Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Automated upgrades were introduced in DataPlatform Runtime Framework version > 24.5.1 in an effort to promote better usability, replace manual processes, stop/mitigate “breaking” changes in Framework releases and to streamline the update experience overall.
Anyone working with the DataPlatform knows that it is updated regularly. It’s a fact of modern life, everyday brings slack notifications that DataPlatform Framework Version 26.y.z is ready, Ontology 3.y.z wants to be installed and you need version 2.y.z of FHIRWalker RIGHT NOW.
"In the world of software management there exists a dread place called "dependency hell." The bigger your system grows and the more packages you integrate into your software, the more likely you are to find yourself, one day, in this pit of despair."" – Tom Preston-Werner
In the unlikely event, that there are breaking changes, [we<--who is this?] stop the script. The team whose build is broken gets the opportunity fix it, and then the upgrade is kicked off from where it had previously stopped. If the build breaks there is not an option to roll back. The procedure simply continues down the decision tree workflow. As things stand, it’s not clear if you can fall back to an older Framework installation by doing a new, from-scratch reinstall using your original repo.
[QUESTION: Lastly, I'm not sure how the automated upgrade gem will handle breaking changes - could use more detail (which may not have been worked out yet by plasma) about breaking changes and how these will be distributed to teams to change their code in accordance with these changes. This also goes for Team City configuration changes and settings/org-tenant changes that may need updating when a new framework is released.]
Automated Upgrades brings all your upgrades together in one place. It's real-time upgrading based on the project or service dependency tree for DataPlatform teams. We're on a mission to make your working life simpler and more productive. Automated Upgrades is a ruby gem that can be included within a ruby script. This gem enables developers to test a full end-to-end dependency tree upgrade locally as well as a partial-tree upgrade test. This same "gem in a script" can be used to run the upgrade cycle in TeamCity.
Automated Upgrades encapsulates two processes:
The manual NuGet update uses the manifest file to do this thing
The TeamCity build uses this same manifest file and is triggered by a successful DataPlatform Runtime build completion via the master branch in GitHub. The develop branch is used for pre-release NuGet packages.
[The above paragraph has this revision: QUESTION: I believe that the process will begin when DataPlatform Framework is checked into master, rather than develop since plasma releases are in the master branch and develop is used for prerelease packages. The same goes for other teams who release nuget packages.]
The process is considered complete when existing and dependent services finish deployment and automated User Acceptance Tests (UATs) are kicked-off.
Automated upgrades allows manual intervention for cases such as breaking code and configuration changes, and also allows interrupt and restart at any point in the process, so you are able to modify as necessary.
[QUESTION: Also, I'm unsure about the flow with upgrading locally vs upgrading in Team City and the nuget packages. Does this mean that whenever a project upgrades with lower dependencies, whoever has checked it will upgrade and build the other services before pushing to the develop or master branch? That can probably be answered by someone in plasma, since they're working on the flow. ]
Automated Upgrades encapsulates a manual Nuget update and TeamCity deploy kickoff for DataPlatform’s Existing or Dependent services based on a manifest file. It ends when dependent services finish deployment and automated UATs are kicked off.
Automated upgrades allows manual intervention for cases such as breaking code and configuration changes, and also allows interrupt and restart at any point in the process, so you are able to modify as necessary
This repository holds all artifacts: design, code and supporting files that go into creating a solution for automated upgrades and deployment of services against a chosen DataPlatform Framework [Runtime?] version.
The automated upgrade project is dependent on DataPlatform teams first adding
.semvers
files to each project. This allows for the automation process to kickoff the following workflow.
Once the Runtime Build has successfully completed, the upgrade project is triggered in TeamCity and begins the following steps:
The gem extracts a version map (JSON file) of packages of DataPlatform Projects and nuget versions from the .semvers files.
Once the version map is extracted, it compares itself to a previous version map for changes. If there are changes, it walks the deployment project dependency tree to process the upgrade according to the dependency chain manifest.
It next seeks what is the next project in the dependency tree in a failed or unprocessed state? [how does it choose, via alphabetical, numberical or our logical progression, of first this team, then that team, etc.?] If a project has indeed failed, or is in an unprocessed state:
EXAMPLE:
Failed, wah-wah: frameworkweb.semver), filename should be Framework.Web.semver
If your project has valid Environment vaiables, it first checks:
If your project's semver
file matches special/nonspecial [<--what consitutes being special?]
Run nuget package version update for specific changed DataPlatform package. [QUESTION: step 6 "execute nuget", references the deployment of nuget packages, which requires the TC build to run and execute unit and integration tests, as well as BVTs. This would happen in the middle of each upgrade for each service on TeamCity and before Acceptance Tests would build. So I think this step would be encapsulated in previous step]
Does project a. build and b. publish nuget? or does the built project publish the Nuget successfully? or is this a project that publishes NuGets?
Gem checks? TeamCity checks? DevOps checks to see if the build is successful or has test faillures.
app.config
?The script first generates a version map, which lists all package version references from DataPlatform Runtime solution must be generated. This list can go into a shared repository that has other artifacts to be used for the upgrade cycle like dependency map, configuration manifest etc.
A single repository is version upgraded. At this time, nugets are not published, and no branches are pushed. Should run partial tree?
Q: How does the process handle new services that are added? A: New services can be added by updating the manifest. When started from a Teamcity project, a single repo will be upgraded. Either the service or a NuGet publishing project. Q: Does upgrade all only include EME services or will it impact Pop Manager and DDA Extract?
A: This will include any service currently being built on TeamCity and using the DataPlatform.
You can subscribe to any app's what?
Yes, upgrades can be scheduled in TeamCity.
Rake? (used for building data platform) This repository holds all artifacts - design, code and supporting files that go into creating solution for automated upgrade and deployment of services against chosen framework version
gem "cucumber", ">=0.8.5", "<0.9.0"
"translate_tabs_to_spaces": true,
"tab_size": 2
def test
s = "A String"
s # not return s
end
def comparer valA, valB
valA + 2 < valB # no need for return in front
end
puts $!
to display full exceptionp [variable]
to display object and it's internals. puts [variable]
only displays toString versionrake test
ruby.exe .\spec\upgrade_spec.rb -n test_fail_on_missing_env_vars
cd
into src\ folder and run rake test
ruby.exe .\spec\upgrade_spec.rb -n test_fail_on_missing_env_vars
More information to come.
FAQs
Unknown package
We found that a2zdeploy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.