The GitHub registry public beta is live • Hacker News Board

Re: The GitHub registry public beta is live

#31

Post by brown9-2 » Tue, Aug 20, 2019, 10:26 PM UTC

danShumway wrote: post #9

> is a software package hosting service, similar to npmjs.org, rubygems.org, or hub.docker.com, that allows you to host your packages and code in one place. You can host software packages privately or publicly and use them as dependencies in your projects. I am... really confused by this. Isn't this just Github? Github is a hosting service that allows you to host your packages and code in one place. It has testing an…

They are implementing the APIs that the package managers expect to fetch artifacts, rather than the package managers having to know how to fetch files via Git.

Re: The GitHub registry public beta is live

#32

Post by brown9-2 » Tue, Aug 20, 2019, 10:27 PM UTC

thefounder wrote: post #10

I like Go more. The git/hg/svn/bz repository is the "package". No custom (and central) "registry"

It helps that Go’s “distributable package” is the source code itself rather than a binary artifact.

Re: The GitHub registry public beta is live

#33

Post by aaomidi » Tue, Aug 20, 2019, 10:28 PM UTC

mvanbaak wrote: post #30

Deleting packages is not supported. Sobhow to handle a compromised package? Looks like you have to contact github and hope the act fast. Oh, and no pip registry :(

Probably because deleting causes a lot of issues.

They should have a release and snapshot branches.

Re: The GitHub registry public beta is live

#34

Post by andyfleming » Tue, Aug 20, 2019, 10:29 PM UTC

nickjj wrote: post #24

Any word on what the price will be for private repos after the beta ends? Would be interesting to see how it compares to Docker Hub for hosting private images.

I think if it's at all comparable, GitHub will win out. It just seems convenient to not have one more subscription with another provider. Plus, hopefully, it will all be integrated well workflow-wise with a repository with actions that publish to the registry.

Re: The GitHub registry public beta is live

#35

Post by andyfleming » Tue, Aug 20, 2019, 10:29 PM UTC

I hope they add robots accounts like Quay.io (https://docs.quay.io/glossary/robot-accounts.html).

Re: The GitHub registry public beta is live

#36

Post by carapace » Tue, Aug 20, 2019, 10:36 PM UTC

FWIW, Software Heritage already has your github repos: https://www.softwareheritage.org/

https://hn.algolia.com/?query=Software%20Heritage&sort=byPop...

And GNU Guix at least will transparently fallback to them:

> Since Software Heritage archives source code for the long term, Guix can fall back to the Software Heritage archive whenever it fails to download source code from its original location. The way this fallback has been designed, package definitions don’t need to be modified: they still refer to the original source code URL, but the downloading machinery transparently comes to Software Heritage when needed.

https://www.softwareheritage.org/2019/04/18/software-heritag...

Re: The GitHub registry public beta is live

#37

Post by gkoberger » Tue, Aug 20, 2019, 10:37 PM UTC

mvanbaak wrote: post #30

Deleting packages is not supported. Sobhow to handle a compromised package? Looks like you have to contact github and hope the act fast. Oh, and no pip registry :(

The alternate is that critical infrastructure can just... disappear. Like "leftpad", but worse.

GitHub is already really great about alerting you with critical issues. Whenever there's a security bug, it pops up in our repo (and with Dependabot, it's become automatic).

Re: The GitHub registry public beta is live

#38

Post by justincormack » Tue, Aug 20, 2019, 10:39 PM UTC

andyfleming wrote: post #35

I hope they add robots accounts like Quay.io ( https://docs.quay.io/glossary/robot-accounts.html ).

It says that permissions are the same as the github repo, so you can create github accounts and grant access, or use tokens.

Re: The GitHub registry public beta is live

#39

Post by aianus » Tue, Aug 20, 2019, 10:40 PM UTC

bad_user wrote: post #28

matharmin wrote: post #18

Earlier quoted context omitted.

In my experience, using git as a dependency source for NPM (including yarn) or Ruby never worked well. It works for a simple case, but it's usually much slower, has issues around managing credentials for private repos, and doesn't have a nice way to publish built files.

Also, most importantly, Git repositories are not immutable and any package repo that's not immutable is a terrible, terrible idea

At least for Ruby, it was easy to pin a specific commit SHA in the Gemfile to guarantee immutability.

Re: The GitHub registry public beta is live

#40

Post by andyfleming » Tue, Aug 20, 2019, 10:41 PM UTC

justincormack wrote: post #38

andyfleming wrote: post #35

I hope they add robots accounts like Quay.io ( https://docs.quay.io/glossary/robot-accounts.html ).

It says that permissions are the same as the github repo, so you can create github accounts and grant access, or use tokens.

It's nice to be able to manage machine/robot accounts more directly though.

On top of that, for orgs, you'd be paying monthly for each user you add.