
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
pgbuild contains a library named PhoneGapBuild that lets you manage your phonegap builds at build.phonegap.com without using the website. It also contains a executable called pgbuild that makes you of the PhoneGapBuild library to provide a command line interface.
PhoneGapBuild uses the PhoneGap Build API. It can create, update and delete git based and file based applications. It can also create and delete Android and iOS keys for code signing (other platforms are not supported).
You need to manually create a build.phonegap.com account through the website. pgbuild will prompt you for the username and password on first usage. This information is cached in plain text at $HOME/.pgbuild. Future usages will automatically pick up the username and password from this file.
The output of pgbuild help is below:
Usage: node pgbuild.js [cmd] [cmd options]
Manage apps and download builds from build.phonegap.com.
cmd is one of the following:
App management
create <gitrepo>|<file> - creates an app
delete <appid> - deletes app with id appid
download <appid> [platform] - download existing build
help - shows this help
rebuild appid [platforms] - rebuild for specified platforms
list - list existing apps
buildstatus <appid> - display build status of app
update <appid> <gitrepo>|<file>- update existing app. gitrepo requires manual 'rebuild'.
Key management
createkey android <title> <keystorefile> <keystore pass> <alias> <key pass> - create key
createkey ios <title> <p12 certificate> <mobileprovision> <cert pass>
deletekey <platform> <id> - delete key
listkeys - list all keys
setkey <appid> <platform> <keyid> - set key for an app
Creating an app based on a git repo.
$ pgbuild create git://git.forwardbias.in/html5/flyingthings.git
Created app with id 238137
$ pgbuild list
id: 238137 Flying Things 1.0.0
repo: git://git.forwardbias.in/html5/flyingthings.git
visibility:private
build status:
complete: symbian, android, webos, winphone
errored: ios
pending: blackberry
$ pgbuild download 238137 android
Downloading to
/home/girishra/git.forwardbias.in/pgbuild/FlyingThings-debug.apk
.......................
$ pgbuild update 238137 ~/git.forwardbias.in/flyingthings.zip
$ pgbuild download 238137 android
Downloading to
/home/girishra/git.forwardbias.in/pgbuild/FlyingThings-debug.apk
..............
$ pgbuild remove 238137
Read lib/phonegapbuild.js to see the API.
Install using npm install pgbuild. It doesn't have any other
dependencies. It is known to work on Mac, Windows and Linux.
PhoneGapBuild has no built-in support for working with proxies. Currently, the best way to make pgbuild work with proxies (HTTP CONNECT or SOCKS) is to use something like proxychains.
FAQs
A tool and library to automate PhoneGap Builds (http://build.phonegap.com/api)
We found that pgbuild demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.