unexpected problem

Description
What steps will reproduce the problem?

What is the expected output? What do you see instead?
Please provide any additional information below
File "C:\Python\Anaconda3\lib\site-packages\spyder\plugins_init_.py", line 511, in
toggled=lambda checked: self.toggle_view(checked),
File "C:\Python\Anaconda3\lib\site-packages\spyder\plugins\ipythonconsole.py", line 725, in toggle_view
self.create_new_client(give_focus=False)
File "C:\Python\Anaconda3\lib\site-packages\spyder\plugins\ipythonconsole.py", line 1033, in create_new_client
self.connect_client_to_kernel(client)
File "C:\Python\Anaconda3\lib\site-packages\spyder\plugins\ipythonconsole.py", line 1068, in connect_client_to_kernel
kc.start_channels(shell=True, iopub=True)
File "C:\Python\Anaconda3\lib\site-packages\qtconsole\kernel_mixins.py", line 43, in start_channels
super(QtKernelClientMixin, self).start_channels(*args, **kw)
File "C:\Python\Anaconda3\lib\site-packages\jupyter_client\threaded.py", line 212, in start_channels
self.shell_channel._inspect = self._check_kernel_info_reply
File "C:\Python\Anaconda3\lib\site-packages\jupyter_client\client.py", line 143, in shell_channel
socket, self.session, self.ioloop
File "C:\Python\Anaconda3\lib\site-packages\jupyter_client\threaded.py", line 205, in ioloop
self._ioloop = ioloop.IOLoop()
File "C:\Python\Anaconda3\lib\site-packages\tornado\util.py", line 312, in new
instance.initialize(*args, **init_kwargs)
File "C:\Python\Anaconda3\lib\site-packages\zmq\eventloop\ioloop.py", line 139, in initialize
super(ZMQIOLoop, self).initialize(impl=impl, **kwargs)
File "C:\Python\Anaconda3\lib\site-packages\tornado\ioloop.py", line 845, in initialize
super(PollIOLoop, self).initialize(**kwargs)
File "C:\Python\Anaconda3\lib\site-packages\tornado\ioloop.py", line 357, in initialize
self.make_current()
File "C:\Python\Anaconda3\lib\site-packages\tornado\ioloop.py", line 315, in make_current
assert asyncio is None
AssertionError
Version and main components

Spyder Version: 3.2.6
Python Version: 3.6.4
Qt Versions: 5.10.0, PyQt5 5.10 on Windows

Dependencies
pyflakes >=0.6.0 :  1.6.0 (OK)
pycodestyle >=2.3:  2.3.1 (OK)
pygments >=2.0   :  2.2.0 (OK)
pandas >=0.13.1  :  0.22.0 (OK)
numpy >=1.7      :  1.14.0 (OK)
sphinx >=0.6.6   :  1.6.3 (OK)
rope >=0.9.4     :  0.10.5 (OK)
jedi >=0.9.0     :  0.10.2 (OK)
nbconvert >=4.0  :  5.3.1 (OK)
sympy >=0.7.3    :  1.1.1 (OK)
cython >=0.21    :  0.26.1 (OK)
qtconsole >=4.2.0:  4.3.1 (OK)
IPython >=4.0    :  6.2.1 (OK)
pylint >=0.25    :  1.7.4 (OK)

Thanks for reporting. I have one question: is the Jupyter notebook working for you? Or is it failing as well?

Yes! Jupyter Notebook works well.

Then I don't know what the problem could be, because the error you reported is not related to Spyder.
Could you run in a system terminal (cmd.exe)
jupyter qtconsole

and report back with any error? Thanks!

Also, particularly if the problem occurs on startup, please reference the Spyder Troubleshooting Guide for general information and fixes.

Closed due to lack of response. Please re-open if you can provide the requested information; thanks.

CAM-Gerlach,
I experienced the same problem, but was able to fix it.  Although had to install Anaconda, as the problem attributed to my antivirus program blocking certain scripts and installation packages during the initial install.

So, the true source of the problem is now clear, thanks to some posters who provided more information with their reports. This is a duplicate of #6627 ; and in any case outside of Spyder's control. To fix for now, run conda install tornado=4.5.3 from the Anaconda Prompt/Terminal/shell (Windows/Mac/Linux) in the conda environment that Spyder is installed in.
@ryanwiley2002 Glad you fixed your problem. I find it very unlikely (though not completely impossible) you had the same issue, as the above is caused by installing Tornado 5.0 instead of the default 4.x; we've had several different startup issues that indeed are caused by antivirus programs doing what you described.


Unable to reset ad sp credentials

az --version: 2.0.30
Created sp with:
az ad sp create-for-rbac -n "rgtest"
Trying to reset creds with:
az ad sp credential reset --name "http://rgtest"
Get this error:
Insufficient privileges to complete the operation.
Traceback (most recent call last):
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\knack\cli.py", line 197, in invoke
    cmd_result = self.invocation.execute(args)
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\core\commands\__init__.py", line 347, in execute
    six.reraise(*sys.exc_info())
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\six.py", line 693, in reraise
    raise value
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\core\commands\__init__.py", line 319, in execute
    result = cmd(params)
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\core\commands\__init__.py", line 180, in __call__
    return super(AzCliCommand, self).__call__(*args, **kwargs)
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\knack\commands.py", line 109, in __call__
    return self.handler(*args, **kwargs)
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\core\__init__.py", line 420, in default_command_handler
    result = op(**command_args)
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\command_modules\role\custom.py", line 1165, in reset_service_principal_credential
    app = show_application(client.applications, aad_sps[0].app_id)
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\command_modules\role\custom.py", line 644, in show_application
    object_id = _resolve_application(client, identifier)
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\command_modules\role\custom.py", line 654, in _resolve_application
    result = list(client.list(filter="identifierUris/any(s:s eq '{}')".format(identifier)))
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\msrest\paging.py", line 121, in __next__
    self.advance_page()
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\msrest\paging.py", line 107, in advance_page
    self._response = self._get_next(self.next_link)
  File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\graphrbac\operations\applications_operations.py", line 158, in internal_paging
    raise models.GraphErrorException(self._deserialize, response)
azure.graphrbac.models.graph_error.GraphErrorException: Insufficient privileges to complete the operation.

I can however reset the credentials via shell.azure.com

Environment summary
Install Method (e.g. pip, interactive script, apt-get, Docker, MSI, edge build) / CLI version (az --version) / OS version / Shell Type (e.g. bash, cmd.exe, Bash on Windows)

This error from the graph service end is legit. Are you logging in as a service principal in CLI? Please share the output of az account show

I'm unable to repro this today.  Will re-open if I see it again.

I'm experiencing the same problem, any suggestion?

Why this ticket was closed???

@dluc, in order to reset password for another Service Principal, you need to add some permissions to the setter Service Principal, please see https://github.com/Azure/azure-cli/issues/7656#issuecomment-574020898. The required permissions may change once we move to MS Graph https://github.com/Azure/azure-cli/issues/12946.


GitHub Actions build error with torch 1.12 on macOS

Segmentation faults are occurring with torch 1.12 and at least macOS. See this PR on transformers for more info - https://github.com/huggingface/transformers/pull/17925

Update build.yml to unpin torch==1.11.0 when this is complete.

1.12.1 just released rc3. Link to milestone - https://github.com/pytorch/pytorch/milestone/30

macOS builds are getting a segmentation fault 11 error code with torch==1.12.1. This issue will remain open but this appears to be a GitHub Actions specific issue just for macOS. For now, macOS builds will be pinned to torch==1.11.0.

I appreciate you sharing this info as it's the most I've seen to date. In doing a few searches, a lot of links point to mkl. What does pip show mkl return? Did you try running Python with the env variable KMP_DUPLICATE_LIB_OK=TRUE? Curious if that is the only problem or another pops up.
I've assumed the issue, at least with the GitHub Actions build, is a package conflict but I'm not a mac user, so I've been limited in what I can debug.

No problem, I'm glad it's helpful.
$ pip3 show mkl
WARNING: Package(s) not found: mkl

So, nothing. And yeah, I did try with that env variable set and it did not change what happened, it fails with that abort trap 6 thing.
I am behind on both python and osx versions. I think i can rustle up another laptop and update macos and try with that to see if it helps.

Appreciate it, anything you can share would be beneficial.
How did you install txtai? Was it a simple pip install or were optional dependencies installed? fasttext has caused issues on macOS in the past.

It was just the pip install. I'm new to python, so i was going for easy :)

To close the loop on this, I tried the same code on a different machine with macos 12.6.2 and that ran the example just fine. Also used a simple pip install in that case, there were the following warnings, but everything worked in the simple case.
ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
spacy-transformers 1.1.7 requires transformers<4.21.0,>=3.4.0, but you have transformers 4.26.0 which is incompatible.
cached-path 1.1.2 requires huggingface-hub<0.6.0,>=0.0.12, but you have huggingface-hub 0.12.0 which is incompatible.
allennlp 2.9.3 requires spacy<3.3,>=2.1.0, but you have spacy 3.4.4 which is incompatible.
allennlp 2.9.3 requires transformers<4.19,>=4.1, but you have transformers 4.26.0 which is incompatible.

When I moved that exact code over to my program, I started getting different segfault the first time i called Embeddings#index. Stripping down my code eventually let me to realize that something that was coming in with spacy was causing the problem. Once I moved all of the spacy related code to a different file, everything worked.
I switched back over to the stand alone example and added a simple import spacy, but that didnt trigger the segfault.
Long story short, works fine on a new OSX and with a minimal program, but there might be some deeper conflict w/ some library shared w/ spacy.

The message below you provided previously is the best hint yet, thank you for that!
OMP: Hint This means that multiple copies of the OpenMP runtime have been linked into the program. That is dangerous, since it can degrade performance or cause incorrect results. The best thing to do is to ensure that only a single OpenMP runtime is linked into the process, e.g. by avoiding static linking of the OpenMP runtime in any library. As an unsafe, unsupported, undocumented workaround you can set the environment variable KMP_DUPLICATE_LIB_OK=TRUE to allow the program to continue to execute, but that may cause crashes or silently produce incorrect results. For more information, please see http://openmp.llvm.org/

This issue discusses a conflict between Faiss and PyTorch that appears relevant. This PR also seems relevant.
#377 is the current open txtai issue tracking this.

Oh, glad it was helpful! I've had a lot of fun playing with the software since I got things running, so thanks for that :)


Exception on path parsing

Hello,
I found a path that can not be imported, because it contains arcs that makerjs somehow does not understand, failing to find intersections. The exact error is:
browser.maker.js:2063 Uncaught TypeError: Cannot read property 'intersectionPoints' of null
    at new Arc (browser.maker.js:2063)
    at map.A (browser.maker.js:8187)
    at Object.fromSVGPathData (browser.maker.js:8286)
    at maker-bug.html:12

the code
<html>
    <head>
        <meta charset="UTF-8">

        <script src="https://maker.js.org/target/js/browser.maker.js"></script>
        <script<EMAIL_ADDRESS>
        <script>
            const m = require('makerjs');
            const svgPath = 'm 6749.8809,410.62695 c -3477.6131,0 -6339.25395,2861.64085 -6339.25395,6339.25395 0,740.1265 129.61746,1474.5598 382.9668,2169.9765 a 179.9415,179.9415 0 0 0 230.20505,107.625 L 3245.291,8224.6738 a 179.9415,179.9415 0 0 0 107.8028,-231.0761 c -145.8833,-398.4212 -220.5293,-819.4197 -220.5293,-1243.7168 0,-1984.3965 1632.9199,-3617.3164 3617.3164,-3617.3164 770.3254,0 1520.8624,246.0596 2141.6543,702.125 a 179.9415,179.9415 0 0 0 0,0 L 14300.08,7807.8613 a 179.9415,179.9415 0 0 0 0,0 c 1087.878,799.163 2403.107,1230.3301 3753.02,1230.3301 3477.702,0 6339.423,-2861.7108 6339.423,-6339.4043 0,-740.0716 -129.576,-1474.4533 -382.865,-2169.8184 a 179.9415,179.9415 0 0 0 -230.209,-107.63281 l -2221.5,802.80861 a 179.9415,179.9415 0 0 0 -107.806,231.0664 c 145.842,398.3745 220.433,819.3257 220.433,1243.5762 0,1984.4872 -1632.979,3617.4668 -3617.476,3617.4668 -770.287,0 -1520.753,-246.0291 -2141.58,-702.0606 l -0,-0 -5408.491,-3973.1231 -0,-0 C 9415.112,841.83402 8099.8234,410.62695 6749.8809,410.62695 Z';
            // const svgPathInAbs = 'M6749.8809 410.62695C3272.2678 410.62695<PHONE_NUMBER>9999985 3272.2677999999996<PHONE_NUMBER>9999985 6749.8809 C410.62694999999985 7490.0074<PHONE_NUMBER>999998 8224.4407<PHONE_NUMBER>999998 8919.8574A179.9415 179.9415 0 0 0 1023.7987999999998 9027.4824L3245.291 8224.6738A179.9415 179.9415 0 0 0 3353.0938 7993.5977C3207.2105 7595.1765000000005 3132.5645 7174.178 3132.5645 6749.8809C3132.5645 4765.4844 4765.4844 3132.5645 6749.8809 3132.5645C7520.2063 3132.5645 8270.7433 3378.6241 8891.5352 3834.6895A179.9415 179.9415 0 0 0 8891.5352 3834.6895L14300.08 7807.8613A179.9415 179.9415 0 0 0 14300.08 7807.8613C15387.958 8607.0243 16703.186999999998 9038.1914 18053.1 9038.1914C21530.802 9038.1914 24392.522999999997 6176.4806 24392.522999999997 2698.7870999999996C24392.522999999997 1958.7154999999996 24262.946999999996 1224.3337999999997 24009.657999999996<PHONE_NUMBER>999994A179.9415 179.9415 0 0 0 23779.448999999997<PHONE_NUMBER>9999944L21557.948999999997 1224.1444999999994A179.9415 179.9415 0 0 0 21450.142999999996 1455.2108999999994C21595.984999999997 1853.5853999999995 21670.575999999997 2274.5365999999995 21670.575999999997 2698.7870999999996C21670.575999999997 4683.274299999999 20037.596999999998 6316.2539 18053.1 6316.2539C17282.813 6316.2539 16532.346999999998 6070.2248 15911.519999999999 5614.1933L15911.519999999999 5614.1933L10503.028999999999 1641.0702L10503.028999999999 1641.0702C9415.112 841.83402 8099.8234 410.62695 6749.8809 410.62695Z';
            const pathModel = m.importer.fromSVGPathData(svgPath, {
                bezierAccuracy: 0.1,
            });
            const svg = m.exporter.toSVG({
                models: {
                    original: pathModel,
                }
            });
            document.write(svg);
        </script>
    </head>
    <body>
        tweet-tweet
    </body>
</html>

I see, this path data is using the C curve command to create smooth curves with multiple Bezier control points (more than 4).
https://developer.mozilla.org/en-US/docs/Web/SVG/Tutorial/Paths#curve_commands
We currently don't have code to create the smoothed control points. As a workaround, do you have any option of creating separate curves?

Hi again, Dan! :)
You are partly right, there are curves with multiple control points in the first svg path. Sorry that I did not mention it, but there is another svg path that stays on the next line and is commented out. It is actually the same shape (only written in absolute coordinates and a bit simplified in it's structure), and there are no curves with >4 control points in it. And this second path gives the same result.
I tried to play a bit with the shape in Inkscape, and I found out that the problem disappears when I change the Arc "A179.9415 179.9415 0 0 0 8891.5352 3834.6895", that's why I assumed that the problem is rather with arcs than with curves.

Thanks for the clarification. BTW I am using this great tool to analyze SVG paths: https://yqnn.github.io/svg-path-editor/
Pasting in your path data, we can see that there are some arcs which are degenerate - they have 0 0 as their dx, dy, which means zero radius.

I suppose Maker.js could catch this, and drop the incoming command. Until then, perhaps you can use svgo (command line) or svgomg (gui) which removes these non-contributing commands.

Dan, simply wow, thank you for the great tool! :)
Yes, it'd be wonderful if makerjs would ignore such incorrect commands (with warnings?), then one'd not be so surprised seeing Inkscape drawing such paths normally.
Thanks for help!


hydrator component

move hydrator logic into own class
close #221

We already use the name "normalizer" to normalize individual values. And "hydrator" is a common name for transforming arrays into objects.
In any case, let's look at it again later to see if it can be structured better. I'm rebuilding the whole thing in several stages.


Update get-started-with-document-translation.md

In the json string for batch processing, a "" is missing, that leads to an error in Visual Studio

@thomash0815 : Thanks for your contribution! The author(s) have been notified to review your proposed change.

#sign-off

Publishing in this repository is suspended until Tuesday, May 25. Merging will resume Tuesday, and we'll merge this approved pull request at that time. Thanks.


add jsx and tsx files support

Can you, pls, implement the ability to add snippets to *.jsx and *.tsx files?

Just published a new version with the requested support. This was a good catch, thanks.


Android's monitorCharacteristicForDevice not working

[x] I am running the latest version
[x] I checked the documentation and found no answer
[x] I checked to make sure that this issue has not already been filed
This seems to be similar issue

I'm using this code and calling connectToDevice() & subscribeToDevice() & writeDataToDevice() in this order using proper formated data, and on iOS I receive data chunks that comes as notifications. As I said, on iOS It works like a charm, and on Android I'm unable to receive any data as notification.
import { Buffer } from "buffer";
import { bind } from "decko";
import EventEmitter from "EventEmitter";

import { BLE_DATA_RECEIVED } from "../constants";

const SERVICE_UUID = "000000ff-0000-1000-8000-00805f9b34fb";
const CHARACTERISTIC_UUID = "0000ff01-0000-1000-8000-00805f9b34fb";
const CHARACTERISTIC_TRANSACTION_ID = "MONITOR_TEMPO_CHARACTERISTIC";

export default class BleApi {
  constructor() {
    this.manager = new BleManager();
    this.eventEmitter = new EventEmitter();

    this.manager.setLogLevel("Verbose");
  }

  @bind
  scanDevices(callback) {
    if (this.scanning) return;
    this.scanning = true;
    this.manager.startDeviceScan(null, null, callback);
  }

  stopScanning() {
    if (!this.scanning) return;
    this.scanning = false;
    this.manager.stopDeviceScan();
  }

  connectToDevice({ deviceID }) {
    return this.manager.connectToDevice(deviceID).then(device => {
      this.stopScanning();
      return device.discoverAllServicesAndCharacteristics().then(() => {
        // console.log("Discovered all services and characteristics of device: ", device.name);
        return { deviceID, connected: true, discovered: true };
      });
    });
  }

  disconnectDevice({ deviceID }) {
    this.manager.cancelTransaction(CHARACTERISTIC_TRANSACTION_ID);
    return this.manager.cancelDeviceConnection(deviceID);
  }

  subscribeToDevice({ deviceID }) {
    this.manager.monitorCharacteristicForDevice(
      deviceID,
      SERVICE_UUID,
      CHARACTERISTIC_UUID,
      (error, characteristic) => {
        if (error) {
          console.error("Error at receiving data from device", error);
          return;
        } else {
          const response = Buffer.from(characteristic.value, "base64");
          const isLastChunk = response[response.length - 1] === 0;

          const clearResponse = response.slice(3);

          if (isLastChunk) {
            this.pendingDataReceive =
              this.pendingDataReceive + clearResponse.slice(0, clearResponse.length - 1).toString("utf8");
            let readyJSON;
            try {
              readyJSON = JSON.parse(this.pendingDataReceive);
            } catch (e) {
              console.log("ERROR WHILE PARSING JSON", this.pendingDataReceive);
            }
            this.pendingDataReceive = "";
          } else {
            this.pendingDataReceive = this.pendingDataReceive + clearResponse.toString("utf8");
          }
        }
      },
      CHARACTERISTIC_TRANSACTION_ID
    );
  }

  writeDataToDevice({ deviceID, data }) {
    const jsonData = JSON.stringify(data);
    const jsonBuffer = Buffer.from(jsonData);
    const trailingNull = Buffer.from([0]);
    const dataToSend = Buffer.concat([jsonBuffer, trailingNull]).toString("base64");

    return this.manager
      .writeCharacteristicWithoutResponseForDevice(deviceID, SERVICE_UUID, CHARACTERISTIC_UUID, dataToSend)
      .then((resp) => {
        return { written: true };
      });
  }
}

The logs from android looks like this
04-08 19:07:33.409 16172-17129/com.myapp.consumermvp D/RxBle#ClientOperationQueue: QUEUED   ScanOperationApi21(50614295)
04-08 19:07:33.410 16172-17140/com.myapp.consumermvp D/RxBle#ClientOperationQueue: STARTED  ScanOperationApi21(50614295)
04-08 19:07:33.416 16172-17200/com.myapp.consumermvp I/RxBle#QueueOperation: Scan operation is requested to start.
04-08 19:07:33.418 16172-17200/com.myapp.consumermvp D/BluetoothAdapter: isLeEnabled(): ON
04-08 19:07:33.425 16172-16194/com.myapp.consumermvp D/BluetoothLeScanner: onScannerRegistered() - status=0 scannerId=5 mScannerId=0
04-08 19:07:33.435 16172-17140/com.myapp.consumermvp D/RxBle#ClientOperationQueue: FINISHED ScanOperationApi21(50614295) in 24 ms
04-08 19:07:55.704 16172-17200/com.myapp.consumermvp I/RxBle#CancellableSubscription: Scan operation is requested to stop.
04-08 19:07:55.711 16172-17200/com.myapp.consumermvp D/BluetoothAdapter: isLeEnabled(): ON
04-08 19:07:55.747 16172-17214/com.myapp.consumermvp D/RxBle#ClientOperationQueue: QUEUED   ConnectOperation(100104710)
04-08 19:07:55.749 16172-17140/com.myapp.consumermvp D/RxBle#ClientOperationQueue: STARTED  ConnectOperation(100104710)
04-08 19:07:55.764 16172-17200/com.myapp.consumermvp V/RxBle#BleConnectionCompat: Connecting without reflection
04-08 19:07:55.765 16172-17200/com.myapp.consumermvp D/BluetoothGatt: connect() - device: 34:26:06:62:D0:6A, auto: false
04-08 19:07:55.766 16172-17200/com.myapp.consumermvp D/BluetoothGatt: registerApp()
    registerApp() - UUID=909a5342-b202-48ab-8bce-09041e44b561
04-08 19:07:55.769 16172-16194/com.myapp.consumermvp D/BluetoothGatt: onClientRegistered() - status=0 clientIf=5
04-08 19:07:56.126 16172-16194/com.myapp.consumermvp D/BluetoothGatt: onClientConnectionState() - status=0 clientIf=5 device=34:26:06:62:D0:6A
04-08 19:07:56.136 16172-16194/com.myapp.consumermvp D/RxBle#BluetoothGatt$1: onConnectionStateChange newState=2 status=0
04-08 19:07:56.153 16172-17140/com.myapp.consumermvp D/RxBle#ClientOperationQueue: FINISHED ConnectOperation(100104710) in 404 ms
04-08 19:07:56.187 16172-17129/com.myapp.consumermvp D/RxBle#ConnectionOperationQueue: QUEUED   ServiceDiscoveryOperation(221031381)
04-08 19:07:56.189 16172-17213/com.myapp.consumermvp D/RxBle#ConnectionOperationQueue: STARTED  ServiceDiscoveryOperation(221031381)
04-08 19:07:56.199 16172-17200/com.myapp.consumermvp D/BluetoothGatt: discoverServices() - device: 34:26:06:62:D0:6A
04-08 19:07:56.771 16172-16194/com.myapp.consumermvp D/BluetoothGatt: onConnectionUpdated() - Device=34:26:06:62:D0:6A interval=30 latency=0 timeout=400 status=0
04-08 19:07:57.220 16172-16194/com.myapp.consumermvp D/BluetoothGatt: onConnectionUpdated() - Device=34:26:06:62:D0:6A interval=6 latency=0 timeout=500 status=0
04-08 19:07:57.261 16172-16194/com.myapp.consumermvp D/BluetoothGatt: onSearchComplete() = Device=34:26:06:62:D0:6A Status=0
04-08 19:07:57.265 16172-16194/com.myapp.consumermvp D/RxBle#BluetoothGatt$1: onServicesDiscovered status=0
04-08 19:07:57.270 16172-17214/com.myapp.consumermvp V/RxBle#ServiceDiscoveryOperation: Preparing services description
04-08 19:07:57.281 16172-17214/com.myapp.consumermvp V/RxBle#ServiceDiscoveryOperation: --------------- ====== Printing peripheral content ====== ---------------
    PERIPHERAL ADDRESS: 34:26:06:62:D0:6A
    PERIPHERAL NAME: MY_TEMPO
    -------------------------------------------------------------------------

    Primary Service - Generic Attribute (00001801-0000-1000-8000-00805f9b34fb)
    Instance ID: 1
    -> Characteristics:
    	* Service Changed (00002a05-0000-1000-8000-00805f9b34fb)
    	  Properties: [ INDICATE ]
    	  -> Descriptors:
    		* Client Characteristic Configuration (00002902-0000-1000-8000-00805f9b34fb)

    Primary Service - Generic Access (00001800-0000-1000-8000-00805f9b34fb)
    Instance ID: 20
    -> Characteristics:
    	* Device Name (00002a00-0000-1000-8000-00805f9b34fb)
    	  Properties: [ READ ]
    	* Appearance (00002a01-0000-1000-8000-00805f9b34fb)
    	  Properties: [ READ ]
    	* Central Address Resolution (00002aa6-0000-1000-8000-00805f9b34fb)
    	  Properties: [ READ ]

    Primary Service - Unknown service (000000ff-0000-1000-8000-00805f9b34fb)
    Instance ID: 40
    -> Characteristics:
    	* Unknown characteristic (0000ff01-0000-1000-8000-00805f9b34fb)
    	  Properties: [ READ WRITE NOTIFY ]
    	  -> Descriptors:
    		* Client Characteristic Configuration (00002902-0000-1000-8000-00805f9b34fb)
    --------------- ====== Finished peripheral content ====== ---------------
04-08 19:07:57.289 16172-17213/com.myapp.consumermvp D/RxBle#ConnectionOperationQueue: FINISHED ServiceDiscoveryOperation(221031381) in 1100 ms
04-08 19:07:57.323 16172-17129/com.myapp.consumermvp D/BluetoothGatt: setCharacteristicNotification() - uuid: 0000ff01-0000-1000-8000-00805f9b34fb enable: true
04-08 19:07:57.349 16172-17129/com.myapp.consumermvp D/RxBle#ConnectionOperationQueue: QUEUED   DescriptorWriteOperation(14600020)
04-08 19:07:57.351 16172-17213/com.myapp.consumermvp D/RxBle#ConnectionOperationQueue: STARTED  DescriptorWriteOperation(14600020)
04-08 19:07:57.370 16172-16194/com.myapp.consumermvp D/BluetoothGatt: onConnectionUpdated() - Device=34:26:06:62:D0:6A interval=30 latency=0 timeout=400 status=0
04-08 19:07:57.408 16172-16194/com.myapp.consumermvp D/RxBle#BluetoothGatt$1: onDescriptorWrite descriptor=00002902-0000-1000-8000-00805f9b34fb status=0
04-08 19:07:57.413 16172-17213/com.myapp.consumermvp D/RxBle#ConnectionOperationQueue: FINISHED DescriptorWriteOperation(14600020) in 63 ms
04-08 19:07:58.317 16172-17128/com.myapp.consumermvp I/ReactNativeJS: SUBSCIREBBED
04-08 19:07:58.372 16172-17129/com.myapp.consumermvp D/RxBle#ConnectionOperationQueue: QUEUED   CharacteristicWriteOperation(53394107)
04-08 19:07:58.374 16172-17213/com.myapp.consumermvp D/RxBle#ConnectionOperationQueue: STARTED  CharacteristicWriteOperation(53394107)
04-08 19:07:58.400 16172-16194/com.myapp.consumermvp D/RxBle#BluetoothGatt$1: onCharacteristicWrite characteristic=0000ff01-0000-1000-8000-00805f9b34fb status=0
04-08 19:07:58.407 16172-17214/com.myapp.consumermvp V/RxBle#BleModule: Write to Characteristic(uuid: 0000ff01-0000-1000-8000-00805f9b34fb, id: 8, value: 7B22636F6D6D616E64223A227365745F6D6F6465222C226D6F6465223A2269646C65227D00)
04-08 19:07:58.415 16172-17213/com.myapp.consumermvp D/RxBle#ConnectionOperationQueue: FINISHED CharacteristicWriteOperation(53394107) in 39 ms
04-08 19:08:02.143 16172-16788/com.myapp.consumermvp W/System: A resource failed to call response.body().close().
    A resource failed to call response.body().close().
04-08 19:08:33.697 16172-17249/com.myapp.consumermvp V/FA: Recording user engagement, ms: 151615
04-08 19:08:33.733 16172-17249/com.myapp.consumermvp V/FA: Connecting to remote service
04-08 19:08:33.765 16172-16172/com.myapp.consumermvp D/ScopedContext: WARNING: getPackageName called on ScopedContext
04-08 19:08:33.766 16172-17249/com.myapp.consumermvp V/FA: Activity paused, time: 691974559
04-08 19:08:33.779 16172-16172/com.myapp.consumermvp D/ScopedContext: WARNING: getPackageName called on ScopedContext
04-08 19:08:33.785 16172-16631/com.myapp.consumermvp D/ScopedContext: WARNING: getPackageName called on ScopedContext
04-08 19:08:33.861 16172-16629/com.myapp.consumermvp D/ScopedContext: WARNING: getPackageName called on ScopedContext
04-08 19:08:34.211 16172-17249/com.myapp.consumermvp V/FA: Connection attempt already in progress
04-08 19:08:34.212 16172-17249/com.myapp.consumermvp D/FA: Connected to remote service
04-08 19:08:34.237 16172-17249/com.myapp.consumermvp V/FA: Processing queued up service tasks: 2

As you can see in the logs, there are no notifications received from the peripheral you are connected to.
I think that the problem lays in the data you write to the characteristic: 7B22636F6D6D616E64223A227365745F6D6F6465222C226D6F6465223A2269646C65227D00. It is far too large for the default MTU (23, 20 bytes usable) so the data you write is simply truncated to 7B22636F6D6D616E64223A227365745F6D6F6465 unless your peripheral supports so called Queued Write Request which is rarely seen.
iOS by default negotiates higher MTU (its a system dependent behaviour). Yet on Android nothing like this happens. You do not even request any MTU change.
Try using higher MTU value.

Yeah, It works, big big thanks!
Great idea to have It as default behavior in the library as you proposed in issue.
Take care and thanks again!


#234 return appropriate http status code according to exception type

After Migrating to Apollo server 3, this solution will not work since in V3 almost all plugin methods are async.


Question: how this can be adapted to work with mapbox_maps_flutter?

Liked your library very much, but unfortunately I am currently stuck with mapbox_maps_flutter, if you can give me some suggestions on what APIs I need in order to port this over to support mapbox_maps_flutter, I can take a stab at it. Thank you!

Hi @wwyung . This plugin is quite closely tied to the inner workings of flutter_map. So I'm not sure that's going to be an easy feat. I think you'd be better served creating a plugin from scratch for mapbox and maybe copying some code from this plugin where it can be useful (i.e. popup positioning calculations).


Small improvements

V0.11.0

Fix: New Shuffle algorithm
Update: set message-box width to 60% of the screen size
Update: Shuffle is no more possible during active meeting
Update: Set default Timeslot counter to 2 minutes insted of 0

First of all, thank you for spending time on this repository.
I took a look at your changes and came to the conclusion not to accept your pull request as of the following reasons.

There are more than one changes in this commit
Shuffling the entries of an active meeting is a feature I use very often
Size of the dialog looks fine to me in case of small window width. I accept that the dialog is to large on larger window width. I would accept a responsive dialog width.
0 minutes is as good as 2 minutes or 5
There is no need for an additional function for shuffling
The reandomnes of both methods are equal (see the statistics)

To be able to compare the randomness, I scramled the same array 1 billion times and counted the new position of the elements. The deviation seems to be equal in both methods. Performance has been equal, too.
Randomness of the old algorithm:
[
  "[100004133,100003243,100003698,100008395,99992037,99996250,100007203,100016808,99987770,99980463]",
  "[100003501,99997500,100001641,100015800,99983135,99998089,100007546,99992358,100010371,99990059]",
  "[99994247,100002792,100005927,99998782,99997130,100005013,99983953,99995015,99996406,100020735]",
  "[100011456,100005503,100005813,99983734,99995776,100004819,99994120,100012509,99995503,99990767]",
  "[99997059,100007892,100006085,99986528,100006250,100004318,100002040,99987123,99996810,100005895]",
  "[99994889,100007839,100002076,99993969,100019444,99989428,99997465,100003342,100000576,99990972]",
  "[99981460,100005456,100001967,100003222,99991352,100003901,100010435,100001186,100008034,99992987]",
  "[99994951,99993323,99986522,100004503,100006938,99996937,100007096,100008660,100010268,99990802]",
  "[100000553,99979609,99986062,100009155,100018450,100006672,99999482,100001344,99986684,100011989]",
  "[100017751,99996843,100000209,99995912,99989488,99994573,99990660,99981655,100007578,100025331]"
]

Randomness of the new algorithm:
[
  "[100002444,99998497,99996148,99982391,100001429,99999116,100003550,100009411,100004731,100002283]",
  "[99993988,100004341,99991146,100008427,100005662,99993244,100020070,100010788,99989300,99983034]",
  "[100004602,99999609,100018907,99992196,99986859,99999433,99994711,99976599,100029026,99998058]",
  "[99988128,100008595,100007756,100011664,99995094,100000181,99989903,99987115,100007945,100003619]",
  "[99979293,99995847,99986622,100003294,99995239,100018091,100010261,100022791,99983302,100005260]",
  "[100018069,99980316,100013220,100000984,99998589,100007177,99998298,100009669,99975588,99998090]",
  "[100008418,100007907,99993972,99993769,100000838,100007440,99991970,99990906,100012747,99992033]",
  "[99993165,99992319,100004255,100018929,100007466,100001145,99992668,99991512,100004613,99993928]",
  "[100006643,99999055,99997071,99999020,99999374,99985205,100007793,100014047,99981051,100010741]",
  "[100005250,100013514,99990903,99989326,100009450,99988968,99990776,99987162,100011697,100012954]"
]


Issue with setting up plugin

I'm just setting up this plugin with the following in my config:
local opts = {silent = true, noremap=false}
vim.api.nvim_set_keymap('n', '<C-a>', '<Plug>(dial-increment)', opts)
vim.api.nvim_set_keymap('n', '<C-x>', '<Plug>(dial-decrement)', opts)
vim.api.nvim_set_keymap('v', '<C-a>', '<Plug>(dial-increment)', opts)
vim.api.nvim_set_keymap('v', '<C-x>', '<Plug>(dial-decrement)', opts)
vim.api.nvim_set_keymap('v', 'g<C-a>', '<Plug>(dial-increment-additional)', opts)
vim.api.nvim_set_keymap('v', 'g<C-x>', '<Plug>(dial-decrement-additional)', opts)

However for example if I do <C-x> on 2021-03-22 then with my cursor on the first character I just get 2020-03-22 instead of 2021-03-21 which is what I would have expected.
If I understood it correctly it should work by default on dates right? Or do I need to add that to the searchlist?

@AckslD
It reproduced, and turned out to be a bug caused by a mistake in the pattern description.
Please update this plugin and check if the problem has been solved.
If you are still having problems, feel free to reopen this issue or create a new issue.
Thank you for your report!

Thanks for the quick response @monaqa! I updated to the latest version but for some reason I still have the same behaviour.

@AckslD
Do you have the cursor on 2021 when you press <C-x>?
If so, the year of 2021-03-22 is decremented, resulting in 2020-03-22.
To decrement the date, you need to bring the cursor on the string 22 or before the string 2021-03-22.

@monaqa Sorry my bad, that makes a lot of sense and it does indeed work :) Thanks for the help!


Blank area when scrolling fast

Current behavior

Display blank area when scrolling fast.

aa.webm
Expected behavior

No blank when scrolling fast

To Reproduce
Please try the code
const App: () => Node = () => {
  const [list, setList] = useState([])

  useEffect(() => {
     fetch('https://api.coinpaprika.com/v1/tickers').then(data => {
      data.json().then(jsonData => {
        setList(jsonData)
      })
    })
  }, [])

  return (
    <View style={{flex: 1}}>
      <FlashList estimatedItemSize={19.4} renderItem={({item, index}) => <Text>{item.name}</Text>} data={list} />
    </View>
  );
};

Platform:

[x] iOS
[x] Android

Environment
1.3.0

Can you mention the device being used and whether Dev mode was off?

@naqvitalha
Yes,

Dev mode was off
I was using Emulator: Pixel 2 API 29. it happen to my ios device/simulator also when i scroll fast enough. And anyone in my team can also see the blank on android real devices - Release mode.

I created a snack for the issue at https://snack.expo.dev/@wcandillon/flashlist-test and it seems to work fine. Should I try it on a very low-end device? is it related to the power of the device?

@phantrungviet98 I tried it on Moto G10. Here's the result: https://user-images.githubusercontent.com/7811728/193417131-2d39ad46-67c7-4611-9cf8-b12995f1d216.mp4
It's possible that something could be wrong in your app or emulator. Anything above Snapdragon 625 shouldn't be a problem. It's difficult to debug specific instances without a repro. We always test on low end devices by default.
If you can't find the problem you can try playing with drawDistance.

Thanks @wcandillon @shrihari1999 @naqvitalha for reply.
From my side, the more slow device, the more fast scroll, the more heavily component, then more visible the blank.
i tested it on Xiaomi Redmi Note 10 - Snapdragon 678
List item has 1 text and SVGUri. Please check my video
https://user-images.githubusercontent.com/46047955/193825258-004621fc-12db-4f1c-8b9d-38bda815b7f7.mp4

@naqvitalha  Thank you for answer, i think i need to optimize the component

Let us know how it goes. I'm going to close this in the meantime.

c

c

Why is this closed if it's not solved?

Why closed are u kidding?


support Webhook APIs

As of August 2020, following api to manage webhooks hasn't been released.
After it be release, this library plan to support it.
ENDPOINT

POST /webhook_subscriptions
GET /webhook_subscriptions/{webhook_uuid}
DELETE /webhook_subscriptions/{webhook_uuid} (Development Document)
GET /webhook_subscriptions (Development Document)

The Webhook apis were released at 16th in Sep 2020.
I'm starting to ready.


Make InstanceGraph track module hierarchies not contained in the top-…

…level hierarchy

I moved the comment. Have you tried this with your constprop input?

Yep, was in the process of testing it.

Seems to work fine. Thanks Albert!


"ValueError: need more than 1 value to unpack" Error. Can anyone help?

Hi ,
I got this error while running in 7 core CPU, 16GM RAM engine. I could not follow "ValueError: need more than 1 value to unpack". I would appreciate any help if given reason and most possible solution.
Exception in thread Thread-2:
Traceback (most recent call last):
File "/usr/lib/python2.7/threading.py", line 810, in __bootstrap_inner
self.run()
File "/usr/lib/python2.7/threading.py", line 763, in run
self.__target(*self.__args, **self.__kwargs)
File "/home/lab1/KittiSeg/hypes/../inputs/kitti_seg_input.py", line 350, in enqueue_loop
for d in gen:
File "/home/lab1/KittiSeg/hypes/../inputs/kitti_seg_input.py", line 155, in _make_data_gen
for image, gt_image in data:
File "/home/lab1/KittiSeg/hypes/../inputs/kitti_seg_input.py", line 114, in _load_gt_file
image_file, gt_image_file = file.split(" ")
ValueError: need more than 1 value to unpack

What do the contents of your data_file look like? The error implies that the lines in your data_file contain a string without spaces, e.g.,
somestringwithoutspaces1
somestringwithoutspaces2
...

The function expects a data_file that has lines that look like:
image1_filename gt_image1_filename
image2_filename gt_image2_filename
...

image1_filename and gt_image1_filename should correspond to the paths in your file system to the input and label images to be trained on, respectively. This part of the code in kitti_seg_input.py should identify where the images and label images are located in you file system / on disk.
Hope this helps!

Yes, I got it. There was a newline without any string at the end of train3.txt
Thank you,


Times don't add up to total time

Is it expected that the individual timings don't add up to the general output time?
This is what I get on one project:
 SMP  ⏱
General output time took 17.75 secs

 SMP  ⏱  Plugins
SourceMapDevToolPlugin took 0.341 secs
DllReferencePlugin took 0.029 secs
MiniCssExtractPlugin took 0.012 secs

 SMP  ⏱  Loaders
C:\Users\jens\Documents\Projects\VisBricks\VisBricks.Crm\ClientApp\node_modules\ts-loader\index.js took 13.32 secs
  module count = 34
C:\Users\jens\Documents\Projects\VisBricks\VisBricks.Crm\ClientApp\node_modules\mini-css-extract-plugin\dist\loader.js, and
C:\Users\jens\Documents\Projects\VisBricks\VisBricks.Crm\ClientApp\node_modules\css-loader\dist\cjs.js, and
C:\Users\jens\Documents\Projects\VisBricks\VisBricks.Crm\ClientApp\node_modules\sass-loader\lib\loader.js took 8.99 secs
  module count = 1
C:\Users\jens\Documents\Projects\VisBricks\VisBricks.Crm\ClientApp\node_modules\css-loader\dist\cjs.js, and
C:\Users\jens\Documents\Projects\VisBricks\VisBricks.Crm\ClientApp\node_modules\sass-loader\lib\loader.js took 4.99 secs
  module count = 1
modules with no loaders took 2.4 secs
  module count = 152

I saw the tickets about multiple entries with the same loaders, but a) I don't know why it happens here, I don't have more than one rule for css and b) the times still don't add up to the general output time when I ignore one of them.
How am I to interpret this result?

Yes, the general output time is everything that webpack does, it's the full time it takes for your build to happen.
As well as running loaders and plugins, webpack also does things entirely by itself (such as writing your output files to disk, for example) which can't really be attributed to any particular loader or plugin.
I want to try and make things clearer in the output itself - but hopefully that clears it up for you?

The ts-loader takes over 13s, the next loader chain over 8s,and the sum 21s is already more than the general output time in this case. That's what I find weird.

@stephencookdev I have the same problem. Do you have any suggestions as to how I can find out exactly what is consuming the extra time? My general output time is at 12 seconds for each incremental build while babel-loader takes only 0.3s when I change a single line of code with HMR enabled.

This plugin looks at how long each entry and exit to a loader takes. Anything happening outside of that is webpack's internals.
This could be stuff like accessing the filesystem (e.g. reading/writing files), handling the dev server, or any other job that webpack does that's not specifically a loader or a plugin (webpack does quite a lot of stuff).
You can try using webpack 4's profiling plugin if you want to get down and dirty to really work out what's taking time. But I would probably recommend just following some general speed up tips, like you can read about here or here.


[Need Help] ios编译时报关于photo_manager的错

Description
项目引用了photo，android编译没问题，ios编译报错，执行pod install就会报如下错误：
[!] CocoaPods could not find compatible versions for pod "photo_manager":
In Podfile:
photo_manager (from .symlinks/plugins/photo_manager/ios)
Specs satisfying the photo_manager (from .symlinks/plugins/photo_manager/ios) dependency were found, but they required a higher minimum deployment target.
Plugin version
版本0.4.8和0.5.0-dev.3都试过，都会报错，也单独引进过photo_manager，还是报错

Set your project min support sdk to iOS 9.0.

Set your project min support sdk to iOS 9.0.

啊，成功了！感谢大佬！


Fix Windows URL interception

Adding servers via URL interception was broken in the Windows client because the system adds a trailing slash to the URL. Strip the slash before sending it to the UI.

Regarding tests, this would only be caught by an integration test, as it is the OS that adds the slash. I thought about fixing this in ShadowsocksConfig, thought it's not clear to me whether trailing slashes are supported in the spec.


Doesn't seem to work anymore with recent steam clients

HeadsDown.html no longer seems to be bundled with the Steam client. Connecting to the web server in general doesn't seem to be possible anymore. This may only be for the SteamOS beta, though.

Since Steam Remote UI was disabled in April 2015, could you make a note of that in the Readme.md the same way it's noted in the docs for this project? https://github.com/SteamDatabase/RemoteControlDocs


Stuck on “authorizationsStateWaitPhoneNumber”

I try to test the [c#  example], it was stuck after entering the phone number.
I just replace the ApiId and ApiHash

Did you send setAuthenticationPhoneNumber request? Is Telegram banned in your area?
You can also set verbosity level of TDLib logs to 5 and check, what's going on there.

Did you send setAuthenticationPhoneNumber request? Is Telegram banned in your area?
You can also set verbosity level of TDLib logs to 5 and check, what's going on there.


add xfcc authenticator

[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[X] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[X] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

@howardjohn PTAL

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

lint_istio
478493b1a42c72e9ec5e15bf173341962e525865
link
true
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test lint_istio

@ramaraochavali: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

gencheck_istio
478493b1a42c72e9ec5e15bf173341962e525865
link
true
/test gencheck_istio

lint_istio
478493b1a42c72e9ec5e15bf173341962e525865
link
true
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

gencheck_istio
35b3fb4ec9ec3e748970cca28a7549b7c5166299
link
true
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

I am getting the following error while running make gen on mac M1. Any suggestions on how to get it working?
WARNING: The requested image's platform (linux/amd64) does not match the detected host platform (linux/arm64/v8) and no specific platform was requested

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

gencheck_istio
1a5b39c414f0068684364c5f13e4ac59663ffb2f
link
true
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

gencheck_istio
1391b2f188f490ceaa60caa90403a1d2534642dd
link
true
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

gencheck_istio
6bdd2309bfde4e477bd49f38757de7b6bd3a6077
link
true
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ramaraochavali: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

gencheck_istio
6bdd2309bfde4e477bd49f38757de7b6bd3a6077
link
true
/test gencheck_istio

integ-security-multicluster_istio
6bdd2309bfde4e477bd49f38757de7b6bd3a6077
link
true
/test integ-security-multicluster_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ramaraochavali: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-security-multicluster_istio
6bdd2309bfde4e477bd49f38757de7b6bd3a6077
link
true
/test integ-security-multicluster_istio

gencheck_istio
5ef0b02914c97aac7fbbf2e3af3a1ca5b8cfae34
link
true
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Another comment - I looked at the library you are using and it's not bad, but it may be better to add a dependency to a generic library for parsing 'http structured' headers - like https://pkg.go.dev/github.com/gobwas/httphead ( I didn't do a lot of research into what's the most popular or if golang core libraries support parsing structured headers  - but I believe XFCC is following the model )

@costinm @howardjohn I have addressed all comments except for library comment - as I could not find any better http header parser. We can continue with the current library and if we find a better one, we can swap it out.

Agree, we can continue with that parser until we find a better one.

Sorry for the nitpicking - this is pretty important and risky.

For more context: the idea would be to have the east/west or ingress
gateway to act as entry point and terminate
most XDS connections. It would also apply standard istio configs -
including RBAC, traffic split, etc and use
ACME or standard certificates.
I did explore the idea of having the east-west gateway co-located with
Istiod - it simplifies deployment but
doesn't sound right. I don't mind having it as an option.
On Fri, Jun 17, 2022 at 10:54 AM Costin Manolache @.***> wrote:

On Thu, Jun 16, 2022 at 11:09 PM Rama Chavali @.***>
wrote:

@.**** commented on this pull request.
In pilot/pkg/bootstrap/server.go
https://github.com/istio/istio/pull/39405#discussion_r899792457:

@@ -308,6 +308,7 @@ func NewServer(args *PilotArgs, initFuncs ...func(*Server)) (*Server, error) {
// is used as the authentication result.
authenticators := []security.Authenticator{
&authenticate.ClientCertAuthenticator{},

&authenticate.XfccAuthenticator{},

The use case here is envoy front ending Istiod and it takes care of TLS
termination. So the connection is from localhost. I think if the peer
connection is from localhost and Xfcc Authenticator is enabled, we can rely
on xfcc authenticator - Do you agree or any concerns?

That limits us to envoy frontend co-located as sidecar with Istiod. It's
useful - but I think the more common/interesting use case
is an envoy acting as gateway ( possibly the main ingress gateway, or the
east/west gateway ).

Looking at go.sum.diff - did we now pick a dep on kong and thrift ?

That is not expected. Will take a look.

@costinm Thank you for your thorough review. I have now introduced concept of DelegatingAuthenticators and added CidrAuthenticator that validates whether the request is from trusted Cidrs, if it is it delegates authentication to XfccAuthenticator. This should help the gateway use case also. PTAL.
regarding kong and go thrift, kong is a parser that participle uses in examples same with go thrift. I think we do not directly depend on it that is why it is not in go.mod

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

lint_istio
4d8e065cf376e4cff0cf58e18fa5be2b5232563e
link
true
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

On Fri, Jun 17, 2022 at 9:41 PM Rama Chavali @.***>
wrote:

@.**** commented on this pull request.
In pilot/pkg/xds/auth.go
https://github.com/istio/istio/pull/39405#discussion_r900696816:

for _, authn := range s.Authenticators {

u, err := authn.Authenticate(ctx)

// If one authenticator passes, return

u, err := authn.Authenticate(authContext)

Mtls is first and xfcc is last. It appends to the list of identities that
previous ones have already added.
Not sure how this works - first wins?
Any one wins. The identities are merged together.

That's not correct behavior AFAIK - we don't want the identity of the
(trusted) gateway in the list.
Or maybe we want it ( to know the path ) - but the result of auth should be
the identity of the real client.
The authenticators are also used for generating certs ( we do support cert
signing based on a client cert) - and
the cert has one NS and KSA, which should be of the original client.

Message ID: @.***>

Great, thanks. I suspect we'll iterate on this - no need to implement
everything in a single PR or solve all use cases.
Will take another look - hopefully other people will take a look as well,
security is very hard.
See my comment on end result of authentication reflecting only the original
client ( it is fine if the auth context
keeps track of connection peer and JWT - but if XFCC is present, that
should be used in XDS and for cert generation ).
On Sat, Jun 18, 2022 at 2:09 AM Rama Chavali @.***>
wrote:

@costinm https://github.com/costinm Thank you for your thorough review.
I have now introduced concept of DelegatingAuthenticators and added
CidrAuthenticator that validates whether the request is from trusted Cidrs,
if it is it delegates authentication to XfccAuthenticator. This should help
the gateway use case also. PTAL.
regarding kong and go thrift, kong is a parser
https://github.com/alecthomas/kong that participle
https://github.com/alecthomas/participle uses in examples same with go
thrift. I think we do not directly depend on it that is why it is not in
go.mod
—
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/pull/39405#issuecomment-1159403516, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAUR2V22XZ4NQJXF2GIRYLVPWG6JANCNFSM5YNI425A
.
You are receiving this because you were mentioned.Message ID:
@.***>

I would also do the delegation in code - too early to abstract, we only
have this special use case.
On Tue, Jun 21, 2022 at 8:31 PM Costin Manolache @.***> wrote:

While I think we will need the CIDR authenticator in the future - for now
it may be best to have the checks in the XFCC authenticator, not as a
separate one.
For 'CIDR' authentication - will be important for the 'trusted network'
case ( where the network has ipsec / etc ) - but with additional code to
lookup the
caller by IP ( based on the discovery info ) and populate the
namespace/KSA from the calling Pod.
In the case of XFCC - the caller IP can be an external load balancer (not
a pod) - we can reuse some code but it's a different kind of CIDR checking,
i.e. against a list of 'trusted auth proxies' CIDR.
On Tue, Jun 21, 2022 at 8:18 PM Rama Chavali @.***>
wrote:

@.**** commented on this pull request.
In pkg/security/security.go
https://github.com/istio/istio/pull/39405#discussion_r903245013:

@@ -351,12 +352,36 @@ type Caller struct {
Identities []string
}

+type AuthContext struct {

// RequestContext is the context from request.
RequestContext context.Context
// Authenticators is the list of authenticators that were executed before in the auth chain.
Authenticators []string
// DelegatedAuthenticators are the list of delegated authenticators that main authenticators can
// choose to get identities from. For example, CidrAuthenticator can delegate the authentication to
// XfccAuthenticator once it validates the connection is from trusted cidr range. XfccAuthenticator
// can then extract identities from peer certificate.
DelegatedAuthenticators []Authenticator

This is not just for XFCC case. We could add other delegated
authenticators later if needed. For XFCC though, having the bool may be
sufficient.
—
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/pull/39405#discussion_r903245013, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAUR2U4BS354ICVIEVRF23VQKAYHANCNFSM5YNI425A
.
You are receiving this because you were mentioned.Message ID:
@.***>

I would also do the delegation in code - too early to abstract, we only
have this special use case.

Are you saying cidr authenticator internally runs xfcc header authenticator and populate identities?

No, XFCC authenticator does checks on the remote IP against the CIDR range,
it has nothing to do with a future CIDR authenticator.
I think we are talking about 2 different CIDR authenticators. What you have
in this PR is not really an authenticator - it checks CIDR
ranges, but doesn't determine the identity of the peer. What I am proposing

for a different PR - is to add a proper CIDR authenticator
that first check the range is 'trusted', and then find the proper namespace
and service account by looking up based on IP, since Istiod
has all the pods.

On Tue, Jun 21, 2022 at 9:00 PM Rama Chavali @.***>
wrote:

I would also do the delegation in code - too early to abstract, we only
have this special use case.
Are you saying cidr authenticator internally runs xfcc header
authenticator and populate identities?
—
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/pull/39405#issuecomment-1162610135, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAUR2QQJIHLS5ZX4DXLWVTVQKFUJANCNFSM5YNI425A
.
You are receiving this because you were mentioned.Message ID:
@.***>

On Wed, Jun 22, 2022 at 6:48 PM Zhonghu Xu @.***> wrote:

Is there a similar design we can borrow? I think a general solution can be
somewhere

For XFCC - there are quite a few 'delegating auth' designs, including K8S
proxy.
For using the IP to derive the namespace/sa - I don't think I've seen this
anywhere. But that's
a separate proposal, specifically for users who have already secure network
layer and don't
need mTLS - or to add another layer of 'defense in depth'.

—
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/pull/39405#issuecomment-1163833884, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAUR2QOP6UCLFSDV4CPU6LVQO7ADANCNFSM5YNI425A
.
You are receiving this because you were mentioned.Message ID:
@.***>

Let us solve Xfcc now and we can iterate on this.

Looking at kubernetes docs,  K8s already supports authenticating a proxy https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authenticating-proxy which is mostly similar to xfcc header.

@kdorosh yes. I am aware of changes needed in istio CA path and authenticate request path. I want to iterate on the main authenticate and once we agree on the solution - I will make changes to those places.

@costinm PTAL. I have changed based on discussions. Currently I have added feature flag to specify trusted CIDRs, we can easily extend it to networks.

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

unit-tests_istio
ec5e0c9f489bbfd0289920b52143e8a960532a48
link
true
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ramaraochavali: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

unit-tests_istio
ec5e0c9f489bbfd0289920b52143e8a960532a48
link
true
/test unit-tests_istio

release-test_istio
ec5e0c9f489bbfd0289920b52143e8a960532a48
link
true
/test release-test_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-pilot-multicluster_istio
1a5f9f435193e446c6933f042a794a413c063045
link
true
/test integ-pilot-multicluster_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test integ-pilot-multicluster_istio

@costinm Agree with most of the comments and left TODOs for others. One thing I want to do as follow-up is to remove the return values from authenticate  and rely on AuthContext. But let us get this in and I will make follow-ups

Agree, we can do the signature change later and most of the other things - but I think we need to make sure we extract the right identity from the chain ( client - and not any of the trusted gateways/proxies ), and that we get the spiffe one.

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-pilot-istiodremote_istio
cded8a0acac74e322ca17e99ac2659fc35f31c49
link
true
/test integ-pilot-istiodremote_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test integ-pilot-istiodremote_istio

On Mon, Jun 27, 2022 at 1:28 AM Zhonghu Xu @.***> wrote:

@.**** commented on this pull request.
In pilot/pkg/features/pilot.go
https://github.com/istio/istio/pull/39405#discussion_r907114879:

@@ -403,6 +403,14 @@ var (
"If enabled, pilot will authorize XDS clients, to ensure they are acting only as namespaces they have permissions for.",
).Get()

// TODO: Move this to proper API.
TrustedGatewayCIDR = env.RegisterStringVar(

"TRUSTED_GATEWAY_CIDR",

"",

"If set, any connections from gateway to Istiod with this CIDR range are treated as trusted for using authenication mechanisms like XFCC."+

	" This can only be used when the network where Istiod and the authenticating gateways are running is a trusted/secure network",

).Get()

cidr has no direct relationship with xfcc headers

The relation is that XFCC headers from the CIDR will be trusted/processed.
Not sure how direct the relation is - it is not exclusive, i.e. we may
trust XFCC from
workloads that authenticate with a mTLS and match a list of identities.
We'll likely have multiple ways to establish trust with an XFCC gateway -
CIDR is one of them.
Message ID: @.***>

@costinm @hzxuzhonghu addressed comments. I still think we need to capture messages in AuthContext because we can remove the return value of each authenticator and can "truly" use context to capture the messages + final identity. Otherwise I do not see use of context at all.

@costinm can you please review this if this makes sense - I want to conclude this PR as https://github.com/istio/istio/pull/39690 is trying to refactor it so that the merge can be smooth.

@costinm Can you PTAL when you get chance?

@costinm PTAL when you get chance

@costinm gentle ping. Can you PTAL?

@hzxuzhonghu Can you please see if your concerns are addressed?

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

unit-tests_istio
1b8caa799a1ff87bb721e744a9060e17ffa30825
link
true
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@howardjohn @hzxuzhonghu Fixed all comments. PTAL

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

unit-tests_istio
6a20a0284e9af3df057584dec1f623ac2fd922b3
link
true
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ramaraochavali: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

unit-tests_istio
6a20a0284e9af3df057584dec1f623ac2fd922b3
link
true
/test unit-tests_istio

integ-security-multicluster_istio
6a20a0284e9af3df057584dec1f623ac2fd922b3
link
true
/test integ-security-multicluster_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ramaraochavali: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-security-multicluster_istio
6a20a0284e9af3df057584dec1f623ac2fd922b3
link
true
/test integ-security-multicluster_istio

unit-tests_istio
40b5e9fc35e3f5546b9bad254fdbf7170f1a2fe3
link
true
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-security_istio
405ae05e30824cf29ceb2ea586cb41e8efad7bd4
link
true
/test integ-security_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test integ-security_istio

@hzxuzhonghu addressed comments. PTAL

in xds authorize, we do check the client identities, which requires spiffe format, so how do you pass this check?

I do not think it is different here. If the identities have spiffeID - one of the identities should be from proxyNamespace.

@hzxuzhonghu fixed comments. For other files that have 2017 in copyright - will fix in a separate PR

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-security_istio
3400ba346162820cd928ccda56ebb54755baf588
link
true
/test integ-security_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test integ-security_istio

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-security-multicluster_istio
3400ba346162820cd928ccda56ebb54755baf588
link
true
/test integ-security-multicluster_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test integ-security-multicluster_istio

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-security-multicluster_istio
3400ba346162820cd928ccda56ebb54755baf588
link
true
/test integ-security-multicluster_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

in xds authorize, we do check the client identities, which requires spiffe format, so how do you pass this check?

I do not think it is different here. If the identities have spiffeID - one of the identities should be from proxyNamespace.

It is a must that at least one identity is spiffeID, so curious how you signed the certs to proxy, then it can make xfcc authenticator work here.

It is a must that at least one identity is spiffeID, so curious how you signed the certs to proxy, then it can make xfcc authenticator work here.

Yes. But if atleast one identity is not spiffe identity, the identity check will fail. Our certs will always have one spiffeID. Is it what you are asking?

@hzxuzhonghu @howardjohn any more concerns with this?

/retest

@ramaraochavali: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-security-multicluster_istio
3400ba346162820cd928ccda56ebb54755baf588
link
unknown
/test integ-security-multicluster_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test integ-security-multicluster_istio

While I think we will need the CIDR authenticator in the future - for now
it may be best to have the checks in the XFCC authenticator, not as a
separate one.
For 'CIDR' authentication - will be important for the 'trusted network'
case ( where the network has ipsec / etc ) - but with additional code to
lookup the
caller by IP ( based on the discovery info ) and populate the namespace/KSA
from the calling Pod.
In the case of XFCC - the caller IP can be an external load balancer (not a
pod) - we can reuse some code but it's a different kind of CIDR checking,
i.e. against a list of 'trusted auth proxies' CIDR.
On Tue, Jun 21, 2022 at 8:18 PM Rama Chavali @.***>
wrote:

@.**** commented on this pull request.
In pkg/security/security.go
https://github.com/istio/istio/pull/39405#discussion_r903245013:

@@ -351,12 +352,36 @@ type Caller struct {
Identities []string
}

+type AuthContext struct {

// RequestContext is the context from request.
RequestContext context.Context
// Authenticators is the list of authenticators that were executed before in the auth chain.
Authenticators []string
// DelegatedAuthenticators are the list of delegated authenticators that main authenticators can
// choose to get identities from. For example, CidrAuthenticator can delegate the authentication to
// XfccAuthenticator once it validates the connection is from trusted cidr range. XfccAuthenticator
// can then extract identities from peer certificate.
DelegatedAuthenticators []Authenticator

This is not just for XFCC case. We could add other delegated
authenticators later if needed. For XFCC though, having the bool may be
sufficient.
—
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/pull/39405#discussion_r903245013, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAUR2U4BS354ICVIEVRF23VQKAYHANCNFSM5YNI425A
.
You are receiving this because you were mentioned.Message ID:
@.***>

And we should support ( via additional PRs) the stronger model used by K8S,
i.e. the auth proxy having an mTLS connection to
Istiod and authenticating strongly.
But I think for 'localhost' or if the network is already secure  ( IPSec,
Wireguard, etc can guarantee encryption and authenticate
the IP address ) - CIDR mode can be acceptable too, in particular for
interop/compatibility purposes.
On Mon, Jun 27, 2022 at 2:53 AM Rama Chavali @.***>
wrote:

@.**** commented on this pull request.
In pilot/pkg/features/pilot.go
https://github.com/istio/istio/pull/39405#discussion_r907200553:

@@ -403,6 +403,14 @@ var (
"If enabled, pilot will authorize XDS clients, to ensure they are acting only as namespaces they have permissions for.",
).Get()

// TODO: Move this to proper API.
TrustedGatewayCIDR = env.RegisterStringVar(

"TRUSTED_GATEWAY_CIDR",

"",

"If set, any connections from gateway to Istiod with this CIDR range are treated as trusted for using authenication mechanisms like XFCC."+

	" This can only be used when the network where Istiod and the authenticating gateways are running is a trusted/secure network",

).Get()

If you config it, you trust this way, just like k8s request header
authenticator. It leaves the decision to the user.
request header authenticator does not leave it to user
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authenticating-proxy
In order to prevent header spoofing, the authenticating proxy is required
to present a valid client certificate to the API server for validation
against the specified CA before the request headers are checked. WARNING:
do not reuse a CA that is used in a different context unless you understand
the risks and the mechanisms to protect the CA's usage.
It is almost similar here
—
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/pull/39405#discussion_r907200553, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAUR2XJ5CUYCSAKSEMGV23VRF23NANCNFSM5YNI425A
.
You are receiving this because you were mentioned.Message ID:
@.***>

On Wed, Jun 22, 2022 at 8:17 AM Rama Chavali @.***>
wrote:

Ok. Looks like the proposal is to

merge the current cidr_authenticator logic in to xfcc authenticator
Drive the trusted ranges from network? Do we need special flag or we
have a network with name as "gateway" or we can configure that in the pilot
flag like TRUSTED_ NETWORK instead of configuring CIDR ranges
directly. Trying to see if we can avoid API change

I think we need to add a flag or label or some way to indicate the
(sub)network is trusted/secure at IP level, and another one to indicate
it is dedicated for gateways, i.e. all requests from that network will be
from a gateway that can use XFCC.

Seems a better option than defining a bunch of env variables or another
network definition config. It is currently a separate config map,
reloaded on change (AFAIK) - at some point we could promote it to a CRD,
but better wait for it to 'settle'.  I think the only broadly used
CRD defining CIDRs is NetworkPolicy - it is unfortunate the syntax is
slightly different, if we later promote networks to a CRD we may
converge them a bit.

—
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/pull/39405#issuecomment-1163245134, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAUR2TBL3J6YUHIKHQLO2DVQMVBDANCNFSM5YNI425A
.
You are receiving this because you were mentioned.Message ID:
@.***>

On Thu, Jun 16, 2022 at 11:09 PM Rama Chavali @.***>
wrote:

@.**** commented on this pull request.
In pilot/pkg/bootstrap/server.go
https://github.com/istio/istio/pull/39405#discussion_r899792457:

@@ -308,6 +308,7 @@ func NewServer(args *PilotArgs, initFuncs ...func(*Server)) (*Server, error) {
// is used as the authentication result.
authenticators := []security.Authenticator{
&authenticate.ClientCertAuthenticator{},

&authenticate.XfccAuthenticator{},

The use case here is envoy front ending Istiod and it takes care of TLS
termination. So the connection is from localhost. I think if the peer
connection is from localhost and Xfcc Authenticator is enabled, we can rely
on xfcc authenticator - Do you agree or any concerns?

That limits us to envoy frontend co-located as sidecar with Istiod. It's
useful - but I think the more common/interesting use case
is an envoy acting as gateway ( possibly the main ingress gateway, or the
east/west gateway ).

We should return one identity ( swapped identity - if peer identity is a
trusted gateway + XFCC, or the peer identity from cert or JWT ). The IP is
not an identity.
However I think the context should preserve information about peer IP and
identity - as a good auth API. Maybe this will also help having better
messages instead
of the multi-error we have when authenticating, but also if we want to log
for audit purposes ( in particular on the cert signing endpoint )
On Thu, Jun 23, 2022 at 3:01 PM Kevin Dorosh @.***>
wrote:

@.**** commented on this pull request.
In security/pkg/server/ca/authenticate/cidr_authenticator.go
https://github.com/istio/istio/pull/39405#discussion_r905504102:

+type CidrAuthenticator struct{}

+var _ security.Authenticator = &CidrAuthenticator{}
+
+func (c *CidrAuthenticator) AuthenticatorType() string {

return CidrAuthenticatorType
+}

+// Authenticate extracts identities from trusted cidr ranges.
+func (c *CidrAuthenticator) Authenticate(ctx security.AuthContext) (*security.Caller, error) {

peerInfo, _ := peer.FromContext(ctx.RequestContext)
if !isAuthenticated(peerInfo.Addr.String()) {

return nil, fmt.Errorf("")

}
ctx.AddDelegatedAuthenticator(XfccAuthenticator{})
return &security.Caller{AuthSource: security.AuthSourceDelegate, Identities: []string{peerInfo.Addr.String()}}, nil

why return an identity at all? it seems like it will be entirely ignored.
either the delegate authenticates and we return the swapped identity, or we
return authn failure.. returning anything here is confusing imo
—
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/pull/39405#discussion_r905504102, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAUR2QKAFO3EDRAT6R6DRDVQTNELANCNFSM5YNI425A
.
You are receiving this because you were mentioned.Message ID:
@.***>


Replace 'ParsableMessage' factory methods with an initializer.

This PR uses an initializer init(name:kind:) to unify multiple factory methods.

What if we changed each of these methods to drop the redundant type name, move the message: parameter first, then drop the redundant label there too?
ParsableMessage.signalled(signalledMessage, named: job.name.rawValue)

I like that idea.  But after giving some more thoughts to this, I think it might be better to drop these static methods and just use initializers instead, since it isn't more complicated:
ParsableMessage(name: job.kind.rawValue, kind: .signalled(message))

What do you think?

That sounds great to me.

Done.

@swift-ci please test

@swift-ci please test


[TreeView] await for state update after focus

[x] I have followed (at least) the PR section of the contributing guide.

will combine this small change with another PR


periodically stops responding on Raspi Pi

Unknown as to why the Connector stops responding on Raspi Pi.
The logs only appear to show disconnection errors.
connector-error.txt

I ended up completely rebuilding my Raspi Pi's to get this to settle.  I don't know if the issue was in some updated component, or what.  But it seems to have settled from the rebuild.


Feature/campaign member

Critical Changes
Recipe for NPSP Contacts, Campaign, Campaign Member Status and Campaign Members
Changes
New Recipe
Issues Closed
#50

@acrosman not sure if we need to merge both @alisamhh and mine or create a new Issue?

We can have them both committed and attached to the same issue that's fine. Hopefully I'll have some time to review and test both the weekend if someone else doesn't get there faster.
Thank you again for coming to the sprint and participating. Looking forward to seeing you again sometime.

@acrosman I made the changes, and the new Title Case Campaign works really well. I have uploaded the new file on this branch. Do I need to do anything more to get this PR ready for merge now?

@JodieM thanks for the changes.  One of us just needs to find the time to re-run to make sure we didn't miss any typos or similar slipping through.  @programmer2coder any chance you have time to re-check?  I'll try to get there when I have a few minutes to focus on not-work when not-fried.

Hi @programmer2coder
Snowfakery prioritizes certain objects based on the standardized order of inserts recommended by Salesforce. @prescod  You have mentioned before that there is a way to override the default order of insert.

Thanks @eehjunggnujhee  , I tried finding that in Snowfakery documentation but couldn't, so I just posted the question in CumulusCI (CCI) community (figuring @prescod is pretty busy these days).

@programmer2coder  the syntax looks like what it will going to do. I can do test from my side and update here

@programmer2coder hi~ using loading file as an option for generate_and_load_from_yml worked. sample command below:
cci task run generate_and_load_from_yaml -o generator_yaml snowfakery_samples/npsp/Contact_Campaign_CampaignMember.recipe.yml -o num_records 10 -o num_records_tablename Contact --org dev --loading_rules snowfakery_samples/npsp/CampaignMember_Status.mapping.yml

The loading file is currently in my local machine. We can perhaps discuss where to host these types of files in the repo.
- sf_object: CampaignMemberStatus
  load_after: Contact

- sf_object: CampaignMember
  load_after: CampaignMemberStatus

Thank you

There is another way to solve this. As discussed above, Snowfakery infers the order from what happens in the recipe. You can make the implicit dependency between CampaignMember and CampaignMemberStatus explicit and it will force CampaignMemberStatus to load before CampaignMember. Here's how I did that:
- object: CampaignMember
  fields:
    ContactId:
      reference: Contact
    Status:
      random_choice:
       - Sent
       - Responded
       - Attended
       - On List
    CampaignId:
      reference: Campaign
    __depends_upon:  # forces the correct load order
      reference: CampaignMemberStatus
- object: CampaignMember
  fields:
    ContactId:
      reference: Contact
    Status:
      random_choice:
       - Sent
       - Responded
       - Attended
       - On List
    CampaignId:
      reference: Campaign
    __depends_upon:  # forces the correct load order
      reference: CampaignMemberStatus

There is nothing special about the word __depends_upon: you could also call it __foobar or __load_after. The leading underscores make it so that it won't output an actual field for loading into Salesforce. But the reference will nevertheless be observed and will force a load order change.
So that's an alternate way to do it which does not require an external file.

Fabulous! I will change it to that.
On Wed, Dec 22, 2021, 3:19 PM Paul Prescod @.***> wrote:

There is another way to solve this. As discussed above, Snowfakery infers
the order from what happens in the recipe. You can make the implicit
dependency between CampaignMember and CampaignMemberStatus explicit and it
will force CampaignMemberStatus to load before CampaignMember. Here's how I
did that:

object: CampaignMember
fields:
ContactId:
reference: Contact
Status:
random_choice:
- Sent
- Responded
- Attended
- On List
CampaignId:
reference: Campaign
__depends_upon:  # forces the correct load order
reference: CampaignMemberStatus
object: CampaignMember
fields:
ContactId:
reference: Contact
Status:
random_choice:
- Sent
- Responded
- Attended
- On List
CampaignId:
reference: Campaign
__depends_upon:  # forces the correct load order
reference: CampaignMemberStatus

There is nothing special about the word __depends_upon: you could also
call it __foobar or __load_after. The leading underscores make it so that
it won't output an actual field for loading into Salesforce. But the
reference will nevertheless be observed and will force a load order change.
So that's an alternate way to do it which does not require an external
file.
—
Reply to this email directly, view it on GitHub
https://github.com/SFDO-Community-Sprints/Snowfakery-Recipe-Templates/pull/86#issuecomment-999274664,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAWUIN3XL64XCSP33AM5XK3USFGW5ANCNFSM5IIUJBJA
.
Triage notifications on the go with GitHub Mobile for iOS
https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675
or Android
https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.
You are receiving this because you were mentioned.Message ID:
<SFDO-Community-Sprints/Snowfakery-Recipe-Templates/pull/86/c999274664@
github.com>

Ok just getting back to this after a long time...
The bottom of my recipe now says
- object: CampaignMember
  fields:
    ContactId:
      reference: Contact
    Status:
      random_choice:
       - Sent
       - Responded
       - Attended
       - On List
    CampaignId:
      reference: Campaign
    __depends_upon:  # forces the correct load order but doesn't output a field
      reference: CampaignMemberStatus

However I get the error
Error: Problem rendering field __depends_upon:
 Cannot evaluate function `reference`:
 Cannot find an object named CampaignMemberStatus

I also tried naming it "__load_after" but it had the same issue
Also, I did not get the issue where it did not create Campaign Members with the newly created CM Statuses on the first run. It seemed to have one of each on the first run.
Sorry, but I'm a bit stuck with where to go next.

Hi @JodieM  Take the CampaignMemberStatus out from the friends relationship and put it in the same hierarchy as campaign member.

- object: Campaign
  just_once: True
  fields:
    Name: ${{fake.Bs | title}} Campaign
    Type:
      random_choice:
        - Conference
        - Webinar
        - Email
        - Telemarketing
    Status: In Progress
    IsActive: True
    Description:
      fake.text:
        max_nb_chars: 100
    StartDate:
      date_between:
        start_date: -30d
        end_date: today
    EndDate: ${{fake.FutureDate}}

- object: CampaignMemberStatus
  nickname: cm1
  fields:
    CampaignId:
      reference: Campaign
    Label: On List
    HasResponded: False
- object: CampaignMemberStatus
  nickname: cm2
  fields:
    CampaignId:
      reference: Campaign
    Label: Attended
    HasResponded: True

- object: CampaignMember
  fields:
    ContactId:
      reference: Contact
    Status:
      random_choice:
        - Sent
        - Responded
        - Attended
        - On List
    CampaignId:
      reference: Campaign
    __depends_upon:  # forces the correct load order
        reference: CampaignMemberStatus

Aha, that makes much more sense now. Ok I will get onto it soon.
On Sun, Jan 30, 2022, 4:10 PM eehjunggnujhee @.***>
wrote:

Hi @JodieM https://github.com/JodieM Take the CampaignMemberStatus out
from the friends relationship and put it in the same hierarchy as campaign
member.

object: Campaign
just_once: True
fields:
Name: ${{fake.Bs | title}} Campaign
Type:
random_choice:
- Conference
- Webinar
- Email
- Telemarketing
Status: In Progress
IsActive: True
Description:
fake.text:
max_nb_chars: 100
StartDate:
date_between:
start_date: -30d
end_date: today
EndDate: ${{fake.FutureDate}}

object: CampaignMemberStatus
nickname: cm1
fields:
CampaignId:
reference: Campaign
Label: On List
HasResponded: False

object: CampaignMemberStatus
nickname: cm2
fields:
CampaignId:
reference: Campaign
Label: Attended
HasResponded: True

object: CampaignMember
fields:
ContactId:
reference: Contact
Status:
random_choice:
- Sent
- Responded
- Attended
- On List
CampaignId:
reference: Campaign
__depends_upon:  # forces the correct load order
reference: CampaignMemberStatus

—
Reply to this email directly, view it on GitHub
https://github.com/SFDO-Community-Sprints/Snowfakery-Recipe-Templates/pull/86#issuecomment-1025071885,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAWUINZ7PMTSTXMRW25HKU3UYTB6BANCNFSM5IIUJBJA
.
Triage notifications on the go with GitHub Mobile for iOS
https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675
or Android
https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.
You are receiving this because you were mentioned.Message ID:
<SFDO-Community-Sprints/Snowfakery-Recipe-Templates/pull/86/c1025071885@
github.com>

@programmer2coder Hi! you are the last reviewer! the recipe ran as expected. I also updated the CCI CLI to the latest version. Let me know what you think, I think we are ready to merge this ticket

Yes, I have just tested this and the recipe ran as expected.  Newly created campaign members are randomly assigned to both the 2 new statuses as well as the 2 old statuses.  Great!


[Bug]: Descriptors cannot be created directly.

Is there an existing issue for the same bug?

[X] I have checked the existing issues.

Describe the bug and reproduction steps
Some protobuf error related to chromaDB:
(openhands-ai-py3.12) (base) xingyaow@xingyao-develop:~/OpenHands$ evaluation/swe_bench/scripts/eval_infer_remote.sh /home/xingyaow/OpenHands/evaluation/evaluation_outputs/outputs/swe-bench-lite/CodeActAgent/valida
te-staging/output.jsonl 16
DATASET not specified, use default princeton-nlp/SWE-bench_Lite
SPLIT not specified, use default test
... Evaluating on /home/xingyaow/OpenHands/evaluation/evaluation_outputs/outputs/swe-bench-lite/CodeActAgent/validate-staging/output.jsonl ...
2024-10-13 05:04:38,283 - datasets - INFO - PyTorch version 2.2.2 available.
2024-10-13 05:04:39,042 - httpx - INFO - HTTP Request: GET https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json "HTTP/1.1 200 OK"
2024-10-13 05:04:41,673 - root - ERROR -   File "/home/xingyaow/OpenHands/evaluation/swe_bench/eval_infer.py", line 14, in <module>
    from evaluation.swe_bench.run_infer import get_instance_docker_image
  File "/home/xingyaow/OpenHands/evaluation/swe_bench/run_infer.py", line 11, in <module>
    import openhands.agenthub
  File "/home/xingyaow/OpenHands/openhands/agenthub/__init__.py", line 3, in <module>
    from openhands.agenthub.micro.agent import MicroAgent
  File "/home/xingyaow/OpenHands/openhands/agenthub/micro/agent.py", line 5, in <module>
    from openhands.controller.agent import Agent
  File "/home/xingyaow/OpenHands/openhands/controller/__init__.py", line 1, in <module>
    from openhands.controller.agent_controller import AgentController
  File "/home/xingyaow/OpenHands/openhands/controller/agent_controller.py", line 7, in <module>
    from openhands.controller.state.state import State, TrafficControlState
  File "/home/xingyaow/OpenHands/openhands/controller/state/state.py", line 15, in <module>
    from openhands.memory.history import ShortTermHistory
  File "/home/xingyaow/OpenHands/openhands/memory/__init__.py", line 3, in <module>                                                                                [68/646]
    from openhands.memory.memory import LongTermMemory
  File "/home/xingyaow/OpenHands/openhands/memory/memory.py", line 16, in <module>
    import chromadb
  File "/home/xingyaow/.cache/pypoetry/virtualenvs/openhands-ai-A46bY4LY-py3.12/lib/python3.12/site-packages/chromadb/__init__.py", line 6, in <module>
    from chromadb.auth.token_authn import TokenTransportHeader
  File "/home/xingyaow/.cache/pypoetry/virtualenvs/openhands-ai-A46bY4LY-py3.12/lib/python3.12/site-packages/chromadb/auth/token_authn/__init__.py", line 24, in <module>
    from chromadb.telemetry.opentelemetry import (
  File "/home/xingyaow/.cache/pypoetry/virtualenvs/openhands-ai-A46bY4LY-py3.12/lib/python3.12/site-packages/chromadb/telemetry/opentelemetry/__init__.py", line 12, in <module>
    from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter
  File "/home/xingyaow/.cache/pypoetry/virtualenvs/openhands-ai-A46bY4LY-py3.12/lib/python3.12/site-packages/opentelemetry/exporter/otlp/proto/grpc/trace_exporter/__init__.py", line 22, in <module>
    from opentelemetry.exporter.otlp.proto.grpc.exporter import (
  File "/home/xingyaow/.cache/pypoetry/virtualenvs/openhands-ai-A46bY4LY-py3.12/lib/python3.12/site-packages/opentelemetry/exporter/otlp/proto/grpc/exporter.py", line 39, in <module>
    from opentelemetry.proto.common.v1.common_pb2 import (
  File "/home/xingyaow/.cache/pypoetry/virtualenvs/openhands-ai-A46bY4LY-py3.12/lib/python3.12/site-packages/opentelemetry/proto/common/v1/common_pb2.py", line 36, in <module>
    _descriptor.FieldDescriptor(
  File "/home/xingyaow/.cache/pypoetry/virtualenvs/openhands-ai-A46bY4LY-py3.12/lib/python3.12/site-packages/google/protobuf/descriptor.py", line 621, in __new__
    _message.Message._CheckCalledFromGeneratedFile()

2024-10-13 05:04:41,673 - root - ERROR - <class 'TypeError'>: Descriptors cannot be created directly.
If this call came from a _pb2.py file, your generated code is out of date and must be regenerated with protoc >= 3.19.0.
If you cannot immediately regenerate your protos, some other possible workarounds are:
 1. Downgrade the protobuf package to 3.20.x or lower.
 2. Set PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python (but this will use pure-Python parsing and will be much slower).

More information: https://developers.google.com/protocol-buffers/docs/news/2022-05-06#python-updates

OpenHands Installation
Development workflow
OpenHands Version
PR https://github.com/All-Hands-AI/OpenHands/pull/4334 after merge from main
Operating System
Linux
Logs, Errors, Screenshots, and Additional Context
No response

Try adding these to pyproject.toml and then reinstall for downgrade:
opentelemetry-api = "1.25.0"
opentelemetry-exporter-otlp-proto-grpc = "1.25.0"

Thanks @diwu-sf ! https://github.com/chroma-core/chroma/issues/2571#issuecomment-2250328476 also suggest a similar thing - i can confirm it is working for me. Will put up a PR soon

cc @enyst  - maybe we should figure a way to enable memory tests in some capacity, which will likely caught this bug

I put up a PR for this a couple of days ago: https://github.com/All-Hands-AI/OpenHands/pull/4325

@xingyaoww This was also reported a few days ago by amanape in slack. Please see the links here:

#4325

The memory tests is a good point, maybe they would have caught this. An optional workflow might do, I'll try.
Although this is weird: as early as last week the human in the loop - yours truly - did notice the suspicious dependabot upgrade. But when I tried to test it on my local, I saw no bad results initially myself. 😅 I did not see this error.
Dependabot deserves suspicion on llama and chroma-related things!


abaplint: cloud syntax vs open-abap

check against cloud syntax
and against open-abap dependencies
next step would be transpiling and running unit tests on github actions

@mbtools

Hmmm I guess I missed a notification for this one


Manager Address is being retrieved from DAO URI and not the EIP 4824 smart contract

Q: can we retrieve the manager/admin address from the registration contract?

Q: can we retrieve the manager/admin address from the registration contract? Q: Is it better it to query it from the contract or by looking out for manager-change events?

A: It can't, but it is possible to identify whether the address is an admin or manager role.
A: Yes, its implementation relies on the SubGraph Indexer.