[TASK] Investigate SELinux enabled with Longhorn

    IIRC, Fedora CoreOS, centos stream and fedora enable SELinux by default and are popular OSes. Although we have a KB for OKD (https://longhorn.io/kb/troubleshooting-volumes-stuck-in-attach-detach-loop-when-using-longhorn-on-okd/), it is worth investigating and figuring out a solution for SELinux enabled env.

cc @innobead @ChanYiLin
Originally posted by @derekbit in https://github.com/longhorn/longhorn/discussions/5367#discussioncomment-5377112

cc @longhorn/qa

We support running e2e integration test RHEL/Cent OS with SELinux enabled on our CI. The latest versions we have tested with SELinux are RHEL 8.6 and CentOS 8.4.
I've triggered the test on RHEL 8.6 SELinux enabled and will share the result.
As far I know, SELinux enabled OS level works fine but SELinux enabled docker label has some problem.

A number of users in various Slack channels and on GitHub are starting to raise SELinux related issues. In particular, it is being reported that updating the following packages on a RHEL-like distribution (which happens automatically in both el8 and el9) causes Longhorn failures:
container-selinux-2.205.0-1.el9_2.noarch
selinux-policy-38.1.11-2.el9_2.2.noarch
selinux-policy-targeted-38.1.11-2.el9_2.2.noarch

The issue manifests itself with the following SELinux violation:
type=SYSCALL msg=audit(1685655494.348:29035): arch=c000003e syscall=83 success=no exit=-13 a0=55b780fce620 a1=1f8 a2=ffffffffffffff00 a3=0 items=2 ppid=1062564 pid=1063465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iscsiadm" exe="/usr/sbin/iscsiadm" subj=system_u:system_r:iscsid_t:s0 key=(null)
type=AVC msg=audit(1685655494.348:29035): avc:  denied  { dac_override } for  pid=1063465 comm="iscsiadm" capability=1  scontext=system_u:system_r:iscsid_t:s0 tcontext=system_u:system_r:iscsid_t:s0 tclass=capability permissive=0

This looks similar to https://github.com/longhorn/longhorn/issues/4988.

syscall=83 would be mkdir; this corresponds to the research at https://bugzilla.redhat.com/show_bug.cgi?id=1973683:

The AVC dac_override denial is due to OpenISCI creating node directory permissions with 0660 (and additionally they call umask(0177) in both iscsiadm and iscsid).
Expected results:
Manually changing the directory permissions results in a successful run. Additionally, patching the mkdir() and umask() calls and rebuilding the RPM is confirmed to fix the issue as well.

also ref https://github.com/fedora-selinux/selinux-policy/pull/526 which was closed as a bug in open-iscsi.

Practical steps to reproduce the issues users have recently been seeing:

Create a Rocky Linux 9 VM (I used a Digital Ocean droplet).
Follow the RKE2 Quick Snstall guide to get a single-node RKE2 cluster up and running (https://docs.rke2.io/install/quickstart),
Note that the following packages are included in the install (container-linux v205 is likely the issue):

[root@selinux-recreate-rocky-9 ~]# curl -sfL https://get.rke2.io/ | sh -
[INFO]  finding release for channel stable
[INFO]  using 1.25 series from channel stable
DigitalOcean Droplet Agent                                                               29 kB/s | 3.3 kB     00:00
Rancher RKE2 Common (stable)                                                            1.7 kB/s | 1.0 kB     00:00
Rancher RKE2 1.25 (stable)                                                              2.3 kB/s | 1.5 kB     00:00
Dependencies resolved.
======================================================================================================================== Package                         Architecture   Version                        Repository                          Size
========================================================================================================================Installing:
 rke2-server                     x86_64         1.25.10~rke2r1-0.el9           rancher-rke2-1.25-stable           9.0 k
Upgrading:
 iptables-libs                   x86_64         1.8.8-6.el9_1                  baseos                             398 k
 selinux-policy                  noarch         38.1.11-2.el9_2.2              baseos                              54 k
 selinux-policy-targeted         noarch         38.1.11-2.el9_2.2              baseos                             6.4 M
Installing dependencies:
 container-selinux               noarch         3:2.205.0-1.el9_2              appstream                           50 k
 iptables-nft                    x86_64         1.8.8-6.el9_1                  baseos                             185 k
 libnftnl                        x86_64         1.2.2-1.el9                    baseos                              83 k
 rke2-common                     x86_64         1.25.10~rke2r1-0.el9           rancher-rke2-1.25-stable            19 M
 rke2-selinux                    noarch         0.12-1.el9                     rancher-rke2-common-stable          22 k

Clone the longhorn/longhorn v1.4.2.
kubectl apply -f deploy/prerequisite/longhorn-iscsi-installation.yaml
kubectl apply -f deploy/longhorn.yaml
Create and attach a Longhorn volume.
The volume never attaches.

eweber@laptop:~> kl get volume
NAME   STATE       ROBUSTNESS   SCHEDULED   SIZE         NODE                       AGE
test   attaching   unknown<PHONE_NUMBER>   selinux-recreate-rocky-9   9m46s

See iSCSI related failures in instance-manager-e logs.

[longhorn-instance-manager] time="2023-06-02T14:55:44Z" level=info msg="Process Manager: prepare to create process test-e-ebf4f7c9"
[longhorn-instance-manager] time="2023-06-02T14:55:44Z" level=debug msg="Process Manager: validate process path: /engine-binaries/longhornio-longhorn-engine-v1.4.2/longhorn dir: /engine-binaries/ image: longhornio-longhorn-engine-v1.4.2 binary: longhorn"
[longhorn-instance-manager] time="2023-06-02T14:55:44Z" level=info msg="Process Manager: created process test-e-ebf4f7c9"
[test-e-ebf4f7c9] time="2023-06-02T14:55:44Z" level=info msg="Creating volume test controller with iSCSI target request timeout 15s and engine to replica(s) timeout 8s"
[test-e-ebf4f7c9] time="2023-06-02T14:55:44Z" level=info msg="Starting with replicas [\"tcp://<IP_ADDRESS>:10000\"]"
time="2023-06-02T14:55:44Z" level=info msg="Connecting to remote: <IP_ADDRESS>:10000 (tcp)"
[test-e-ebf4f7c9] time="2023-06-02T14:55:44Z" level=info msg="Opening remote: <IP_ADDRESS>:10000"
[test-e-ebf4f7c9] time="2023-06-02T14:55:44Z" level=info msg="Adding backend: tcp://<IP_ADDRESS>:10000"
[test-e-ebf4f7c9] time="2023-06-02T14:55:44Z" level=info msg="Start monitoring tcp://<IP_ADDRESS>:10000"
[test-e-ebf4f7c9] time="2023-06-02T14:55:44Z" level=info msg="Got backend tcp://<IP_ADDRESS>:10000 UnmapMarkSnapChainRemoved false"
time="2023-06-02T14:55:44Z" level=info msg="Controller checked and corrected flag unmapMarkSnapChainRemoved=false for backend replicas"
[test-e-ebf4f7c9] time="2023-06-02T14:55:44Z" level=info msg="Got backend tcp://<IP_ADDRESS>:10000 revision counter 0"
[test-e-ebf4f7c9] time="2023-06-02T14:55:44Z" level=info msg="Shutting down iSCSI target iqn.2019-10.io.longhorn:test"
lh_client_close_conn: Closing connection
[test-e-ebf4f7c9] time="2023-06-02T14:55:44Z" level=info msg="device test: iSCSI device /dev/longhorn/test shutdown"
[test-e-ebf4f7c9] go-iscsi-helper: tgtd is already running
[test-e-ebf4f7c9] time="2023-06-02T14:55:45Z" level=info msg="go-iscsi-helper: found available target id 1"
tgtd: device_mgmt(246) sz:91 params:path=/var/run/longhorn-test.sock,bstype=longhorn,bsopts=size=5368709120;request_timeout=15
tgtd: bs_thread_open(409) 16
[test-e-ebf4f7c9] time="2023-06-02T14:55:45Z" level=info msg="New data socket connection established"
[longhorn-instance-manager] time="2023-06-02T14:55:45Z" level=info msg="Wait for gRPC service of process test-e-ebf4f7c9 to start at localhost:10000"
[test-e-ebf4f7c9] time="2023-06-02T14:55:45Z" level=warning msg="Failed to discover" error="<nil>"
[test-e-ebf4f7c9] time="2023-06-02T14:55:45Z" level=warning msg="Nodes cleaned up for iqn.2019-10.io.longhorn:test"
[longhorn-instance-manager] time="2023-06-02T14:55:46Z" level=info msg="Wait for gRPC service of process test-e-ebf4f7c9 to start at localhost:10000"
[longhorn-instance-manager] time="2023-06-02T14:55:47Z" level=info msg="Wait for gRPC service of process test-e-ebf4f7c9 to start at localhost:10000"
[longhorn-instance-manager] time="2023-06-02T14:55:48Z" level=info msg="Wait for gRPC service of process test-e-ebf4f7c9 to start at localhost:10000"
[test-e-ebf4f7c9] time="2023-06-02T14:55:48Z" level=warning msg="Failed to discover" error="<nil>"
[test-e-ebf4f7c9] time="2023-06-02T14:55:48Z" level=warning msg="Nodes cleaned up for iqn.2019-10.io.longhorn:test"
[longhorn-instance-manager] time="2023-06-02T14:55:49Z" level=info msg="Wait for gRPC service of process test-e-ebf4f7c9 to start at localhost:10000"
[longhorn-instance-manager] time="2023-06-02T14:55:50Z" level=info msg="Wait for gRPC service of process test-e-ebf4f7c9 to start at localhost:10000"
[longhorn-instance-manager] time="2023-06-02T14:55:51Z" level=info msg="Wait for gRPC service of process test-e-ebf4f7c9 to start at localhost:10000"
[test-e-ebf4f7c9] time="2023-06-02T14:55:51Z" level=warning msg="Failed to discover" error="<nil>"
[test-e-ebf4f7c9] time="2023-06-02T14:55:51Z" level=warning msg="Nodes cleaned up for iqn.2019-10.io.longhorn:test"
[longhorn-instance-manager] time="2023-06-02T14:55:52Z" level=info msg="Wait for gRPC service of process test-e-ebf4f7c9 to start at localhost:10000"
[longhorn-instance-manager] time="2023-06-02T14:55:53Z" level=info msg="Wait for gRPC service of process test-e-ebf4f7c9 to start at localhost:10000"
[longhorn-instance-manager] time="2023-06-02T14:55:54Z" level=info msg="Wait for gRPC service of process test-e-ebf4f7c9 to start at localhost:10000"
[test-e-ebf4f7c9] time="2023-06-02T14:55:54Z" level=warning msg="Failed to discover" error="<nil>"
[test-e-ebf4f7c9] time="2023-06-02T14:55:54Z" level=warning msg="Nodes cleaned up for iqn.2019-10.io.longhorn:test"

See denials in SELinux audit logs:

[root@selinux-recreate-rocky-9 ~]# ausearch -m AVC -ts recent
...
----
time->Fri Jun  2 14:58:17 2023
type=PROCTITLE msg=audit(1685717897.278:1612): proctitle=697363736961646D002D6D00646973636F76657279002D740073656E6474617267657473002D700031302E34322E302E3733
type=SYSCALL msg=audit(1685717897.278:1612): arch=c000003e syscall=83 success=no exit=-13 a0=55b0c1e7f590 a1=1f8 a2=ffffffffffffff00 a3=0 items=0 ppid=55197 pid=55730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iscsiadm" exe="/usr/sbin/iscsiadm" subj=system_u:system_r:iscsid_t:s0 key=(null)
type=AVC msg=audit(1685717897.278:1612): avc:  denied  { dac_override } for  pid=55730 comm="iscsiadm" capability=1  scontext=system_u:system_r:iscsid_t:s0 tcontext=system_u:system_r:iscsid_t:s0 tclass=capability permissive=0

Following the instructions at https://www.redhat.com/sysadmin/selinux-denial2, I was able to get more complete information about our denial:
[root@selinux-recreate-rocky-9 ~]# ausearch -m AVC -ts recent
...
----
time->Fri Jun  2 15:51:32 2023
type=PROCTITLE msg=audit(1685721092.234:3026): proctitle=697363736961646D002D6D00646973636F76657279002D740073656E6474617267657473002D700031302E34322E302E3733
type=PATH msg=audit(1685721092.234:3026): item=1 name="/var/lib/iscsi/nodes/iqn.2019-10.io.longhorn:test/<IP_ADDRESS>,3260,1" nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1685721092.234:3026): item=0 name="/var/lib/iscsi/nodes/iqn.2019-10.io.longhorn:test/" inode=4773183 dev=fc:01 mode=040600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:iscsi_var_lib_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1685721092.234:3026): cwd="/"
type=SYSCALL msg=audit(1685721092.234:3026): arch=c000003e syscall=83 success=no exit=-13 a0=56076778c590 a1=1f8 a2=ffffffffffffff00 a3=0 items=2 ppid=183514 pid=183836 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iscsiadm" exe="/usr/sbin/iscsiadm" subj=system_u:system_r:iscsid_t:s0 key=(null)
type=AVC msg=audit(1685721092.234:3026): avc:  denied  { dac_override } for  pid=183836 comm="iscsiadm" capability=1  scontext=system_u:system_r:iscsid_t:s0 tcontext=system_u:system_r:iscsid_t:s0 tclass=capability permissive=0

[root@selinux-recreate-rocky-9 ~]# ausearch -m AVC -ts recent
Jun  2 15:53:13 selinux-recreate-rocky-9 setroubleshoot[22979]: SELinux is preventing /usr/sbin/iscsiadm from using the dac_override capability. For complete SELinux messages run: sealert -l 92f9ce68-1390-4994-845c-f7e968d4d04b
Jun  2 15:53:13 selinux-recreate-rocky-9 setroubleshoot[22979]: SELinux is preventing /usr/sbin/iscsiadm from using the dac_override capability.#012#012*****  Plugin dac_override (91.4 confidence) suggests   **********************#012#012If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system#012Then turn on full auditing to get path information about the offending file and generate the error again.#012Do#012#012Turn on full auditing#012# auditctl -w /etc/shadow -p w#012Try to recreate AVC. Then execute#012# ausearch -m avc -ts recent#012If you see PATH record check ownership/permissions on file, and fix it,#012otherwise report as a bugzilla.#012#012*****  Plugin catchall (9.59 confidence) suggests   **************************#012#012If you believe that iscsiadm should have the dac_override capability by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'iscsiadm' --raw | audit2allow -M my-iscsiadm#012# semodule -X 300 -i my-iscsiadm.pp#012

[root@selinux-recreate-rocky-9 ~]# sealert -l 92f9ce68-1390-4994-845c-f7e968d4d04b
SELinux is preventing /usr/sbin/iscsiadm from using the dac_override capability.

*****  Plugin dac_override (91.4 confidence) suggests   **********************

If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system
Then turn on full auditing to get path information about the offending file and generate the error again.
Do

Turn on full auditing
# auditctl -w /etc/shadow -p w
Try to recreate AVC. Then execute
# ausearch -m avc -ts recent
If you see PATH record check ownership/permissions on file, and fix it,
otherwise report as a bugzilla.

*****  Plugin catchall (9.59 confidence) suggests   **************************

If you believe that iscsiadm should have the dac_override capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'iscsiadm' --raw | audit2allow -M my-iscsiadm
# semodule -X 300 -i my-iscsiadm.pp

Additional Information:
Source Context                system_u:system_r:iscsid_t:s0
Target Context                system_u:system_r:iscsid_t:s0
Target Objects                /var/lib/iscsi/nodes/iqn.2019-10.io.longhorn:test/
                              <IP_ADDRESS>,3260,1 [ capability ]
Source                        iscsiadm
Source Path                   /usr/sbin/iscsiadm
Port                          <Unknown>
Host                          selinux-recreate-rocky-9
Source RPM Packages           iscsi-initiator-
                              utils-<IP_ADDRESS>-3.git2a8f9d8.el9.x86_64
Target RPM Packages
SELinux Policy RPM            selinux-policy-targeted-38.1.11-2.el9_2.2.noarch
Local Policy RPM              selinux-policy-targeted-38.1.11-2.el9_2.2.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     selinux-recreate-rocky-9
Platform                      Linux selinux-recreate-rocky-9
                              5.14.0-162.12.1.el9_1.0.2.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Mon Jan 30 22:14:42 UTC 2023
                              x86_64 x86_64
Alert Count                   1030
First Seen                    2023-06-02 14:45:25 UTC
Last Seen                     2023-06-02 15:53:58 UTC
Local ID                      92f9ce68-1390-4994-845c-f7e968d4d04b

Raw Audit Messages
type=AVC msg=audit(1685721238.267:3099): avc:  denied  { dac_override } for  pid=189623 comm="iscsiadm" capability=1  scontext=system_u:system_r:iscsid_t:s0 tcontext=system_u:system_r:iscsid_t:s0 tclass=capability permissive=0

type=SYSCALL msg=audit(1685721238.267:3099): arch=x86_64 syscall=mkdir success=no exit=EACCES a0=565066f87590 a1=1f8 a2=ffffffffffffff00 a3=0 items=2 ppid=189090 pid=189623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=iscsiadm exe=/usr/sbin/iscsiadm subj=system_u:system_r:iscsid_t:s0 key=(null)

type=CWD msg=audit(1685721238.267:3099): cwd=/

type=PATH msg=audit(1685721238.267:3099): item=0 name=/var/lib/iscsi/nodes/iqn.2019-10.io.longhorn:test/ inode=4773183 dev=fc:01 mode=040600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:iscsi_var_lib_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0

type=PATH msg=audit(1685721238.267:3099): item=1 name=/var/lib/iscsi/nodes/iqn.2019-10.io.longhorn:test/<IP_ADDRESS>,3260,1 nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0

Hash: iscsiadm,iscsid_t,iscsid_t,capability,dac_override

Did you see this? @clemenko @galal-hussein

The root cause here is a bug in open-iscsi, which @derekbit and others correctly identified in #4988. The KB article we have for OKD lists three workarounds:

Upgrade your OKD to a newer version which is after 4.12.0-0.okd-2022-12-10.
Upgrade open-iscsi to a newer version including the fix of the permission issue if possible.
If in the existing non-working environment, applying dac_override using a local CIL via MachineConfig is also a workaround.

1 and 3 actually both do the same thing: add the dac_override capability to the iscsid_t SElinux role.
2 is the "correct" solution, and requires no SELinux modifications.
Unfortunately, while the upstream Fedora iscsi_initiator_utils package now points to a fixed version of open-iscsi, there is a patch within the RPM build that "undoes" the fix within a particular function. (The 0770 permissions from the fix are changed back to 0660 permissions, so the execute permission is lost, and dac_override is required.) Modifying this patch and rebuilding the iscsi-initiator-utils fixes the issue without SELinux work, as does building and installing open-iscsi instead of iscsi_initiator_utils. In the long term, we can likely get iscsi_initiator_utils fixed more completely. In the short term, we will probably continue to require an SELinux workaround.

@ejweber I was seeing the same problematic patch in upstream CentOS yesterday too https://gitlab.com/redhat/centos-stream/rpms/iscsi-initiator-utils/-/blob/c9s/0003-idbm_rec_write-seperate-old-and-new-style-writes.patch#L156-L174
I am wondering how do we create PR/issue to these upstream RPM. Any idea @clemenko ?

Observations
I am not the best at reading SELinux policies themselves, but I believe I understand now why updated RHEL/Rocky is broken and why the chcon -t container_file_t /usr/sbin/iscsiadm workaround works.
On a non-updated Rocky/RHEL node, there is NO rule to transition from the spc_t domain to the iscsid_t domain. We execute iscsiadm in the spc_t context, which has dac_override capabilities.
[root@selinux-recreate-rocky-9-2 ~]# yum list installed | grep 'container-selinux\|selinux-policy'
container-selinux.noarch             3:2.189.0-1.el9              @@commandline
selinux-policy.noarch                34.1.43-1.el9_1.1            @anaconda
selinux-policy-targeted.noarch       34.1.43-1.el9_1.1            @anaconda

[root@selinux-recreate-rocky-9-2 ~]# sesearch -T -s spc_t | grep iscsid
# empty

[root@selinux-recreate-rocky-9-2 ~]# sesearch -A -s spc_t -c capability -p dac_override
allow spc_t spc_t:capability { audit_control audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_broadcast net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config };

On an updated Rocky/RHEL node, there IS a rule to transition from the spc_t domain to the iscsid_t domain. We execute iscsiadm in the iscsid_t context (as we rightfully should), which does not have dac_override capabilities (as is appropriate).
[root@selinux-recreate-rocky-9 bin]# yum list installed | grep 'container-selinux\|selinux-policy'
container-selinux.noarch                    3:2.205.0-1.el9_2                @appstream
selinux-policy.noarch                       38.1.11-2.el9_2.2                @baseos
selinux-policy-targeted.noarch              38.1.11-2.el9_2.2                @baseos

[root@selinux-recreate-rocky-9 bin]# sesearch -T -s spc_t | grep iscsid
type_transition spc_t iscsid_exec_t:process iscsid_t;

[root@selinux-recreate-rocky-9 bin]# sesearch -A -s iscsid_t -c capability
allow iscsid_t iscsid_t:capability { dac_read_search ipc_lock net_admin net_raw sys_admin sys_module sys_nice sys_resource };

The chcon -t container_file_t /usr/sbin/iscsiadm workaround words because changing the context of /usr/sbin/iscsiadm to container_file_t disables the transition to the iscsid_t domain (there are essentially no transitions). This allows us to execute iscsiadm in the spc_t context with our dac_override capabilities intact.
The root user on either node can execute iscsiadm without issue because there is no rule on either system to transition from the unconfined_t to iscsiadm_t domain. The root user executes iscsiadm in the unconfined_t context, which, of course, has dac_override capabilities.
[root@selinux-recreate-rocky-9 bin]# sesearch -T -s unconfined_t | grep iscsid
# empty

[root@selinux-recreate-rocky-9 bin]# sesearch -A -s unconfined_t -c capability
allow unconfined_t unconfined_t:capability sys_module; [ secure_mode_insmod ]:False
allow unconfined_t unconfined_t:capability { audit_control audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_broadcast net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config };

Analysis
The updated container-selinux policies are correct. Unfortunately, they expose a bug in the RHEL/Rocky version of iscsi-initiator-utils and disable functionality that was working incorrectly before. As mentioned above, the long-term fix is to submit a patch to iscsi-initiator-utils upstream.
My preferred fix is actually the SELinux policy addition that grants iscsid_t the needed dac_override capability. It is clear what this does and why. OKD added an SELinux rule for this transition to its set of policies and it would be nice if RKE2 did as well to make Longhorn installation painless until the underlying issue is resolved.
The chcon -t container_file_t /usr/sbin/iscsiadm is not functionally different in my opinion. It still effectively grants us a dac_override capability (that we were always operating with before), but it obfuscates how exactly this is happening. It is also not necessarily permanent (a relabel operation will likely return the iscsiadm context to the "correct" one). However, we can likely add it to our iSCSI installation script and make it somewhat transparent.

Would it make sense for the rke2-selinux policy to add the dac_override then? I asked them the same question.

Since the Rocky 9 / RKE2 discussion has largely taken over this issue, I opened #6074 as a replacement for the original work.
@galal-hussein ended up making the change suggested by @clemenko to rke2-selinux. My analysis supports this decision, so we are good there. I want to accomplish the following things before we close this one out:

[ ] Get an upstream patch in for iscsi-initiator-utils (we can create an issue to track and eventually test it in downstream distros once it is out there).
[ ] Produce an updated KB.
[ ] Provide a DaemonSet that can automatically make the necessary change in non-RKE deployments if users want.

Agree as well on all three points! Getting the upstream package fixed is the ultimate goal. Should we use #5627 or #6074 as we move forward? @ejweber

Lets use this one (#5627) please.

After applied the iscsi selinux workaround: https://raw.githubusercontent.com/longhorn/longhorn/master/deploy/prerequisite/longhorn-iscsi-selinux-workaround.yaml, automated test cases can run and pass without a bunch of errors/failures.
Oracle 9.1 + k3s v1.27.1+k3s1 + selinux mode = enforcing: https://ci.longhorn.io/job/public/job/master/job/rhel/job/amd64/job/longhorn-tests-rhel-amd64/111/
Oracle 9.1 + rke2 v1.27.2+rke2r1 + selinux mode = enforcing: https://ci.longhorn.io/job/public/job/master/job/rhel/job/amd64/job/longhorn-tests-rhel-amd64/112/
Rockylinux 9.2 + k3s v1.27.1+k3s1 + selinux mode = permissive: https://ci.longhorn.io/job/public/job/master/job/rhel/job/amd64/job/longhorn-tests-rhel-amd64/113/
Rockylinux 9.2 + k3s v1.27.1+k3s1 + selinux mode = enforcing: https://ci.longhorn.io/job/public/job/master/job/rhel/job/amd64/job/longhorn-tests-rhel-amd64/114/
Rockylinux 9.2 + rke2 v1.27.2+rke2r1 + selinux mode = permissive: https://ci.longhorn.io/job/public/job/master/job/rhel/job/amd64/job/longhorn-tests-rhel-amd64/115/
Rockylinux 9.2 + rke2 v1.27.2+rke2r1 + selinux mode = enforcing: https://ci.longhorn.io/job/public/job/master/job/rhel/job/amd64/job/longhorn-tests-rhel-amd64/116/
RHEL 9.1 + k3s v1.27.1+k3s1 + selinux mode = permissive: https://ci.longhorn.io/job/public/job/master/job/rhel/job/amd64/job/longhorn-tests-rhel-amd64/117/
RHEL 9.1 + k3s v1.27.1+k3s1 + selinux mode = enforcing: https://ci.longhorn.io/job/public/job/master/job/rhel/job/amd64/job/longhorn-tests-rhel-amd64/118/
RHEL 9.1 + rke2 v1.27.2+rke2r1 + selinux mode = permissive: https://ci.longhorn.io/job/public/job/master/job/rhel/job/amd64/job/longhorn-tests-rhel-amd64/119/
RHEL 9.1 + rke2 v1.27.2+rke2r1 + selinux mode = enforcing: https://ci.longhorn.io/job/public/job/master/job/rhel/job/amd64/job/longhorn-tests-rhel-amd64/120/


How to add Multiple tabs?

I want to add 4 tabs for a screen.i can do 1st and second tab successfully but it doesn't show anything for next tab.Instead of using with same code.Please help me how to do?
Thanks in advance.

See CustomerDialog, it has 3 tabs and no problems.

I am doing the same according to  customer .but still its not working.
In console it show the error "Failed to load resource: the server responded with a status of 404 (Not Found)"

What is the URL

http://localhost:55555/fonts/fontawesome-webfont.woff2?v=4.4.0

This is irrelevant. Just a font file.

yeah...that's the my point.
I am following the same code.But Still it doesn't work.
Ok I will tell u step by step what i have done  then u correct me where I am going  wrong
First i have added Template file in web
then add file to show column in that tab
In Script Project
I have Added a Dialog & grid  file
then in master file give call to the tab as it is done in customer

Open a gist with your template and script files

Hello Sir,I have shared my template & script files on gist.
Please do needful.
Thanks in Advance.

Could you share a link to your gist, how can i see your gist otherwise :)

https://gist.github.com/nilimajagtap

Make it public or share the link to gist

i  have make it public.Could u please check

Why TabSectionDetail div inside the TabSection????

By mistake I have putted.Now its working absolutely fine.
Thanks for quick replay.
Always greatful :)


.net 6

Just for trigger Action

Codecov Report

Merging #1 (1b770fe) into develop (27fb109) will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##           develop        #1   +/-   ##
=========================================
  Coverage   100.00%   100.00%
=========================================
  Files            5         5
  Lines          224       224
=========================================
  Hits           224       224

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.


Fix a styling issue on iOS/iPadOs

Related issue: https://github.com/cdr/code-server/issues/2247
So, instead of using button elements( including input[type="submit"])  directly on page, I added a label element which preserved the style while remaining the same functionality.
Before

After

Over all, not a big problem but still, an improvement.

Hi @jw-12138, thanks for reporting this bug and contributing. ❤
I've opened https://github.com/cdr/code-server/pull/2339 with your commit included for credits but a simpler fix applied where we just disable webkit's native input styles.


Application to other schedulers

Hi @inbarhub
First of all thanks for a very good and interesting paper, really enjoyed reading.
I wonder if it's possibly to apply the derived noise maps to schedulers other than DDPM/DDIM? For example have you tried substituting the noise maps in Euler Ancestral sampler? Since ddim/ddpm in general seems to produce lower quality results/requires larger number of steps

Hi @inbarhub First of all thanks for a very good and interesting paper, really enjoyed reading.
I wonder if it's possibly to apply the derived noise maps to schedulers other than DDPM/DDIM? For example have you tried substituting the noise maps in Euler Ancestral sampler? Since ddim/ddpm in general seems to produce lower quality results/requires larger number of steps

Hi @bonlime, Have you tried that? It seems that null-text inversion uses DDIM with predictoin = 'epsilon'. I am not sure if null-text inversion suppprts other options. I am curious as well

@daiqing-qi
No, I ended up not trying this paper. You're right that null-text uses DDIM inversion with prediction "epsilon", but I haven't yet seen the correct version of DDIM inversion. There is on in 🤗 diffusers, but it's incorrect and no one cares about it. I tried reimplementing it myself, it's more correct, but the math is still slightly off.
This is a proof that DDIM inversion in 🤗 is incorrect. With 0.5 strength going to noise from image (1) and back results in image (2) which looses saturation. My implementation results in image (3), which looks better at first
(1)

(2)

(3)

But after applying the inversion on the same image for multiple times 🤗  results in image (4) and my version in image (5) which shows that it's also incorrect but in different direction. The DPM++ inverted scheduler in 🤗  suffers from the same exact problems
(4)

(5)

@daiqing-qi No, I ended up not trying this paper. You're right that null-text uses DDIM inversion with prediction "epsilon", but I haven't yet seen the correct version of DDIM inversion. There is on in 🤗 diffusers, but it's incorrect and no one cares about it. I tried reimplementing it myself, it's more correct, but the math is still slightly off.
This is a proof that DDIM inversion in 🤗 is incorrect. With 0.5 strength going to noise from image (1) and back results in image (2) which looses saturation. My implementation results in image (3), which looks better at first (1)  (2)  (3)
But after applying the inversion on the same image for multiple times 🤗 results in image (4) and my version in image (5) which shows that it's also incorrect but in different direction. The DPM++ inverted scheduler in 🤗 suffers from the same exact problems (4)  (5)

Hi @bonlime, thanks for you reply! It is very helpful. I think applying the inversion on the same image for multiple times leads to another image is reasonable as the inversion only makes the reconstructed image look similar, while the invisible erroes can accumulate. May I ask if you could share your code/implementation of the DDIM Inversion? Thanks!

Hi,
From the equation of "Euler Ancestral", it seems that you can extract the noise in the same way we did in DDPM. However, we haven't tried this.


Edit filter closes category

Very minor, but create a custom filter that has variants in it. Then edit the filter. The category closes (hiding the passing variants) and reopens when modal is closed. A little weird

If you edit the filter and cancel, the category remains closed. Seems like we should just leave the category open throughout


core: BodyNodes re-implementation

See https://github.com/orgs/stroeer/teams/api/discussions/1

We won't refactor the body for now.


Deposit form: Permissions never get reevaluated after initial page load

Package version (if known): v12 and v13dev
The deposit page passes around permissions as props to some components, which may render differently (e.g. as disabled) based on the permissions.
Currently, those permissions are never updated in the frontend except for during initial page load.
This shouldn't be an issue for the current "vanilla" InvenioRDM workflow, but it may be an issue with some customized workflows.
E.g. if some action on the deposit form changes the permissions (say, the user provided a community to submit the record to), then those changes aren't reflected in the system until the page is reloaded.

Related issue: https://github.com/inveniosoftware/invenio-app-rdm/issues/2854


Can we label already downloaded imagery with the custom labels ?

I have an imagery (in geotiff) and have a separate geojson to label the image.Kindly guide how can I use these two as inputs for label-maker to create npz file.I do not wish to use OSM data as I already have the data in geotiff  and label in geojson.

Yes, you can specify the geojson parameter and skip the label-maker download step

I am trying to create labels but unfotunately it is not able to find the path,I have checked the path there is no issue with path.
(base) C:\Users\SHUBHAM>label-maker labels --dest U:\new_pune\pune_1 --config U:\pune_config.json
Traceback (most recent call last):
  File "C:\Users\SHUBHAM\Anaconda3\Scripts\label-maker-script.py", line 9, in <module>
    sys.exit(cli())
  File "C:\Users\SHUBHAM\Anaconda3\lib\site-packages\label_maker\main.py", line 104, in cli
    make_labels(dest_folder=dest_folder, sparse=sparse, **config)
  File "C:\Users\SHUBHAM\Anaconda3\lib\site-packages\label_maker\label.py", line 84, in make_labels
    mbtiles_file_zoomed, filtered_geo])
  File "C:\Users\SHUBHAM\Anaconda3\lib\subprocess.py", line 488, in run
    with Popen(*popenargs, **kwargs) as process:
  File "C:\Users\SHUBHAM\Anaconda3\lib\subprocess.py", line 800, in __init__
    restore_signals, start_new_session)
  File "C:\Users\SHUBHAM\Anaconda3\lib\subprocess.py", line 1207, in _execute_child
    startupinfo)
FileNotFoundError: [WinError 2] The system cannot find the file specified

This is my json file :
{
  "country": "india",
  "bounding_box": [1.09725, 6.05520, 1.34582, 6.30915],
  "geojson":"E:\\pune_corp\\labels.geojson",
  "zoom":19,
  "classes": [{ "name": "schools","filter":["has"]}],
  "imagery": "E:\\part1_cog.tif",
  "background_ratio": 1,
  "ml_type": "object-detection"
}

@shubhamsharma1609 can you try the paths with single slashes (rather than double)?

Getting this error :
Traceback (most recent call last):
  File "C:\Users\SHUBHAM\Anaconda3\Scripts\label-maker-script.py", line 9, in <module>
    sys.exit(cli())
  File "C:\Users\SHUBHAM\Anaconda3\lib\site-packages\label_maker\main.py", line 73, in cli
    config = json.load(open(args.get('config')))
  File "C:\Users\SHUBHAM\Anaconda3\lib\json\__init__.py", line 296, in load
    parse_constant=parse_constant, object_pairs_hook=object_pairs_hook, **kw)
  File "C:\Users\SHUBHAM\Anaconda3\lib\json\__init__.py", line 348, in loads
    return _default_decoder.decode(s)
  File "C:\Users\SHUBHAM\Anaconda3\lib\json\decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "C:\Users\SHUBHAM\Anaconda3\lib\json\decoder.py", line 353, in raw_decode
    obj, end = self.scan_once(s, idx)
json.decoder.JSONDecodeError: Invalid \escape: line 4 column 16 (char 95)

Invalid escape.

@shubhamsharma1609 unfortunately I don't have access to a Windows machine to debug this. Can you check anything related to not finding the path (file permissions, file name, spaces, case, etc)?

I am checking that.Also, I am utilising the geojson file having mutlipolygon but as per the documentation it is mentioned that only polygon should be there. Can you please guide how I can package this as .npz for creation of npz file as per label maker or any other approach ?

@shubhamsharma1609 you can convert the MultiPolygon into a FeatureCollection of Polygons

I am running in linux and getting the following error. Even when the geojson is supplied at the right path now it is giving bounding box error.Whereas in the documentation it is given as that the bounding box and country will be overridden by the geojson. Please help.
(env) abc@linux:~/Downloads$ label-maker labels --config pune_config.json
Determining labels for each tile
Traceback (most recent call last):
  File "/home/abc/miniconda3/envs/env/bin/label-maker", line 10, in <module>
    sys.exit(cli())
  File "/home/abc/miniconda3/envs/env/lib/python3.8/site-packages/label_maker/main.py", line 104, in cli
    make_labels(dest_folder=dest_folder, sparse=sparse, **config)
  File "/home/abc/miniconda3/envs/env/lib/python3.8/site-packages/label_maker/label.py", line 89, in make_labels
    tilereduce(dict(zoom=zoom, source=mbtiles_to_reduce, bbox=bounding_box,
  File "/home/abc/miniconda3/envs/env/lib/python3.8/site-packages/tilepie/__init__.py", line 21, in tilereduce
    tiles = tm.tileslist(bbox=options.get('bbox'), zoomlevels=[zoom])
  File "/home/abc/miniconda3/envs/env/lib/python3.8/site-packages/tilepie/reader.py", line 68, in tileslist
    return proj.tileslist(bbox)
  File "/home/abc/miniconda3/envs/env/lib/python3.8/site-packages/tilepie/proj.py", line 106, in tileslist
    raise InvalidCoverageError(_("Wrong format of bounding box."))
tilepie.proj.InvalidCoverageError: Wrong format of bounding box.

which version of label-maker are you using?

label-maker 0.8.0. Also,my geojson is a feature collection only.

If you have non-polygon features, you'll need to update to 0.9.0 (just released)

The geojson consists of multi polygons in the form of feature collection.

The geojson file which I have is created from the groundwork tool from  azavea and I am using the same geojson file to create labelled dataset https://github.com/developmentseed/label-maker/issues/32 and I am unable to generate custom labels for the local file.

Can you upgrade to 0.9.0 and show me the geojson file + config.json?


scanBleDevices causes memory leak

Summary
Doing a basic scan of ble devices causes a memory leak despite ending the scan subscription at onStop().
Library version
1.10.1
Preconditions
Have sample app cloned & loaded: https://github.com/seljabali/rxandroidble2-leak
Steps to reproduce actual result
1. Enable Bluetooth on device
2. Enable GPS
3. Open app
4. Hit back button
5. Pull system drop down
6. Wait for Canary to analyze heap
7. Canary momentarily shows leak.
Actual result

Canary showing a memory leak

Expected result

Canary not showing a memory leak

Minimum code snippet reproducing the issue
scanDisposable = RxBle.get()
    .scanBleDevices(
        ScanSettings.Builder()
            .setScanMode(ScanSettings.SCAN_MODE_LOW_LATENCY)
            .setCallbackType(ScanSettings.CALLBACK_TYPE_ALL_MATCHES)
            .build()
    )
    .subscribeOn(Schedulers.io())
    .observeOn(AndroidSchedulers.mainThread())
    .doOnError {
        onScanError() // commenting this out stops leak
    }
    .doOnNext {
    }
    .subscribe()

Logs from the application running with settings:
https://github.com/seljabali/rxandroidble2-leak/blob/master/leakLog.txt

What device/OS have you tested on?

What device/OS have you tested on?

Samsung Galaxy S8

What OS version?

What OS version?

Oreo: 8.0, Api: 26

Correct me if I am wrong but it seems that the root-cause of the leak is
2019-09-04 18:25:36.760 20056-20556/com.seljabali.rxandroidble2leak D/LeakCanary: ┬
2019-09-04 18:25:36.760 20056-20556/com.seljabali.rxandroidble2leak D/LeakCanary: ├─ android.bluetooth.le.BluetoothLeScanner$BleScanCallbackWrapper
2019-09-04 18:25:36.760 20056-20556/com.seljabali.rxandroidble2leak D/LeakCanary: │    Leaking: UNKNOWN
2019-09-04 18:25:36.760 20056-20556/com.seljabali.rxandroidble2leak D/LeakCanary: │    GC Root: Global variable in native code
2019-09-04 18:25:36.760 20056-20556/com.seljabali.rxandroidble2leak D/LeakCanary: │    ↓ BluetoothLeScanner$BleScanCallbackWrapper.mScanCallback

Which is a part of Android OS — not library's?

I have looked through the classes that are referenced by the trace but all of those should be garbage collected normally with their Observable chains. I do not see anything leaking in either ScanOperationApi21 (which is held by the OS) nor in FIFORunnableEntry which is held because the operation is not collected.

Hey @dariuszseweryn. I've updated the project to target Q/Api29. In testing on an S8 using Android 9, I found that the ScanCallBack doesn't leak however the Rx implementation does leak. For convenience, I've created side by side fragments between the two implementations on the github project to easily switch between the two in its MainActivity.

 I will try to run it once I will get my hands on an API 29 device.

Update — I have tested on Android 10, API 29 Google Pixel device and the problem seems to be fixed without any changes to the library. Closing. Thank you for the report.
(...)
2019-11-04 14:02:09.774 12741-12741/com.seljabali.rxandroidble2leak I/RxBle#Client: ScanResult{bleDevice=RxBleDeviceImpl{MAC='XX:XX:XX:XX:XX:XX', name=null}, rssi=-74, timestampNanos=2181930517163897, callbackType=CALLBACK_TYPE_ALL_MATCHES, scanRecord=[...]}
2019-11-04 14:02:09.880 12741-12741/com.seljabali.rxandroidble2leak I/RxBle#Client: ScanResult{bleDevice=RxBleDeviceImpl{MAC='XX:XX:XX:XX:XX:XX', name=null}, rssi=-73, timestampNanos=2181930584983644, callbackType=CALLBACK_TYPE_ALL_MATCHES, scanRecord=[...]}
2019-11-04 14:02:09.889 12741-12784/com.seljabali.rxandroidble2leak I/RxBle#CancellableDisposable: Scan operation is requested to stop.
2019-11-04 14:02:09.891 12741-12784/com.seljabali.rxandroidble2leak D/BluetoothAdapter: isLeEnabled(): ON
2019-11-04 14:02:15.107 12741-12777/com.seljabali.rxandroidble2leak D/LeakCanary: Checking retained object because app became invisible
2019-11-04 14:02:15.109 12741-12777/com.seljabali.rxandroidble2leak D/LeakCanary: No retained objects

Hello !
Sorry I reopen this issue but I think that this leak is not fixed. I got the same problem in my code.
I did some investigations with my own code linked to this leak.
I am using the version 1.10.5 of the library and Android 10 on a OnePlus 6.
I got the following leak trace : https://gist.github.com/LeMimit/f532873e8c891ed4d89d874276c9441f
This is basically the same as the previous comment. Starting with BleScanCallbackWrapper.
I cloned the code at https://github.com/seljabali/rxandroidble2-leak. With ScanCallBackBleFragment using the vanilla API, I have indeed no leak, but I got one using ScanRxBleFragment which is using library API.
May be this is linked to the fact that in the library in ScanOperation:
final SCAN_CALLBACK_TYPE scanCallback = createScanCallback(emitter);

The emitter is used in the callback which keep a reference. The same emitter is subscribed in the fragment which keep a reference to the Fragment itself. When the fragment is destroyed we have a leak.
Thanks !

Hello everyone,
Is there any updates about this leak? I do have the same leak happening on Android 9 using RX?
Thanks

Hello,
I've created a PR with a solution to the issue
https://github.com/Polidea/RxAndroidBle/pull/708
Hope it can be merged soon


{% highlight %} produces "Liquid error: undefined method `join' for..."

Wherever I have used {% highlight %}  I am getting the following error:
"Liquid error: undefined method 'join' for..."
This is on Jekyll v0.11.0

Hey, would you mind indicating why you closed this issue? Did you resolve it?

Unfortunately my only resolution at the moment is to revert to an older version of Liquid.  The reason I closed it is that it is a duplicate of Issue #422.  I didn't spot this when I opened it because of the default filter that was being applied.


docs: update changelogs

Description

add missing link to CHANGELOG.md
add changelog v4.3.1
remove empty secitons in the past changelog

Checklist:

[x] Securely signed commits
[] Component(s) with PHPDoc blocks, only if necessary or adds value
[] Unit testing, with >80% coverage
[x] User guide updated
[] Conforms to style guide

Ah, it was just not updated.
Fixed.


Skeleton rows for data tables

Summary
An option to show a skeleton representation of a row in a data table is needed so that individual rows can be set to a loading status, new content structure can be displayed whilst loading.
💰 User value
Provides option to display rows in a data table that have yet to load or are updating.
📚 User Stories
If relevant, describe the high-level functionality as user stories.
As an ICDS user:
I need a skeleton representation of a data table row
So that the row structure can be displayed whilst loading or updating.
📝 Acceptance Criteria
If relevant, describe in full detail the different interactions and edge cases that the component or patterns needs to fulfil.
Given that a table row exists
When setting its properties
Then an option exists to show it as a skeleton.
Given that a table exists
When setting the table properties
Then it can be set to show as skeleton which displays all rows as skeletons.
✏ Designs
If there's a Figma design file (or other mock-up), include it here.
## 🧾 Guidance
If there's written guidance or documentation, include it here.

discussed implementing by having a (@internal) prop to turn on this mode


Backup labels in list-backup command broken?

All backup labels are same as the first one in list-backup command:
./pgmoneta-cli -c pgmoneta.conf list-backup primary
Server           : primary
Number of backups: 3
Backup           :
<PHONE_NUMBER>2708 (Backup: 8.7 MB Restore: 60.8 MB WAL: 80 MB Delta: 0 Retain: No Valid: Yes)
<PHONE_NUMBER>2708 (Backup: 5.0 MB Restore: 60.8 MB WAL: 80 MB Delta: 0 Retain: No Valid: Yes)
<PHONE_NUMBER>2708 (Backup: 5.0 MB Restore: 60.8 MB WAL: 80 MB Delta: 0 Retain: No Valid: Yes)

The build is the latest commit on main branch.
System info: "Linux  6.6.31-linuxkit aarch64 GNU/Linux" Ubuntu 24.04

I am running pgmoneta on Ubuntu 24.04 on a VM running on MacOS 13.5

Thanks for bringing this up. We are working on new manifest feature and I might have broken something. This should be fixed in the next patch.

Can you pull and check? @shikharish

Fixed. Thanks.


test env for bcdb backend

procedure

install js-ng using pip3 mechanism (osx/linux)
call a test script which reserves 2 ubuntu containers
register 2 identities to TF explorer, see https://github.com/threefoldtech/home/issues/803
build zdb/bcdb backend/crystal tools over SSH
start zdb/bcdb with ct tmux...
build a crystal test script which calls the bcdb and does a flow like would be used for chat message

store msgA on bcdbA/zdbA, gets a unique id back (give 3bot_B access (read only))
call bcdbB ask for 3botA_ID/msgid, message should come back
when script asks bcdbA using 3botBID it should fail
do some store of msg where we use a name index field to retrieve value (search)

I was also thinking about this. We should indeed have an easy way to test BCDB at scale with plenty of users.
I think the test plan above is a good start, we should probably make it a bit more detail but we can start by that.
I also want to point out that for basic functionality testing, bcdb have a flag where you can pass a peer list from a file to do some fast/easy testing. See https://github.com/threefoldtech/bcdb/tree/master/docs#peer-2-peer
With this you can run multiple BCDB on a single machine and make fast progress.


Create agsb.txt

This adds Altrincham Grammar School for Boys to the list of supported schools.
The sixth form offers a computer science A-Level which runs for 2 years. https://agsb.co.uk/media/95899/sixth-form-2019-20-prospectus-oct-19-20-final-version-aj.pdf. Page 20 details the course's content.

@Gobot1234 Pull request merged. Thank you!


Missing "default" argument from askYesNo

Installation information

jumpscale version: Jumpscale 9
operating system: Ubuntu 17

Detailed description
askYesNo when called by the AYS server it is given the arguments: message and default, only message is defined.
Steps to reproduce
Execute following AYS command:
ays action install -a {actorName}

Relevant stacktraces
File "/usr/local/bin/ays", line 6, in <module>
    exec(compile(open(__file__).read(), __file__, 'exec'))
  File "/opt/code/github/jumpscale/ays9/cmds/ays", line 673, in <module>
    cli()
  File "/opt/code/github/jumpscale/ays9/cmds/ays", line 658, in action
    resp = j.tools.console.askYesNo('Do you want to execute this action block ?', True)
TypeError: askYesNo() takes from 1 to 2 positional arguments but 3 were given
askYesNo() takes from 1 to 2 positional arguments but 3 were given

Fixed by https://github.com/Jumpscale/core9/commit/47a38e779da36815cbe3dd2f4e62a4bd2dd6456b thank you


tests: move pytest config to setup.cfg, use --pdbcls=pdb:pdb.Pdb

Codecov Report

Merging #179 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #179   +/-   ##
=======================================
  Coverage   63.41%   63.41%
=======================================
  Files           3        3
  Lines        1733     1733
  Branches      159      159
=======================================
  Hits         1099     1099
  Misses        580      580
  Partials       54       54

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9e79a48...cb8dc3d. Read the comment docs.


Error during WebSocket handshake: Unexpected response code: 502

Getting this error when trying to connect to a secure websocket with wss://chatws.mydomain.com but it works fine with ws://chatws.mydomain.com. Https is correctly configured for the app. I assume this is an issue with Nginx configuration? dokku logs someapp indicates that nginx never actually forwards the request to my app when using the wss scheme.
root@d:~# nginx -v
nginx version: nginx/1.8.0
root@d:~# dokku version
v0.3.18
root@d:/home/dokku/chatws# cat nginx.conf
server {
  listen      [::]:80;
  listen      80;
  server_name chatws.mydomain.com ;
  location    / {
    proxy_pass  http://chatws;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection upgrade;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Port $server_port;
    proxy_set_header X-Request-Start $msec;
  }
  include /home/dokku/chatws/nginx.conf.d/*.conf;
}
upstream chatws { server <IP_ADDRESS>:5000; }

That nginx conf doesn't appear to have ssl support, so secure web sockets wouldn't work.

Here is an example configuration that works.

@olalonde any luck getting ^ to work?

Yes thanks I had indeed forgotten to setup ssl for some reason.


Canvas Resize

Thanks so much for this angular version. Any idea on how to get this portion to work?
var wrapper = document.getElementById("signature-pad"),
    canvas = wrapper.querySelector("canvas"),
    signaturePad;

// Adjust canvas coordinate space taking into account pixel ratio,
// to make it look crips on mobile devices.
// This also causes canvas to be cleared.
function resizeCanvas() {
    var ratio =  window.devicePixelRatio || 1;
    canvas.width = canvas.offsetWidth * ratio;
    canvas.height = canvas.offsetHeight * ratio;
    canvas.getContext("2d").scale(ratio, ratio);
}

window.onresize = resizeCanvas;
signaturePad = new SignaturePad(canvas);

I do this, it's not beatiful but it works for me:
canvasWidth = if canvas.offsetWidth != 0 then canvas.offsetWidth else $('.canvas-container').width() # I use the width of the div which contains the canvas
canvasHeight = if canvas.offsetHeight != 0 then canvas.offsetHeight else 116 # I hardcode this because my signature must always have the same height.

canvas.width = canvasWidth * ratio
canvas.height = canvasHeight * ratio

Any chance you could update your main repo with how to make the canvas responsive?
The comment above makes no sense to me. I'm reluctant to do Javascript when a pure AngularJS solution should work.
No matter what size I set the CSS of the Canvas, it always stretches it without redrawing the available area.

Don't forget that when defining the size of a canvas element, there are two sizes, html and css. You have to define the html size of the canvas.
By the way, I improved my solution. It has some js, btw, maybe you don't like it...
The key is knowing the size of the canvas container element. Whenever the window is resized, I call the code below, so the canvas recalculates and resizes accordingly and the content is loaded again.
ratio = window.devicePixelRatio || 1
canvasWidth = if canvas.offsetWidth != 0 then canvas.offsetWidth else $('.canvas-container').width()

aspectRatio = 2.5 # Just because I want this ratio
canvasHeight = canvas.offsetWidth / aspectRatio
$('.canvas-container').css('height', "#{$('.canvas-container').width() / aspectRatio}px")

canvas.width = canvasWidth * ratio
canvas.height = canvas.width / aspectRatio

canvas.getContext("2d").scale(ratio, ratio)
# Some code to load the content of the canvas again


Make "version" field of DataModelId optional

The retrieve data models endpoint does not require the version field in the request, so I believe it should be optional in the DataModelId as well.
(This PR also includes fixes for some minor cargo clippy warnings.)

Thanks for this. However, looking at the API docs, it still says required. So we could probably still adhere to the docs.🙂

@toondaey Thanks for reviewing! Yes, version is required for DatamodelCreate (what you're referring to), but it is optional for the /byids endpoint (what I believe @frxstrem is referring to).

As this might be a breaking change, perhaps we want to bump the SDK version accordingly?

Thanks for this. However, looking at the API docs, it still says required. So we could probably still adhere to the docs.🙂

The create data models endpoint uses a different data type where the version field is still required:
https://github.com/cognitedata/cognite-sdk-rust/blob/75caa7927814aaf7d5e9e0a78b8ac2d7401ca167/cognite/src/api/data_modeling/data_models.rs#L16
https://github.com/cognitedata/cognite-sdk-rust/blob/75caa7927814aaf7d5e9e0a78b8ac2d7401ca167/cognite/src/dto/data_modeling/data_models.rs#L9-L19
But for the retrieve endpoint (which I linked in the PR description) it does say that version is optional.

My bad! That should've been obvious when I didn't see the other fields. I suppose as @niekbeckers suggested, considering this will be a breaking change, a version bump would be appropriate here.

@toondaey I bumped the version, is the PR in an approvable state now?


Cannot upload mission to Intel Aero

I am unable to upload a .plan mission file to the Intel Aero
Running Beta 1.8.0
QGC stable:

QGC Daily

persistent error message:
Mission transfer failed. Retry transfer. Error: Vehicle returned error: Unspecified error (MAV_MISSION_ERROR).

it seems i hit the upper limit on allowed waypoints as a shorter 31 waypoint mission file can be uploaded without issue

new issue with mission upload broken despite number of waypoints running current master #9984


Clarify the rule for leading trivia

Just a wording clarification for internal libsyntax docs

@swift-ci please smoke test

Thanks @matklad! Welcome to the Swift project :smile:

Not your issue.
@swift-ci please smoke test

Thanks, @matklad!


Fix Issue #11: Implement Manhattan Heuristic

I have added the Manhattan heuristic in utils.py
Also note a small change in the type of state; changed it from ShortestPathSearchProblem to ShortestPathState

Looks good! thanks


CLOUD-42526 add read only scopes of resources to security config

Please review @schfeca75 !
Makes Cloudbreak handle new read-only scopes on resources' endpoints and try to validate all possible URL patterns with scopes.

Jenkins build finished, all tests passed.
Refer to this link for build results: http://ci.sequenceiq.com/job/cloudbreak-pull-request/1728/

Jenkins build finished, all tests passed.
Refer to this link for build results: http://ci.sequenceiq.com/job/cloudbreak-pull-request/1731/


Failing scheduled task - task() takes 0 positional arguments but 5 were given

Task scheduler seems to be creating tasks incorrectly. On creating a Scheduled task with no positional or keyword arguments, when the task is published, the value is as follows:
[0, 'default', '', 'default', {}]

this seems to be the priority, queue, exchange, routing key and keyword arguments parameters. Only the very last item in the above list should be getting passed to the function

This is happening because the publish() method of the ScheduledTask object was not update to reflect the changed signature of the publish_message() function


Phantom crashes when clicking button

This is related to teampoltergeist/poltergeist/issues/548 but I am not sure who can help me so crossposting here.
I have no idea what to do about the crash dump since I am on mac os x but like I mentioned in the poltergeist issue selenium handles clicking the button just fine.

I hit the same symptoms on Linux. There's a crash dump report in issue #13055

Please upgrade to PhantomJS 2. 1.9.x is no longer supported, and known to have many crasher bugs that are fixed in 2 version.

This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a temporary error. The following address(es) deferred:
<EMAIL_ADDRESS>Domain castonguay.org has exceeded the max emails per hour (200/200 (100%)) allowed.  Message will be reattempted later
------- This is a copy of the message, including all the headers. ------
Received: from github-smtp2-ext3.iad.github.net ([<IP_ADDRESS>]:47929 helo=github-smtp2b-ext-cp1-prd.iad.github.net)
by server191.web-hosting.com with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.86_1)
(envelope-from<EMAIL_ADDRESS>id 1apkMe-003Gt6-Cg
for<EMAIL_ADDRESS>Mon, 11 Apr 2016 18:31:25 -0400
Date: Mon, 11 Apr 2016 15:30:44 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com;
s=pf2014; t=1460413844;
bh=uHYyTf3UlwHk599O4/GIqOusAoTJK7xZngXr0KCtjKI=;
h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID:
List-Archive:List-Post:List-Unsubscribe:From;
b=CROLjIEUCy8cjEGCxpqwEcFBokhvwjlxiCypBgFezD9L1lIhFRFexgEL/wvknhWJU
epBUHhR6BHVxD3asbBofLsudACzTaomZ7FMT5fjAX4gHeS1oI8dyr1B4FSPUMflv3I
mw2NyOT1A8nN2Q5RIXND9Y+NvnTmqyDO4ziIsHo8=
From: Vitaly Slobodin<EMAIL_ADDRESS>Reply-To: ariya/phantomjs<EMAIL_ADDRESS>To: ariya/phantomjs<EMAIL_ADDRESS>Message-ID<EMAIL_ADDRESS>In-Reply-To<EMAIL_ADDRESS>References<EMAIL_ADDRESS>Subject: Re: [ariya/phantomjs] Phantom crashes when clicking button (#12699)
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="--==_mimepart_570c2594183e5_40c13fc57f4ed2a0271123";
charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: Vitallium
X-GitHub-Recipient: dREc
List-ID: ariya/phantomjs <phantomjs.ariya.github.com>
List-Archive: https://github.com/ariya/phantomjs
List-Post<EMAIL_ADDRESS>List-Unsubscribe<EMAIL_ADDRESS>https://github.com/notifications/unsubscribe/AAF3ujBuyaKd3IE4KhzP_nKA4Qz2K3P4ks5p2suUgaJpZM4C2CLN
X-Auto-Response-Suppress: All
X-GitHub-Recipient-Address<EMAIL_ADDRESS>X-Spam-Status: No, score=-3.5
X-Spam-Score: -34
X-Spam-Bar: ---
X-Ham-Report: Spam detection software, running on the system "server191.web-hosting.com",
has NOT identified this incoming email as spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
root@localhost for details.
Content preview:  Please upgrade to PhantomJS 2. 1.9.x is no longer supported,
and known to have many crasher bugs that are fixed in 2 version. --- You
are receiving this because you are subscribed to this thread. Reply to this
email directly or view it on GitHub: https://github.com/ariya/phantomjs/issues/12699#issuecomment-208593376
[...]
Content analysis details:   (-3.5 points, 5.0 required)
pts rule name              description

0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: github.com]
-5.0 RCVD_IN_DNSWL_HI       RBL: Sender listed at http://www.dnswl.org/, high
trust
[<IP_ADDRESS> listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3      RBL: Good reputation (+3)
[<IP_ADDRESS> listed in wl.mailspike.net]
1.6 HTML_IMAGE_ONLY_12     BODY: HTML: images with 800-1200 bytes of words
0.0 HTML_MESSAGE           BODY: HTML included in message
-0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
-0.0 RCVD_IN_MSPIKE_WL      Mailspike good senders
X-Spam-Flag: NO
----==_mimepart_570c2594183e5_40c13fc57f4ed2a0271123
Content-Type: text/plain;
charset=UTF-8
Content-Transfer-Encoding: 7bit
Please upgrade to PhantomJS 2. 1.9.x is no longer supported, and known to have many crasher bugs that are fixed in 2 version.

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/ariya/phantomjs/issues/12699#issuecomment-208593376
----==_mimepart_570c2594183e5_40c13fc57f4ed2a0271123
Content-Type: text/html;
charset=UTF-8
Content-Transfer-Encoding: 7bit
Please upgrade to PhantomJS 2. 1.9.x is no longer supported, and known to have many crasher bugs that are fixed in 2 version.
—You are receiving this because you are subscribed to this thread.Reply to this email directly or view it on GitHub

----==_mimepart_570c2594183e5_40c13fc57f4ed2a0271123--

This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a temporary error. The following address(es) deferred:
<EMAIL_ADDRESS>Domain castonguay.org has exceeded the max emails per hour (201/200 (100%)) allowed.  Message will be reattempted later
------- This is a copy of the message, including all the headers. ------
Received: from o1.sgmail.github.com ([<IP_ADDRESS>]:28678)
by server191.web-hosting.com with esmtps (TLSv1.2:DHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.86_1)
(envelope-from<EMAIL_ADDRESS>id 1apkMf-003Gu9-EO
for<EMAIL_ADDRESS>Mon, 11 Apr 2016 18:31:26 -0400
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=github.com;
h=from:reply-to:to:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe;
s=s20150108; bh=DnLWikXI+qCsLwa2IqmXxm6UP7g=; b=gGDtDE6+93iwgBWr
n96RaVBra3Ylf9Y9NDmi8Pp3gv/KBJLRyEHe9taKRer41jTuJujRhud9aofevNSQ
1/1ns7E9d7BMoqH2k+BFQtUf70SMdwLkcmEBc8ws/zGxOimr8kgiBebiQo58X5m4
iJqfJe9yoR8aGLjUFRJ93qNpSaE=
Received: by filter0915p1mdw1.sendgrid.net with SMTP id filter0915p1mdw1.14324.570C25941C
2016-04-11 22:30:44.364292448 +0000 UTC
Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [<IP_ADDRESS>])
by ismtpd0001p1iad1.sendgrid.net (SG) with ESMTP id 00EyWzpbRM647X3vnRYAuw
for<EMAIL_ADDRESS>Mon, 11 Apr 2016 22:30:44.291 +0000 (UTC)
Date: Mon, 11 Apr 2016 15:30:44 -0700
From: Vitaly Slobodin<EMAIL_ADDRESS>Reply-To: ariya/phantomjs<EMAIL_ADDRESS>To: ariya/phantomjs<EMAIL_ADDRESS>Message-ID<EMAIL_ADDRESS>In-Reply-To<EMAIL_ADDRESS>References<EMAIL_ADDRESS>Subject: Re: [ariya/phantomjs] Phantom crashes when clicking button (#12699)
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="--==_mimepart_570c259425623_40693fc57f4ed2a031838a";
charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: Vitallium
X-GitHub-Recipient: dREc
List-ID: ariya/phantomjs <phantomjs.ariya.github.com>
List-Archive: https://github.com/ariya/phantomjs
List-Post<EMAIL_ADDRESS>List-Unsubscribe<EMAIL_ADDRESS>https://github.com/notifications/unsubscribe/AAF3ujBuyaKd3IE4KhzP_nKA4Qz2K3P4ks5p2suUgaJpZM4C2CLN
X-Auto-Response-Suppress: All
X-GitHub-Recipient-Address<EMAIL_ADDRESS>X-SG-EID: CjWC6vIGLGo0uWsXQ9th+U0br113QN4BhNL8BXzrk7uIm8MCQ2KE6HiuVUCg9sjG3KVLRkqJEgzvZK
o/Foi/bNNol9g+G6dVlF8F/eHasWSFopOmjpiVlCGlq0Fots0ZAMCUZwfvgufSO2DKf6jT37oNR6P/
1qI1ivd97q2ttuAShmS/SCNkbxllM/G4/mdHvrU+NGQdD/zEaB3SLcWjMdIR9kSsJdkKS976/yL4AS
k=
X-Spam-Status: No, score=-0.2
X-Spam-Score: -1
X-Spam-Bar: /
X-Ham-Report: Spam detection software, running on the system "server191.web-hosting.com",
has NOT identified this incoming email as spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
root@localhost for details.
Content preview:  Closed #12699. --- You are receiving this because you are
subscribed to this thread. Reply to this email directly or view it on GitHub:
https://github.com/ariya/phantomjs/issues/12699#event-623249441 [...]
Content analysis details:   (-0.2 points, 5.0 required)
pts rule name              description

0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: github.com]
-0.7 RCVD_IN_DNSWL_LOW      RBL: Sender listed at http://www.dnswl.org/, low
trust
[<IP_ADDRESS> listed in list.dnswl.org]
-1.0 RP_MATCHES_RCVD        Envelope sender domain matches handover relay domain
1.6 HTML_IMAGE_ONLY_12     BODY: HTML: images with 800-1200 bytes of words
0.0 HTML_MESSAGE           BODY: HTML included in message
-0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
-0.0 RCVD_IN_MSPIKE_H3      RBL: Good reputation (+3)
[<IP_ADDRESS> listed in wl.mailspike.net]
-0.0 RCVD_IN_MSPIKE_WL      Mailspike good senders
X-Spam-Flag: NO
----==_mimepart_570c259425623_40693fc57f4ed2a031838a
Content-Type: text/plain;
charset=UTF-8
Content-Transfer-Encoding: 7bit
Closed #12699.

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/ariya/phantomjs/issues/12699#event-623249441
----==_mimepart_570c259425623_40693fc57f4ed2a031838a
Content-Type: text/html;
charset=UTF-8
Content-Transfer-Encoding: 7bit
Closed #12699.
—You are receiving this because you are subscribed to this thread.Reply to this email directly or view it on GitHub

----==_mimepart_570c259425623_40693fc57f4ed2a031838a--


Typescript Import function gets compiler error in Visual Studio

This question was first posted here: https://stackoverflow.com/questions/46827184/typescript-import-function-gets-compiler-error/46827260?noredirect=1#46827260
In my Typescript I am using the import function as described here:
https://github.com/Microsoft/TypeScript/issues/12933
So my code is like:
import("../myScriptToBeImported").then((module) => {this.dosomethingWithModule(module);             }).catch(this.doSomethingWithError.bind(this));
I am running this as part of an MVC project in Visual Studio with Webpack. Webpack compiles the Typescript without any errors and the project runs fine, yet for the above line the following errors are always shown in Visual Studio:

TS1128 (TS) Declaration or statement expected.
TS2391 (TS) Function implementation is missing or not immediately following the declaration.
TS7010 (TS) 'import', which lacks return-type annotation, implicitly has an 'any' return type.

I am using Typescript version 2.4.2. How can I get rid of these errors?
For information, my tsconfig file looks like this:
{   "compilerOptions": {     "module": "esnext",     "moduleResolution": "node",     "noEmitOnError": true,     "strict": true,     "removeComments": false,     "sourceMap": true,     "target": "es5",     "typeRoots": [       "node_modules/@types"     ],     "lib": [ "es6", "dom" ],     "baseUrl": ".",     "experimentalDecorators": true,     "emitDecoratorMetadata": true   },   "exclude": [     "node_modules",     "wwwroot"   ],   "compileOnSave": false,   "buildOnSave": false }

Use typescript@next which has support for this feature.

You should not need to install typescript@next. This feature was part of TS 2.4 release and<EMAIL_ADDRESS>should have it.
From the description above, VS is not using TS 2.4. can you share your project file?

Hi mhegazy - here is my csproj file:
<Project Sdk="Microsoft.NET.Sdk.Web">

    <PropertyGroup Label="Globals">
        <SccProjectName>SAK</SccProjectName>
        <SccProvider>SAK</SccProvider>
        <SccAuxPath>SAK</SccAuxPath>
        <SccLocalPath>SAK</SccLocalPath>
        <TypeScriptToolsVersion>Latest</TypeScriptToolsVersion>
    </PropertyGroup>

    <PropertyGroup>
      <TargetFramework>net462</TargetFramework>
    </PropertyGroup>

    <PropertyGroup>
      <!-- https://stackoverflow.com/questions/39176586/how-to-disable-typescript-compilation-in-net-core-projects -->
      <!-- Makes the TypeScript compilation task a no-op -->
      <TypeScriptCompileBlocked>true</TypeScriptCompileBlocked>
    </PropertyGroup>

    <ItemGroup>
      <EmbeddedResource Remove="Logging\**" />
    </ItemGroup>

    <ItemGroup>
      <None Remove="Areas\Ordering\Scripts\PatientIntake\intakeLayout.ts" />
      <None Remove="Scripts\Common\iocContainer.ts" />
    </ItemGroup>

    <ItemGroup>
        <PackageReference Include="AutoMapper" Version="6.1.1" />
        <PackageReference Include="AutoMapper.Extensions.Microsoft.DependencyInjection" Version="3.0.1" />
        <PackageReference Include="Microsoft.NETCore.Portable.Compatibility" Version="1.0.1" />
        <PackageReference Include="Microsoft.Extensions.Logging.Filter" Version="1.1.2" />
        <PackageReference Include="Microsoft.Extensions.Options" Version="2.0.0" />
        <PackageReference Include="Newtonsoft.Json" Version="<IP_ADDRESS>" />
        <PackageReference Include="IdentityModel" Version="2.10.0" />
        <PackageReference Include="IdentityServer4.AccessTokenValidation" Version="1.2.1" />
        <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.1.1" />
        <PackageReference Include="Microsoft.AspNet.SignalR" Version="2.2.2" />
        <PackageReference Include="Microsoft.AspNetCore" Version="2.0.0" />
        <PackageReference Include="Microsoft.AspNetCore.Authentication.Cookies" Version="2.0.0" />
        <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="2.0.0" />
        <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="2.0.0" />
        <PackageReference Include="Microsoft.AspNetCore.Owin" Version="2.0.0" />
        <PackageReference Include="Microsoft.AspNetCore.Rewrite" Version="2.0.0" />
        <PackageReference Include="Microsoft.AspNetCore.Session" Version="2.0.0" />
        <PackageReference Include="Microsoft.AspNetCore.StaticFiles" Version="2.0.0" />
        <PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="2.0.0" />
        <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="5.1.4" />
        <PackageReference Include="Microsoft.VisualStudio.Web.BrowserLink" Version="2.0.0" />
        <PackageReference Include="NLog" Version="5.0.0-beta09" />
        <PackageReference Include="NLog.Web" Version="4.5.0" />
        <PackageReference Include="NLog.Web.AspNetCore" Version="4.4.1" />
        <PackageReference Include="StyleCop.Analyzers" Version="1.1.0-beta004" />
        <PackageReference Include="Telerik.UI.for.AspNet.Core" Version="2017.3.913" />
    </ItemGroup>
    <ItemGroup>
        <DotNetCliToolReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Tools" Version="2.0.0" />
    </ItemGroup>
    <PropertyGroup>
        <CodeAnalysisRuleSet>$(SolutionDir)\Brightree.ruleset</CodeAnalysisRuleSet>
        <AssetTargetFallback>portable-net45+win8</AssetTargetFallback>
        <PostBuildEvent></PostBuildEvent>
        <UserSecretsId>a31e29fc-c241-499d-81f1-fc0e546093fe</UserSecretsId>
    </PropertyGroup>
    <ItemGroup>
        <AdditionalFiles Include="$(SolutionDir)\stylecop.json" />
    </ItemGroup>
    <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
        <TreatWarningsAsErrors>True</TreatWarningsAsErrors>
        <TreatSpecificWarningsAsErrors />
    </PropertyGroup>
    <ItemGroup>
        <Folder Include="Areas\ARManagement\Controllers\" />
    </ItemGroup>
    <ItemGroup>
      <TypeScriptCompile Include="Areas\Ordering\Scripts\PatientIntake\intakeLayout.ts" />
      <TypeScriptCompile Include="Scripts\Common\iocContainer.ts" />
    </ItemGroup>

    <ItemGroup>
      <Content Update="web.config">
        <CopyToOutputDirectory>Always</CopyToOutputDirectory>
      </Content>
    </ItemGroup>

    <ItemGroup>
      <None Update="nlog.config">
        <CopyToOutputDirectory>Always</CopyToOutputDirectory>
      </None>
      <None Update="web.Load.config">
        <CopyToOutputDirectory>Always</CopyToOutputDirectory>
      </None>
      <None Update="web.Master.config">
        <CopyToOutputDirectory>Always</CopyToOutputDirectory>
      </None>
      <None Update="web.Prod.config">
        <CopyToOutputDirectory>Always</CopyToOutputDirectory>
      </None>
      <None Update="web.QA.config">
        <CopyToOutputDirectory>Always</CopyToOutputDirectory>
      </None>
      <None Update="web.QAHot.config">
        <CopyToOutputDirectory>Always</CopyToOutputDirectory>
      </None>
      <None Update="web.StageA.config">
        <CopyToOutputDirectory>Always</CopyToOutputDirectory>
      </None>
      <None Update="web.StageB.config">
        <CopyToOutputDirectory>Always</CopyToOutputDirectory>
      </None>
      <None Update="web.StageC.config">
        <CopyToOutputDirectory>Always</CopyToOutputDirectory>
      </None>
    </ItemGroup>

    <ProjectExtensions>
       <VisualStudio><UserProperties appsettings_1Production_1json__JSONSchema="" Properties_4launchSettings_1json__JSONSchema="" appsettings_1QA_1json__JSONSchema="" appsettings_1json__JSONSchema="" package_1json__JSONSchema="" /></VisualStudio>
    </ProjectExtensions>

</Project>

I am unable to reproduce this locally with this file. can you share the full project, or a sample project that shows the issue?
Also noticed that your tsconfig.json is not referenced from the project file above, is this the same project?

The tsconfig is included in the project. I'm not sure why it does not show in the proj file.
I should mention that other developers working on the exact same project do not get this error, so it must be something to do with my local environment.

@prsmith1 Might you have the wrong TypeScript settings configured in your .csproj?
Even with <TypeScriptCompileBlocked>true</TypeScriptCompileBlocked>, the project settings tools version will still affect the language features recognized by the IDE.
For example

Compared to

@aluanhaddad I have tried '2.3' and 'Use latest available' (we are using 2.4), but it didn't make any difference. Looking at my extensions, the 'TypeScript Build for Microsoft Visual Studio' and 'TypeScript for Microsoft Visual Studio' extensions are both on 15.3.10723.1 and are set to auto update, so I think they're okay too.

Well, it will not work with '2.3' and I was thinking that you might have an older version of the SDK installed and that 'latest' might be mapping to '<2.4'.


Add Support for Google Secret Manager

Add support for Google Secret manger resources. Pricing details
Note for community: Please 👍 if you'd like to upvote this or receive updates.
See our contributing guide if you'd like to work on this! Implementation details:
google_secret_manager_secret
All cost components for this resource should show "cost depends on usage by default".

Cost component name: Active secret versions, units: versions. Monthly quantity is based on the usage param active_secret_versions: 10 # Number of active secret versions in each month.

Costing is multiplied per location that the secret is replicated into. If replication.0.automatic == true then just use 1 location. Else we need to multiply the active_secret_versions by the number of replication locations.

Cost component name: Access operations, units: 10K operations (UnitMultiplier should probably be set). Monthly quantity based on a usage param monthly_access_operations: 20000 # Monthly number of access operations.

Cost component name: Rotation Notifications, units: Rotations. Monthly quantity is based on the usage param monthly_rotation_notifications: 100 # Monthly number of rotation notifications..

google_secret_manager_secret_version

Cost component name: Active secret version, units: versions. Monthly quantity is 1 by default. If the parent google_secret_manager_secret is available and is replicated (follow d.References) then: if replication.0.automatic == true then keep using monthly quantity 1. Else, quantity is the number of replication locations.

Cost component name: Access operations, units: 10K operations (UnitMultiplier should probably be set). Monthly quantity based on a usage param monthly_access_operations: 20000 # Monthly number of access operations. - so it should show "cost depends on usage by default".

Free resources
google_secret_manager_secret_iam_policy
google_secret_manager_secret_iam_binding
google_secret_manager_secret_iam_member

Infracost implementation
Ok so as per the pricing details here https://cloud.google.com/secret-manager/pricing, secret manager is priced as such:

Billable item
Price per month

Active secret versions
$0.06 per version per location

Destroyed secret versions
Free

Access operations
$0.03 per 10,000 operations

Management operations
Free

Rotation Notifications
$0.05 per rotation

With the following free limits (I have questions about these, see the bottom of this comment)

Resource
Monthly free usage limits1

Active secret versions
6 versions

Access operations
10,000 operations

Rotation Notifications
3 rotations

Issues
As you'll see from the pricing table above the costs are split between google_secret_manager_secret & google_secret_manager_secret_version.
The ideal solution would mean have the all costs on google_secret_manager_secret counting numbers of google_secret_manager_secret_version from d.References. Fetching information such as enabled from the child google_secret_manager_secret_version.  This is not possible until https://github.com/infracost/infracost/issues/849 is merged. Thus we need to fallback to usage params.
google_secret_manager_secret
All the costs for Google Secret Manager can be encapsulated on this resource.
Active secret versions
Unit
versions
Costing
Monthly quantity based on usage param active_monthly_secret_versions which is a float allowing users to specify that they only used a certain version for x days out of the month. See pricing docs which notes:

"This is based on actual consumption. If you had a secret version that was active for only 2 days, you would be billed proportional to that usage, and not for the whole month."

Conditions
costing is multiplied per location that the google_secret_manager_secret is replicated into. If replication.0.automatic == true then just use 1 location. Else we need to multiply the active_monthly_secret_versions by the number of replication locations.
Access operations
Unit
10,000 Operations
Costing
Monthly quantity based on a usage param monthly_access_operations
Rotation Notifications
Unit
Rotations
Costing
We can do this 1 of two ways - there is a rotation block in the google_secret_manager_secret that has a rotation_period & next_rotation_time which we can use to estimate the number of monthly rotations. This won't catch manual rotations and might be a bit flaky.
Or we introduce usage param of monthly_rotation_notification which allows users to specify the number of rotations
Questions

If active_monthly_secret_versions < free tier of 6 versions then we need to display as free. However this is a global usage amount aggregated across projects for the billing account so we need to understand the total amount of secret versions in the whole infrastructure/plan. I'm not sure of the best way/if we can do this currently?
Same as above with monthly_access_operations which is free under 10,000 operations
Same as above for rotations, which are free under 3 a month.
See question about implementation for Rotation Notifications

@hugorut I updated the issue description using your investigation findings - thanks! The main changes I made are:

secret version is also charged for, we can assume quantity 1 or parent's location replica count. This enables users to see costs by default if they use versions, and use the usage-file to model costs at the parent's secret resource if needed.
we ignore free tiers, mentioned in the contrib guide and docs
I removed "monthly from the usage param for active_secret_versions as it's a continuous resource, the relevant contrib guide is this:

For resources that are continuous in time, do not use prefixes, e.g. use instances, subscriptions, storage_gb. For non-continuous resources, prefix with monthly_ so users knows what time interval to estimate for, e.g. monthly_log_lines, monthly_requests.

This has been merged to master and will go live with the v0.9.14 release sometime next week.

@yawboateng this is live in v0.9.14


proxy configuration is not working in angular universe-server side rendering

In my project i have file proxy.conf.ts with content like this
const BACKEND_URL = process.env.BACKEND_URL || 'localhost';
const BACKEND_PORT = process.env.BACKEND_PORT || '3013';
const PROXY_CONFIG = {
    '/proxy/*': {
        target: `http://${BACKEND_URL}:${BACKEND_PORT}`,
        secure: false,
        pathRewrite: {
         '^/proxy': ''
        },
        changeOrigin: true,
        logLevel: 'debug'
    }
};

I have added "proxyConfig":"proxy.conf.ts" in angular.json its working only when i use ng serve but while using npm run build:ssr and npm run serve:ssr i got
error: SyntaxError: Unexpected token < in JSON at position 0 at JSON.parse (<anonymous>) Http failure during parsing for http://localhost:4000/proxy/generate.
This is my package.json,
"scripts": {
    "ng": "ng",
    "start": "ng serve",
    "test": "ng test",
    "lint": "tslint ./src/**/*.ts -t verbose",
    "e2e": "ng e2e",
    "build:ssr": "npm run build:client-and-server-bundles && npm run webpack:server",
    "serve:ssr": "node dist/server.js",
    "build:client-and-server-bundles": "ng build --prod && ng run angular.io-example:server",
    "webpack:server": "webpack --config webpack.server.config.js --progress --colors"
}

Hello, we reviewed this issue and determined that it doesn't fall into the bug report or feature request category. This issue tracker is not suitable for support requests, please repost your issue on StackOverflow using tag angular-cli.
If you are wondering why we don't resolve support issues via the issue tracker, please check out this explanation.


Add GRC OWNERS file to crds/grc directory

/cc @mprahl @JakobGray

Copied OWNERS file into https://github.com/stolostron/multiclusterhub-operator/pull/893


Stop checking out repo in CodeQL merge queue hack

Checklist

[ ] I have added tests
[ ] I have updated the docs and cheatsheet
[ ] I have not broken the cheatsheet

How does this work without checking out the repo?

The hack was already doing nothing after checking out the repo. But since it does nothing, there's no point cloning the repo either.


Linkcheck RTD support and fixing links

[x] Enabled linkcheck in RTD CI.

Linkcheck can be run locally with the command sphinx-build -b linkcheck docs docs/_build/linkcheck, which places the output log txt/json in the docs/_build/linkcheck folder.

[x] Fixed links
[x] Fixed incorrect docstring

Ignore links by appending a regex string to linkcheck_ignore in conf.py.

Not sure about http://ariane.lagrangian.free.fr/whatsariane.html and whether that is the proper link (not sure who owns free.fr)

Not sure about http://ariane.lagrangian.free.fr/whatsariane.html and whether that is the proper link (not sure who owns free.fr)

I looked around, but I think that this is indeed the correct website. https://ubc-moad-docs.readthedocs.io/en/latest/ariane.html also links to there

Good to go! If we could include this in the next release @erikvansebille (for the patched docstring)


🚀 Feature: use a dropdown or menu for the i18n language selector

🔖 Feature description
The current language selector control works for cases when there aren't many languages installed.  But if a user sets up many translations the selection widget becomes more difficult to use.
🎤 Context
When many languages are set up for a backstage instance, the language selector becomes a bit unwieldy:

✌ Possible Implementation
What about using a drop-down style menu for this selection instead?
Also it might be nicer to show language names instead of language codes, perhaps just passing the language codes through the translation layer would be enough, as that would allow users to supply translated names for each language.
👀 Have you spent some time to check if this feature request has been raised before?

[X] I checked and didn't find similar issue

🏢 Have you read the Code of Conduct?

[X] I have read the Code of Conduct

Are you willing to submit PR?
Yes I am willing to submit a PR!

With a quick switchover to a Select component:

And if I use the same list as above, seems still like having the language name would be nicer:

👍 to this change from me 😁

So then maybe it could be something like this:

it would require a smart way to allow the typing to work for the translation function without having to relax the typing too much, as that's a really nice feature of the current implementation.

The simplest approach I guess would be to add a 2nd function returned by useTranslationRef that doesn't have the type restrictions called something like untypedT for special cases like this.  But I'll spend some more time thinking on this, maybe there's other options.

@gashcrumb maybe although I feel that would be the least desirable workaround tbh. It'd need to be accompanied by some equivalent ability to provide freeform keys in createTranslationMessages and createTranslationResource which might also get a bit messy.
Thinking that perhaps one of the optimal ways to handle this is if we could end up with a translation key with a type like languageToggle.language.${string}?

Yep, agreed, I'd go with a select containing language codes over that workaround :-)
Good idea on the typing, I got side-tracked away from this last week but am planning on looking again this week, I'll start with that thought.

Naive question from someone not deeply familiar with i18next yet etc: Isn't this a more generic need, should it really be scoped to the language toggle? Thinking something like core.language.<code>.name and then being able to add more things than the plain name if needed.
As a side track, there's also new Intl.DisplayNames(languageCode, { type: 'language' }).of(languageCode) in most modern browsers for this specific need if all one wants is the user's defined locale name for the language code :)

Pssh, accidental edit instead of quote reply - sorry about that ... here comes the actual reply:

Awesome, I wasn't aware of that but that'd be worth trying for sure.

Yeah I think so too. Especially behind a try-catch and falling back to the raw string in the off-chance it isn't working, I think might be The Right Thing to do for a frontend piece of code in general (even better than the explicit translations). But I am definitely no authority on these things.

Yep, that approach works really nicely @freben.
With English selected:

Then I select German:

I'll see how the tests look and probably get a PR open.

Just a note that you'd typically wanna display the languages in its own language rather than the currently selected one to make them easy to find

So like this:

Which seems better too since the list doesn't change with the selection.

That looks awesome ✨

So like this:

Which seems better too since the list doesn't change with the selection.

I'll suggest to implement a popup/modal widget instead of dropdown, what do we expect if the list goes beyond than 20 items?
In my perspective implementing this as a popup/modal we can handle the height/width of the container that will display the languages, without taking the user to the bottom of the page after searching for the language (can also be implemented a search bar for this), what do you think?

@C-RoblesAutodesk yep, that's a good idea, let me add that to the PR.

@C-RoblesAutodesk so for this I opted for the Select component, which doesn't expose properties to set the maxHeight property for the menu which would achieve this.  I think this would warrant a separate issue, as I started to add this it starts to increase the scope of change beyond what I personally would want in a PR.


fix JSONField incorrect comment

What this PR does / why we need it?
fix #1434 修正错误的代码注释
Summary of your change
com.alibaba.fastjson2.annotation.JSONField
Please indicate you've done the following:

[ ] Made sure tests are passing and test coverage is added if needed.
[ ] Made sure commit message follow the rule of Conventional Commits specification.
[ ] Considered the docs impact and opened a new docs issue or PR with docs changes if needed.

Codecov Report
Patch coverage has no change and project coverage change: -2.54 :warning:

Comparison is base (f542aba) 75.93% compared to head (8ac08e1) 73.40%.

Additional details and impacted files
@@             Coverage Diff              @@
##               main    #1436      +/-   ##
============================================
- Coverage     75.93%   73.40%   -2.54%
+ Complexity    20172    19262     -910
============================================
  Files           613      601      -12
  Lines         79122    78374     -748
  Branches      17461    17296     -165
============================================
- Hits          60079    57527    -2552
- Misses        11864    13751    +1887
+ Partials       7179     7096      -83

see 82 files with indirect coverage changes

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.


fix: Don't require var.zone for read_replica instances

Currently, a value is required for either var.read_replicas[replica]["zone"] or var.zone as a fallback.
This commit tweaks that behaviour to use either var.zone or a random
available zone as the fallback.
Backwards compatibility should be retained, as local.zone already
prefers the value of var.zone over a random available zone.
Also worth noting that local.zone is already used in the
location_preference {} block.

/gcbrun

/gcbrun

@fatmcgav - sorry for the delay on this. Can you please sign the CLA?

@g-awmalik no worries... So I've changed jobs since opening this PR, but will see if can sort the cla out tomorrow 👍


NIFI-12642 Added support for FileResourceService in PutS3Object

Summary
Added support to upload content directly from local file's inputstream (by-passing the content repository) inside the PutS3Object processor. The default behaviour is upload from flowfile content to be backward compatible. This can be overridden if the RESOURCE_TRANSFER_SOURCE property value is set to FILE_RESOURCE_SERVICE, and a FileResourceService controller service is registered.
NIFI-12642
Tracking
Please complete the following tracking steps prior to pull request creation.
Issue Tracking

[x] Apache NiFi Jira issue created

Pull Request Tracking

[x] Pull Request title starts with Apache NiFi Jira issue number, such as NIFI-00000
[x] Pull Request commit message starts with Apache NiFi Jira issue number, as such NIFI-00000

Pull Request Formatting

[x] Pull Request based on current revision of the main branch
[x] Pull Request refers to a feature branch with one commit containing changes

Verification
Please indicate the verification steps performed prior to pull request creation.
Build

[x] Build completed using mvn clean install -P contrib-check

[x] JDK 21

Licensing

[ ] New dependencies are compatible with the Apache License 2.0 according to the License Policy
[ ] New dependencies are documented in applicable LICENSE and NOTICE files

Documentation

[ ] Documentation formatting appears as expected in rendered files

@balazsgerner It looks the processor does not upload the file's content in File Resource Service mode (an empty file is created only). Could you please double check it?

Thanks for spotting that, the reason for this issue was that we always considered the flowfile content's size, and in the case the source is FILE_RESOURCE_SERVICE, the incoming flowfile content was empty.
Fixed in 73f49bb


Enhance gathering of metadata on SQL queries

Atm the way in which metadata such as num. joins, tables involved for sql queries is gathered is rudimentary. Should be possible to use something like https://code.google.com/p/python-sqlparse/ to parse the SQL and pull out tables etc via the tokens generated

Could be taken from https://github.com/andialbrecht/sqlparse/blob/master/examples/extract_table_names.py or https://stackoverflow.com/a/69684339/848811


[Bug]: Twilight Portal Not Working

General Info

[X] I didn't added any mods
[X] I get this issue consistently in single-player
[X] I get this issue consistently in multi-player
[ ] I am crashing and can provide my crash report(s)
[X] I am using the latest version of the modpack

Your launcher
Curseforge
Modpack version
1.5.8
Describe your issue
When i step into the twilight forest portal nothing happens i just sit in the portal
Steps to reproduce the issue
Throw Diamond in portal, step into portal
Additional Information
a

The new update v1.6.0 fixed issue with all dimensions.