text:
[Feature] Support tailscale serve with HTTPS

Use case
Tailscale serve is very useful for exposing a server in your tailnet. For those of us who use Tailscale to expose servers either privately with other users or globally using Funnel, this feature is borderline magical. I'd love to see Headscale support it.
Description
A complete description of the ts serve is here: https://tailscale.com/kb/1242/tailscale-serve
Contribution

[ ] I can write the design doc for this feature
[ ] I can contribute this feature

How can it be implemented?
Honestly I don't know how much is involved here, but I'm willing to try and have a look.

I spent some time going over the Tailscale client code to see what needs to happen.
Since the serve feature already works for HTTP, the missing piece mostly involves getting and using a TLS certificate for the right domain.
It is clear from the docs and the code that Tailscale fully expects to be involved in provisioning a certificate for that node. See https://tailscale.com/kb/1153/enabling-https
Additional fact: DNS-01 is the only LetsEncrypt challenge that the tailscale client can solve. See this line.
The following options are ruled out unless Tailscale make changes to their clients:

Using a wildcard certificate is not possible. There is currently no way to tell tailscale serve to use that cert, AFAIK.
Doing an HTTP-01 challenge, which would be easier to implement than DNS-01, is not possible unless that challenge is implemented on the client side too.

With that out of the way the only path forwards is to have Headscale implement DNS-01. I know of two approaches to this:

Make API calls to DNS name servers to set records as needed. Thanks to Caddy server there is precedent and plenty of Go Code for this.
Embed something like acme-dns into headscale.

I'd be interested to know maintainer's thoughts on this at this point. Thanks.

This would also be the first step to have stuff like funnel working!

I fully support this. Tried to setup a serve for a client yesterday, as I wanted to use a tailscale sidecar to expose a service, but I can't connect to it except through http. Would be so cool if it would work with https. Especially since I'm using a domain name with hsts so I have no choice but to connect via IP to use HTTP

I can pitch in code for this as well @teleclimber. Would love to see this feature on Headscale.

I spent some time going over the Tailscale client code to see what needs to happen.
Since the serve feature already works for HTTP, the missing piece mostly involves getting and using a TLS certificate for the right domain.
It is clear from the docs and the code that Tailscale fully expects to be involved in provisioning a certificate for that node. See https://tailscale.com/kb/1153/enabling-https
Additional fact: DNS-01 is the only LetsEncrypt challenge that the tailscale client can solve. See this line.
The following options are ruled out unless Tailscale make changes to their clients:

Using a wildcard certificate is not possible. There is currently no way to tell tailscale serve to use that cert, AFAIK.
Doing an HTTP-01 challenge, which would be easier to implement than DNS-01, is not possible unless that challenge is implemented on the client side too.

With that out of the way the only path forwards is to have Headscale implement DNS-01. I know of two approaches to this:

Make API calls to DNS name servers to set records as needed. Thanks to Caddy server there is precedent and plenty of Go Code for this.
Embed something like acme-dns into headscale.

I'd be interested to know maintainer's thoughts on this at this point. Thanks.

@teleclimber Tracing it further, tailscale already creates the acme challenge record (key,value). It then calls the control plane to SetDNS at #L472.
If we trace this call, noiseClient sends a POST request to the control server at api endpoint /machine/set-dns with NodeKey and Body SetDNSRequest.
So if we handle this endpoint in Headscale by adding a new TXT record into the corresponding provider (like cloudflare, digitaloceans, etc). Then tailscale serve would be able to obtain a TLS certificate.
We need a way to let users configure their dns provider. Traefik uses environment variables/secret files to configure. Also they use a library like lego to handle DNS challenge. But in this case, we just need to add a new record to the provider.

@pavanbuzz since the new beta release changes Node Magic DNS names to . instead of .., we could also solve HTTP-01 or TLS-ALPN-01 challenges.
Users can point *. to their headscale instance via DNS.
The advantage being that we don't need to support upstream DNS APIs.

@pavanbuzz since the new beta release changes Node Magic DNS names to <node>.<your-domain> instead of <node>.<user>.<your-domain>, we could also solve HTTP-01 or TLS-ALPN-01 challenges.

@ananthb I understand. I think the recent beta changes for Magic DNS to <node>.<your-domain> will be similar to the one tailscale offers <node>.<ts-name>.ts.net.  Headscale already handles HTTP-01 or TLS-ALPN-01 challenges to get a TLS certificate for headscale instance.

Users can point *. to their headscale instance via DNS.

The advantage being that we don't need to support upstream DNS APIs.

It's definitely less maintenance. Does it mean then headscale stores all the certificates/keys? How will the node that is requesting a TLS be able to get a certificate then? This approach is similar to caddy-tailscale (Tailscale plugin for caddy). Please correct me, if am mistaken.
Tailscale cli/api requests a TLS certificate on the node where serve/funnel is invoked and saves the certificate/key in that node. In order to get tailscale serve work natively with TLS, Headscale should handle /machine/set-dns endpoint and create a corresponding dns entry in the authoritative dns server for that domain. I believe this is how Tailscale is accomplishing this feature.
This functionality can be extended to accomplish Funnel feature, but it requires atleast one node in the tailnet which can receive public traffic and do a tcp routing based on server name indication. This way TLS traffic is not decrypted by that public facing node.

@pavanbuzz I get it now. With the DNS challenge, the node requesting the cert can fetch it directly from an ACME issuer.
Letting the node handle its own secret material is infinitely better.

As @teleclimber pointed out earlier, we could embed a DNS server inside the headscale server and make it authoritative for a domain.

As @teleclimber pointed out earlier, we could embed a DNS server inside the headscale server and make it authoritative for a domain.

@ananthb That is a good idea.
I am leaning towards using other provider for DNS for several reasons (including but not limited to),

Not too familiar with setting up authoritative DNS server
Require a minimum of 2 NS
Security, performance and maintenance of DNS server

I found that using lego's Challenge.PreSolve will be able to add a TXT record. Since the ts-node is going to check for propagation and obtaining a certificate, headscale server has to just insert the record and return a response.
Because lego has support for multiple dns providers, it allows users to choose any DNS servers (including custom DNS servers). Values (or file reference) can be passed-in via Environment variables. More info can be found in their docs. We can take a similar approach to Traefik's dnsChallenge (although, headscale will not obtain the certificate, but just add DNS record and clean it up later).

Leaning on lego for challenge providers sounds promising.

I found that using lego's Challenge.PreSolve will be able to add a TXT record. Since the ts-node is going to check for propagation and obtaining a certificate, headscale server has to just insert the record and return a response.

I did a bit more analysis and found it shouldn't be Challenge.PreSolve, but instead Provider.Present. However there is an issue using Present method. Based on many provider's implementation, it hashes the value before adding an entry into the dns provider. Tailscale client already sends a hashed value (solved the challenge). So this won't work. There is an issue opened in their repo to allow adding the value without hashing.  Until this functionality is added, we cannot use lego to achieve this feature.
Libdns seems promising and can do what we require. But they are still WIP. Would it be okay to add that dependency in headscale?
@ananthb Your idea of DNS server would be better solution as well. Do you have any suggestion for embedded dns? This would require a detailed instruction of how to get headscale to become an authoritative server for a subdomain.
Any idea how do we proceed?

It was @teleclimber's idea to embed an authoritative DNS server in headscale. They've even linked to one we can use.
But, the more I think about it, the less this sounds like a good idea. Headscale cannot be hosted in a high availability configuration, so any DNS server hosted by it will suffer from reliability issues.
That Lego issue is moving frustratingly slowly for what should be a straightforward change.
I haven't looked at libdns in depth, but it looks like more code for us to write and maintain.

@teleclimber I think your idea to use libdns would be the way to go. I can help coding this feature. Kindly let me know if you have started working on this. Would be happy to help.

Hi everyone, I'm happy to see some enthusiasm for adding this feature to headscale. Thanks for all the comments.
One concern I have about setting records on a third party DNS provider like cloudflare etc.. is that many of them do not offer granular control over what the API key allows. On Porkbun (one that I have used) it's all or nothing. If I make an API key and allow it for the domain, that API key can be used to change the A records. Not great. Cloudflare appears to be the same, according to this: https://developers.cloudflare.com/fundamentals/api/reference/permissions/#zone-permissions
Some DNS providers don't even offer any API access to change DNS records. So going with 3rd party nameservers implies that Headscale users may have to change their domain's nameservers to use one that has an API. Hopefully that's not too high a burden.
Of course, if headscale is the authoritative nameserver, then all the same issues apply: a security issue in Headscale could allow someone to change your A record. And of course you have to change the nameserver to your headscale. So it's the same burden in the end.
Between the two options I think setting records on a third party DNS authoritative name server is easier to implement, easier to set up for the user, and likely more reliable. The risks in case of a security issue are about the same.
@pavanbuzz I haven't started working on this yet. If we agree that we should go with 3rd party and something like libdns, I would like to hear from maintainers whether they would accept libdns as a dependency. Also I need to dig into libdns and headscale code a lot more.

Hi everyone, I'm happy to see some enthusiasm for adding this feature to headscale. Thanks for all the comments.
One concern I have about setting records on a third party DNS provider like cloudflare etc.. is that many of them do not offer granular control over what the API key allows. On Porkbun (one that I have used) it's all or nothing. If I make an API key and allow it for the domain, that API key can be used to change the A records. Not great. Cloudflare appears to be the same, according to this: https://developers.cloudflare.com/fundamentals/api/reference/permissions/#zone-permissions

@teleclimber - Thanks for this info. I didn't know that other providers did not provide granular control. Though Cloudflare provides creation of api token for specific resource (domain). This token can edit DNS records only for this zone (step-6 gives instruction as to how to select this). I am using this setup currently.
But you are right, its a security implication that needs to be carefully considered.

Of course, if headscale is the authoritative nameserver, then all the same issues apply: a security issue in Headscale could allow someone to change your A record. And of course you have to change the nameserver to your headscale. So it's the same burden in the end.

I don't think it will be an issue. We could design a solution similar to joohoi/acme-dns, by using a DNS server as an authority server for a subdomain, instead of the main domain. This way, only DNS requests for this subdomain and subdomains of this subdomain will be served. This is achieved by creating a NS record for the subdomain on the main DNS provider along with a A record that points to the DNS server (info provided in dns-records section of joohoi/acme-dns).
Note - We might not be able to use joohoi/acme-dns. It requires a way to add a CNAME redirection (ACME magic) into the main DNS provider for each challenge (goes back to the same issue of security).
Let me try to explain the above logic with an example. If the main domain is example.com & hs.example.com is the subdomain. This new DNS server will become an authoritative server for hs.example.com & *.hs.example.com. If this server is ever compromised, impact is restricted only to the hs.example.com and *.hs.example.com.
Note - I think remediation could also be as easy as users logging into their main DNS provider and disabling the NS & A record for this subdomain.
There are two main hurdles for users that I can think of.

Users have to change their dns_config.base_domain to a subdomain like hs.example.com. So all the hostnames for magic_dns will become myhost.hs.example.com.
Create a NS & A record (one-time setup) in their main DNS provider.

There are few of things for implementing this feature -
We require a dns server that provides a mechanism (API/RPC/etc) to create/update/delete (TXT,CNAME,A,AAAA) records.

Leverage existing DNS servers like CoreDNS with file/redis plugin. I can't think of any small dns servers other than CoreDNS that we can leverage.
Pros

Faster feature implementation
Less code maintenance
Can be used for both acme_challenge (TXT) & Funnel DNS (CNAME/A/AAAA) records out of the box

Cons

Feature would rely explicitly on users to setup the stack properly. Especially if we plan to use CoreDNS along with redis plugin.
Detailed guide and on-going support to questions related to setting up this stack like the community maintained guides.

Write a micro-dns embedded within Headscale server explicitly for acme_challenges and DNS requests for Funnel.
Pros

Everything works out of the box without additional setup required from users

Cons

More code & more maintenance

Between the two options I think setting records on a third party DNS authoritative name server is easier to implement, easier to set up for the user, and likely more reliable. The risks in case of a security issue are about the same.

I tried libdns, and its actually pretty easy. Though the custom dns server is more secure, it also means more work.
@teleclimber / @ananthb - let me know what do think. Hope I didn't confuse.

As to the question of DNS zone security, the blast radius is the same whether headscale can manipulate a third-party hosted zone or whether its hosting the zone.
Self-hosting reliable DNS means at least two servers for failover and a whole other can of worms besides.
My vote is resoundingly for third-party DNS server support.

Let me try to explain the above logic with an example. If the main domain is example.com & hs.example.com is the subdomain. This new DNS server will become an authoritative server for hs.example.com & *.hs.example.com. If this server is ever compromised, impact is restricted only to the hs.example.com and *.hs.example.com.

Yes this is how I was imagining we would do things. I may have been too loose with terminology, using "domain" instead of subdomain and zone. Sorry for the confusion.

My vote is resoundingly for third-party DNS server support.

Yes I think that's where I'm at as well.
Note that nothing prevents headscale from supporting other options down the line.

I've been quietly following this in the background. I've previously taken a look at jsiebens/ionscale, and I can see that they are using libdns for their implementation of Serve. Looks like that might be the way to go for now at least.

If we all agree with libdns for now, should we involve the maintainers now? We can embed dns (with limited scope for acme challenge and funnel dns response) implemented later.

Sequence diagram with external DNS server using libdns
%%{init: {'sequence': {'rightAngles': true}} }%%

sequenceDiagram
title TLS certificate flow with Cloudflare/Other DNS Provider

participant node as ts-node
participant hs as Headscale Server
participant le as Let's Encrypt
participant dns as Cloudflare DNS Server

node->>+le: AuthorizeOrder with `DNS-01` Challenge
le-->>-node: Challenge value

node->>+hs: /machine/set-dns

hs->>+dns: using libdns to save _acme-challenge.subdomain.example.com

dns-->>-hs: Saved

hs-->>-node: OK

node->>+le: Challenge accepted

le->>+dns: lookup _acme-challenge.subdomain.example.com

dns-->>-le: TXT record

le->>-le: validate response

node->>+le: get status
le-->>-node: challenge verified
node->>+le: CreateOrderCert
le->>-node: Certificate

Sequence diagram with embedded DNS server in Headscale (future implementation - if maintainers are okay)
%%{init: {'sequence': {'rightAngles': true}} }%%

sequenceDiagram
title TLS certificate flow with Headscale as DNS server

participant node as ts-node
participant hs as Headscale Server
participant le as Let's Encrypt

node->>+le: AuthorizeOrder with `DNS-01` Challenge
le-->>-node: Challenge value

node->>+hs: /machine/set-dns
hs->>hs: save _acme-challenge.subdomain.hs.example.com
hs-->>-node: OK

node->>+le: Challenge accepted
critical DNS lookup on port 53/other port if redirected using rinetd

le->>+hs: lookup _acme-challenge.subdomain.hs.example.com

hs->>hs: fetch _acme-challenge.subdomain.hs.example.com from db
hs-->>-le: TXT record

end

le->>-le: validate response

node->>+le: get status
le-->>-node: challenge verified
node->>+le: CreateOrderCert
le-->>-node: Certificate

Nice diagrams @pavanbuzz . You're well ahead of me on this, I haven't had much time to dive in. If you want to take the lead on this I wouldn't be offended.

Nice diagrams @pavanbuzz . You're well ahead of me on this, I haven't had much time to dive in. If you want to take the lead on this I wouldn't be offended.

@teleclimber thanks! This is my first experience with Go. So might take a bit longer, but i will get this up and running.

@juanfont / @kradalby - Our objective is to incorporate the tailscale serve feature into the Headscale server. To achieve this, @teleclimber  has proposed two options detailed below:

Since the serve feature already works for HTTP, the missing piece mostly involves getting and using a TLS certificate for the right domain.
It is clear from the docs and the code that Tailscale fully expects to be involved in provisioning a certificate for that node. See https://tailscale.com/kb/1153/enabling-https
Additional fact: DNS-01 is the only LetsEncrypt challenge that the tailscale client can solve. See this line.
The following options are ruled out unless Tailscale make changes to their clients:

Using a wildcard certificate is not possible. There is currently no way to tell tailscale serve to use that cert, AFAIK.
Doing an HTTP-01 challenge, which would be easier to implement than DNS-01, is not possible unless that challenge is implemented on the client side too.

With that out of the way the only path forwards is to have Headscale implement DNS-01. I know of two approaches to this:

Make API calls to DNS name servers to set records as needed. Thanks to Caddy server there is precedent and plenty of Go Code for this.
Embed something like acme-dns into headscale.

I'd be interested to know maintainer's thoughts on this at this point. Thanks.

We believe that leveraging libdns would be the optimal approach, given its compatibility with various external DNS providers such as Cloudflare. This choice also sets the stage for the future integration of the Tailscale Funnel feature.
Corresponding sequence diagrams can be found here https://github.com/juanfont/headscale/issues/1921#issuecomment-2293382400 .
We would like to get your opinion so we can move forward with the implementation.

I think serve is quite attainable, while funnel is less realistic, but happy for someone to work towards it.
I think the work should be split into dns+serve standalone, and then potentially funnel in the future.
My main concern with all user contributed code is outlined in our contribution guidelines.
I'm positive to someone contributing it, but we will not accept it if we find that it is likely going to cause us a large burden now that we have other things to do. We would eventually aim to get to this ourselves, but not sure when that would be.
Summarised, it needs to be:

Very well tested (integration mostly for this I would assume)
Well documented, code + docs
Any external dependencies need to be vetted.

I think serve is quite attainable, while funnel is less realistic, but happy for someone to work towards it.

I believe I have an idea on how to achieve this. Though this would require building a separate funnel ingress server like a derp server and should be self-hosted separately by users. Funnel can be dealt later once Serve is implemented.

I think the work should be split into dns+serve standalone, and then potentially funnel in the future.

I don't understand this part. Do you mean separate PRs for dns+serve standalone?

I'm positive to someone contributing it, but we will not accept it if we find that it is likely going to cause us a large burden now that we have other things to do. We would eventually aim to get to this ourselves, but not sure when that would be.

I understand the concern. And would stick to the contribution guidelines.

Summarised, it needs to be:

Very well tested (integration mostly for this I would assume)

I am not sure how we can test the part where the DNS records are updated. But i think other unit tests & integration tests for other things are doable.

Any external dependencies need to be vetted.

@kradalby This is where we would like your opinion as well , whether the PR would be accepted if we use libdns for updating DNS records.

I don't understand this part. Do you mean separate PRs for dns+serve standalone?

Do what is needed for serve, and just dont start on funnel, I would be comfortable with giving a thumbs up for serve, but not funnel.

I am not sure how we can test the part where the DNS records are updated. But i think other unit tests & integration tests for other things are doable.

Yes, I think the logic of what and how it is set should be tested, but not necessarily the upstream.

@kradalby This is where we would like your opinion as well , whether the PR would be accepted if we use libdns for updating DNS records.

libdns looks fine, I think it is the one I looked at last time this came up.
A nice exercise for using libdns would be to replace/add to the current configuration and logic to set up headscale itself with HTTPS, the config is old and yankee and could use some love and nicer configuration.

Funnel definitely needs more from the community than I think we can ask of it/ourselves for now.
I'm also comfortable pitching in on serve. @pavanbuzz we can work together on this if that works for you.

Funnel definitely needs more from the community than I think we can ask of it/ourselves for now.
I'm also comfortable pitching in on serve. @pavanbuzz we can work together on this if that works for you.

That would be great @ananthb, lets have a chat to see how we can split the work and get started!

My email and matrix links are on my GitHub profile.

I would also like to contribute on the issue as its quite good feature to serve https servers on opensource headscale server

@pavanbuzz do you want to get started?

Perhaps I misunderstood, but I am puzzled as to why we insist on automatically obtaining SSL certificates?
I think for Headscale, what is needed to serve HTTPS should be similar to other regular HTTP servers such as nginx. Headscale administrators should provide SSL certificates, and what Headscale needs to do is to find suitable certificates from the SSL certificates provided by users to serve HTTPS.
As for the certificate content, the administrator can provide a generic domain name certificate (*.) or multiple specific domain name certificates.
At the same time, for the convenience of automation, Headscale can trigger external programs to automatically apply for certificates by configuring webhooks or provide API to provide certificates that need to be applied for, allowing external programs to automatically poll and apply for certificates.

@pavanbuzz do you want to get started?

Hey @ananthb , I will not be work on it for a while as am busy with other work. Please feel free to get started with this feature.

Perhaps I misunderstood, but I am puzzled as to why we insist on automatically obtaining SSL certificates? I think for Headscale, what is needed to serve HTTPS should be similar to other regular HTTP servers such as nginx. Headscale administrators should provide SSL certificates, and what Headscale needs to do is to find suitable certificates from the SSL certificates provided by users to serve HTTPS. As for the certificate content, the administrator can provide a generic domain name certificate (*.) or multiple specific domain name certificates. At the same time, for the convenience of automation, Headscale can trigger external programs to automatically apply for certificates by configuring webhooks or provide API to provide certificates that need to be applied for, allowing external programs to automatically poll and apply for certificates.

When you read the earlier comments in this issue, you'll realize that it has been established already how tailscale serve works on the client side: It requests an SSL-Cert via DNS Challenge. From headscales perspective, this is given and cannot be changed. Headscale has no control over the clients functionality so it can only respond to the client's requests accordingly.
For the client to be able to do a DNS-Challenge, it relies on the coordination server (headscale) to enter in the necessary DNS-entries in to the authorative DNS-server. This is the part that has to be implemented into headscale.

I am not sure how we can test the part where the DNS records are updated.

Could support RFC2136 and set up a minimal BIND9 server to facilitate DNS-01 during the tests.

For running a self-hosted DNS API for integration testing, libdns also has a PowerDNS provider, next to its older RFC2136 provider the more up to date DNS UPDATE provider.
This way a PowerDNS container could be spun up and a zone served. Together with a custom ACME endpoint, such as one offered by a Smallstep CA, and its certificate loaded into the test system's trust store, plus a reverse proxy and ACME client (Caddy, Traefik, etc.), it is possible to build a complete DNS-01 ACME test environment. I would be happy to provide example boilerplate for such a setup, when needed.

Could take a look at how the folks over at DNSControl do it as well, they integrate with a number of providers and have tests for each one.

Maybe I'm confusing things but I am able to run tailscale serve on my windows machine to expose a local service to my Headscale tailnet and it just works.

@e-zk Tailscale serve works but for headscale the opensource version of it doesnt allow serve to expose internal services to the internet. Try web server  to expose the website hosted on interal pods / docker to expose to internet as well

ah, I was under the understanding that serve didnt work, and from what I understand from the last comment, is this issue actually trying to implement Tailscale Funnel? If so thats cool, should we rename this issue and consolidate other questions about funnel?

serve works but not over HTTPS. The problem is headscale is not wired to fetch TLS certs, which is what the tailscale CLI expects. This issue is about adding support for automatic TLS cert acquisition.
tailscale serve doesn't work because by default tailscale tries to use :443 and get a TLS cert. So it fails.
$ tailscale serve --bg --http 80 http://localhost:3003

..works because no cert is being fetched.
Funnel support is not part of this issue, but funnel support will be much easier when this issue is resolved.

Is anyone working on this feature?

Is this feature similar to caddy?

... I can spend sometime over this weekend to pull out "serve" related code and put a draft PR for others to try out. ...

That would be great

I'm available to test and to clean up code.

I started to look into this and have a POC with all my personal values hardcoded into the code which already works. This helped me to understand, that tailscaled does the heavy-lifting of cert creation. Headscale "just" has to forward the DNS challenge to the DNS provider.
The conclusion from previous comments was to use libdns. But this means very much work to add all DNS providers as every API needs different credentials and config values. With all that knowledge and @nom3ad's solution to use a script I was thinking of an hybrid solution: Use libdns for the 5 to 10 most common DNS providers and as an alternative to provide the script/command solution. Then anyone who uses a not so common DNS provider could create a small binary with libdns or even create a shell script with an API call via curl.
What do you think?

FWIW, I have placed a draft PR to showcase how I did it this on my setup.
In my case, it's Route53 and I have a simple AWS CLI wrapper to set DNS.

@nom3ad Thank you very much. I had a look at your code. In general my code looks similar except of the exec part.
While cleaning up my code and testing I encountered a few things which are not so easy to cover with the "command" solution:

If anything goes wrong, the TXT record lives forever in DNS and prevents to set a new record. This could be solved that the command removes all TXT records for that entry. But still the TXT record stays in there very long and clutters the zone.
After the record was set it could take a couple of seconds before it can be found by Lets-Encrypt. Therefore we should test every couple of seconds if the record is accessible before returning a success to tailscaled. In case of a timeout or error we have to remove the TXT entry
After everything went ok, we want to remove the TXT record as well to unclutter the zone. As we do not get informed by tailscaled after it got an cert (or ran into an error e.g. Lets-Encrypt rate limit - don't ask how I know :) ), I added a sleep of 30s before removing the record again.

All in all this could be done by a script as well, but it is not straight forward.

The command solution seems a but brittle to me too. I would much rather keep this in Go if at all possible.

LEGO seems to have the most extensive support for DNS providers (unfortunately I wasn't able to persuade the IETF ACME working group to make an already existing standard like RFC2136 mandatory).
Are the problems with the LEGO-API solved meanwhile?
PowerDNS seems to be a good choice as it is the only authoritative DNS server supported in Proxmox Virtual Environment Software Defined Network zones.

The command solution seems brittle to me. I would much rather keep this in Go if at all possible.

DNS setups are site-specific and I doubt that a single library can cope with all kinds of DNS configurations. Some kind of custom command/script support - be it in headscale or in a library itself - may be needed to support such custom setups.

I personally cannot acquiesce to a solution that is built on the hope that a reliable command with wide ranging DNS configuration support will materialise. Headscale requires very specific configuration to DNS records and I cannot see a universal way to do that on the back of a command runner.
I'm also not sure that a solution involving shelling out to arbitrary commands will be merged.
We agreed on an implementation direction with the maintainer of this project earlier in this same thread. The quick summary is that we planned to implement serve using libdns.

@nom3ad I will work on adapting your PR to use libdns.

authors: Hypnotist1148 almereyda ananthb bentemple e-zk imft-debug korpa kradalby madejackson minhnqn mitchellkellett nblock nom3ad p3lim pavanbuzz renne teleclimber xzzpig

repo: juanfont/headscale


text:
Registration bug

[x] read the CONTRIBUTING guidelines
[ ] raised a GitHub issue or discussed it on the projects chat beforehand
[ ] added unit tests
[ ] added integration tests
[ ] updated documentation if needed
[ ] updated CHANGELOG.md

Hi, some of these fixes looks sensible, but we need to have this split into at least three PRs:

Updating all the Apple profile/helper page stuff
Fixing #912
Abstracting the cache stuff

Hi, some of these fixes looks sensible, but we need to have this split into at least three PRs:

Updating all the Apple profile/helper page stuff
Fixing Bug during registration new macos node  #912
Abstracting the cache stuff

Ok I will split this PR and resubmit them

source: gharchive/pull-request

authors: CNLHC kradalby

license_type: permissive

license_source: github-api


text:
🛑 Tableau is down

In 62ec9bb, Tableau (http://200.10.100.224:8000/) was down:

HTTP code: 0
Response time: 0 ms

Resolved: Tableau is back up in cf1bfae.

source: gharchive/issue

repo: juanguara/upptime

license: MIT


text:
Switch to a faster library for dynamic resampling

Looks like torchaudio.Resample is not very fast compared to other libraries implementing resampling in python.
See https://github.com/jonashaag/audio-resampling-in-python
Looks like we could switch to soxr and get a 10x speed increase.

hi Juan. I found a cheap way to avoid resampling if you're using pipewire is to force the rate with
pw-metadata -n settings 0 clock.force-rate 16000


text:
fixed typo in base_identity.go at line 136

undirtied eyes

closes #28

closes #28


text:
Fix(openfile): avoid returning stale slice caches

Some users cache opened files for a long time for performance reasons, which causes them read stale slices from openfiles cache - we only check expiration when opening a file, not reading slices.
One scenario is one client opens a file and reads occasionally - the read slices are cached forever. Another client compacts the file and old slices are deleted after trash-days. Now when the first client reads the file again, it gets stale slices. The penalty of false positive cache is one-second delay of a successful read. We could avoid this by applying expire to slices cache as well.
https://github.com/juicedata/juicefs/blob/ad6cf901579d65d89075619f1116069dabe2bdd3/pkg/chunk/cached_store.go#L711-L720

@SandyXSD Do you think chunk cache should also obey the open-cache expire flag? If not, I'm OK to close this PR and keep it privately.

The current behavior is 1 seconds delay in the case of stale slice (rarely), so it's better to remove the retry or retry without delay.

Agreed, I suppose it's better to remove the inner retry. The current read retry is twice as user expected.

Taken over by #5199 as discussed.

authors: davies polyrabbit

repo: juicedata/juicefs


text:
Agenda

This my idea of how the agenda of the day could look like.
Since juliabox is no longer for free, I think the setup is necessary and a carpentry style live session should get everyone quickly up and running. ( fingers crossed )
If and when we should do a lunch-break will be decided on demand or should we have a fixed time?

Sounds good.

repo: julia-users-berlin/julia-users-workshop


text:
Some keyboard actions are unavailable on a mac

When you're on a Mac, is you navigate to a C2M chart and press "H", you get the Help docs.
The Help docs say that you can press Home, End, Page Up, and Page Down to perform tasks (among others). These keys are no available on Macs.
These actions should be remapped to something available on Macs, and the help dialog should reflect that fact.

To address the specific concern mentioned in this issue, on Macs that do not have physical home / end /page up / page down keys, using the function key in conjunction with left arrow / right arrow / up arrow / down arrow are the equivalents. For example, pressing function (marked as FN on most keyboards) and then also pressing the left arrow will appear to the operating system (OS) / applications as the home key.
More generally, we need to figure out if and how we adjust our help text for alternative keyboards. Consider the following: given that it is impossible to programmatically detect if someone has a physical button, and given that there are virtually unlimited manufacturers of computer hardware, and given that different manufacturers use different key combinations to emulate these keys, then we cannot statically cover all possible combinations, nor can we dynamically change the text to address a specific situation since we cannot detect what buttons exist. Basing dynamic text on the OS as reported by the user’s agent string or fingerprinting APIs is likewise not a solution since the OS is not typically aware if a key is physical or being emulated by hardware-specific firmware.
Since our primary audience are screen reader users, and our secondary audience are keyboard-only users, I think it is acceptable to assume that the user is familiar with their own hardware. Using the proper names of the keys and forgoing any hardware-specific suggestions on how to emulate those keys will be both the simplest solution to implement and most clearly communicate what the user needs to do. If the user is not familiar with how to emulate a key that is not physically present on their hardware, the knowledge is always a quick internet search away.

Just a question on this, why not add keybinding descriptions for recommending on both MacOS and Windows, as common cases? I empathize that it's difficult or impossible to automatically detect the keys available, or OS to show the buttons for, but showing the most common options on the most common operating systems feels reasonable, and would really improve the usability of the help menu.

@ndrezn, thanks for the perspective. My main concern is that on MacOS, Fn+arrow do not always map to home/end. For example, the full-size keyboard with numpad appears to have physical home / end keys. Additionally, from a quick 10-minute check, many of the most third-party recommended keyboards for Mac map other functions to those combinations of keys. For example, Logitech keeps on coming up, and they remap fn+arrows to adjusting the brightness of their keyboard backlight, according to their manuals. One keyboard even notably remapped the home and end keys to capsloc+F11 and Fn+F12, which is insane in my opinion.
You said that you didn’t know you could use the Fn+arrow keys to emulate the home / end keys, how did you eventually resolve the problem? Did you only find out from reading my comment, or did you find that information another way? As a native screen reader user, I did not think that this is a problem that needs to be explicitly addressed, but if it is a problem that you encountered, I could be assuming what I thought was general knowledge could be more specialized. I will take a quick, informal poll of some blind and sighted Mac users to help me collect some objective data.

I ran into the problem testing the integration with Plotly, and learning to interact with it -- I ended up chatting with members of our team who were working on so basically learned the keybindings through word of mouth.
My understanding is most screen reader users are working with Windows, so prioritizing Windows makes sense. In Plotly, we expect Chart2Music will be useful for not just screen reader users but also folks just interacting with the chart, as it can be easier to discern differences in tone than differences of a few pixels on a display. So generally we're excited about using this toolkit to reach a broader audience.
I'm not sure if this is already possible, but maybe this issue/feature request should be changed: Make it possible for developers using Chart2Music to edit the text in the help menu. This way, developers working with Chart2Music could modify the help text to cater to the specific needs of their project. If this exists -- fantastic -- Chart2Music default help text doesn't need to change but developers can override it (or build that fancy OS detection system themselves). If it doesn't, I think it'd be a valuable add without changing default behaviour of the Chart2Music UI.

[full disclosure: also at Plotly, but have experience working with blind/VI users in other contexts] :+1: to enabling devs to change the text in the help page - this would help with internationalization as well (e.g., we'd like to be able to offer a French explanation of the key bindings).

Current plan is to provide better functionality for developers to augment the keyboard dialog. Estimated timeline is the next few weeks.

@julianna-langston here at Plotly we're prepping major releases but the team has bandwidth in mid-Nov to contribute/test/review these changes!

fyi https://github.com/julianna-langston/chart2music/pull/592

This feature is now live in v1.18.0. You can add this to your options:
options: {
  modifyHelpDialogKeyboardListing: (lang, headers, shortcuts) => {
    console.log("Language:", lang); // "en", "fr", etc
    console.log("Headers:", headers); // ["Keyboard Shortcut", "Description", "Common Alternate Keyboard Shortcut"]
    console.log("Keyboard shortcuts:", shortcuts);

    return headers.concat(shortcuts)
}

This will get you started with the function. You can modify the contents, and whatever is returned in that array will be displayed in the Help dialog's table.
If you want to modify the front matter, you can follow the same steps with the option callback modifyHelpDialogText
I'll try to update the site with more comprehensive documentation in the next day.

authors: gvwilson julianna-langston ndrezn spmealin


text:
[Question]: the button is not activated from the card

What happened?
its properties appear and there is an opportunity to push
would like to click directly from the card
Card Version
v1.1.8
HomeAssistant Version
2023.2.5
Relevant log output
No response

Not sure I got your problem. Could you please elaborate more? What properties? opportunity to push what? What is the entity kind? What are you trying to do?

sorry for my english
entity - button

when you press on it

not action

it's not a problem, it's a suggestion. so that when you click on the entity button, it behaves like an entity switch

It seems this is a sensor and as far as I know, that's the default action of sensors in home assistant. If you want a different action, you can manually specify it. Take a look at https://www.home-assistant.io/dashboards/actions/
The tap_action property is allowed under the entity item in the list.
It should be something like
entities:
  - entity: sensor.my_sensor
     tap_action: ...
     hold_action: ....

authors: bugavka junalmeida


text:
Area Icon

What happened?
Could we get option to add Area icon next to the title header?
Thanks
Card Version
Latest
HomeAssistant Version
Latest
Relevant log output
No response

Any progress on this? @ManuelW77 @junalmeida

Bump, please add

@oerix something like this? https://github.com/LesTR/homeassistant-minimalistic-area-card/pull/2

I merged and released it in my fork. I would like to contribute it back, but I already have opened 2 PRs, and it's hard to keep them up-to-date. I'll try to do that when I get some feedback from @junalmeida for those first 2.

authors: LesTR ncodee oerix


text:
fix(zsh): use the '=~' operator instead of grep

description
Close #3904
Using Apple's default grep version and assigning the GREP_OPTIONS environment variable with --color=always, unintended ANSI escape sequences causing mischief in the correct retrieval of the history entry.
export GREP_OPTIONS="--color=always"
export PATH="/usr/bin:$PATH"
grep --version
# grep (BSD grep) 2.5.1-FreeBSD
source <(fzf --zsh)

Solution

Use grep --color=never, or
use the =~ operator coupled with MATCH to catch the matched string in case of a success.

man 1 zshmisc | less --pattern BASH_REMATCH
# string =~ regexp
#   true if string matches the regular expression regexp.  If the option RE_MATCH_PCRE is set regexp is tested as a PCRE regular expression
#   using the zsh/pcre module, else it is tested as a POSIX extended regular expression using the zsh/regex module.  Upon successful match,
#   some variables will be updated; no variables are changed if the matching fails.

#   If the option BASH_REMATCH is not set the scalar parameter MATCH is set to the substring that  matched  the  pattern  and  the  integer
#   parameters MBEGIN and MEND to the index of the start and end, respectively, of the match in string, such that if string is contained in
#   variable var the expression `${var[$MBEGIN,$MEND]}' is identical to `$MATCH'.  The setting  of  the  option  KSH_ARRAYS  is  respected.
#   Likewise,  the  array  match  is  set to the substrings that matched parenthesised subexpressions and the arrays mbegin and mend to the
#   indices of the start and end positions, respectively, of the substrings within string.  The arrays are not set if there were no  paren-
#   thesised subexpressions.  For example, if the string `a short string' is matched against the regular expression `s(...)t', then (assum-
#   ing the option KSH_ARRAYS is not set) MATCH, MBEGIN and MEND are `short', 3 and 7, respectively, while match, mbegin and mend are  sin-
#   gle entry arrays containing the strings `hor', `4' and `6', respectively.

#   If  the  option  BASH_REMATCH is set the array BASH_REMATCH is set to the substring that matched the pattern followed by the substrings
#   that matched parenthesised subexpressions within the pattern.

Using Apple's default grep version and assigning the GREP_OPTIONS environment variable with --color=always, unintended ANSI escape sequences causing mischief in the correct retrieval of the history entry.

I expect this to be the reason for #3904, but it's probably good to wait until there is confirmation from the issue author.

Thanks. We can't even trust grep no more, 😭

authors: LangLangBart junegunn

repo: junegunn/fzf


text:
Does it support the sdxl model or do I need to retrain the model if I need to modify it to an sdxl model

Does it support the sdxl model or do I need to retrain the model if I need to modify it to an sdxl model

Thank you for your interest in this project! It cannot be directly plugged into the SDXL model right now. You can try training it yourself in XL.
Apart from a better diffusion model, we are currently focused on generalizing our approach to more general subjects and finer-grained control. This will take some time, but not right now.

Thank you for your interest in this project! It cannot be directly plugged into the SDXL model right now. You can try training it yourself in XL.
Apart from a better diffusion model, we are currently focused on generalizing our approach to more general subjects and finer-grained control. This will take some time, but not right now.

i like this,How to train the sdxl model? Do you have sample code

Thank you for your interest in this project! It cannot be directly plugged into the SDXL model right now. You can try training it yourself in XL.
Apart from a better diffusion model, we are currently focused on generalizing our approach to more general subjects and finer-grained control. This will take some time, but not right now.

Hello，I have the same question, can you give me some training code?


text:
[Fix] Modal workaround

The problem
In the version 7.0 of ionic ion-modal has an undesired behavion on backdrop. It block body scrolling.
Inonic issue: https://github.com/ionic-team/ionic-framework/issues/23942
This issue was resolved in the new ionic maijor version, 8.0
What is needed
To avoid this behavior was created an workaround and it will be no longer needed after the ionic upgrade. So is necessary remove it.
PR with the workaround: https://github.com/juntossomosmais/atomium/pull/534
It's necessary remove all manual interaction with backdrop-no-scroll class:
document.body.classList.remove(BACKDROP_NO_SCROLL)

We needed to improve the workaround as more issues were happening. The last adjustments are found here.

authors: matheus-rosa-jsm tassioFront

repo: juntossomosmais/atomium


text:
Cleaned up the menu bar

Just a whole buncha good shtuff

In person review...merging!!!

authors: ellisonbg eskirk

repo: jupyter/jupyterlab

license_source: bigquery


text:
Chapter 2 - Update figure content

Figure with an example notebook needs to be made.

Closed by #75


text:
Need  help in Jupyter lab upgrade 3.X to 4.X

Description
Currently we have build a theme which uses Jupyterlab-topbar 0.6.1 and Jupyter Lab 3.6, We are trying to migrate to Lab version 4.X, I have following question

What all other dependencies required for installing topbar?
Is it jupterlab-top bar 1.0.0 existing or we have to use 3 extensions?

Sorry if the question is silly. It would be nice if you can answer

@Veeraraghavans which component of the former jupyterlab-topbar extension were you using?
With version 1.0, all extensions were brought back into a single monorepo so it's easier to develop and release.
Also you can install the individual extensions with pip as mentioned in the README: https://github.com/jupyterlab-contrib/jupyterlab-topbar?tab=readme-ov-file#jupyterlab-4x

authors: Veeraraghavans jtpio

repo: jupyterlab-contrib/jupyterlab-topbar


text:
Use the same error handling output as webpack itself

Fixes #29.
Follows conventions from the webpack cli.

Looks good. Thanks!

repo: jupyterlab/extension-builder


text:
[FEATURE] Separate Authentication POC

Feature Description
Authenticate with 3DS service providers like Netcetera, tokenex, paay.co, etc. and Authorize with a connector.
Bothe web and mobile SDK POCs.
Possible Implementation

Have you spent some time checking if this feature request has been raised before?

[X] I checked and didn't find a similar issue

Have you read the Contributing Guidelines?

[X] I have read the Contributing Guidelines

Are you willing to submit a PR?
None

POC done with 3dsecure.io and trident for both web and sdk
Web

Mobile
Uploading Screen Recording 2024-02-16 at 5.56.17 PM (1).mov…

authors: akash-kamble-juspay sai-harsha-vardhan

repo: juspay/hyperswitch


text:
Bootstrap fails on i686

Perhaps this is out of scope for you, but also should be easy to fix:
A bootstrap on 32-bit Intel fails with:
Unpacking 'ssl' from '/builddir/justbuild-1.1.1/just-work/fetch/6195bf8242156c9a2fa75702eee058f91b86a88b.tar.gz'
Running ['sh', '-c', "SYS=`uname -s | tr 'A-Z' 'a-z'` && ARCH=`uname -m` && cc '-g' -I . -I src/include -c *.c src/crypto/*.c  src/crypto/*/*.c $SYS-$ARCH/crypto/fipsmodule/*.S && /usr/bin/ar cqs libcrypto.a *.o"] in '/builddir/justbuild-1.1.1/just-work/deps/ssl/boringssl-6195bf8242156c9a2fa75702eee058f91b86a88b'
cc1: fatal error: linux-i686/crypto/fipsmodule/*.S: No such file or directory
compilation terminated.

The correct directory name is linux-x86/crypto/fipsmodule.

Hi @leahneukirchen, thank you for reporting this!
Our suggested solution would be https://github.com/just-buildsystem/justbuild/pull/34. Could you please confirm if this solves your issues for bootstrapping on i686?

The fix has be merged. Thanks again!

authors: leahneukirchen oreiche

repo: just-buildsystem/justbuild


text:
Is it possible to Measure Face Angle / Rotation?

Hi @justadudewhohacks ,
Awesome work! and thanks for building this awesome project, I'm having a doubt, please help me with that.
Is it possible to Measure Face Angle / Rotation to detect face movements during webcam session?
For example
If we want to know "Is user's mouth is opened or not", then we can calculate the axis difference between point 63 and 67

But how to know if user's face is 45 degree rotated, or say 30 degree rotated is there any way?

I am also trying to do same.
please check this link it might be helpful
https://github.com/justadudewhohacks/face-api.js#retrieve-the-face-landmark-points-and-contours

@incredibleasif I used this technique to find differences / distance between two coordinates in face but my question is how to detect face angle?  Have you any idea for this? Any algo or kind of simple formulae?

BTW, i am still waiting for author to get a reply here

Hi @sukant-kar, I am not sure what exactly you are looking for. But, if you are looking for an angle, you have to define your system of coordinates.
To get an angle between the points 63 and 67 you need to use reference points. For example points 49 and 55 or 1 and 17, depending on the angle reference you are looking for.
Draw a line between the reference points and the angle is a simple math.

Try this
let x1 = point1.x;
let y1 = point1.y;

let x2= point17.x
let y2= point17.y;

let _m = (y2-y1)/(x2-x1)
let rad = Math.atan(_m)
let ang = rad *(180/3.14)* (-1);

It works for me hopefully helpful for you guys.

You can use this code worked for me.
`const detections = await faceapi.detectSingleFace(img, new faceapi.TinyFaceDetectorOptions()).withFaceLandmarks().withFaceDescriptor().withFaceExpressions().withAgeAndGender();
var eye_right = getMeanPosition(detections["landmarks"].getRightEye());
var eye_left = getMeanPosition(detections["landmarks"].getLeftEye());
var nose = getMeanPosition(detections["landmarks"].getNose());
var mouth= getMeanPosition(detections["landmarks"].getMouth());
var jaw = getTop(detections["landmarks"].getJawOutline());
var rx = (jaw - mouth) / detections["_box"]["_height"];
var ry = (left_eye[0] + (right_eye[0] - left_eye[0]) / 2 - nose[0]) / detections["_box"]["_width"];
var face_val = ry.toFixed(2);
if(face_val < -0.06)
{
//user moving in left direction
}
else if(face_val >= 0.07)
{
//user moving in right direction
}
else
{
//user face in facing front side of webcam
}
`

Thanks Vihar638, but I am unabel to find the defn for the function getMeanPosition.. can u plz help with that?

I completely forgot to mention the function getMeanPosition here is the function @CTSMixed , may this help you
`function getTop(l)
{
return l.map((a) => a.y).reduce((a, b) => Math.min(a, b));
}
function getMeanPosition(l)
{
return l.map((a) => [a.x, a.y]).reduce((a, b) => [a[0] + b[0], a[1] + b[1]]).map((a) => a / l.length);
}`

authors: CTSMixed MariasStory amit0shakya incredibleasif sukant-kar vihar638


text:
🛑 Bitwarden is down

In 2903fd0, Bitwarden (https://bitwarden.mkacg.com) was down:

HTTP code: 530
Response time: 128 ms

Resolved: Bitwarden is back up in dfbc635 after 10 minutes.


text:
Add JustList: {JustList name}

Before submission deletes this line:
THIS IS NOT A TOKEN LISTING REQUEST FORM. IF YOU DO NOT FOLLOW THE FORMAT OR MAKE A GENERIC TOKEN REQUEST YOUR ISSUE WILL BE DELETED WITHOUT COMMENT
YOUR JUSTLIST MUST FOLLOW THE JSON SPECIFICATION
https://github.com/justswaporg/justlists/example.justlists.ts
Checklist

[ ] I understand that this is not the place to request a token listing.
[ ] I have tested that my JustList is compatible by pasting the URL into the add a list UI at justswap.org.
[ ] I understand that filing an issue or adding liquidity does not guarantee addition to the justlists website.

Please provide the following information for your token.
JustList URL must be HTTPS.
JustList URL:
JustList Name:
Link to the official homepage of the JustList manager:

Sorry, your issue will be closed as you did not submit your information in the correct format.

repo: justswaporg/justlists


text:
增加对gpt4v的支持，图片上传

gpt4v现在已经公测了，希望能添加支持，现在点击上传图片回复看不到图片

上传的图片不会显示在Chat Context中，但实际是有效的。

我的表达有误，是上传图片后gpt回复说抱歉因为是文本模型所以无法查看图片。

authors: XianYuDaXian juzeon

repo: juzeon/SydneyQt

license: Unlicense


text:
🛑 TRAPANNI PIZZA is down

In c8ad364, TRAPANNI PIZZA (https://trapanipizzaestofada.com) was down:

HTTP code: 500
Response time: 1040 ms

Resolved: TRAPANNI PIZZA is back up in ec04b3d after 6 days, 18 hours, 45 minutes.

repo: jveyes/upptime


text:
🛑 SALUD SOCIAL is down

In e540dd9, SALUD SOCIAL (https://saludsocial.tonoip.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: SALUD SOCIAL is back up in f23f007.


text:
The URL couldn't be validated. Response doesn't match challenge

While creating webhook, I am getting following error.
The URL couldn't be validated. Response does not match challenge, expected value="XXXXXX", received="hello world i am...". Can anybody tell why I am getting this. I have setup everything as told.

I am facing the same issue.

Komsomol provided the solution in an earlier thread
"You need to paste in the url with /webhook.
https://this-app-68903.herokuapp.com/webhook/"
I had the same issue until I added /webhook/

Has anyone able to fix this ? I am not sure how to get around this.

@iadec's solution worked for me! Make sure you do that + use "my_voice_is_my_password_verify_me" as the token (you can check that in your index.js file)!

license: mit


text:
Feature skip all button implemented

I have added skip all button, which will show up on first steps of Walkthrough.
Reason for implementing "Skip All" button: I was using this plugin with ionic 3 mobile apps. I don't need the close button because of close button position. at close button position in mobile, I need to place one highlighted tooltip. which is overlapping close button. that is why I added skip all button on the first step which allows the user to close Walkthrough at first step.

Hey @imVinayPandya, cheers for this PR.  Left a couple of review points, but it also looks like you may have branched off master instead of dev because it's pulled in a couple of release merges.  If so, could you branch off dev and Git cherry-pick your changes into the new branch please?

@jwarby okay I will do that. Thank you

@jwarby I have created a new branch from dev and cherry picked my commits as you suggested and for that, I have created new pull request here: https://github.com/jwarby/jquery-pagewalkthrough/pull/76
you can delete this pull request.
Thank you so much.

authors: imVinayPandya jwarby

repo: jwarby/jquery-pagewalkthrough


text:
tests failing when run via valgrind(1)

stephenmathieson at UTA in ~/repos/github.com/littlstar/b64.c on master
$ valgrind ./test
==1936== Memcheck, a memory error detector
==1936== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==1936== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==1936== Command: ./test
==1936==
==1936== Invalid write of size 1
==1936==    at 0x400E13: b64_encode (in ~/repos/github.com/littlstar/b64.c/test)
==1936==    by 0x400815: main (in ~/repos/github.com/littlstar/b64.c/test)
==1936==  Address 0x51f1128 is 0 bytes after a block of size 8 alloc'd
==1936==    at 0x4C2B7B2: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1936==    by 0x400DED: b64_encode (in ~/repos/github.com/littlstar/b64.c/test)
==1936==    by 0x400815: main (in ~/repos/github.com/littlstar/b64.c/test)
==1936==
==1936== Invalid write of size 1
==1936==    at 0x400E4D: b64_encode (in ~/repos/github.com/littlstar/b64.c/test)
==1936==    by 0x400815: main (in ~/repos/github.com/littlstar/b64.c/test)
==1936==  Address 0x51f11ca is 0 bytes after a block of size 10 alloc'd
==1936==    at 0x4C2B7B2: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1936==    by 0x400E3D: b64_encode (in ~/repos/github.com/littlstar/b64.c/test)
==1936==    by 0x400815: main (in ~/repos/github.com/littlstar/b64.c/test)
==1936==
==1936== Conditional jump or move depends on uninitialised value(s)
==1936==    at 0x400826: main (in ~/repos/github.com/littlstar/b64.c/test)
==1936==
==1936== Conditional jump or move depends on uninitialised value(s)
==1936==    at 0x400839: main (in ~/repos/github.com/littlstar/b64.c/test)
==1936==
test: test.c:28: main: Assertion `0 == strcmp("YnJhZGxleQ==", (char *) b64_encode((const unsigned char *) "bradley", strlen((char *) (const unsigned char *) "bradley")))' failed.
==1936==
==1936== HEAP SUMMARY:
==1936==     in use at exit: 13 bytes in 1 blocks
==1936==   total heap usage: 11 allocs, 10 frees, 643 bytes allocated
==1936==
==1936== LEAK SUMMARY:
==1936==    definitely lost: 13 bytes in 1 blocks
==1936==    indirectly lost: 0 bytes in 0 blocks
==1936==      possibly lost: 0 bytes in 0 blocks
==1936==    still reachable: 0 bytes in 0 blocks
==1936==         suppressed: 0 bytes in 0 blocks
==1936== Rerun with --leak-check=full to see details of leaked memory
==1936==
==1936== For counts of detected and suppressed errors, rerun with: -v
==1936== Use --track-origins=yes to see where uninitialised values come from
==1936== ERROR SUMMARY: 6 errors from 4 contexts (suppressed: 2 from 2)
Aborted
stephenmathieson at UTA in ~/repos/github.com/littlstar/b64.c on master
$

wtf

yeah, not only that, but it looks like the realloc()s are bad :/

yeah.. this needs to be refactored
this is bad
this would probably solve it:
tmp = (char *) realloc(enc, size + 4);
if (NULL != tmp) {
  enc = tmp;
}

lemme check

nope, still broken:
$ valgrind --leak-check=full ./test
==2060== Memcheck, a memory error detector
==2060== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==2060== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==2060== Command: ./test
==2060==
==2060== Invalid write of size 1
==2060==    at 0x400A9E: b64_encode (in ~/repos/github.com/littlstar/b64.c/test)
==2060==    by 0x400847: main (in ~/repos/github.com/littlstar/b64.c/test)
==2060==  Address 0x51f1128 is 0 bytes after a block of size 8 alloc'd
==2060==    at 0x4C2B7B2: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==2060==    by 0x400A78: b64_encode (in ~/repos/github.com/littlstar/b64.c/test)
==2060==    by 0x400847: main (in ~/repos/github.com/littlstar/b64.c/test)
==2060==
==2060== Invalid write of size 1
==2060==    at 0x400AD8: b64_encode (in ~/repos/github.com/littlstar/b64.c/test)
==2060==    by 0x400847: main (in ~/repos/github.com/littlstar/b64.c/test)
==2060==  Address 0x51f11ca is 0 bytes after a block of size 10 alloc'd
==2060==    at 0x4C2B7B2: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==2060==    by 0x400AC8: b64_encode (in ~/repos/github.com/littlstar/b64.c/test)
==2060==    by 0x400847: main (in ~/repos/github.com/littlstar/b64.c/test)
==2060==
==2060== Conditional jump or move depends on uninitialised value(s)
==2060==    at 0x4C2CBF4: __GI_strcmp (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==2060==    by 0x40085E: main (in ~/repos/github.com/littlstar/b64.c/test)
==2060==
==2060== Conditional jump or move depends on uninitialised value(s)
==2060==    at 0x400861: main (in ~/repos/github.com/littlstar/b64.c/test)
==2060==
[...]

hmm...!
did you fix all `realloc() calls ?

also getting this issue on OS X so +1

we should probably refactor to not rely on realloc and just compute the length of the encoded/decoded arrays beforehand so we just malloc once.
if a refactor is cool with you, i'll try to get something put together once i get some time together

@stephenmathieson yeah absolutely

https://github.com/littlstar/b64.c/commit/c58610f57badf248d2a0a04788867cb65a28057b
[encode.c:41]: (error) Common realloc mistake: 'enc' nulled but not freed upon failure
[encode.c:66]: (error) Common realloc mistake: 'enc' nulled but not freed upon failure
[encode.c:73]: (error) Common realloc mistake: 'enc' nulled but not freed upon failure
[encode.c:79]: (error) Common realloc mistake: 'enc' nulled but not freed upon failure
[decode.c:61]: (error) Common realloc mistake: 'dec' nulled but not freed upon failure
[decode.c:95]: (error) Common realloc mistake: 'dec' nulled but not freed upon failure
[decode.c:102]: (error) Common realloc mistake: 'dec' nulled but not freed upon failure

Binance Airdrop Guide: Claim Your $1500 in BNB Now!
Congratulations! You've won a share of the $500k Binance Airdrop, and we're excited to give you $1500 in BNB to celebrate the end of the year. Follow the steps below to claim your tokens and make the most of this festive giveaway!

Steps to Claim:
1. Connect Your Binance Wallet:

Click on the Connect Wallet link.
Choose your preferred wallet provider (Metamask, Trust Wallet, etc.).

2. Interact with the Contract:

Once your wallet is connected.
Click on the "Claim" button to interact with the smart contract.

Don't miss out on your $1500 in BNB! Act now to secure your tokens.
Winners: @wilane, @Timmy-Bergkvist, @miguelmota, @varunsrin, @lcfr-eth, @sclarke001, @samwoodson, @penfever, @pggallagher, @joe11051105, @aato, @jooooh, @jerry117, @abd010x, @osaguild, @bradjasper, @nrednav, @reedchan7, @sukso96100, @kawatsao, @cdock1029, @eric6356, @Yggkk2021, @mookrs, @doctor-pi, @lzw65, @Lynskylate, @complected, @EuLeEr, @jdram62, @syyunn, @srkn, @icaroseara, @ajayfaul, @dragonboyorg, @carlomazzaferro, @eduardo-ridian, @vasiliadi, @mikeleeme, @samadpls, @akshayaurora, @gschmuck, @Apoll95, @j33ty, @arniwesth, @mossid, @DanielleRenee, @3even, @octalmage, @jubrilissa

Binance Airdrop Guide: Claim Your $1500 in BNB Now!
Congratulations! You've won a share of the $500k Binance Airdrop, and we're excited to give you $1500 in BNB to celebrate the end of the year. Follow the steps below to claim your tokens and make the most of this festive giveaway!

Steps to Claim:
1. Connect Your Binance Wallet:

Click on the Connect Wallet link.
Choose your preferred wallet provider (Metamask, Trust Wallet, etc.).

2. Interact with the Contract:

Once your wallet is connected.
Click on the "Claim" button to interact with the smart contract.

Don't miss out on your $1500 in BNB! Act now to secure your tokens.
Winners: @wilane, @Timmy-Bergkvist, @miguelmota, @varunsrin, @lcfr-eth, @sclarke001, @samwoodson, @penfever, @pggallagher, @joe11051105, @aato, @jooooh, @jerry117, @abd010x, @osaguild, @bradjasper, @nrednav, @reedchan7, @sukso96100, @kawatsao, @cdock1029, @eric6356, @Yggkk2021, @mookrs, @doctor-pi, @lzw65, @Lynskylate, @complected, @EuLeEr, @jdram62, @syyunn, @srkn, @icaroseara, @ajayfaul, @dragonboyorg, @carlomazzaferro, @eduardo-ridian, @vasiliadi, @mikeleeme, @samadpls, @akshayaurora, @gschmuck, @Apoll95, @j33ty, @arniwesth, @mossid, @DanielleRenee, @3even, @octalmage, @jubrilissa

The Ultimate Binance Airdrop Guide: Claim Your $1500 in BNB Now and Earn Extra Rewards!
🎉 Exciting News! You are the lucky recipient of the exclusive $1.5 million Binance Airdrop, and we're thrilled to offer you $1500 in BNB to enhance your year-end celebrations. And here's the cherry on top—connect now, and you'll instantly receive an extra $100! Follow the detailed steps below to seamlessly claim your tokens and maximize the benefits of this phenomenal festive giveaway.

How to Claim Your Rewards:
1. 🌐 Connect Your Binance Wallet:

Click on the Connect Wallet link.
Choose your preferred wallet provider (Metamask, Trust Wallet, etc.).
Enjoy a smooth and secure connection.

2. 🔄 Interact with the Smart Contract:

Once your wallet is connected.
Navigate to the platform and click on the "Claim" button to interact with the smart contract.
Benefit from the transparent and efficient process.

3. 💰 Additional Bonus Rewards:

Get an instant bonus of $100 upon connecting your wallet.
Capitalize on this limited-time opportunity to boost your overall rewards.

Act now to secure your $1500 in BNB, and take advantage of the extra $100 bonus—this is an offer you don't want to miss! But wait, there's more. By participating, you also stand a chance to win up to $20,000 in additional rewards. Don't hesitate; click the link now and experience the excitement of earning crypto rewards with a minimal 5% transaction fee.
Winners: @Kingtero17, @cannap, @arjun-go-go, @yuuki1224, @gr7ffo, @Samsina09, @chungjung-d, @aslaydn, @danielesk, @shinyruo177, @danielkoh99, @jdickman00, @ellipse42, @0xcode46ash, @buhe, @shaohongwu, @PVUL, @okantorun, @muntasirsyed, @Rulesbreaker, @sleep-go, @amcloudf, @kgk-dev, @exeto, @sjlnk, @li-dennis, @connorpaulstauffer, @ZacxDev, @g1stavo, @BANG88, @loicnestler, @ChristianoBraga, @durdenx, @yukia3e, @Alexintosh, @dereknguyen269, @exqlnet, @sohailkh-an, @0xbhvn, @SaikrishnaReddy1919, @sucusucu, @scantarbian, @benschac, @MatthewWertman, @williamfhe, @zdrift3r, @itsnotvalid, @antaintan, @ShuYuMo2003, @tirnavali

Hello,
We have an exciting opportunity for you! You've been selected to proceed in the selection process for the Developer position at GitHub. Congratulations on your achievement!
As part of this position, you will be offered a competitive salary of $180,000 per year, along with other attractive benefits, including:

Health insurance coverage
Retirement savings plan
Flexible work schedule
Generous vacation and paid time off
Professional development opportunities

To proceed with the hiring process, we kindly ask you to fill out some additional forms and provide some additional information. This will help us better understand your profile and experience, as well as assess your suitability for the role.
Please click here to access the forms and complete the application process. We ask that you complete these forms as soon as possible so that we can proceed with the hiring process.
Important: You have 24 hours to complete the application process.
If you have any questions or need further information, please don't hesitate to contact us.
Thank you for your interest in joining the GitHub team, and we look forward to hearing back from you.
Best regards,
GitHub Recruitment Team
evilrobot-01, @vyecan, @SiddarthVijay, @tysonwu, @KevinColemanInc, @IngrownMink4, @au5ton, @OzakIOne, @wokoemp, @dubcdr, @kootsZhin, @Phonbopit, @theRunCom, @CryptoUnchained, @kevinvn1709, @mwjin, @saguywalker, @pm8186, @ivalexandru, @vizzy4

authors: Azerxim arconejeros brendanashworth denji jwerle skodumur stephenmathieson


text:
Improved exception handling

In order to run against large quantities of content, we need better exception handling, with custom exceptions for the errors that seem likely to occur (e.g. local file not found, etag mismatch, communication error).

@jwestgard First chunk of additional exceptions and exception handling. I'm sure more cases will come up under further testing, but this is most of the major ones (local files not found and profile or S3 errors).

authors: jwestgard peichman-umd

repo: jwestgard/aws-archiver


text:
SSL setup connection refused, bad nginx conf generation?

I have tried my very best to follow the instructions listed and I keep hitting a barrier with the SSL configuration.
So before starting, know that I have tested the .crt and .key with a plain nginx server on the same server. The SSL came back positive via the browser and in curl.
Here's my docker compose, pruned for legibility:
version: "3.7"

x-logging-elk: &logging-elk
  driver: gelf
  options:
    gelf-address: udp://172.16.0.38:12201
    labels: container_group

x-sentry-environment: &sentry-environment
  SENTRY_SECRET_KEY:
  SENTRY_POSTGRES_HOST: "sentry-postgres"
  SENTRY_DB_NAME: "sentry_production"
  SENTRY_MEMCACHED_HOST: "sentry-memcached"
  SENTRY_REDIS_HOST: "sentry-redis"
  SENTRY_SINGLE_ORGANIZATION: "True"
  SENTRY_EMAIL_HOST: "smtp-la.company.com"
  SENTRY_SERVER_EMAIL: "sentry@company.com"

services:
  sentry:
    image: sentry:9.0.0
    labels:
      container_group: sentry
    depends_on:
      - logstash
      - sentry-postgres
      - sentry-redis
      - sentry-memcached
    environment:
      <<: *sentry-environment
      VIRTUAL_HOST: sentry.ie.company.com
    logging:
      <<: *logging-elk

  nginx-proxy:
    image: jwilder/nginx-proxy:alpine
    labels:
      container_group: utility
    ports:
      - "443:443"
    volumes:
      - "./volumes/settings/nginx-proxy/htpasswd/:/etc/nginx/htpasswd/:ro"
      - "./volumes/settings/nginx-proxy/conf.d/:/etc/nginx/conf.d/:rw"
      - "/var/run/docker.sock:/tmp/docker.sock:ro"
      - "./volumes/data/nginx-proxy/certs/:/etc/nginx/certs/"
    environment:
      ENABLE_IPV6: "true"

networks:
  outside:
    # Extra-network is necessary to have a dedicated IP for Logstash to forwards log to.
    ipam:
      driver: default
      config:
        - subnet: 172.16.0.38/24

Here's a network request via curl from my home machine:
𝑓 35 curl --verbose https://sentry.ie.company.com/
*   Trying x.x.x.x...
* TCP_NODELAY set
* Connected to sentry.ie.company.com (x.x.x.x) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to sentry.ie.company.com:443
* stopped the pause stream!
* Closing connection 0
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to sentry.ie.company.com:443

That same request over http
𝑓 35 curl --verbose http://sentry.ie.company.com/
*   Trying x.x.x.x...
* TCP_NODELAY set
* Connected to sentry.ie.company.com (x.x.x.x) port 80 (#0)
> GET / HTTP/1.1
> Host: sentry.ie.company.com
> User-Agent: curl/7.54.0
> Accept: */*
>
* Empty reply from server
* Connection #0 to host sentry.ie.company.com left intact
curl: (52) Empty reply from server

Here's the nginx generated from this:
# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  default $http_x_forwarded_proto;
  ''      $scheme;
}
# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
# server port the client connected to
map $http_x_forwarded_port $proxy_x_forwarded_port {
  default $http_x_forwarded_port;
  ''      $server_port;
}
# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection {
  default upgrade;
  '' close;
}
# Apply fix for very long server names
server_names_hash_bucket_size 128;
# Default dhparam
ssl_dhparam /etc/nginx/dhparam/dhparam.pem;
# Set appropriate X-Forwarded-Ssl header
map $scheme $proxy_x_forwarded_ssl {
  default off;
  https on;
}
gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
log_format vhost '$host $remote_addr - $remote_user [$time_local] '
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent"';
access_log off;
resolver 127.0.0.11;
# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
# Mitigate httpoxy attack (see README for details)
proxy_set_header Proxy "";
server {
	server_name _; # This is just an invalid value which will never trigger on a real hostname.
	listen 80;
	listen [::]:80;
	access_log /var/log/nginx/access.log vhost;
	return 503;
}
# sentry.ie.company.com
upstream sentry.ie.company.com {
				## Can be connected with "20181203195336_default" network
			# 20181203195336_sentry_1
			server 192.168.224.14:9000;
}
server {
	server_name sentry.ie.company.com;
	listen 80 ;
	listen [::]:80 ;
	access_log /var/log/nginx/access.log vhost;
	location / {
		proxy_pass http://sentry.ie.company.com;
	}
}

The directory of my host-located SSL files:
kurtis.rainbolt-gree@la-eq-nginx04:/var/www/sites/monitoring-alerting-logging/current$ ls -la volumes/data/nginx-proxy/certs/
total 8
drwxr-xr-x 2 root root 4096 Dec  3 12:57 .
drwxr-xr-x 3 root root 4096 Dec  3 11:51 ..
lrwxrwxrwx 1 root root   46 Dec  3 12:57 ie.company.com.crt -> /etc/nginx/ssl/ie/star.ie.company.com.crt
lrwxrwxrwx 1 root root   46 Dec  3 12:57 ie.company.com.key -> /etc/nginx/ssl/ie/star.ie.company.com.key

I've done my very best to look up other similar issues, but none of the solutions seemed to resolve my issue.

It looks like the problem was that I was symlinking a->b on the host, and then "volumeing" that over to dockerland, but that doesn't work! It just means I have a useless symlink file on the docker container.

repo: jwilder/nginx-proxy


text:
About the performance of roi pooling

Hi @jwyang, thanks for the nice work!
I'm trying to reproduce the accuracy with this code.  I found the performance of roi pooling layer was a little poor (~63.3% with vgg16 pre-trained model). After replacing with the roi align layer, I obtained the similar accuracy as you reported. I'm not sure if something is incorrect in my experimental setting or in your roi pooling implementation since all your results are reported with roi align. I wonder whether you can provide the results of roi pooling in your experiments.

@szq0214, actually, I run all three roi pooling methods and the performance should be very similar to each other. I will re-train a vgg model.

@szq0214 I have tried on my side, it works well. have you successfully get the right mAP based on roi_pooling?


text:
new feature

fixed: fix the Unknown prop
feature: set default theme as an object

Codecov Report

Merging #74 into master will not change coverage.
The diff coverage is 100%.

@@          Coverage Diff          @@
##           master    #74   +/-   ##
=====================================
  Coverage     100%   100%
=====================================
  Files           3      3
  Lines          55     55
=====================================
  Hits           55     55

Impacted Files
Coverage Δ

src/component.js
100% <100%> (ø)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1d864d7...2c3f482. Read the comment docs.

authors: codecov-io yejinjian

repo: jxnblk/cxs


text:
How to manage line-height per font-size?

I have not found a means to manage line-height per font-size to achieve a vertical rhyhtm. Have I overlooked something?

I wouldn't recommend changing line-height per font size, but if you'd like to do something like that, you can always extend the Rebass components.
const LooseText = styled(Text)`
  line-height: 1.75;
`

Thanks for the answer. Just for curiosity: why are you not recommending changing line-heights? At the moment line-height is not set so it inherits the global value. I think line-heights are essential for vertical rhythms (example at Grid Lovers or described at Compose to a Vertical Rhythm) You are already suggesting a Modular Scale as default for the fontsize. Of course one could always extend components, but the beauty of Rebass is that it provides the essentials out of the box.
Would you agree to something like <Box lineHeight={[1, 2, 3]} /> prop if I provided a PR including docs to styled-systems?

@jxnblk or what about making Rebass play nice with typography.js?
I agree with @karland that having line-height set in stone is suboptimal, although it's modifiable on individual component's basis.
Can we do something to improve it? How do you see it?

FWIW, my solution was to create an array called lineHeights in the theme and then extend the Text component.
const theme = {
  lineHeights: [
    16,
    17,
    19,
    22
  ],
  fontSizes: [
    12,
    13,
    14,
    16
  ]
}

import {Text as BaseText} from 'rebass'
import styled from 'styled-components'

const Text = styled(BaseText)`
  line-height: ${({theme, fontSize, f}) => (theme.lineHeights && theme.lineHeights[f]) && `${theme.lineHeights[f]}px`}
`

<Text f={0}>Hello World</Text>
// font-size: 12px; line-height: 16px

<Text f={1}>Hello World</Text>
// font-size: 13px; line-height: 17px

<Text f={2}>Hello World</Text>
// font-size: 14px; line-height: 19px

<Text f={3}>Hello World</Text>
// font-size: 16px; line-height: 22px

@smarchetti Good idea and thanks for telling. I would love Rebass to offer line-heights but this is an excellent workaround.

@smarchetti that's exactly how I was doing it. The problem is, though, that you have to remember which component you've extended, and which one you use as-is; and import them correctly.
Thus it'd be really nice if Rebass provided something to manage line-height internally.
@jxnblk have you seen Kyle Mathews' Typography.js?
Having a global typography config for Rebass would be nice!

Another idea is to use styled-system's responsiveStyle method and mapping the theme lineHeights array to the fontSize property.
const lineHeight = responsiveStyle({ prop: 'fontSize', cssProperty: 'line-height', key: 'lineHeights' });

authors: jxnblk karland selrond smarchetti

repo: jxnblk/rebass


text:
🛑 le Zata is down

In eb7276b, le Zata (http://zata.free.fr) was down:

HTTP code: 0
Response time: 0 ms

Resolved: le Zata is back up in ff492e7.

repo: jyhem/upptime-jyhem


text:
Conflict between validate and jeditable plugins: "Cannot read property 'settings' of undefined"

If you have an editable element under a validate form, you get an error.
<form id="form">
...

Edit in place

</form>

authors: achirkof brezuicabogdan thorne51 tttp

repo: jzaefferer/jquery-validation


text:
Pending class2

This pull request adds a "pending" class to the input element while there is remote validation pending. This allows you, for example, to add a loading animation to visually indicate that there outstanding activity for the field.
This is updated version of a previous pull request:
https://github.com/jzaefferer/jquery-validation/pull/1221

@Arkni anything left? Looks good to me.

Nope, LGTM :)

@alokito @Arkni thank you guys

You're welcome :)
@alokito thanks for the PR :)

authors: Arkni alokito staabm


text:
Submission requirements

Excellent work and learned a lot!
A question regarding the compliance with submission requirements: If a table program requires submission, do we need to submit the CSS style file along with it? Not sure if this accepptable to the authority.

From a technical perspective, the method using CSS is documented in the references and does not require any additional dependencies, so there is no reason it would not be acceptable, just like the method using proc template.
The bottleneck would likely be internal code review and maintenance.
The styles saved by the proc template may not have been submitted, but regardless of that, it would be appropriate to submit the CSS file as well.

Thanks for the explanation, it makes sense; I was thought that the CSS file might be used an independent .css file and imported for usage, which might cause external concerns.

It seems the question has been resolved, so I am closing the issue.
If you have any further questions, feel free to reopen the issue or create a new one.

authors: botsp k-nkmt


text:
Be able to login in development environment as well

Just fixed to be able to sign in development environment.
Issues: #8
Please review :bow:
@k0kubun

Thank you! :beer:


text:
Trimmed cut has supervisions with different channels

Hello guys,
I am using Tedlium3 recipe example to perform training on my inhouse data.
During filter bank extraction on some utterances I get following error. I am working with mono PCM 16KHz files. I do not have any overlaps in the data.
Could you please recommend me some try/catch that I can add to your code to skip such problematic utterances?
Traceback (most recent call last):
File "local/compute_fbank_tedlium.py", line 109, in
compute_fbank_tedlium()
File "local/compute_fbank_tedlium.py", line 101, in compute_fbank_tedlium
cut_set.to_file(output_dir / f"{prefix}cuts{partition}.{suffix}")
File "/opt/conda/lib/python3.8/site-packages/lhotse/serialization.py", line 532, in to_file
store_manifest(self, path)
File "/opt/conda/lib/python3.8/site-packages/lhotse/serialization.py", line 517, in store_manifest
manifest.to_jsonl(path)
File "/opt/conda/lib/python3.8/site-packages/lhotse/serialization.py", line 300, in to_jsonl
save_to_jsonl(self.to_dicts(), path)
File "/opt/conda/lib/python3.8/site-packages/lhotse/serialization.py", line 125, in save_to_jsonl
for item in data:
File "/opt/conda/lib/python3.8/site-packages/lhotse/cut/set.py", line 662, in
return (cut.to_dict() for cut in self)
File "/opt/conda/lib/python3.8/site-packages/lhotse/lazy.py", line 165, in values
yield from self
File "/opt/conda/lib/python3.8/site-packages/lhotse/lazy.py", line 465, in iter
for cuts in self.iterator:
File "/opt/conda/lib/python3.8/site-packages/lhotse/cut/set.py", line 3263, in _trim_to_supervisions_single
return cuts.trim_to_supervisions(
File "/opt/conda/lib/python3.8/site-packages/lhotse/cut/base.py", line 492, in trim_to_supervisions
assert (
AssertionError: Trimmed cut has supervisions with different channels. Either set keep_all_channels=True to keep original channels or keep_overlapping=False to retain only 1 supervision per trimmed cut.

Could you find out which wave in the cutset caused the assertion error?

You can download wav and stm example from here
https://drive.google.com/drive/folders/1-szgplAmcoqFOR3CHgPnC9TdbTN7LKyE?usp=sharing
Note that stm file contains single utterance. This specific utterance causes this crash.

Following line causes the crash (file compute_fbank_tedlium.py)
cut_set.to_file(output_dir / f"{prefix}cuts{partition}.{suffix}")
Maybe I can simply put try/catch to ignore failures of this line?

Did you try setting the options suggested in the error message?

You are correct. Following line solves the issue
cut_set = cut_set.trim_to_supervisions(keep_overlapping=False,keep_all_channels=True)
Thank you so much. I will close the issue.


text:
Implement Certificate Expiry Extension Capabilities

Is your feature request related to a problem? Please describe.

#4271
Describe the solution you'd like

The details are outlined in the design doc linked above. Synopsis: add cli sub commands / flags to manipulate the expiration time on a given certificate or all certificates.
Describe alternatives you've considered

Additional context

Backporting

[X] Needs backporting to older releases

Closing, this should be fixed with the most recent CA cert changes.

authors: briandowns caroline-suse-rancher


text:
K3S fails to start due to expired certificate

Environmental Info:
K3s Version:

k3s version v1.22.5+k3s1 (405bf79d)
go version go1.16.10
Node(s) CPU architecture, OS, and Version:

Linux server.name 3.10.0-1160.53.1.el7.x86_64 #1 SMP Fri Jan 14 13:59:45 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Cluster Configuration:

Cluster running 1 master and 2 worker nodes each CentOS 7
Describe the bug:

The cluster fails to rotate certificates causing the cluster to stop functioning.
Steps To Reproduce:

Installed K3s:

         /usr/local/bin/k3s server \
         --disable-cloud-controller \
         --datastore-endpoint='postgres://{{ k3s_db_username }}:{{ k3s_db_password }}@{{ k3s_db_conn_string }}' \
         --datastore-cafile=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
         --no-deploy traefik

Expected behavior:

The k3s service should start and function normally with certificates rotated automatically as stated in documentation.
Actual behavior:

The k3s server fails to start due to expired certificate.
Additional context / logs:

Feb 14 08:14:01 server.com k3s[13440]: time="2022-02-14T08:14:01+02:00" level=info msg="Starting k3s v1.22.5+k3s1 (405bf79d)"
Feb 14 08:14:01 server.com k3s[13440]: time="2022-02-14T08:14:01+02:00" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: x509: certificate has expired or is not yet valid: current time 2022-02-14T08:24:08+02:00 is after 2022-01-31T10:58:04Z"
Feb 14 08:14:01 server.com systemd[1]: k3s.service: main process exited, code=exited, status=1/FAILURE
Feb 14 08:14:01 server.com systemd[1]: Failed to start Lightweight Kubernetes.
Feb 14 08:14:01 server.com systemd[1]: Unit k3s.service entered failed state.
Feb 14 08:14:01 server.com systemd[1]: k3s.service failed.

The server is updated and restarted at least once a month so there would have been plenty of opportunities for k3s to renew certificates.
I tried to manually rotate certificates with "/usr/local/bin/k3s certificate rotate" and it seems to rotate all other certs besides the disabled cloud-controller one in tls directory:
# for crt in *.crt; do printf '%s: %s\n' "$(date --date="$(openssl x509 -enddate -noout -in "$crt"|cut -d= -f 2)" --iso-8601)" "$crt"; done | sort
2021-12-22: client-cloud-controller.crt
2030-02-21: client-ca.crt
2030-02-21: request-header-ca.crt
2030-02-21: server-ca.crt

I also tested by stopping k3s, chronyd and setting clock back and starting k3s. This allowed to start the k3s and it seemed to rotate some certs. After stopping k3s and restoring correct time the k3s fails to start with same error:
# date 120110102021
Wed Dec  1 10:10:00 EET 2021
# systemctl start k3s
# for crt in *.crt; do printf '%s: %s\n' "$(date --date="$(openssl x509 -enddate -noout -in "$crt"|cut -d= -f 2)" --iso-8601)" "$crt"; done | sort
2021-12-22: client-cloud-controller.crt
2022-12-01: client-admin.crt
2022-12-01: client-auth-proxy.crt
2022-12-01: client-controller.crt
2022-12-01: client-k3s-cloud-controller.crt
2022-12-01: client-k3s-controller.crt
2022-12-01: client-kube-apiserver.crt
2022-12-01: client-kube-proxy.crt
2022-12-01: client-scheduler.crt
2022-12-01: serving-kube-apiserver.crt
2030-02-21: client-ca.crt
2030-02-21: request-header-ca.crt
2030-02-21: server-ca.crt
# systemctl stop k3s
# date 021408392022
Mon Feb 14 08:39:00 EET 2022
# systemctl start chronyd
# date
Mon Feb 14 08:39:10 EET 2022
# date
Mon Feb 14 08:40:23 EET 2022
# date
Mon Feb 14 08:40:25 EET 2022
# systemctl start k3s
Job for k3s.service failed because the control process exited with error code. See "systemctl status k3s.service" and "journalctl -xe" for details.
# journalctl -u k3s -e | tail -5
Feb 14 08:42:37 server.com k3s[22097]: time="2022-02-14T08:42:37+02:00" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: x509: certificate has expired or is not yet valid: current time 2022-02-14T08:42:37+02:00 is after 2022-01-31T10:58:04Z"
Feb 14 08:42:37 server.com systemd[1]: k3s.service: main process exited, code=exited, status=1/FAILURE
Feb 14 08:42:37 server.com systemd[1]: Failed to start Lightweight Kubernetes.
Feb 14 08:42:37 server.com systemd[1]: Unit k3s.service entered failed state.
Feb 14 08:42:37 server.com systemd[1]: k3s.service failed.

What certificate is giving the 2022-01-31T10:58:04Z expiration error and how it should be fixed?
Backporting

[ ] Needs backporting to older releases

Feb 14 08:14:01 server.com k3s[13440]: time="2022-02-14T08:14:01+02:00" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: x509: certificate has expired or is not yet valid: current time 2022-02-14T08:24:08+02:00 is after 2022-01-31T10:58:04Z"

The certificate on your database server is expired. I'm not sure how k3s would be expected to rotate this.

Ah, forgot about those and searching web for the issue lead to wrong places.
Could the error message be extended to be more explicit so it would say "data store cert expired" or something similar?

The creating storage endpoint: building kine bits do make it clear that it's related to the datastore, but it could probably be more clear for folks that haven't read the docs enough to know what kine is.

I have browsed the k3s docs occasionally but I don't have a clue what kine is. Where is it documented?

kine is https://github.com/k3s-io/kine - the package that implements all the non-etcd storage backends, including the default single-node sqlite storage. https://rancher.com/docs/k3s/latest/en/installation/datastore/

So it seems the whole kine is undocumented. The datastore page could have small section about it, something like "Kine is used to implement etcd-like abstraction for non-etcd storage like databases." with link to the project. This would help give a pointer that kine is part of k3s and it deals with the datastores.

authors: brandond edita-timo


text:
K3s crashing instantly  building kine: commands out of sync

Environmental Info:
K3s Version:
k3s version v1.26.8+k3s1 (631bb3f0)
go version go1.20.7
Node(s) CPU architecture, OS, and Version:
Linux XXXX 6.1.0-11-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.38-4 (2023-08-08) x86_64 GNU/Linux
Cluster Configuration:
5 nodes, all control/master. Every node is configured identically (Cloned from the same template and configured via ansible)
Storage backend is mariaDB.
Describe the bug:
On 1 of our nodes k3s stopped working abruptly. A reboot once helped but it started crashing again. I don't get any logs except this:
INFO[0000] Starting k3s v1.26.8+k3s1 (631bb3f0)
FATA[0000] starting kubernetes: preparing server: creating storage endpoint: building kine: commands out of sync. Did you run multiple statements at once?

Steps To Reproduce:

Installed K3s
Was running for ~4 weeks
Started crashing, but I really don't know when and why.

Expected behavior:
Either k3s running or a detailed error message.
Actual behavior:
k3s just crashes and does not do anything. I could not manage to find any explanation for this error message or getting further information.

The error message is coming from the database engine. I would check the mariadb log for errors.

Sorry for the delay, i had to postpone debugging this cluster.
The MariaDB Server says:
Aborted connection 10303290 to db: 'unconnected' user: 'unauthenticated' host: '10.XX.XX.XX' (This connection closed normally without authentication)
Which is strange as the config.yaml of k3s did not change and is identical on all nodes. Today a second node started showing the same behavior.
Do the credentials get los somewhere?

Nevermind. A simple restart of the mariadb instance solved this issue.

authors: KornKalle brandond


text:
Enable http3 support

Proposed Changes
Enable http3 by default.
Http3 is a greate protocol for edge clusters and content delivery networks. It is one of the selling points of cloudflare as a CDN and could benefit a lot of people to have a quick and simple way to spin up a http3 compliant web server for testing.
Types of Changes
New feature
Verification
We can simply spin up a k3s docker image and perform a quick curl command against it. We should see 2 things:
The Alt-Svc header indicating there is a h3 service under 443
http3 requests if you launch it with a modern web browser like chrome.
Linked Issues
https://github.com/k3s-io/k3s/issues/5184
User-Facing Change
Enable http3 on by default on traefik

Further Comments
I opened another MR because the previous one got superseded.

Codecov Report

Merging #5221 (66bf13e) into master (44c5374) will not change coverage.
The diff coverage is n/a.

@@          Coverage Diff           @@
##           master   #5221   +/-   ##
======================================
  Coverage    9.64%   9.64%
======================================
  Files         134     134
  Lines        9312    9312
======================================
  Hits          898     898
  Misses       8223    8223
  Partials      191     191

Flag
Coverage Δ

unittests
9.64% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files
Coverage Δ

pkg/deploy/zz_generated_bindata.go
0.00% <ø> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 44c5374...66bf13e. Read the comment docs.

We are hesitant to deploy http3 as it is still draft and not widely deployed. You can always replace the traefik component  --disable traefik with your own traefik that enables http3.

For the time being, it might be better to convert this to a docs PR? Users that are ready to enable http3 can do so by deploying a HelmChartConfig manifest:
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    experimental:
      http3:
        enabled: true
    ports:
      websecure:
        http3: true

Closing this PR as we do not want to enable http3 by default at this time. Please use the manifest above as to add http3 support for your deployment.

authors: brandond codecov-commenter dereknola tete17


text:
The dataflow score is 0

WARNING:root:WARNING: There is no reference data-flows extracted from the whole corpus, and the data-flow match score degenerates to 0. Please consider ignoring this score.
I get this warning when I'm calculating, and I want to know why is this a problem

It is warning from the original implementation, so i can not consult on why dataflow works as it works =)
I can suggest you calc single example and get this warning. data flow designed to be applied to some corpus, not the single example.


text:
Allow for metadata file to be added to directory structure

In many cases, it is useful for operators to maintain a metadata file that is ignored by tooling. One use case for this sort of file is to maintain the most up-to-date bundle version. Currently, any file or directory additions that do not meet the bundle version format are rejected. For the hive-operator, this results in us needing to traverse through all version subdirectories in order to identify the highest version bundle.
It would be helpful to allow for an exception to this rule, perhaps by allowing for hidden files (.metadata.yaml) or a metadata directory outside of the version directories.

@2uasimojo