
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
I've joined the POSSE and publish as much as I can to justin.searls.co and syndicate it elsewhere. Just like I use feed2toot to cross-post my web site's posts to Mastodon, I wanted to cross-post to Threads as well, so I made this thing that reads from an Atom XML feed and generates Threads posts. It's meant to be run on a schedule (e.g. cron job) to regularly check the feed, and does its best to avoid double-posts by keeping track of post URLs that have already been processed in a local cache file.
If you've done this whole dance to post to Instagram, prepare to be delighted by how much simpler Meta made it for the Threads API:
threads_basic
threads_content_publish
THREADS_USER_ID
THREADS_ACCESS_TOKEN
env var)To get an idea of what this gem is doing under the hood, namely it will:
feed2thread
continuously or if the configuration file isn't writable)<entry>
collect the <title>
as the thread's text and URL of its <link rel="alternate">
as the unique ID of the post$ gem install feed2thread
Next, create a configuration file in YAML to tell feed2thread everything it needs to run. Make sure this file is writable, as the gem will refresh the facebook access token on each run:
feed_url: https://example.com/feed.xml
threads_user_id: 9000
access_token: EAADXD
If the above were saved as feed2thread.yml
, we could then run the app from
the command line:
$ feed2thread
In addition to overwriting the access_token
in your configuration
file, a feed2thread.cache.yml
will also be created (or updated) in the same
directory. This file is used internally by feed2thread to keep track of which
entry URLs in the atom feed have been processed and can be ignored on the next
run.
For available options, run feed2thread --help
:
$ feed2thread --help
Usage: feed2thread [options]
--config PATH Path of feed2thread YAML configuration (default: feed2thread.yml)
--cache-path PATH Path of feed2thread's cache file to track processed entries (default: feed2thread.cache.yml)
--limit POST_COUNT Max number of Instagram posts to create on this run (default: unlimited)
--skip-token-refresh Don't attempt to exchange the access token for a new long-lived access token
--populate-cache Populate the cache file with any posts found in the feed WITHOUT posting them to Instagram
We publish a Docker image using GitHub
actions
tagged as latest
for every new commit to the main
branch, as well as with a
release tag tracking every release of the gem on
rubygems.org. The images are hosted here on GitHub's
container
registry
You can also use Docker to run this on your own automation platform like Proxmox or Kubernetes.
$ docker run --rm -it \
-v ./your_config_dir:/srv/config
ghcr.io/searls/feed2thread
To configure the container, there are just four things to know:
/config
--config /config/feed2thread.yml
, but you can
customize this by configuring the command value as neededSLEEP_TIME
environment variable to the number of seconds you'd like
to wait between runsfeed2thread
as ad hoc as opposed to via the included daemon
(presumably to handle scheduling it yourself), simply change the entrypoint to
/srv/exe/feed2thread
I run this on my Synology DS 920+, using the DSM's Container Manager app.
There are just a few things to know to set this up:
At the time of this writing, the Action > Import > Add from URL
feature of the Container Manager's
"Image" tab does not support GitHub Container Registry URLs. However, if you connect via SSH:
$ sudo -s
# Enter your user password.
$ docker pull ghcr.io/searls/feed2thread:latest
Once downloaded, the image will appear in the app. From there, select
ghcr.io/searls/feed2thread
, hit Run, and complete the wizard, setting any custom
command line flags (once the container is created, this cannot be edited), as
well as choosing a location to mount the /config
volume and setting a
SLEEP_TIME
environment variable (these can be changed after the fact).
Look at your cache file (by default, feed2thread.cache.yml
) and you should see
all the Atom feed entry URLs that succeeded, failed, or were (by the --populate-cache
option) skipped. If you don't see the error in the log, try
removing the relevant URL from the cache and running feed2thread
again.
FAQs
Unknown package
We found that feed2thread demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.