
Research
/Security News
Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages
Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers
Pytest fixtures to dynamically create GIT repositories for testing.
Update setup.py to include:
from distutils.core import setup
setup(
tests_require=["pytest-git-fixtures"]
)
All fixtures should be automatically included via the pytest11 entry point.
import logging
import subprocess
from pytest_git_fixtures import GITRepo # Optional, for typing
LOGGER = logging.getLogger(__name__)
def test_sanity_check(git_repo: GITRepo):
environment = {
"GNUPGHOME": git_repo.gnupg_keypair.gnupg_home,
"HOME": str(git_repo.homedir),
}
completed_process = subprocess.run(
["git", "log", "--show-signature"],
capture_output=True,
check=True,
cwd=str(git_repo.clone_work_tree),
env=environment,
)
stdout = completed_process.stdout.decode("utf-8")
LOGGER.debug(stdout)
assert "Good signature from" in stdout
assert git_repo.commit_message in stdout
completed_process = subprocess.run(
["git", "log", "--show-signature"],
capture_output=True,
check=True,
cwd=str(git_repo.work_tree),
env={**environment, **{"GIT_DIR": str(git_repo.upstream)}},
)
stdout = completed_process.stdout.decode("utf-8")
LOGGER.debug(stdout)
assert "Good signature from" in stdout
assert git_repo.commit_message in stdout
$ pip install pytest_git_fixtures
$ git clone https://github.com/crashvb/pytest-git-fixtures
$ cd pytest-git-fixtures
$ virtualenv env
$ source env/bin/activate
$ python -m pip install --editable .[dev]
Provides the path to a templated GIT configuration file that is used to initialize the repository. If a user-defined script (tests/gitconfig) can be located, it is used. Otherwise, an embedded configuration template is copied to temporary location and returned. This fixture is used by the git_repo fixture.
TheGIT_USER_EMAIL
, GIT_USER_NAME
, and GIT_SIGNINGKEY
variables will be populated within the template during generation of the repository.
Provides the commit message of the initial commit to the repository. This fixture is used by the git_repo fixture.
Provides the path to a GIT initialization script that is used to create repository structure. If a user-defined script (tests/git-init.sh) can be located, it is used. Otherwise, an embedded script is copied to temporary location and returned. This fixture is used by the git_repo fixture.
The GIT_COMMIT_MESSAGE
, GIT_INITIAL_BRANCH_NAME
, GIT_PATH_CLONE
, GIT_PATH_FORK
, GIT_PATH_UPSTREAM
, GIT_PATH_WORK_TREE
, GIT_REMOTE_NAME_FORK
, GIT_REMOTE_NAME_UPSTREAM
, GIT_TEST_FILENAME
, GIT_WORK_TREE_BRANCH_NAME
, GNUPGHOME
, GNUPG_PASSPHRASE
, and HOME
environment variables will be populated during invocation of the script.
Provides the name of the initial branch to use. This fixture is used by the git_repo fixture.
Provides the name of the remote used to reference the fork repository. This fixture is used by the git_repo fixture.
Provides the name of the remote used to reference the upstream repository. This fixture is used by the git_repo fixture.
Initializes a temporary GIT repository with a bare upstream, fork, and separate work tree.
The following fields are defined in the tuple provided by this fixture:
Typing is provided by pytest_git_fixtures.GITRepo
.
Provides the name of the test file committed into the repository. This fixture is used by the git_repo fixture.
Provides the name of the branch used to create the git work tree. This fixture is used by the git_repo fixture.
gpg-wrapper
script that can be used in conjunction with the git gpg.program
configuration value as follows:import subprocess
from pytest_git_fixtures import GITRepo # Optional, for typing
def test_something_with_gnupg(git_repo: GITRepo):
subprocess.run(
[
"git",
"-c",
f"gpg.program={git_repo.gnupg_keypair.gnupg_home}/gpg-wrapper",
"commit",
"--message",
"Look Ma, no hands!",
],
check=True,
cwd=str(git_repo.clone_work_tree),
env={"GNUPG_PASSPHRASE": git_repo.gnupg_keypair.passphrase},
)
Variable | Default Value | Description |
---|---|---|
PGITF_DEBUG | Adds additional debug logging. |
FAQs
Pytest fixtures for testing with git.
We found that pytest-git-fixtures demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers
Security News
pnpm's new minimumReleaseAge setting delays package updates to prevent supply chain attacks, with other tools like Taze and NCU following suit.
Security News
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.