Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
With djangorecipe you can manage your django site in a way that is familiar to buildout users. For example:
bin/django
to run django instead of bin/python manage.py
.
bin/test
to run tests instead of bin/python manage.py test yourproject
.
(Including running coverage "around" your test).
bin/django
automatically uses the right django settings. So you can have
a development.cfg
buildout config and a production.cfg
, each telling
djangorecipe to use a different django settings module. bin/django
will
use the right setting automatically, no need to set an environment variable.
Djangorecipe is developed on github at https://github.com/rvanlaar/djangorecipe, you can submit bug reports there. It is tested with travis-ci and the code quality is checked via landscape.io:
.. image:: https://secure.travis-ci.org/rvanlaar/djangorecipe.png?branch=master :target: http://travis-ci.org/rvanlaar/djangorecipe/
.. image:: https://landscape.io/github/rvanlaar/djangorecipe/master/landscape.svg?style=flat :target: https://landscape.io/github/rvanlaar/djangorecipe/master :alt: Code Health
You can see an example of how to use the recipe below with some of the most common settings::
[buildout]
show-picked-versions = true
parts =
django
eggs =
yourproject
gunicorn
develop = .
# ^^^ Assumption: the current directory is where you develop 'yourproject'.
versions = versions
[versions]
Django = 1.8.2
gunicorn = 19.3.0
[django]
recipe = djangorecipe
settings = development
eggs = ${buildout:eggs}
project = yourproject
test = yourproject
scripts-with-settings = gunicorn
# ^^^ This line generates a bin/gunicorn-with-settings script with
# the correct django environment settings variable already set.
Earlier versions of djangorecipe used to create a project structure for you,
if you wanted it to. Django itself generates good project structures now. Just
run bin/django startproject <projectname>
. The main directory created is
the one where you should place your buildout and probably a setup.py
.
Startproject creates a manage.py
script for you. You can remove it, as the
bin/django
script that djangorecipe creates is the (almost exact)
replacement for it.
See django's documentation for startproject <https://docs.djangoproject.com/en/1.8/ref/django-admin/#django-admin-startproject>
_.
You can also look at cookiecutter <https://cookiecutter.readthedocs.org/>
_.
The recipe supports the following options.
project This option sets the name for your project.
settings
You can set the name of the settings file which is to be used with
this option. This is useful if you want to have a different
production setup from your development setup. It defaults to
development
.
test If you want a script in the bin folder to run all the tests for a specific set of apps this is the option you would use. Set this to the list of app labels which you want to be tested. Normally, it is recommended that you use this option and set it to your project's name.
scripts-with-settings
Script names you add to here (like 'gunicorn') get a duplicate script
created with '-with-settings' after it (so:
bin/gunicorn-with-settings
). They get the settings environment variable
set. At the moment, it is mostly useful for gunicorn, which cannot be run
from within the django process anymore. So the script must already be passed
the correct settings environment variable.
Note: the package the script is in must be in the "eggs" option of your part. So if you use gunicorn, add it there (or add it as a dependency of your project).
eggs
Like most buildout recipes, you can/must pass the eggs (=python packages)
you want to be available here. Often you'll have a list in the
[buildout]
part and re-use it here by saying ${buildout:eggs}
.
coverage
If you set coverage = true
, bin/test
will start coverage recording
before django starts. The coverage
library must be importable. See the
extra coverage notes further below.
The options below are for older projects or special cases mostly:
dotted-settings-path
Use this option to specify a custom settings path to be used. By default,
the project
and settings
option values are concatenated, so for
instance myproject.development
. dotted-settings-path = somewhere.else.production
allows you to customize it.
extra-paths
All paths specified here will be used to extend the default Python
path for the bin/*
scripts. Use this if you have code somewhere without a
proper setup.py
.
control-script
The name of the script created in the bin folder. This script is the
equivalent of the manage.py
Django normally creates. By default it
uses the name of the section (the part between the [ ]
). Traditionally,
the part is called [django]
.
initialization
Specify some Python initialization code to be inserted into the
control-script
. This functionality is very limited. In particular, be
aware that leading whitespace is stripped from the code given.
wsgi
An extra script is generated in the bin folder when this is set to
true
. This is mostly only useful when deploying with apache's
mod_wsgi. The name of the script is the same as the control script, but with
.wsgi
appended. So often it will be bin/django.wsgi
.
wsgi-script Use this option if you need to overwrite the name of the script above.
deploy_script_extra
In the wsgi
deployment script, you sometimes need to wrap the application
in a custom wrapper for some cloud providers. This setting allows extra
content to be appended to the end of the wsgi script. For instance
application = some_extra_wrapper(application)
. The limits described
above for initialization
also apply here.
testrunner
This is the name of the testrunner which will be created. It
defaults to test
.
Starting in django 1.7, you cannot use a custom test runner (like django-nose)
anymore to automatically run your tests with coverage enabled. The new app
initialization mechanism already loads your models.py
, for instance,
before the test runner gets called. So your models.py
shows up as largely
untested.
With coverage = true
, bin/test
starts coverage recording before django
gets called. It also prints out a report and export xml results (for recording
test results in Jenkins, for instance) and html results.
Behind the scenes, true
is translated to a default of report xml_report html_report
. These space-separated function names are called in turn on the
coverage instance. See the coverage API docs <http://coverage.readthedocs.io/en/latest/api.html>
_ for the available
functions. If you only want a quick report and xml output, you can set
coverage = report xml_report
instead.
Note that you cannot pass options to these functions, like html output
location. For that, add a .coveragerc
next to your buildout.cfg
. See
the coverage configuration file docs <http://coverage.readthedocs.io/en/latest/config.html>
_. Here is an example::
[run]
omit =
*/migrations/*
*settings.py
source = your_app
[report]
show_missing = true
[html]
directory = htmlcov
[xml]
output = coverage.xml
If you want to deploy a project using mod_wsgi you could use this example as a starting point::
<Directory /path/to/buildout>
Order deny,allow
Allow from all
</Directory>
<VirtualHost 1.2.3.4:80>
ServerName my.rocking.server
CustomLog /var/log/apache2/my.rocking.server/access.log combined
ErrorLog /var/log/apache2/my.rocking.server/error.log
WSGIScriptAlias / /path/to/buildout/bin/django.wsgi
</VirtualHost>
Corner case: there is a problem when several wsgi scripts are combined in a
single virtual host instance of Apache. This is due to the fact that Django
uses the environment variable DJANGO_SETTINGS_MODULE. This variable gets set
once when the first wsgi script loads. The rest of the wsgi scripts will fail,
because they need a different settings modules. However the environment
variable DJANGO_SETTINGS_MODULE is only set once. The new initialization
option that has been added to djangorecipe can be used to remedy this problem
as shown below::
[django]
settings = acceptance
initialization =
import os
os.environ['DJANGO_SETTINGS_MODULE'] = '${django:project}.${django:settings}'
Running Django with auto-reload in PyDev requires adding a small snippet of code::
import pydevd pydevd.patch_django_autoreload(patch_remote_debugger=False, patch_show_console=True)
just before the if __name__ == "__main__":
in the manage.py
module (or in
this case the control script, normally bin/django
, that is generated). The
following example buildout generates two control scripts: one for command-line
usage and one for PyDev, with the required snippet, using the recipe's
initialization
option::
[buildout]
parts = django pydev
eggs =
mock
[django]
recipe = djangorecipe
eggs = ${buildout:eggs}
project = dummyshop
[pydev]
<= django
initialization =
import pydevd
pydevd.patch_django_autoreload(patch_remote_debugger=False, patch_show_console=True)
django-configurations (http://django-configurations.readthedocs.org/en/latest/)
is an application that helps you organize your Django settings into classes.
Using it requires modifying the manage.py file. This is done easily using the
recipe's initialization
option::
[buildout]
parts = django
eggs =
hashlib
[django]
recipe = djangorecipe
eggs = ${buildout:eggs}
project = myproject
initialization =
# Patch the manage file for django-configurations
import os
os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'myproject.settings')
os.environ.setdefault('DJANGO_CONFIGURATION', 'Development')
from configurations.management import execute_from_command_line
import django
django.core.management.execute_from_command_line = execute_from_command_line
bin/test
was missing quotes around an option. [reinout]Added optional coverage
option. Set it to true
to automatically run
coverage around your django tests. Needed if you used to have a test runner
like django-nose run your coverage automatically. Since django 1.7, this
doesn't work anymore. With the new "coverage" option, bin/test
does it
for you. [reinout]
Automated tests (travis-ci.org) test with django 1.4, 1.8 and 1.9 now. And pypi, python 2.7 and python 3.4. [reinout]
script-with-settings
instead of scripts-with-settings
(note the missing s
after
script
). The correct one is script-with-settings
.
[tzicatl]script-entrypoints
entry point finding now actually works.Renamed script-entrypoints
option to scripts-with-settings
. It
accepts script names that would otherwise get generated (like gunicorn
)
and generates a duplicate script named like bin/gunicorn-with-settings
.
Technical note: this depends on the scripts being setuptools "console_script entrypoint" scripts.
Removed project generation. Previously, djangorecipe would generate a
directory for you from a template, but Django's own template is more than
good enough now. Especially: it generates a subdirectory for your project
now. Just run bin/django startproject <projectname>
.
See django's documentation for startproject <https://docs.djangoproject.com/en/1.8/ref/django-admin/#django-admin-startproject>
_.
You can also look at cookiecutter <https://cookiecutter.readthedocs.org/>
_.
This also means the projectegg
option is now deprecated, it isn't needed
anymore.
We aim at django 1.7 and 1.8 now. Django 1.4 still works, (except that that one doesn't have a good startproject command).
Gunicorn doesn't come with the django manage.py integration, so bin/django run_gunicorn
doesn't work anymore. If you add script-entrypoints = gunicorn
to the configuration, we generate a bin/django_env_gunicorn
script that is identical to bin/gunicorn
, only with the environment
correctly set. Note: renamed in 2.1 to scripts-with-settings
.
This way, you can use the wsgi.py script in your project (copy it from the
django docs if needed) with bin/django_env_gunicorn yourproject/wsgi.py
just like suggested everywhere. This way you can adjust your wsgi file to
your liking and run it with gunicorn.
For other wsgi runners (or programs you want to use with the correct
environment set), you can add a full entry point to script-entrypoints
,
like script-entrypoints = gunicorn=gunicorn.app.wsgiapp:run
would be the
full line for gunicorn. Look up the correct entrypoint in the relevant
package's setup.py
.
Django's 1.8 wsgi.py
file looks like this, see https://docs.djangoproject.com/en/1.8/howto/deployment/wsgi/::
import os
from django.core.wsgi import get_wsgi_application
os.environ.setdefault("DJANGO_SETTINGS_MODULE", "yourproject.settings")
application = get_wsgi_application()
The wsgilog
option has been deprecated, the old apache mod_wsgi script
hasn't been used for a long time.
Removed old pth option, previously used for pinax. Pinax uses proper python packages since a long time, so it isn't needed anymore.
dotted-settings-path
options was only used in management script. Now
it is also used for the generated wsgi file and the test scripts.Added dotted-settings-path
option. Useful when you want to specify a
custom settings path to be used by the manage.main()
command.
Renamed deploy_script_extra
(with underscores) to
deploy-script-extra
(with dashes) for consistency with the other
options. If the underscore version is found, an exception is raised.
bin/test
now passes along command line arguments to the underlying
management command. Previously, only the equivalent of manage.py test list_of_apps
would be done. Now command line arguments are passed as-is
after the list of apps.
Added deploy_script_extra
option. It is appended to the wsgi script.
Useful for instance for a cloud hoster where you need to wrap your wsgi
application object in a custom call.
Djangorecipe works with django 1.6 now.
Tested with Django 1.4, 1.5 and 1.6. Pre-1.4 support is gone, now. Also tested on Python 2.6/2.7, 3.2/3.3.
Moved to buildout 2 support only.
Removed generation of fastcgi script. You can run it easily as bin/django runfcgi
and it will be deprecated in Django 1.7 anyway.
Removed deprecation warning in Django 1.4. Fixes #49, thanks Shagi.
Added documentation for use with mr.developer. Thanks shagi (closes issue #45)
Added Travis support.
*.rst
files due to a recent txt-to-rst
rename action).Djangorecipe now depends on Django. The use of the version =
statement
is deprecated. Specify the django version in the
[versions]
section. Install django via mr.developer if you need to use
an svn/git/hg repository. For other uses
Versionpin djangorecipe to 0.23.1 if you don't want to upgrade.
Thanks to Reinout van Rees for help with this release.
Removed subversion and download support.
Added support for svn urls with spaces. Thanks to Brad103 (fixes #537718).
Updated code and buildout to use newest zc.recipe.egg, zc.recipe.testrunner and python-dateutil.
The admin url is now configured for django 1.1 or higher. Thanks to Sam Charrington (fixes #672220).
Bootstrap.py updated (fixes #501954).
The recipe know makes the django
package know to setuptools during install.
This closes #397864. Thanks to Daniel Bruce and Dan Fairs for the patch.
Fixed #451065 which fixes a problem with the WSGI log file option.
Added the posibilty to configure more FCGI related settings. Thanks to Vasily Sulatskov for the patch.
The generated WSGI & FCGI scripts are now properly removed when options change (fixes #328182). Thanks to Horst Gutmann for the patch.
Scripts are now updated when dependencies change. This fixes #44658, thanks to Paul Carduner for the patch.
When running again with non-newest set the recipe will no longer update the Subversion checkout. Thanks to vinilios for the patch.
The WSGI and FCGI scripts are now generated using Buildout's own system. This makes them more similar to the generated manage script with regard to the setup of paths. Thanks to Jannis Leidel for the patch.
Paths from eggs and extra-paths now get precedence over the default system path (fixes #370420). Thanks to Horst Gutmann for the patch.
The generated WSGI script now uses the python
option if
present. This fixes #361695.
Fixed a problem with the new WSGI logging option #348797. Thanks to Bertrand Mathieu for the patch.
Disable generation of the WSGI log if "wsgilog" isn't set, thanks to Jacob Kaplan-Moss for the patch.
Updated buildout.cfg and .bzrignore, thanks Jacob Kaplan-Moss.
The recipe now supports creating a FCGI script. Thanks to Jannis Leidel for the patch.
When downloading a Django recipe for the first time the recipe now properly reports the url it is downloading from.
Specifying a user name within a subversion url now works. The code that determined the revision has been updated. This fixes issue #274004. Thanks to Remco for the patch.
Updated the template for creating new projects. It now uses the
current admin system when generating it's urls.py
file. This fixes
issue #276255. Thanks to Roland for the patch.
The recipe no longer executes subversion to determine whether the versions is to be downloaded using subversion. This fixes issue #271145. Thanks to Kapil Thangavelu for the patch.
Changed the pythonpath
option to extra-paths
. This makes the
recipe more consistent with other recipes (see issue #270908).
Another go at fixing the updating problem (#250811) by making sure the update method is always called. It would not be called in the previous version since the recipe wrote a random secret (if it wasn't specified) to the options for use with a template. Buildout saw this as a change in options and therefore always decided to un-install & install.
When both projectegg and wsgi=True are specified, the generated wsgi file did not have the correct settings file in it. This has been fixed with a patch from Dan Fairs.
The recipe now has logging. All print statements have been replaced and a few extra logging calls have been added. This makes the recipe more informative about long running tasks. Thanks erny for the patch from issue #260628.
The recipe no longer expects the top level directory name in a release tarball to be consistent with the version number. This fixes issue #260097. Thanks to erny for reporting this issue and suggesting a solution.
Revision pinns for the svn checkout now stay pinned when re-running the buildout. This fixes issue #250811. Thanks to Remco for reporting this.
Added an option to specify an egg to use as the project. This disables the code which creates the basic project structure. Thanks to Dan Fairs for the patch from issue #252647.
The settings option is fixed so that it supports arbitrary depth
settings paths (example; conf.customer.development
).
The version argument now excepts a full svn url as well. You can use this to get a branch or fix any url to a specific revision with the standard svn @ syntax
The wsgi script is no longer made executable and readable only by the user who ran buildout. This avoids problems with deployment.
FAQs
Buildout recipe for Django
We found that djangorecipe demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.