Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Package Registry

github.com

Post reply on HN
Print view View original

31–40 of 389 posts

Re: GitHub Package Registry

#31

Post by ccleve »

This is really outstanding.

It will mean the death of Maven Central, about which I have mixed feelings. On the one hand, Sonatype deserves enormous thanks for what they have done for the open source world, as does mvnrepository.org. Their central repository has been free and maintained for a long time. Thank you, Sonatype.

On the other hand, it took me three days to release a new version of one of my artifacts the other day. The process for doing a Maven deploy is very complex. It took hours to get my private key to work because the key registries were slow. Then the staging server was slow, and kept timing out. Support was responsive, and said they were dealing with a DDOS attack. On top of that, it takes a while for artifacts to show up in the registry even after they have been uploaded. I'm glad that getting that artifact out wasn't an emergency.

This new Github service separates the registry from the artifact storage, which is the right way to do it. The registry should be quick to update because it's only a pointer. The artifact storage will be under my control. Credentials and security should be easier to deal with. I really hope this works out.

Re: GitHub Package Registry

#33

Post by jackfoxy »

gigatexal wrote: post #14

This is pretty interesting. Github really is becoming the social network that MS never seemed to be able to create. We already use it as our portfolio of work for potential employers. We collaborate with fellow enthusiasts and maybe even make new friends. We host our websites from it. Abuse it to store binaries, too. And now, along side, source code we can use it as a CDN of sorts to serve packages, for free, sounds…

Pure speculation, it would not surprise me to wake up someday and see MS has bought Stackoverflow. Given their direction of integrating the entire developer experience, it would make sense. MS is upgrading technical docs across the board, organizing and linking to SO content would make sense.

Re: GitHub Package Registry

#34

Post by mceachen »

Doesn't this bifurcate the namespace of literally every packaging system they are supporting, or are they requiring `@author/`-namespaced package names?

In the livestream he pokes around a github repo, sees it's one author, and decides that what makes it trustworthy? No GPG signing?

The new Actions support (about 50 minutes into the live stream) for auto-publishing from master is pretty sweet. From the very cursory demo, it seems very much like Gitlab's CI pipelines.

Re: GitHub Package Registry

#35

Post by socrates667 »

mceachen wrote: post #23
selrond wrote: post #13

This could solve the trust issues with npm - you never know, whether the package you're installing is really from the source provided on its npm page

Unless they require code signing, how does this help trust issues?

They can create a special kind of Authentic GitHub signing that guarantees that the source you see is responsible for the binary being downloaded.

Re: GitHub Package Registry

#36

Post by kevingadd »

mceachen wrote: post #23
selrond wrote: post #13

This could solve the trust issues with npm - you never know, whether the package you're installing is really from the source provided on its npm page

Unless they require code signing, how does this help trust issues?

Code signing is a different sort of trust issue, in this case if the package file is coming from the same github repo page as the source code, you know it (AFAIK) had to come from someone with write access to the repository.

vs having an npm package named (for example) nodejs, are you sure the npm package is authored by and owned by the same person or people that own the nodejs git repository? How do you verify that?

There are many problems this doesn't solve of course but it does seem like it helps with the one I describe above, the connection between the source and the package.

Unsolved problems of course would include things like 'did someone get unauthorized access to the git repo and put an artifact there' and 'did someone with unauthorized access push code to the repo and then have an artifact built'. Those are tough and real problems but I don't know if that's any different between this and say, npm. Code signing Helps with that but you have the same unauthorized access problem if some bad actor gets their signing key instead of repo access.

Re: GitHub Package Registry

#37

Post by mceachen »

prh8 wrote: post #26
kissgyorgy wrote: post #21

GitHub is coming after GitLab :D They first started with Boards, then Github Actions and now with this.

What does Gitlab have that this is competing with? I know Gitlab's docker registry but not of a package registry.

Gitlab's CI pipelines look an awful lot like github's new Actions tab.

Re: GitHub Package Registry

#38

Post by bluGill »

ben_jones wrote: post #28
gigatexal wrote: post #14

This is pretty interesting. Github really is becoming the social network that MS never seemed to be able to create. We already use it as our portfolio of work for potential employers. We collaborate with fellow enthusiasts and maybe even make new friends. We host our websites from it. Abuse it to store binaries, too. And now, along side, source code we can use it as a CDN of sorts to serve packages, for free, sounds…

Or you know, it could just focus on its core competencies and be good (great?) at what it does. They don't need to eat the world to provide a positive impact to it...

MS's core competency has always been developers. IBM called Microsoft for BASIC back in the day because without MS BASIC their computer was DOA to a lot of potential customers.
Post reply on HN