
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
Serve up git repositories over http and accept git pushes.
This library makes it super easy to set up custom git push deploy logic.

var pushover = require('pushover');
var repos = pushover('/tmp/repos');
repos.on('push', function (push) {
console.log('push ' + push.repo + '/' + push.commit
+ ' (' + push.branch + ')'
);
push.accept();
});
repos.on('fetch', function (fetch) {
console.log('fetch ' + fetch.commit);
fetch.accept();
});
var http = require('http');
var server = http.createServer(function (req, res) {
repos.handle(req, res);
});
server.listen(7000);
then start up the pushover server...
$ node example/simple.js
meanwhile...
$ git push http://localhost:7000/beep master
Counting objects: 356, done.
Delta compression using up to 2 threads.
Compressing objects: 100% (133/133), done.
Writing objects: 100% (356/356), 46.20 KiB, done.
Total 356 (delta 210), reused 355 (delta 210)
To http://localhost:7000/beep
* [new branch] master -> master
and then...
$ node example/simple.js
push beep.git/d5013a53a0e139804e729a12107fc212f11e64c3 (master)
or...
$ git clone http://localhost:7000/beep.git
and then...
fetch beep.git/d5013a53a0e139804e729a12107fc212f11e64c3
var pushover = require('pushover')
Create a new repository collection from the directory repoDir.
repoDir should be entirely empty except for git repo directories.
If repoDir is a function, repoDir(repo) will be used to dynamically resolve
project directories. The return value of repoDir(repo) should be a string path
specifying where to put the string repo. Make sure to return the same value
for repo every time since repoDir(repo) will be called multiple times.
The return value, repos is an EventEmitter that emits the events listed below
in the events section.
By default, repository targets will be created if they don't exist. You can
disable that behavior with opts.autoCreate.
If opts.checkout is true, create and expected checked-out repos instead of
bare repos.
Handle incoming HTTP requests with a connect-style middleware.
Everything is admin-party by default. Check the credentials further up the stack using basic auth or whatevs.
Create a new bare repository repoName in the instance repository directory.
Optionally get a callback cb(err) to be notified when the repository was
created.
Create a subdirectory dir in the repo dir with an errback cb(err).
Get a list of all the repositories in the callback cb(err, repos).
Find out whether repoName exists in the callback cb(exists).
Emitted when somebody does a git push to the repo.
Exactly one listener must call push.accept() or push.reject(). If there are
no listeners, push.accept() is called automatically.
push is an http duplex object (see below) with these extra properties:
Emitted when somebody does a git push --tags to the repo.
Exactly one listener must call tag.accept() or tag.reject(). If there are
no listeners, tag.accept() is called automatically.
tag is an http duplex object (see below) with these extra properties:
Emitted when somebody does a git fetch to the repo (which happens whenever you
do a git pull or a git clone).
Exactly one listener must call fetch.accept() or fetch.reject(). If there are
no listeners, fetch.accept() is called automatically.
fetch is an http duplex objects (see below) with these extra properties:
Emitted when the repo is queried for info before doing other commands.
Exactly one listener must call info.accept() or info.reject(). If there are
no listeners, info.accept() is called automatically.
info is an http duplex object (see below) with these extra properties:
Emitted when the repo is queried for HEAD before doing other commands.
Exactly one listener must call head.accept() or head.reject(). If there are
no listeners, head.accept() is called automatically.
head is an http duplex object (see below) with these extra properties:
Emitted when pushover creates a resposne stream that will be sent to the git client on the other end.
This should really only be used if you want to send verbose or error messages to the remote git client.
response is a writable stream that can accept buffers containing git packfile sidechannel transfer protocol encoded strings. done is a callback that must be called when you want to end the response.
If you create a response listener then you must either call the done function or execute the following end sequence when you want to end the response:
response.queue(new Buffer('0000'))
response.queue(null)
If you never use the response event then the above data will be sent by default. Binding a listener to the response event will prevent the end sequence those from being sent, so you must send them yourself after sending any other messages.
The arguments to each of the events 'push', 'fetch', 'info', and 'head'
are http duplex that act as both http
server request and http server response objects so you can pipe to and from them.
For every event if there are no listeners dup.accept() will be called
automatically.
Accept the pending request.
Reject the pending request.
With npm do:
npm install pushover
MIT
Reading through grack was super handy.
FAQs
git push deploy server over http
The npm package pushover receives a total of 130 weekly downloads. As such, pushover popularity was classified as not popular.
We found that pushover demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.