Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
🧹 GitLabracadabra 🧙
:alembic: Adds some magic to GitLab :crystal_ball:
GitLab'racadabra is a GitOps way to configure a GitLab instance from a YAML configuration, using the API.
It is able to create GitLab's groups, projects, users and application settings.
:thumbsup: It's also able to mirror :
mirrors
parameter in Mirroring repositories.image_mirrors
parameter. See Mirroring container images.package_mirrors
parameter. See Mirroring packages.It is based on Python GitLab.
Debian package is available from artifacts and can be installed with:
apt install gitlabracadabra_*.deb
gitlabracadabra --verbose --dry-run
Note: Debian 11 bullseye or later is required.
pip install gitlabracadabra
There are also Docker/OCI images.
Example usage:
sudo docker run -ti \
-v "$HOME/.python-gitlab.cfg:/home/gitlabracadabra/.python-gitlab.cfg:ro" \
-v "$PWD/gitlabracadabra.yml:/app/gitlabracadabra.yml:ro" \
'registry.gitlab.com/gitlabracadabra/gitlabracadabra:v2.5.1' \
--verbose --dry-run
Other images are available. Examples:
registry.gitlab.com/gitlabracadabra/gitlabracadabra/main
: Current main
registry.gitlab.com/gitlabracadabra/gitlabracadabra/main:b1cd3482bf9583c5db863c359e12cafcdb7119bf
: A specific commit of main
Local installation (in $HOME/.local
):
# On Debian or Ubuntu
sudo apt install -y --no-install-recommends \
python3-build \
python3-github \
python3-gitlab \
python3-html5lib \
python3-jsonschema \
python3-packaging \
python3-pygit2 \
python3-semantic-version \
python3-vcr \
python3-venv \
python3-yaml \
python3-pip \
python3-coverage \
python3-pytest
# On Alpine
sudo apk add \
py3-build \
py3-pygithub \
py3-requests-toolbelt \
py3-html5lib \
py3-jsonschema \
py3-packaging \
py3-pygit2 \
py3-semantic-version \
py3-vcrpy \
py3-yaml \
py3-pip \
py3-coverage \
py3-pytest
# On others
pip install build
# Build and install
python3 -m build
version="$(grep __version__ gitlabracadabra/__init__.py | awk -F "'" '{print $2}')"
pip install --user "dist/gitlabracadabra-$version"*.whl
# Test
pytest-3 # or pytest
~/.local/bin/gitlabracadabra --verbose --dry-run
GitLabracadabra uses the same configuration file as Python GitLab CLI to store connection parameters.
Example ~/.python-gitlab.cfg
:
[global]
default = gitlab
[gitlab]
url = https://gitlab.com
private_token = T0K3N
More information in Python GitLab documentation.
Alternatively, you can use the following environment variables:
GITLAB_URL
: GitLab URLGITLAB_PRIVATE_TOKEN
or GITLAB_OAUTH_TOKEN
: authenticationGITLAB_TLS_VERIFY
: either true
or false
, or a CA path. Ignored when emty.GitLabracadabra actions are configured with a YAML file.
See GitLabracadabra's own action file or read:
Since job token probably won't have enough permissions, you'll need to use a personal access token:
GITLAB_PRIVATE_TOKEN
protected variablepython-gitlab
. Example .gitlab-ci.yml
:default:
image:
name: 'registry.gitlab.com/gitlabracadabra/gitlabracadabra:v2.5.1'
entrypoint: [""]
before_script:
- |
cat << EOF > ~/.python-gitlab.cfg
[global]
default = gitlab
[gitlab]
url = ${CI_SERVER_URL:-https://gitlab.com}
private_token = ${GITLAB_PRIVATE_TOKEN}
# job_token = ${GITLAB_JOB_TOKEN}
EOF
stages:
- test
- deploy
test:
stage: test
script:
- gitlabracadabra --verbose --dry-run
rules:
- if: '$CI_COMMIT_BRANCH != "main"'
apply:
stage: deploy
script:
- gitlabracadabra --verbose
rules:
- if: '$CI_COMMIT_BRANCH == "main"'
File bugs and feature requests in GitLab issues. Security issues should be marked as confidential.
Propose documentation or code improvements in GitLab merge requests.
This repository enforces commit message convention, to check this locally install the commitlint hook:
npm install @commitlint/{config-conventional,cli}
echo 'npx commitlint --edit' >> .git/hooks/commit-msg
chmod +x .git/hooks/commit-msg
See also:
FAQs
Adds some magic to GitLab
We found that gitlabracadabra demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.