
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
This command line utility is useful for providing interface for deploying to various providers (currently only supports Zeit.co's Now).
$ yarn global add launchkit
$ npm i -g launchkit
$ launchkit -h
Intended usage is to create a launchkit.yml
in the root of your
project's repository using the syntax described below and encrypt using
a secret stored in .key
file.
Your secret token phrase
default:
deployer: now
options:
alias: dev.example.com
token: [your Now API token]
vars:
NODE_ENV: development
production:
options:
alias: example.com
This encrypts the file so you can keep it in version
control like .git repository and keep different configurations
for different branches/features you work on. The only thing
you then need to share with your team is the .key
file.
$ launchkit encrypt launchkit.yml
$ launchkit update production options.vars.NODE_ENV=production
$ launchkit view
default:
deployer: now
options:
alias: dev.example.com
token: [your Now API token]
vars:
NODE_ENV: development
production:
options:
alias: example.com
vars:
NODE_ENV: production
// The general schema of the file should look like this
// Note that any config is deeply merged with "default" if present
MainConfig {
[envName]: EnvConfig,
default: EnvConfig,
}
// Individual configs for each branch
EnvConfig {
deployer: string,
protected: boolean,
options: DeployerOptions,
}
DeployerOptions {
// ...any data that the provider might need to deploy
}
// Only the "now" provider is currently supported:
NowDeployerOptions {
token: string
// Aliasing pattern using Mustache, see example below. Can also be a list
// of strings if you need to alias to multiple URLs.
alias: string
vars: {
[TARGET_ENV_VAR]: ""
}
}
You can include environment variables in the configuration (options.alias and options.vars) using handlebars. This feature is currently only available for the Now deployer.
default:
deployer: now
options:
alias: '{{PROJECT_REPONAME}}-{{BRANCH}}.example.com'
token: XxMTU7FBlszCFkMnzsAGhnho
vars:
CAREERS_SITE: 'https://careers-site-dev.example.com'
DATA_SERVICE: 'https://data-service-dev.example.com'
PUBLIC_API: 'https://public-api-{{ENVIRONMENT}}.example.com'
dev:
options:
alias: '{{PROJECT_REPONAME}}-dev.example.com'
vars:
CAREERS_SITE: 'https://careers-site.example.com'
DATA_SERVICE: 'https://data-service.example.com'
PUBLIC_API: 'https://public-api.example.com'
SUPER_SECRET_TOKEN: beep
production:
options:
alias:
- 'www.example.com'
- 'example.com'
vars:
CAREERS_SITE: 'https://careers-site.example.com'
DATA_SERVICE: 'https://data-service.example.com'
PUBLIC_API: 'https://public-api.example.com'
SUPER_SECRET_TOKEN: foo
FAQs
Deploy with ease
The npm package launchkit receives a total of 9 weekly downloads. As such, launchkit popularity was classified as not popular.
We found that launchkit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.