Product
Socket Now Supports uv.lock Files
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
@balena/contrato
Advanced tools
The official contract implementation
The official contracts implementation
import { Contract } from 'contrato';
const osContract = new Contract({
type: 'sw.os',
slug: 'balenaos',
version: '6.1.2',
children: [
{ type: 'sw.service', slug: 'balena-engine', version: '20.10.43' },
{ type: 'sw.service', slug: 'NetworkManager', version: '0.6.0' },
],
provides: [{ type: 'sw.feature', slug: 'secureboot' }],
});
const serviceContract = new Contract({
type: 'sw.application',
slug: 'myapp',
requires: [
{ type: 'sw.service', slug: 'balena-engine', version: '>20' },
{ type: 'sw.feature', slug: 'secureboot' },
],
});
if (osContract.satisfiesChildContract(serviceContract)) {
console.log('myapp can be installed!');
}
Is a specification for describing things. A thing can be pretty much anything, a software library, a feature, an API, etc. Relationships between things can be established via composition and referencing (requires
and provides
). Through this library, contracts can be validated, composed and combined.
balena.io is a complex product with a great number of inter-conecting components. Each of the components have their own requisites, capabilities, and incompatibilities. Contracts are an effort to formally document those interfaces, and a foundation on which we can build advanced tooling to ultimately automate the process of the team, increase productivity, and remove the human element from tasks that can be performed better by a machine.
The concept of contracts is generic enough that it can be applied to seemingly unrelated scenarios, from base images and OS images, to device types and backend components. Re-using the same contract "format" between them allows us to multiply the gains we get by developing complex contract-related programming modules.
Describe a thing via a contract
{
"type": "sw.library",
"slug": "glibc",
"version": "2.40",
"assets": {
"license": {
"name": "GNU Lesser General Public License",
"url": "https://www.gnu.org/licenses/lgpl-3.0.html#license-text"
}
}
}
Describe a thing that requires a thing
{
"type": "sw.utility",
"slug": "curl",
"version": "8.11.1",
"requires": [{ "type": "sw.library", "slug": "glibc", "version": ">=2.17" }],
"data": {
"protocols": ["HTTP", "HTTPS", "FTP"]
}
}
Describe a complex thing via a composite contract
{
"type": "sw.os",
"slug": "balenaos",
"version": "4.1.5",
"children": [
{
"type": "sw.library",
"slug": "glibc",
"version": "2.16",
"assets": {
"license": {
"name": "GNU Lesser General Public License",
"url": "https://www.gnu.org/licenses/lgpl-3.0.html#license-text"
}
}
}
]
}
Validate requirements of a contract via contrato
import { Contract } from 'contrato';
const osContract = new Contract({
type: 'sw.os',
slug: 'balenaos',
version: '4.1.5',
children: [
{
type: 'sw.library',
slug: 'glibc',
version: '2.16',
},
],
});
const curlContract = new Contract({
type: 'sw.utility',
slug: 'curl',
version: '8.11.1',
requires: [{ type: 'sw.library', slug: 'glibc', version: '>=2.17' }],
});
if (osContract.satisfiesChildContract(curlContract)) {
console.log('cURL requirements are met and it can be installed!');
} else {
// cannot install cURL, missing requirements: { type: 'sw.library', slug: 'glibc', version: '>=2.17' }
console.log(
'cannot install cURL, missing requirements: ',
osContract.getNotSatisfiedChildRequirements(curlContract),
);
}
Describe a universe of things
import { Contract, Universe } from 'contrato';
const universe = new Universe();
universe.addChildren([
new Contract({ type: 'sw.os', slug: 'debian' }),
new Contract({ type: 'sw.os', slug: 'fedora' }),
new Contract({
type: 'arch.sw',
slug: 'armv7hf',
requires: [{ type: 'hw.device-type', data: { arch: 'armv7hf' } }],
}),
new Contract({
type: 'arch.sw',
slug: 'amd64',
requires: [{ type: 'hw.device-type', data: { arch: 'amd64' } }],
}),
new Contract({
type: 'hw.device-type',
slug: 'raspberrypi3',
data: { arch: 'armv7hf' /* ... */ },
}),
new Contract({
type: 'hw.device-type',
slug: 'intel-nuc',
data: { arch: 'amd64' /* ... */ },
}),
]);
Generate combinations of things with a Blueprint
import { Contract, Universe, Blueprint } from 'contrato';
const universe = new Universe();
universe.addChildren([
/* ... */
]);
const blueprint = new Blueprint(
{ 'hw.device-type': 1, 'arch.sw': 1, 'sw.os': 1 },
{ type: 'meta.context' },
);
// Generate contexts with valid combinations of the given types
const contexts = blueprint.reproduce(universe);
Build templates using the metadata from a combination
import { Contract, Universe, Blueprint, buildTemplate } from 'contrato';
/* ... */
// Generate contexts with valid combinations of the given types
const contexts = blueprint.reproduce(universe);
const template = ```
Welcome to {{this.sw.os.slug}}OS for {{this.hw.device-type.slug}}!
This build supports the architecture {{this.arch.sw.slug}}
```;
for (const context of contexts) {
// Welcome to OS fedoraOS for intel-nuc
// ...
console.log(buildTemplate(template, context));
}
See contracts specification for additional documentation on the contract format.
Run the test
npm script:
npm test
Before submitting a PR, please make sure that you include tests, and that the linter runs without any warning:
npm run lint
If you're having any problem, please raise an issue on GitHub.
The project is licensed under the Apache 2.0 license.
FAQs
The official contract implementation
The npm package @balena/contrato receives a total of 908 weekly downloads. As such, @balena/contrato popularity was classified as not popular.
We found that @balena/contrato demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.