
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
github.com/carousell/orion/builder
Orion-Builder is written in golang, please follow instructions on https://golang.org/doc/install to install, or you can also run
brew install golang
add the following lines to your ~/.profile
export GOPATH="$HOME/code/go"
export GOBIN="$GOPATH/bin"
export PATH="$GOBIN:$PATH"
export PATH="$HOME/.gotools:$PATH"
source your ~/.profile
source ~/.profile
then create the code dir
mkdir -p $GOPATH
we use govendor
to vendor package in Orion-Builder, install it by running
go get -u github.com/kardianos/govendor
another helpful tool to check for unupdated packages is Go-Package-Store
, install it by running
go get -u github.com/shurcooL/Go-Package-Store/cmd/Go-Package-Store
now clone this repo
mkdir -p $GOPATH/src/github.com/carousell/
git clone git@github.com:carousell/Orion-Builder.git $GOPATH/src/github.com/carousell/Orion-Builder
You need the following tools to better develop for go
go get -u github.com/golang/lint/golint
now you can build the package by using make build
for gRPC, you need to follow the following steps
get gRPC codebase
go get -u google.golang.org/grpc
install protobuf
brew install protobuf
install the protoc plugin for go
go get -u github.com/golang/protobuf/{proto,protoc-gen-go}
install the protoc plugin for orion
go get -u github.com/carousell/Orion/protoc-gen-orion
just run ./create.sh <service-name>
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.