
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
releasecmd
Advanced tools
releasecmd is a release subcommand for setup.py (setuptools.setup). the subcommand creates a git tag and pushes and uploads packages to PyPI.
|PyPI pkg ver| |Supported Python versions| |CI status| |CodeQL|
.. |PyPI pkg ver| image:: https://badge.fury.io/py/releasecmd.svg :target: https://badge.fury.io/py/releasecmd :alt: PyPI package version
.. |Supported Python versions| image:: https://img.shields.io/pypi/pyversions/releasecmd.svg :target: https://pypi.org/project/releasecmd :alt: Supported Python versions
.. |CI status| image:: https://github.com/thombashi/releasecmd/actions/workflows/ci.yml/badge.svg :target: https://github.com/thombashi/releasecmd/actions/workflows/ci.yml :alt: CI status
.. |CodeQL| image:: https://github.com/thombashi/releasecmd/actions/workflows/github-code-scanning/codeql/badge.svg :target: https://github.com/thombashi/releasecmd/actions/workflows/github-code-scanning/codeql :alt: CodeQL
releasecmd
is a release
subcommand for setup.py
(setuptools.setup
).
The subcommand creates a git tag and pushes and uploads packages to PyPI
.
The subcommand class (releasecmd.ReleaseCommand
) is implemented as a subclass of setuptools.Command
class.
The release
subcommand performs the following tasks:
--version
option, use that version--use-installed-version
option is specified__version__
variable)--sign
option is specifiedtwine
.::
pip install releasecmd
:setup.py: .. code-block:: python
import setuptools
from releasecmd import ReleaseCommand
setuptools.setup(
...
cmdclass={"release": ReleaseCommand},
)
.. code-block::
$ python3 setup.py release
running release
[get the version from ./releasecmd/__version__.py]
[pull git tags]
Already up to date.
[check existing git tags]
[create a git tag: v0.0.15]
[push git tags]
[upload the package to PyPI]
...
prerequisite: package binaries must be in the dist/
directory.
You can specify a version manually by --version
option:
.. code-block::
$ python3 setup.py release --version 0.1.0
[create a git tag: v0.1.0]
[pull git tags]
Already up to date.
[check existing git tags]
[push git tags]
[upload packages to PyPI]
.. code-block::
$ python3 setup.py release --sign
running release
[get the version from ./releasecmd/__version__.py]
[pull git tags]
Already up to date.
[check existing git tags]
[create a git tag with gpg signing: v0.1.0]
[push git tags]
[upload packages to PyPI]
...
.. code-block::
$ python3 setup.py release --skip-tagging
running release
[get the version from ./releasecmd/__version__.py]
skip git tagging
[upload packages to PyPI]
...
::
Options for 'ReleaseCommand' command:
--skip-tagging skip a git tag creation
--skip-uploading skip uploading packages to PyPI
--dry-run don't actually do anything
--sign make a GPG-signed git tag
--verbose show verbose output
--search-dir specify a root directory path to search a version
file. defaults to the current directory.
--tag-template specify git tag format. defaults to 'v{version}'
--use-installed-version use an installed package version as a release
version
--version specify release version
Git <https://git-scm.com/>
__FAQs
releasecmd is a release subcommand for setup.py (setuptools.setup). the subcommand creates a git tag and pushes and uploads packages to PyPI.
We found that releasecmd demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.