![Maven Central Adds Sigstore Signature Validation](https://cdn.sanity.io/images/cgdhsj6q/production/7da3bc8a946cfb5df15d7fcf49767faedc72b483-1024x1024.webp?w=400&fit=max&auto=format)
Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
github.com/containous/yaegi
Yaegi is Another Elegant Go Interpreter. It powers executable Go scripts and plugins, in embedded interpreters or interactive shells, on top of the Go runtime.
New()
, Eval()
, Use()
unsafe
and syscall
packages neither used nor exported by defaultimport "github.com/traefik/yaegi/interp"
go install github.com/traefik/yaegi/cmd/yaegi@latest
Note that you can use rlwrap (install with your favorite package manager),
and alias the yaegi
command in alias yaegi='rlwrap yaegi'
in your ~/.bashrc
, to have history and command line edition.
curl -sfL https://raw.githubusercontent.com/traefik/yaegi/master/install.sh | bash -s -- -b $GOPATH/bin v0.9.0
Create an interpreter with New()
, run Go code with Eval()
:
package main
import (
"github.com/traefik/yaegi/interp"
"github.com/traefik/yaegi/stdlib"
)
func main() {
i := interp.New(interp.Options{})
i.Use(stdlib.Symbols)
_, err := i.Eval(`import "fmt"`)
if err != nil {
panic(err)
}
_, err = i.Eval(`fmt.Println("Hello Yaegi")`)
if err != nil {
panic(err)
}
}
The following program is compiled ahead of time, except bar()
which is interpreted, with the following steps:
i.Eval(src)
to evaluate the script in the context of interpreterv, err := i.Eval("foo.Bar")
to get the symbol from the interpreter context, as a reflect.Value
Interface()
method and type assertion to convert v
into bar
, as if it was compiledpackage main
import "github.com/traefik/yaegi/interp"
const src = `package foo
func Bar(s string) string { return s + "-Foo" }`
func main() {
i := interp.New(interp.Options{})
_, err := i.Eval(src)
if err != nil {
panic(err)
}
v, err := i.Eval("foo.Bar")
if err != nil {
panic(err)
}
bar := v.Interface().(func(string) string)
r := bar("Kung")
println(r)
}
The Yaegi command can run an interactive Read-Eval-Print-Loop:
$ yaegi
> 1 + 2
3
> import "fmt"
> fmt.Println("Hello World")
Hello World
>
Note that in interactive mode, all stdlib package are pre-imported, you can use them directly:
$ yaegi
> reflect.TypeOf(time.Date)
: func(int, time.Month, int, int, int, int, int, *time.Location) time.Time
>
Or interpret Go packages, directories or files, including itself:
$ yaegi -syscall -unsafe -unrestricted github.com/traefik/yaegi/cmd/yaegi
>
Or for Go scripting in the shebang line:
$ cat /tmp/test
#!/usr/bin/env yaegi
package main
import "fmt"
func main() {
fmt.Println("test")
}
$ ls -la /tmp/test
-rwxr-xr-x 1 dow184 dow184 93 Jan 6 13:38 /tmp/test
$ /tmp/test
test
Documentation about Yaegi commands and libraries can be found at usual godoc.org.
Beside the known bugs which are supposed to be fixed in the short term, there are some limitations not planned to be addressed soon:
.s
) are not supported.reflect
and printing values using %T may give different results between compiled mode and interpreted mode.Go modules are not supported yet. Until that, it is necessary to install the source into $GOPATH/src/github.com/traefik/yaegi
to pass all the tests.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.