Security News
Supply Chain Attack Detected in @solana/web3.js Library
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
package.json
workflow for native development with Reason/OCaml.
This README serves as a development documentation for esy. For user documentation refer to esy.sh documentation site.
The following snippet lists esy repository structured (omitting irrelevant or obvious items) with further explanations:
├── CHANGELOG.md
├── LICENSE
├── README.md
│
├── Makefile
│ Common tasks and workflows for esy development.
│
├── bin
│
├── docs
│ esy end user documentation in markdown format.
│
├── dune
├── dune-project
│
├── esy
│ This dune library implements sandbox builder - a routine which builds
│ the enture dependency graph and provides other introspection APIs.
│
├── esy/bin
│ This dune executable implements "esy" command.
│
├── esy-solve
│ This dune library implements solver.
│
├── esy-install
│ This dune library implements installer.
│
├── esy-build-package
│ This dune library implements package builder. esy library uses this to
│ build each package.
│
├── esy-build-package/bin
│ This dune executable implements "esy-build-package" command.
│
├── esy-installer
│ Implementation of installation procedure defined with *.install files.
│ This re-implements opam-installer.
│
├── esy-command-expression
│ Parser for #{...} syntax used in esy manifests.
│
├── esy-shell-expansion
│ A simple shell expansion.
│
├── esy-yarn-lockfile
│ Parser for a subset of yarn lockfile format.
│
├── esy-lib
│ A collection of utility modules shared between other libraries.
│
├── site
│ Sources for https://esy.sh
│
├── esy.lock
├── package.json
│
├── scripts
│
├── test
│ Unit tests.
│
├── test-e2e-slow
│ End-to-end test suite which takes a significiant amount of time.
│ We execute it on CI by placing `@slowtest` token in commit messages.
│
└── test-e2e
End-to-end test suite.
To make changes to esy
and test them locally:
% git clone git://github.com/esy/esy.git
% cd esy
% esy
% esy bootstrap
Unit tests:
% esy test:unit
E2E tests:
% esy test:e2e
There are two branches:
master
— the active development, we cut new versions out of there regularly.0.0.x
— maintainance branch for 0.0.x releases.0.2.x
— maintainance branch for 0.2.x releases.0.3.x
— maintainance branch for 0.3.x releases.To make changes to esy.sh:
% make site-bootstrap
% make site-start
% make site-publish
Issues are tracked at esy/esy.
esy is released on npm.
Because esy is written in OCaml/Reason and compiled into a native executable we need to acquire a set of prebuilt binaries for each supported platform (Windows, macOS and Linux). We employ CI servers (thanks Azure) to build platform specific releases.
The release workflow is the following:
Ensure you are on master
branch and assuming you want to release the
version currently defined in package.json
(see step 6.), run
% make release-tag
% git push && git push --tags
Wait till CI finishes its task and release @esy-nightly/esy
package.
You can test it manually.
Run
% make release-prepare
which downloads the nightly corresponding to the current commit working
directory is at and "promotes" it to a release. It will create
_release/package
directory.
Ensure release inside _release/package
directory is ok.
You can cd _release/package && npm pack && npm install -g ./esy-*.tgz
to test how
release installs and feels.
Run
% make release-publish
to upload the release on npm.
Use
% make NPM_RELEASE_TAG=next release-publish
To publish release under next
tag (so users won't get it automatically but
only explicitly requested).
Bump version in package.json
to the next patch version.
We expect next version to be patch version most of the time. In case you want to release new minor or major version you need to bump it before the reelase.
FAQs
Package builder for esy.
The npm package esy receives a total of 494 weekly downloads. As such, esy popularity was classified as not popular.
We found that esy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.