Skip to content
master
Switch branches/tags
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 
lib
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Hoplon

Hoplon is a package that helps you verify that the code in your project's dependencies contains exactly what's on their GitHub and no other malicious code.

Hoplon is a set of tools to create and share signed "audits" describing the security status of hexpm (or other) packages. It allows you to maintain a collection of "trusted keys" - people whose audits you can fetch and take into account when assessing packages you (want to) use.

See CodeBEAM STO presentation slides for details. Video of the talk coming soon.

travis badge Hex.pm docs

Usage

There is no current version of hoplon on hex.pm, you need to get it from github:

defp deps do
  [
    {:hoplon, github: "nietaki/hoplon"},
  ]
end

After you add it to your dependencies, you gain access to the relevant hoplon tasks. The currently relevant hoplon tasks are mix hoplon.fetch, mix hoplon.my_key, mix hoplon.status and mix hoplon.trusted_keys

All of those mix tasks come with documentation:

mix help hoplon.trusted_keys

About

decentralized package security audit network of trust

Resources

License

Packages

No packages published