oparrish

require 'aws/s3'
require 'digest/md5'
require 'mime/types'

## These are some constants to keep track of my S3 credentials and 
## bucket name. Nothing fancy here.    

AWS_ACCESS_KEY_ID = ENV['S3_KEY']
AWS_SECRET_ACCESS_KEY = ENV['S3_SECRET']
AWS_BUCKET = ENV['S3_BUCKET']

fantactuka

require "sass"
require "compass"

def compile_sass(sass_file)
  sass_dir = File.dirname(sass_file)
  compass_dir = File.join(Compass.base_directory, "frameworks/compass/stylesheets")
  Sass.compile(File.read(sass_file), syntax: :sass, load_paths: [sass_dir, compass_dir])
end

pcreux

# specs and cukes results are stored in JUnit format under test-reports
if (grep 'failures="[^0]"' test-reports/* || grep 'errors="[^0]"' test-reports/*); then
  curl -H "Authorization: token MY_TOKEN" --request POST --data '{"state": "failure", "description": "Failed!", "target_url": "${bamboo.buildResultsUrl}"}' https://api.github.com/repos/USER/REPO/statuses/${bamboo.repository.revision.number} > /dev/null
else
  curl -H "Authorization: token MY_TOKEN" --request POST --data '{"state": "success", "description": "Success!", "target_url": "${bamboo.buildResultsUrl}"}' https://api.github.com/repos/USER/REPO/statuses/${bamboo.repository.revision.number} > /dev/null
fi

henrik

1. Your class can be no longer than 100 lines of code.
2. Your methods can be no longer than five lines of code.
3. You can pass no more than four parameters and you can’t just make it one big hash.
4. When a call comes into your Rails controller, you can only instantiate one object to do whatever it is that needs to be done. And your view can only know about one instance variable.

You can break these rules if you can talk your pair into agreeing with you.

gshutler

#! /usr/bin/env bash

set -e

eval "$(rbenv init -)"

for version in `rbenv whence gem`; do
  rbenv shell "$version"
  echo "Updating rubygems for $version"
  gem update --system --no-document --quiet

nz

HMAC over Basic Auth

This is a pattern I use fairly frequently for administrative APIs. It's a sort of OAuth lite for non-public APIs that produces good quality tokens. Once you build it a few times, it's not any harder than using arbitrary basic auth in your APIs.

The client and the app share a secret, which is never transmitted across the wire. The client uses this secret to create an HMAC digest of a payload consisting of the current time and a random nonce value. The nonce is provided as the Basic Authorization user, and the resulting HMAC digest is provided as the Basic Authorization password.

A similar process is followed on the server side. The server uses the supplied nonce, its own time, and its own copy of the shared secret. It may want to check against several tokens across a small window of times to account for clock drift.

• Using HMAC means the secret is never transmitted across the wire. Theoretically these are safe across plaintext connections, but you're using TLS anyway, right?
• The i