
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
install-artifact-from-github
Advanced tools
Create binary artifacts hosted by github and install from them without compiling.
This is a no-dependency micro helper for developers of binary addons for Node. It is a companion project for save-artifact-to-github. These two projects are integrated with GitHub facilities and solve two problems:
save-artifact-to-github
saves a binary artifact according to the platform, architecture, and Node ABI.install-artifact-from-github
retrieves such artifact, tests if it works properly, and rebuilds a project from sources in the case of failure.In general, it can save your users from a long recompilation and, in some cases, even save them from installing build tools. By using GitHub facilities (Releases and Actions) the whole process of publishing and subsequent installations are secure, transparent, painless, inexpensive, or even free for public repositories.
Installation:
npm install --save install-artifact-from-github
In your package.json
(pseudo-code with comments):
{
// your custom package.json stuff
// ...
"scripts": {
// your scripts go here
// ...
// creates an artifact (from save-artifact-to-github)
"save-to-github": "save-to-github --artifact build/Release/ABC.node",
// installs using pre-created artifacts
"install": "install-from-cache --artifact build/Release/ABC.node",
// used by "install" to test the artifact
"verify-build": "node scripts/verify-build.js"
// used by "install" to rebuild from sources
"rebuild": "node-gyp rebuild"
}
}
When a project, which uses install-artifact-from-github
, is being installed, it does the following actions:
DEVELOPMENT_SKIP_GETTING_ASSET
set to a non-empty value ⇒ it builds from sources..development
is present in the project folder ⇒ it builds from sources.brotli
, if it is available. If it succeeds ⇒ it checks if it works.gzip
. If it succeeds ⇒ it checks if it works.npm run verify-build
. You may provide the script verify-build
to do the checking.
verify-build
, it tries npm test
.
npm run rebuild
, which should be provided.DEVELOPMENT_SKIP_GETTING_ASSET
— if it is set to a non-empty value, it forces the build from sources.
It is useful for development and testing.DEVELOPMENT_SHOW_VERIFICATION_RESULTS
— if it is non-empty, it shows the verification output.
Otherwise, the output is suppressed so not to scary unsuspecting users with possible errors.
It is useful for development and testing.DOWNLOAD_HOST
— if set, its value is used instead of https://github.com
.This script is meant to be run using npm run
. It relies on
npm environment variables to learn about the project.
--artifact path
— points where to place the downloaded artifact. It is a required parameter.--prefix prefix
— provides a prefix for the generated artifact name. Default: ''
.--suffix suffix
— provides a suffix for the generated artifact name. Default: ''
.--host host
— provides a prefix for the download host. It should not end with /
.
Example: --host https://sample.com/repo
.
--host-var ENVVAR
— provides a name of an environment variable, which value will specify the download host.
Example: --host-var RE2_DOWNLOAD_MIRROR
.
--host
is not specified.DOWNLOAD_HOST
name is assumed.https://github.com
will be used.Ultimately, the downloadable file name has the following format:
`${host}/${user}/${repo}/releases/download/${tag}/${prefix}${platform}-${arch}-${abi}${suffix}.${compression}`
Where:
platform
is process.platform.
arch
is process.arch.abi
is process.versions.modules.compression
can be br
or gz
.Example with default values: https://github.com/uhop/node-re2/releases/download/1.15.2/linux-x64-83.br
.
The additional documentation is available in the wiki.
The realistic complex example can be found in uhop/node-re2:
save-to-github
here from a separate project, reduced 3rd-party dependencies.yarn
-specific bug.FAQs
Create binary artifacts hosted by github and install them without compiling.
The npm package install-artifact-from-github receives a total of 632,860 weekly downloads. As such, install-artifact-from-github popularity was classified as popular.
We found that install-artifact-from-github demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.