cwielenb/CNCF-Dataset huggingface dataset:
Project: ArangoDB (App Definition and Development / Database)
File: example2.md

+++ title = "Calling it from C" description = "" weight = 30 +++ Firstly we need to declare to C our `result` returning C++ function: {{% snippet "c_api.c" "preamble" %}} Now let's call the C++ function from C: {{% snippet "c_api.c" "example" %}} Running this C program yields: ``` to_string(9) fills buffer with '9' of 1 characters to_string(99) fills buffer with '99' of 2 characters to_string(999) fills buffer with '999' of 3 characters to_string(9999) failed with error code 105 (No buffer space available) ```
Project: kube-hunter (Provisioning / Security & Compliance)
File: CONTRIBUTING.md

Thank you for taking interest in contributing to kube-hunter! This guide will walk you through the development process of kube-hunter. kube-hunter is written in Python 3 and supports versions 3.6 and above. You'll probably want to create a virtual environment for your local project. Once you got your project and IDE set up, you can `make dev-deps` and start contributing! You may also install a pre-commit hook to take care of linting - `pre-commit install`. Feel free to open issues for any reason as long as you make it clear if this issue is about a bug/feature/hunter/question/comment. Please spend a small amount of time giving due diligence to the issue tracker. Your issue might be a duplicate. If it is, please add your comment to the existing issue. Remember users might be searching for your issue in the future, so please give it a meaningful title to help others. The issue should clearly explain the reason for opening, the proposal if you have any, and any relevant technical information. Every Pull Request should have an associated Issue unless you are fixing a trivial documentation issue. Your PR is more likely to be accepted if it focuses on just one change. Describe what the PR does. There's no convention enforced, but please try to be concise and descriptive. Treat the PR description as a commit message. Titles that start with "fix"/"add"/"improve"/"remove" are good examples. Please add the associated Issue in the PR description. There's no need to add or tag reviewers. If a reviewer commented on your code or asked for changes, please remember to mark the discussion as resolved after you address it. PRs with unresolved issues should not be merged (even if the comment is unclear or requires no action from your side). Please include a comment with the results before and after your change. Your PR is more likely to be accepted if it includes tests (We have not historically been very strict about tests, but we would like to improve this!). If you are contributing a new Hunter: When you open an issue to present the Hunter, please specify which `Vulnerability` classes you plan to add. A maintainer will assign each `Vulnerability` a VID for you to include in your Hunter code. Please add a KB article to `/docs/kb/` explaining the vulnerability and suggesting remediation steps. Look at other articles for examples. Please adhere to the following types convention: Use `Hunter` class to report vulnerabilities, `ActiveHunter` if your Hunter might change the state of the cluster, and `Discovery` for scanning the cluster (all are descendants of `HunterBase`). Also, use the `Vulnerability` class to report findings, and `Service` to report a discovery to be used by a hunter (both are descendants of `Event`, refrain from using `Event` directly).
Project: Meshery (Provisioning / Automation & Configuration)
File: 10-12-2022-02-03-10_9078178a.md

timestamp: "2022-10-12 02:02:44 UTC Wed" meshery-component: meshery-consul meshery-component-version: edge meshery-server-version: "v0.6.15" k8s-distro: minikube k8s-version: "v1.20.11" service-mesh: Consul service-mesh-version: "v0.49.0" tests: consul-client: null consul-server: null overall-status: "failing"
Project: YugabyteDB (App Definition and Development / Database)
File: jsonb-to-recordset.md

title: jsonbtorecordset() and jsontorecordset() headerTitle: jsonbtorecordset() and jsontorecordset() linkTitle: jsonbtorecordset() description: Convert a homogeneous JSON array of JSON objects into the equivalent set of SQL records. Offers no practical advantage over the jsonbpopulaterecordset() variant. menu: v2.18: identifier: jsonb-to-recordset parent: json-functions-operators weight: 240 type: docs Purpose: Convert a homogeneous JSON array of JSON objects into the equivalent set of SQL records. Signature For the `jsonb` variant: ``` input value: jsonb return value: SETOF record ``` Notes: The function `jsonbtorecordset()` bears the same relationship to as bears to . Therefore, the `DO` block that demonstrated the functionality of can be extended to demonstrate the functionality of `jsonbtorecordset()` as well and to show that their results are identical. See the "Record and array comparison" note in the account of `jsonbpopulaterecordset()`. ```plpgsql create type t as (a int, b int); do $body$ declare arrayofobjects constant jsonb := '[ {"a": 1, "b": 2}, {"b": 4, "a": 3}, {"a": 5, "c": 6}, {"b": 7, "d": 8}, {"c": 9, "d": 0} ]'; rows_1 t[]; rows_2 t[]; expected_rows constant t[] := array[ ( 1, 2)::t, ( 3, 4)::t, ( 5, null)::t, (null, 7)::t, (null, null)::t ]; row t; n int := 0; begin for row in ( select a, b from jsonbpopulaterecordset(null::t, arrayofobjects) ) loop n := n + 1; rows_1[n] := row; end loop; n := 0; for row in ( select a, b from jsonbtorecordset(arrayofobjects) as onthefly(a int, b int) ) loop n := n + 1; rows_2[n] := row; end loop; assert (rows1 = expectedrows) and (rows2 = expectedrows), 'unexpected'; end; $body$; ``` The same considerations apply here as do for if the target `record` data type has a non-primitive field. The `jsonbtorecordset()` syntax variant therefore has no practical advantage over the variant.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: oxfordbigdatainstitute.md

title: "Oxford Big Data Institute" icon: /images/logos/powered-by/oxfordbigdatainstitute.png hasLink: "https://www.bdi.ox.ac.uk/" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. -->
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.9.18.md

RabbitMQ `3.9.18` is a maintenance release in the `3.9.x` release series. Please refer to the Upgrading to 3.9 section from if upgrading from a version prior to 3.9.0. This release requires at least Erlang 23.2, and supports Erlang 24. has more details on Erlang version requirements for RabbitMQ. Release notes can be found on GitHub at . 40 to 50% throughput improvement for some workloads where AMQP 0-9-1 clients consumed from a . GitHub issue: Configuration of fallback secrets for Shovel and Federation credential obfuscation. This feature allows for secret rotation during rolling cluster node restarts. Contributed by Lajos @luos Gerecs. GitHub issue: Reduced memory footprint of individual of quorum queue consumers. GitHub issue: CLI tools failed to run on Erlang 25 because of an old version of Elixir (compiled on Erlang 21) was used in the release pipeline. Erlang 25 no longer loads modules compiled on Erlang 21 or older. Default log level used a four-character severity abbreviation instead of more common longer format, for example, `warn` instead of `warning`. GitHub issue: `rabbitmq-diagnostics status` now reports crypto library (OpenSSL, LibreSSL, etc) used by the runtime, as well as its version details. GitHub issue: `rabbitmqctl setloglevel` documentation clarification. Contributed by Pter @gomoripeti Gmri (CloudAMQP). GitHub issue: `credentials_obfuscation` was upgraded To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.9.18.tar.xz` instead of the source tarball produced by GitHub.
Project: LinuxKit (Provisioning / Automation & Configuration)
File: 2017-05-24.md

Time: 9am PDT (12pm EDT, 5pm BST) Meeting location: https://docker.zoom.us/j/779801882 Announcement: Video Recording: https://youtu.be/OB1Tu6cISLg Introductions Overview of LinuxKit and its security initiatives Discuss goals of SIG Updates on security `/projects`: clear-containers kernel-config kspp landlock miragesdk okernel wireguard IMA namespace support Proposal: `hardened` channel - combining multiple security `/projects` into one yml which projects are ready? When is a project "ready"? which projects can / cannot be combined? Next meeting: 2017-06-07 miragesdk demo and deep dive - @samoht we can propose additional deep dives and discussion topics! Administrivia There is a code of conduct Attendees from Docker, Intel, HPE, Google, IBM, ARM, Arxan Technologies What is LinuxKit? LinuxKit is a toolkit for building container-focused Linuxen. i.e. distro building tool, not a distro itself Grew out of Docker for \ ({AWS, Mac, etc.}) Borrowed userspace mostly from Alpine system daemons (e.g. DHCP, possibly SSH, etc.) run in containers, which are distributed as Docker images base OS is immutable, since daemons are containers Projects * Question: what's the Intel feeling r.e. kvmtool, are they still interested in using it for clear containers? * working on a more-sane way to manage kernel config, centered around diffs from defconfig instead of whole configs * eBPF LSM that may be a better solution to some of the problems that SELinux can also solve no assumptions about policy, subjects, objects, etc. made by other LSMs LSM stacking hopefully this decade :) previous versions went up to a v22, but progress being made * re-write system daemons that have lots attack surface but don't get much attention (dhcpd is a great example, needs privs for netlink and such) dhcpd works (used in Docker desktop client) hoping to submit to google clusterfuzz * improve the linux kernel's ability to protect its own integrity leverage modern CPU support for things like EPT, to split the kernel into two parts https://github.com/linux-okernel/linux-okernel * new "VPN" tunnel, meant to replace IPSec or OpenVPN much smaller codebase modern crypto less complexity: no certs, etc. key exchange is done out of band, simply base64 encoded keys kernel module for now, working on upstreaming exposes a network device, so everything going through it is secure * IMA itself is designed to detect any changes to files allows users to specify policies about which files to check EVM protects changes to file xattrs, etc. IMA is not namespace aware right now, the goal is to be able to add custom policies per-mount-namespace policies "hardened" channel maybe don't call it "hardened", since it really means "testing" (staging, probational), "hardened" also makes it sound like mainline LinuxKit isn't secure somehow require CI for graduation wrap up forum link above
Project: Apache CarbonData (App Definition and Development / Database)
File: index-developer-guide.md

<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> Index is a data structure that can be used to accelerate certain query of the table. Different Index can be implemented by developers. Currently, Carbondata supports three types of Indexes: BloomFilter Index: A space-efficient probabilistic data structure that is used to test whether an element is a member of a set. Lucene Index: High performance, full-featured text search engine. Secondary Index: Sencondary index tables to hold blocklets are created as indexes and managed as child tables internally by Carbondata. When user issues `CREATE INDEX index_name ON TABLE main AS 'provider'`, the corresponding IndexProvider implementation will be created and initialized. Currently, the provider string can be: class name IndexFactory implementation: Developer can implement new type of Index by extending IndexFactory When user issues `DROP INDEX index_name ON TABLE main`, the corresponding IndexFactory class will be called. Click for more details about and supported .
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: pull.image.md

Pull image policy. The default is always. always, true: Always pull the image and throw an error if the pull fails. missing: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. never, false: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. newer: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found.
Project: SuperEdge (Provisioning / Automation & Configuration)
File: CHANGELOG-0.4.md

- - Penetrator. It is used to batch add and reload edge nodes from the cloud(,). The user submits nodetask, a Kubernetes CRD, and then penetrator batch adds and reloads edge nodes in the background, even if the nodes can only be accessed one-way. Support SSH login to edge nodesfrom cloud, even if the nodes can only be accessed one-way(,). Servicegroup supports multi cluster application distribution(,). Nodeunits under the same nodegroup can be distributed in different clusters and need to be used together with clusternet. SuperEdge can install into native Kubernetes cluster as add-on(,). Fetch the NewInitNodePhase() function directly into an `init-node.sh` script(,). Upgrade k8s.io/klog into k8s.io/klog/v2(,). Modify edgeadm, to disable selinux(, ). Lite-apiserver: add modify-request-accept param(, ). Check node name parameter, the IPv4 format is not supported(, ). Add hostname requirements to deployment docs(, ). Add edge-health deploy(, ).
Project: YugabyteDB (App Definition and Development / Database)
File: check-processes.md

title: Check servers linkTitle: Check servers headerTitle: Check YugabyteDB servers description: How to check if your YugabyteDB servers are running menu: preview: parent: troubleshoot-nodes weight: 10 type: docs To troubleshoot server issues, you should perform a number of checks. To verify whether or not the servers are running, you need to connect to the local node where YugabyteDB is running. On a local setup, this would be your local machine (or a Docker instance running on your local machine). On a multi-node cluster, you may need to `ssh` into the machines where the YugabyteDB nodes are running, as follows: ```sh ps aux | grep yb-tserver ``` If you are expecting a YB-Master server on this node, execute the following command: ```sh $ ps aux | grep yb-master ``` If the servers are not running, you can start them by using the following: . and when using a . If the servers are running, yet they are not accessible from your client machine, it may indicate a network issue. Typically, the endpoints are defined as follows: | Description | URL | | - | - | | Master Web Page | `<node-ip>:7000` | | TServer Web Page | `<node-ip>:9000` | | YSQL Metrics | `<node-ip>:13000/metrics` | | YCQL Metrics | `<node-ip>:12000/metrics` | | YSQL Server | `<node-ip>:5433` | | YCQL Server | `<node-ip>:9042` | However, in some cases these endpoints may not be accessible, depending on the configuration on your physical machines or on your cloud provider account. Private versus Public IP: Consider setting up a VPN or using the node's public IP (for example, get it from the machine status on your cloud-provider account). Cloud Account Configuration: Open the relevant ports, as per the following definition, for TCP traffic on your cloud provider account (for example, security group rules). Firewall is enabled: If your host has firewall enabled, run the following commands to open the ports using firewall exceptions. ```sh sudo firewall-cmd --zone=public --add-port=7000/tcp; sudo firewall-cmd --zone=public --add-port=7100/tcp; sudo firewall-cmd --zone=public --add-port=9000/tcp; sudo firewall-cmd --zone=public --add-port=9100/tcp; sudo firewall-cmd --zone=public --add-port=11000/tcp; sudo firewall-cmd --zone=public --add-port=12000/tcp; sudo firewall-cmd --zone=public --add-port=9300/tcp; sudo firewall-cmd --zone=public --add-port=9042/tcp; sudo firewall-cmd --zone=public --add-port=6379/tcp; ``` macOS Monterey enables AirPlay receiving by default, which listens on port 7000. This conflicts with YugabyteDB and causes `yugabyted start` to fail, as follows: ```sh ./bin/yugabyted start ``` ```output Starting yugabyted... / Running system checks...Failed to bind to address: 0.0.0.0:7000 ``` The workaround is to disable AirPlay receiving, then start YugabyteDB, and then, optionally, enable AirPlay receiving. Alternatively, and this is the recommended approach, you can change the default port number using the `--masterwebserverport` flag when you start the cluster, as follows: ```sh ./bin/yugabyted start --masterwebserverport=9999 ```
Project: Pravega (App Definition and Development / Streaming & Messaging)
File: pravega-security-authorization-authentication.md

<!-- Copyright Pravega Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> Pravega ingests application data, which is often sensitive and requires security mechanisms to avoid unauthorized access. To prevent such unauthorized accesses in shared environments, we have enabled mechanisms in Pravega that secure Stream data stored in a Pravega cluster. The security documentation covers aspects of our mechanisms and provides configuration details to enable security in Pravega. Key features of security implementation: Pravega allows administrators to enable encryption for different communication channels using TLS. Pravega provides role Based access control which can be availed by a variety of enterprises. Pravega performs dynamic implementations of the Authorization/Authentication . Multiple implementations can co-exist and different plugins can be used by different users. Multiple mechanisms are enabled by Pravega to the users for specifying auth parameters to the client. See for more details. Components like Bookkeeper, Zookeeper etc., which are deployed with Pravega can be deployed securely with TLS. discusses various options for this design and anlayzes the pros and cons in detail.
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl-system-token-list.md

layout: default title: mesheryctl-system-token-list permalink: reference/mesheryctl/system/token/list redirect_from: reference/mesheryctl/system/token/list/ type: reference display-title: "false" language: en command: system subcommand: token List tokens List all the tokens in your meshconfig <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system token list [flags] </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system token list </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> -h, --help help for list </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -c, --context string (optional) temporarily change the current context. -v, --verbose verbose output -y, --yes (optional) assume yes for user interactive prompts. </div> </pre> Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.
Project: KICS (Provisioning / Security & Compliance)
File: 22fbfeac-7b5a-421a-8a27-7a2178bb910b.md

title: CMK Rotation Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 22fbfeac-7b5a-421a-8a27-7a2178bb910b Query name: CMK Rotation Disabled Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: Customer Master Keys (CMK) must have rotation enabled, which means the attribute 'enablekeyrotation' must be set to 'true' when the key is enabled.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awskmskey" "positive1" { description = "KMS key 1" } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "awskmskey" "positive2" { description = "KMS key 2" is_enabled = true enablekeyrotation = false } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" resource "awskmskey" "positive3" { description = "KMS key 3" is_enabled = true customermasterkeyspec = "SYMMETRICDEFAULT" enablekeyrotation = false } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="1" resource "awskmskey" "positive4" { description = "KMS key 4" customermasterkeyspec = "SYMMETRICDEFAULT" enablekeyrotation = false } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="1" resource "awskmskey" "positive5" { description = "KMS key 5" customermasterkeyspec = "RSA2048" enablekeyrotation = true } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awskmskey" "negative1" { description = "KMS key 1" is_enabled = true enablekeyrotation = true } ``` ```tf title="Negative test num. 2 - tf file" resource "awskmskey" "negative2" { description = "KMS key 2" customermasterkeyspec = "RSA4096" } ``` ```tf title="Negative test num. 3 - tf file" resource "awskmskey" "negative3" { description = "KMS key 3" customermasterkeyspec = "RSA2048" } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf resource "awskmskey" "negative4" { description = "KMS key 4" customermasterkeyspec = "RSA3072" } ``` </details> <details><summary>Negative test num. 5 - tf file</summary> ```tf resource "awskmskey" "negative5" { description = "KMS key 5" customermasterkeyspec = "SYMMETRICDEFAULT" enablekeyrotation = true } ``` </details>
Project: YugabyteDB (App Definition and Development / Database)
File: CONTRIBUTORS.md

If you have contributed to the YugabyteDB codebase, you will be asked to add yourself to this file. Check if your name is already in this file. If so, you do not need to do anything further. If your name is not in this list, please send a pull request with your name added to the end of this list. Each entry in the list below has the following format: ``` ``` This is a list of people who have contributed code to the .
Project: SuperEdge (Provisioning / Automation & Configuration)
File: bug-report.md

name: Bug Report about: Create a report to help us improve labels: kind/bug <!-- Please use this template while reporting a bug and provide as much info as possible. Thanks! --> What happened: What you expected to happen: How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: SuperEdge version: Kubernetes version (use `kubectl version`): OS (e.g. `cat /etc/os-release`): Kernel (e.g. `uname -a`): Hardware configuration (e.g. `lscpu`) Go Version (e.g. `go version`) Others: