Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The asynchronous RPC client-server framework and message specification for Rigetti Quantum Cloud Services (QCS).
Implements an efficient transport protocol by using ZeroMQ (ZMQ) sockets and
MessagePack (msgpack
) serialization.
Not intended to be a full-featured replacement for other frameworks like gRPC or Apache Thrift.
To install directly from the source, run pip install -e .
from within the top-level
directory of the rpcq
repository. To additionally install the requirements for testing,
make sure to run pip install -r requirements.txt
.
To instead install the latest released verson of rpcq
from the Python package manager PyPi,
run pip install rpcq
.
NOTE: We strongly encourage users of rpcq
to install the software within a (Python)
virtual environment (read up on virtualenv
,
pyenv
, or conda
for more info).
Installation is easier with QuickLisp. After placing the source for RPCQ within your local
Lisp projects directory (cf. ql:*local-project-directories*
), run (ql:quickload :rpcq)
and QuickLisp will download the necessary Lisp dependencies.
In addition to the Lisp dependencies, RPCQ depends on ZeroMQ. Be sure to install both the library and its development headers (which are necessary for the Lisp foreign-function interface to get its bearings).
The following two code samples (first in Python, then in Lisp) demonstrate how to create a server, add a test handler, and spin it up.
from rpcq import Server
server = Server()
@server.rpc_handler
def test():
return 'test'
server.run('tcp://*:5555')
(defun test ()
"test")
(let ((dt (rpcq:make-dispatch-table)))
(rpcq:dispatch-table-add-handler dt 'test)
(rpcq:start-server :dispatch-table dt
:listen-addresses '("tcp://*:5555")))
In another window, we can (again first in Python, then in Lisp) create a client that points to the same socket, and call the test method.
from rpcq import Client
client = Client('tcp://localhost:5555')
client.call('test')
(rpcq:with-rpc-client (client "tcp://localhost:5555")
(rpcq:rpc-call client "test"))
In all cases (including interoperating a client/server pair written in different languages), this will return the string 'test'
.
The message spec as defined in src/messages.lisp
(which in turn produces rpcq/messages.py
)
is meant to be used with the Rigetti QCS platform. Therefore,
these messages are used in pyquil
, in order
to allow users to communicate with the Rigetti Quil compiler and quantum processing units (QPUs).
PyQuil provides utilities for users to interact with the QCS API and write programs in
Quil, the quantum instruction language developed at Rigetti.
Thus, most users will not interact with rpcq.messages
directly. However, for those interested
in building their own implementation of the QCS API utilities in pyQuil, becoming acquainted
with the client-server framework, the available messages in the message spec, and how they
are used in the pyquil.api
module would be a good place to start!
Currently only Python bindings are available for the message spec, but more language bindings
are in the works. To update the Python message bindings after editing src/messages.lisp
,
open rlwrap sbcl
and run:
(ql:quickload :rpcq)
(with-open-file (f "rpcq/messages.py" :direction :output :if-exists :supersede)
(rpcq:python-message-spec f))
NOTE: Requires pre-installed
sbcl
,
quicklisp
, and
(optionally) rlwrap
.
We can also use the rpcq docker container to update the message spec without to install the requirements.
./docker_update_python_spec.sh
The rpcq
repository is configured with GitLab CI to automatically run the unit tests.
The tests run within a container based off of the
rigetti/lisp
Docker image, which is pinned to a specific
tag. If you need a more recent version of the image, update the tag in the .gitlab-ci.yml
.
The Python unit tests can be executed locally by running pytest
from the top-level
directory of the repository (assuming you have installed the test requirements).
The Lisp unit tests can be run locally by doing the following from within rlwrap sbcl
:
(ql:quickload :rpcq)
(asdf:test-system :rpcq)
There may be some instances of STYLE-WARNING
, but if the test run successfully,
there should be something near the bottom of the output that looks like:
RPCQ-TESTS (Suite)
TEST-DEFMESSAGE [ OK ]
The CI pipeline for rpcq
produces a Docker image, available at
rigetti/rpcq
. To get the latest stable
version of rpcq
, run docker pull rigetti/rpcq
. The image is built from the
rigetti/lisp
Docker image, which is pinned to a specific
tag. If you need a more recent version of the image, update the tag in the Dockerfile
.
To learn more about the rigetti/lisp
Docker image, check out the
docker-lisp
repository.
VERSION.txt
and dependency versions (if applicable) and push the commit to master
.vX.Y.Z
that contains the same version number as in VERSION.txt
.pypi
and verify it appears here.Developed at Rigetti Computing by Nikolas Tezak, Steven Heidel, Eric Peterson, Colm Ryan, Peter Karalekas, Guen Prawiroatmodjo, Erik Davis, and Robert Smith.
FAQs
The RPC framework and message specification for Rigetti QCS.
We found that rpcq demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.