Security News
PyPI’s New Archival Feature Closes a Major Security Gap
PyPI now allows maintainers to archive projects, improving security and helping users make informed decisions about their dependencies.
@darkobits/chex
Advanced tools
If you use Execa in your application to integrate with other executables, this tool provides a way to:
$ npm install @darkobits/chex
Chex exports an async function that accepts a string. That string may be an executable name, or an executable name and valid semver range. If a name alone is provided, Chex makes sure the executable is installed. If a semver range is provided along with a name, Chex ensures that the version of the executable satisfies that semver range. Chex then returns an Execa decorator bound to the provided executable.
Let's imagine we are writing a tool that is going to make several calls to the git
CLI, and we know
that we need Git version 2.0.0 or greater. We want to make this assertion as early as possible in our
program so we can present the user with a meaningful error before we try to use an unsupported Git
feature. Let's see how we can accomplish this with Chex:
import chex from '@darkobits/chex';
// Assume this is our program's entrypoint.
export default async function main() {
const git = await chex('git >=2.0.0');
// Now, we can use this value just like Execa:
const status = await git(['rev-parse', 'HEAD']);
// If you prefer the string form, you can use that as well. Execa's
// .command() variant is just an overload with Chex:
const sha = await git('status');
// Execa options are passed-though to Execa:
const pushResult = await git('push origin master', { stdio: 'inherit' });
// You can also do all of the above synchronously:
const pullResult = git.sync('pull');
}
Need to integrate with several other tools? You can get fancy:
import chex from '@darkobits/chex';
// Assume this is our program's entrypoint.
export default async function main() {
const dependencies = ['git >=2.0.0', 'docker', 'python'];
// This will throw if any of the above aren't installed or the version isn't satisfied.
const [git, docker, python] = await Promise.all(dependencies.map(chex));
// ... do awesome things!
}
But wait, there's more!
Chex will also attach version
and rawVersion
properties to the value it returns, which you can use
for debugging/reporting:
import chex from '@darkobits/chex';
export default async function main() {
const docker = await chex('docker >=19');
console.log(docker.version);
//=> '19.3.4'
console.log(docker.rawVersion);
//=> 'Docker version 19.03.4, build 9013bf5'
}
Chex is available in asynchronous and synchronous modes. This package's default export is the
asynchronous function. The synchronous function is available at the .sync
property.
interface Chex {
(executableExpression: string, execaOpts?: execa.Options): Promise<ExecaWrapper>;
sync(executableExpression: string, execaOpts?: execa.SyncOptions): ExecaWrapper;
}
Note: Execa options provided to chex
or chex.sync
will be used to configure the call to locate
the executable. Calls to the executable itself may be configured by providing an Execa options object to
the wrapper returned by Chex.
ExecaWrapper
is a function with the following signature and properties:
interface ExecaWrapper {
/**
* Call the bound executable via Execa asynchronously.
*/
(commandOrArgs: string | Array<string>, execaOpts?: ExecaOptions): ExecaChildProcess;
/**
* Call the bound executable via Execa synchronously.
*/
sync(commandOrArgs: string | Array<string>, execaOpts?: ExecaOptions): ExecaSyncReturnValue;
/**
* Parsed/cleaned semver version of the executable.
*/
version: string;
/**
* Raw version descriptor reported by the executable.
*/
rawVersion: string;
}
Note: Both the synchronous and asynchronous versions of Chex return the same Execa wrapper, which itself has synchronous and asynchronous modes. It is therefore possible to mix and match these call types to fit your application's needs.
Some tools make the process of determining their version exceedingly difficult. If Chex is unable to determine the version of an executable and you provided a semver range, Chex will throw an error because it is unable to guarantee that the version of the executable satisfies your criteria. For these executables, you can omit a version criteria and Chex will still throw if the executable is not found.
FAQs
Check that an executable is installed and verify its version.
The npm package @darkobits/chex receives a total of 11 weekly downloads. As such, @darkobits/chex popularity was classified as not popular.
We found that @darkobits/chex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI now allows maintainers to archive projects, improving security and helping users make informed decisions about their dependencies.
Research
Security News
Malicious npm package postcss-optimizer delivers BeaverTail malware, targeting developer systems; similarities to past campaigns suggest a North Korean connection.
Security News
CISA's KEV data is now on GitHub, offering easier access, API integration, commit history tracking, and automated updates for security teams and researchers.