Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Cement is an advanced Application Framework for Python, with a primary focus on Command Line Interfaces (CLI). Its goal is to introduce a standard, and feature-full platform for both simple and complex command line applications as well as support rapid development needs without sacrificing quality. Cement is flexible, and it's use cases span from the simplicity of a micro-framework to the complexity of a mega-framework. Whether it's a single file script, or a multi-tier application, Cement is the foundation you've been looking for.
The first commit to Git was on Dec 4, 2009. Since then, the framework has seen several iterations in design, and has continued to grow and improve since it's inception. Cement is the most stable, and complete framework for command line and backend application development.
pip install cement
Optional CLI Extras (for development):
pip install cement[cli]
Cement core features include (but are not limited to):
pytest
, coverage
)ruff
)mypy
)sphinx
)Some extensions that are shipped with the mainline Cement source do require external dependencies. It is the responsibility of the application developer to include these dependencies along with their application, as Cement explicitly does not include them. Dependencies can be installed via each extensions optional package (ex: cement[colorlog]
, cement[redis]
, etc).
See: https://docs.builtoncement.com/extensions
The Cement CLI Application Framework is Open Source and is distributed under the BSD License (three clause). Please see the LICENSE file included with this software.
This project includes a Docker Compose configuration that sets up all required services, and dependencies for development and testing. This is the recommended path for local development, and is the only fully supported option.
The following creates all required docker containers, and launches an BASH shell within the cement
dev container for development.
$ make dev
|> cement <| src #
The above is the equivalent of running:
$ docker compose up -d
$ docker compose exec cement /bin/bash
All execution is done inside the docker containers.
Testing Alternative Versions of Python
The latest stable version of Python 3 is the default, and target version accessible as the cement
container within Docker Compose. For testing against alternative versions of python, additional containers are created (ex: cement-py38
, cement-py39
, etc). You can access these containers via:
$ docker-compose ps
Name Command State Ports
-------------------------------------------------------------------------
cement_cement-py38_1 /bin/bash Up
cement_cement-py39_1 /bin/bash Up
cement_cement-py310_1 /bin/bash Up
cement_cement-py311_1 /bin/bash Up
cement_cement-py312_1 /bin/bash Up
cement_cement_1 /bin/bash Up
cement_memcached_1 docker-entrypoint.sh memcached Up 11211/tcp
cement_redis_1 docker-entrypoint.sh redis ... Up 6379/tcp
$ docker-compose exec cement-py39 /bin/bash
|> cement-py39 <| src #
Windows development and support is not 100% complete. Applications Built on Cement is known to run and work on Windows well, however it is not a primary target for development and as such the setup is not as streamlined and currently has several known issues.
If you are developing on Windows, the recommended path is still Docker. However if you are specifically targeting development for Windows you will want to run Python/Cement natively which will require setting up a development environment on the Windows host.
This is very rough (future doc coming), however the following will be required:
Assuming Python/PIP are installed, the following will install PDM:
pip install pipx
pipx install pdm
C++ Build Tools are install, the following will create a development virtual env:
pdm venv create
pdm install --without memcached
You can then run the core tests:
pdm run pytest --cov=cement.core tests/core
Note that only the core library is fully tested on Windows.
Please explore the Makefile for helpers that may or may not work. Example, the following will run the same as the above pdm run pytest
command:
make test-core
And, you can run Cement CLI via:
pdm run cement --help
Similar to the above... if you are developing on macOS, the recommended path is still Docker. However if you are specifically targeting development for macOS you will want to run Python/Cement natively which will require setting up a development environment on the macOS host.
This is less nuanced than Windows, however still required some dependencies that will not be fully covered here (example: memcached). The following will get you setup to run the core library tests.
pip install pipx
pipx install pdm
pdm venv create
pdm install --without memcached
make test-core
And, you can run Cement CLI via:
pdm run cement --help
Cement has a strict policy that all code and tests meet PEP8 guidelines, therefore ruff
is called before any unit tests run. All code submissions require 100% test coverage and PEP8 compliance:
Execute the following to run all compliance and unit tests:
$ make test
A coverage report is printed to console, as well as the HTML version created in coverage-report
:
$ open coverage-report/index.html
See Makefile
for all other common development actions.
FAQs
Application Framework for Python
We found that cement demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.