Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This folder contains the necessary scripts to generate the ArmoniK.Api Python package. Please note that while the package generation is platform dependent, the generated package should be compatible with Linux and Windows.
At each release, we provide a prepackaged version of ArmoniK.Api available on PyPI here : https://pypi.org/project/armonik. To install the package to your current Python environment, you can use pip :
pip install armonik
Requirements :
If the python command doesn't link to python3 on your system, you may be able to install the package python-is-python3, which links python to python3.
To generate the package from sources, run the proto2python.sh script from its folder. You need to specify a directory where the virtual environment used for the build will be located. For example the following command will generate the packages and will create the build environment "pyvenv" in the current user's home directory:
./proto2python.sh ~/pyvenv
3 folders will be created :
Instead of running the script you can install the armonik package in "editable" mode, allowing you to make changes to the source code, and the changes will be reflected immediately without reinstalling the package.
pip install -e ./packages/python
From this directory, use the following command:
pip install pkg/armonik*.whl
The generated package will be installed to your current python environment
Coming soon
Before running tests, ensure the following setup steps are completed:
sudo apt install dotnet-sdk-6.0 jq
Verify that port 5000 is available (Armonik and the mock server communicate on the same port, uninstall armonik if necessary):
lsof -i :5000
cd packages/csharp/ArmoniK.Api.Mock
dotnet run
The test environment utilizes a mock endpoint to assert if the ArmoniK service has been triggered. It leverages the requests library to query the /calls.json endpoint, examining the JSON response to validate the count of remote procedure calls made to specific services and methods
curl localhost:5000/calls.json | jq
In prevision of the API test, run the following command:
curl localhost:5000/calls.json | jq '.Tasks'
You should have as output:
{
"GetTask": 0,
"ListTasks": 0,
"GetResultIds": 0,
"CancelTasks": 0,
"CountTasksByStatus": 0,
"ListTasksDetailed": 0,
"SubmitTasks": 0
}
Once the endpoint runs, you can initiate a gRPC channel to it with a Python client.
Below is an example using a Tasks client and calling the list_tasks
method:
import grpc
import armonik.client
with grpc.insecure_channel("localhost:5001") as channel:
tasks_client = ArmoniKTasks(channel)
tasks.client.list_tasks()
Port 5001
is actually ArmoniK's control-plane endpoint.
For the sake of simplicity, the example gRPC channel here is an insecure one. You should never do that in production environment.
Execute the Python code snippet above and re-run command:
curl localhost:5000/calls.json | jq '.Tasks'
You should have as output:
{
"GetTask": 0,
"ListTasks": 0,
"GetResultIds": 0,
"CancelTasks": 0,
"CountTasksByStatus": 0,
"ListTasksDetailed": 1,
"SubmitTasks": 0
}
You can see that attribute ListTasksDetailed
was incremented, meaning that the API effectively handled your call !
Starting from gRPC version 1.57 and onward, it is necessary to explicitly specify the default authority when creating the gRPC channel. more details
FAQs
GRPC python binding for the ArmoniK orchestrator API
We found that armonik demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.