This is a custom validator that stops validation if a specific field doesn’t have the assumed value – and can also require the field to be present (so that the field can’t just be left empty even if the other field is present).

def validator_required_if(other_field_name, other_value, is_required: bool = False):
    def _validator(form, field):
        other_field = form[other_field_name]

        if other_field.data == other_value:
            if not field.data or (isinstance(field.data, str) and not field.data.strip()):
                raise StopValidation(f'This field is required when {other_field.label.text} is "{other_value}"')
        else:
            field.data = None

            if not is_required:
                field.errors[:] = []

            raise StopValidation()

    return _validator

Usage of the validator in a WTForms field:

# 'type' is a different field on the same form.
# 'label' is the value 'type' should have to apply the following validators
text = StringField(_l('Label'), validators=[validator_required_if('type', 'label'), InputRequired()])

The example verifies that the field text has input present if the field type is set to label. If the field type is set to label but text isn’t present, an error will be thrown.

A common way to solve this is by defining a personal access token (a PAT), but this has a severe limitation: it needs access to both the project you’re deploying and the external submodule. But why does that matter? Because it means that you can’t configure the PAT under an organisation and re-use it across all your projects without making the PAT have access to all the repositories as well.

You effectively end up with a super-PAT that isn’t limited to just deploying the submodule.

Instead, you have to do it rather manually and as a two-step process. First, check out your project as you’d usually do with the checkout action, and then do the manual dance of configuring ssh with your deploy key and fetch submodules explicitly with git.

You’ll end up with something resembling these two workflow steps (based on a few posts on Stack Overflow and suggestions from a few LLMs):

      - name: Checkout and setup
        uses: actions/checkout@v6.0.1
        with:
          submodules: false
      - run: |
          mkdir -p ~/.ssh
          touch ~/.ssh/id_deploy_key
          chmod 0600 ~/.ssh/id_deploy_key
          echo '${{ secrets.LIBRARY_DEPLOY_PRIVATE_KEY }}' > ~/.ssh/id_deploy_key
          GIT_SSH_COMMAND="ssh -i ~/.ssh/id_deploy_key" git submodule update --init --recursive
        shell: bash

This is slightly verbose, but it works nicely in practice. Stick the deploy key in an organization secret under the name LIBRARY_DEPLOY_PRIVATE_KEY, and it’ll be available to any workflow that needs access to your private submodule.

And if it leaks – it just affects your common library, which shouldn’t contain any valuable secrets (.. outside of your code, at least) and your generic library code.

The best way would be that actions itself supported providing a deploy key for a given submodule, but it doesn’t seem like GitHub wants to support that from the tickets I read while researching this.

So if no data has been submitted, we want to get the initial value defined for the form to show to the user, but if data has been submitted, we want to show the value submitted instead.

The first iteration was something like this:

ExportForm(self.request.GET, initial={
    'start_datetime': utcnow(),
    'end_datetime': utcnow(),
})

Since request.GET is empty, the initial value should be used instead. And if we use {{ form.start_datetime.initial }} everything looks fine. But if we use .value instead of .initial to get the resolved value for the field (the submitted or the initial value), we only get None back.

The problem occurs because we’ve actually bound the form – if the form is unbound, we get the initial value back when calling {{ form.start_datetime.value }}, but since the form has been initialized with a dictionary (self.request.GET), the form is now considered bound, even if self.request.GET is empty (i.e. no parameters has been provided through the URL – the state before a request is made).

The answer is to massage the form slightly on creation instead:

ExportForm(self.request.GET or None, initial={
    'start_datetime': utcnow(),
    'end_datetime': utcnow(),
})

The or None part means that if the GET request is empty, we send in None instead, meaning that the form won’t be considered bound. This way we can use {{ form.start_datetime.value }} in our form, and actually get either the submitted value or the initial value back.

Flask-Session supports this through their regenerate function, which you can call on the defined session interface (either through app.session_interface or, in a blueprint, through current_app.session_interface).

Some language models (regardless of them qualifying themselves as either large or small) are going to say “just use session.clear() and the session token will be regenerated”, but they’ll be wrong (at least for Flask 3.1).

So you try to do it yourself – you log out of your account, and then sign in again, and by calling regenerate() in your sign in function, you expect the session token to be regenerated from whatever it previously was.

But that doesn’t happen.

Your code would look like (in a blueprint):

session.clear()
current_app.session_interface.regenerate(session)

session['user_id'] = user.id

return redirect(url_for('index'))

.. but nothing changes. Well, it turns out that Flask-Session guards it regenerate() function with a check for a true-ish value, instead of checking if there’s a valid session given:

def regenerate(self, session: ServerSideSession) -> None:
    """Regenerate the session id for the given session. Can be used by calling ``flask.session_interface.regenerate()``."""
    if session:
        # Remove the old session from storage
        self._delete_session(self._get_store_id(session.sid))
        # Generate a new session ID
        new_sid = self._generate_sid(self.sid_length)
        session.sid = new_sid
        # Mark the session as modified to ensure it gets saved
        session.modified = True

And this is where the issue happens – since you’ve done what you should be doing – clearing the session, not trusting whatever might be there; you’re left with an empty session dictionary, which will evaluate to a false-y value, and not a true-ish value – so since the session is empty, the code will never run.

The answer is to ask Flask-Session nicely to regenerate the session id after you’ve populated with the user’s information:

session.clear()
session['user_id'] = user.id
current_app.session_interface.regenerate(session)

That way the Flask-Session will be happy with you, since you now have a session that will be seen as true-ish instead, and the world will rejoice.

And that, my friends, was what made me write another post here to document something weird after eight years of hiatus.

ENV MAGICK_HOME=/usr
RUN apk add --no-cache imagemagick && \
apk add --no-cache imagemagick-dev

The first one is required for Wand to find the installed MagickWand libraries, while the second installs the imagickmagick development dependencies (and thus, the magickwand shared library).

Turns out it was ansicon.exe. After starting the 32-bit cmd.exe from windows\SysWOW64 and stuff worked – I discovered I got an error about ansicon.exe not being able to load. Removing ansicon.exe completely solved the problem. I’m .. stunned.

The solution: A new USB controller card. Apparently the USB ports on the motherboard introduced too much noise on the connection, and since ANT+ (or bkool, not sure) doesn’t have any proper error correction to detect errors on a smaller level and resend USB packages, it seems there was an error introduced somewhere in the firmware update, and the end checksum failed.

A new VIA-based USB PCI-card from Ebay solved the issue, and now my firmware is upgraded! Yay! (the trainer worked just fine except for that, so it was still usable – but I had a bug appear that the firmware should fix (or maybe that was caused by noise on the USB bus as well? We’ll see. Zwifting away in a couple of days)!

There’s quite a few other reasons for the error as well, but Google have probably already told you about those.

Sadly all the old URLs for apt-get in sources.list had stopped working, as the mirrors no longer had that specific Ubuntu (utopic) version available.

Luckily – after a bit of using our old friend Google – I found old-releases.ubuntu.com. This is also available as an archive for content through APT, so if you prefix your old addresses with old-releases.ubuntu.com instead of whatever mirror you’re used to fetching images from, you can get last version of the packages made available when you first set up your distro.

Saved the day!

What solved it? Removing the old directory again (even after trying a fresh install) and then explicitly finding the 64-bit version from the python download page (it gives you the 32-bit version by default, it seems). Reinstalling with the new archive fixed everything, and now it works again (and I checked “pre-compile the standard library, but that shouldn’t change anything)! Woho! Now to just reinstall quite a few virtualenvs..