cwielenb/CNCF-Dataset huggingface dataset:
Project: Chef InSpec (Provisioning / Security & Compliance)
File: ip6tables.md

+++ title = "ip6tables resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "ip6tables" identifier = "inspec/resources/os/ip6tables.md ip6tables resource" parent = "inspec/resources/os" +++ Use the `ip6tables` Chef InSpec audit resource to test rules that are defined in `ip6tables`, which maintains tables of IP packet filtering rules for IPv6. There may be more than one table. Each table contains one (or more) chains (both built-in and custom). A chain is a list of rules that match packets. When the rule matches, the rule defines what target to assign to the packet. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v4.6.9 of InSpec. A `ip6tables` resource block declares tests for rules in IP tables: describe ip6tables(rule:'name', table:'name', chain: 'name') do it { should have_rule('RULE') } end where `ip6tables()` may specify any combination of `rule`, `table`, or `chain` `rule:'name'` is the name of a rule that matches a set of packets `table:'name'` is the packet matching table against which the test is run `chain: 'name'` is the name of a user-defined chain or one of `ACCEPT`, `DROP`, `QUEUE`, or `RETURN` `have_rule('RULE')` tests that rule in the ip6tables list. This must match the entire line taken from `ip6tables -S CHAIN`. The following examples show how to use this Chef InSpec audit resource. describe ip6tables do it { should have_rule('-P INPUT ACCEPT') } end describe ip6tables(table:'mangle', chain: 'INPUT') do it { should have_rule('-P INPUT ACCEPT') } end describe ip6tables do it { should have_rule('-A INPUT -p tcp -m tcp -m multiport --dports 5432 -m comment --comment "postgres" -j ACCEPT') } end Note that the rule specification must exactly match what's in the output of `ip6tables -S INPUT`, which will depend on how you've built your rules. {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `have_rule` matcher tests the named rule against the information in the `ip6tables` file: it { should have_rule('RULE') }
Project: Shifu (Provisioning / Automation & Configuration)
File: CHANGELOG-v0.17.0.md

update user metrics URL to shifu.dev by @tomqin93 in https://github.com/Edgenesis/shifu/pull/589 Bump github.com/minio/minio-go/v7 from 7.0.50 to 7.0.52 by @dependabot in https://github.com/Edgenesis/shifu/pull/580 Bump github.com/spf13/cobra from 1.6.1 to 1.7.0 by @dependabot in https://github.com/Edgenesis/shifu/pull/582 Full Changelog: https://github.com/Edgenesis/shifu/compare/v0.16.0...v0.17.0
Project: Chef InSpec (Provisioning / Security & Compliance)
File: alicloud.md

+++ title = "Chef InSpec and Alibaba Cloud" draft = false gh_repo = "inspec" [menu] [menu.inspec] title = "AliCloud" identifier = "inspec/cloud/alibaba" parent = "inspec/cloud" +++ Chef InSpec has resources for auditing Alibaba. You will need to install AliCloud SDK version 0.8.0 and require AliCloud credentials to use the Chef InSpec AliCloud resources. You can configure AliCloud credentials in an or export them in your shell. ```bash export ALICLOUDACCESSKEY="anaccesskey" export ALICLOUDSECRETKEY="asecretkey" export ALICLOUD_REGION="eu-west-1" ``` {{< inspec/inspec_resources platform="alicloud" >}}
Project: KICS (Provisioning / Security & Compliance)
File: baa452f0-1f21-4a25-ace5-844e7a5f410d.md

title: Volume Mounted In Multiple Containers hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: baa452f0-1f21-4a25-ace5-844e7a5f410d Query name: Volume Mounted In Multiple Containers Platform: DockerCompose Severity: <span style="color:#bb2124">High</span> Category: Build Process URL: Volume mounts should not be shared, which means that 'propagation' should not be set to 'shared', 'rshared', 'slave', or 'rslave'<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="15" version: "3.2" services: old8k: image: notreal container_name: "c1" restart: always expose: 74746 76867 volumes: type: bind source: $ENVVAR/.whew/path/datapath target: "/data" bind: propagation: rshared ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="15" version: "3.2" services: old8k: image: notreal container_name: "c2" restart: always expose: 74746 76867 volumes: type: bind source: $ENVVAR/.whew/path/datapath target: "/data" bind: propagation: shared ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="15" version: "3.2" services: old8k: image: notreal container_name: "c3" restart: always expose: 74746 76867 volumes: type: bind source: $ENVVAR/.whew/path/datapath target: "/data" bind: propagation: rslave ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="15" version: "3.2" services: old8k: image: notreal container_name: "c4" restart: always expose: 74746 76867 volumes: type: bind source: $ENVVAR/.whew/path/datapath target: "/data" bind: propagation: slave ``` </details> ```yaml title="Negative test num. 1 - yaml file" version: "3.2" services: old8k: image: notreal container_name: "c5" restart: always expose: 74746 76867 volumes: type: bind source: $ENVVAR/.whew/path/datapath target: "/data" bind: propagation: private ``` ```yaml title="Negative test num. 2 - yaml file" version: "3.2" services: old8k: image: notreal container_name: "c6" restart: always expose: 74746 76867 volumes: type: bind source: $ENVVAR/.whew/path/datapath target: "/data" bind: propagation: rprivate #this is the default value ``` ```yaml title="Negative test num. 3 - yaml file" version: "3.2" services: old8k: image: notreal container_name: "c7" restart: always expose: 74746 76867 volumes: type: bind source: $ENVVAR/.whew/path/datapath target: "/data" ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: powershell.md

+++ title = "powershell resource" draft = false gh_repo = "inspec" platform = "windows" [menu] [menu.inspec] title = "powershell" identifier = "inspec/resources/os/powershell.md powershell resource" parent = "inspec/resources/os" +++ Use the `powershell` Chef InSpec audit resource to test a Powershell script on the Windows platform. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. A `powershell` resource block declares a Powershell script to be tested, and then compares the output of that command to the matcher in the test: script = <<-EOH EOH describe powershell(script) do its('property') { should eq 'output' } end where `'script'` must specify a Powershell script to be run `'matcher'` is one of `exit_status`, `stderr`, or `stdout` `'output'` tests the output of the command run on the system versus the output value stated in the test The `exit_status` property tests the exit status for the command: its('exit_status') { should eq 123 } The `stderr` property tests results of the command as returned in standard error (stderr): its('stderr') { should eq 'error' } The `stdout` property tests results of the command as returned in standard output (stdout): its('stdout') { should eq '/^1$/' } The following examples show how to use this Chef InSpec audit resource. script = <<-EOH $user = Get-WmiObject Win32_UserAccount -filter "Name = 'Administrator'" $groups = $user.GetRelated('Win32_Group') | Select-Object -Property Caption, Domain, Name, LocalAccount, SID, SIDType, Status $groups | ConvertTo-Json EOH describe powershell(script) do its('stdout') { should_not eq '' } end The following Powershell script: script = <<-EOH Write-Output 'hello' EOH can be tested in the following ways. For a newline: describe powershell(script) do its('stdout') { should eq "hello\r\n" } its('stderr') { should eq '' } end Removing whitespace `\r\n` from `stdout`: describe powershell(script) do its('strip') { should eq "hello" } end No newline: describe powershell("'hello' | Write-Host -NoNewLine") do its('stdout') { should eq 'hello' } its('stderr') { should eq '' } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: Dex (Provisioning / Security & Compliance)
File: ADOPTERS.md

This is a list of production adopters of Dex (in alphabetical order): integrates Dex to provide convenient Single Sign On capabilities to its web UI and CLI uses Dex for authenticating users across their Kubernetes infrastructure (using Kubernetes OIDC support). is using Dex for authenticating to its Pipeline control plane and also to authenticate users against provisioned Kubernetes clusters (via Kubernetes OIDC support). uses Dex for authenticating users in . The code is Open Source, available at . uses Dex for authentication in their distribution, including SSO to the custom dashboard, Grafana, Kibana, and Harbor. uses Dex for providing access to core components of , integration with various authentication providers, plugging custom applications. is leveraging federated OIDC provided by Dex for authenticating users to their compute infrastructure based on Kubernetes. is using Dex for authenticating access to the dashboard of , a Kubernetes-native platform for backup, disaster recovery and mobility of Kubernetes applications. K10 is widely used by a variety of customers including large enterprises, financial services, design firms, and IT companies. is using Dex to authenticate access to Kubernetes API server (even for managed Kubernetes like Google Kubernetes Engine or Azure Kubernetes Service) and for protecting web UI of and other UIs integrated in Kyma (, , and ). Kyma is an open-source project () designed natively on Kubernetes, that allows you to extend and customize your applications in a quick and modern way, using serverless computing or microservice architecture. uses Dex for authenticating users across their Kubernetes infrastructure (using Kubernetes OIDC support) in conjunction with the for protecting web UIs. Pydio Cells is an open source sync & share platform written in Go. Cells is using Dex as an OIDC service for authentication and authorizations. Check out for more information and/or to contribute. uses Dex for authentication in their public Fulcio instance, which is a certificate authority for code signing certificates bound to OIDC-based identities.
Project: Confidential Containers (Provisioning / Security & Compliance)
File: v0.7.0.md

Release Date: July 24th, 2023 Please see the for details on how to try out Confidential Containers. Please refer to our and pages for a definition of the acronyms used in this document. Flexible instance types/profiles support for peer-pods Ability to use CSI Persistent Volume with peer-pods on Azure and IBM Cloud EAA-KBC/Verdictd support removed from enclave-cc Baremetal SNP without attestation available via operator Guest components (`attestation-agent`, `image-rs` and `ocicrypt-rs`) merged into Documentation and community repositories merged together Confidential Containers is tested with attestation on the following platforms: Intel TDX AMD SEV(-ES) Intel SGX The following platforms are untested or partially supported: IBM Secure Execution (SE) on IBM zSystems (s390x) running LinuxONE AMD SEV-SNP The following platforms are in development: ARM CCA The following are known limitations of this release: Platform support is rapidly changing Image signature validation with AMD SEV-ES is not covered by CI. SELinux is not supported on the host and must be set to permissive if in use. The generic KBS does not yet supported all platforms. The format of encrypted container images is still subject to change The container image format itself may still change The tools to generate images are not in their final form The image format itself is subject to change in upcoming releases Not all image repositories support encrypted container images. CoCo currently requires a custom build of `containerd`, which is installed by the operator. Codepath for pulling images will change significantly in future releases. `crio` is only supported with `cloud-api-adaptor`. Complete integration with Kubernetes is still in progress. OpenShift support is not yet complete. Existing APIs do not fully support the CoCo security and threat model. Some commands accessing confidential data, such as `kubectl exec`, may either fail to work, or incorrectly expose information to the host Container images must be downloaded separately (inside guest) for each pod. The CoCo community aspires to adopting open source security best practices, but not all practices are adopted yet. We track our status with the OpenSSF Best Practices Badge, which remained at 64% at the time of this release. Vulnerability reporting mechanisms still need to be created. Public github issues are still appropriate for this release until private reporting is established. None
Project: LinuxKit (Provisioning / Automation & Configuration)
File: sbom.md

LinuxKit bootable images are composed of existing OCI images. OCI images, when built, often are scanned to create a software bill-of-materials (SBoM). The buildkit builder system itself contains the . When LinuxKit composes an operating system image using `linuxkit build`, it will, by default, combine the SBoMs of all the OCI images used to create the final image. It looks for SBoMs in the following locations: Future support for is under consideration, and will be reviewed when it is generally available. When building packages with `linuxkit pkg build`, it also has the ability to generate an SBoM for the package, which later can be consumed by `linuxkit build`. When `linuxkit build` is run, it does the following for dealing with SBoMs: For each OCI image that it processes: check if the image contains an SBoM attestation; it not, skip this step. Retrieve the SBoM attestation. After generating the root filesystem, combine all of the individual SBoMs into a single unified SBoM. Save the output single SBoM into the root of the image as `sbom.spdx.json`. Currently, only SPDX json format is supported. By default, linuxkit combines the SBoMs into a file with output format SPDX json, and the file saved to the filename `sbom.spdx.json`. In addition, in order to assist with reproducible builds, the creation date/time of the SBoM is a fixed date/time set by linuxkit, rather than the current date/time. Note, however, that even with a fixed date/time, reproducible builds depends on reproducible SBoMs on the underlying container images. This is not always the case, as the unique IDs for each package and file might be deterministic, but it might not. This can be overridden by using the CLI flags: `--no-sbom`: do not find and consolidate the SBoMs `--sbom-output <filename>`: the filename to save the output to in the image. `--sbom-current-time true|false`: whether or not to use the current time for the SBoM creation date/time (default `false`) To disable SBoM generation when running `linuxkit build`, use the CLI flag `--sbom false`. When `linuxkit pkg build` is run, by default it enables generating an SBoM using the . This means that it inherits all of those capabilities as well, and saves the SBoM in the same location, as an attestation on the image. By default, buildkit runs with output format SPDX json, specifically via its integration image . You can select a different image to run a scanner, provided it complies with the , by passing the CLI flag `--sbom-scanner <image>`. To disable SBoM generation when running `linuxkit pkg build`, use the CLI flag `--sbom-scanner=false`.
Project: Apache Heron (App Definition and Development / Streaming & Messaging)
File: heron-design-goals.md

id: version-0.20.0-incubating-heron-design-goals title: Heron Design Goals sidebar_label: Heron Design Goals original_id: heron-design-goals <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> From the beginning, Heron was envisioned as a new kind of stream processing system, built to meet the most demanding of technological requirements, to handle even the most massive of workloads, and to meet the needs of organizations of all sizes and degrees of complexity. Amongst these requirements: The ability to process billions of events per minute Extremely low end-to-end latency Predictable behavior regardless of scale and in the face of issue like extreme traffic spikes and pipeline congestion Simple administration, including: The ability to deploy on shared infrastructure Powerful monitoring capabilities Fine-grained configurability Easy debuggability To meet these requirements, a few core design goals have guidedand continue to guideHeron's development: Heron was designed to serve a wide range of requirements, use cases, platforms, programming languages and so on. In order to suit varyingand often unforeseeableneeds, Heron provides support for mulitple: metrics sinks operating systems and platforms topology Due to its fundamentally character, Heron is remarkably easy to extend to meet your needs, with simple APIs that you can use to add support for new schedulers, programming languages (for topologies), topology uploaders, etc. Heron topologies should be process based rather than thread based, and each process should run in isolation for the sake of easy debugging, profiling, and troubleshooting. Heron topologies should use only those resources that they are initially allocated and never exceed those bounds. This makes Heron safe to run in shared infrastructure. Although Heron has a that we recommend for all future topology development, Heron is fully API and data model compatible with , making it easy for developers to transition from Storm to Heron. In a distributed system like Heron, there are no guarantees that all system components will execute at the same speed. Heron has built-in [back pressure mechanisms](heron-architecture#stream-manager) to ensure that topologies can self-adjust in case components lag. Heron provides support for , , and processing semantics.
Project: Apache Spark (App Definition and Development / Streaming & Messaging)
File: sql-error-conditions-invalid-aggregate-filter-error-class.md

layout: global title: INVALIDAGGREGATEFILTER error class displayTitle: INVALIDAGGREGATEFILTER error class license: | Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. <!-- DO NOT EDIT THIS FILE. It was generated automatically by `org.apache.spark.SparkThrowableSuite`. --> The FILTER expression `<filterExpr>` in an aggregate function is invalid. This error class has the following derived error classes: Expected a FILTER expression without an aggregation, but found `<aggExpr>`. Expected a FILTER expression without a window function, but found `<windowExpr>`. Expected a deterministic FILTER expression. Expected a FILTER expression of the BOOLEAN type.
Project: Apache Spark (App Definition and Development / Streaming & Messaging)
File: sql-ref-syntax-ddl-create-database.md

layout: global title: CREATE DATABASE displayTitle: CREATE DATABASE license: | Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Creates a database with the specified name. If database with the same name already exists, an exception will be thrown. ```sql CREATE { DATABASE | SCHEMA } [ IF NOT EXISTS ] database_name [ COMMENT database_comment ] [ LOCATION database_directory ] [ WITH DBPROPERTIES ( propertyname = propertyvalue [ , ... ] ) ] ``` database_name* Specifies the name of the database to be created. IF NOT EXISTS* Creates a database with the given name if it does not exist. If a database with the same name already exists, nothing will happen. database_directory* Path of the file system in which the specified database is to be created. If the specified path does not exist in the underlying file system, this command creates a directory with the path. If the location is not specified, the database will be created in the default warehouse directory, whose path is configured by the static configuration spark.sql.warehouse.dir. database_comment* Specifies the description for the database. WITH DBPROPERTIES ( property_name=property_value [ , ... ] )* Specifies the properties for the database in key-value pairs. ```sql -- Create database `customerdb`. This throws exception if database with name customerdb -- already exists. CREATE DATABASE customer_db; -- Create database `customer_db` only if database with same name doesn't exist. CREATE DATABASE IF NOT EXISTS customer_db; -- Create database `customer_db` only if database with same name doesn't exist with -- `Comments`,`Specific Location` and `Database properties`. CREATE DATABASE IF NOT EXISTS customer_db COMMENT 'This is customer database' LOCATION '/user' WITH DBPROPERTIES (ID=001, Name='John'); -- Verify that properties are set. DESCRIBE DATABASE EXTENDED customer_db; +-+--+ |databasedescriptionitem|databasedescriptionvalue| +-+--+ | Database Name| customer_db| | Description| This is customer database| | Location| hdfs://hacluster/user| | Properties| ((ID,001), (Name,John))| +-+--+ ```