
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
This is a Gem created to manage the connection of a ruby/rails service
to Guide's GRPC Server (Sidecar). With it you can simplify the connection
process and send data to the sidecar both synchronously and asynchronously.
In order to connect to the grpc server, the app must use the https protocol.
In order to successfully connect to the server through https - instead of having it's connection
refused -, a .crt
security certificate file must be provided.
You can do that by either adding this line to your application's Gemfile:
gem 'grpc_toolbox'
And then executing:
bundle install
Or by installing directly with:
gem install grpc_toolbox
You only need to this step if you're using docker
or docker-compose
to run the application.
As said on the Pre-requisites
section, you'll need a .crt
file that can authenticate your connection
to the grpc server.
This step is to make it so the container can copy the .crt
file provided by the host.
If you're using docker-compose, all you'll need to do is to make sure the volumes
section of your
docker-compose.yaml
has this line:
volumes:
- "${HOST_CERTIFICATES}/:${CONTAINER_CERTIFICATES_FOLDER}/"
Where:
HOST_CERTIFICATES
is the path to the folder on the HOST machine where the .crt file is locatedCONTAINER_CERTIFICATES_FOLDER
is the path to folder on the CONTAINER where the host's files are going to be copied to.Example:
volumes:
- "/home/master/certificates/:/https/"
if you're using docker run
, you'll need to add the following option to your command:
-v {HOST_CERTIFICATES}:{CONTAINER_CERTIFICATES_FOLDER}
Where:
HOST_CERTIFICATES
is the path to the folder on the HOST machine where the .crt file is locatedCONTAINER_CERTIFICATES_FOLDER
is the path to folder on the CONTAINER where the host's files are going to be copied to.Example:
docker run --name your_service -v /home/master/certificates:/https/ your-image
Create a file named grpc_toolbox.rb
inside the config/initializers
, then add the following lines:
GRPCToolbox.configure do |config|
config.server = {GRPC_SERVER_HOST}
config.certificate_path = {CONTAINER_CERTIFICATES_FULLPATH}
end
Where
GRPC_SERVER_HOST
is the address the gem will use to communicate to the grpc_serverCONTAINER_CERTIFICATES_FULLPATH
is the full path to the .crt
file the gem will use, including the file name.
Example:
GRPCToolbox.configure do |config|
config.server = "sidecar:443"
config.certificate_path = "/https/example.crt"
end
Once configured, you'll just need to create an client object:
client = GRPCToolbox::Client.new
then, pass the params you want to send as hash to the function send_audit_request
:
params = {
origin_ip: '127.0.0.1',
username: 'rlnascimento',
origin_type: 'num-sei',
system: 'gem-toolbox',
module: 'gem',
operation_type: 'update'
}
client.async.send_audit_request(params)
You can either use client.async.send_audit_request
or client.send_audit_request
. The logic is
the same, the only difference is that the first one is asynchronous and the second one is not.
FAQs
Unknown package
We found that grpc_toolbox demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.