Add wait flags to svcat commands

A pretty common scenario is that I want to execute an operation (provision/bind) and then wait for it to be ready to use. I think it would be very dev friendly to support those with flags, instead of driving people to use bash-foo:

svcat OP [--timeout=5m] waits for the instance to be provisioned or fail. Useful for simple scripts that aren't performing concurrent tasks. When a timeout is not set, wait some long but not infinite duration.
svcat OP --no-wait does not wait for the operation to complete (current behavior). The status will be empty in the output. Useful when you want to chain multiple commands and wait for them later.
svcat get RESOURCE --watch mimics the functionality of kubectl. Useful for those who didn't use --wait on the original OP or are watching an operation they didn't initiate from svcat.
Use a slight backoff instead of polling at a set interval. We shouldn't be so aggressive on the backoff that we aren't checking status for huge spans of time. Just enough that we aren't polling every second the entire time.

[x] svcat provision --wait
[x] svcat bind --wait
[x] svcat deprovision --wait
[x] svcat unbind INSTANCE --wait waits for all bindings associated with the instance to be deleted.
[x] svcat unbind --name BINDING --wait
[ ] svcat get instance NAME --wait waits until the specified instance's current operation is complete. Useful when you didn't watch on provision and want to check in later.
[ ] svcat get binding NAME --wait, same as above but for bindings.
[ ] svcat sync broker NAME --wait, waits for the sync to complete.
[ ] svcat touch instance NAME --wait waits for the instance to be processed by the svc-cat controller.

Examples:
svcat provision mysql

svcat bind mysql --no-wait
svcat get binding mysql --watch

Migrated from https://github.com/Azure/service-catalog-cli/issues/89

I would also think it should be the opposite - make the default "wait" and add some "--no-wait" flag for the less common cases where you don't want to wait.

I agree! Not sure why I picked it to work that way when I first created that issue a while back but I'd prefer that svcat do what most people probably want by default.

#dibs

/remove-lifecycle rotten
/lifecycle frozen

/unassign


Bluetooth: controller: nRF5340 Rev 1 Errata [117]

Add the workaround for nRF5340 Rev 1 Errata [117] RADIO:
Changing MODE requires additional configuration.
Signed-off-by: Vinayak Kariappa Chettimada<EMAIL_ADDRESS>

@cvinayak does this still apply?

This is required based on https://infocenter.nordicsemi.com/topic/errata_nRF5340_Rev1/ERR/nRF5340/Rev1/latest/anomaly_340_117.html
But on manual testing between central_hr and peripheral_hr, I saw issues that I dont remember now. I need to revisit this PR, hence DNM. Will tag it v2.6 release, so I pick it up then during release testing.


Add new registration page

Changes proposed

Added new Registration route
Added Base Registration component
Implemented registration page promotion section
Hide Footer section on /register route

Screenshots

Note to reviewers

Code of Conduct

[x] By submitting this pull request, I confirm I've read and complied with the CoC 🖖

Check List (Check all the applicable boxes)

[x] My code follows the code style of this project.
[ ] My change requires changes to the documentation.
[ ] I have updated the documentation accordingly.
[x] All new and existing tests passed.
[x] This PR does not contain plagiarized content.
[x] The title of my pull request is a short description of the requested changes.

You can also join our Discord community.
Feel free to check out other cool repositories of the Thecyberworld.
Join the Thecyberworld GitHub Organisation by raising an issue (you will be sent an invitation).

Thank you for contributing to this project


fix span messages in tests

The comment should make it clear, but as I noted in my main forking PR, the index has to be recalculated otherwise it incorrectly appears as if the messages are all or mostly going to node 0.

My LOGAF is low, but I'd probably just handle the broadcast vs p2p messages separately, i.e.

LOGAF, I like that...
Well, it doesn't make sense to do it like that IMO because for example there is a test currently I wrote that does something like 'send propose message only to node 0 and not anybody else'. So in the tests, the node index is distinct and important, especially when the behaviour is divergent. Other parts of the test framework correctly have the node index as part of the span, so it is misleading when you read later in the logs that node 0 got a message that was actually for node 2 according to a different span etc.


UnicodeEncodeError: 'charmap' codec can't encode character '\u2265'

Hi Jake!
Thank you sooooooo much for your work on, well, everything. Here, in particular on altair ❤
I was thrilled to discover altair_saver, as I just happened to need a way of saving plots to HTML with the javascript dependencies inline: altair_saver.save(chart, "boom.html", inline=True)!
Problem
At first try, it fails on my machine:
>>> import altair
>>> import altair_saver
>>> import vega_datasets
>>>
>>> chart = altair.Chart(vega_datasets.data.cars.url).mark_point().encode(
>>>     x='Horsepower:Q',
>>>     y='Miles_per_Gallon:Q',
>>>     color='Origin:N'
>>> )
>>> altair_saver.save(chart, "cars.html", inline=True)

---------------------------------------------------------------------------
UnicodeEncodeError                        Traceback (most recent call last)
<ipython-input-2-526fd86c54d9> in <module>
----> 1 altair_saver.save(chart, "cars.html", inline=True)

~\AppData\Local\Continuum\miniconda3\envs\plotter\lib\site-packages\altair_saver\_core.py in save(chart, fp, fmt, mode, method, **kwargs)
     75     saver = Saver(spec, mode=mode, **kwargs)
     76
---> 77     saver.save(fp=fp, fmt=fmt)
     78
     79

~\AppData\Local\Continuum\miniconda3\envs\plotter\lib\site-packages\altair_saver\savers\_saver.py in save(self, fp, fmt)
     92         elif isinstance(content, str):
     93             with maybe_open(fp, "w") as f:
---> 94                 f.write(content)
     95         elif isinstance(content, bytes):
     96             with maybe_open(fp, "wb") as f:

~\AppData\Local\Continuum\miniconda3\envs\plotter\lib\encodings\cp1252.py in encode(self, input, final)
     17 class IncrementalEncoder(codecs.IncrementalEncoder):
     18     def encode(self, input, final=False):
---> 19         return codecs.charmap_encode(input,self.errors,encoding_table)[0]
     20
     21 class IncrementalDecoder(codecs.IncrementalDecoder):

UnicodeEncodeError: 'charmap' codec can't encode character '\u2265' in position 246219: character maps to <undefined>

'\u2265' is the innocent-looking GREATER-THAN OR EQUAL TO sign, ≥

It seems to come from the source for vega.js:

(Pdb)  input.find("// vega.js v")
74
(Pdb)  input.find("// vega-lite.js v")
481314

The encoding happens in a module named "cp1252.py", which seems to indicate the Windows 1252 encoding

How my machine ends up thinking 1252 is the way to go is beyond me: I checked sys.getdefaultencoding() and got utf-8.

Context

altair 4.0.1
altair_saver 0.1.0
vega_datasets 0.8.0

conda-installed python 3.7.6
Windows 10
Monkeypatching solution
I found that I could "solve" the problem (i.e., successfully save a usable html) by monkeypatching altair_saver.savers._saver.maybe_open to explicitly use utf-8, like so:
import contextlib
from typing import Union, Iterator, IO

@contextlib.contextmanager
def maybe_open(fp: Union[IO, str], mode: str = "w") -> Iterator[IO]:
    """Write to string or file-like object"""
    if isinstance(fp, str):
        with open(fp, mode, encoding="UTF-8") as f:    # --------- I added the encoding kwarg
            yield f
    elif isinstance(fp, io.TextIOBase) and "b" in mode:
        raise ValueError("File expected to be opened in binary mode.")
    elif isinstance(fp, io.BufferedIOBase) and "b" not in mode:
        raise ValueError("File expected to be opened in text mode")
    else:
        yield fp

from altair_saver.savers import _saver
_saver.maybe_open = maybe_open

I know far too little about HTML encodings to tell if this is a generally good idea, so... draw your own conclusions :wink:

Since Altair 5.2, the functionality of Altair Saver is now available in Altair via the vl-convert package. Most of the functionality has been available since 5.0, and the main addition in 5.2 was PDF export. See the docs on how to save charts for more details.
We are going to archive this repo, so I'm closing all the open issues and PRs before doing so. Try out the new options for saving charts mentioned above and if you run into issues, please open an issue directly in the altair or vl-convert repo.


Enhancement request: Exclude folder and sub-folders

"Add Excluded Folder" works for the specified folder but not for nested sub-folders.  Maybe there's a way to do this with regex?

Yeah this would be super useful. I assumed it applied to all sub folders but recently have realised that it does not :/

@penalba I figured out how to do this.

Enable the "use regular expressions to check for excluded folder" option.
Use regex to define excluded folder paths. I.e. instead of:

Notes/Subject1/Topic1
Write:
Notes/Subject1/Topic1/.*
This works for me.

Works for me too -- thanks!


HTTPRouteHostnameIntersection Conformance Test Fails

The HTTPRouteHostnameIntersection conformance test is failing.

Similar to #434 , It appears that one of the issues is that there are multiple listeners configured to use the same port in the test yaml


Presets support

Saving current exporter settings to presets is quite convenient and much needed in production. Example in collada exporter:

Good idea. We will probably do this, as soon as all features are implemented.

Fixed in glTF-Blender-IO.


⚠ Bofrost.at has degraded performance

In 9289565, Bofrost.at (https://www.bofrost.at) experienced degraded performance:

HTTP code: 200
Response time: 1501 ms

Resolved: Bofrost.at performance has improved in b16b248 after 6 minutes.


RFP - en-croissant

Checklist

[x] The package I am requesting does not already exist on https://community.chocolatey.org/packages;
[x] There is no open issue for this package;
[x] The issue title starts with 'RFP - ';
[x] The download URL is public and not locked behind a paywall / login;

Package Details
Software project URL : https://encroissant.org/
Direct download URL for the software / installer : https://github.com/franciscoBSalgueiro/en-croissant/releases/download/v0.10.0/en-croissant_0.10.0_x64_en-US.msi
Software summary / short description: An open-source, cross-platform chess GUI that aims to be powerful, customizable and easy to use.

I'll pick this one up.

v0.10.0 has been packaged, submitted, and is now awaiting moderator approval.
https://community.chocolatey.org/packages/en-croissant/0.10.0

Package has been approved and should now be available for consumption.
Issue can be closed.


Saif expapptest

Explanation of Change

Fixed Issues

$ https://github.com/Expensify/App/issues/53547
PROPOSAL: https://github.com/Expensify/App/issues/53547#issuecomment-1369752925
Tests

Offline tests
QA Steps

Same as tests

[x] Verify that no errors appear in the JS console

Offline tests

QA Steps

Key Changes:
1. Cached IDs:
Added useState to store the last valid parentReportID and parentReportActionID.
useEffect updates these states whenever valid values are provided.
2. Fallback Logic:
Use cached values (cachedParentReportID, cachedParentReportActionID) if the backend returns null or empty values.
3. No Breakage on Null IDs:
Prevents navigation from breaking by ensuring fallback values are always available.
Consider Adding Logs for Debugging:
Add logs to identify when cached values are being used:
console.log('Using cached ID:', {finalParentReportID, finalParentReportActionID});  // TODO: These must be filled out, or the issue title must include "[No QA]."

[x] Verify that no errors appear in the JS console

PR Author Checklist
Contributor License Agreement (CLA)
I hereby sign the CLA as a contributor to the Expensify project. I agree to the terms and conditions outlined in the CLA document.
Reviewer Checklist

[x] I have verified the author checklist is complete (all boxes are checked off).
[x] I verified the correct issue is linked in the ### Fixed Issues section above
[x] I verified testing steps are clear and they cover the changes made in this PR

[x] I verified the steps for local testing are in the Tests section
[x] I verified the steps for Staging and/or Production testing are in the QA steps section
[x] I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
[x] I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)

[x] I checked that screenshots or videos are included for tests on all platforms
[x] I included screenshots or videos for tests on all platforms
[x] I verified tests pass on all platforms & I tested again on:

[x] Android: Native
[x] Android: mWeb Chrome
[x] iOS: Native
[x] iOS: mWeb Safari
[x] MacOS: Chrome / Safari
[x] MacOS: Desktop

[x] If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
[x] I verified proper code patterns were followed (see Reviewing the code)

[x] I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
[x] I verified that comments were added to code that is not self explanatory
[x] I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
[x] I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
[x] I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
[x] I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
[x] I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
[x] I verified the JSDocs style guidelines (in STYLE.md) were followed

[x] If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
[x] I verified that this PR follows the guidelines as stated in the Review Guidelines
[x] I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
[x] I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
[x] I verified any variables that can be defined as constants (ie. in CONST.ts or at the top of the file that uses the constant) are defined as such
[x] If a new component is created I verified that:

[x] A similar component doesn't exist in the codebase
[x] All props are defined accurately and each prop has a /** comment above it */
[x] The file is named correctly
[x] The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
[x] The only data being stored in the state is data necessary for rendering and nothing else

[x] Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)

[x] All JSX used for rendering exists in the render method
[x] The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions

[x] If any new file was added I verified that:

[x] The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory

[x] If a new CSS style is added I verified that:

[x] A similar style doesn't already exist
[x] The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)

[x] If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
[x] If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
[x] If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
[x] If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
[x] If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:

[x] I verified that all the inputs inside a form are aligned with each other.
[x] I added Design label and/or tagged @Expensify/design so the design team can review the changes.

[x] If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
[x] For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
[x] If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
[x] I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: Native

https://github.com/user-attachments/assets/ea231ade-3ba6-43cf-b1a8-63b4e0762501

Android: mWeb Chrome

https://github.com/user-attachments/assets/ea231ade-3ba6-43cf-b1a8-63b4e0762501

iOS: Native

https://github.com/user-attachments/assets/ea231ade-3ba6-43cf-b1a8-63b4e0762501

iOS: mWeb Safari

https://github.com/user-attachments/assets/ea231ade-3ba6-43cf-b1a8-63b4e0762501

MacOS: Chrome / Safari

https://github.com/user-attachments/assets/ea231ade-3ba6-43cf-b1a8-63b4e0762501

MacOS: Desktop

https://github.com/user-attachments/assets/ea231ade-3ba6-43cf-b1a8-63b4e0762501

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.
I have read the CLA Document and I hereby sign the CLA
You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.

I hereby sign the CLA as a contributor to the Expensify project. I agree to the terms and conditions outlined in the CLA document.

@cla-assistant recheck

@cla-assistant recheck

@hoangzinh Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]
NOTE: It looks like docs/redirects.csv was modified in this PR. Please see this SO for special instructions on how to review changes to that file.

Hi, I am trying to sign the Contributor License Agreement (CLA) for my contribution, but the link to the CLA.md file appears to be broken (404 - Page Not Found). Could you please provide the correct link or guide me on how I can sign the CLA? Thank you!

@cla-assistant recheck, I have signed the CLA as per the instructions in the document.

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.
I have read the CLA Document and I hereby sign the CLA
You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.

I have read and signed the CLA.

For CLA, just follow this comment #53750 (comment)

I have read and signed the CLA.
what next @hoangzinh

Was the contributor ever hired? If not, can we close this PR? Thanks!

I have spent a significant amount of time explaining the frontend and backend issues, but I feel my efforts and time have not been respected.


How can I disable song editor?

What is your question?
 Like, if you press 7 key in FNF you can open the song editor but in these mods you can't. How can I do that?

in source?

in source?

what file?

Bro just find the code that leads to the charting state and comment out it idk

Bro just find the code that leads to the charting state and comment out it idk

thanx


WindowIdentifier::from_native() may only be called once for Wayland GTK windows

Hello,
it seems like WindowIndentifier::from_native() can only be called once, otherwise the following GCritical is emitted:
(dev.Cogitri.Health:21): Gdk-CRITICAL **: 12:22:08.835: gdk_wayland_toplevel_export_handle: assertion '!impl->display_server.xdg_exported' failed

This GCritical origins from gdk_wayland_toplevel_export_handle. The documentation for that function says:
* gdk_wayland_toplevel_export_handle:
[...]
* It is an error to call this function on a surface that is already
* exported.

Not sure what would be the best way to handle this, should we just put a notice in the docs?

Yes that's expected because the handle is unexported when the WindowIdentifier is dropped.
I wonder what would be the best way forward here, but addikg a comment at least seems fine to me

Alright, I’ll submit a PR later today.
Another question: To work around this I currently just hold onto the WindowIndentifier in a OnceCell that’s initialised when the window is created. Is that fine or should I always re-request the WindowIdentifier?

I would say you can keep only once instance around by wrapping it in a OnceCell. I don't know if we can do something about it on the crate side?

Hm, I don’t really think we can other than hacky ways like having a global HashMap<WeakRef, WindowIdentifier> to remember the WindowIdentifier

Ah yeah indeed. That would be very painful to do. I guess going with a comment would be good enough for now.
Feel free to open another issue regarding the usage of the Default implementation of WindowIdentifier in some of the portals

Cant we do a static Once that holds the identifier?


LASA - sulfadiazine - sulfasalazine

Background https://onlinelibrary.wiley.com/doi/full/10.1002/pds.5859
We think it might be worth exploring a new measure akin to our measure on zuclopenthixol https://www.bennett.ox.ac.uk/blog/2019/10/zuclopenthixol-acetate-a-new-kind-of-measure-on-openprescribing/
If we decide it is a good thing to do - can you share the  preview measure with me and I'll get further input please?

Preview here: https://openprescribing.net/measure/preview_sulfadiazine/


Swagger UI: Using implicit flow for OAuth2/OpenIdConnect

After some trial and error I've managed to configure the OAuth2 authorization against AWS Cognito in the Swagger UI client.
Ideally, I would have used the OpenIdConnectUrl configuration in the SwaggerSecuritySchemeType.OpenIdConnect settings. Which seemed to work to an extent, as it was correctly downloading the configuration from the endpoint published by AWS Cognito and then redirecting to the login page.
However, Swagger UI was not receiving the configuration for the implicit flow, so the process was failing due to the missing response_type=token parameter in the query string.
As a workaround, the following configuration works when using OAuth2 config for Cognito.
I'm leaving it here so that it can be found by others trying to use a similar setup.
// Note: This is a custom POCO used to retrieve the settings
var swaggerOptions = app.ApplicationServices.GetService<IOptions<SwaggerUIOptions>>()?.Value;

app.UseSwaggerUi3WithApiExplorer(settings =>
            {
                settings.GeneratorSettings.OperationProcessors.Add(new OperationSecurityScopeProcessor("JWT token"));

                settings.OAuth2Client = new OAuth2ClientSettings()
                {
                    AppName = "MyDemoApp",
                    ClientId = swaggerOptions.SwaggerClientId
                };

                settings.GeneratorSettings.DocumentProcessors.Add(new SecurityDefinitionAppender("JWT token",
                    new SwaggerSecurityScheme
                    {
                        Type = SwaggerSecuritySchemeType.OAuth2,
                        Flow = SwaggerOAuth2Flow.Implicit,
                        Flows = new OpenApiOAuthFlows() {
                            Implicit = new OpenApiOAuthFlow()
                            {
                                Scopes = new Dictionary<string, string> { { "openid", "User Profile" } },
                                AuthorizationUrl = swaggerOptions.AuthorizationUrl,
                                TokenUrl = swaggerOptions.TokenUrl
                            }
                        }
                    }));
                });

Thanks for reporting here! Is there any action we should take? Or is this only informational? Maybe we should move this to the wiki?

Looking at the Swagger UI processing it seems that the scheme is not passed:
https://github.com/RSuter/NSwag/blob/master/src/NSwag.AspNetCore/SwaggerUi3/index.html#L104

Maybe we just have to update the Swagger UI 3 and then it is fixed... currently we are probably not using latest Swagger UI 3

OK, I've just found this in your docs
https://github.com/RSuter/NSwag/wiki/Middlewares#enable-authorization-in-generator-and-swagger-ui
Which describes how to config an OAuth2 client, but using a "client credentials grant" rather than an "implicit" flow.
I'm guessing that something might be getting lost in the process of translating from the SwaggerSecurityScheme to the index.html template that you've linked.
If you could maybe point me how this process works, I could have a debugging session this weekend and if all goes well (a big ambitious if) put together a PR?

Its pretty simple, the placeholders from index.html are replaced here:
https://github.com/RSuter/NSwag/blob/master/src/NSwag.AspNetCore/SwaggerUi3Settings.cs#L54
Just open the solution (i think nswag.min.sln is enough) and start this project:
https://github.com/RSuter/NSwag/tree/master/src/NSwag.Sample.NETCore21

If you have time it would also be awesome if you improve the wiki with your findings.

brilliant, thanks for that, I'll try to get some time to give this a shot :)

Sorry to dig up an old ticket, but can we get an example on how to configure OpenIDConnect client with swaggerui3? Currently I am manually setting up the SecurityScheme as Oauth2 with Implicit flow and various endpoints but would be keen to use proper discovery endpoint instead.

        services.AddOpenApiDocument((options, s) =>
        {
            options.Title = title;
            options.Version = version;
            options.ApiGroupNames = new[] { groupName };

            var authOptions = s.GetRequiredService<IOptions<AuthOptions>>();
            var envOptions = s.GetRequiredService<IOptions<EnvironmentOptions>>();

            options.AddSecurity("oauth2", Enumerable.Empty<string>(), new OpenApiSecurityScheme
            {
                AuthorizationUrl = $"{authOptions.Value.AuthorizationUrl}",
                Flow = OpenApiOAuth2Flow.Implicit,
                Type = OpenApiSecuritySchemeType.OAuth2,
                Scopes = new Dictionary<string, string>
                {
                    {
                        $"{authOptions.Value.ApiScope}", "Access APIs"
                    }
                }
            });

            options.OperationProcessors.Add(new AspNetCoreOperationSecurityScopeProcessor("oauth2"));
        });

        app.UseOpenApi();
        app.UseSwaggerUi3(options =>
        {
            options.OAuth2Client = new OAuth2ClientSettings
            {
                ClientId = clientId
            };
        });

Is there a sample to use OpenIdConnectUrl? In combination with IdentityServer4 Discovery Endpoint
https://demo.identityserver.io/.well-known/openid-configuration
With or without authorization code?

https://identityserver.github.io/Documentation/docsv2/endpoints/authorization.html

Its /connect/authorize

That's Authorization endpoint, the Discovery Endpoint retrieves metadata for the OpenID Provider including Authorization endpoint, available grant types and scopes.
So technically this means if Authorization point changes I wouldn't have to update anything for SwaggerUI to continue functioning.
http://docs.identityserver.io/en/latest/endpoints/discovery.html

Agree with @zyofeng, being able to use the discovery endpoint to configure the authorise/token endpoints would be useful when using the OpenID Connect type.
The discovery endpoint is a well-defined part of the openId Connect specification, meaning it's not only useful for those of us that are using IdentityServer 🙂


context.setBackgroundColor not working as expected

While swiping, I am using func didTransition(with context: SwipeActionTransitioningContext) { to customize the UI:
func didTransition(with context: SwipeActionTransitioningContext) {
if context.actionIdentifier == "favorite" {
if context.newPercentVisible < 0.5 {
context.setBackgroundColor(.green)
context.button.backgroundColor = .green
}
In this example, the button changes the background color, but the background color of the action/context doesn't change.
I also tried holding a reference to the action, and setting it that way as well:
favoriteAction?.backgroundColor = .green
Unfortunately, that is not working either. Is this a bug or am I doing something incorrectly?

Setting the color in the drawRect of my SwipeActionsView seemed to do the trick.


Typo.

"Constrained-based" in the README should be "Constraint-based".

Oh, thanks so much! Just fixed it :)


Report if there is a newer version available in the UI

I'll add the info to /api.

What info is available?

We can tell if there is a new version, what version is it, and a link to the release notes.

I'm imagining something like
VERSION 0.14 (new version available: 0.15)

With a tooltip:
[New version available. Click on the link to see the release notes.]

Sounds good, although we're starting to overload the bottom-right corner quite a log (cf plugins)

Dupe #914


Inherit icon from executable specified in "commandline" for default

Description of the new feature/enhancement
Use icon of the executable specified in "commandline" for default.

Proposed technical implementation details (optional)
For example:
If I have this in my config:

I want to see the icon of python.exe at here by default:

(I hope it isn't a dup. :) )

@ddarfantasy - I believe this is very similar to https://github.com/microsoft/terminal/issues/1504, but more complex (as now you need to resolve what is the relevant "python.exe" - logic that is usually down by CreateProcess itself).

This is a good request, but it is also very difficult because as @Don-Vito points out we'd need to effectively run CreateProcess (or crib all of its resolution logic) to figure out what application you're pointing at... and even so, it could be wrong and of course expensive to do for every profile. I'd rather support it as part of /dup #1504 :smile:


fix: not signature in dockerfile

summary
I found gcc and g++ packages are not UNTRUSTED signature packages, so  we can install the packages with --allow-untrusted argv.
=> ERROR [build 2/7] RUN apk add --no-cache --update gcc g++ go make                                                                                7.2s
------
 > [build 2/7] RUN apk add --no-cache --update gcc g++ go make:
#0 0.297 fetch https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz
#0 6.047 fetch https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
#0 6.047 WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/edge/main: UNTRUSTED signature
#0 7.190 WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/edge/community: UNTRUSTED signature
#0 7.191 ERROR: unable to select packages:
#0 7.195   g++ (no such package):
#0 7.195     required by: world[g++]
#0 7.195   gcc (no such package):
#0 7.195     required by: world[gcc]
#0 7.195   go (no such package):
#0 7.195     required by: world[go]
#0 7.195   make (no such package):
#0 7.195     required by: world[make]

Alpine packages have valid signatures. It's probably your local issue.


stats: handle FatalError and NoRetryError when reported to stats

This is a proposal to properly handle FatalError and NoRetryError when they are not directly returned by the command, but just reported to stats.
See https://github.com/ncw/rclone/pull/2488#issuecomment-416675577 for the addressed use-case.

OK, got it, thanks for the clarification!
I was actually thinking that if at least one NoRetryError happen, then there is no chance that another attempt can succeed. Now I understand that the purpose of retries is not necessarily to succeed, but to go as far as possible. This makes more sense because otherwise, NoRetryError would have been essentially the same as FatalError.
I will fix this :wink:

Well, I have turned the !NoRetryError logic into a simple retryError flag, which behaves similarly to the fatalError flag. I think it helps keeping things simple.
I have also improved the formatted error details as suggested.
Let me know if it's better now.

Apologies for the delay!
I think that looks great now thank you - I will merge it now :-)


Fix performance issue introduced by vendor code

Performance issue about unaligned memory access
In mbedtls 3.4.0, upstream refactor the code of accessing unaligned address from using bit calculation to use pointer + memcpy + clang's bitswap.
This is fine in no-sgx environment, but become very slow in fortanix SGX environment.
I think the most possible reason here is call of memcpy.
This PR mainly replace all these new functions with old implementation in https://github.com/Mbed-TLS/mbedtls/blob/v3.3.0/library/common.h
Performance tests result:
Command used to run bench:
cargo +stable bench --no-default-features --features dsa,force_aesni_support,mpi_force_c_code,rdrand,std,time --target=x86_64-fortanix-unknown-sgx
Branch for testing: `yx/mbedtls-9_bench` at e51d4d17591817922928b3f23b6a85de4c3b2501 :
Benchmarking pbkdf2_hmac
Benchmarking pbkdf2_hmac: Warming up for 3.0000 s
Benchmarking pbkdf2_hmac: Collecting 100 samples in estimated 7.6594 s (200 iterations)
Benchmarking pbkdf2_hmac: Analyzing
pbkdf2_hmac             time:   [38.324 ms 38.332 ms 38.339 ms]
Found 1 outliers among 100 measurements (1.00%)
  1 (1.00%) high mild

Branch for testing: `yx/mbedtls-11_bench` at 489cad5a6d8dc1042329de5aaf9d0a801a7ba802 :
Benchmarking pbkdf2_hmac
Benchmarking pbkdf2_hmac: Warming up for 3.0000 s
Benchmarking pbkdf2_hmac: Collecting 100 samples in estimated 14.664 s (100 iterations)
Benchmarking pbkdf2_hmac: Analyzing
pbkdf2_hmac             time:   [146.82 ms 146.86 ms 146.91 ms]
Found 6 outliers among 100 measurements (6.00%)
  1 (1.00%) low mild
  3 (3.00%) high mild
  2 (2.00%) high severe

After this PR, the performance number back to be as same as yx/mbedtls-9_bench one
Performance issue about explicit_bzero (debug mode only)
When providing the explicit_bzero function through rust, there is a big performance downgrade in SGX
For example, when running the pbkdf :
Command: cargo +stable nextest run --test pbkdf --no-default-features --features dsa,force_aesni_support,mpi_force_c_code,rdrand,std,time  --target=x86_64-fortanix-unknown-sgx
# debug
PASS [   7.689s] mbedtls::pbkdf test_pbkdf2
# release
PASS [   0.233s] mbedtls::pbkdf test_pbkdf2

After ensure C mbedtls side to not call explicit_bzero, the time reduce to
# debug
PASS [   1.785s] mbedtls::pbkdf test_pbkdf2
# release
PASS [   0.234s] mbedtls::pbkdf test_pbkdf2

This performance issue should be not related to usage of Zeroize crate, because above tests results are reproduced by following minimal implementation of explicit_bzero:
#[no_mangle]
pub unsafe extern "C" fn explicit_bzero(buf: *mut std::ffi::c_void, len: alloc::size_t) {
    // TODO: use `volatile_set_memory` when stabilized
    for i in 0..len {
        let ptr = (buf as *mut u8).add(i);
        core::ptr::write_volatile(ptr, 0u8);
    }
}

Or maybe I need to export a C define from mbedtls-sys, such as __SGX__. And use this to conditional compile the change above

I haven't looked at this in full detail yet, but one thing I'm not thrilled about is directly conditioning the code on __SGX__ being defined. The existing code seems to be pretty good at defining macros for features/properties like MBEDTLS_EFFICIENT_UNALIGNED_ACCESS and then conditionalizing the code on those macros. The feature macros get set based on things like the defines for the CPU architecture, so there's a level of indirection there.
This is a nice thing to do because at some point in the future there might be some other non-SGX platform that wants to use these alternatives for memory access. And it would be weird if they had to define SGX to get the behavior they want, since since that platform wouldn't have anything to do with SGX.
So I think you want to conditionalize the code on a macro named something like MEMCPY_IS_SLOW or something like that, and we can set the MEMCPY_IS_SLOW macro if __SGX__ is set. Then later someone else can compile with MEMCPY_IS_SLOW or make their own change to the header to automatically turn on MEMCPY_IS_SLOW for their platform as appropriate.
Minor C language thing: identifiers starting with double underscores are reserved for use by the platform. So things like the compiler or the system headers can define idenfiers that start with double underscores. Since this is something that we're defining, it shouldn't use double underscores. The standard library also uses some identifiers with single underscores, so those should be avoided as well.

HI @arai-fortanix ,
Yes, it seems the upstream code added the MBEDTLS_EFFICIENT_UNALIGNED_ACCESS and apply such check on mbedtls_xor but not other macros in alignments.h,
One possible solution here is to also add similar checks on MBEDTLS_EFFICIENT_UNALIGNED_ACCESS for family of MBEDTLS_PUT_UINT32_BE macros. And this changes  are reasonable and could be up-streamed.

This PR doesn't make sense to me. The code is clearly intended to get optimized so that there are no actual calls to memcpy. If our generated code still has calls to memcpy, we need to fix how the code is compiled.
Having compiled both Linux and SGX in release mode:
$ objdump -j .text.mbedtls_internal_sha256_process -r target/x86_64-fortanix-unknown-sgx/release/build/mbedtls-sys-auto-f19242cb09f8b77a/out/build/library/CMakeFiles/mbedcrypto.dir/sha256.c.obj

target/x86_64-fortanix-unknown-sgx/release/build/mbedtls-sys-auto-f19242cb09f8b77a/out/build/library/CMakeFiles/mbedcrypto.dir/sha256.c.obj:     file format elf64-x86-64

RELOCATION RECORDS FOR [.text.mbedtls_internal_sha256_process]:
OFFSET           TYPE              VALUE
0000000000000080 R_X86_64_PLT32    memcpy-0x0000000000000004
000000000000009a R_X86_64_PC32     .rodata.K-0x0000000000000004
0000000000000b1e R_X86_64_PLT32    mbedtls_platform_zeroize-0x0000000000000004

$ objdump -j .text.mbedtls_internal_sha256_process -r target/release/build/mbedtls-sys-auto-030256f45744a275/out/build/library/CMakeFiles/mbedcrypto.dir/sha256.c.o

target/release/build/mbedtls-sys-auto-030256f45744a275/out/build/library/CMakeFiles/mbedcrypto.dir/sha256.c.o:     file format elf64-x86-64

RELOCATION RECORDS FOR [.text.mbedtls_internal_sha256_process]:
OFFSET           TYPE              VALUE
0000000000000082 R_X86_64_PC32     .rodata.K-0x0000000000000004
0000000000000b06 R_X86_64_PLT32    mbedtls_platform_zeroize-0x0000000000000004
0000000000000b32 R_X86_64_PLT32    __stack_chk_fail-0x0000000000000004

So it's clear that the compiler fails to properly optimize out the call to memcpy. The fix should be in the compilation, not the code.

So the reason why memcpy is not been optimized is:
When compiling, if build script of mbedtls-sys detect the environment is freestanding , see mbedtls-sys/build/features.rs , it will add cflag: -ffreestanding which equals -fno-builtin .
Then with  -fno-builtin  , clang will Disable implicit builtin knowledge of functions which cause memcpy and other builtin functions not been optimized out.
If assuming -fno-builtin  is necessary , then there are two solutions:

We should define exactly which builtin functions should be disable one by one through -fno-builtin-<value> to ensure only necessary functions are not been optimized.

According to https://man7.org/linux/man-pages/man1/gcc.1.html:

With the -fno-builtin-function option only the built-in
function function is disabled.  function must not begin with
_builtin.  If a function is named that is not built-in in
this version of GCC, this option is ignored.  There is no
corresponding -fbuiltin-function option; if you wish to
enable built-in functions selectively when using -fno-builtin
or -ffreestanding, you may define macros such as:
    #define abs(n)          __builtin_abs ((n))
    #define strcpy(d, s)    __builtin_strcpy ((d), (s))

We need to add #define memcpy(dst, src, sz)  __builtin_memcpy((dst), (src), (sz)) in mbedtls-sys/vendor/library/alignment.h after #include <string.h> to ensure all calls to memcpy in this file will be optimized.

Hi @jethrogb ,

But there's no way to instruct the compiler, "ignore all builtins, except these specific ones"?
As far as I know after some search on internet, the only way is to add something like  #define abs(n)          __builtin_abs ((n)) in source code where you want to except some functions.

And as you can see this PR, I just updated, because of the limitation of C macro, this kind of C macros need to:

Add after include header file, so add this in config.h will cause compile error.
Such C macro cannot dealing with C code, if they call memcpy  like this: memcpy(a, A_MACRO_EXPAND_TO_TWO_ARGUMENTS(b))

Github is down now, https://www.githubstatus.com/

I'm not thrilled by forcing an inclusion of string.h. But that makes me wonder, which string.h are we including, and are we including the appropriate support functions for that string.h in the build environment?
The reason I'm asking is that we had a bug in zircon where we were compiling code using glibc's ctype.h header, but we were linking in the MUSL code for ctype. This led to bugs where the glibc code in the ctype header was calling a MUSL function with the same name, but different semantics, which led to code not operating correctly. I want to make sure we don't have a similar problem here.

Just fixed the CI.

I'm not thrilled by forcing an inclusion of string.h.

Me too. But this is only way how we could avoid changing vendor code.
I am thinking, is it possible to have a CMakeList.txt on top of mbedtls 's CMakeList.txt to overrride some vendor code without touching the vendor folder


Rename master branch to main branch.

git now uses main as the default branch.

This is literally a non-issue, it does not matter. There is no reason to raise an issue about this.


Remove jbrequire usage and code style updates

This removes the usage jbrequire since it isn't needed with the current build system. It also splits the HelloView's stateModel into a separate file so that organizationally it's more like established JBrowse plugins. Also avoid a couple ts-ignores.

:+1:

we may want to make it clear somewhere that our ability to use imports is because of our specialized build system


Fix memoize: save argument only if function does not throw

Before, if by any chance, the fn function was to throw, the argument would have been saved into prevArg, resulting in returning value from the previous call if it was to be called again with the same argument after that.
Side note, I'm not sure if worth fixing it, but if arg is undefined on the first call, then if will match the initial prevArg and directly return value (which is also undefined). I don't think anything is preventing users from having an initial undefined state, might not happen a lot though. One easy way to fix it would be to create whatever object and assigning to let prevArg: AT = initialPrevArg; so that the strict equality can never yield true on the first call.

Thanks for the clear explanation!

Side note, I'm not sure if worth fixing it, but if arg is undefined on the first call, then if will match the initial prevArg and directly return value (which is also undefined). I don't think anything is preventing users from having an initial undefined state, might not happen a lot though. One easy way to fix it would be to create whatever object and assigning to let prevArg: AT = initialPrevArg; so that the strict equality can never yield true on the first call.

Great point, I think assigning an empty object would be reasonable, with a good comment.

Cool. I will do another pull request for the initial prevArg.


[Tools] Update .NET SDK Versions

Summary
The focus of these changes is to update the .NET SDK versions used in the pipelines to include the latest. This will allow testing on the current platform.

/check-enforcer override


infinite loop on seeing a folder on Windows

/cc @ethantkoenig Sorry for bothering you again. I tried to fix it, but couldn't.
To reproduce:

Have latest Gitea master on Windows
Import Gitea source code to the instance
Navigate to the routers/ folder in the web UI. Browser waits forever, theres a loop on the server

To debug I added the following line after this line:
fmt.Println(path)

Here's the output log

Hmm, definitely troubling that SHA1 hashes are being printed. Could you add the print statements I had you add last time (https://github.com/go-gitea/gitea/issues/1836#issuecomment-306053014)?

@ethantkoenig Here you go.

@andreynering Could you run the following command (from the root of the gitea repo you were testing on), and show me the output?
$ git log --pretty=format:%H --name-only -3 cd1821a7e292b05e04fcc2a969b42d06ab512849 -- routers\dev routers\org routers\init.go routers\install.go routers\home.go

@ethantkoenig Sorry for the delay.
It's empty. There's no output for this command.

@andreynering Weird. You ran the command on Windows, right?
The command that corresponds to the log line
logCommand: startHash=cd1821a7e292b05e04fcc2a969b42d06ab512849, state=&{entries:map[routers\dev:0x127fc640 routers\org:0x127fc900 routers\repo:0x127fc980 routers\user:0x127fca00 routers\init.go:0x127fc740 routers\install.go:0x127fc880 routers\admin:0x127fc540 routers\api:0x127fc5c0 routers\home.go:0x127fc6c0] commits:map[routers\api:0x12e9c000 routers\admin:0x12df89a0 routers\repo:0x12e29500 routers\user:0x12e4c1c0] lastCommitHash:cd1821a7e292b05e04fcc2a969b42d06ab512849 lastCommit:<nil> treePath:routers headCommit:0x12e9c000 nextSearchSize:128}

and the fact that the next log line is different indicates that when this ran in gitea, the output was not empty (becuase the lastCommitHash gets updated)

The UNIX equivalent (forward slashes instead of back slashes)
$ git log --pretty=format:%H --name-only -3 cd1821a7e292b05e04fcc2a969b42d06ab512849^ -- routers/dev routers/org routers/init.go routers/install.go routers/home.go

does not returns a non-empty output on Linux, so it must be something wrong with the formatting of the command for Windows? @andreynering Can you figure what's wrong with the formatting of the command I had you run?

@ethantkoenig I just tried with forward slash, and got the same output both on Linux and Windows:
8de8e11487ebd729d026c8a71adfa9ea6b926a69
routers/install.go

01d957677f160e4b5e43ce043b05e246493b34ea
routers/init.go

9d2b830275bf766b9f5e48e3be4b785dc1b2134a
routers/home.go

Git requires forward slashes on any OS.

@andreynering Just to confirm, so that we can fix this once and for all:

On Windows, when someone calls func (tes Entries) GetCommitsInfo(commit *Commit, treePath string), both the TreeEntry elements of tes  (in the TreeEntry.name attribute) and the treePath argument will use backslashes (\) as the file separator?
On Windows, the git log expects any argument filenames to use forward slashes (/) as a file separator, and the listed files will also use forward slashes (/) as the file separator?

On windows both ways seems to be working for me but in response there is always forward slashes:
git log --pretty=format:%H --name-only -3 cd1821a7e292b05e04fcc2a969b42d06ab512849^ -- routers/dev routers/org routers/init.go routers/install.go routers/home.go
8de8e11487ebd729d026c8a71adfa9ea6b926a69
routers/install.go

01d957677f160e4b5e43ce043b05e246493b34ea
routers/init.go

9d2b830275bf766b9f5e48e3be4b785dc1b2134a
routers/home.go

git log --pretty=format:%H --name-only -3 cd1821a7e292b05e04fcc2a969b42d06ab512849^ -- routers\dev routers\org routers\init.go routers\install.go routers\home.go
8de8e11487ebd729d026c8a71adfa9ea6b926a69
routers/install.go

01d957677f160e4b5e43ce043b05e246493b34ea
routers/init.go

9d2b830275bf766b9f5e48e3be4b785dc1b2134a
routers/home.go

git --version
git version 2.11.0.windows.3

@ethantkoenig

On Windows, when someone calls func (tes Entries) GetCommitsInfo(commit *Commit, treePath string), both the TreeEntry elements of tes (in the TreeEntry.name attribute) and the treePath argument will use backslashes (\) as the file separator?

I debugged again with print statements, and there ist'n any separators, just the folder or file name. Maybe this is the problem?
Browsing Gitea root (/) (no infinite loop):
entryName: .github
entryName: cmd
entryName: conf
entryName: docker
entryName: integrations
entryName: models
entryName: modules
entryName: options
entryName: public
entryName: routers
entryName: scripts
entryName: templates
entryName: vendor
entryName: .dockerignore
entryName: .drone.yml
entryName: .drone.yml.sig
entryName: .editorconfig
entryName: .gitattributes
entryName: .gitignore
entryName: .lgtm
entryName: CHANGELOG.md
entryName: CONTRIBUTING.md
entryName: DCO
entryName: Dockerfile
entryName: Dockerfile.rpi
entryName: LICENSE
entryName: MAINTAINERS
entryName: Makefile
entryName: README.md
entryName: README_ZH.md
entryName: main.go
TreePath:

Browsing Gitea's /routers, folder (infine loop right after the statements get printed):
entryName: admin
entryName: api
entryName: dev
entryName: org
entryName: repo
entryName: user
entryName: home.go
entryName: init.go
entryName: install.go
TreePath: routers

On Windows, the git log expects any argument filenames to use forward slashes (/) as a file separator, and the listed files will also use forward slashes (/) as the file separator?

As I have noticed, yes and yes. Maybe some versions also accept \, as @lafriks noted. In my computer it doesn't. I suggests using /, as it sems to work anywhere.
$ git version
git version 2.10.2.windows.1

@andreynering Sorry to keep bothering you, but could you show me the treePath for a nested directory (e.g. routers/admin).  I need to know if it's routers/admin or routers\admin

I'm away from my computer, but will check as soon as possible.

@ethantkoenig For visiting router/api/v1:
entryName: admin
entryName: convert
entryName: misc
entryName: org
entryName: repo
entryName: user
entryName: utils
entryName: api.go
TreePath: routers/api/v1

@andreynering Could you checkout https://github.com/ethantkoenig/gitea/tree/debug/get_commit_infos and let me know if it fixes your problem?

@ethantkoenig Sorry, not fixed. Still infinite loop.

@andreynering Added another change to the branch, try again?

@ethantkoenig 🎉 🚀 💯  Congrats. It's fixed now.
Here's the log if you are curious. I visited Gitea's root, then /routers/, and then /routers/api/v1/.


User.GetUsersFromIds is not working anymore

I have created a new project
Installed tweetinvi as a nuget package
Here a very simple application code
And  User.GetUsersFromIds returns nothing
But this one works User.GetUserFromId
        private void Button_Click(object sender, RoutedEventArgs e)
        {
            authUser();
            RateLimit.RateLimitTrackerMode = RateLimitTrackerMode.TrackAndAwait;
            var authenticatedUser = User.GetAuthenticatedUser();

            var friendIds = User.GetFriendIds(authenticatedUser.ScreenName, 99).ToList();

            var vrFr = User.GetUsersFromIds(friendIds.GetRange(0, 99));//does not work
            var cc = User.GetUserFromId(friendIds.First());//works
        }

Thanks for reporting this. It definitely looks like a bug that I will investigate.
Cheers,
Linvi

Hello,
I have tested it and everything works as expected. I do not know what you .GetRange() function is doing exactly but if you use .Take(100) from Linq everything works as expected.
Cheers,
Linvi


[Feature request] Change the command + 'A' to highlight behavior

This plugin is amazing so far!
One feature that would be nice is changing how command + 'A' works. Currently, all the text in the entire file is highlighted at once. In most other outliner apps, command + 'A' will first highlight the current block, then highlight the parent block progressively until it reaches the root of the tree structure. I'm not sure if this would be possible, but it would be much appreciated :)

@ShreyasKallingal good idea! I think I can do that.

@ShreyasKallingal Added CMD+A suport in https://github.com/vslinko/obsidian-outliner/releases/tag/1.0.4
RN it works only with current line and whole tree because it's easy to implement.
You can follow separate issue to be notified about highlighting of parent block https://github.com/vslinko/obsidian-outliner/issues/9

Wow, that was fast. Thank you very much!


[ast/sensor_ctrl] Turn ast_init_done_o to Mubi and remove flash/otp alerts from AST

This PR replaces PR "[ast/sensor_ctrl] Remove unused OTP/Flash alert signals https://github.com/lowRISC/opentitan/pull/14721"

Turn ast_init_done_o to Mubi, and
Remove flash/otp alerts from AST

@tjaychen @msfschaffner  @arnonsha @zi-v
Signed-off-by: Jacob Levy<EMAIL_ADDRESS>

This PR replaces PR "[ast/sensor_ctrl] Remove unused OTP/Flash alert signals #14721"

assigning myself to make sure I review.

I will take a look at the alerts part also today.

this lgtm, i'll merge it now and make the sensor_ctrl changes.

Thanks for making the changes, @Jacob-Levy. LGTM, too!


[BUG] analyzer-rpc server is returning absolute paths instead fo relative paths from the project root

We are seeing that analyzer-rpc server is returning absolute paths, and while we have a fix here we should track this down in the analyzer and fix it for real.

Hi @shawn-hurley ! I'm a new contributor, and I really liked the Konveyor project . I'd love to help out by solving this issue. Any advice for someone just getting started?

Hello @AdityaPandeyCN, glad to have you here!
To be honest, this one is going to be a little more challenging than a good first issue to get your feet wet in the project. There are a lot of different places in github.com/konveyor/analyzer-lsp that will have to be checked with a lot of edge cases on preserving behavior.
This might be an interesting to look at in the kai project: https://github.com/konveyor/kai/issues/478
I am going to go add some info there if that one looks interesting?


Fix various layout hint issues

Fixes #560. Also disables context menu freeze option on other locked columns (front/back). Added a check for columns listed in multiple layout hints which will display an error.
Instead of modifying the model columns (which caused the initial issue), the model now defines a starting list of moved columns. The list is derived from the layout hints. If a user makes more changes, they are simply added to the moved columns list. The model column order is left untouched. The model base moved columns will be useful for column groups via layout hints
When a user unfreezes a column, it is moved to just after the remaining frozen columns + front locked columns.
This may cause odd behavior in DHE PQs if the underlying table changes (but the original implementation would too). We should probably have some way of versioning PQ tables like we do for shared dashboards (if we don't already), because all other user modifications to a table would be incorrect if the underlying table changed.

Fixed an issue where the frozen columns were not being fetched if there were enough columns in the table that not all data is fetched when scrolling right

Discussion for V2 of Grid here: https://github.com/deephaven/web-client-ui/discussions/587


Added 2 options

To use private ip instead of public
allow for alternate databag file

Update the readme and this is good to go :)

Updated.

Merged and 0.0.34 released on pypi.


README.md has dead link

I noticed that you have a dead link in README.md
https://github.com/mrjono1/FastExcel/blob/master/FastExcelDemo/Program.cs

thankyou, for finding this, it has been fixed


Update fs2-core, fs2-reactive-streams to 2.5.7

Updates

co.fs2:fs2-core
co.fs2:fs2-reactive-streams

from 2.2.2 to 2.5.7.
GitHub Release Notes - Changelog - Version Diff
I'll automatically update this PR to resolve conflicts as long as you don't change it yourself.
If you'd like to skip this version, you can just close this PR. If you have any feedback, just mention me in the comments below.
Configure Scala Steward for your repository with a .scala-steward.conf file.
Have a fantastic day writing Scala!

Ignore future updates
Add this to your .scala-steward.conf file to ignore future updates of this dependency:
updates.ignore = [ { groupId = "co.fs2" } ]

labels: library-update, semver-minor

Superseded by #316.


get data ranges for missing types

Hi,I 'm learning how to generate random data in tflite benchmark.However,I met this confusing code , and it doesn't seem to include datatype of int32 or uint32 and so on , I guess maybe the code should be like this ？If not, could you complete the range setting for Int32  and Uint32? It 's really important to me, thanks!

Hi @alankelly Can you please review this PR ? Thank you!

Hi @alankelly Can you please review this PR ? Thank you!

Hi @alankelly Can you please review this PR ? Thank you!

Thanks for spotting this, this is definitely a bug. Since this is only used for benchmarking, it doesn't impact correctness but should nevertheless be fixed


Pls fix spelling

Describe the bug
A name of an absolete module is misspelled
Expected behavior
I expected spelling to be right
Screenshots

Setup (please complete the following information):

OS: [Windows 10]
ChatTriggers Version: [2.1.4]
Minecraft Version: [1.8.9]
Java Version: [Does it even matter for this bug]

Additional context
When switching servers a message was popping up telling me to delete a module "PeristentKeyBinds", there was no module with this exact name

This issue tracker is for issues with the mod. How modules function is the concern of the module author.


Optimize the interface for geting task list

Paging, filtering and sorting when manipulating db
Split updating task progress from getting task list

close #235


Node-webkit symbol lookup error: dns_sd_bindings.node

I did npm install nw, giving me version:
nw.js v0.12.0-alpha2
io.js v1.0.0
Chromium 41.0.2236.2
commit hash: e0d5ce6-d017875-34492e5-2e978ac-1116f2c-fd87c8d

My node is latest stable, built on Debian system.
drasko@Lenin:~/nw/test$ node -v
v0.12.0

When I try to run a simple discovery example, I am getting:
drasko@Lenin:~/nw/test$ ./node_modules/nw/nwjs/nw .
[22472:0208/170801:ERROR:browser_main_loop.cc(164)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.
ATTENTION: default value of option force_s3tc_enable overridden by environment.
/home/drasko/nw/test/node_modules/nw/nwjs/nw: symbol lookup error: /home/drasko/nw/test/node_modules/mdns/build/Release/dns_sd_bindings.node: undefined symbol: _ZN2v88Template3SetENS_6HandleINS_6StringEEENS1_INS_4DataEEENS_17PropertyAttributeE
drasko@Lenin:~/nw/test$

Apologies for not responding.
FWIW, this was most likely caused by building with one version of node (or node-webkit) and then plugging it into a different version. Always do clean rebuilds and manage your versions carefully.


[SwipeableDrawer] Ignore open swipe if it didn't start on the swipe area

Same as #15038, but for next. Fixes #15035.

[x] I have followed (at least) the PR section of the contributing guide.

@leMaik Well done 💯


cors calls not working

When I do a window.fetch call inside a stoy, I get a cors error.
Please provide issue details here - What did you expect to happen? What happened instead?
When I do the following call inside a story:
  fetch(
    'https://maps.googleapis.com/maps/api/place/autocomplete/json?input=Vict&types=(cities)&language=pt_BR&key=[somekey]'
  )
    .then(r => r.json())
    .then(r => console.log(r))

I get:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://maps.googleapis.com/maps/api/place/autocomplete/json?input=Vict&types=(cities)&language=pt_BR&key=[my_key]. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).

TypeError: NetworkError when attempting to fetch resource.

I expected storybook dev server to allow CORS calls either by default or by configuration.
I tried to add the following content to .storybook/webpack.config.js
module.exports = (baseConfig, env, defaultConfig) => {
  defaultConfig.devServer = {
    ...defaultConfig.devServer,
    headers: {
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, PATCH, OPTIONS',
      'Access-Control-Allow-Headers':
        'X-Requested-With, content-type, Authorization',
    },
  }

  return defaultConfig
}

but it doesn't affect the result at all.

@storybook/react ^3.3.15

@storybook/addon-options/register ^3.3.15

Firefox and Chrome on Ubuntu.

Hi @marcusnielsen; sorry if I am being dense but isn't it the maps.googleapis.com server that would need to enable cors?
I think you just need to pass { cors: true } to your fetch request..

@tmeasday welcome to the club of not trying to be dense about cors :-D
I think you are 100% correct. After reading your comment, I searched for some clues and found: https://stackoverflow.com/questions/30178359/how-to-enable-cors-for-google-places-api .
It basically says that their web API doesn't do cors. Yay.
I got a twitter tip on this as well, telling me to proxy through cors anywhere like this: https://cors-anywhere.herokuapp.com/https://maps.googleapis.com/maps/api/place/autocomplete/json?input=Vict&types=(cities)&language=pt_BR&key=[my_key]. I'll keep it for now, and then proxy through our own server.
Thank you so much for replying, this has driven me crazy over the past week <3


feat: override full modsecurity.conf file

move all variables from modsecurity-override.conf to modsecurity.conf
add extra variables to configure modsecurity.conf params
update README with new variables
use only curl and remove wget usage (consistency)

Fixes #234

No comments from @dune73 or @airween. Will merge by EOD.

This pull request broke my setup using nginx-alpine.
To fix it I had to force the following values inside my docker compose:
      MODSEC_AUDIT_STORAGE_DIR: /var/log/modsecurity/audit/
      MODSEC_DISABLE_BACKEND_COMPRESSION: 'Off'
      MODSEC_UPLOAD_KEEP_FILES: 'Off'

The first one seems due to a typo - MODSEC_AUDIT_STORAGE_DIR is used by the new file, but the environment variable that is used for the default value is MODSEC_AUDIT_STORAGE.
The second one doesn't seem to have a default value.
The third one would complain that RelevantOnly was not a valid value, and it needed On or Off.


improved footer

changed footer
issue: [#7 ]

@patel-atul Footer which you have made is awesome.
You have to make just few changes,

Use the same font which is used in the website
Footer which you have made is only showing on home page, it should show on every page.

@swapnilsparsh Made changes you have requested please have a look at it.

@swapnilsparsh Made changes you have requested please have a look at it.

Made all the changes requested.

Made all the changes requested.

Made all the changes requested.

Made all the changes requested.

@swapnilsparsh  I have not changed anything in developers page it was already like that i have only linked the page in footer and also I dont know how to fix this.

@swapnilsparsh  I have not changed anything in developers page it was already like that i have only linked the page in footer and also I dont know how to fix this.

@swapnilsparsh  I have not changed anything in developers page it was already like that i have only linked the page in footer and also I dont know how to fix this.

If you dont fix this then I can't merge your PR.

@swapnilsparsh  I have not changed anything in developers page it was already like that i have only linked the page in footer and also I dont know how to fix this.

If you dont fix this then I can't merge your PR.

@swapnilsparsh I have no know knowledge of python or django. I can only do frontend. I have tried some solutions from stack overflow but didn't work please help me.

@swapnilsparsh I have no know knowledge of python or django. I can only do frontend. I have tried some solutions from stack overflow but didn't work please help me.

@swapnilsparsh I have no know knowledge of python or django. I can only do frontend. I have tried some solutions from stack overflow but didn't work please help me.

You have to link the file then your problem will resolve

@swapnilsparsh I have no know knowledge of python or django. I can only do frontend. I have tried some solutions from stack overflow but didn't work please help me.

You have to link the file then your problem will resolve

Shall I give it a try @swapnilsparsh

Shall I give it a try @swapnilsparsh


Bug in Prefetched Relay Node Querysets When No Explicit Pagination Filters Are Passed

I have read the docs thoroughly before making this bug report.

[X] Yes

I have read through other open issues, and my issue is not a duplicate.

[X] Yes

What version of the library you are using?
0.2.0
Which python version are you using?
3.12
What operating system are you on?
Mac
Description
When querying a nested Relay Node and not passing any explicit pagination args, the prefetched queryset is not being filtered by page size.
More concretely, in a query like this:
query {
  pagedPropertyManagers {
    edges {
      node {
        id
        housingCompanies {
          edges {
            node {
              name
              id
            }
          }
        }
      }
    }
  }
}

The prefetched queryset of housingCompanies is not limited because no pagination args are being passed. This is because of this conditional block:
https://github.com/MrThearMan/graphene-django-query-optimizer/blob/770b6599fb040543e938b4b9eb09bbf77a124b9b/query_optimizer/optimizer.py#L137-L139
which evaluates to True because the pagination_args here (for housingCompanies) is:
{'after': None, 'before': None, 'first': None, 'last': None, 'size': None}

To me, this is incorrect behavior. If no pagination args are given, only the first graphene_settings.RELAY_CONNECTION_MAX_LIMIT entries must be prefetched. Right now, all housingCompanies for the given propertyManager are being prefetched.
In my specific use case, my nested node has 2k+ entries for each parent node while the page size is 100, so the total response time ends up being extremely long despite doing the optimal no. of SQL queries.

Quickest Way To Reproduce
I can confirm for sure is that excessive elements are being prefetched. I debugged this by setting graphene_settings.RELAY_CONNECTION_MAX_LIMIT to 1, and adding a print statement below the following line:
https://github.com/MrThearMan/graphene-django-query-optimizer/blob/770b6599fb040543e938b4b9eb09bbf77a124b9b/query_optimizer/cache.py#L114-L120
logger.debug(f"Adding {selected.count()} prefetched items of type '{selected.model}' to cache")

Since in my test data, most propertyManagers had more than 1 housingCompanies associated, it was easy to catch.
Commenting out the problematic code block alleviated the issue (ofc, that isn't a feasible solution because we want that for list fields)

Thoughts on Solutions
I'm not sure the best way to do this, but if there were a way to indicate that this is a connection field and not a list field, this should be straightforward to bypass (in theory)
But the calling site of this function (self.compile_prefetch) doesn't seem to have that info, and I'm not sure what the best way to pass that information down is. On the other hand, I may also be misunderstanding how the info is flowing, so I'm curious to hear your thoughts :)

Yep, this is a oversight on my part. I added that check for normal list fields, but it doesn't quite work like I expected for connection fields. There might be a way to get this to work by changing how get_filter_info works, I'll have a look.

Should be fixed now. Released in 0.2.2


Easy way to include icons in list_display?

Obvious way is to add the css link to your admin base_site.html and write a method each model or model admin to render as_html.
I'm trying to think of a more elegant way that requires less configuration.

Hi @andybak !
I know it's an old topic but did you find anything about this ? 😃


ShadyDOM + ShadyCSS + dom-repeat + appendChild

Description
When using appendChild inside of an element that is placed using dom-repeat, the ShadyDOM scoping on the appended child is incorrectly applied at the parent element's parent rather than the direct parent.
Live Demo
http://jsbin.com/copevoxeci/edit?html,console,output
Steps to Reproduce

Create a parent element that uses dom-repeat to place child elements.
Have those child elements .appendChild elements into themselves either via this.shadowRoot or a cached element in the template.
See the incorrect scope being applied.

Expected Results
<my-element-parent class="style-scope my-element-parent">
    <my-element class="style-scope my-element-parent">

    </my-element>
    <dom-repeat class="style-scope my-element-parent" style="display: none;"></dom-repeat>
</my-element-parent>

Actual Results
<my-element-parent class="style-scope my-element-parent">
    <my-element class="style-scope my-element-parent">

    </my-element>
    <dom-repeat class="style-scope my-element-parent" style="display: none;"></dom-repeat>
</my-element-parent>

Browsers Affected

[ ] Chrome
[x] Firefox <-- confirmed
[x] Edge <-- here and below assumed based on ShadyDOM usage
[x] Safari 9
[x] Safari 8
[x] IE 11

Versions

Polymer: v2.2.0
webcomponents: v1.0.17

I can corroborate this is a problem. Attached is a screenshot of our DOM after this exact same scenario. The classes are applied to the elements, but styles are not registered in the browser for the elements. If I stamp a single element to the DOM outside of the context of a dom-repeat, it renders as expected.


Setup formbuilder-languages as npm module

:tada: This PR is included in version 1.0.0 :tada:
The release is available on:

npm package (@latest dist-tag)
GitHub release

Your semantic-release bot :package::rocket:


add charge correction ordering test

Added test for #18 #17 which has been fixed.
Note that I have also included tests for freysoldt and LOCPOT.gz are included. If we don't want to test fresoldt then they can be removed. This should be decided before merging as LOCPOT.gz files are rather large in size.

Thanks very much for this @zhubonan, and sorry for the delay in getting to it (I wanted to have the new updated version of doped ready, so I could then go through this when revamping and rechecking the new corrections implementation).
Now merged to develop


examples: comment the usage of process.nextTick

Usage of process.nextTick() was confusing some newbies like me, after getting answered in #2903, I commented the respective examples' code.

Awesome, thanks!


REQUEST: can you please add virtual navigation

can you please add an option for virtual navigation ?? i'm using gesture navigation mode on my MIUI 10 .. it's very hard to draw those gestures with mouse or touch-pad and i don't want to switch from full-screen mode on my phone. thanks in advance :)

You can try
CTRL + b for back button
CTRL + h for home button
CTRL + m for menu/recent apps
CTRL + n for notification panel
I find those commands very handy and I just miss the swipe commands (up, right and left) which are mandatory for some apps.

@Lucaacer not really. I'm using mouse to control scrcpy most time, and these shortcuts are a little hard to push using only left hand 😂

Right-click for BACK
Middle-click for HOME

Ref #7

Thanks, but what about ctrl-m?

Just my 2 cents. I would totally add some virtual navigation button, like the official android emulator does. I have a logitech mouse and my middle click is remapped, so I can't press the home button easily. Even using a touchpad or the apple magic mouse I'm not really sure you can "middle click". So the 3/4 virtual nav button would (maybe with an option to enable/disable them) would be really appreciated. If you're interested I can write the code on my own and make a pull request, but I won't do that if that's not something you're considering to merge (honestly I don't want to maintain a fork, so I won't do that if that will not be merged)
(PS: I'll be able to work on that in 2 weeks or so anyway)


Mini games plugin

who has never dreamed of playing snake or flappy bird in the gmod menu ?, frankly a plugin filled with mini games could be very fun

The original menu plugin repo already has a Snake plugin you can use. It's compatible with MPR and once installed, it will appear as a "Legacy plugin."
As for adding other mini games, that's not something I'll do. If you want to write some and open a Pull Request, then I'll accept it.

The original menu plugin repo already has a Snake plugin you can use. It's compatible with MPR and once installed, it will appear as a "Legacy plugin." As for adding other mini games, that's not something I'll do. If you want to write some and open a Pull Request, then I'll accept it.

Thanks for the link I added it, I can finally play in a game in a game !


Hmac SHA512 not working on EXMO

Hello again, so now i've tried to apply this hashing methods - Hmac and SHA512 to work with the authenticated API access my account on EXMO,  https://exmo.me/en/api  it seems i've done all right, but it is not working at all - EXMO server always gives me error:

1
200
connection	close
access-control-allow-headers	Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Key, Sign
content-type	application/json; charset=utf-8
strict-transport-security	max-age=604800
content-length	81
server	nginx
access-control-allow-credentials	true
access-control-allow-methods	POST, GET, OPTIONS, PUT, DELETE
date	Sun, 20 Oct 2019 09:48:24 GMT
Response body:
{"result":false,"error":"Error 40005: Authorization error, Incorrect signature"}

So my code looks like this:
ssl = require("ssl")
http = require("socket.http")
https = require("ssl.https")
socket = require("socket")
ltn12 = require("ltn12")
hashings = require("hashings")

api_key = "myopenkey"
api_secret = "mysecretkey"

x = tostring(math.modf(os.time()*1000))

hs = hashings.hmac(hashings.sha512, api_secret)
hs:update(x)
sign=hs:hexdigest()

local request_body = "nonce="..tostring(x)
local response_body = {}

local res, code, response_headers = https.request{
    url = "https://api.exmo.com/v1/user_info/",
    method = "POST",
    headers =
      {
          ["Content-Type"] = "application/x-www-form-urlencoded",
          ["Content-Length"] = #request_body,
		   Key=api_key,
		   Sign=sign
      },
      source = ltn12.source.string(request_body),
      sink = ltn12.sink.table(response_body),
}

print(res)
print(code)

if type(response_headers) == "table" then
  for k, v in pairs(response_headers) do
    print(k, v)
  end
end

print("Response body:")
if type(response_body) == "table" then
  print(table.concat(response_body))
else
  print("Not a table:", type(response_body))
end

EXMO posted examples to access their API on many languages -
https://github.com/exmo-dev/exmo_api_lib
I've tried their example on python2:
import httplib
import urllib
import json
import hashlib
import hmac
import time

api_key = "your_key"
api_secret = "your_secret"

nonce = int(round(time.time()*1000))

params = {"nonce": nonce}
params = urllib.urlencode(params)

H = hmac.new(api_secret, digestmod=hashlib.sha512)
H.update(params)
sign = H.hexdigest()

headers = {"Content-type": "application/x-www-form-urlencoded",
           "Key":api_key,
           "Sign":sign}
conn = httplib.HTTPSConnection("api.exmo.com")
conn.request("POST", "/v1/user_info", params, headers)
response = conn.getresponse()

print response.status, response.reason
print json.load(response)

conn.close()

and python3 also, and it was working without any problem - no any error messages and quick access to account
So it seems that one of your algorithms - Hmac or SHA-512, or both, has some differences from implementation of this algorithms in many languages

You're calculating the HMAC using different data types. Lua you're using the nonce as a string as the data. In Python you're using a dict with a string key and integer value as the data. You need to work with EXMO to determine exactly how the payload data needs to represented when passed to the hashing library.

Lua you're using the nonce as a string as the data. In Python you're using a dict with a string key and integer value as the data

Yes!  I overlooked this! I passed nonce to update() in lua code immediately after calculating it as a numeric value converted to string:
x = tostring(math.modf(os.time()*1000))
hs = hashings.hmac(hashings.sha512, api_secret)
hs:update(x)
So the x is the numeric string like as '3453345345'
but in Pyhton code nonce, after calculating its value and converting into string, concatenating with the string "nonce=" so the final string that passed to update() looks like this:
"nonce=3453345345"
So i fix this in Lua code to:
params = "nonce="..tostring(math.modf(os.time()*10000))
hs = hashings.hmac(hashings.sha512, api_secret)
hs:update(params)
But it not worked at once, one else thing was need to fix:
in python string sign was exist only from lower-case symbols like this:
e998231bbf544c09de83a1a738febfa64351d91c58067905cbac23dc18f3892541ebee57d08521095bfff10644276b26b9e2a5d3376fbcb0c3fe6d474ad54439
but your function hexdigest()  returns always upper-case symbols,
so i fixed this by:
sign=string.lower(hs:hexdigest())
and after that it worked! I accesed to my EXMO account!!!!
But one else question: why calculation  of HMAC SHA512 in your lua-hashings library is so slow?
it takes about several minutes, but in python, on the same computer, this algorith calculated almost at once, calculation takes about several seconds.
Why is such difference?

But one else question: why calculation of HMAC SHA512 in your lua-hashings library is so slow?
it takes about several minutes, but in python, on the same computer, this algorith calculated almost at once, calculation takes about several seconds.
Why is such difference?

Python's crypto operations are native code and are written in C, which makes them much faster. My library is pure Lua which is why it's so much slower.
Reason 1: Most crypto algorithms rely on fixed size unsigned integer wrapping behavior and Lua only has 1 size integer, signed 64 bit (default but can be compiled with different sizes). lua-num (also my library) which is also a pure Lua library is used to emulate fixed size integers of various sizes and integer wrapping. Emulating this behavior is slow.
Unsigned 64 bit integers is the slowest because no native code like optimizations are available. Integer wrapping for an unsigned 32 bit integer can be emulated using Lua's 64 bit integer. The integer itself and operations like bit shifting is fast because it's the native type.
An unsigned 64 bit integer with wrapping support cannot be contained in a singed 64 bit integer. lua-nums needs to use the big num type underneath which makes calculations very slow. Native operations like bit shifting isn't available and needs to additionally be emulated.
You called out SHA512 which uses unsigned 64 bit integers. Making SHA512 a very slow algorithm in pure Lua. If you used SHA256 it would be faster. But still slow because emulation of integer wrapping is still required.
Python's crypto written in C doesn't have do this emulation.
Rason 2: C compilers are able to detect and optimize many crypto operations and some processors have acceleration for certain crypto. For example, x64 processors have the aes-ni instructions which further accelerates AES encryption. Anything written in Lua isn't able to take advantage of processor level optimizations. Python's C crypto code being compiled can benefit from compiler optimizations.
Making it faster: A Lua crypto wrapper around something like OpenSSL would calculate a HMAC SHA512 almost instantly because the Lua code is calling an optimized C library. However, lua-hashings was written in pure Lua so C libraries are not needed. It's portable to any system that runs Lua because no native code needs to be compiled. There is no worry about X library working or not working or needing to be installed on the system for this library to work.

I guess about it, much thanks for your reply and your great work! ))


Spire Agent doesn't support cgroupsv2 for docker workload attestor plugin

Client's attestation isn't a security concern but more of a practical concern since a client cannot retrieve anything from the vault (write only policies).
Still, attesting clients' workloads makes harder for a user to spoof it's client identity. In order to do that, we currently leverage spire docker plugin, which provides a good way of making sure that the workload running runs inside of one of the HPCS-provided images.
This docker plugin makes usage of cgroupsv1 /proc/PID/cgroups which provides informations about the container, etc.
This behaviour has been modified in cgroupsv2 and this file doesn't provide anymore the needed informations. This way, docker plugin's functions are broken.
see : https://github.com/spiffe/spire/issues/4682
and : https://github.com/spiffe/spire/pull/4251

Current mitigation :
UNIX plugin provides the possibility to use the SHA256 of the binary calling the workload API as a selector for SVIDs. On standard LINUX systems, it allows us to make sure that the program fetching the workload API is the binary we've put inside of the HPCS containers.

On Mac, docker is not natively supported, causing docker containers to run inside of a VM/microVM. This results in a replacement of those calling binaries. f.e :
time="2024-03-22T09:39:01Z" level=debug msg="PID attested to have selectors" pid=66 selectors="[type:\"unix\" value:\"uid:0\" type:\"unix\" value:\"user:root\" type:\"unix\" value:\"gid:0\" type:\"unix\" value:\"group:root\" type:\"unix\" value:\"supplementary_gid:0\" type:\"unix\" value:\"supplementary_group:root\" type:\"unix\" value:\"supplementary_gid:1\" type:\"unix\" value:\"supplementary_group:bin\" type:\"unix\" value:\"supplementary_gid:2\" type:\"unix\" value:\"supplementary_group:daemon\" type:\"unix\" value:\"supplementary_gid:3\" type:\"unix\" value:\"supplementary_group:sys\" type:\"unix\" value:\"supplementary_gid:4\" type:\"unix\" value:\"supplementary_group:adm\" type:\"unix\" value:\"supplementary_gid:6\" type:\"unix\" value:\"supplementary_group:disk\" type:\"unix\" value:\"supplementary_gid:10\" type:\"unix\" value:\"supplementary_group:wheel\" type:\"unix\" value:\"supplementary_gid:11\" type:\"unix\" value:\"supplementary_group:floppy\" type:\"unix\" value:\"supplementary_gid:20\" type:\"unix\" value:\"supplementary_group:dialout\" type:\"unix\" value:\"supplementary_gid:26\" type:\"unix\" value:\"supplementary_group:tape\" type:\"unix\" value:\"supplementary_gid:27\" type:\"unix\" value:\"supplementary_group:video\" type:\"unix\" value:\"path:/usr/bin/qemu-x86_64\" type:\"unix\" value:\"sha256:3fc6c8fbd8fe429b67276854fbb5ae594118f7f0b10352a508477833b04ee9b7\"]" subsystem_name=workload_attestor

We currently have no mitigation for that