
Research
/Security News
Shai Hulud Strikes Again (v2)
Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.
thumblemonks-grudge
Advanced tools
Grudge is a stand-alone system, which means you run it on your own, that watches the comments of some git repository and provides a web interface to allow people to rate the comments.
In my experience, code commit comments have been very funny; or at least very good reads. It's kind of an insight into some of the programmer's minds. At one point, I was scouring the commit comments and sending a daily email of the ones I thought were funny. The emails were well received, so I figured there must be something to this.
Thus, the goals are:
I also hope that something like this will make for better commit comments; since you know you are now being watched ... and judged.
Well, basically I typed 'rate' into Apple's thesaurus app and noticed the word 'judge'. I wanted to add a 'G' to the front of the app - since this is a git commit watcher - and so hit upon 'grudge'.
Alas, Grudge = Git Judge
Once your system is bootstrapped, grudge will monitor for updates. For each commit, grudge will store the SHA hash of the commit-id (for referential reasons) and the date it was committed (for ordering reasons). Commit messages and other commit data (like author) stay in the git repository and are always retrieved from there; even at a possible speed reduction (though grudge seems pretty quick).
Each vote is recorded for a commit as either a +1 or a -1. Votes are themselves entities, which means you could get the voting history for any commit.
Commits have a net score, which is simply the sum of all of the votes. Popular commits are those with the highest net score. Unpopular are those with the lowest net score.
DataMapper - sudo gem install data_mapper
DataObjects - sudo gem install data_objects ... if not already installed
DataObject bindings for Sqlite - sudo gem install do_sqlite3
JSON Pure - sudo gem install json_pure - annoyingly needed by data_mapper
$ sudo gem install thumblemonks-grudge
$ mkdir foo && cd foo
$ grudge init
Edit the file in your Grudge instance called config/grudge.yml. In it edit the git repository url that you want Grudge to watch. For now, do this for both development and production entries. You don't need to edit anything else, unless you just can't help yourself.
Example:
...
repository:
url: git://github.com/thumblemonks/grudge.git
...
When just playing around, you can run:
$ grudge start
This will first clone the remote repository you defined, bootstrap the commits in a local Sqlite database, then run the Sinatra web-app. As long as you don't remove clone.git, the cloning will only happen on the first run. Grudge will, however, grab new updates from the repo each time you start it.
Point your browser at http://localhost:9292/ and you are done.
Oh yeah ... advertise it!
It is suggested that you run grudge through Apache via Phusion Passenger. In order to do this, simply point a configured Phusion Virtual Host at the public directory wherever you ran grudge init.
As of this writing the way to tell Grudge to automatically look for updates is to setup a remote repository via a post-receive hook. This means your instance of Grudge will need to be routable by your git server.
If this is so, just setup a post-receive hook to hit the URL with a POST request:
http(s)://your-grudge-instance/repository/pull
You can update manually by either restarting the app or via the Grudge console like so:
$ grudge pull
You could also setup a bash alias like the following:
wget -q --post-data='\'''\'' --no-cookies --delete-after http://your-grudge-instance/repository/pull
Not that I did that ;)
Someone for sure. I guess my wife for giving me the Saturday to write this.
Copyright © 2008 Justin Knowlden, released under the MIT license
FAQs
Unknown package
We found that thumblemonks-grudge demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.

Product
Add real-time Socket webhook events to your workflows to automatically receive software supply chain alert changes in real time.

Security News
ENISA has become a CVE Program Root, giving the EU a central authority for coordinating vulnerability reporting, disclosure, and cross-border response.