
Security News
npm Adopts OIDC for Trusted Publishing in CI/CD Workflows
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.
Before you install, navigate to the directory you want to install into.
This Makefile
based workflow lets you choose between installing Remarkbox from PyPI packages or directly from the source code (editable mode). Both flows create a virtual environment in ./env
and store configuration and SQLite data in the persistent ./data
directory.
Install Remarkbox
For a PyPI Installation, run::
wget "https://git.unturf.com/engineering/remarkbox/remarkbox/-/raw/main/Makefile"
make install-from-pypi
For a Source Installation (editable mode), run::
git clone ssh://git@git.unturf.com:2222/engineering/remarkbox/remarkbox.git
make install-from-source
Activate the Virtual Environment
Before running any subsequent commands or scripts (including starting the server or running tests), activate the virtual environment with::
source env/bin/activate
Activating the virtual environment ensures that all Python commands (such as pip
or pshell
) use the packages and settings in ./env
rather than your system-wide Python installation. This is crucial for consistency throughout the rest of this document.
Start the Development Server
You'll want to configure the system in data/development.ini
.
Typically I control most stuff with environment vars, for example vars.sh
::
# optional but currently broken...
export REMARKBOX_APP_STRIPE_PUBLIC="pk_test_removed"
export REMARKBOX_APP_STRIPE_SECRET="sk_test_removed"
# optional & you will need to create you're own slack app/bot.
export REMARKBOX_APP_SLACK_PUBLIC="removed"
export REMARKBOX_APP_SLACK_SECRET="removed"
# optional, defaults to localhost & http://localhost:6543
export REMARKBOX_APP_ROOT_DOMAIN="example.com"
export REMARKBOX_APP_URL="https://example.com"
Once the virtual environment is active, run::
source vars.sh
make serve
Other commands—such as make test
, and make http
operate within this environment.
This is the codebase that powers both self‑hosted and SaaS Remarkbox!
https://www.remarkbox.com <https://www.remarkbox.com>
_https://faq.remarkbox.com <https://faq.remarkbox.com>
_https://meta.remarkbox.com <https://meta.remarkbox.com>
_https://westworld2.com <https://westworld2.com>
_Remarkbox is a standalone question and answer site (forum) or an embedded comments/product reviews service that works anywhere HTML is supported.
Note: These goals are not in priority order.
#. Support Multiple Use Cases:
#. Adopt Widely Used Tools:
#. To be popular
#. To be safe from spammers
#. To be easy to manage and clean up spam
#. To be passwordless – using one‑time-password codes via email for registration and authentication
#. To scale horizontally
#. To be multitenant
#. To minimize friction for new users
#. To be engaging for users
#. To be search engine optimized
#. To have great test coverage
#. To be easy to create and load custom themes (similar to WordPress)
This repository includes a Makefile that automates your local Remarkbox environment setup by creating:
./env
./data
(which holds your development.ini
and SQLite database)Note: The Makefile handles environment setup and database initialization, so you do not need to run these steps manually.
To set up a functional testing environment on your workstation, open two terminal shells:
In the first shell, start the Remarkbox server::
make serve
In the second shell, run a simple HTTP server (to serve an index.html
file)::
make http
Browse to http://127.0.0.1:8000 <http://127.0.0.1:8000>
_ to view the homepage, which embeds a local copy of Remarkbox. In development, one‑time-password codes are logged to the console if an SMTP server is not available.
For new environments, migrations are not needed—the Makefile creates and stamps the database schema as ready. For existing deployments, you can run:
Upgrade to the Latest Revision:
::
env/bin/alembic -c data/development.ini upgrade head
View Migration History and Current Revision:
::
env/bin/alembic -c data/development.ini history
env/bin/alembic -c data/development.ini current
Create a New Migration Script:
::
env/bin/alembic -c data/development.ini revision -m "Added email_id column to User table."
Autogenerate a Migration Script:
::
env/bin/alembic -c data/development.ini revision --autogenerate -m "autogenerated indices."
Review the generated script before applying it.
To list paying customers, execute:
.. code-block:: sql
SELECT * FROM rb_pay_what_you_can
INNER JOIN rb_user ON rb_user.id = rb_pay_what_you_can.user_id
WHERE amount > 0 AND rb_user.stripe_id IS NOT NULL;
To interact with Remarkbox’s models and database using an interactive Python shell, run:
.. code-block:: bash
env/bin/pshell data/development.ini
For example, the following script modifies every Node
that has a Uri
:
.. code-block:: python
# Begin the database transaction.
request.tm.begin()
# Retrieve all Uri objects.
uris = m.uri.get_all_uris(request.dbsession)
# Update each Node.
for uri in uris:
uri.node.has_uri = True
request.dbsession.add(uri.node)
# Flush and commit changes.
request.dbsession.flush()
request.tm.commit()
Optional Formatting Guidelines:
black <https://black.readthedocs.io/>
_ (manual execution).All contributed code is placed in the public domain.
source code: https://git.unturf.com/engineering/remarkbox/remarkbox <https://git.unturf.com/engineering/remarkbox/remarkbox>
_
Remarkbox is trademarked, do not misrepresent the brand.
Feel free to white label any code or themes into your own brand.
Original Developer:
Russell Ballestrini <https://russell.ballestrini.net>
_
FAQs
remarkbox
We found that remarkbox demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.
Research
/Security News
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
Security News
The CNA Scorecard ranks CVE issuers by data completeness, revealing major gaps in patch info and software identifiers across thousands of vulnerabilities.