
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
From German "Herkunft" (origin, provenance)
Track configuration value origins and modification history through YAML parsing with modern Python best practices.
herrkunft is a standalone library extracted from esm_tools that provides transparent provenance tracking for configuration values loaded from YAML files. It tracks:
Perfect for scientific computing, workflow configuration, and any application where configuration traceability matters.
Launch interactive notebooks in your browser (no installation required):
pip install herrkunft
For development:
pip install herrkunft[dev]
from provenance import load_yaml
# Load a configuration file with provenance tracking
config = load_yaml("config.yaml", category="defaults")
# Access values normally
database_url = config["database"]["url"]
print(database_url) # postgresql://localhost/mydb
# Access provenance information
print(database_url.provenance.current.yaml_file) # config.yaml
print(database_url.provenance.current.line) # 15
print(database_url.provenance.current.column) # 8
from provenance import ProvenanceLoader
# Set up hierarchy: defaults < user < production
loader = ProvenanceLoader()
# Load multiple configs with different priorities
defaults = loader.load("defaults.yaml", category="defaults")
user_config = loader.load("user.yaml", category="user")
prod_config = loader.load("production.yaml", category="production")
# Merge with automatic conflict resolution
from provenance import HierarchyManager
hierarchy = HierarchyManager(["defaults", "user", "production"])
final_config = hierarchy.merge(defaults, user_config, prod_config)
# Production values override user values, which override defaults
# Full history is preserved in provenance
from provenance import dump_yaml
# Save configuration with provenance as inline comments
dump_yaml(config, "output.yaml", include_provenance=True)
Output:
database:
url: postgresql://localhost/mydb # config.yaml:15:8
port: 5432 # config.yaml:16:8
herrkunft is built with modern Python best practices:
herrkunft/
├── core/ # Provenance tracking and hierarchy management
├── types/ # Type wrappers (DictWithProvenance, etc.)
├── yaml/ # YAML loading and dumping
├── utils/ # Utilities for cleaning, validation, serialization
└── config/ # Library configuration and settings
Track which configuration file and parameters were used for each simulation run:
config = load_yaml("simulation.yaml")
run_simulation(config)
# Later, audit which file provided each parameter
for key, value in config.items():
print(f"{key}: {value.provenance.current.yaml_file}")
Manage development, staging, and production configs with clear conflict resolution:
loader = ProvenanceLoader()
config = loader.load_multiple([
("defaults.yaml", "defaults"),
("production.yaml", "production"),
("secrets.yaml", "secrets"), # Highest priority
])
Export complete provenance history for compliance or debugging:
from provenance import to_json
# Export config with full provenance metadata
to_json_file(config, "audit.json")
Full documentation is available at https://herrkunft.readthedocs.io
git clone https://github.com/pgierz/herrkunft.git
cd herrkunft
pip install -e .[dev]
pytest # Run all tests
pytest --cov=provenance # With coverage
pytest -v tests/test_core/ # Specific test directory
black provenance tests # Format code
ruff provenance tests # Lint
mypy provenance # Type check
Contributions are welcome! Please see CONTRIBUTING.md for guidelines.
MIT License - see LICENSE for details.
Extracted from the esm_tools project, which provides workflow management for Earth System Models. The provenance tracking feature was originally developed to track configuration origins in complex HPC simulation workflows.
If you use herrkunft in your research, please cite:
@software{herrkunft2024,
title = {herrkunft: Configuration Provenance Tracking for Python},
author = {Gierz, Paul and Andrés-Martínez, Miguel},
year = {2024},
url = {https://github.com/pgierz/herrkunft}
}
FAQs
Track configuration value origins and modification history through YAML parsing
We found that herrkunft demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.