Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
[Config] Templar provides the ability to manage development configurations for any file in a project, using ERB templates.
Once Templar is installed and configured, it will automatically keep your local copies of configurations up-to-date. It does this by running prior to initialization of the Rails (and Capistrano) environment.
The Example section below, will give you the best idea of the usage of Templar.
Most of this example is now handled by rake templar:file[filename]
, this task is currently only supported by Rails.
This will take you, step by step, through the process of configuring and using Templar to manage the database.yml file in a Rails application.
Before we begin, please follow the instructions in the Installation section below.
database.yml
filedevelopment:
adapter: mysql
database: name_development
user:
username: root
password:
production:
...
git mv
the database.yml
fileMove the file from it's normal location to the templar directory and add the erb
extension.
git mv config/database.yml config/templar/database.yml.erb
config/database.yml
to .gitignore
This means you will track the template, but not the output file.
echo "config/database.yml" > .gitignore
templar.yml
configedit the config/templar.yml
file and add an entry to the templates
section for database.yml
templates:
...
- { file: database.yml.erb, dest: config/database.yml }
database.yml
Copy and paste the configuration information from config/templar/database.yml.erb
to templar/data.yml
# database.yml
database:
adapter: mysql
database: name_development
username: root
password:
host: 127.0.0.1
database.yml.erb
fileChange the values in the config/templar/database.yml.erb
file to use the template variables.
The configuration values from the config/templar/data.yml
file are available in the @T template variable.
development:
adapter: <%= @T.database.adapter %>
database: <%= @T.database.database %>
user: <%= @T.database.user %>
username: <%= @T.database.username %>
password: <%= @T.database.password %>
production:
...
The database.yml
is now managed by Templar. I'm hoping that this entire process will be simplified with a rake task.
Add the gem into the Gemfile.
gem 'templar'
Then run bundle install
Add the following line to this file:
Templar.init()
templarize
commandSimilar to capify
or wheneverize
this command will add the basic configuration files for Templar to your
rails application directory.
From within the rails base directory, run the command templarize .
You must specify the .
as part of the command.
Once the command is complete, it will have created three new files config/templar/data.yml
, config/templar/data.sample.yml
and config/templar.yml
.
It will also have added some lines to the .gitignore
file.
There are two types of configuration files for Templar.
The templar.yml
file is the primary configuration for Templar. Most often, you will only need to change the
templates
section of this file.
# templates: the list of files and destinations to be handled by **Templar**
templates:
# example
#- {file: randomconfig.yml.erb, dest: config/randomconfig.yml}
# default options
# you generally will not need to change these options
# directory: the directory containing the templated configuration files (erb) and the data file
directory: config/templar
# always_update: force the template files to be regenerated everytime
# default: false. The files will only be regenerated when the erb template is newer than the destination file
always_update: false
# the file containing the data used in the templates
# default: data.yml (relative to the "directory" configuration value)
data_file: data.yml
This file is ignored by git automatically (as part of the installation process). This should contain the configuration for the local development environment.
An example data.yml
.
# database.yml
database:
adapter: mysql
database: name_development
username: root
password:
host: 127.0.0.1
This file contains any of the data that will be inserted into the template configuration files. Such that if you have a
database.yml.erb
file managed by Templar, you can populate the data from the database block in the data.yml
file.
This file should contain the default local development environment configuration data. This is used to create the
config/templar/data.yml
file for users when they first setup their local development environment for the app.
See Example for more info.
The Capistrano integration is used for one specific purpose. It is rare and few will need it.
You can use Templar in conjunction with Capistrano to manage templated configuration files which you will be pushing directly to the server using Capistrano's push method.
This allows you to have all the same functionality of templar, when running in something other than Ruby and Rails.
I use this to manage properties files for a J2EE application in SVN, and use Capistrano to push the properties files to the servers
Still needs a bit of help.
FAQs
Unknown package
We found that templar demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.