cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: d994585f-defb-4b51-b6d2-c70f020ceb10.md

title: SQS Policy With Public Access hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d994585f-defb-4b51-b6d2-c70f020ceb10 Query name: SQS Policy With Public Access Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Checks for dangerous permissions in Action statements in an SQS Queue Policy. This is deemed a potential security risk as it would allow various attacks to the queue<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="10 28" name: First SQS queue with policy community.aws.sqs_queue: name: my-queue1 region: ap-southeast-1 defaultvisibilitytimeout: 120 messageretentionperiod: 86400 maximummessagesize: 1024 delivery_delay: 30 receivemessagewait_time: 20 policy: Version: "2012-10-17" Statement: Effect: "Allow" Action: "sqs:*" Resource: "*" Principal: "*" make_default: false state: present name: Second SQS queue with policy community.aws.sqs_queue: name: my-queue2 region: ap-southeast-3 defaultvisibilitytimeout: 120 messageretentionperiod: 86400 maximummessagesize: 1024 delivery_delay: 30 receivemessagewait_time: 20 policy: Version: "2012-10-17" Statement: Effect: "Allow" Action: "*" Resource: "*" Principal: AWS: "*" make_default: false state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: First SQS queue with policy community.aws.sqs_queue: name: my-queue1 region: ap-southeast-1 defaultvisibilitytimeout: 120 messageretentionperiod: 86400 maximummessagesize: 1024 delivery_delay: 30 receivemessagewait_time: 20 policy: Version: '2012-10-17' Statement: Effect: Allow Action: sqs:* Resource: '*' Principal: Principal make_default: false state: present ```
Project: ClickHouse (App Definition and Development / Database)
File: build-cross-riscv.md

slug: /en/development/build-cross-riscv sidebar_position: 68 title: How to Build ClickHouse on Linux for RISC-V 64 Architecture sidebar_label: Build on Linux for RISC-V 64 As of writing (11.11.2021) building for risc-v considered to be highly experimental. Not all features can be enabled. This is for the case when you have Linux machine and want to use it to build `clickhouse` binary that will run on another Linux machine with RISC-V 64 CPU architecture. This is intended for continuous integration checks that run on Linux servers. The cross-build for RISC-V 64 is based on the , follow them first. Follow the instructions from https://apt.llvm.org/ for your Ubuntu or Debian setup or do ``` sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)" ``` ``` bash cd ClickHouse mkdir build-riscv64 CC=clang-18 CXX=clang++-18 cmake . -Bbuild-riscv64 -G Ninja -DCMAKETOOLCHAINFILE=cmake/linux/toolchain-riscv64.cmake -DGLIBCCOMPATIBILITY=OFF -DENABLELDAP=OFF -DOPENSSLNOASM=ON -DENABLEJEMALLOC=ON -DENABLEPARQUET=OFF -DENABLEGRPC=OFF -DENABLEHDFS=OFF -DENABLE_MYSQL=OFF ninja -C build-riscv64 ``` The resulting binary will run only on Linux with the RISC-V 64 CPU architecture.
Project: Kyverno (Provisioning / Security & Compliance)
File: SECURITY.md

The Kyverno community has adopted this security disclosures and response policy to ensure we responsibly handle critical issues. For information regarding the security of this project please join our . You think you discovered a potential security vulnerability in Kyverno. You are unsure how a vulnerability affects Kyverno. You think you discovered a vulnerability in another project that Kyverno depends on. For projects with their own vulnerability reporting and disclosure process, please report it directly there. You need help tuning Kyverno components for security - please discuss this is in the Kyverno . You need help applying security-related updates. Your issue is not security-related. Email the Kyverno security group at kyverno-security@googlegroups.com Emails should contain: description of the problem precise and detailed steps (include screenshots) that created the problem the affected version(s) any possible mitigations, if known The project security team will send an initial response to the disclosure in 3-5 days. Once the vulnerability and fix are confirmed, the team will plan to release the fix in 7 to 28 days based on the severity and complexity. You may be contacted by a project maintainer to further discuss the reported item. Please bear with us as we seek to understand the breadth and scope of the reported problem, recreate it, and confirm if there is a vulnerability present. Kyverno versions follow terminology and are expressed as x.y.z: where x is the major version y is the minor version and z is the patch version Security fixes, may be backported to the three most recent minor releases, depending on severity and feasibility. Patch releases are cut from those branches periodically, plus additional urgent releases, when required.
Project: YugabyteDB (App Definition and Development / Database)
File: synthetic-data-sql.md

title: synthetic-data.sql linkTitle: synthetic-data.sql headerTitle: Linear regression analysis scatter-plot on synthetic data description: Show straight line computer by linear regression analysis the best fits a synthetically noisy straight line menu: v2.18: identifier: synthetic-data-sql parent: analysis-scripts weight: 20 type: docs Save this script as "synthetic-data.sql" ```plpgsql drop procedure if exists populate_t( int, double precision, double precision, double precision, double precision) cascade; drop table if exists t cascade; create table t( k int primary key, x double precision, y double precision, delta double precision); create procedure populate_t( noofrows in int, slope in double precision, intercept in double precision, mean in double precision, stddev in double precision) language plpgsql as $body$ begin delete from t; with a1 as ( select s.v as k, s.v as x, (s.v * slope) + intercept as y from generateseries(1, noof_rows) as s(v)), a2 as ( select ( row_number() over()) as k, r.v as delta from normalrand(noof_rows, mean, stddev) as r(v)) insert into t(k, x, y, delta) select k, x, a1.y, a2.delta from a1 inner join a2 using(k); insert into t(k, x, y, delta) values (noofrows + 1, 0, null, null), (noofrows + 2, null, 0, null); end; $body$; call populate_t( noofrows => 100, mean => 0.0, stddev => 5.0, slope => -1.2, intercept => 131.4); \o analysis-results/synthetic-data.txt with a as ( select regr_r2 ((y + delta), x) as r2, regr_slope ((y + delta), x) as s, regr_intercept((y + delta), x) as i from t) select to_char(r2, '0.99') as r2, to_char(s, '90.9') as s, to_char(i, '990.9') as i from a; \o \t on \o analysis-results/synthetic-data.csv select round(x)::text||','||round(y + delta)::text from t where x > 60 and x < 95 and x is not null and y is not null order by x; \o \t off ```
Project: Numaflow (App Definition and Development / Streaming & Messaging)
File: join-vertex.md

Numaflow Pipeline Edges can be defined such that multiple Vertices can forward messages to a single vertex. Please see the following examples: Without JOIN, Numaflow could only allow users to build where could only read from previous one vertex. This meant that Numaflow could only support simple pipelines or tree-like pipelines. Supporting pipelines where you had to read from multiple sources or UDFs were cumbersome and required creating redundant vertices. Join vertices allow users the flexibility to read from multiple sources, process data from multiple UDFs, and even write to a single sink. The Pipeline Spec doesn't change at all with JOIN, now you can create multiple Edges that have the same To Vertex, which would have otherwise been prohibited. There is no limitation on which vertices can be joined. For instance, one can join Map or Reduce vertices as shown below: The introduction of Join Vertex allows users to eliminate redundancy in their pipelines. It supports many-to-one data flow without needing multiple vertices performing the same job. By joining the sink vertices, we now only need a single vertex responsible for sending to the data sink. Two different Sources containing similar data that can be processed the same way can now point to a single vertex. This feature allows for efficient aggregation of data from multiple sources. A special case of a "Join" is a Cycle (a Vertex which can send either to itself or to a previous Vertex.) An example use of this is a Map UDF which does some sort of reprocessing of data under certain conditions such as a transient error. Cycles are permitted, except in the case that there's a Reduce Vertex at or downstream of the cycle. (This is because a cycle inevitably produces late data, which would get dropped by the Reduce Vertex. For this reason, cycles should be used sparingly.) The following examples are of Cycles:
Project: TiDB (App Definition and Development / Database)
File: code_review_guide.md

Make sure you are familiar with the packages the PR modifies. Make sure you have enough continuous time to review the PR, use 300 LOC per hour to estimate. Make sure you can follow the updates of the PR in the next few work days. Read the description of the PR, if it's not easy to understand, ask the coder to improve it. For a bug fix PR, if there is no test case, ask the coder to add tests. For a performance PR, if no benchmark result is provided, ask the coder to add a benchmark result. Am I able to understand the purpose of each unit test? Do unit tests actually test that the code is performing the intended functionality? Do unit tests cover all the important code blocks and specially handled errors? Could procedure tests be rewritten to table driven tests? Is the code written following the style guide? Is the same code duplicated more than twice? Do comments exist and describe the intent of the code? Are hacks, workarounds and temporary fixes commented? Does this function do more than the name suggests? Can this function's behavior be inferred by its name? Do tests exist and are they comprehensive? Do unit tests cover all the important code branches? Could the test code be extracted into a table-driven test? Be kind to the coder, not to the code. Ask questions rather than make statements. Treat people who know less than you with respect, deference, and patience. Remember to praise when the code quality exceeds your expectation. It isn't necessarily wrong if the coder's solution is different than yours. Refer to the code style document when necessary. Checkout Github notification regularly to keep track of the updates of the PR. When the PR has been updated, start another round of review or give it a LGTM.
Project: KCL (Provisioning / Automation & Configuration)
File: E2L28.md

KCL will report `UniqueKeyError` when duplicate names appear in the KCL code. The `ewcode` of `UniqueKeyError` is `E2L28`. For example: ```python schema Person: name: str = "kcl" age: int = 1 schema Person: aa: int x0 = Person{} x1 = Person{age:101} ``` The KCL program will cause the following error message. ```shell error[E2L28]: UniqueKeyError --> /schema/same_name/main.k:5:8 | 5 | schema Person: | ^ Unique key error name 'Person' | --> /schema/same_name/main.k:1:8 | 1 | schema Person: | ^ The variable 'Person' is declared here | ``` Possible resolution: Check if the name with error has been used.
Project: KICS (Provisioning / Security & Compliance)
File: 0632d0db-9190-450a-8bb3-c283bffea445.md

title: Redis Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0632d0db-9190-450a-8bb3-c283bffea445 Query name: Redis Publicly Accessible Platform: Ansible Severity: <span style="color:#ff0000">Critical</span> Category: Networking and Firewall URL: Firewall rule allowing unrestricted access to Redis from other Azure sources<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" name: Create a Firewall rule for Azure Cache for Redis azurermrediscachefirewallrule: resource_group: myResourceGroup cache_name: myRedisCache name: myRule startipaddress: 1.2.3.4 endipaddress: 2.3.4.5 ``` ```yaml title="Negative test num. 1 - yaml file" name: Create a Firewall rule for Azure Cache for Redis azurermrediscachefirewallrule: resource_group: myResourceGroup cache_name: myRedisCache name: myRule startipaddress: 192.168.1.1 endipaddress: 192.168.1.4 ```
Project: Harbor (Provisioning / Container Registry)
File: 4-06-LDAP-usergroup-view-logs.md

Test 4-06 - User Views Logs (LDAP Mode) ======= To verify that a LDAP user group can views logs when users are managed externally by LDAP or AD (LDAP mode). User guide This test requires that a Harbor instance is running and available. An LDAP server is running and available, and enabled memberof overlay feature. Harbor is set to authenticate against an LDAP or AD server. ( auth_mode is set to ldap_auth* .) The user data is stored in an LDAP or AD server. A linux host with Docker CLI installed (Docker client). LDAP group config parameter are configured. ldapgroupbasedn ldapgroupfilter ldap_gid ldapgroupscope Add group harboradmin and create a user adminuser, adminuser is a member of harboradmin Login to UI with admin user, create a private project ldapgroupproj Add a project member with ldap the LDAP DN of harbor_admin, with administrator role Log in to the UI as the admin_user in docker client. push/pull images to ldapgroupproj. View the logs of the project. Try below search criteria to see if the search result is correct: push only pull only pull and push delete only all push and delete different date ranges date range and push All operations in Step 5 should be logged. Logs can be viewed in Step 6, check if the time and operations are correct. Logs can be filtered in Step 6. None
Project: StarRocks (App Definition and Development / Database)
File: StarRocks_intro.md

displayed_sidebar: "English" import FeatureList from '/src/components/Features/index.js' StarRocks is a next-gen, high-performance analytical data warehouse that enables real-time, multi-dimensional, and highly concurrent data analysis. StarRocks has an MPP architecture and is equipped with a fully vectorized execution engine, a columnar storage engine that supports real-time updates, and is powered by a rich set of features including a fully-customized cost-based optimizer (CBO), intelligent materialized view and more. StarRocks supports real-time and batch data ingestion from a variety of data sources. It also allows you to directly analyze data stored in data lakes with zero data migration. StarRocks is also compatible with MySQL protocols and can be easily connected using MySQL clients and popular BI tools. StarRocks is highly scalable, available, and easy to maintain. It is widely adopted in the industry, powering a variety of OLAP scenarios, such as real-time analytics, ad-hoc queries, data lake analytics and more. is licensed under Apache 2.0, available at the StarRocks GitHub repository (see the ). StarRocks (i) links to or calls functions from third party software libraries, the licenses of which are available in the folder ; and (ii) incorporates third party software code, the licenses of which are available in the folder . Join our for asking general questions. Join our for chat. For community news, read the . You can also follow us on to get first-hand updates on new features, events, and sharing. <FeatureList language="English" />
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_spanner_instance_iam_policy.md

+++ title = "googlespannerinstanceiampolicy resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlespannerinstanceiampolicy" identifier = "inspec/resources/gcp/googlespannerinstanceiampolicy.md googlespannerinstanceiampolicy resource" parent = "inspec/resources/gcp" +++ A `googlespannerinstanceiampolicy` is used to test a Google Instance Iam Policy resource ```ruby describe googlespannerinstanceiampolicy(project: "project", name: "name") do it { should exist } end googlespannerinstanceiampolicy(project: "project", name: "name").bindings.each do |binding| describe binding do its('role') { should eq 'roles/editor'} its('members') { should include 'user:testuser@example.com'} end end ``` Properties that can be accessed from the `googlespannerinstanceiampolicy` resource: `iambindingroles` : The list of roles that exist on the policy. `bindings` : Associates a list of members to a role. `role` : Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner. `members` : Specifies the identities requesting access for a Cloud Platform resource. `audit_configs` : Specifies cloud audit logging configuration for this policy. `service` : Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services. `auditlogconfigs` : The configuration for logging of each type of permission. `log_type` : The log type that this config enables. For example, ADMINREAD, DATAWRITE or DATA_READ `exempted_members` : Specifies the identities that do not cause logging for this type of permission. Ensure the is enabled for the current project.
Project: Hazelcast IMDG (App Definition and Development / Database)
File: affinity_helper.md

`PATHTOJDKINCLUDEDIR`: The full path for the include directory under your JDK installation. ``` gcc -c -I ${PATHTOJDKINCLUDEDIR} -fPIC -Os -o affinityhelper.o affinityhelper.c gcc -shared -fPIC -Wl,-soname,libaffinityhelper.so -o affinityhelper.so affinity_helper.o -lc ```
Project: KICS (Provisioning / Security & Compliance)
File: c9846969-d066-431f-9b34-8c4abafe422a.md

title: Remote Desktop Port Open To Internet hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c9846969-d066-431f-9b34-8c4abafe422a Query name: Remote Desktop Port Open To Internet Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: The Remote Desktop port is open to the internet in a Security Group<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8" Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Allow rdp to client host VpcId: Ref: myVPC SecurityGroupIngress: IpProtocol: tcp FromPort: 3389 ToPort: 3389 CidrIp: 0.0.0.0/0 ``` ```json title="Positive test num. 2 - json file" hl_lines="10" { "Resources": { "InstanceSecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Allow rdp to client host", "VpcId": { "Ref": "myVPC" }, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": 3389, "ToPort": 3389, "CidrIp": "0.0.0.0/0" } ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Allow rdp to client host VpcId: Ref: myVPC SecurityGroupIngress: IpProtocol: tcp FromPort: 3389 ToPort: 3389 CidrIp: 192.168.0.0/16 ``` ```json title="Negative test num. 2 - json file" { "Resources": { "InstanceSecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Allow rdp to client host", "VpcId": { "Ref": "myVPC" }, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": 3389, "ToPort": 3389, "CidrIp": "192.168.0.0/16" } ] } } } } ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: cassandradb_conf.md

+++ title = "cassandradb_conf resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "cassandradb_conf" identifier = "inspec/resources/os/cassandradbconf.md cassandradbconf resource" parent = "inspec/resources/os" +++ Use the `cassandradbconf` Chef InSpec audit resource to test the configuration of a Cassandra database, which is typically located at `$CASSANDRAHOME/cassandra.yaml` or `$CASSANDRA_HOME\conf\cassandra.yaml` depending upon the platform. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} The value of the `CASSANDRA_HOME` environment variable must be set in the system. A `cassandradb_conf` resource block fetches configurations in the `cassandra.yaml` file, and then compares them with the value stated in the test: describe cassandradb_conf do its('config item') { should eq 'value' } end The following examples show how to use this Chef InSpec audit resource. describe cassandradb_conf do its('listen_address') { should eq 'localhost' } its('num_tokens') { should eq 16 } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.0-rc.5m.md

layout: release date: 2022-04-15 tag: v0.6.0-rc.5m language: en [mesheryctl] Improved UX for bash script installer @cpepper96 (#5371) Adds HPE Security Engineering as adopter @mchurichi (#5382) [Visualiser] Add Cluster Name To Visualiser @theBeginner86 (#5348) Fix failing kubeopenapi binary due to missing library @Revolyssup (#5373) [Docker Extension] Proxy: remove unnecessary caps @leecalcote (#5369) [CI] Made changes to Makefile to enforce usage of go v1.17.8 @asubedy (#5367) [DDE] Setup Golang proxy for the UI to be able to communicate with Meshery Server @sudo-NithishKarthik (#5365) [Bug] - Fixed Upstream URL Issue @adithyaakrishna (#5359) potential fix for dde icon @warunicorn19 (#5358) dde_css @warunicorn19 (#5356) Update ADOPTERS.md @samirparhi-dev (#5353) [CI] Workflow DDE @leecalcote (#5351) Changed Description @hershd23 (#5350) small changes in dde @warunicorn19 (#5347) added browse in dde @warunicorn19 (#5343) [UI]Designed Multi Cluster Context Switcher Search Box and Chip @Harshit-Dandriyal (#5310) Bump async from 3.2.0 to 3.2.3 in /ui @dependabot (#5381) Bump async from 3.2.0 to 3.2.3 in /provider-ui @dependabot (#5380) fix: extension class conflicts due to mui makestyles classNames conflicts @Abhishek-kumar09 (#5383) Fix: Select All not working @MUzairS15 (#5378) [UI] Card view of Design Page @asubedy (#5339) [Extension] Use loading component from extension point @Abhishek-kumar09 (#5372) [RJSF] Support Lazy loading of components tooltip in Exntension @Abhishek-kumar09 (#5363) Bump moment from 2.29.1 to 2.29.2 in /ui @dependabot (#5362) Bump @types/react-relay from 11.0.2 to 13.0.2 in /ui @dependabot (#5332) Bump babel-plugin-relay from 11.0.2 to 13.2.0 in /ui @dependabot (#5333) [UI] Card view of Design Page @asubedy (#5339) Remove wrk2 submodule @leecalcote (#5384) Bump async from 3.2.0 to 3.2.3 in /ui @dependabot (#5381) Bump async from 3.2.0 to 3.2.3 in /provider-ui @dependabot (#5380) Revert "[CI] Use mesheryctl to start adapters in CI" @gr455 (#5379) fix(#5342): image version to edge-latest for meshery-perf @gkarthiks (#5344) [CI] Use mesheryctl to start adapters in CI @gr455 (#5361) Bump moment from 2.29.1 to 2.29.2 in /ui @dependabot (#5362) Bump @types/react-relay from 11.0.2 to 13.0.2 in /ui @dependabot (#5332) Bump babel-plugin-relay from 11.0.2 to 13.2.0 in /ui @dependabot (#5333) Bump github.com/99designs/gqlgen from 0.17.1 to 0.17.2 @dependabot (#5324) [CI] Upgrade setup-go version @alphaX86 (#5354) [CI] Docker Extension for Meshery workflow @leecalcote (#5352) [CI] DDE: Fix release channel logic @leecalcote (#5349) Updated Contributing-gitflow(Readme) @Nandani-Paliwal (#5313) Bump nokogiri from 1.13.3 to 1.13.4 in /docs @dependabot (#5370) Thank you to our contributors for making this release possible: @Abhishek-kumar09, @Harshit-Dandriyal, @MUzairS15, @Nandani-Paliwal, @Revolyssup, @adithyaakrishna, @alphaX86, @asubedy, @cpepper96, @dependabot, @dependabot[bot], @gkarthiks, @gr455, @hershd23, @l5io, @leecalcote, @mchurichi, @samirparhi-dev, @sudo-NithishKarthik, @theBeginner86 and @warunicorn19