cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 45e1fca5-f90e-465d-825f-c2cb63fa3944.md

title: Missing Zypper Non-interactive Switch hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 45e1fca5-f90e-465d-825f-c2cb63fa3944 Query name: Missing Zypper Non-interactive Switch Platform: Dockerfile Severity: <span style="color:#ff7213">Medium</span> Category: Supply-Chain URL: Omitting the non-interactive switch causes the command to fail during the build process, because zypper would expect manual input<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="2" FROM busybox:1.0 RUN zypper install httpd && zypper clean HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1 ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM busybox:1.0 RUN zypper install -y httpd=2.4.46 && zypper clean HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1 ``` ```dockerfile title="Negative test num. 2 - dockerfile file" FROM golang:1.16 AS builder WORKDIR /go/src/github.com/foo/href-counter/ RUN go get -d -v golang.org/x/net/html COPY app.go ./ RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app . RUN zypper install httpd && zypper clean FROM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /root/ COPY --from=builder /go/src/github.com/foo/href-counter/app ./ CMD ["./app"] RUN useradd -ms /bin/bash patrick USER patrick ```
Project: ClickHouse (App Definition and Development / Database)
File: build-osx.md

slug: /en/development/build-osx sidebar_position: 65 sidebar_label: Build on macOS title: How to Build ClickHouse on macOS description: How to build ClickHouse on macOS for macOS :::info You don't have to build ClickHouse yourself! You can install pre-built ClickHouse as described in . Follow macOS (Intel) or macOS (Apple silicon) installation instructions. ::: The build works on x86_64 (Intel) and arm64 (Apple Silicon) based on macOS 10.15 (Catalina) or higher with Homebrew's vanilla Clang. :::note It is also possible to compile with Apple's XCode `apple-clang`, but it's strongly discouraged. ::: First install Install the latest from App Store. Open it at least once to accept the end-user license agreement and automatically install the required components. Then, make sure that the latest Command Line Tools are installed and selected in the system: ``` bash sudo rm -rf /Library/Developer/CommandLineTools sudo xcode-select --install ``` ``` bash brew update brew install ccache cmake ninja libtool gettext llvm gcc binutils grep findutils nasm ``` ``` bash git clone --recursive git@github.com:ClickHouse/ClickHouse.git ``` To build using Homebrew's vanilla Clang compiler (the only recommended way): ``` bash cd ClickHouse mkdir build export PATH=$(brew --prefix llvm)/bin:$PATH cmake -G Ninja -DCMAKEBUILDTYPE=RelWithDebInfo -DCMAKECCOMPILER=$(brew --prefix llvm)/bin/clang -DCMAKECXXCOMPILER=$(brew --prefix llvm)/bin/clang++ -S . -B build cmake --build build ``` To build using XCode native AppleClang compiler in XCode IDE (this option is only for development builds and workflows, and is not recommended unless you know what you are doing): ``` bash cd ClickHouse rm -rf build mkdir build cd build XCODEIDE=1 ALLOWAPPLECLANG=1 cmake -G Xcode -DCMAKEBUILDTYPE=Debug -DENABLE_JEMALLOC=OFF .. cmake --open . ``` If you intend to run `clickhouse-server`, make sure to increase the systems `maxfiles` variable. :::note Youll need to use sudo. ::: To do so, create the `/Library/LaunchDaemons/limit.maxfiles.plist` file with the following content: ``` xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>limit.maxfiles</string> <key>ProgramArguments</key> <array> <string>launchctl</string> <string>limit</string> <string>maxfiles</string> <string>524288</string> <string>524288</string> </array> <key>RunAtLoad</key> <true/> <key>ServiceIPC</key> <false/> </dict> </plist> ``` Give the file correct permissions: ``` bash sudo chown root:wheel /Library/LaunchDaemons/limit.maxfiles.plist ``` Validate that the file is correct: ``` bash plutil /Library/LaunchDaemons/limit.maxfiles.plist ``` Load the file (or reboot): ``` bash sudo launchctl load -w /Library/LaunchDaemons/limit.maxfiles.plist ``` To check if its working, use the `ulimit -n` or `launchctl limit maxfiles` commands. ``` bash cd ClickHouse ./build/programs/clickhouse-server --config-file ./programs/server/config.xml ```
Project: ClickHouse (App Definition and Development / Database)
File: mongodb.md

slug: /en/sql-reference/table-functions/mongodb sidebar_position: 135 sidebar_label: mongodb Allows `SELECT` queries to be performed on data that is stored on a remote MongoDB server. Syntax ``` sql mongodb(host:port, database, collection, user, password, structure [, options]) ``` Arguments `host:port` MongoDB server address. `database` Remote database name. `collection` Remote collection name. `user` MongoDB user. `password` User password. `structure` - The schema for the ClickHouse table returned from this function. `options` - MongoDB connection string options (optional parameter). :::tip If you are using the MongoDB Atlas cloud offering please add these options: ``` 'connectTimeoutMS=10000&ssl=true&authSource=admin' ``` ::: Returned Value A table object with the same columns as the original MongoDB table. Examples Suppose we have a collection named `my_collection` defined in a MongoDB database named `test`, and we insert a couple of documents: ```sql db.createUser({user:"test_user",pwd:"password",roles:[{role:"readWrite",db:"test"}]}) db.createCollection("my_collection") db.my_collection.insertOne( { log_type: "event", host: "120.5.33.9", command: "check-cpu-usage -w 75 -c 90" } ) db.my_collection.insertOne( { log_type: "event", host: "120.5.33.4", command: "system-check"} ) ``` Let's query the collection using the `mongodb` table function: ```sql SELECT * FROM mongodb( '127.0.0.1:27017', 'test', 'my_collection', 'test_user', 'password', 'log_type String, host String, command String', 'connectTimeoutMS=10000' ) ``` See Also
Project: StarRocks (App Definition and Development / Database)
File: engines.md

displayed_sidebar: "English" `engines` provides information about storage engines. The following fields are provided in `engines`: | Field | Description | | | | | ENGINE | The name of the storage engine. | | SUPPORT | The server's level of support for the storage engine. Valid values:<ul><li>`YES`: The engine is supported and active.</li><li>`DEFAULT`: Like `YES`, plus this is the default engine.</li><li>`NO`: The engine is not supported.</li><li>`DISABLED`: The engine is supported but has been disabled.</li></ul> | | COMMENT | A brief description of the storage engine. | | TRANSACTIONS | Whether the storage engine supports transactions. | | XA | Whether the storage engine supports XA transactions. | | SAVEPOINTS | Whether the storage engine supports savepoints. |
Project: StarRocks (App Definition and Development / Database)
File: st_astext.md

displayed_sidebar: "English" Converts a geometric figure to WKT (Well Known Text) format. ```Haskell VARCHAR ST_AsText(GEOMETRY geo) ``` ```Plain Text MySQL > SELECT STAsText(STPoint(24.7, 56.7)); ++ | stastext(stpoint(24.7, 56.7)) | ++ | POINT (24.7 56.7) | ++ ``` STASTEXT,STASWKT,ST,ASTEXT,ASWKT
Project: KICS (Provisioning / Security & Compliance)
File: 2ca87964-fe7e-4cdc-899c-427f0f3525f8.md

title: DocDB Logging Is Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2ca87964-fe7e-4cdc-899c-427f0f3525f8 Query name: DocDB Logging Is Disabled Platform: Pulumi Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: DocDB logging should be enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="10" name: my-pulumi-project runtime: nodejs config: aws:region: us-east-1 resources: aws:docdb/cluster: type: aws:docdb:Cluster properties: backupRetentionPeriod: 5 clusterIdentifier: my-docdb-cluster engine: docdb masterPassword: mustbeeightchars masterUsername: foo preferredBackupWindow: 07:00-09:00 skipFinalSnapshot: true ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="18" name: my-pulumi-project runtime: nodejs config: aws:region: us-east-1 resources: aws:docdb/cluster: type: aws:docdb:Cluster properties: backupRetentionPeriod: 5 clusterIdentifier: my-docdb-cluster engine: docdb masterPassword: mustbeeightchars masterUsername: foo preferredBackupWindow: 07:00-09:00 skipFinalSnapshot: true enabledCloudwatchLogsExports: [] ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="18" name: my-pulumi-project runtime: nodejs config: aws:region: us-east-1 resources: aws:docdb/cluster: type: aws:docdb:Cluster properties: backupRetentionPeriod: 5 clusterIdentifier: my-docdb-cluster engine: docdb masterPassword: mustbeeightchars masterUsername: foo preferredBackupWindow: 07:00-09:00 skipFinalSnapshot: true enabledCloudwatchLogsExports: audit ``` ```yaml title="Negative test num. 1 - yaml file" name: my-pulumi-project runtime: nodejs config: aws:region: us-east-1 resources: aws:docdb/cluster: type: aws:docdb:Cluster properties: backupRetentionPeriod: 5 clusterIdentifier: my-docdb-cluster engine: docdb masterPassword: mustbeeightchars masterUsername: foo preferredBackupWindow: 07:00-09:00 skipFinalSnapshot: true enabledCloudwatchLogsExports: audit profiler ```
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: CHANGELOG-v2023.12.21.md

title: Changelog | KubeDB description: Changelog menu: docs_{{.version}}: identifier: changelog-kubedb-v2023.12.21 name: Changelog-v2023.12.21 parent: welcome weight: 20231221 product_name: kubedb menuname: docs{{.version}} sectionmenuid: welcome url: /docs/{{.version}}/welcome/changelog-v2023.12.21/ aliases: /docs/{{.version}}/CHANGELOG-v2023.12.21/ Update pg arbiter api (#1091) Add nodeSelector, tolerations in es & kafka spec (#1089) Update deps Update deps Configure node topology for autoscaling compute resources (#1085) Prepare for release v0.24.0 (#166) Utilize topologyInfo in compute autoscalers (#162) Send hourly audit events (#165) Update autoscaler & ops apis (#161) Prepare for release v0.39.0 (#741) Prepare for release v0.15.0 (#89) Send hourly audit events (#88) Prepare for release v0.39.0 (#686) Send hourly audit events (#685) Set tolerations & nodeSelectors from esNode (#682) Prepare for release v0.2.0 (#12) Prepare for release v0.10.0 (#55) Send hourly audit events (#54) Set tolerations & nodeSelectors from kafka topology nodes (#53) Prepare for release v0.2.0 (#32) Add mysql and mariadb manifest backup and restore support (#31) Prepare for release v0.23.0 (#240) Send hourly audit events (#239) Prepare for release v0.2.0 (#7) Use appscode-images as base image (#6) Prepare for release v0.19.0 (#95) Prepare for release v0.32.0 (#410) Send hourly audit events (#409) Prepare for release v0.32.0 (#589) Send hourly audit events (#588) Prepare for release v0.2.0 (#6) Prepare for release v0.2.0 (#17) Prepare for release v0.32.0 (#581) Send hourly audit events (#580) Prepare for release v0.2.0 (#8) Install mysqlbinlog (#7) Use appscode-images as base image (#6) Prepare for release v0.17.0 (#92) Prepare for release v0.2.0 (#16) Prepare for release v0.26.0 (#503) Set tolerations & nodeSelectors while verticalScaling (#500) Send hourly audit events (#502) Update opsRequest api (#499) Update daily-opensearch.yml Update daily workflow for ES and Kafka. (#493) Prepare for release v0.26.0 (#338) Send hourly audit events (#337) Prepare for release v0.12.0 (#52) Prepare for release v0.23.0 (#142) Prepare for release v0.26.0 (#303) Send hourly audit events (#302) Prepare for release v0.39.0 (#694) Send hourly audit events (#693) Send hourly audit events (#691) Set toleration & nodeSelector fields from arbiter spec (#689) Fix formatting Prepare for release v0.2.0 (#9) Prepare for release v0.2.0 (#9) Fix makefile Prepare for release v0.39.0 (#65) Send hourly audit events (#64) Prepare for release v0.26.0 (#317) Send hourly audit events (#316) Prepare for release v0.32.0 (#504) Send hourly audit events (#503) Prepare for release v0.18.0 (#83) Prepare for release v0.2.0 (#13) Prepare for release v0.26.0 (#247) Prepare for release v0.15.0 (#90) Send hourly audit events (#89) Prepare for release v0.24.0 (#275) Prepare for release v0.15.0 (#99) Send hourly audit events (#98) Prepare for release v0.15.0 (#76) Send hourly audit events (#75)
Project: StarRocks (App Definition and Development / Database)
File: hex_decode_string.md

displayed_sidebar: "English" This function performs the opposite operation of . It interprets each pair of hexadecimal digits in the input string as a number and converts it to the byte represented by the number. The return value is a binary string. This function is supported from v3.0. ```Haskell hexdecodestring(str); ``` `str`: the string to convert. The supported data type is VARCHAR. An empty string is returned if any of the following situations occur: The length of the string is 0 or the number of characters in the string is an odd number. The string contains characters other than `[0-9]`, `[a-z]`, and `[A-Z]`. Returns a value of the VARCHAR type. ```Plain Text mysql> select hexdecodestring(hex("Hello StarRocks")); +-+ | hexdecodestring(hex('Hello StarRocks')) | +-+ | Hello StarRocks | +-+ ``` HEXDECODESTRING
Project: Salt Project (Provisioning / Automation & Configuration)
File: 0000-template.md

Feature Name: (fill with a unique identifier, ex: myawesomefeature) Start Date: (fill with today's date, YYYY-MM-DD) RFC PR: (leave this empty) Salt Issue: (leave this empty) Brief explanation of the feature. Why are we doing this? What use cases does it support? What is the expected outcome? If this RFC is not accepted, the motivation could be used to develop alternative solutions. Enumerate the constraints you are trying to solve without coupling them too closely to the solution you have in mind. This is the bulk of the RFC. Explain the design in enough detail for somebody familiar with the product to understand, and for somebody familiar with the internals to implement. It should include: Definition of any new terminology Examples of how the feature is used. Corner-cases A basic code example in case the proposal involves a new or changed API Outline of a test plan for this feature. How do you plan to test it? Can it be automated? What other designs have been considered? What is the impact of not doing this? What parts of the design are still TBD? Why should we not do this? Please consider: Implementation cost, both in term of code size and complexity Integration of this feature with other existing and planned features Cost of migrating existing Salt setups (is it a breaking change?) Documentation (would Salt documentation need to be re-organized or altered?) There are tradeoffs to choosing any path. Attempt to identify them here.
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.77.md

layout: release date: 2023-04-10 tag: v0.6.77 Redirect with Meshery Provider when provider is enforced @Revolyssup (#7522) Add metallb config and contour HTTPProxy @Revolyssup (#7499) Update Readme.md (wrap words) @HetviSoni (#7516) Bump github.com/docker/docker from 20.10.21+incompatible to 20.10.24+incompatible in /scripts/component_generation @dependabot (#7476) fix: use strict equality @Udit-takkar (#7515) Bump golang.org/x/oauth2 from 0.5.0 to 0.6.0 @dependabot (#7452) Added docker hub extension link @Ambareen09 (#7518) Thank you to our contributors for making this release possible: @Aisuko, @Ambareen09, @HetviSoni, @MUzairS15, @Revolyssup, @Udit-takkar, @dependabot and @leecalcote
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_storage_bucket_iam_bindings.md

+++ title = "googlestoragebucketiambindings resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlestoragebucketiambindings" identifier = "inspec/resources/gcp/googlestoragebucketiambindings.md googlestoragebucketiambindings resource" parent = "inspec/resources/gcp" +++ This resource is deprecated. Please use `google_storage_bucket_iam_policy` instead Use the `googlestoragebucketiambindings` InSpec audit resource to test properties of all, or a filtered group of, GCP storage bucket IAM bindings. A `googlestoragebucketiambindings` resource block collects GCP storage bucket IAM bindings then tests that group. describe googlestoragebucketiambindings(bucket: 'bucket-buvsjjcndqz') do it { should exist } end Use this InSpec resource to enumerate roles then test in-depth using `googleprojectiam_binding`. googlestoragebucketiambindings(bucket: 'bucket-buvsjjcndqz').iambindingroles.each do |iambindingrole| describe googlestoragebucketiambinding(bucket: 'bucket-buvsjjcndqz', role: iambindingrole) do it { should exist } its('members') {should include 'user:someuser@domain.com' } end end The following examples show how to use this InSpec audit resource. ```ruby describe googlestoragebucketiambindings(bucket: 'bucket-buvsjjcndqz') do its('count') { should be <= 100} end ``` ```ruby describe googlestoragebucketiambindings(bucket: 'bucket-buvsjjcndqz') do its('iambindingroles') { should include "roles/storage.admin" } end ``` ```ruby describe googlestoragebucketiambindings(bucket: 'bucket-buvsjjcndqz').where(iambindingrole: "roles/iam.securityReviewer") do it { should_not exist } end ``` This resource supports the following filter criteria: `iambindingrole`. This may be used with `where`, as a block or as a method. `iambindingroles` - an array of googlestoragebucketiambinding role strings e.g. `["roles/storage.admin", "roles/owner"]` Ensure the is enabled.
Project: KICS (Provisioning / Security & Compliance)
File: 97fa667a-d05b-4f16-9071-58b939f34751.md

title: Serial Ports Are Enabled For VM Instances hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 97fa667a-d05b-4f16-9071-58b939f34751 Query name: Serial Ports Are Enabled For VM Instances Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Google Compute Engine VM instances should not enable serial ports. When enabled, anyone can access your VM, if they know the username, project ID, SSH key, instance name and zone<br> ```tf title="Positive test num. 1 - tf file" hl_lines="26 44 38" resource "googlecomputeinstance" "positive1" { name = "test" machine_type = "e2-medium" zone = "us-central1-a" tags = ["foo", "bar"] boot_disk { initialize_params { image = "debian-cloud/debian-9" } } scratch_disk { interface = "SCSI" } network_interface { network = "default" access_config { } } metadata = { serial-port-enable = true } metadatastartupscript = "echo hi > /test.txt" service_account { scopes = ["userinfo-email", "compute-ro", "storage-ro"] } } resource "googlecomputeproject_metadata" "positive2" { metadata = { serial-port-enable = "TRUE" } } resource "googlecomputeprojectmetadataitem" "positive3" { key = "serial-port-enable" value = "TRUE" } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecomputeinstance" "negative1" { name = "test" machine_type = "e2-medium" zone = "us-central1-a" tags = ["foo", "bar"] boot_disk { initialize_params { image = "debian-cloud/debian-9" } } scratch_disk { interface = "SCSI" } network_interface { network = "default" access_config { } } metadata = { serial-port-enable = "FALSE" } metadatastartupscript = "echo hi > /test.txt" service_account { scopes = ["userinfo-email", "compute-ro", "storage-ro"] } } resource "googlecomputeproject_metadata" "negative2" { metadata = { serial-port-enable = false } } resource "googlecomputeprojectmetadataitem" "negative3" { key = "my_metadata" value = "my_value" } ```
Project: Tetragon (Provisioning / Security & Compliance)
File: CODE_OF_CONDUCT.md

In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation. Examples of behavior that contributes to creating a positive environment include: Using welcoming and inclusive language Being respectful of differing viewpoints and experiences Gracefully accepting constructive criticism Focusing on what is best for the community Showing empathy towards other community members Examples of unacceptable behavior by participants include: The use of sexualized language or imagery and unwelcome sexual attention or advances Trolling, insulting/derogatory comments, and personal or political attacks Public or private harassment Publishing others' private information, such as a physical or electronic address, without explicit permission Other conduct which could reasonably be considered inappropriate in a professional setting Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at oss-conduct@uber.com. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. This Code of Conduct is adapted from the , version 1.4, available at .