Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This package provides a asyncio client interface to query Trino a distributed SQL engine. It supports Python 3.7, 3.8, 3.9, 3.10, 3.11, 3.12.
$ pip install aiotrino
Use the DBAPI interface to query Trino:
import aiotrino
conn = aiotrino.dbapi.connect(
host='localhost',
port=8080,
user='the-user',
catalog='the-catalog',
schema='the-schema',
)
cur = await conn.cursor()
await cur.execute('SELECT * FROM system.runtime.nodes')
rows = await cur.fetchall()
await conn.close()
Or with context manager
import aiotrino
async with aiotrino.dbapi.connect(
host='localhost',
port=8080,
user='the-user',
catalog='the-catalog',
schema='the-schema',
) as conn:
cur = await conn.cursor()
await cur.execute('SELECT * FROM system.runtime.nodes')
rows = await cur.fetchall()
This will query the system.runtime.nodes
system tables that shows the nodes
in the Trino cluster.
The DBAPI implementation in aiotrino.dbapi
provides methods to retrieve fewer
rows for example Cursorfetchone()
or Cursor.fetchmany()
. By default
Cursor.fetchmany()
fetches one row. Please set
trino.dbapi.Cursor.arraysize
accordingly.
For backwards compatibility with PrestoSQL, override the headers at the start of your application
import aiotrino
aiotrino.constants.HEADERS = aiotrino.constants.PrestoHeaders
The BasicAuthentication
class can be used to connect to a LDAP-configured Trino
cluster:
import aiotrino
conn = aiotrino.dbapi.connect(
host='coordinator url',
port=8443,
user='the-user',
catalog='the-catalog',
schema='the-schema',
http_scheme='https',
auth=aiotrino.auth.BasicAuthentication("principal id", "password"),
)
cur = await conn.cursor()
await cur.execute('SELECT * FROM system.runtime.nodes')
rows = await cur.fetchall()
await conn.close()
The JWTAuthentication
class can be used to connect to a configured Trino cluster:
import aiotrino
conn = aiotrino.dbapi.connect(
host='coordinator url',
port=8443,
catalog='the-catalog',
schema='the-schema',
http_scheme='https',
auth=aiotrino.auth.JWTAuthentication(token="jwt-token"),
)
cur = await conn.cursor()
await cur.execute('SELECT * FROM system.runtime.nodes')
rows = await cur.fetchall()
await conn.close()
The client runs by default in autocommit mode. To enable transactions, set
isolation_level to a value different than IsolationLevel.AUTOCOMMIT
:
import aiotrino
from aiotrino import transaction
async with aiotrino.dbapi.connect(
host='localhost',
port=8080,
user='the-user',
catalog='the-catalog',
schema='the-schema',
isolation_level=transaction.IsolationLevel.REPEATABLE_READ,
) as conn:
cur = await conn.cursor()
await cur.execute('INSERT INTO sometable VALUES (1, 2, 3)')
await cur.fetchone()
await cur.execute('INSERT INTO sometable VALUES (4, 5, 6)')
await cur.fetchone()
The transaction is created when the first SQL statement is executed.
trino.dbapi.Connection.commit()
will be automatically called when the code
exits the with context and the queries succeed, otherwise
`trino.dbapi.Connection.rollback()' will be called.
Start by forking the repository and then modify the code in your fork.
Clone the repository and go inside the code directory. Then you can get the
version with ./setup.py --version
.
We recommend that you use virtualenv
for development:
$ virtualenv .venv
$ . .venv/bin/activate
# TODO add requirements.txt: pip install -r requirements.txt
$ pip install .
For development purpose, pip can reference the code you are modifying in a virtualenv:
$ pip install -e .[tests]
That way, you do not need to run pip install
again to make your changes
applied to the virtualenv.
When the code is ready, submit a Pull Request.
There is a helper scripts, run
, that provides commands to run tests.
Type ./run tests
to run both unit and integration tests.
aiotrino
uses pytest for its tests. To run
only unit tests, type:
$ pytest tests
Then you can pass options like --pdb
or anything supported by pytest --help
.
To run the tests with different versions of Python in managed virtualenvs,
use tox
(see the configuration in tox.ini
):
$ tox
To run integration tests:
$ pytest integration_tests
They pull a Docker image and then run a container with a Trino server:
trinodb/trino:${TRINO_VERSION}
aiotrino-python-client-tests-{uuid4()[:7]}
Supported OS Ubuntu 22.04
Install pyenv
curl https://pyenv.run | bash
Install required python versions
# Install the latest of all supported versions
pyenv install 3.7, 3.8, 3.9, 3.10, 3.11, 3.12
Set the installed versions as default for the shell. This allows tox
to find them.
List installed versions and update the following command as needed.
pyenv versions
pyenv shell 3.12.1 3.11.3 3.10.11 3.9.16 3.8.16 3.7.16
Install tox
pip install tox
Run tox
tox
aiotrino/__init__.py
.git tag -m '' current_version
). .venv/bin/activate &&
pip install twine wheel setuptools &&
rm -rf dist/ &&
./setup.py sdist bdist_wheel &&
twine upload dist/* &&
open https://pypi.org/project/aiotrino/ &&
echo "Released!"
git push upstream master current_version
)Feel free to create an issue as it make your request visible to other users and contributors.
If an interactive discussion would be better or if you just want to hangout and chat about the Trino Python client, you can join us on the #python-client channel on Trino Slack.
FAQs
ASyncIO Client for the Trino distributed SQL Engine
We found that aiotrino demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.