Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
pytrilogy is an experimental implementation of the Trilogy language, a higher-level SQL that replaces tables/joins with a lightweight semantic binding layer.
Trilogy looks like SQL, but simpler. It's a modern SQL refresh targeted at SQL lovers who want reusability and simplicity with the power and iteratability of SQL. It compiles to SQL - making it easy to debug or integrate into existing workflows - and can be run against any supported SQL backend.
[!TIP] To get an overview of the language and run interactive examples, head to the documentation.
Installation: pip install pytrilogy
pytrilogy
can be run locally to parse and execute trilogy model [.preql] files using the trilogy
CLI tool, or can be run in python by importing the trilogy
package.
You can read more about the project here and try out an interactive demo here.
Trilogy:
WHERE
name like '%lvis%'
SELECT
name,
count(name) as name_count
ORDER BY
name_count desc
LIMIT 10;
vs SQL, the goals are:
Preserve:
Enhance:
Maintain:
Save the following code in a file named hello.preql
key sentence_id int;
property sentence_id.word_one string; # comments after a definition
property sentence_id.word_two string; # are syntactic sugar for adding
property sentence_id.word_three string; # a description to it
# comments in other places are just comments
# define our datasources as queries in duckdb
datasource word_one(
sentence: sentence_id,
word:word_one
)
grain(sentence_id)
query '''
select 1 as sentence, 'Hello' as word
union all
select 2, 'Bonjour'
''';
datasource word_two(
sentence: sentence_id,
word:word_two
)
grain(sentence_id)
query '''
select 1 as sentence, 'World' as word
union all
select 2 as sentence, 'World'
''';
datasource word_three(
sentence: sentence_id,
word:word_three
)
grain(sentence_id)
query '''
select 1 as sentence, '!' as word
union all
select 2 as sentence, '!'
''';
# an actual select statement
# joins are automatically resolved between the 3 sources
with sentences as
select sentence_id, word_one || ' ' || word_two || word_three as text;
SELECT
--sentences.sentence_id,
sentences.text
WHERE
sentences.sentence_id = 1
;
SELECT
--sentences.sentence_id,
sentences.text
WHERE
sentences.sentence_id = 2
;
# semicolon termination for all statements
Run the following from the directory the file is in.
trilogy run hello.trilogy duckdb
The current Trilogy implementation supports these backends:
Trilogy can be run directly in python through the core SDK. Trilogy code can be defined and parsed inline or parsed out of files.
A bigquery example, similar to bigquery the quickstart.
from trilogy import Dialects, Environment
environment = Environment()
environment.parse('''
key name string;
key gender string;
key state string;
key year int;
key yearly_name_count int; int;
datasource usa_names(
name:name,
number:yearly_name_count,
year:year,
gender:gender,
state:state
)
address `bigquery-public-data.usa_names.usa_1910_2013`;
'''
)
executor = Dialects.BIGQUERY.default_executor(environment=environment)
results = executor.execute_text(
'''SELECT
name,
sum(yearly_name_count) -> name_count
WHERE
name = 'Elvis'
ORDER BY
name_count desc
LIMIT 10;
'''
)
# multiple queries can result from one text batch
for row in results:
# get results for first query
answers = row.fetchall()
for x in answers:
print(x)
Trilogy can be run through a CLI tool, also named 'trilogy'.
After installing trilogy, you can run the trilogy CLI with two required positional arguments; the first the path to a file or a direct command, and second the dialect to run.
trilogy run <cmd or path to trilogy file> <dialect>
To pass arguments to a backend, append additional -- flags after specifying the dialect.
Example:
trilogy run "key x int; datasource test_source ( i:x) grain(in) address test; select x;" duckdb --path <path/to/database>
N/A, only supports default auth. In python you can pass in a custom client. support arbitrary cred paths.
[!TIP] The CLI can also be used for formatting. Trilogy has a default formatting style that should always be adhered to.
trilogy fmt <path to trilogy file>
Additional examples can be found in the public model repository.
This is a good place to look for modeling examples.
Clone repository and install requirements.txt and requirements-test.txt.
Please open an issue first to discuss what you would like to change, and then create a PR against that issue.
Trilogy combines two aspects; a semantic layer and a query language. Examples of both are linked below:
Python "semantic layers" are tools for defining data access to a warehouse in a more abstract way.
"Better SQL" has been a popular space. We believe Trilogy takes a different approach then the following, but all are worth checking out. Please open PRs/comment for anything missed!
import [path] as [alias];
Types: string | int | float | bool | date | datetime | time | numeric(scale, precision) | timestamp | interval | list<[type]> | map<[type], [type]> | struct<name:[type], name:[type]>
;
Key:
key [name] [type];
Property:
property [key>].[name] [type];
property x.y int;
or
property <[key](,[key])?>.<name> [type];
property <x,y>.z int;
Transformation:
auto [name] <- [expression];
auto x <- y + 1;
datasource <name>(
<column>:<concept>,
<column>:<concept>,
)
grain(<concept>, <concept>)
address <table>;
Primary acces
select
<concept>,
<concept>+1 -> <alias>
WHERE
<concept> = <value>
ORDER BY
<concept> asc|desc
;
Reusable virtual set of rows. Useful for windows, filtering.
with <alias> as
select
<concept>,
<concept>+1 -> <alias>
WHERE
<concept> = <value>
select <alias>.<concept>;
Store output of a query in a warehouse table
persist <alias> as <table_name> from
<select>;
Return generated SQL without executing.
show <select>;
FAQs
Declarative, typed query language that compiles to SQL.
We found that pytrilogy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.