Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The Pact Broker is an application for sharing of consumer driven contracts and verification results. It is optimised for use with "pacts" (contracts created by the Pact framework), but can be used for any type of contract that can be serialized to JSON.
You can try out a Pact Broker for free at pactflow.io. Built by a group of core Pact maintainers, PactFlow is a fork of the OSS Pact Broker with extra goodies like an improved UI, field level verification results and federated login.
Why do I need a Pact Broker?
Contract testing is an alternative approach to traditional integration testing that gives you tests that are quicker to execute, and that are more maintainable at scale. One down side of the approach is that the important information that would be available all in one place at the end of an integration test suite execution (that is, the version numbers of all the applications that were tested together, and whether the tests passed or failed) is now spread out across many different builds. The Pact Broker is a tool that brings all this information back together again, and allows you to deploy with safety.
It:
Features:
PUT
to a resource that specifies the consumer name and application version, and the provider name. eg http://my-pact-broker/pacts/provider/Animal%20Service/consumer/Zoo%20App/version/1.0.0
(Note that you are specifying the consumer application version in the URL, not the pact version. The broker will take care of versioning the pact behind the scenes when its content changes. It is expected that the consumer application version will increment with every CI build.)http://my-pact-broker/pacts/provider/Animal%20Service/consumer/Zoo%20App/latest
.If you don't have a Pact Broker CI Nerf Gun, you'll probably want to read about using pact when the consumer and provider are being written by different teams.
pact-broker can-i-deploy --pacticipant CONSUMER_NAME --version CONSUMER_VERSION ...
(see documentation here)Read more about how to use the Pact Broker in the overview on the wiki page.
See the wiki for documentation on the Pact Broker. Please read the overview page first to get an understanding of the HTTP resources in the broker, and how they relate to each other.
pact-broker
, and ask a new question if not.Paste the pact URL into a browser to view a HTML version of the pact.
Use the embedded HAL browser to navigate the API.
Use the HAL browser to view documentation as you browse.
Download a copy of the example Docker Compose file from the Pact Broker Docker repository and run:
docker compose up
Then open a browser at http://localhost:9292.
git clone git@github.com:pact-foundation/pact_broker.git && cd pact_broker/example
bundle install
bundle exec rackup -p 9292 -o 0.0.0.0
(this will use a Sqlite database. If you want to try it out with a Postgres database, see the README in the example directory.)In a hurry? Hate having to run your own infrastructure? Check out pactflow.io - it's fast, it's secure and it's free to trial!
You can use the Pact Broker Docker image or Terraform on AWS. See the wiki for instructions on using a reverse proxy with SSL.
pactfoundation/pact-broker
Docker image does not support it. New features will not be optimised for MySQL, and some new features may not even be supported on it (eg. the database clean feature).{ adapter: "postgres", database: "pact_broker", username: 'pact_broker', password: 'pact_broker', :encoding => 'utf8' }
encoding: 'utf8'
in your Sequel options to avoid encoding issues.RACK_ENV
is set to production
.Please read the UPGRADING.md documentation before upgrading your Pact Broker, for information on the supported upgrade paths.
The Pact Broker follows the semantic versioning scheme.
FAQs
Unknown package
We found that pact_broker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.