Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
@ibm-functions/composer
Advanced tools
Composer is an IBM Cloud Functions programming model for composing individual functions into larger applications.
Composer is a new programming model from IBM Research for composing IBM Cloud Functions, built on Apache OpenWhisk. With Composer, developers can build even more serverless applications including using it for IoT, with workflow orchestration, conversation services, and devops automation, to name a few examples.
Programming compositions for IBM Cloud Functions is supported by a new developer tool called IBM Cloud Shell, or just Shell. Shell offers a CLI and graphical interface for fast, incremental, iterative, and local development of serverless applications. While we recommend using Shell, Shell is not required to work with compositions. Compositions may be managed using a combination of the Composer compose command (for deployment) and the OpenWhisk CLI (for configuration, invocation, and life-cycle management).
In contrast to earlier releases of Composer, a Redis server is not required to run compositions. Composer now synthesizes OpenWhisk conductor actions to implement compositions. Compositions have all the attributes and capabilities of an action (e.g., default parameters, limits, blocking invocation, web export).
This repository includes:
Composer and Shell are currently available as IBM Research previews. As Composer and Shell continue to evolve, it may be necessary to redeploy existing compositions to take advantage of new capabilities. However existing compositions should continue to run fine without redeployment.
Composer is distributed as Node.js package. To install this package, use the Node Package Manager:
npm -g install @ibm-functions/composer
We recommend to install the package globally (with -g
option) if you intend to
use the compose
command to define and deploy compositions. Use a local install
(without -g
option) if you intend to use node
instead. The two installations
can coexist. Shell embeds the Composer package, so there is no need to install
Composer explicitly when using Shell.
A composition is typically defined by means of a Javascript expression as illustrated in samples/demo.js:
composer.if(
composer.action('authenticate', { action: function ({ password }) { return { value: password === 'abc123' } } }),
composer.action('success', { action: function () { return { message: 'success' } } }),
composer.action('failure', { action: function () { return { message: 'failure' } } }))
Compositions compose actions using combinator methods. These methods
implement the typical control-flow constructs of a sequential imperative
programming language. This example composition composes three actions named
authenticate
, success
, and failure
using the composer.if
combinator,
which implements the usual conditional construct. It take three actions (or
compositions) as parameters. It invokes the first one and, depending on the
result of this invocation, invokes either the second or third action.
This composition includes the definitions of the three composed actions. If the actions are defined and deployed elsewhere, the composition code can be shorten to:
composer.if('authenticate', 'success', 'failure')
One way to deploy a composition is to use the compose command:
compose demo.js --deploy demo
ok: created actions /_/authenticate,/_/success,/_/failure,/_/demo
The compose
command synthesizes and deploys an action named demo
that
implements the composition. It also deploys the composed actions if definitions
are provided for them.
The demo
composition may be invoked like any action, for instance using the
OpenWhisk CLI:
wsk action invoke demo -p password passw0rd
ok: invoked /_/demo with id 4f91f9ed0d874aaa91f9ed0d87baaa07
The result of this invocation is the result of the last action in the
composition, in this case the failure
action since the password in incorrect:
wsk activation result 4f91f9ed0d874aaa91f9ed0d87baaa07
{
"message": "failure"
}
This invocation creates a trace, i.e., a series of activation records:
wsk activation list
activations
fd89b99a90a1462a89b99a90a1d62a8e demo
eaec119273d94087ac119273d90087d0 failure
3624ad829d4044afa4ad829d40e4af60 demo
a1f58ade9b1e4c26b58ade9b1e4c2614 authenticate
3624ad829d4044afa4ad829d40e4af60 demo
4f91f9ed0d874aaa91f9ed0d87baaa07 demo
The entry with the earliest start time (4f91f9ed0d874aaa91f9ed0d87baaa07
)
summarizes the invocation of the composition while other entries record later
activations caused by the composition invocation. There is one entry for each
invocation of a composed action (a1f58ade9b1e4c26b58ade9b1e4c2614
and
eaec119273d94087ac119273d90087d0
). The remaining entries record the beginning
and end of the composition as well as the transitions between the composed
actions.
Compositions are implemented by means of OpenWhisk conductor actions. The documentation of conductor actions explains execution traces in greater details.
We are looking forward to your feedback and criticism. We encourage you to join us on slack. File bugs and we will squash them.
We welcome contributions to Composer and Shell. See CONTRIBUTING.md.
FAQs
Composer is a new programming model for composing cloud functions built on Apache OpenWhisk.
We found that @ibm-functions/composer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.