Boot fails after closing device

There seems to be some issues with the set of whitelisted commands.
I am using an im8xmp verdin SoM.
My build is based on the tdxref default manifest configuration (not the TorizonOS one).
I have added the INHERT = "tdx-signed" and other variables to use my custom certs and keys.
However, after closing the device I am unable to boot it.
I have now got a patch that sets my open allowed list to the same as the closed list so I can more easily debug and still flash new images using TEZI.
What I have found out is that my boot_cmd to load from mmc includes the use of part uuid which is only listed as CMD_CAT_PART_READ.
I believe 0001-toradex-common-add-command-whitelisting-modules.patch should include the CMD_CAT_NEEDED category so that it is an allowed command during boot.
Changing this one value appears to work for me, but not sure how to prepare a change and PR for this fix (I am a noob at yocto things).
Here is essentially what is being run to load the mmc2 root partition:
env set uuid_set 'part uuid ${root_devtype} ${root_devnum}:${root_part} uuid'
env set rootfsargs_set 'run uuid_set && env set rootfsargs root=PARTUUID=${uuid} ro rootwait'

@MMG-DG thanks for reporting and debugging the issue.
Maybe some recent change in the Toradex BSP caused this. Your proposed fix makes sense to me.
@rborn-tx what do you think?

@sergioprado Have we tested booting tdxref with hardening enabled? If so, then we should have seen messages saying that some command didn't pass the whitelist (which would prevent the boot when the device was closed). From the warnings, we should evaluate whether or not the commands are always safe and, if so, add them to the whitelist. This would require code changes so it would be normally be done by us at Toradex.
Users who decide to customize the boot script shouldn't need to do something like that; instead they would configure the set of allowed commands via the control FDT even on a compiled image (but we don't have the tooling for that yet and that's why this is not yet documented).

Maybe some recent change in the Toradex BSP caused this.

Checking the tdxref boot script I don't see recent changes. Thus my feeling is that we may have overlooked warning messages when testing tdxref.

@MMG-DG, you mentioned the device no longer booted after it was closed. I'm sorry to hear that.
Weren't warning messages shown on the console before the device was closed? You should have seen messages such as:
Command execution denied (blocked by category) for `part uuid mmc 0:2...`.

Similar problem would happen with the kernel command line protection.
By the way, I've just notice that the tdxref boot script is setting the kernel command line dynamically. This will most certainly cause issues with the kernel command line protection as well. Considering that, maybe the best solution for you at the moment is to disable the hardening in your Yocto config if building tdxref (in your local.conf for example):
TDX_UBOOT_HARDENING_ENABLE:forcevariable = "0"

If you are not enabling the rootfs protection (via dm-verity) the hardening doesn't add much value anyways.
Beware that all the hardening is currently tuned for Torizon OS images. Due to this, bumps are expected for other images, at least for now. We expect to improve this situation in the future.
Now, let me ask you something: have you considered using the Torizon OS minimal in your project, rather than tdxref? There all the hardening should work out of the box plus many other features such as remote and offline updates. The rootfs protection on Torizon OS is not implemented yet but it's an ongoing effort that we expect to finish in the near future.

@rborn-tx - I will have to double check, but I don't think we have any issues with the UBOOT hardening part.
In response to the question about the warnings...
I am new to the project I am working on (which is 9 months behind schedule at present). I was told it was all good, but found that not to be the case for the first SoM I flashed and fused. However, I have been digging into it all to figure out what was done and how to fix it.
As I am new to this project and the fact the initial delivery date is roughly 1 month away, I don't have the time now to review the Use of TorizonOS, but it is already something I have suggested as a high-priority item for our v2 release and as such that may be the way we go after initial release.
For this project our requirement is pretty much "if it can be secured it MUST be secured" (naturally that is coming from powers that are either not technical, or know what is generally possible in linux environments and throwing around buzz words).
P.S. Just messaged a colleague who worked on the initial builds and he says that warning never showed as the "open" definition is basically to allow all commands. I have just run a build with a patch to set the open value to be the same as the closed value so that at least we can see these warnings early and not brick any more SoMs.
P.P.S. Something else we have been looking at is using caam within u-boot to do encryption of the full rootfs (which seems to require some dek... commands. Is there and easy way for me to add these if/when needed to our layer? maybe as a conditional patch. What would be nice is if we could have a yocto variable that is expanded to generate the command definitions, so any custom layers can just append extra safe, unsafe and needed definitions.

@sergioprado Have we tested booting tdxref with hardening enabled?

@rborn-tx actually I was about to ask you that. When I worked in secure boot for iMX devices the hardening feature was not implemented yet and when I worked on secure boot for AM62 the hardening feature was not tested since it is disabled by default. Remeber that when this feature was developed and merged, I was not part of the security team. So yeah, I didn't have a chance to test this in a BSP image. And based on your answer, I guess when thjis feature was developed, only Torizon OS was tested. Is that right? If so, I would recommend to disable this feature by default in this layer, until this is properly tested in BSP builds. Does that make sense to you?
@MMG-DG while we have the hardening properly tested for BSP images, I would recommend you to just disabled it by adding the following line to a configuration file, as already recommended by Rogerio:
TDX_UBOOT_HARDENING_ENABLE:forcevariable = "0"

Just to be sure...
When you say "BSP images", you mean the TorizonOS ones only?
We are using the tdx-reference-minimal-image as our base and building on top of that. Is this not a BSP image?

Unfortunately, my project specifically states we have to use it and have it turned on.
The only issue we had with doing this was that single needed command (part uuid) in the whitelist when closing the device.
If that single change makes it into this repo, then as far as my overlords are concerned it is working for our use case and I will have to continue with everything as is.

@sergioprado

And based on your answer, I guess when thjis feature was developed, only Torizon OS was tested. Is that right?

That's right.

If so, I would recommend to disable this feature by default in this layer, until this is properly tested in BSP builds. Does that make sense to you?

That's likely the best we can do for now since our focus is Torizon OS. But let's discussed it internally.

I built a tdx-reference-minimal-image and ran it to get the following message on the console:
...
   Uncompressing Kernel Image
   Loading Device Tree to 000000007dee9000, end 000000007defc4cc ... OK
## WARNING: Required node "/chosen/toradex,secure-boot" could not be found in device-tree.
## WARNING: Allowing boot while device is open; please fix bootargs before closing device.
...

Due to the lack of the device-tree node mentioned above (which comes from a special overlay called <MACHINE>-secboot-kargs_overlay.dtbo) the hardening is actually disabled. After I added the said overlay to overlays.txt in the image I got a different message:
## WARNING: Initial part of passed bootargs string (A) does not match 'required-bootargs' property (B) in device-tree.
##  A: "root=PARTUUID=f1065cb0-02 ro rootwait console=tty1 console=ttymxc0,115200 consoleblank=0 earlycon"
##  B: "root=PARTUUID=7ad80ede-02 ro rootwait console=tty1 console=ttymxc0,115200 consoleblank=0 earlycon"
## WARNING: Allowing boot while device is open; please fix bootargs before closing device.

Still, I didn't get messages complaining about commands not passing the whitelist which is definitely an issue.
Anyways, the above shows that even if we added "part uuid" to the needed list, one would still face problems with booting the tdxref image with hardening enabled, in this case related to the kernel arguments protection. Solving that part would be a bit harder because the tdxref image passes a variable part which must be validated by U-Boot.
@MMG-DG So, unfortunately, at the moment the hardening is not really usable with the BSP images. The short term solution is just disabling it as we suggested before. By doing so you still get a full chain of trust (if you care about the buzzword :smile:) if using the tdxref-signed class, even though the chain can be broken under special circumstances.
Thanks again for reporting the problem!

Unfortunately, my project specifically states we have to use it and have it turned on.

@MMG-DG interesting. Would you please elaborate more on why this is a requirement for your project?

Hi,
It's me again....
I am now back on testing this part of the build (deadline tomorrow), and I just want to try and confirm some things....
based on previous reply about messages on the console:

...
Uncompressing Kernel Image
Loading Device Tree to 000000007dee9000, end 000000007defc4cc ... OK
WARNING: Required node "/chosen/toradex,secure-boot" could not be found in device-tree.
WARNING: Allowing boot while device is open; please fix bootargs before closing device.
...

and

## WARNING: Initial part of passed bootargs string (A) does not match 'required-bootargs' property (B) in device-tree.
##  A: "root=PARTUUID=f1065cb0-02 ro rootwait console=tty1 console=ttymxc0,115200 consoleblank=0 earlycon"
##  B: "root=PARTUUID=7ad80ede-02 ro rootwait console=tty1 console=ttymxc0,115200 consoleblank=0 earlycon"
## WARNING: Allowing boot while device is open; please fix bootargs before closing device.

I am not seeing anything like these at all. I have set my fuses (except the final one) for the certificates. I am seeing no HAB issues, but I am also still seeing hab fuse not enabled.  Is this right? or should this say something else? I was expecting something else as I have set everything except the last fuse to make Secure Boot a no-return thing.
I also don't see any warnings like you do. I am sure I am missing something, but not sure what.
Here is a brief extract of what I see in the console:
U-Boot SPL 2022.04-6.7.0-devel+git.7588eb559ca2 (May 28 2024 - 11:19:14 +0000)
DDRINFO: start DRAM init
DDRINFO: DRAM rate 4000MTS
DDRINFO:ddrphy calibration done
DDRINFO: ddrmix config done
DDR configured as dual rank
SEC0:  RNG instantiated
Normal Boot
WDT:   Started watchdog@30280000 with servicing (60s timeout)
Boot Stage: Primary boot
Find img info 0x&48026c00, size 20480
Need continue download 19456
Download 883712, Total size 903712
hab fuse not enabled

Authenticate image from DDR location 0x401fadc0...
NOTICE:  BL31: v2.6(release):lf_v2.6-g3c1583ba0a
NOTICE:  BL31: Built : 11:00:38, Nov 21 2022
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.148-6.7.0-devel+git.f437ddb7191d (oe-user@oe-host) (aarch64-tdx-linux-gcc (GCC) 11.4.0, GNU ld (GNU Binutils) 2.38.20220708) #1 SMP PREEMPT Wed May 15 17:04:15 UTC 2024
[    0.000000] Machine model: Toradex Verdin iMX8M Plus WB on Verdin Development Board
[    0.000000] efi: UEFI not found.
[    0.000000] Reserved memory: created CMA memory pool at 0x00000000de000000, size 512 MiB
[    0.000000] OF: reserved mem: initialized node linux,cma, compatible id shared-dma-pool
[    0.000000] earlycon: ec_imx6q0 at MMIO 0x0000000030880000 (options '')
[    0.000000] printk: bootconsole [ec_imx6q0] enabled
[    0.000000] NUMA: No NUMA configuration found
[    0.000000] NUMA: Faking a node at [mem 0x0000000040000000-0x000000013fffffff]
[    0.000000] NUMA: NODE_DATA [mem 0x13f796800-0x13f798fff]
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x00000000ffffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   [mem 0x0000000100000000-0x000000013fffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x000000013fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000013fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 19 pages/cpu s38936 r8192 d30696 u77824
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: detected: ARM erratum 845719
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 1032192
[    0.000000] Policy zone: Normal
[    0.000000] Kernel command line: root=PARTUUID=5fe27906-02 ro rootwait console=tty1 console=ttymxc2,115200 consoleblank=0 earlycon
[    0.000000] Dentry cache hash table entries: 524288 (order: 10, 4194304 bytes, linear)
[    0.000000] Inode-cache hash table entries: 262144 (order: 9, 2097152 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:on, heap free:on
[    0.000000] mem auto-init: clearing system memory may take some time...
[    0.000000] software IO TLB: mapped [mem 0x00000000da000000-0x00000000de000000] (64MB)
[    0.000000] Memory: 3493776K/4194304K available (17216K kernel code, 1712K rwdata, 6492K rodata, 3136K init, 508K bss, 176240K reserved, 524288K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000] rcu: 	RCU event tracing is enabled.
[    0.000000] rcu: 	RCU restricting CPUs from NR_CPUS=256 to nr_cpu_ids=4.
[    0.000000] 	Trampoline variant of Tasks RCU enabled.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=4
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 160 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] GICv3: Distributor has no Range Selector support
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv3: 16 PPIs implemented
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x0000000038880000
[    0.000000] ITS: No ITS available, not enabling LPIs
[    0.000000] arch_timer: cp15 timer(s) running at 8.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x1d854df40, max_idle_ns:<PHONE_NUMBER>20 ns
[    0.000000] sched_clock: 56 bits at 8MHz, resolution 125ns, wraps every<PHONE_NUMBER>500ns
[    0.008632] Console: colour dummy device 80x25
[    0.012999] printk: console [tty1] enabled
[    0.016701] Calibrating delay loop (skipped), value calculated using timer frequency.. 16.00 BogoMIPS (lpj=32000)
[    0.026966] pid_max: default: 32768 minimum: 301
[    0.031649] LSM: Security Framework initializing
[    0.036330] Mount-cache hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.043676] Mountpoint-cache hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.053177] rcu: Hierarchical SRCU implementation.
[    0.057274] EFI services will not be available.
[    0.061185] smp: Bringing up secondary CPUs ...
[    0.065965] Detected VIPT I-cache on CPU1
[    0.065992] GICv3: CPU1: found redistributor 1 region 0:0x00000000388a0000
[    0.066032] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.066529] Detected VIPT I-cache on CPU2
[    0.066551] GICv3: CPU2: found redistributor 2 region 0:0x00000000388c0000
[    0.066574] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.067041] Detected VIPT I-cache on CPU3
[    0.067063] GICv3: CPU3: found redistributor 3 region 0:0x00000000388e0000
[    0.067082] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.067152] smp: Brought up 1 node, 4 CPUs
[    0.122082] SMP: Total of 4 processors activated.
[    0.126797] CPU features: detected: 32-bit EL0 Support
[    0.131979] CPU features: detected: CRC32 instructions
[    0.137168] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.154267] CPU: All CPU(s) started at EL2
[    0.155536] alternatives: patching kernel code
[    0.161482] devtmpfs: initialized
[    0.176819] KASLR disabled due to lack of seed
[    0.178589] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns:<PHONE_NUMBER>100000 ns
[    0.188257] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.273963] pinctrl core: initialized pinctrl subsystem
[    0.276980] DMI not present or invalid.
[    0.280835] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.295914] DMA: preallocated 512 KiB GFP_KERNEL pool for atomic allocations
[    0.300568] DMA: preallocated 512 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.308456] DMA: preallocated 512 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.315983] audit: initializing netlink subsys (disabled)
[    0.321542] audit: type=2000 audit(0.248:1): state=initialized audit_enabled=0 res=1
[    0.322048] thermal_sys: Registered thermal governor 'step_wise'
[    0.329140] thermal_sys: Registered thermal governor 'power_allocator'
[    0.335476] cpuidle: using governor menu
[    0.345923] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[    0.352580] ASID allocator initialised with 65536 entries
[    0.358227] Serial: AMBA PL011 UART driver
[    0.362105] imx mu driver is registered.
[    0.365974] imx rpmsg driver is registered.
[    0.383326] imx8mp-pinctrl 30330000.pinctrl: initialized IMX pinctrl driver
[    0.399153] platform 32e80000.lcd-controller: Fixing up cyclic dependency with 32e60000.mipi_dsi
[    0.411891] platform 32fd8000.hdmi: Fixing up cyclic dependency with 32fc6000.lcd-controller
[    0.437267] HugeTLB registered 1.00 GiB page size, pre-allocated 0 pages
[    0.441182] HugeTLB registered 32.0 MiB page size, pre-allocated 0 pages
[    0.447926] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages
[    0.454634] HugeTLB registered 64.0 KiB page size, pre-allocated 0 pages
[    0.462677] cryptd: max_cpu_qlen set to 1000
[    0.469045] ACPI: Interpreter disabled.
[    0.471952] iommu: Default domain type: Translated
[    0.474960] iommu: DMA domain TLB invalidation policy: strict mode
[    0.481610] SCSI subsystem initialized
[    0.485373] usbcore: registered new interface driver usbfs
[    0.490562] usbcore: registered new interface driver hub
[    0.495883] usbcore: registered new device driver usb
[    0.502096] mc: Linux media interface: v0.10
[    0.505253] videodev: Linux video capture interface: v2.00
[    0.510802] pps_core: LinuxPPS API ver. 1 registered
[    0.515718] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti<EMAIL_ADDRESS>[    0.524925] PTP clock support registered
[    0.529049] EDAC MC: Ver: 3.0.0
[    0.533159] FPGA manager framework
[    0.535495] Advanced Linux Sound Architecture Driver Initialized.
[    0.542806] clocksource: Switched to clocksource arch_sys_counter
[    0.547850] VFS: Disk quotas dquot_6.6.0
[    0.551659] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[    0.558699] pnp: PnP ACPI: disabled
[    0.569130] NET: Registered PF_INET protocol family
[    0.571308] IP idents hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.580235] tcp_listen_portaddr_hash hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.587272] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.595000] TCP established hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.603170] TCP bind hash table entries: 32768 (order: 7, 524288 bytes, linear)
[    0.610762] TCP: Hash tables configured (established 32768 bind 32768)
[    0.616948] UDP hash table entries: 2048 (order: 4, 65536 bytes, linear)
[    0.623671] UDP-Lite hash table entries: 2048 (order: 4, 65536 bytes, linear)
[    0.630965] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.636916] RPC: Registered named UNIX socket transport module.
[    0.642421] RPC: Registered udp transport module.
[    0.647138] RPC: Registered tcp transport module.
[    0.651861] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.659098] hw perfevents: enabled with armv8_cortex_a53 PMU driver, 7 counters available
[    0.670922] Initialise system trusted keyrings
[    0.672675] workingset: timestamp_bits=42 max_order=20 bucket_order=0
[    0.685817] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.689484] NFS: Registering the id_resolver key type
[    0.693950] Key type id_resolver registered
[    0.698105] Key type id_legacy registered
[    0.702217] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[    0.708879] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[    0.716456] 9p: Installing v9fs 9p2000 file system support
[    0.757403] Key type asymmetric registered
[    0.758658] Asymmetric key parser 'x509' registered
[    0.763614] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 243)
[    0.771006] io scheduler mq-deadline registered
[    0.775547] io scheduler kyber registered
[    0.784552] EINJ: ACPI disabled.
[    0.794236] mxs-dma 33000000.dma-apbh: initialized
[    0.797564] SoC: i.MX8MP revision 1.1
[    0.800499] Bus freq driver module loaded
[    0.810935] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[    0.816882] 30860000.serial: ttymxc0 at MMIO 0x30860000 (irq = 34, base_baud = 1500000) is a IMX
[    0.823796] 30880000.serial: ttymxc2 at MMIO 0x30880000 (irq = 35, base_baud = 1500000) is a IMX
[    0.832120] printk: console [ttymxc2] enabled
[    0.832120] printk: console [ttymxc2] enabled
[    0.840760] printk: bootconsole [ec_imx6q0] disabled
[    0.840760] printk: bootconsole [ec_imx6q0] disabled
[    0.851195] 30890000.serial: ttymxc1 at MMIO 0x30890000 (irq = 36, base_baud = 1500000) is a IMX
[    0.879612] brd: module loaded
[    0.887503] loop: module loaded
[    0.898426] tun: Universal TUN/TAP device driver, 1.6
[    0.904924] usbcore: registered new device driver r8152-cfgselector
[    0.911260] usbcore: registered new interface driver r8152
[    0.916922] VFIO - User Level meta-driver version: 0.3
[    0.927925] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    0.934554] ehci-platform: EHCI generic platform driver
[    0.940086] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    0.946308] ohci-platform: OHCI generic platform driver
[    0.952524] usbcore: registered new interface driver uas
[    0.957902] usbcore: registered new interface driver usb-storage
[    0.963996] usbcore: registered new interface driver usbserial_generic
[    0.970561] usbserial: USB Serial support registered for generic
[    0.976611] usbcore: registered new interface driver ftdi_sio
[    0.982395] usbserial: USB Serial support registered for FTDI USB Serial Device
[    0.989751] usbcore: registered new interface driver usb_serial_simple
[    0.996313] usbserial: USB Serial support registered for carelink
[    1.002447] usbserial: USB Serial support registered for flashloader
[    1.008834] usbserial: USB Serial support registered for funsoft
[    1.014871] usbserial: USB Serial support registered for google
[    1.020824] usbserial: USB Serial support registered for hp4x
[    1.026603] usbserial: USB Serial support registered for kaufmann
[    1.032733] usbserial: USB Serial support registered for libtransistor
[    1.039296] usbserial: USB Serial support registered for moto_modem
[    1.045596] usbserial: USB Serial support registered for motorola_tetra
[    1.052242] usbserial: USB Serial support registered for nokia
[    1.058106] usbserial: USB Serial support registered for novatel_gps
[    1.064495] usbserial: USB Serial support registered for siemens_mpi
[    1.070880] usbserial: USB Serial support registered for suunto
[    1.076833] usbserial: USB Serial support registered for vivopay
[    1.082874] usbserial: USB Serial support registered for zio
[    1.088575] usbcore: registered new interface driver usb_ehset_test
[    1.095178] usbcore: registered new device driver onboard-usb-hub
[    1.105120] input: 30370000.snvs:snvs-powerkey as /devices/platform/soc@0/30000000.bus/30370000.snvs/30370000.snvs:snvs-powerkey/input/input0
[    1.120168] snvs_rtc 30370000.snvs:snvs-rtc-lp: registered as rtc1
[    1.126550] i2c_dev: i2c /dev entries driver
[    1.136177] device-mapper: ioctl: 4.45.0-ioctl (2021-03-22) initialised<EMAIL_ADDRESS>[    1.144909] EDAC MC: ECC not enabled
[    1.150094] sdhci: Secure Digital Host Controller Interface driver
[    1.156302] sdhci: Copyright(c) Pierre Ossman
[    1.161244] Synopsys Designware Multimedia Card Interface Driver
[    1.168105] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.177019] ledtrig-cpu: registered to indicate activity on CPUs
[    1.184159] SMCCC: SOC_ID: ARCH_SOC_ID not implemented, skipping ....
[    1.191956] caam 30900000.crypto: device ID = 0x0a16040100000100 (Era 9)
[    1.198708] caam 30900000.crypto: job rings = 2, qi = 0
[    1.207709] mmc2: SDHCI controller on 30b60000.mmc [30b60000.mmc] using ADMA
[    1.226698] caam algorithms registered in /proc/crypto
[    1.232979] caam 30900000.crypto: caam pkc algorithms registered in /proc/crypto
[    1.240513] caam 30900000.crypto: rng crypto API alg registered prng-caam
[    1.247335] caam 30900000.crypto: registering rng-caam
[    1.253747] Device caam-keygen registered
[    1.259305] usbcore: registered new interface driver usbhid
[    1.264910] usbhid: USB HID core driver
[    1.274229] mmc2: new HS400 Enhanced strobe MMC card at address 0001
[    1.274926]  cs_system_cfg: CoreSight Configuration manager initialised
[    1.281459] mmcblk2: mmc2:0001 IX2932 29.1 GiB
[    1.289670] random: crng init done
[    1.290669] hantrodec 0 : module inserted. Major = 235
[    1.291181] hantrodec 1 : module inserted. Major = 235
[    1.292228] hantroenc: HW at base <0000000038320000> with ID <0x80006200>
[    1.295659]  mmcblk2: p1 p2 p3 p4
[    1.300554] hx280enc: module inserted. Major <234>
[    1.307793] mmcblk2boot0: mmc2:0001 IX2932 4.00 MiB
[    1.317948] NET: Registered PF_LLC protocol family
[    1.321739] mmcblk2boot1: mmc2:0001 IX2932 4.00 MiB
[    1.326106] NET: Registered PF_INET6 protocol family
[    1.331380] mmcblk2rpmb: mmc2:0001 IX2932 4.00 MiB, chardev (237:0)
[    1.336829] Segment Routing with IPv6
[    1.350309] In-situ OAM (IOAM) with IPv6
[    1.354302] NET: Registered PF_PACKET protocol family
[    1.360179] 8021q: 802.1Q VLAN Support v1.8
[    1.364500] 9pnet: Installing 9P2000 support
[    1.368819] tsn generic netlink module v1 init...
[    1.373615] Key type dns_resolver registered
[    1.378579] Loading compiled-in X.509 certificates
[    1.390809] Loaded X.509 cert 'Build time autogenerated kernel key: f060c2f64935e45cda8d2a3b0907544ea0539f16'
[    1.401325] Key type trusted registered
[    1.428745] +V3.3_SD: supplied by +V3.3_SW
[    1.446144] nxp-pca9450 0-0025: pca9450bc probed.
[    1.452387] rtc-ds1307 0-0032: oscillator failed, set time!
[    1.458437] rtc-ds1307 0-0032: registered as rtc0
[    1.463491] rtc-ds1307 0-0032: hctosys: unable to read the hardware clock
[    1.473129] at24 0-0050: supply vcc not found, using dummy regulator
[    1.480085] at24 0-0050: 256 byte 24c02 EEPROM, writable, 16 bytes/write
[    1.486879] i2c i2c-0: IMX I2C adapter registered
[    1.492796] i2c i2c-1: IMX I2C adapter registered
[    1.498596] i2c 2-000f: Fixing up cyclic dependency with 32e40000.csi
[    1.505560] i2c 2-0021: Fixing up cyclic dependency with 32e50000.csi
[    1.512380] i2c i2c-2: IMX I2C adapter registered
[    1.518777] i2c 3-0048: Fixing up cyclic dependency with 32e60000.mipi_dsi
[    1.525751] i2c 3-0048: Fixing up cyclic dependency with hdmi-connector
[    1.533136] i2c i2c-3: IMX I2C adapter registered
[    1.538592] imx8mq-usb-phy 381f0040.usb-phy: supply vbus not found, using dummy regulator
[    1.566682] pps pps0: new PPS source ptp0
[    1.578191] fec 30be0000.ethernet eth0: registered PHC device 0
[    1.585099] clk: failed to reparent hsio_axi to sys_pll2_500m: -16
[    1.596007] clk: failed to reparent hsio_axi to sys_pll2_500m: -16
[    1.602916] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    1.608453] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 1
[    1.616539] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x0000002001010010
[    1.625996] xhci-hcd xhci-hcd.1.auto: irq 79, io mem 0x38200000
[    1.632079] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    1.637590] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 2
[    1.645269] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[    1.652986] hub 1-0:1.0: USB hub found
[    1.656793] hub 1-0:1.0: 1 port detected
[    1.661073] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    1.670290] hub 2-0:1.0: USB hub found
[    1.674087] hub 2-0:1.0: 1 port detected
[    1.678653] imx-cpufreq-dt imx-cpufreq-dt: cpu speed grade 7 mkt segment 2 supported-hw 0x80 0x4
[    1.690488] mxc-mipi-csi2-sam 32e40000.csi: supply mipi-phy not found, using dummy regulator
[    1.691970] sdhci-esdhc-imx 30b50000.mmc: Got CD GPIO
[    1.699366] : mipi_csis_imx8mp_phy_reset, No remote pad found!
[    1.709950] mxc-mipi-csi2-sam 32e40000.csi: lanes: 4, hs_settle: 13, clk_settle: 2, wclk: 1, freq: 500000000
[    1.720734] mxc-mipi-csi2-sam 32e50000.csi: supply mipi-phy not found, using dummy regulator
[    1.723667] mmc0: SDHCI controller on 30b40000.mmc [30b40000.mmc] using ADMA
[    1.729609] : mipi_csis_imx8mp_phy_reset, No remote pad found!
[    1.742248] mxc-mipi-csi2-sam 32e50000.csi: lanes: 1, hs_settle: 13, clk_settle: 2, wclk: 1, freq: 108000000
[    1.744032] mmc1: SDHCI controller on 30b50000.mmc [30b50000.mmc] using ADMA
[    1.753821] isi-capture 32e00000.isi:cap_device: deferring 32e00000.isi:cap_device device registration
[    1.768618] mxc-isi 32e00000.isi: mxc_isi.0 registered successfully
[    1.776432] isi-capture 32e02000.isi:cap_device: deferring 32e02000.isi:cap_device device registration
[    1.785895] mxc-isi 32e02000.isi: mxc_isi.1 registered successfully
[    1.793945] On-module +V3.3_ETH: supplied by On-module +V3.3 (BUCK4)
[    1.890433] mmc0: new ultra high speed SDR104 SDIO card at address 0001
[    2.010069] dwhdmi-imx 32fd8000.hdmi: Detected HDMI TX controller v2.13a with HDCP (samsung_dw_hdmi_phy2)
[    2.020804] dwhdmi-imx 32fd8000.hdmi: registered DesignWare HDMI I2C bus driver
[    2.030237] imx-dwmac 30bf0000.ethernet: IRQ eth_lpi not found
[    2.037042] imx-dwmac 30bf0000.ethernet: User ID: 0x10, Synopsys ID: 0x51
[    2.043865] imx-dwmac 30bf0000.ethernet: 	DWMAC4/5
[    2.048668] imx-dwmac 30bf0000.ethernet: DMA HW capability register supported
[    2.055830] imx-dwmac 30bf0000.ethernet: RX Checksum Offload Engine supported
[    2.062978] imx-dwmac 30bf0000.ethernet: Wake-Up On Lan supported
[    2.069150] imx-dwmac 30bf0000.ethernet: Enable RX Mitigation via HW Watchdog Timer
[    2.076826] imx-dwmac 30bf0000.ethernet: Enabled L3L4 Flow TC (entries=8)
[    2.083631] imx-dwmac 30bf0000.ethernet: Enabled RFS Flow TC (entries=8)
[    2.090368] imx-dwmac 30bf0000.ethernet: Enabling HW TC (entries=256, max_off=256)
[    2.097955] imx-dwmac 30bf0000.ethernet: Using 34 bits DMA width
[    2.113624] input: gpio-keys as /devices/platform/gpio-keys/input/input1
[    2.142413] ALSA device list:
[    2.145418]   No soundcards found.
[    2.158748] EXT4-fs (mmcblk2p2): mounted filesystem with ordered data mode. Opts: (null). Quota mode: none.
[    2.168808] VFS: Mounted root (ext4 filesystem) readonly on device 179:2.
[    2.179202] devtmpfs: mounted
[    2.183105] Freeing unused kernel memory: 3136K
[    2.187740] Run /sbin/init as init process
[    2.333839] systemd[1]: systemd 250.5+ running in system mode (-PAM -AUDIT -SELINUX -APPARMOR -IMA -SMACK -SECCOMP -GCRYPT -GNUTLS +OPENSSL -ACL +BLKID -CURL -ELFUTILS -FIDO2 -IDN2 -IDN -IPTC -KMOD -LIBCRYPTSETUP +LIBFDISK -PCRE2 -PWQUALITY -P11KIT -QRENCODE -BZIP2 -LZ4 -XZ -ZLIB -ZSTD -BPF_FRAMEWORK -XKBCOMMON -UTMP -SYSVINIT default-hierarchy=hybrid)
[    2.365968] systemd[1]: Detected architecture arm64.

Welcome to TDX Wayland with XWayland 6.7.0-devel-20240703125556+build.0 (kirkstone)!

Does this look correct to you, or is there something missing?
Fingers crossed you can point me in the right direction before I potentially break another SoM.

On a related note.....
Shouldn't it be possible to specify multiple categories in the bootloader-commands of the device tree?
I have allow-open = <CMD_CAT_ALL_SAFE, CMD_CAT_FUSE_WRITE>; for my testing image, but that fails to build.
I am assuming I have the incorrect syntax.

OK, after a lot of testing and playing I think we can close this issue.
This is definitely not going to work without a fair amount of thinking :-)
If/when I get some time, I may look into what is happening and see if I can make this a bit more generic to work for the other images (unless the powers-that-be decide to just go with TorizonOS for the next round of images).

Disabling the hardening as I said at the beginning would be the easiest at the moment.
Another possibility would be disabling only the kernel command line protection (which is the part of the hardening that is harder to make work on the BSP reference images). We don't have an option for that but you could do it by adding a config fragment to u-boot setting CONFIG_TDX_BOOTARGS_PROTECTION=n.
Anyways, we do have plans to make the hardening work on BSP reference images, but that it's a low priority task that may take a while to be scheduled. In the long term I'd suggest consider switching to Torizon OS so you get all of the secure boot features plus many others for free.

@MMG-DG, as @rborn-tx mentioned, we have the hardening feature in our backlog. As soon as it gets some priority, we will work on it.
For now, I will leave this issue opened. It is a honest bug report of a feature documented but that currently doesn't work. Hopefully we can fix that soon.
Thanks again for reporting!

Obs: I just changed the title of the issue to describe better the problem.

Hi,
FYI: this is MMG_DG, from one of my home accounts.
I have setup several test for some of the options mentioned here.
These have hopefully been tested while I was on holiday by my team.
Depending on the results, I may have a branch I can create a PR on that disabled the bootargs protection on non-torizon builds.
I have also been working on a patch and some changes that should (if they work), enable the bootargs ability for the base BSP images (tdx minimal and multimedia reference images).
In the long run, I think we will be looking to eventually swap to torizon os. At which point I will probably have a million questions on how that works 😁

Sounds good, thanks for the update!

Merry Christmas,
I have been working on this for a while now and wanted to quickly run a "theory" past you guys....
Note: I have added TDX_UBOOT_SILENT_ENABLE to add the extra silencing of u-boot we require (e.g. adding silent=1 to bootargs via a patch).
If I add a u-boot-distro-boot.bbappend with the following to my layer:
TDX_UBOOT_SILENT_ENABLE ?= "0"
TDX_UBOOT_ROOTFS_IDENTIFIER ?= "root=/dev/\x24{root_devtype}blk\x24{root_devnum}p\x24{root_part} rootfstype=${TEZI_ROOT_PART_TYPE}"
TDX_UBOOT_CONSOLE_BOOTARGS ?= "${@oe.utils.conditional('TDX_UBOOT_SILENT_ENABLE', '1', 'console=null', 'console=ttymxc2,115200', d)}"

do_deploy:prepend() {
    sed -i \
        -e 's/console=\x24{console},\x24{baudrate}/${TDX_UBOOT_CONSOLE_BOOTARGS}/g' \
        -e '/env set uuid_set/d' \
        -e 's/run uuid_set && //g' \
        -e "s@rootfsargs root=PARTUUID=\x24{uuid} ro@rootfsargs ${TDX_UBOOT_ROOTFS_IDENTIFIER} ro@g" \
        -e "s@echo \"Booting from \x24{devtype} failed!\" && false@echo \"Booting from \x24{devtype} failed!\" && reset@" \
        "${WORKDIR}/boot.cmd.in"
}

Note: the reset in the last change above I believe will force the system to reset instead of jumping into the u-boot init prompt (which was highlighted in our security review as a bad thing as it potentially allows a way to break the secure boot process).
Also in my conf/local.conf I added:
TDX_SECBOOT_REQUIRED_BOOTARGS = "${TDX_UBOOT_ROOTFS_IDENTIFIER} ro rootwait console=tty1 ${TDX_UBOOT_CONSOLE_BOOTARGS} consoleblank=0 earlycon"
TEZI_EXTERNAL_KERNEL_DEVICETREE_BOOT:append = "${TDX_SECBOOT_KARGS_OVERLAY}.dtbo"

Then the bootargs verification seems to work fine.
This also removes the use of part uuid which avoids the original issue I had with the whitelisting.
Does this look correct? or is there a better way to do this?
FYI, once I have finished my current project release process I will clean-up the branch I have and submit possible PR with the changes to support this.
My only other question is if it is possible to apply these changes only when :torizonis NOT in the overrides? As that way it will not affect the Torizon builds as you already do what is required there for it to work.
Regards,
MMG

@MMG-DG as far as I understood, this is another approach to hardening U-Boot, by disabling the command-line prompt and limiting the parameters passed to the kernel at build time, am I right?
Are you implementing this on top of the U-Boot hardening feature we have, or to substitute it?

@sergioprado - This is to make what you have for the hardening work on the base BSP reference images (currently our build uses the reference minimal image).
The main issue was the validation of the kernel bootargs. However, with these changes (which I will have in my fork soon and will create a PR for officially) I can get everything to work for the u-boot hardening.
The only caveat at the moment is that I also force the addition of :torizon into the overrides so the code to prevent the hardening on the bsp images is side-stepped while I am testing it all.
My hope is that if this is cleaned up and my PR gets accepted then this layer will be able to work on all the tdx images as well as torizon.

Hi @MMG-DG, let me give you some feedback on this:

Note: the reset in the last change above I believe will force the system to reset instead of jumping into the u-boot init prompt (which was highlighted in our security review as a bad thing as it potentially allows a way to break the secure boot process).

If you're using the CLI access prevention feature that is part of the hardening then U-Boot would not enter its CLI once the boot script is finished (e.g. if it does not succeed in booting the OS), so you wouldn't need to concern yourself much about this in the boot script.
However, to highlight a feature of our hardening implementation, preventing access to the CLI is not strictly needed to ensure the secure boot process can't be broken. I mean, even if an attacker gets access to the CLI they wouldn't be able to do anything other than execute authentic/signed software in the end (unless we missed something, which would be considered a but). Thus the CLI access prevention is just an extra layer of security which is generally nice to have, but not essential to the solution.

TDX_UBOOT_ROOTFS_IDENTIFIER ?= "root=/dev/\x24{root_devtype}blk\x24{root_devnum}p\x24{root_part} rootfstype=${TEZI_ROOT_PART_TYPE}"
Also in my conf/local.conf I added:
TDX_SECBOOT_REQUIRED_BOOTARGS = "${TDX_UBOOT_ROOTFS_IDENTIFIER} ro rootwait console=tty1 ${TDX_UBOOT_CONSOLE_BOOTARGS} consoleblank=0 earlycon"
TEZI_EXTERNAL_KERNEL_DEVICETREE_BOOT:append = "${TDX_SECBOOT_KARGS_OVERLAY}.dtbo"

A major problem I see here is that TDX_UBOOT_ROOTFS_IDENTIFIER depends on variables whose value are set at runtime ($root_devtype/devnum). Thus an attacker who's able to modify the U-Boot environment would also be able to inject kernel arguments by setting those variables. As a general principle you don't want anything depending on runtime variables to be present in TDX_SECBOOT_REQUIRED_BOOTARGS.
Thus the challenge becomes figuring out a way to boot the system with a fixed kernel command-line. In fact this may not even be possible. In case of Torizon OS, most of the kernel command-line is fixed (including the selection of the boot partition by name (which depends on a ramdisk in order to work)) but we need a variable part to specify which OSTree to boot. To solve this, we keep the fixed part of the kargs inside the kargs overlay and the variable part is separately validated by U-Boot (as part of the hardening). This is described in our hardening docs (Kernel command-line protection).
I haven't thought of how to solve the problem for BSP images in general, so I can't really suggest an approach at the moment; this would be result of an investigation where the maintenance effort would need to be taken into account.
Anyways, if you want the hardening working for your use case in the short term then I'd suggest considering only allowing boot to a specific block device/partition in which case you would pass a fixed root=/dev/... argument to the kernel. You'ds still bump into the fatal error saying the hardening is only tested with Torizon OS images, but we could perhaps change that into a warning. What do you think?

@rborn-tx -

in relation to the CLI access prevention: this is quite possible as the version we initially sent for testing was while the U-Boot hardening was disabled (due to the change where it only applies to torizon images). Once I have that all working we will getting it re-tested and can possibly confirm if that works.
I assume by the hardening prevention you also include the signing of the rootfs? Which is not currently possible in our case (due to the rootfs then being read-only; something we will be fixing in version 2 of our images), so my question here would be... In this case would it not still be possible to cause U-Boot to load an alternative rootfs?
In the case of TDX_UBOOT_ROOTFS_IDENTIFIER... I have actually used more variables for the mention uboot ones in my local version for exactly that reason, but just left the uboot variables in place as an example of what values are actually going in there. So this should not be a problem, I just don't know if any of those values differ in other modules as I only have access to the iMX8MP. However, I guess this would be something we would add to the machine configs and then inject as proper yocto variables here instead?

With all of those bits in place it does appear to work and successfully boots after blowing the secure-boot fuse. So for our implementation it is good enough. I would however prefer to try and make it as generic as possible before merging any changes in a PR (once I have that ready maybe it would be good to get some input on that part).
Regards,
MMG

@MMG-DG

1. in relation to the `CLI access prevention`: this is quite possible as the version we initially sent for testing was while the U-Boot hardening was disabled (due to the change where it only applies to torizon images). Once I have that all working we will getting it re-tested and can possibly confirm if that works.

Feedback is always appreciated :slightly_smiling_face:

2. I assume by the hardening prevention you also include the signing of the rootfs? Which is not currently possible in our case (due to the rootfs then being read-only; something we will be fixing in version 2 of our images), so my question here would be... In this case would it not still be possible to cause U-Boot to load an alternative rootfs?

The hardening is concerned with what we call the basic chain of trust (BCoT) which means all boot chain up to when the kernel FIT image is loaded and the kernel executed by U-Boot; i.e. it doesn't cover the rootfs. Notice that U-Boot does not "load" a rootfs, it simply passes information to the kernel indicating the block device to be used for the root mount (if a ramdisk is not in use (is that your case?)). The kernel command line protection is responsible for preventing changes to the kernel arguments that could be used to switch to another rootfs. That's another reason for passing a fixed root=... rather than leaving this parameter to be determined dynamically at runtime.

3. In the case of `TDX_UBOOT_ROOTFS_IDENTIFIER`... I have actually used more variables for the mention uboot ones in my local version for exactly that reason, but just left the uboot variables in place as an example of what values are actually going in there. So this should not be a problem, I just don't know if any of those values differ in other modules as I only have access to the iMX8MP. However, I guess this would be something we would add to the machine configs and then inject as proper yocto variables here instead?

Simply preventing a different rootfs to be selected provides very little protection. For this security layer I'm leaning towards assuming the rootfs protection is in use so that the rootfs could be taken from anywhere as long as it is signed. With this we keep both security and flexibility.

With all of those bits in place it does appear to work and successfully boots after blowing the secure-boot fuse. So for our implementation it is good enough. I would however prefer to try and make it as generic as possible before merging any changes in a PR (once I have that ready maybe it would be good to get some input on that part).

Regarding this whole topic, I have good news: we are about to start working on making hardening officially work on BSP images. So, stay tuned!

Hi,
Am I correct in thinking there was a merge for changes to support this now?
If so, once my current sprint is over I will be looking to “re-pin” to the latest commit and start removing my custom changes and revert to using your implementation.
Also, I believe I can use the new encryption-key-location “partition” changes and hopefully then turn on the signed rootfs settings for a FCoT.
Getting excited that I may be able to delete a lot of my code soon. lol.
After that we will be looking to migrate to the Scarthgap branches and start testing that.
so much to do and not enough time.
Thanks for everything you guys are doing.
Regards,
MMG

@thepinkmile yes the support for U-Boot hardening on iMX based modules is merged on both scarthgap and kirkstone branches.
@rborn-tx can this issue be closed now?

can this issue be closed now?

@sergioprado I hope to do it soon. Though the feature implementation should be done, I wanted to confirm if the expected kernel arguments are correctly set at least for some other machines.

@sergioprado It seems it will take a while until we have automated builds and tests for the BSP images with secure boot. Considering that, I thought of closing this issue right now since, as I said, in theory the work is done even though it has not been tested on most machines. Then if anyone reports related issues we could reopen it or create a new one. How does that sound?

@rborn-tx sounds good! Let's consider the feature implemented and close this issue. Any bugs found, we handle it in a separate issue.


enable skip test for csr and empty cert test

Enable the csr_failure and emprt certchain test for node agent

Hi @williamaronli. Thanks for your PR.
I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.
Once the patch is verified, the new status will be reflected by the ok-to-test label.
I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.


[KYUUBI #2571] Release connection to prevent the engine leak

Why are the changes needed?

close #2571
How was this patch tested?

[ ] Add some test cases that check the changes thoroughly including negative and positive cases if possible

[ ] Add screenshots for manual tests if appropriate

[ ] Run test locally before make a pull request

thanks, merging to master


Raspberry Pi 3B+ screen distortion...

Hi, I'm trying to run chromium_os on my raspberry Pi, I downloaded the latest release, i.e, r86r2pi4b, and am getting this issue again, it was like this from the initial builds, I will post a video below about what I'm talking about...
Edit, the link to the video...
Edit: Link to the video...
https://drive.google.com/file/d/1r-2srRMk0OqpKz-aH_RoQnREFHPISK_g/view?usp=sharing
As you can see, the entire screen is distorted except the chromium logo in the boot process and the cursor...
I hope there is a way to fix this, I previously reported this same issue and couldn't update it due to me getting locked out of my account...

This is a monitor resolution specific issue, when I used a different monitor it worked flawlessly, as no amount of effort can fix this specific issue, I'm going to close this issue for now...


Update CI to use Ubuntu 22.04

Related issue
Fixes #306

Thank you for the PR @ellnix
Can you update the ubuntu version everywhere in the CI manifest files to avoid future maintenance (when 20.04 will be deprecated)?

Sure thing, for some reason I assumed it would just grab that setting everywhere. I'm not familiar with github actions, which is why I let that issue sit for so long.

Good for me, I let you merge if you are ok @ellnix

Oh, thanks. I am assuming I use bors in this case?

bors merge

bors merge

For some reason bors does not like me and it's failing with 403 @curquiza

@ellnix it's happening sometimes, merge manually in this case. I don't know what to do with this kind of issue 😓


Name overlap on mobile

1. It's not just a mobile bug.  It's reproducible simply by making the browser window really small.

Correct.
Pretty much all sizing behavior throughout the entire site can be reproduced by just making the window width smaller; there's no attempt to detect mobile directly, but instead all behavior is just driven by windows size using bootstrap.
A lot of those still need a pass at various sizes, but this page in particular just doesn't take size into account.

2. When the page renders, it tries to create 5 columns for the "Main Poll Voters" and "Provisional Poll Voters" sections, and then it's smart enough to split the total number of ballots evenly across those columns as needed, with each column being given 20% of the width.

So, the number of columns needs to not be fixed at 5, but rather be allowed to be fewer based on the width of the window. Perhaps this ties into these lines.

Yes.
My recommendation, unless someone has a better idea, is to rebuild this using a bootstrap grid instead of trying to make the logic work for variable numbers of columns using columnize. That's actually how the Voter Hall of Fame on the About page already works: https://github.com/redditCFB/rcfbpoll3/blob/2787e2d59d7590aaa03dbfc254656d7609edb193/app/poll/templates/about.html#L31C29-L31C29, this was just built first and I didn't go back and update it.


add GitHub repo url to /version endpoint

Add GitHub repo URL to /version endpoint.
The current deployed commit print the warning This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. when we put the commit hash in this repo.
Outputting the GitHub repo URL in the version endpoint can help to identify where is the repo that is deployed.

On hold:
https://github.com/rustyhorde/vergen/issues/353


Core dump not saving to flash (IDF 3.3.5) (IDFGH-7011)

I've enabled core dump to flash on ESP-IDF 3.3.5 and tested it by forcing a kernel panic (null pointer access and also tried an integer divide by 0).  I'm getting the appropriate Guru Meditation Error on the UART console.  However, when I run esp_partition_find_first on the core dump partition, it returns null.
I need to be able to access the partition via wifi to debug devices in the field - I can't plug in to the UART.  The UART core dump mode does work however, it's just not useful since I will not have access to the UART in the field.

Hi @readmodifywrite, could you please attach your sdkconfig file, the partition table (if you are using a custom one) and the code snippet where you are calling esp_partition_find_first?
Another note, according to ESP-IDF support period policy, release/v3.3 maintenance period has expired at the beginning of March and this version is now End of Life. We do not plan to provide support for release/v3.3 branch anymore.

See attached.  I renamed sdk_config to a .txt file so github would accept it.
`const esp_partition_t *pt = esp_partition_find_first( ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_DATA_COREDUMP, "coredump" );
if( pt == NULL ){

    trace_printf( "wow no core dump, ok.\r\n" );

    return 0;
}`

I am aware 3.3 is no longer supported, however, I was unable to update to 4.x as the menuconfig option is broken on the idf_as_lib project on 4.x.
partitions_singleapp_coredump.csv
sdkconfig.txt

Thanks for the information, the config looks correct. Could you check if the partition table in flash is up to date? The 2nd stage bootloader logs the partition list on startup:
I (57) boot: Partition Table:
I (61) boot: ## Label            Usage          Type ST Offset   Length
I (68) boot:  0 nvs              WiFi data        01 02 00009000 00006000
I (76) boot:  1 phy_init         RF data          01 01 0000f000 00001000
I (83) boot:  2 factory          factory app      00 00 00010000 00100000
I (91) boot:  3 coredump         Unknown data     01 03 00110000 00010000
I (98) boot: End of partition table

You can also add this code snippet to the app to debug where the issue is:
    esp_partition_iterator_t it = esp_partition_find(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_ANY, NULL);
    for (; it != NULL; it = esp_partition_next(it)) {
        const esp_partition_t *part = esp_partition_get(it);
        printf("- partition '%s' (%d:%d) at offset 0x%x with size 0x%x\n", part->label, part->type, part->subtype, part->address, part->size);
    }
    esp_partition_iterator_release(it);

Here's the output with IDF v3.3.5 and hello_world example, modified as above and with CONFIG_ESP32_ENABLE_COREDUMP_TO_FLASH=y enabled.
- partition 'nvs' (1:2) at offset 0x9000 with size 0x6000
- partition 'phy_init' (1:1) at offset 0xf000 with size 0x1000
- partition 'coredump' (1:3) at offset 0x110000 with size 0x10000

Ah, that was it: I wasn't updating the binary partition table itself.
Thanks!


[Research] Web admin with terminal access

https://cockpit-project.org/
Very active repo with recent developments: https://github.com/cockpit-project/cockpit
Readily available on Debian (including the RaspiOS):
sudo apt install cockpit
Will be available on the port 9090 over HTTPS with a self-sign certificate.
Authenticated with the linux username and password eg:
admin
passswordA
To access over the LAN allow though the firewall:
sudo ufw allow 9090

For remote Tor access:
config.scripts/internet.hiddenservice.sh cockpit 443 9090
Somewhat limited in the Tor browser due to the JavaScript blocking, but the terminal login works.

On a non-RPi Linux based system it can even be used to manage virtual machines (just like virt-manager): https://github.com/cockpit-project/cockpit-machines
And has a graphical ZFS interface: https://github.com/optimans/cockpit-zfs-manager (which seem to be EoL being picked up by the 45Drives corp https://www.45drives.com/ https://github.com/45Drives/cockpit-zfs-manager)

@cstenglein @rootzoll what do you think about having a terminal tab integrated to the webUI?
Same security practices should apply:

HTTPS only (even when served over Tor)
compare the fingerprint of the self-signed certificate on the LCD or from the menu (as already done.for webUIs)
terminal login simply protected by the ssh password (passwordA) - as in Cockpit

Cockpit does have plugins - https://cockpit-project.org/blog/cockpit-starter-kit.html, but probably better to take the terminal part and integrate to the RaspiBlitz webUI.
A terminal in the browser window can have all the functionality not implemented in the web-interface yet and would be very handy for debugging.

Cockpit TLS cert info (from the manpage):
To specify the TLS certificate the web service should use, simply drop
a file with the extension .cert in the /etc/cockpit/ws-certs.d
directory. If there are multiple files in this directory, then the
highest priority one is chosen after sorting.

To check which certificate cockpit-ws will use, run the following
command

$ sudo /usr/lib/cockpit/cockpit-certificate-ensure --check
/etc/cockpit/ws-certs.d/0-self-signed.cert

Display the SHA-1 fingerprint:
openssl x509 -sha1 -in /etc/cockpit/ws-certs.d/0-self-signed.cert -fingerprint -noout | cut -d"=" -f2

Display the SHA-256 fingerprint:
openssl x509 -sha256 -in /etc/cockpit/ws-certs.d/0-self-signed.cert -fingerprint -noout | cut -d"=" -f2

Hi, sorry for the late answer. Just writing my thoughts and concerns, don't wanna make it sound negative 😮
Fist of all, interesting idea. I'm currently not entirely convinced about the usecases though:

A terminal in the browser window can have all the functionality not implemented in the web-interface yet

I'm not sure what the benefit for the user would be. Can't the user just ssh into the raspiblitz then?
A cool idea would be to access non-implemented functionality on-the-go over the webui => terminal but I'm not sure how the cockpit handles the terminal output. I guess it's not mobile friendly and that would introduce another issue.

and would be very handy for debugging.

I would say it depends. Currently, the webUI would be more targeted towards non-technical users and errors should be displayed over the webUI as well (don't know if that really works in practice if there is some config file that needs change etc.)
To get better debugging output, would implementing cstenglein/raspiblitz-web#49 be enough or should there some additional solutions in the webUI?

Thanks for your input @cstenglein !
Agree that having a terminal in the browser is mainly just a convenience factor.
I was thinking of the troubles with getting a terminal open on Windows and also on mobile, but as you say text and dialog menus are not suitable for small screens.
It actually does come with some security tradeoff also because it relies on the SSL encryption rather than ssh itself (let alone the possible browser extensions in play).
So agree, Cockpit might come useful as an option to manage the server underlying RaspiBlitz (like my case managing VMs in it), but for the RaspiBlitz WebGUI the aim should be to be able to expose the log / cli outputs.

I find myself using the virtual machine manager extension the most: https://github.com/cockpit-project/cockpit-machines

Components are directly linked like the Terminal:
https://localhost:9090/system/terminal

After having the WebUI out for some time now, I now think this would be a good idea.
Reasoning is that there are errors which you can't recover from a webUI perspective (e.g. peers.dat file from bitcoin corrupted etc.) where a terminal might make sense.

As far as I remember all solutions we found for a WebUI-Terminal just had clearnet communication between browser & server. So instead of having a fake terminal in the WebUI I would recommend a special section first that basically explains how to open a real terminal on a desktop or mobile phone. I thin kthe v1.10 milestone would a great spot for that.


skip showing time in reporter if datetime couldn't parse

Codecov Report
Base: 68.31% // Head: 41.67% // Decreases project coverage by -26.64% :warning:

Coverage data is based on head (301c6c3) compared to base (5865562).
Patch coverage: 100.00% of modified lines in pull request are covered.

:exclamation: Current head 301c6c3 differs from pull request most recent head 1971540. Consider uploading reports for the commit 1971540 to get more accurate results

:mega: This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more
Additional details and impacted files
@@             Coverage Diff             @@
##             main      #74       +/-   ##
===========================================
- Coverage   68.31%   41.67%   -26.64%
===========================================
  Files          20       20
  Lines        1799     1502      -297
===========================================
- Hits         1229      626      -603
- Misses        570      876      +306

Impacted Files
Coverage Δ

shellclear/src/clearer.rs
0.00% <ø> (-96.74%)
:arrow_down:

shellclear/src/exporter/data.rs
0.00% <ø> (-92.86%)
:arrow_down:

shellclear/src/exporter/table.rs
0.00% <ø> (-90.00%)
:arrow_down:

shellclear/src/exporter/text.rs
0.00% <ø> (-89.40%)
:arrow_down:

shellclear/src/masker.rs
95.74% <ø> (-4.26%)
:arrow_down:

shellclear/src/shell.rs
4.00% <ø> (-93.06%)
:arrow_down:

shellclear/src/state.rs
0.00% <ø> (-85.61%)
:arrow_down:

shellclear/src/engine.rs
88.06% <100.00%> (-1.33%)
:arrow_down:

... and 6 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

:umbrella: View full report at Codecov.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.


OpenConsole needs the devicename to be passed in

vurDomainOpenConsole say taht libvirt will select the first console for you if you don't specify the device name.
That is not the case in the go bindings, since an empyt string is passed in instead of nil.
I can create a PR tomorrow. Wantet do report it for now.
Btw. the bindings work great :+1:

Fixed in master.


Import docs into main repository

Fixes #2865 by merging docs repo and main gitea repo.
I've removed the following files from the docs subdir as they are the same as the contents in main repo:

MAINTAINERS
CONTRIBUTING.md
DCO
and the .github directory

but I've kept the LICENSE file as it differs from the one in the main repo.

LGTM

This would deprecate https://github.com/go-gitea/docs/

LGTM

@techknowlogick have you updated latest changes from docs?

@lafriks I'm just missing the latest commit from 5 hours ago. Let me put that in and I'll ping you when that is done. Thanks for checking.

@lafriks updated and drone has a successful build.

@techknowlogick docs docker build fails with lstat docker/caddy.conf: no such file or directory see https://drone.gitea.io/go-gitea/gitea/2024/17

Looking at the drone-docker plugin it looks like it takes the main dir
as the folder instead of the dir that the dockerfile is in. I'm going to
submit a PR to resolve this now.
On Sun, Nov 26, 2017, at 08:52 PM, Lauris BH wrote:

@techknowlogick[1] docs docker build fails with lstat
docker/caddy.conf: no such file or directory see
https://drone.gitea.io/go-gitea/gitea/2024/17> — You are receiving this because you were mentioned. Reply to this
email directly, view it on GitHub[2], or mute the thread[3].>

Links:

https://github.com/techknowlogick
https://github.com/go-gitea/gitea/pull/2874#issuecomment-347058899
https://github.com/notifications/unsubscribe-auth/AAKBZYJ5wrbhI_V8Z8CCK16YDwaOHzvUks5s6hXOgaJpZM4QVta-

@lafriks I submitted a fix to #2989


feat(VIST-CPC-810): Create Cancel Visit Button for Admin

JIRA: link to jira ticket
Context:
Create Cancel Visit Button next to each visit for Admin. When user clicks on this button, it will pop out a window on the browser asking for confirmation. If the user confirms, the status of the visit will be set to "CANCELLED". For a visit that has been completed, there is no "Cancel Request" button.
Does this PR change the .vscode folder in petclinic-frontend?:
NO
Changes
BACKEND:

Implemented a new patch request method in visits-service and api-gateway.
Implemented tests for this new method.

FRONTEND:

Implemented a button "Cancel Request" with method "handleCancel".
Added a new status "Cancelled" with red color.

Before and After UI (Required for UI-impacting PRs)
Before UI:

After UI:

I have also been working on adding another table and my PR should be done soon.
The page is definitely getting cluttered with all the features, maybe we should discuss for sprint 3 how to re-organize the admin page? We can make the buttons more consistent, prettier etc


Fixing ux on running commands

Feature/Change Description
Adding run icons for scripts, so they run when the button is clicked, not when the row is clicked.
Developer Checklist

[ ] Updated documentation or README.md
[ ] If adding new feature(s), added and ran unit tests
[ ] If create new release, bumped version number
[ ] Ran npm run style:fix for code style enforcement
[ ] Ran npm run lint:fix for linting
[ ] Ran npm audit to discover vulnerabilities

References
https://code.visualstudio.com/api/references/contribution-points#contributes.views
https://code.visualstudio.com/api/extension-guides/tree-view
https://github.com/microsoft/vscode-npm-scripts

@duluca what needs to be done?


Mark all but the first test as pending in exercises?

The standard behavior in exercism tracks, to help simulate TDD, is to mark all but the first test as pending.
In ert, it looks like this can be done with (ert-skip "pending") or maybe :expected-result :failed ?

I don't follow this strategy personally, so I'll leave it up to the community to comment here.

Does anyone else have any comments?


add gpu support

onnx.rs is currently hardcoded for cpu, enable at least one other execution provider for gpu such as CUDA.

d20b039


Migrate debian importer to importer-improver model

Signed-off-by: Tushar Goel<EMAIL_ADDRESS>

@pombredanne addressed all comments on this PR, please let me know if this looks good


Made atom counting more efficient

Summary Change Description
Replaced calls to Compound.atom_count() when the formular was available in an associated peakgroup, to calls to atom_count_in_formula in models.utilities.
Affected Issue Numbers

Resolves #474

Code Review Notes
I was able to remove loops that involved the 1:M PeakGroup:Compound relationship.
Checklist

[x] All issue requirements satisfied (or no linked issues)
[x] Linting passes.
[x] Migrations created & committed (or no model changes)
Tests

[x] Tests implemented (or no code changes)
[x] All multi_working tag tests pass locally
[x] All example load tests pass (remotely) (or their failures predated and are unrelated to this branch)
[x] @tag("multi_working") added to newly passing test functions/classes (or no newly passing tests)
[x] @tag("multi_broken"), @tag("multi_unknown"), or @tag("multi_mixed") removed from newly passing test functions/classes (or no newly passing tests)

I haven't actually run the tests - I just assume they'll pass since it was a simple edit and I'm re-using code that already existed in peak_group_label. If any tests fail, I'll fix them, so only start your review once the tests are passing.

Sorry Fan.  I explicitly had the thought "2 reviews is enough" and gambled that you hadn't looked at it yet.
So I'd added that check because I looked at this code:
    formula = models.CharField(
        max_length=256,
        help_text='The molecular formula of the compound (e.g. "C6H12O6").',
    )

and assumed the default was to allow null values.  So you're saying the default is null=False?

You're right.  False is the default.

yes. It's a bit confusing, I got it wrong before and then remembered.


Implement multi-tenant auth

Multi-tenant auth is a superset of BearerTokenAuth: for some 401s we would get we can handle the multi-tenant auth by parsing WWW-Authenticate, and reauthenticate. Azure supports it.

At some point we will want to support this.  @antkmsft Can you provide details on who is requesting this work and the expected delivery.  Can you also add a cost estimate to the Project Cost field.

@RickWinter
Currently, no customer is asking for this. It is just that recently I joined the meeting about this in other SDKs (this week, and there's a recording), and I have an idea how this can be implemented.
I think at one point George was implementing this, but the design was not in alignment with what other languages do, the PR (https://github.com/Azure/azure-sdk-for-cpp/pull/3365) was closed and I haven't seen a new one since.
I did put the cost in days here, on the right. If it is not showing up, I'll ask you how to do it, since this is the second time I am not putting it in the right place.


Light Table's Future.

https://lighttable.discourse.group/t/future-of-lighttable/50/2?u=prertik

For the ones wondering what's CIDER's Orchard: https://metaredux.com/posts/2018/11/09/ciders-orchard-the-heart.html

@prertik I just checked your presentation.

But, the new codebase will be open-sourced, once, I've fixed Analyzing plugins.

Are you sure about this? I think this will only difficult receiving feedback... Why don't just use a different branch?

@allentiak Yes, I'm sure. In fact, this is the only viable approach to make it one true Clojure editor.
Yeah, I'll use a different branch, I was thinking maybe of another repo or something like that. I want to keep this codebase for legacy reasons.

BTW, @prertik: Chances are, "Please check this out" is probably not the best subject choice...
Have you tried something like "Light Table's Future", or the like?

Thanks for the suggestion @allentiak!

Vote? What for?

Vote? On what? I don't understand the question...

I believe he may be referring to this tweet, @allentiak - https://twitter.com/lighttable/status/1233018553827115008?s=20

*Disclaimer: I share my opinion in the hope that it might be useful,
and because @prertik asked for it. I will be clear: even though I
fancy the idea of reviving LT, actually working towards it is not on
my priority list right now. Of course, this might change in the
future, but it is too soon to tell.
@prertik Nice new title!
Thanks, @sbauer322! I knew nothing about this poll.
I think a new release is critical - even if that code is thrown away
right away. After all all code eventually ends up in the trash bin :-)
And I think that the sooner a new release is out, the better. That
could be useful for reviving the project. Once it is revived, the new
LT community members may decide where to take it from there. But be
willing to spend a few months working all alone. Maybe recruiting a
local (this is: physically close) colleague/mate might help?
Regarding Community Management, I can advise the following readings:

How to Have a Successful Free Software
Project
"[T]here is more to the free software development than the creation of
a ‘bazaar’." Great place to start. Awesome reading. In fact, I think I
should re-read it myself :-)

Open Advise, a knowledge collection
from a wide variety of Free Software projects. It answers the question
what 42 prominent contributors would have liked to know when they
started so you can get a head-start no matter how and where you
contribute.

The Cathedral and the
Bazaar Eric
Raymond's journey to becoming (and quitting being) Sendmail's
maintainer.

Producing OSS This is more a reference book.

Are there any updates already?
I would really like to see this project being revived. 👍


bug: rate limit exceeded when a query returns many repos

➜  a git:(master) ✗ mp init "org:15five"
2022/03/26 20:43:46 GET https://api.github.com/search/code?page=5&q=org%3A15five: 403 You have exceeded a secondary rate limit. Please wait a few minutes before you try again. []

When iterating through the results the program should sleep to avoid hitting a rate limit.
Workaround: using a more specific search. Although if a very large organization tried microplane they could run into the issue even with a specific search.

Thanks for reporting!
Agreed, there should be better backoff/retry logic here.
If it's possible that a search can take several minutes, we may need to explore other UX.
Turbolift solves this problem elegantly by offloading search to another specialized CLI and being composable with that. It think microplane would do well to use this approach, too. https://github.com/Skyscanner/turbolift#identifying-the-repos-to-operate-upon


Error Running Gradle

I really need help, I don't really know how to fix this. Thank you very much
D:\beekeep>flutter run
Launching lib/main.dart on A37f in debug mode...
Initializing gradle...                                      145.2s
Resolving dependencies...
* Error running Gradle:
Exit code 1 from: D:\beekeep\android\gradlew.bat app:properties:
Starting a Gradle Daemon (subsequent builds will be faster)
Download https://jcenter.bintray.com/org/codehaus/mojo/mojo-parent/34/mojo-parent-34.pom
Download https://jcenter.bintray.com/org/codehaus/codehaus-parent/4/codehaus-parent-4.pom
Download https://jcenter.bintray.com/com/intellij/annotations/12.0/annotations-12.0.pom
Download https://jcenter.bintray.com/com/google/jimfs/jimfs/1.1/jimfs-1.1.pom
Download https://jcenter.bintray.com/com/google/jimfs/jimfs-parent/1.1/jimfs-parent-1.1.pom
Download https://jcenter.bintray.com/org/apache/httpcomponents/httpcore/4.2.5/httpcore-4.2.5.pom
Download https://jcenter.bintray.com/commons-logging/commons-logging/1.1.1/commons-logging-1.1.1.pom
Download https://jcenter.bintray.com/commons-codec/commons-codec/1.6/commons-codec-1.6.pom
Download https://jcenter.bintray.com/org/apache/httpcomponents/httpcomponents-core/4.2.5/httpcomponents-core-4.2.5.pom
Download https://jcenter.bintray.com/org/apache/commons/commons-parent/22/commons-parent-22.pom
Download https://jcenter.bintray.com/org/apache/commons/commons-parent/5/commons-parent-5.pom
Download https://jcenter.bintray.com/org/apache/apache/4/apache-4.pom
Download https://dl.google.com/dl/android/maven2/com/android/tools/external/com-intellij/intellij-core/26.0.1/intellij-core-26.0.1.pom
Download https://jcenter.bintray.com/com/android/tools/external/lombok/lombok-ast/0.2.3/lombok-ast-0.2.3.pom
Download https://jcenter.bintray.com/org/jetbrains/kotlin/kotlin-reflect/1.1.3-2/kotlin-reflect-1.1.3-2.pom
Download https://jcenter.bintray.com/org/jetbrains/trove4j/trove4j/20160824/trove4j-20160824.pom
Download https://dl.google.com/dl/android/maven2/com/android/tools/lint/lint/26.0.1/lint-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/build/gradle-core/3.0.1/gradle-core-3.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/build/gradle/3.0.1/gradle-3.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/build/builder/3.0.1/builder-3.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/lint/lint-checks/26.0.1/lint-checks-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/lint/lint-api/26.0.1/lint-api-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/external/org-jetbrains/uast/26.0.1/uast-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/build/gradle-api/3.0.1/gradle-api-3.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/databinding/compilerCommon/3.0.1/compilerCommon-3.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/build/manifest-merger/26.0.1/manifest-merger-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/sdk-common/26.0.1/sdk-common-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/sdklib/26.0.1/sdklib-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/repository/26.0.1/repository-26.0.1.jar
Download https://jcenter.bintray.com/org/jetbrains/kotlin/kotlin-reflect/1.1.3-2/kotlin-reflect-1.1.3-2.jar
Download https://jcenter.bintray.com/org/jetbrains/kotlin/kotlin-stdlib/1.1.3-2/kotlin-stdlib-1.1.3-2.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/build/transform-api/2.0.0-deprecated-use-gradle-api/transform-api-2.0.0-deprecated-use-gradle-api.jar
Download https://jcenter.bintray.com/org/ow2/asm/asm-analysis/5.1/asm-analysis-5.1.jar
Download https://jcenter.bintray.com/org/ow2/asm/asm-commons/5.1/asm-commons-5.1.jar
Download https://jcenter.bintray.com/org/ow2/asm/asm-util/5.1/asm-util-5.1.jar
Download https://jcenter.bintray.com/org/ow2/asm/asm-tree/5.1/asm-tree-5.1.jar
Download https://jcenter.bintray.com/org/ow2/asm/asm/5.1/asm-5.1.jar
Download https://jcenter.bintray.com/org/jacoco/org.jacoco.report/<IP_ADDRESS>502262128/org.jacoco.report-<IP_ADDRESS>502262128.jar
Download https://jcenter.bintray.com/org/jacoco/org.jacoco.core/<IP_ADDRESS>502262128/org.jacoco.core-<IP_ADDRESS>502262128.jar
Download https://jcenter.bintray.com/net/sf/jopt-simple/jopt-simple/4.9/jopt-simple-4.9.jar
Download https://jcenter.bintray.com/net/sf/proguard/proguard-gradle/5.3.3/proguard-gradle-5.3.3.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/analytics-library/tracker/26.0.1/tracker-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/analytics-library/shared/26.0.1/shared-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/analytics-library/protos/26.0.1/protos-26.0.1.jar
Download https://jcenter.bintray.com/com/google/protobuf/protobuf-java/3.0.0/protobuf-java-3.0.0.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/build/builder-model/3.0.1/builder-model-3.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/build/builder-test-api/3.0.1/builder-test-api-3.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/ddms/ddmlib/26.0.1/ddmlib-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/layoutlib/layoutlib-api/26.0.1/layoutlib-api-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/dvlib/26.0.1/dvlib-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/common/26.0.1/common-26.0.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/build/apksig/3.0.1/apksig-3.0.1.jar
Download https://jcenter.bintray.com/com/squareup/javawriter/2.5.0/javawriter-2.5.0.jar
Download https://jcenter.bintray.com/org/bouncycastle/bcpkix-jdk15on/1.56/bcpkix-jdk15on-1.56.jar
Download https://jcenter.bintray.com/org/bouncycastle/bcprov-jdk15on/1.56/bcprov-jdk15on-1.56.jar
Download https://jcenter.bintray.com/it/unimi/dsi/fastutil/7.2.0/fastutil-7.2.0.jar
Download https://jcenter.bintray.com/com/googlecode/json-simple/json-simple/1.1/json-simple-1.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/databinding/baseLibrary/3.0.1/baseLibrary-3.0.1.jar
Download https://jcenter.bintray.com/commons-io/commons-io/2.4/commons-io-2.4.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/annotations/26.0.1/annotations-26.0.1.jar
Download https://jcenter.bintray.com/org/jetbrains/annotations/13.0/annotations-13.0.jar
Download https://jcenter.bintray.com/org/apache/httpcomponents/httpmime/4.1/httpmime-4.1.jar
Download https://jcenter.bintray.com/net/sf/kxml/kxml2/2.3.0/kxml2-2.3.0.jar
Download https://jcenter.bintray.com/com/google/errorprone/error_prone_annotations/2.0.18/error_prone_annotations-2.0.18.jar
Download https://jcenter.bintray.com/com/google/j2objc/j2objc-annotations/1.1/j2objc-annotations-1.1.jar
Download https://jcenter.bintray.com/org/codehaus/mojo/animal-sniffer-annotations/1.14/animal-sniffer-annotations-1.14.jar
Download https://jcenter.bintray.com/com/intellij/annotations/12.0/annotations-12.0.jar
Download https://jcenter.bintray.com/org/apache/httpcomponents/httpcore/4.2.5/httpcore-4.2.5.jar
Download https://jcenter.bintray.com/commons-logging/commons-logging/1.1.1/commons-logging-1.1.1.jar
Download https://dl.google.com/dl/android/maven2/com/android/tools/external/com-intellij/intellij-core/26.0.1/intellij-core-26.0.1.jar
Download https://jcenter.bintray.com/org/jetbrains/trove4j/trove4j/20160824/trove4j-20160824.jar

FAILURE: Build failed with an exception.

* What went wrong:
A problem occurred configuring root project 'android'.
> Could not resolve all files for configuration ':classpath'.
   > Could not download ecj.jar (org.eclipse.jdt.core.compiler:ecj:4.6.1)
      > Could not get resource 'https://jcenter.bintray.com/org/eclipse/jdt/core/compiler/ecj/4.6.1/ecj-4.6.1.jar'.
         > Could not GET 'https://jcenter.bintray.com/org/eclipse/jdt/core/compiler/ecj/4.6.1/ecj-4.6.1.jar'.
            > d29vzk4ow07wi7.cloudfront.net
   > Could not download jimfs.jar (com.google.jimfs:jimfs:1.1)
      > Could not get resource 'https://jcenter.bintray.com/com/google/jimfs/jimfs/1.1/jimfs-1.1.jar'.
         > Could not GET 'https://jcenter.bintray.com/com/google/jimfs/jimfs/1.1/jimfs-1.1.jar'.
            > d29vzk4ow07wi7.cloudfront.net
   > Could not download lombok-ast.jar (com.android.tools.external.lombok:lombok-ast:0.2.3)
      > Could not get resource 'https://jcenter.bintray.com/com/android/tools/external/lombok/lombok-ast/0.2.3/lombok-ast-0.2.3.jar'.
         > Could not GET 'https://jcenter.bintray.com/com/android/tools/external/lombok/lombok-ast/0.2.3/lombok-ast-0.2.3.jar'.
            > d29vzk4ow07wi7.cloudfront.net
   > Could not download guava.jar (com.google.guava:guava:22.0)
      > Could not get resource 'https://jcenter.bintray.com/com/google/guava/guava/22.0/guava-22.0.jar'.
         > Could not GET 'https://jcenter.bintray.com/com/google/guava/guava/22.0/guava-22.0.jar'.
            > d29vzk4ow07wi7.cloudfront.net
   > Could not download antlr4.jar (org.antlr:antlr4:4.5.3)
      > Could not get resource 'https://jcenter.bintray.com/org/antlr/antlr4/4.5.3/antlr4-4.5.3.jar'.
         > Could not GET 'https://jcenter.bintray.com/org/antlr/antlr4/4.5.3/antlr4-4.5.3.jar'.
            > d29vzk4ow07wi7.cloudfront.net
   > Could not download juniversalchardet.jar (com.googlecode.juniversalchardet:juniversalchardet:1.0.3)
      > Could not get resource 'https://jcenter.bintray.com/com/googlecode/juniversalchardet/juniversalchardet/1.0.3/juniversalchardet-1.0.3.jar'.
         > Could not GET 'https://jcenter.bintray.com/com/googlecode/juniversalchardet/juniversalchardet/1.0.3/juniversalchardet-1.0.3.jar'.
            > d29vzk4ow07wi7.cloudfront.net
   > Could not download proguard-base.jar (net.sf.proguard:proguard-base:5.3.3)
      > Could not get resource 'https://jcenter.bintray.com/net/sf/proguard/proguard-base/5.3.3/proguard-base-5.3.3.jar'.
         > Could not GET 'https://jcenter.bintray.com/net/sf/proguard/proguard-base/5.3.3/proguard-base-5.3.3.jar'.
            > d29vzk4ow07wi7.cloudfront.net
   > Could not download gson.jar (com.google.code.gson:gson:2.3)
      > Could not get resource 'https://jcenter.bintray.com/com/google/code/gson/gson/2.3/gson-2.3.jar'.
         > Could not GET 'https://jcenter.bintray.com/com/google/code/gson/gson/2.3/gson-2.3.jar'.
            > d29vzk4ow07wi7.cloudfront.net
   > Could not download commons-compress.jar (org.apache.commons:commons-compress:1.12)
      > Could not get resource 'https://jcenter.bintray.com/org/apache/commons/commons-compress/1.12/commons-compress-1.12.jar'.
         > Could not GET 'https://jcenter.bintray.com/org/apache/commons/commons-compress/1.12/commons-compress-1.12.jar'.
            > d29vzk4ow07wi7.cloudfront.net
   > Could not download httpclient.jar (org.apache.httpcomponents:httpclient:4.2.6)
      > Could not get resource 'https://jcenter.bintray.com/org/apache/httpcomponents/httpclient/4.2.6/httpclient-4.2.6.jar'.
         > Could not GET 'https://jcenter.bintray.com/org/apache/httpcomponents/httpclient/4.2.6/httpclient-4.2.6.jar'.
            > d29vzk4ow07wi7.cloudfront.net
   > Could not download jsr305.jar (com.google.code.findbugs:jsr305:1.3.9)
      > Could not get resource 'https://jcenter.bintray.com/com/google/code/findbugs/jsr305/1.3.9/jsr305-1.3.9.jar'.
         > Could not GET 'https://jcenter.bintray.com/com/google/code/findbugs/jsr305/1.3.9/jsr305-1.3.9.jar'.
            > Read timed out
   > Could not download commons-codec.jar (commons-codec:commons-codec:1.6)
      > Could not get resource 'https://jcenter.bintray.com/commons-codec/commons-codec/1.6/commons-codec-1.6.jar'.
         > Could not GET 'https://jcenter.bintray.com/commons-codec/commons-codec/1.6/commons-codec-1.6.jar'.
            > Read timed out

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output.

* Get more help at https://help.gradle.org

BUILD FAILED in 19m 15s

Please review your Gradle project setup in the android/ folder.

Please add the output of flutter doctor -v.
How to reproduce? Is this a newly unmodified project created with flutter create?

I also encountered the same problem. How do I solve it?Thanks

@mmtou can you provide information about how to reproduce?

@zoechi Maybe because of China's network, but I tried many times or the same result.
I will try another way. If there is any problem, I will ask you again. Thank you.

You followed https://github.com/flutter/flutter/wiki/Using-Flutter-in-China ?

I've seen it. This address seems to be a problem. https://storage.flutter-io.cn
Everything is normal on MacBook, but it's not normal on win10.

Without additional information, we are unfortunately not sure how to resolve this issue. We are therefore reluctantly going to close this bug for now. Please don't hesitate to comment on the bug if you have any more information for us; we will reopen it right away!
Thanks for your contribution.


Feat: Add ability to create additional labels for each metric

I was thinking, ideally, this would support an arbitrary number of key-value pairs that a user would define. But at minimum, a cluster label would be nice.
A user-configurable cluster name label would allow you to install this exporter multiple times, to scrape metrics from multiple clusters, and ensure unique timeseries in Prometheus for each. You can currently work around this already, for example, with the kube-prometheus pattern, you can define labels on a Service to be used as additional timeseries labels, by the ServiceMonitor configuration. But a way to do it that required less configuration, and maybe less Prometheus experience, would be nice.

This was indirectly solved by https://github.com/Starttoaster/proxmox-exporter/pull/23
A cluster label is added to every metric if on startup the API responds with a valid cluster status. The cluster name is derived from that response. I think this lessens the need for the ability to add configurable labels to each timeseries, if not removes it entirely. Going to close this issue as complete for now.


Menu positioning ignores disabled MenuItem

So this weird jumps are happening.

[x] The issue is present in the latest release.
[x] I have searched the issues of this repository and believe that this is not a duplicate.

Current Behavior 😯
Menu position changes if it contains disabled menu-items
Expected Behavior 🤔
Menu stays at same position.
Steps to Reproduce 🕹
After many hours of debugging while sleeping I woke up and figured out that for some reason disabled menu-items' heights don't count to calculate the positioning.
Is it by design? Is there a way to work around it?
https://codesandbox.io/s/reverent-bird-k7dsj?file=/src/Demo.js
Steps:

create a Menu with MenuItems inside
disable first MenuItem(s)
see that the positioning of Menu ignores the disabled MenuItem

Context 🔦
When the item is clicked, an http request is fired and that item is disabled until request completes. When it completes, the menu is closed.

Your Environment 🌎

Tech
Version

Material-UI
v5.0.0-alpha.12

React
16.13.1

Browser
latest Chrome, Safari, Firefox

Duplicate of #20755


chore: Start svelte 5 move

TL;DR
Updated core dependencies including Svelte 5, SvelteKit, and associated tooling packages.
What changed?

Upgraded @sveltejs/kit to v2.5.27
Upgraded @sveltejs/vite-plugin-svelte to v4.0.0
Upgraded svelte to v5.0.0
Upgraded svelte-check to v4.0.0
Updated related development dependencies:

eslint-plugin-svelte to v2.45.1
prettier-plugin-svelte to v3.2.6
typescript to v5.5.0
vite to v5.4.4

How to test?

Delete node_modules and package lock file
Run npm install
Start the development server
Verify all existing functionality works as expected
Check for any console errors or warnings

Why make this change?
The upgrade to Svelte 5 brings new features and improvements to the framework. Updating related dependencies ensures compatibility and provides access to the latest tooling improvements and bug fixes.

#91  👈 (View in Graphite)
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Merge activity

Dec 26, 3:13 AM EST: A user started a stack merge that includes this pull request via Graphite.


kill prog if user not root

added os.geteuid() to check if user is root (or sudo)

this is for the other .py script...Couldn't combine file edits into one pull [gracefully] because working from browser.


Replaced calculation of label text size with access to cached value

Hi,
Because chart axis label is immutable structure we can store size of non-rotated text and use the value  instead of dynamic calculation. It's supposed to improve performance especially in case of scrolling.

Thanks! :thumbsup:


AddDataChannelAsync results in InvalidOperationException

I'm attempting to create a connection between peers and open a data channel. Both peers fire their
Connected events, and ICE candidates are exchanged. Both peers show Initialized and Connected to be true.
However, when then calling AddDataChannelAsync("Main", true, true);, I catch an InvalidOperationException. The fully expanded aggregate exceptions included below.
From the source,
/// <exception xref="InvalidOperationException">The peer connection is not intialized.</exception> /// <exception xref="InvalidOperationException">SCTP not negotiated.</exception>
Appears to describe two different possible exceptions of the type I'm seeing. Based on the state of things, I'm fairly sure it's not the first. The second is something I'm not sure how confirm as I didn't see any documentation on how to specifically negotiate.
Perhaps it's the SCTP configuration or something else not in the documentation. Any idea on next steps for this?

InvalidOperationException: Operation is not valid due to the current state of the object.
Microsoft.MixedReality.WebRTC.Interop.Utils.ThrowOnErrorCode (System.UInt32 res) (at :0)
Microsoft.MixedReality.WebRTC.PeerConnection+<>c__DisplayClass84_0.b__0 () (at :0)
System.Threading.Tasks.Task1[TResult].InnerInvoke () (at <1f0c1ef1ad524c38bbc5536809c46b48>:0) System.Threading.Tasks.Task.Execute () (at <1f0c1ef1ad524c38bbc5536809c46b48>:0) --- End of stack trace from previous location where exception was thrown --- System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw () (at <1f0c1ef1ad524c38bbc5536809c46b48>:0) System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Threading.Tasks.Task task) (at <1f0c1ef1ad524c38bbc5536809c46b48>:0) System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Threading.Tasks.Task task) (at <1f0c1ef1ad524c38bbc5536809c46b48>:0) System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd (System.Threading.Tasks.Task task) (at <1f0c1ef1ad524c38bbc5536809c46b48>:0) System.Runtime.CompilerServices.TaskAwaiter1[TResult].GetResult () (at <1f0c1ef1ad524c38bbc5536809c46b48>:0)
Microsoft.MixedReality.WebRTC.PeerConnection+d__84.MoveNext () (at :0)
--- End of stack trace from previous location where exception was thrown ---
System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw () (at <1f0c1ef1ad524c38bbc5536809c46b48>:0)
System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Threading.Tasks.Task task) (at <1f0c1ef1ad524c38bbc5536809c46b48>:0)
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Threading.Tasks.Task task) (at <1f0c1ef1ad524c38bbc5536809c46b48>:0)
System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd (System.Threading.Tasks.Task task) (at <1f0c1ef1ad524c38bbc5536809c46b48>:0)
System.Runtime.CompilerServices.TaskAwaiter1[TResult].GetResult () (at <1f0c1ef1ad524c38bbc5536809c46b48>:0) Microsoft.MixedReality.WebRTC.PeerConnection+<AddDataChannelAsync>d__83.MoveNext () (at <c56b6ea76b85487f9304292eaf9f9d89>:0) --- End of stack trace from previous location where exception was thrown --- System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw () (at <1f0c1ef1ad524c38bbc5536809c46b48>:0) System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Threading.Tasks.Task task) (at <1f0c1ef1ad524c38bbc5536809c46b48>:0) System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Threading.Tasks.Task task) (at <1f0c1ef1ad524c38bbc5536809c46b48>:0) System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd (System.Threading.Tasks.Task task) (at <1f0c1ef1ad524c38bbc5536809c46b48>:0) System.Runtime.CompilerServices.TaskAwaiter1[TResult].GetResult () (at <1f0c1ef1ad524c38bbc5536809c46b48>:0)
ObjectTheory.Core.Universal.Common.Networking.WebRTC.WebRTCPeer+d__26.MoveNext () (at Assets/Core/OT.Core.Universal/Common/Networking/WebRTC/WebRTCPeer.cs:207)
UnityEngine.Debug:LogException(Exception, Object)

ObjectTheory.Core.Unity.Common.Logging.UnityDebugLogger:LogException(String, Exception, Object) (at Assets/Core/OT.Core.Unity/Scripts/Common/Logging/UnityDebugLogger.cs:24)
ObjectTheory.Core.Universal.Common.Logging.<>c__DisplayClass10_0:b__0(ILogger) (at Assets/Core/OT.Core.Universal/Common/Logging/LogManager.cs:89)
System.Collections.Generic.List1:ForEach(Action1)
ObjectTheory.Core.Universal.Common.Logging.LogManager:LogException(String, Exception, Object, Boolean) (at Assets/Core/OT.Core.Universal/Common/Logging/LogManager.cs:89)
ObjectTheory.Core.Universal.Common.Networking.WebRTC.d__26:MoveNext() (at Assets/Core/OT.Core.Universal/Common/Networking/WebRTC/WebRTCPeer.cs:214)
System.Runtime.CompilerServices.AsyncTaskMethodBuilder1:SetException(Exception) Microsoft.MixedReality.WebRTC.<AddDataChannelAsync>d__83:MoveNext() System.Runtime.CompilerServices.AsyncTaskMethodBuilder1:SetException(Exception)
Microsoft.MixedReality.WebRTC.d__84:MoveNext()
UnityEngine.UnitySynchronizationContext:ExecuteTasks()

Hi @michael-house,
SCTP not negotiated. means you open a data channel after negotiating an SDP session without SCTP negotiation. This is an unfortunate limitation of the Google implementation. If you use data channels at all, you need to open at least 1 data channel before you connect to the remote peer, so that the SCTP negotiation is done and SSL certificates etc. are negotiated. Otherwise any subsequent opening fails because it's too late to do that negotiation. This is unfortunately not really well documenting as I see looking for comments now. I will see how we can improve that. See this comment in TestAppUWP about the error.

Hi @djee-ms, thanks for the response. This means I need to:

Initialize PeerConnection
AddDataChannelAsync
Create connection (create offer or reply)

Right? Do I create the data channel on the offering peer, the answering peer, both or does it matter?

I've tried in the order I suggested above, still the same exception.
Perhaps I wasn't clear: "SCTP not negotiated" was just one of the other exception possibilities I was seeing from the documentation. It's not the error text I am receiving. Maybe 'Operation is not valid due to the current state of the object' is the expected description for that exception, you know better than me.
So, attempting to create a data channel before the peer is connected still results in the exception:

InvalidOperationException: Operation is not valid due to the current state of the object.

PeerConnection.InitializeAsync()
PeerConnection.AddDataChannelAsync()
PeerConnection.CreateOffer()

Note that in step 3. doing a CreateAnswer() is an error and will not work. You need to call AddDataChannelAsync() before CreateOffer(), which means you need to do it on the caller side (not the callee side). Also if you use out-of-band channels (explicit ID) then you need to add the data channel on both sides. For in-band channels (generated ID) the channel will be automatically created on the callee. If you want to have a look at an example, the TestAppUWP example app is doing just that as linked above.

Excellent, thanks Jerome, everything is working now as expected. It would be nice if the exception was a bit more clear, like saying SCTP not negotiated instead of Operation is not valid due to the current state of the object.. Thanks for all your hard work.

AddDataChannelAsync() should now throw a specific SctpNotNegotiatedException for this common misuse case. Also added a test for it to make sure this works.