81–90 of 137 posts
I think this beta sign-up has been up for a bit already. It still just adds you to a wait list as far as I can tell, unless I missed something.
And then removed 16 months later: https://github.blog/2009-10-08-gem-building-is-defunct/
Hopefully this one lasts longer.
Deja vu https://github.blog/2008-04-25-github-s-rubygem-server/ And then removed 16 months later: https://github.blog/2009-10-08-gem-building-is-defunct/ Hopefully this one lasts longer.
Any word on what the price will be for private repos after the beta ends? Would be interesting to see how it compares to Docker Hub for hosting private images.
I think if it's at all comparable, GitHub will win out. It just seems convenient to not have one more subscription with another provider. Plus, hopefully, it will all be integrated well workflow-wise with a repository with actions that publish to the registry.
Earlier quoted context omitted.
I think if it's at all comparable, GitHub will win out. It just seems convenient to not have one more subscription with another provider. Plus, hopefully, it will all be integrated well workflow-wise with a repository with actions that publish to the registry.
if docker loses, then who will maintain docker?
Even if GitHub "wins" there will still be a lot on Docker Hub.
Also, it's already possible to use other registries like Amazon's ECR or Google Cloud's GCR, or even your own private one.
Earlier quoted context omitted.
git urls are tricky to use with many tools (like pip-compile) though. At best they're slow, since things like "what's the latest version?" require downloading the repo. We forked some things into a private DevPI instance at present for that reason (well, also for latency)
Pipenv locks the VCS dependency to the commit, making pulling very fast.
> is a software package hosting service, similar to npmjs.org, rubygems.org, or hub.docker.com, that allows you to host your packages and code in one place. You can host software packages privately or publicly and use them as dependencies in your projects. I am... really confused by this. Isn't this just Github? Github is a hosting service that allows you to host your packages and code in one place. It has testing an…
They are implementing the APIs that the package managers expect to fetch artifacts, rather than the package managers having to know how to fetch files via Git.
The problems like with rubygems from yesterday and npm a few weeks back would be gone with something like that.
Deleting packages is not supported. Sobhow to handle a compromised package? Looks like you have to contact github and hope the act fast. Oh, and no pip registry :(
The alternate is that critical infrastructure can just... disappear. Like "leftpad", but worse. GitHub is already really great about alerting you with critical issues. Whenever there's a security bug, it pops up in our repo (and with Dependabot, it's become automatic).
I just looked up Dependabot and linked it with a repo that I already have robust testing and CI pipeline for. Preliminarily Dependabot is great!
It automatically updates by dependencies to the latest versions and submits individual PRs. Since I have TravisCI hooked up to this particular repo, I can see all the test results for each PR and can (confidently) merge the changes into master without manually firing up my personal dev machine(s) and manually performing what Dependabot just did.
Anyway, thanks for the tip!
Deja vu https://github.blog/2008-04-25-github-s-rubygem-server/ And then removed 16 months later: https://github.blog/2009-10-08-gem-building-is-defunct/ Hopefully this one lasts longer.