Security News
Supply Chain Attack Detected in Solana's web3.js Library
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
express-chocolatey-server
Advanced tools
A simple Chocolatey package server for Express.
Designed to host packages for https://github.com/shaka-project/shaka-lab
If you need to serve Chocolatey packages, and the other options look too complicated, this is the server for you.
It doesn't require Windows, it doesn't require .NET, it can be deployed anywhere you can use Express, and it can be integrated into other Express-based servers. It is not a full nuget v2 API implementation, nor a full odata implementation. Rather, it implements the bare minimum to interact with the Chocolatey client.
You can use the standalone server CLI to serve the packages themselves as well as their metadata. Or, if you want to host the package files separately, you can use the module as a library and provide the package metadata.
If you want to host the actual package files in the same server, this is the easiest way to use express-chocolatey-server. You can use our standalone server CLI, and provide paths to all the packages you want to serve.
PORT=8000 npx express-chocolatey-server *.nupkg
Start by placing your nupkg files, package.json (see below), and app.yaml (also below) in a folder.
package.json:
{
"dependencies": {
"express-chocolatey-server": "^1.0.0"
},
"scripts": {
"start": "express-chocolatey-server *.nupkg"
},
"engines": {
"node": "16.x.x"
}
}
app.yaml:
runtime: nodejs16
handlers:
- url: /.*
secure: always
redirect_http_response_code: 301
script: auto
Then deploy to App Engine with:
gcloud app deploy app.yaml --project=MY_PROJECT_ID_GOES_HERE
The client needs to add your server as a new "source". Each source has a name. If you want your source to be named "my-awesome-packages" and your server is running at "http://10.0.0.2:8000/", you would configure your choco clients with:
choco source add -n=my-awesome-packages -s=http://10.0.0.2:8000/
The library provides two methods:
function readPackageMetadata(path)
: Reads a single nupkg file and returns
metadata extracted from it.
async function configureRoutes(app, prefix, packageMetadataList)
: Sets up
Express routes for a Chocolatey server under the given prefix, and serves
metadata for the packages listed.
If you want to host the packages separately from the Express server, you will want to pre-computing the package metadata, rather than maintaining it by hand.
// This is an example script for pre-computing package metadata and hosting
// packages on another server.
const chocolateyServer = require('express-chocolatey-server');
(async () => {
// Load metadata about chocolatey packages given on the command-line.
const packagePaths = process.argv.slice(2);
const packageMetadataList = await Promise.all(packagePaths.map((path) => {
return chocolateyServer.readPackageMetadata(path);
}));
// YOU NEED TO CUSTOMIZE THIS PART.
// In each package entry, add a `url` field with the download URL.
// Save this JSON to a file to be loaded in the server later.
console.log(JSON.stringify(packageMetadataList));
});
// This is an example server using pre-computed metadata, with packages hosted
// on another server.
const express = require('express');
const chocolateyServer = require('express-chocolatey-server');
const app = express();
const port = process.env['PORT'] || 8000;
(async () => {
// Load pre-computed package metadata in JSON.
// These entries MUST have a `url` field.
const packageMetadataList = require('package-metadata.json');
// Configure chocolatey server routes at the root ('/').
// You could also use any other route prefix you like.
await chocolateyServer.configureRoutes(app, '/', packageMetadataList);
// Start the server.
app.listen(port, () => {
console.log(`Listening on port ${port}`)
});
})();
FAQs
Simple Chocolatey package server for Express
The npm package express-chocolatey-server receives a total of 5 weekly downloads. As such, express-chocolatey-server popularity was classified as not popular.
We found that express-chocolatey-server demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.