
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
The following should be installed by apt, yum, etc., depending on your OS.
NOTE: Some distro's may have different names for these.
sudo apt-get update
sudo apt-get install -y \
build-essential \
intltool \
lftp \
librsync-dev \
libffi-dev \
libssl-dev \
openssl \
par2 \
python3-dev \
python3-pip \
python3-venv \
python3 \
rclone \
rsync \
rdiff \
tzdata
Since Python3.11 site package directories have been marked as Externally Managed and now require
using --break-system-packages
to install into them. This means that a package like duplicity with
many packages must use a virtual environment, or venv, to install their packages. Rather than going
through the manual process of producing a venv, activating it, installing duplicity, etc., we will be
using pipx
from now on to install duplicity. This way we get the same effect as a pip install, but
isolated in a venv.
To install follow instructions below. Steps (1) and (2) are important.
PyPA (Python Packaging Authority) has been making rapid changes to the way we install Python modules.
To accomodate installing new packages on older Pythons prior to 3.11, it is necessary to upgrade
packaging tools like this:
sudo python3 -m pip install --upgrade pip pipx
NOTE: Failure to upgrade will probably result in a failed install. <--IMPORTANT!
To make sure the pipx dirs are on your path do:
sudo pipx --global ensurepath # for all users
pipx ensurepath # for single user
If you have an existing duplicity on your path and it was not installed by setup.py, pip, or pipx, you must uninstall it using the same method by which it was installed.
You can tell if you have multiple instances by doing
which -a duplicity
and then use apt, yum, snap, or other command to remove them.
Chose one of the following depending on whether you want to install for all users or the current user. Use both if needed.
With --global
duplicity will be installed in /usr/local/bin/duplicity
and its many packages in /opt/pipx/venvs/duplicity
.
Without --global
duplicity will be installed in ~/.local/bin/duplicity
and its many packages in ~/.local/pipx/venvs/duplicity
.
sudo pipx --global install duplicity[==version]
pipx install duplicity[==version]
You can keep multiple versions of duplicity by supplying --suffix=version
.
sudo pipx --global install --suffix=version duplicity[==version]
pipx install --suffix=version duplicity[==version]
For more information on downloading duplicity's source code from the code repository and developing for duplicity, see README-REPO.
For source docs: http://duplicity.readthedocs.io/
For more information see the duplicity web site at:
or at:
or post to the mailing list at:
https://lists.nongnu.org/mailman/listinfo/duplicity-talk
or post a new issue at:
FAQs
Encrypted backup using rsync algorithm
We found that duplicity demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.