cwielenb/CNCF-Dataset huggingface dataset:
Project: KubeArmor (Provisioning / Security & Compliance)
File: CODE_OF_CONDUCT.md

This is Code of Conduct is based on the [CNCF Code of Conduct](https://github.com/cncf/foundation/edit/master/code-of-conduct.md). See the referred document for translated versions into different languages. The text below is modified with KubeArmor community specific contact details. As contributors and maintainers of this project, and in the interest of fostering an open and welcoming community, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities. We are committed to making participation in this project a harassment-free experience for everyone, regardless of level of experience, gender, gender identity and expression, sexual orientation, disability, personal appearance, body size, race, ethnicity, age, religion, or nationality. Examples of unacceptable behavior by participants include: The use of sexualized language or imagery Personal attacks Trolling or insulting/derogatory comments Public or private harassment Publishing others' private information, such as physical or electronic addresses, without explicit permission Other unethical or unprofessional conduct. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct. By adopting this Code of Conduct, project maintainers commit themselves to fairly and consistently applying these principles to every aspect of managing this project. Project maintainers who do not follow or enforce the Code of Conduct may be permanently removed from the project team. This code of conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project maintainers or our mediator, Nandhini Ananthakalyanaraman (<nandhini@accuknox.com>). Individuals found to be in violation of the Code of Conduct may be removed from the project and prevented from future participation. This Code of Conduct is adapted from the Contributor Covenant (http://contributor-covenant.org), version 1.2.0, available at http://contributor-covenant.org/version/1/2/0/
Project: ClickHouse (App Definition and Development / Database)
File: v23.10.5.20-stable.md

sidebar_position: 1 sidebar_label: 2023 Backported in : There was a potential vulnerability in previous ClickHouse versions: if a user has connected and unsuccessfully tried to authenticate with the "interserver secret" method, the server didn't terminate the connection immediately but continued to receive and ignore the leftover packets from the client. While these packets are ignored, they are still parsed, and if they use a compression method with another known vulnerability, it will lead to exploitation of it without authentication. This issue was found with by https://twitter.com/malacupa. (). Backported in : There was an attempt to have the proper listing in , but the fix itself was in the wrong place, so it's still broken. See an . (). Fix ON CLUSTER queries without database on initial node (). Fix buffer overflow in Gorilla codec (). Close interserver connection on any exception before authentication (). Fix client suggestions for user without grants (). Fix pygithub (). Avoid dependencies with no fixed versions (). Tiny improvement security ().
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: scalr-iacp.md

title: Scalr subtitle: Policy enforcement for Terraform labels: category: Infrastructure as Code layer: cicd software: terraform tutorials: https://iacp.docs.scalr.com/en/latest/working-with-iacp/opa.html#creating-the-opa-policy code: https://github.com/Scalr/sample-tf-opa-policies inventors: scalr blogs: https://www.scalr.com/blog/opa-is-to-policy-automation-as-terraform-is-to-iac/ docs_features: cli-integration: note: | These policies can be run using OPA at the command line against a Terraform plan JSON. See in the README. terraform: note: | These policies can be run using OPA at the command line against a Terraform plan JSON. See in the README. Scalr allows teams to easily collaborate on Terraform through its pipeline that runs all Terraform operations, policy checks, and stores state. Scalr uses OPA to check the auto-generated Terraform JSON plan to ensure that it meets your organization standards prior to an apply.
Project: SeaTunnel (App Definition and Development / Streaming & Messaging)
File: Hbase.md

Hbase sink connector Output data to Hbase | name | type | required | default value | |--||-|--| | zookeeper_quorum | string | yes | - | | table | string | yes | - | | rowkey_column | list | yes | - | | family_name | config | yes | - | | rowkey_delimiter | string | no | "" | | version_column | string | no | - | | null_mode | string | no | skip | | wal_write | boolean | yes | false | | writebuffersize | string | no | 8 1024 1024 | | encoding | string | no | utf8 | | hbaseextraconfig | string | no | - | | common-options | | no | - | The zookeeper cluster host of hbase, example: "hadoop001:2181,hadoop002:2181,hadoop003:2181" The table name you want to write, example: "seatunnel" The column name list of row keys, example: ["id", "uuid"] The family name mapping of fields. For example the row from upstream like the following shown: | id | name | age | |-||--| | 1 | tyrantlucifer | 27 | id as the row key and other fields written to the different families, you can assign family_name { name = "info1" age = "info2" } this means that `name` will be written to the family `info1` and the `age` will be written to the family `info2` if you want other fields written to the same family, you can assign family_name { all_columns = "info" } this means that all fields will be written to the family `info` The delimiter of joining multi row keys, default `""` The version column name, you can use it to assign timestamp for hbase record The mode of writing null value, support [`skip`, `empty`], default `skip` skip: When the field is null, connector will not write this field to hbase empty: When the field is null, connector will write generate empty value for this field The wal log write flag, default `false` The write buffer size of hbase client, default `8 1024 1024` The encoding of string field, support [`utf8`, `gbk`], default `utf8` The extra configuration of hbase Sink plugin common parameters, please refer to for details ```hocon Hbase { zookeeper_quorum = "hadoop001:2181,hadoop002:2181,hadoop003:2181" table = "seatunnel_test" rowkey_column = ["name"] family_name { all_columns = seatunnel } } ``` Add hbase sink connector ()
Project: StarRocks (App Definition and Development / Database)
File: utc_time.md

displayed_sidebar: "English" Returns the current UTC time as a value in 'HH:MM:SS'. ```Haskell TIME UTC_TIME() ``` ```Plain Text MySQL > select utc_time(); +-+ | utc_time() | +-+ | 12:31:18 | +-+ ``` UTC_TIME,UTC,TIME
Project: ClickHouse (App Definition and Development / Database)
File: v23.8.9.54-lts.md

sidebar_position: 1 sidebar_label: 2024 Backported in : Output valid JSON/XML on excetpion during HTTP query execution. Add setting `httpwriteexceptioninoutput_format` to enable/disable this behaviour (enabled by default). (). Backported in : Fix transfer query to MySQL compatible query. Fixes . Fixes . Fixes . (). Backported in : Fetching a part waits when that part is fully committed on remote replica. It is better not send part in PreActive state. In case of zero copy this is mandatory restriction. (). Backported in : Handle sigabrt case when getting PostgreSQl table structure with empty array. (). Backported in : Fix issue caught in https://github.com/docker-library/official-images/pull/15846. (). Flatten only true Nested type if flatten_nested=1, not all Array(Tuple) (). Fix ALTER COLUMN with ALIAS (). Prevent incompatible ALTER of projection columns (). Fix segfault after ALTER UPDATE with Nullable MATERIALIZED column (). Fix incorrect JOIN plan optimization with partially materialized normal projection (). Fix `ReadonlyReplica` metric for all cases (). Fix working with read buffers in StreamingFormatExecutor (). bugfix: correctly parse SYSTEM STOP LISTEN TCP SECURE (). Ignore ON CLUSTER clause in grant/revoke queries for management of replicated access entities. (). Disable system.kafka_consumers by default (due to possible live memory leak) (). Fix invalid memory access in BLAKE3 (Rust) (). Normalize function names in CREATE INDEX (). Fix invalid preprocessing on Keeper (). Fix Integer overflow in Poco::UTF32Encoding (). Remove parallel parsing for JSONCompactEachRow (). Fix parallel parsing for JSONCompactEachRow (). NO CL ENTRY: 'Update PeekableWriteBuffer.cpp'. (). Pin alpine version of integration tests helper container (). Remove heavy rust stable toolchain (). Fix docker image for integration tests (fixes CI) ().
Project: KICS (Provisioning / Security & Compliance)
File: 88541597-6f88-42c8-bac6-7e0b855e8ff6.md

title: OSS Bucket Allows List Action From All Principals hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 88541597-6f88-42c8-bac6-7e0b855e8ff6 Query name: OSS Bucket Allows List Action From All Principals Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: OSS Bucket should not allow list action from all principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering/deletion. This means the 'Effect' must not be 'Allow' when the 'Action' contains 'List', for all Principals.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="5" resource "alicloudossbucket" "bucket-policy1" { bucket = "bucket-1-policy" acl = "private" policy = <<POLICY {"Statement": [ { "Action": [ "oss:ListObjectVersions", "oss:ListObjects", "oss:ListParts" ], "Effect": "Allow", "Principal": [ "*" ], "Resource": [ "acs:oss:*:174649585760xxxx:examplebucket" ] } ], "Version":"1"} POLICY } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="5" resource "alicloudossbucket" "bucket-policy5" { bucket = "bucket-5-policy" acl = "private" policy = <<POLICY {"Statement": [ { "Action": [ "oss:ListObjectVersions", "oss:RestoreObject" ], "Effect": "Allow", "Principal": [ "*" ], "Resource": [ "acs:oss:*:174649585760xxxx:examplebucket" ] } ], "Version":"1"} POLICY } ``` ```tf title="Negative test num. 1 - tf file" resource "alicloudossbucket" "bucket-policy2" { bucket = "bucket-2-policy" acl = "private" policy = <<POLICY {"Statement": [ { "Action": [ "oss:AbortMultipartUpload" ], "Effect": "Allow", "Principal": [ "*" ], "Resource": [ "acs:oss:*:174649585760xxxx:examplebucket" ] } ], "Version":"1"} POLICY } ``` ```tf title="Negative test num. 2 - tf file" resource "alicloudossbucket" "bucket-policy3" { bucket = "bucket-3-policy" acl = "private" policy = <<POLICY {"Statement": [ { "Action": [ "oss:ListObjectVersions", "oss:ListObjects", "oss:ListParts" ], "Effect": "Allow", "Principal": [ "20214760404935xxxx" ], "Resource": [ "acs:oss:*:174649585760xxxx:examplebucket" ] } ], "Version":"1"} POLICY } ``` ```tf title="Negative test num. 3 - tf file" resource "alicloudossbucket" "bucket-policy4" { bucket = "bucket-4-policy" acl = "private" policy = <<POLICY {"Statement": [ { "Action": [ "oss:ListObjectVersions", "oss:ListObjects", "oss:ListParts" ], "Effect": "Deny", "Principal": [ "*" ], "Resource": [ "acs:oss:*:174649585760xxxx:examplebucket" ] } ], "Version":"1"} POLICY } ```
Project: StarRocks (App Definition and Development / Database)
File: murmur_hash3_32.md

displayed_sidebar: "English" Returns the 32-bit murmur3 hash value of the input string. ```Haskell INT MURMURHASH332(VARCHAR input, ...) ``` ```Plain Text MySQL > select murmurhash332(null); +--+ | murmurhash332(NULL) | +--+ | NULL | +--+ MySQL > select murmurhash332("hello"); +--+ | murmurhash332('hello') | +--+ | 1321743225 | +--+ MySQL > select murmurhash332("hello", "world"); +--+ | murmurhash332('hello', 'world') | +--+ | 984713481 | +--+ ``` MURMURHASH332,HASH
Project: Weaviate (App Definition and Development / Database)
File: Readme.md

This folder contains scripts to help execute the benchmark remotely on a GCP VM. Bash gcloud (logged in and permissions to `semi-automated-benchmarking` project terraform From the root folder run ``` test/benchmark/remote/run.sh --all ``` To run the whole benchmark suite. The `--all` command will: Check that `gcloud` and `terraform` are installed locally Spin up a machine in GCP Install the dependencies on this machine Clone Weaviate Check out the same commit that is check out locally Run the benchmarks script Copy the results file to the local machine Destroy the machine If any of the command fails the machine will be destroyed. You can also run all commands individually, simply run the command without parameters to list all possible options. To do all steps (including spinning up a machine) that happen before running the benchmarks you can invoke it with the `--prepare` option. To get an interactive ssh session into the machine, use `--ssh`. To destroy the machine at an arbitrary point run `--delete_machine`. *Note: Checking out a branch that does not yet have the scripts from this folder, will fail. You need a branch created after this script was initially built or has been rebased on top of it.* ``` test/benchmark/remote/run.sh --prepare test/benchmark/remote/run.sh --checkout <name-of-your-branch-or-commit> test/benchmark/remote/run.sh --benchmark test/benchmark/remote/run.sh --delete_machine ```
Project: Pinniped (Provisioning / Key Management)
File: README.md

The Vision To create a modern, geometric typeface. Open sourced, and openly available. Influenced by other popular geometric, minimalist sans-serif typefaces of the new millenium. Designed for optimal readability at small point sizes while beautiful at large point sizes. December 2017 update Currently working on greatly improving spacing and kerning of the base typeface. Once this is done, work on other variations (e.g. rounded or slab) can begin in earnest. The License Licensed under Open Font License (OFL). Available to anyone and everyone. Contributions welcome. Contact Contact me via chris.m.simpson@icloud.com or http://twitter.com/ChrisMSimpson for any questions, requests or improvements (or just submit a pull request). Support You can now support work on Metropolis via Patreon at https://www.patreon.com/metropolis.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: azurerm_virtual_machine_disks.md

+++ title = "azurermvirtualmachine_disks resource" draft = false gh_repo = "inspec" platform = "azure" [menu] [menu.inspec] title = "azurermvirtualmachine_disks" identifier = "inspec/resources/azure/azurermvirtualmachinedisks.md azurermvirtualmachinedisks resource" parent = "inspec/resources/azure" +++ {{< inspec/azurermdeprecated resource="azurevirtualmachinedisks" >}} Use the `azurermvirtualmachine_disks` InSpec audit resource to test properties of some or all Azure Disks within a subscription. This resource interacts with version `2019-03-01` of the Azure Management API. For more information see the . At the moment, there doesn't appear to be a way to select the version of the Azure API docs. If you notice a newer version being referenced in the official documentation please open an issue or submit a pull request using the updated version. This resource is available in the `inspec-azure` [resource pack](/inspec/glossary/#resource-pack). To use it, add the following to your `inspec.yml` in your top-level profile: depends: name: inspec-azure git: https://github.com/inspec/inspec-azure.git You'll also need to setup your Azure credentials; see the resource pack . This resource first became available in 1.8.0 of the inspec-azure resource pack. An `azurermvirtualmachine_disks` resource block returns all Azure Disks in a subscription. describe azurermvirtualmachine_disks do ... end The following examples show how to use this InSpec audit resource. describe azurermvirtualmachine_disks do it('names') { should include 'app-server-disk' } end describe azurermvirtualmachine_disks.where { attached == true } do it { should_not exist } end `ids` `names` `properties` `tags` `locations` `attached` `resource_groups` {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The control will pass if the filter returns at least one result. Use `should_not` if you expect zero matches. describe azurermvirtualmachine_disks.where { <filter> == <criteria> } do it { should exist } end Your [Service Principal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal) must be setup with a `contributor` role on the subscription you wish to test.
Project: NeuVector (Provisioning / Security & Compliance)
File: OLD_README.md

First give you a full example, I will explain every command below. session := sh.NewSession() session.Env["PATH"] = "/usr/bin:/bin" session.Stdout = os.Stdout session.Stderr = os.Stderr session.Alias("ll", "ls", "-l") session.ShowCMD = true // enable for debug var err error err = session.Call("ll", "/") if err != nil { log.Fatal(err) } ret, err := session.Capture("pwd", sh.Dir("/home")) # wraper of session.Call if err != nil { log.Fatal(err) } fmt.Println(ret) create a new Session session := sh.NewSession() use alias like this session.Alias("ll", "ls", "-l") # like alias ll='ls -l' set current env like this session.Env["BUILDID"] = "123" # like export BUILDID=123 set current directory session.Set(sh.Dir("/")) # like cd / pipe is also supported session.Command("echo", "hello\tworld").Command("cut", "-f2") // output should be "world" session.Run() test, the build in command support session.Test("d", "dir") // test dir session.Test("f", "file) // test regular file with `Alias Env Set Call Capture Command` a shell scripts can be easily converted into golang program. below is a shell script. export PATH=/usr/bin:/bin alias ll='ls -l' cd /usr if test -d "local" then ll local | awk '{print $1, $NF}' fi convert to golang, will be s := sh.NewSession() s.Env["PATH"] = "/usr/bin:/bin" s.Set(sh.Dir("/usr")) s.Alias("ll", "ls", "-l") if s.Test("d", "local") { s.Command("ll", "local").Command("awk", "{print $1, $NF}").Run() }
Project: YugabyteDB (App Definition and Development / Database)
File: hevodata.md

title: Hevo Data linkTitle: Hevo Data description: Use Hevo Data with YSQL API aliases: menu: preview_integrations: identifier: hevodata parent: data-integration weight: 571 type: docs is a no-code data movement platform which lets you set up your database or data warehouse for analytics and is designed to process billions of records. After all the historical data in the source is ingested, any new and changed data thereafter is ingested as incremental data. In case of RDBMS sources like PostgreSQL, you can define how Hevo fetches this data, using ingestion modes, and query modes. Hevo ingests your data from , applies transformations on it, and brings it to a using which you can define how your data must be stored at the . Hevo supports PostgreSQL among many other databases as a source. It can also work with YugabyteDB as a source using PostgreSQL's configuration with some changes. To add YugabyteDB as a source in Hevo, create a as follows: Start a YugabyteDB cluster. Refer . In the Hevo UI, create a new Pipeline by selecting PostgreSQL as the source type. Provide an appropriate hostname and port (Default for YugabyteDB is 5433) for your YugabyteDB cluster as per the following illustration: Under Select an Ingestion Mode, choose Table. You can also choose Custom SQL, in which case you also need to provide the actual SQL to fetch data from your tables. Logical Replication is not supported. Provide the database and schema name where the table data is present and other connection details. Select the tables which you want to ingest into Hevo. Select a value for the Query Mode. If your table has an incrementing column and a timestamp column which gets updated for updates, you can choose Change Data Capture. xmin is not supported in YugabyteDB. Select and configure a destination as per your requirement. After the pipeline is created, data from your YugabyteDB cluster gets ingested into the destination via the Hevo pipeline.
Project: KICS (Provisioning / Security & Compliance)
File: aa737abf-6b1d-4aba-95aa-5c160bd7f96e.md

title: Image Pull Policy Of The Container Is Not Set To Always hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: aa737abf-6b1d-4aba-95aa-5c160bd7f96e Query name: Image Pull Policy Of The Container Is Not Set To Always Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Image Pull Policy of the container must be defined and set to Always<br> ```tf title="Positive test num. 1 - tf file" hl_lines="12" resource "kubernetes_pod" "busybox" { metadata { name = "busybox-tf" } spec { container { image = "busybox" command = ["sleep", "3600"] name = "busybox" imagepullpolicy = "IfNotPresent" } restart_policy = "Always" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="30" resource "kubernetes_deployment" "example" { metadata { name = "terraform-example" labels = { test = "MyExampleApp" } } spec { replicas = 3 selector { match_labels = { test = "MyExampleApp" } } template { metadata { labels = { test = "MyExampleApp" } } spec { container { image = "nginx:1.7.8" name = "example" imagepullpolicy = "IfNotPresent" resources { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } } } } } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetes_pod" "busybox" { metadata { name = "busybox-tf" } spec { container { image = "busybox" command = ["sleep", "3600"] name = "busybox" imagepullpolicy = "Always" } restart_policy = "Always" } } ```
Project: KICS (Provisioning / Security & Compliance)
File: c6fc6f29-dc04-46b6-99ba-683c01aff350.md

title: Serial Ports Are Enabled For VM Instances hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c6fc6f29-dc04-46b6-99ba-683c01aff350 Query name: Serial Ports Are Enabled For VM Instances Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Google Compute Engine VM instances should not enable serial ports. When enabled, anyone can access your VM, if they know the username, project ID, SSH key, instance name and zone<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="4" name: serial_enabled google.cloud.gcpcomputeinstance: metadata: serial-port-enable: yes zone: us-central1-a auth_kind: serviceaccount ``` ```yaml title="Negative test num. 1 - yaml file" name: serial_disabled google.cloud.gcpcomputeinstance: metadata: serial-port-enabled: no zone: us-central1-a auth_kind: serviceaccount name: serial_undefined google.cloud.gcpcomputeinstance: metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' zone: us-central1-a auth_kind: serviceaccount ```