cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 9efb0b2d-89c9-41a3-91ca-dcc0aec911fd.md

title: Image Version Not Explicit hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9efb0b2d-89c9-41a3-91ca-dcc0aec911fd Query name: Image Version Not Explicit Platform: Dockerfile Severity: <span style="color:#ff7213">Medium</span> Category: Supply-Chain URL: Always tag the version of an image explicitly<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="1" FROM alpine RUN apk add --update py2-pip RUN pip install --upgrade pip COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python", "/usr/src/app/app.py"] ``` ```dockerfile title="Positive test num. 2 - dockerfile file" hl_lines="7" FROM ubuntu:22.04 AS test RUN echo "hello" FROM test AS build RUN echo "build" FROM construction AS final RUN echo "final" ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM alpine:3.5 RUN apk add --update py2-pip RUN pip install --upgrade pip COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 ARG IMAGE=alpine:3.12 FROM $IMAGE CMD ["python", "/usr/src/app/app.py"] ``` ```dockerfile title="Negative test num. 2 - dockerfile file" FROM ubuntu:22.04 AS test RUN echo "hello" FROM test AS build RUN echo "build" FROM build AS final RUN echo "final" ```
Project: Athenz (Provisioning / Key Management)
File: review_enabled_roles.md

Athenz now supports configuring roles in domains as review-enabled thus requiring two domain administrator approvals before a principal is added to a role. To designate a role as review-enabled, the domain administrator may use either Athenz UI or utility. To use Athenz UI, the domain administrator will login to their domain role view and choose the `Review Enabled` slider for the appropriate role. For example, in the following case, the `dbreaderaccess` role is configured as review-served. ``` zms-cli -d <domain-name> set-role-review-enabled <role-name> true ``` The show-role command will display the review attribute if it's enabled for a role: ``` $ zms-cli -d home.johndoe set-role-review-enabled read-access true [domain home.johndoe role read-access review-enabled attribute successfully updated] $ zms-cli -d home.johndoe show-role read-access role: name: read-access review_enabled: true members: user.janedoe ``` Unlike a regular role, when any one of the domain administrators adds a user in a review enabled role, it will be added in pending/inactive state until it is approved by one of the other domain administrators. For example, in this use case, the domain administrator would like to add `user.bob` principal to the `dbreaderaccess` role which is configured as review enabled. When the domain administrator adds the principal id to the role, it will be added in the `Pending Approval` column. It will be in pending state until one of the other domain administrators reviews and either approves or rejects the request. Once the pending request is processed, all domain administrators will receive an email notification stating that `user.pgote` would like to be added to the `dbreaderaccess` role and they need to either approve or reject the request. The email will include a link to the Athenz UI workflow page which can also be accessed by clicking on the notifications icon in the Athenz UI toolbar: Once in the approval view page, the domain administrator may either approve or reject the request. The domain administrator will need to provide a justification in the `Audit Reference` field and optionally specify an expiration date (even if the user didn't request one). Once approved, the principal will become an active/approved member of the role. If rejected, the principal's name will be removed from the `Pending Approval` column. Important The domain administrator that submitted the original request is not authorized to approve his/her own request. It must be approved by another domain administrator. This requires that the domain must have at least 2 administrators. Additional domain administrator approver workflow only applies to adding users in review enabled roles. The domain administrators have the authorization to remove any principal from a review enabled role without further approval process.
Project: Eclipse Che (App Definition and Development / Application Definition & Image Build)
File: CODE_OF_CONDUCT.md

As contributors and maintainers of this project, and in the interest of fostering an open and welcoming community, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities. We are committed to making participation in this project a harassment-free experience for everyone, regardless of level of experience, gender, gender identity and expression, sexual orientation, disability, personal appearance, body size, race, ethnicity, age, religion, or nationality. Examples of unacceptable behavior by participants include: The use of sexualized language or imagery Personal attacks Trolling or insulting/derogatory comments Public or private harassment Publishing other's private information, such as physical or electronic addresses, without explicit permission Other unethical or unprofessional conduct Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. By adopting this Code of Conduct, project maintainers commit themselves to fairly and consistently applying these principles to every aspect of managing this project. Project maintainers who do not follow or enforce the Code of Conduct may be permanently removed from the project team. This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting a project maintainer at che-dev@eclipse.org. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. Maintainers are obligated to maintain confidentiality with regard to the reporter of an incident. This Code of Conduct is adapted from the , version 1.3.0, available at
Project: ClickHouse (App Definition and Development / Database)
File: quantileinterpolatedweighted.md

slug: /en/sql-reference/aggregate-functions/reference/quantileInterpolatedWeighted sidebar_position: 203 Computes of a numeric data sequence using linear interpolation, taking into account the weight of each element. To get the interpolated value, all the passed values are combined into an array, which are then sorted by their corresponding weights. Quantile interpolation is then performed using the by building a cumulative distribution based on weights and then a linear interpolation is performed using the weights and the values to compute the quantiles. When using multiple `quantile*` functions with different levels in a query, the internal states are not combined (that is, the query works less efficiently than it could). In this case, use the function. Syntax ``` sql quantileInterpolatedWeighted(level)(expr, weight) ``` Alias: `medianInterpolatedWeighted`. Arguments `level` Level of quantile. Optional parameter. Constant floating-point number from 0 to 1. We recommend using a `level` value in the range of `. `expr` Expression over the column values resulting in numeric , or . `weight` Column with weights of sequence members. Weight is a number of value occurrences. Returned value Quantile of the specified level. Type: for numeric data type input. if input values have the `Date` type. if input values have the `DateTime` type. Example Input table: ``` text nval 0 3 1 2 2 1 5 4 ``` Query: ``` sql SELECT quantileInterpolatedWeighted(n, val) FROM t ``` Result: ``` text quantileInterpolatedWeighted(n, val) 1 ``` See Also
Project: ClickHouse (App Definition and Development / Database)
File: v20.6.3.28-stable.md

Backported in : The function `groupArrayMoving` was not working for distributed queries. It's result was calculated within incorrect data type (without promotion to the largest type). The function `groupArrayMovingAvg` was returning integer number that was inconsistent with the `avg` function. This fixes . (). Backported in : CREATE USER IF NOT EXISTS now doesn't throw exception if the user exists. This fixes . (). Backported in : Fix columns duplication for range hashed dictionary created from DDL query. This fixes . (). Backported in : Fix DateTime64 conversion functions with constant argument. (). Backported in : Fix assert in `arrayElement` function in case of array elements are Nullable and array subscript is also Nullable. This fixes . (). Backported in : Fix function if with nullable constexpr as cond that is not literal NULL. Fixes . (). Backported in : Fix potentially low performance and slightly incorrect result for `uniqExact`, `topK`, `sumDistinct` and similar aggregate functions called on Float types with NaN values. It also triggered assert in debug build. This fixes . (). Backported in : The server may crash if user passed specifically crafted arguments to the function `h3ToChildren`. This fixes . (). Backported in : Fix possible error `Totals having transform was already added to pipeline` in case of a query from delayed replica. (). Backported in : Fix crash in `LEFT ASOF JOIN` with `joinusenulls=1`. (). Backported in : Fix segfault when function `groupArrayMovingSum` deserializes empty state. Fixes . (). Backported in : Fix PrettyCompactMonoBlock for clickhouse-local. Fix extremes/totals with PrettyCompactMonoBlock. Fixes . (). Backported in : Fix `aggregate function any(x) is found inside another aggregate function in query` error with `SET optimizemovefunctionsoutof_any = 1` and aliases inside `any()`. ().
Project: KICS (Provisioning / Security & Compliance)
File: ca4df748-613a-4fbf-9c76-f02cbd580307.md

title: Default Azure Storage Account Network Access Is Too Permissive hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ca4df748-613a-4fbf-9c76-f02cbd580307 Query name: Default Azure Storage Account Network Access Is Too Permissive Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Make sure that your Azure Storage Account access is limited to those who require it.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="3" name: create an account azure.azcollection.azurermstorageaccount: resource_group: myResourceGroup name: clh0002 type: Standard_RAGRS tags: testing: testing delete: on-exit publicnetworkaccess: Enabled ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="3" name: create an account azure.azcollection.azurermstorageaccount: resource_group: myResourceGroup name: clh0002 type: Standard_RAGRS tags: testing: testing delete: on-exit ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="3" name: create an account azure.azcollection.azurermstorageaccount: resource_group: myResourceGroup name: clh0002 type: Standard_RAGRS tags: testing: testing delete: on-exit network_acls: default_action: Allow ``` ```yaml title="Negative test num. 1 - yaml file" name: create an account azure.azcollection.azurermstorageaccount: resource_group: myResourceGroup name: clh0002 type: Standard_RAGRS tags: testing: testing delete: on-exit network_acls: default_action: Deny ``` ```yaml title="Negative test num. 2 - yaml file" name: create an account azure.azcollection.azurermstorageaccount: resource_group: myResourceGroup name: clh0002 type: Standard_RAGRS tags: testing: testing delete: on-exit publicnetworkaccess: Disabled ```
Project: Flink (App Definition and Development / Streaming & Messaging)
File: python_types.md

title: "Data Types" weight: 32 type: docs aliases: /dev/python/table-api-users-guide/python_types.html <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> This page describes the data types supported in PyFlink Table API. Data Type A data type describes the logical type of a value in the table ecosystem. It can be used to declare input and/or output types of Python user-defined functions. Users of the Python Table API work with instances of `pyflink.table.types.DataType` within the Python Table API or when defining user-defined functions. A `DataType` instance declares the logical type which does not imply a concrete physical representation for transmission or storage. All pre-defined data types are available in `pyflink.table.types` and can be instantiated with the utility methods defined in `pyflink.table.types.DataTypes`. A list of all pre-defined data types can be found . Data Type and Python Type Mapping A data type can be used to declare input and/or output types of Python user-defined functions. The inputs will be converted to Python objects corresponding to the data type and the type of the user-defined functions result must also match the defined data type. For vectorized Python UDF, the input types and output type are `pandas.Series`. The element type of the `pandas.Series` corresponds to the specified data type. | Data Type | Python Type | Pandas Type | |--||--| | `BOOLEAN` | `bool` | `numpy.bool_` | | `TINYINT` | `int` | `numpy.int8` | | `SMALLINT` | `int` | `numpy.int16` | | `INT` | `int` | `numpy.int32` | | `BIGINT` | `int` | `numpy.int64` | | `FLOAT` | `float` | `numpy.float32` | | `DOUBLE` | `float` | `numpy.float64` | | `VARCHAR` | `str` | `str` | | `VARBINARY` | `bytes` | `bytes` | | `DECIMAL` | `decimal.Decimal` | `decimal.Decimal` | | `DATE` | `datetime.date` | `datetime.date` | | `TIME` | `datetime.time` | `datetime.time` | | `TimestampType` | `datetime.datetime` | `datetime.datetime` | | `LocalZonedTimestampType` | `datetime.datetime` | `datetime.datetime` | | `INTERVAL YEAR TO MONTH` | `int` | `Not Supported Yet` | | `INTERVAL DAY TO SECOND` | `datetime.timedelta` | `Not Supported Yet` | | `ARRAY` | `list` | `numpy.ndarray` | | `MULTISET` | `list` | `Not Supported Yet` | | `MAP` | `dict` | `Not Supported Yet` | | `ROW` | `Row` | `dict` |
Project: KubeVirt (App Definition and Development / Application Definition & Image Build)
File: CHANGES.md

Bump fsnotify to v1.5.1 fixes issue #28, hpcloud/tail#90. PR #27: "Add timeout to tests"by @kokes++. Also timeout on FreeBSD. PR #29: "Use temp directory for tests, instead of relative" by @ches++. Documentation updates. Small linter cleanups. Added example in test. Document the usage of Cleanup when re-reading a file (thanks to @lesovsky) for issue #18. Add example directories with example and tests for issues. Fix of checksum problem because of forced tag. No changes to the code. Incorporated PR 162 by by Mohammed902: "Simplify non-Windows build tag". Incorporated PR 9 by mschneider82: "Added seekinfo to Tail". Incorporated PR 7: "Fix deadlock when stopping on non-empty file/buffer", fixes upstream issue 93. Incorporated changes of unmerged upstream PR 149 by mezzi: "added line num to Line struct". Incorporated changes of unmerged upstream PR 128 by jadekler: "Compile-able code in readme". Incorporated changes of unmerged upstream PR 130 by fgeller: "small change to comment wording". Incorporated changes of unmerged upstream PR 133 by sm3142: "removed spurious newlines from log messages". Incorporated changes of unmerged upstream PR 126 by Code-Hex: "Solved the problem for never return the last line if it's not followed by a newline". Incorporated changes of unmerged upstream PR 131 by StoicPerlman: "Remove deprecated os.SEEK consts". The changes bumped the minimal supported Go release to 1.9. migration to go modules. release of master branch of the dormant upstream, because it contains fixes and improvement no present in the tagged release.
Project: KICS (Provisioning / Security & Compliance)
File: 5baa92d2-d8ee-4c75-88a4-52d9d8bb8067.md

title: GKE Legacy Authorization Enabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5baa92d2-d8ee-4c75-88a4-52d9d8bb8067 Query name: GKE Legacy Authorization Enabled Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: Kubernetes Engine Clusters must have Legacy Authorization set to disabled, which means the attribute 'enablelegacyabac' must not be true<br> ```tf title="Positive test num. 1 - tf file" hl_lines="6" resource "googlecontainercluster" "positive1" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 enablelegacyabac = true timeouts { create = "30m" update = "40m" } } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecontainercluster" "negative1" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 enablelegacyabac = false timeouts { create = "30m" update = "40m" } } ```
Project: Portus (Provisioning / Container Registry)
File: README.md

We use for producing the RPMs of Portus. More specifically, we have a subproject inside of for each Portus version (e.g. this is the one for the ). Each subproject contains the related Portus version with its dependencies (build and runtime dependencies). The `portus` package contains the `spec` file and some patches. The `spec` file is produced with the `make_spec.sh` script like this: ```bash $ ./make_spec.sh portus ``` This generated file is then used in OBS. That being said, in the `master` branch we allow Travis CI to do this. On a successful Travis CI build, the `packageandpushtoobs.sh` script will be run. This script will: Call `make_spec.sh` and push the generated `spec` file. Push the patches inside of the `patches` directory. Ruby is handled with the traditional `bundler` way. We have a `Gemfile.lock` which determines the versions to be used, and in OBS we have already packaged the different gems with their respective versions. If the `Gemfile.lock` and the gems from OBS are in sync, then the build will succeed, as all Ruby requirements are met. Note that Ruby dependencies will be available during runtime execution. Javascript is a bit different, since the way to require the dependencies are with the `package.json` file. That being said, we use , and this tool allows us to have a `yarn.lock` file similar to the `Gemfile.lock` one. That being said, Javascript packaging is a big mess, and we haven't packaged all the requirements in OBS. To circumvent this, we produce the `node_modules` directory locally, and then push it into the OBS repository as a tarball. Doing this locally is guaranteed to produce a reproducible `node_modules` directory thanks to yarn. These Javascript dependencies will only be available during build time. This is because we use webpack: When building the RPM, we will produce the desired assets with webpack, and so everything will be bundled as files inside of the `public` directory. On a successful build, the `node_modules` directory will be excluded from the final RPM, so we will end up with the bundled assets, but without the heavy `node_modules` directory. That being said, we intent to improve how we generate the `node_modules` directory (e.g. in the `packageandpushtoobs.sh` script). Once upon a time, we developed `portusctl` as a helper application for managing your Portus instance. Eventually we realized that we had to re-purpose it, and so we moved it into its .
Project: ClickHouse (App Definition and Development / Database)
File: v21.9.3.30-stable.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Use real tmp file instead of predefined "rows_sources" for vertical merges. This avoids generating garbage directories in tmp disks. (). Backported in : Fix possible crash for `SELECT` with partially created aggregate projection in case of exception. (). Backported in : Fix benign race condition in ReplicatedMergeTreeQueue. Shouldn't be visible for user, but can lead to subtle bugs. (). Backported in : Fix expressions compilation with short circuit evaluation. (). Backported in : Fixed a race condition between `DROP PART` and `REPLACE/MOVE PARTITION` that might cause replicas to diverge in rare cases. (). Backported in : Fix reading of subcolumns from compact parts. (). Backported in : Fix bug with LowCardinality in short-curcuit function evaluation. Closes . (). Backported in : Fix higher-order array functions (`SIGSEGV` for `arrayCompact`/`ILLEGAL_COLUMN` for `arrayDifference`/`arrayCumSumNonNegative`) with consts. (). Backported in : Fix the number of threads used in `GLOBAL IN` subquery (it was executed in single threads since bugfix). (). Add more checks for LC in native protocol. (). Fix usage of nested columns with non-array columns with the same prefix (). Lower compiledexpressioncache_size to 128MB (). Column default dictGet identifier fix ().
Project: KICS (Provisioning / Security & Compliance)
File: 5e0fb613-ba9b-44c3-88f0-b44188466bfd.md

title: RAM Account Password Policy Not Require at Least one Uppercase Character hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5e0fb613-ba9b-44c3-88f0-b44188466bfd Query name: RAM Account Password Policy Not Require at Least one Uppercase Character Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Secret Management URL: Ram Account Password Policy should have 'requireuppercasecharacters' set to true<br> ```tf title="Positive test num. 1 - tf file" hl_lines="4" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = false requireuppercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 12 passwordreuseprevention = 5 maxloginattempts = 3 } ``` ```tf title="Negative test num. 1 - tf file" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = false requireuppercasecharacters = true require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 12 passwordreuseprevention = 5 maxloginattempts = 3 } ``` ```tf title="Negative test num. 2 - tf file" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 12 passwordreuseprevention = 5 maxloginattempts = 3 } ```