
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Copy over your .env.example
in style.
Typically, in any marginally complex app using dotenv, you'll have some step in new developer onboarding where you need to copy over a .env.example
file to .env
.
Also, in most Rails apps, gems, and other setups, you typically have a bin/setup
script that will do its best to automate the app bootstrapping process for freshly cloned copies.
This is an attempt to harmonize these two concepts by creating a user-friendly automated flow for filling in .env
.
To install globally and run anywhere:
gem install dotenv-init
Or, to use in your project (i.e., in bin/setup
):
gem "dotenv-init", group: :development
# Optional: enable colors
gem "colorize"
Given a .env.example
like this:
# Facebook credentials can be found in the 1Password Vault.
# Create a test app specifically for your local copy of this
# app and then grab its app ID.
export FACEBOOK_APP_ID=
# This is the password used as a backdoor to the admin
# console in the event the client locks themselves out (again).
# Regenerate with `rake secret`, or just use the default in development:
export ADMIN_PASSWORD=hunter2
Running dotenv-init
will present you with a prompt interactively walking you through filling these values in, providing defaults when they're given:
Facebook credentials can be found in the 1Password Vault.
Create a test app specifically for your local copy of this
app and then grab its app ID.
FACEBOOK_APP_ID: 110318327925842
This is the password used as a backdoor to the admin
console in the event the client locks themselves out (again).
Regenerate with `rake secret`, or just use the default in development:
ADMIN_PASSWORD: (hunter2) hunter3
Providing all of the values will populate .env
with the exact same formatting as your .env.example
, including comments and whitespace.
Before making a commit, please run rake spec
and rubocop
to ensure it will pass CI.
Please write good commit messages, be polite, and be open to discussing ways to improve on the code you've contributed.
For details on how the parser works, check out dotenv's parser as well as comment_aware_parser_spec.rb. This project's parser simply subclasses dotenv's parser to add more functionality.
Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/dotenv-assigner.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that dotenv-init demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.