No C#/Nuget support? Really?
AWS CodeArtifact: A fully managed software artifact repository service
31–40 of 92 posts
Re: AWS CodeArtifact: A fully managed software artifact repository service
#32It’s frustrating to not see more system package management (deb, rpm) from these new services (github and gitlab for instance). Are others not packaging their code in intermediate packages before packing them into containers?
Most people don't need to do that. You can build things you need as part of the image build. No need to setup a deb or rpm package unless you're also installing it that way somewhere else.
Re: AWS CodeArtifact: A fully managed software artifact repository service
#33No C#/Nuget support? Really?
That is strange, I wonder if that's coming later but I didn't see anything to that effect. I'd also have liked to see docker image support (despite ecr) and raw binaries too.
Re: AWS CodeArtifact: A fully managed software artifact repository service
#34Earlier quoted context omitted.
I could not disagree more re. the expiring credentials. It is a bad practice to have credentials that never expire, especially on developer laptops, especially credentials of this nature. Developers frequently store this stuff in plain text in their home directory or as environment variables. That's a huge security risk! This service manages the process of generating and expiring credentials automatically, which is a…
This service is for code artifacts. What credential to the developers use to access source code? Do they expire? It is common for developers to use Git to store source code, in a hosted service like GitHub. It is common to use SSH keys to access Git. Frequently those SSH keys are generated without passphrases. Those are non-expiring credentials stored on disk. If HTTPS is used to access Git, it will likely be with no…
Your source code may reference a shared library at a specific version from a trusted source to build. This trusted source is CodeArtifact.
The short lived passwords is a non issue and a good thing. Your dependency resolver should handle fetching the new password and most orgs I’ve worked at had scripts dealing with short lived passwords/iam.
Re: AWS CodeArtifact: A fully managed software artifact repository service
#35Earlier quoted context omitted.
This service is for code artifacts. What credential to the developers use to access source code? Do they expire? It is common for developers to use Git to store source code, in a hosted service like GitHub. It is common to use SSH keys to access Git. Frequently those SSH keys are generated without passphrases. Those are non-expiring credentials stored on disk. If HTTPS is used to access Git, it will likely be with no…
Your source code may reference a shared library at a specific version from a trusted source to build. This trusted source is CodeArtifact. The short lived passwords is a non issue and a good thing. Your dependency resolver should handle fetching the new password and most orgs I’ve worked at had scripts dealing with short lived passwords/iam.
> Your dependency resolver should handle fetching the new password
According to AWS's documentation, none of the supported dependency resolvers will fetch the new password[1][2][3].
If they were capable of automatically fetching the new password without human intervention, it would mean they have credentials for generating credentials. If this isn't on an EC2 instance (where an IAM role can be used), that means there are long-lived credentials (probably written to disk) used to generate short-lived credentials.
This would be the case if you are using a hosted CI service that doesn't run on your own EC2 instances. You would probably be providing an AWS key and secret, which would then be used to generate the short-lived credentials. But the key and secret won't be short-lived, and will have at least the same access as the short-lived credentials (probably more access).
> Your source code may reference a shared library at a specific version from a trusted source to build. This trusted source is CodeArtifact.
HTTPS is what forms the trust between you and the artifact repository. Short-lived passwords don't do anything to ensure you are talking to the real trusted source. They may make it so the artifact repository can better trust you are who you say you are, but I don't see what they has to do with safely getting a specific version of a library.
[1] https://docs.aws.amazon.com/codeartifact/latest/ug/python-co...
[2] https://docs.aws.amazon.com/codeartifact/latest/ug/npm-auth....
[3] https://docs.aws.amazon.com/codeartifact/latest/ug/env-var.h...
Re: AWS CodeArtifact: A fully managed software artifact repository service
#36It’s frustrating to not see more system package management (deb, rpm) from these new services (github and gitlab for instance). Are others not packaging their code in intermediate packages before packing them into containers?
We've been going that direction. Packages integrate better into multiple use cases (e.g. VM images, containers). Running a properly signed apt repo is easy these days, so why not?
For people that disagree with this model: where do you think the the software comes from when you apt/apk install things inside your Dockerfile?
Re: AWS CodeArtifact: A fully managed software artifact repository service
#37This has been a fairly obvious service that has been missing for a while, nice to see them provide a solution. Most dependency management tools have some kind of hacky support for using S3 directly. Full fledged artifact management tools like Artifactory and Nexus support S3 backed storage. Interesting to see that the pricing is approximately double that of S3, for what I imagine is not much more than a thin layer on…
To add to your list of Artifactory and Nexus, Pulp[1] is also a cool project in this space, and is fully open source.
Honestly the fact that they only support javascript, Python and Java is pretty bare bones compared to what the others on the above list support, and again as you say, for a fairly high price.
Re: AWS CodeArtifact: A fully managed software artifact repository service
#38This has been a fairly obvious service that has been missing for a while, nice to see them provide a solution. Most dependency management tools have some kind of hacky support for using S3 directly. Full fledged artifact management tools like Artifactory and Nexus support S3 backed storage. Interesting to see that the pricing is approximately double that of S3, for what I imagine is not much more than a thin layer on…
> Interesting to see that the pricing is approximately double that of S3, for what I imagine is not much more than a thin layer on top of it.
Haven’t looked carefully, but is there a difference in the guarantees it provides? Might be a performance or SLA difference.
Re: AWS CodeArtifact: A fully managed software artifact repository service
#39The login credentials expire after 12 hours (or less)[1], just like with their Docker registry (ECR). That makes it pretty annoying to use, especially on developer laptops. GCP has a similar offering[2]. And GitHub[3]. [1] https://docs.aws.amazon.com/codeartifact/latest/ug/python-co... [2] https://cloud.google.com/artifact-registry [3] https://github.com/features/packages
I could not disagree more re. the expiring credentials. It is a bad practice to have credentials that never expire, especially on developer laptops, especially credentials of this nature. Developers frequently store this stuff in plain text in their home directory or as environment variables. That's a huge security risk! This service manages the process of generating and expiring credentials automatically, which is a…
> Developers frequently store this stuff in plain text in their home directory or as environment variables
If you care about the security of these artifacts, why is their home directory (or their full disk) not encrypted? If they have access to the repository, they probably have artifacts downloaded on their laptops, so if the laptop is compromised, the artifacts are compromised anyway.
Edit:
Not saying temporary credentials are bad. But the reasons you gave seem a little suspect to me. A better reason is that you don't have to worry about invalidating the credentials when an employee stops working for you.
Re: AWS CodeArtifact: A fully managed software artifact repository service
#40I don't get it. The git server you use supports artifacts already. You could also just put all of your artifacts on an S3 bucket if you needed somewhere to put them, which is exactly what this is but more expensive. I don't understand when this would save you money or simplify devops.
It’s not “exactly what this is”. Every time AWS or Azure or GCP releases a service, there are a droves of people on HN decrying them as “just ”, without bothering to understand if that’s actually true. It’s not. Skim the docs and you will see it is not “just S3”.
yep. I've worked on a solution that "just uses s3". It is not trivial.