Update event-hubs-kafka-connect-tutorial.md

throwing error "Couldn't resolve server bpborders.servicebus.windows.net:9093 # e.g. namespace.servicebus.windows.net:9093" by ignoring the # in the same line, so moving on top

#sign-off


Admins can't see 'Share My Work' if registered users are removed from default admin set

Descriptive summary
Removing ‘registered users’ from the default admin set will remove the Share Your Work button for everyone, including admins.
[ observed in  Hyku v1.0.0.beta1 ]

I believe #1142 will address this.

The button is removed if the current user does not have permission to create works in any admin set.  It is not specific to the default admin set or the "registered users". I believe this is appropriate behavior.

Yes I think the registered bit is a red herring, the problem is down to the admin not being a 'manager' as noted by @mjgiarlo :point_up: ... I'll close


Python-debug mode via sympy.lambdify

The new 3.0 Operator class unfortunately did not feature a Python-debug mode any more. Since this, however, can be quite a useful feature during development, we should re-instate it soon. For this we can use  the new internal Operator hierarchy and combine the automatic argument derivation routines with sympy.lambdify to provide a fully automated front-end to the SymPy JIT capabilities.

Closing due to lack of demand.


Consolidate getOrder as "element order" and implement getRepOrder for general and NVIDIA layouts

This partially reverts commit 38a11b859fff79ea214256d3f1cfe43d54e36c2c.
Supersedes https://github.com/triton-lang/triton/pull/5085
It also documents that we are implicitly choosing a way to tile a
full tensor depending on the layout. See https://github.com/triton-lang/triton/pull/5085#issuecomment-2460925683

@lezcano Can you add a lit test from my PR here, to make sure store vectorization happens and so we don't break it again accidentally in the future?

Added the lit test!


Add support for chanfok_ceiling_fan_light.yaml to devices.

The file Carro PN-04F02D gets detected for this setup each time, but there are differences between the files so created a custom one.
DP: {"1":"Switch 1","9":"Countdown 1","20":"light","21":"Light mode","22":"Brightness","23":"Color Temperature","24":"Test Bit","28":"Control Data","38":"Relay status","42":"Random time","43":"Cycle time","60":"Fan switch","61":"Fan Mode","62":"Wind Speed Level","63":"Direction Fan","66":"Voice"}
Detail: CHANFOK 20'' Smart Ceiling Fans With Lights Compatible with Alexa and Google Assistant, Low profile with Light and Remote, APP Control, 6-Speed Reversible Blades for Bedroom
Amazon link to the product

This is a duplicate of chanfok_fan_light.yaml, which already exists.


Apply new project base from change-project-base

As discussed with @ebrehault , I've clean up a bit the repo and updated tooling and base and fixing live reload for demo project, etc...
Still can be improved, I allow changes directly on the pull request so we can move faster with validating it and starting to fix issues again.

You did a great job ! :+1:
Post-approved :tongue:


Support for decommissioning and recommissioning a zone

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
Describe the solution you'd like
A clear and concise description of what you want to happen.
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
Additional context
Add any other context or screenshots about the feature request here.

@Bukhtawar Can you provide some details and additional context? We'll need more context the the title provides.

@Bukhtawar Can you provide more details ?


Use semistandard JS style

Currently, we don't have a defined coding style for our JavaScript source files. I propose we use straight semistandard. I've grown to like it over the past year and think it would be good to use.
Here's a quick and dirty summary of the semistandard style:

Two spaces for indentation
Semicolons
Space between function keyword and parameters
Single quote strings
No unnecessarily quoted property names (e.g. { key: 'value', 'data-thing': 1 })
Use dot notation for non-quoted property names (e.g. obj.key, obj['data-thing'])
Spaces between brackets for objects and arrays (e.g. { |...| }, [ |...| ])
Use let over var
Use const keyword for non-reassigned variables
Space between //, /*, and */ and comment text
Single-expression if statement bodies go on the same line (e.g. if (foo) bar = 'baz';)

There are a couple of other style changes I wish to declare (which aren't a part of semistandard):

Use descriptive variable names
Add more comments (capitalized & punctuated)

#316 begins enforcement of a style based on semistandard.


Update developer-driven evolution doc with guidance on distributed tracing

In grow-up scenarios, convenience layer will call protocol method. Both of them might need to have a diagnostic scope. We need to decide what the scope should be like. See whole conversation here:
https://github.com/Azure/azure-sdk-for-net/pull/27363#discussion_r822152875

Guidance will be determined in resolution of https://github.com/Azure/autorest.csharp/issues/2127

Guidance is here: https://github.com/azure/autorest.csharp/issues/2127#issuecomment-1086127240

@AlexanderSher/@annelo-msft  , as you are working on this feature, could you help to work on the document for it?

Per @lmazuel and @KrzysztofCwalina, GA requirement is for partner docs is only "how to create the MVP".  That makes this issue something we can bring in after v1.0.

We need to put the below information from @lmolkova:
We can't update DiagnosticSource version if we want to stay compatible with older Functions V2 (and maybe even v3) runtimes.
However, everyone who uses tracing via OpenTelemetry or supported version of Application Insights SDK would have DiagnosticSource 5.0.0 or higher. AppInsights deprecated version that uses old DiagnosticSource  ~2 years ago.
I.e. in user apps, where DS version is resolved to 5.0.0+ as tracing SDK dependency, suppression would just work.
Users who don't use tracing don't care about suppression at all.
So, my suggestion is to do neither and only document that suppression does not work on old DS versions.


Do we need a purge?

After I've implemented keeping claims data after you run porter uninstall, there isn't a good way to uninstall a bundle then reinstall it with the same name and start over without keeping all the old history (and maybe some buggy data that you were trying to get rid of).
Do we need a command to delete the data for an installation so that you can move on with your life? 😂

+1!  porter kondo <installation name> ?

No, this bundle does not bring me joy. 🔥

Perhaps a flag particular to porter uninstall?  Like --force or --force-remove, etc.?

I was thinking about that. Let's say that you uninstalled it without that flag weeks ago and now you want to cleanup the data. Running porter uninstall --force would perhaps give people incorrect expectations because we wouldn't execute uninstall again (or shouldn't?). We just want to remove the data from porter.
How about a primary command that removes porter data for a bundle, and a flag for uninstall that will call that command for you when you uninstall?
Scenario A - You were on the ball and knew that you wanted to remove everything when you uninstalled
$ porter uninstall --delete wordpress
uninstall wordpress
delete all data for wordpress

Scenario B - You didn't realize you wanted to remove all the data until much later
$ porter uninstall wordpress
uninstall wordpress

# weeks pass

$ porter installation delete wordpress
delete all data for wordpress

Scenario C - You have mightily screwed up the bundle and need to make it go away, you can't even get uninstall to work
$ porter uninstall --delete wordpress
uninstall failed!
skipping tidy, it's not safe

$ porter installation delete wordpress --force
delete all data for wordpress

Alternatives for delete which may be a bad word that would be confused with uninstall:

forget
purge
expunge

Thanks for providing the list of valid scenarios; very helpful.  I like it.  I don't have an issue with delete.  It seems to carry enough differentiating behavior from uninstall.  (uninstall to uninstall the bundle, though the installation record(s) shall remain; delete to delete all record(s) of the installation`.)
One follow-up Q: If porter installation delete <installation> is invoked on an installation whose last result action isn't uninstall, should it error out? Or call uninstall behind the scenes and proceed?  (Maybe the former if --force isn't included; maybe the latter if it is?)

I was thinking that by default the delete command needs to be safe and only remove records if the last command was uninstall and the uninstall was successful. Otherwise they need to use porter installation delete --force.
For porter uninstall --delete the --force flag already means something else, it means to force pull the tag if it was already cached. We use that flag for anything that supports --tag. I guess that's the problem with using a very generic word to modify another flag's behavior... Oops, we probably should have called it --repull or something that like.
But for this case, maybe we have two flags on porter uninstall: --delete and --force-delete? --delete will be the safe flag it won't delete if the uninstall fails (giving you a chance to retry it). --force-delete will remove it no matter what.

I'll pull this in, working off of Carolyn's design mentioned in https://github.com/deislabs/porter/issues/1163#issuecomment-664531659 and https://github.com/deislabs/porter/issues/1163#issuecomment-664586962


Attach BottomBar to fragment

I'm not sure if it is a issue but It doesnt seem possible to attach the bottombar to a fragment.
When trying to do so i get this exception:
java.lang.IllegalStateException: The specified child already has a parent. You must call removeView() on the child's parent first.

Please see #183


Crash on server start

Server comes to a crawl then crashes once i start it.
Minecraft: 1.12.2
Sponge: 7.1.5
GriefPrevention: <IP_ADDRESS>9
Crash log here https://pastebin.com/s6AG6tzd

GP <IP_ADDRESS>9+ requires SpongeForge 7.1.6 RC3610+(Or SpongeVanilla 7.1.6-RC156+). As of this post, SpongeForge 7.1.6 RC3616(Or SpongeVanilla 7.1.6-RC156) is what we recommend using, and like always the latest GP version available.


Replace Stack with ArrayDeque

Stack has synchronization overhead that's not required in the
NodeOperationTreeGenerator.

Codecov Report

Merging #4905 into master will decrease coverage by -0.12%.
The diff coverage is 100%.

@@             Coverage Diff              @@
##             master    #4905      +/-   ##
============================================
- Coverage     82.19%   82.08%   -0.12%
+ Complexity    10692    10672      -20
============================================
  Files          1294     1294
  Lines         44523    44523
  Branches       5629     5629
============================================
- Hits          36597    36548      -49
- Misses         5298     5331      +33
- Partials       2628     2644      +16

Impacted Files
Coverage Δ
Complexity Δ

...io/crate/executor/transport/TransportExecutor.java
93.95% <100%> (ø)
6 <ø> (ø)
:x:

...n/java/io/crate/exceptions/JobKilledException.java
0% <ø> (-66.67%)
0% <ø> (-1%)

...arch/indices/recovery/BlobStartPrefixResponse.java
66.66% <ø> (-33.34%)
3% <ø> (-2%)

...ration/collect/collectors/OrderedDocCollector.java
75% <ø> (-25%)
5% <ø> (-2%)

...o/crate/analyze/SafeExpressionToStringVisitor.java
83.33% <ø> (-16.67%)
7% <ø> (-1%)

...crate/executor/transport/TransportShardAction.java
77.5% <ø> (-12.5%)
8% <ø> (-1%)

...eration/projectors/ColumnIndexWriterProjector.java
73.33% <ø> (-8.89%)
7% <ø> (-1%)

...io/crate/protocols/postgres/types/VarCharType.java
91.66% <ø> (-8.34%)
10% <ø> (-1%)

...ate/operation/projectors/SortingTopNProjector.java
90% <ø> (-5%)
13% <ø> (-1%)

.../java/io/crate/blob/TransportDeleteBlobAction.java
75% <ø> (-5%)
5% <ø> (-1%)

... and 21 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d87d028...837ab08. Read the comment docs.


test: add cypress e2e

What changes this PR introduce?
Add End To End (e2e) automated tests thanks to cypress.

:tada: This PR is included in version 1.3.5 :tada:
The release is available on GitHub release
Your semantic-release bot :package::rocket:


[ParserFactory] Ability to handle CREATE TRIGGER multi semicolons

As a user, I would like to be able to use the CREATE TRIGGER statement which can contain multiple semicolons. ParserFactory currently splits in the semicolon as a delimited to differentiate between each query. Add support for BEGIN and END; statements.

Note, avoid delimiting via GO statement. As this would not be optimal and it is not Sqlite cimmand.
// split script on GO command
System.Collections.Generic.IEnumerable<string> commandStrings = Regex.Split(script, @"^\s*GO\s*$",
                         RegexOptions.Multiline | RegexOptions.IgnoreCase);


add Dart_SDK project library to examples that don't have it

This ensures that when someone opens the project using IDEA,
the Flutter plugin will find the location of the Flutter SDK
and automatically run "flutter packages get".

I verified that opening these examples works and the Dart code is analyzed correctly, but some of them don't actually run for me. (I'm not familiar with them but they seem to be testing native code.)


A placeholder localhost URL in place for the Server buttons

concore editor is developed as a front-end for concore. However, currently, there is no seamless integration between the concore-editor and concore deployment. Currently, these server buttons (Build, Debug, Run, Clear, Stop, Destroy) do not do anything when clicked. Adding a sample URL from a localhost execution of concore FRI will provide a first step towards the integration with concore backend.
To identify and understand the concore APIs, please check the test.py provided as part of concore FRI. Concore FRI (File Receiver Interface) functions as a python interface to expose concore methods as REST APIs.
To test this locally and implement it, one must perform the below steps:

install concore following the installation guidelines.
install concore editor., following the README.
Run concore FRI as the backend following the README.
Test and confirm that FRI runs successfully through the test.py method as indicated in the README.

Following the above steps, once the concore FRI runs, implement a similar strategy (similar to how test.py functions as a client for FRI) with concore editor in Javascript (React or a similar framework).

hi @pradeeban  I would like to contribute in this project and be part of your GSOC projects this year can u please guide me

Hi and welcome, @parteekcoder. Please go through the README and previous discussions, also in https://github.com/NISYSLAB/Emory-BMI-GSoC/.

Yeah can u please assign me some work so that I can understand better

Please feel free to attempt the open bugs.

But there are not many issues ,may be u can suggest some improvements if want

@pradeeban  is this issue still open to solve

as there is already an PR for this issue

Yes, there is a PR on this that is currently open.
I recommend #58 or #45 instead.

@pradeeban this issue can be closed after reviewing.

Thanks, @Rahuljagwani, for your contributions. Closing this issue now.


SCIM2 Filtering is not supported with the schema attribute

Request : curl -v -k --user admin:admin https://localhost:9443/scim2/Users?filter=schemas+eq+"urn:ietf:params:scim:schemas:core:2.0:User"
Response : {"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"scimType":"invalidValue","detail":"Not a valid attribute name/uri","status":"400"}
Quoted from the spec
"The following are examples of valid filters."
"filter=
schemas eq "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
The above filter should be supported from wso2 IS

This issue is being closed due to extended inactivity. Please feel free to reopen it if further attention is needed. Thank you for helping us keep the issue list relevant and focused!


updating feeds doesn't update to latest

I'm trying to build a package using your packaging building script (which is awesome BTW).  I notice my luci feed is really quite old though, compared to the current tip of the openwrt-19.07 branch.
As you can see here scripts/feeds update -f -a only updates the luci feed to https://github.com/openwrt/luci/commit/adbbd5cf690cf993e0de1e56266ac6fd2b2dfe91:
+ .../sdk-19.07.1-ar71xx-nand/scripts/feeds update -f -a
Updating feed 'base' from 'https://git.openwrt.org/openwrt/openwrt.git;v19.07.1' ...
Already up to date.
Create index file './feeds/base.index'
Updating feed 'packages' from 'https://git.openwrt.org/feed/packages.git^1ec76dd7ca647f76a75c4f88b3b70d154221e7e9' ...
Create index file './feeds/packages.index'
Updating feed 'luci' from 'https://git.openwrt.org/project/luci.git^adbbd5cf690cf993e0de1e56266ac6fd2b2dfe91' ...
Create index file './feeds/luci.index'
...

Yet, the openwrt-19.07 branch of luci is currently at https://github.com/openwrt/luci/commit/a24f198c6f2707f034e0ad09133553191c72ad06 which is quite a ways ahead of where I am being updated to: https://github.com/openwrt/luci/compare/adbbd5cf690cf993e0de1e56266ac6fd2b2dfe91...openwrt-19.07
The result is that the package I end up building: luci-app-mwan3_git-20.029.45734-adbbd5c-1_all.ipk is quite a bit older than what the imagebuilder wants to install currently:
Installing luci-app-mwan3 (git-20.061.59608-041863a-1) to root...
Downloading http://downloads.openwrt.org/releases/19.07.1/packages/mips_24kc/luci/luci-app-mwan3_git-20.061.59608-041863a-1_all.ipk

Is there a step in the SDK that your script is missing to get the feeds up to their most recent commits?

The default feeds are taken from the SDK, which locks them to the specific point in time. Not sure what you trying to-do?
You can just grab whatever packages you want and put them in a subdir and directly add them to the config file via:
## Local feeds (src-link) have to-be in the script dir, the path is than given relative from there, without './'
## 'my-feed' dir exists in the script dir
#FEED_4="src-link test my-feed"
#FEED_4_PACKAGES="test_package"

PS: For luci packages just change the include to:
include $(TOPDIR)/feeds/luci/luci.mk

which locks them to the specific point in time

Oh.  Hrm.  That seems less than helpful.  Wouldn't most people want their SDK installation to default to building the same version of any given package they'd get out the OpenWRT package repos?
IOW, updating the feeds on the SDK should march them up to whatever is the most current git hash for the SDK's OpenWRT version/branch, so that it's always building the current version (not the locked-in-time) version of a package for the OpenWRT version.  Did that make sense?
As for what I'm trying to do, I'm just trying to build a local version of luci-app-mwa3 with:
### ('18.06.0', '18.06.1', '18.06.2' 'snapshots')
VERSION="19.07.1"
TARGET="ar71xx"
SUBTARGET="nand"

# build from official feeds
PACKAGES="luci-app-mwan3"

DEBUG=1

# disable signing for snapshots
DISABLE_SIGNING=1

and hoping to get a luci-app-mwan3_git-20.061.59608-041863a-1_all.ipk build, just like is current at https://downloads.openwrt.org/releases/19.07.1/packages/mips_24kc/luci/ right now.

Ahhh.  I see:
$ cat sdk-19.07.1-ar71xx-nand/feeds.conf.default
src-git base https://git.openwrt.org/openwrt/openwrt.git;v19.07.1
src-git packages https://git.openwrt.org/feed/packages.git^1ec76dd7ca647f76a75c4f88b3b70d154221e7e9
src-git luci https://git.openwrt.org/project/luci.git^adbbd5cf690cf993e0de1e56266ac6fd2b2dfe91
src-git routing https://git.openwrt.org/feed/routing.git^839ea37939ad1c6cbb4ac543962bbb66be4a2a3f
src-git telephony https://git.openwrt.org/feed/telephony.git^6f95d6ab3f359ee2ce81c20522700937424d1591

I (wouldn't everyone?) really want to do a /luci.git/s/^.*/;openwrt-19.07/ in sdk-19.07.1-ar71xx-nand/feeds.conf then, don't I?  I would argue that most people would want this project to do the same and equivillent for all feeds so that they are always building the current version of packages for their OpenWRT version.

As for what I'm trying to do, I'm just trying to build a local version of luci-app-mwa3 with:

My builder was actually created for building external custom feeds or local modified packages. As you noted you can always just grab a official package from the official download sources.
I think its possible to just strip the commit numbers, but the idea is mainly to build a external/custom package against the official SDK, so kernel modules and all dependencies match the SDK version.
PS: I actually use it to quickly verify my new versions against older (none snapshot) builds, without the need to setup a full build environment for each subversion.

reconfigure a specific package

That's what I am trying to do.  But of course, I want my modified build to be what is current for my OpenWRT version plus my modification.  Speaking of local modifications, I am using the tarball format that https://github.com/Andy2244/openwrt-package-builder/blob/07982d072b00b6861aab28c1dce2fa60aa9acd4b/build.in#L383-L408 implements.  I'm wondering about the usability/workflow of this method and why it wants to delete the patch tarball when it's done?  So what is the expected workflow?  Where is that tarball of patches supposed to live and how is it supposed to get into $SCRIPT_DIR, given that it needs to be copied to the $SCRIPT_DIR for each run because it will be removed after the run?
I'll push some PRs once I have what I am looking for.  Of course, all new features with switches so as to not change existing behaviour.

So what is the expected workflow? Where is that tarball of patches supposed to live and how is it supposed to get into $SCRIPT_DIR, given that it needs to be copied to the $SCRIPT_DIR for each run because it will be removed after the run?

The actual patches live in a folder structure inside the script dir, example:
.patches/packages/18.06.0/mypatch.patch
You have to package them via ./builder.sh bundle_patches. I personally just either use direct github PR# or copy the package in a local custom_feed directory and than use the source_link feed logic to build it from there.
PS: build.in is what runs inside the container so yes that would be the location to stick the sed into to use updated official feeds.

Ahh.  I see.  Is there a reason to use a tarball between the two?  Why can't build.in just find and apply the patches in the $SCRIPT_DIR/.patches/ directory directly?

The container has no special logic for different SDK versions, that's handled outside. The patches are SDK specific so thats how i tested stuff, but as noted i personally never really use this logic, so feel free to improve it.

But build.in is perfectly aware of SDK version.
Looking at build.in I'm still not seeing why it cannot handle .patches/ directly rather than having to have them tarballed up.
I will try add some logic to handle .patches/ directly, in the format described to see what issues arise.  It just seems to me that building an existing package in a different way (i.e. so needing to apply a patch to its' feed) is probably one of the most straightforward/common use-cases.
I could be biased.  :-)

Looking at build.in I'm still not seeing why it cannot handle .patches/ directly rather than having to have them tarballed up.

Sure, to-be honest i can't really remember why i did it this way. Maybe just so i can control when/what patch versions are applied.


Freemoji plugin seems to be broken

When I type :emote: it just sends the message without any image

Cannot reproduce. Is the plugin updated and is it enabled.

Yeah. Will send you video

https://user-images.githubusercontent.com/41782443/150691550-4c357f71-80b6-4277-8ead-15b200eb02d5.mp4

Okay I removed every plugin and theme and it seems it works now. There must be something interfering. Thanks


add x-csrf-token to accepted headers

According to this SO post, it's actually required by
some clients. No harm in adding it as far as I can see.
http://stackoverflow.com/a/26833155/680742

:+1:


Outdated documention for NormalModuleReplacementPlugin when using function replacement option (webpack5)

the documentation for NormalModuleReplacementPlugin is outdated with regard to the Advanced Example for webpack5:
The example in the documentation instructs to replace resource.request with the modified request, but in webpack5, the field resource.createData.request needs to be changed instead (see source code for webpack5 NormalModuleReplacementPlugin.js).
The documentation should be updated, changing src/content/plugins/normal-module-replacement-plugin.md at line 45:
          resource.request = resource.request.replace(

to
          resource.createData.request = resource.request.replace(

I believe you're talking about the afterResolve case while the example shows beforeResolve case:
if (resourceRegExp.test(result.request)) {
  if (typeof newResource === 'function') {
    newResource(result);
  } else {
    result.request = newResource; // it's mutating the `result.request`
  }
}

yes, of course, you are correct.
Ideally the description should explain, that the plugin is used during 2 phases and so on.
However, failing that, the advanced example should instruct to modify the result in a way that would work for both phases, e.g. changing it to something like
          resource.request = resource.request.replace(
            /-APP_TARGET/,
            `-${appTarget}`
          );
          if(resource.createData) resource.createData.request = resource.request;

Or, alternatively, it should explicitly state that users should look into the source code of the plugin:
otherwise it may not work sometimes, and users will have no clue why that is (thinking they did everything correctly, since they followed the documentation).


Address comp governance issues

Addressing existing CVEs on the latest branch:

CVE-2022-37611
CVE-2022-21680
CVE-2022-21681

Abandoning as V3 is addressing these (typescript update etc).


Noting ingestion_time() vs. Timestamp

Using the Timestamp field in custom detections can result in data loss if an endpoint queues an event. In reality customers likely won't need time-based filters in custom detections as they are pre-filtered.

@JohanFreelancer9 - kindly do the copy editor review for this PR. Thanks

Hi! currently discussing this edit offline with PM. Will update this thread for necessary updates, if any. Please hold. @yogkumgit @JohanFreelancer9

@schmurky Any update?

Yes, apologies for late update. This has been resolved by adding this note
Avoid filtering custom detections using the Timestamp column. The data used for custom detections is pre-filtered based on the detection frequency.
to this page: https://docs.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide

@JohanFreelancer9 - kindly do the copy editor review for this PR. Thanks

I already added the note. This PR is okay to close. :)

@schmurky Please merge this PR. Thanks


Exceptions in IDE during debugging flutter web

Hi,
I get exceptions in the IDE during debugging.
Unfortunately I can NOT copy them. Just take screenshots

These are not exceptions in my code. These are framework exceptions or something reladet.
I can not view variable content anymore by hover tooltip.
Flutter doctor:
[√] Flutter (Channel master, 2.6.0-12.0.pre.790, on Microsoft Windows [Version 10.0.19043.1348], locale de-DE)
• Flutter version 2.6.0-12.0.pre.790 at C:\Users\akilian\Flutter SDK\flutter
• Upstream repository https://github.com/flutter/flutter.git
• Framework revision 3a18e6ee42 (10 days ago), 2021-11-22 13:01:00 +0300
• Engine revision ad00d12833
• Dart version 2.16.0 (build 2.16.0-35.0.dev)
• DevTools version 2.8.0
[!] Android toolchain - develop for Android devices (Android SDK version 30.0.3)
• Android SDK at C:\Users\akilian\AppData\Local\Android\sdk
X cmdline-tools component is missing
Run path/to/sdkmanager --install "cmdline-tools;latest"
See https://developer.android.com/studio/command-line for more details.
X Android license status unknown.
Run flutter doctor --android-licenses to accept the SDK licenses.
See https://flutter.dev/docs/get-started/install/windows#android-setup for more details.
[√] Chrome - develop for the web
• Chrome at C:\Program Files\Google\Chrome\Application\chrome.exe
[√] Android Studio (version 2020.3)
• Android Studio at C:\Program Files\Android\Android Studio
• Flutter plugin can be installed from:
https://plugins.jetbrains.com/plugin/9212-flutter
• Dart plugin can be installed from:
https://plugins.jetbrains.com/plugin/6351-dart
• Java version OpenJDK Runtime Environment (build 11.0.10+0-b96-7249189)
[√] VS Code (version 1.52.1)
• VS Code at C:\Users\akilian\AppData\Local\Programs\Microsoft VS Code
• Flutter extension can be installed from:
https://marketplace.visualstudio.com/items?itemName=Dart-Code.flutter
[√] Connected device (2 available)
• Chrome (web) • chrome • web-javascript • Google Chrome 96.0.4664.45
• Edge (web)   • edge   • web-javascript • Microsoft Edge 95.0.1020.53
! Doctor found issues in 1 category.

@Wissperwind
There's similar open issue describing your case, https://github.com/flutter/flutter/issues/87856
Please follow-up in it for further updates.
Closing this as a duplicate.


What Changes are Breaking for v1 -> v2?

Forgive me if I just missed it, but in looking to update some deps I see that this has been bumped to v2+ and I don't see the breaking changes listed anywhere, so figured I'd create an issue to ask what they may be (and to perhaps get them documented).
Cheers, and thanks for the great module.

https://github.com/pinojs/sonic-boom/pull/66 and https://github.com/pinojs/sonic-boom/pull/45 (note that TS types are not compatible with DT ones).

Assuming I'm already on Node v12 and up, is there any functional/usage difference that would result from the flatstr removal?
Thanks for the quick reply!

@aphix Yes. Your performance might improve. See https://github.com/davidmarkclements/flatstr/issues/10

@kibertoad So, no changes from me and a potential performance boost? Awesome! That's a rare and nice thing to hear =)
Thanks again, closing-


Unable to set "ignoredKeys" from serverless.yml

Hi, I tried to set "ignoredKeys" in serverless.yml but I couldn't get it to work. I glanced at the generated epsagon_handlers code and I could see that process.env.EPSAGON_IGNORED_KEYS assigned with the correct value. However, during runtime in lambda process.env.EPSAGON_IGNORED_KEYS is undefined.
I'm on 1.10.0 and using typescript on node 12.

@brigitte0 Hi,
Can you share an example of how you set the "ignoredKeys" value in your serverless.yml?

Fixed by: #91
The environment variables were set after epsagon already tried to read them, so they were not effective.


ReadCodes error on ec2 instance

I am using fastBPE as part of a larger pipeline. It works fine on my PC.
But when I run this using sagemaker on an instance, I get the following error:

fast: fast.cc:464: void readCodes(const char*, std::unordered_map<std::pair<std::__cxx11::basic_string, std::__cxx11::basic_string >, unsigned int, pair_hash>&, std::unordered_map<std::__cxx11::basic_string, std::pair<std::__cxx11::basic_string, std::__cxx11::basic_string > >&): Assertion `codes.find(pair) == codes.end()' failed.

Delete extra “o o 0” line in codes files.

Delete extra “o o 0” line in codes files.

Sorry, there is still the same mistake.

Delete extra “o o 0” line in codes files.

Sorry, there is still the same mistake.
what should I do?

if nCodes is wrongly chosen there will be errors when 'applybpe'.  How to choose this number? What exactly is it used for? I don't know. But lowering it solves the problem (choose a low value to see).


not a bug, just some thoughts

First of all, really thanks for your amazing work, it is not common for this kind of projects to have them open source on github, especially with the models architecture included too. I am now going slowly in details through the paper and the code, and I must say that they are both commented very well, well written and structured.
I am currently starting my disseration project and I would like to use this as a starting point. My idea involves incorporating two images into the model: a pre-flood image and a post-flood image (with some adjustments to the model architecture). Im curious if there's a specific reason why the decision was made to use single images exclusively, or if the primary focus was on water detection.
Second thought is about the use of EMS. While I'm aware that EMS is a well-established Copernicus service, I've yet to come across a clear explanation regarding the dataset used to train the models that generate the ground truth labels. These labels aren't human-generated but rather produced by algorithms. From the limited information available, it appears that these algorithms don't involve machine learning and primarily rely on Sentinel-1 or other SAR data. Additionally, there's a lack of information regarding the accuracy of these algorithms.
This leads to the question: Is it worth using EMS as ground truth? Firstly, the model can't surpass the accuracy of EMS ground truth. And if the EMS labels are flawed, we might be instructing the model with erroneous information. In such a case, what we pretend to get out from the model?

Hi @makovez, your points are perfectly reasonable, the focus here was quite what you guessed: our objective was mainly to understand how feasible it is to delineate flooded areas using the single post-event image only.
About EMS you're perfectly right, there's not much in terms of "how good they are", and they are generated using tools, however this generation is still done by a human operator (GIS experts, if you check the bottom right of each EMS map there's the provider's name), so in this regard it is still manually validated and in my opinion a decent output for ML (probably not the best, but we also took the opportunity to explore this data).
In my opinion, so completely debatable, it is still worth using them, especially if you include pre+post and you probabbly also account for inaccuracies (e.g., some ad hoc loss, online relabeling, self-training, ...).
Last, I must say that this work here it's pretty much obsolete at the moment: we are working on a way more accurate flood detection pipeline using time series. We also intend to release the new dataset, addressing the limitations of this work.

That's good that EMS provides also the person name that manually review the labels, I didn't know that.
Do you intend to use LSTM + CNN for timeseries? And if you will still use EMS as labels, how do you create a GT for the timeseries?
It would be nice to have a chat with you, if you have telegram @sbongown

Can't really say much at the moment, but in terms of models we'll try new SotAs (vision transformers mostly), and in terms of label basically the inputs is the "4D" tensor with S1 VV-VH images in time, with a single output for each series, the rasterized EMS delineation.


Service loadbalancer 404s after first request to http services

reqrep and keep-alive do not play nicely. The first request to a http service works fine but subsequent requests 404 because the request is not parsed. Haproxy merely passes the data through. Using "option http-server-close" fixes this issue.
Issue noted here a few years back http://permalink.gmane.org/gmane.comp.web.haproxy/7670

@asim please submit a pr if you have the time, if not I'll verify and report back (I'm pretty sure I've tried curling an http service multiple times, but I don't remember the specifis of reqrep and keep-alive). Perhaps @aledbf has run into this as well?


Support Annotation reference?

So as it stands now, reference to classes via annotation are not considered by jdepend, see:
http://stackoverflow.com/questions/7241685/jdepend-misses-cycles
Any plan to support this?

Closed it as annotation of RUNTIME Retention policies are indeed found.


feat: playground support promql

Start and end time is not showing properly.

Add default absolute time range for playground


CB-6854 introduce CDP_RUNTIME_UPGRADE entitlement to prevent unattended upgrade

https://github.infra.cloudera.com/thunderhead/thunderhead/pull/130

Looks good, don't forget to update the design doc with they feature flag section

Yes, thanks.


Feature Suggestion

Hello! Ever since I set up my CAT S22 Flip I've been using your keyboard and it's worked great! It's way better than the other T9 apps I've tried. However, as seems common with many S22 phones, my physical keyboard started to malfunction so that every time I hit a button, the phone registers it as a long-press and types many letters/numbers per single click. It's made my phone unusable, and the only fix I've come across is to use the Old T9 Keyboard app from the play store. It has a feature in the settings called "Multi-press solution" specifically to address this problem, and it works. However, I don't like that app as much as yours. I appreciate how TT9 allows me to customize many keys and upload new words to the dictionary with the press of a button. It's also much more visually pleasing and minimalistic. I'd really hate to forever stop using TT9 :(  Is it possible to recreate the feature to address this issue? Thanks so much for all your hard work and have a great day :)

Hello here!
The feature is already available, but you may be using an older version. Make sure to update to at least v29.0, then go to: TT9 Settings → Initial Setup, and under the "Compatibility" section look for "Key repeat protection".
Also, make sure to read the manual. It probably contains the answers to other questions you may have.

Ohh it seems I had v27.0 installed. I just downloaded v29.0. Thanks!!


Add paytm icon

Description
Added icon for Paytm.

Fixes #(issue)
Type of change

:x: Bug fix (non-breaking change which fixes an issue)
✅ Icon addition (non-breaking change that adds/modifies Lawnicons's icons)
:x: General change (non-breaking change that doesn't fit the above categories like copyediting)

Icons addition information
Icons added

Paytm (net.one97.paytm)

Is Stoke insted of Fill is applicable for Text as well?

Is Stoke insted of Fill is applicable for Text as well?

Yes, I use stroke for text on my submitted icons all the time

@Goooler


[Snyk] Security upgrade jest from 23.6.0 to 24.0.0

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

packages/ffe-cards-react/package.json

Vulnerabilities that will be fixed
With an upgrade:

Severity
Priority Score (*)
Issue
Breaking Change
Exploit Maturity

589/1000  Why? Has a fix available, CVSS 7.5
Prototype Pollution SNYK-JS-MERGE-1040469
Yes
No Known Exploit

494/1000  Why? Has a fix available, CVSS 5.6
Command Injection SNYK-JS-NODENOTIFIER-1035794
Yes
No Known Exploit

601/1000  Why? Proof of Concept exploit, Has a fix available, CVSS 5.6
Prototype Pollution SNYK-JS-YARGSPARSER-560381
Yes
Proof of Concept

506/1000  Why? Proof of Concept exploit, Has a fix available, CVSS 3.7
Regular Expression Denial of Service (ReDoS) npm:braces:20180219
Yes
Proof of Concept

(*) Note that the real score may have changed since the PR was raised.
Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
🛠 Adjust project settings
📚 Read more about Snyk's upgrade and patch logic

Coverage remained the same at 82.009% when pulling 4ae3c29748a2339a1ef9d0ba2ffd9c4d64d729ba on snyk-fix-6270d946814720619c9f928560a16141 into d743d78bab0f6a4ce0bc199e8e419261247ca8b6 on develop.


More CVE fix

Coverage increased (+1.5%) to 69.29% when pulling 681ff758985f8debb6c0022bd679272066d72c39 on feature/spray_update into 96b4fb3e2b8f3b8cf28e6ea11681175f9177c54f on develop.


Replacing a pck file

Replacing a pck file with custom build / original game builded using gdre tools ending up with GDWeave not working, is there a way to fix this or is it a GDWeave problem?

Do you mean loading a mod's custom pck file? What game and engine version?

Do you mean loading a mod's custom pck file? What game and engine version?

yes, the game version was 1.08 and the engine is GodotSteam 3.5.2
West merged pck and exe in one file so don't really know if loader will work with builded exe, i'll test it and write if it's not


docs: Add several clarifications

Mention need to use pip install --pre. Mention that
pandas is not installed by default. Fix code highlighting issue.
Closes #124

Merged without review. These changes are trivial.


Incorrect Timezone get in Application?

\vendor\yiisoft\yii2\base\Application.php
Lines 244 - 249:
if (isset($config['timeZone'])) {
$this->setTimeZone($config['timeZone']);
unset($config['timeZone']);
} elseif (!ini_get('date.timezone')) {
$this->setTimeZone('UTC');
}
I have no date.timezone into my php ini file. So it's set timeZone to UTC. But my current timezone is Europe/Helsinki.
Sure, I can set timeZone to Europe/Helsinki, but I think this is incorrect. You should get timezone from date_default_timezone_get before set UTC.
Thank you!

date_default_timezone_get() will get the value from date.timezone if that does not exist, it will throw an error, so that does not make sense.

note that setTimeZone() and getTimeZone() on the application are just wrappers for date_default_timezone_get()/set().

also not having date.timezone set in PHP config is not recommended: http://php.net/manual/en/function.date-default-timezone-get.php

date_default_timezone_get() will get the value from date.timezone. if that does not exist, it will throw an error, so that does not make sense.

Ubuntu 15.10
Apache/2.4.12
PHP 5.6.11
No  date.timezone into php ini file....
ini_get("date.timezone") is string(0) ""
date_default_timezone_get() is "Europe/Helsinki" ...
also php have default ini file after install....

it throws a warning: https://3v4l.org/DUqTa

Ok. Like you want. Of сourse I already fixув it. But before I had different mysql and php time. It was because framework sets UTC time by default. It looks like error. isn't it?

If Yii would not set the timezone itself you would see an exception in this case so everything is correct.
PHP documentation is very clear about the fact that you should not leave date.timezone empty.

Yes. But empty date.timezone this is just warning, but "incorrect" timezone perhaps will throw critical error. I love Yii and just want to make it better ;)

Or... May be better throw exception instead set UTC time?

this behavior was added in https://github.com/yiisoft/yii2/commit/b8ad3567e44f818d7b45f20bf1ebdfa274f90dfb see #209 and #210 for the discussion about it. Imo the current solution is the best one.

Oh. sorry. Didn't see it

no problem, that happended 11700 issues before this one :-)

ahah. Thank you. Have a nice day


xss_clean issue

In xss_clean URL Decode part, we use rawurldecode to decode string.
While the string is encoded in gb2312, such as  'https://www.sogou.com/web?query=����01'.
The return string will be decoded as error string.

This issue was not caused by xss_clean, using rawurldecode to decode a string that was encoded in GB2313 is incorrect way. If possible you should encode the url in normal url encode standard (see http://php.net/manual/en/function.urlencode.php) or RFC 3986 (see http://php.net/manual/en/function.rawurlencode.php).
I hope this will help you. Good day! :)


Noticed a few problems after latest update.

Posts are showing dual [Add Karma] buttons. (was one of these meant to be the karma count?)
Last post info now is set to 8% width which causes the info to take 3 lines, and could really be on one line when using large screens. Wasted space was dismissed here #137 as a 'usual thing', however this is pretty terrible (expands the content by 20 lines per page).

Old issue but STILL BROKEN


Bad formatting in design document

The choice of code/non-code font is wrong at the beginning of the 'Considerations around Admitting Subtypes' section in the reflectable capability design document.

Fixed in commit 79441c96c1436b53976d360a15beb7ae0dda89d9.


Use selenium refresh for selenide refresh instead of reopen current url.

Proposed changes
Use selenium refresh for selenide refresh instead of reopen current url.
Fix #740 issue.
Checklist

[ ] Checkstyle and unit tests pass locally with my changes by running gradle check chrome htmlunit command
[ ] I have added tests that prove my fix is effective or that my feature works
[ ] I have added necessary documentation (if appropriate)

Codecov Report

Merging #741 into master will decrease coverage by 0.07%.
The diff coverage is 66.66%.

@@             Coverage Diff              @@
##             master     #741      +/-   ##
============================================
- Coverage     63.57%   63.49%   -0.08%
+ Complexity      878      877       -1
============================================
  Files           154      154
  Lines          3028     3030       +2
  Branches        298      298
============================================
- Hits           1925     1924       -1
- Misses         1004     1007       +3
  Partials         99       99

Impacted Files
Coverage Δ
Complexity Δ

src/main/java/com/codeborne/selenide/Selenide.java
0% <0%> (ø)
0 <0> (ø)
:arrow_down:

...in/java/com/codeborne/selenide/impl/Navigator.java
66.66% <100%> (-2.19%)
21 <1> (ø)

...e/selenide/impl/WebDriverThreadLocalContainer.java
80% <0%> (-0.75%)
29% <0%> (-1%)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 778e4ff...8c7f5b2. Read the comment docs.

Coverage decreased (-0.08%) to 66.766% when pulling 8c7f5b2dcc23929cec8720784f463654654a99f0 on rosolko:refresh into 778e4ff52b8816bbfd7962326676f8c38d4d7063 on codeborne:master.


Add detailed release notes for 1.2

This is my initial effort at translating the release notes into a user-facing document

/cherry-pick release-1.2
/lgtm


Add external mouse hover support in SessionView.java

This is how are pull requests handled by FreeRDP

Every new pull request needs to build and pass the unit tests at https://ci.freerdp.com
At least 1 (better two) people need to review and test a pull request and agree to accept

Preparations before creating a pull

Rebase your branch to current master, no merges allowed!
Try to clean up your commit history, group changes to commits
Check your formatting! A clang-format script can be found at .clang-format

The cmake target clangformat reformats the whole codebase

Optional (but higly recommended)

Run a clang scanbuild before and after your changes to avoid introducing new bugs
Run your compiler at pedantic level to check for new warnings

To ease accepting your contribution

Give the pull request a proper name so people looking at it have an basic idea what it is for
Add at least a brief description what it does (or should do :) and what it's good for
Give instructions on how to test your changes
Ideally add unit tests if adding new features

What you should be prepared for

fix issues found during the review phase
Joining our chat to talk to other developers or help them test your pull might accelerate acceptance

Matrix room : #FreeRDP:matrix.org (main)
XMPP channel<EMAIL_ADDRESS>(bridged)
IRC channel : #freerdp @ irc.oftc.net (bridged)

Joining our mailing list<EMAIL_ADDRESS>may be helpful too.

Please remove this text before submitting your pull!

@kevin147147 some explanation what you want to do here would be nice.
is this just mouse move on hover?

Yes when you move the cursor with an external mouse it will do hover :)

@freerdp-bot test

@kevin147147 code needs to meet formatting requirements, git clang-format can do that for you

I fixed the formatting

@freerdp-bot test

@kevin147147 sorry, you seem to be lacking some imports

@freerdp-bot test please


Problem with IMG height="auto"

Hello,
i have a problem with slipHover.
In my div, i loaded the Image
img src="http://www.lifelenta.ru/images/uploads/files/kNfza5eZV0xwd.jpg" width="25%"
Sliphover doesn't work (doesn't show the overlay). Once i resize the window, it works perfectly fine.
Then, i tried to give the image a height. For example like height="100px" or something. Then, it works fine again (without resize window).
I tried some commands, and found out: everytime the height of a table or image is set to "auto", Sliphover doesn't work until i resize the window.
Can you help me fixing that?? because i have to use the height="auto" command to show the images correctly on my homepage.
Thank you,
Marius

hi @mikelawry ,
would love to help but I cant reproduce the problem.
if you can setup a jsfiddle that would be very helpful.


Streaming a response within a thread is not threadsafe

Don't thread a streamed response, it raises an error.

Should be able to test this in IO once it is merged. The Bug test workflow failed and I have imported the Allocation into the Axalta workspace in IO so that is ready to run/test too.


Make Route53 dns01 work with IAM roles for service accounts

cert-manager should support the new IAM Roles for Service Accounts (IRSA) feature of AWS. Instead of putting the assumed role into the ClusterIssuer, it should go into the service account.
If you set everything up as described in the linked AWS page and put the assumed role in,  just put the web identity role into v1.10.1, you get a lot of errors:
error instantiating route53 challenge solver: unable to assume role: AccessDenied: Access denied\n\tstatus code: 403

Hi @munnerz, of course. The whole thing works like this:
In addition to your AWS EKS Kubernetes cluster, you run an OpenID Connect identity provider for your AWS account, associated with your cluster. Because Kubernetes service accounts are first-class citizens in IAM now, you can allow them to assume an IAM role by creating a role with a trust relationship like this (identifiers redacted):
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Federated":
          "arn:aws:iam::0123456789012:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/FFFFFFFFFFFFFFFF0123456789ABCDEF"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "oidc.eks.eu-central-1.amazonaws.com/id/FFFFFFFFFFFFFFFF0123456789ABCDEF:sub":
            "system:serviceaccount:cert-manager:cert-manager"
        }
      }
    }
  ]
}

This role gets a policy with the permission to modify the DNS zone as you already wrote in your documentation, ideally restricted to the the required zones. Let's assume the ARN of this role is arn:aws:iam::0123456789012:role/cert-manager-demo.
To tell cert-manager to actually make use of that granted permission and assume that role, you annotate the service account like this:
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::0123456789012:role/cert-manager-demo
  name: cert-manager
  namespace: cert-manager

Now a mutating admission controller will modify all pods running with that service account as follows:
apiVersion: apps/v1
kind: Pod
# ...
spec:
  # ...
  containers:
  - name: ...
    # ...
    env:
    - name: AWS_ROLE_ARN
      value: arn:aws:iam::0123456789012:role/cert-manager-demo
    - name: AWS_WEB_IDENTITY_TOKEN_FILE
      value: /var/run/secrets/eks.amazonaws.com/serviceaccount/token
    volumeMounts:
    - mountPath: /var/run/secrets/eks.amazonaws.com/serviceaccount
        name: aws-iam-token
        readOnly: true
  volumes:
  - name: aws-iam-token
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          audience: sts.amazonaws.com
          expirationSeconds: 86400
          path: token

According to the linked blog post, you need to update the AWS SDK for Go to version 1.23.13 or beyond. I am not sure wether you need to change anything in the code, as External-DNS actually works and they just call AssumeRole as you do.
The cluster issuer doesn't need the role attribute as this went to the service account:
apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
  namespace: cert-manager
spec:
  acme:
    ...
    solvers:
    - selector:
        dnsZones:
        - "example.com"
      dns01:
        route53:
          region: eu-central-1
          hostedZoneID: DNSZONEIDHERE
          # no more role here

I think in the end it's just updating the AWS SDK and adjusting the documentation.

We've just today cut the v0.11.0-beta.0 release, which includes this (as well as quite a few other changes!)
If you've got the chance to give this a go and update this issue with the results, it'd be great to find out if there's anything more we need to do to support this 😄

Yes, just tried it, but I am unable to create a cluster issuer due to https://github.com/jetstack/cert-manager/issues/2109. When creating the custom resource definitions, I got this validation error
error: error validating "https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml": error validat
ing data: ValidationError(CustomResourceDefinition.spec.validation.openAPIV3Schema.properties.spec.properties.solver.properties.dns01.prope
rties.webhook.properties.config): unknown field "x-kubernetes-preserve-unknown-fields" in io.k8s.apiextensions-apiserver.pkg.apis.apiextens
ions.v1beta1.JSONSchemaProps; if you choose to ignore these errors, turn validation off with --validate=false

Workaround is using --validate=false. Tested on Amazon EKS 1.14.7.

I've added some comments in #2109 😄

& yep, that fields is only present in k8s 1.15 onwards. Setting --validate=false is absolutely fine to do. The error occurs because kubectl has validation based on OpenAPI schemas, and in 1.14 that field was not present. The Kubernetes apiserver will just silently drop this field when it gets submitted to an older apiserver 😄

Hello there, I can confirm that opening port 443 as described in https://github.com/jetstack/cert-manager/issues/2109 made creating the cluster issuer work.
I also added the eks.amazonaws.com/role-arn annotation that made the admission controller mutate the cert manager pod. Here is an excerpt from kubectl describe pod:
   Environment:
      POD_NAMESPACE:                cert-manager (v1:metadata.namespace)
      AWS_ROLE_ARN:                 arn:aws:iam::xxxxxxxxxxxx:role/CertManager-demo
      AWS_WEB_IDENTITY_TOKEN_FILE:  /var/run/secrets/eks.amazonaws.com/serviceaccount/token
    Mounts:
      /var/run/secrets/eks.amazonaws.com/serviceaccount from aws-iam-token (ro)
      /var/run/secrets/kubernetes.io/serviceaccount from cert-manager-token-c595c (ro)

However, the challenge fails because the injected token cannot be read:
$ kubectl describe challenge ...
...
Error presenting challenge: Failed to change Route 53 record set: WebIdentityErr: unable to read file at /var/run/secrets/eks.amazonaws.com/serviceaccount/token
...

$ kubectl logs cert-manager-...
...
E1010 12:04:47.578424       1 controller.go:131] cert-manager/controller/challenges "msg"="re-queuing item  due to error processing" "error"="Failed to change Route 53 record set: WebIdentityErr: unable to read file at /var/run/secrets/eks.amazonaws.com/serviceaccount/token\ncaused by: open /var/run/secrets/eks.amazonaws.com/serviceaccount/token: permission denied" "key"="cert-manager/demo-example-com-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx"
...

As the container has no shell I am unable to check the current permissions, but I think it's just a small thing.

Hello,
I'm having some issues getting the IAM roles working with v11.0.0, and I fear I'm missing something simple.

I am using helm to install on Kubernetes 1.14, and have read through the release notes, and updated my ClusterIssuer to conform to the new API spec.

I have followed all the steps to create the IAM Roles for Service Accounts (IRSA) and attached it to the Route53 role.

I have removed all previous versions of cert manager, all CRDs, and deleted the cert-manager namespace.

Here is how I'm installing cert manager

Apply v0.11 CRDs

kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml --validate=false

Create the cert-manager namespace and labels (I added both to be backwards compatible)

kubectl create namespace cert-manager
kubectl label namespace cert-manager cert-manager.io/disable-validation=true
kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true

I then install cert manager v0.11.0 using Helm, and a custom values.yaml

helm install --name cert-manager \
    --namespace cert-manager \
    -f values.yaml \
    --version 0.11.0 \
    jetstack/cert-manager

The values.yaml contains the annotation and securityContext @hendrikhalkow mentioned, as well as setting letsencrypt-dev as the defaultIssuer.
serviceAccount:
  # Specifies whether a service account should be created
  create: true
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::xxx:role/my-role

ingressShim:
  defaultIssuerName: "letsencrypt-dev"
  defaultIssuerKind: "ClusterIssuer"

securityContext:
  enabled: true
  fsGroup: 1001

I then add my ClusterIssuer, which looks like this (notice the updated apiVersion

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-dev
  namespace: cert-manager
spec:
  acme:
    # The ACME server URL
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email<EMAIL_ADDRESS>    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-dev
    solvers:
    - selector:
        dnsZones:
          - "mydomain"
      dns01:
        route53:
          region: us-east-1

Finally, I deploy my Ingress with the kubernetes.io/tls-acme: "true" annotation.
However, in the logs I'm seeing an error AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity:
"msg"="re-queuing item  due to error processing" "error"="Failed to determine Route 53 hosted zone ID: WebIdentityErr: failed to retrieve credentials\ncaused by: AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity\n\tstatus code: 403, request id: c5209031-eb99-11e9-b4ee-d30fa2245e4a" "key"="monitoring/grafana-dev-us-east-1-lets-encrypt-3071181437-3860980709-2148988824"

Any ideas? Any help would be greatly appreciated.

Hi @cookandy, the fact that you get this error message shows that you already set up your cert-manager correctly because AssumeRoleWithWebIdentity is already being attempted. Please check your trust policy (see code snippet above) where you allow the service account to perform that action.

Yes, just tried it, but I am unable to create a cluster issuer due to #2109. When creating the custom resource definitions, I got this validation error
error: error validating "https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml": error validat
ing data: ValidationError(CustomResourceDefinition.spec.validation.openAPIV3Schema.properties.spec.properties.solver.properties.dns01.prope
rties.webhook.properties.config): unknown field "x-kubernetes-preserve-unknown-fields" in io.k8s.apiextensions-apiserver.pkg.apis.apiextens
ions.v1beta1.JSONSchemaProps; if you choose to ignore these errors, turn validation off with --validate=false

Workaround is using --validate=false which allows creating the custom resource definitions. Tested on Amazon EKS 1.14.7.

Getting the same error on GKE (GitVersion:"v1.14.6-gke.1") and the same workaround solves the immediate issue. It would be nice however if the validation works. Should I raise a separate issue for it or is it already on the todo list?

I had the same problems with 0.11, first with the CRD validation failing and then withe cert-manager unable to read the Service Account token:
unable to read file at /var/run/secrets/eks.amazonaws.com/serviceaccount/token

The same --validate=false and securityContext.enabled: true changes fixed these for me, and DNS challenges are working for the IAM Service Account Role and well as assuming cross-account roles.
BTW, I noticed the cross-account instructions on the website fails to mention that the policy in account X needs to include at ability to assume the role in account A, as well as for account A to trust the role in account X.

I am having the same issue described here.  after following some of the steps above on 1 cluster, i was able to get the route53 dns01 challenge to work.  however i was unable to achieve that on another cluster.  my conclusion is that this needs some explicit documentation explaining how to update the trust relationships, policies, etc so there is a decent guide beyond an open github issue.

Also having a similar issue, EKS running 1.14 with cross-account access to route53.
The same role that I've used in the ClusterIssuer is the one that I've specified in ExternalDNS service and it is working there, but with CertManager I'm getting the following error on the challange:
  Warning  PresentError  10s (x4 over 34s)  cert-manager  Error presenting challenge: error instantiating route53 challenge solver: unable to assume role: NoCredentialProviders: no valid providers in chain. Deprecated.

I am getting error instantiating route53 challenge solver: unable to assume role: NoCredentialProviders: no valid providers in chain issue while working with cert manager.
I am using latest version 0.12 and I have created an IAM role for my lets-encrypt ClusterIssuer. Below is my lets-encrypt cluster issuer:
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: xxxx-issuer
spec:
  acme:
    email<EMAIL_ADDRESS>    privateKeySecretRef:
      name: xxxx-issuer
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - dns01:
        route53:
          role: arn:aws:iam::xxxx:role/kube2iam-cert_manager_role
          hostedZoneID: xxxx
          region: eu-central-1
      selector:
        dnsZones:
        - sennder.com

Below is my IAM role:
https://cert-manager.io/docs/configuration/acme/dns01/route53/#set-up-a-iam-role

@hendrikhalkow ... I'm trying to follow your instructions above to enable in EKS. Just to confirm -- "arn:aws:iam::0123456789012:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/FFFFFFFFFFFFFFFF0123456789ABCDEF" is the oidc provider associated with the EKS cluster?  ... it looks suspiciously simple :) -- I worry I am not understanding something.
So ... the service account request tokens for the role from the oidc endpoint, and injects them into pods in the cert-manager namespace, which allows the cert manager (and anything else in the namespace?) to use them.
What is the security context? What is the "magic config" fsGroup: 1001? It would be useful for someone to provide links to documentation (and/or write some) for beginners like myself that aren't familiar with all the internals.

@shaunc it's really that simple. Today, my working Helm values look like this:
securityContext:
  enabled: "true"
serviceAccount:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::000000000000:role/CertManagerRoleName

Replace the 0 digits with your actual AWS account ID. The IAM role CertManagerRoleName has a policy attached that looks like this:
{
    "Statement": [
        {
            "Action": "route53:GetChange",
            "Effect": "Allow",
            "Resource": "arn:aws:route53:::change/*"
        },
        {
            "Action": "route53:ListHostedZonesByName",
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": "route53:ChangeResourceRecordSets",
            "Effect": "Allow",
            "Resource": "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID"
        }
    ],
    "Version": "2012-10-17"
}

Replace YOUR_HOSTED_ZONE_ID with your actual ID of your Route53 zone. To check if everything works, check your cert manager pod:
k describe pod -n cert-manager cert-manager-...

You should see a volume aws-iam-token which indicates that it's working.

Note: you will still need to use spec.solvers[X].dns01.route53.role if your Route53 zones live inside another account. The reason is because while the IAM-linked service roles can provide temporary credentials to your pod, they do not assume the role automatically.
From AWS documentation, they give an example of an AWS config:
[profile account_b_role]
source_profile = account_a_role
role_arn=arn:aws:iam::222222222222:role/account-b-role

[profile account_a_role]
web_identity_token_file = /var/run/secrets/eks.amazonaws.com/serviceaccount/token
role_arn=arn:aws:iam::111111111111:role/account-a-role

@sc250024 thanks for the details 😄 would you be able to add a note to our docs to explain this for the next person? It'd probably save them a lot of time digging out and stumbling across this issue in future! 😄

@munnerz Sure.

I'm seeing
unable to read file at /var/run/secrets/eks.amazonaws.com/serviceaccount/token\ncaused by: open /var/run/secrets/eks.amazonaws.com/serviceaccount/token: permission denied"

I haven't been able to apply the securityContext.enabled: true fix since I don't use helm and like @shaunc I cannot find much information about it.

    spec:
      securityContext:
        enabled: true
        fsGroup: 1001
      containers: ...

Please add this to the cert-manager deployment.  This is required in AWS so that the cert-manager pod can access the token that has the credentials.

Would somebody be able to create a PR to add this block into our Helm chart by default? I think it's harmless for users running outside of AWS, and should hopefully resolve issues like this across different cloud providers! 😄

@munnerz That's how people get coronavirus. Today, you're forcing Kubernetes annotations on them, even if they don't use it. It's a slippery slope.

@sc250024 I don't think that's very appropriate - please be mindful of your words and how they may affect others. We want to ensure nobody feels excluded here, and comments like these could really upset anyone affected by the virus.

On the topic at hand, it looks like this PR: https://github.com/jetstack/cert-manager/commit/3b838758a34c1c56d20eaaa69246d68484585a2d changed how the securityContext is set.
@thismatters @derrickburns would you be able to elaborate on your solutions above with some full examples, including what version of CM you applied the patch to? As well, would you mind testing it out with the latest (v0.14.0) version of cert-manager too?

I'm not really much of a kubernetes expert, nor does startup life (amidst a pandemic) permit much time for rework. Now that I've gotten everything working just right I'm pretty reticent to touch anything.
I was patching version 0.13.1. I downloaded the manifest (https://github.com/jetstack/cert-manager/releases/download/v0.13.1/cert-manager.yaml) found deployment/cert-manager, added the aforementioned securityContext block, and applyd it to my cluster.

@munnerz  The PR that you mentioned works for me.  There is no more need for changes to work with IAM for Service Accounts.  Thanks!

It's not clear from this bug report, but it seems that I still need fsGroup: 1001 to use IRSA with cert-manager? Tested with 0.14.2, where the last-mentioned PR (#2455) is present.
I read @derrickburns 's last comment as meaning that the fsGroup setting is no longer needed...
Does this block need to be mentioned in the docs?

It finally worked on my cluster, kudos to @hendrikhalkow and @munnerz !

It finally worked on my cluster, kudos to @hendrikhalkow and @munnerz !

Mentioned on the k8s 1.19 for EKS release notes, I believe the fsGroup setting should not be needed for k8s 1.19 onwards, due to the implementation of https://github.com/kubernetes/enhancements/pull/1598.

Hi, @hendrikhalkow  I've followed exactly how you mentioned here for the setup, but I get the same error as @cookandy gets.
Here is my trust policy, which I don't think is incorrect (or if it is, please let me know)
{       "Sid": "",       "Effect": "Allow",       "Principal": {         "Federated": "arn:aws:iam::012345678901:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/5............237"       },       "Action": "sts:AssumeRoleWithWebIdentity",       "Condition": {         "StringEquals": {           "oidc.eks.eu-central-1.amazonaws.com/id/5............237:sub": "system:serviceaccount:cert-manager:cert-manager"         }       }     }
I also have this in the pod description:
Environment:                                                                                POD_NAMESPACE:                cert-manager (v1:metadata.namespace)                                                                                AWS_DEFAULT_REGION:           eu-central-1                                                                                AWS_REGION:                   eu-central-1                                                                                AWS_ROLE_ARN:                 arn:aws:iam::012345678901:role/cert-manager                                                                                AWS_WEB_IDENTITY_TOKEN_FILE:  /var/run/secrets/eks.amazonaws.com/serviceaccount/token                                                                                Mounts:                                                                                /var/run/secrets/eks.amazonaws.com/serviceaccount from aws-iam-token (ro)                                                                                /var/run/secrets/kubernetes.io/serviceaccount from cert-manager-token-2jxpg (ro)
and this is the values.yaml
image:   tag: v0.16.1 serviceAccount:   annotations:      eks.amazonaws.com/role-arn: arn:aws:iam::{{ .Values | get "aws.account" }}:role/cert-manager securityContext:   enabled: true
Failed to determine Route 53 hosted zone ID: WebIdentityErr: failed to retrieve credentials\ncaused by: AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity\n\tstatus code: 403
I don't really understand what am I missing.

@nikhileshva Did you check out the docs here? https://cert-manager.io/docs/configuration/acme/dns01/route53

@sc250024 I followed the doc and also the thread here. My initial setup was working with kube2iam, so I have the rout53 role policy in place which is working.
Now, switching to IRSA setup, first error I see was this
Failed to determine Route 53 hosted zone ID: WebIdentityErr: failed fetching WebIdentity token: \ncaused by: WebIdentityErr: unable to read file at /var/run/secrets/eks.amazonaws.com/serviceaccount/token\ncaused by: open /var/run/secrets/eks.amazonaws.com/serviceaccount/token: permission denied"

I figured that my service account was not setup correctly as it did not have the correct namespace there. After fixing this, I got the error mentioned in my previous post. Adding securityContext, as mentioned here in thread, didn't work either.

@nikhileshva did you fix your issue ? I have the same. IRSA is in place, annotation is on the service account, security context is set..  but I still have the error "is not authorized to perform: sts:AssumeRole on resource ..."

thanks @some-random-dude123
I am providing full ClusterIssuer on Staging for anyone who lands here from $searchEngine.
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: le-stg-issuer
spec:
  acme:
    email<EMAIL_ADDRESS>    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # Secret resource that will be used to store the account's private key.
      name: le-stg-issuer-account-key
    solvers:
    - selector:
        dnsZones:
        - "<hostedZoneDNS>"
      dns01:
        route53:
          region: <awsRegion>
          hostedZoneID: <hostedZoneID>

Sample kuard app using Nginx Inc. IC:
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kuard
spec:
  selector:
    matchLabels:
      app: kuard
  replicas: 2
  template:
    metadata:
      labels:
        app: kuard
    spec:
      containers:
      - image: gcr.io/kuar-demo/kuard-amd64:1
        imagePullPolicy: Always
        name: kuard
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: kuard
spec:
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
  selector:
    app: kuard

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kuard
  annotations:
    #  NB: it's a `cert-manager.io/cluster-issuer` and not `cert-manager.io/issuer`.
    cert-manager.io/cluster-issuer: "le-stg-issuer"
    nginx.org/proxy-connect-timeout: "60s"
    nginx.org/proxy-read-timeout: "30s"
    nginx.org/client-max-body-size: "6m"
    nginx.org/server-snippets: |
      # https://cipherlist.eu/
      ssl_protocols TLSv1.2 TLSv1.3;
spec:
  ingressClassName: "nginx"
  tls:
  - hosts:
    - my.host.name
    secretName: kuard-stg-tls
  rules:
  - host: my.host.name
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kuard
            port:
              number: 80

I know this is an old ticket already closed, but since I came here for some issue discussed here and still had it after going through the previous comments, then I am sharing my troubles how I solved it.
On cert manager 1.5.5, whatever the ClusterIssuer configuration (with or without role) I have the same error:
E0428 11:20:28.782720       1 controller.go:163] cert-manager/controller/challenges "msg"="re-queuing item due to error processing" "error"="failed to change Route 53 record set: WebIdentityErr: failed to retrieve credentials\ncaused by: AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity\n\tstatus code: 403, request id: b37eb35f-139b-4e6d-869a-e82cd1dd7fb9" "key"="<namespace>/<certificate-name>-gpwrv-1785813032-1499251413"

The reason was that I deployed cert manager using helm giving "foobar" as name for the release. So the cert manager pod was using a service account called oobar-cert-manager ... while my AWS web identity configuration was expecting cert-manager.
Enforcing the cert manager service account to be cert-manager fixed it. This go achieved using this in values.yaml for the chart deployment:
serviceAccount:
  create: true
  name: "cert-manager"  # This is the line that was missing
  annotations:
    k8s.dolby.io/role-arn: arn:aws:iam::<acount>:role/<rolename>

Note: you will still need to use spec.solvers[X].dns01.route53.role if your Route53 zones live inside another account. The reason is because the the IAM-linked service roles provide temporary credentials to your pod, but it will not assume the role for you.
The examples listed above from other users assume the role lives inside the same AWS account as the Route53 zones, which means the permissions to modify DNS records are attached to the role directly.
From AWS documentation, they give an example of an AWS config:
[profile account_b_role]
source_profile = account_a_role
role_arn=arn:aws:iam::222222222222:role/account-b-role

[profile account_a_role]
web_identity_token_file = /var/run/secrets/eks.amazonaws.com/serviceaccount/token
role_arn=arn:aws:iam::111111111111:role/account-a-role

Hi @sc250024 circling back to this...
We're utilizing IRSA for our Kubernetes cluster, and are attempting to assume another role from the service account role that has been assigned to cert manager (as a means of cross-account role assumption). Unfortunately, there isn't a way to inform Cert Manager, from the looks of things, to utilize the Web Token Identity File to do this effectively (as you've laid out here). We can't even set the AWS_PROFILE environment variable with a mounted config, as this would likely make the original role not work properly.
Any idea of how Cert Manager could handle this?

I have the same issues with cross-account IRSA. When I used explicit access and secret keys in K8s secret - everything was fine, but I wanted to remove all tokens and make eveything automagic, so I switched to IRSA. Now I can't debug what's going on as I am getting again and again the next message:
I1027 11:15:50.526798       1 route53.go:76] "cert-manager/route53-session-provider: using ambient credentials"
I1027 11:15:50.526866       1 route53.go:93] "cert-manager/route53-session-provider: assuming role" role="arn:aws:iam::308712144460:role/dns-manager"
E1027 11:15:50.531612       1 sync.go:282] "cert-manager/challenges/finalizer: error cleaning up challenge" err=<
	error instantiating route53 challenge solver: unable to assume role: WebIdentityErr: failed to retrieve credentials
	caused by: AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity
		status code: 403, request id: d82d60c1-9dcc-4e83-82d7-3f76a489bd67

no further debug, it is the maximum log level. I really wonder what requisites cert-manager is using to try AssumeRoleWithWebIdentity. I checked the permissions several times and I don't see any issues with it. However, cross-account IRSA is complicated, not so easy as I expected. But what's interesting - I was able to set up it for other services, but not for cert-manager.
Kindly looking for any assistance.
@brockoffdev @nikhileshva Did you manage to get it working?

I am having the same issue, I validated the events in AWS Cloudtrail and saw that AWS is providing the Accesskey and token, but I don't see access-denied in the assume-role with web-identity.
To test the process i modified the permissions in the trust-policy in the role, and then I saw some access-denied in cloudtrail, I am not sure what is happening :(

I have read all the comments and applied every combination of changes proposed, none worked.
But, for anyone else getting to my comment, here's what I did that made it work...
The eks.amazonaws.com/role-arn annotation on ServiceAccount should work. At least that's what I expected to see having worked with External Secrets Operator before. BUT IT DOES NOT! :x:
On the other hand, it seems that the normal AWS CLI workflow, having the following env vars on the cert-manager Deployment makes it work:

AWS_ROLE_ARN
AWS_WEB_IDENTITY_TOKEN_FILE

The cert-manager Deployment will take the [missing] AWS_REGION from the ClusterIssuer as it turns out.
Here's the piece of code that makes it work anyway if you're curious:
https://github.com/cert-manager/cert-manager/blob/aa17b34edea7d0cce6efaa099053b03606d3f84e/pkg/issuer/acme/dns/route53/route53.go#L96-L99
Additionally, you'd need the Kubernetes projected volumes manually mounted on the Deployment too!
Here's the full list of changes on the Deployment/cert-manager for your reference:
# ... truncated ...
containers:
  env:
    - name: AWS_ROLE_ARN
      value: arn:aws:iam::XXXXXXXXXXXX:role/cert-manager
    - name: AWS_WEB_IDENTITY_TOKEN_FILE
      value: /var/run/secrets/eks.amazonaws.com/token
  volumeMounts:
    - mountPath: /var/run/secrets/eks.amazonaws.com
      name: token
      readOnly: true
volumes:
  - name: token
    projected:
      defaultMode: 420
      sources:
        - serviceAccountToken:
            audience: sts.amazonaws.com
            expirationSeconds: 3600
            path: token
# ... truncated ...


Import docker compose project issues

Hello there!
First of all, thanks for this awesome product! :)
I have a docker-compose project that was already up-and-running before installing DockStation.
After running dockstation and creating a new project, by importing an existing compose-file, dockstation shows the project as stopped, even tho it's currently running.
Also, if I choose to start the "allegedly stopped" project, dockstation tries to recreate all containers, volumes, networks, etc...
How can i create an "imported" project and having it already "attached" to my existing docker-compose's containers(and its status)/volumes/networks/etc?
I'm using macOS, my dockstation version is 1.5.1, docker-engine is 18.09.02 and docker-compose is 1.23.2.
Best regards

Hi @rafaismyname
Hm. It's strange.
Did you create .env file with COMPOSE_PROJECT_NAME param before project importing?

@igor-lemon
Nope i have not set the COMPOSE_PROJECT_NAME param, i just ran docker-compose up and got my env up and running.
1- If i run via terminal, container's names would be the name of the docker-compose.yml file's folder. Ex.: Path of my project being \Users\Rafa\Dev\Project the name of the containers would be project_[serviceName]_[instanceCount] (project_database_1)
2- If starting the imported docker-compose.yml using Dockstation, it will create another containers (not re-utilizing the ones that were already created for that compose project) using the proper naming that Dockstation implies
Let me know if you need any other info. :)
Best regards

What is name of containers which was created via DockStation?
Can you show me your docker-compose config? You can write to<EMAIL_ADDRESS>


Layout resets

Closes #626.
Before submitting the PR, please make sure you do the following

[x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
[x] This message body should clearly illustrate what problems it solves.
[x] Ideally, include a test that fails without this PR but passes with it.

Tests

[x] Run the tests with pnpm test and lint the project with pnpm lint

Changesets

[x] If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpx changeset and following the prompts

Had an API that uses a module export to indicate that this is a reset layout been considered? That seems in a sense tidier than a separate file, especially since they're not allowed to coexist. Was that dismissed because it made it harder to check for at compile time? because it's harder for users to see at a glance?

Ooh. I kind of like @Conduitry's idea

Addressed that in https://github.com/sveltejs/kit/issues/626#issuecomment-812309617. tl;dr the manifest generator (which at present just looks at the names of files on the filesystem, and could theoretically be rewritten to take an array of strings, which is actually probably a good idea anyway) would have to a) know how to preprocess components, which incidentally implies becoming an async function, and b) be sufficiently good at static analysis that it understands all of these, and presumably an infinite number of weird edge cases:
export const reset = true;

const reset = true;
export { reset };

export const reset = some_value();

// export const reset = true;

Otherwise it would have to be determined at runtime by loading layout components higher up the tree, executing load (and hoping that they don't error), then discarding the result of calling load as soon as we encounter a reset.
In any case I think the filename is probably clearer insofar as you can understand the route structure by just looking at the filesystem.

Is it true that today the way of reseting layout is via the @ at the filename on page/layouts as pointed in docs ?


Upgrade TF dependency to v2.5-rc1.

What do these changes do?
This PR updates the TensorFlow dependency to recently released v2.5-rc0 v2.5-rc1.
How Has This Been Tested?
CI.
Benchmark Results
N/A, though we should collect new benchmark numbers before making a new release.
Related issue number
Depends on #627, will be a draft until then.

Nice, looks like we are getting closed:
larq_compute_engine/mlir/python/graphdef_tfl_flatbuffer.cc:7:10: fatal error: mlir/IR/Module.h: No such file or directory
    7 | #include "mlir/IR/Module.h"
      |          ^~~~~~~~~~~~~~~~~~
compilation terminated.

Nice, looks like we are getting closed:

Yeah, just building locally so that I can debug these properly, but fingers crossed not too far left to go :)

So, now CI is green, I've run a few test release builds: https://github.com/larq/compute-engine/actions/runs/751501689

MacOS builds pass (Python 3.6-3.9) ✅✅✅✅
One Windows build passes (Python 3.7), but the other three time-out. Once https://github.com/tensorflow/tensorflow/pull/48525 is merged we will be able to disable GCP and AWS builds on Windows as we do on Linux/Mac which will hopefully help with compile times. ✅❌❌❌
One Linux build currently fails with a internal compiler error: Segmentation fault, which then stops the other builds. Python 3.9 is currently unsupported in the custom-op Docker image that we use (even the TF-nightly version). 😱❓❓❌
The Android aar build passes ✅
Arm32 and Aarch64 benchmark binaries build successfully, but the Android benchmark binary fails (should be fixed by https://github.com/tensorflow/tensorflow/pull/48546) ✅✅❌

Thanks for tackling the update and the extended testing!

Python 3.9 is currently unsupported in the custom-op Docker image that we us

We currently still rely on an old TensorFlow image to do our builds. Therefore we install our custom Python version in the linux build skript and have a bunch of workarounds: https://github.com/larq/compute-engine/blob/657ef7984db5865c2469573b8e5f0d3553507c96/.github/tools/release_linux.sh#L9-L10
Maybe we can try adding a similar workaround for Python 3.9 as we did here:
https://github.com/larq/compute-engine/blob/657ef7984db5865c2469573b8e5f0d3553507c96/.github/tools/release_linux.sh#L18-L21
I tired updating the docker image at some point but ran into other errors and had to revert it in #558. We could look at what TF-Addons is doing, but that probably will require us rewrite our Linux build skript to remove all the workarounds that are tied to the ancient image although that might fix the compile errors.

internal compiler error: Segmentation fault

Do you think this could be caused by bazel simply running out of memory similar to how it sometimes did on Windows in the past?

Maybe we can try adding a similar workaround for Python 3.9

Ah nice, yeah that's a good idea. I only very briefly tried 3.9 on Linux, just by updating the image tag to nightly-custom-op. But I'll try again with edits to release_linux.sh as you suggest :)

internal compiler error: Segmentation fault

Do you think this could be caused by bazel simply running out of memory similar to how it sometimes did on Windows in the past?

Ah yes could well be, definitely something to investigate. There are a few Bazel options that I enabled for Windows to reduce memory usage, it's probably worth trying those with Linux too. Maybe also configuring the swap space.

I pushed a fix to reenable Python 3.9 builds on Linux. Note that this was tested on a large cloud VM, so the compiler segfaults did not reproduce.
I think for the remaining Linux build failures on CI our best shot is probably to enable the memory saving flags similar to our Windows builds or try and see if the targets added in https://github.com/larq/compute-engine/pull/628#discussion_r613301169 cause the problems.

Linux builds are now working for all Python versions, however the Windows builds still timeout after 6h (which is the maximum allowed runtime for GitHub actions).

Ah great, thanks for pushing this further Lukas :)
https://github.com/tensorflow/tensorflow/pull/48525 just got merged, which is nice, so I'll open a PR to cherry-pick that onto the 2.5 branch, and if that goes smoothly it might help with the Windows builds.

tensorflow/tensorflow#48525 just got merged, which is nice, so I'll open a PR to cherry-pick that onto the 2.5 branch, and if that goes smoothly it might help with the Windows builds.

And the cherry-pick is now merged, so I've updated the TF dependency and am running the test release again: https://github.com/larq/compute-engine/runs/2498846429?check_suite_focus=true. Fingers crossed the Windows builds now pass.

Hmm sadly the Windows builds still don't pass, they get roughly 90% of the way there: 9,017 / 9,710 targets within the six hour limit.
I'll try and investigate other options for speeding things up.

Hmm sadly the Windows builds still don't pass, they get roughly 90% of the way there: 9,017 / 9,710 targets within the six hour limit.
I'll try and investigate other options for speeding things up.

What if we add another bazel cache for these builds? Then they might fail a first time but should succeed a second time, and it would also just be faster in general. It might have be a separate cache from the normal CI tests since the build configuration is completely different and we don't want to invalidate the normal cache (although maybe bazel already takes care of this properly by itself).

I spent a while this evening running a Windows build on my home machine, and didn't learn much, except that I saw lots of MKL targets - turns out that MKL is built on Windows indescriminately, even if you try and disable it (also on Linux, for that matter): https://github.com/tensorflow/tensorflow/blob/5dcfc51118817f27fad5246812d83e5dccdc5f72/third_party/mkl/build_defs.bzl#L37. This might explain why MacOS builds are relatively a lot quicker.

Thanks for investigating! These logs also show up on CI and unfortunately 9922add4c15109398ac4798878fb000a64378b8b  makes the build crash :(
Do you think we can use the Windows equivalent of -O2 for the builds?

Thanks for investigating! These logs also show up on CI and unfortunately 9922add makes the build crash :(
Do you think we can use the Windows equivalent of -O2 for the builds?

Ah yeah I know, it turns out that TF is just completely incompatible with --config=fastbuild. I tried adding -DNDEBUG but that didn't help, tested on my local machine.
I think /O2 is probably what's already being used by Bazel with --config=opt, and in MSVC there is no /O3: https://docs.microsoft.com/en-us/cpp/build/reference/compiler-options-listed-by-category?view=msvc-160#optimization

The test release looks good: https://github.com/larq/compute-engine/actions/runs/857230232
Actually only one build timed out, 3/4 of the Windows ones succeeded. But as discussed above let's resolve the Windows build time issues later in a future PR.


Add option to recompress

Recompress the raw NBT back to GZIP. Minecraft doesn't seem to accept raw NBT at all (w00t).
MCPE level.dat header isn't hard to recreate too:

The file begins with an 8-byte header, consisting of a little-endian 4-byte integer indicating the type of the file, which is 3 (was 2 before latest update) for level.dat. It is followed by another integer containing the length of the file, minus the header.Minecraft Wiki

PS: Meanwhile for everyone else use the GNU™® gzip utility.

Adding Gzipping should be trivial. I haven't messed with MC in a while so I'll have to refamiliarize myself with the level.dat header. And my code :).


do not include all fontawesome icons to the bundle

import { library } from "@fortawesome/fontawesome-svg-core";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { fab } from "@fortawesome/free-brands-svg-icons";
import { fas } from "@fortawesome/free-solid-svg-icons";

library.add(fab, fas);

replace with only 4 icons used in dck-react-components
library.add(faSearch, faAngleUp, faAngleDown, faExclamationCircle);

not actual. current version of dck-react-components is going to be deprecated


Vue Tree list , how use it ?

Hello , my example https://codepen.io/anon/pen/yzErdy
thanks for help

What's the question ?

Probably better to ask the creators of that codepen. Don't see how this is related to nuxt


boundary: 0.7.5 -> 0.7.6

Description of changes
https://github.com/hashicorp/boundary/releases/tag/v0.7.6
Things done

Built on platform(s)

[ ] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[x] aarch64-darwin

[ ] For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
[ ] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[ ] Tested basic functionality of all binary files (usually in ./result/bin/)
22.05 Release Notes (or backporting 21.11 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module
[ ] (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes

[ ] Fits CONTRIBUTING.md.

Result of nixpkgs-review pr 164519 run on x86_64-linux 1

1 package built:

boundary


CVAT doesn't export instance annotations in the correct format

Hi there. I'm a big fan of using the openvino model assisted annotation. So I need to train a MaskRCNN and convert it to openvino then upload the model to cvat (have done it for faster rcnn). But to train MaskRCNN you need a TFrecord file and for that you need the XMLS( in the correct format) with the bounding box coordinates of the polygons and also the PNG masks. When I dump annotations in the sementation mask format I don't get the XMLS. When I export in other format coco it has a json file which has the bbox co-ords but that is not what's needed.. We need an xml per image not one big Json file in the wrong format.
CVAT doesn't export the write annotation files needed to (convert to tfrecord) and train maskRCNN.
I'm Running CVAT in docker. Using a slightly older version - just before serverless functions were introduced.
Cheers,
Sam

@zhiltsov-max , @davodogster , I have moved the issue into Datumaro repo. I believe the use case should be supported somehow inside the framework first.

There is an option --save-masks in tf_detection_api format of Datumaro, but in CVAT it is not used by default. How do you think, would it be adequate, if it was turned on by default (so the polygons were converted to masks, like in mask format of CVAT)? Maybe it should be another format, or an export option?

The masks are exported (voc segmentation) as PNG but they miss classes when there is more than one class as mentioned in the other issue from someone else (maybe it was fixed in the recent version of CVAT). The coco instance annotations (json) work for training TF1OD maskrcnn if you first run create_coco_tf_record.py to generated the sharded tfrecords. I have got it running. I had to use this helpful script to split the instances_default.json into training and validation https://github.com/akarazniewicz/cocosplit. It would be great if cvat exported pascal voc xmls with the bbox cordinates of the objects so that users can use a modified version of create_pet_tf_record.py to generate. 2 ways to train MaskRCNN tensorflow - 1. PNGs + Pascal bbox XMLS, 2. instances_default.json. Both get converted to tfrecord outside CVAT. even if you could do it in CVAT.. it wouldn't address the train-test split problem :)

@zhiltsov-max Hi Max, actually the Pascal VOC PNG Mask + XML per image is the much preferred annotation option for instance segmentation! This is because users need to merge training data from different tasks in cvat which is not possible if you just have one coco json file for each CVAT task (as opposed to each image). I annotate a task, train a model, upload the model to CVAT and apply it to a new task, then download the annotations then merge annotations from task 1 and task 2 (much easier if it's per image annotations instead of per task). Hope this makes sense. Sam

Take a look at Datumaro documentation ("transform", "merge", "export", "add and remove data" sections), I think, you might find something interesting there - particularly, about merging and splitting of datasets. For example, coco annotations can be easily merged.
What you are describing is just a full PASCAL VOC format - with xmls and masks, so what about using:
# export task as Datumaro project
# the project will have polygons, so we create a project with boxes and a project with masks

datum project transform -t polygons_to_masks -o masks_proj
datum project export -p masks_proj -f voc [-- --save-images]

datum project transform -t shapes_to_boxes -o boxes_proj
datum project export -p boxes_proj -f voc

@zhiltsov-max Thanks so much for this info! It looks promising so I will look into it. And I'm very happy to hear that task merging will be available in CVAT soon.

@zhiltsov-max The import command just created an empty directory called train_proj with nothing in it

There should be a .datumaro subdirectory, which is hidden by default.

@zhiltsov-max I think datumaro is a great concept.. but it needs more work - your basic functions fail for me.
Here it is (raw, looks good):

I exported the polygons as a Datumaro dataset, ran the transform command which just created a new (failed) default.json

failed results:

Please help - Cheers, Sam

Run export ... -- --label-map=source.

@zhiltsov-max Hi max, thank you for that additional code. It works if I run datum export -p masks_proj -f voc -- --label-map=source, I have npw exported a datumaro polygon dataset from CVAT and successfully converted it to coco json, png masks, tf record, and converted it to voc boxes, and then boxes to yolo. datum project transform is an interesting command, it seems to create a strange intermediate dataset which can then be converted to a proper dataset. COCO and TF instance format don't require the --label-map param.

Closing, the answer is in https://github.com/openvinotoolkit/datumaro/issues/28#issuecomment-700514967


ip address validation not working

Ip address validation passes for any given letter
console.log(is.ip('H'))

The regex for this seems to have been taken from this StackOverflow question:
http://stackoverflow.com/questions/23483855/javascript-regex-to-validate-ipv4-and-ipv6-address-no-hostnames
which itself appears to have come from a textbook. I'd suggest what needs to happen is the code for IP just runs the checks for IPv4 and IPv6 although I don't know if the performance may suffer as a result.  I might see if I can knock together a PR but I don't think the maintainer is actively managing this repo anymore.

Worth mentioning that the IPv6 validation has the same bug

I've added an explicit test for this in the PR.  You may want to fork your own version to incorporate this fix

Okay, let me check this