cwielenb/CNCF-Dataset huggingface dataset:
Project: Trivy (Provisioning / Security & Compliance)
File: swift.md

Trivy supports and package managers. The following scanners are supported. | Package manager | SBOM | Vulnerability | License | |--|:-:|:-:|:-:| | Swift | | | - | | CocoaPods | | | - | The following table provides an outline of the features Trivy offers. | Package manager | File | Transitive dependencies | Dev dependencies | | Position | |::||:--:|:-:|::|:--:| | Swift | Package.resolved | | Included | - | | | CocoaPods | Podfile.lock | | Included | | - | These may be enabled or disabled depending on the target. See for the detail. Trivy parses file to find dependencies. Don't forget to update (`swift package update` command) this file before scanning. CocoaPods uses package names in `PodFile.lock`, but Trivy relies on uses Git URLs. We parse to match package names and links. !!! note "Limitation" Since holds only Git URLs, such as github.com/apple/swift-nio, Trivy can't identify affected submodules, and detect all submodules maintained by the same URL. For example, and both are maintained under `github.com/apple/swift-nio`, and Trivy detect CVE-2022-3215 for both of them, even though only is actually affected.
Project: YugabyteDB (App Definition and Development / Database)
File: equality-operator.md

title: = (equality operator) [JSON] headerTitle: = (equality operator) linkTitle: = (equality) description: Test if two jsonb values are equal using the JSON equality operator (=). menu: v2.18: identifier: equality-operator parent: json-functions-operators weight: 15 type: docs Purpose: Test if two `jsonb` values are equal. Signature: ``` input values: jsonb = jsonb return value: boolean ``` Notes: There is no `json` overload. If you want to test that two `json` values are equal, express the predicate thus: ``` lhsjsonvalue::text = rhsjsonvalue::text ``` Example: ```plpgsql do $body$ declare j1 constant jsonb := '["a","b","c"]'; j2 constant jsonb := ' [ "a","b","c" ]'; begin assert j1 = j2, 'unexpected'; end; $body$; ``` Notice that the text definitions of the to-be-compared JSON values may differ in whitespace. Because `jsonb` holds a fully parsed representation of the value, whitespace (except within primitive JSON string values and key names) has no meaning. If you need to test two `json` values for equality, then you must `::text` typecast each. See the account of the `::text` operator when the input is a `json` value. The `json` representation preserves semantically insignificant whitespace and repeats occurrences of the same keys in an object. This implies that the equality comparison of two `json` values would in general be unpredictable and therefore meaningless. This is why the `=` operator doesn't have a `json` overload and is another reason to prefer consistently to choose to use `jsonb`. ```plpgsql do $body$ declare j1 constant json := '["a","b","c"]'; j2 constant json := '["a","b","c"]'; j3 constant json := '["a","b", "c"]'; begin assert (j1::text = j2::text) and not (j1::text = j3::text), 'unexpected'; end; $body$; ```
Project: SPIRE (Provisioning / Key Management)
File: plugin_server_keymanager_disk.md

The `disk` key manager maintains a set of private keys that are persisted to disk. The plugin accepts the following configuration options: | Configuration | Description | ||-| | keys_path | Path to the keys file on disk | A sample configuration: ```hcl KeyManager "disk" { plugin_data = { keys_path = "/opt/spire/data/server/keys.json" } } ```
Project: Harbor (Provisioning / Container Registry)
File: 3-11-DB-admin-user-manage-project-members.md

Test 3-11 - Admin Manages Project Members (DB Mode) ======= To verify that an admin user can add members of various roles to a project. Users are managed locally by Harbor (DB mode). User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against a local database. ( auth_mode is set to db_auth* .) The user data is stored in a local database. A linux host with Docker CLI installed (Docker client). At least three non-admin users are in Harbor. At least one project that admin user is not a member of. NOTE: In below test, user A, B and C are non system admin users. User A, B, C and project X should be replaced by longer and meaningful names. MUST use two kinds of browsers at the same time to ensure independent sessions. For example, use Chrome and Firefox, or Chrome and Safari. DO NOT use the same browser to log in two users at the same time in different windows(tabs). Log in to UI as admin user. Look for an existing project X that admin is not a member of. Add user A to project X as project admin. Add user B to project X as developer. Add user C to project X as guest. On a Docker client host, use `docker login <harbor_host>` to log in as admin. Use `docker push` to push an image to project X. Use `docker pull` to pull the image from project X. On a Docker client host, log out admin and log in as user A. Use `docker push` to push an image to project X. Use `docker pull` to pull the image from project X. On a Docker client host, log out user A and log in as user B. Use `docker push` to push an image to project X. Use `docker pull` to pull the image from project X. On a Docker client host, log out user B and log in as user C. Use `docker pull` to pull the image from project X. Use `docker push` to push an image to project X. (should fail) Keeps admin's UI session logging on, in a different browser log in as user C. In user C's UI, verify his/her role is guest of project X. In admin's UI, change user C's role to developer of project X. In user C's UI, verify his/her role is developer of project X. On a Docker client host, log in as user C. Use `docker pull` to pull the image from project X. Use `docker push` to push an image to project X. In admin's UI, change user C's role to project admin of project X. In user C's UI, verify his/her role is project admin of project X. In admin's UI, remove user C from project X. Set project X's publicity to on. On a Docker client host, log in as user C. Use `docker pull` to pull the image from project X. Use `docker push` to push an image to project X. (should fail) Set project X's publicity to off. On a Docker client host, log in as user C. Use `docker pull` to pull the image from project X. (should fail) Use `docker push` to push an image to project X. (should fail) Step 7,8,10,11,16 should succeed. Step 17 should report errors. Step 19,21, as described. Step 23,24 should succeed. Step 26 as described. Step 30 should succeed. Step 31 should fail. Step 34-35 should fail. None
Project: Cyclops (App Definition and Development / Application Definition & Image Build)
File: glasskube.md

slug: glasskube sidebar_label: Using Glasskube title: Install Cyclops with the Glasskube Package Manager description: "Glasskube is the easiest way to install and open Cyclops." is the missing Package Manager for Kubernetes featuring a GUI and a CLI. Glasskube packages are dependency aware, GitOps ready and can get automatic updates via a central public package repository. If you haven't already installed the `glasskube` client you can install it either via brew or follow the . ```shell brew install glasskube/tap/glasskube ``` After installing Glasskube you can bootstrap Glasskube with `glasskube bootstrap` or perform an automatic bootstrap with your first package installation. (This feature is only available in Glasskube v0.0.3+) Glasskube provides a graphical and command line interface for installing Cyclops. You simply install cyclops with: ```shell glasskube install cyclops ``` and open Cyclops with ```shell glasskube open cylcops ``` You can now access Cyclops in your browser on . The first step is to open the Glasskube GUI with the `serve` command. ```shell glasskube serve ``` Your default webbrowser will open on . Where you just need to click the "Install" Button for Cyclops. After the Installation of Cyclops you can open Cyclops with the "Open" button. Glasskube will automatically create all needed port forwarding connections and open Cyclops on .
Project: OAuth2 Proxy (Provisioning / Key Management)
File: azure.md

id: azure title: Azure Add an application: go to , choose Azure Active Directory, select App registrations and then click on New registration. Pick a name, check the supported account type(single-tenant, multi-tenant, etc). In the Redirect URI section create a new Web platform entry for each app that you want to protect by the oauth2 proxy(e.g. https://internal.yourcompanycom/oauth2/callback). Click Register. Next we need to add group read permissions for the app registration, on the API Permissions page of the app, click on Add a permission, select Microsoft Graph, then select Application permissions, then click on Group and select Group.Read.All. Hit Add permissions and then on Grant admin consent (you might need an admin to do this). <br/>IMPORTANT: Even if this permission is listed with "Admin consent required=No" the consent might actually be required, due to AAD policies you won't be able to see. If you get a "Need admin approval" during login, most likely this is what you're missing! Next, if you are planning to use v2.0 Azure Auth endpoint, go to the Manifest page and set `"accessTokenAcceptedVersion": 2` in the App registration manifest file. On the Certificates & secrets page of the app, add a new client secret and note down the value after hitting Add. Configure the proxy with: for V1 Azure Auth endpoint (Azure Active Directory Endpoints - https://login.microsoftonline.com/common/oauth2/authorize) ``` --provider=azure --client-id=<application ID from step 3> --client-secret=<value from step 5> --azure-tenant={tenant-id} --oidc-issuer-url=https://sts.windows.net/{tenant-id}/ ``` for V2 Azure Auth endpoint (Microsoft Identity Platform Endpoints - https://login.microsoftonline.com/common/oauth2/v2.0/authorize) ``` --provider=azure --client-id=<application ID from step 3> --client-secret=<value from step 5> --azure-tenant={tenant-id} --oidc-issuer-url=https://login.microsoftonline.com/{tenant-id}/v2.0 ``` *Notes*: When using v2.0 Azure Auth endpoint (`https://login.microsoftonline.com/{tenant-id}/v2.0`) as `--oidcissuerurl`, in conjunction with `--resource` flag, be sure to append `/.default` at the end of the resource name. See https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope for more details. When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxybuffersize in nginx or implementing the should resolve this.
Project: CloudMatos (Provisioning / Security & Compliance)
File: SECURITY.md

If you think you have found a potential security vulnerability in `Matos`, please email directly. Do not file a public issue. If English is not your first language, please try to describe the problem and its impact to the best of your ability. For greater detail, please use your native language and we will try our best to translate it using online services. Please also include the code you used to find the problem and the shortest amount of code necessary to reproduce it. Please do not disclose this to anyone else. We will retrieve a CVE identifier if necessary and give you full credit under whatever name or alias you provide. We will only request an identifier when we have a fix and can publish it in a release. We will respect your privacy and will only publicize your involvement if you grant us permission. This following information discusses the process the `Matos` project follows in response to vulnerability disclosures. If you are disclosing a vulnerability, this section of the documentation lets you know how we will respond to your disclosure. When you report an issue, one of the project members will respond to you within few days. This initial response will at the very least confirm receipt of the report. If we were able to rapidly reproduce the issue, the initial response will also contain confirmation of the issue. If we are not, we will often ask for more information about the reproduction scenario. Our goal is to have a fix for any vulnerability released within two weeks of the initial disclosure. This may potentially involve shipping an interim release that simply disables function while a more mature fix can be prepared, but will in the vast majority of cases mean shipping a complete release as soon as possible. Throughout the fix process we will keep you up to speed with how the fix is progressing. Once the fix is prepared, we will notify you that we believe we have a fix. Often we will ask you to confirm the fix resolves the problem in your environment, especially if we are not confident of our reproduction scenario. At this point, we will prepare for the release. We will obtain a CVE number if one is required, providing you with full credit for the discovery. We will also decide on a planned release date, and let you know when it is. On release day, we will push the patch to our public repository, along with an updated changelog that describes the issue. The change log is generated automatically from commit messages. We will then issue a PyPI release containing the patch. At this point, we will publicise the release. This will involve announcement on our Slack channel (community.cloudmatos.com) and all other communication mechanisms available to the core team. We will also explicitly mention which commits contain the fix to make it easier for other distributors and users to easily patch their own versions of `Matos` if upgrading is not an option.
Project: ClickHouse (App Definition and Development / Database)
File: stochasticlogisticregression.md

slug: /en/sql-reference/aggregate-functions/reference/stochasticlogisticregression sidebar_position: 222 This function implements stochastic logistic regression. It can be used for binary classification problem, supports the same custom parameters as stochasticLinearRegression and works the same way. Parameters are exactly the same as in stochasticLinearRegression: `learning rate`, `l2 regularization coefficient`, `mini-batch size`, `method for updating weights`. For more information see . ``` text stochasticLogisticRegression(1.0, 1.0, 10, 'SGD') ``` Fitting <!-- --> See the `Fitting` section in the description. Predicted labels have to be in \[-1, 1\]. Predicting <!-- --> Using saved state we can predict probability of object having label `1`. ``` sql WITH (SELECT state FROM your_model) AS model SELECT evalMLMethod(model, param1, param2) FROM test_data ``` The query will return a column of probabilities. Note that first argument of `evalMLMethod` is `AggregateFunctionState` object, next are columns of features. We can also set a bound of probability, which assigns elements to different labels. ``` sql SELECT ans < 1.1 AND ans > 0.5 FROM (WITH (SELECT state FROM your_model) AS model SELECT evalMLMethod(model, param1, param2) AS ans FROM test_data) ``` Then the result will be labels. `testdata` is a table like `traindata` but may not contain target value. See Also
Project: CloudEvents (App Definition and Development / Streaming & Messaging)
File: sampledrate.md

There are many cases in an Event's life when a system (either the system creating the event or a system transporting the event) might wish to only emit a portion of the events that actually happened. In a high throughput system where creating the event is costly, a system might wish to only create an event for 1/100 of the times that something happened. Additionally, during the transmission of an event from the source to the eventual recipient, any step along the way might choose to only pass along a fraction of the events it receives. In order for the system receiving the event to understand what is actually happening in the system that generated the event, information about how many similar events happened would need to be included in the event itself. This field provides a place for a system generating an event to indicate that the emitted event represents a given number of other similar events. It also provides a place for intermediary transport systems to modify the event when they impose additional sampling. This specification does not mandate which component (e.g. event source, event producer) is responsible for doing the sampling. Rather just if sampling is done then the attributes defined below are where the metadata would appear within the CloudEvent. As with the main , the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in . However, the scope of these key words is limited to when this extension is used. For example, an attribute being marked as "REQUIRED" does not mean it needs to be in all CloudEvents, rather it needs to be included only when this extension is being used. Type: `Integer` Description: The rate at which this event has already been sampled. Represents the number of similar events that happened but were not sent plus this event. For example, if a system sees 30 occurrences and emits a single event, `sampledrate` would be 30 (29 not sent and 1 sent). A value of `1` is the equivalent of this extension not being used at all. Constraints REQUIRED The rate MUST be greater than zero.
Project: StarRocks (App Definition and Development / Database)
File: variance.md

displayed_sidebar: "English" Returns the population variance of an expression. Since v2.5.10, this function can also be used as a window function. ```Haskell VARIANCE(expr) ``` `expr`: the expression. If it is a table column, it must evaluate to TINYINT, SMALLINT, INT, BIGINT, LARGEINT, FLOAT, DOUBLE, or DECIMAL. Returns a DOUBLE value. ```plaintext MySQL > select varpop(icurrentprice), irecstartdate from item group by irecstart_date; +--++ | varpop(icurrentprice) | irecstartdate | +--++ | 314.96177792808226 | 1997-10-27 | | 463.73633459357285 | NULL | | 302.02102643609123 | 1999-10-28 | | 337.9318386924913 | 2000-10-27 | | 333.80931439318346 | 2001-10-27 | +--++ MySQL > select variance(icurrentprice), irecstartdate from item group by irecstartdate; +++ | variance(icurrentprice) | irecstart_date | +++ | 314.96177792808226 | 1997-10-27 | | 463.7363345935729 | NULL | | 302.02102643609123 | 1999-10-28 | | 337.9318386924912 | 2000-10-27 | | 333.80931439318346 | 2001-10-27 | +++ ``` VARIANCE,VARPOP,VARIANCEPOP
Project: ThreatMapper (Provisioning / Security & Compliance)
File: pagerduty.md

title: PagerDuty ThreatMapper raises notifications to PagerDuty using the PagerDuty API (v1 or v2). In the PagerDuty console, navigate to Configuration > Services. If you are creating a new service for your integration, click Add New Service. If you are adding your integration to an existing service, click the name of the service you want to add the integration to, go to the Integrations tab, then click New Integration as shown in the image below. Next, create a new integration by selecting the appropriate API version as shown in the image below. Finally, return to the ThreatMapper management console. Enter the "integration key" of the new integration and subscribe to the vulnerabilities on PagerDuty as shown below:
Project: KICS (Provisioning / Security & Compliance)
File: 953c0cc6-5f30-44cb-a803-bf4ef2571be8.md

title: Databricks Autoscale Badly Setup hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 953c0cc6-5f30-44cb-a803-bf4ef2571be8 Query name: Databricks Autoscale Badly Setup Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Resource Management URL: Databricks should have min and max worker setup for autoscale<br> ```tf title="Positive test num. 1 - tf file" hl_lines="6" resource "databricks_cluster" "positive1" { cluster_name = "Shared Autoscaling" sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id autotermination_minutes = 20 autoscale { min_workers = 1 } aws_attributes { availability = "SPOT" zone_id = "us-east-1" firstondemand = 1 spotbidprice_percent = 100 } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="6" resource "databricks_cluster" "positive2" { cluster_name = "Shared Autoscaling" sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id autotermination_minutes = 20 autoscale { max_workers = 50 } aws_attributes { availability = "SPOT" zone_id = "us-east-1" firstondemand = 1 spotbidprice_percent = 100 } } ``` ```tf title="Negative test num. 1 - tf file" resource "databricks_cluster" "negative" { cluster_name = "Shared Autoscaling" sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id autotermination_minutes = 20 autoscale { min_workers = 1 max_workers = 50 } aws_attributes { availability = "SPOTWITHFALLBACK" zone_id = "auto" firstondemand = 1 spotbidprice_percent = 100 } } ```
Project: KICS (Provisioning / Security & Compliance)
File: b4378389-a9aa-44ee-91e7-ef183f11079e.md

title: IAM Policies Attached To User hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b4378389-a9aa-44ee-91e7-ef183f11079e Query name: IAM Policies Attached To User Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: IAM policies should be attached only to groups or roles<br> ```tf title="Positive test num. 1 - tf file" hl_lines="18" resource "awsiamuser" "positive1_1" { name = "${local.resource_prefix.value}-user" force_destroy = true tags = { Name = "${local.resource_prefix.value}-user" Environment = local.resource_prefix.value } } resource "awsiamaccesskey" "positive12" { user = awsiamuser.user.name } resource "awsiampolicyattachment" "positive13" { name = "excess_policy" users = [awsiamuser.user.name] policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:*", "s3:*", "lambda:*", "cloudwatch:*" ], "Effect": "Allow", "Resource": "*" } ] } EOF } output "username" { value = awsiamuser.user.name } output "secret" { value = awsiamaccesskey.user.encryptedsecret } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="18" resource "awsiamuser" "positive2_1" { name = "${local.resource_prefix.value}-user" force_destroy = true tags = { Name = "${local.resource_prefix.value}-user" Environment = local.resource_prefix.value } } resource "awsiamaccesskey" "positive22" { user = awsiamuser.user.name } resource "awsiamuserpolicy" "positive23" { name = "excess_policy" user = awsiamuser.user.name policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:*", "s3:*", "lambda:*", "cloudwatch:*" ], "Effect": "Allow", "Resource": "*" } ] } EOF } output "username" { value = awsiamuser.user.name } output "secret" { value = awsiamaccesskey.user.encryptedsecret } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="27" resource "awsiamuser" "user" { name = "test-user" } resource "awsiampolicy" "policy" { name = "test_policy" path = "/" description = "My test policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiamuserpolicyattachment" "test-attach" { user = awsiamuser.user.name policyarn = awsiam_policy.policy.arn } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "negative1" { name = "${local.resource_prefix.value}-user" force_destroy = true tags = { Name = "${local.resource_prefix.value}-user" Environment = local.resource_prefix.value } } resource "awsiamaccess_key" "negative2" { user = awsiamuser.user.name } resource "awsiampolicy_attachment" "negative3" { name = "excess_policy" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:*", "s3:*", "lambda:*", "cloudwatch:*" ], "Effect": "Allow", "Resource": "*" } ] } EOF } output "username" { value = awsiamuser.user.name } output "secret" { value = awsiamaccesskey.user.encryptedsecret } ```