Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Command line interface (CLI) and software development kit (SDK) to interact with Gable API
gable
is Gable on the command line. It publishes contracts, registers data assets and more.
gable --help
Usage: gable [OPTIONS] COMMAND [ARGS]...
Options:
--endpoint TEXT Customer API endpoint for Gable, in the format
https://api.company.gable.ai/
--api-key TEXT API Key for Gable
--version Show the version and exit.
--help Show this message and exit.
Commands:
auth View configured Gable authentication information
contract Validate/publish contracts and check data asset compliance
data-asset Commands for data assets
ping Pings the Gable API to check for connectivity
gable
is hosted on PyPi, so to install it just run:
pip install gable
Gable's CLI allows you to introspect your database and register tables as data assets within Gable's system. Connecting to these databases require additional packages to communicate with your database(s) of choice.
For MySQL, install the additional packages by running:
pip install 'gable[mysql]'
For PostgreSQL, install the additional packages by running:
pip install 'gable[postgres]'
To install all additional dependencies at once, you can run:
pip install 'gable[all]'
The Gable CLI supports shell autocomplete for zsh
and bash
so you can hit TAB
to see available commands and options as you write the command.
To enable it, run the following commands:
_SHELL=zsh # or bash
GABLE_CONFIG_DIR=~/.config/gable
mkdir -p $GABLE_CONFIG_DIR
_GABLE_COMPLETE=${_SHELL}_source gable > $GABLE_CONFIG_DIR/complete.sh
Then add the following to your shell startup scripts (e.g. .zshrc
, .bashrc
):
source ~/.config/gable/complete.sh
To establish an authenticated connection with Gable via the CLI, you need:
In order to find your API key and API endpoint, see the documentation in your Gable web app at (/docs/settings/api_keys
).
There are two supported methods for providing this config to the CLI:
You have the option to pass the endpoint and API key information directly as arguments during the CLI invocation. For example:
gable --endpoint "https://api.yourorganization.gable.ai" --api-key "yourapikey" ping
To avoid providing this config every time you execute a command, you can set them as environment variables: GABLE_API_ENDPOINT
and GABLE_API_KEY
. To make them persistent in your environment, add this to your shell initialization file (e.g. .zshrc
or .bashrc
):
export GABLE_API_ENDPOINT="https://api.yourorganization.gable.ai"
export GABLE_API_KEY="yourapikey"
Then, you can simply use the CLI as follows:
gable ping
Full releases should be published in an automated way by the github deployment pipelines. In the event we want to quickly deploy a pre-release to a customer:
pyproject.toml
file by appending a a0
or b0
(for alpha or beta), so for example 0.3.0a0
. The number afterwards can be incremented as needed if you need to publish a new version of the pre-release (a1
, a2
, etc).API KEY
from the PyPi Gable Login+API Key login in the Engineering
1password vault.TWINE_PASSWORD="the value you got from 1password!!!" poetry run poe publish_pypi_pre
PRE-RELEASE
.pyproject.toml
. On merging the automation will fail (gracefully) due to the specified version already existing in pypiFAQs
Command line interface (CLI) and software development kit (SDK) to interact with Gable API
We found that gable demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.