pub
security-products
Our great sponsors
pub | security-products | |
---|---|---|
21 | 7 | |
1,028 | - | |
1.4% | - | |
9.2 | - | |
3 days ago | - | |
Dart | ||
BSD 3-clause "New" or "Revised" License | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
pub
-
Writing a Package Manager
Agreed. Version resolution is the interesting problem.
Most package managers use a SAT solver to resolve dependencies. The Dart team has a detailed write up on their SAT-based approach which is worth a read [1]. For contrast, Russ Cox presents an algorithm that doesn't use a SAT solver (intended for Go) [2].
[1] https://github.com/dart-lang/pub/blob/master/doc/solver.md
[2] https://research.swtch.com/vgo-mvs
- Modern SAT solvers: fast, neat and underused (2018)
-
Private pub.dev - is it possible?
Official documentation.
-
Self hosting package repository
As I understand Custom package repositories it's possible to host one's own package repository. The Repository Specification is public, but dart.dev only references cloud based paid services like Cloudsmith and OnePub.
- PubGrub: A next-generation version solving algorithm
-
I am building a pub server. When does the client send the name and version of the package and how can I access it?
As u/Which-Adeptness6908 already pointed out, the repository specification is small, and that's all you need to implement a server: https://github.com/dart-lang/pub/blob/master/doc/repository-spec-v2.md
- So you want to write a package manager
-
Tencent WeChat is now a GitHub secret scanning partner
https://docs.github.com/en/code-security/secret-scanning/sec...
A bit sad, they don't publish the list of regexes, etc.
--------------
I added a similar thing to the package manager for Dart / Flutter, because we saw users accidentally publishing secrets. That code is public, it relies on regexes and entropy estimation:
https://github.com/dart-lang/pub/blob/eb8ee21a089ebe0f2c2dd8...
It was heavily inspired by the researchers in:
-
Another choice of Flutter Version Manager: fvm in shell
Heres are some issues I've faced when trying with the dart-version cli: - The installation - dart pub global activate needs to have flutter/dart global installed already. - Global activated fvm cli got invalid after flutter upgrade, see issue - The cli does not work with customized fork of flutter. - You should run fvm flutter , not flutter , this changes CI/CD workflow
-
Dart on CLI: Foundations
This will add the args dependency in your pubspec file. We used the Darts package manager pub to add this dependency.
security-products
-
How to use GitLab SAST tool to detect simple DOM vulnerability?
Gitlab uses OSS analyzers for vulnerability detection. You will need to see what predefined rules are set up for the analyzers that were ran for the code in question. More than likely, these predefined rules will not detect everything. A POC will allow you to understand the limits of the provided rulesets, and you will need to customize your own rules for gaps that you find. You can find a list of analyzers here https://gitlab.com/gitlab-org/security-products/analyzers.
-
How Go Mitigates Supply Chain Attacks
>> The only commands that will change the go.mod (and therefore the build) are go get and go mod tidy. These commands are not expected to be run automatically or in CI, so changes to dependency trees must be made deliberately and have the opportunity to go through code review.
GO doesn't do jack shit to mitigate supply chain attacks. Version pinning with checksum and that is it. But what could they do? Solve supply chain attacks as a language feature? That doesn't even make sense.
Application developers using Go must prevent supply chain attacks against their applications. So go get some SAST for your pipeline.
Sure there is truth in saying: always verify your dependencies (and their dependencies) yourself with a code review on every update. But lets talk about collaborative vulnerability management instead. (yes there could be other attestations, but one thing at a time).
Let's say repositories that publishes go modules should also publish a curated list of known vulnerabilities (including known supply chain attacks) for the modules they publish. This curation is work: reports must be verified before being included in the list and they must be verified quickly. This work scales with the number of packages published. And worse, modules could be published in more than one repository, module publishing repository can be different from source code repositories, and lists of vulnerabilities can exist independent from these repository - so reports should be synced between different list providers. Different implementations and lack of common standards make this a hard problem. And implicit trust for bulk imports could open the door for takedown attacks.
There is an argument that vulnerability listing should be split from source and module publishing: each focusing on their core responsibility. For supply chain attacks especially this split in responsibilities also makes it harder for an attacker to both attack suppliers and suppress reports. But for all other issues it increase distance as reports must travel upstream. And it creates perverse incentives, like trying to keep reports exclusive to paying customers.
To pile on the insanity: reports can be wrong. And there are unfixed CVEs that are many years old (well ok maybe not for go... yet). Downstream there are "mitigated" and "wont-fix" classifications for reports about dependencies and many SAST tooling can't parse that for transitive dependencies.
Really, supply chain attacks are the easy case in vulnerability management, because they are so obviously a "must-fix" when detected. (and to please the never update crowd: for a downstream project "fix" can mean not updating a dependency into an attacked version)
Long story short: go get some SAST in your pipelines to defend against supply chain attacks. Like GitLabs Gemnasium ( https://gitlab.com/gitlab-org/security-products/gemnasium-db... ) or GitHubs Dependabot ( https://github.com/advisories?query=type%3Areviewed+ecosyste... ) among many, many others. (not recommendations, just examples!)
This helps you sort out supply chain attacks that other people have already found, before you update into them. (Collaboration!) is useful. Sure you are still left with reading the source changes of any dependency update, because who knows, you may be the first one to spot one, but hey, good for you.
-
The vulnerability research team @GitLab is introducing an open-source community-driven advisory database for third-party security dependencies
What's with the weird terms to/for the database?
-
GitLab Ultimate DAST Issues
GitLab documentation says nothing about Auth0 and I'm almost inclined to go in and edit Gitlab's code but that feels like it defeats the point of their plan which isn't cheap and I'd rather not have to maintain a workaround fix. Our GitLab contact hasn't been able to give a solid answer for this either.
- Package Hunter: A tool for identifying malicious dependencies via runtime monitoring.
-
Package Hunter: A tool for detecting malicious code in your dependencies
Interesting thought from https://twitter.com/d_scho/status/1419752750351540231
> Isn‘t dependabot doing the same, basically?
with a response in the thread at https://twitter.com/solidnerd/status/1420307219745230850
> Dependabot / renovate only checking for version updates of your programm deps. Package Hunter analyze a program's deps for unexpected behavior (mal code) by installing the dependencies in a sandbox env and monitors system calls executed during the installation.
Package Hunter requires Falco, Docker and NodeJS to run, following the instructions at https://gitlab.com/gitlab-org/security-products/package-hunt... - give it a try :)
- Javafuzz
What are some alternatives?
unpub - Self-hosted private Dart Pub server for Enterprise
pub-dev - The pub.dev website
shhgit - Ah shhgit! Find secrets in your code. Secrets detection for your GitHub, GitLab and Bitbucket repositories.
fvm - Flutter Version Manager - POSIX-compliant bash script to manage multiple active flutter versions
courier - Private dart package manager
fvm - Flutter Version Management: A simple CLI to manage Flutter SDK versions.
roo - A package and environment manager for R
Hello-World - My first repository on GitHub!
Decider - An Open Source .Net Constraint Programming Solver
Cargo - The Rust package manager
sturm - Simpleminded terminal interface