
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
This tool takes a minimal Puppetfile.src
as input and recursively resolves all
the dependencies into a final Puppetfile
that r10k or other tools can use to
deploy your control repository.
This means that instead of listing every single Puppet module to be installed, you can instead just list the modules that you actually care about and will use directly. This has a few major benefits:
Note: if this pull request is merged and released, then it will obsolete this tool by incorporating the functionality into r10k itself.
This is distributed as a Ruby gem. Simply install it with
gem install r10k-resolve
Puppetfile.src
that describes only the modules you intend to use.r10k-resolve
from the same directory to generate the Puppetfile
with
all dependencies resolved.
--source
and --output
arguments if you'd rather.--puppet-version
.Puppetfile
for quality and security purposes. This is
optional, but highly recommended.Puppetfile
and deploy your control repository, as fitting your
standard workflow.Puppetfile.src
mod 'dellemc-powerstore', '0.8.1'
mod 'puppetlabs-mysql', '13.1.0'
mod 'puppet-php', '8.1.1'
Puppetfile
mod 'dellemc-powerstore', '0.8.1'
mod 'puppetlabs-mysql', '13.1.0'
mod 'puppet-php', '8.1.1'
####### resolved dependencies #######
mod 'puppet-format', '1.0.0'
mod 'puppetlabs-stdlib', '8.5.0'
mod 'puppetlabs-apt', '8.5.0'
mod 'puppetlabs-inifile', '5.4.0'
mod 'puppet-zypprepo', '4.0.1'
mod 'puppet-archive', '6.1.0'
mod 'puppetlabs-concat', '7.3.0'
# Generated with r10k-resolve version 0.0.1
Note that all dependencies will be satisfied from the Forge, no matter what
the original source was. If you need a module version checked out from source
control, you'll either need to add that to the source Puppetfile.src
or update
the generated Puppetfile
to reflect this.
This is not yet rigorously tested. Please validate the generated output and make sure it looks reasonable.
FAQs
Unknown package
We found that r10k-resolve demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.