github.com/Hanashi/impfzertifikat-wallet

As the solution from Fabian Pimminger is already mentioned, the people responsible for the rejection of this feature request should have a look at the responses in the media.
As there is stated that a single developer can develop and provide a proper solution in the time of just 6 hours, and the official authorities are not able to.
Can someone please test if this solution is working with the german certificates too?

I just tried Fabian's soulution but in Germany you don't get an PDF, so I used an screenshot but got an 500 error.

@ezadoo

So the only option, and the option I will recommend everyone of my friends and family, is to use third party apps for creating passes, where the passes are generated on unknown untrusted servers abroad, like somebody already mentioned above. But there is no alternative.

Please do not recommend unsafe solutions on other services to others, especially if you know they are untrusted.
You can criticize our decisions as much as you want. That is totally okay and encouraged. What I think is not okay is to tell others to use a solution with even more privacy concerns because you don't agree with a decision that was made. Especially if there actually is an alternative, which is to store the certificate in the CWA.
Corona-Warn-App Open Source Team

As long as the CWA/CovPass team cannot get permission to publish your apps in the US (i.e., global) app stores, alternatives are needed and will be found. The SwissCovid app fills the contract-tracing gap in a reputable way (consider marketing it so people don’t install whatever dodgy app “Germany covid app” turns up) but now people are stuck without a good way to keep their digital Impfpasses. (Yes, person who keeps chiming in about keeping a second Apple ID, we realize you are very clever and we are very dim, but many of us live in the real, messy world and are seeking solutions that are sustainable for the real people living there.)

@ezadoo stated that a developer could build that feature in 6 hours, i wanted to see if it is really that easy and fast. So an afternoon later: Yes, it is.
It´s an pretty simple Node.js implementation: https://github.com/Nils-witt/ImpfpassToAppleWalletServer

@heinezen
I just read an article about the vaccination certificate in Apple Wallet on an Apple-specific website.
[https://www.iphone-ticker.de/impfnachweis-im-apple-wallet-derzeit-nur-ueber-umwege-176199/](Impfnachweis im Apple Wallet: Derzeit nur über Umwege)
And they are already recommending the mentioned third-party apps for creating passes wich work with Apple Wallet, as the official Apps are not willing to integrate support for Apple Wallet.
And so many other people are going to use the third-party apps.

@ezadoo @Nils-witt @riconeitzel @amandadebler
We do not recommend storing the certificate in the Apple Wallet due to privacy risks involved. Whether the CWA implements the feature does not change the risk here. This is the reason why the feature was rejected in the first place.
You can still use other methods than Apple Wallet to store the certificate:

storing the certificate inside the CWA
keeping a copy of the printout in your physical wallet or pockets

All solutions or workarounds in this thread should be used at your own risk and are not endorsed by the CWA team.

Corona-Warn-App Open Source Team

If the CWA implemented this feature, this would mitigate the risk of being uploaded to untrusted servers, so it's better than using third party apps.

@heinezen For me the bigger privacy risk is an unlocked phone to show it and that I maybe hand over to someone who wants to scan the QR code.

German Logic:
CWA with Apple wallet support = privacy risk
Luca app where nearly every privacy expert says that this is a privacy mess and you shouldn’t use it = funded from the states (bundesländer)
This example can be continued endlessly

@heinezen For me the bigger privacy risk is an unlocked phone to show it and that I maybe hand over to someone who wants to scan the QR code.

+1

For everyone interested in my little project:
It´s now working well with my certificates and has now a client app:
https://github.com/Nils-witt/VacxPass-iOS
All development in those repos took around 12 hours (+/-).

@ezadoo stated that a developer could build that feature in 6 hours, i wanted to see if it is really that easy and fast. So an afternoon later: Yes, it is.
It´s an pretty simple Node.js implementation: https://github.com/Nils-witt/VacxPass-Server

I developed a small web app, which lets you add your certificates as a pass: CovidPass. It is developed in accordance with the GDPR and is hosted in Germany. Feel free to contribute

We do not recommend storing the certificate in the Apple Wallet due to privacy risks involved. Whether the CWA implements the feature does not change the risk here. This is the reason why the feature was rejected in the first place.
You can still use other methods than Apple Wallet to store the certificate:

storing the certificate inside the CWA
keeping a copy of the printout in your physical wallet or pockets

All solutions or workarounds in this thread should be used at your own risk and are not endorsed by the CWA team.
Corona-Warn-App Open Source Team

How is carrying a copy of the printout any different / more secure than having the certificate exported into the wallet app? It contains the same QR code so I don't really get why you would suggest this as a viable alternative while denying the wallet export due to privacy issues.

@heinezen For me the bigger privacy risk is an unlocked phone to show it and that I maybe hand over to someone who wants to scan the QR code.

+1

@heinezen For me the bigger privacy risk is an unlocked phone to show it and that I maybe hand over to someone who wants to scan the QR code.

You can unlock your phone and keep it in your hands while the QR code is scanned.

Corona-Warn-App Open Source Team

When we are already talking about hypothetical choices, we should consider the possibility to disable the Wallet access from the lockscreen in the same way.
Also if you search in Google for the search term "Impfpass Apple wallet", etc you are getting already a huge amount of results from big news- and tech-websites wich are promoting all the mentioned apps and so the interest in this feature and the amount of users for this solutions will grow in the future.

We do not recommend storing the certificate in the Apple Wallet due to privacy risks involved. Whether the CWA implements the feature does not change the risk here. This is the reason why the feature was rejected in the first place.

Could you elaborate a bit more in detail how Wallet might increase privacy risks? Did you conduct a formal risk assessment of the feature?

@heinezen For me the bigger privacy risk is an unlocked phone to show it and that I maybe hand over to someone who wants to scan the QR code.

You can unlock your phone and keep it in your hands while the QR code is scanned.
Corona-Warn-App Open Source Team

Even for ApplePay you are sometime required to give your phone to a person behind plexiglass so that the person holds it to the payment device. So handing a completly unlocked device to a person that could even run away with it is more a security issue than having the vaccination certificate in the wallet. Even the apple emergency pass is able to be shown on locked phones with even more sensitive information.
Since there are websites propagating the use of third party apps or websites you should really provide a safe implementation. Using thrids party apps or websites is an issue for the whole pandemic as, when certificate is needed to be uploaded, a thrid party company can collect many certificates and sell them or whatever and many people checking the certificate skip the fact that they should compare the certificate data against an ID.

@heinezen For me the bigger privacy risk is an unlocked phone to show it and that I maybe hand over to someone who wants to scan the QR code.

You can unlock your phone and keep it in your hands while the QR code is scanned.
Corona-Warn-App Open Source Team

Even for ApplePay you are sometime required to give your phone to a person behind plexiglass so that the person holds it to the payment device. So handing a completly unlocked device to a person that could even run away with it is more a security issue than having the vaccination certificate in the wallet. Even the apple emergency pass is able to be shown on locked phones with even more sensitive information.
Since there are websites propagating the use of third party apps or websites you should really provide a safe implementation. Using thrids party apps or websites is an issue for the whole pandemic as, when certificate is needed to be uploaded, a thrid party company can collect many certificates and sell them or whatever and many people checking the certificate skip the fact that they should compare the certificate data against an ID.

That’s not true!
The device stays in the hands of the owner.
And only the owner will put the device on the payment device and no one else.
I don’t know where you are but payment devices should always be outside of the glass.
It’s the same thing you don’t give your wallet to the cashier and say: „take out the money“ if you pay with cash

That’s not true!
The device stays in the hands of the owner.
And only the owner will put the device on the payment device and no one else.
I don’t know where you are but payment devices should always be outside of the glass.
It’s the same thing you don’t give your wallet to the cashier and say: „take out the money“ if you pay with cash

That is real world experiance and also happens with credit and giro card. Of course, it should not happen, but it happened and still happens to me, so your statement "That’s not true!" is wrong, I wouldnt come up with it if it does not happen ;-)

That’s not true!
The device stays in the hands of the owner.
And only the owner will put the device on the payment device and no one else.
I don’t know where you are but payment devices should always be outside of the glass.
It’s the same thing you don’t give your wallet to the cashier and say: „take out the money“ if you pay with cash

That is real world experiance and also happens with credit and giro card. Of course, it should not happen, but it happened and still happens to me, so your statement "That’s not true!" is wrong, I wouldnt come up with it if it does not happen ;-)

In which area do you live? I have never seen that kind of sad actions.

@iMonZ same here, some terminals can't be accessed, since there's a Plexiglas in between

Since the feature is still declined and the situation regarding the IOS wallet has not changed so far, we will close this issue again. We will reopen the issue if a solution has been found.

Corona-Warn-App Open Source Team

For anyone interested, I have opened a Feedback to Apple, FB9448541:
[Wallet] Add support for requiring authentication to show the pass barcode

Wallet passes should support a way to mark the pass as requiring authentication so the barcode is only visible when the device is unlocked (eg. after Touch ID or Face ID). This would be interesting for barcodes that contain sensitive information like the EU Digital COVID Certificate QRs.

For example the German Exposure Notification app Corona-Warn-App has denied to add support for generating Apple Wallet passes for the EU Digital COVID Certificate because the barcode would be exposed without user authentication: https://github.com/corona-warn-app/cwa-app-ios/issues/2965

That’s not true!

The device stays in the hands of the owner.

And only the owner will put the device on the payment device and no one else.

I don’t know where you are but payment devices should always be outside of the glass.

It’s the same thing you don’t give your wallet to the cashier and say: „take out the money“ if you pay with cash

That is real world experiance and also happens with credit and giro card. Of course, it should not happen, but it happened and still happens to me, so your statement "That’s not true!" is wrong, I wouldnt come up with it if it does not happen ;-)

In which area do you live? I have never seen that kind of sad actions.

True story at the vaccination center for my first jab in Bavaria:
I had to hand over my iPhone for scanning the registration, because the scanner cable was too short. So the iPhone was completely unlocked behind the glasses.

That’s not true!

The device stays in the hands of the owner.

And only the owner will put the device on the payment device and no one else.

I don’t know where you are but payment devices should always be outside of the glass.

It’s the same thing you don’t give your wallet to the cashier and say: „take out the money“ if you pay with cash

That is real world experiance and also happens with credit and giro card. Of course, it should not happen, but it happened and still happens to me, so your statement "That’s not true!" is wrong, I wouldnt come up with it if it does not happen ;-)

In which area do you live? I have never seen that kind of sad actions.

True story at the vaccination center for my first jab in Bavaria:
I had to hand over my iPhone for scanning the registration, because the scanner cable was too short. So the iPhone was completely unlocked behind the glasses.

Exactly, I've experienced this too, also from both sides.
As I did the checkin myself, I've experienced this problem multiple times.
But this case doesn't exist in the minds of the developers here, neither does the option to disable the wallet access from lockscreen.

Dear @ezadoo, dear community.
We will come back to this thread with any news if there should be any new development regarding this issue, and of course in the meantime feel free to continue the discussion here. Just for clarification: The developers do not decide which features will be implemented. This is to be decided by several other stakeholders, amongst them BMG and RKI.

Corona-Warn-App Open Source Team

@dsarkar & @heinezen
Could you please let us know why exactly this feature has been declined? The reason @heinezen gives in https://github.com/corona-warn-app/cwa-app-ios/issues/2965#issuecomment-864567200 is a very general one.
Is the problem here also the accessibility from the lock screen?

https://www.computerbild.de/artikel/cb-News-App-Check-iOS-15.1-Impfnachweis-wandert-in-die-Wallet-30805397.html

@iMonZ Please see https://github.com/corona-warn-app/cwa-wishlist/issues/646#issuecomment-924325875 and what's written in the article:

Einen Haken hat die Sache aber wohl: Derzeit testet Apple das Feature nur mit Zertifikaten, die man in den USA ausgibt.  Ob zum Launch von iOS 15.1 auch deutsche Impfnachweise in der Wallet Unterstützung finden, steht nicht fest.

According to Apple (https://developer.apple.com/news/?id=7h3vwlh5) only SMART Health Cards are able to use this feature. So this feature is useless for Europe at the moment.

As it come to my attention that it is now possible to export the Certificate as pdf and a note that the pdf contains sensitive personal data and it should only be shown to authorized personal.
And I want to ask the same question that Ein-Tim asked regarding this topic elsewhere:

I don't understand why it isn't possible to just add a similar note and let the user add the DCC in their wallet. There is literally no difference to the PDF which can be created, the user could set it as their wallpaper on the Lock Screen and the app can't do anything against it. Still this feature was implemented while the wallet integration was declined...

Why is this from a privacy standpoint not a problem, and why isn't a similar note displayed and sufficient for a the Wallet-integration?
With the PDF Feature the decision here simply seems like hypocrisy.

Looks like this can be easily done even with a web app:
https://covidpass.marvinsextro.de/de-DE
Disclaimer: I have no affiliation with the operator of that site and I cannot verify whether it's secure and trustworthy.

What is the process to get this feature reconsidered?
The attack vector of “someone unauthorised can access the certificate” is, as other have pointed out, not a real one:

What information can be extracted?
How can this information be used against the victim?
What does the attacker need to achieve in order to carry out the attack?
What are the risks involved with the suggested solution?
What are the risks involved with a comparable attack scenario when the proposed solution is not implemented?

Question 1:
The certificate encodes full name, date of birth, date(s) and make(s) of vaccine or date(s) when infection(s) was/were diagnosed, as well as the issuing authority.
The certificate does not include information about the nationality/nationalities, place of birth, place(s) of residence or other personally identifying information.
Question 2:

The combination of full name and date of birth can often (but not always) be used to find more personally identifying information, such as place of birth, places of residence, etc. All of this data could be used for stalking or doxxing the attack victim. Some of such data might be used to gain access to the victim’s accounts via social engineering.
The date(s) and/or make(s) of vaccination could be used to undermine the victim’s standing, if (e.g.) it is a public figure. (Queue jumping, being vaccinated at all, artificially delaying vaccination, getting a vaccine not destined for the victim’s demographic at the time, etc.)
The date(s) of previous diagnosed infection(s) can be used to discriminate against the victim e.g. when applying for a job or an insurance.

Question 3:
In order to carry out the attack, the attacker has to come into physical possession of the (potentially unattended) device of the victim. They have to invoke Wallet (double tap on home or sleep/wake button), select the pass added by CWA, and scan/take a photo of the QR code.
Question 4:
The suggested solution of giving the user the option, to add a vaccination certificate to Wallet, allows an attacker with physical access to the victims device to capture the information detailed under 1. If the device is left unattended, this can happen without the victim noticing the attack.
Question 5:
Except for the chance of capturing the extractable data without the victim noticing the attack when the device is left unattended, all negative outcomes already exist today, without implementing the proposed solution. In addition, though, forcing users to unlock their devices in order to access the certificate QR code has risks of its own:

Users will be tempted to use weaker Passcodes for easier access to the certificate at the point of contact.
The passcode can be spied on, giving an attacker unrestricted access to all on-device data, even exposing other passwords, (through keychain) and OTP two factor authentication codes.
An unlocked device can be snatched out of the user’s hands, giving the thief unrestricted access to most device data.

I think the last point makes an immensely strong case, that not implementing the proposed solution of opt-in support for adding a vaccination certificate to Apple Wallet actually creates a larger attack surface, with more severe consequences for the attack victim, than not doing so.
Further, with the feature being opt-in, every user can do their own risk assessment, and come to a conclusion on whether or not this risk is worth the benefits on their own.

I have the strong impression that we bow hypothetical risk scenarios way out of proportion here. We can have a look at existing implementations that have Wallet integration for the very same passes (GreenPass App, TK app, various web services) and see that those things are not an issue.
The functionality is optional (and can't be non-optional, in iOS a pass can only be added to the wallet with user consent) and the users have additional full system control over the wallet being accessible in the locked state. However they have the true benefits of not having to unlock their phone for their passes (that is a security plus in my book…). And in case they have a watch they sync passes with, that makes a good backup in case the phone runs out of battery. With the added importance of the pass these days, this is a huge plus.
With other apps already having wallet integration with, to my knowledge, none of the issues considered here, it is hard to explain why the CWA doesn't do this. I am strongly for reopening the issue.

If I had time, I would open an Online Partition for CWA implementing apple wallet.

What's the privacy concern anyways? If I lose the printed paper, everyone can see all my data just fine and I don't even have the option to remotely delete it.

By the way, there are already services that allow you to import your certificate into your wallet, and yes, it is accessible from the Lock Screen without unlocking the phone (tried it myself).
And yes, I would prefer if this was possible right from the covid app, not only for vaccination certs but also for test results that got imported into the app :)
https://www.heise.de/ratgeber/Tipp-Corona-Impfausweis-im-Apple-Wallet-auf-iPhone-hinterlegen-6283647.html

@dsarkar So is there a plan to implement this feature?

@abrenner94 Currently there is plan to implement this feature.

What privacy concern? It’s absolutely safe, some people have the QR code on a peace of plastic in their pocket.

Dear @GamerHD007,
Thanks for your comment.  In general, the decision which features are implemented is not the competence of the development team, but other stakeholders, which involve several governmental entities.

The this topic should be discussed again with the different stakeholders and governmental entities.
Because if an PDF-Export is no privacy-concern with an displayed warning, then the same should be applied to the Wallet too.
@dsarkar Was the topic discussed and declined as Wallet Integration in general or only regarding the vaccination certificate?
As it becomes again more relevant to have a covid-test, and an test result contains less private (health) data, would it be necessary/useful to create an different issue for the Wallet Integration for covid-tests, so this Test topic could be discussed officially?

It's the hobbyist lawyers of the RKI again.

I think the responsible person is from the Rki. The contract page is here:
https://www.rki.de/DE/Service/Kontakt/kontakt_node.html;jsessionid=6632B869771DA5B1EE1C1582E80F008D.internet081

@Gernot

I have the strong impression that we blow hypothetical risk scenarios way out of proportion here. We can have a look at existing implementations that have Wallet integration for the very same passes (GreenPass App, TK app, various web services) and see that those things are not an issue.

You nailed it!
There is a german phrase for it. "Der Markt regelt"
Your comment applies to the CovPassCheck-App, too.
Just look at this issue

This issue is once again a prime example of why digital progress in Germany takes forever or doesn't happen at all. Germany destroys its own progress far too often with nonsensical data protection rules.

@kevin-kraus Not exactly. There are scenarios where data protection is good and can be well integrated and regarded. But people still "protest" against them. This here, however, is indeed over exaggerated. The problem is: if it goes to court. there are only two outcomes: right or wrong. So the risk is quite always quite high.

@treysis But where's the data protection issue with the potential Wallet integration?
As it wouldn't be mandatory and the user would have to decide proactively to use this feature, if a similar notice as seen with the pdf export is shown.
So data protection seems to be used simply as "killer argument".

Theoretically the argument that Wallet passes are by default synced via iCloud could be used, however, if I store the exported PDF in the iCloud the app can't do anything against it.
So besides of "The certificate would be available on the lockscreen thus other people with physical access to your device could scan the certificates QR code and steal your certificate", I don't see other good arguments against this feature.

But everyone else (in a shop or restaurant) scanning the certificate could do the same, which is why the certificate doesn‘t say much without checking the ID card…

@Ein-Tim Yes. And the access from lockscreen without password can also be deactivated, if you disable the double-click in the settings.

Good News everyone!
iOS 15.4 Beta 1 added support for EU digital Covid Certificates in the wallet app. See iOS & iPadOS 15.4 Beta Release Notes:

Verifiable health records now support adding vaccination records in the EU Digital COVID Certificate (EU DCC) format to the Wallet and Health apps. (79917344)

h/t @achisto
FYI @dsarkar, I suggest you transfer this info to the internal ticket.

Good News everyone!
iOS 15.4 Beta 1 added support for EU digital Covid Certificates in the wallet app. See iOS & iPadOS 15.4 Beta Release Notes:

Verifiable health records now support adding vaccination records in the EU Digital COVID Certificate (EU DCC) format to the Wallet and Health apps. (79917344)

h/t @achisto
FYI @dsarkar, I suggest you transfer this info to the internal ticket.

Awesome! Thanks for the info!

Good News everyone!
iOS 15.4 Beta 1 added support for EU digital Covid Certificates in the wallet app. See iOS & iPadOS 15.4 Beta Release Notes:

Verifiable health records now support adding vaccination records in the EU Digital COVID Certificate (EU DCC) format to the Wallet and Health apps. (79917344)

h/t @achisto
FYI @dsarkar, I suggest you transfer this info to the internal ticket.

Just before everyone updates to iOS 15.4 Beta 1:
You can't add them to your Wallet app right now as only verrified records can be added and the verification isn't working right now.

Good News everyone!
iOS 15.4 Beta 1 added support for EU digital Covid Certificates in the wallet app. See iOS & iPadOS 15.4 Beta Release Notes:

Verifiable health records now support adding vaccination records in the EU Digital COVID Certificate (EU DCC) format to the Wallet and Health apps. (79917344)

h/t @achisto
FYI @dsarkar, I suggest you transfer this info to the internal ticket.

Just before everyone updates to iOS 15.4 Beta 1:
You can't add them to your Wallet app right now as only verrified records can be added and the verification isn't working right now.

Let's try to fix them dear cwa team!
But actually what do they mean with verified?
If Apple uses the same servers as cwa(RKI) then a scan of the QR code should be enough for verifying right?

Good News everyone!

iOS 15.4 Beta 1 added support for EU digital Covid Certificates in the wallet app. See iOS & iPadOS 15.4 Beta Release Notes:

Verifiable health records now support adding vaccination records in the EU Digital COVID Certificate (EU DCC) format to the Wallet and Health apps. (79917344)

h/t @achisto

FYI @dsarkar, I suggest you transfer this info to the internal ticket.

Just before everyone updates to iOS 15.4 Beta 1:

You can't add them to your Wallet app right now as only verrified records can be added and the verification isn't working right now.

Let's try to fix them, dear cwa team!
But actually, what do they mean with verified?
If Apple uses the same servers as cwa(RKI) then a scan of the QR code should be enough for verifying, right?
Someone has a documentation to this topic?

There is not much information available

Ist works

@Ein-Tim could you and the rest of the team please inform those stakeholders who have been blocking this feature for months (in the most polite way possible, of course) to come to their senses regarding these kinds of concerns, and use this ticket as a cautionary tale of how not to go on about useful functionality?
There is lots to be learned here, and none of it is technical. In this case, Apple stepped up ending a fruitless debate that prevented a practical and good solution from happening. In other cases, they can’t without just flipping national authorities the bird and saying “Screw this! If you’re too incompetent to set up a decentralised system that can hand out meaningful contact warnings, we’re building a centralised one and offer/integrate it as part of our Health App, which hundreds of millions of people use anyway”.

It works

I am sad now:/ Its a beta, so things will improve on the way.

@danyowdee
I'm only a community contributor and not involved in the internal processes anyhow. I'm sure @dsarkar will inform the development team about the changed situation which will then inform the stakeholders.

It works

I am sad now:/ Its a beta, so things will improve on the way.

It took a little time in my case to work. It took 5 minutes before I could add it to the wallet

This is the text in the Health app which is shown before the certificate is added to the Wallet:

I know this is closed. However, iOS 15.4 is expected to officially support EU vaccine certificates in the health app and wallet. I don‘t know if there are any APIs planned that would ease exporting those from CWA instead of making the user scan them again, but maybe this could be reconsidered.
Source (one of many):
https://twitter.com/viticci/status/1486836265265864707

@GamerHD007 Your name is not properly redacted in your screenshot.

Dear All,
I have forwarded internally the  latest news cited here. Thanks everybody.
Best wishes, DS

Corona-Warn-App Open Source Team

It works

I am sad now:/ Its a beta, so things will improve on the way.

It took a little time in my case to work. It took 5 minutes before I could add it to the wallet

what exactly did you do? For me it says could not verify :(

@iMonZ was you're vac cert issued by Germany?

@iMonZ was you're vac cert issued by Germany?

Yep

@iMonZ ok, then you probably should report this to apple, so they are aware that this issue also exists for German certs, even though the bug was already mentioned for other German certs so apple is now probably already aware that German certs are affected too.

@iMonZ ok, then you probably should report this to apple, so they are aware that this issue also exists for German certs, even though the bug was already mentioned for other German certs so apple is now probably already aware that German certs are affected too.

Im just curious if this is a sever or system issue.
Hope apple fixes this but next week with the new beta

It seems like Apple fixed the "Not checked" for Germany, now the entries show up as "Checked - Signatur valid".

Still does not work for me.

It seems like Apple fixed the "Not checked" for Germany, now the entries show up as "Checked - Signature valid".

Doesn’t work for me.
Have you rescanned your certificate or just keep the already scanned one?

@Kamik423 & @iMonZ
I just scanned one of my certificates in and left it in the Health app for some days and this evening I was able to add it to the Wallet.

@Kamik423 & @iMonZ
I just scanned one of my certificates in and left it in the Health app for some days and this evening I was able to add it to the Wallet.

Thanks.
Good to know.

@Ein-Tim
Have you received a push notification or some other kind of notification as soon as your signatures were validated and you were able to add the certificates to your wallet?
Or did you just check every once in a while and at some point they were verified?

@kevin-kraus
I did not receive a push notification but I just checked the Health app and at some point the button to add it to the Wallet was blue.

I had no problems with scanning. It always worked even with the we code on a 32 mm Apple Watch

@kevin-kraus

I did not receive a push notification but I just checked the Health app and at some point the button to add it to the Wallet was blue.

Great! It worked now!
I just opened health (hadn’t killed it this time so I kept it open) and it just got blue!
Sad thing I tried it and the  security women used a Samsung a21 and it couldn’t scan it. She asked me: could you make it bigger.
I sayd not that is not possible. But after like 20 seconds it still worked!
Next thing would be Covid tests for 2g+ dear apple.

You are able to also add PCR tests to Apple Health.

@kevin-kraus
You can add all types of EU DCCs.

Just found out, that the App of the Techniker Krankenkasse is able to read the QR codes and pushes them into the apple wallet if wanted. So there is an option to solve that in the CWA if wanted. GDPR is no problem here.

Or just update to iOS 15.4, then open the camera app and scan the code.
Done.
Easiest way ever

@kevin-kraus

I did not receive a push notification but I just checked the Health app and at some point the button to add it to the Wallet was blue.

Great! It worked now!
I just opened health (hadn’t killed it this time so I kept it open) and it just got blue!
Sad thing I tried it and the  security women used a Samsung a21 and it couldn’t scan it. She asked me: could you make it bigger.
I sayd not that is not possible. But after like 20 seconds it still worked!
Next thing would be Covid tests for 2g+ dear apple.

You are able to also add PCR tests to Apple Health.

How? This unfortunately doesn’t work for me.
I got an CWA Link for the Test

@iMonZ If you have a test certificate (like a vaccination certificate) just scan it with the native iOS camera and it opens in health.

@kaystrobach It isn't a GDPR problem but a problem of RKI's lawyers and the management decision not to revise the legal decisions.

FYI: iOS 15.4 is now in RC status: https://developer.apple.com/news/releases/?id=03082022d
I guess we can expect a public release in the next 7-10 days.

So, iOS 15.4 has now been released to the public: https://developer.apple.com/news/releases/?id=03142022d

So, iOS 15.4 has now been released to the public: https://developer.apple.com/news/releases/?id=03142022d

Nice, now we can remove CWA and CovPass.

@Hanashi
Please think about removing CWA, it offers many other features, including bluetooth and check-in based contact tracing.
iOS does not do that (-;

@Hanashi
Please think about removing CWA, it offers many other features, including bluetooth and check-in based contact tracing. iOS does not do that (-;

Not really.
Most features you don’t need anymore.
Most people only need a place for the certificate which is the wallet
And for the test there is no standardized QR code so you just need a pdf or picture or text where it says that you were tested.
so yeah you can uninstall the CWA app and definitely the CovPass App (that was useless in the first place)

@iMonZ but neither contact tracing nor check-in.

@iMonZ but neither contact tracing nor check-in.

Which both you don’t need anymore

Why not? You can also get the result of PCR tests much faster. And if positive test, you can warn others. Why don't we need this anymore?

Why not? You can also get the result of PCR tests much faster. And if positive test, you can warn others. Why don't we need this anymore?

actually you just get the results over Email
And btw you can add you pcr test to iOS as well and get there the notification ;)

PCR test? I got mine in the app, was very convenient.
Still useful for contact tracing and check-ins.

PCR test? I got mine in the app, was very convenient.
Still useful for contact tracing and check-ins.

I just test myself a few times a week and that’s it.
No need for contact tracing. Haven’t needed to use the checkin feature for a year aswell.
So yeah find yourself explanations for useless features.
The CWA was really good made.
I checked to source code so props on that maybe one of the best apps Germany has ever made. But the time has come to archive this projects.

I suggest to stay on topic here, be happy about the iOS 15.4 release. (-;
It is certainly discussable what is necessary and what not, but I think this is a decision everyone should take for themselves.

So yeah find yourself explanations for useless features.

Useless for you...


fix Fix core bug of convert to predicate column

Proposed changes
Issue Number: close #8315 #8835
Fix core bug of convert to predicate column
Problem Summary:
recurrent:
When enable_low_cardinality_optimize = true, for the TPCH dataset, using the following SQL query will Core
select count(*) from lineitem where l_comment = 'ously even exc';

This SQL will trigger the execution of ColumnDictionary::convert_to_predicate_column_if_dictionary, and res->reserve(_codes.size()) is problematic because the current _codes.size() is smaller than its reserve value, so inserting a value into PredicateColumn will Core.
Checklist(Required)

Does it affect the original behavior: (Yes/No/I Don't know)
Has unit tests been added: (Yes/No/No Need)
Has document been added or modified: (Yes/No/No Need)
Does it need to update dependencies: (Yes/No)
Are there any changes that cannot be rolled back: (Yes/No)

Further comments
If this is a relatively large or complex change, kick off the discussion at<EMAIL_ADDRESS>by explaining why you chose the solution you did and what alternatives you considered, etc...

If this core dump has a stack info, you can open an issue and post stack in it. Then releated to this pr.

If this core dump has a stack info, you can open an issue and post stack in it. Then releated to this pr.

ok, i created an issue: #8835

1.1.3 rc2 version has this core bug


[FLOC-2006] Factor in configure_cluster.

https://clusterhq.atlassian.net/browse/FLOC-2006
The test failures will hopefully be fixed by #1470.

Was going to review when acceptance tests pass, but they're failing... in useful way looks like? So address and resubmit (and coordinate with Dave's work).

The failing tests are also failing on master.

Address, and then merge when both vagrant and non-vagrant builds are happy; I can't actually see a passing vagrant build right now because of Unrelated Reasons.

Merging with vagrant failure, since the builder has never succeeded.