cwielenb/CNCF-Dataset huggingface dataset:
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: authfile.md

Path of the authentication file. Default is `${XDGRUNTIMEDIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. The file is created by . If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using docker login. Note: There is also the option to override the default path of the authentication file by setting the `REGISTRYAUTHFILE` environment variable. This can be done with export REGISTRY_AUTH_FILE=_path_.
Project: StarRocks (App Definition and Development / Database)
File: bitmap_agg.md

displayed_sidebar: "English" Aggregates values (excluding NULLs) in a column into a bitmap (multiple rows into one row). ```Haskell BITMAP_AGG(col) ``` `col`: the column whose values you want to aggregate. It must evaluate to BOOLEAN, TINYINT, SMALLINT, INT, BIGINT, and LARGEINT. Returns a value of the BITMAP type. If the value in a row is less than 0 or greater than 18446744073709551615, the value will be ignored and not added to the Bitmap (see Example 3). Take the following data table as an example: ```PlainText mysql> CREATE TABLE t1_test ( c1 int, c2 boolean, c3 tinyint, c4 int, c5 bigint, c6 largeint ) DUPLICATE KEY(c1) DISTRIBUTED BY HASH(c1) BUCKETS 1 PROPERTIES ("replication_num" = "3"); INSERT INTO t1_test VALUES (1, true, 11, 111, 1111, 11111), (2, false, 22, 222, 2222, 22222), (3, true, 33, 333, 3333, 33333), (4, null, null, null, null, null), (5, -1, -11, -111, -1111, -11111), (6, null, null, null, null, "36893488147419103232"); select * from t1_test order by c1; +++++-+-+ | c1 | c2 | c3 | c4 | c5 | c6 | +++++-+-+ | 1 | 1 | 11 | 111 | 1111 | 11111 | | 2 | 0 | 22 | 222 | 2222 | 22222 | | 3 | 1 | 33 | 333 | 3333 | 33333 | | 4 | NULL | NULL | NULL | NULL | NULL | | 5 | 1 | -11 | -111 | -1111 | -11111 | | 6 | NULL | NULL | NULL | NULL | 36893488147419103232 | +++++-+-+ ``` Example 1: Aggregate values in column `c1` into one bitmap. ```PlainText mysql> select bitmaptostring(bitmapagg(c1)) from t1test; +-+ | bitmaptostring(bitmap_agg(c1)) | +-+ | 1,2,3,4,5,6 | +-+ ``` Example 2: Aggregate values in column `c2` into one bitmap (NULLs are ignored). ```PlainText mysql> SELECT BITMAPTOSTRING(BITMAPAGG(c2)) FROM t1test; +-+ | bitmaptostring(bitmap_agg(c2)) | +-+ | 0,1 | +-+ ``` Example 3: Aggregate values in column `c6` into one bitmap (the last two values that exceed the value range are ignored). ```PlainText mysql> select bitmaptostring(bitmapagg(c6)) from t1test; +-+ | bitmaptostring(bitmap_agg(c6)) | +-+ | 11111,22222,33333 | +-+ ``` BITMAP_AGG, BITMAP
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: CODE_OF_CONDUCT.md

In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. Examples of behavior that contributes to creating a positive environment include: Using welcoming and inclusive language Being respectful of differing viewpoints and experiences Gracefully accepting constructive criticism Focusing on what is best for the community Showing empathy towards other community members Examples of unacceptable behavior by participants include: The use of sexualized language or imagery and unwelcome sexual attention or advances Trolling, insulting/derogatory comments, and personal or political attacks Public or private harassment Publishing others' private information, such as a physical or electronic address, without explicit permission Other conduct which could reasonably be considered inappropriate in a professional setting Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at conduct@sourced.tech. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. This Code of Conduct is adapted from the , version 1.4, available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: oidc.md

title: OpenID Connect (OIDC) software: oauth oidc labels: category: security tutorials: https://www.openpolicyagent.org/docs/latest/oauth-oidc/ blogs: https://blog.styra.com/blog/integrating-identity-oauth2-and-openid-connect-in-open-policy-agent Integrating OpenID Connect (OIDC) with Open Policy Agent
Project: ShardingSphere (App Definition and Development / Database)
File: mask-rule.en.md

+++ title = "MASK" weight = 4 +++ ```sql REGISTER STORAGE UNIT ds_0 ( HOST="127.0.0.1", PORT=3306, DB="ds_0", USER="root", PASSWORD="root" ); ``` Create mask rule ```sql CREATE MASK RULE t_mask ( COLUMNS( (NAME=phonenumber,TYPE(NAME='MASKFROMXTO_Y', PROPERTIES("from-x"=1, "to-y"=2, "replace-char"="*"))), (NAME=address,TYPE(NAME='MD5')) )); ``` Create mask table ```sql CREATE TABLE `t_mask` ( `id` int(11) NOT NULL, `user_id` varchar(45) DEFAULT NULL, `phone_number` varchar(45) DEFAULT NULL, `address` varchar(45) DEFAULT NULL, PRIMARY KEY (`id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; ``` Alter mask rule ```sql ALTER MASK RULE t_mask ( COLUMNS( (NAME=user_id,TYPE(NAME='MD5')) )); ``` Drop mask rule ```sql DROP MASK RULE t_mask; ``` Unregister storage unit ```sql UNREGISTER STORAGE UNIT ds_0; ``` Drop distributed database ```sql DROP DATABASE mask_db; ```
Project: KICS (Provisioning / Security & Compliance)
File: d3499f6d-1651-41bb-a9a7-de925fea487b.md

title: Unpinned Package Version in Apk Add hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d3499f6d-1651-41bb-a9a7-de925fea487b Query name: Unpinned Package Version in Apk Add Platform: Dockerfile Severity: <span style="color:#ff7213">Medium</span> Category: Supply-Chain URL: Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="2 13 14 16 18" FROM alpine:3.9 RUN apk add --update py-pip RUN sudo pip install --upgrade pip COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 ENV TEST="test" CMD ["python", "/usr/src/app/app.py"] FROM alpine:3.7 RUN apk add py-pip && apk add tea RUN apk add py-pip \ && rm -rf /tmp/* RUN apk add --dir /dir libimagequant \ && minidlna RUN ["apk", "add", "py-pip"] RUN sudo pip install --upgrade pip COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python"] ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM alpine:3.4 RUN apk add --update py-pip=7.1.2-r0 RUN sudo pip install --upgrade pip COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python", "/usr/src/app/app.py"] FROM alpine:3.1 RUN apk add py-pip=7.1.2-r0 RUN ["apk", "add", "py-pip=7.1.2-r0"] RUN sudo pip install --upgrade pip COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python", "/usr/src/app/app.py"] ``` ```dockerfile title="Negative test num. 2 - dockerfile file" FROM alpine:3.4 RUN apk add --update py-pip=7.1.2-r0 RUN sudo pip install --upgrade pip COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python", "/usr/src/app/app.py"] FROM alpine:3.1 RUN apk add --virtual .test py-pip=7.1.2-r0 RUN apk --quiet --update --no-cache add libstdc++==11.2.1_git20220219-r2 RUN ["apk", "add", "--virtual .test", "py-pip=7.1.2-r0"] RUN sudo pip install --upgrade pip COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python", "/usr/src/app/app.py"] ```
Project: Meshery (Provisioning / Automation & Configuration)
File: kubedb-grafana-dashboards.md

layout: integration title: Kubedb Grafana Dashboards subtitle: Collaborative and visual infrastructure as code for Kubedb Grafana Dashboards image: /assets/img/integrations/kubedb-grafana-dashboards/icons/color/kubedb-grafana-dashboards-color.svg permalink: extensibility/integrations/kubedb-grafana-dashboards docURL: https://docs.meshery.io/extensibility/integrations/kubedb-grafana-dashboards description: integrations-category: App Definition and Development integrations-subcategory: Database registrant: Artifact Hub components: featureList: [ "KubeDB simplifies many of the difficult or tedious management tasks of running a production grade databases on private and public clouds. Maintain one stack for all your stateless and stateful applications and simplify the operational complexity.", "Standard Kubernetes is all you need. If you can run Kubernetes, you can provision and manage databases using KubeDB. Use standard Kubernetes CLI and API to provision and manage databases.", "KubeDB uses Persistent Volume Claims (PVC) to dynamically provision disks for database instances. Using appropriately defined StorageClasses, KubeDB provisioned database instances are designed to scale from small development workloads up to performance-intensive workloads on private and public cloud environments." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: Harbor (Provisioning / Container Registry)
File: 12-02-LDAP-usergroup-update.md

Test 12-02 LDAP Usergroup Update ======= To verify admin user can update an LDAP group User guide This test requires that a Harbor instance is running and available. An LDAP server is running and available, and enabled memberof overlay feature LDAP group config parameter are configured. ldapgroupbasedn ldapgroupfilter ldap_gid ldapgroupscope Login UI as admin user. In `Administration->User Group` page, Add an LDAP with a valid group DN with group name. In `Administration->User Group` page, Update the user group with a different name. In step3 the user group name is updated None
Project: kube-hunter (Provisioning / Security & Compliance)
File: KHV036.md

vid: KHV036 title: Anonymous Authentication categories: [Remote Code Execution] severity: high The kubelet is configured to allow anonymous (unauthenticated) requests to it's HTTP api. This may expose certein information, and capabilities to an attacker with access to the kubelet API. Ensure kubelet is protected using `--anonymous-auth=false` kubelet flag. Allow only legitimate users using `--client-ca-file` or `--authentication-token-webhook` kubelet flags. This is usually done by the installer or cloud provider.
Project: KICS (Provisioning / Security & Compliance)
File: architecture.md

KICS is 100% open source is written in Golang using Open Policy Agent (<a href="https://www.openpolicyagent.org/" target="_blank">OPA</a>). Golang speed, simplicity and reliability made it the perfect choice for writing KICS, while <a href="https://www.openpolicyagent.org/docs/latest/policy-language/" target="_blank">Rego</a> as a query language, was a native choice to implement security queries. So far have written 1000+ ready-to-use queries that cover a wide range of vulnerabilities checks for AWS, GCP, Azure and other cloud providers. KICS has a pluggable architecture with extensible pipeline of parsing IaC languages, which allows an easy integration of new IaC languages and queries. At a very high level, KICS is composed of the following main components: a command line interface, parser, queries execution engine, IaC providers, security queries, and results writer. Command Line Interface => Provides CLI input to KICS. Parser => responsible for parsing input IaC files (terraform and others) IaC Providers => Converts IaC language into normalized JSON Queries Execution Engine => applies REGO queries against normalized JSON Security Queries => pre-built REGO queries for each security and misconfiguration Writer => Writes results into JSON format <img src="https://raw.githubusercontent.com/Checkmarx/kics/master/docs/img/arch/high-level-arch.png"> <br/> The sequence diagram below depicts interaction of the main KICS components: <br/> <img src="https://raw.githubusercontent.com/Checkmarx/kics/master/docs/img/arch/exec-flow-1.png"> <br/> <img src="https://raw.githubusercontent.com/Checkmarx/kics/master/docs/img/arch/exec-flow-2.png"> KICS creates multiple services, each containing a unique parser. All the services will then concurrently generate a payload and run queries on it according to its containing parser. Concurrency exists on both the services representing each platform as well as the queries of each service. Each platform detected will run their queries concurrently with one another and the queries of each platform will themselves run concurrently using the number of workers passed on th. When a vulnerability is found, it is saved inside the Storage which is shared amongst all the services. Paths => create services based on types of IaC files; Service => contains a unique parser and shares other resources with other services; Start Scan => Services will concurrently create payloads based on its parser, inspect for vulnerabilities and save them on the shared storage; Results => when all services have finished their execution all the results will be gathered from the storage.
Project: Athenz (Provisioning / Key Management)
File: README.md

zts-accesstoken =============== ZTS OAuth2 Access Token Client application in Go to request an access token from ZTS Server for the given identity to access a role in a provider domain: There are two possible ways to use the utility: 1) using your athenz service identity certificate ```shell $ zts-accesstoken -domain <domain> [-roles <roles>] [-service <service>] -svc-key-file <private-key-file> -svc-cert-file <service-cert-file> -zts <ZTS url> [-expire-time <expire-time-in-mins>] ``` 2) using ntoken from a file ```shell $ zts-accesstoken -domain <domain> [-roles <roles>] [-service <service>] -ntoken-file <ntoken-file> -hdr Athenz-Principal-Auth -zts <ZTS url> [-expire-time <expire-time-in-mins>] ``` The service identity ntoken can be obtained by using the zms-svctoken utility. The optional expire-time argument specifies how long the access token should be valid for. The value must be specified in minutes. The defualt if no value is specified is 120 minutes. Copyright The Athenz Authors Licensed under the
Project: Meshery (Provisioning / Automation & Configuration)
File: kubevirt.md

layout: integration title: Kubevirt subtitle: Collaborative and visual infrastructure as code for Kubevirt image: /assets/img/integrations/kubevirt/icons/color/kubevirt-color.svg permalink: extensibility/integrations/kubevirt docURL: https://docs.meshery.io/extensibility/integrations/kubevirt description: integrations-category: App Definition and Development integrations-subcategory: Application Definition & Image Build registrant: Artifact Hub components: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: KICS (Provisioning / Security & Compliance)
File: 3e4d5ce6-3280-4027-8010-c26eeea1ec01.md

title: Project-wide SSH Keys Are Enabled In VM Instances hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3e4d5ce6-3280-4027-8010-c26eeea1ec01 Query name: Project-wide SSH Keys Are Enabled In VM Instances Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Secret Management URL: VM Instance should block project-wide SSH keys<br> ```tf title="Positive test num. 1 - tf file" hl_lines="29 39" resource "googlecomputeinstance" "positive1" { name = "test" machine_type = "e2-medium" zone = "us-central1-a" tags = ["foo", "bar"] boot_disk { initialize_params { image = "debian-cloud/debian-9" } } // Local SSD disk scratch_disk { interface = "SCSI" } network_interface { network = "default" access_config { // Ephemeral IP } } metadata = { block-project-ssh-keys = false } metadatastartupscript = "echo hi > /test.txt" service_account { scopes = ["userinfo-email", "compute-ro", "storage-ro"] } } resource "googlecomputeinstance" "positive2" { name = "test" machine_type = "e2-medium" zone = "us-central1-a" tags = ["foo", "bar"] boot_disk { initialize_params { image = "debian-cloud/debian-9" } } // Local SSD disk scratch_disk { interface = "SCSI" } network_interface { network = "default" access_config { // Ephemeral IP } } metadatastartupscript = "echo hi > /test.txt" service_account { scopes = ["userinfo-email", "compute-ro", "storage-ro"] } } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecomputeinstance" "negative1" { name = "test" machine_type = "e2-medium" zone = "us-central1-a" tags = ["foo", "bar"] boot_disk { initialize_params { image = "debian-cloud/debian-9" } } // Local SSD disk scratch_disk { interface = "SCSI" } network_interface { network = "default" access_config { // Ephemeral IP } } metadata = { block-project-ssh-keys = "TRUE" } metadatastartupscript = "echo hi > /test.txt" service_account { scopes = ["userinfo-email", "compute-ro", "storage-ro"] } } ```
Project: KICS (Provisioning / Security & Compliance)
File: a737be28-37d8-4bff-aa6d-1be8aa0a0015.md

title: Workload Mounting With Sensitive OS Directory hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a737be28-37d8-4bff-aa6d-1be8aa0a0015 Query name: Workload Mounting With Sensitive OS Directory Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: Workload is mounting a volume with sensitive OS Directory<br> ```tf title="Positive test num. 1 - tf file" hl_lines="112 53" resource "kubernetes_pod" "test1" { metadata { name = "terraform-example1" } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } volume { host_path { path = "/var/log" } } dns_policy = "None" } } resource "kubernetespersistentvolume" "test2" { metadata { name = "terraform-example2" } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } volume { host_path { path = "/var/log" } } dns_policy = "None" } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetes_pod" "test3" { metadata { name = "terraform-example3" } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } resource "kubernetespersistentvolume" "test4" { metadata { name = "terraform-example4" } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } ```
Project: ClickHouse (App Definition and Development / Database)
File: v21.1.6.13-stable.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Fix rare bug when some replicated operations (like mutation) cannot process some parts after data corruption. Fixes . (). Backported in : Fix crash which could happen if unknown packet was received from remove query (was introduced in ). (). Backported in : Fix 'Empty task was returned from async task queue' on query cancellation. (). Backported in : Fixed behaviour, when `ALTER MODIFY COLUMN` created mutation, that will knowingly fail. (). Backported in : - Block parallel insertions into storage join. (). Backported in : Out of bound memory access was possible when formatting specifically crafted out of range value of type `DateTime64`. This closes . This closes . (). Backported in : Fixes . Fixed bug that could cause duplicates with insert query (if one of the callbacks came a little too late). (). Backported in : Fix bug with `joinusenulls` and joining `TOTALS` from subqueries. This closes and . ().