b2: Fallback to b2_hide_file when delete returns unauthorized

What is the purpose of this change? What does it change?
This allows using restic in an append-only mode with B2. The idea is this
would provide security in case the machine being backed up is compromised.
The attacker won't be able to just immediately delete all backups with the
API key on the machine.
To use this feature create an application key without the deleteFiles
capability. I also recommend restricting the key to just one bucket. For
example using the b2 command line tool:
b2 create-key --bucket <bucketName> <keyName> listBuckets,readFiles,writeFiles,listFiles

Before I go off documenting this change I would like some feedback on whether you guys would prefer the automatic fallback like in this PR or would rather have a command line config toggle?
Checklist

[x] I have read the Contribution Guidelines
[ ] I have added tests for all changes in this PR
[ ] I have added documentation for the changes (in the manual)
[ ] There's a new file in changelog/unreleased/ that describes the changes for our users (template here)
[x] I have run gofmt on the code in all commits
[x] All commit messages are formatted in the same style as the other commits in the repo
[ ] I'm done, this Pull Request is ready for review

Codecov Report

:exclamation: No coverage uploaded for pull request base (master@604b18a). Click here to learn what that means.
The diff coverage is 0%.

@@            Coverage Diff            @@
##             master    #2398   +/-   ##
=========================================
  Coverage          ?   46.53%
=========================================
  Files             ?      174
  Lines             ?    14491
  Branches          ?        0
=========================================
  Hits              ?     6744
  Misses            ?     6746
  Partials          ?     1001

Impacted Files
Coverage Δ

internal/backend/b2/b2.go
0% <0%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 604b18a...b644316. Read the comment docs.

Any chance I can get a review on this? @MichaelEischer @fd0 @rawtaz (sorry not sure who to ping)

FWIW https://github.com/restic/restic/compare/master...Medo42:b2-hide-option looks like a take on doing this via config instead of at runtime.
@MichaelEischer I'd really like to help push this forward, would you be able to help answer the question as to which direction is preferred?

I would argue in favour of this PR for the simple reason that it is simple.
While I understand the idea of separate keys for locks or config variables, this solution has some elegance:
It's not possible to create a key with write but without delete using the backblaze UI. You have to do so manually and intentionally using their api. Thus, if restic finds itself using such a key using this PR's change, I think it's very sensible for it to fall back on hide? I'm not sure the user would ever expect anything different?

Related: https://github.com/restic/restic/issues/2134

+1 for automatic fallback to hide, with a notice logged. Best that people's backups err on the side of working :-)
Also, I have created immutable buckets through the web UI, I'm not sure if it implementsb through the same underlying mechanism, but it's an option only in the creation form and in manifests the same errors

I'm not sure if it implements through the same underlying mechanism, but it's an option only in the creation form and it manifests the sa

You mean the new "Object lock" feature? I'm not sure that works the same as restricting the application key TBH but as long as the key you create can't clear the object lock I suspect it might just work out.

If we can get this merged, then restic will have ransomware protection on b2, which would be pretty cool!  I've been hopefully watching restic/b2 ransomware protection support for a few years and would love to see some progress on this front to make it finally happen :)
With that in mind, it would be great to come to a decision and either merge this PR or #2887.
My personal vote would be for this PR.  It is simpler to set up for the user, and old versions of lock files should not be too large (and can eventually be permanently deleted automatically with the b2 lifecycle rule).
In future, it would be good to have a way to restore from old versions (ie, use bucket's file versions as they existed at datetime), along with adding to the docs what minimal b2 permissions are required -- but neither of those would block this PR.

My personal vote would be for this PR. It is simpler to set up for the user, and old versions of lock files should not be too large (and can eventually be permanently deleted automatically with the b2 lifecycle rule).

I agree, based on the lifecycle rules screenshot posted in https://github.com/restic/restic/issues/2134#issuecomment-1066171529, it looks like this PR would be the more user friendly solution.
I'm a bit undecided on whether it is a good idea to silently fall back to just hiding files or whether we should add an option that specifies whether delete/hide is used. When using hide, then users have to setup the key permissions and lifecycle rules accordingly anyways, so it would also be possible to pass an additional option to restic. On the other hand, not having to pass an option would be more convenient.
So the question is whether there are downsides when automatically falling back to hiding. In that variant, restic will at least send one delete request that will fail and have to be repeated, but that wouldn't be much of a problem. It would also be easier to accidentally not delete data but just hide it. However, I can't really say much about how likely that is to happen or not.

I am pro additional parameter.  Here's my thinking:

how likely that is to happen or not.

In practice, it seems very unlikely someone will wind up using an API key without delete files permission accidentally.  (At least currently) the B2 admin panel does not make it easy to create an application key without delete permission.  This is what we have now:

If you want to set up a key without the delete file permission, the only way to do it is via the API (AFAIK).  Thus, a user has to be really commited to setting things up this way.  They're not likely to accidentally have this permission disabled but actually want files to be deleteable.  However, it's always possible this UI may change in future.
It does seem more likely that the user may forget to configure their lifecycle rules to auto-delete old files, though.

whether there are downsides when automatically falling back to hiding

For lock files, the damage done is pretty minimal -- just a trivial amount of space.
For running a forget, that could potentially be more expensive if the user has not configured lifecycle rules.  IMO that situation would be worth having a parameter for to ensure the user has configured their bucket correctly.
So I'm not sure about halting for normal operations without a parameter (other than for consistency maybe), but for forget in particular, that one may need some special warning since the user is trying to free up space.  Something like:
The provided API key does not have permission to delete files.  Restic can hide files instead of deleting by using the -whatever parameter, however, this will not free up space.  Before enabling this parameter, you may wish to ensure you have configured b2 lifecycle rules to delete hidden versions of files after a set time.

I am pro additional parameter. Here's my thinking:

I agree. Let's just add an addiitonal parameter that tells the B2 backend to hide files when set. The PR also needs a changelog entry

I've rebuilt the PR to provide a backend option to hide files. The option is currently called -o b2.hide-files=true, although we could rename it to something else. I wonder whether some other name might be easier to understand, maybe soft-delete? However, as the B2 documentation speaks of hiding files, that might be the easiest to understand variant.
Btw, using the S3 backend of B2 it is also possible to achieve the same results. For S3 the default is to just hide files.
Can someone test whether a key created using b2 create-key --bucket <bucketName> <keyName> listBuckets,readFiles,writeFiles,listFiles works or whether we need additonal permissions?

I've rebuilt the PR to provide a backend option to hide files.

Sweet, thanks!

The option is currently called -o b2.hide-files=true, although we could rename it to something else. I wonder whether some other name might be easier to understand, maybe soft-delete? However, as the B2 documentation speaks of hiding files, that might be the easiest to understand variant.

I would advocate to being consistent with the b2 terminology, since a b2 user can look up what 'hidden file' means in b2 and realize they should check their lifecycle rules to ensure hidden files are auto deleted.  Creating a new term might not be easily searchable.

Btw, using the S3 backend of B2 it is also possible to achieve the same results. For S3 the default is to just hide files.

Interesting; this would be a useful info point to go into documentation for setting all this up.

Can someone test whether a key created using b2 create-key --bucket <bucketName> <keyName> listBuckets,readFiles,writeFiles,listFiles works or whether we need additonal permissions?

I tested this today (console output).  Highlights:

Yes, the above key generation command will generate a key with working permissions
Init throws a 404 error, but seems to init just fine (b2_download_file_by_name: 404: : b2.b2err)
Tested backing up, forgetting, and restoring -- all worked OK when using the hide option with limited permission key
When called without the hide option, it retries on a 401 unauth error, which is kinda weird to retry on, but no big deal
One weird thing (bug?) is that calling backup does not clean up the lock afterwards?  IE, I can still see the locks folder & file in not-hidden state via the web interface after running a backup, and until unlock is manually called. Multiple backups can be called in a row, but can't seem to call backup > forget.  Instead unlock has to be manually called (backup > unlock > forget).
After messing around with this a bit, I realized this is the kind of parameter that would be good to have a way to store in session memory (ie, an environment variable like password, etc.)  Since otherwise it's quite easy to forget to pass every time, and is a thing that remains consistent with the session.  That said, that could just be an area for future enhancement rather holding up this PR.

Thanks for testing!

Init throws a 404 error, but seems to init just fine (b2_download_file_by_name: 404: : b2.b2err)

That #3750, the "error" is essentially saying that no repository exists right now.

When called without the hide option, it retries on a 401 unauth error, which is kinda weird to retry on, but no big deal

That error is returned by B2: "The auth token used is valid, but does not authorize this call with these parameters."

One weird thing (bug?) is that calling backup does not clean up the lock afterwards?

backup also must be called with the b2.hide-files option set. Otherwise it won't be able to delete it's lock file. In general it is always necessary to specify that option, when using a restricted application key. For now the easiest way is to use a small wrapper script which always adds the necessary parameter (or create an alias).

Btw, using the S3 backend of B2 it is also possible to achieve the same results. For S3 the default is to just hide files.

Interesting; this would be a useful info point to go into documentation for setting all this up.

Right now we don't have a place which documents setting up append-only repositories. The part that using the S3-backend of B2 only hides files, is already subtly mentioned in https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#backblaze-b2 .

Thanks -- and yep, that makes sense now!  Quite excited to be able to use this feature :)

The changelog now says that the parameter is always necessary.

I've fixed a few typos in the changelog and changed it to use the correct option name.

After talking with @rawtaz and the unintuitive behavior regarding the lock files, I've switched the approach back to automatically falling back to hiding files if not authorized to delete them.
The main change to the previous implementation, besides making the code work with latest changes to the B2 backend, is that the fallback now works silently and does not cause restic to print a warning that the remove operation had to be retried.

Just wondering if using B2 via rclone would instead provide the "hide" rather than delete. Or does the restic interface do hard deletes too?
(Sorry, not in a position to test empirically)

rclone itself hides files by default on B2. It is just that restic passes the --b2-hard-delete to rclone by default (but that can be changed).
Could someone test the current PR version which automatically falls back to hiding files if deleting is not possible?

I gave it a quick test and it seems to be working well.  Definitely a lot easier to use now that we don't need to remember to pass the parameter.  :+1:

console output log of test

rclone itself hides files by default on B2. It is just that restic passes the --b2-hard-delete to rclone by default (but that can be changed).
Could someone test the current PR version which automatically falls back to hiding files if deleting is not possible?

Hmm, does this mean once this lands an append-only rclone server can now use a key without the deleteFiles permission?

append-only mode rclone + b2 no-deleteFile should work already. How can I disable the --b2-hard-delete flag being passed?

call restic like this: restic -o rclone.args="serve restic --stdio" [...].

Is this for calling restic on the backup client side, or in place of rclone serve restic? My rclone host sits on another server.

Is this for calling restic on the backup client side, or in place of rclone serve restic? My rclone host sits on another server.

That example is for the case when restic starts rclone itself. If rclone already runs at some other server, then just omit the --b2-hard-delete flag there?

But I thought you said the --b2-hard-delete flag was passed in by default?

But I thought you said the --b2-hard-delete flag was passed in by default?

??? When using the rclone backend, then restic concatenates the rclone.program (default rclone) and rclone.args (default serve restic --stdio --b2-hard-delete) and runs that command. In that case you can use the -o rclone.args="serve restic --stdio" from above to get rid of the --b2-hard-delete option.
If rclone runs on a different host than restic, then you're either connecting to it using the rest backend (rclone was started using rclone serve restic --addr :8080, that command line doesn't contain the --b2-hard-delete flag) or you have a setup similar to https://ruderich.org/simon/notes/append-only-backups-with-restic-and-rclone . In the latter case just make sure that the forced ssh-command doesn't contain the --b2-hard-delete parameter. Or when not using forced commands, then just set the already mentioned rclone.args.
Which of these variants matches your setup?

I have a setup similar to the latter! So in that case, it's not being passed in by default...!


add test case for ServerStatusChecker

What is the purpose of the change
add test case for ServerStatusChecker
see more detail from #7888
Brief changelog
Verifying this change

Checklist

[x] Make sure there is a GitHub_issue field for the change (usually before you start working on it). Trivial changes like typos do not require a GitHub issue. Your pull request should address just this issue, without pulling in other changes - one PR resolves one issue.
[ ] Each commit in the pull request should have a meaningful subject line and body.
[ ] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
[ ] Check if is necessary to patch to Dubbo 3 if you are work on Dubbo 2.7
[ ] Write necessary unit-test to verify your logic correction, more mock a little better when cross module dependency exist. If the new feature or significant change is committed, please remember to add sample in dubbo samples project.
[ ] Add some description to dubbo-website project if you are requesting to add a feature.
[ ] GitHub Actions works fine on your own branch.
[ ] If this contribution is large, please follow the Software Donation Guide.

Codecov Report

Merging #7889 (c76d93d) into master (028153a) will increase coverage by 0.53%.
The diff coverage is 81.81%.

@@             Coverage Diff              @@
##             master    #7889      +/-   ##
============================================
+ Coverage     59.46%   60.00%   +0.53%
+ Complexity      555      545      -10
============================================
  Files          1086     1089       +3
  Lines         43844    43807      -37
  Branches       6399     6371      -28
============================================
+ Hits          26074    26287     +213
+ Misses        14885    14568     -317
- Partials       2885     2952      +67

Impacted Files
Coverage Δ

...n/java/org/apache/dubbo/common/utils/NetUtils.java
68.21% <81.81%> (+1.65%)
:arrow_up:

...a/org/apache/dubbo/rpc/filter/AccessLogFilter.java
28.35% <0.00%> (-50.75%)
:arrow_down:

...va/org/apache/dubbo/rpc/support/AccessLogData.java
53.16% <0.00%> (-37.98%)
:arrow_down:

...ng/transport/dispatcher/all/AllChannelHandler.java
62.06% <0.00%> (-20.69%)
:arrow_down:

...rg/apache/dubbo/remoting/utils/PayloadDropper.java
76.92% <0.00%> (-15.39%)
:arrow_down:

...ng/transport/dispatcher/WrappedChannelHandler.java
43.47% <0.00%> (-15.22%)
:arrow_down:

...dubbo/common/status/support/LoadStatusChecker.java
50.00% <0.00%> (-11.54%)
:arrow_down:

...in/java/org/apache/dubbo/common/utils/JVMUtil.java
81.13% <0.00%> (-11.33%)
:arrow_down:

...che/dubbo/remoting/transport/mina/MinaChannel.java
35.52% <0.00%> (-10.53%)
:arrow_down:

...g/apache/dubbo/remoting/p2p/support/FileGroup.java
41.50% <0.00%> (-9.44%)
:arrow_down:

... and 76 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 028153a...c76d93d. Read the comment docs.


Add rendering for facets

We can already render faces, though we have this feature disabled for now, as the lighting makes it look very bad. Rendering higher elements (like Stella4D does, for instance) would be quite hard, so I'd rather put it off for the near future.


added the multichannelio.py object to neo/io

This new object should implement the capability of reading *.mcd files (files generated with the recording system from multichannel systems company). It was developed with numpy 1.8.1, quantities 0.10.1, and the neuroshare headers (0.9) for python that can be found at pythonhosted.org/neuroshare.
Currently this reads analog data, spike waveforms, and trigger events (without duration).
A file to test this code can be found here: https://www.dropbox.com/s/0a3m4dhbvtwr387/wn25_a2_amp14_100.mcd
Since it uses the neuroshare headers, this could in principle be used to open other file types than just *.mcd.
Issue: the GUI part of the code is commented out, since I didn't know how it worked, but uncommenting it should not interfere with the code.
written by Andre Maia Chagas
Contact<EMAIL_ADDRESS>

Coverage decreased (-1.32%) to 62.78% when pulling 6dd778725f4dfcae88fc752cd0f3deec16bd9d99 on amchagas:master into b393aa5847ea79be3fad879abc08b68b547655d6 on NeuralEnsemble:master.

After merging PR #185 the Travis build passes. @rproepp and @samuelgarcia - is this ok to merge now?

OK for me.

Coverage increased (+35.9%) to 100.0% when pulling 6dd778725f4dfcae88fc752cd0f3deec16bd9d99 on amchagas:master into b393aa5847ea79be3fad879abc08b68b547655d6 on NeuralEnsemble:master.


add test result status to compliance page

@cjol I tried to add the same into the confirmation box but was having some difficulties, maybe there's a better way to do that you can suggest?


[RFC] Global Loop

This is an alternative to #10 introducing a global loop on top of the current API and being backward compatible.
It adds a new API via functions on top of the current API for accessing the methods of the global loop (except run() and stop).
React\EventLoop\futureTick(function() {
});

This allows components to also introduce their own functions on top of their existing API using the global loop.
namespace React\Dns;

use React\EventLoop;

function resolver($nameserver)
{
    $factory = new React\Dns\Resolver\Factory();
    return $factory->create($nameserver, EventLoop\GlobalLoop::get());
}

By default, the driver is created by Factory::create(). This can be overridden by setting a custom factory using GlobalLoop::setFactory() which expects a simple callable returning a LoopInterface.
The global loop is run automatically in a shutdown function, so no need to call run() manually. This behaviour can be disabled by calling GlobalLoop::disableRunOnShutdown().
This is a RFC, so share your thoughts and comments :)

Consider running the shutdown function only if the loop has not yet been run. Otherwise, if the loop has been explicitly stopped, there may be events and timers that would resume on exit.
    public static function get()
    {
        if (self::$loop) {
            return self::$loop;
        }

        register_shutdown_function(function () {
            if (self::$disableRunOnShutdown || !self::$loop) {
                return;
            }

            self::$loop->run();
        });

        self::$loop = self::create();

        // disable auto-start if the loop gets run elsewhere
        self::$loop->futureTick(function () {
            self::$disableRunOnShutdown = true;
        });

        return self::$loop;
    }

@mbonneau When do you think a global loop should be stopped? In tests, you probably want to call disableRunOnShutdown() in the test bootstrap file to fully control the loop in the test methods.

@jsor I would suggest that the following code is not intuitive:
<?php

use React\EventLoop\Timer\Timer;

require __DIR__ . '/vendor/autoload.php';

$loop = React\EventLoop\GlobalLoop::get();

$timer = $loop->addTimer(1, function (Timer $timer) {
    $timer->getLoop()->stop();
});

$periodicTimer = $loop->addPeriodicTimer(0.25, function (Timer $timer) {
    echo "Doing something periodically.\n";
});

$loop->run();

Whether this is correct use of the event loop is debatable.

@mbonneau What is $timer->getLoop()->stop(); supposed to do here? Cancelling the periodic timer? If yes, the code should look like:
require __DIR__ . '/vendor/autoload.php';

$periodicTimer = React\EventLoop\addPeriodicTimer(0.25, function () {
    echo "Doing something periodically.\n";
});

React\EventLoop\addTimer(1, function () use ($periodicTimer) {
    $periodicTimer->cancel();
});

Maybe, React\EventLoop\run() and React\EventLoop\stop() should be removed so it's clearer that messing around with the global loop is dicouraged.
If you need to control the global loop, eg. in tests, you sould call disableRunOnShutdown()in your bootstrap script and use GlobalLoop::get()->run() / GlobalLoop::get()->stop() explicitely.

Just discovered reactphp/react#330 again. This is basically the same i'm proposing here and this PR would be the foundation for implementing a functional API.

I'm curious about the decision to use functions here instead of static methods on the Loop class; what's the thinking behind not putting that functionality within GlobalLoop as methods? The functionality in those functions is very much dependent on the state of GlobalLoop.

@joshdifabio Apart from React\EventLoop\addTimer() being nicer than React\EventLoop\GlobalLoop::addTimer(), it should make the distinction between the API for application and infrastructure/library code.
The functional API targets applications.
React\EventLoop\futureTick(function() {
});

React\Dns\resolve('reactphp.org')->then(function($ip) {
});

The GlobalLoop API targets infrastructure code/libraries.
// bootstrap file
React\EventLoop\GlobalLoop::setFactory($factory);

namespace React\Dns;

function resolve($name)
{
    $factory = new React\Dns\Resolver\Factory();
    return $factory->create('<IP_ADDRESS>', React\EventLoop\GlobalLoop::get())->resolve($name);
}

@jsor I don't agree with the rationale behind using functions, but I appreciate the time taken to explain. Thanks.
How do you guys see this interoperating with the interop standard?

@joshdifabio

@jsor I don't agree with the rationale behind using functions, but I appreciate the time taken to explain. Thanks.

Since this is a RFC, i'm really interested in your thoughts/comments on this regarding a better API.

How do you guys see this interoperating with the interop standard?

Something like this probably:
React\EventLoop\GlobalLoop::setFactory(function() {
    return new WyriHaximus\React\AsyncInteropLoop\AsyncInteropLoop();
});

If you really make the change and use a global accessor, why not directly support async-interop? I can see that it makes no sense to support async-interop when you don't have a global accessor, but why have your own?
I can also only strongly advise against running an entire application in a shutdown function. Any exit will directly exit the whole application instead of running other shutdown hooks as expected.

Apart from React\EventLoop\addTimer() being nicer than React\EventLoop\GlobalLoop::addTimer(), it should make the distinction between the API for application and infrastructure/library code.

Why should libraries use the API differently than application code?

Note, that the property is marked @internal, so it should be pretty clear the messing around with it isn't a good idea ;)

@jsor It's marked as internal, but is basically required by all test suites to fiddle around with? Doesn't seem like a good API decision then.

In our components, the loop instance gets injected. They do not use the global loop directly and thus do not depend on the global loop in tests. Only the thin functional layer on top, which basically just does some wiring, accesses the gobal loop.

I've filed #82 as a simplified alternative.

Closing this as it has been resolved through #226 and follow up PR's


MultiCueObstacleTransformer::SetObjMapperOptions

what is the orientation of camera cordinate, x axis to right or front?
theta_ray = static_cast(atan2(point_in_camera.x(), point_in_camera.z()));
Is it should be " theta_ray = static_cast(atan2(point_in_camera.z(), point_in_camera.x())); " ?

The z is heading, x is right and y is the vertical direction. You can ref to link

@daohu527   So theat_ray is the angle between vehicle orientation and x ( or z ?) axis, means atan2(z, x) ? That's what I feel strange.

@daohu527 I am convinced that there is an error here. The function atan2 takes the values of the first - "Y" (camera coordinate Z) and the second - "X" (camera coordinate X) coordinates. So it should be "theta_ray = static_cast(atan2(point_in_camera.z(), point_in_camera.x()));". Orientation determination works better with these changes.


5.1 Feedback:  Devices > Robot Detail> Magnetic module Set engage height button becomes clickable

Overview
On a robot detail page when you click the magnetic module overflow menu > set engage height and you put in an integer value (in or out of acceptable range) then delete it, the "Set Engage Height" button becomes active and you may click it.

seems to be happening on similar slideouts like Temperature Module > Set module temperature

Current Behavior
"Set Engage Height" button is clickable when the engage height value field is empty
Expected Behavior
"Set Engage Height" button is only clickable when the engage height value is present and in range.
Operating system
Mac

confirm this is not a problem in edge as it should have been fixed by previous work by @sakibh

confirmed that this is fixed in edge


cert-manager with ingress template on default enforced https

Is there an existing issue for this?

[x] I have searched the existing issues

Version
equal or higher than v1.16.0 and lower than v1.17.0
What happened?
With Cilium 1.16.1 with Cert Manager 1.15.x I added Cluster Issuer that would apply an annotation on resolver ingress template with ingress.cilium.io/force-https: disabled
How can we reproduce the issue?
Install Cilium
Enable Ingress Controller
Setup Cert Manager with ClusterIssuer
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    solvers:
      - http01:
          ingress:
            ingressClassName: cilium
            ingressTemplate:
              metadata:
                annotations:
                  ingress.cilium.io/force-https: disabled

Cilium Version
1.16.1
Kernel Version
5.14
Kubernetes Version
1.30.4
Regression
No response
Sysdump
cilium sysdump
Error: unknown command "sysdump" for "cilium-dbg"
Run 'cilium-dbg --help' for usage.
unknown command "sysdump" for "cilium-dbg"
Relevant log output
No root ingress
$ curl -v -o- http://hostname.local/.well-known/acme-challenge/GwuRA1lujBcuyJDn4_nkBPhfOXoVacx7TfoaAJtNXQ4

Trying X.Y.Z.A:80...
Connected to hostname.local (X.Y.Z.A) port 80 (#0)

GET /.well-known/acme-challenge/GwuRA1lujBcuyJDn4_nkBPhfOXoVacx7TfoaAJtNXQ4 HTTP/1.1
Host: hostname.local
User-Agent: curl/7.76.1
Accept: /

Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< location: https://hostname.local/.well-known/acme-challenge/GwuRA1lujBcuyJDn4_nkBPhfOXoVacx7TfoaAJtNXQ4
< date: Thu, 10 Oct 2024 15:02:37 GMT
< server: envoy
< content-length: 0
<
Connection #0 to host hostname.local left intact

Root ingress with ingress.cilium.io/force-https: disabled
$ curl -v -o- http://hostname.local/.well-known/acme-challenge/GwuRA1lujBcuyJDn4_nkBPhfOXoVacx7TfoaAJtNXQ4

Trying X.Y.Z.A:80...
Connected to hostname.local (X.Y.Z.A) port 80 (#0)

GET /.well-known/acme-challenge/GwuRA1lujBcuyJDn4_nkBPhfOXoVacx7TfoaAJtNXQ4 HTTP/1.1
Host: hostname.local
User-Agent: curl/7.76.1
Accept: /

Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< cache-control: no-cache, no-store, must-revalidate
< date: Thu, 10 Oct 2024 15:02:41 GMT
< content-length: 87
< content-type: text/plain; charset=utf-8
< x-envoy-upstream-service-time: 1
< server: envoy
<
Connection #0 to host hostname.local left intact
GwuRA1lujBcuyJDn4_nkBPhfOXoVacx7TfoaAYtNXQ4.HJJ93uakKtthoKULHdbtgjlOENjr0rbor1MINt6_3zE

Anything else?
My observation is that annotation works only on the ingress with / path
Cilium Users Document

[x] Are you a user of Cilium? Please add yourself to the Users doc

Code of Conduct

[x] I agree to follow this project's Code of Conduct

This seems related to the Ingress configuration as documented here: https://docs.cilium.io/en/stable/network/servicemesh/ingress/#supported-ingress-annotations (see force-https). Have you tried using the ingressController.enforceHttps helm setting?

@snovak7 gotcha. Just to pare this down to the simplest case, can you give some example Ingress resources that demonstrate the issue?

@squeed it's really simple
On a fresh cluster with Cert Manager installed (hopefully have ingress controller setup) where Let's Encrypt can reach your ingress with default ingress controller setting enforceHttps set to true (as per default).
Now register an ingress to a simple application and http should force to https, and fail with connection reset, as there is no certificate present, of course this domain will fail with Let's Encrypt and will be in pending state.
now adding to the (Cluster)Issuer:
ingressTemplate:
  metadata:
    annotations:
      ingress.cilium.io/force-https: disabled

this would build similar to example from cilium docs page with added annotation, and only /subpath prefix (without root)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: basic-ingress
  namespace: default
  annotations:
    ingress.cilium.io/force-https: disabled
spec:
  ingressClassName: cilium
  rules:
  - http:
      paths:
      - backend:
          service:
            name: details
            port:
              number: 9080
        path: /details
        pathType: Prefix

you would expect that the PathPrefix would allowed to be accessed by http solver by non-secure port, but you're redirected to the https hostname ignoring the annotation.

Maybe if I complicate it a bit further with example of 2 ingresses that share the hostname:

the actual website/service, which we want to force to use only secure traffic
Ingress that wants to challenge cert manager with letsencrypt where we don't want to force the https for the  reason of a challenge

Ah right (my cert-manager knowledge is a bit rusty). So, CertManager creates a second Ingress with the same hostname (and, obviously, without the force-https annotation). However, it seems that this collides with the force-https, which thus applies per-hostname, not per-Ingress.
One possible work-around would be to set acme.cert-manager.io/http01-edit-in-place: "true" on the Ingress resource, which will provision a temporary self-signed certificate used for initial verification. Not perfect, but it should work.
I don't know enough about the Ingress / GatewayAPI architecture to say whether or not this can be fixed in code or in docs, but at least I understand it now. I'll ask the ingress people for the most reasonable approach.


Lens App Does Not Correctly Decode Secrets

Describe the bug
The lens app does not properly decode secrets. It should be using JSON Path instead of just the base64 -d command against the secret.
To Reproduce
Steps to reproduce the behavior:

Go to secrets
look at the secrets

Expected behavior
Lens should properly decode the secrets, so that if someone wants to re-use the secret they are not copying over extra zeroes and slashes. It cost me two days for an analysis, and I had to basically write a bash script to filter and parse all secrets in a cluster because someone used your application to make another secret that locked out a service account on Artifactory!
Screenshots
NA
Environment (please complete the following information):

Lens Version: ANY
OS: ANY
Installation method (e.g. snap or AppImage in Linux): ALL YOUR IMAGES DO THIS

Logs:
NA
Kubeconfig:
Quite often the problems are caused by malformed kubeconfig which the application tries to load. Please share your kubeconfig, remember to remove any secret and sensitive information.
THIS HAS NOTHING TO DO WITH A KUBECONFIG BUT INSTEAD IS THE WAY IN WHICH THE LOGIC OF THE APPLICATION IS WRITTEN

Additional context
Fix the decoding process to use JSONPATH to get the actual secret instead of just decoding them with base64 or the library.

Hello Richard-Barrett,
Thank you for reaching out to Lens support!
Thank you for reporting a bug.
We are working on your issue. Stand by for further updates.
Best Regards,
Tikhon Kudinov
Lens Support Engineer
Mirantis, Inc


adding option for s3-proxy

could you update the package version too: https://github.com/moj-analytical-services/deploy.json/blob/master/package.json#L3 (not actually used for anything except consistency)


Implementation swiper slider in bootstrap tabs, resizeFix, reInit()

I am beginner front-end developer. I have little problem with sliders in tabs. My sliders work but while i switch to second slider I can't see it. slider lost width and height If I resize site by responsive tools of firefox slider generates width and height. I used resizeFix()' and 'reInit()' but doesn't work
Could you help me http://stackoverflow.com/questions/24142330/resizefix-reinit-sliders

Thankyou very much you saved my life ^__^
May happiness be with you always! :)


Using buttons in cards creates overlay issue on mobile/smaller viewports

Summary of the bug
Interactive card on the card guidance page causes overlay issues similar to the one in linked ticket #294
🪜 How to reproduce

Go to page: Card Component - Guidance
Look at: The top example of a card component with image and interactions
Do: Reduce screen size or use mobile to see the card overlay.

🧐 Expected behaviour
The buttons should collapse/shrink to compensate for the smaller viewport.
Navigate to card code examples with images etc to see how the card should react.
📸 Screenshots or code
Broken overlay

Correct overlay

🖥 Desktop

Browser:  chrome
Browser version:  22
Website version:  V2

Additional info
Linked ticket #294

Note: This is a bug when the width is below 320px.

Issue is dependent on button label size. Need to design solution to address the issue of the container width of buttons being larger than viewport, minus internal passing of cards. Moving back to Design To-Do.


capi_return is NULL , numpy.linalg.LinAlgError: Singular matrix

Hello, its a nice project you are doing, thank you for sharing it with community.
When i'm using the Trajectory generation and control example on the README file everything is fine, but when i want to use RRT waypoints as input i get this error:
capi_return is NULL
Call-back cb_calcfc_in__cobyla__user__routines failed.
Traceback (most recent call last):
File "/home/ROS/Quadrotor-Simulation/runsim.py", line 56, in
traj = trajGenerator(waypoints,max_vel = 10,gamma = 1000000)
File "/home/ROS/Quadrotor-Simulation/TrajGen/trajGen.py", line 16, in init
self.optimize()
File "/home/ROS/Quadrotor-Simulation/TrajGen/trajGen.py", line 28, in optimize
T = optimize.minimize(self.get_cost,Tmin, method="COBYLA",constraints= ({'type': 'ineq', 'fun': lambda T: T-Tmin}))['x']
File "/home/ROS/.local/lib/python3.6/site-packages/scipy/optimize/_minimize.py", line 623, in minimize
return _minimize_cobyla(fun, x0, args, constraints, **options)
File "/home/ROS/.local/lib/python3.6/site-packages/scipy/optimize/cobyla.py", line 34, in wrapper
return func(*args, **kwargs)
File "/home/ROS/.local/lib/python3.6/site-packages/scipy/optimize/cobyla.py", line 262, in _minimize_cobyla
dinfo=info)
File "/home/ROS/.local/lib/python3.6/site-packages/scipy/optimize/cobyla.py", line 252, in calcfc
f = fun(x, *args)
File "/home/ROS/Quadrotor-Simulation/TrajGen/trajGen.py", line 21, in get_cost
coeffs,cost = self.MinimizeSnap(T)
File "/home/ROS/Quadrotor-Simulation/TrajGen/trajGen.py", line 40, in MinimizeSnap
invA = LA.inv(A)
File "<array_function internals>", line 6, in inv
File "/home/ROS/.local/lib/python3.6/site-packages/numpy/linalg/linalg.py", line 546, in inv
ainv = _umath_linalg.inv(a, signature=signature, extobj=extobj)
File "/home/ROS/.local/lib/python3.6/site-packages/numpy/linalg/linalg.py", line 88, in _raise_linalgerror_singular
raise LinAlgError("Singular matrix")
numpy.linalg.LinAlgError: Singular matrix
I'm using numpy-1.19.5 and scipy-1.5.4
Thanks in advanced.

Hi, sorry for late reply.
I have updated the readme and runsim.py files.
If any two consecutive waypoints have the same (x,y,z) coordinates, you will get this  "Singular matrix"  error.
And also my scipy version is 1.1.0,  If that made any difference.
Hope this helps.
Feel free to contribute to any part of the code.

There was a typo in rrt.py file. I fixed it.
I will close this issue if you confirm that it's working.

Hi, Thank you for your reply.
I noticed the "singular matrix" error was happening cause of duplicate waypoint in the end of "waypoints" array after RRTStar, so i just used:
waypoints = np.delete(waypoints,(np.shape(waypoints)[0]-1), axis=0)
before "trajGenerator" in "runsim.py" for removing the last item in the array and it worked.
Then i saw your reply and clone your project again,i didn't check what you did but it also works perfectly with your changes.
Thanks again.


addRecipient incorrectly formats CONTACT_LISTS in XML request

Cannot add a recipient specifying the contactLists option because the child items of CONTACT_LISTS is malformed. Currently being added as an array index, not CONTACT_LIST_ID.
Can be fixed by adding the following to add-recipient.js
if (typeof options.contactLists !== 'undefined') {
    subnode = [];
    for (key in options.contactLists) {
        subnode.push({
            CONTACT_LIST_ID: options.contactLists[key]
        });
    }
    params["CONTACT_LISTS"] = subnode;
}

I have a branch I can push with a fix, but require permissions.

Pull request #20 open

The pull request has been merged and version 0.1.8 has been published.
Closing issue.


implementing adding user to group

@nirajacharya2  please rebase this so it "sees" the current master license.


merge from arlac77/npm-package-template-esm-only

.travis.yml

chore(travis): remove node versions 12.6.0
chore(travis): add node versions -10,-11,-12,12.7.0

Codecov Report

Merging #67 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master      #67   +/-   ##
=======================================
  Coverage   93.13%   93.13%
=======================================
  Files           6        6
  Lines         233      233
  Branches       40       36    -4
=======================================
  Hits          217      217
  Misses         16       16

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8a237eb...629bceb. Read the comment docs.

:tada: This PR is included in version 1.1.1 :tada:
The release is available on:

npm package (@latest dist-tag)
GitHub release

Your semantic-release bot :package::rocket:


ExecutorMode: Passthrough - is it still working as intended? If so, should it be kept?

Based on exploration, it appears that the addition of go routines & parallel execution changed the role of the executor config ExecutorMode. At this point, the setting only impacts whether the result root level IsSuccess is overwritten and set true or left set by executor.PolicyEnforcer.OverallVerifyResult().
The original intent of this setting was to allow Ratify to not take on the responsibility of making the final call on the suitability of the subject.  It also places the responsibility on the customer (which is good) and enables nuanced policy to be enforced without complicating Ratify. The implementation (pre: go routines) gave the setting a more impactful role as it forced all artifacts to be verified and did not allow short-circuiting the loop if/when validation failed or an exception was thrown.
Is it the desire/intent for executor mode passthrough to only impact the setting of the value of the result's root level IsSuccess?
- If yes, what value does it actually add to always return true? The end user should be trusted to determine whether Ratify saying it was successful or not is enough validation needed. Assuming what the Ratify policy does / doesn't do is comprehensible and widely understood. If it isn't clear what the criteria used by the Ratify policy provider is, then wouldn't it make more sense to fallback to false and force the constraint writer to use the specific verification results instead of trusting Ratify's decision?
- If not, it may be worth revisiting what the desired behavior is & ensuring that is reflected in the code.

@noelbundick-msft @joshuaphelpsms @mluker @rasavant-ms @mattklup
Please add/update as appropriate.

@susanshi  & @akashsinghal: opened for discussion as requested.
// @etrexel

Thanks for sharing the findings @cmaclaughlin . Given passthrough mode doesn't not change validation behavior, I agree it should be removed, the caller of Ratify can decide how to evaluate ratify Report. @etrexel do you have any concerns? we should also double check with internal partners.


update flask sqlalchemy

setup: increase flask-sqlalchemy version
fix: tests LocalProxy
change: remove click 3 compatibility
change: add proxy file

NOTE: the bugfix has to be discussed before merging!
if we use the change then following two lines have to be updated:
invenio_oauth2server.utils
invenio_oauthclient.utils

@ntarocco How should we proceed with this?

@ntarocco How should we proceed with this?
The change of the signature of the rebuild_encrypted_properties function is backward compatible but it may be necessary to update the two usages in invenio-oauth2server and invenio-oauthclient
It looks like that there are tests there, so we can run the tests and see if they pass. If there is a change in the future, the tests should not pass.

Coordination:
This looks like it can be merged: tests are passing and maintainer has approved. I don't know that another outside reviewer could review this well.
If @ntarocco wants to merge, go ahead.

@fenekku thanks, we are still chatting offline on these changes. I would also test these changes before merging. Almost ready :)


How to avoid the entire request being logged every time using pino?

I am new to nodejs and decided to use the pino logger in my application. Here is the code snippet showing how I am using it:
const expressPino = require('express-pino-logger');
const { LOGLEVEL } = require('../config.js');

// Constructs a Pino Instance
const logger = pino({
  level: LOGLEVEL || 'trace',
  prettyPrint: { levelFirst: true, colorize: true, ignore: 'pid' },
});
// Construct an express middleware using the above pino instance
const expressLogger = expressPino({ logger });

module.exports = { logger, expressLogger };

Now, every time I do req.log.debug(config['abc']), the entire request body gets logged, thus making the logs very cumbersome to read. I tried changing the log levels but that doesn't help.  Here is an example output:
DEBUG [1610445271782] (on blserver-org1): sku=FIN01  Query String     req: {       "id": 1,       "method": "POST",       "url": "/ifo_params?sku=FIN01",       "headers": {         "channel-name": "mychannel",         "content-type": "application/json",         "authorization": "Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjVmOTcxMmEwODczMTcyMGQ2NmZkNGEyYTU5MmU0ZGZjMmI1ZGU1OTUiLCJ0eXAiOiJKV1QifQ.eyJvcmdJZCI6ImJ1eWVyMiIsImFkbWluIjp0cnVlLCJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vbWFya2V0c24tZGV2IiwiYXVkIjoibWFya2V0c24tZGV2IiwiYXV0aF90aW1lIjoxNjEwNDQ0ODU5LCJ1c2VyX2lkIjoibzBWZWl4VnJmZFJqbEdWZXlNS1p4Q052TkZSMiIsInN1YiI6Im8wVmVpeFZyZmRSamxHVmV5TUtaeENOdk5GUjIiLCJpYXQiOjE2MTA0NDQ4NTksImV4cCI6MTYxMDQ0ODQ1OSwiZW1haWwiOiJidXllcjJfYWRtaW5AbWFpbGluYXRvci5jb20iLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnsiZW1haWwiOlsiYnV5ZXIyX2FkbWluQG1haWxpbmF0b3IuY29tIl19LCJzaWduX2luX3Byb3ZpZGVyIjoicGFzc3dvcmQifX0.QlHxLrxcfxUmGK_Q193RdQSIBsoHly66CZDTWdRdyfZNAn-wH13el41ILnAj3YqVWgAFJY8u4BcFgZYePCujIO2gKFsM0WUs2M-a7CsMcDaWpqrQyVsfalRoYMDsk1DJypaevuKV8O4IbmdkgCbS8HmYO-dk99LRcwwYKs_vVnNBO4bTv5FFzMLh-DXrVfVBKk23Qem7JN5lX9UU6RZ-4WAVN-pN-TR5uRuF2koWjCoa90CKNhYOzKW1zeN904f1rCeuY0a4R4faFYMNAlkxslBpVSKaXCkSBXOSCjVykp611Ay6EQBkrpqbD1zHvv6eEfaaMyOzjlH3DzDye-vfMQ",         "user-agent": "PostmanRuntime/7.26.8",         "accept": "*/*",         "cache-control": "no-cache",         "postman-token": "aab26357-78ff-4899-8509-7918ca9a65c4",         "host": "localhost:3000",         "accept-encoding": "gzip, deflate, br",         "connection": "keep-alive",         "content-length": "114"       }     }
Can someone please tell me how to tell pino to not log the entire request every time.

These can be easly done by passing your own serializers. Also, it might be a good change to pino-http.

These can be easly done by passing your own serializers. Also, it might be a good change to pino-http.

I've just run into this as well. It seems @types/pino-http indicate you can pass the redact option to pino-http, but this has no effect. Seemingly because pino doesn't support re-configuration?

I don't really understand how this relates to typescript. Note that @types/pino are not maintained by us.


Add anthropic.claude-3-5-sonnet-20241022-v2:0

This is the newest Sonnet model. See https://aws.amazon.com/blogs/aws/upgraded-claude-3-5-sonnet-from-anthropic-available-now-computer-use-public-beta-and-claude-3-5-haiku-coming-soon-in-amazon-bedrock/ for details.
Also, thanks a lot for this useful package!

Fixed by https://github.com/sblakey/llm-bedrock-anthropic/commit/268e4bb4e861b9df7a59c37cac0a8eaefc75d7c9


unicode normalization

Issue raised by @benc. May want to support unicode normalization for logical paths and object ids. For example, ṩ could be represented as \u1E69, \u0073\u0323\u0307, or \u0073\u0307\u0323. Without normalization, it would difficult to find an object or file that uses such a character without knowing the representation that was used.
For logical paths, strings could be normalized for comparison purposes only and written to the inventory in the same form as they were received.
Object ids would need to be normalized as part of the storage layout.
It's unclear how much of an issue this is. If a user consistently encodes their strings, they will not experience any issues.
https://www.unicode.org/reports/tr15/
https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/text/Normalizer.html

For now, ocfl-java is not going to unicode normalize strings. If users need normalization, it should be done before passing the strings to ocfl-java.


Is it allowed to update the EntropyBottleneck while training?

Thanks for your excellent work. I wonder if it is allowed to update the EntropyBottleneck while training. I still couldn't understand what "update" are doing.

update fills in the discretized CDFs. Those are not used during training. They are used during compress and decompress. Just be sure to call update(force=True) immediately before each test/infer epoch, e.g., https://github.com/InterDigitalInc/CompressAI-Trainer/blob/master/compressai_trainer/runners/base.py#L90-L92

Thank you for your reply.


Release new version

Hi, would it be possible to release a new version soon?
Specifically I'm looking forward to the fix from this commit, which throws errors in all unsupported browsers, and in iOS private browsing.
Thanks.

Hoy!
I won't have time today but I can do one tomorrow.

Thanks, would be great :+1:

+1, waiting on this bug fix too :)

+1, Me too

Done, bower and npm updated.
A bit late, for that I apologize.


Missing button state change

When state is set to schedule, button content should transition to "schedule"

🙈 I opened an issue for this one just now


refactor: drop lodash packages

Ref https://github.com/developit/dlv
Per function lodash.* packages are deprecated and gonna be removed.
Dlv is very small and popular alternative to lodash.at which fits
better to the use case. And looks like lodash.has is unused.
Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

[ ] Make sure to open an issue as a bug/issue before writing your code!  That way we can discuss the change, evaluate designs, and agree on the general idea
[x] Ensure the tests and linter pass
[x] Code coverage does not decrease (if any source code was changed)
[ ] Appropriate docs were updated (if necessary)

Fixes #<issue_number_goes_here> 🦕

Thank you for the PR!  I apologize, but taking a closer look - we were able to get rid of the dependency all up in #903!

Ok. Good.


Exclude Pest expectation interceptors code from failure snippets

this PR is a workaround for excluding Pest interceptors code from error snippets, it follows #254 and #255
as soon as PHP 8.1/8.2 bug https://github.com/php/php-src/issues/10623#issuecomment-1436023780 will be fixed (current fix PR: https://github.com/php/php-src/pull/10625), this workaround will be updated as follows:

this Pest PR will be reverted: https://github.com/pestphp/pest/pull/668#event-8555597818
$this->ignorePestInterceptors(...) will not be needed anymore
ignorePestPipes() will be updated for using ReflectionFunction to retrieve interceptor lines from its wrapper pipe, this way:

private function ignorePestPipes($frame): bool
{
    if (class_exists(Expectation::class)) {
        $reflection = new ReflectionClass(Expectation::class);

        /** @var array<string, array<Closure(Closure, mixed ...$arguments): void>> $expectationPipes */
        $expectationPipes = $reflection->getStaticPropertyValue('pipes', []);

        foreach ($expectationPipes as $pipes) {
            foreach ($pipes as $pipeClosure) {

+               $pipeReflection = new ReflectionFunction($pipeClosure);
+               $pipeUses = $pipeReflection->getClosureUsedVariables();
+               if(array_key_exists('$handler', $pipeUses)){
+                   $pipeClosure = $pipeUses['$handler'];
+               }

                if ($this->isFrameInClosure($frame, $pipeClosure)) {
                    return true;
                }
            }
        }
    }

    return false;
}

@fabio-ivona Tests are failing..

It's a composer dependency issue, it doesn't resolve 2.x-dev to 2.0

@nunomaduro adding "version": "7.x-dev" in composer.json fixed the tests
just can't get why production workflows aren't failing..


Real Servers and Virtual Services not discovered

Hi I was wondering if you could give me any pointers on how to troubleshoot this issue (https://kemplmmp.codeplex.com/workitem/1952...I posted here there bit ago)   We have no issues with discovery and with SCOM grabbing performance data but we don't get any real or virtual servers.   Is there a mechanism to enable some logging to try and determine what is going on?   Do you know what db tables I might look at to see if there is even any data getting into the system?   I've updated SCOM to the 2012R2 U12 and was running 7.1.22b (I think) now we're running 7.2.37.yattayatta on our kemps.  We're running in HA mode and I'm discovering against the shared HA IP.   I've used snmpwalk to grab the data off the kemps and it seems ok
Version info
QND.DataItemEncoder.Library <IP_ADDRESS>
QND.Network.Kemp <IP_ADDRESS>
QND SNMP Library <IP_ADDRESS>
All the other MP are up to date as far as I can tell.
Any help would be super appreciated!
Thanks

Hi joneedu,
first of all I'm sorry I completely missed this request, my GitHub notifications aren't working :-(.
The issue you're reporting is really strange, for VS I use the following OID .<IP_ADDRESS>.4.1.12<IP_ADDRESS>
Any error should be logged by the SNMP standard module in the OpsMgr event log on the MSs in the pool you use to monitor your Kemp device.


How to show unpack errors to the user

As of right now if a message fails to unpack it will become a unknown message and no error is ever bubbled up to the user.
As a user I am sometimes interested in a full list of all the unpack errors that occurred in one packet.
This is where the errors get lost at the moment
https://github.com/teeworlds-go/go-teeworlds-protocol/blob/eed93918e7be3b64e482472f24f858af47d3f339/protocol7/packet.go#L243-L253
Would it be nice to have a Errors []error field on the Packet struct? Should every single failed call to unpacker call the user hook OnError()?

errors.Join


MSID: 90729 Version: 2 DOI: 10.1101/2<IP_ADDRESS>0771

MSID: 90729
Version: 2
Preprint DOI: https://doi.org/10.1101/2<IP_ADDRESS>0771
Step 1. Awaiting reviews
Editorial to post reviews via hypothesis
Useful links:

DocMap: https://data-hub-api.elifesciences.org/enhanced-preprints/docmaps/v2/by-publisher/elife/get-by-manuscript-id?manuscript_id=90729
New model tracking: https://docs.google.com/spreadsheets/d/1_fHaoOy7hjyocptKtVJRijeNpUY4hBS7Ck_aVmx6ZJk/
Reviews on sciety: https://sciety.org/articles/activity/10.1101/2<IP_ADDRESS>0771

For trouble shooting (e.g. no Docmaps available):

DocMap issue addressing: https://miro.com/app/board/uXjVNCwK6EI=/
Explore DataHub DocMaps API: https://lookerstudio.google.com/reporting/4c2f0368-babb-4beb-b5b3-497e7e7b0f08/page/ejphD
Unmatched submissions and preprints: https://lookerstudio.google.com/u/0/reporting/9f86204f-3bf7-477c-9b18-5c5ef141bf69/page/p_gxi57ha93c
Unmatched manuscripts spreadsheet: https://docs.google.com/spreadsheets/d/15QcK8w-ssB7109RQEDtFpJPZ0J5HTGxoHa_2TtpMBbg/edit#gid=1336081641

Step 2. Preview reviewed preprint
Production QC content ahead of publication
Instructions:

QC preview: https://prod--epp.elifesciences.org/previews/90729v2
Update ticket with any problems (add blocked label)
When QC OK, add QC OK label to ticket and add publication date and time to https://docs.google.com/spreadsheets/d/1amAlKvdLcaDp5W8Z8g77NmkwbMF5n_u89ArSqPMO8jg
Move card to next column
(At end of the day post link in #enhanced-preprint and ask for PDF to be generated)

Useful links:

Preprint DOI :  https://doi.org/10.1101/2<IP_ADDRESS>0771
Confirm reviews returned by EPP: https://prod--epp.elifesciences.org/api/reviewed-preprints/90729/v2/reviews
To update the MECA path in the docmap: https://docs.google.com/spreadsheets/d/1mctCQuNFBjSn97Lihy7_vBO6z7-N-oqyLv4clyi6zHg

Step 3: Awaiting search reindex
This step adds the reviewed preprint to the homepage: https://elifesciences.org
The search reindex is triggered once an hour. We need the reviewed preprint to be indexed as the search application serves the journal homepage.
Useful links:

Jenkins pipeline to reindex search can be triggered sooner or monitored here: https://alfred.elifesciences.org/job/process/job/process-reindex-reviewed-preprints/

Step 4: Published! PDF requested
Waiting for PDF to be generated
Useful links:

PDF tracking: https://docs.google.com/spreadsheets/d/106_XeDjmuBae7gexOTNzg60lapeqjl2aRn9DzupGyS8/

Step 5: Introduce PDF to data folder and git repo
Upload PDF to relevent folder in git repo https://github.com/elifesciences/enhanced-preprints-data/
Step 6: Done!

[ ] Kettle is on!

warn: [mixed-citation-other-publication-flag] mixed-citation in reference (id=c3) has a publication-type='other'. Is that correct?

Ready to check


flow 4: cleanup flow of devices - engine

@keybase/react-hackers more of the same but actually making some progress on flowtype for engine. had to use $FlowIssue on some annoying stuff thats never exposed outside of engine

👍

rebased version here: https://github.com/keybase/client/pull/3804


Update app.js

Using LocalStorage to store data, and get when the user closes and open the browser to re-use the data

I resolved this error and refactored so its not necessary the merge


CARDS-1844: As an administrator, I can update the Terms of Use from the admin UI

Jira link

bold text in the preview doesn't look bold at all
I guess it's a browser-specific. Looks ok in the Chrome.

bold text in the preview doesn't look bold at all

Looks very bold on my device. @sdumitriu please post a screenshot for comparison.

I think that enabled at the top makes more sense. It would be even better if de-selecting it would hide all the other settings, since they are useless if the whole thing is not enabled.

They are not useless. There is a Terms of Use and Privacy Policy link at the bottom of every patient screens that reveals the terms. The "enabled" property (which should probably be renamed for clarity) is not about whether Terms of Use exist. It is only about whether the patient user is forced to accept them before answering surveys

enabled renamed to enforceAccept in 18ca79d.

Firefox vs

Firefox vs Chrome - bold fonts in FF is not prominent as in Chrome

I see, thank you @sashaandjic ! Please report this separately, we'll have to tweak the MDEditor style.

Tested - all looks and works well One very small thing that should not hold this PR is that when UoT is empty and flag Patients must accept the Terms of Use before using the portal is set to true the patient who is signing in for the first time will see this:
image
Nothing is broken here. Everything works as per design.

I think this is ok since it's an admin setting and if the admin decides the terms should be empty the consequences are really their fault.

@marta-  I would live it as is.

@marta- Bold in Firefox:
Bold text from Markdown is just rendered as a <strong> element, with no styles other than what the browser has as a default.
In Firefox, this is font-weight: bolder, which means "increase the font weight a bit from what was inherited". This is correct.
In Chrome, it's font-weight: bold, which has a fixed value.
When it is displayed normally in a page (not in the editor), it is usually wrapped with a Typography, which does define the font weight as 400. In the editor, it is not surrounded by Typography, so the base font-weight is inherited all the way from <body>, which for an unknown reason is set to 300 instead of the default 400. bolder then turns the font weight for <strong> to 400, so regular text has weight 300, bold text has weight 400 in Firefox. Depending on the system, 400 may be different from 300, but not on my system, so there is no difference at all.
The question is, why is the root font weight set to 300? Is it OK if we remove this custom style from the body element?

@marta- Bold in Firefox:

@sdumitriu This discussion belongs on the dedicated jira task CARDS-1852.


Trouble integrating with masonry.js

Hi There,
I'm loving instafeed and have been using it for a while with good results, I have recently been trying to output the thumbnails in to a layout parsed with masonry.js however having no success.  I have more or less managed to get instafeed to output the right html structure for masonry to interpret however no results.
Has anyone had any luck with this?

Closing this one as stale, but @mattgp if you're out there, yes, you can only have one after callback (though that function can just call two other functions).


Overwrite global parameters with the creation of new instances

for example, as in "Camera" or "Body", etc.

Some properties of an instance are initialized in the constructor, however they are global variables and therefore new instances would overwrite them in the Blender environment. Examples:

https://github.com/MattiaPugliatti/corto/blob/5c90bd145028701699b72e4f1d08b37238602e21/cortopy/_Body.py#L89C8-L89C77
https://github.com/MattiaPugliatti/corto/blob/5c90bd145028701699b72e4f1d08b37238602e21/cortopy/_Camera.py#L102
https://github.com/MattiaPugliatti/corto/blob/5c90bd145028701699b72e4f1d08b37238602e21/cortopy/_Rendering.py#L73

After preliminary review, the following solution is proposed in https://github.com/MattiaPugliatti/corto/commit/bc61c2579ee1303140f8e1d554365c0d2395bb80.

For the body class, it is already behaving as expected. If a new body instance is created it will override the "diffuse bounces property", if one wishes to define multiple objects they shall have the same property. If this is not the case, different instances can be created and the method set_diffuse_bounces can be used to fix the intended behavior.
For the camera class, the global properties will be overwritten in the blender environment, but their local copy is stored as attributes of the instance in the workspace. Consequently, the method toBlender() has been implemented to allow to push the variables from the local workshpace to Blender without having to redefine the camera. Basically, once multiple cameras are created, the global variables will be set to the latest camera created, however if a different one is needed, the global parameters can be set from the attributes of one of the instances by simply pushing them to Blender through toBlender() method.
For the rendering class the behavior has been fixed in the same way as for camera class.


Gitlab CI strange output

Hi, thanks for the nice gem!
I don't think it is a issue with the gem really but I don't where to start my investigations.
I use the gem on Gitlab CI.
So I run RSpec with a command bundle exec rspec --format Fuubar.
But it gives me very poor progress bar formatting.
As I can see I should somehow force tty option. I found this PR, added --tty option to my initial command.
And now the output looks like the following:

I don't quite understand what causes the issue. Is it something with Gitlab CI settings?
Is there anything I can do to avoid this behaviour?
I would like progress bar to be rewritten on the same line (as it works locally).
Thanks.

@ivanovaleksey you actually want the opposite.  Remove the --tty option and instead set the CONTINUOUS_INTEGRATION environment variable to true in your build.  That should solve your problem.

Thank you for the reply @jfelchner.
With CONTINUOUS_INTEGRATION=true bundle exec rspec --format Fuubar command progress bar looks like this (as it described in progress bar wiki page):
Progress: |===================

Is there any way to get progress bar with ' %c/%C |%w>%i| %e ' format but on the same line?

@ivanovaleksey not unless Gitlab starts supporting ANSI codes and carriage returns in their log output.

Thank you @jfelchner for the explanation.


Is Safety 3 still beta?

https://safetycli.com/research/safety-cli-3-vulnerability-scanning-for-secure-python-development (and various other pages such as https://docs.safetycli.com/safety-docs/safety-cli-3/available-commands-and-inputs) seem to say that Safety 3.0 has been released, and safety 2.x has been deprecated. However, there are some references in the documentation that seem to imply that safety 2.x is the current version, and 3.x is still beta.
https://docs.safetycli.com/safety-docs/safety-cli-3/system-wide-developer-machine-scanning

Please note that the new safety scan command is currently in beta. At this time, safety check is still supported but will be phased out in the coming months as we transition fully to safety scan.

https://docs.safetycli.com/safety-2

Existing Customers: Upgrade to Safety 3.0
Safety 3.0 is now available, providing system-wide scanning, unpinned package support, new SBOM and JSON output formats, and more.
To join the beta for the Safety 3.0 release, please complete this form.

Hey there @Zeckie,
thanks for sharing and asking that question. I am sorry that some of the docs are a bit confusing around our new version. I've created an issue for us internally to fix it as soon as we can.
The answer: No Safety 3 and safety scan are not in beta anymore. safety scan is our all new command and which everyone should use going forward.
Does this help you?
I'll follow up on this issue here once we fix our docs 🙌


Support token based authentication for self-managed

Starting with 8.2 Zeebe also supports M2M token based authentication. The needed clientId, clientSecret, oAuthUrl and audience should be passed by in application.properties.
https://docs.camunda.io/docs/self-managed/zeebe-deployment/security/client-authorization/

closed in favour of #443


Update memcached to 2.2.2

after clone the project  & run npm install, I got error while installing memcached module, update to the latest version(2.2.2) fixed that

I've not merged this as the original package dep points to a very specific commit that we needed to fix some problem. Problem is, it was well over 2 years ago and I can't remember what the issue was. Since there's no tests (on my side) covering, I don't want to merge (and because it's not a problem with<EMAIL_ADDRESS>atm).
I appreciate the PR though, thank you so much <3


Update version to 0.5.4

Checklist

[x] Used a personal fork of the feedstock to propose changes
[x] Bumped the build number (if the version is unchanged)
[x] Reset the build number to 0 (if the version changed)
[ ] Re-rendered with the latest conda-smithy (Use the phrase @conda-forge-admin, please rerender in a comment in this PR for automated rerendering)
[x] Ensured the license file is being packaged.

Version update required for https://github.com/conda-forge/bw2io-feedstock/pull/18

@conda-forge-admin, please rerender

Hi! This is the friendly automated conda-forge-linting service.
I just wanted to let you know that I linted all conda-recipes in your PR (recipe/meta.yaml) and found it was in an excellent condition.

Hi! This is the friendly automated conda-forge-webservice.
I tried to rerender for you, but it looks like there was nothing to do.
This message was generated by GitHub Actions workflow run https://github.com/conda-forge/conda-forge-webservices/actions/runs/12194866722. Examine the logs at this URL for more detail.


Concurrent edit of share PAD flows

Can we update the documentation to provide information on the behaviour if 2 users concurrently edit the same PAD flow which is shared between them?

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: ae761774-78a1-83be-4f75-18ff7ad9074d
Version Independent ID: f6f4a32d-f5af-3e07-9178-a65547039c3b
Content: Share and manage desktop flows - Power Automate
Content Source: articles/desktop-flows/manage.md
Service: flow
GitHub Login: @MSFTMan
Microsoft Alias: DeonHe

@hitendra72  Thank you for the feedback. We have added this information and will be live soon.


Link to "Bluetooth swift pair" does not work

https://docs.microsoft.com/en-us/windows-hardware/design/component-guidelines/components/bluetooth-swift-pair.md

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: e6c30c68-d0cb-7a62-f154-e6ab40c0119e
Version Independent ID: 4dec63f5-fc8f-b8ea-117f-ddeed34bfc31
Content: What's new in driver development
Content Source: windows-driver-docs-pr/what-s-new-in-driver-development.md
Service: unspecified
GitHub Login: @tedhudek
Microsoft Alias: windowsdriverdev

Thanks, @pavel-a
I fixed that. The correct link is https://docs.microsoft.com/en-us/windows-hardware/design/component-guidelines/bluetooth-swift-pair


Put the prototype online somewhere for easier feedback

Basic EC2 install in place, still needs some improvements:

[ ] shell script to update from main in one command
[ ] npm command to run the bundler just once (no watch mode)
[ ] Make sure everything restart on reboot

There's now a test version online!
For reference, the shell script to update everything is:
git pull origin main &&
source /home/ubuntu/.cache/pypoetry/virtualenvs/riparias-early-warning-webapp-Gz5dE7VP-py3.8/bin/activate &&
poetry install &&
npm install &&
npm run webpack-prod &&
python manage.py collectstatic --settings=djangoproject.local_settings --no-input &&
python manage.py migrate --settings=djangoproject.local_settings &&
sudo systemctl restart gunicorn

Cron is configured and appears ok, to be confirmed 100% in a couple of days

Looks good!


Consider prefixing tags with "v"

Tags should be named v1.2.3, etc.  This is the tagging scheme used by Git and the kernel itself.  It's best when everyone uses the same convention.

Thanks @davvid. Definitely an option I'ld like to include. I'll have a think about how best to do this.

This option should be the default behavior.  Just saying.  Cos, like, the person who invented Git does it that way.


[Feature]: Pipeline: Image Embedding using resnet50

Is there an existing issue for this?

[X] I have searched the existing issues.

Is your feature request related to a problem? Please describe.
the shape of output embedding is shape: (1, 2048), can i get (1, 64) or (1, 32) ?
Pipeline Output:
The pipeline returns a tuple Tuple[('feature_vector', numpy.ndarray)] containing following fields:
feature_vector:
the embedding of input image
data type: numpy.ndarray
shape: (1, 2048)
Describe the solution you'd like.
No response
Describe an alternate solution.
No response
Anything else? (Additional Context)
No response

Currently, the smallest is resnet18, which is 512 dimensions. You can try some dimensionality reduction methods provided by sklearn.

Currently, the smallest is resnet18, which is 512 dimensions. You can try some dimensionality reduction methods provided by sklearn.

thanks vert much !


iox-#1919-fix-max-group-name-length

Pre-Review Checklist for the PR Author

[x] Code follows the coding style of CONTRIBUTING.md
[x] Tests follow the best practice for testing
[x] Changelog updated in the unreleased section including API breaking changes
[x] Branch follows the naming format (iox-123-this-is-a-branch)
[x] Commits messages are according to this guideline

[x] Commit messages have the issue ID (iox-#123 commit text)
[x] Commit author matches Eclipse Contributor Agreement (and ECA is signed)

[x] Update the PR title

Follow the same conventions as for commit messages
Link to the relevant issue

[x] Relevant issues are linked
[x] Add sensible notes for the reviewer
[ ] All checks have passed (except task-list-completed)
[x] All touched (C/C++) source code files from iceoryx_hoofs are added to ./clang-tidy-diff-scans.txt
[x] Assign PR to reviewer

Notes for Reviewer

Checklist for the PR Reviewer

[ ] Commits are properly organized and messages are according to the guideline
[ ] Code according to our coding style and naming conventions
[ ] Unit tests have been written for new behavior
[ ] Public API changes are documented via doxygen
[ ] Copyright owner are updated in the changed files
[ ] All touched (C/C++) source code files from iceoryx_hoofs have been added to ./clang-tidy-diff-scans.txt
[ ] PR title describes the changes

Post-review Checklist for the PR Author

[ ] All open points are addressed and tracked via issues

References

Closes #1919

@atirehgram did you sign the eclipse eca yet? https://www.eclipse.org/legal/ECA.php
This is required by every committer. For this you require an eclipse account which uses the same email address you used for the commits here and has signed the eclipse committer agreement.

@atirehgram did you sign the eclipse eca yet? https://www.eclipse.org/legal/ECA.php
This is required by every committer. For this you require an eclipse account which uses the same email address you used for the commits here and has signed the eclipse committer agreement.

Sorry, I forgot with which email I had signed it. It should be fine now, could you please retrigger the check?

@atirehgram eclipse does not want to verify it. It states<EMAIL_ADDRESS>failed. Could you may please check again if you signed with the same email address the ECA you committed with.
And I will retry it in the afternoon again - maybe eclipse requires just some more time. Most of the times eclipse is just a little bit weird and slow.

I double checked the mail in the ECA and I also retriggered the check manually twice, but it keeps failing.

@atirehgram we have a hard internal deadline for a feature until Thursday. I would retrigger the check again and on Friday I would start digging here deeper.
But when we are lucky the problem is just vanished until then.

@atirehgram I think eclipse somehow screws up here and after trying the 1000th captcha challenge of trying to find a hamster in its natural environment I would propose the following.

Could you please split up your commits into two with the correct author and force push it. Maybe the eclipse thingy has your email cached somewhere and therefore it does not validate it.
If this does not work I would create an eclipse bug ticket.

One question, did you change the commits author or had multiple authors for one commit? This could maybe explain the eclipse bug - but it is still an eclipse bug.

@atirehgram I have found the problem. When you take a look at your commit with git log --format=fuller you see:
commit b2b0047e7516e7e0e3e38f5493111255f20f724a (HEAD -> iox-1919-fix-max-group-name-length, foo/iox-1919-fix-max-group-name-length)
Author:     Margherita Protti<EMAIL_ADDRESS>AuthorDate: Mon Feb 27 14:17:33 2023 +0100
Commit:     Margherita Protti<EMAIL_ADDRESS>CommitDate: Tue Feb 28 08:32:27 2023 +0100

So it seems you have somehow an author but a different committer (I didn't know that this was possible). The e-mail in the author section has to sign the ECA. And usually the author and committer are the same I suspect. So could you please use the same email for commit and author and then we can get this PR in.
I think you may have to rebase to master again since it shows now a merge conflict with our release notes.
But when we handled this PR sucessfully the next PRs from your side will be much smoother. Eclipse with its ECA is not so welcoming to newcomers :/ ...


inference on cpu

is it possible to do inference on cpu in colab?

Hey AK,
At the current state, the code does not support inference on CPU, just GPU.
Although it is possible to add this option in some minor code changes.
This change will make PTI extremely slow (I predict 10 min per identity), especially in Colab.
May I ask what the purpose of running PTI on CPU instead of GPU?

@danielroich thanks, I was looking to port PTI to gradio hub https://gradio.app/hub which does support gpu but it is fairly new right now and unstable

@AK391 Done :)
I might add that running PTI is very slow on CPU but it can be done from now on.
All you have to do on the inference notebook is to change global_config.device from 'cuda' to 'cpu' under Configuration Setup
and everything will run on CPU instead of GPU
Hope it helps!
Daniel

@danielroich thanks 10 mins per identity is pretty long but ill try to see what I can do


[Bug]: Zitadel init command was failed with PostgreSQL

Preflight Checklist

[X] I could not find a solution in the documentation, the existing issues or discussions
[X] I have joined the ZITADEL chat

Environment
Self-hosted
Version
2.55.0
Database
PostgreSQL
Database Version
16
Describe the problem caused by this bug
Hi, team!
I just tested your fix in 2.55.0. See details below.
Build container:
$ docker image ls
REPOSITORY   TAG           IMAGE ID       CREATED          SIZE
zitadel      2.55.0-rc.1   cb8dca7a5906   42 seconds ago   231MB

Before start Zitadel container I created new db - ztdb on existing PG cluster where hosted worked Zitadel deployment.
Start container
docker run --rm --name=init1 --hostname=init1 --network=host \
  --volume /etc/localtime:/etc/localtime:ro \
  --env ZITADEL_DATABASE_POSTGRES_HOST=hxowifpe.mdb.mycloud.net \
  --env ZITADEL_DATABASE_POSTGRES_PORT=6432 \
  --env ZITADEL_DATABASE_POSTGRES_DATABASE=ztdb \
  --env ZITADEL_DATABASE_POSTGRES_USER_USERNAME=dbadmin \
  --env ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=My324up@paS98 \
  --env ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable \
  --env ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE=ztdb \
  --env ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME=dbadmin \
  --env ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD=My324up@paS98 \
  --env ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE=disable \
  --entrypoint /opt/zitadel/zitadel \
zitadel:2.55.0-rc.1 start-from-init --masterkeyFromEnv

and have got the following results
time="2024-06-20T10:28:58+03:00" level=info msg="initialization started" caller="/home/runner/work/zitadel/zitadel/cmd/initialise/init.go:75"
time="2024-06-20T10:28:58+03:00" level=info msg="verify user" caller="/home/runner/work/zitadel/zitadel/cmd/initialise/verify_user.go:39" username=dbadmin
time="2024-06-20T10:28:58+03:00" level=fatal msg="unable to initialize the database" caller="/home/runner/work/zitadel/zitadel/cmd/initialise/init.go:68" error="ERROR: permission denied to create role (SQLSTATE 42501)"

Yes, now we successfully connected to PG database, but db initialization was failed.
My PG cluster is deployed in cloud as a PG Managed solution and dbadmin user already has mdb_admin role in ztdb database.
May be for such type of deployments init step with "grant roles" should be skiped ?
Note: as I wrote before here start-from-config command works fine.
P.S. I can create dedicated database for your tests, if it help to resolve this issue.
Thank you.
/Alexander
To reproduce
Start container
docker run --rm --name=init1 --hostname=init1 --network=host \
  --volume /etc/localtime:/etc/localtime:ro \
  --env ZITADEL_DATABASE_POSTGRES_HOST=hxowifpe.mdb.mycloud.net \
  --env ZITADEL_DATABASE_POSTGRES_PORT=6432 \
  --env ZITADEL_DATABASE_POSTGRES_DATABASE=ztdb \
  --env ZITADEL_DATABASE_POSTGRES_USER_USERNAME=dbadmin \
  --env ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=My324up@paS98 \
  --env ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable \
  --env ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE=ztdb \
  --env ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME=dbadmin \
  --env ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD=My324up@paS98 \
  --env ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE=disable \
  --entrypoint /opt/zitadel/zitadel \
zitadel:2.55.0-rc.1 start-from-init --masterkeyFromEnv

and have got the following results
time="2024-06-20T10:28:58+03:00" level=info msg="initialization started" caller="/home/runner/work/zitadel/zitadel/cmd/initialise/init.go:75"
time="2024-06-20T10:28:58+03:00" level=info msg="verify user" caller="/home/runner/work/zitadel/zitadel/cmd/initialise/verify_user.go:39" username=dbadmin
time="2024-06-20T10:28:58+03:00" level=fatal msg="unable to initialize the database" caller="/home/runner/work/zitadel/zitadel/cmd/initialise/init.go:68" error="ERROR: permission denied to create role (SQLSTATE 42501)"

Screenshots
No response
Expected behavior
zitadel init command successfully create all required objects at database.
Operating System
No response
Relevant Configuration
No response
Additional Context
No response

FYI
This story was started from https://github.com/zitadel/zitadel/pull/8045

I am not sure why we are verifying if a Postgres role exists by creating it.
https://github.com/zitadel/zitadel/blob/3d071fc505b506691f14d33ce971226b6f07384d/cmd/initialise/verify_user.go#L38-L45

I have run into this issue as well

@0xMurage It seems that the function is poorly named as that is where the init process creates the user. But the issue is if the database credentials do not allow for creating roles, this "verify" step fails even if the user already exists.

I think the correct implementation logic should be that if the user already exists, it should not be created. However, checking this in PostgreSQL might also require administrative permissions.

You can run SELECT CURRENT_USER and check if that is the user that you would create.
Also, I’d much prefer if Zitadel init sent an encrypted password, rather than sending it in as clear text.

I did struggle with this a lot recently. I'm using an existing DB cluster in which I created a database and a dedicated User for Zitadel to use. User had all required permissions to work with that particular empty database. Since there are other databases in that DB cluster I would be reluctant to grant wider permissions for Zitadel. Eventually after user had been given CREATEDB and CREATEROLE privilages, the first-time installation went through, although there was no need to create additional databases nor roles as they've been created before.

Hi @aidas-emersoft ,
sorry I am newbie in zitadel, may I clarify one thing ( since the zitadel is up and running properly), however, if I access the postgres db container, only "zitadel" db has been created. but no any tables has been created. is that the right behavior ?

thanks
Regards,
Lawes

@laweschan the tables are not under the public schema. Look at the other schemas in the database. Also this is not a support forum but a bug report. The Discord is a better place to ask questions.

Same issue with role creating, we can not use already created Managed High Availability PostgreSQL cluster


init: explicitly name exported functions for mypy --strict

This small PR fixes mypy --strict reporting Module "wrapt_timeout_decorator" does not explicitly export attribute "timeout" as per the explanation provided by https://github.com/tiangolo/typer/issues/112#issuecomment-648344361

I changed accordingly, thank You for the contribution
yours sincerely
Robert


Mobile first

In this branch, I did:

[ ] Add the header section
[ ] Add a section who have class="head flex".
[ ] Create an images folder and add images in.
[ ] configure linters

I modify readme file

I did add future features in readme file

I did add future features in readme file

@noelfoka, Kindly be notifies that your README file was empty with nothing in it


New services.tlp.enable default on 20.09

PR #263 introduced a new services.tlp.enable default that depends on services.power-profiles-daemon.enable only available on unstable or the upcoming 21.05 stable. I've resolved this for myself by explicitly setting services.tlp.enable = true but I'm wondering if there is a way to only depend on services.power-profiles-daemon.enable if that option is available so it doesn't break updates for others.

Yes. I have a look.


Raidboss - Archive all inaccurate stack/spread

On final omega, when he casts "Archive All" there is a delta attack, where you either have to stack or spread.
The trigger for it will always show "stack", even if you don't have any debuff.
I'd assume this comes due to this bit of code, which is meant for Omega M/F:
...
   {
     id: 'O12S Stack Marker',
     regex: /1B:........:\y{Name}:....:....:003E:0000:0000:0000:/,
     suppressSeconds: 1,
     infoText: {
       en: 'Stack',
     },
   },
...

I think adding a check for target might help fix this. Not sure how to correctly add that, though.

Thanks for reminding me that I needed to fix this.  Sorry for the confusion!


Change Docker base image to slim/alpine

Fixed somewhat in 8e74cfebf1a31bce7f381829c97a1c56b8ce104a by using pip install --user and copying the .local folder into the runtime stage.


Remove Quartz Scheduler

This is great! A much needed cleanup! Thanks for taking care of it. A few comments inline, but this looks really good!

:x: Build jmxtrans 249 failed (commit https://github.com/jmxtrans/jmxtrans/commit/93f903696f by @gquintana)

:x: Build jmxtrans 251 failed (commit https://github.com/jmxtrans/jmxtrans/commit/dded18920e by @gquintana)

:white_check_mark: Build jmxtrans 252 completed (commit https://github.com/jmxtrans/jmxtrans/commit/84e5190c3a by @gquintana)

:x: Build jmxtrans 253 failed (commit https://github.com/jmxtrans/jmxtrans/commit/2f957809a8 by @gquintana)

:white_check_mark: Build jmxtrans 254 completed (commit https://github.com/jmxtrans/jmxtrans/commit/4bbcff23ef by @gquintana)

@gehel Can I merge this PR?

Looks good to me, feel free to merge.
In a more general note, don't let me be the bottleneck, if you think that your code is good enough, I trust your judgment, always feel free to merge!


v_args-decoration of Transformer breaks staticmethods

If callback methods are defined as staticmethods, and the Transformer is decorated with v_args, e.g.:
@v_args()
class MyTransformer(Transformer):
    @staticmethod
    def integer(args):
        pass # some code here

Then all the staticmethods break - they start receiving a MyTransformer instance as the first argument. Removing @staticmethod and adding self as the first argument works as a workaround

Fixed in master and version 0.6.5


add RTF references in readme

https://interoperability.blob.core.windows.net/files/Archive_References/[MSFT-RTF].pdf
https://interoperability.blob.core.windows.net/files/MS-OXRTFEX/%5bMS-OXRTFEX%5d-100804.pdf

dean links, not adding


Fix a parser bug for maven classpath

Currently, the plugin fails to parse all classpaths from maven if pom.xml has a lot of classpaths (i.e. https://gist.github.com/chiwanpark/5df218280df53de7356172a2540229c5). This pull request fixes the bug by removing offset.

you can increase the offset, remove it may cause vim blocked.

@wsdjeg Thanks for guidance. Is the configurable offset resonable? Then, I'll update my pull request.

@wsdjeg Yes, I am using Neovim 0.2.2.

It is feature of neovim's job
https://github.com/neovim/neovim/issues/4266

@wsdjeg Okay, I will wait for updating neovim.


Bump Dependencies #5324200229

Bumps dependencies for product-is. Link : https://github.com/wso2/product-is/actions/runs/5324200229

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.jenkins-is-staging seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.You have signed the CLA already but the status is still pending? Let us recheck it.


On the implementation of subscripts

A simple mental model
There's a simple mental model I like for explaining projections: a subscript is a function that calls another function on the projected value. For example, these two programs have equivalent semantics:
// 1
subscript incremented(_ x: Int): Int { let y = x + 1; yield y }
public fun main() {
  let s = 10
  let t = incremented[s]
  print(t)
}

// 2
fun with_incremented<E,T>(_ x: Int, _ c: [E](Int) -> T) -> T { let y = x + 1; c(y) }
public fun main() {
  let s = 10
  with_incremented(s, fun(t) { print(t) })
}

The problem of arbitrary overlapping projections
Unfortunately, this simple model can only work when overlapping projections nest. Consider this:
subscript f(_ x: Int): Int { x }
public fun main() {
  let s = 10
  let t = f[s] // <--|
  let u = f[s] // <--+--|
  print(t)     // <--|  |
  print(u)     // <-----|
}

Here, neither the lifetime of t nor that of u is nested into the other. So we can't naively wrap the code within the lifetime of either into a lambda.
Eager continuations
At CppCon, @dabrahams suggested that we created continuations that wrap the whole code after the start of a projection, regardless of the end of its lifetime. The idea was that if we could already convince ourselves that value uniqueness was upheld, then it wouldn't matter what low-level code we generate.
This technique would work in the above example, but only because everything is immutable. I think that's because logically extending the lifetime of t so that it encapsulates that of u doesn't change the behavior of the program outside of what the specification allows. Indeed, Val only guarantees that a projection ends after its last use, but not necessarily as soon as possible.
But the same approach can't apply in the presence of mutation:
subscript f(_ x: yielded Int): Int { let { x } inout { &x } }
public fun main() {
  var s = 10
  inout t = f[&s]
  &t += 1
  print(s)
}

This program is obviously legal. But if we capture all the code after the binding of t in a lambda, then its lifetime will cover that of the immutable use of s. One may think that it's not an issue, since we'd have already established that the program is legal before the transformation, but consider this:
subscript f(_ x: yielded Int): Int {
  let { x }
  inout { var y = x; yield &y; x = y }
}

The above subscript is moving the value of the projected value out of its storage. That should be fine, because we should be allowed to rely on the guarantee that no one will try to read x before control returns. but the transformation is going against this assumption.
Falsy hope
At CppCon, I thought we could deal with this situation by only eagerly wrap code into continuations of immutable projections. For mutable projections, we would only wrap code within a binding's useful lifetime, essentially falling back on my simpler mental model. I though it would work because overlapping mutable projections must nest, unlike immutable ones.
Unfortunately, I overlooked this situation:
subscript f(_ x: yielded Int): Int { let { x } inout { &x } }
public fun main() {
  var s = 10
  let t = f[s]
  if t > Int.random(in: 0 ..< 100) {
    inout u = f[&s]
    &u += 1
  } else {
    print(t)
  }
}

The problem here is that there isn't a single point where we can decide to terminate the projection of t. Its useful lifetime ends in both branches of the conditional statement. Further, we can't extend it until after the conditional because we need s to be unique by the time we bind u.
A page from co-routines
I originally thought we could implement subscripts like co-routines. A subscript would be compiled to two functions. The first would implement the code before yield and return a pointer to the projected value along with an environment and a tag identifying where it gave away control. The second would implement the code after yield.
Roughly speaking, it would look like the following:
// 1
subscript truthy(x: Int): Bool {
  var s = "was "
  if x == 0 {
    yield false
    print(s + "falsy")
  } else {
    yield true
    print(s + "truthy")
  }
}

// 2
fun truthy_before(x: Int) -> {Pointer<Bool>, Pointer<{String, Bool}>, Int} {
  let e = MutablePointer<{String, Bool}>.allocate(count: 1)
  let s = e.rebound<String>()
  unsafe s.initialize(to: "was")
  let b = e.advanced(by: MemoryLayout<String>.size).rebound<Bool>()
  if x == 0 {
    unsafe b.initialize(to: false)
    return (b, e, 0)
  } else {
    unsafe b.initialize(to: true)
    return (b, e, 1)
  }
}

fun truthy_after(_ e: Pointer<{String, Bool}>, tag: Int) -> Void {
  match tag {
    0 { print(unsafe e.rebound<String>.pointee + "falsy") }
    1 { print(unsafe e.rebound<String>.pointee + "truthy") }
  }
  unsafe e.deinitialize()
  unsafe e.deallocate()
}

The problem with that approach is that it involves dynamic allocation, meaning that subscripts would no longer a be zero-cost abstraction feature. But I think I have a solution.
Truthy hope?
The dynamic allocation is used to store the objects that are projected or created before yield and used after. Since we're only talking about object storage, then, I think we can statically determine the size we need. It doesn't matter how many functions are called before or after yield, so we don't need to allocate a call stack, only a single frame.
So we could ask the subscript's caller to allocate such storage within its own  frame. For instance, in the above example, truthy_before and truthy_after would use a block of memory passed from the caller as their local stack and dynamic allocation would no longer be necessary.
It's not necessarily easy to determine the exact minimum storage we need during lowering because we can't know whether a local binding requires storage before we run last use analysis, but we can definitely get an upper bound. That's probably good enough for the vast majority of cases.
Another limitation is that subscripts would not be allowed to use something like alloca. I think this is pretty minor, though, because they would still be allowed to call functions that do it.

Your pointer manipulations in truthy_before would produce UB if the usual rules apply to val (b doesn't point at the bool in the tuple).  Can you come up with an example that only uses safe operations?

Not sure it's possible with only safe operations. However, I took some shortcuts to keep the example concise and because we have yet to finalize the actual API of pointers for Val. So to hopefully makes tings clearer, here's what I meant in Swift:
func truthy_before(x: Int) -> (UnsafeMutablePointer<Bool>, UnsafeMutableRawPointer, Int) {
  let e = UnsafeMutableRawPointer.allocate(
    byteCount: MemoryLayout<(String, Bool)>.size,
    alignment: MemoryLayout<(String, Bool)>.alignment)
  let s = e.assumingMemoryBound(to: String.self)
  s.initialize(to: "was ")

  let b = e
    .advanced(by: MemoryLayout<(String, Bool)>.offset(of: \.1)!)
    .assumingMemoryBound(to: Bool.self)
  if x == 0 {
    b.initialize(to: false)
    return (b, e, 0)
  } else {
    b.initialize(to: true)
    return (b, e, 1)
  }
}

Resolved in slack.  The part missing from Dimi's rendition of my CppCon suggestion was that the projection code after the yield, which ends the lifetime of the projection, is passed as a closure to the continuation passed into the projection along with the let/inout-bound projected value, and the continuation calls that closure when the lifetime of the projection ends.  (@kyouko-taiga please verify and close if appropriate)

Summary of a chat with Dave about that:
There's a way to work around the issue I mentioned about eager continuations. Rather than simply calling a continuation with the projected value, a subscript could also pass a callback. The continuation will be expected to call it when it's done with the projection.
For example:
// 1
subscript truthy(x: Int): Bool {
  var s = "was "
  if x == 0 {
    yield false
    print(s + "falsy")
  } else {
    yield true
    print(s + "truthy")
  }
}

// 2
fun truthy<E, T>(x: Int, c: [E](Bool, [Pointer<Frame>]() -> Void) -> T) -> T {
  var s = "was "
  if x == 0 {
    return c(false, fun() { print(s + "falsy") })
  } else {
    return c(true, fun() { print(s + "truthy") })
  }
}

In (2), truthy expects c to eventually call the lambda that gets passed as its second argument.
One big advantage of this solution over the one I suggested is that supports ABI stability. If the caller of a subscript needs to know how much memory it has to allocate before calling it, then it means we can't modify the implementation of a subscript without having all its callers being recompiled too (note: a workaround could be to have a symbol next to each subscript that tells what size the caller is expected to allocate).


Issue with MaterialDesignThemes.Mahapps 0.0.9

Using MahApps <IP_ADDRESS>, an exception is thrown at app launch with this message :
Set property 'System.Windows.ResourceDictionary.DeferrableContent' threw an exception.
Seems to be thrown by MaterialDesignTheme.MahApps.Defaults.xaml

I'm having the same problem, For me the problem is
<ResourceDictionary Source="pack://application:,,,/MaterialDesignThemes.MahApps;component/Themes/MaterialDesignTheme.MahApps.Flyout.xaml" />
Removing that from my App.xaml lets my app start as usual

@bbougot @Insire Can one of you create a repo sample? Would be really useful. thx

https://github.com/Insire/InsireBot-V2 you can see the problem here

check my App.xaml Line 32 and uncomment that line and the error is back

Having this same issue.

When I look into the MaterialDesignThemes.MahApps assembly with dotPeek there is no type for FlyoutAssist, which exist in source code.
It seems like the 0.0.9 package includes the 0.0.1 assembly:

Should be verifiable by downloading the nuget package at https://www.nuget.org/packages/MaterialDesignThemes.MahApps/

Sorry guys...will try to look at this v. soon.

OK, please retry with https://www.nuget.org/packages/MaterialDesignThemes.MahApps/0.0.10

Most recent version works for me. Thanks for your work!

I am just experiencing the exact same error. Appeared using 0.0.11, tried 0.0.10 but still have the same issue.

I experience the same problem in this latest release 0.0.11 :(

The issue is because of the paket.lock file,
please check this:
https://github.com/ButchersBoy/MaterialDesignInXamlToolkit/issues/659


Update VoyagerBaseController.php

Fixes #4406 see explanation in https://github.com/the-control-group/voyager/issues/4406#issuecomment-533507546

Closing in favor of https://github.com/the-control-group/voyager/pull/4442


[ARM] az resource move: Add example for moving multiple resources

Related command

Description

Testing Guide

History Notes

[Component Name 1] BREAKING CHANGE: az command a: Make some customer-facing breaking change
[Component Name 2] az command b: Add some customer-facing feature

This checklist is used to make sure that common guidelines for a pull request are followed.

[x] The PR title and description has followed the guideline in Submitting Pull Requests.

[x] I adhere to the Command Guidelines.

[x] I adhere to the Error Handling Guidelines.

ARM


add sequence number to rows read

add sequence number to rows read allows reconstruction of event sequences

I assume the sequence number should be stored per-file? And should that information go into structured data, and if so, where?