Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/GoogleCloudPlatform/opentelemetry-operations-go/propagator
This package contains Trace Context Propagators for use with Google Cloud Trace that make it compatible with OpenTelemetry.
To get started with instrumentation in Google Cloud, see Generate traces and metrics with Go.
To learn more about instrumentation and observability, including opinionated recommendations for Google Cloud Observability, visit Instrumentation and observability.
There are two available propagators in this package:
CloudTraceOneWayPropagator
(Recommended)The CloudTraceOneWayPropagator
reads the X-Cloud-Trace-Context
header for trace and
span IDs, but does not write the X-Cloud-Trace-Context
header into outgoing
requests.
This is useful for ensuring spans created in your code are attached to the traces that some Google Cloud services automatically trace.
import (
"go.opentelemetry.io/otel/propagation"
gcppropagator "github.com/GoogleCloudPlatform/opentelemetry-operations-go/propagator"
)
func installPropagators() {
otel.SetTextMapPropagator(
propagation.NewCompositeTextMapPropagator(
// Putting the CloudTraceOneWayPropagator first means the TraceContext propagator
// takes precedence if both the traceparent and the XCTC headers exist.
gcppropagator.CloudTraceOneWayPropagator{},
propagation.TraceContext{},
propagation.Baggage{},
))
}
CloudTraceFormatPropagator
The standard propagator reads and writes the X-Cloud-Trace-Context
header.
Note that because of differences between the meaning of the sampled
flag
(described below), this can result in 100% tracing when the parent context
has a deferred tracing decision.
import (
"go.opentelemetry.io/otel/propagation"
gcppropagator "github.com/GoogleCloudPlatform/opentelemetry-operations-go/propagator"
)
func installPropagators() {
otel.SetTextMapPropagator(
propagation.NewCompositeTextMapPropagator(
// Putting the CloudTraceFormatPropagator first means the TraceContext propagator
// takes precedence if both the traceparent and the XCTC headers exist.
gcppropagator.CloudTraceFormatPropagator{},
propagation.TraceContext{},
propagation.Baggage{},
))
}
Google Cloud Trace encodes trace information in the X-Cloud-Trace-Context
HTTP
header, using the format described in the Trace documentation.
OpenTelemetry uses the newer, W3C standard
traceparent
header
There is an important semantic difference between Cloud Trace's
TRACE_TRUE
flag, and W3C's sampled
flag.
As outlined in the Trace
documentation, setting
the TRACE_TRUE
flag will cause trace information to be collected.
This differs from the W3C behavior, where the sampled
flag indicates that the
caller may have recorded trace information, but does not necessarily impact
the sampling done by other services.
To preserve the Cloud-Trace behavior when using traceparent
, you can use the
ParentBased
sampler like
so:
import sdktrace go.opentelemetry.io/otel/sdk/trace
sampler := sdktrace.ParentBased(
sdktrace.NeverSample(),
sdktrace.WithRemoteParentSampled(sdktrace.AlwaysSample()))
)
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.