
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
tf-requests
Advanced tools
A utility script for interacting with the Testing Farm (TF) API in GitLab CI environments.
A utility script for interacting with the Testing Farm (TF) API, tailored for GitLab CI environments.
Testing Farm API documentation: https://testing-farm.gitlab.io/api/
tf-requests is designed to facilitate interactions with the Testing Farm service directly from a GitLab
CI job. Using environment variables, possibly sourced from various CI environments, this script
constructs, validates, and sends payloads to the Testing Farm API. It then monitors the job's progress
and reports back the results, ensuring a seamless integration into your CI/CD pipelines.
It's a tmt plan that runs on TF and builds a new OS image using a compose generated by the same GitLab
pipeline.
It needs some secrets to talk to AWS.
All build jobs run on virtual instances (AWS) and using a standard TF compose (CentOS Stream9 or RHEL9-nigthly)
It's a tmt plan that runs on TF using a pre-existing OS image. It runs some tests inside the image.
They could be integration tests (smoke-tests, remote-update-test or environment-details) that run
in a OS image
created by the same GitLab pipeline.
Some test jobs run on virtual instances (AWS), but others on physical boards (like QDrive3 or RideSX4).
Those boards need a special TF compose format (a JSON-like string containing the URLs for the rootfs
and boot images).
For the others, the TF compose is the name of the AMI generated for the build job that builds the testing image.
It should be passed in a variable (IMAGE_KEY).
As in the previous test job, tt's a tmt plan that runs on TF using a pre-existing OS image. It runs some tests
inside the image.
Unlike the previous test case, the package tests use an image already built and published by another pipeline.
It could be the latest one (nightly) or a formal release (like ER3 or similar).
This works only downstream, as it's where we run the package testing.
You can find examples of how to use tf-requests in GitLab jobs at the the .gitlab-ci.yml file,
at the integration jobs. There are examples of different jobs with the expected environment variables:
glibc) on a nightly image.Just calculate and show the payload (no API call made)
Pass a list of the ENV variables names for the variables and the secrets, so they get use in the right payload section
Example:
For a GitLab CI job defined with the following variables:
ARCH=aarch64
TF_API_KEY=YOUR_API_KEY
AWS_SECRET=some_secret_key
CI_REPO_URL=http://your-repo.git
...
You can run the script with:
tf-request --secrets AWS_SECRET --variables ARCH,CI_REPO_URL
Support meta variables (META_VARIABLES, META_CONTEXT, META_SECRETS).
These variables are supported for backawrd compatibility.
Support variables with a path for the pyload structure. Use a separator that can be a shell variable
name, like __.
These new type of variables allow send new variables without the need of hardcoding them in the request
or the use of the META variables. Please, use this for new variables instead of the META if possible.
For example, for this element:
{
"top_dir": {
"second_level": {
"key": "value"
}
}
}
The ENV variable would be:
top_dir__second_level__key="value"
Set up your GitLab CI job with the necessary environment variables. This can include pipeline variables, job-specific variables, and any other required data.
Run the tf_request in your job script:
tf-requests --secrets SECRET_1,SECRET_2 --variables VAR_1,VAR_2
The script will construct the payload, send it to the Testing Farm API, and monitor the job status. Once the job completes, results will be reported directly in the GitLab CI logs.
For a GitLab CI job defined with the following variables:
ARCH=aarch64
TF_API_KEY=YOUR_API_KEY
AWS_SECRET=some_secret_key
CI_REPO_URL=http://your-repo.git
...
You can run the script with:
tf-requests --secrets AWS_SECRET --variables ARCH,CI_REPO_URL
Setting up your development environment:
git clone <repository-url>
cd tf_requests
pdm install --dev
Running tests (pytest):
pdm run test
Running linting (flake8):
pdm run lint
Check types (mypy):
pdm run check-types
Check formatting (black and isort):
pdm run check-formatting
FAQs
A utility script for interacting with the Testing Farm (TF) API in GitLab CI environments.
We found that tf-requests demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.