
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
The Computer and Information Science Department at Penn is building cross-departmental monitoring tools to help with advising and student support.
Our goal is a single aggregation point for tracking student progress (and triggering alarms as appropriate) across many courses. Ultimately there will be both "pull" and "push" components (messages vs dashboard).
We pull from both the Gradescope and Canvas APIs.
This library requires a bit of setup to ensure it crawls Gradescope and Canvas appropriately.
config.yaml.default
to config.yaml
config.yaml
as follows:gradescope
/ gs_login
to the Gradescope email address of an account given instructor permission on the courses you want to monitor.gradescope
/ gs_pwd
to the password for above account.canvas
/ api_key
to the new Canvas access token you created above.site
to your Canvas host URL (e.g., https://canvas.upenn.edu
for Penn)Optionally you'll want to restrict the courses to a subset of the available ones:
canvas
/ course_ids
: a list of specific Canvas course IDs to crawl, rather than all that are currently active. Each should be on a separate line indented with a leading dashgradescope
/ semesters
: a list of the Gradescope "years" / semesters to crawlThen set up and run the environment:
python -m venv venv # Create a virtual environment
chmod +x venv/bin/activate # Make the activate script executable
source venv/bin/activate # Activate the virtual environment
pip install -r requirements.txt # Install dependencies
python collect_events.py # Run the script
After the script runs, there should be a series of files in the current directory:
gs_courses.csv
/ canvas_courses.csv
: list of courses to which we have accessgs_assignments.csv
/ canvas_assignments.csv
: list of student assignments (quizzes, exams, HWs)gs_students.csv
/ canvas_students.csv
: list of enrolled students by course_idgs_extensions.csv
/ canvas_student_summaries.csv
: list of student info including late days, extensions, etc.gs_submissions.csv
/ canvas_submissions.csv
: list of homework submissions including timestamps, whether late, etc.Alternatively, you can use the libraries directly:
import pandas as pd
from gscdash.pycanvas.pycanvas import CanvasStatus
from gscdash.pyscope.pyscope import GradescopeStatus
# Restrict to these course IDs
canvas_course_list = []
# Restrict to these semesters
gradescope_sem_list = []
canvas = CanvasStatus(canvas_url, canvas_api_key, canvas_course_list)
canvas_courses, all_students, all_assignments, all_submissions, all_student_summaries = canvas.get_course_info()
gs = GradescopeStatus(email, pwd, gradescope_sem_list)
gs_courses, gs_students, gs_assignments, gs_submissions, gs_extensions = gs.get_course_info()
We leverage and adapt the pyscope
API, which we have updated to 2023 Gradescope with extensions. Gradescope does not really have an external API, but through some clever work by prior authors, HTML crawling is used to pull the important data and wrap it in objects.
Credit: The pyscope
codebase is derived from Sagar Reddy Patil's Gradescope iCalendar Converter, sagarredypatil/gradescope-ics, which also leverages the original Gradescope codebase from Anton Pozharski, apozharski/gradescope-api. This overall package inherits the AGPL license as a result of this. However, new subsystems use the standard Apache 2 license.
Major changes:
course.get_roster()
API call.We leverage the Canvas LTI APIs from the U of Florida library. Substantial layering over these libraries has been added in the pycanvas
package, and a common API between the Canvas and Gradescope modules has been implemented as CourseApi
.
FAQs
Gradescope-Canvas Dashboard support
We found that gscdash demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.